// File: /workspace/github_c_makefile_star2_O0/cbouilla[P]AES-attacks-finder/Search.c
// Function: RandomizedSearch
Solver RandomizedSearch(const int T, Solver *B1, const int N1, SysEqLin E)
{
	int Alloue=1000; // espace alloué pour stocker les solvers
	Solver * __restrict Candidat=malloc(Alloue*sizeof(Solver));
	int N=0;
	int v_max=0;
	int proba = 0;
	int pos=0;
	Solver * __restrict guess_probable = malloc(N1*sizeof(Solver));
	printf("Randomized Search : \n");
	unsigned int cpt=0;
	int cpt2=0;
	const int coeff_proba=200*E->gen/E->a;
	Solver tmp;
	while (1)
	{
		cpt++;
		// On génère une solver
		if (cpt2 < proba) tmp=GenerateSolver(T,guess_probable,pos,E);
		else tmp=GenerateSolver(T,B1,N1,E);
		int i=0;
		// On la teste vis à vis des autres
		while (i < N)
		{
			Solver tmp2=UnionSolverBorne(Candidat[i],tmp,E,T);
			if (tmp2!=NULL)
			{
				if (tmp2->Nvar == Candidat[i]->Nvar)
				{
					freeSolver(tmp2);
					break;
				}
				if (tmp2->Nvar == tmp->Nvar)
				{
					N--;
					freeSolver(Candidat[i]);
					Candidat[i]=Candidat[N];
					freeSolver(tmp2);
				}
				else
				{
					N--;
					freeSolver(Candidat[i]);
					Candidat[i]=Candidat[N];
					freeSolver(tmp);
					tmp=PropagateSolver2(tmp2,E,B1,N1);
					freeSolver(tmp2);
					printf("\ncollision found!! Output : %d\n",tmp->sortie);
					if (tmp->sortie<T && tmp->sortie>0)
					{
						SysEqLin F = EsachantX(tmp->var,tmp->Nvar,E);
						tmp2 = SearchAlgoLowMem(F,T-tmp->sortie);
						if (tmp2)
						{
							Solver tmp3 = NewSolver();
							tmp3->var = UnionListesTriees(tmp->var,tmp->Nvar,tmp2->var,tmp2->Nvar,&tmp3->Nvar);
							tmp3->temps = max(tmp->temps,tmp->sortie+tmp2->temps);
							tmp3->memoire = max(tmp->memoire,tmp2->memoire);
							tmp3->sortie = tmp->sortie + tmp2->sortie;
							tmp3->type = 2;
							tmp3->fils2 = tmp;
							tmp3->fils1 = tmp2;
							tmp = tmp3;
						}
						freeSysEq(F);
					}
					if (tmp->sortie>0) i=0;
					else i=N;
				}
			}
			else
			{
				//freeSolver(tmp2);
				i++;
			}
		}
		if (i==N) // c'est une nouvelle solver
		{
			if (tmp->sortie<=0) // On a probablement gagné
			{
				for (i = 0; i < N; i++) freeSolver(Candidat[i]);
				free(Candidat);
				for (i = 0; i < pos; i++) freeSolver(guess_probable[i]);
				free(guess_probable);
				printf("\n");
				return tmp;
			}
			Candidat[N++]=tmp;
			if (tmp->Nvar>=v_max) // Elle a beaucoup de variables -> elle parait interessante
			{
				/* On cherchera une partie des solvers générées dans son complémentaire */
				v_max=tmp->Nvar;
				for (i = 0; i < pos; i++) freeSolver(guess_probable[i]);
				pos=0;
				for (i = 0; i < N1; i++) if (!ContenuListesTriees(B1[i]->var,B1[i]->Nvar,tmp->var,tmp->Nvar)) guess_probable[pos++]=copySolver(B1[i]);
				proba=v_max*coeff_proba;
			}
			if (cpt2 >= 199)
			{
				printf("\r - generated solvers : %u, number of variables max : %d / %d ",cpt,v_max,E->a/E->gen);
				fflush(stdout);
				cpt2=0;
			}
			else cpt2++;
			if (N==Alloue) // On a atteint la limite d'espace alloué
			{
				i=0;
				while (i<N) // On supprime celles qui semblent peu intéressantes
				{
					if (Candidat[i]->Nvar<=(v_max+T)/2 && Candidat[i]->memoire<=1)
					{
						freeSolver(Candidat[i]);
						N--;
						Candidat[i]=Candidat[N];
					}
					else i++;
				}
				if (Alloue-N<500) // On realloue
				{
					Alloue+=1000;
					Candidat=realloc(Candidat,Alloue*sizeof(Solver));
					if (Candidat==NULL)
					{
						printf("Erreur allocation");
						getchar();
					}
				}
			}		
		}
		else // elle est moins interessante que celles que l'on a déjà
		{
			freeSolver(tmp);
			cpt2++;
		}
		if (N==1 && Candidat[0]->Nvar==E->a/E->gen) // On a gagné
		{
			tmp=Candidat[0];
			free(Candidat);
			printf("\n");
			return tmp;
		}
	}
	int i;
	for (i = 0; i < N; i++) freeSolver(Candidat[i]);
	free(Candidat);
	printf("\n");
	return NULL;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0xa0, %rsp
movl %edi, -0xc(%rbp)
movq %rsi, -0x18(%rbp)
movl %edx, -0x1c(%rbp)
movq %rcx, -0x28(%rbp)
movl $0x3e8, -0x2c(%rbp)     # imm = 0x3E8
movslq -0x2c(%rbp), %rdi
shlq $0x3, %rdi
callq 0x21c0
movq %rax, -0x38(%rbp)
movl $0x0, -0x3c(%rbp)
movl $0x0, -0x40(%rbp)
movl $0x0, -0x44(%rbp)
movl $0x0, -0x48(%rbp)
movslq -0x1c(%rbp), %rdi
shlq $0x3, %rdi
callq 0x21c0
movq %rax, -0x50(%rbp)
leaq 0x16c6e(%rip), %rdi     # 0x38e33
movb $0x0, %al
callq 0x2100
movl $0x0, -0x54(%rbp)
movl $0x0, -0x58(%rbp)
movq -0x28(%rbp), %rax
imull $0xc8, 0x10(%rax), %eax
movq -0x28(%rbp), %rcx
cltd
idivl 0x8(%rcx)
movl %eax, -0x5c(%rbp)
movl -0x54(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x54(%rbp)
movl -0x58(%rbp), %eax
cmpl -0x44(%rbp), %eax
jge 0x2221a
movl -0xc(%rbp), %edi
movq -0x50(%rbp), %rsi
movl -0x48(%rbp), %edx
movq -0x28(%rbp), %rcx
callq 0x21ae0
movq %rax, -0x68(%rbp)
jmp 0x22231
movl -0xc(%rbp), %edi
movq -0x18(%rbp), %rsi
movl -0x1c(%rbp), %edx
movq -0x28(%rbp), %rcx
callq 0x21ae0
movq %rax, -0x68(%rbp)
movl $0x0, -0x6c(%rbp)
movl -0x6c(%rbp), %eax
cmpl -0x3c(%rbp), %eax
jge 0x224fe
movq -0x38(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rdi
movq -0x68(%rbp), %rsi
movq -0x28(%rbp), %rdx
movl -0xc(%rbp), %ecx
callq 0xac00
movq %rax, -0x78(%rbp)
cmpq $0x0, -0x78(%rbp)
je 0x224f0
movq -0x78(%rbp), %rax
movl 0x8(%rax), %eax
movq -0x38(%rbp), %rcx
movslq -0x6c(%rbp), %rdx
movq (%rcx,%rdx,8), %rcx
cmpl 0x8(%rcx), %eax
jne 0x22295
movq -0x78(%rbp), %rdi
callq 0x93b0
jmp 0x224fe
movq -0x78(%rbp), %rax
movl 0x8(%rax), %eax
movq -0x68(%rbp), %rcx
cmpl 0x8(%rcx), %eax
jne 0x222e5
movl -0x3c(%rbp), %eax
addl $-0x1, %eax
movl %eax, -0x3c(%rbp)
movq -0x38(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rdi
callq 0x93b0
movq -0x38(%rbp), %rax
movslq -0x3c(%rbp), %rcx
movq (%rax,%rcx,8), %rdx
movq -0x38(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq %rdx, (%rax,%rcx,8)
movq -0x78(%rbp), %rdi
callq 0x93b0
jmp 0x224ee
movl -0x3c(%rbp), %eax
addl $-0x1, %eax
movl %eax, -0x3c(%rbp)
movq -0x38(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rdi
callq 0x93b0
movq -0x38(%rbp), %rax
movslq -0x3c(%rbp), %rcx
movq (%rax,%rcx,8), %rdx
movq -0x38(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq %rdx, (%rax,%rcx,8)
movq -0x68(%rbp), %rdi
callq 0x93b0
movq -0x78(%rbp), %rdi
movq -0x28(%rbp), %rsi
movq -0x18(%rbp), %rdx
movl -0x1c(%rbp), %ecx
callq 0xb580
movq %rax, -0x68(%rbp)
movq -0x78(%rbp), %rdi
callq 0x93b0
movq -0x68(%rbp), %rax
movl 0x14(%rax), %esi
leaq 0x16afa(%rip), %rdi     # 0x38e49
movb $0x0, %al
callq 0x2100
movq -0x68(%rbp), %rax
movl 0x14(%rax), %eax
cmpl -0xc(%rbp), %eax
jge 0x224d3
movq -0x68(%rbp), %rax
cmpl $0x0, 0x14(%rax)
jle 0x224d3
movq -0x68(%rbp), %rax
movq (%rax), %rdi
movq -0x68(%rbp), %rax
movl 0x8(%rax), %esi
movq -0x28(%rbp), %rdx
callq 0x11aa0
movq %rax, -0x80(%rbp)
movq -0x80(%rbp), %rdi
movl -0xc(%rbp), %esi
movq -0x68(%rbp), %rax
subl 0x14(%rax), %esi
callq 0x1cb00
movq %rax, -0x78(%rbp)
cmpq $0x0, -0x78(%rbp)
je 0x224ca
callq 0x9280
movq %rax, -0x88(%rbp)
movq -0x68(%rbp), %rax
movq (%rax), %rdi
movq -0x68(%rbp), %rax
movl 0x8(%rax), %esi
movq -0x78(%rbp), %rax
movq (%rax), %rdx
movq -0x78(%rbp), %rax
movl 0x8(%rax), %ecx
movq -0x88(%rbp), %r8
addq $0x8, %r8
callq 0x24e0
movq %rax, %rcx
movq -0x88(%rbp), %rax
movq %rcx, (%rax)
movq -0x68(%rbp), %rax
movl 0xc(%rax), %eax
movq -0x68(%rbp), %rcx
movl 0x14(%rcx), %ecx
movq -0x78(%rbp), %rdx
addl 0xc(%rdx), %ecx
cmpl %ecx, %eax
jle 0x2241e
movq -0x68(%rbp), %rax
movl 0xc(%rax), %eax
movl %eax, -0x90(%rbp)
jmp 0x22432
movq -0x68(%rbp), %rax
movl 0x14(%rax), %eax
movq -0x78(%rbp), %rcx
addl 0xc(%rcx), %eax
movl %eax, -0x90(%rbp)
movl -0x90(%rbp), %ecx
movq -0x88(%rbp), %rax
movl %ecx, 0xc(%rax)
movq -0x68(%rbp), %rax
movl 0x10(%rax), %eax
movq -0x78(%rbp), %rcx
cmpl 0x10(%rcx), %eax
jle 0x22461
movq -0x68(%rbp), %rax
movl 0x10(%rax), %eax
movl %eax, -0x94(%rbp)
jmp 0x2246e
movq -0x78(%rbp), %rax
movl 0x10(%rax), %eax
movl %eax, -0x94(%rbp)
movl -0x94(%rbp), %ecx
movq -0x88(%rbp), %rax
movl %ecx, 0x10(%rax)
movq -0x68(%rbp), %rax
movl 0x14(%rax), %ecx
movq -0x78(%rbp), %rax
addl 0x14(%rax), %ecx
movq -0x88(%rbp), %rax
movl %ecx, 0x14(%rax)
movq -0x88(%rbp), %rax
movb $0x2, 0x18(%rax)
movq -0x68(%rbp), %rcx
movq -0x88(%rbp), %rax
movq %rcx, 0x28(%rax)
movq -0x78(%rbp), %rcx
movq -0x88(%rbp), %rax
movq %rcx, 0x20(%rax)
movq -0x88(%rbp), %rax
movq %rax, -0x68(%rbp)
movq -0x80(%rbp), %rdi
callq 0x12220
movq -0x68(%rbp), %rax
cmpl $0x0, 0x14(%rax)
jle 0x224e6
movl $0x0, -0x6c(%rbp)
jmp 0x224ec
movl -0x3c(%rbp), %eax
movl %eax, -0x6c(%rbp)
jmp 0x224ee
jmp 0x224f9
movl -0x6c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x6c(%rbp)
jmp 0x22238
movl -0x6c(%rbp), %eax
cmpl -0x3c(%rbp), %eax
jne 0x227d1
movq -0x68(%rbp), %rax
cmpl $0x0, 0x14(%rax)
jg 0x2259b
movl $0x0, -0x6c(%rbp)
movl -0x6c(%rbp), %eax
cmpl -0x3c(%rbp), %eax
jge 0x22543
movq -0x38(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rdi
callq 0x93b0
movl -0x6c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x6c(%rbp)
jmp 0x2251f
movq -0x38(%rbp), %rdi
callq 0x2030
movl $0x0, -0x6c(%rbp)
movl -0x6c(%rbp), %eax
cmpl -0x48(%rbp), %eax
jge 0x22577
movq -0x50(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rdi
callq 0x93b0
movl -0x6c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x6c(%rbp)
jmp 0x22553
movq -0x50(%rbp), %rdi
callq 0x2030
leaq 0x14950(%rip), %rdi     # 0x36ed7
movb $0x0, %al
callq 0x2100
movq -0x68(%rbp), %rax
movq %rax, -0x8(%rbp)
jmp 0x22845
movq -0x68(%rbp), %rdx
movq -0x38(%rbp), %rax
movl -0x3c(%rbp), %ecx
movl %ecx, %esi
addl $0x1, %esi
movl %esi, -0x3c(%rbp)
movslq %ecx, %rcx
movq %rdx, (%rax,%rcx,8)
movq -0x68(%rbp), %rax
movl 0x8(%rax), %eax
cmpl -0x40(%rbp), %eax
jl 0x22687
movq -0x68(%rbp), %rax
movl 0x8(%rax), %eax
movl %eax, -0x40(%rbp)
movl $0x0, -0x6c(%rbp)
movl -0x6c(%rbp), %eax
cmpl -0x48(%rbp), %eax
jge 0x225fa
movq -0x50(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rdi
callq 0x93b0
movl -0x6c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x6c(%rbp)
jmp 0x225d6
movl $0x0, -0x48(%rbp)
movl $0x0, -0x6c(%rbp)
movl -0x6c(%rbp), %eax
cmpl -0x1c(%rbp), %eax
jge 0x2267d
movq -0x18(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rax
movq (%rax), %rdi
movq -0x18(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rax
movl 0x8(%rax), %esi
movq -0x68(%rbp), %rax
movq (%rax), %rdx
movq -0x68(%rbp), %rax
movl 0x8(%rax), %ecx
callq 0x3360
cmpl $0x0, %eax
jne 0x22670
movq -0x18(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rdi
callq 0x9380
movq %rax, %rdx
movq -0x50(%rbp), %rax
movl -0x48(%rbp), %ecx
movl %ecx, %esi
addl $0x1, %esi
movl %esi, -0x48(%rbp)
movslq %ecx, %rcx
movq %rdx, (%rax,%rcx,8)
jmp 0x22672
movl -0x6c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x6c(%rbp)
jmp 0x22608
movl -0x40(%rbp), %eax
imull -0x5c(%rbp), %eax
movl %eax, -0x44(%rbp)
cmpl $0xc7, -0x58(%rbp)
jl 0x226d9
movl -0x54(%rbp), %esi
movl -0x40(%rbp), %eax
movl %eax, -0x98(%rbp)
movq -0x28(%rbp), %rax
movl 0x8(%rax), %eax
movq -0x28(%rbp), %rcx
cltd
idivl 0x10(%rcx)
movl -0x98(%rbp), %edx
movl %eax, %ecx
leaq 0x167af(%rip), %rdi     # 0x38e69
movb $0x0, %al
callq 0x2100
movq 0x1a900(%rip), %rax     # 0x3cfc8
movq (%rax), %rdi
callq 0x21d0
movl $0x0, -0x58(%rbp)
jmp 0x226e2
movl -0x58(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x58(%rbp)
movl -0x3c(%rbp), %eax
cmpl -0x2c(%rbp), %eax
jne 0x227cf
movl $0x0, -0x6c(%rbp)
movl -0x6c(%rbp), %eax
cmpl -0x3c(%rbp), %eax
jge 0x22784
movq -0x38(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rax
movl 0x8(%rax), %eax
movl %eax, -0x9c(%rbp)
movl -0x40(%rbp), %eax
addl -0xc(%rbp), %eax
movl $0x2, %ecx
cltd
idivl %ecx
movl %eax, %ecx
movl -0x9c(%rbp), %eax
cmpl %ecx, %eax
jg 0x22776
movq -0x38(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rax
cmpl $0x1, 0x10(%rax)
jg 0x22776
movq -0x38(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq (%rax,%rcx,8), %rdi
callq 0x93b0
movl -0x3c(%rbp), %eax
addl $-0x1, %eax
movl %eax, -0x3c(%rbp)
movq -0x38(%rbp), %rax
movslq -0x3c(%rbp), %rcx
movq (%rax,%rcx,8), %rdx
movq -0x38(%rbp), %rax
movslq -0x6c(%rbp), %rcx
movq %rdx, (%rax,%rcx,8)
jmp 0x2277f
movl -0x6c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x6c(%rbp)
jmp 0x226f5
movl -0x2c(%rbp), %eax
subl -0x3c(%rbp), %eax
cmpl $0x1f4, %eax            # imm = 0x1F4
jge 0x227cd
movl -0x2c(%rbp), %eax
addl $0x3e8, %eax            # imm = 0x3E8
movl %eax, -0x2c(%rbp)
movq -0x38(%rbp), %rdi
movslq -0x2c(%rbp), %rsi
shlq $0x3, %rsi
callq 0x21f0
movq %rax, -0x38(%rbp)
cmpq $0x0, -0x38(%rbp)
jne 0x227cb
leaq 0x166e9(%rip), %rdi     # 0x38ea8
movb $0x0, %al
callq 0x2100
callq 0x2170
jmp 0x227cd
jmp 0x227cf
jmp 0x227e3
movq -0x68(%rbp), %rdi
callq 0x93b0
movl -0x58(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x58(%rbp)
cmpl $0x1, -0x3c(%rbp)
jne 0x22840
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl 0x8(%rax), %eax
movl %eax, -0xa0(%rbp)
movq -0x28(%rbp), %rax
movl 0x8(%rax), %eax
movq -0x28(%rbp), %rcx
cltd
idivl 0x10(%rcx)
movl %eax, %ecx
movl -0xa0(%rbp), %eax
cmpl %ecx, %eax
jne 0x22840
movq -0x38(%rbp), %rax
movq (%rax), %rax
movq %rax, -0x68(%rbp)
movq -0x38(%rbp), %rdi
callq 0x2030
leaq 0x146a8(%rip), %rdi     # 0x36ed7
movb $0x0, %al
callq 0x2100
movq -0x68(%rbp), %rax
movq %rax, -0x8(%rbp)
jmp 0x22845
jmp 0x221f0
movq -0x8(%rbp), %rax
addq $0xa0, %rsp
popq %rbp
retq
nopw %cs:(%rax,%rax)