Bypassing JNI anti-tamper on Android
The Challenge: Moving Beyond Bytecode
In the world of Android security, most research revolves around the JVM layer. We’re used to patching .dex files using Smali or leveraging automated frameworks like ReVanced.
It’s a comfortable space, but developers are increasingly moving the “crown jewels” out of reach.
Sophisticated applications now bury their most critical logic—license verification, anti-tamper mechanisms, and complex obfuscation—inside Native Libraries (.so files).
By using the Java Native Interface (JNI), they move the security frontier from easily readable bytecode to compiled machine code.
When logic is shifted to the native layer, simply patching the Java caller is no longer enough; the library itself will often detect the change and refuse to cooperate.
Hands-on example
I recently encountered a target that utilized native “kill-switches” embedded directly within the JNI_OnLoad function.
In the JNI lifecycle, JNI_OnLoad is the gatekeeper. It is the very first function executed when a library is loaded; if it returns an error or triggers a crash, the library fails to initialize, effectively neutralizing any Java features that depend on it.
Identifying the Target
Our first step is to locate where the native bridge is established.
Opening the APK in jadx, we look for the System.loadLibrary call and the native method definitions:
package foo.bar.baz.LicenceManager
public final class DefaultPublicKeyDataProvider implements PublicKeyDataProvider {
public final Base64Coding a;
@Metadata(d1 = {"<metadata>")
public static final class Companion {
}
static {
System.loadLibrary("lm");
}
public DefaultPublicKeyDataProvider(Base64Coding base64Coding) {
this.a = base64Coding;
}
@JvmStatic
private static final native String getPublicKeyData();
@Override
public final Object a() {
return this.a.decode(getPublicKeyData());
}
}
If we try to bypass the logic in Java, we hit a wall: the library liblm.so performs its own integrity checks upon loading.
If we’ve tampered with the APK, JNI_OnLoad detects the signature mismatch and kills the process before getPublicKeyData() can even be called.
type: logcat
osVersion: google/blazer/blazer:16/
package: com.foo.myapp:75, targetSdk 35
buffers: main,system,crash,events,kernel
level: error
--------- beginning of main
01-10 07:57:59.231 11550 11550 E FeatureFlagsImplExport: android.os.flagging.AconfigStorageReadException: ERROR_PACKAGE_NOT_FOUND: package android.xr cannot be found on the device
01-10 07:57:59.329 11550 11847 E ashmem : Pinning is deprecated since Android Q. Please use trim or other methods.
--------- beginning of crash
01-10 07:57:59.367 11550 11550 E AndroidRuntime: FATAL EXCEPTION: main
01-10 07:57:59.367 11550 11550 E AndroidRuntime: Process: com.foo.myapp, PID: 11550
01-10 07:57:59.367 11550 11550 E AndroidRuntime: java.lang.UnsatisfiedLinkError: JNI_ERR returned from JNI_OnLoad in "/data/app/~~A-Ly5qW1ZbWSSjYZdgcnjQ==/com.foo.myapp-U4v8WCluA7NjDuUwNy3fCw==/lib/arm64/libfusefs.so"
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at java.lang.Runtime.loadLibrary0(Runtime.java:1097)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at java.lang.Runtime.loadLibrary0(Runtime.java:1019)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at java.lang.System.loadLibrary(System.java:1765)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.foo.myapp.data.common.junction.fusefs.BlockingFuseFileSystem.<clinit>(Unknown Source:2)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.foo.myapp.data.common.LibraryManagerImpl.a(Unknown Source:5)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.foo.myapp.ui.storagemanager.service.server.local.DomainLauncher.b(Unknown Source:63)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.foo.myapp.ui.EdsApp$onCreate$1.invokeSuspend(Unknown Source:43)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.foo.myapp.ui.EdsApp$onCreate$1.invoke(Unknown Source:12)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.foo.myapp.data.common.threadcoroutinecontext.LaunchBlockingKt$launchBlocking$1.invokeSuspend(Unknown Source:45)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.foo.myapp.data.common.threadcoroutinecontext.LaunchBlockingKt$launchBlocking$1.invoke(Unknown Source:12)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at kotlinx.coroutines.CoroutineStart.a(Unknown Source:40)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.foo.myapp.data.common.threadcoroutinecontext.LaunchBlockingKt.a(Unknown Source:41)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.foo.myapp.ui.EdsApp.onCreate(Unknown Source:52)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:1406)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at android.app.ActivityThread.handleBindApplication(ActivityThread.java:8183)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at android.app.ActivityThread.-$$Nest$mhandleBindApplication(Unknown Source:0)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at android.app.ActivityThread$H.handleMessage(ActivityThread.java:2699)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:132)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at android.os.Looper.dispatchMessage(Looper.java:333)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at android.os.Looper.loopOnce(Looper.java:263)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at android.os.Looper.loop(Looper.java:367)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at android.app.ActivityThread.main(ActivityThread.java:9331)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:566)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.android.internal.os.ExecInit.main(ExecInit.java:50)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.android.internal.os.RuntimeInit.nativeFinishInit(Native Method)
01-10 07:57:59.367 11550 11550 E AndroidRuntime: at com.android.internal.os.RuntimeInit.main(RuntimeInit.java:366)
Into the Depths: Analyzing liblm.so with Ghidra
Once we’ve identified that the security logic is anchored in the native layer, we need to extract the liblm.so file from the APK (usually found in the lib/arm64-v8a/ directory) and load it into Ghidra.
decompiled_apk/lib/arm64-v8a
❯ ls
Permissions Size User Date Modified Name
.rw-r--r-- 4.0M blaz 1 Jan 1981 libcryfs-jni.so
.rw-r--r-- 1.7M blaz 1 Jan 1981 libcrypto.so
.rw-r--r-- 2.6M blaz 1 Jan 1981 libcryptsetup.so
.rw-r--r-- 4.1M blaz 1 Jan 1981 libencfs-jni.so
.rw-r--r-- 4.3k blaz 1 Jan 1981 liberrno-lib.so
.rw-r--r-- 210k blaz 1 Jan 1981 libexfat.so
.rw-r--r-- 641k blaz 1 Jan 1981 libext4.so
.rw-r--r-- 183k blaz 1 Jan 1981 libfat.so
.rw-r--r-- 52k blaz 1 Jan 1981 libfdutil.so
.rw-r--r-- 134k blaz 1 Jan 1981 libfusefs.so
.rw-r--r-- 104k blaz 1 Jan 1981 libgocryptfs-jni.so
.rw-r--r-- 8.1M blaz 1 Jan 1981 libgocryptfs.so
.rw-r--r-- 68k blaz 1 Jan 1981 libjson-c.so
.rw-r--r-- 111k blaz 1 Jan 1981 liblibusb.so
.rw-r--r-- 8.9k blaz 1 Jan 1981 liblibusbcom.so
.rw-r--r-- 41k blaz 1 Jan 1981 liblm.so
.rw-r--r-- 36k blaz 1 Jan 1981 libmemoryutil.so
.rw-r--r-- 345k blaz 1 Jan 1981 libmounter.so
.rw-r--r-- 389k blaz 1 Jan 1981 libnrb.so
.rw-r--r-- 648k blaz 1 Jan 1981 libntfs.so
.rw-r--r-- 6.5M blaz 1 Jan 1981 libpdfsdk.so
.rw-r--r-- 47k blaz 1 Jan 1981 libpdfsdk_jni.so
.rw-r--r-- 626k blaz 1 Jan 1981 libsmb.so
.rw-r--r-- 272k blaz 1 Jan 1981 libsmb2.so
.rw-r--r-- 1.8M blaz 1 Jan 1981 libsqlite3x.so
.rw-r--r-- 5.2k blaz 1 Jan 1981 libusb-lib.so
.rw-r--r-- 564k blaz 1 Jan 1981 libutil.so
.rw-r--r-- 1.8M blaz 1 Jan 1981 libveracrypt.so
We are on the right track. Among all the other libraries the app depends on, there’s also liblm.so — the one we are interested in. Let’s open it in Ghidra to see what we find!
Locating the Entry Point
In the Symbol Tree, we look for JNI_OnLoad. This is the function the Android Runtime (ART) calls immediately after System.loadLibrary().
Looking at the decompiled JNI_OnLoad, this is what we find:
undefined8 JNI_OnLoad(undefined8 param_1)
{
int iVar1;
undefined8 uVar2;
obfs_check1_start();
uVar2 = loadJniUtil(param_1);
if (-1 < (int)uVar2) {
getEnv();
iVar1 = obfs_check1_finish();
if (iVar1 == 0) {
clearJni();
uVar2 = 0xffffffff;
}
else {
uVar2 = 0x10006;
}
}
return uVar2;
}
The code is not very hard to read as-is, but let’s rename the parameter, local variables, and return value to make it even clearer.
undefined8 JNI_OnLoad(undefined8 JavaVM)
{
int antiTamperCheck?;
undefined8 JNI_VERSION;
obfs_check1_start();
JNI_VERSION = loadJniUtil(JavaVM);
if (-1 < (int)JNI_VERSION) {
getEnv();
antiTamperCheck? = obfs_check1_finish();
if (antiTamperCheck? == 0) {
clearJni();
JNI_VERSION = 0xffffffff;
}
else {
JNI_VERSION = 0x10006;
}
}
return JNI_VERSION;
}
When we look at the decompiled C code, several red flags appear that indicate this isn’t just a standard library registration.
The developers have wrapped the initialization process in multiple validation layers:
The Starting Gun (obfs_check1_start): This function simply captures the current CPU time using clock() and stores it in a global variable (DAT_00111928).
- This is a classic anti-debugging/anti-tracing technique.
- By marking the exact moment the library starts loading, the application can later calculate how long the initialization took.
Here’s the code of the obfs_check1_start if you’re interested:
obfs_check1_start code
void obfs_check1_start(void)
{
DAT_00111928 = clock();
return;
}
The Bridge Initialization (loadJniUtil): The library attempts to load its internal utilities.
- Notice the check if (-1 < (int)uVar2). In JNI, returning -1 (typically JNI_ERR) tells the Android Runtime that the library failed to load, which crashes the Java side with an UnsatisfiedLinkError.
The “Trap” (obfs_check1_finish): This is the most critical part of the logic.
- Even if the library loads correctly, it runs a finishing check.
- If iVar1 == 0 (the check fails), it calls clearJni() to wipe sensitive data from memory and returns 0xffffffff (-1).
- If it succeeds, it returns 0x10006—the hex constant for JNI_VERSION_1_6, signaling to Android that everything is fine.
Here is the code for obfs_check1_finish if you are interested (note that it is very long and difficult to read; thankfully, we won’t have to deal with it much besides acknowledging its existence):
obfs_check1_finish code
void obfs_check1_finish(long *param_1)
{
char cVar1;
long lVar2;
undefined1 auVar3 [16];
undefined1 auVar4 [16];
undefined1 auVar5 [16];
undefined1 auVar6 [16];
undefined1 auVar7 [16];
undefined1 auVar8 [16];
undefined1 auVar9 [16];
undefined1 auVar10 [16];
undefined1 auVar11 [16];
undefined1 auVar12 [16];
undefined1 auVar13 [16];
undefined1 auVar14 [16];
undefined1 auVar15 [16];
undefined1 auVar16 [16];
undefined1 auVar17 [16];
undefined1 auVar18 [16];
undefined1 auVar19 [16];
undefined1 auVar20 [16];
undefined1 auVar21 [16];
undefined1 auVar22 [16];
undefined1 auVar23 [16];
undefined1 auVar24 [16];
undefined1 auVar25 [16];
int iVar26;
uint uVar27;
clock_t cVar28;
void *pvVar29;
long lVar30;
undefined8 uVar31;
void *pvVar32;
long lVar33;
long lVar34;
undefined8 uVar35;
undefined8 uVar36;
undefined8 uVar37;
undefined8 uVar38;
undefined8 uVar39;
undefined8 uVar40;
undefined8 uVar41;
undefined8 uVar42;
undefined8 uVar43;
byte *pbVar44;
char *__s2;
char *pcVar45;
ulong uVar46;
byte *pbVar47;
code *pcVar48;
byte bVar49;
byte bVar50;
byte bVar51;
byte bVar52;
byte bVar53;
byte bVar54;
byte bVar55;
byte bVar56;
byte bVar57;
byte bVar58;
byte bVar59;
byte bVar60;
byte bVar61;
byte bVar62;
byte bVar63;
byte bVar64;
undefined1 auVar65 [16];
int iVar66;
int iVar67;
int iVar68;
int iVar69;
int iVar70;
int iVar71;
int iVar72;
int iVar73;
int iVar74;
byte bVar75;
byte bVar76;
byte bVar77;
byte bVar78;
byte bVar79;
byte bVar80;
byte bVar81;
byte bVar82;
byte bVar83;
byte bVar84;
byte bVar85;
byte bVar86;
byte bVar87;
byte bVar88;
byte bVar89;
byte bVar90;
int iVar91;
int iVar92;
int iVar93;
int iVar94;
uint local_84;
undefined8 local_80;
undefined8 uStack_78;
long local_68;
lVar2 = tpidr_el0;
local_68 = *(long *)(lVar2 + 0x28);
cVar28 = clock();
if (((double)(cVar28 - DAT_00111928) / 1000000.0 <= 0.1) && (param_1 != (long *)0x0)) {
pvVar29 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar93 = 3;
iVar94 = 4;
iVar91 = 1;
iVar92 = 2;
uVar35 = 0;
uVar31 = 0x541c0770;
iVar26 = 0x238;
do {
iVar66 = iVar91 * 0x105c72;
iVar67 = iVar92 * 0x105c72;
iVar68 = iVar93 * 0x105c72;
iVar69 = iVar94 * 0x105c72;
iVar91 = iVar91 + 8;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar26 = iVar26 + -8;
iVar70 = iVar66 + 0x4171c8;
iVar71 = iVar67 + 0x4171c8;
iVar72 = iVar68 + 0x4171c8;
iVar73 = iVar69 + 0x4171c8;
bVar75 = (byte)uVar31 ^ (byte)iVar66;
bVar76 = (byte)((ulong)uVar31 >> 8) ^ (byte)((uint)iVar66 >> 8);
bVar77 = (byte)((ulong)uVar31 >> 0x10) ^ (byte)((uint)iVar66 >> 0x10);
bVar78 = (byte)((ulong)uVar31 >> 0x18) ^ (byte)((uint)iVar66 >> 0x18);
bVar79 = (byte)((ulong)uVar31 >> 0x20) ^ (byte)iVar67;
bVar80 = (byte)((ulong)uVar31 >> 0x28) ^ (byte)((uint)iVar67 >> 8);
bVar81 = (byte)((ulong)uVar31 >> 0x30) ^ (byte)((uint)iVar67 >> 0x10);
bVar82 = (byte)((ulong)uVar31 >> 0x38) ^ (byte)((uint)iVar67 >> 0x18);
uVar31 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(bVar78,
CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))));
bVar83 = (byte)uVar35 ^ (byte)iVar68;
bVar84 = (byte)((ulong)uVar35 >> 8) ^ (byte)((uint)iVar68 >> 8);
bVar85 = (byte)((ulong)uVar35 >> 0x10) ^ (byte)((uint)iVar68 >> 0x10);
bVar86 = (byte)((ulong)uVar35 >> 0x18) ^ (byte)((uint)iVar68 >> 0x18);
bVar87 = (byte)((ulong)uVar35 >> 0x20) ^ (byte)iVar69;
bVar88 = (byte)((ulong)uVar35 >> 0x28) ^ (byte)((uint)iVar69 >> 8);
bVar89 = (byte)((ulong)uVar35 >> 0x30) ^ (byte)((uint)iVar69 >> 0x10);
bVar90 = (byte)((ulong)uVar35 >> 0x38) ^ (byte)((uint)iVar69 >> 0x18);
uVar35 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(bVar86,
CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))));
bVar49 = bVar49 ^ (byte)iVar70;
bVar50 = bVar50 ^ (byte)((uint)iVar70 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar70 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar70 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar71;
bVar54 = bVar54 ^ (byte)((uint)iVar71 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar71 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar71 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar72;
bVar58 = bVar58 ^ (byte)((uint)iVar72 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar72 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar72 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar73;
bVar62 = bVar62 ^ (byte)((uint)iVar73 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar73 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar73 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar65[1] = bVar50;
auVar65[0] = bVar49;
auVar65[2] = bVar51;
auVar65[3] = bVar52;
auVar65[4] = bVar53;
auVar65[5] = bVar54;
auVar65[6] = bVar55;
auVar65[7] = bVar56;
auVar65[8] = bVar57;
auVar65[9] = bVar58;
auVar65[10] = bVar59;
auVar65[0xb] = bVar60;
auVar65[0xc] = bVar61;
auVar65[0xd] = bVar62;
auVar65[0xe] = bVar63;
auVar65[0xf] = bVar64;
auVar3[1] = bVar50;
auVar3[0] = bVar49;
auVar3[2] = bVar51;
auVar3[3] = bVar52;
auVar3[4] = bVar53;
auVar3[5] = bVar54;
auVar3[6] = bVar55;
auVar3[7] = bVar56;
auVar3[8] = bVar57;
auVar3[9] = bVar58;
auVar3[10] = bVar59;
auVar3[0xb] = bVar60;
auVar3[0xc] = bVar61;
auVar3[0xd] = bVar62;
auVar3[0xe] = bVar63;
auVar3[0xf] = bVar64;
auVar65 = NEON_ext(auVar65,auVar3,8,1);
uVar27 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])
));
local_84 = uVar27 ^ 0x244e18f0 ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],uVar27)))) >> 0x20);
do {
*(byte *)((long)pvVar29 + uVar46) =
(&DAT_001025e8)[uVar46] ^ (byte)uVar46 ^ *(byte *)((ulong)&local_84 | uVar46 & 3);
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
lVar30 = (**(code **)(*param_1 + 0x30))(param_1,pvVar29);
uVar31 = __strlen_chk(pvVar29,0x80);
__memset_chk(pvVar29,0,uVar31,0x80);
free(pvVar29);
if (lVar30 != 0) {
pvVar29 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar93 = 3;
iVar94 = 4;
iVar91 = 1;
iVar92 = 2;
uVar35 = 0;
uVar31 = 0x5000f37e;
iVar26 = 0x348;
do {
iVar66 = iVar91 * 0x1c962c;
iVar67 = iVar92 * 0x1c962c;
iVar68 = iVar93 * 0x1c962c;
iVar69 = iVar94 * 0x1c962c;
iVar91 = iVar91 + 8;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar26 = iVar26 + -8;
iVar70 = iVar66 + 0x7258b0;
iVar71 = iVar67 + 0x7258b0;
iVar72 = iVar68 + 0x7258b0;
iVar73 = iVar69 + 0x7258b0;
bVar75 = (byte)uVar31 ^ (byte)iVar66;
bVar76 = (byte)((ulong)uVar31 >> 8) ^ (byte)((uint)iVar66 >> 8);
bVar77 = (byte)((ulong)uVar31 >> 0x10) ^ (byte)((uint)iVar66 >> 0x10);
bVar78 = (byte)((ulong)uVar31 >> 0x18) ^ (byte)((uint)iVar66 >> 0x18);
bVar79 = (byte)((ulong)uVar31 >> 0x20) ^ (byte)iVar67;
bVar80 = (byte)((ulong)uVar31 >> 0x28) ^ (byte)((uint)iVar67 >> 8);
bVar81 = (byte)((ulong)uVar31 >> 0x30) ^ (byte)((uint)iVar67 >> 0x10);
bVar82 = (byte)((ulong)uVar31 >> 0x38) ^ (byte)((uint)iVar67 >> 0x18);
uVar31 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(bVar78,
CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))));
bVar83 = (byte)uVar35 ^ (byte)iVar68;
bVar84 = (byte)((ulong)uVar35 >> 8) ^ (byte)((uint)iVar68 >> 8);
bVar85 = (byte)((ulong)uVar35 >> 0x10) ^ (byte)((uint)iVar68 >> 0x10);
bVar86 = (byte)((ulong)uVar35 >> 0x18) ^ (byte)((uint)iVar68 >> 0x18);
bVar87 = (byte)((ulong)uVar35 >> 0x20) ^ (byte)iVar69;
bVar88 = (byte)((ulong)uVar35 >> 0x28) ^ (byte)((uint)iVar69 >> 8);
bVar89 = (byte)((ulong)uVar35 >> 0x30) ^ (byte)((uint)iVar69 >> 0x10);
bVar90 = (byte)((ulong)uVar35 >> 0x38) ^ (byte)((uint)iVar69 >> 0x18);
uVar35 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(bVar86,
CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))));
bVar49 = bVar49 ^ (byte)iVar70;
bVar50 = bVar50 ^ (byte)((uint)iVar70 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar70 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar70 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar71;
bVar54 = bVar54 ^ (byte)((uint)iVar71 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar71 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar71 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar72;
bVar58 = bVar58 ^ (byte)((uint)iVar72 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar72 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar72 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar73;
bVar62 = bVar62 ^ (byte)((uint)iVar73 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar73 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar73 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar4[1] = bVar50;
auVar4[0] = bVar49;
auVar4[2] = bVar51;
auVar4[3] = bVar52;
auVar4[4] = bVar53;
auVar4[5] = bVar54;
auVar4[6] = bVar55;
auVar4[7] = bVar56;
auVar4[8] = bVar57;
auVar4[9] = bVar58;
auVar4[10] = bVar59;
auVar4[0xb] = bVar60;
auVar4[0xc] = bVar61;
auVar4[0xd] = bVar62;
auVar4[0xe] = bVar63;
auVar4[0xf] = bVar64;
auVar5[1] = bVar50;
auVar5[0] = bVar49;
auVar5[2] = bVar51;
auVar5[3] = bVar52;
auVar5[4] = bVar53;
auVar5[5] = bVar54;
auVar5[6] = bVar55;
auVar5[7] = bVar56;
auVar5[8] = bVar57;
auVar5[9] = bVar58;
auVar5[10] = bVar59;
auVar5[0xb] = bVar60;
auVar5[0xc] = bVar61;
auVar5[0xd] = bVar62;
auVar5[0xe] = bVar63;
auVar5[0xf] = bVar64;
auVar65 = NEON_ext(auVar4,auVar5,8,1);
uVar27 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = uVar27 ^ 0x3ecba34 ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],uVar27)))) >> 0x20);
do {
*(byte *)((long)pvVar29 + uVar46) =
(&DAT_00102668)[uVar46] ^ (byte)uVar46 ^ *(byte *)((ulong)&local_84 | uVar46 & 3);
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
pvVar32 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar93 = 3;
iVar94 = 4;
iVar91 = 1;
iVar92 = 2;
uVar35 = 0;
uVar31 = 0x25f5c53b;
iVar26 = 0x350;
do {
iVar66 = iVar91 * 0x125877;
iVar67 = iVar92 * 0x125877;
iVar68 = iVar93 * 0x125877;
iVar69 = iVar94 * 0x125877;
iVar91 = iVar91 + 8;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar26 = iVar26 + -8;
iVar70 = iVar66 + 0x4961dc;
iVar71 = iVar67 + 0x4961dc;
iVar72 = iVar68 + 0x4961dc;
iVar73 = iVar69 + 0x4961dc;
bVar75 = (byte)uVar31 ^ (byte)iVar66;
bVar76 = (byte)((ulong)uVar31 >> 8) ^ (byte)((uint)iVar66 >> 8);
bVar77 = (byte)((ulong)uVar31 >> 0x10) ^ (byte)((uint)iVar66 >> 0x10);
bVar78 = (byte)((ulong)uVar31 >> 0x18) ^ (byte)((uint)iVar66 >> 0x18);
bVar79 = (byte)((ulong)uVar31 >> 0x20) ^ (byte)iVar67;
bVar80 = (byte)((ulong)uVar31 >> 0x28) ^ (byte)((uint)iVar67 >> 8);
bVar81 = (byte)((ulong)uVar31 >> 0x30) ^ (byte)((uint)iVar67 >> 0x10);
bVar82 = (byte)((ulong)uVar31 >> 0x38) ^ (byte)((uint)iVar67 >> 0x18);
uVar31 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(bVar78,
CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))));
bVar83 = (byte)uVar35 ^ (byte)iVar68;
bVar84 = (byte)((ulong)uVar35 >> 8) ^ (byte)((uint)iVar68 >> 8);
bVar85 = (byte)((ulong)uVar35 >> 0x10) ^ (byte)((uint)iVar68 >> 0x10);
bVar86 = (byte)((ulong)uVar35 >> 0x18) ^ (byte)((uint)iVar68 >> 0x18);
bVar87 = (byte)((ulong)uVar35 >> 0x20) ^ (byte)iVar69;
bVar88 = (byte)((ulong)uVar35 >> 0x28) ^ (byte)((uint)iVar69 >> 8);
bVar89 = (byte)((ulong)uVar35 >> 0x30) ^ (byte)((uint)iVar69 >> 0x10);
bVar90 = (byte)((ulong)uVar35 >> 0x38) ^ (byte)((uint)iVar69 >> 0x18);
uVar35 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(bVar86,
CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))));
bVar49 = bVar49 ^ (byte)iVar70;
bVar50 = bVar50 ^ (byte)((uint)iVar70 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar70 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar70 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar71;
bVar54 = bVar54 ^ (byte)((uint)iVar71 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar71 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar71 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar72;
bVar58 = bVar58 ^ (byte)((uint)iVar72 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar72 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar72 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar73;
bVar62 = bVar62 ^ (byte)((uint)iVar73 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar73 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar73 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar6[1] = bVar50;
auVar6[0] = bVar49;
auVar6[2] = bVar51;
auVar6[3] = bVar52;
auVar6[4] = bVar53;
auVar6[5] = bVar54;
auVar6[6] = bVar55;
auVar6[7] = bVar56;
auVar6[8] = bVar57;
auVar6[9] = bVar58;
auVar6[10] = bVar59;
auVar6[0xb] = bVar60;
auVar6[0xc] = bVar61;
auVar6[0xd] = bVar62;
auVar6[0xe] = bVar63;
auVar6[0xf] = bVar64;
auVar7[1] = bVar50;
auVar7[0] = bVar49;
auVar7[2] = bVar51;
auVar7[3] = bVar52;
auVar7[4] = bVar53;
auVar7[5] = bVar54;
auVar7[6] = bVar55;
auVar7[7] = bVar56;
auVar7[8] = bVar57;
auVar7[9] = bVar58;
auVar7[10] = bVar59;
auVar7[0xb] = bVar60;
auVar7[0xc] = bVar61;
auVar7[0xd] = bVar62;
auVar7[0xe] = bVar63;
auVar7[0xf] = bVar64;
auVar65 = NEON_ext(auVar6,auVar7,8,1);
local_84 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = local_84 ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],local_84)))) >> 0x20
);
do {
*(byte *)((long)pvVar32 + uVar46) =
(&DAT_001026e8)[uVar46] ^ (byte)uVar46 ^ *(byte *)((ulong)&local_84 | uVar46 & 3);
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
lVar33 = (**(code **)(*param_1 + 0x388))(param_1,lVar30,pvVar29,pvVar32);
uVar31 = __strlen_chk(pvVar29,0x80);
__memset_chk(pvVar29,0,uVar31,0x80);
free(pvVar29);
uVar31 = __strlen_chk(pvVar32,0x80);
__memset_chk(pvVar32,0,uVar31,0x80);
free(pvVar32);
if ((lVar33 != 0) &&
(lVar30 = (**(code **)(*param_1 + 0x390))(param_1,lVar30,lVar33), lVar30 != 0)) {
pvVar29 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar93 = 3;
iVar94 = 4;
iVar91 = 1;
iVar92 = 2;
uVar35 = 0;
uVar31 = 0x1c680c8c;
iVar26 = 0x388;
do {
iVar66 = iVar91 * 0x1a1a5d;
iVar67 = iVar92 * 0x1a1a5d;
iVar68 = iVar93 * 0x1a1a5d;
iVar69 = iVar94 * 0x1a1a5d;
iVar91 = iVar91 + 8;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar26 = iVar26 + -8;
iVar70 = iVar66 + 0x686974;
iVar71 = iVar67 + 0x686974;
iVar72 = iVar68 + 0x686974;
iVar73 = iVar69 + 0x686974;
bVar75 = (byte)uVar31 ^ (byte)iVar66;
bVar76 = (byte)((ulong)uVar31 >> 8) ^ (byte)((uint)iVar66 >> 8);
bVar77 = (byte)((ulong)uVar31 >> 0x10) ^ (byte)((uint)iVar66 >> 0x10);
bVar78 = (byte)((ulong)uVar31 >> 0x18) ^ (byte)((uint)iVar66 >> 0x18);
bVar79 = (byte)((ulong)uVar31 >> 0x20) ^ (byte)iVar67;
bVar80 = (byte)((ulong)uVar31 >> 0x28) ^ (byte)((uint)iVar67 >> 8);
bVar81 = (byte)((ulong)uVar31 >> 0x30) ^ (byte)((uint)iVar67 >> 0x10);
bVar82 = (byte)((ulong)uVar31 >> 0x38) ^ (byte)((uint)iVar67 >> 0x18);
uVar31 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(bVar78,
CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))));
bVar83 = (byte)uVar35 ^ (byte)iVar68;
bVar84 = (byte)((ulong)uVar35 >> 8) ^ (byte)((uint)iVar68 >> 8);
bVar85 = (byte)((ulong)uVar35 >> 0x10) ^ (byte)((uint)iVar68 >> 0x10);
bVar86 = (byte)((ulong)uVar35 >> 0x18) ^ (byte)((uint)iVar68 >> 0x18);
bVar87 = (byte)((ulong)uVar35 >> 0x20) ^ (byte)iVar69;
bVar88 = (byte)((ulong)uVar35 >> 0x28) ^ (byte)((uint)iVar69 >> 8);
bVar89 = (byte)((ulong)uVar35 >> 0x30) ^ (byte)((uint)iVar69 >> 0x10);
bVar90 = (byte)((ulong)uVar35 >> 0x38) ^ (byte)((uint)iVar69 >> 0x18);
uVar35 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(bVar86,
CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))));
bVar49 = bVar49 ^ (byte)iVar70;
bVar50 = bVar50 ^ (byte)((uint)iVar70 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar70 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar70 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar71;
bVar54 = bVar54 ^ (byte)((uint)iVar71 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar71 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar71 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar72;
bVar58 = bVar58 ^ (byte)((uint)iVar72 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar72 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar72 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar73;
bVar62 = bVar62 ^ (byte)((uint)iVar73 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar73 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar73 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar8[1] = bVar50;
auVar8[0] = bVar49;
auVar8[2] = bVar51;
auVar8[3] = bVar52;
auVar8[4] = bVar53;
auVar8[5] = bVar54;
auVar8[6] = bVar55;
auVar8[7] = bVar56;
auVar8[8] = bVar57;
auVar8[9] = bVar58;
auVar8[10] = bVar59;
auVar8[0xb] = bVar60;
auVar8[0xc] = bVar61;
auVar8[0xd] = bVar62;
auVar8[0xe] = bVar63;
auVar8[0xf] = bVar64;
auVar9[1] = bVar50;
auVar9[0] = bVar49;
auVar9[2] = bVar51;
auVar9[3] = bVar52;
auVar9[4] = bVar53;
auVar9[5] = bVar54;
auVar9[6] = bVar55;
auVar9[7] = bVar56;
auVar9[8] = bVar57;
auVar9[9] = bVar58;
auVar9[10] = bVar59;
auVar9[0xb] = bVar60;
auVar9[0xc] = bVar61;
auVar9[0xd] = bVar62;
auVar9[0xe] = bVar63;
auVar9[0xf] = bVar64;
auVar65 = NEON_ext(auVar8,auVar9,8,1);
uVar27 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = uVar27 ^ 0x5c67057d ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],uVar27)))) >> 0x20
);
do {
*(byte *)((long)pvVar29 + uVar46) =
(&DAT_00102768)[uVar46] ^ (byte)uVar46 ^ *(byte *)((ulong)&local_84 | uVar46 & 3);
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
lVar33 = (**(code **)(*param_1 + 0x30))(param_1,pvVar29);
uVar31 = __strlen_chk(pvVar29,0x80);
__memset_chk(pvVar29,0,uVar31,0x80);
free(pvVar29);
if (lVar33 != 0) {
pvVar29 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar93 = 3;
iVar94 = 4;
iVar91 = 1;
iVar92 = 2;
uVar35 = 0;
uVar31 = 0x4cd7852d;
iVar26 = 0x3d0;
do {
iVar66 = iVar91 * 0x1c9e44;
iVar67 = iVar92 * 0x1c9e44;
iVar68 = iVar93 * 0x1c9e44;
iVar69 = iVar94 * 0x1c9e44;
iVar91 = iVar91 + 8;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar26 = iVar26 + -8;
iVar70 = iVar66 + 0x727910;
iVar71 = iVar67 + 0x727910;
iVar72 = iVar68 + 0x727910;
iVar73 = iVar69 + 0x727910;
bVar75 = (byte)uVar31 ^ (byte)iVar66;
bVar76 = (byte)((ulong)uVar31 >> 8) ^ (byte)((uint)iVar66 >> 8);
bVar77 = (byte)((ulong)uVar31 >> 0x10) ^ (byte)((uint)iVar66 >> 0x10);
bVar78 = (byte)((ulong)uVar31 >> 0x18) ^ (byte)((uint)iVar66 >> 0x18);
bVar79 = (byte)((ulong)uVar31 >> 0x20) ^ (byte)iVar67;
bVar80 = (byte)((ulong)uVar31 >> 0x28) ^ (byte)((uint)iVar67 >> 8);
bVar81 = (byte)((ulong)uVar31 >> 0x30) ^ (byte)((uint)iVar67 >> 0x10);
bVar82 = (byte)((ulong)uVar31 >> 0x38) ^ (byte)((uint)iVar67 >> 0x18);
uVar31 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(bVar78
,CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))));
bVar83 = (byte)uVar35 ^ (byte)iVar68;
bVar84 = (byte)((ulong)uVar35 >> 8) ^ (byte)((uint)iVar68 >> 8);
bVar85 = (byte)((ulong)uVar35 >> 0x10) ^ (byte)((uint)iVar68 >> 0x10);
bVar86 = (byte)((ulong)uVar35 >> 0x18) ^ (byte)((uint)iVar68 >> 0x18);
bVar87 = (byte)((ulong)uVar35 >> 0x20) ^ (byte)iVar69;
bVar88 = (byte)((ulong)uVar35 >> 0x28) ^ (byte)((uint)iVar69 >> 8);
bVar89 = (byte)((ulong)uVar35 >> 0x30) ^ (byte)((uint)iVar69 >> 0x10);
bVar90 = (byte)((ulong)uVar35 >> 0x38) ^ (byte)((uint)iVar69 >> 0x18);
uVar35 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(bVar86
,CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))));
bVar49 = bVar49 ^ (byte)iVar70;
bVar50 = bVar50 ^ (byte)((uint)iVar70 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar70 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar70 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar71;
bVar54 = bVar54 ^ (byte)((uint)iVar71 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar71 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar71 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar72;
bVar58 = bVar58 ^ (byte)((uint)iVar72 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar72 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar72 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar73;
bVar62 = bVar62 ^ (byte)((uint)iVar73 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar73 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar73 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar10[1] = bVar50;
auVar10[0] = bVar49;
auVar10[2] = bVar51;
auVar10[3] = bVar52;
auVar10[4] = bVar53;
auVar10[5] = bVar54;
auVar10[6] = bVar55;
auVar10[7] = bVar56;
auVar10[8] = bVar57;
auVar10[9] = bVar58;
auVar10[10] = bVar59;
auVar10[0xb] = bVar60;
auVar10[0xc] = bVar61;
auVar10[0xd] = bVar62;
auVar10[0xe] = bVar63;
auVar10[0xf] = bVar64;
auVar11[1] = bVar50;
auVar11[0] = bVar49;
auVar11[2] = bVar51;
auVar11[3] = bVar52;
auVar11[4] = bVar53;
auVar11[5] = bVar54;
auVar11[6] = bVar55;
auVar11[7] = bVar56;
auVar11[8] = bVar57;
auVar11[9] = bVar58;
auVar11[10] = bVar59;
auVar11[0xb] = bVar60;
auVar11[0xc] = bVar61;
auVar11[0xd] = bVar62;
auVar11[0xe] = bVar63;
auVar11[0xf] = bVar64;
auVar65 = NEON_ext(auVar10,auVar11,8,1);
local_84 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = local_84 ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],local_84)))) >>
0x20);
do {
*(byte *)((long)pvVar29 + uVar46) =
(&DAT_001027e8)[uVar46] ^ (byte)uVar46 ^ *(byte *)((ulong)&local_84 | uVar46 & 3);
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
pvVar32 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar93 = 3;
iVar94 = 4;
iVar91 = 1;
iVar92 = 2;
uVar35 = 0;
uVar31 = 0x7388c19a;
iVar26 = 0x398;
do {
iVar66 = iVar91 * 0x3a6f3;
iVar67 = iVar92 * 0x3a6f3;
iVar68 = iVar93 * 0x3a6f3;
iVar69 = iVar94 * 0x3a6f3;
iVar91 = iVar91 + 8;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar26 = iVar26 + -8;
iVar70 = iVar66 + 0xe9bcc;
iVar71 = iVar67 + 0xe9bcc;
iVar72 = iVar68 + 0xe9bcc;
iVar73 = iVar69 + 0xe9bcc;
bVar75 = (byte)uVar31 ^ (byte)iVar66;
bVar76 = (byte)((ulong)uVar31 >> 8) ^ (byte)((uint)iVar66 >> 8);
bVar77 = (byte)((ulong)uVar31 >> 0x10) ^ (byte)((uint)iVar66 >> 0x10);
bVar78 = (byte)((ulong)uVar31 >> 0x18) ^ (byte)((uint)iVar66 >> 0x18);
bVar79 = (byte)((ulong)uVar31 >> 0x20) ^ (byte)iVar67;
bVar80 = (byte)((ulong)uVar31 >> 0x28) ^ (byte)((uint)iVar67 >> 8);
bVar81 = (byte)((ulong)uVar31 >> 0x30) ^ (byte)((uint)iVar67 >> 0x10);
bVar82 = (byte)((ulong)uVar31 >> 0x38) ^ (byte)((uint)iVar67 >> 0x18);
uVar31 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(bVar78
,CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))));
bVar83 = (byte)uVar35 ^ (byte)iVar68;
bVar84 = (byte)((ulong)uVar35 >> 8) ^ (byte)((uint)iVar68 >> 8);
bVar85 = (byte)((ulong)uVar35 >> 0x10) ^ (byte)((uint)iVar68 >> 0x10);
bVar86 = (byte)((ulong)uVar35 >> 0x18) ^ (byte)((uint)iVar68 >> 0x18);
bVar87 = (byte)((ulong)uVar35 >> 0x20) ^ (byte)iVar69;
bVar88 = (byte)((ulong)uVar35 >> 0x28) ^ (byte)((uint)iVar69 >> 8);
bVar89 = (byte)((ulong)uVar35 >> 0x30) ^ (byte)((uint)iVar69 >> 0x10);
bVar90 = (byte)((ulong)uVar35 >> 0x38) ^ (byte)((uint)iVar69 >> 0x18);
uVar35 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(bVar86
,CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))));
bVar49 = bVar49 ^ (byte)iVar70;
bVar50 = bVar50 ^ (byte)((uint)iVar70 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar70 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar70 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar71;
bVar54 = bVar54 ^ (byte)((uint)iVar71 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar71 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar71 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar72;
bVar58 = bVar58 ^ (byte)((uint)iVar72 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar72 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar72 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar73;
bVar62 = bVar62 ^ (byte)((uint)iVar73 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar73 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar73 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar12[1] = bVar50;
auVar12[0] = bVar49;
auVar12[2] = bVar51;
auVar12[3] = bVar52;
auVar12[4] = bVar53;
auVar12[5] = bVar54;
auVar12[6] = bVar55;
auVar12[7] = bVar56;
auVar12[8] = bVar57;
auVar12[9] = bVar58;
auVar12[10] = bVar59;
auVar12[0xb] = bVar60;
auVar12[0xc] = bVar61;
auVar12[0xd] = bVar62;
auVar12[0xe] = bVar63;
auVar12[0xf] = bVar64;
auVar13[1] = bVar50;
auVar13[0] = bVar49;
auVar13[2] = bVar51;
auVar13[3] = bVar52;
auVar13[4] = bVar53;
auVar13[5] = bVar54;
auVar13[6] = bVar55;
auVar13[7] = bVar56;
auVar13[8] = bVar57;
auVar13[9] = bVar58;
auVar13[10] = bVar59;
auVar13[0xb] = bVar60;
auVar13[0xc] = bVar61;
auVar13[0xd] = bVar62;
auVar13[0xe] = bVar63;
auVar13[0xf] = bVar64;
auVar65 = NEON_ext(auVar12,auVar13,8,1);
uVar27 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = uVar27 ^ 0x742dd ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],uVar27)))) >>
0x20);
do {
*(byte *)((long)pvVar32 + uVar46) =
(&DAT_00102868)[uVar46] ^ (byte)uVar46 ^ *(byte *)((ulong)&local_84 | uVar46 & 3);
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
lVar34 = (**(code **)(*param_1 + 0x480))(param_1,lVar33,pvVar29,pvVar32);
uVar31 = __strlen_chk(pvVar29,0x80);
__memset_chk(pvVar29,0,uVar31,0x80);
free(pvVar29);
uVar31 = __strlen_chk(pvVar32,0x80);
__memset_chk(pvVar32,0,uVar31,0x80);
free(pvVar32);
if (lVar34 != 0) {
iVar91 = (**(code **)(*param_1 + 0x4b0))(param_1,lVar33,lVar34);
uVar31 = (**(code **)(*param_1 + 0xf8))(param_1,lVar30);
pvVar29 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar94 = 3;
iVar66 = 4;
iVar92 = 1;
iVar93 = 2;
uVar36 = 0;
uVar35 = 0x8a062cf;
iVar26 = 0x228;
do {
iVar67 = iVar92 * 0x494f4;
iVar68 = iVar93 * 0x494f4;
iVar69 = iVar94 * 0x494f4;
iVar70 = iVar66 * 0x494f4;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar66 = iVar66 + 8;
iVar26 = iVar26 + -8;
iVar71 = iVar67 + 0x1253d0;
iVar72 = iVar68 + 0x1253d0;
iVar73 = iVar69 + 0x1253d0;
iVar74 = iVar70 + 0x1253d0;
bVar75 = (byte)uVar35 ^ (byte)iVar67;
bVar76 = (byte)((ulong)uVar35 >> 8) ^ (byte)((uint)iVar67 >> 8);
bVar77 = (byte)((ulong)uVar35 >> 0x10) ^ (byte)((uint)iVar67 >> 0x10);
bVar78 = (byte)((ulong)uVar35 >> 0x18) ^ (byte)((uint)iVar67 >> 0x18);
bVar79 = (byte)((ulong)uVar35 >> 0x20) ^ (byte)iVar68;
bVar80 = (byte)((ulong)uVar35 >> 0x28) ^ (byte)((uint)iVar68 >> 8);
bVar81 = (byte)((ulong)uVar35 >> 0x30) ^ (byte)((uint)iVar68 >> 0x10);
bVar82 = (byte)((ulong)uVar35 >> 0x38) ^ (byte)((uint)iVar68 >> 0x18);
uVar35 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(
bVar78,CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))
));
bVar83 = (byte)uVar36 ^ (byte)iVar69;
bVar84 = (byte)((ulong)uVar36 >> 8) ^ (byte)((uint)iVar69 >> 8);
bVar85 = (byte)((ulong)uVar36 >> 0x10) ^ (byte)((uint)iVar69 >> 0x10);
bVar86 = (byte)((ulong)uVar36 >> 0x18) ^ (byte)((uint)iVar69 >> 0x18);
bVar87 = (byte)((ulong)uVar36 >> 0x20) ^ (byte)iVar70;
bVar88 = (byte)((ulong)uVar36 >> 0x28) ^ (byte)((uint)iVar70 >> 8);
bVar89 = (byte)((ulong)uVar36 >> 0x30) ^ (byte)((uint)iVar70 >> 0x10);
bVar90 = (byte)((ulong)uVar36 >> 0x38) ^ (byte)((uint)iVar70 >> 0x18);
uVar36 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(
bVar86,CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))
));
bVar49 = bVar49 ^ (byte)iVar71;
bVar50 = bVar50 ^ (byte)((uint)iVar71 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar71 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar71 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar72;
bVar54 = bVar54 ^ (byte)((uint)iVar72 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar72 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar72 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar73;
bVar58 = bVar58 ^ (byte)((uint)iVar73 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar73 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar73 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar74;
bVar62 = bVar62 ^ (byte)((uint)iVar74 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar74 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar74 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar14[1] = bVar50;
auVar14[0] = bVar49;
auVar14[2] = bVar51;
auVar14[3] = bVar52;
auVar14[4] = bVar53;
auVar14[5] = bVar54;
auVar14[6] = bVar55;
auVar14[7] = bVar56;
auVar14[8] = bVar57;
auVar14[9] = bVar58;
auVar14[10] = bVar59;
auVar14[0xb] = bVar60;
auVar14[0xc] = bVar61;
auVar14[0xd] = bVar62;
auVar14[0xe] = bVar63;
auVar14[0xf] = bVar64;
auVar15[1] = bVar50;
auVar15[0] = bVar49;
auVar15[2] = bVar51;
auVar15[3] = bVar52;
auVar15[4] = bVar53;
auVar15[5] = bVar54;
auVar15[6] = bVar55;
auVar15[7] = bVar56;
auVar15[8] = bVar57;
auVar15[9] = bVar58;
auVar15[10] = bVar59;
auVar15[0xb] = bVar60;
auVar15[0xc] = bVar61;
auVar15[0xd] = bVar62;
auVar15[0xe] = bVar63;
auVar15[0xf] = bVar64;
auVar65 = NEON_ext(auVar14,auVar15,8,1);
uVar27 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = uVar27 ^ 0x12f610 ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],uVar27)))) >>
0x20);
do {
*(byte *)((long)pvVar29 + uVar46) =
(&DAT_001028e8)[uVar46] ^ (byte)uVar46 ^ *(byte *)((ulong)&local_84 | uVar46 & 3)
;
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
pvVar32 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar94 = 3;
iVar66 = 4;
iVar92 = 1;
iVar93 = 2;
uVar36 = 0;
uVar35 = 0x3017a073;
iVar26 = 0x2e8;
do {
iVar67 = iVar92 * 0xd1ac;
iVar68 = iVar93 * 0xd1ac;
iVar69 = iVar94 * 0xd1ac;
iVar70 = iVar66 * 0xd1ac;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar66 = iVar66 + 8;
iVar26 = iVar26 + -8;
iVar71 = iVar67 + 0x346b0;
iVar72 = iVar68 + 0x346b0;
iVar73 = iVar69 + 0x346b0;
iVar74 = iVar70 + 0x346b0;
bVar75 = (byte)uVar35 ^ (byte)iVar67;
bVar76 = (byte)((ulong)uVar35 >> 8) ^ (byte)((uint)iVar67 >> 8);
bVar77 = (byte)((ulong)uVar35 >> 0x10) ^ (byte)((uint)iVar67 >> 0x10);
bVar78 = (byte)((ulong)uVar35 >> 0x18) ^ (byte)((uint)iVar67 >> 0x18);
bVar79 = (byte)((ulong)uVar35 >> 0x20) ^ (byte)iVar68;
bVar80 = (byte)((ulong)uVar35 >> 0x28) ^ (byte)((uint)iVar68 >> 8);
bVar81 = (byte)((ulong)uVar35 >> 0x30) ^ (byte)((uint)iVar68 >> 0x10);
bVar82 = (byte)((ulong)uVar35 >> 0x38) ^ (byte)((uint)iVar68 >> 0x18);
uVar35 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(
bVar78,CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))
));
bVar83 = (byte)uVar36 ^ (byte)iVar69;
bVar84 = (byte)((ulong)uVar36 >> 8) ^ (byte)((uint)iVar69 >> 8);
bVar85 = (byte)((ulong)uVar36 >> 0x10) ^ (byte)((uint)iVar69 >> 0x10);
bVar86 = (byte)((ulong)uVar36 >> 0x18) ^ (byte)((uint)iVar69 >> 0x18);
bVar87 = (byte)((ulong)uVar36 >> 0x20) ^ (byte)iVar70;
bVar88 = (byte)((ulong)uVar36 >> 0x28) ^ (byte)((uint)iVar70 >> 8);
bVar89 = (byte)((ulong)uVar36 >> 0x30) ^ (byte)((uint)iVar70 >> 0x10);
bVar90 = (byte)((ulong)uVar36 >> 0x38) ^ (byte)((uint)iVar70 >> 0x18);
uVar36 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(
bVar86,CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))
));
bVar49 = bVar49 ^ (byte)iVar71;
bVar50 = bVar50 ^ (byte)((uint)iVar71 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar71 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar71 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar72;
bVar54 = bVar54 ^ (byte)((uint)iVar72 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar72 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar72 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar73;
bVar58 = bVar58 ^ (byte)((uint)iVar73 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar73 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar73 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar74;
bVar62 = bVar62 ^ (byte)((uint)iVar74 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar74 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar74 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar16[1] = bVar50;
auVar16[0] = bVar49;
auVar16[2] = bVar51;
auVar16[3] = bVar52;
auVar16[4] = bVar53;
auVar16[5] = bVar54;
auVar16[6] = bVar55;
auVar16[7] = bVar56;
auVar16[8] = bVar57;
auVar16[9] = bVar58;
auVar16[10] = bVar59;
auVar16[0xb] = bVar60;
auVar16[0xc] = bVar61;
auVar16[0xd] = bVar62;
auVar16[0xe] = bVar63;
auVar16[0xf] = bVar64;
auVar17[1] = bVar50;
auVar17[0] = bVar49;
auVar17[2] = bVar51;
auVar17[3] = bVar52;
auVar17[4] = bVar53;
auVar17[5] = bVar54;
auVar17[6] = bVar55;
auVar17[7] = bVar56;
auVar17[8] = bVar57;
auVar17[9] = bVar58;
auVar17[10] = bVar59;
auVar17[0xb] = bVar60;
auVar17[0xc] = bVar61;
auVar17[0xd] = bVar62;
auVar17[0xe] = bVar63;
auVar17[0xf] = bVar64;
auVar65 = NEON_ext(auVar16,auVar17,8,1);
uVar27 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = uVar27 ^ 0xd2b4 ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],uVar27)))) >>
0x20);
do {
*(byte *)((long)pvVar32 + uVar46) =
(&DAT_00102968)[uVar46] ^ (byte)uVar46 ^ *(byte *)((ulong)&local_84 | uVar46 & 3)
;
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
lVar33 = (**(code **)(*param_1 + 0x108))(param_1,uVar31,pvVar29,pvVar32);
uVar35 = __strlen_chk(pvVar29,0x80);
__memset_chk(pvVar29,0,uVar35,0x80);
free(pvVar29);
uVar35 = __strlen_chk(pvVar32,0x80);
__memset_chk(pvVar32,0,uVar35,0x80);
free(pvVar32);
if (lVar33 != 0) {
uVar35 = (**(code **)(*param_1 + 0x110))(param_1,lVar30,lVar33);
pvVar29 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar94 = 3;
iVar66 = 4;
iVar92 = 1;
iVar93 = 2;
uVar37 = 0;
uVar36 = 0x52da1095;
iVar26 = 0x318;
do {
iVar67 = iVar92 * 0xba2b;
iVar68 = iVar93 * 0xba2b;
iVar69 = iVar94 * 0xba2b;
iVar70 = iVar66 * 0xba2b;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar66 = iVar66 + 8;
iVar26 = iVar26 + -8;
iVar71 = iVar67 + 0x2e8ac;
iVar72 = iVar68 + 0x2e8ac;
iVar73 = iVar69 + 0x2e8ac;
iVar74 = iVar70 + 0x2e8ac;
bVar75 = (byte)uVar36 ^ (byte)iVar67;
bVar76 = (byte)((ulong)uVar36 >> 8) ^ (byte)((uint)iVar67 >> 8);
bVar77 = (byte)((ulong)uVar36 >> 0x10) ^ (byte)((uint)iVar67 >> 0x10);
bVar78 = (byte)((ulong)uVar36 >> 0x18) ^ (byte)((uint)iVar67 >> 0x18);
bVar79 = (byte)((ulong)uVar36 >> 0x20) ^ (byte)iVar68;
bVar80 = (byte)((ulong)uVar36 >> 0x28) ^ (byte)((uint)iVar68 >> 8);
bVar81 = (byte)((ulong)uVar36 >> 0x30) ^ (byte)((uint)iVar68 >> 0x10);
bVar82 = (byte)((ulong)uVar36 >> 0x38) ^ (byte)((uint)iVar68 >> 0x18);
uVar36 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(
bVar78,CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))
));
bVar83 = (byte)uVar37 ^ (byte)iVar69;
bVar84 = (byte)((ulong)uVar37 >> 8) ^ (byte)((uint)iVar69 >> 8);
bVar85 = (byte)((ulong)uVar37 >> 0x10) ^ (byte)((uint)iVar69 >> 0x10);
bVar86 = (byte)((ulong)uVar37 >> 0x18) ^ (byte)((uint)iVar69 >> 0x18);
bVar87 = (byte)((ulong)uVar37 >> 0x20) ^ (byte)iVar70;
bVar88 = (byte)((ulong)uVar37 >> 0x28) ^ (byte)((uint)iVar70 >> 8);
bVar89 = (byte)((ulong)uVar37 >> 0x30) ^ (byte)((uint)iVar70 >> 0x10);
bVar90 = (byte)((ulong)uVar37 >> 0x38) ^ (byte)((uint)iVar70 >> 0x18);
uVar37 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(
bVar86,CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))
));
bVar49 = bVar49 ^ (byte)iVar71;
bVar50 = bVar50 ^ (byte)((uint)iVar71 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar71 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar71 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar72;
bVar54 = bVar54 ^ (byte)((uint)iVar72 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar72 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar72 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar73;
bVar58 = bVar58 ^ (byte)((uint)iVar73 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar73 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar73 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar74;
bVar62 = bVar62 ^ (byte)((uint)iVar74 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar74 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar74 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar18[1] = bVar50;
auVar18[0] = bVar49;
auVar18[2] = bVar51;
auVar18[3] = bVar52;
auVar18[4] = bVar53;
auVar18[5] = bVar54;
auVar18[6] = bVar55;
auVar18[7] = bVar56;
auVar18[8] = bVar57;
auVar18[9] = bVar58;
auVar18[10] = bVar59;
auVar18[0xb] = bVar60;
auVar18[0xc] = bVar61;
auVar18[0xd] = bVar62;
auVar18[0xe] = bVar63;
auVar18[0xf] = bVar64;
auVar19[1] = bVar50;
auVar19[0] = bVar49;
auVar19[2] = bVar51;
auVar19[3] = bVar52;
auVar19[4] = bVar53;
auVar19[5] = bVar54;
auVar19[6] = bVar55;
auVar19[7] = bVar56;
auVar19[8] = bVar57;
auVar19[9] = bVar58;
auVar19[10] = bVar59;
auVar19[0xb] = bVar60;
auVar19[0xc] = bVar61;
auVar19[0xd] = bVar62;
auVar19[0xe] = bVar63;
auVar19[0xf] = bVar64;
auVar65 = NEON_ext(auVar18,auVar19,8,1);
uVar27 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = uVar27 ^ 0x240af33 ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],uVar27))))
>> 0x20);
do {
*(byte *)((long)pvVar29 + uVar46) =
(&DAT_001029e8)[uVar46] ^ (byte)uVar46 ^
*(byte *)((ulong)&local_84 | uVar46 & 3);
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
pvVar32 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar94 = 3;
iVar66 = 4;
iVar92 = 1;
iVar93 = 2;
uVar37 = 0;
uVar36 = 0x5b1be76;
iVar26 = 0x3c8;
do {
iVar67 = iVar92 * 0x1d0179;
iVar68 = iVar93 * 0x1d0179;
iVar69 = iVar94 * 0x1d0179;
iVar70 = iVar66 * 0x1d0179;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar66 = iVar66 + 8;
iVar26 = iVar26 + -8;
iVar71 = iVar67 + 0x7405e4;
iVar72 = iVar68 + 0x7405e4;
iVar73 = iVar69 + 0x7405e4;
iVar74 = iVar70 + 0x7405e4;
bVar75 = (byte)uVar36 ^ (byte)iVar67;
bVar76 = (byte)((ulong)uVar36 >> 8) ^ (byte)((uint)iVar67 >> 8);
bVar77 = (byte)((ulong)uVar36 >> 0x10) ^ (byte)((uint)iVar67 >> 0x10);
bVar78 = (byte)((ulong)uVar36 >> 0x18) ^ (byte)((uint)iVar67 >> 0x18);
bVar79 = (byte)((ulong)uVar36 >> 0x20) ^ (byte)iVar68;
bVar80 = (byte)((ulong)uVar36 >> 0x28) ^ (byte)((uint)iVar68 >> 8);
bVar81 = (byte)((ulong)uVar36 >> 0x30) ^ (byte)((uint)iVar68 >> 0x10);
bVar82 = (byte)((ulong)uVar36 >> 0x38) ^ (byte)((uint)iVar68 >> 0x18);
uVar36 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(
bVar78,CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))
));
bVar83 = (byte)uVar37 ^ (byte)iVar69;
bVar84 = (byte)((ulong)uVar37 >> 8) ^ (byte)((uint)iVar69 >> 8);
bVar85 = (byte)((ulong)uVar37 >> 0x10) ^ (byte)((uint)iVar69 >> 0x10);
bVar86 = (byte)((ulong)uVar37 >> 0x18) ^ (byte)((uint)iVar69 >> 0x18);
bVar87 = (byte)((ulong)uVar37 >> 0x20) ^ (byte)iVar70;
bVar88 = (byte)((ulong)uVar37 >> 0x28) ^ (byte)((uint)iVar70 >> 8);
bVar89 = (byte)((ulong)uVar37 >> 0x30) ^ (byte)((uint)iVar70 >> 0x10);
bVar90 = (byte)((ulong)uVar37 >> 0x38) ^ (byte)((uint)iVar70 >> 0x18);
uVar37 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(
bVar86,CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))
));
bVar49 = bVar49 ^ (byte)iVar71;
bVar50 = bVar50 ^ (byte)((uint)iVar71 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar71 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar71 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar72;
bVar54 = bVar54 ^ (byte)((uint)iVar72 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar72 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar72 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar73;
bVar58 = bVar58 ^ (byte)((uint)iVar73 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar73 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar73 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar74;
bVar62 = bVar62 ^ (byte)((uint)iVar74 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar74 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar74 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar20[1] = bVar50;
auVar20[0] = bVar49;
auVar20[2] = bVar51;
auVar20[3] = bVar52;
auVar20[4] = bVar53;
auVar20[5] = bVar54;
auVar20[6] = bVar55;
auVar20[7] = bVar56;
auVar20[8] = bVar57;
auVar20[9] = bVar58;
auVar20[10] = bVar59;
auVar20[0xb] = bVar60;
auVar20[0xc] = bVar61;
auVar20[0xd] = bVar62;
auVar20[0xe] = bVar63;
auVar20[0xf] = bVar64;
auVar21[1] = bVar50;
auVar21[0] = bVar49;
auVar21[2] = bVar51;
auVar21[3] = bVar52;
auVar21[4] = bVar53;
auVar21[5] = bVar54;
auVar21[6] = bVar55;
auVar21[7] = bVar56;
auVar21[8] = bVar57;
auVar21[9] = bVar58;
auVar21[10] = bVar59;
auVar21[0xb] = bVar60;
auVar21[0xc] = bVar61;
auVar21[0xd] = bVar62;
auVar21[0xe] = bVar63;
auVar21[0xf] = bVar64;
auVar65 = NEON_ext(auVar20,auVar21,8,1);
uVar27 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = uVar27 ^ 0x805e4 ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],uVar27))))
>> 0x20);
do {
*(byte *)((long)pvVar32 + uVar46) =
(&DAT_00102a68)[uVar46] ^ (byte)uVar46 ^
*(byte *)((ulong)&local_84 | uVar46 & 3);
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
lVar33 = (**(code **)(*param_1 + 0x108))(param_1,uVar31,pvVar29,pvVar32);
uVar31 = __strlen_chk(pvVar29,0x80);
__memset_chk(pvVar29,0,uVar31,0x80);
free(pvVar29);
uVar31 = __strlen_chk(pvVar32,0x80);
__memset_chk(pvVar32,0,uVar31,0x80);
free(pvVar32);
if (lVar33 != 0) {
uVar31 = (**(code **)(*param_1 + 0x110))(param_1,lVar30,lVar33);
pvVar29 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar94 = 3;
iVar66 = 4;
iVar92 = 1;
iVar93 = 2;
uVar37 = 0;
uVar36 = 0x4b574e87;
iVar26 = 0x2f8;
do {
iVar67 = iVar92 * 0x619f9;
iVar68 = iVar93 * 0x619f9;
iVar69 = iVar94 * 0x619f9;
iVar70 = iVar66 * 0x619f9;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar66 = iVar66 + 8;
iVar26 = iVar26 + -8;
iVar71 = iVar67 + 0x1867e4;
iVar72 = iVar68 + 0x1867e4;
iVar73 = iVar69 + 0x1867e4;
iVar74 = iVar70 + 0x1867e4;
bVar75 = (byte)uVar36 ^ (byte)iVar67;
bVar76 = (byte)((ulong)uVar36 >> 8) ^ (byte)((uint)iVar67 >> 8);
bVar77 = (byte)((ulong)uVar36 >> 0x10) ^ (byte)((uint)iVar67 >> 0x10);
bVar78 = (byte)((ulong)uVar36 >> 0x18) ^ (byte)((uint)iVar67 >> 0x18);
bVar79 = (byte)((ulong)uVar36 >> 0x20) ^ (byte)iVar68;
bVar80 = (byte)((ulong)uVar36 >> 0x28) ^ (byte)((uint)iVar68 >> 8);
bVar81 = (byte)((ulong)uVar36 >> 0x30) ^ (byte)((uint)iVar68 >> 0x10);
bVar82 = (byte)((ulong)uVar36 >> 0x38) ^ (byte)((uint)iVar68 >> 0x18);
uVar36 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(
bVar78,CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))
));
bVar83 = (byte)uVar37 ^ (byte)iVar69;
bVar84 = (byte)((ulong)uVar37 >> 8) ^ (byte)((uint)iVar69 >> 8);
bVar85 = (byte)((ulong)uVar37 >> 0x10) ^ (byte)((uint)iVar69 >> 0x10);
bVar86 = (byte)((ulong)uVar37 >> 0x18) ^ (byte)((uint)iVar69 >> 0x18);
bVar87 = (byte)((ulong)uVar37 >> 0x20) ^ (byte)iVar70;
bVar88 = (byte)((ulong)uVar37 >> 0x28) ^ (byte)((uint)iVar70 >> 8);
bVar89 = (byte)((ulong)uVar37 >> 0x30) ^ (byte)((uint)iVar70 >> 0x10);
bVar90 = (byte)((ulong)uVar37 >> 0x38) ^ (byte)((uint)iVar70 >> 0x18);
uVar37 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(
bVar86,CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))
));
bVar49 = bVar49 ^ (byte)iVar71;
bVar50 = bVar50 ^ (byte)((uint)iVar71 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar71 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar71 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar72;
bVar54 = bVar54 ^ (byte)((uint)iVar72 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar72 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar72 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar73;
bVar58 = bVar58 ^ (byte)((uint)iVar73 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar73 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar73 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar74;
bVar62 = bVar62 ^ (byte)((uint)iVar74 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar74 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar74 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar22[1] = bVar50;
auVar22[0] = bVar49;
auVar22[2] = bVar51;
auVar22[3] = bVar52;
auVar22[4] = bVar53;
auVar22[5] = bVar54;
auVar22[6] = bVar55;
auVar22[7] = bVar56;
auVar22[8] = bVar57;
auVar22[9] = bVar58;
auVar22[10] = bVar59;
auVar22[0xb] = bVar60;
auVar22[0xc] = bVar61;
auVar22[0xd] = bVar62;
auVar22[0xe] = bVar63;
auVar22[0xf] = bVar64;
auVar23[1] = bVar50;
auVar23[0] = bVar49;
auVar23[2] = bVar51;
auVar23[3] = bVar52;
auVar23[4] = bVar53;
auVar23[5] = bVar54;
auVar23[6] = bVar55;
auVar23[7] = bVar56;
auVar23[8] = bVar57;
auVar23[9] = bVar58;
auVar23[10] = bVar59;
auVar23[0xb] = bVar60;
auVar23[0xc] = bVar61;
auVar23[0xd] = bVar62;
auVar23[0xe] = bVar63;
auVar23[0xf] = bVar64;
auVar65 = NEON_ext(auVar22,auVar23,8,1);
uVar27 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = uVar27 ^ 0xa7a1b ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],uVar27))))
>> 0x20);
do {
*(byte *)((long)pvVar29 + uVar46) =
(&DAT_00102ae8)[uVar46] ^ (byte)uVar46 ^
*(byte *)((ulong)&local_84 | uVar46 & 3);
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
pvVar32 = malloc(0x80);
bVar49 = 0;
bVar50 = 0;
bVar51 = 0;
bVar52 = 0;
bVar53 = 0;
bVar54 = 0;
bVar55 = 0;
bVar56 = 0;
bVar57 = 0;
bVar58 = 0;
bVar59 = 0;
bVar60 = 0;
bVar61 = 0;
bVar62 = 0;
bVar63 = 0;
bVar64 = 0;
iVar94 = 3;
iVar66 = 4;
iVar92 = 1;
iVar93 = 2;
uVar37 = 0;
uVar36 = 0x3f51a418;
iVar26 = 0x268;
do {
iVar67 = iVar92 * 0x706e;
iVar68 = iVar93 * 0x706e;
iVar69 = iVar94 * 0x706e;
iVar70 = iVar66 * 0x706e;
iVar92 = iVar92 + 8;
iVar93 = iVar93 + 8;
iVar94 = iVar94 + 8;
iVar66 = iVar66 + 8;
iVar26 = iVar26 + -8;
iVar71 = iVar67 + 0x1c1b8;
iVar72 = iVar68 + 0x1c1b8;
iVar73 = iVar69 + 0x1c1b8;
iVar74 = iVar70 + 0x1c1b8;
bVar75 = (byte)uVar36 ^ (byte)iVar67;
bVar76 = (byte)((ulong)uVar36 >> 8) ^ (byte)((uint)iVar67 >> 8);
bVar77 = (byte)((ulong)uVar36 >> 0x10) ^ (byte)((uint)iVar67 >> 0x10);
bVar78 = (byte)((ulong)uVar36 >> 0x18) ^ (byte)((uint)iVar67 >> 0x18);
bVar79 = (byte)((ulong)uVar36 >> 0x20) ^ (byte)iVar68;
bVar80 = (byte)((ulong)uVar36 >> 0x28) ^ (byte)((uint)iVar68 >> 8);
bVar81 = (byte)((ulong)uVar36 >> 0x30) ^ (byte)((uint)iVar68 >> 0x10);
bVar82 = (byte)((ulong)uVar36 >> 0x38) ^ (byte)((uint)iVar68 >> 0x18);
uVar36 = CONCAT17(bVar82,CONCAT16(bVar81,CONCAT15(bVar80,CONCAT14(bVar79,CONCAT13(
bVar78,CONCAT12(bVar77,CONCAT11(bVar76,bVar75)))))
));
bVar83 = (byte)uVar37 ^ (byte)iVar69;
bVar84 = (byte)((ulong)uVar37 >> 8) ^ (byte)((uint)iVar69 >> 8);
bVar85 = (byte)((ulong)uVar37 >> 0x10) ^ (byte)((uint)iVar69 >> 0x10);
bVar86 = (byte)((ulong)uVar37 >> 0x18) ^ (byte)((uint)iVar69 >> 0x18);
bVar87 = (byte)((ulong)uVar37 >> 0x20) ^ (byte)iVar70;
bVar88 = (byte)((ulong)uVar37 >> 0x28) ^ (byte)((uint)iVar70 >> 8);
bVar89 = (byte)((ulong)uVar37 >> 0x30) ^ (byte)((uint)iVar70 >> 0x10);
bVar90 = (byte)((ulong)uVar37 >> 0x38) ^ (byte)((uint)iVar70 >> 0x18);
uVar37 = CONCAT17(bVar90,CONCAT16(bVar89,CONCAT15(bVar88,CONCAT14(bVar87,CONCAT13(
bVar86,CONCAT12(bVar85,CONCAT11(bVar84,bVar83)))))
));
bVar49 = bVar49 ^ (byte)iVar71;
bVar50 = bVar50 ^ (byte)((uint)iVar71 >> 8);
bVar51 = bVar51 ^ (byte)((uint)iVar71 >> 0x10);
bVar52 = bVar52 ^ (byte)((uint)iVar71 >> 0x18);
bVar53 = bVar53 ^ (byte)iVar72;
bVar54 = bVar54 ^ (byte)((uint)iVar72 >> 8);
bVar55 = bVar55 ^ (byte)((uint)iVar72 >> 0x10);
bVar56 = bVar56 ^ (byte)((uint)iVar72 >> 0x18);
bVar57 = bVar57 ^ (byte)iVar73;
bVar58 = bVar58 ^ (byte)((uint)iVar73 >> 8);
bVar59 = bVar59 ^ (byte)((uint)iVar73 >> 0x10);
bVar60 = bVar60 ^ (byte)((uint)iVar73 >> 0x18);
bVar61 = bVar61 ^ (byte)iVar74;
bVar62 = bVar62 ^ (byte)((uint)iVar74 >> 8);
bVar63 = bVar63 ^ (byte)((uint)iVar74 >> 0x10);
bVar64 = bVar64 ^ (byte)((uint)iVar74 >> 0x18);
} while (iVar26 != 0);
bVar49 = bVar49 ^ bVar75;
bVar50 = bVar50 ^ bVar76;
bVar51 = bVar51 ^ bVar77;
bVar52 = bVar52 ^ bVar78;
bVar53 = bVar53 ^ bVar79;
bVar54 = bVar54 ^ bVar80;
bVar55 = bVar55 ^ bVar81;
bVar56 = bVar56 ^ bVar82;
bVar57 = bVar57 ^ bVar83;
bVar58 = bVar58 ^ bVar84;
bVar59 = bVar59 ^ bVar85;
bVar60 = bVar60 ^ bVar86;
bVar61 = bVar61 ^ bVar87;
bVar62 = bVar62 ^ bVar88;
bVar63 = bVar63 ^ bVar89;
bVar64 = bVar64 ^ bVar90;
uVar46 = 0;
auVar24[1] = bVar50;
auVar24[0] = bVar49;
auVar24[2] = bVar51;
auVar24[3] = bVar52;
auVar24[4] = bVar53;
auVar24[5] = bVar54;
auVar24[6] = bVar55;
auVar24[7] = bVar56;
auVar24[8] = bVar57;
auVar24[9] = bVar58;
auVar24[10] = bVar59;
auVar24[0xb] = bVar60;
auVar24[0xc] = bVar61;
auVar24[0xd] = bVar62;
auVar24[0xe] = bVar63;
auVar24[0xf] = bVar64;
auVar25[1] = bVar50;
auVar25[0] = bVar49;
auVar25[2] = bVar51;
auVar25[3] = bVar52;
auVar25[4] = bVar53;
auVar25[5] = bVar54;
auVar25[6] = bVar55;
auVar25[7] = bVar56;
auVar25[8] = bVar57;
auVar25[9] = bVar58;
auVar25[10] = bVar59;
auVar25[0xb] = bVar60;
auVar25[0xc] = bVar61;
auVar25[0xd] = bVar62;
auVar25[0xe] = bVar63;
auVar25[0xf] = bVar64;
auVar65 = NEON_ext(auVar24,auVar25,8,1);
local_84 = CONCAT13(bVar52 ^ auVar65[3],
CONCAT12(bVar51 ^ auVar65[2],
CONCAT11(bVar50 ^ auVar65[1],bVar49 ^ auVar65[0])));
local_84 = local_84 ^
(uint)(CONCAT17(bVar56 ^ auVar65[7],
CONCAT16(bVar55 ^ auVar65[6],
CONCAT15(bVar54 ^ auVar65[5],
CONCAT14(bVar53 ^ auVar65[4],local_84))
)) >> 0x20);
do {
*(byte *)((long)pvVar32 + uVar46) =
(&DAT_00102b68)[uVar46] ^ (byte)uVar46 ^
*(byte *)((ulong)&local_84 | uVar46 & 3);
uVar46 = uVar46 + 1;
} while (uVar46 != 0x80);
pcVar48 = *(code **)(*param_1 + 0x108);
uVar36 = (**(code **)(*param_1 + 0xf8))(param_1,uVar35);
lVar30 = (*pcVar48)(param_1,uVar36,pvVar29,pvVar32);
uVar36 = __strlen_chk(pvVar29,0x80);
__memset_chk(pvVar29,0,uVar36,0x80);
free(pvVar29);
uVar36 = __strlen_chk(pvVar32,0x80);
__memset_chk(pvVar32,0,uVar36,0x80);
free(pvVar32);
if (lVar30 != 0) {
uVar36 = FUN_001086a4();
uVar37 = FUN_001087a4();
uVar38 = FUN_001088a0();
uVar39 = FUN_001089a0();
uVar40 = FUN_00108aa0();
uVar41 = FUN_00108ba0();
if (iVar91 < 0x1c) {
uVar31 = (**(code **)(*param_1 + 0x110))(param_1,uVar35,lVar30,uVar31,0x40);
uVar35 = FUN_00108aa0();
uVar42 = FUN_00108ba0();
pcVar48 = *(code **)(*param_1 + 0x2f0);
uVar43 = (**(code **)(*param_1 + 0xf8))(param_1,uVar31);
lVar30 = (*pcVar48)(param_1,uVar43,uVar35,uVar42);
FUN_00108670(uVar35);
FUN_00108670(uVar42);
pcVar48 = *(code **)(*param_1 + 0x2f8);
}
else {
uVar31 = (**(code **)(*param_1 + 0x110))();
uVar35 = FUN_001086a4();
uVar42 = FUN_001087a4();
pcVar48 = *(code **)(*param_1 + 0x2f0);
uVar43 = (**(code **)(*param_1 + 0xf8))(param_1,uVar31);
uVar43 = (*pcVar48)(param_1,uVar43,uVar35,uVar42);
FUN_00108670(uVar35);
FUN_00108670(uVar42);
uVar31 = (**(code **)(*param_1 + 0x2f8))(param_1,uVar31,uVar43);
uVar35 = FUN_001088a0();
uVar42 = FUN_001089a0();
pcVar48 = *(code **)(*param_1 + 0x108);
uVar43 = (**(code **)(*param_1 + 0xf8))(param_1,uVar31);
lVar30 = (*pcVar48)(param_1,uVar43,uVar35,uVar42);
FUN_00108670(uVar35);
FUN_00108670(uVar42);
if (lVar30 == 0) goto LAB_00108630;
pcVar48 = *(code **)(*param_1 + 0x110);
}
lVar30 = (*pcVar48)(param_1,uVar31,lVar30);
FUN_00108670(uVar36);
FUN_00108670(uVar37);
FUN_00108670(uVar38);
FUN_00108670(uVar39);
FUN_00108670(uVar40);
FUN_00108670(uVar41);
if (lVar30 != 0) {
pcVar48 = *(code **)(*param_1 + 0x568);
iVar26 = (**(code **)(*param_1 + 0x558))(param_1,lVar30);
uVar31 = (*pcVar48)(param_1,lVar30,iVar26 + -1);
uVar35 = FUN_00108ca0();
uVar36 = FUN_00108da0();
pcVar48 = *(code **)(*param_1 + 0x108);
uVar37 = (**(code **)(*param_1 + 0xf8))(param_1,uVar31);
uVar37 = (*pcVar48)(param_1,uVar37,uVar35,uVar36);
FUN_00108670(uVar35);
FUN_00108670(uVar36);
lVar30 = (**(code **)(*param_1 + 0x110))(param_1,uVar31,uVar37);
if (lVar30 != 0) {
uVar31 = FUN_00108ea0();
lVar33 = (**(code **)(*param_1 + 0x30))(param_1,uVar31);
FUN_00108670(uVar31);
if (lVar33 != 0) {
uVar31 = FUN_00108fa0();
uVar35 = FUN_001090a0();
lVar34 = (**(code **)(*param_1 + 0x388))(param_1,lVar33,uVar31,uVar35);
FUN_00108670(uVar31);
FUN_00108670(uVar35);
if (lVar34 != 0) {
uVar31 = FUN_001091a0();
uVar35 = (**(code **)(*param_1 + 0x538))(param_1,uVar31);
FUN_00108670(uVar31);
lVar33 = (**(code **)(*param_1 + 0x390))(param_1,lVar33,lVar34,uVar35);
if (lVar33 != 0) {
uVar31 = FUN_00109294();
uVar35 = FUN_00109388();
pcVar48 = *(code **)(*param_1 + 0x108);
uVar36 = (**(code **)(*param_1 + 0xf8))(param_1,lVar33);
lVar34 = (*pcVar48)(param_1,uVar36,uVar31,uVar35);
FUN_00108670(uVar31);
FUN_00108670(uVar35);
if ((lVar34 != 0) &&
(lVar30 = (**(code **)(*param_1 + 0x110))
(param_1,lVar33,lVar34,lVar30), lVar30 != 0)) {
uVar27 = (**(code **)(*param_1 + 0x558))(param_1,lVar30);
pbVar44 = (byte *)(**(code **)(*param_1 + 0x6f0))(param_1,lVar30,0);
if (pbVar44 != (byte *)0x0) {
__s2 = (char *)malloc((long)(int)(uVar27 * 3));
uStack_78 = 0x4645444342413938;
local_80 = 0x3736353433323130;
if (0 < (int)uVar27) {
cVar1 = *(char *)((ulong)&local_80 | (ulong)*pbVar44 & 0xf);
*__s2 = *(char *)((ulong)&local_80 | (ulong)(*pbVar44 >> 4));
__s2[1] = cVar1;
if (uVar27 != 1) {
lVar33 = (ulong)uVar27 - 1;
pcVar45 = __s2 + 4;
pbVar47 = pbVar44;
do {
pbVar47 = pbVar47 + 1;
bVar49 = *pbVar47;
lVar33 = lVar33 + -1;
pcVar45[-2] = ':';
cVar1 = *(char *)((ulong)&local_80 | (ulong)bVar49 & 0xf);
pcVar45[-1] = *(char *)((ulong)&local_80 |
(ulong)(bVar49 >> 4));
*pcVar45 = cVar1;
pcVar45 = pcVar45 + 3;
} while (lVar33 != 0);
}
}
pcVar48 = *(code **)(*param_1 + 0x6f8);
__s2[(long)(int)(uVar27 * 3) - 1] = '\0';
(*pcVar48)(param_1,lVar30,pbVar44,0);
pcVar45 = (char *)FUN_00109488();
iVar26 = strcmp(pcVar45,__s2);
FUN_00108670(pcVar45);
free(__s2);
if (iVar26 == 0) {
uVar31 = 1;
goto LAB_00108634;
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
LAB_00108630:
uVar31 = 0;
LAB_00108634:
if (*(long *)(lVar2 + 0x28) == local_68) {
return;
}
/* WARNING: Subroutine does not return */
__stack_chk_fail(uVar31);
}
The Patching Goal
Because obfs_check1_start and obfs_check1_finish work together to measure execution time, traditional step-by-step debugging is almost guaranteed to trigger the kill-switch.
From a bypass perspective, however, we don’t need to worry about the clock.
We just need to ensure the code always takes the else path.
In assembly, our objective is to find the conditional branch instruction that evaluates iVar1 and force it to always point to the “Golden Return” of 0x10006.
Executing the patch
To do so, we’ll have to examine the assembly instructions rather than just the decompiled code. Don’t worry, it’s a short function.
**************************************************************
* FUNCTION *
**************************************************************
undefined __cdecl JNI_OnLoad(undefined8 JavaVM)
undefined <UNASSIGNED> <RETURN>
undefined8 x0:8 JavaVM XREF[2]: 00103e14(W),
00103e20(W)
undefined8 x0:8 JNI_VERSION XREF[2]: 00103e14(W),
00103e20(W)
undefined4 w0:4 antiTamperCheck? XREF[1]: 00103e20(W)
undefined8 Stack[-0x10]:8 local_10 XREF[2]: 00103e00(W),
00103e3c(R)
undefined8 Stack[-0x20]:8 local_20 XREF[2]: 00103dfc(W),
00103e40(*)
JNI_OnLoad XREF[3]: Entry Point(*), 001033a4,
001035a8(*)
00103dfc fd 7b be a9 stp x29,x30,[sp, #local_20]!
00103e00 f3 0b 00 f9 str x19,[sp, #local_10]
00103e04 fd 03 00 91 mov x29,sp
00103e08 f3 03 00 aa mov x19,JavaVM
00103e0c f5 15 00 94 bl obfs_check1_start undefined obfs_check1_start()
00103e10 e0 03 13 aa mov JavaVM,x19
00103e14 f7 15 00 94 bl <EXTERNAL>::loadJniUtil undefined loadJniUtil()
00103e18 20 01 f8 37 tbnz JNI_VERSION,#0x1f,LAB_00103e3c
00103e1c f9 15 00 94 bl <EXTERNAL>::getEnv undefined getEnv()
00103e20 fc 15 00 94 bl obfs_check1_finish undefined obfs_check1_finish()
00103e24 80 00 00 34 cbz antiTamperCheck?,LAB_00103e34
00103e28 c0 00 80 52 mov antiTamperCheck?,#0x6
00103e2c 20 00 a0 72 movk antiTamperCheck?,#0x1, LSL #16
00103e30 03 00 00 14 b LAB_00103e3c
LAB_00103e34 XREF[1]: 00103e24(j)
00103e34 fb 15 00 94 bl <EXTERNAL>::clearJni undefined clearJni()
00103e38 00 00 80 12 mov antiTamperCheck?,#0xffffffff
LAB_00103e3c XREF[2]: 00103e18(j), 00103e30(j)
00103e3c f3 0b 40 f9 ldr x19,[sp, #local_10]
00103e40 fd 7b c2 a8 ldp x29=>local_20,x30,[sp], #0x20
00103e44 c0 03 5f d6 ret
**************************************************************
* THUNK FUNCTION *
**************************************************************
thunk undefined JNI_OnUnload()
Thunked-Function: <EXTERNAL>::clearJni
undefined <UNASSIGNED> <RETURN>
JNI_OnUnload XREF[3]: Entry Point(*), 001033ac,
001035d0(*)
00103e48 f6 15 00 14 b <EXTERNAL>::clearJni
We’ll modify addresses 0x00103e0c (bl obfs_check1_start), 0x00103e20 (bl obfs_check1_finish) and, 0x00103e24 (cbz antiTamperCheck?,LAB_00103e34).
We can do so in Ghidra by right-clicking on the address and selecting patch instruction
Let’s take the easiest route to see if it works. We will replace the addresses above with NOP (No Operation) opcodes and see what happens.
Doing so, we get the following:
**************************************************************
* FUNCTION *
**************************************************************
undefined __cdecl JNI_OnLoad(undefined8 JavaVM)
undefined <UNASSIGNED> <RETURN>
undefined8 x0:8 JavaVM XREF[1]: 00103e14(W)
undefined8 x0:8 JNI_VERSION XREF[1]: 00103e14(W)
undefined4 w0:4 antiTamperCheck?
undefined8 Stack[-0x10]:8 local_10 XREF[2]: 00103e00(W),
00103e3c(R)
undefined8 Stack[-0x20]:8 local_20 XREF[2]: 00103dfc(W),
00103e40(*)
JNI_OnLoad XREF[3]: Entry Point(*), 001033a4,
001035a8(*)
00103dfc fd 7b be a9 stp x29,x30,[sp, #local_20]!
00103e00 f3 0b 00 f9 str x19,[sp, #local_10]
00103e04 fd 03 00 91 mov x29,sp
00103e08 f3 03 00 aa mov x19,JavaVM
00103e0c 1f 20 03 d5 nop
00103e10 e0 03 13 aa mov JavaVM,x19
00103e14 f7 15 00 94 bl <EXTERNAL>::loadJniUtil undefined loadJniUtil()
00103e18 20 01 f8 37 tbnz JNI_VERSION,#0x1f,LAB_00103e3c
00103e1c f9 15 00 94 bl <EXTERNAL>::getEnv undefined getEnv()
00103e20 1f 20 03 d5 nop
00103e24 1f 20 03 d5 nop
00103e28 c0 00 80 52 mov antiTamperCheck?,#0x6
00103e2c 20 00 a0 72 movk antiTamperCheck?,#0x1, LSL #16
00103e30 03 00 00 14 b LAB_00103e3c
00103e34 fb 15 00 94 bl <EXTERNAL>::clearJni undefined clearJni()
00103e38 00 00 80 12 mov antiTamperCheck?,#0xffffffff
LAB_00103e3c XREF[2]: 00103e18(j), 00103e30(j)
00103e3c f3 0b 40 f9 ldr x19,[sp, #local_10]
00103e40 fd 7b c2 a8 ldp x29=>local_20,x30,[sp], #0x20
00103e44 c0 03 5f d6 ret
**************************************************************
* THUNK FUNCTION *
**************************************************************
thunk undefined JNI_OnUnload()
Thunked-Function: <EXTERNAL>::clearJni
undefined <UNASSIGNED> <RETURN>
JNI_OnUnload XREF[3]: Entry Point(*), 001033ac,
001035d0(*)
00103e48 f6 15 00 14 b <EXTERNAL>::clearJni
And if we look at it in the decompiled code view:
undefined8 JNI_OnLoad(undefined8 JavaVM)
{
undefined8 JNI_VERSION;
JNI_VERSION = loadJniUtil(JavaVM);
if (-1 < (int)JNI_VERSION) {
getEnv();
JNI_VERSION = 0x10006;
}
return JNI_VERSION;
}
That looks pretty good! The calls to obfs_check1_finish and obfs_check1_start are gone, and the conditional check is gone. We are almost done.
Honestly, the only thing left is to export the modified library from Ghidra, replace the library in the decompiled APK, and recompile the APK.
And that’s easy!
And that’s it! Now we could replace the library in the decompiled APK, recompile it with something like apktool, and see if our fixes work.
Discovering other checks
Let’s check if some other dynamically linked library also exports obfs_check1_start or obfs_check1_finish. We can do so using nm and just a bit of bash scripting.
❯ for lib in *.so; do
if nm -D "$lib" 2>/dev/null | grep -qE 'obfs_check1_start|obfs_check1_finish'; then
echo "[+] Found target: $lib"
TARGET_LIBS+=("$lib")
fi
done
[+] Found target: libfusefs.so
[+] Found target: liblm.so
[+] Found target: libmounter.so
We can see that two other libraries (libmounter.so and libfusefs.so) also export the functions we’ve determined to be anti-tamper checks. We would also have to patch these to get a fully working APK, but I won’t bore you with the details, since the steps are almost identical.