// File: 4n6ist[P]usn_analytics/lib/usnjrnl.cpp
// Function: UsnJrnl::WriteSuspiciousInfo()
int UsnJrnl::WriteSuspiciousInfo() {
  map<string, uint16_t> job_table, exe_table, dll_table, scr_table, ps1_table, vb_table, bat_table, tck_table;
  map<string, string> psexec_table;  // timestamp, filename
  //map<string, uint16_t> stream_table, ea_table;
  int i;
  
  for(i=0; i < usnmain_set.size(); i++) {
    if (usnmain_set[i].file_name.size() < 5 )
      continue;
    if (usnmain_set[i].reasons_i == (SECURITY|CLOSE))
      continue;
      
    FindInsertCount(&(usnmain_set[i].file_name), ".job", &job_table);
    FindInsertCount(&(usnmain_set[i].file_name), ".exe", &exe_table);
    FindInsertCount(&(usnmain_set[i].file_name), ".dll", &dll_table);
    FindInsertCount(&(usnmain_set[i].file_name), ".scr", &scr_table);
    FindInsertCount(&(usnmain_set[i].file_name), ".vba", &vb_table);
    FindInsertCount(&(usnmain_set[i].file_name), ".vbe", &vb_table);
    FindInsertCount(&(usnmain_set[i].file_name), ".vbs", &vb_table);
    FindInsertCount(&(usnmain_set[i].file_name), ".ps1", &ps1_table);
    FindInsertCount(&(usnmain_set[i].file_name), ".bat", &bat_table);
    FindInsertCount(&(usnmain_set[i].file_name), ".tck", &tck_table);

#ifdef _WIN32
    if (stricmp(usnmain_set[i].file_name.c_str(), "PSEXESVC.exe") == 0)      
       psexec_table[usnmain_set[i].timestamp_s] = usnmain_set[i].file_name;
#else
    if (strcasecmp(usnmain_set[i].file_name.c_str(), "PSEXESVC.exe") == 0)      
       psexec_table[usnmain_set[i].timestamp_s] = usnmain_set[i].file_name;    
#endif
        
  }
  
  WriteFileNameList("job", &job_table);
  WriteFileNameList("exe", &exe_table);
  WriteFileNameList("dll", &dll_table);
  WriteFileNameList("scr", &scr_table);
  WriteFileNameList("ps1", &ps1_table);
  WriteFileNameList("vbe/vbs", &vb_table);
  WriteFileNameList("bat", &bat_table);
  WriteFileNameList("tck", &tck_table);

  fprintf(fp_ofreport, "\n[PSEXESVC] %lu files (timestamp, name)\n", psexec_table.size());
  i=0;
  for(auto x: psexec_table) {
    fprintf(fp_ofreport, "%s, %s\n", x.first.c_str(), x.second.c_str());
    i++;
    if(i > 1024) {
      fprintf(fp_ofreport, "reached 1024 files...skip the rest\n");
      break;
    }      
  }

  printf("...Done\n");  

  return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x620, %rsp            # imm = 0x620
movq %rdi, -0x8(%rbp)
movq -0x8(%rbp), %rax
movq %rax, -0x508(%rbp)
leaq -0x38(%rbp), %rdi
callq 0xad90
leaq -0x68(%rbp), %rdi
callq 0xad90
leaq -0x98(%rbp), %rdi
callq 0xad90
leaq -0xc8(%rbp), %rdi
callq 0xad90
leaq -0xf8(%rbp), %rdi
callq 0xad90
leaq -0x128(%rbp), %rdi
callq 0xad90
leaq -0x158(%rbp), %rdi
callq 0xad90
leaq -0x188(%rbp), %rdi
callq 0xad90
leaq -0x1b8(%rbp), %rdi
callq 0xbbe0
movl $0x0, -0x1bc(%rbp)
movq -0x508(%rbp), %rdi
movslq -0x1bc(%rbp), %rax
movq %rax, -0x510(%rbp)
addq $0x50, %rdi
callq 0xaf20
movq %rax, %rcx
movq -0x510(%rbp), %rax
cmpq %rcx, %rax
jae 0x8e58
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
movq %rax, %rdi
addq $0x3a, %rdi
callq 0x3220
cmpq $0x5, %rax
jae 0x8549
jmp 0x8e44
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
cmpl $0x80000800, 0x5a(%rax) # imm = 0x80000800
jne 0x856e
jmp 0x8e44
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
addq $0x3a, %rax
movq %rax, -0x520(%rbp)
leaq -0x1e1(%rbp), %rdi
movq %rdi, -0x518(%rbp)
callq 0x35d0
movq -0x518(%rbp), %rdx
leaq 0x13ee1(%rip), %rsi     # 0x1c492
leaq -0x1e0(%rbp), %rdi
callq 0xa400
jmp 0x85bf
movq -0x520(%rbp), %rsi
movq -0x508(%rbp), %rdi
leaq -0x1e0(%rbp), %rdx
leaq -0x38(%rbp), %rcx
callq 0x9600
jmp 0x85df
leaq -0x1e0(%rbp), %rdi
callq 0x31d0
leaq -0x1e1(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
addq $0x3a, %rax
movq %rax, -0x530(%rbp)
leaq -0x219(%rbp), %rdi
movq %rdi, -0x528(%rbp)
callq 0x35d0
movq -0x528(%rbp), %rdx
leaq 0x13e8d(%rip), %rsi     # 0x1c4c7
leaq -0x218(%rbp), %rdi
callq 0xa400
jmp 0x8648
movq -0x530(%rbp), %rsi
movq -0x508(%rbp), %rdi
leaq -0x218(%rbp), %rdx
leaq -0x68(%rbp), %rcx
callq 0x9600
jmp 0x8668
leaq -0x218(%rbp), %rdi
callq 0x31d0
leaq -0x219(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
addq $0x3a, %rax
movq %rax, -0x540(%rbp)
leaq -0x241(%rbp), %rdi
movq %rdi, -0x538(%rbp)
callq 0x35d0
movq -0x538(%rbp), %rdx
leaq 0x13dd4(%rip), %rsi     # 0x1c497
leaq -0x240(%rbp), %rdi
callq 0xa400
jmp 0x86d1
movq -0x540(%rbp), %rsi
movq -0x508(%rbp), %rdi
leaq -0x240(%rbp), %rdx
leaq -0x98(%rbp), %rcx
callq 0x9600
jmp 0x86f4
leaq -0x240(%rbp), %rdi
callq 0x31d0
leaq -0x241(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
addq $0x3a, %rax
movq %rax, -0x550(%rbp)
leaq -0x269(%rbp), %rdi
movq %rdi, -0x548(%rbp)
callq 0x35d0
movq -0x548(%rbp), %rdx
leaq 0x13d4d(%rip), %rsi     # 0x1c49c
leaq -0x268(%rbp), %rdi
callq 0xa400
jmp 0x875d
movq -0x550(%rbp), %rsi
movq -0x508(%rbp), %rdi
leaq -0x268(%rbp), %rdx
leaq -0xc8(%rbp), %rcx
callq 0x9600
jmp 0x8780
leaq -0x268(%rbp), %rdi
callq 0x31d0
leaq -0x269(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
addq $0x3a, %rax
movq %rax, -0x560(%rbp)
leaq -0x291(%rbp), %rdi
movq %rdi, -0x558(%rbp)
callq 0x35d0
movq -0x558(%rbp), %rdx
leaq 0x13cc6(%rip), %rsi     # 0x1c4a1
leaq -0x290(%rbp), %rdi
callq 0xa400
jmp 0x87e9
movq -0x560(%rbp), %rsi
movq -0x508(%rbp), %rdi
leaq -0x290(%rbp), %rdx
leaq -0x128(%rbp), %rcx
callq 0x9600
jmp 0x880c
leaq -0x290(%rbp), %rdi
callq 0x31d0
leaq -0x291(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
addq $0x3a, %rax
movq %rax, -0x570(%rbp)
leaq -0x2b9(%rbp), %rdi
movq %rdi, -0x568(%rbp)
callq 0x35d0
movq -0x568(%rbp), %rdx
leaq 0x13c3f(%rip), %rsi     # 0x1c4a6
leaq -0x2b8(%rbp), %rdi
callq 0xa400
jmp 0x8875
movq -0x570(%rbp), %rsi
movq -0x508(%rbp), %rdi
leaq -0x2b8(%rbp), %rdx
leaq -0x128(%rbp), %rcx
callq 0x9600
jmp 0x8898
leaq -0x2b8(%rbp), %rdi
callq 0x31d0
leaq -0x2b9(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
addq $0x3a, %rax
movq %rax, -0x580(%rbp)
leaq -0x2e1(%rbp), %rdi
movq %rdi, -0x578(%rbp)
callq 0x35d0
movq -0x578(%rbp), %rdx
leaq 0x13bb8(%rip), %rsi     # 0x1c4ab
leaq -0x2e0(%rbp), %rdi
callq 0xa400
jmp 0x8901
movq -0x580(%rbp), %rsi
movq -0x508(%rbp), %rdi
leaq -0x2e0(%rbp), %rdx
leaq -0x128(%rbp), %rcx
callq 0x9600
jmp 0x8924
leaq -0x2e0(%rbp), %rdi
callq 0x31d0
leaq -0x2e1(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
addq $0x3a, %rax
movq %rax, -0x590(%rbp)
leaq -0x309(%rbp), %rdi
movq %rdi, -0x588(%rbp)
callq 0x35d0
movq -0x588(%rbp), %rdx
leaq 0x13b31(%rip), %rsi     # 0x1c4b0
leaq -0x308(%rbp), %rdi
callq 0xa400
jmp 0x898d
movq -0x590(%rbp), %rsi
movq -0x508(%rbp), %rdi
leaq -0x308(%rbp), %rdx
leaq -0xf8(%rbp), %rcx
callq 0x9600
jmp 0x89b0
leaq -0x308(%rbp), %rdi
callq 0x31d0
leaq -0x309(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
addq $0x3a, %rax
movq %rax, -0x5a0(%rbp)
leaq -0x331(%rbp), %rdi
movq %rdi, -0x598(%rbp)
callq 0x35d0
movq -0x598(%rbp), %rdx
leaq 0x13aaa(%rip), %rsi     # 0x1c4b5
leaq -0x330(%rbp), %rdi
callq 0xa400
jmp 0x8a19
movq -0x5a0(%rbp), %rsi
movq -0x508(%rbp), %rdi
leaq -0x330(%rbp), %rdx
leaq -0x158(%rbp), %rcx
callq 0x9600
jmp 0x8a3c
leaq -0x330(%rbp), %rdi
callq 0x31d0
leaq -0x331(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
addq $0x3a, %rax
movq %rax, -0x5b0(%rbp)
leaq -0x359(%rbp), %rdi
movq %rdi, -0x5a8(%rbp)
callq 0x35d0
movq -0x5a8(%rbp), %rdx
leaq 0x13a23(%rip), %rsi     # 0x1c4ba
leaq -0x358(%rbp), %rdi
callq 0xa400
jmp 0x8aa5
movq -0x5b0(%rbp), %rsi
movq -0x508(%rbp), %rdi
leaq -0x358(%rbp), %rdx
leaq -0x188(%rbp), %rcx
callq 0x9600
jmp 0x8ac8
leaq -0x358(%rbp), %rdi
callq 0x31d0
leaq -0x359(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
movq %rax, %rdi
addq $0x3a, %rdi
callq 0x3120
movq %rax, %rdi
leaq 0x139b2(%rip), %rsi     # 0x1c4bf
callq 0x33e0
cmpl $0x0, %eax
jne 0x8e42
movq -0x508(%rbp), %rdi
addq $0x50, %rdi
movq %rdi, -0x5c8(%rbp)
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
movq -0x5c8(%rbp), %rdi
addq $0x3a, %rax
movq %rax, -0x5c0(%rbp)
movslq -0x1bc(%rbp), %rsi
callq 0xaf90
movq %rax, %rsi
addq $0x12, %rsi
leaq -0x1b8(%rbp), %rdi
callq 0xbc00
movq %rax, -0x5b8(%rbp)
jmp 0x8b73
movq -0x5c0(%rbp), %rsi
movq -0x5b8(%rbp), %rdi
callq 0x3050
jmp 0x8b88
jmp 0x8e42
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x8bbf
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x1e0(%rbp), %rdi
callq 0x31d0
leaq -0x1e1(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x8c02
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x218(%rbp), %rdi
callq 0x31d0
leaq -0x219(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x8c45
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x240(%rbp), %rdi
callq 0x31d0
leaq -0x241(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x8c88
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x268(%rbp), %rdi
callq 0x31d0
leaq -0x269(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x8ccb
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x290(%rbp), %rdi
callq 0x31d0
leaq -0x291(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x8d0e
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x2b8(%rbp), %rdi
callq 0x31d0
leaq -0x2b9(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x8d51
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x2e0(%rbp), %rdi
callq 0x31d0
leaq -0x2e1(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x8d94
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x308(%rbp), %rdi
callq 0x31d0
leaq -0x309(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x8dd7
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x330(%rbp), %rdi
callq 0x31d0
leaq -0x331(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x8e1a
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x358(%rbp), %rdi
callq 0x31d0
leaq -0x359(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x958c
jmp 0x8e44
movl -0x1bc(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x1bc(%rbp)
jmp 0x84ea
leaq -0x381(%rbp), %rdi
movq %rdi, -0x5d0(%rbp)
callq 0x35d0
movq -0x5d0(%rbp), %rdx
leaq 0x1361a(%rip), %rsi     # 0x1c493
leaq -0x380(%rbp), %rdi
callq 0xa400
jmp 0x8e87
movq -0x508(%rbp), %rdi
leaq -0x380(%rbp), %rsi
leaq -0x38(%rbp), %rdx
callq 0x97d0
jmp 0x8ea0
leaq -0x380(%rbp), %rdi
callq 0x31d0
leaq -0x381(%rbp), %rdi
callq 0x33c0
leaq -0x3a9(%rbp), %rdi
movq %rdi, -0x5d8(%rbp)
callq 0x35d0
movq -0x5d8(%rbp), %rdx
leaq 0x135ef(%rip), %rsi     # 0x1c4c8
leaq -0x3a8(%rbp), %rdi
callq 0xa400
jmp 0x8ee7
movq -0x508(%rbp), %rdi
leaq -0x3a8(%rbp), %rsi
leaq -0x68(%rbp), %rdx
callq 0x97d0
jmp 0x8f00
leaq -0x3a8(%rbp), %rdi
callq 0x31d0
leaq -0x3a9(%rbp), %rdi
callq 0x33c0
leaq -0x3d1(%rbp), %rdi
movq %rdi, -0x5e0(%rbp)
callq 0x35d0
movq -0x5e0(%rbp), %rdx
leaq 0x1355f(%rip), %rsi     # 0x1c498
leaq -0x3d0(%rbp), %rdi
callq 0xa400
jmp 0x8f47
movq -0x508(%rbp), %rdi
leaq -0x3d0(%rbp), %rsi
leaq -0x98(%rbp), %rdx
callq 0x97d0
jmp 0x8f63
leaq -0x3d0(%rbp), %rdi
callq 0x31d0
leaq -0x3d1(%rbp), %rdi
callq 0x33c0
leaq -0x3f9(%rbp), %rdi
movq %rdi, -0x5e8(%rbp)
callq 0x35d0
movq -0x5e8(%rbp), %rdx
leaq 0x13501(%rip), %rsi     # 0x1c49d
leaq -0x3f8(%rbp), %rdi
callq 0xa400
jmp 0x8faa
movq -0x508(%rbp), %rdi
leaq -0x3f8(%rbp), %rsi
leaq -0xc8(%rbp), %rdx
callq 0x97d0
jmp 0x8fc6
leaq -0x3f8(%rbp), %rdi
callq 0x31d0
leaq -0x3f9(%rbp), %rdi
callq 0x33c0
leaq -0x421(%rbp), %rdi
movq %rdi, -0x5f0(%rbp)
callq 0x35d0
movq -0x5f0(%rbp), %rdx
leaq 0x134b2(%rip), %rsi     # 0x1c4b1
leaq -0x420(%rbp), %rdi
callq 0xa400
jmp 0x900d
movq -0x508(%rbp), %rdi
leaq -0x420(%rbp), %rsi
leaq -0xf8(%rbp), %rdx
callq 0x97d0
jmp 0x9029
leaq -0x420(%rbp), %rdi
callq 0x31d0
leaq -0x421(%rbp), %rdi
callq 0x33c0
leaq -0x449(%rbp), %rdi
movq %rdi, -0x5f8(%rbp)
callq 0x35d0
movq -0x5f8(%rbp), %rdx
leaq 0x1346a(%rip), %rsi     # 0x1c4cc
leaq -0x448(%rbp), %rdi
callq 0xa400
jmp 0x9070
movq -0x508(%rbp), %rdi
leaq -0x448(%rbp), %rsi
leaq -0x128(%rbp), %rdx
callq 0x97d0
jmp 0x908c
leaq -0x448(%rbp), %rdi
callq 0x31d0
leaq -0x449(%rbp), %rdi
callq 0x33c0
leaq -0x471(%rbp), %rdi
movq %rdi, -0x600(%rbp)
callq 0x35d0
movq -0x600(%rbp), %rdx
leaq 0x133f1(%rip), %rsi     # 0x1c4b6
leaq -0x470(%rbp), %rdi
callq 0xa400
jmp 0x90d3
movq -0x508(%rbp), %rdi
leaq -0x470(%rbp), %rsi
leaq -0x158(%rbp), %rdx
callq 0x97d0
jmp 0x90ef
leaq -0x470(%rbp), %rdi
callq 0x31d0
leaq -0x471(%rbp), %rdi
callq 0x33c0
leaq -0x499(%rbp), %rdi
movq %rdi, -0x608(%rbp)
callq 0x35d0
movq -0x608(%rbp), %rdx
leaq 0x13393(%rip), %rsi     # 0x1c4bb
leaq -0x498(%rbp), %rdi
callq 0xa400
jmp 0x9136
movq -0x508(%rbp), %rdi
leaq -0x498(%rbp), %rsi
leaq -0x188(%rbp), %rdx
callq 0x97d0
jmp 0x9152
leaq -0x498(%rbp), %rdi
callq 0x31d0
leaq -0x499(%rbp), %rdi
callq 0x33c0
movq -0x508(%rbp), %rax
movq 0x18(%rax), %rax
movq %rax, -0x610(%rbp)
leaq -0x1b8(%rbp), %rdi
callq 0xbce0
movq -0x610(%rbp), %rdi
movq %rax, %rdx
leaq 0x1333b(%rip), %rsi     # 0x1c4d4
movb $0x0, %al
callq 0x34d0
movl $0x0, -0x1bc(%rbp)
leaq -0x1b8(%rbp), %rax
movq %rax, -0x4a8(%rbp)
movq -0x4a8(%rbp), %rdi
callq 0xbd00
movq %rax, -0x4b0(%rbp)
movq -0x4a8(%rbp), %rdi
callq 0xbd30
movq %rax, -0x4b8(%rbp)
leaq -0x4b0(%rbp), %rdi
leaq -0x4b8(%rbp), %rsi
callq 0xbd60
testb $0x1, %al
jne 0x91fa
jmp 0x9501
leaq -0x4b0(%rbp), %rdi
callq 0xbd90
movq %rax, %rsi
leaq -0x4f8(%rbp), %rdi
callq 0xbdb0
jmp 0x9217
movq -0x508(%rbp), %rax
movq 0x18(%rax), %rax
movq %rax, -0x620(%rbp)
leaq -0x4f8(%rbp), %rdi
callq 0x3120
movq %rax, -0x618(%rbp)
leaq -0x4f8(%rbp), %rdi
addq $0x20, %rdi
callq 0x3120
movq -0x620(%rbp), %rdi
movq -0x618(%rbp), %rdx
movq %rax, %rcx
leaq 0x13299(%rip), %rsi     # 0x1c4fd
movb $0x0, %al
callq 0x34d0
movl -0x1bc(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x1bc(%rbp)
cmpl $0x400, -0x1bc(%rbp)    # imm = 0x400
jle 0x94ca
movq -0x508(%rbp), %rax
movq 0x18(%rax), %rdi
leaq 0x131b9(%rip), %rsi     # 0x1c455
movb $0x0, %al
callq 0x34d0
movl $0x5, -0x4fc(%rbp)
jmp 0x94d4
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x92e4
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x380(%rbp), %rdi
callq 0x31d0
leaq -0x381(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x9327
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x3a8(%rbp), %rdi
callq 0x31d0
leaq -0x3a9(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x936a
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x3d0(%rbp), %rdi
callq 0x31d0
leaq -0x3d1(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x93ad
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x3f8(%rbp), %rdi
callq 0x31d0
leaq -0x3f9(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x93f0
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x420(%rbp), %rdi
callq 0x31d0
leaq -0x421(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x9433
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x448(%rbp), %rdi
callq 0x31d0
leaq -0x449(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x9476
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x470(%rbp), %rdi
callq 0x31d0
leaq -0x471(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
jmp 0x94b9
movq %rax, %rcx
movl %edx, %eax
movq %rcx, -0x1f0(%rbp)
movl %eax, -0x1f4(%rbp)
leaq -0x498(%rbp), %rdi
callq 0x31d0
leaq -0x499(%rbp), %rdi
callq 0x33c0
jmp 0x958c
movl $0x0, -0x4fc(%rbp)
leaq -0x4f8(%rbp), %rdi
callq 0xbe10
movl -0x4fc(%rbp), %eax
testl %eax, %eax
je 0x94ee
jmp 0x94ec
jmp 0x9501
jmp 0x94f0
leaq -0x4b0(%rbp), %rdi
callq 0xbe40
jmp 0x91de
leaq 0x12f06(%rip), %rdi     # 0x1c40e
xorl %eax, %eax
callq 0x3060
jmp 0x9511
movl $0x1, -0x4fc(%rbp)
leaq -0x1b8(%rbp), %rdi
callq 0xbe70
leaq -0x188(%rbp), %rdi
callq 0xb0c0
leaq -0x158(%rbp), %rdi
callq 0xb0c0
leaq -0x128(%rbp), %rdi
callq 0xb0c0
leaq -0xf8(%rbp), %rdi
callq 0xb0c0
leaq -0xc8(%rbp), %rdi
callq 0xb0c0
leaq -0x98(%rbp), %rdi
callq 0xb0c0
leaq -0x68(%rbp), %rdi
callq 0xb0c0
leaq -0x38(%rbp), %rdi
callq 0xb0c0
xorl %eax, %eax
addq $0x620, %rsp            # imm = 0x620
popq %rbp
retq
leaq -0x1b8(%rbp), %rdi
callq 0xbe70
leaq -0x188(%rbp), %rdi
callq 0xb0c0
leaq -0x158(%rbp), %rdi
callq 0xb0c0
leaq -0x128(%rbp), %rdi
callq 0xb0c0
leaq -0xf8(%rbp), %rdi
callq 0xb0c0
leaq -0xc8(%rbp), %rdi
callq 0xb0c0
leaq -0x98(%rbp), %rdi
callq 0xb0c0
leaq -0x68(%rbp), %rdi
callq 0xb0c0
leaq -0x38(%rbp), %rdi
callq 0xb0c0
movq -0x1f0(%rbp), %rdi
callq 0x35c0
nop