// File: /workspace/github_c_makefile_star2_O0/jsummers[P]deark/modules/exe.c
// Function: do_Rich_segment
static void do_Rich_segment(deark *c, lctx *d)
{
	i64 segment_start;
	i64 segment_end;
	i64 sig_pos;
	i64 pos;
	i64 p;
	i64 k;
	u32 n;
	u32 key;
	i64 num_entries;

	segment_start = 128;
	segment_end = d->ext_header_offset;
	if(segment_end%8) segment_end -= segment_end%8;
	if(segment_end - segment_start < 24) return; // No place for a Rich segment

	// Try to find the "Rich" signature", which starts 8 bytes from the end of
	// the Rich segment.
	// Based on limited research, the Rich signature usually starts 16, 24, or 32
	// bytes before the "PE" signature.
	sig_pos = 0;
	for(p = segment_end-8; p >= segment_start+16; p -= 8 ) {
		n = (u32)de_getu32le(p);
		if(n==0x68636952U) { // "Rich"
			sig_pos = p;
			break;
		}
	}
	if(sig_pos==0) {
		return; // Rich segment not found
	}

	// Likely "Rich" signature found at sig_pos

	key = (u32)de_getu32le(sig_pos+4);

	// Decode and verify the "start" signature
	n = (u32)de_getu32le(segment_start);
	if((n ^ key) != 0x536e6144U) { // "Dans"
		// False positive? Or maybe our detection logic isn't perfect?
		return;
	}

	de_dbg(c, "\"Rich\" segment detected at %"I64_FMT", sig at %"I64_FMT", len=%"I64_FMT,
		segment_start, sig_pos,
		(i64)(sig_pos+8 - segment_start));

	de_dbg_indent(c, 1);

	pos = segment_start + 16;
	num_entries  = (sig_pos - pos)/8;
	for(k=0; k<num_entries; k++) {
		u32 id_and_value;
		u32 id;
		u32 value;
		u32 use_count;

		id_and_value = (u32)de_getu32le(pos+8*k);
		use_count = (u32)de_getu32le(pos+8*k+4);
		id_and_value ^= key;
		use_count ^= key;
		id = (id_and_value&0xffff0000U)>>16;
		value = id_and_value&0x0000ffffU;
		// TODO: Provide additional information, based on the 'type' and 'build'?
		de_dbg(c, "entry[%d]: type=%u, build=%u, use_count=%u",
			(int)k, (UI)id, (UI)value, (UI)use_count);
	}

	de_dbg_indent(c, -1);
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x60, %rsp
movq %rdi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq $0x80, -0x18(%rbp)
movq -0x10(%rbp), %rax
movq 0x38(%rax), %rax
movq %rax, -0x20(%rbp)
movq -0x20(%rbp), %rax
movl $0x8, %ecx
cqto
idivq %rcx
cmpq $0x0, %rdx
je 0x60971
movq -0x20(%rbp), %rax
movl $0x8, %ecx
cqto
idivq %rcx
movq -0x20(%rbp), %rax
subq %rdx, %rax
movq %rax, -0x20(%rbp)
movq -0x20(%rbp), %rax
subq -0x18(%rbp), %rax
cmpq $0x18, %rax
jge 0x60984
jmp 0x60b45
movq $0x0, -0x28(%rbp)
movq -0x20(%rbp), %rax
subq $0x8, %rax
movq %rax, -0x38(%rbp)
movq -0x38(%rbp), %rax
movq -0x18(%rbp), %rcx
addq $0x10, %rcx
cmpq %rcx, %rax
jl 0x609e0
movq -0x8(%rbp), %rax
movq 0x18(%rax), %rdi
movq -0x38(%rbp), %rsi
callq 0x165540
movl %eax, -0x44(%rbp)
cmpl $0x68636952, -0x44(%rbp) # imm = 0x68636952
jne 0x609d0
movq -0x38(%rbp), %rax
movq %rax, -0x28(%rbp)
jmp 0x609e0
jmp 0x609d2
movq -0x38(%rbp), %rax
subq $0x8, %rax
movq %rax, -0x38(%rbp)
jmp 0x60998
cmpq $0x0, -0x28(%rbp)
jne 0x609ec
jmp 0x60b45
movq -0x8(%rbp), %rax
movq 0x18(%rax), %rdi
movq -0x28(%rbp), %rsi
addq $0x4, %rsi
callq 0x165540
movl %eax, -0x48(%rbp)
movq -0x8(%rbp), %rax
movq 0x18(%rax), %rdi
movq -0x18(%rbp), %rsi
callq 0x165540
movl %eax, -0x44(%rbp)
movl -0x44(%rbp), %eax
xorl -0x48(%rbp), %eax
cmpl $0x536e6144, %eax       # imm = 0x536E6144
je 0x60a2a
jmp 0x60b45
movq -0x8(%rbp), %rdi
movq -0x18(%rbp), %rdx
movq -0x28(%rbp), %rcx
movq -0x28(%rbp), %r8
addq $0x8, %r8
subq -0x18(%rbp), %r8
leaq 0x147b89(%rip), %rsi    # 0x1a85d2
movb $0x0, %al
callq 0x15b0d0
movq -0x8(%rbp), %rdi
movl $0x1, %esi
callq 0x15b560
movq -0x18(%rbp), %rax
addq $0x10, %rax
movq %rax, -0x30(%rbp)
movq -0x28(%rbp), %rax
subq -0x30(%rbp), %rax
movl $0x8, %ecx
cqto
idivq %rcx
movq %rax, -0x50(%rbp)
movq $0x0, -0x40(%rbp)
movq -0x40(%rbp), %rax
cmpq -0x50(%rbp), %rax
jge 0x60b37
movq -0x8(%rbp), %rax
movq 0x18(%rax), %rdi
movq -0x30(%rbp), %rsi
movq -0x40(%rbp), %rax
shlq $0x3, %rax
addq %rax, %rsi
callq 0x165540
movl %eax, -0x54(%rbp)
movq -0x8(%rbp), %rax
movq 0x18(%rax), %rdi
movq -0x30(%rbp), %rsi
movq -0x40(%rbp), %rax
shlq $0x3, %rax
addq %rax, %rsi
addq $0x4, %rsi
callq 0x165540
movl %eax, -0x60(%rbp)
movl -0x48(%rbp), %eax
xorl -0x54(%rbp), %eax
movl %eax, -0x54(%rbp)
movl -0x48(%rbp), %eax
xorl -0x60(%rbp), %eax
movl %eax, -0x60(%rbp)
movl -0x54(%rbp), %eax
andl $0xffff0000, %eax       # imm = 0xFFFF0000
shrl $0x10, %eax
movl %eax, -0x58(%rbp)
movl -0x54(%rbp), %eax
andl $0xffff, %eax           # imm = 0xFFFF
movl %eax, -0x5c(%rbp)
movq -0x8(%rbp), %rdi
movq -0x40(%rbp), %rax
movl %eax, %edx
movl -0x58(%rbp), %ecx
movl -0x5c(%rbp), %r8d
movl -0x60(%rbp), %r9d
leaq 0x147ae7(%rip), %rsi    # 0x1a8606
movb $0x0, %al
callq 0x15b0d0
movq -0x40(%rbp), %rax
addq $0x1, %rax
movq %rax, -0x40(%rbp)
jmp 0x60a88
movq -0x8(%rbp), %rdi
movl $0xffffffff, %esi       # imm = 0xFFFFFFFF
callq 0x15b560
addq $0x60, %rsp
popq %rbp
retq
nopl (%rax,%rax)