// File: /workspace/github_c_makefile_star2_O0/mabdi[P]bunney/bunny-main.c
// Function: chunk_walk
static _u8 chunk_walk(struct bunny_traceitem* t, _u32 oper, _u32 csize) {
  _s32 shift, pos, rev;

  if (reg_execs > cycle_branch_limit && (zero_range || reg_params > cycle_value_limit)) return 1;

  if (oper == FLOW_INSERT && t->fuzzable >= size_limit) {
    outf("      >>> Fuzzable input limit of %u exceeded (use -F to adjust).\n",size_limit);
    return 1;
  }

  /* FLOW_SWAP is symmetrical; the rest should be tested for +/- shifts */

  for (rev=0;rev < 1 + (oper != FLOW_SWAP);rev++) 
    for (shift = 1; shift < chunk_off_max; shift++) {

      _s32 max = t->fuzzable - csize - shift;

      for (pos=0;pos <= max;pos++) {
        struct bunny_traceitem* n;
        _u8 rne = 0;
        _u32 src, dst;
  
        flow_command(FLOW_RESET,0,0,0);

        if (!rev) { src = pos; dst = pos + shift; }
          else { src = pos + shift; dst = pos; }

        flow_command(oper,dst,csize,src);

        n = run_program();

        if (check_crash(n)) {
          outf("%s %u bytes from offset #%u to #%u.\n\n",
            (oper == FLOW_INSERT) ? "cloning" : 
            (oper == FLOW_SWAP) ? "swapping" : "pasting over",
            csize, src, dst);
          if (keep_fault) continue;
          return 1;
        }

        if (reg_execs > cycle_branch_limit) epath_ign++;
          else if ((rne=register_new_exec(n,1))) {
            outf("      Triggered by %s %u bytes from offset #%u to #%u.\n",
              (oper == FLOW_INSERT) ? "cloning" : 
              (oper == FLOW_SWAP) ? "swapping" : "pasting over",
              csize, src, dst);
  
            reg_execs++;
            if (reg_execs > cycle_branch_limit) 
              outf("      >>> Per-cycle call path limit of %u exceeded (use -N to adjust).\n",cycle_branch_limit);
          }

        if (reg_params > cycle_value_limit) ppath_ign++;
          else if (register_new_param(n,0,0,1,rne)) {
            outf("      Triggered by %s %u bytes from offset #%u to #%u.\n",
              (oper == FLOW_INSERT) ? "cloning" : 
              (oper == FLOW_SWAP) ? "swapping" : "pasting over",
              csize, src, dst);
            reg_params++;
            if (reg_params > cycle_value_limit) 
              outf("      >>> Per-cycle function parameter limit of %u exceeded (use -P to adjust).\n",cycle_value_limit);
          }
      
        /* Context not saved */
        if (!rne) discard_context(n,1);
      
      }
  
    }


  return 0;
  
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x90, %rsp
movq %rdi, -0x10(%rbp)
movl %esi, -0x14(%rbp)
movl %edx, -0x18(%rbp)
movl 0x7b8d(%rip), %eax      # 0x123c8
cmpl 0x79e3(%rip), %eax      # 0x12224
jbe 0xa866
movzbl 0x7abb(%rip), %eax      # 0x12305
cmpl $0x0, %eax
jne 0xa85d
movl 0x7b77(%rip), %eax      # 0x123cc
cmpl 0x79cd(%rip), %eax      # 0x12228
jbe 0xa866
movb $0x1, -0x1(%rbp)
jmp 0xad41
cmpl $0x6a, -0x14(%rbp)
jne 0xa8c1
movq -0x10(%rbp), %rax
movl 0x4(%rax), %eax
cmpl 0x7a8f(%rip), %eax      # 0x12308
jb 0xa8c1
jmp 0xa87d
movl 0x7a85(%rip), %esi      # 0x12308
leaq 0x5c93(%rip), %rdi      # 0x1051d
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x7a3f(%rip)      # 0x122d8
je 0xa8b6
movq 0x7a36(%rip), %rdi      # 0x122d8
movl 0x7a60(%rip), %edx      # 0x12308
leaq 0x5c6e(%rip), %rsi      # 0x1051d
movb $0x0, %al
callq 0x22d0
jmp 0xa8b8
movb $0x1, -0x1(%rbp)
jmp 0xad41
movl $0x0, -0x24(%rbp)
movl -0x24(%rbp), %eax
cmpl $0x6b, -0x14(%rbp)
setne %cl
andb $0x1, %cl
movzbl %cl, %ecx
addl $0x1, %ecx
cmpl %ecx, %eax
jge 0xad3d
movl $0x1, -0x1c(%rbp)
movl -0x1c(%rbp), %eax
cmpl 0x7915(%rip), %eax      # 0x12208
jae 0xad2d
movq -0x10(%rbp), %rax
movl 0x4(%rax), %eax
subl -0x18(%rbp), %eax
subl -0x1c(%rbp), %eax
movl %eax, -0x28(%rbp)
movl $0x0, -0x20(%rbp)
movl -0x20(%rbp), %eax
cmpl -0x28(%rbp), %eax
jg 0xad1d
movb $0x0, -0x31(%rbp)
movl $0x2, %edi
xorl %ecx, %ecx
movl %ecx, %esi
movl %ecx, %edx
callq 0x7590
cmpl $0x0, -0x24(%rbp)
jne 0xa947
movl -0x20(%rbp), %eax
movl %eax, -0x38(%rbp)
movl -0x20(%rbp), %eax
addl -0x1c(%rbp), %eax
movl %eax, -0x3c(%rbp)
jmp 0xa956
movl -0x20(%rbp), %eax
addl -0x1c(%rbp), %eax
movl %eax, -0x38(%rbp)
movl -0x20(%rbp), %eax
movl %eax, -0x3c(%rbp)
movl -0x14(%rbp), %edi
movl -0x3c(%rbp), %esi
movl -0x18(%rbp), %edx
movl -0x38(%rbp), %ecx
callq 0x7590
callq 0x7b70
movq %rax, -0x30(%rbp)
movq -0x30(%rbp), %rdi
callq 0xcf40
cmpb $0x0, %al
je 0xaa4c
jmp 0xa983
cmpl $0x6a, -0x14(%rbp)
jne 0xa996
leaq 0x5bf6(%rip), %rax      # 0x10586
movq %rax, -0x48(%rbp)
jmp 0xa9b2
movl -0x14(%rbp), %edx
leaq 0x5bf7(%rip), %rax      # 0x10597
leaq 0x5be7(%rip), %rcx      # 0x1058e
cmpl $0x6b, %edx
cmoveq %rcx, %rax
movq %rax, -0x48(%rbp)
movq -0x48(%rbp), %rsi
movl -0x18(%rbp), %edx
movl -0x38(%rbp), %ecx
movl -0x3c(%rbp), %r8d
leaq 0x5b99(%rip), %rdi      # 0x10560
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x7902(%rip)      # 0x122d8
je 0xaa33
movq 0x78f9(%rip), %rax      # 0x122d8
movq %rax, -0x50(%rbp)
cmpl $0x6a, -0x14(%rbp)
jne 0xa9f6
leaq 0x5b96(%rip), %rax      # 0x10586
movq %rax, -0x58(%rbp)
jmp 0xaa12
movl -0x14(%rbp), %edx
leaq 0x5b97(%rip), %rax      # 0x10597
leaq 0x5b87(%rip), %rcx      # 0x1058e
cmpl $0x6b, %edx
cmoveq %rcx, %rax
movq %rax, -0x58(%rbp)
movq -0x50(%rbp), %rdi
movq -0x58(%rbp), %rdx
movl -0x18(%rbp), %ecx
movl -0x38(%rbp), %r8d
movl -0x3c(%rbp), %r9d
leaq 0x5b34(%rip), %rsi      # 0x10560
movb $0x0, %al
callq 0x22d0
jmp 0xaa35
cmpb $0x0, 0x78c6(%rip)      # 0x12302
je 0xaa43
jmp 0xad0f
movb $0x1, -0x1(%rbp)
jmp 0xad41
movl 0x7976(%rip), %eax      # 0x123c8
cmpl 0x77cc(%rip), %eax      # 0x12224
jbe 0xaa6e
movl 0x7900(%rip), %eax      # 0x12360
addl $0x1, %eax
movl %eax, 0x78f7(%rip)      # 0x12360
jmp 0xab9b
movq -0x30(%rbp), %rdi
movl $0x1, %esi
callq 0x8770
movb %al, -0x31(%rbp)
cmpb $0x0, %al
je 0xab99
jmp 0xaa89
cmpl $0x6a, -0x14(%rbp)
jne 0xaa9c
leaq 0x5af0(%rip), %rax      # 0x10586
movq %rax, -0x60(%rbp)
jmp 0xaab8
movl -0x14(%rbp), %edx
leaq 0x5af1(%rip), %rax      # 0x10597
leaq 0x5ae1(%rip), %rcx      # 0x1058e
cmpl $0x6b, %edx
cmoveq %rcx, %rax
movq %rax, -0x60(%rbp)
movq -0x60(%rbp), %rsi
movl -0x18(%rbp), %edx
movl -0x38(%rbp), %ecx
movl -0x3c(%rbp), %r8d
leaq 0x5ad7(%rip), %rdi      # 0x105a4
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x77fc(%rip)      # 0x122d8
je 0xab39
movq 0x77f3(%rip), %rax      # 0x122d8
movq %rax, -0x68(%rbp)
cmpl $0x6a, -0x14(%rbp)
jne 0xaafc
leaq 0x5a90(%rip), %rax      # 0x10586
movq %rax, -0x70(%rbp)
jmp 0xab18
movl -0x14(%rbp), %edx
leaq 0x5a91(%rip), %rax      # 0x10597
leaq 0x5a81(%rip), %rcx      # 0x1058e
cmpl $0x6b, %edx
cmoveq %rcx, %rax
movq %rax, -0x70(%rbp)
movq -0x68(%rbp), %rdi
movq -0x70(%rbp), %rdx
movl -0x18(%rbp), %ecx
movl -0x38(%rbp), %r8d
movl -0x3c(%rbp), %r9d
leaq 0x5a72(%rip), %rsi      # 0x105a4
movb $0x0, %al
callq 0x22d0
jmp 0xab3b
movl 0x7887(%rip), %eax      # 0x123c8
addl $0x1, %eax
movl %eax, 0x787e(%rip)      # 0x123c8
movl 0x7878(%rip), %eax      # 0x123c8
cmpl 0x76ce(%rip), %eax      # 0x12224
jbe 0xab97
jmp 0xab5a
movl 0x76c4(%rip), %esi      # 0x12224
leaq 0x570d(%rip), %rdi      # 0x10274
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x7762(%rip)      # 0x122d8
je 0xab93
movq 0x7759(%rip), %rdi      # 0x122d8
movl 0x769f(%rip), %edx      # 0x12224
leaq 0x56e8(%rip), %rsi      # 0x10274
movb $0x0, %al
callq 0x22d0
jmp 0xab95
jmp 0xab97
jmp 0xab99
jmp 0xab9b
movl 0x782b(%rip), %eax      # 0x123cc
cmpl 0x7681(%rip), %eax      # 0x12228
jbe 0xabbd
movl 0x77b9(%rip), %eax      # 0x12368
addl $0x1, %eax
movl %eax, 0x77b0(%rip)      # 0x12368
jmp 0xacf9
movq -0x30(%rbp), %rdi
xorl %edx, %edx
movl $0x1, %ecx
movl %edx, %esi
movzbl -0x31(%rbp), %r8d
callq 0x8b80
cmpb $0x0, %al
je 0xacf7
jmp 0xabde
cmpl $0x6a, -0x14(%rbp)
jne 0xabf1
leaq 0x599b(%rip), %rax      # 0x10586
movq %rax, -0x78(%rbp)
jmp 0xac0d
movl -0x14(%rbp), %edx
leaq 0x599c(%rip), %rax      # 0x10597
leaq 0x598c(%rip), %rcx      # 0x1058e
cmpl $0x6b, %edx
cmoveq %rcx, %rax
movq %rax, -0x78(%rbp)
movq -0x78(%rbp), %rsi
movl -0x18(%rbp), %edx
movl -0x38(%rbp), %ecx
movl -0x3c(%rbp), %r8d
leaq 0x5982(%rip), %rdi      # 0x105a4
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x76a7(%rip)      # 0x122d8
je 0xac97
movq 0x769e(%rip), %rax      # 0x122d8
movq %rax, -0x80(%rbp)
cmpl $0x6a, -0x14(%rbp)
jne 0xac54
leaq 0x593b(%rip), %rax      # 0x10586
movq %rax, -0x88(%rbp)
jmp 0xac73
movl -0x14(%rbp), %edx
leaq 0x5939(%rip), %rax      # 0x10597
leaq 0x5929(%rip), %rcx      # 0x1058e
cmpl $0x6b, %edx
cmoveq %rcx, %rax
movq %rax, -0x88(%rbp)
movq -0x80(%rbp), %rdi
movq -0x88(%rbp), %rdx
movl -0x18(%rbp), %ecx
movl -0x38(%rbp), %r8d
movl -0x3c(%rbp), %r9d
leaq 0x5914(%rip), %rsi      # 0x105a4
movb $0x0, %al
callq 0x22d0
jmp 0xac99
movl 0x772d(%rip), %eax      # 0x123cc
addl $0x1, %eax
movl %eax, 0x7724(%rip)      # 0x123cc
movl 0x771e(%rip), %eax      # 0x123cc
cmpl 0x7574(%rip), %eax      # 0x12228
jbe 0xacf5
jmp 0xacb8
movl 0x756a(%rip), %esi      # 0x12228
leaq 0x55f7(%rip), %rdi      # 0x102bc
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x7604(%rip)      # 0x122d8
je 0xacf1
movq 0x75fb(%rip), %rdi      # 0x122d8
movl 0x7545(%rip), %edx      # 0x12228
leaq 0x55d2(%rip), %rsi      # 0x102bc
movb $0x0, %al
callq 0x22d0
jmp 0xacf3
jmp 0xacf5
jmp 0xacf7
jmp 0xacf9
cmpb $0x0, -0x31(%rbp)
jne 0xad0d
movq -0x30(%rbp), %rdi
movl $0x1, %esi
callq 0x8570
jmp 0xad0f
movl -0x20(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x20(%rbp)
jmp 0xa910
jmp 0xad1f
movl -0x1c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x1c(%rbp)
jmp 0xa8ea
jmp 0xad2f
movl -0x24(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x24(%rbp)
jmp 0xa8c8
movb $0x0, -0x1(%rbp)
movb -0x1(%rbp), %al
addq $0x90, %rsp
popq %rbp
retq
nopl (%rax)