// File: cgvwzq[P]aes_bf/src/aes-brute-force.cpp
// Function: main
int main (int argc, char*argv[]) 
{
	uint8_t payload[16] = {0};
	uint8_t key[16] = {0};
	uint8_t iv[16] = {0};
	uint8_t plain_mask[16] = {0};
	uint8_t plain[16] = {0};
	uint8_t next_block[16] = {0};
	uint8_t cipher_mask[16] = {0};
	uint8_t cipher[16] = {0};

	const char *payload_str = "4D346731_435F6330_306B3133_5F465457"; // payload

	const char *key_str = "FD621FE5_A2B40253_9DFA147C_A9272778"; //  fixed on Linux 

	#ifndef PADDING
		const char *iv_str = "20202020_20202020_20202020_20202020"; // fixed on Chrome
		const char *plain_mask_str = "A0A0A0A0_A0A0A0A0_A0A0A0A0_A0A0A0A0A0"; // bit mask for valid chars
		const char *plain_str = "20202020_20202020_20202020_20202020"; // valid ascii chars
	#else
		const char *iv_str = "7B007D00_2A007B00_2D002D00_3A002800";
		const char *plain_mask_str = "A0A0A0A0_A0A0A0A0_A0A0A0A0_A0A0A0A0FF"; // bit mask for valid chars + padding
		const char *plain_str = "20202020_20202020_20202020_20202001"; // valid ascii chars + padding
	#endif

	const char *cipher_mask_str = "FFFFFFFF_FFFFFFFF_FFFFFFFF_FFFFFFFF"; // try all chars
	const char *cipher_str = "00000000_00000000_00000000_00000000"; 
	const char *next_block_str = "00000000_00000000_00000000_00000000"; 

	char buf[8][1024] = {0};

	memcpy (buf[0], payload_str, MIN(strlen (payload_str), 1024));
	memcpy (buf[1], key_str, MIN(strlen (key_str), 1024));
	memcpy (buf[2], iv_str, MIN(strlen (iv_str), 1024));
	memcpy (buf[3], plain_mask_str, MIN(strlen (plain_mask_str), 1024));
	memcpy (buf[4], plain_str, MIN(strlen (plain_str), 1024));
	memcpy (buf[5], next_block_str, MIN(strlen (next_block_str), 1024));
	memcpy (buf[6], cipher_mask_str, MIN(strlen (cipher_mask_str), 1024));
	memcpy (buf[7], cipher_str, MIN(strlen (cipher_str), 1024));

	if (0 != aes128_self_test())
	{
		std::cerr << "ERROR: AES-NI self test failed" << std::endl;
		exit(-1);
    }

    unsigned int len;
    len = user_hexstr_to_bytes (payload, 16, buf[0], strlen (buf[0]) + 1);
	assert (16 == len);
    len = user_hexstr_to_bytes (key, 16, buf[1], strlen (buf[1]) + 1);
	assert (16 == len);
    len = user_hexstr_to_bytes (iv, 16, buf[2], strlen (buf[2]) + 1);
	assert (16 == len);
    len = user_hexstr_to_bytes (plain_mask, 16, buf[3], strlen (buf[3]) + 1);
	assert (16 == len);
    len = user_hexstr_to_bytes (plain, 16, buf[4], strlen (buf[4]) + 1);
	assert (16 == len);
    len = user_hexstr_to_bytes (next_block, 16, buf[5], strlen (buf[5]) + 1);
	assert (16 == len);
    len = user_hexstr_to_bytes (cipher_mask, 16, buf[6], strlen (buf[6]) + 1);
	assert (16 == len);
    len = user_hexstr_to_bytes (cipher, 16, buf[7], strlen (buf[7]) + 1);
	assert (16 == len);

	__m128i key_schedule[20] = {0};
	aes128_load_key (key, key_schedule);
	#ifndef PADDING
		aes128_dec (key_schedule, payload, next_block); 
	#endif

	unsigned int n_threads = std::thread::hardware_concurrency ();
	//if (0 == n_threads)
	if (true) // debug
	{
		n_threads = 1;
	}

	std::cout << "[+] INFO: " << n_threads << " concurrent threads supported in hardware." << std::endl << std::endl;
	std::cout << "[+] Search parameters:\t" << std::endl << std::endl;
	std::cout << "\t- n_threads:\t" << n_threads << std::endl;
	println_128 ("\t- payload:\t", payload);
	println_128 ("\t- key:\t\t", key);
	println_128 ("\t- iv:\t\t", iv);
    println_128 ("\t- plain_mask:\t", plain_mask);
    println_128 ("\t- plain:\t", plain);
	#ifndef PADDING
		// start from valid ciphertext
		aes_brute_force::initial_ciphertext (cipher, next_block);
	#endif
    println_128 ("\t- cipher:\t", cipher);
    println_128 ("\t- next_block:\t", next_block);
	std::cout << std::endl;

	std::cout << "[+] Dividing work in jobs..." << std::endl << std::endl;
	voffset_t v;
	aes_brute_force::mask_to_offsets (cipher_mask, next_block, &v);
	uint8_t jobs_cipher_mask[16];
	memcpy (jobs_cipher_mask, cipher_mask, 16);

	if (1 == v.n_offsets)
	{
		n_threads = 1;
		std::cout << "[+] INFO: n_threads set to 1 because n_offsets=1" << std::endl;
	}
	if (1 != n_threads)
	{
		jobs_cipher_mask[v.offsets[0]] = 0; //fix this key byte at the job level.
	}
	std::vector<std::thread *> threads (n_threads);
	std::vector<aes_brute_force *> jobs (n_threads);
	aes_brute_force::reset ();

	int n_ciphers_per_thread = (n_threads == 1) ? 0 : ((v.n_valid_chars + n_threads - 1) / n_threads);
	unsigned int nbits = 0;
	for (unsigned int i=v.n_valid_chars; i; i = i >> 1, nbits++);

	unsigned int jobs_cnt = 0;
	for (unsigned int thread_i=0; thread_i < n_threads; thread_i++)
	{
		cipher[v.offsets[0]] = v.valid_chars[0][jobs_cnt++];
		jobs.at(thread_i) = new aes_brute_force (jobs_cipher_mask, cipher, key, iv, plain_mask, plain, next_block);
		printf ("\tthread_%d: %d jobs ", thread_i, n_ciphers_per_thread);
		print_128 ("(mask : ", jobs_cipher_mask, ")\n");
		for (int i=0; i < n_ciphers_per_thread-1; i++)
		{
			cipher[v.offsets[0]] = v.valid_chars[0][jobs_cnt++];
			jobs.at(thread_i)->push(cipher);
		}
	}
	// TODO: calculate entropy from given masks
	std::cout  << std::endl << "\tlaunching " << (v.n_offsets * nbits) << " bits search" << std::endl;
	std::chrono::steady_clock::time_point t1 = std::chrono::steady_clock::now();
	for (unsigned int thread_i=0; thread_i < n_threads; thread_i++)
	{
		threads.at(thread_i) = new std::thread(&aes_brute_force::compute, jobs.at(thread_i));
	}

	bool found = false;
	uint64_t loop_cnt = 0;
	int winner = -1;
	for (unsigned int thread_i=0; thread_i < n_threads; thread_i++)
	{
		threads.at(thread_i)->join();
		if (jobs.at(thread_i)->found)
		{
			found = true;
			winner = thread_i;
			memcpy (cipher, jobs.at(thread_i)->valid_cipher, 16);

		}
		loop_cnt += jobs.at(thread_i)->loop_cnt;
	}
	std::chrono::steady_clock::time_point t2 = std::chrono::steady_clock::now();
	std::cout << std::endl;
	if (found)
	{
		std::cout << "[+] Thread " << winner << " claims to have found a valid ciphertext" << std::endl;
        println_128 ("[+] CIPHER FOUND: ", cipher);
    }
	else
	{
        std::cout << "[!] No valid cipher could be found." << std::endl;
    }
	std::cout << std::endl << "[+] Performances:" << std::endl;
    std::cout << "\t" << std::dec << loop_cnt << " AES128 operations done in ";
    std::chrono::duration<double> time_span = std::chrono::duration_cast<std::chrono::duration<double>>(t2 - t1);
    std::cout << time_span.count() << "s" << std::endl;

	if (!loop_cnt)
	{
		return 1;
	}

    uint64_t ns = std::chrono::duration_cast<std::chrono::nanoseconds>(t2-t1).count();
    unsigned int aes_op_duration_ns = ns / loop_cnt;

    std::cout << "\t" << aes_op_duration_ns << " ns per AES128 operation" <<std::endl;
    uint64_t ciphers_per_sec = loop_cnt / time_span.count();
	if (ciphers_per_sec > 1000000)
	{
		std::cout << "\t" << std::fixed << std::setprecision(2) << ciphers_per_sec/1000000.0 << " million ciphers per second" << std::endl;
	}
	else
	{
		std::cout << "\t" << ciphers_per_sec << " cipers per second" << std::endl;
	}
	if (found)
	{
		uint8_t dec[16] = {0};
		char txt[17] = {0}; 
		__m128i key_schedule[20] = {0};
		aes128_load_key (key, key_schedule);
		aes128_dec (key_schedule, cipher, dec); 
		for (unsigned int i=0; i < 16; i++) {
			dec[i] ^= iv[i]; // IV
		}
		memcpy (txt, dec, 16);
		println_128 ("[+] Ciphertext: ", cipher);
		println_128 ("[+] Plaintext: ", dec);
		printf("\tascii: %s (length=%zu)\n", txt, strlen(txt));
		#ifndef PADDING
			char txt2[17] = {0};
			println_128 ("[+] Next block: ", next_block);
			for (unsigned int i=0; i < 16; i++) {
				next_block[i] ^= cipher[i]; 
			}
			memcpy (txt2, next_block, 16);
			println_128 ("[+] Next block XOR cipher: ", next_block);
			printf("\tascii: %s (length=%zu)\n", txt2, strlen(txt2));
		#endif
	}

    return 0;
}

// Assembly:
subq $0x37c8, %rsp           # imm = 0x37C8
movl $0x0, 0x37c4(%rsp)
movl %edi, 0x37c0(%rsp)
movq %rsi, 0x37b8(%rsp)
leaq 0x37a0(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20d0
leaq 0x3790(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20d0
leaq 0x3780(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20d0
leaq 0x3770(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20d0
leaq 0x3760(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20d0
leaq 0x3750(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20d0
leaq 0x3740(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20d0
leaq 0x3730(%rsp), %rdi
xorl %esi, %esi
movl $0x10, %edx
callq 0x20d0
leaq 0x5805(%rip), %rax      # 0x803d
movq %rax, 0x3728(%rsp)
leaq 0x581a(%rip), %rax      # 0x8061
movq %rax, 0x3720(%rsp)
leaq 0x582f(%rip), %rax      # 0x8085
movq %rax, 0x3718(%rsp)
leaq 0x5844(%rip), %rax      # 0x80a9
movq %rax, 0x3710(%rsp)
leaq 0x585b(%rip), %rax      # 0x80cf
movq %rax, 0x3708(%rsp)
leaq 0x5870(%rip), %rax      # 0x80f3
movq %rax, 0x3700(%rsp)
leaq 0x5885(%rip), %rax      # 0x8117
movq %rax, 0x36f8(%rsp)
leaq 0x5876(%rip), %rax      # 0x8117
movq %rax, 0x36f0(%rsp)
leaq 0x16f0(%rsp), %rdi
xorl %esi, %esi
movl $0x2000, %edx           # imm = 0x2000
callq 0x20d0
leaq 0x16f0(%rsp), %rax
movq %rax, 0x2e8(%rsp)
movq 0x3728(%rsp), %rax
movq %rax, 0x2f0(%rsp)
movq 0x3728(%rsp), %rdi
callq 0x20a0
cmpq $0x400, %rax            # imm = 0x400
jae 0x2909
movq 0x3728(%rsp), %rdi
callq 0x20a0
movq %rax, 0x2e0(%rsp)
jmp 0x2918
movl $0x400, %eax            # imm = 0x400
movq %rax, 0x2e0(%rsp)
jmp 0x2918
movq 0x2f0(%rsp), %rsi
movq 0x2e8(%rsp), %rdi
movq 0x2e0(%rsp), %rdx
callq 0x2100
leaq 0x16f0(%rsp), %rax
addq $0x400, %rax            # imm = 0x400
movq %rax, 0x2d0(%rsp)
movq 0x3720(%rsp), %rax
movq %rax, 0x2d8(%rsp)
movq 0x3720(%rsp), %rdi
callq 0x20a0
cmpq $0x400, %rax            # imm = 0x400
jae 0x2987
movq 0x3720(%rsp), %rdi
callq 0x20a0
movq %rax, 0x2c8(%rsp)
jmp 0x2996
movl $0x400, %eax            # imm = 0x400
movq %rax, 0x2c8(%rsp)
jmp 0x2996
movq 0x2d8(%rsp), %rsi
movq 0x2d0(%rsp), %rdi
movq 0x2c8(%rsp), %rdx
callq 0x2100
leaq 0x16f0(%rsp), %rax
addq $0x800, %rax            # imm = 0x800
movq %rax, 0x2b8(%rsp)
movq 0x3718(%rsp), %rax
movq %rax, 0x2c0(%rsp)
movq 0x3718(%rsp), %rdi
callq 0x20a0
cmpq $0x400, %rax            # imm = 0x400
jae 0x2a05
movq 0x3718(%rsp), %rdi
callq 0x20a0
movq %rax, 0x2b0(%rsp)
jmp 0x2a14
movl $0x400, %eax            # imm = 0x400
movq %rax, 0x2b0(%rsp)
jmp 0x2a14
movq 0x2c0(%rsp), %rsi
movq 0x2b8(%rsp), %rdi
movq 0x2b0(%rsp), %rdx
callq 0x2100
leaq 0x16f0(%rsp), %rax
addq $0xc00, %rax            # imm = 0xC00
movq %rax, 0x2a0(%rsp)
movq 0x3710(%rsp), %rax
movq %rax, 0x2a8(%rsp)
movq 0x3710(%rsp), %rdi
callq 0x20a0
cmpq $0x400, %rax            # imm = 0x400
jae 0x2a83
movq 0x3710(%rsp), %rdi
callq 0x20a0
movq %rax, 0x298(%rsp)
jmp 0x2a92
movl $0x400, %eax            # imm = 0x400
movq %rax, 0x298(%rsp)
jmp 0x2a92
movq 0x2a8(%rsp), %rsi
movq 0x2a0(%rsp), %rdi
movq 0x298(%rsp), %rdx
callq 0x2100
leaq 0x16f0(%rsp), %rax
addq $0x1000, %rax           # imm = 0x1000
movq %rax, 0x288(%rsp)
movq 0x3708(%rsp), %rax
movq %rax, 0x290(%rsp)
movq 0x3708(%rsp), %rdi
callq 0x20a0
cmpq $0x400, %rax            # imm = 0x400
jae 0x2b01
movq 0x3708(%rsp), %rdi
callq 0x20a0
movq %rax, 0x280(%rsp)
jmp 0x2b10
movl $0x400, %eax            # imm = 0x400
movq %rax, 0x280(%rsp)
jmp 0x2b10
movq 0x290(%rsp), %rsi
movq 0x288(%rsp), %rdi
movq 0x280(%rsp), %rdx
callq 0x2100
leaq 0x16f0(%rsp), %rax
addq $0x1400, %rax           # imm = 0x1400
movq %rax, 0x270(%rsp)
movq 0x36f0(%rsp), %rax
movq %rax, 0x278(%rsp)
movq 0x36f0(%rsp), %rdi
callq 0x20a0
cmpq $0x400, %rax            # imm = 0x400
jae 0x2b7f
movq 0x36f0(%rsp), %rdi
callq 0x20a0
movq %rax, 0x268(%rsp)
jmp 0x2b8e
movl $0x400, %eax            # imm = 0x400
movq %rax, 0x268(%rsp)
jmp 0x2b8e
movq 0x278(%rsp), %rsi
movq 0x270(%rsp), %rdi
movq 0x268(%rsp), %rdx
callq 0x2100
leaq 0x16f0(%rsp), %rax
addq $0x1800, %rax           # imm = 0x1800
movq %rax, 0x258(%rsp)
movq 0x3700(%rsp), %rax
movq %rax, 0x260(%rsp)
movq 0x3700(%rsp), %rdi
callq 0x20a0
cmpq $0x400, %rax            # imm = 0x400
jae 0x2bfd
movq 0x3700(%rsp), %rdi
callq 0x20a0
movq %rax, 0x250(%rsp)
jmp 0x2c0c
movl $0x400, %eax            # imm = 0x400
movq %rax, 0x250(%rsp)
jmp 0x2c0c
movq 0x260(%rsp), %rsi
movq 0x258(%rsp), %rdi
movq 0x250(%rsp), %rdx
callq 0x2100
leaq 0x16f0(%rsp), %rax
addq $0x1c00, %rax           # imm = 0x1C00
movq %rax, 0x240(%rsp)
movq 0x36f8(%rsp), %rax
movq %rax, 0x248(%rsp)
movq 0x36f8(%rsp), %rdi
callq 0x20a0
cmpq $0x400, %rax            # imm = 0x400
jae 0x2c7b
movq 0x36f8(%rsp), %rdi
callq 0x20a0
movq %rax, 0x238(%rsp)
jmp 0x2c8a
movl $0x400, %eax            # imm = 0x400
movq %rax, 0x238(%rsp)
jmp 0x2c8a
movq 0x248(%rsp), %rsi
movq 0x240(%rsp), %rdi
movq 0x238(%rsp), %rdx
callq 0x2100
callq 0x4120
movl %eax, %ecx
xorl %eax, %eax
cmpl %ecx, %eax
je 0x2ce0
movq 0x9335(%rip), %rdi      # 0xbff0
leaq 0x5479(%rip), %rsi      # 0x813b
callq 0x2140
movq %rax, %rdi
movq 0x92e7(%rip), %rsi      # 0xbfb8
callq 0x2160
movl $0xffffffff, %edi       # imm = 0xFFFFFFFF
callq 0x2170
leaq 0x37a0(%rsp), %rax
movq %rax, 0x228(%rsp)
leaq 0x16f0(%rsp), %rax
movq %rax, 0x230(%rsp)
leaq 0x16f0(%rsp), %rdi
callq 0x20a0
movq 0x228(%rsp), %rdi
movq 0x230(%rsp), %rdx
movq %rax, %rcx
addq $0x1, %rcx
movl $0x10, %esi
callq 0x26f0
movl %eax, 0x16ec(%rsp)
movl $0x10, %eax
cmpl 0x16ec(%rsp), %eax
jne 0x2d45
jmp 0x2d64
leaq 0x540e(%rip), %rdi      # 0x815a
leaq 0x5411(%rip), %rsi      # 0x8164
movl $0x1b0, %edx            # imm = 0x1B0
leaq 0x541d(%rip), %rcx      # 0x817c
callq 0x20e0
leaq 0x3790(%rsp), %rax
movq %rax, 0x218(%rsp)
leaq 0x16f0(%rsp), %rax
addq $0x400, %rax            # imm = 0x400
movq %rax, 0x220(%rsp)
leaq 0x16f0(%rsp), %rdi
addq $0x400, %rdi            # imm = 0x400
callq 0x20a0
movq 0x218(%rsp), %rdi
movq 0x220(%rsp), %rdx
movq %rax, %rcx
addq $0x1, %rcx
movl $0x10, %esi
callq 0x26f0
movl %eax, 0x16ec(%rsp)
movl $0x10, %eax
cmpl 0x16ec(%rsp), %eax
jne 0x2dd6
jmp 0x2df5
leaq 0x537d(%rip), %rdi      # 0x815a
leaq 0x5380(%rip), %rsi      # 0x8164
movl $0x1b2, %edx            # imm = 0x1B2
leaq 0x538c(%rip), %rcx      # 0x817c
callq 0x20e0
leaq 0x3780(%rsp), %rax
movq %rax, 0x208(%rsp)
leaq 0x16f0(%rsp), %rax
addq $0x800, %rax            # imm = 0x800
movq %rax, 0x210(%rsp)
leaq 0x16f0(%rsp), %rdi
addq $0x800, %rdi            # imm = 0x800
callq 0x20a0
movq 0x208(%rsp), %rdi
movq 0x210(%rsp), %rdx
movq %rax, %rcx
addq $0x1, %rcx
movl $0x10, %esi
callq 0x26f0
movl %eax, 0x16ec(%rsp)
movl $0x10, %eax
cmpl 0x16ec(%rsp), %eax
jne 0x2e67
jmp 0x2e86
leaq 0x52ec(%rip), %rdi      # 0x815a
leaq 0x52ef(%rip), %rsi      # 0x8164
movl $0x1b4, %edx            # imm = 0x1B4
leaq 0x52fb(%rip), %rcx      # 0x817c
callq 0x20e0
leaq 0x3770(%rsp), %rax
movq %rax, 0x1f8(%rsp)
leaq 0x16f0(%rsp), %rax
addq $0xc00, %rax            # imm = 0xC00
movq %rax, 0x200(%rsp)
leaq 0x16f0(%rsp), %rdi
addq $0xc00, %rdi            # imm = 0xC00
callq 0x20a0
movq 0x1f8(%rsp), %rdi
movq 0x200(%rsp), %rdx
movq %rax, %rcx
addq $0x1, %rcx
movl $0x10, %esi
callq 0x26f0
movl %eax, 0x16ec(%rsp)
movl $0x10, %eax
cmpl 0x16ec(%rsp), %eax
jne 0x2ef8
jmp 0x2f17
leaq 0x525b(%rip), %rdi      # 0x815a
leaq 0x525e(%rip), %rsi      # 0x8164
movl $0x1b6, %edx            # imm = 0x1B6
leaq 0x526a(%rip), %rcx      # 0x817c
callq 0x20e0
leaq 0x3760(%rsp), %rax
movq %rax, 0x1e8(%rsp)
leaq 0x16f0(%rsp), %rax
addq $0x1000, %rax           # imm = 0x1000
movq %rax, 0x1f0(%rsp)
leaq 0x16f0(%rsp), %rdi
addq $0x1000, %rdi           # imm = 0x1000
callq 0x20a0
movq 0x1e8(%rsp), %rdi
movq 0x1f0(%rsp), %rdx
movq %rax, %rcx
addq $0x1, %rcx
movl $0x10, %esi
callq 0x26f0
movl %eax, 0x16ec(%rsp)
movl $0x10, %eax
cmpl 0x16ec(%rsp), %eax
jne 0x2f89
jmp 0x2fa8
leaq 0x51ca(%rip), %rdi      # 0x815a
leaq 0x51cd(%rip), %rsi      # 0x8164
movl $0x1b8, %edx            # imm = 0x1B8
leaq 0x51d9(%rip), %rcx      # 0x817c
callq 0x20e0
leaq 0x3750(%rsp), %rax
movq %rax, 0x1d8(%rsp)
leaq 0x16f0(%rsp), %rax
addq $0x1400, %rax           # imm = 0x1400
movq %rax, 0x1e0(%rsp)
leaq 0x16f0(%rsp), %rdi
addq $0x1400, %rdi           # imm = 0x1400
callq 0x20a0
movq 0x1d8(%rsp), %rdi
movq 0x1e0(%rsp), %rdx
movq %rax, %rcx
addq $0x1, %rcx
movl $0x10, %esi
callq 0x26f0
movl %eax, 0x16ec(%rsp)
movl $0x10, %eax
cmpl 0x16ec(%rsp), %eax
jne 0x301a
jmp 0x3039
leaq 0x5139(%rip), %rdi      # 0x815a
leaq 0x513c(%rip), %rsi      # 0x8164
movl $0x1ba, %edx            # imm = 0x1BA
leaq 0x5148(%rip), %rcx      # 0x817c
callq 0x20e0
leaq 0x3740(%rsp), %rax
movq %rax, 0x1c8(%rsp)
leaq 0x16f0(%rsp), %rax
addq $0x1800, %rax           # imm = 0x1800
movq %rax, 0x1d0(%rsp)
leaq 0x16f0(%rsp), %rdi
addq $0x1800, %rdi           # imm = 0x1800
callq 0x20a0
movq 0x1c8(%rsp), %rdi
movq 0x1d0(%rsp), %rdx
movq %rax, %rcx
addq $0x1, %rcx
movl $0x10, %esi
callq 0x26f0
movl %eax, 0x16ec(%rsp)
movl $0x10, %eax
cmpl 0x16ec(%rsp), %eax
jne 0x30ab
jmp 0x30ca
leaq 0x50a8(%rip), %rdi      # 0x815a
leaq 0x50ab(%rip), %rsi      # 0x8164
movl $0x1bc, %edx            # imm = 0x1BC
leaq 0x50b7(%rip), %rcx      # 0x817c
callq 0x20e0
leaq 0x3730(%rsp), %rax
movq %rax, 0x1b8(%rsp)
leaq 0x16f0(%rsp), %rax
addq $0x1c00, %rax           # imm = 0x1C00
movq %rax, 0x1c0(%rsp)
leaq 0x16f0(%rsp), %rdi
addq $0x1c00, %rdi           # imm = 0x1C00
callq 0x20a0
movq 0x1b8(%rsp), %rdi
movq 0x1c0(%rsp), %rdx
movq %rax, %rcx
addq $0x1, %rcx
movl $0x10, %esi
callq 0x26f0
movl %eax, 0x16ec(%rsp)
movl $0x10, %eax
cmpl 0x16ec(%rsp), %eax
jne 0x313c
jmp 0x315b
leaq 0x5017(%rip), %rdi      # 0x815a
leaq 0x501a(%rip), %rsi      # 0x8164
movl $0x1be, %edx            # imm = 0x1BE
leaq 0x5026(%rip), %rcx      # 0x817c
callq 0x20e0
leaq 0x15a0(%rsp), %rdi
xorl %esi, %esi
movl $0x140, %edx            # imm = 0x140
callq 0x20d0
leaq 0x3790(%rsp), %rdi
leaq 0x15a0(%rsp), %rsi
callq 0x4250
callq 0x21a0
movl %eax, 0x159c(%rsp)
movl $0x1, 0x159c(%rsp)
movq 0x8e2e(%rip), %rdi      # 0xbfd0
leaq 0x4fea(%rip), %rsi      # 0x8193
callq 0x2140
movq %rax, %rdi
movl 0x159c(%rsp), %esi
callq 0x2190
movq %rax, %rdi
leaq 0x4fd7(%rip), %rsi      # 0x819e
callq 0x2140
movq %rax, %rdi
movq 0x8de2(%rip), %rsi      # 0xbfb8
callq 0x2160
movq %rax, %rdi
movq 0x8dd3(%rip), %rsi      # 0xbfb8
callq 0x2160
movq 0x8ddf(%rip), %rdi      # 0xbfd0
leaq 0x4fd1(%rip), %rsi      # 0x81c9
callq 0x2140
movq %rax, %rdi
movq 0x8db1(%rip), %rsi      # 0xbfb8
callq 0x2160
movq %rax, %rdi
movq 0x8da2(%rip), %rsi      # 0xbfb8
callq 0x2160
movq 0x8dae(%rip), %rdi      # 0xbfd0
leaq 0x4fb8(%rip), %rsi      # 0x81e1
callq 0x2140
movq %rax, %rdi
movl 0x159c(%rsp), %esi
callq 0x2190
movq %rax, %rdi
movq 0x8d71(%rip), %rsi      # 0xbfb8
callq 0x2160
leaq 0x37a0(%rsp), %rsi
leaq 0x4f95(%rip), %rdi      # 0x81f0
callq 0x43e0
leaq 0x3790(%rsp), %rsi
leaq 0x4f8e(%rip), %rdi      # 0x81fd
callq 0x43e0
leaq 0x3780(%rsp), %rsi
leaq 0x4f84(%rip), %rdi      # 0x8207
callq 0x43e0
leaq 0x3770(%rsp), %rsi
leaq 0x4f79(%rip), %rdi      # 0x8210
callq 0x43e0
leaq 0x3760(%rsp), %rsi
leaq 0x4f75(%rip), %rdi      # 0x8220
callq 0x43e0
leaq 0x3730(%rsp), %rsi
leaq 0x4f6c(%rip), %rdi      # 0x822b
callq 0x43e0
leaq 0x3750(%rsp), %rsi
leaq 0x4f64(%rip), %rdi      # 0x8237
callq 0x43e0
movq 0x8cf1(%rip), %rdi      # 0xbfd0
movq 0x8cd2(%rip), %rsi      # 0xbfb8
callq 0x2160
movq 0x8cde(%rip), %rdi      # 0xbfd0
leaq 0x4f4e(%rip), %rsi      # 0x8247
callq 0x2140
movq %rax, %rdi
movq 0x8cb0(%rip), %rsi      # 0xbfb8
callq 0x2160
movq %rax, %rdi
movq 0x8ca1(%rip), %rsi      # 0xbfb8
callq 0x2160
leaq 0x3740(%rsp), %rdi
leaq 0x3750(%rsp), %rsi
leaq 0x57a(%rsp), %rdx
callq 0x4dc0
movq 0x3740(%rsp), %rax
movq %rax, 0x560(%rsp)
movq 0x3748(%rsp), %rax
movq %rax, 0x568(%rsp)
movzbl 0x58a(%rsp), %ecx
movl $0x1, %eax
cmpl %ecx, %eax
jne 0x3397
movl $0x1, 0x159c(%rsp)
movq 0x8c54(%rip), %rdi      # 0xbfd0
leaq 0x4ee1(%rip), %rsi      # 0x8264
callq 0x2140
movq %rax, %rdi
movq 0x8c26(%rip), %rsi      # 0xbfb8
callq 0x2160
movl $0x1, %eax
cmpl 0x159c(%rsp), %eax
je 0x33b5
movzbl 0x57a(%rsp), %eax
movb $0x0, 0x560(%rsp,%rax)
movl 0x159c(%rsp), %eax
movq %rax, 0x1a8(%rsp)
leaq 0x547(%rsp), %rdi
movq %rdi, 0x1b0(%rsp)
callq 0x4ee0
movq 0x1a8(%rsp), %rsi
movq 0x1b0(%rsp), %rdx
leaq 0x548(%rsp), %rdi
callq 0x4ef0
jmp 0x33f8
leaq 0x547(%rsp), %rdi
callq 0x4f70
movl 0x159c(%rsp), %eax
movq %rax, 0x198(%rsp)
leaq 0x517(%rsp), %rdi
movq %rdi, 0x1a0(%rsp)
callq 0x4f80
movq 0x198(%rsp), %rsi
movq 0x1a0(%rsp), %rdx
leaq 0x518(%rsp), %rdi
callq 0x4f90
jmp 0x3448
leaq 0x517(%rsp), %rdi
callq 0x5010
callq 0x5020
jmp 0x345c
cmpl $0x1, 0x159c(%rsp)
jne 0x3471
xorl %eax, %eax
movl %eax, 0x194(%rsp)
jmp 0x3493
movzbl 0x158b(%rsp), %eax
addl 0x159c(%rsp), %eax
subl $0x1, %eax
xorl %edx, %edx
divl 0x159c(%rsp)
movl %eax, 0x194(%rsp)
movl 0x194(%rsp), %eax
movl %eax, 0x510(%rsp)
movl $0x0, 0x50c(%rsp)
movzbl 0x158b(%rsp), %eax
movl %eax, 0x508(%rsp)
cmpl $0x0, 0x508(%rsp)
je 0x3553
jmp 0x34cb
movl 0x508(%rsp), %eax
shrl %eax
movl %eax, 0x508(%rsp)
movl 0x50c(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x50c(%rsp)
jmp 0x34bb
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x538(%rsp)
movl %eax, 0x534(%rsp)
leaq 0x547(%rsp), %rdi
callq 0x4f70
jmp 0x4104
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x538(%rsp)
movl %eax, 0x534(%rsp)
leaq 0x517(%rsp), %rdi
callq 0x5010
jmp 0x40f7
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x538(%rsp)
movl %eax, 0x534(%rsp)
jmp 0x40ea
movl $0x0, 0x504(%rsp)
movl $0x0, 0x500(%rsp)
movl 0x500(%rsp), %eax
cmpl 0x159c(%rsp), %eax
jae 0x3754
movl 0x504(%rsp), %eax
movl %eax, %ecx
incl %ecx
movl %ecx, 0x504(%rsp)
movb 0x58b(%rsp,%rax), %cl
movzbl 0x57a(%rsp), %eax
movb %cl, 0x3730(%rsp,%rax)
movl $0x10c8, %edi           # imm = 0x10C8
callq 0x2150
movq %rax, 0x188(%rsp)
jmp 0x35b9
movq 0x188(%rsp), %rdi
movq %rsp, %rax
leaq 0x3750(%rsp), %rcx
movq %rcx, 0x8(%rax)
leaq 0x3760(%rsp), %rcx
movq %rcx, (%rax)
leaq 0x560(%rsp), %rsi
leaq 0x3730(%rsp), %rdx
leaq 0x3790(%rsp), %rcx
leaq 0x3780(%rsp), %r8
leaq 0x3770(%rsp), %r9
callq 0x5030
jmp 0x360a
movl 0x500(%rsp), %eax
movl %eax, %esi
leaq 0x518(%rsp), %rdi
callq 0x5150
movq %rax, 0x180(%rsp)
jmp 0x362a
movq 0x180(%rsp), %rax
movq 0x188(%rsp), %rcx
movq %rcx, (%rax)
movl 0x500(%rsp), %esi
movl 0x510(%rsp), %edx
leaq 0x4c43(%rip), %rdi      # 0x8295
xorl %eax, %eax
callq 0x2030
jmp 0x365b
leaq 0x4c48(%rip), %rdi      # 0x82aa
leaq 0x4d7c(%rip), %rdx      # 0x83e5
leaq 0x560(%rsp), %rsi
callq 0x4410
jmp 0x3678
movl $0x0, 0x4fc(%rsp)
movl 0x4fc(%rsp), %eax
movl 0x510(%rsp), %ecx
subl $0x1, %ecx
cmpl %ecx, %eax
jge 0x373c
movl 0x504(%rsp), %eax
movl %eax, %ecx
incl %ecx
movl %ecx, 0x504(%rsp)
movb 0x58b(%rsp,%rax), %cl
movzbl 0x57a(%rsp), %eax
movb %cl, 0x3730(%rsp,%rax)
movl 0x500(%rsp), %eax
movl %eax, %esi
leaq 0x518(%rsp), %rdi
callq 0x5150
movq %rax, 0x178(%rsp)
jmp 0x36e4
movq 0x178(%rsp), %rax
movq (%rax), %rdi
leaq 0x3730(%rsp), %rsi
callq 0x5190
jmp 0x36fe
jmp 0x3700
movl 0x4fc(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x4fc(%rsp)
jmp 0x3683
movq 0x188(%rsp), %rdi
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x538(%rsp)
movl %eax, 0x534(%rsp)
callq 0x2130
jmp 0x40ea
jmp 0x373e
movl 0x500(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x500(%rsp)
jmp 0x3569
movq 0x8875(%rip), %rdi      # 0xbfd0
movq 0x8856(%rip), %rsi      # 0xbfb8
callq 0x2160
movq %rax, 0x170(%rsp)
jmp 0x3771
movq 0x170(%rsp), %rdi
leaq 0x4b33(%rip), %rsi      # 0x82b3
callq 0x2140
movq %rax, 0x168(%rsp)
jmp 0x378f
movq 0x168(%rsp), %rdi
movzbl 0x58a(%rsp), %esi
movl 0x50c(%rsp), %eax
imull %eax, %esi
callq 0x2190
movq %rax, 0x160(%rsp)
jmp 0x37b8
movq 0x160(%rsp), %rdi
leaq 0x4af8(%rip), %rsi      # 0x82bf
callq 0x2140
movq %rax, 0x158(%rsp)
jmp 0x37d6
movq 0x158(%rsp), %rdi
movq 0x87d3(%rip), %rsi      # 0xbfb8
callq 0x2160
jmp 0x37ec
callq 0x2180
movq %rax, 0x4f0(%rsp)
movl $0x0, 0x4ec(%rsp)
movl 0x4ec(%rsp), %eax
cmpl 0x159c(%rsp), %eax
jae 0x38f5
movl $0x8, %edi
callq 0x2150
movq %rax, 0x150(%rsp)
jmp 0x382c
leaq 0x199d(%rip), %rax      # 0x51d0
movq %rax, 0x4d8(%rsp)
movq $0x0, 0x4e0(%rsp)
movl 0x4ec(%rsp), %eax
movl %eax, %esi
leaq 0x518(%rsp), %rdi
callq 0x5150
movq %rax, 0x148(%rsp)
jmp 0x3867
movq 0x148(%rsp), %rdx
movq 0x150(%rsp), %rdi
leaq 0x4d8(%rsp), %rsi
callq 0x5380
jmp 0x3886
movl 0x4ec(%rsp), %eax
movl %eax, %esi
leaq 0x548(%rsp), %rdi
callq 0x5450
movq %rax, 0x140(%rsp)
jmp 0x38a6
movq 0x140(%rsp), %rax
movq 0x150(%rsp), %rcx
movq %rcx, (%rax)
movl 0x4ec(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x4ec(%rsp)
jmp 0x3804
movq 0x150(%rsp), %rdi
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x538(%rsp)
movl %eax, 0x534(%rsp)
callq 0x2130
jmp 0x40ea
movb $0x0, 0x4d7(%rsp)
movq $0x0, 0x4c8(%rsp)
movl $0xffffffff, 0x4c4(%rsp) # imm = 0xFFFFFFFF
movl $0x0, 0x4c0(%rsp)
movl 0x4c0(%rsp), %eax
cmpl 0x159c(%rsp), %eax
jae 0x3a58
movl 0x4c0(%rsp), %eax
movl %eax, %esi
leaq 0x548(%rsp), %rdi
callq 0x5450
movq %rax, 0x138(%rsp)
jmp 0x3953
movq 0x138(%rsp), %rax
movq (%rax), %rdi
callq 0x21f0
jmp 0x3965
movl 0x4c0(%rsp), %eax
movl %eax, %esi
leaq 0x518(%rsp), %rdi
callq 0x5150
movq %rax, 0x130(%rsp)
jmp 0x3985
movq 0x130(%rsp), %rax
movq (%rax), %rax
testb $0x1, 0x8(%rax)
je 0x3a04
movb $0x1, 0x4d7(%rsp)
movl 0x4c0(%rsp), %eax
movl %eax, 0x4c4(%rsp)
leaq 0x3730(%rsp), %rax
movq %rax, 0x120(%rsp)
movl 0x4c0(%rsp), %eax
movl %eax, %esi
leaq 0x518(%rsp), %rdi
callq 0x5150
movq %rax, 0x128(%rsp)
jmp 0x39dc
movq 0x120(%rsp), %rax
movq 0x128(%rsp), %rcx
movq (%rcx), %rcx
movq 0x1030(%rcx), %rdx
movq %rdx, (%rax)
movq 0x1038(%rcx), %rcx
movq %rcx, 0x8(%rax)
movl 0x4c0(%rsp), %eax
movl %eax, %esi
leaq 0x518(%rsp), %rdi
callq 0x5150
movq %rax, 0x118(%rsp)
jmp 0x3a24
movq 0x118(%rsp), %rax
movq (%rax), %rax
movq (%rax), %rax
addq 0x4c8(%rsp), %rax
movq %rax, 0x4c8(%rsp)
movl 0x4c0(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x4c0(%rsp)
jmp 0x391f
callq 0x2180
movq %rax, 0x4b8(%rsp)
movq 0x8564(%rip), %rdi      # 0xbfd0
movq 0x8545(%rip), %rsi      # 0xbfb8
callq 0x2160
jmp 0x3a7a
testb $0x1, 0x4d7(%rsp)
je 0x3b0f
movq 0x8541(%rip), %rdi      # 0xbfd0
leaq 0x4836(%rip), %rsi      # 0x82cc
callq 0x2140
movq %rax, 0x110(%rsp)
jmp 0x3aa5
movq 0x110(%rsp), %rdi
movl 0x4c4(%rsp), %esi
callq 0x2200
movq %rax, 0x108(%rsp)
jmp 0x3ac3
movq 0x108(%rsp), %rdi
leaq 0x4806(%rip), %rsi      # 0x82d8
callq 0x2140
movq %rax, 0x100(%rsp)
jmp 0x3ae1
movq 0x100(%rsp), %rdi
movq 0x84c8(%rip), %rsi      # 0xbfb8
callq 0x2160
jmp 0x3af7
leaq 0x4803(%rip), %rdi      # 0x8301
leaq 0x3730(%rsp), %rsi
callq 0x43e0
jmp 0x3b0d
jmp 0x3b44
movq 0x84ba(%rip), %rdi      # 0xbfd0
leaq 0x47f7(%rip), %rsi      # 0x8314
callq 0x2140
movq %rax, 0xf8(%rsp)
jmp 0x3b2c
movq 0xf8(%rsp), %rdi
movq 0x847d(%rip), %rsi      # 0xbfb8
callq 0x2160
jmp 0x3b42
jmp 0x3b44
movq 0x8485(%rip), %rdi      # 0xbfd0
movq 0x8466(%rip), %rsi      # 0xbfb8
callq 0x2160
movq %rax, 0xf0(%rsp)
jmp 0x3b61
movq 0xf0(%rsp), %rdi
leaq 0x47c8(%rip), %rsi      # 0x8338
callq 0x2140
movq %rax, 0xe8(%rsp)
jmp 0x3b7f
movq 0xe8(%rsp), %rdi
movq 0x842a(%rip), %rsi      # 0xbfb8
callq 0x2160
jmp 0x3b95
movq 0x8434(%rip), %rdi      # 0xbfd0
leaq 0x466b(%rip), %rsi      # 0x820e
callq 0x2140
movq %rax, 0xe0(%rsp)
jmp 0x3bb2
movq 0xe0(%rsp), %rdi
leaq 0x18cf(%rip), %rsi      # 0x5490
callq 0x2070
movq %rax, 0xd8(%rsp)
jmp 0x3bd0
movq 0xd8(%rsp), %rdi
movq 0x4c8(%rsp), %rsi
callq 0x2050
movq %rax, 0xd0(%rsp)
jmp 0x3bef
movq 0xd0(%rsp), %rdi
leaq 0x474c(%rip), %rsi      # 0x834a
callq 0x2140
jmp 0x3c05
leaq 0x4b8(%rsp), %rdi
leaq 0x4f0(%rsp), %rsi
callq 0x54e0
movq %rax, 0xc8(%rsp)
jmp 0x3c24
movq 0xc8(%rsp), %rax
movq %rax, 0x4a8(%rsp)
leaq 0x4a8(%rsp), %rdi
callq 0x54b0
vmovsd %xmm0, 0xc0(%rsp)
jmp 0x3c4c
vmovsd 0xc0(%rsp), %xmm0
vmovsd %xmm0, 0x4b0(%rsp)
leaq 0x4b0(%rsp), %rdi
callq 0x5530
vmovsd %xmm0, 0xb8(%rsp)
jmp 0x3c76
vmovsd 0xb8(%rsp), %xmm0
movq 0x834a(%rip), %rdi      # 0xbfd0
callq 0x2230
movq %rax, 0xb0(%rsp)
jmp 0x3c95
movq 0xb0(%rsp), %rdi
leaq 0x4765(%rip), %rsi      # 0x8409
callq 0x2140
movq %rax, 0xa8(%rsp)
jmp 0x3cb3
movq 0xa8(%rsp), %rdi
movq 0x82f6(%rip), %rsi      # 0xbfb8
callq 0x2160
jmp 0x3cc9
cmpq $0x0, 0x4c8(%rsp)
jne 0x3cef
movl $0x1, 0x37c4(%rsp)
movl $0x1, 0x4a4(%rsp)
jmp 0x40c1
leaq 0x4b8(%rsp), %rdi
leaq 0x4f0(%rsp), %rsi
callq 0x54e0
movq %rax, 0xa0(%rsp)
jmp 0x3d0e
movq 0xa0(%rsp), %rax
movq %rax, 0x488(%rsp)
leaq 0x488(%rsp), %rdi
callq 0x5540
movq %rax, 0x98(%rsp)
jmp 0x3d35
movq 0x98(%rsp), %rax
movq %rax, 0x490(%rsp)
leaq 0x490(%rsp), %rdi
callq 0x5570
movq %rax, 0x90(%rsp)
jmp 0x3d5c
movq 0x90(%rsp), %rax
movq %rax, 0x498(%rsp)
movq 0x498(%rsp), %rax
movq 0x4c8(%rsp), %rcx
xorl %edx, %edx
divq %rcx
movl %eax, 0x484(%rsp)
movq 0x8241(%rip), %rdi      # 0xbfd0
leaq 0x4478(%rip), %rsi      # 0x820e
callq 0x2140
movq %rax, 0x88(%rsp)
jmp 0x3da5
movq 0x88(%rsp), %rdi
movl 0x484(%rsp), %esi
callq 0x2190
movq %rax, 0x80(%rsp)
jmp 0x3dc3
movq 0x80(%rsp), %rdi
leaq 0x4594(%rip), %rsi      # 0x8366
callq 0x2140
movq %rax, 0x78(%rsp)
jmp 0x3dde
movq 0x78(%rsp), %rdi
movq 0x81ce(%rip), %rsi      # 0xbfb8
callq 0x2160
jmp 0x3df1
vcvtusi2sdq 0x4c8(%rsp), %xmm0, %xmm0
vmovsd %xmm0, 0x68(%rsp)
leaq 0x4b0(%rsp), %rdi
callq 0x5530
vmovsd %xmm0, 0x70(%rsp)
jmp 0x3e17
vmovsd 0x68(%rsp), %xmm0
vmovsd 0x70(%rsp), %xmm1
vdivsd %xmm1, %xmm0, %xmm0
vcvttsd2usi %xmm0, %rax
movq %rax, 0x478(%rsp)
cmpq $0xf4240, 0x478(%rsp) # imm = 0xF4240
jbe 0x3f01
movq 0x8182(%rip), %rdi      # 0xbfd0
leaq 0x43b9(%rip), %rsi      # 0x820e
callq 0x2140
movq %rax, 0x60(%rsp)
jmp 0x3e61
movq 0x60(%rsp), %rdi
leaq 0x1713(%rip), %rsi      # 0x5580
callq 0x2070
movq %rax, 0x58(%rsp)
jmp 0x3e79
movl $0x2, %edi
callq 0x55a0
movl %eax, 0x54(%rsp)
jmp 0x3e89
movq 0x58(%rsp), %rdi
movl 0x54(%rsp), %eax
movl %eax, 0x474(%rsp)
movl 0x474(%rsp), %esi
callq 0x21d0
movq %rax, 0x48(%rsp)
jmp 0x3eac
movq 0x48(%rsp), %rdi
vcvtusi2sdq 0x478(%rsp), %xmm0, %xmm0
vmovsd 0x4144(%rip), %xmm1     # 0x8008
vmulsd %xmm1, %xmm0, %xmm0
callq 0x2230
movq %rax, 0x40(%rsp)
jmp 0x3ed4
movq 0x40(%rsp), %rdi
leaq 0x449f(%rip), %rsi      # 0x837f
callq 0x2140
movq %rax, 0x38(%rsp)
jmp 0x3eec
movq 0x38(%rsp), %rdi
movq 0x80c0(%rip), %rsi      # 0xbfb8
callq 0x2160
jmp 0x3eff
jmp 0x3f61
movq 0x80c8(%rip), %rdi      # 0xbfd0
leaq 0x42ff(%rip), %rsi      # 0x820e
callq 0x2140
movq %rax, 0x30(%rsp)
jmp 0x3f1b
movq 0x30(%rsp), %rdi
movq 0x478(%rsp), %rsi
callq 0x2050
movq %rax, 0x28(%rsp)
jmp 0x3f34
movq 0x28(%rsp), %rdi
leaq 0x445b(%rip), %rsi      # 0x839b
callq 0x2140
movq %rax, 0x20(%rsp)
jmp 0x3f4c
movq 0x20(%rsp), %rdi
movq 0x8060(%rip), %rsi      # 0xbfb8
callq 0x2160
jmp 0x3f5f
jmp 0x3f61
testb $0x1, 0x4d7(%rsp)
je 0x40ab
vpxor %xmm0, %xmm0, %xmm0
vmovdqa %xmm0, 0x460(%rsp)
vmovdqa %xmm0, 0x440(%rsp)
movb $0x0, 0x450(%rsp)
vpxor %xmm0, %xmm0, %xmm0
vmovdqu64 %zmm0, 0x400(%rsp)
vmovdqu64 %zmm0, 0x3c0(%rsp)
vmovdqu64 %zmm0, 0x380(%rsp)
vmovdqu64 %zmm0, 0x340(%rsp)
vmovdqu64 %zmm0, 0x300(%rsp)
leaq 0x3790(%rsp), %rdi
leaq 0x300(%rsp), %rsi
vzeroupper
callq 0x4250
jmp 0x3fd3
leaq 0x300(%rsp), %rdi
leaq 0x3730(%rsp), %rsi
leaq 0x460(%rsp), %rdx
callq 0x44c0
jmp 0x3ff2
movl $0x0, 0x2fc(%rsp)
cmpl $0x10, 0x2fc(%rsp)
jae 0x4041
movl 0x2fc(%rsp), %eax
movzbl 0x3780(%rsp,%rax), %edx
movl 0x2fc(%rsp), %eax
movzbl 0x460(%rsp,%rax), %ecx
xorl %edx, %ecx
movb %cl, 0x460(%rsp,%rax)
movl 0x2fc(%rsp), %eax
addl $0x1, %eax
movl %eax, 0x2fc(%rsp)
jmp 0x3ffd
vmovdqa 0x460(%rsp), %xmm0
vmovdqa %xmm0, 0x440(%rsp)
leaq 0x4354(%rip), %rdi      # 0x83ae
leaq 0x3730(%rsp), %rsi
callq 0x43e0
jmp 0x4069
leaq 0x434f(%rip), %rdi      # 0x83bf
leaq 0x460(%rsp), %rsi
callq 0x43e0
jmp 0x407f
leaq 0x440(%rsp), %rdi
movq %rdi, 0x18(%rsp)
callq 0x20a0
movq 0x18(%rsp), %rsi
movq %rax, %rdx
leaq 0x432f(%rip), %rdi      # 0x83cf
xorl %eax, %eax
callq 0x2030
jmp 0x40a9
jmp 0x40ab
movl $0x0, 0x37c4(%rsp)
movl $0x1, 0x4a4(%rsp)
leaq 0x518(%rsp), %rdi
callq 0x55c0
leaq 0x548(%rsp), %rdi
callq 0x5620
movl 0x37c4(%rsp), %eax
addq $0x37c8, %rsp           # imm = 0x37C8
retq
leaq 0x518(%rsp), %rdi
callq 0x55c0
leaq 0x548(%rsp), %rdi
callq 0x5620
movq 0x538(%rsp), %rdi
callq 0x2220
nopw %cs:(%rax,%rax)