_QWORD *__fastcall malloc_adjust(signed int a1)
{
  signed int v2; // [sp+Ch] [bp-4h]@3

  if ( a1 >= 0 && a1 > 16 )                     // >16
  {
    if ( a1 <= 16 || a1 > 48 )                  // >48
    {
      if ( a1 <= 48 || a1 > 80 )                // >80
        v2 = 400;                               // 80<x
      else
        v2 = 80;                                // 48<x<=80
    }
    else
    {
      v2 = 48;                                  // 16<size<=48
    }
  }
  else
  {
    v2 = 16;                                    // x<=16
  }
  return malloc_(v2);
}//这个malloc_adjust会根据输入调整一下实际分配的大小，就当他是对齐用的吧。。。

if ( v3 == 2 )
{
	puts("welcome to Playerunknown's Battlegrounds");
	puts("First,you need set your username and password");
	v1 = malloc_adjust(48);
	dreflhs_rhs_withGC((_QWORD **)&sign_infor, v1);// collapse
	puts("input your username");
	getstr(sign_infor->username, 0x10LL);
	puts("input your password");
	getstr(sign_infor->password, 0x10LL);
	puts("Second,you need create a character and give him a name");
	v2 = malloc_adjust(56);
	dreflhs_rhs_withGC((_QWORD **)&sign_infor->status, v2);
	sign_infor->status->health = 100LL;
	sign_infor->status->capacity = 100LL;
	sign_infor->status->stamina = 100LL;
	puts("input your character's name");
	getstr(sign_infor->status->name, 0x10LL);
	puts("all is ok");
}

// *lhs=rhs
_QWORD *__fastcall dreflhs_rhs_withGC(_QWORD **pointer, void *mem_frommymalloc)
{
  _QWORD *chunk_mem; // rax@2
  _QWORD *chunk; // rax@4
  _QWORD *result; // rax@5

  if ( mem_frommymalloc )
  {
    chunk_mem = minus_16(mem_frommymalloc);
    incre_ref(chunk_mem);
  }
  if ( *pointer )
  {
    chunk = minus_16(*pointer);
    reduce_ref(chunk);                          // collapse
  }
  result = pointer;
  *pointer = mem_frommymalloc;
  return result;
}
__int64 __fastcall is_deref_a_inrange(_QWORD *a1)
{
  return *a1 <= 0x7FFFFFFFEFFFLL && *a1 > 0x400000LL;
}
_DWORD *__fastcall ret_addr_of_first_addr(_QWORD *chunk, signed __int64 *pi)
{
  signed __int64 i; // [sp+18h] [bp-18h]@3
  signed __int64 size; // [sp+20h] [bp-10h]@3
  _QWORD *mem; // [sp+28h] [bp-8h]@3

  if ( !chunk )
    exit(0);
  mem = chunk + 2;
  size = (chunk[1] - 16LL) / 8;
  for ( i = *pi; i < size; ++i )
  {
    *pi = i;
    if ( (unsigned __int8)is_deref_a_inrange(&mem[i]) )
      return &mem[i];
  }
  return 0LL;
}

// also, reflect mem to chunk[2](data part)
_QWORD *__fastcall rec_chunk(_QWORD *chunk)
{
  _QWORD *result; // rax@3

  if ( !mem )
    mem = malloc_adjust(4);
  chunk[2] = mem;//任意chunk[2]可以被我们控制，会被赋值为mem的值，QWORD SHOOT here!!!
  *mem = chunk;                        // 可能overflow，但我没用这个
  result = mem + 1;
  ++mem;
  return result;
}
__int64 __fastcall reduce_ref(_QWORD *chunk)
{
  _QWORD *chunk_1; // rax@3
  __int64 i; // [sp+10h] [bp-20h]@1
  _QWORD *chunk_; // [sp+18h] [bp-18h]@1
  _QWORD **p_elem; // [sp+20h] [bp-10h]@2
  __int64 v6; // [sp+28h] [bp-8h]@1

  v6 = *MK_FP(__FS__, 40LL);
  i = 0LL;
  chunk_ = chunk;
  --*chunk;
  if ( !*chunk_ )                               // 如果引用计数变成0
  {
    while ( 1 )
    {
      p_elem = (_QWORD **)ret_addr_of_first_addr(chunk, &i);
      if ( p_elem == 0LL )                      // 如果在chunk中已经没有有效地址了
        break;
      ++i;                                      // 增加i并且做下次循环
      chunk_1 = minus_16(*p_elem);              // 如果 *pmem 是有效地址(在指定范围中)，但不一定是在mmap的堆中, 也会把它当作mmap中的chunk，进行rec_chunk的调用
      rec_chunk(chunk_1);                       // 它被当成了chunk，但不一定是mmap中的chunk(0x41414141-16)
    }
    rec_chunk(chunk_);
  }
  return *MK_FP(__FS__, 40LL) ^ v6;
}