// File: NKUSec[P]Rethinking-Honeywords/atk.cpp
// Function: attack(char*, char*, int, int)
void attack(char* cracknum_file, char* res_file, int THRESHOLD_X, int THRESHOLD_WRONG)
{
	FILE* fout = fopen(res_file, "w");
	FILE* fcrack = fopen(cracknum_file, "w");
	while (wrong_cnt < THRESHOLD_WRONG && !heap.empty())
	{
		Account tmpNode = heap.top();
		heap.pop();
		int line = tmpNode.line;
		int line_pos = tmpNode.pos[tmpNode.pivot];
		bool hit = tmpNode.hit[tmpNode.pivot];

		for (int i = acnt[line].pivot+1; i < THRESHOLD_X; i++)
			acnt[line].p[i] *= acnt[line].sum;
		acnt[line].sum = acnt[line].p[acnt[line].pivot]*acnt[line].sum;
		if (acnt[line].sum == 0)
		{
			acnt[line].sum = THRESHOLD_K - acnt[line].pivot - 1;
			for (int i = acnt[line].pivot+1; i < THRESHOLD_X; i++) 
				acnt[line].p[i] = THRESHOLD_K - acnt[line].pivot - 2;
		}
		for (int i = acnt[line].pivot+1; i < THRESHOLD_X; i++)
			acnt[line].p[i] /= acnt[line].sum;
		if (hit)
		{
			hit_cnt++;
			fprintf(fout, "%d\t%d\t%d\t%g\n", hit_cnt, line, line_pos, acnt[line].p[acnt[line].pivot]);
		}
		else
		{
			wrong_cnt++;
			fprintf(fout, "%d\t%d\t%d\t%g\n", hit_cnt, line, line_pos, acnt[line].p[acnt[line].pivot]);
			fprintf(fcrack, "%d\n", hit_cnt);
			acnt[line].pivot++;
			if (acnt[line].pivot < THRESHOLD_X)
			{
				heap.push(acnt[line]);
			}
		}
		if (wrong_cnt % 10000 == 0) printf("wrong attempts: %d\n", wrong_cnt);
	}
	fclose(fout);
	fclose(fcrack);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x160, %rsp            # imm = 0x160
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movl %edx, -0x14(%rbp)
movl %ecx, -0x18(%rbp)
movq -0x10(%rbp), %rdi
leaq 0x232a(%rip), %rsi      # 0x401e
callq 0x1160
movq %rax, -0x20(%rbp)
movq -0x8(%rbp), %rdi
leaq 0x2316(%rip), %rsi      # 0x401e
callq 0x1160
movq %rax, -0x28(%rbp)
movl 0x542d(%rip), %ecx      # 0x7144
xorl %eax, %eax
cmpl -0x18(%rbp), %ecx
movb %al, -0x159(%rbp)
jge 0x1d38
leaq 0x53e5(%rip), %rdi      # 0x7110
callq 0x2530
xorb $-0x1, %al
movb %al, -0x159(%rbp)
movb -0x159(%rbp), %al
testb $0x1, %al
jne 0x1d47
jmp 0x21e7
leaq 0x53c2(%rip), %rdi      # 0x7110
callq 0x2550
movq %rax, %rsi
leaq -0x140(%rbp), %rdi
movl $0x118, %edx            # imm = 0x118
callq 0x10d0
leaq 0x53a2(%rip), %rdi      # 0x7110
callq 0x2570
movl -0x2c(%rbp), %eax
movl %eax, -0x144(%rbp)
movslq -0x30(%rbp), %rax
movl -0xa0(%rbp,%rax,4), %eax
movl %eax, -0x148(%rbp)
movslq -0x30(%rbp), %rax
movb -0x50(%rbp,%rax), %al
andb $0x1, %al
movb %al, -0x149(%rbp)
movq 0x538c(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movl 0x110(%rax), %eax
addl $0x1, %eax
movl %eax, -0x150(%rbp)
movl -0x150(%rbp), %eax
cmpl -0x14(%rbp), %eax
jge 0x1e29
movq 0x535a(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movsd 0x108(%rax), %xmm0
movq 0x533a(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movslq -0x150(%rbp), %rcx
mulsd (%rax,%rcx,8), %xmm0
movsd %xmm0, (%rax,%rcx,8)
movl -0x150(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x150(%rbp)
jmp 0x1dc4
movq 0x5300(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movq 0x52e8(%rip), %rcx      # 0x7130
movslq -0x144(%rbp), %rdx
imulq $0x118, %rdx, %rdx      # imm = 0x118
addq %rdx, %rcx
movslq 0x110(%rcx), %rcx
movsd (%rax,%rcx,8), %xmm0
movq 0x52c4(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
mulsd 0x108(%rax), %xmm0
movq 0x52a4(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movsd %xmm0, 0x108(%rax)
movq 0x5284(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movsd 0x108(%rax), %xmm0
xorps %xmm1, %xmm1
ucomisd %xmm1, %xmm0
jne 0x1fb5
jp 0x1fb5
movq 0x5251(%rip), %rcx      # 0x7130
movslq -0x144(%rbp), %rax
imulq $0x118, %rax, %rax      # imm = 0x118
addq %rax, %rcx
movl $0x14, %eax
subl 0x110(%rcx), %eax
subl $0x1, %eax
cvtsi2sd %eax, %xmm0
movq 0x5227(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movsd %xmm0, 0x108(%rax)
movq 0x5207(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movl 0x110(%rax), %eax
addl $0x1, %eax
movl %eax, -0x154(%rbp)
movl -0x154(%rbp), %eax
cmpl -0x14(%rbp), %eax
jge 0x1fb3
movq 0x51d5(%rip), %rcx      # 0x7130
movslq -0x144(%rbp), %rax
imulq $0x118, %rax, %rax      # imm = 0x118
addq %rax, %rcx
movl $0x14, %eax
subl 0x110(%rcx), %eax
subl $0x2, %eax
cvtsi2sd %eax, %xmm0
movq 0x51ab(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movslq -0x154(%rbp), %rcx
movsd %xmm0, (%rax,%rcx,8)
movl -0x154(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x154(%rbp)
jmp 0x1f49
jmp 0x1fb5
movq 0x5174(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movl 0x110(%rax), %eax
addl $0x1, %eax
movl %eax, -0x158(%rbp)
movl -0x158(%rbp), %eax
cmpl -0x14(%rbp), %eax
jge 0x2045
movq 0x5142(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movsd 0x108(%rax), %xmm1
movq 0x5122(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movslq -0x158(%rbp), %rcx
movsd (%rax,%rcx,8), %xmm0
divsd %xmm1, %xmm0
movsd %xmm0, (%rax,%rcx,8)
movl -0x158(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x158(%rbp)
jmp 0x1fdc
testb $0x1, -0x149(%rbp)
je 0x20c3
movl 0x50ec(%rip), %eax      # 0x7140
addl $0x1, %eax
movl %eax, 0x50e3(%rip)      # 0x7140
movq -0x20(%rbp), %rdi
movl 0x50d9(%rip), %edx      # 0x7140
movl -0x144(%rbp), %ecx
movl -0x148(%rbp), %r8d
movq 0x50b5(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rsi
imulq $0x118, %rsi, %rsi      # imm = 0x118
addq %rsi, %rax
movq 0x509d(%rip), %rsi      # 0x7130
movslq -0x144(%rbp), %r9
imulq $0x118, %r9, %r9        # imm = 0x118
addq %r9, %rsi
movslq 0x110(%rsi), %rsi
movsd (%rax,%rsi,8), %xmm0
leaq 0x1f69(%rip), %rsi      # 0x4020
movb $0x1, %al
callq 0x1180
jmp 0x21bb
movl 0x507b(%rip), %eax      # 0x7144
addl $0x1, %eax
movl %eax, 0x5072(%rip)      # 0x7144
movq -0x20(%rbp), %rdi
movl 0x5064(%rip), %edx      # 0x7140
movl -0x144(%rbp), %ecx
movl -0x148(%rbp), %r8d
movq 0x5040(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rsi
imulq $0x118, %rsi, %rsi      # imm = 0x118
addq %rsi, %rax
movq 0x5028(%rip), %rsi      # 0x7130
movslq -0x144(%rbp), %r9
imulq $0x118, %r9, %r9        # imm = 0x118
addq %r9, %rsi
movslq 0x110(%rsi), %rsi
movsd (%rax,%rsi,8), %xmm0
leaq 0x1ef4(%rip), %rsi      # 0x4020
movb $0x1, %al
callq 0x1180
movq -0x28(%rbp), %rdi
movl 0x5003(%rip), %edx      # 0x7140
leaq 0x1ef9(%rip), %rsi      # 0x403d
movb $0x0, %al
callq 0x1180
movq 0x4fde(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movl 0x110(%rax), %ecx
addl $0x1, %ecx
movl %ecx, 0x110(%rax)
movq 0x4fb7(%rip), %rax      # 0x7130
movslq -0x144(%rbp), %rcx
imulq $0x118, %rcx, %rcx      # imm = 0x118
addq %rcx, %rax
movl 0x110(%rax), %eax
cmpl -0x14(%rbp), %eax
jge 0x21b9
movq 0x4f94(%rip), %rsi      # 0x7130
movslq -0x144(%rbp), %rax
imulq $0x118, %rax, %rax      # imm = 0x118
addq %rax, %rsi
leaq 0x4f5c(%rip), %rdi      # 0x7110
callq 0x24e0
jmp 0x21bb
movl 0x4f83(%rip), %eax      # 0x7144
movl $0x2710, %ecx           # imm = 0x2710
cltd
idivl %ecx
cmpl $0x0, %edx
jne 0x21e2
movl 0x4f70(%rip), %esi      # 0x7144
leaq 0x1e52(%rip), %rdi      # 0x402d
movb $0x0, %al
callq 0x1040
jmp 0x1d11
movq -0x20(%rbp), %rdi
callq 0x1130
movq -0x28(%rbp), %rdi
callq 0x1130
addq $0x160, %rsp            # imm = 0x160
popq %rbp
retq
nopw %cs:(%rax,%rax)