// File: /workspace/github_c_makefile_star2_O1/sos22[P]unexec/unexec.c
// Function: end_trampoline
static void * alloc_trampoline_text(struct trampoline *out) {
    /* We need a valid fsbase to call into libc, for the PLT, so
     * restore it from the trampoline. */
    unsigned long fsbase;
    if (arch_prctl(ARCH_GET_FS, &fsbase) < 0) return NULL;
    asm(
        "    jmp end_trampoline\n"
        "start_trampoline:\n"
        /* Set personality and disable address
         * randomisation. Randomisation affects exec behaviour, so
         * need to re-exec if we changed anything. */
        "    mov %[___NR_personality], %%rax\n"
        "set_rsi_persona_no_random:\n"
        "    movq $0x123456789, %%rdi\n"
        "    movq %%rdi, %%rbx\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "    cmpq %%rax, %%rbx\n"
        "    jne exec_self\n" /* re-exec */
        /* Set fsbase */
        "    movq %[_ARCH_SET_FS], %%rdi\n"
        "set_rsi_fsbase:\n"
        "    movq $0x123456789, %%rsi\n" /* patched to fsbase */
        "    mov %[___NR_arch_prctl], %%eax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        /* Extend trampoline with new argv and environ from stack. */
        /* First we need to find out how big the area is. */
        "    movq (%%rsp), %%rax\n" /* How many arguments do we have? */
        "    lea 16(%%rsp, %%rax, 8), %%rsi\n" /* Skip past arguments. */
        "1:  leaq 8(%%rsi), %%rsi\n" /* Skip past environment
                                      * variables until we get a NULL
                                      * pointer. */
        "    movq (%%rsi), %%rax\n"
        "    testq %%rax, %%rax\n"
        "    jnz 1b\n"
        "    movq -8(%%rsi), %%rdi\n" /* rdi is last environment var,
                                       * so walk it to the end. */
        "    xor %%al, %%al\n" /* find end of variable. */
        "    movq $-1, %%rcx\n"
        "    cld\n"
        "    repne; scasb\n" /* rdi is now end of bit of stack which
                                must be copied. */
        "    movq %%rdi, %%r15\n"
        "    movq $0xfff, %%rax\n" /* Round boundaries to pages, for
                                    * mmap */
        "    addq %%rax, %%rdi\n"
        "    notq %%rax\n"
        "    movq %%rsp, %%r14\n"
        "    andq %%rax, %%r14\n"
        "    andq %%rax, %%rdi\n"
        "    subq %%r14, %%rdi\n" /* rdi is how big an allocation we
                                   * need. */
        "    movq %%rdi, %%r14\n"
        "set_rdi_tramp_top:\n" /* ANON mmap to get space above the trampoline */
        "    movq $0x123456789, %%rdi\n"
        "    movq %%r14, %%rsi\n"
        "    movq %[READ_WRITE], %%rdx\n"
        "    movq %[PRIVATE_ANONYMOUS], %%r10\n"
        "    mov $-1, %%r8\n"
        "    mov $0, %%r9\n"
        "    mov %[___NR_mmap], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "    movq %%rax, %%r8\n"
        "    addq %%r14, %%r8\n"
        "    movq %%rsp, %%rsi\n" /* copy stack to bounce zone we just
                                   * allocated. */
        "    movq %%rsp, (%%rax)\n" /* Top of bounce zone is old rsp,
                                     * so that we can fix up relative
                                     * pointers. */
        "    leaq 8(%%rax), %%rdi\n"
        "    movq %%r15, %%rcx\n"
        "    subq %%rsp, %%rcx\n"
        "    rep; movsb\n"
        /* munmap everything above the trampoline. */
        "    movq %%r8, %%rdi\n"
        "set_rsi_kern_base:\n"
        "    movq $0x123456789, %%rsi\n" /* patched later */
        "    subq %%r8, %%rsi\n"
        "    mov %[___NR_munmap], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "set_r15_tramp:\n"
        "    movq $0x123456789, %%r15\n" /* Patched to @out later */
        "    movq %c[mappings](%%r15), %%r14\n" /* r14 is next mapping */
        "    mov %[sizeofmapping], %%eax\n"
        "    movq %c[nrmappings](%%r15), %%rbx\n"
        "    imul %%rbx, %%rax\n"
        "    addq %%r14, %%rax\n"
        "    movq %%rax, %%r13\n" /* r13 is sentinel mapping */
        "next_mapping:\n"
        "    cmpq %%r14, %%r13\n"
        "    je done_mappings\n"
        /* open the next thing to map */
        "    movq %c[offsetpath](%%r14), %%rdi\n"
        "    movq %[_O_RDONLY], %%rsi\n"
        "    movq %[___NR_open], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        "    movq %%rax, %%r12\n"
        /* XXX should probably make some attempt to check the world
         * still looks like what we expect; otherwise, this'll be
         * confusing. */
        /* Now do the mmap */
        "    movq %c[offsetstart](%%r14), %%rdi\n"
        "    movq %c[offsetsize](%%r14), %%rsi\n"
        "    movq %c[offsetprot](%%r14), %%rdx\n"
        "    movq %c[offsetflags](%%r14), %%r10\n"
        "    movq %%r12, %%r8\n"
        "    movq %c[offsetoffset](%%r14), %%r9\n"
        "    testq %[_MAP_ANONYMOUS], %%r10\n"
        "    jz 1f\n" /* Zap FD anonymous maps */
        "    movq $-1, %%r8\n"
        "1:\n"
        "    movq %[___NR_mmap], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        /* Anon maps need to be pread in. */
        "    testq %[_MAP_ANONYMOUS], %c[offsetflags](%%r14)\n"
        "    jz 1f\n"
        "    movq %%r12, %%rdi\n"
        "    movq %c[offsetstart](%%r14), %%rsi\n"
        "    movq %c[offsetsize](%%r14), %%rdx\n"
        "    movq %c[offsetoffset](%%r14), %%r10\n"
        "    movq %[___NR_pread], %%rax\n"
        "    syscall\n"
        "    cmpq %%rax, %c[offsetsize](%%r14)\n"
        "    jne syscall_failed\n"
        "1:\n"
        /* close the fd */
        "    movq %%r12, %%rdi\n"
        "    movq %[___NR_close], %%rax\n"
        "    syscall\n"
        "    testq %%rax, %%rax\n"
        "    js syscall_failed\n"
        /* Advance to next structure. */
        "    lea %c[sizeofmapping](%%r14), %%r14\n"
        "    jmp next_mapping\n"
        "done_mappings:\n"
        /* All mappings restored, r15 set to trampoline
         * structure. Restore call saved registers. */
        "    movq %c[stash_rbx](%%r15), %%rbx\n"
        "    movq %c[stash_rsp](%%r15), %%rsp\n"
        "    movq %c[stash_ret](%%r15), %%rsi\n"
        "    movq %%rsi, (%%rsp)\n"
        "    movq %c[stash_rbp](%%r15), %%rbp\n"
        "    movq %c[stash_r12](%%r15), %%r12\n"
        "    movq %c[stash_r13](%%r15), %%r13\n"
        "    movq %c[stash_r14](%%r15), %%r14\n"
        "    movq %c[stash_r15](%%r15), %%r15\n"
        /* save_registers() returns 1 in the new process. */
        "    mov $1, %%eax\n"
        "    ret\n"
        "syscall_failed:\n"
        "    ud2\n"
        "exec_self:\n"
        /* Have to re-run execve. stack is argc, then argv, then environ. */
        "    movq (%%rsp), %%rax\n"
        "    leaq 8(%%rsp), %%rsi\n" /* argv */
        "    leaq 8(%%rsi, %%rax, 8), %%rdx\n" /* env */
        "mov_proc_self_exe_rdi:\n"
        "    movq $0x123456778, %%rdi\n"
        "    mov %[___NR_execve], %%rax\n"
        "    syscall\n"
        "    jmp syscall_failed\n"
        "end_trampoline:\n"
        :
        : [mappings] "i" (offsetof(mappings, struct trampoline)),
          [sizeofmapping] "i" (sizeof(struct mapping)),
          [nrmappings] "i" (offsetof(nrmappings, struct trampoline)),
          [offsetpath] "i" (offsetof(path, struct mapping)),
          [offsetstart] "i" (offsetof(start, struct mapping)),
          [offsetsize] "i" (offsetof(size, struct mapping)),
          [offsetprot] "i" (offsetof(prot, struct mapping)),
          [offsetflags] "i" (offsetof(flags, struct mapping)),
          [offsetoffset] "i" (offsetof(offset, struct mapping)),
          [_O_RDONLY] "i" (O_RDONLY),
          [READ_WRITE] "i" (PROT_READ|PROT_WRITE),
          [PRIVATE_ANONYMOUS] "i" (MAP_PRIVATE|MAP_ANONYMOUS),
          [_ARCH_SET_FS] "i" (ARCH_SET_FS),
          [___NR_arch_prctl] "i" (__NR_arch_prctl),
          [___NR_close] "i" (__NR_close),
          [___NR_execve] "i" (__NR_execve),
          [___NR_mmap] "i" (__NR_mmap),
          [___NR_munmap] "i" (__NR_munmap),
          [___NR_open] "i" (__NR_open),
          [___NR_personality] "i" (__NR_personality),
          [___NR_pread] "i" (__NR_pread64),
          [stash_rbx] "i" (offsetof(stash.rbx, struct trampoline)),
          [stash_rsp] "i" (offsetof(stash.rsp, struct trampoline)),
          [stash_rbp] "i" (offsetof(stash.rbp, struct trampoline)),
          [stash_r12] "i" (offsetof(stash.r12, struct trampoline)),
          [stash_r13] "i" (offsetof(stash.r13, struct trampoline)),
          [stash_r14] "i" (offsetof(stash.r14, struct trampoline)),
          [stash_r15] "i" (offsetof(stash.r15, struct trampoline)),
          [stash_ret] "i" (offsetof(stash.ret, struct trampoline)),
          [_MAP_ANONYMOUS] "i" (MAP_ANONYMOUS)
        );
    extern const unsigned char start_trampoline[0];
    extern const unsigned char set_rsi_persona_no_random[0];
    extern const unsigned char set_rsi_fsbase[0];
    extern const unsigned char set_rdi_tramp_top[0];
    extern const unsigned char set_rsi_kern_base[0];
    extern const unsigned char set_r15_tramp[0];
    extern const unsigned char mov_proc_self_exe_rdi[0];
    extern const unsigned char end_trampoline[0];
    char * res = alloc_in_trampoline(end_trampoline - start_trampoline, out);
    memcpy(res, start_trampoline, end_trampoline - start_trampoline);
    *(unsigned long *)(res + 2 + (set_rsi_persona_no_random - start_trampoline)) =
        personality(0xffffffff) | ADDR_NO_RANDOMIZE;
    *(unsigned long *)(res + 2 + (set_rsi_fsbase - start_trampoline)) =
        (unsigned long)fsbase;
    unsigned long out_top = (unsigned long)out + out->allocated + sizeof(*out);
    *(unsigned long *)(res + 2 + (set_rdi_tramp_top - start_trampoline)) =
        out_top;
    *(unsigned long *)(res + 2 + (set_rsi_kern_base - start_trampoline)) =
        KERN_BASE;
    *(unsigned long *)(res + 2 + (set_r15_tramp - start_trampoline)) =
        (unsigned long)out;
    *(unsigned long *)(res + 2 + (mov_proc_self_exe_rdi - start_trampoline)) =
        (unsigned long)out->procselfexe;
    return res; }

// Assembly:
movq -0xb8(%rbp), %r12
movq %r12, %rdi
movq %rbx, %rsi
callq 0x2621
movq %rax, %r14
movq %rax, %rdi
leaq -0x22f(%rip), %rsi      # 0x15be
movq %r12, %rdx
callq 0x1110
movl $0xffffffff, %edi       # imm = 0xFFFFFFFF
callq 0x1030
orl $0x40000, %eax          # imm = 0x40000
cltq
movq -0xa8(%rbp), %rcx
movq %rax, 0x2(%rcx,%r14)
movq -0x180(%rbp), %rax
movq -0x88(%rbp), %rcx
movq %rax, 0x2(%rcx,%r14)
movl (%rbx), %eax
leaq 0x80(%rbx,%rax), %rax
movq -0x98(%rbp), %rcx
movq %rax, 0x2(%rcx,%r14)
movq -0x80(%rbp), %rax
movabsq $0x7ffffffff000, %rcx   # imm = 0x7FFFFFFFF000
movq %rcx, 0x2(%rax,%r14)
movq -0x78(%rbp), %rax
movq %rbx, 0x2(%rax,%r14)
movq 0x28(%rbx), %rax
movq -0x70(%rbp), %rcx
movq %rax, 0x2(%rcx,%r14)
jmp 0x1869
xorl %r14d, %r14d
movq %r14, 0x10(%rbx)
callq 0x1040
movq %rax, -0x50(%rbp)
movl $0x0, (%rax)
cmpb $0x0, (%r15)
je 0x1c91
movl $0x0, -0x40(%rbp)
leaq -0x38(%rbp), %r12
movq %r15, %rdi
incq %r15
movzbl -0x1(%r15), %eax
cmpl $0xa, %eax
je 0x18ae
testl %eax, %eax
je 0x21a5
incq %r15
jmp 0x1897
movb $0x0, -0x1(%r15)
movq %r12, %rsi
movl $0x10, %edx
callq 0x1160
movq -0x38(%rbp), %rdi
movq %r12, %rsi
movl $0xb, %r12d
cmpb $0x2d, (%rdi)
jne 0x1c72
movq %rax, %r14
incq %rdi
movq %rdi, -0x38(%rbp)
movl $0x10, %edx
callq 0x1160
movq -0x38(%rbp), %rdi
cmpb $0x20, (%rdi)
jne 0x1c72
leaq 0x1(%rdi), %rcx
movq %rcx, -0x38(%rbp)
movzbl 0x1(%rdi), %ecx
cmpl $0x2d, %ecx
je 0x1918
cmpl $0x72, %ecx
jne 0x1c72
movl $0x1, %edx
jmp 0x191a
xorl %edx, %edx
leaq 0x2(%rdi), %rcx
movq %rcx, -0x38(%rbp)
movzbl 0x2(%rdi), %ecx
cmpl $0x2d, %ecx
je 0x1937
cmpl $0x77, %ecx
jne 0x1c72
orl $0x2, %edx
leaq 0x3(%rdi), %rcx
movq %rcx, -0x38(%rbp)
movzbl 0x3(%rdi), %ecx
cmpl $0x2d, %ecx
je 0x1954
cmpl $0x78, %ecx
jne 0x1c72
orl $0x4, %edx
leaq 0x4(%rdi), %rcx
movq %rcx, -0x38(%rbp)
movzbl 0x4(%rdi), %ecx
cmpl $0x70, %ecx
je 0x1975
cmpl $0x73, %ecx
jne 0x1c72
movl $0x1, %esi
jmp 0x197a
movl $0x2, %esi
leaq 0x5(%rdi), %rcx
movq %rcx, -0x38(%rbp)
cmpb $0x20, 0x5(%rdi)
jne 0x1c72
movq %rsi, -0x68(%rbp)
movl %edx, -0x44(%rbp)
movq %rax, -0x90(%rbp)
addq $0x6, %rdi
movq %rdi, -0x38(%rbp)
leaq -0x38(%rbp), %rsi
movl $0x10, %edx
callq 0x1160
movq -0x38(%rbp), %rdi
cmpb $0x20, (%rdi)
jne 0x1c72
movq %rax, -0xd8(%rbp)
incq %rdi
movq %rdi, -0x38(%rbp)
leaq -0x38(%rbp), %rsi
movl $0x10, %edx
callq 0x1160
movq -0x38(%rbp), %rdi
cmpb $0x3a, (%rdi)
jne 0x1c72
incq %rdi
movq %rdi, -0x38(%rbp)
leaq -0x38(%rbp), %rsi
movl $0x10, %edx
callq 0x1160
movq -0x38(%rbp), %rdi
cmpb $0x20, (%rdi)
jne 0x1c72
incq %rdi
movq %rdi, -0x38(%rbp)
leaq -0x38(%rbp), %rsi
movl $0xa, %edx
callq 0x1160
movq -0x38(%rbp), %rdi
cmpb $0x20, (%rdi)
jne 0x1c72
movq %r13, -0x60(%rbp)
subq %r14, -0x90(%rbp)
decq %rdi
movb 0x1(%rdi), %r13b
incq %rdi
cmpb $0x20, %r13b
je 0x1a38
movq %rdi, -0x38(%rbp)
leaq 0x16e6(%rip), %rsi      # 0x3136
movq %rdi, -0xb0(%rbp)
callq 0x10e0
testl %eax, %eax
je 0x1b7f
movq -0xb0(%rbp), %rdi
leaq 0x16cf(%rip), %rsi      # 0x3141
callq 0x10e0
movq -0x68(%rbp), %rcx
leal 0x120(%rcx), %r10d
testl %eax, %eax
cmovnel %ecx, %r10d
xorl %r11d, %r11d
testb %r13b, %r13b
je 0x1b8e
movl %r10d, %eax
andl $0x20, %eax
movq -0x60(%rbp), %r13
movl -0x44(%rbp), %r8d
jne 0x1be9
movq -0x50(%rbp), %rax
cmpl $0x0, (%rax)
jne 0x1c72
movl %r10d, -0x68(%rbp)
movq -0xb0(%rbp), %rdi
leaq -0x180(%rbp), %rsi
callq 0x1100
testl %eax, %eax
js 0x1b98
movb $0x1, %r11b
movl -0x44(%rbp), %r8d
testb $0x1, %r8b
movl -0x68(%rbp), %r10d
je 0x1bce
movq -0xb0(%rbp), %rdi
xorl %esi, %esi
xorl %eax, %eax
callq 0x1150
movl $0xb, %r12d
testl %eax, %eax
js 0x1bba
xorl %edi, %edi
movq -0x90(%rbp), %rsi
movl $0x1, %edx
movl $0x2, %ecx
movl %eax, %r8d
movq -0xd8(%rbp), %r9
movl %eax, -0xc4(%rbp)
callq 0x1080
movq %rax, -0xd0(%rbp)
movl -0xc4(%rbp), %edi
callq 0x10b0
movq -0xd0(%rbp), %rcx
cmpq $-0x1, %rcx
je 0x1bba
movq %rcx, %rdi
movq %r14, %rsi
movq -0x90(%rbp), %r12
movq %r12, %rdx
callq 0x1120
testl %eax, %eax
sete -0x29(%rbp)
movq -0xd0(%rbp), %rdi
movq %r12, %rsi
callq 0x1130
movb $0x1, %cl
xorl %r12d, %r12d
jmp 0x1bbc
movl $0x7, %r12d
movq -0x60(%rbp), %r13
jmp 0x1c6d
movq -0x60(%rbp), %r13
movl -0x44(%rbp), %r8d
jmp 0x1be9
movl $0xb, %r12d
movq -0x50(%rbp), %rax
cmpl $0x2, (%rax)
movb -0x29(%rbp), %al
movl %eax, %r11d
movl -0x44(%rbp), %r8d
movl -0x68(%rbp), %r10d
jne 0x1bdb
xorl %r11d, %r11d
jmp 0x1bce
xorl %ecx, %ecx
movb -0x29(%rbp), %al
movl %eax, %r11d
testb %cl, %cl
movl -0x44(%rbp), %r8d
movl -0x68(%rbp), %r10d
je 0x1bdb
movq -0x50(%rbp), %rax
movl $0x0, (%rax)
xorl %r12d, %r12d
testl %r12d, %r12d
je 0x1be9
movb %r11b, -0x29(%rbp)
jmp 0x1c72
testb $0x1, %r11b
je 0x1c1c
movq -0xb0(%rbp), %rdi
movq %rbx, %rsi
movl %r10d, %r12d
movl %r11d, -0x68(%rbp)
callq 0x266e
movl -0x68(%rbp), %r11d
movl %r12d, %r10d
movl -0x44(%rbp), %r8d
movl -0x40(%rbp), %esi
movq -0xd8(%rbp), %r9
jmp 0x1c26
movq 0x28(%rbx), %rax
xorl %r9d, %r9d
movl -0x40(%rbp), %esi
cmpl 0x20(%rbx), %esi
jae 0x255d
orl $0x10, %r10d
movq 0x18(%rbx), %rcx
movl %esi, %edx
leaq (%rdx,%rdx,4), %rdx
movq %r14, (%rcx,%rdx,8)
movq -0x90(%rbp), %rdi
movq %rdi, 0x8(%rcx,%rdx,8)
movq %r9, 0x10(%rcx,%rdx,8)
movl %r8d, 0x18(%rcx,%rdx,8)
movl %r10d, 0x1c(%rcx,%rdx,8)
movq %rax, 0x20(%rcx,%rdx,8)
incl %esi
movl %esi, -0x40(%rbp)
xorl %r12d, %r12d
movb %r11b, -0x29(%rbp)
movb $0xa, -0x1(%r15)
testl %r12d, %r12d
je 0x1c81
cmpl $0x7, %r12d
jne 0x1d09
cmpb $0x0, (%r15)
leaq -0x38(%rbp), %r12
jne 0x1891
jmp 0x1c98
movl $0x0, -0x40(%rbp)
movl -0x40(%rbp), %eax
movl %eax, 0x20(%rbx)
movq -0x50(%rbp), %rax
cmpl $0x0, (%rax)
jne 0x1d0f
movl 0x4(%rbx), %r14d
cmpl (%rbx), %r14d
movq -0x58(%rbp), %r15
jbe 0x1dd6
movq %rbx, %rdi
movq %r13, %rsi
callq 0x1130
addq $0x107f, %r14           # imm = 0x107F
movq %r14, %r13
andq $-0x1000, %r13          # imm = 0xF000
xorl %r14d, %r14d
movl $0x10000, %edi          # imm = 0x10000
movq %r13, %rsi
movl $0x3, %edx
movl $0x32, %ecx
movl $0xffffffff, %r8d       # imm = 0xFFFFFFFF
xorl %r9d, %r9d
callq 0x1080
movq %rax, %rbx
cmpq $-0x1, %rax
jne 0x14fa
jmp 0x1e14
cmpl $0xb, %r12d
jne 0x1ca7
movq %rbx, %r14
movq -0x58(%rbp), %r15
jmp 0x1d22
movl $0xffffffff, -0x48(%rbp) # imm = 0xFFFFFFFF
xorl %r13d, %r13d
movq %r15, %rdi
callq 0x126e
cmpq $-0x1, %r14
je 0x1d3b
movq %r14, %rdi
movq %r13, %rsi
callq 0x1130
movl -0x48(%rbp), %r12d
testl %r12d, %r12d
je 0x1d5b
movl %r12d, %ebx
movl %ebx, %eax
addq $0x2778, %rsp           # imm = 0x2778
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
movq -0xe8(%rbp), %rdi
callq 0x1030
movl $0xffffffff, %ebx       # imm = 0xFFFFFFFF
testl %eax, %eax
js 0x1d47
movq $-0x3f, %r15
leaq -0x2708(%rbp), %r14
leaq 0x40(%r15), %rax
cmpl $0x21, %eax
ja 0x1da7
movl %eax, %eax
movabsq $0x300080200, %rcx      # imm = 0x300080200
btq %rax, %rcx
jae 0x1da7
addq $0x98, %r14
incq %r15
jne 0x1d7e
jmp 0x1dbb
leal 0x40(%r15), %edi
movq %r14, %rsi
xorl %edx, %edx
callq 0x1050
testl %eax, %eax
jns 0x1d99
jmp 0x1d47
leaq -0x198(%rbp), %rdi
xorl %esi, %esi
callq 0x1170
testl %eax, %eax
jns 0x1d44
jmp 0x1d47
movl 0x20(%rbx), %ecx
testq %rcx, %rcx
je 0x1e27
movq 0x18(%rbx), %rdx
movq 0x28(%rbx), %rsi
leaq (,%rcx,8), %rax
leaq (%rax,%rax,4), %rdi
movl $0x3, %eax
xorl %r8d, %r8d
xorl %r9d, %r9d
cmpq %rsi, 0x20(%rdx,%r8)
sete %r9b
addl %r9d, %eax
addq $0x28, %r8
cmpq %r8, %rdi
jne 0x1dfa
jmp 0x1e2c
movl $0xffffffff, -0x48(%rbp) # imm = 0xFFFFFFFF
movq $-0x1, %r14
jmp 0x1d22
movl $0x3, %eax
movl %eax, %edx
imulq $0x38, %rdx, %rdx
addq $0x103f, %rdx           # imm = 0x103F
andq $-0x1000, %rdx          # imm = 0xF000
testq %rcx, %rcx
je 0x1e76
shlq $0x3, %rcx
leaq (%rcx,%rcx,4), %rcx
xorl %esi, %esi
movq 0x18(%rbx), %rdi
movq 0x28(%rbx), %r8
cmpq %r8, 0x20(%rdi,%rsi)
jne 0x1e6d
movq %rdx, 0x10(%rdi,%rsi)
addq 0x8(%rdi,%rsi), %rdx
movq %r8, 0x20(%rdi,%rsi)
addq $0x28, %rsi
cmpq %rsi, %rcx
jne 0x1e4f
movl %eax, 0x30(%rbx)
movq %rdx, 0x38(%rbx)
movl $0xc, %edi
xorl %esi, %esi
xorl %eax, %eax
callq 0x10f0
movq %rax, -0x50(%rbp)
movq -0xe0(%rbp), %rdi
movl $0x241, %esi            # imm = 0x241
movl $0x1c9, %edx            # imm = 0x1C9
xorl %eax, %eax
callq 0x1150
testl %eax, %eax
movq %r13, -0x60(%rbp)
js 0x2181
movl %eax, %edi
xorps %xmm0, %xmm0
leaq -0x180(%rbp), %rsi
movaps %xmm0, (%rsi)
movaps %xmm0, 0x10(%rsi)
movaps %xmm0, 0x30(%rsi)
movaps %xmm0, 0x20(%rsi)
movl $0x464c457f, (%rsi)     # imm = 0x464C457F
movw $0x102, 0x4(%rsi)       # imm = 0x102
movb $0x3, 0x7(%rsi)
movabsq $0x1003e0002, %rax      # imm = 0x1003E0002
movq %rax, 0x10(%rsi)
movq 0x10(%rbx), %rax
movq %rax, 0x18(%rsi)
movq $0x40, 0x20(%rsi)
movq $0x0, 0x28(%rsi)
movabsq $0x38004000000000, %rax # imm = 0x38004000000000
movq %rax, 0x30(%rsi)
movzwl 0x30(%rbx), %eax
movw %ax, 0x38(%rsi)
movl $0x40, 0x3a(%rsi)
movw $0x0, 0x3e(%rsi)
movl $0x40, %edx
movl %edi, -0x40(%rbp)
callq 0x1060
cmpq $0x40, %rax
jne 0x2226
cmpl $0x0, 0x20(%rbx)
je 0x1fc9
leaq -0x170(%rbp), %r14
movb $0x1, %r15b
movl $0x20, %r13d
xorl %r12d, %r12d
movq 0x18(%rbx), %rax
movq (%rax,%r13), %rcx
cmpq 0x28(%rbx), %rcx
jne 0x1fb6
movq $0x0, -0x180(%rbp)
movq -0x10(%rax,%r13), %rcx
movq %rcx, -0x178(%rbp)
xorps %xmm0, %xmm0
movups %xmm0, (%r14)
movq -0x18(%rax,%r13), %rax
movq %rax, -0x160(%rbp)
movups %xmm0, 0x18(%r14)
movl $0x38, %edx
movl -0x40(%rbp), %edi
leaq -0x180(%rbp), %rsi
callq 0x1060
cmpq $0x38, %rax
jne 0x2196
incq %r12
movl 0x20(%rbx), %eax
addq $0x28, %r13
cmpq %rax, %r12
setb %r15b
jb 0x1f5b
movabsq $0x500000001, %rax      # imm = 0x500000001
leaq -0x180(%rbp), %rsi
movq %rax, (%rsi)
movq 0x38(%rbx), %rax
movq %rax, 0x8(%rsi)
movq %rbx, 0x10(%rsi)
xorl %eax, %eax
movq %rax, 0x18(%rsi)
movl (%rbx), %ecx
subq $-0x80, %rcx
movq %rcx, 0x20(%rsi)
movq %rcx, 0x28(%rsi)
movq %rax, 0x30(%rsi)
movl $0x38, %edx
movl -0x40(%rbp), %edi
callq 0x1060
cmpq $0x38, %rax
jne 0x2226
xorps %xmm0, %xmm0
leaq -0x180(%rbp), %rsi
movaps %xmm0, (%rsi)
movaps %xmm0, 0x20(%rsi)
movaps %xmm0, 0x10(%rsi)
movq $0x0, 0x30(%rsi)
movabsq $0x46474e551, %rax      # imm = 0x46474E551
movq %rax, (%rsi)
movl $0x38, %edx
movl -0x40(%rbp), %edi
callq 0x1060
cmpq $0x38, %rax
jne 0x2226
movabsq $0x600000001, %rax      # imm = 0x600000001
leaq -0x180(%rbp), %rsi
movq %rax, (%rsi)
xorl %eax, %eax
movq %rax, 0x8(%rsi)
movq $-0x1000, %rcx          # imm = 0xF000
addq 0x8(%rbx), %rcx
movq %rcx, 0x10(%rsi)
xorps %xmm0, %xmm0
movups %xmm0, 0x18(%rsi)
movq $0x1000, 0x28(%rsi)     # imm = 0x1000
movq %rax, 0x30(%rsi)
movl $0x38, %edx
movl -0x40(%rbp), %edi
callq 0x1060
cmpq $0x38, %rax
jne 0x2226
cmpl $0x0, 0x20(%rbx)
je 0x217a
xorl %r12d, %r12d
xorl %r13d, %r13d
xorl %r14d, %r14d
movq 0x18(%rbx), %rax
movq 0x20(%rax,%r12), %rcx
cmpq 0x28(%rbx), %rcx
jne 0x2167
testq %r14, %r14
je 0x2106
movl -0x40(%rbp), %edi
xorl %esi, %esi
movl $0x1, %edx
callq 0x1090
testq %rax, %rax
js 0x2129
cmpq %r14, %rax
jne 0x257c
movq 0x18(%rbx), %rdx
xorl %ecx, %ecx
cmpq 0x10(%rdx,%r12), %rax
je 0x212e
jmp 0x259b
movq 0x10(%rax,%r12), %rsi
movl -0x40(%rbp), %edi
xorl %edx, %edx
callq 0x1090
testq %rax, %rax
js 0x21c4
movq 0x18(%rbx), %rax
movq 0x10(%rax,%r12), %r14
jmp 0x2137
movl $0x2, %ecx
testq %rax, %rax
js 0x21c9
movq 0x18(%rbx), %rax
movq (%rax,%r12), %rsi
movq 0x8(%rax,%r12), %rdx
movl -0x40(%rbp), %edi
callq 0x1060
movq 0x18(%rbx), %rcx
movq 0x8(%rcx,%r12), %rcx
movq %rax, %rdx
cmpq %rcx, %rax
je 0x215f
xorl %edx, %edx
cmpq %rcx, %rax
jne 0x21c4
addq %rdx, %r14
incq %r13
movl 0x20(%rbx), %eax
addq $0x28, %r12
cmpq %rax, %r13
jb 0x20bf
movl $0x6, %ecx
jmp 0x21c9
movl $0x0, -0x88(%rbp)
movl $0xffffffff, %r14d      # imm = 0xFFFFFFFF
jmp 0x2246
testb $0x1, %r15b
je 0x1fc9
jmp 0x2226
leaq 0xf50(%rip), %rdi       # 0x30fc
leaq 0xe6b(%rip), %rsi       # 0x301e
leaq 0xf4c(%rip), %rcx       # 0x3106
movl $0x19a, %edx            # imm = 0x19A
callq 0x10a0
movl $0x2, %ecx
cmpl $0x2, %ecx
je 0x2226
cmpl $0x6, %ecx
jne 0x2533
movl (%rbx), %r12d
leaq 0x40(%rbx), %rdi
callq 0x1180
movl $0x0, -0x88(%rbp)
movl $0x0, %r14d
testl %eax, %eax
movq -0x58(%rbp), %r15
movq -0x60(%rbp), %r13
jne 0x2246
subq $-0x80, %r12
movl -0x40(%rbp), %edi
movq %rbx, %rsi
movq %r12, %rdx
callq 0x1060
cmpq %r12, %rax
jne 0x2226
movl $0x1, %r14d
movb $0x1, %al
movl %eax, -0x88(%rbp)
jmp 0x2236
movl $0xffffffff, %r14d      # imm = 0xFFFFFFFF
movl $0x0, -0x88(%rbp)
movl -0x40(%rbp), %edi
callq 0x10b0
movq -0x58(%rbp), %r15
movq -0x60(%rbp), %r13
cmpl $0x1, %r14d
je 0x24f9
movl %r14d, -0x48(%rbp)
testl %r14d, %r14d
jne 0x252b
movl $0xc, %edi
xorl %esi, %esi
xorl %eax, %eax
callq 0x10f0
cmpq %rax, -0x50(%rbp)
jne 0x253e
leaq (%rbx,%r13), %rax
leaq (%rbx,%r13), %rsi
addq $0x10, %rsi
movq -0x10(%rsi), %rcx
movq %rcx, -0x78(%rbp)
movq -0x8(%rsi), %rdi
movq %rax, -0x80(%rbp)
leaq (%rax,%rdi,8), %rcx
addq $0x18, %rcx
movl $0xffffffff, %edx       # imm = 0xFFFFFFFF
movq -0xa0(%rbp), %rax
incl %edx
cmpq $0x0, (%rcx,%rdx,8)
jne 0x22a5
movq %rdx, -0x98(%rbp)
testq %rax, %rax
je 0x24a2
movq %rsi, -0xc0(%rbp)
movq %rcx, -0x50(%rbp)
movq -0x98(%rbp), %rax
incl %eax
leaq (,%rdi,8), %rcx
movl %eax, %eax
movq %rax, -0x70(%rbp)
leaq (%rcx,%rax,8), %r12
addq $0x8, %r12
testq %rdi, %rdi
movq %rdi, -0x40(%rbp)
je 0x2329
movq -0x80(%rbp), %r13
movq %r13, %r15
subq -0x78(%rbp), %r15
addq $0x8, %r15
movl $0x2, %r14d
movq (%r13,%r14,8), %rdi
addq %r15, %rdi
callq 0x1070
movq -0x40(%rbp), %rdi
addq %rax, %r12
incq %r12
leal -0x1(%r14), %eax
incq %r14
cmpq %rax, %rdi
ja 0x2306
leaq 0x8(,%rdi,8), %rax
movq %rax, -0x90(%rbp)
movq -0x70(%rbp), %rcx
shlq $0x3, %rcx
movq -0x98(%rbp), %rax
movl %eax, %r15d
testl %eax, %eax
movq %rcx, -0x70(%rbp)
je 0x238b
movq -0x80(%rbp), %rax
subq -0x78(%rbp), %rax
addq $0x8, %rax
movq %rax, -0xa8(%rbp)
xorl %r14d, %r14d
movq -0x50(%rbp), %r13
movq (%r13,%r14,8), %rdi
addq -0xa8(%rbp), %rdi
callq 0x1070
addl %eax, %r12d
incl %r12d
incq %r14
cmpq %r14, %r15
jne 0x236c
movq %r15, -0xb8(%rbp)
movl %r12d, %edi
callq 0x25ba
movq -0x90(%rbp), %rsi
addq %rax, %rsi
addq %rsi, -0x70(%rbp)
movq -0xa0(%rbp), %rcx
movq -0x40(%rbp), %rdx
movl %edx, (%rcx)
movq %rax, 0x8(%rcx)
movq %rsi, 0x10(%rcx)
testq %rdx, %rdx
je 0x2434
movq -0x80(%rbp), %rax
subq -0x78(%rbp), %rax
addq $0x8, %rax
movq %rax, -0xa8(%rbp)
movl $0x1, %r15d
xorl %r14d, %r14d
movq -0x70(%rbp), %r13
movq -0xc0(%rbp), %rax
movq (%rax,%r14,8), %r12
addq -0xa8(%rbp), %r12
movq %r12, %rdi
callq 0x1070
movq %rax, %rcx
movq -0xa0(%rbp), %rax
movq 0x8(%rax), %rax
movq %r13, (%rax,%r14,8)
leaq 0x1(%rcx), %rdx
movq %rcx, %r14
movq %r13, %rdi
movq %r12, %rsi
callq 0x1110
addq %r14, %r13
incq %r13
movl %r15d, %r14d
incl %r15d
cmpq %r14, -0x40(%rbp)
ja 0x23e2
jmp 0x2438
movq -0x70(%rbp), %r13
cmpl $0x0, -0x98(%rbp)
movq -0x50(%rbp), %rcx
je 0x24a2
movq -0x80(%rbp), %rdx
subq -0x78(%rbp), %rdx
addq $0x8, %rdx
movq %rdx, -0x40(%rbp)
xorl %r15d, %r15d
movq (%rcx,%r15,8), %r12
addq -0x40(%rbp), %r12
movq %r12, %rdi
callq 0x1070
movq %rax, %r14
movq -0xa0(%rbp), %rax
movq 0x10(%rax), %rax
movq %r13, (%rax,%r15,8)
leaq 0x1(%r14), %rdx
movq %r13, %rdi
movq %r12, %rsi
callq 0x1110
movq -0xb8(%rbp), %rax
movq -0x50(%rbp), %rcx
addq %r14, %r13
incq %r13
incq %r15
cmpq %r15, %rax
jne 0x2458
movq -0x98(%rbp), %rax
decl %eax
movq (%rcx,%rax,8), %rax
movq -0x80(%rbp), %r15
movq %r15, %rcx
subq -0x78(%rbp), %rcx
leaq (%rcx,%rax), %r14
leaq (%rcx,%rax), %rdi
addq $0x8, %rdi
callq 0x1070
leaq (%rax,%r14), %rsi
addq $0x1007, %rsi           # imm = 0x1007
andq $-0x1000, %rsi          # imm = 0xF000
subq %r15, %rsi
movq %r15, %rdi
callq 0x1130
testb $0x1, -0x88(%rbp)
movq -0x58(%rbp), %r15
movq -0x60(%rbp), %r13
je 0x252b
movq -0xe0(%rbp), %rdi
movl $0x1c0, %esi            # imm = 0x1C0
callq 0x1140
movl $0x1, -0x48(%rbp)
movq -0xa0(%rbp), %rax
testq %rax, %rax
je 0x252b
xorps %xmm0, %xmm0
movups %xmm0, (%rax)
movq $0x0, 0x10(%rax)
movq %rbx, %r14
jmp 0x1d22
movl %eax, -0x88(%rbp)
jmp 0x223e
leaq 0xb32(%rip), %rdi       # 0x3077
leaq 0xad2(%rip), %rsi       # 0x301e
leaq 0xb32(%rip), %rcx       # 0x3085
movl $0x30c, %edx            # imm = 0x30C
callq 0x10a0
leaq 0xbe5(%rip), %rdi       # 0x3149
leaq 0xab3(%rip), %rsi       # 0x301e
leaq 0xb94(%rip), %rcx       # 0x3106
movl $0x20e, %edx            # imm = 0x20E
callq 0x10a0
leaq 0xc2b(%rip), %rdi       # 0x31ae
leaq 0xa94(%rip), %rsi       # 0x301e
leaq 0xc29(%rip), %rcx       # 0x31ba
movl $0x28a, %edx            # imm = 0x28A
callq 0x10a0
leaq 0xc50(%rip), %rdi       # 0x31f2
leaq 0xa75(%rip), %rsi       # 0x301e
leaq 0xc0a(%rip), %rcx       # 0x31ba
movl $0x28b, %edx            # imm = 0x28B
callq 0x10a0