// File: buildsi[P]ldaudit-yaml/auditlib.cpp
// Function: la_objsearch
char * la_objsearch(const char *name, uintptr_t *cookie, unsigned int flag) {

  // Derive a human friendly flag name
  std::string flagName;
  std::string desc;
  switch(flag) {
    case LA_SER_ORIG:
      desc = "This is the original name that is being searched for (ELF NEEDED or filename)";
      flagName = "LA_SER_ORIG";
      break;
    case LA_SER_LIBPATH:
      flagName = "LA_SER_LIBPATH";
      desc = "name was created using a directory specified in LD_LIBRARY_PATH";
      break;
    case LA_SER_RUNPATH:
      flagName = "LA_SER_RUNPATH";
      desc = "name was created using a directory specified in an ELF DT_RPATH or DT_RUNPATH list.";
      break;
    case LA_SER_DEFAULT:
      flagName = "LA_SER_DEFAULT";
      desc = "name was found via a search of one of the default directories.";
      break;
    case LA_SER_CONFIG:
      flagName = "LA_SER_CONFIG";
      desc = "name was found via the ldconfig(8) cache (/etc/ld.so.cache).";
      break;
    case LA_SER_SECURE:
      desc = "name is specific to a secure object (unused on Linux).";
      flagName = "LA_SER_SECURE";
  }
  
  std::stringstream ss;
  ss << cookie;
   
  std::string output = "  - event: searching_for\n    function: la_objsearch\n    name: \"" + std::string(name) + "\"\n";
  output += "    initiated_by: " + ss.str() + "\n    flag: \"" + flagName + "\"\n    description: \"" + desc + "\"\n";
  doPrint(output);

  return (char*)name;
}

// Assembly:
subq $0x378, %rsp            # imm = 0x378
movq %rdi, 0x370(%rsp)
movq %rsi, 0x368(%rsp)
movl %edx, 0x364(%rsp)
leaq 0x340(%rsp), %rdi
callq 0x3310
leaq 0x320(%rsp), %rdi
callq 0x3310
movl 0x364(%rsp), %eax
movl %eax, 0x1c(%rsp)
subl $0x1, %eax
je 0x3c1a
jmp 0x3bca
movl 0x1c(%rsp), %eax
subl $0x2, %eax
je 0x3c64
jmp 0x3bd9
movl 0x1c(%rsp), %eax
subl $0x4, %eax
je 0x3c95
jmp 0x3be8
movl 0x1c(%rsp), %eax
subl $0x8, %eax
je 0x3cf4
jmp 0x3bf7
movl 0x1c(%rsp), %eax
subl $0x40, %eax
je 0x3cc6
jmp 0x3c06
movl 0x1c(%rsp), %eax
subl $0x80, %eax
je 0x3d22
jmp 0x3d50
leaq 0x348e(%rip), %rsi      # 0x70af
leaq 0x320(%rsp), %rdi
callq 0x3300
jmp 0x3c30
leaq 0x34c6(%rip), %rsi      # 0x70fd
leaq 0x340(%rsp), %rdi
callq 0x3300
jmp 0x3c46
jmp 0x3d50
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x4182
leaq 0x349e(%rip), %rsi      # 0x7109
leaq 0x340(%rsp), %rdi
callq 0x3300
jmp 0x3c7a
leaq 0x3497(%rip), %rsi      # 0x7118
leaq 0x320(%rsp), %rdi
callq 0x3300
jmp 0x3c90
jmp 0x3d50
leaq 0x34bc(%rip), %rsi      # 0x7158
leaq 0x340(%rsp), %rdi
callq 0x3300
jmp 0x3cab
leaq 0x34b5(%rip), %rsi      # 0x7167
leaq 0x320(%rsp), %rdi
callq 0x3300
jmp 0x3cc1
jmp 0x3d50
leaq 0x34ee(%rip), %rsi      # 0x71bb
leaq 0x340(%rsp), %rdi
callq 0x3300
jmp 0x3cdc
leaq 0x34e7(%rip), %rsi      # 0x71ca
leaq 0x320(%rsp), %rdi
callq 0x3300
jmp 0x3cf2
jmp 0x3d50
leaq 0x350e(%rip), %rsi      # 0x7209
leaq 0x340(%rsp), %rdi
callq 0x3300
jmp 0x3d0a
leaq 0x3506(%rip), %rsi      # 0x7217
leaq 0x320(%rsp), %rdi
callq 0x3300
jmp 0x3d20
jmp 0x3d50
leaq 0x352b(%rip), %rsi      # 0x7254
leaq 0x320(%rsp), %rdi
callq 0x3300
jmp 0x3d38
leaq 0x354c(%rip), %rsi      # 0x728b
leaq 0x340(%rsp), %rdi
callq 0x3300
jmp 0x3d4e
jmp 0x3d50
leaq 0x188(%rsp), %rdi
callq 0x3160
jmp 0x3d5f
leaq 0x198(%rsp), %rdi
movq 0x368(%rsp), %rsi
callq 0x31b0
jmp 0x3d76
movq 0x370(%rsp), %rax
movq %rax, 0x8(%rsp)
leaq 0x127(%rsp), %rdi
movq %rdi, 0x10(%rsp)
callq 0x3420
movq 0x8(%rsp), %rsi
movq 0x10(%rsp), %rdx
leaq 0x128(%rsp), %rdi
callq 0x33f0
jmp 0x3dae
leaq 0x34e4(%rip), %rsi      # 0x7299
leaq 0x148(%rsp), %rdi
leaq 0x128(%rsp), %rdx
callq 0x33e0
jmp 0x3dcc
leaq 0x3506(%rip), %rdx      # 0x72d9
leaq 0x168(%rsp), %rdi
leaq 0x148(%rsp), %rsi
callq 0x3090
jmp 0x3dea
leaq 0x148(%rsp), %rdi
callq 0x3130
leaq 0x128(%rsp), %rdi
callq 0x3130
leaq 0x127(%rsp), %rdi
callq 0x3260
leaq 0x40(%rsp), %rdi
leaq 0x188(%rsp), %rsi
callq 0x3220
jmp 0x3e25
leaq 0x3270(%rip), %rsi      # 0x709c
leaq 0x60(%rsp), %rdi
leaq 0x40(%rsp), %rdx
callq 0x33e0
jmp 0x3e3d
leaq 0x3498(%rip), %rdx      # 0x72dc
leaq 0x80(%rsp), %rdi
leaq 0x60(%rsp), %rsi
callq 0x3090
jmp 0x3e58
leaq 0xa0(%rsp), %rdi
leaq 0x80(%rsp), %rsi
leaq 0x340(%rsp), %rdx
callq 0x3380
jmp 0x3e77
leaq 0x346b(%rip), %rdx      # 0x72e9
leaq 0xc0(%rsp), %rdi
leaq 0xa0(%rsp), %rsi
callq 0x3090
jmp 0x3e95
leaq 0xe0(%rsp), %rdi
leaq 0xc0(%rsp), %rsi
leaq 0x320(%rsp), %rdx
callq 0x3380
jmp 0x3eb4
leaq 0x341e(%rip), %rdx      # 0x72d9
leaq 0x100(%rsp), %rdi
leaq 0xe0(%rsp), %rsi
callq 0x3090
jmp 0x3ed2
leaq 0x168(%rsp), %rdi
leaq 0x100(%rsp), %rsi
callq 0x32e0
jmp 0x3ee9
leaq 0x100(%rsp), %rdi
callq 0x3130
leaq 0xe0(%rsp), %rdi
callq 0x3130
leaq 0xc0(%rsp), %rdi
callq 0x3130
leaq 0xa0(%rsp), %rdi
callq 0x3130
leaq 0x80(%rsp), %rdi
callq 0x3130
leaq 0x60(%rsp), %rdi
callq 0x3130
leaq 0x40(%rsp), %rdi
callq 0x3130
leaq 0x20(%rsp), %rdi
leaq 0x168(%rsp), %rsi
callq 0x30f0
jmp 0x3f52
leaq 0x20(%rsp), %rdi
callq 0x38f0
jmp 0x3f5e
leaq 0x20(%rsp), %rdi
callq 0x3130
movq 0x370(%rsp), %rax
movq %rax, (%rsp)
leaq 0x168(%rsp), %rdi
callq 0x3130
leaq 0x188(%rsp), %rdi
callq 0x31a0
leaq 0x320(%rsp), %rdi
callq 0x3130
leaq 0x340(%rsp), %rdi
callq 0x3130
movq (%rsp), %rax
addq $0x378, %rsp            # imm = 0x378
retq
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x4175
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x4027
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x401a
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
leaq 0x148(%rsp), %rdi
callq 0x3130
leaq 0x128(%rsp), %rdi
callq 0x3130
leaq 0x127(%rsp), %rdi
callq 0x3260
jmp 0x4175
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x4168
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x413e
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x4134
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x4127
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x411a
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x410d
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
jmp 0x4100
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
leaq 0x100(%rsp), %rdi
callq 0x3130
leaq 0xe0(%rsp), %rdi
callq 0x3130
leaq 0xc0(%rsp), %rdi
callq 0x3130
leaq 0xa0(%rsp), %rdi
callq 0x3130
leaq 0x80(%rsp), %rdi
callq 0x3130
leaq 0x60(%rsp), %rdi
callq 0x3130
leaq 0x40(%rsp), %rdi
callq 0x3130
jmp 0x4168
movq %rax, %rcx
movl %edx, %eax
movq %rcx, 0x318(%rsp)
movl %eax, 0x314(%rsp)
leaq 0x20(%rsp), %rdi
callq 0x3130
leaq 0x168(%rsp), %rdi
callq 0x3130
leaq 0x188(%rsp), %rdi
callq 0x31a0
leaq 0x320(%rsp), %rdi
callq 0x3130
leaq 0x340(%rsp), %rdi
callq 0x3130
movq 0x318(%rsp), %rdi
callq 0x3410
nopl (%rax)