// File: /workspace/github_c_makefile_star2_O0/jsummers[P]deark/modules/pklite.c
// Function: analyze_descrambler
static void analyze_descrambler(deark *c, lctx *d)
{
	i64 pos;
	i64 pos_of_endpos_field = 0;
	i64 pos_of_jmp_field = 0;
	i64 pos_of_op = 0;
	i64 pos_of_scrambled_word_count = 0;
	i64 scrambled_endpos_raw;
	int saved_indent_level;

	de_dbg_indent_save(c, &saved_indent_level);

	switch(d->intro_class) {
		// Classes that might be scrambled:
	case INTRO_CLASS_112:
	case INTRO_CLASS_114:
	case INTRO_CLASS_150:
		break;
	default:
		goto done;
	}

	pos = d->position2;
	if(pos + 200 > EPBYTES_LEN) goto done;

	if(pkl_memmatch(&d->epbytes[pos],
		(const u8*)"\x2d\x20\x00\x8e\xd0\x2d??\x50\x52\xb9??\xbe??\x8b\xfe"
		"\xfd\x90\x49\x74?\xad\x92\x33\xc2\xab\xeb\xf6", 30, '?', 0))
	{
		d->descrambler_class = DESCRAMBLER_CLASS_114;
		pos_of_scrambled_word_count = pos+11;
		pos_of_endpos_field = pos+14;
		pos_of_jmp_field = pos+22;
		pos_of_op = pos+25;
	}
	else if(pkl_memmatch(&d->epbytes[pos],
		(const u8*)"\x8b\xfc\x81\xef??\x57\x57\x52\xb9??\xbe??\x8b\xfe"
		"\xfd\x49\x74?\xad\x92\x03\xc2\xab\xeb\xf6", 28, '?', 0))
	{
		d->descrambler_class = DESCRAMBLER_CLASS_120VAR1A;
		pos_of_scrambled_word_count = pos+10;
		pos_of_endpos_field = pos+13;
		pos_of_jmp_field = pos+20;
		pos_of_op = pos+23;
	}

	else if(pkl_memmatch(&d->epbytes[pos],
		(const u8*)"\x8b\xfc\x81\xef??\x57\x57\x52\xb9??\xbe??\x8b\xfe"
		"\xfd\x90\x49\x74?\xad\x92\x03\xc2\xab\xeb\xf6", 29, '?', 0))
	{
		d->descrambler_class = DESCRAMBLER_CLASS_120VAR1B;
		pos_of_scrambled_word_count = pos+10;
		pos_of_endpos_field = pos+13;
		pos_of_jmp_field = pos+21;
		pos_of_op = pos+24;
	}

	else if(pkl_memmatch(&d->epbytes[pos],
		(const u8*)"\x59\x2d\x20\x00\x8e\xd0\x51??\x00\x50\x80\x3e"
		"\x41\x01\xc3\x75\xe6\x52\xb8??\xbe??\x56\x56\x52\x50\x90"
		"???????\x74", 38, '?', 0))
	{
		d->descrambler_class = DESCRAMBLER_CLASS_150;
		pos_of_scrambled_word_count = pos+20;
		pos_of_endpos_field = pos+23;
		pos_of_jmp_field = pos+38;
		pos_of_op = pos+45;
	}
	else if(pkl_memmatch(&d->epbytes[pos],
		(const u8*)"\x2d\x20\x00????????????\xb9??\xbe????????\x74???\x03",
		32, '?', 0))
	{
		d->descrambler_class = DESCRAMBLER_CLASS_120VAR2;
		pos_of_scrambled_word_count = pos+16;
		pos_of_endpos_field = pos+19;
		pos_of_jmp_field = pos+28;
		pos_of_op = pos+31;
	}
	else if(pkl_memmatch(&d->epbytes[pos],
		(const u8*)"\x2d\x20\x00????????????\xb9??\xbe?????????\x74???\x03",
		33, '?', 0))
	{
		d->descrambler_class = DESCRAMBLER_CLASS_PKZIP204CLIKE;
		pos_of_scrambled_word_count = pos+16;
		pos_of_endpos_field = pos+19;
		pos_of_jmp_field = pos+29;
		pos_of_op = pos+32;
	}

	else if(pkl_memmatch(&d->epbytes[pos],
		(const u8*)"\x2d\x20\x00?????????????????\xb9??\xbe??????????\x74???\x03",
		39, '?', 0))
	{
		d->descrambler_class = DESCRAMBLER_CLASS_PKLITE201LIKE;
		pos_of_scrambled_word_count = pos+21;
		pos_of_endpos_field = pos+24;
		pos_of_jmp_field = pos+35;
		pos_of_op = pos+38;
	}

	else if(pkl_memmatch(&d->epbytes[pos],
		(const u8*)"\x8b\xfc\x81?????????????\xbb??\xbe??????\x74???\x03",
		31, '?', 0))
	{
		d->descrambler_class = DESCRAMBLER_CLASS_CHK4LITE201LIKE;
		pos_of_scrambled_word_count = pos+17;
		pos_of_endpos_field = pos+20;
		pos_of_jmp_field = pos+27;
		pos_of_op = pos+30;
	}

	else if(pkl_memmatch(&d->epbytes[pos],
		(const u8*)"\x59\x2d\x20\x00\x8e\xd0\x51\x2d??\x50\x52\xb9??\xbe??\x8b\xfe"
		"\xfd\x90\x49\x74?\xad\x92\x33", 28, '?', 0))
	{
		d->descrambler_class = DESCRAMBLER_CLASS_150IBM;
		pos_of_scrambled_word_count = pos+13;
		pos_of_endpos_field = pos+16;
		pos_of_jmp_field = pos+24;
		pos_of_op = pos+27;
	}

	if(!d->descrambler_class) {
		goto done;
	}

	d->scrambled_decompressor = 1;

	if(d->epbytes[pos_of_op]==0x33) {
		d->scramble_method = SCRAMBLE_METHOD_XOR;
	}
	else if(d->epbytes[pos_of_op]==0x03) {
		d->scramble_method = SCRAMBLE_METHOD_ADD;
	}
	else {
		d->errflag = 1;
		goto done;
	}

	de_dbg(c, "descrambler at ep+%"I64_FMT, d->position2);
	de_dbg_indent(c, 1);
	de_dbg(c, "descrambler class: %u", (UI)d->descrambler_class);

	de_dbg(c, "scramble method: %u", (UI)d->scramble_method);
	d->scrambled_word_count = de_getu16le_direct(&d->epbytes[pos_of_scrambled_word_count]);
	if(d->scrambled_word_count>0) d->scrambled_word_count--;
	de_dbg(c, "scrambled word count: %u", (UI)d->scrambled_word_count);
	scrambled_endpos_raw = de_getu16le_direct(&d->epbytes[pos_of_endpos_field]);
	d->pos_of_last_scrambled_word = ip_to_eprel(d, scrambled_endpos_raw);
	de_dbg(c, "pos of last scrambled word: %u", (UI)d->pos_of_last_scrambled_word);
	d->copier_pos = read_and_follow_1byte_jump(d, pos_of_jmp_field);

done:
	de_dbg_indent_restore(c, saved_indent_level);
	if(!d->errflag) {
		if(!d->scrambled_decompressor && !d->data_before_decoder) {
			d->copier_pos = d->position2;
		}
		de_dbg(c, "is scrambled: %u", (UI)d->scrambled_decompressor);
	}
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x50, %rsp
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq $0x0, -0x20(%rbp)
movq $0x0, -0x28(%rbp)
movq $0x0, -0x30(%rbp)
movq $0x0, -0x38(%rbp)
movq -0x8(%rbp), %rdi
leaq -0x44(%rbp), %rsi
callq 0x15b580
movq -0x10(%rbp), %rax
movzbl 0x34(%rax), %eax
movl %eax, -0x48(%rbp)
subl $0xc, %eax
je 0x1148f3
jmp 0x1148df
movl -0x48(%rbp), %eax
subl $0xe, %eax
je 0x1148f3
jmp 0x1148e9
movl -0x48(%rbp), %eax
subl $0x32, %eax
jne 0x1148f5
jmp 0x1148f3
jmp 0x1148fa
jmp 0x114e58
movq -0x10(%rbp), %rax
movq 0x40(%rax), %rax
movq %rax, -0x18(%rbp)
movq -0x18(%rbp), %rax
addq $0xc8, %rax
cmpq $0x3e8, %rax            # imm = 0x3E8
jle 0x11491d
jmp 0x114e58
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x18(%rbp), %rdi
leaq 0xafecd(%rip), %rsi     # 0x1c4800
movl $0x1e, %edx
movl $0x3f, %ecx
xorl %r8d, %r8d
callq 0x15f6b0
cmpl $0x0, %eax
je 0x114987
movq -0x10(%rbp), %rax
movb $0xe, 0x48(%rax)
movq -0x18(%rbp), %rax
addq $0xb, %rax
movq %rax, -0x38(%rbp)
movq -0x18(%rbp), %rax
addq $0xe, %rax
movq %rax, -0x20(%rbp)
movq -0x18(%rbp), %rax
addq $0x16, %rax
movq %rax, -0x28(%rbp)
movq -0x18(%rbp), %rax
addq $0x19, %rax
movq %rax, -0x30(%rbp)
jmp 0x114cdf
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x18(%rbp), %rdi
leaq 0xaf706(%rip), %rsi     # 0x1c40a3
movl $0x1c, %edx
movl $0x3f, %ecx
xorl %r8d, %r8d
callq 0x15f6b0
cmpl $0x0, %eax
je 0x1149f1
movq -0x10(%rbp), %rax
movb $0x65, 0x48(%rax)
movq -0x18(%rbp), %rax
addq $0xa, %rax
movq %rax, -0x38(%rbp)
movq -0x18(%rbp), %rax
addq $0xd, %rax
movq %rax, -0x20(%rbp)
movq -0x18(%rbp), %rax
addq $0x14, %rax
movq %rax, -0x28(%rbp)
movq -0x18(%rbp), %rax
addq $0x17, %rax
movq %rax, -0x30(%rbp)
jmp 0x114cdd
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x18(%rbp), %rdi
leaq 0xaf6b9(%rip), %rsi     # 0x1c40c0
movl $0x1d, %edx
movl $0x3f, %ecx
xorl %r8d, %r8d
callq 0x15f6b0
cmpl $0x0, %eax
je 0x114a5b
movq -0x10(%rbp), %rax
movb $0x66, 0x48(%rax)
movq -0x18(%rbp), %rax
addq $0xa, %rax
movq %rax, -0x38(%rbp)
movq -0x18(%rbp), %rax
addq $0xd, %rax
movq %rax, -0x20(%rbp)
movq -0x18(%rbp), %rax
addq $0x15, %rax
movq %rax, -0x28(%rbp)
movq -0x18(%rbp), %rax
addq $0x18, %rax
movq %rax, -0x30(%rbp)
jmp 0x114cdb
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x18(%rbp), %rdi
leaq 0xafdae(%rip), %rsi     # 0x1c481f
movl $0x26, %edx
movl $0x3f, %ecx
xorl %r8d, %r8d
callq 0x15f6b0
cmpl $0x0, %eax
je 0x114ac5
movq -0x10(%rbp), %rax
movb $0x32, 0x48(%rax)
movq -0x18(%rbp), %rax
addq $0x14, %rax
movq %rax, -0x38(%rbp)
movq -0x18(%rbp), %rax
addq $0x17, %rax
movq %rax, -0x20(%rbp)
movq -0x18(%rbp), %rax
addq $0x26, %rax
movq %rax, -0x28(%rbp)
movq -0x18(%rbp), %rax
addq $0x2d, %rax
movq %rax, -0x30(%rbp)
jmp 0x114cd9
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x18(%rbp), %rdi
leaq 0xafd6b(%rip), %rsi     # 0x1c4846
movl $0x20, %edx
movl $0x3f, %ecx
xorl %r8d, %r8d
callq 0x15f6b0
cmpl $0x0, %eax
je 0x114b2f
movq -0x10(%rbp), %rax
movb $0x67, 0x48(%rax)
movq -0x18(%rbp), %rax
addq $0x10, %rax
movq %rax, -0x38(%rbp)
movq -0x18(%rbp), %rax
addq $0x13, %rax
movq %rax, -0x20(%rbp)
movq -0x18(%rbp), %rax
addq $0x1c, %rax
movq %rax, -0x28(%rbp)
movq -0x18(%rbp), %rax
addq $0x1f, %rax
movq %rax, -0x30(%rbp)
jmp 0x114cd7
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x18(%rbp), %rdi
leaq 0xafd22(%rip), %rsi     # 0x1c4867
movl $0x21, %edx
movl $0x3f, %ecx
xorl %r8d, %r8d
callq 0x15f6b0
cmpl $0x0, %eax
je 0x114b99
movq -0x10(%rbp), %rax
movb $0x69, 0x48(%rax)
movq -0x18(%rbp), %rax
addq $0x10, %rax
movq %rax, -0x38(%rbp)
movq -0x18(%rbp), %rax
addq $0x13, %rax
movq %rax, -0x20(%rbp)
movq -0x18(%rbp), %rax
addq $0x1d, %rax
movq %rax, -0x28(%rbp)
movq -0x18(%rbp), %rax
addq $0x20, %rax
movq %rax, -0x30(%rbp)
jmp 0x114cd5
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x18(%rbp), %rdi
leaq 0xafcda(%rip), %rsi     # 0x1c4889
movl $0x27, %edx
movl $0x3f, %ecx
xorl %r8d, %r8d
callq 0x15f6b0
cmpl $0x0, %eax
je 0x114c03
movq -0x10(%rbp), %rax
movb $0x6e, 0x48(%rax)
movq -0x18(%rbp), %rax
addq $0x15, %rax
movq %rax, -0x38(%rbp)
movq -0x18(%rbp), %rax
addq $0x18, %rax
movq %rax, -0x20(%rbp)
movq -0x18(%rbp), %rax
addq $0x23, %rax
movq %rax, -0x28(%rbp)
movq -0x18(%rbp), %rax
addq $0x26, %rax
movq %rax, -0x30(%rbp)
jmp 0x114cd3
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x18(%rbp), %rdi
leaq 0xaf4c5(%rip), %rsi     # 0x1c40de
movl $0x1f, %edx
movl $0x3f, %ecx
xorl %r8d, %r8d
callq 0x15f6b0
cmpl $0x0, %eax
je 0x114c6a
movq -0x10(%rbp), %rax
movb $0x6f, 0x48(%rax)
movq -0x18(%rbp), %rax
addq $0x11, %rax
movq %rax, -0x38(%rbp)
movq -0x18(%rbp), %rax
addq $0x14, %rax
movq %rax, -0x20(%rbp)
movq -0x18(%rbp), %rax
addq $0x1b, %rax
movq %rax, -0x28(%rbp)
movq -0x18(%rbp), %rax
addq $0x1e, %rax
movq %rax, -0x30(%rbp)
jmp 0x114cd1
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x18(%rbp), %rdi
leaq 0xafc31(%rip), %rsi     # 0x1c48b1
movl $0x1c, %edx
movl $0x3f, %ecx
xorl %r8d, %r8d
callq 0x15f6b0
cmpl $0x0, %eax
je 0x114ccf
movq -0x10(%rbp), %rax
movb $0x33, 0x48(%rax)
movq -0x18(%rbp), %rax
addq $0xd, %rax
movq %rax, -0x38(%rbp)
movq -0x18(%rbp), %rax
addq $0x10, %rax
movq %rax, -0x20(%rbp)
movq -0x18(%rbp), %rax
addq $0x18, %rax
movq %rax, -0x28(%rbp)
movq -0x18(%rbp), %rax
addq $0x1b, %rax
movq %rax, -0x30(%rbp)
jmp 0x114cd1
jmp 0x114cd3
jmp 0x114cd5
jmp 0x114cd7
jmp 0x114cd9
jmp 0x114cdb
jmp 0x114cdd
jmp 0x114cdf
movq -0x10(%rbp), %rax
cmpb $0x0, 0x48(%rax)
jne 0x114cee
jmp 0x114e58
movq -0x10(%rbp), %rax
movb $0x1, 0x49(%rax)
movq -0x10(%rbp), %rax
movq -0x30(%rbp), %rcx
movzbl 0x10c(%rax,%rcx), %eax
cmpl $0x33, %eax
jne 0x114d15
movq -0x10(%rbp), %rax
movb $0x1, 0x4a(%rax)
jmp 0x114d42
movq -0x10(%rbp), %rax
movq -0x30(%rbp), %rcx
movzbl 0x10c(%rax,%rcx), %eax
cmpl $0x3, %eax
jne 0x114d34
movq -0x10(%rbp), %rax
movb $0x2, 0x4a(%rax)
jmp 0x114d40
movq -0x10(%rbp), %rax
movb $0x1, (%rax)
jmp 0x114e58
jmp 0x114d42
movq -0x8(%rbp), %rdi
movq -0x10(%rbp), %rax
movq 0x40(%rax), %rdx
leaq 0xaf3a9(%rip), %rsi     # 0x1c40fe
movb $0x0, %al
callq 0x15b0d0
movq -0x8(%rbp), %rdi
movl $0x1, %esi
callq 0x15b560
movq -0x8(%rbp), %rdi
movq -0x10(%rbp), %rax
movzbl 0x48(%rax), %edx
leaq 0xaf397(%rip), %rsi     # 0x1c4114
movb $0x0, %al
callq 0x15b0d0
movq -0x8(%rbp), %rdi
movq -0x10(%rbp), %rax
movzbl 0x4a(%rax), %edx
leaq 0xaf393(%rip), %rsi     # 0x1c412a
movb $0x0, %al
callq 0x15b0d0
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x38(%rbp), %rdi
callq 0x165260
movq %rax, %rcx
movq -0x10(%rbp), %rax
movq %rcx, 0x50(%rax)
movq -0x10(%rbp), %rax
cmpq $0x0, 0x50(%rax)
jle 0x114dd8
movq -0x10(%rbp), %rax
movq 0x50(%rax), %rcx
addq $-0x1, %rcx
movq %rcx, 0x50(%rax)
movq -0x8(%rbp), %rdi
movq -0x10(%rbp), %rax
movq 0x50(%rax), %rax
movl %eax, %edx
leaq 0xaf351(%rip), %rsi     # 0x1c413e
movb $0x0, %al
callq 0x15b0d0
movq -0x10(%rbp), %rdi
addq $0x10c, %rdi            # imm = 0x10C
addq -0x20(%rbp), %rdi
callq 0x165260
movq %rax, -0x40(%rbp)
movq -0x10(%rbp), %rdi
movq -0x40(%rbp), %rsi
callq 0x115ce0
movq %rax, %rcx
movq -0x10(%rbp), %rax
movq %rcx, 0x58(%rax)
movq -0x8(%rbp), %rdi
movq -0x10(%rbp), %rax
movq 0x58(%rax), %rax
movl %eax, %edx
leaq 0xaf31e(%rip), %rsi     # 0x1c4157
movb $0x0, %al
callq 0x15b0d0
movq -0x10(%rbp), %rdi
movq -0x28(%rbp), %rsi
callq 0x115c90
movq %rax, %rcx
movq -0x10(%rbp), %rax
movq %rcx, 0x60(%rax)
movq -0x8(%rbp), %rdi
movl -0x44(%rbp), %esi
callq 0x15b5a0
movq -0x10(%rbp), %rax
cmpb $0x0, (%rax)
jne 0x114eab
movq -0x10(%rbp), %rax
cmpb $0x0, 0x49(%rax)
jne 0x114e91
movq -0x10(%rbp), %rax
cmpb $0x0, 0x6(%rax)
jne 0x114e91
movq -0x10(%rbp), %rax
movq 0x40(%rax), %rcx
movq -0x10(%rbp), %rax
movq %rcx, 0x60(%rax)
movq -0x8(%rbp), %rdi
movq -0x10(%rbp), %rax
movzbl 0x49(%rax), %edx
leaq 0xaf2d2(%rip), %rsi     # 0x1c4176
movb $0x0, %al
callq 0x15b0d0
addq $0x50, %rsp
popq %rbp
retq
nopw %cs:(%rax,%rax)