// File: /workspace/github_c_makefile_star2_O3/sos22[P]unexec/unexec.c
// Function: end_trampoline
static void * alloc_trampoline_text(struct trampoline *out) {
    /* We need a valid fsbase to call into libc, for the PLT, so
     * restore it from the trampoline. */
    unsigned long fsbase;
    if (arch_prctl(ARCH_GET_FS, &fsbase) < 0) return NULL;
    asm(
        "    jmp end_trampoline\n"
        "start_trampoline:\n"
        /* Set personality and disable address
         * randomisation. Randomisation affects exec behaviour, so
         * need to re-exec if we changed anything. */
        "    mov %[___NR_personality], %%rax\n"
        "set_rsi_persona_no_random:\n"
        "    movq $0x123456789, %%rdi\n"
        "    movq %%rdi, %%rbx\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "    cmpq %%rax, %%rbx\n"
        "    jne exec_self\n" /* re-exec */
        /* Set fsbase */
        "    movq %[_ARCH_SET_FS], %%rdi\n"
        "set_rsi_fsbase:\n"
        "    movq $0x123456789, %%rsi\n" /* patched to fsbase */
        "    mov %[___NR_arch_prctl], %%eax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        /* Extend trampoline with new argv and environ from stack. */
        /* First we need to find out how big the area is. */
        "    movq (%%rsp), %%rax\n" /* How many arguments do we have? */
        "    lea 16(%%rsp, %%rax, 8), %%rsi\n" /* Skip past arguments. */
        "1:  leaq 8(%%rsi), %%rsi\n" /* Skip past environment
                                      * variables until we get a NULL
                                      * pointer. */
        "    movq (%%rsi), %%rax\n"
        "    testq %%rax, %%rax\n"
        "    jnz 1b\n"
        "    movq -8(%%rsi), %%rdi\n" /* rdi is last environment var,
                                       * so walk it to the end. */
        "    xor %%al, %%al\n" /* find end of variable. */
        "    movq $-1, %%rcx\n"
        "    cld\n"
        "    repne; scasb\n" /* rdi is now end of bit of stack which
                                must be copied. */
        "    movq %%rdi, %%r15\n"
        "    movq $0xfff, %%rax\n" /* Round boundaries to pages, for
                                    * mmap */
        "    addq %%rax, %%rdi\n"
        "    notq %%rax\n"
        "    movq %%rsp, %%r14\n"
        "    andq %%rax, %%r14\n"
        "    andq %%rax, %%rdi\n"
        "    subq %%r14, %%rdi\n" /* rdi is how big an allocation we
                                   * need. */
        "    movq %%rdi, %%r14\n"
        "set_rdi_tramp_top:\n" /* ANON mmap to get space above the trampoline */
        "    movq $0x123456789, %%rdi\n"
        "    movq %%r14, %%rsi\n"
        "    movq %[READ_WRITE], %%rdx\n"
        "    movq %[PRIVATE_ANONYMOUS], %%r10\n"
        "    mov $-1, %%r8\n"
        "    mov $0, %%r9\n"
        "    mov %[___NR_mmap], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "    movq %%rax, %%r8\n"
        "    addq %%r14, %%r8\n"
        "    movq %%rsp, %%rsi\n" /* copy stack to bounce zone we just
                                   * allocated. */
        "    movq %%rsp, (%%rax)\n" /* Top of bounce zone is old rsp,
                                     * so that we can fix up relative
                                     * pointers. */
        "    leaq 8(%%rax), %%rdi\n"
        "    movq %%r15, %%rcx\n"
        "    subq %%rsp, %%rcx\n"
        "    rep; movsb\n"
        /* munmap everything above the trampoline. */
        "    movq %%r8, %%rdi\n"
        "set_rsi_kern_base:\n"
        "    movq $0x123456789, %%rsi\n" /* patched later */
        "    subq %%r8, %%rsi\n"
        "    mov %[___NR_munmap], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "set_r15_tramp:\n"
        "    movq $0x123456789, %%r15\n" /* Patched to @out later */
        "    movq %c[mappings](%%r15), %%r14\n" /* r14 is next mapping */
        "    mov %[sizeofmapping], %%eax\n"
        "    movq %c[nrmappings](%%r15), %%rbx\n"
        "    imul %%rbx, %%rax\n"
        "    addq %%r14, %%rax\n"
        "    movq %%rax, %%r13\n" /* r13 is sentinel mapping */
        "next_mapping:\n"
        "    cmpq %%r14, %%r13\n"
        "    je done_mappings\n"
        /* open the next thing to map */
        "    movq %c[offsetpath](%%r14), %%rdi\n"
        "    movq %[_O_RDONLY], %%rsi\n"
        "    movq %[___NR_open], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "    movq %%rax, %%r12\n"
        /* XXX should probably make some attempt to check the world
         * still looks like what we expect; otherwise, this'll be
         * confusing. */
        /* Now do the mmap */
        "    movq %c[offsetstart](%%r14), %%rdi\n"
        "    movq %c[offsetsize](%%r14), %%rsi\n"
        "    movq %c[offsetprot](%%r14), %%rdx\n"
        "    movq %c[offsetflags](%%r14), %%r10\n"
        "    movq %%r12, %%r8\n"
        "    movq %c[offsetoffset](%%r14), %%r9\n"
        "    testq %[_MAP_ANONYMOUS], %%r10\n"
        "    jz 1f\n" /* Zap FD anonymous maps */
        "    movq $-1, %%r8\n"
        "1:\n"
        "    movq %[___NR_mmap], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        /* Anon maps need to be pread in. */
        "    testq %[_MAP_ANONYMOUS], %c[offsetflags](%%r14)\n"
        "    jz 1f\n"
        "    movq %%r12, %%rdi\n"
        "    movq %c[offsetstart](%%r14), %%rsi\n"
        "    movq %c[offsetsize](%%r14), %%rdx\n"
        "    movq %c[offsetoffset](%%r14), %%r10\n"
        "    movq %[___NR_pread], %%rax\n"
        "    syscall\n"
        "    cmpq %%rax, %c[offsetsize](%%r14)\n"
        "    jne syscall_failed\n"
        "1:\n"
        /* close the fd */
        "    movq %%r12, %%rdi\n"
        "    movq %[___NR_close], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        /* Advance to next structure. */
        "    lea %c[sizeofmapping](%%r14), %%r14\n"
        "    jmp next_mapping\n"
        "done_mappings:\n"
        /* All mappings restored, r15 set to trampoline
         * structure. Restore call saved registers. */
        "    movq %c[stash_rbx](%%r15), %%rbx\n"
        "    movq %c[stash_rsp](%%r15), %%rsp\n"
        "    movq %c[stash_ret](%%r15), %%rsi\n"
        "    movq %%rsi, (%%rsp)\n"
        "    movq %c[stash_rbp](%%r15), %%rbp\n"
        "    movq %c[stash_r12](%%r15), %%r12\n"
        "    movq %c[stash_r13](%%r15), %%r13\n"
        "    movq %c[stash_r14](%%r15), %%r14\n"
        "    movq %c[stash_r15](%%r15), %%r15\n"
        /* save_registers() returns 1 in the new process. */
        "    mov $1, %%eax\n"
        "    ret\n"
        "syscall_failed:\n"
        "    ud2\n"
        "exec_self:\n"
        /* Have to re-run execve. stack is argc, then argv, then environ. */
        "    movq (%%rsp), %%rax\n"
        "    leaq 8(%%rsp), %%rsi\n" /* argv */
        "    leaq 8(%%rsi, %%rax, 8), %%rdx\n" /* env */
        "mov_proc_self_exe_rdi:\n"
        "    movq $0x123456778, %%rdi\n"
        "    mov %[___NR_execve], %%rax\n"
        "    syscall\n"
        "    jmp syscall_failed\n"
        "end_trampoline:\n"
        :
        : [mappings] "i" (offsetof(mappings, struct trampoline)),
          [sizeofmapping] "i" (sizeof(struct mapping)),
          [nrmappings] "i" (offsetof(nrmappings, struct trampoline)),
          [offsetpath] "i" (offsetof(path, struct mapping)),
          [offsetstart] "i" (offsetof(start, struct mapping)),
          [offsetsize] "i" (offsetof(size, struct mapping)),
          [offsetprot] "i" (offsetof(prot, struct mapping)),
          [offsetflags] "i" (offsetof(flags, struct mapping)),
          [offsetoffset] "i" (offsetof(offset, struct mapping)),
          [_O_RDONLY] "i" (O_RDONLY),
          [READ_WRITE] "i" (PROT_READ|PROT_WRITE),
          [PRIVATE_ANONYMOUS] "i" (MAP_PRIVATE|MAP_ANONYMOUS),
          [_ARCH_SET_FS] "i" (ARCH_SET_FS),
          [___NR_arch_prctl] "i" (__NR_arch_prctl),
          [___NR_close] "i" (__NR_close),
          [___NR_execve] "i" (__NR_execve),
          [___NR_mmap] "i" (__NR_mmap),
          [___NR_munmap] "i" (__NR_munmap),
          [___NR_open] "i" (__NR_open),
          [___NR_personality] "i" (__NR_personality),
          [___NR_pread] "i" (__NR_pread64),
          [stash_rbx] "i" (offsetof(stash.rbx, struct trampoline)),
          [stash_rsp] "i" (offsetof(stash.rsp, struct trampoline)),
          [stash_rbp] "i" (offsetof(stash.rbp, struct trampoline)),
          [stash_r12] "i" (offsetof(stash.r12, struct trampoline)),
          [stash_r13] "i" (offsetof(stash.r13, struct trampoline)),
          [stash_r14] "i" (offsetof(stash.r14, struct trampoline)),
          [stash_r15] "i" (offsetof(stash.r15, struct trampoline)),
          [stash_ret] "i" (offsetof(stash.ret, struct trampoline)),
          [_MAP_ANONYMOUS] "i" (MAP_ANONYMOUS)
        );
    extern const unsigned char start_trampoline[0];
    extern const unsigned char set_rsi_persona_no_random[0];
    extern const unsigned char set_rsi_fsbase[0];
    extern const unsigned char set_rdi_tramp_top[0];
    extern const unsigned char set_rsi_kern_base[0];
    extern const unsigned char set_r15_tramp[0];
    extern const unsigned char mov_proc_self_exe_rdi[0];
    extern const unsigned char end_trampoline[0];
    char * res = alloc_in_trampoline(end_trampoline - start_trampoline, out);
    memcpy(res, start_trampoline, end_trampoline - start_trampoline);
    *(unsigned long *)(res + 2 + (set_rsi_persona_no_random - start_trampoline)) =
        personality(0xffffffff) | ADDR_NO_RANDOMIZE;
    *(unsigned long *)(res + 2 + (set_rsi_fsbase - start_trampoline)) =
        (unsigned long)fsbase;
    unsigned long out_top = (unsigned long)out + out->allocated + sizeof(*out);
    *(unsigned long *)(res + 2 + (set_rdi_tramp_top - start_trampoline)) =
        out_top;
    *(unsigned long *)(res + 2 + (set_rsi_kern_base - start_trampoline)) =
        KERN_BASE;
    *(unsigned long *)(res + 2 + (set_r15_tramp - start_trampoline)) =
        (unsigned long)out;
    *(unsigned long *)(res + 2 + (mov_proc_self_exe_rdi - start_trampoline)) =
        (unsigned long)out->procselfexe;
    return res; }

// Assembly:
movq -0x90(%rbp), %r14
movq %r14, %rdi
movq %r12, %rsi
callq 0x24b9
movq %rax, %rbx
movq %rax, %rdi
leaq -0x22f(%rip), %rsi      # 0x15a9
movq %r14, %rdx
callq 0x1110
movl $0xffffffff, %edi       # imm = 0xFFFFFFFF
callq 0x1030
orl $0x40000, %eax          # imm = 0x40000
cltq
movq -0xd0(%rbp), %rcx
movq %rax, 0x2(%rcx,%rbx)
movq -0x170(%rbp), %rax
movq -0xc8(%rbp), %rcx
movq %rax, 0x2(%rcx,%rbx)
movl (%r12), %eax
leaq 0x80(%r12,%rax), %rax
movq -0xc0(%rbp), %rcx
movq %rax, 0x2(%rcx,%rbx)
movq -0xb8(%rbp), %rax
movabsq $0x7ffffffff000, %rcx   # imm = 0x7FFFFFFFF000
movq %rcx, 0x2(%rax,%rbx)
movq -0xb0(%rbp), %rax
movq %r12, 0x2(%rax,%rbx)
movq 0x28(%r12), %rax
movq -0xa8(%rbp), %rcx
movq %rax, 0x2(%rcx,%rbx)
jmp 0x185f
xorl %ebx, %ebx
movq %rbx, 0x10(%r12)
callq 0x1040
movq %rax, -0x50(%rbp)
movl $0x0, (%rax)
movb (%r13), %al
testb %al, %al
movq %r12, -0x30(%rbp)
je 0x1bca
xorl %esi, %esi
movq %r13, %r14
leaq -0x40(%rbp), %rbx
movq %r14, %rdi
incq %r14
cmpb $0xa, %al
je 0x18a9
movzbl %al, %eax
testl %eax, %eax
je 0x2212
movb (%r14), %al
incq %r14
jmp 0x1892
movl %esi, -0x78(%rbp)
movb $0x0, -0x1(%r14)
movq %rbx, %rsi
movl $0x10, %edx
callq 0x1160
movq %rax, -0x38(%rbp)
movq -0x40(%rbp), %rdi
cmpb $0x2d, (%rdi)
jne 0x1c70
incq %rdi
movq %rdi, -0x40(%rbp)
movq %rbx, %rsi
movl $0x10, %edx
callq 0x1160
movq -0x40(%rbp), %rdi
cmpb $0x20, (%rdi)
jne 0x1c70
movq %rax, %r15
movzbl 0x1(%rdi), %eax
xorl %ecx, %ecx
cmpl $0x2d, %eax
je 0x190c
cmpl $0x72, %eax
jne 0x1c70
movl $0x1, %ecx
movzbl 0x2(%rdi), %eax
cmpl $0x2d, %eax
je 0x1921
cmpl $0x77, %eax
jne 0x1c70
orl $0x2, %ecx
movzbl 0x3(%rdi), %eax
cmpl $0x2d, %eax
movl %ecx, -0x58(%rbp)
je 0x193a
cmpl $0x78, %eax
jne 0x1c70
addl $0x4, -0x58(%rbp)
movzbl 0x4(%rdi), %eax
movl $0x2, %ecx
cmpl $0x70, %eax
je 0x1956
cmpl $0x73, %eax
jne 0x1c70
movl $0x1, %ecx
movq %rcx, -0x70(%rbp)
cmpb $0x20, 0x5(%rdi)
jne 0x1c70
addq $0x6, %rdi
movq %rdi, -0x40(%rbp)
movq %rbx, %rsi
movl $0x10, %edx
callq 0x1160
movq %rax, -0x60(%rbp)
movq -0x40(%rbp), %rdi
cmpb $0x20, (%rdi)
jne 0x1c70
incq %rdi
movq %rdi, -0x40(%rbp)
movq %rbx, %rsi
movl $0x10, %edx
callq 0x1160
movq -0x40(%rbp), %rdi
cmpb $0x3a, (%rdi)
jne 0x1c70
incq %rdi
movq %rdi, -0x40(%rbp)
movq %rbx, %rsi
movl $0x10, %edx
callq 0x1160
movq -0x40(%rbp), %rdi
cmpb $0x20, (%rdi)
jne 0x1c70
incq %rdi
movq %rdi, -0x40(%rbp)
movq %rbx, %rsi
movl $0xa, %edx
callq 0x1160
movq -0x40(%rbp), %r12
cmpb $0x20, (%r12)
jne 0x1c70
subq -0x38(%rbp), %r15
movb 0x1(%r12), %bl
incq %r12
cmpb $0x20, %bl
je 0x19f3
movq %r12, %rdi
leaq 0x172c(%rip), %rsi      # 0x3136
callq 0x10e0
testl %eax, %eax
je 0x1a83
movq %r15, -0x68(%rbp)
movq %r12, %rdi
leaq 0x1720(%rip), %rsi      # 0x3141
callq 0x10e0
movq -0x70(%rbp), %rcx
leal 0x120(%rcx), %r15d
testl %eax, %eax
cmovnel %ecx, %r15d
testb %bl, %bl
setne %al
testb $0x20, %r15b
sete %cl
andb %al, %cl
cmpb $0x1, %cl
jne 0x1b2e
movq -0x50(%rbp), %rax
cmpl $0x0, (%rax)
jne 0x1c70
movq %r12, %rdi
leaq -0x170(%rbp), %rsi
callq 0x1100
testl %eax, %eax
js 0x1a8f
testb $0x1, -0x58(%rbp)
jne 0x1aab
movq -0x50(%rbp), %rax
movl $0x0, (%rax)
jmp 0x1b3b
movq -0x30(%rbp), %r12
movl -0x78(%rbp), %esi
jmp 0x1bb4
movq -0x50(%rbp), %rax
cmpl $0x2, (%rax)
jne 0x1c70
movq -0x50(%rbp), %rax
movl $0x0, (%rax)
jmp 0x1b2e
movq %r12, %rdi
xorl %esi, %esi
xorl %eax, %eax
callq 0x1150
testl %eax, %eax
js 0x1c70
movl %eax, %ebx
xorl %edi, %edi
movq -0x68(%rbp), %rsi
movl $0x1, %edx
movl $0x2, %ecx
movl %eax, %r8d
movq -0x60(%rbp), %r9
callq 0x1080
movq %rax, -0x70(%rbp)
movl %ebx, %edi
callq 0x10b0
movq -0x70(%rbp), %rcx
cmpq $-0x1, %rcx
je 0x1c70
movq %rcx, %rdi
movq -0x38(%rbp), %rsi
movq -0x68(%rbp), %rbx
movq %rbx, %rdx
callq 0x1120
movl %eax, -0x9c(%rbp)
movq -0x70(%rbp), %rdi
movq %rbx, %rsi
callq 0x1130
movq -0x50(%rbp), %rax
movl $0x0, (%rax)
cmpl $0x0, -0x9c(%rbp)
je 0x1b3b
movq -0x30(%rbp), %r12
movq 0x28(%r12), %rbx
xorl %edi, %edi
jmp 0x1b6e
movq %r12, %rdi
callq 0x1070
leaq 0x1(%rax), %rdi
movq %rdi, -0x70(%rbp)
movq -0x30(%rbp), %rsi
callq 0x24b9
movq %rax, %rbx
movq %rax, %rdi
movq %r12, %rsi
movq -0x30(%rbp), %r12
movq -0x70(%rbp), %rdx
callq 0x1110
movq -0x60(%rbp), %rdi
movl -0x78(%rbp), %esi
cmpl 0x20(%r12), %esi
jae 0x23d6
orl $0x10, %r15d
movq 0x18(%r12), %rax
movl %esi, %ecx
leaq (%rcx,%rcx,4), %rcx
movq -0x38(%rbp), %rdx
movq %rdx, (%rax,%rcx,8)
movq -0x68(%rbp), %rdx
movq %rdx, 0x8(%rax,%rcx,8)
movq %rdi, 0x10(%rax,%rcx,8)
movl -0x58(%rbp), %edx
movl %edx, 0x18(%rax,%rcx,8)
movl %r15d, 0x1c(%rax,%rcx,8)
movq %rbx, 0x20(%rax,%rcx,8)
incl %esi
movb $0xa, -0x1(%r14)
movb (%r14), %al
testb %al, %al
leaq -0x40(%rbp), %rbx
jne 0x188c
jmp 0x1bcc
xorl %esi, %esi
movl %esi, 0x20(%r12)
movl $0xffffffff, %r15d      # imm = 0xFFFFFFFF
movq -0x50(%rbp), %rax
cmpl $0x0, (%rax)
jne 0x1d26
movl 0x4(%r12), %ebx
cmpl (%r12), %ebx
jbe 0x1d2e
movq %r12, %rdi
movq -0x98(%rbp), %rsi
callq 0x1130
addq $0x107f, %rbx           # imm = 0x107F
andq $-0x1000, %rbx          # imm = 0xF000
xorl %r14d, %r14d
movl $0x10000, %edi          # imm = 0x10000
movq %rbx, %rsi
movl $0x3, %edx
movl $0x32, %ecx
movl $0xffffffff, %r8d       # imm = 0xFFFFFFFF
xorl %r9d, %r9d
callq 0x1080
movq %rax, %r12
cmpq $-0x1, %rax
jne 0x14d1
movl $0xffffffff, %r14d      # imm = 0xFFFFFFFF
jmp 0x1c53
movq %r13, %rdi
callq 0x126e
xorl %r13d, %r13d
movq %r13, %rdi
callq 0x126e
movl %r14d, %eax
addq $0x2768, %rsp           # imm = 0x2768
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
movl $0xffffffff, %r15d      # imm = 0xFFFFFFFF
xorl %r14d, %r14d
movq -0x30(%rbp), %r12
movq %r13, %rdi
callq 0x126e
cmpq $-0x1, %r12
je 0x1c9a
movq %r12, %rdi
movq -0x98(%rbp), %rsi
callq 0x1130
testb %r14b, %r14b
movabsq $0x300080200, %r12      # imm = 0x300080200
je 0x1cff
movq -0xd8(%rbp), %rdi
callq 0x1030
movl $0xffffffff, %r14d      # imm = 0xFFFFFFFF
testl %eax, %eax
js 0x1c5b
movq $-0x3f, %r14
leaq -0x26f8(%rbp), %rbx
leaq 0x40(%r14), %rdi
cmpl $0x21, %edi
ja 0x1cec
movl %edi, %eax
btq %rax, %r12
jae 0x1cec
addq $0x98, %rbx
incq %r14
jne 0x1ccd
jmp 0x1d07
movq %rbx, %rsi
xorl %edx, %edx
callq 0x1050
testl %eax, %eax
jns 0x1cde
jmp 0x1347
movl %r15d, %r14d
jmp 0x1c5b
leaq -0x188(%rbp), %rdi
xorl %esi, %esi
callq 0x1170
testl %eax, %eax
movl $0xffffffff, %r14d      # imm = 0xFFFFFFFF
cmovnsl %r15d, %r14d
jmp 0x1c5b
xorl %r14d, %r14d
jmp 0x1c7d
testl %esi, %esi
je 0x1d9c
movq 0x18(%r12), %rcx
movq 0x28(%r12), %rdx
movl %esi, %eax
shlq $0x3, %rax
leaq (%rax,%rax,4), %rsi
movl $0x3, %eax
xorl %edi, %edi
movq -0x48(%rbp), %rbx
xorl %r8d, %r8d
cmpq %rdx, 0x20(%rcx,%rdi)
sete %r8b
addl %r8d, %eax
addq $0x28, %rdi
cmpq %rdi, %rsi
jne 0x1d51
movl %eax, %edi
imulq $0x38, %rdi, %rdi
addq $0x103f, %rdi           # imm = 0x103F
andq $-0x1000, %rdi          # imm = 0xF000
xorl %r8d, %r8d
cmpq %rdx, 0x20(%rcx,%r8)
jne 0x1d91
movq %rdi, 0x10(%rcx,%r8)
addq 0x8(%rcx,%r8), %rdi
addq $0x28, %r8
cmpq %r8, %rsi
jne 0x1d80
jmp 0x1daa
movl $0x1000, %edi           # imm = 0x1000
movl $0x3, %eax
movq -0x48(%rbp), %rbx
movl %eax, 0x30(%r12)
movq %rdi, 0x38(%r12)
xorl %r14d, %r14d
movl $0xc, %edi
xorl %esi, %esi
xorl %eax, %eax
callq 0x10f0
movq %rax, -0x58(%rbp)
movq %rbx, %rdi
movl $0x241, %esi            # imm = 0x241
movl $0x1c9, %edx            # imm = 0x1C9
xorl %eax, %eax
callq 0x1150
testl %eax, %eax
js 0x1c7d
movl %eax, %edi
movq 0x10(%r12), %rax
movzwl 0x30(%r12), %ecx
xorps %xmm0, %xmm0
leaq -0x170(%rbp), %rsi
movaps %xmm0, (%rsi)
movl $0x464c457f, (%rsi)     # imm = 0x464C457F
movw $0x102, 0x4(%rsi)       # imm = 0x102
movb $0x3, 0x7(%rsi)
movabsq $0x1003e0002, %rdx      # imm = 0x1003E0002
movq %rdx, 0x10(%rsi)
movq %rax, 0x18(%rsi)
movq $0x40, 0x20(%rsi)
movq $0x0, 0x28(%rsi)
movabsq $0x38004000000000, %rax # imm = 0x38004000000000
movq %rax, 0x30(%rsi)
movw %cx, 0x38(%rsi)
movl $0x40, 0x3a(%rsi)
movw $0x0, 0x3e(%rsi)
movl $0x40, %edx
movl %edi, -0x38(%rbp)
callq 0x1060
cmpq $0x40, %rax
jne 0x2205
movq -0x30(%rbp), %rax
movl 0x20(%rax), %eax
testl %eax, %eax
je 0x1ef9
leaq -0x160(%rbp), %r14
movl $0x20, %r12d
xorl %ebx, %ebx
movq -0x30(%rbp), %rsi
movq 0x18(%rsi), %rcx
movq (%rcx,%r12), %rdx
cmpq 0x28(%rsi), %rdx
jne 0x1eeb
movq -0x18(%rcx,%r12), %rax
movq -0x10(%rcx,%r12), %rcx
movq $0x0, -0x170(%rbp)
movq %rcx, -0x168(%rbp)
xorps %xmm0, %xmm0
movups %xmm0, (%r14)
movq %rax, -0x150(%rbp)
movups %xmm0, 0x18(%r14)
movl $0x38, %edx
movl -0x38(%rbp), %edi
leaq -0x170(%rbp), %rsi
callq 0x1060
cmpq $0x38, %rax
jne 0x2205
movq -0x30(%rbp), %rax
movl 0x20(%rax), %eax
incq %rbx
movl %eax, %ecx
addq $0x28, %r12
cmpq %rcx, %rbx
jb 0x1e85
movabsq $0x500000001, %rax      # imm = 0x500000001
leaq -0x170(%rbp), %rsi
movq %rax, (%rsi)
movq -0x30(%rbp), %rcx
movq 0x38(%rcx), %rax
movq %rax, 0x8(%rsi)
movq %rcx, 0x10(%rsi)
xorl %eax, %eax
movq %rax, 0x18(%rsi)
movl (%rcx), %ecx
subq $-0x80, %rcx
movq %rcx, 0x20(%rsi)
movq %rcx, 0x28(%rsi)
movq %rax, 0x30(%rsi)
movl $0x38, %edx
movl -0x38(%rbp), %edi
callq 0x1060
cmpq $0x38, %rax
jne 0x2205
xorps %xmm0, %xmm0
leaq -0x170(%rbp), %rsi
movups %xmm0, 0x28(%rsi)
movups %xmm0, 0x18(%rsi)
movups %xmm0, 0x8(%rsi)
movabsq $0x46474e551, %rax      # imm = 0x46474E551
movq %rax, (%rsi)
movl $0x38, %edx
movl -0x38(%rbp), %edi
callq 0x1060
cmpq $0x38, %rax
jne 0x2205
movq $-0x1000, %rax          # imm = 0xF000
movq -0x30(%rbp), %rcx
addq 0x8(%rcx), %rax
movabsq $0x600000001, %rcx      # imm = 0x600000001
leaq -0x170(%rbp), %rsi
movq %rcx, (%rsi)
xorl %ecx, %ecx
movq %rcx, 0x8(%rsi)
movq %rax, 0x10(%rsi)
xorps %xmm0, %xmm0
movups %xmm0, 0x18(%rsi)
movq $0x1000, 0x28(%rsi)     # imm = 0x1000
movq %rcx, 0x30(%rsi)
movl $0x38, %edx
movl -0x38(%rbp), %edi
callq 0x1060
cmpq $0x38, %rax
jne 0x2205
movq -0x30(%rbp), %rax
movl 0x20(%rax), %eax
testl %eax, %eax
movl -0x38(%rbp), %edi
je 0x20b9
movq -0x30(%rbp), %rcx
movq 0x18(%rcx), %rcx
xorl %r14d, %r14d
xorl %r12d, %r12d
xorl %ebx, %ebx
movq 0x20(%rcx,%r14), %rdx
movq -0x30(%rbp), %rsi
cmpq 0x28(%rsi), %rdx
jne 0x20a7
testq %rbx, %rbx
je 0x2050
xorl %esi, %esi
movl $0x1, %edx
callq 0x1090
testq %rax, %rax
js 0x2205
cmpq %rbx, %rax
jne 0x23f5
movq %rbx, %rcx
movq -0x30(%rbp), %rbx
movq 0x18(%rbx), %rax
movq %rcx, -0x78(%rbp)
cmpq 0x10(%rax,%r14), %rcx
je 0x2076
jmp 0x2414
movq 0x10(%rcx,%r14), %rsi
xorl %edx, %edx
callq 0x1090
testq %rax, %rax
js 0x2205
movq -0x30(%rbp), %rbx
movq 0x18(%rbx), %rax
movq 0x10(%rax,%r14), %rcx
movq %rcx, -0x78(%rbp)
movq (%rax,%r14), %rsi
movq 0x8(%rax,%r14), %rdx
movl -0x38(%rbp), %edi
callq 0x1060
movq 0x18(%rbx), %rcx
cmpq 0x8(%rcx,%r14), %rax
movq -0x78(%rbp), %rbx
jne 0x2205
addq %rax, %rbx
movq -0x30(%rbp), %rax
movl 0x20(%rax), %eax
movl -0x38(%rbp), %edi
incq %r12
movl %eax, %edx
addq $0x28, %r14
cmpq %rdx, %r12
jb 0x1fff
movq -0x30(%rbp), %rax
movl (%rax), %r12d
leaq 0x40(%rax), %rdi
callq 0x1180
testl %eax, %eax
je 0x21a9
movl $0xc, %edi
xorl %esi, %esi
xorl %eax, %eax
callq 0x10f0
cmpq %rax, -0x58(%rbp)
jne 0x2433
movq -0x98(%rbp), %rax
movq -0x30(%rbp), %rcx
leaq (%rcx,%rax), %rdx
addq %rax, %rcx
addq $0x10, %rcx
movq -0x10(%rcx), %rax
movq %rax, -0x60(%rbp)
movq %rcx, -0x70(%rbp)
movq -0x8(%rcx), %rax
movq %rdx, -0x38(%rbp)
movq %rax, -0x48(%rbp)
leaq (%rdx,%rax,8), %rcx
addq $0x18, %rcx
movl $0xffffffff, %eax       # imm = 0xFFFFFFFF
incl %eax
cmpq $0x0, (%rcx,%rax,8)
jne 0x2124
movq %rax, -0x68(%rbp)
cmpq $0x0, -0x88(%rbp)
movq %rcx, -0x58(%rbp)
je 0x2384
movq -0x68(%rbp), %rax
incl %eax
movq -0x48(%rbp), %rdx
leaq (,%rdx,8), %rcx
movl %eax, %eax
movq %rax, -0x80(%rbp)
leaq (%rcx,%rax,8), %rbx
addq $0x8, %rbx
testq %rdx, %rdx
je 0x2231
movq -0x38(%rbp), %r15
subq -0x60(%rbp), %r15
addq $0x8, %r15
movl $0x2, %r14d
movq -0x48(%rbp), %r12
movq -0x38(%rbp), %rax
movq (%rax,%r14,8), %rdi
addq %r15, %rdi
callq 0x1070
addq %rax, %rbx
incq %rbx
leal -0x1(%r14), %eax
incq %r14
cmpq %rax, %r12
ja 0x2182
jmp 0x2235
subq $-0x80, %r12
movl -0x38(%rbp), %edi
movq -0x30(%rbp), %rsi
movq %r12, %rdx
callq 0x1060
cmpq %r12, %rax
jne 0x2205
movl -0x38(%rbp), %edi
callq 0x10b0
movq -0x48(%rbp), %rdi
movl $0x1c0, %esi            # imm = 0x1C0
callq 0x1140
movl $0x1, %r15d
cmpq $0x0, -0x88(%rbp)
je 0x1c76
xorps %xmm0, %xmm0
movq -0x88(%rbp), %rax
movups %xmm0, (%rax)
movq $0x0, 0x10(%rax)
jmp 0x1c76
movl -0x38(%rbp), %edi
callq 0x10b0
jmp 0x1c76
leaq 0xee3(%rip), %rdi       # 0x30fc
leaq 0xdfe(%rip), %rsi       # 0x301e
leaq 0xedf(%rip), %rcx       # 0x3106
movl $0x19a, %edx            # imm = 0x19A
callq 0x10a0
movq -0x48(%rbp), %r12
leaq 0x8(,%r12,8), %rax
movq %rax, -0x90(%rbp)
shlq $0x3, -0x80(%rbp)
movq -0x68(%rbp), %rax
movl %eax, %ecx
movq %rcx, -0x78(%rbp)
testl %eax, %eax
je 0x228b
movq -0x38(%rbp), %rax
subq -0x60(%rbp), %rax
addq $0x8, %rax
movq %rax, -0x50(%rbp)
xorl %r14d, %r14d
movq -0x58(%rbp), %r12
movq -0x78(%rbp), %r15
movq (%r12,%r14,8), %rdi
addq -0x50(%rbp), %rdi
callq 0x1070
addl %eax, %ebx
incl %ebx
incq %r14
cmpq %r14, %r15
jne 0x2272
movl %ebx, %edi
callq 0x2452
movq -0x90(%rbp), %rsi
addq %rax, %rsi
addq %rsi, -0x80(%rbp)
movq -0x88(%rbp), %rcx
movq -0x48(%rbp), %rdx
movl %edx, (%rcx)
movq %rax, 0x8(%rcx)
movq %rsi, 0x10(%rcx)
testq %rdx, %rdx
je 0x2322
movq -0x38(%rbp), %rax
subq -0x60(%rbp), %rax
addq $0x8, %rax
movq %rax, -0x50(%rbp)
movl $0x1, %r15d
xorl %ebx, %ebx
movq -0x80(%rbp), %r14
movq -0x70(%rbp), %rax
movq (%rax,%rbx,8), %r12
addq -0x50(%rbp), %r12
movq %r12, %rdi
callq 0x1070
movq %rax, %rcx
movq -0x88(%rbp), %rax
movq 0x8(%rax), %rax
movq %r14, (%rax,%rbx,8)
leaq 0x1(%rcx), %rdx
movq %rcx, %rbx
movq %r14, %rdi
movq %r12, %rsi
callq 0x1110
addq %rbx, %r14
incq %r14
movl %r15d, %ebx
incl %r15d
cmpq %rbx, -0x48(%rbp)
ja 0x22d6
jmp 0x2326
movq -0x80(%rbp), %r14
cmpl $0x0, -0x68(%rbp)
je 0x2384
movq -0x38(%rbp), %rax
subq -0x60(%rbp), %rax
addq $0x8, %rax
movq %rax, -0x48(%rbp)
xorl %r15d, %r15d
movq -0x58(%rbp), %rax
movq (%rax,%r15,8), %rbx
addq -0x48(%rbp), %rbx
movq %rbx, %rdi
callq 0x1070
movq %rax, %r12
movq -0x88(%rbp), %rax
movq 0x10(%rax), %rax
movq %r14, (%rax,%r15,8)
leaq 0x1(%r12), %rdx
movq %r14, %rdi
movq %rbx, %rsi
callq 0x1110
addq %r12, %r14
incq %r14
incq %r15
cmpq %r15, -0x78(%rbp)
jne 0x233f
movq -0x68(%rbp), %rax
decl %eax
movq -0x58(%rbp), %rcx
movq (%rcx,%rax,8), %rax
movq -0x38(%rbp), %r14
movq %r14, %rcx
subq -0x60(%rbp), %rcx
leaq (%rcx,%rax), %rbx
leaq (%rcx,%rax), %rdi
addq $0x8, %rdi
callq 0x1070
leaq (%rax,%rbx), %rsi
addq $0x1007, %rsi           # imm = 0x1007
andq $-0x1000, %rsi          # imm = 0xF000
subq %r14, %rsi
movq %r14, %rdi
callq 0x1130
xorl %r15d, %r15d
movb $0x1, %r14b
jmp 0x1c79
leaq 0xd6c(%rip), %rdi       # 0x3149
leaq 0xc3a(%rip), %rsi       # 0x301e
leaq 0xd1b(%rip), %rcx       # 0x3106
movl $0x20e, %edx            # imm = 0x20E
callq 0x10a0
leaq 0xdb2(%rip), %rdi       # 0x31ae
leaq 0xc1b(%rip), %rsi       # 0x301e
leaq 0xdb0(%rip), %rcx       # 0x31ba
movl $0x28a, %edx            # imm = 0x28A
callq 0x10a0
leaq 0xdd7(%rip), %rdi       # 0x31f2
leaq 0xbfc(%rip), %rsi       # 0x301e
leaq 0xd91(%rip), %rcx       # 0x31ba
movl $0x28b, %edx            # imm = 0x28B
callq 0x10a0
leaq 0xc3d(%rip), %rdi       # 0x3077
leaq 0xbdd(%rip), %rsi       # 0x301e
leaq 0xc3d(%rip), %rcx       # 0x3085
movl $0x30c, %edx            # imm = 0x30C
callq 0x10a0