// File: /workspace/github_c_makefile_star2_O2/cbouilla[P]AES-attacks-finder/Search.c
// Function: RandomizedSearch
Solver RandomizedSearch(const int T, Solver *B1, const int N1, SysEqLin E)
{
	int Alloue=1000; // espace alloué pour stocker les solvers
	Solver * __restrict Candidat=malloc(Alloue*sizeof(Solver));
	int N=0;
	int v_max=0;
	int proba = 0;
	int pos=0;
	Solver * __restrict guess_probable = malloc(N1*sizeof(Solver));
	printf("Randomized Search : \n");
	unsigned int cpt=0;
	int cpt2=0;
	const int coeff_proba=200*E->gen/E->a;
	Solver tmp;
	while (1)
	{
		cpt++;
		// On génère une solver
		if (cpt2 < proba) tmp=GenerateSolver(T,guess_probable,pos,E);
		else tmp=GenerateSolver(T,B1,N1,E);
		int i=0;
		// On la teste vis à vis des autres
		while (i < N)
		{
			Solver tmp2=UnionSolverBorne(Candidat[i],tmp,E,T);
			if (tmp2!=NULL)
			{
				if (tmp2->Nvar == Candidat[i]->Nvar)
				{
					freeSolver(tmp2);
					break;
				}
				if (tmp2->Nvar == tmp->Nvar)
				{
					N--;
					freeSolver(Candidat[i]);
					Candidat[i]=Candidat[N];
					freeSolver(tmp2);
				}
				else
				{
					N--;
					freeSolver(Candidat[i]);
					Candidat[i]=Candidat[N];
					freeSolver(tmp);
					tmp=PropagateSolver2(tmp2,E,B1,N1);
					freeSolver(tmp2);
					printf("\ncollision found!! Output : %d\n",tmp->sortie);
					if (tmp->sortie<T && tmp->sortie>0)
					{
						SysEqLin F = EsachantX(tmp->var,tmp->Nvar,E);
						tmp2 = SearchAlgoLowMem(F,T-tmp->sortie);
						if (tmp2)
						{
							Solver tmp3 = NewSolver();
							tmp3->var = UnionListesTriees(tmp->var,tmp->Nvar,tmp2->var,tmp2->Nvar,&tmp3->Nvar);
							tmp3->temps = max(tmp->temps,tmp->sortie+tmp2->temps);
							tmp3->memoire = max(tmp->memoire,tmp2->memoire);
							tmp3->sortie = tmp->sortie + tmp2->sortie;
							tmp3->type = 2;
							tmp3->fils2 = tmp;
							tmp3->fils1 = tmp2;
							tmp = tmp3;
						}
						freeSysEq(F);
					}
					if (tmp->sortie>0) i=0;
					else i=N;
				}
			}
			else
			{
				//freeSolver(tmp2);
				i++;
			}
		}
		if (i==N) // c'est une nouvelle solver
		{
			if (tmp->sortie<=0) // On a probablement gagné
			{
				for (i = 0; i < N; i++) freeSolver(Candidat[i]);
				free(Candidat);
				for (i = 0; i < pos; i++) freeSolver(guess_probable[i]);
				free(guess_probable);
				printf("\n");
				return tmp;
			}
			Candidat[N++]=tmp;
			if (tmp->Nvar>=v_max) // Elle a beaucoup de variables -> elle parait interessante
			{
				/* On cherchera une partie des solvers générées dans son complémentaire */
				v_max=tmp->Nvar;
				for (i = 0; i < pos; i++) freeSolver(guess_probable[i]);
				pos=0;
				for (i = 0; i < N1; i++) if (!ContenuListesTriees(B1[i]->var,B1[i]->Nvar,tmp->var,tmp->Nvar)) guess_probable[pos++]=copySolver(B1[i]);
				proba=v_max*coeff_proba;
			}
			if (cpt2 >= 199)
			{
				printf("\r - generated solvers : %u, number of variables max : %d / %d ",cpt,v_max,E->a/E->gen);
				fflush(stdout);
				cpt2=0;
			}
			else cpt2++;
			if (N==Alloue) // On a atteint la limite d'espace alloué
			{
				i=0;
				while (i<N) // On supprime celles qui semblent peu intéressantes
				{
					if (Candidat[i]->Nvar<=(v_max+T)/2 && Candidat[i]->memoire<=1)
					{
						freeSolver(Candidat[i]);
						N--;
						Candidat[i]=Candidat[N];
					}
					else i++;
				}
				if (Alloue-N<500) // On realloue
				{
					Alloue+=1000;
					Candidat=realloc(Candidat,Alloue*sizeof(Solver));
					if (Candidat==NULL)
					{
						printf("Erreur allocation");
						getchar();
					}
				}
			}		
		}
		else // elle est moins interessante que celles que l'on a déjà
		{
			freeSolver(tmp);
			cpt2++;
		}
		if (N==1 && Candidat[0]->Nvar==E->a/E->gen) // On a gagné
		{
			tmp=Candidat[0];
			free(Candidat);
			printf("\n");
			return tmp;
		}
	}
	int i;
	for (i = 0; i < N; i++) freeSolver(Candidat[i]);
	free(Candidat);
	printf("\n");
	return NULL;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x68, %rsp
movq %rcx, %r13
movl %edx, %ebp
movq %rsi, 0x50(%rsp)
movl %edi, %r15d
movl $0x1f40, %edi           # imm = 0x1F40
callq 0x21c0
movq %rax, %r12
movslq %ebp, %rbx
leaq (,%rbx,8), %rdi
callq 0x21c0
movq %rax, 0x48(%rsp)
leaq 0x15ba6(%rip), %rdi     # 0x2ae86
callq 0x2090
imull $0xc8, 0x10(%r13), %eax
cltd
idivl 0x8(%r13)
movl %eax, 0x5c(%rsp)
testl %ebx, %ebx
movl $0x0, %eax
movl %ebp, 0x30(%rsp)
cmovgl %ebp, %eax
movq %rax, 0x60(%rsp)
movl $0x3e8, 0x1c(%rsp)      # imm = 0x3E8
xorl %esi, %esi
movl $0x0, 0x38(%rsp)
movq $0x0, 0x20(%rsp)
xorl %ebp, %ebp
movl $0x0, 0x34(%rsp)
xorl %r14d, %r14d
movq %r13, 0x28(%rsp)
movq %r15, 0x40(%rsp)
movl %esi, 0x3c(%rsp)
cmpl 0x38(%rsp), %r14d
movl %r14d, 0xc(%rsp)
movl %r15d, %edi
jge 0x1535a
movq 0x48(%rsp), %rsi
movq 0x20(%rsp), %rdx
jmp 0x15363
movq 0x50(%rsp), %rsi
movl 0x30(%rsp), %edx
movq %r13, %rcx
callq 0x14e26
movq %rax, %rbx
incl 0x34(%rsp)
xorl %r14d, %r14d
movslq %ebp, %rbp
movslq %r14d, %r14
cmpl %ebp, %r14d
jge 0x15510
movq (%r12,%r14,8), %rdi
movq %rbx, %rsi
movq %r13, %rdx
movl %r15d, %ecx
callq 0x73be
testq %rax, %rax
jne 0x153a5
incq %r14
movq 0x28(%rsp), %r13
jmp 0x1537b
movq %rax, %r13
movl 0x8(%rax), %r15d
movq (%r12,%r14,8), %rdi
cmpl 0x8(%rdi), %r15d
je 0x154fe
movl 0x8(%rbx), %eax
movl %eax, 0x10(%rsp)
decq %rbp
callq 0x6852
movslq %ebp, %rax
movq (%r12,%rax,8), %rax
movq %rax, (%r12,%r14,8)
cmpl 0x10(%rsp), %r15d
jne 0x153ef
movq %r13, %rdi
callq 0x6852
movq 0x28(%rsp), %r13
movq 0x40(%rsp), %r15
jmp 0x15378
movq %rbx, %rdi
callq 0x6852
movq %r13, %rdi
movq 0x28(%rsp), %r14
movq %r14, %rsi
movq 0x50(%rsp), %rdx
movl 0x30(%rsp), %ecx
callq 0x788d
movq %rax, %rbx
movq %r13, %rdi
callq 0x6852
movl 0x14(%rbx), %esi
leaq 0x15850(%rip), %rdi     # 0x2ac75
xorl %eax, %eax
callq 0x2110
movl 0x14(%rbx), %eax
movq 0x40(%rsp), %r15
cmpl %r15d, %eax
setge %cl
testl %eax, %eax
setle %dl
orb %cl, %dl
jne 0x154d6
movq (%rbx), %rdi
movl 0x8(%rbx), %esi
movq %r14, %rdx
callq 0xb021
movl %r15d, %esi
subl 0x14(%rbx), %esi
movq %rax, 0x10(%rsp)
movq %rax, %rdi
callq 0x122f8
testq %rax, %rax
je 0x154db
movq %rax, %r14
callq 0x67a4
movq %rax, %r13
movq (%rbx), %rdi
movl 0x8(%rbx), %esi
movq (%r14), %rdx
movl 0x8(%r14), %ecx
leaq 0x8(%rax), %r8
callq 0x2440
movq %rax, (%r13)
movl 0xc(%rbx), %eax
movl 0x14(%rbx), %ecx
movl 0xc(%r14), %edx
addl %ecx, %edx
cmpl %edx, %eax
cmovgl %eax, %edx
movl %edx, 0xc(%r13)
movl 0x10(%rbx), %eax
movl 0x10(%r14), %edx
cmpl %edx, %eax
cmovgl %eax, %edx
movl %edx, 0x10(%r13)
addl 0x14(%r14), %ecx
movl %ecx, 0x14(%r13)
movb $0x2, 0x18(%r13)
movq %rbx, 0x28(%r13)
movq %r14, 0x20(%r13)
movq %r13, %rbx
movq 0x28(%rsp), %r13
jmp 0x154de
movq %r14, %r13
jmp 0x154eb
movq %r14, %r13
movq 0x10(%rsp), %rdi
callq 0xb562
movl 0x14(%rbx), %eax
testl %eax, %eax
movl %ebp, %r14d
movl $0x0, %eax
cmovgl %eax, %r14d
jmp 0x15375
movq %r13, %rdi
callq 0x6852
movq 0x28(%rsp), %r13
movq 0x40(%rsp), %r15
cmpl %r14d, %ebp
jne 0x15547
cmpl $0x0, 0x14(%rbx)
movl 0xc(%rsp), %r14d
movl 0x3c(%rsp), %ecx
jle 0x15730
movslq %ebp, %rax
movq %rbx, (%r12,%rax,8)
movl 0x8(%rbx), %eax
movq %rax, 0x10(%rsp)
cmpl %ecx, %eax
jge 0x15560
movl %ecx, %eax
movq %rax, 0x10(%rsp)
jmp 0x15600
movq %rbx, %rdi
callq 0x6852
movl 0xc(%rsp), %r14d
incl %r14d
movl 0x3c(%rsp), %esi
jmp 0x1570a
movq 0x20(%rsp), %r13
testl %r13d, %r13d
movl $0x0, %eax
cmovlel %eax, %r13d
xorl %r14d, %r14d
movq 0x48(%rsp), %r15
cmpq %r14, %r13
je 0x1558c
movq (%r15,%r14,8), %rdi
callq 0x6852
incq %r14
jmp 0x15579
xorl %r14d, %r14d
movq $0x0, 0x20(%rsp)
movq 0x28(%rsp), %r13
movq 0x50(%rsp), %r15
cmpq %r14, 0x60(%rsp)
je 0x155e8
movq (%r15,%r14,8), %rax
movq (%rax), %rdi
movl 0x8(%rax), %esi
movq (%rbx), %rdx
movl 0x8(%rbx), %ecx
callq 0x2a3d
testl %eax, %eax
jne 0x155e3
movq (%r15,%r14,8), %rdi
callq 0x6846
movq 0x20(%rsp), %rdx
movslq %edx, %rcx
incl %edx
movq %rdx, 0x20(%rsp)
movq 0x48(%rsp), %rdx
movq %rax, (%rdx,%rcx,8)
incq %r14
jmp 0x1559d
movq 0x10(%rsp), %rax
imull 0x5c(%rsp), %eax
movl %eax, 0x38(%rsp)
movq 0x40(%rsp), %r15
movl 0xc(%rsp), %r14d
cmpl $0xc7, %r14d
movl 0x1c(%rsp), %ebx
jge 0x15612
incl %r14d
jmp 0x15646
movl 0x8(%r13), %eax
cltd
idivl 0x10(%r13)
xorl %r14d, %r14d
leaq 0x15670(%rip), %rdi     # 0x2ac95
movl 0x34(%rsp), %esi
movq 0x10(%rsp), %rdx
movl %eax, %ecx
xorl %eax, %eax
callq 0x2110
movq 0x1a982(%rip), %rax     # 0x2ffc0
movq (%rax), %rdi
callq 0x21d0
incl %ebp
cmpl %ebx, %ebp
jne 0x156d6
movl %ebx, %ecx
movl %r14d, 0xc(%rsp)
movq 0x10(%rsp), %rax
addl %r15d, %eax
cltd
pushq $0x2
popq %rsi
idivl %esi
movl %eax, %ebx
xorl %r14d, %r14d
movl %ecx, %ebp
movslq %r14d, %r14
cmpl %ebp, %r14d
jge 0x1569d
movq (%r12,%r14,8), %rdi
cmpl %ebx, 0x8(%rdi)
jg 0x15683
cmpl $0x1, 0x10(%rdi)
jle 0x15688
incq %r14
jmp 0x1566f
callq 0x6852
movslq %ebp, %rax
decl %ebp
movq -0x8(%r12,%rax,8), %rax
movq %rax, (%r12,%r14,8)
jmp 0x1566c
movl 0x1c(%rsp), %ecx
movl %ecx, %eax
subl %ebp, %eax
cmpl $0x1f3, %eax            # imm = 0x1F3
jg 0x156df
movslq %ecx, %rax
addl $0x3e8, %ecx            # imm = 0x3E8
movl %ecx, 0x1c(%rsp)
leaq 0x1f40(,%rax,8), %rsi
movq %r12, %rdi
callq 0x21f0
testq %rax, %rax
movl 0xc(%rsp), %r14d
je 0x156ed
movq %rax, %r12
movq 0x10(%rsp), %rax
movl %eax, %esi
jmp 0x1570a
movq 0x10(%rsp), %rax
movl %eax, %esi
movl 0xc(%rsp), %r14d
jmp 0x1570a
leaq 0x155e0(%rip), %rdi     # 0x2acd4
xorl %eax, %eax
callq 0x2110
callq 0x2170
movq 0x10(%rsp), %rax
movl %eax, %esi
xorl %r12d, %r12d
cmpl $0x1, %ebp
jne 0x1533b
movq (%r12), %rbx
movl 0x8(%rbx), %ecx
movl 0x8(%r13), %eax
cltd
idivl 0x10(%r13)
cmpl %eax, %ecx
jne 0x1533b
movq %r12, %rdi
jmp 0x15784
xorl %r14d, %r14d
testl %ebp, %ebp
movl $0x0, %r15d
cmovgl %ebp, %r15d
cmpq %r14, %r15
je 0x15752
movq (%r12,%r14,8), %rdi
callq 0x6852
incq %r14
jmp 0x1573f
movq %r12, %rdi
callq 0x2030
xorl %r14d, %r14d
movq 0x20(%rsp), %r12
testl %r12d, %r12d
cmovlel %r14d, %r12d
movq 0x48(%rsp), %r15
cmpq %r14, %r12
je 0x15781
movq (%r15,%r14,8), %rdi
callq 0x6852
incq %r14
jmp 0x1576e
movq %r15, %rdi
callq 0x2030
pushq $0xa
popq %rdi
callq 0x2040
movq %rbx, %rax
addq $0x68, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq