// File: /workspace/github_c_makefile_star2_O2/sos22[P]unexec/unexec.c
// Function: end_trampoline
static void * alloc_trampoline_text(struct trampoline *out) {
    /* We need a valid fsbase to call into libc, for the PLT, so
     * restore it from the trampoline. */
    unsigned long fsbase;
    if (arch_prctl(ARCH_GET_FS, &fsbase) < 0) return NULL;
    asm(
        "    jmp end_trampoline\n"
        "start_trampoline:\n"
        /* Set personality and disable address
         * randomisation. Randomisation affects exec behaviour, so
         * need to re-exec if we changed anything. */
        "    mov %[___NR_personality], %%rax\n"
        "set_rsi_persona_no_random:\n"
        "    movq $0x123456789, %%rdi\n"
        "    movq %%rdi, %%rbx\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "    cmpq %%rax, %%rbx\n"
        "    jne exec_self\n" /* re-exec */
        /* Set fsbase */
        "    movq %[_ARCH_SET_FS], %%rdi\n"
        "set_rsi_fsbase:\n"
        "    movq $0x123456789, %%rsi\n" /* patched to fsbase */
        "    mov %[___NR_arch_prctl], %%eax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        /* Extend trampoline with new argv and environ from stack. */
        /* First we need to find out how big the area is. */
        "    movq (%%rsp), %%rax\n" /* How many arguments do we have? */
        "    lea 16(%%rsp, %%rax, 8), %%rsi\n" /* Skip past arguments. */
        "1:  leaq 8(%%rsi), %%rsi\n" /* Skip past environment
                                      * variables until we get a NULL
                                      * pointer. */
        "    movq (%%rsi), %%rax\n"
        "    testq %%rax, %%rax\n"
        "    jnz 1b\n"
        "    movq -8(%%rsi), %%rdi\n" /* rdi is last environment var,
                                       * so walk it to the end. */
        "    xor %%al, %%al\n" /* find end of variable. */
        "    movq $-1, %%rcx\n"
        "    cld\n"
        "    repne; scasb\n" /* rdi is now end of bit of stack which
                                must be copied. */
        "    movq %%rdi, %%r15\n"
        "    movq $0xfff, %%rax\n" /* Round boundaries to pages, for
                                    * mmap */
        "    addq %%rax, %%rdi\n"
        "    notq %%rax\n"
        "    movq %%rsp, %%r14\n"
        "    andq %%rax, %%r14\n"
        "    andq %%rax, %%rdi\n"
        "    subq %%r14, %%rdi\n" /* rdi is how big an allocation we
                                   * need. */
        "    movq %%rdi, %%r14\n"
        "set_rdi_tramp_top:\n" /* ANON mmap to get space above the trampoline */
        "    movq $0x123456789, %%rdi\n"
        "    movq %%r14, %%rsi\n"
        "    movq %[READ_WRITE], %%rdx\n"
        "    movq %[PRIVATE_ANONYMOUS], %%r10\n"
        "    mov $-1, %%r8\n"
        "    mov $0, %%r9\n"
        "    mov %[___NR_mmap], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "    movq %%rax, %%r8\n"
        "    addq %%r14, %%r8\n"
        "    movq %%rsp, %%rsi\n" /* copy stack to bounce zone we just
                                   * allocated. */
        "    movq %%rsp, (%%rax)\n" /* Top of bounce zone is old rsp,
                                     * so that we can fix up relative
                                     * pointers. */
        "    leaq 8(%%rax), %%rdi\n"
        "    movq %%r15, %%rcx\n"
        "    subq %%rsp, %%rcx\n"
        "    rep; movsb\n"
        /* munmap everything above the trampoline. */
        "    movq %%r8, %%rdi\n"
        "set_rsi_kern_base:\n"
        "    movq $0x123456789, %%rsi\n" /* patched later */
        "    subq %%r8, %%rsi\n"
        "    mov %[___NR_munmap], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "set_r15_tramp:\n"
        "    movq $0x123456789, %%r15\n" /* Patched to @out later */
        "    movq %c[mappings](%%r15), %%r14\n" /* r14 is next mapping */
        "    mov %[sizeofmapping], %%eax\n"
        "    movq %c[nrmappings](%%r15), %%rbx\n"
        "    imul %%rbx, %%rax\n"
        "    addq %%r14, %%rax\n"
        "    movq %%rax, %%r13\n" /* r13 is sentinel mapping */
        "next_mapping:\n"
        "    cmpq %%r14, %%r13\n"
        "    je done_mappings\n"
        /* open the next thing to map */
        "    movq %c[offsetpath](%%r14), %%rdi\n"
        "    movq %[_O_RDONLY], %%rsi\n"
        "    movq %[___NR_open], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "    movq %%rax, %%r12\n"
        /* XXX should probably make some attempt to check the world
         * still looks like what we expect; otherwise, this'll be
         * confusing. */
        /* Now do the mmap */
        "    movq %c[offsetstart](%%r14), %%rdi\n"
        "    movq %c[offsetsize](%%r14), %%rsi\n"
        "    movq %c[offsetprot](%%r14), %%rdx\n"
        "    movq %c[offsetflags](%%r14), %%r10\n"
        "    movq %%r12, %%r8\n"
        "    movq %c[offsetoffset](%%r14), %%r9\n"
        "    testq %[_MAP_ANONYMOUS], %%r10\n"
        "    jz 1f\n" /* Zap FD anonymous maps */
        "    movq $-1, %%r8\n"
        "1:\n"
        "    movq %[___NR_mmap], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        /* Anon maps need to be pread in. */
        "    testq %[_MAP_ANONYMOUS], %c[offsetflags](%%r14)\n"
        "    jz 1f\n"
        "    movq %%r12, %%rdi\n"
        "    movq %c[offsetstart](%%r14), %%rsi\n"
        "    movq %c[offsetsize](%%r14), %%rdx\n"
        "    movq %c[offsetoffset](%%r14), %%r10\n"
        "    movq %[___NR_pread], %%rax\n"
        "    syscall\n"
        "    cmpq %%rax, %c[offsetsize](%%r14)\n"
        "    jne syscall_failed\n"
        "1:\n"
        /* close the fd */
        "    movq %%r12, %%rdi\n"
        "    movq %[___NR_close], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        /* Advance to next structure. */
        "    lea %c[sizeofmapping](%%r14), %%r14\n"
        "    jmp next_mapping\n"
        "done_mappings:\n"
        /* All mappings restored, r15 set to trampoline
         * structure. Restore call saved registers. */
        "    movq %c[stash_rbx](%%r15), %%rbx\n"
        "    movq %c[stash_rsp](%%r15), %%rsp\n"
        "    movq %c[stash_ret](%%r15), %%rsi\n"
        "    movq %%rsi, (%%rsp)\n"
        "    movq %c[stash_rbp](%%r15), %%rbp\n"
        "    movq %c[stash_r12](%%r15), %%r12\n"
        "    movq %c[stash_r13](%%r15), %%r13\n"
        "    movq %c[stash_r14](%%r15), %%r14\n"
        "    movq %c[stash_r15](%%r15), %%r15\n"
        /* save_registers() returns 1 in the new process. */
        "    mov $1, %%eax\n"
        "    ret\n"
        "syscall_failed:\n"
        "    ud2\n"
        "exec_self:\n"
        /* Have to re-run execve. stack is argc, then argv, then environ. */
        "    movq (%%rsp), %%rax\n"
        "    leaq 8(%%rsp), %%rsi\n" /* argv */
        "    leaq 8(%%rsi, %%rax, 8), %%rdx\n" /* env */
        "mov_proc_self_exe_rdi:\n"
        "    movq $0x123456778, %%rdi\n"
        "    mov %[___NR_execve], %%rax\n"
        "    syscall\n"
        "    jmp syscall_failed\n"
        "end_trampoline:\n"
        :
        : [mappings] "i" (offsetof(mappings, struct trampoline)),
          [sizeofmapping] "i" (sizeof(struct mapping)),
          [nrmappings] "i" (offsetof(nrmappings, struct trampoline)),
          [offsetpath] "i" (offsetof(path, struct mapping)),
          [offsetstart] "i" (offsetof(start, struct mapping)),
          [offsetsize] "i" (offsetof(size, struct mapping)),
          [offsetprot] "i" (offsetof(prot, struct mapping)),
          [offsetflags] "i" (offsetof(flags, struct mapping)),
          [offsetoffset] "i" (offsetof(offset, struct mapping)),
          [_O_RDONLY] "i" (O_RDONLY),
          [READ_WRITE] "i" (PROT_READ|PROT_WRITE),
          [PRIVATE_ANONYMOUS] "i" (MAP_PRIVATE|MAP_ANONYMOUS),
          [_ARCH_SET_FS] "i" (ARCH_SET_FS),
          [___NR_arch_prctl] "i" (__NR_arch_prctl),
          [___NR_close] "i" (__NR_close),
          [___NR_execve] "i" (__NR_execve),
          [___NR_mmap] "i" (__NR_mmap),
          [___NR_munmap] "i" (__NR_munmap),
          [___NR_open] "i" (__NR_open),
          [___NR_personality] "i" (__NR_personality),
          [___NR_pread] "i" (__NR_pread64),
          [stash_rbx] "i" (offsetof(stash.rbx, struct trampoline)),
          [stash_rsp] "i" (offsetof(stash.rsp, struct trampoline)),
          [stash_rbp] "i" (offsetof(stash.rbp, struct trampoline)),
          [stash_r12] "i" (offsetof(stash.r12, struct trampoline)),
          [stash_r13] "i" (offsetof(stash.r13, struct trampoline)),
          [stash_r14] "i" (offsetof(stash.r14, struct trampoline)),
          [stash_r15] "i" (offsetof(stash.r15, struct trampoline)),
          [stash_ret] "i" (offsetof(stash.ret, struct trampoline)),
          [_MAP_ANONYMOUS] "i" (MAP_ANONYMOUS)
        );
    extern const unsigned char start_trampoline[0];
    extern const unsigned char set_rsi_persona_no_random[0];
    extern const unsigned char set_rsi_fsbase[0];
    extern const unsigned char set_rdi_tramp_top[0];
    extern const unsigned char set_rsi_kern_base[0];
    extern const unsigned char set_r15_tramp[0];
    extern const unsigned char mov_proc_self_exe_rdi[0];
    extern const unsigned char end_trampoline[0];
    char * res = alloc_in_trampoline(end_trampoline - start_trampoline, out);
    memcpy(res, start_trampoline, end_trampoline - start_trampoline);
    *(unsigned long *)(res + 2 + (set_rsi_persona_no_random - start_trampoline)) =
        personality(0xffffffff) | ADDR_NO_RANDOMIZE;
    *(unsigned long *)(res + 2 + (set_rsi_fsbase - start_trampoline)) =
        (unsigned long)fsbase;
    unsigned long out_top = (unsigned long)out + out->allocated + sizeof(*out);
    *(unsigned long *)(res + 2 + (set_rdi_tramp_top - start_trampoline)) =
        out_top;
    *(unsigned long *)(res + 2 + (set_rsi_kern_base - start_trampoline)) =
        KERN_BASE;
    *(unsigned long *)(res + 2 + (set_r15_tramp - start_trampoline)) =
        (unsigned long)out;
    *(unsigned long *)(res + 2 + (mov_proc_self_exe_rdi - start_trampoline)) =
        (unsigned long)out->procselfexe;
    return res; }

// Assembly:
movq -0xa0(%rbp), %rdi
movq %rbx, %rsi
callq 0x2320
movq %rbx, %r15
movq %rax, %rbx
movq %rax, %rdi
leaq -0x22f(%rip), %rsi      # 0x1534
movq -0xa0(%rbp), %rdx
callq 0x1110
movl $0xffffffff, %edi       # imm = 0xFFFFFFFF
callq 0x1030
orl $0x40000, %eax          # imm = 0x40000
cltq
movq -0xd8(%rbp), %rcx
movq %rax, 0x2(%rcx,%rbx)
movq -0x170(%rbp), %rax
movq -0xd0(%rbp), %rcx
movq %rax, 0x2(%rcx,%rbx)
movl (%r15), %eax
leaq 0x80(%r15,%rax), %rax
movq -0xc8(%rbp), %rcx
movq %rax, 0x2(%rcx,%rbx)
movq -0xc0(%rbp), %rax
movabsq $0x7ffffffff000, %rcx   # imm = 0x7FFFFFFFF000
movq %rcx, 0x2(%rax,%rbx)
movq -0xb8(%rbp), %rax
movq %r15, 0x2(%rax,%rbx)
movq 0x28(%r15), %rax
movq -0xb0(%rbp), %rcx
movq %rax, 0x2(%rcx,%rbx)
jmp 0x17ef
movq %rbx, %r15
xorl %ebx, %ebx
movq %rbx, 0x10(%r15)
callq 0x1040
movq %rax, -0x78(%rbp)
andl $0x0, (%rax)
xorl %esi, %esi
movq %r14, %rdi
movq %r12, -0x50(%rbp)
movq %r15, %rbx
movq %r15, -0x40(%rbp)
movb (%rdi), %al
movl %esi, %ecx
testb %al, %al
je 0x1b4b
leaq 0x1(%rdi), %r13
cmpb $0xa, %al
je 0x1837
movzbl %al, %eax
testl %eax, %eax
je 0x1f8d
movb (%r13), %al
incq %r13
jmp 0x181f
movq %rcx, -0x98(%rbp)
movl %esi, -0x88(%rbp)
movb $0x0, -0x1(%r13)
leaq -0x30(%rbp), %rsi
pushq $0x10
popq %rdx
callq 0x1160
movq %rax, -0x48(%rbp)
movq -0x30(%rbp), %rdi
cmpb $0x2d, (%rdi)
jne 0x1b91
incq %rdi
movq %rdi, -0x30(%rbp)
leaq -0x30(%rbp), %rsi
pushq $0x10
popq %rdx
callq 0x1160
movq -0x30(%rbp), %rdi
cmpb $0x20, (%rdi)
jne 0x1b91
movq %rax, %r15
movzbl 0x1(%rdi), %eax
xorl %ecx, %ecx
cmpl $0x2d, %eax
je 0x18a0
cmpl $0x72, %eax
jne 0x1b91
pushq $0x1
popq %rcx
movzbl 0x2(%rdi), %eax
cmpl $0x2d, %eax
je 0x18b5
cmpl $0x77, %eax
jne 0x1b91
orl $0x2, %ecx
movzbl 0x3(%rdi), %eax
cmpl $0x2d, %eax
movl %ecx, -0x38(%rbp)
je 0x18ce
cmpl $0x78, %eax
jne 0x1b91
addl $0x4, -0x38(%rbp)
movzbl 0x4(%rdi), %eax
pushq $0x2
popq %rcx
cmpl $0x70, %eax
je 0x18e8
cmpl $0x73, %eax
jne 0x1b91
pushq $0x1
popq %rax
movl %eax, %ecx
movq %rcx, -0x58(%rbp)
cmpb $0x20, 0x5(%rdi)
jne 0x1b91
addq $0x6, %rdi
movq %rdi, -0x30(%rbp)
leaq -0x30(%rbp), %rsi
pushq $0x10
popq %rdx
callq 0x1160
movq %rax, -0xa8(%rbp)
movq -0x30(%rbp), %rdi
cmpb $0x20, (%rdi)
jne 0x1b91
incq %rdi
movq %rdi, -0x30(%rbp)
leaq -0x30(%rbp), %rsi
pushq $0x10
popq %rdx
callq 0x1160
movq -0x30(%rbp), %rdi
cmpb $0x3a, (%rdi)
jne 0x1b91
incq %rdi
movq %rdi, -0x30(%rbp)
leaq -0x30(%rbp), %rsi
pushq $0x10
popq %rdx
callq 0x1160
movq -0x30(%rbp), %rdi
cmpb $0x20, (%rdi)
jne 0x1b91
incq %rdi
movq %rdi, -0x30(%rbp)
leaq -0x30(%rbp), %rsi
pushq $0xa
popq %rdx
callq 0x1160
movq -0x30(%rbp), %r12
cmpb $0x20, (%r12)
jne 0x1b91
subq -0x48(%rbp), %r15
movb $0x20, %bl
cmpb $0x20, %bl
jne 0x1995
movb 0x1(%r12), %bl
incq %r12
jmp 0x1986
movq %r12, %rdi
leaq 0x1797(%rip), %rsi      # 0x3136
callq 0x10e0
testl %eax, %eax
je 0x1a1c
movq %r15, -0x90(%rbp)
movq %r12, %rdi
leaq 0x1788(%rip), %rsi      # 0x3141
callq 0x10e0
movq -0x58(%rbp), %rcx
leal 0x120(%rcx), %r15d
testl %eax, %eax
cmovnel %ecx, %r15d
testb %bl, %bl
setne %al
testb $0x20, %r15b
sete %cl
andb %al, %cl
cmpb $0x1, %cl
movq -0x40(%rbp), %rbx
jne 0x1aca
movq -0x78(%rbp), %rax
cmpl $0x0, (%rax)
jne 0x1b91
movq %r12, %rdi
leaq -0x170(%rbp), %rsi
callq 0x1100
testl %eax, %eax
js 0x1a2f
testb $0x1, -0x38(%rbp)
jne 0x1a48
movq -0x78(%rbp), %rax
andl $0x0, (%rax)
jmp 0x1ad3
movq -0x50(%rbp), %r12
movq -0x40(%rbp), %rbx
movl -0x88(%rbp), %esi
jmp 0x1b34
movq -0x78(%rbp), %rax
cmpl $0x2, (%rax)
jne 0x1b91
movq -0x78(%rbp), %rax
andl $0x0, (%rax)
jmp 0x1aca
movq %r12, %rdi
xorl %esi, %esi
xorl %eax, %eax
callq 0x1150
testl %eax, %eax
js 0x1b91
xorl %edi, %edi
movq -0x90(%rbp), %rsi
pushq $0x1
popq %rdx
pushq $0x2
popq %rcx
movl %eax, %r8d
movq -0xa8(%rbp), %r9
movl %eax, -0x64(%rbp)
callq 0x1080
movq %rax, -0x58(%rbp)
movl -0x64(%rbp), %edi
callq 0x10b0
movq -0x58(%rbp), %rcx
cmpq $-0x1, %rcx
je 0x1b91
movq %rcx, %rdi
movq -0x48(%rbp), %rsi
movq -0x90(%rbp), %rdx
callq 0x1120
movl %eax, -0x64(%rbp)
movq -0x58(%rbp), %rdi
movq -0x90(%rbp), %rsi
callq 0x1130
movq -0x78(%rbp), %rax
andl $0x0, (%rax)
cmpl $0x0, -0x64(%rbp)
je 0x1ad3
movq 0x28(%rbx), %rax
xorl %r8d, %r8d
jmp 0x1ae5
movq %r12, %rdi
movq %rbx, %rsi
callq 0x236d
movq -0xa8(%rbp), %r8
movl -0x88(%rbp), %esi
cmpl 0x20(%rbx), %esi
movq -0x50(%rbp), %r12
jae 0x2234
orl $0x10, %r15d
movq 0x18(%rbx), %rcx
imulq $0x28, -0x98(%rbp), %rdx
movq -0x48(%rbp), %rdi
movq %rdi, (%rcx,%rdx)
movq -0x90(%rbp), %rdi
movq %rdi, 0x8(%rcx,%rdx)
movq %r8, 0x10(%rcx,%rdx)
movl -0x38(%rbp), %edi
movl %edi, 0x18(%rcx,%rdx)
movl %r15d, 0x1c(%rcx,%rdx)
movq %rax, 0x20(%rcx,%rdx)
incl %esi
movb $0xa, -0x1(%r13)
movq %r13, %rdi
movabsq $0x300080200, %r13      # imm = 0x300080200
jmp 0x180f
movl %esi, 0x20(%rbx)
movq -0x78(%rbp), %rax
cmpl $0x0, (%rax)
jne 0x1bb5
movq %rbx, %rdi
movl 0x4(%rbx), %ebx
cmpl (%rdi), %ebx
jbe 0x1c57
movq %r12, %rsi
callq 0x1130
pushq $-0x1
popq %r8
pushq $0x3
popq %rdx
movabsq $0x1fffff000, %rax      # imm = 0x1FFFFF000
pushq $0x32
popq %rcx
jmp 0x1487
xorl %r14d, %r14d
xorl %r12d, %r12d
movq %rax, %rbx
jmp 0x1bb8
xorl %r15d, %r15d
movabsq $0x300080200, %r13      # imm = 0x300080200
movq -0x50(%rbp), %r12
jmp 0x1bb8
movq %r14, %rdi
callq 0x126e
xorl %r14d, %r14d
xorl %r12d, %r12d
pushq $-0x1
popq %rbx
xorl %r15d, %r15d
movq %r14, %rdi
callq 0x126e
cmpq $-0x1, %rbx
je 0x1bd1
movq %rbx, %rdi
movq %r12, %rsi
callq 0x1130
testb %r15b, %r15b
je 0x1c38
movq -0xe0(%rbp), %rdi
callq 0x1030
pushq $-0x1
popq %rbx
testl %eax, %eax
js 0x1c3b
pushq $-0x3f
popq %r15
leaq -0x26f8(%rbp), %r14
testq %r15, %r15
je 0x1c26
leaq 0x40(%r15), %rdi
cmpl $0x21, %edi
ja 0x1c16
movl %edi, %eax
btq %rax, %r13
jae 0x1c16
incq %r15
addq $0x98, %r14
jmp 0x1bf4
movq %r14, %rsi
xorl %edx, %edx
callq 0x1050
testl %eax, %eax
jns 0x1c0a
jmp 0x1c3b
leaq -0x188(%rbp), %rdi
xorl %esi, %esi
callq 0x1170
testl %eax, %eax
js 0x1c3b
movl -0x60(%rbp), %ebx
movl %ebx, %eax
addq $0x2768, %rsp           # imm = 0x2768
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
pushq $-0x1
popq %rbx
jmp 0x1bb8
imulq $0x28, %rcx, %rax
xorl %ecx, %ecx
movq %rdi, %rbx
pushq $0x3
popq %r8
cmpq %rcx, %rax
je 0x1c85
movq 0x18(%rbx), %rdx
movq 0x20(%rdx,%rcx), %rdx
xorl %esi, %esi
cmpq 0x28(%rbx), %rdx
sete %sil
addl %esi, %r8d
addq $0x28, %rcx
jmp 0x1c64
movl %r8d, %ecx
imulq $0x38, %rcx, %rcx
addq $0x103f, %rcx           # imm = 0x103F
andq $-0x1000, %rcx          # imm = 0xF000
xorl %edx, %edx
cmpq %rdx, %rax
je 0x1cc0
movq 0x18(%rbx), %rsi
movq 0x20(%rsi,%rdx), %rdi
cmpq 0x28(%rbx), %rdi
jne 0x1cba
movq %rcx, 0x10(%rsi,%rdx)
addq 0x8(%rsi,%rdx), %rcx
addq $0x28, %rdx
jmp 0x1c9c
movl %r8d, 0x30(%rbx)
movq %rcx, 0x38(%rbx)
callq 0x22b0
movq %rax, -0x48(%rbp)
xorl %r15d, %r15d
movq -0x80(%rbp), %rdi
movl $0x241, %esi            # imm = 0x241
movl $0x1c9, %edx            # imm = 0x1C9
xorl %eax, %eax
callq 0x1150
movq %rbx, %rcx
testl %eax, %eax
js 0x1de5
movl %eax, %ebx
xorps %xmm0, %xmm0
leaq -0x170(%rbp), %rsi
movaps %xmm0, (%rsi)
movl $0x464c457f, (%rsi)     # imm = 0x464C457F
movw $0x102, 0x4(%rsi)       # imm = 0x102
movb $0x3, 0x7(%rsi)
movabsq $0x1003e0002, %rax      # imm = 0x1003E0002
movq %rax, 0x10(%rsi)
movq 0x10(%rcx), %rax
movq %rax, 0x18(%rsi)
movq $0x40, 0x20(%rsi)
andq $0x0, 0x28(%rsi)
movabsq $0x38004000000000, %rax # imm = 0x38004000000000
movq %rax, 0x30(%rsi)
movzwl 0x30(%rcx), %eax
movw %ax, 0x38(%rsi)
movl $0x40, 0x3a(%rsi)
andw $0x0, 0x3e(%rsi)
pushq $0x40
popq %rdx
movl %ebx, %edi
callq 0x1060
cmpq $0x40, %rax
jne 0x21bd
leaq -0x160(%rbp), %r13
pushq $0x20
popq %r12
xorl %r15d, %r15d
movq -0x40(%rbp), %rdx
movl 0x20(%rdx), %eax
cmpq %rax, %r15
jae 0x1ded
movq 0x18(%rdx), %rax
movq (%rax,%r12), %rcx
cmpq 0x28(%rdx), %rcx
jne 0x1ddc
andq $0x0, -0x170(%rbp)
movq -0x10(%rax,%r12), %rcx
movq %rcx, -0x168(%rbp)
xorps %xmm0, %xmm0
movups %xmm0, (%r13)
movq -0x18(%rax,%r12), %rax
movq %rax, -0x150(%rbp)
movups %xmm0, 0x18(%r13)
movl %ebx, %edi
leaq -0x170(%rbp), %rsi
pushq $0x38
popq %rdx
callq 0x1060
cmpq $0x38, %rax
jne 0x21bd
incq %r15
addq $0x28, %r12
jmp 0x1d7a
movq %rcx, %rbx
jmp 0x1bb8
movabsq $0x500000001, %rax      # imm = 0x500000001
leaq -0x170(%rbp), %rsi
movq %rax, (%rsi)
movq 0x38(%rdx), %rax
movq %rax, 0x8(%rsi)
movq %rdx, 0x10(%rsi)
andq $0x0, 0x18(%rsi)
movl (%rdx), %eax
subq $-0x80, %rax
movq %rax, 0x20(%rsi)
movq %rax, 0x28(%rsi)
andq $0x0, 0x30(%rsi)
pushq $0x38
popq %rdx
movl %ebx, %edi
callq 0x1060
cmpq $0x38, %rax
jne 0x21bd
xorps %xmm0, %xmm0
leaq -0x170(%rbp), %rsi
movups %xmm0, 0x28(%rsi)
movups %xmm0, 0x18(%rsi)
movups %xmm0, 0x8(%rsi)
movabsq $0x46474e551, %rax      # imm = 0x46474E551
movq %rax, (%rsi)
pushq $0x38
popq %rdx
movl %ebx, %edi
callq 0x1060
cmpq $0x38, %rax
jne 0x21bd
movabsq $0x600000001, %rax      # imm = 0x600000001
leaq -0x170(%rbp), %rsi
movq %rax, (%rsi)
andq $0x0, 0x8(%rsi)
movq $-0x1000, %rax          # imm = 0xF000
movq -0x40(%rbp), %rcx
addq 0x8(%rcx), %rax
movq %rax, 0x10(%rsi)
xorps %xmm0, %xmm0
movups %xmm0, 0x18(%rsi)
movq $0x1000, 0x28(%rsi)     # imm = 0x1000
andq $0x0, 0x30(%rsi)
pushq $0x38
popq %rdx
movl %ebx, %edi
callq 0x1060
cmpq $0x38, %rax
jne 0x21bd
xorl %r15d, %r15d
xorl %r13d, %r13d
movq $0x0, -0x38(%rbp)
movq -0x40(%rbp), %rdx
movl 0x20(%rdx), %eax
cmpq %rax, %r13
jae 0x1fac
movq 0x18(%rdx), %rax
movq 0x20(%rax,%r15), %rcx
cmpq 0x28(%rdx), %rcx
jne 0x1f81
cmpq $0x0, -0x38(%rbp)
je 0x1f34
movl %ebx, %edi
xorl %esi, %esi
pushq $0x1
popq %rdx
callq 0x1090
testq %rax, %rax
js 0x21bd
cmpq -0x38(%rbp), %rax
jne 0x2253
movq -0x40(%rbp), %r12
movq 0x18(%r12), %rax
movq -0x38(%rbp), %rcx
cmpq 0x10(%rax,%r15), %rcx
je 0x1f5d
jmp 0x2272
movq 0x10(%rax,%r15), %rsi
movl %ebx, %edi
xorl %edx, %edx
callq 0x1090
testq %rax, %rax
js 0x21bd
movq -0x40(%rbp), %r12
movq 0x18(%r12), %rax
movq 0x10(%rax,%r15), %rcx
movq %rcx, -0x38(%rbp)
movq (%rax,%r15), %rsi
movq 0x8(%rax,%r15), %rdx
movl %ebx, %edi
callq 0x1060
movq 0x18(%r12), %rcx
cmpq 0x8(%rcx,%r15), %rax
jne 0x21bd
addq %rax, -0x38(%rbp)
incq %r13
addq $0x28, %r15
jmp 0x1ed2
leaq 0x1168(%rip), %rdi      # 0x30fc
leaq 0x1083(%rip), %rsi      # 0x301e
leaq 0x1164(%rip), %rcx      # 0x3106
movl $0x19a, %edx            # imm = 0x19A
callq 0x10a0
movl (%rdx), %r15d
leaq 0x40(%rdx), %rdi
callq 0x1180
testl %eax, %eax
je 0x2170
callq 0x22b0
cmpq %rax, -0x48(%rbp)
jne 0x2291
movq -0x50(%rbp), %rcx
movq -0x40(%rbp), %rdx
movq (%rdx,%rcx), %rax
movq 0x8(%rdx,%rcx), %rsi
leaq (%rdx,%rcx), %rdi
addq $0x10, %rdi
movq %rdi, -0x60(%rbp)
addq %rcx, %rdx
movq %rdx, -0x80(%rbp)
movq %rsi, -0x38(%rbp)
leaq (%rdx,%rsi,8), %rcx
addq $0x18, %rcx
pushq $-0x1
popq %rdx
incl %edx
cmpq $0x0, (%rcx,%rdx,8)
jne 0x2002
movq %rdx, -0x58(%rbp)
movq %rcx, -0x88(%rbp)
cmpq $0x0, -0x70(%rbp)
je 0x21de
movq -0x58(%rbp), %rcx
incl %ecx
movq -0x38(%rbp), %rsi
leaq (,%rsi,8), %rdx
leaq 0x8(,%rsi,8), %r13
movl %ecx, %ebx
leaq (%rdx,%rbx,8), %r15
addq $0x8, %r15
shlq $0x3, %rbx
movq -0x80(%rbp), %rcx
subq %rax, %rcx
addq $0x8, %rcx
movq %rcx, -0x48(%rbp)
xorl %eax, %eax
movl %eax, %r12d
cmpq %r12, -0x38(%rbp)
jbe 0x2081
movq -0x60(%rbp), %rax
movq (%rax,%r12,8), %rdi
addq -0x48(%rbp), %rdi
callq 0x1070
addq %rax, %r15
incq %r15
leal 0x1(%r12), %eax
jmp 0x205a
movl -0x58(%rbp), %eax
movq %rax, -0x98(%rbp)
xorl %r12d, %r12d
cmpq %r12, -0x98(%rbp)
je 0x20b6
movq -0x88(%rbp), %rax
movq (%rax,%r12,8), %rdi
addq -0x48(%rbp), %rdi
callq 0x1070
addl %eax, %r15d
incl %r15d
incq %r12
jmp 0x208e
movl %r15d, %edi
callq 0x22c1
movq -0x70(%rbp), %rcx
movq -0x38(%rbp), %rdx
movl %edx, (%rcx)
movq %rax, 0x8(%rcx)
addq %rax, %r13
movq %r13, 0x10(%rcx)
addq %rbx, %r13
xorl %eax, %eax
movl %eax, %r12d
cmpq %r12, -0x38(%rbp)
jbe 0x2120
movq -0x60(%rbp), %rax
movq (%rax,%r12,8), %rbx
addq -0x48(%rbp), %rbx
movq %rbx, %rdi
callq 0x1070
movq %rax, %r15
movq -0x70(%rbp), %rax
movq 0x8(%rax), %rax
movq %r13, (%rax,%r12,8)
leaq 0x1(%r15), %rdx
movq %r13, %rdi
movq %rbx, %rsi
callq 0x1110
addq %r15, %r13
incq %r13
leal 0x1(%r12), %eax
jmp 0x20d8
xorl %r12d, %r12d
cmpq %r12, -0x98(%rbp)
je 0x21ed
movq -0x88(%rbp), %rax
movq (%rax,%r12,8), %rbx
addq -0x48(%rbp), %rbx
movq %rbx, %rdi
callq 0x1070
movq %rax, %r15
movq -0x70(%rbp), %rax
movq 0x10(%rax), %rax
movq %r13, (%rax,%r12,8)
leaq 0x1(%r15), %rdx
movq %r13, %rdi
movq %rbx, %rsi
callq 0x1110
addq %r15, %r13
incq %r13
incq %r12
jmp 0x2123
subq $-0x80, %r15
movl %ebx, %edi
movq -0x40(%rbp), %rsi
movq %r15, %rdx
callq 0x1060
cmpq %r15, %rax
jne 0x21bd
movl %ebx, %edi
callq 0x10b0
movq -0x80(%rbp), %rdi
movl $0x1c0, %esi            # imm = 0x1C0
callq 0x1140
cmpq $0x0, -0x70(%rbp)
je 0x21b2
movq -0x70(%rbp), %rax
andq $0x0, 0x10(%rax)
xorps %xmm0, %xmm0
movups %xmm0, (%rax)
xorl %r15d, %r15d
pushq $0x1
popq %rax
movl %eax, -0x60(%rbp)
jmp 0x21c7
movl %ebx, %edi
callq 0x10b0
xorl %r15d, %r15d
movabsq $0x300080200, %r13      # imm = 0x300080200
movq -0x50(%rbp), %r12
movq -0x40(%rbp), %rbx
jmp 0x1bb8
movq -0x80(%rbp), %rcx
subq %rax, %rcx
addq $0x8, %rcx
movq %rcx, -0x48(%rbp)
movq -0x58(%rbp), %rcx
decl %ecx
movq -0x88(%rbp), %rax
movq -0x48(%rbp), %rbx
addq (%rax,%rcx,8), %rbx
movq %rbx, %rdi
callq 0x1070
leaq (%rax,%rbx), %rsi
addq $0xfff, %rsi            # imm = 0xFFF
andq $-0x1000, %rsi          # imm = 0xF000
movq -0x80(%rbp), %rdi
subq %rdi, %rsi
callq 0x1130
movl $0x0, -0x60(%rbp)
movb $0x1, %r15b
jmp 0x21c7
leaq 0xf0e(%rip), %rdi       # 0x3149
leaq 0xddc(%rip), %rsi       # 0x301e
leaq 0xebd(%rip), %rcx       # 0x3106
movl $0x20e, %edx            # imm = 0x20E
callq 0x10a0
leaq 0xf54(%rip), %rdi       # 0x31ae
leaq 0xdbd(%rip), %rsi       # 0x301e
leaq 0xf52(%rip), %rcx       # 0x31ba
movl $0x28a, %edx            # imm = 0x28A
callq 0x10a0
leaq 0xf79(%rip), %rdi       # 0x31f2
leaq 0xd9e(%rip), %rsi       # 0x301e
leaq 0xf33(%rip), %rcx       # 0x31ba
movl $0x28b, %edx            # imm = 0x28B
callq 0x10a0
leaq 0xddf(%rip), %rdi       # 0x3077
leaq 0xd7f(%rip), %rsi       # 0x301e
leaq 0xddf(%rip), %rcx       # 0x3085
movl $0x30c, %edx            # imm = 0x30C
callq 0x10a0