// File: /workspace/github_c_makefile_star2_O0/jogolden[P]ps4flashtool/southbridge.c
// Function: decrypt_decompress_eap_kernel
int decrypt_decompress_eap_kernel(unsigned char *eapkernel, unsigned int eaplength, unsigned char **data, unsigned int *length) {
    struct eap_kernel_storage_hdr *shdr = (struct eap_kernel_storage_hdr *)eapkernel;
    struct eap_kernel_hdr *hdr;
    unsigned char *ptr, *output;
    unsigned int len, outlen;

    if(shdr->magic != EAP_KERNEL_STORAGE_HEADER_MAGIC) {
        printf("error: invalid EAP kernel storage header magic\n");
        return 1;
    }

    ptr = (unsigned char *)malloc(eaplength);
    if(!ptr) {
        printf("error: could not allocate memory for EAP kernel\n");
        return 1;
    }

    memcpy(ptr, eapkernel, eaplength);

    memset(random_seeds, 0, sizeof(random_seeds));
    init_eap_keys();

    // decrypt
    len = 512 - 0x2C;
    len -= len % 0x10;
    aes128_cbc_decrypt(eap_keys[1], ptr + 0x2C, ptr + 0x2C, len, shdr->iv);
    hdr = (struct eap_kernel_hdr *)(ptr + 0x2C);

    if(hdr->magic != EAP_KERNEL_HEADER_MAGIC) {
        printf("error: invalid EAP kernel header magic\n");
        return 1;
    }

    // decrypt
    len = hdr->length;
    len -= hdr->length % 0x10;
    aes128_cbc_decrypt(eap_keys[1], ptr + 0x2C, ptr + 0x2C, len, shdr->iv);

    printf("warning: EAP kernel decryption and decompression will remove the decompressor part of the EAP kernel loading\n");

    // decompress
    output = (unsigned char *)malloc(len);
    outlen = len;
    do {
        outlen *= 2; // resize buffer
        output = realloc(output, outlen);
        len = arzl_decompress(output, outlen, ptr + 0x1D30, NULL);
    } while (len == 0x80560201); // out of space

    arzl_deobfuscate(output, len, 2);

    free(ptr);

    if(data) {
        *data = output;
    } else {
        free(output);
    }

    if(length) {
        *length = len;
    }

    return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x50, %rsp
movq %rdi, -0x10(%rbp)
movl %esi, -0x14(%rbp)
movq %rdx, -0x20(%rbp)
movq %rcx, -0x28(%rbp)
movq -0x10(%rbp), %rax
movq %rax, -0x30(%rbp)
movq -0x30(%rbp), %rax
cmpl $0x12ebc95c, (%rax)     # imm = 0x12EBC95C
je 0xaf75
leaq 0x26ea(%rip), %rdi      # 0xd64c
movb $0x0, %al
callq 0x2080
movl $0x1, -0x4(%rbp)
jmp 0xb138
movl -0x14(%rbp), %eax
movl %eax, %edi
callq 0x2100
movq %rax, -0x40(%rbp)
cmpq $0x0, -0x40(%rbp)
jne 0xafa4
leaq 0x26eb(%rip), %rdi      # 0xd67c
movb $0x0, %al
callq 0x2080
movl $0x1, -0x4(%rbp)
jmp 0xb138
movq -0x40(%rbp), %rdi
movq -0x10(%rbp), %rsi
movl -0x14(%rbp), %eax
movl %eax, %edx
callq 0x20f0
leaq 0x5443(%rip), %rdi      # 0x10400
xorl %esi, %esi
movl $0x9c4, %edx            # imm = 0x9C4
callq 0x20a0
callq 0xacc0
movl $0x1d4, -0x4c(%rbp)     # imm = 0x1D4
movl -0x4c(%rbp), %ecx
andl $0xf, %ecx
movl -0x4c(%rbp), %eax
subl %ecx, %eax
movl %eax, -0x4c(%rbp)
movq -0x40(%rbp), %rsi
addq $0x2c, %rsi
movq -0x40(%rbp), %rdx
addq $0x2c, %rdx
movl -0x4c(%rbp), %ecx
movq -0x30(%rbp), %r8
addq $0x8, %r8
leaq 0x537b(%rip), %rdi      # 0x10380
addq $0x10, %rdi
callq 0x3a50
movq -0x40(%rbp), %rax
addq $0x2c, %rax
movq %rax, -0x38(%rbp)
movq -0x38(%rbp), %rax
cmpl $0x4b726e00, (%rax)     # imm = 0x4B726E00
je 0xb040
leaq 0x2680(%rip), %rdi      # 0xd6ad
movb $0x0, %al
callq 0x2080
movl $0x1, -0x4(%rbp)
jmp 0xb138
movq -0x38(%rbp), %rax
movl 0x4(%rax), %eax
movl %eax, -0x4c(%rbp)
movq -0x38(%rbp), %rax
movl 0x4(%rax), %ecx
andl $0xf, %ecx
movl -0x4c(%rbp), %eax
subl %ecx, %eax
movl %eax, -0x4c(%rbp)
movq -0x40(%rbp), %rsi
addq $0x2c, %rsi
movq -0x40(%rbp), %rdx
addq $0x2c, %rdx
movl -0x4c(%rbp), %ecx
movq -0x30(%rbp), %r8
addq $0x8, %r8
leaq 0x5302(%rip), %rdi      # 0x10380
addq $0x10, %rdi
callq 0x3a50
leaq 0x2647(%rip), %rdi      # 0xd6d5
movb $0x0, %al
callq 0x2080
movl -0x4c(%rbp), %eax
movl %eax, %edi
callq 0x2100
movq %rax, -0x48(%rbp)
movl -0x4c(%rbp), %eax
movl %eax, -0x50(%rbp)
movl -0x50(%rbp), %eax
shll %eax
movl %eax, -0x50(%rbp)
movq -0x48(%rbp), %rdi
movl -0x50(%rbp), %eax
movl %eax, %esi
callq 0x2120
movq %rax, -0x48(%rbp)
movq -0x48(%rbp), %rdi
movl -0x50(%rbp), %esi
movq -0x40(%rbp), %rdx
addq $0x1d30, %rdx           # imm = 0x1D30
xorl %eax, %eax
movl %eax, %ecx
callq 0x3bb0
movl %eax, -0x4c(%rbp)
cmpl $0x80560201, -0x4c(%rbp) # imm = 0x80560201
je 0xb0a9
movq -0x48(%rbp), %rdi
movl -0x4c(%rbp), %esi
movl $0x2, %edx
callq 0x5190
movq -0x40(%rbp), %rdi
callq 0x2030
cmpq $0x0, -0x20(%rbp)
je 0xb118
movq -0x48(%rbp), %rcx
movq -0x20(%rbp), %rax
movq %rcx, (%rax)
jmp 0xb121
movq -0x48(%rbp), %rdi
callq 0x2030
cmpq $0x0, -0x28(%rbp)
je 0xb131
movl -0x4c(%rbp), %ecx
movq -0x28(%rbp), %rax
movl %ecx, (%rax)
movl $0x0, -0x4(%rbp)
movl -0x4(%rbp), %eax
addq $0x50, %rsp
popq %rbp
retq