// File: /workspace/github_c_makefile_star2_O0/mabdi[P]bunney/bunny-main.c
// Function: valset_rand_walk
static _u8 valset_rand_walk(struct bunny_traceitem* t, _u8 size) {
  _u32 val;
  _s32 pos;

  if (reg_execs > cycle_branch_limit && (zero_range || reg_params > cycle_value_limit)) return 1;

  for (val=0;val < rand_val_walks; val++) 
    for (pos=0;pos < (_s32)t->fuzzable - size ;pos++) {
      struct bunny_traceitem* n;
      _s32 rval = 0;
      _u8  rne = 0;

      flow_command(FLOW_RESET,0,0,0);

      switch (size) {
        case 1: flow_command(FLOW_SETBYTE , pos, (rval = (_s8)random()) , 0); break;
        case 2: flow_command(FLOW_SETWORD , pos, (rval = (_s16)random()), 0); break;
        case 4: flow_command(FLOW_SETDWORD, pos, (rval = R32()), 0); break;
      }

      n = run_program();

      if (check_crash(n)) {
        outf("setting offset #%u to %d (%s).\n\n",pos, rval,
             (size == 1) ? "byte" : (size == 2) ? "word" : "dword" );
        if (keep_fault) continue;
        return 1;
      }

      if (reg_execs > cycle_branch_limit) epath_ign++;
        else if ((rne=register_new_exec(n,1))) {
        outf("      Triggered by setting offset #%u to %d (%s).\n",pos, rval,
             (size == 1) ? "byte" : (size == 2) ? "word" : "dword" );
        reg_execs++;
        if (reg_execs > cycle_branch_limit) 
          outf("      >>> Per-cycle call path limit of %u exceeded (use -N to adjust).\n",cycle_branch_limit);
      }

      if (reg_params > cycle_value_limit) ppath_ign++;
        else if (register_new_param(n,pos,size,1,rne)) {
          outf("      Triggered by setting offset #%u to %d (%s).\n",pos, rval,
               (size == 1) ? "byte" : (size == 2) ? "word" : "dword" );
          reg_params++;
          if (reg_params > cycle_value_limit) 
            outf("      >>> Per-cycle function parameter limit of %u exceeded (use -P to adjust).\n",cycle_value_limit);
        }
    
      /* Context not saved */
      if (!rne) discard_context(n,1);
    
    }

  return 0;
  
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0xd0, %rsp
movb %sil, %al
movq %rdi, -0x10(%rbp)
movb %al, -0x11(%rbp)
movl 0x842d(%rip), %eax      # 0x123c8
cmpl 0x8283(%rip), %eax      # 0x12224
jbe 0x9fc6
movzbl 0x835b(%rip), %eax      # 0x12305
cmpl $0x0, %eax
jne 0x9fbd
movl 0x8417(%rip), %eax      # 0x123cc
cmpl 0x826d(%rip), %eax      # 0x12228
jbe 0x9fc6
movb $0x1, -0x1(%rbp)
jmp 0xa519
movl $0x0, -0x18(%rbp)
movl -0x18(%rbp), %eax
cmpl 0x8242(%rip), %eax      # 0x12218
jae 0xa515
movl $0x0, -0x1c(%rbp)
movl -0x1c(%rbp), %eax
movq -0x10(%rbp), %rcx
movl 0x4(%rcx), %ecx
movzbl -0x11(%rbp), %edx
subl %edx, %ecx
cmpl %ecx, %eax
jge 0xa505
movl $0x0, -0x2c(%rbp)
movb $0x0, -0x2d(%rbp)
movl $0x2, %edi
xorl %ecx, %ecx
movl %ecx, %esi
movl %ecx, %edx
callq 0x7590
movzbl -0x11(%rbp), %eax
movl %eax, -0x34(%rbp)
subl $0x1, %eax
je 0xa038
jmp 0xa024
movl -0x34(%rbp), %eax
subl $0x2, %eax
je 0xa05a
jmp 0xa02e
movl -0x34(%rbp), %eax
subl $0x4, %eax
je 0xa07c
jmp 0xa0b2
movl -0x1c(%rbp), %eax
movl %eax, -0x38(%rbp)
callq 0x2120
movl -0x38(%rbp), %esi
movsbl %al, %edx
movl %edx, -0x2c(%rbp)
movl $0x65, %edi
xorl %ecx, %ecx
callq 0x7590
jmp 0xa0b2
movl -0x1c(%rbp), %eax
movl %eax, -0x3c(%rbp)
callq 0x2120
movl -0x3c(%rbp), %esi
movswl %ax, %edx
movl %edx, -0x2c(%rbp)
movl $0x66, %edi
xorl %ecx, %ecx
callq 0x7590
jmp 0xa0b2
movl -0x1c(%rbp), %eax
movl %eax, -0x4c(%rbp)
callq 0x2120
shlq $0x10, %rax
movq %rax, -0x48(%rbp)
callq 0x2120
movl -0x4c(%rbp), %esi
movq %rax, %rcx
movq -0x48(%rbp), %rax
xorq %rcx, %rax
movl %eax, %edx
movl %edx, -0x2c(%rbp)
movl $0x67, %edi
xorl %ecx, %ecx
callq 0x7590
callq 0x7b70
movq %rax, -0x28(%rbp)
movq -0x28(%rbp), %rdi
callq 0xcf40
cmpb $0x0, %al
je 0xa1ae
jmp 0xa0ce
movl -0x1c(%rbp), %eax
movl %eax, -0x54(%rbp)
movl -0x2c(%rbp), %eax
movl %eax, -0x50(%rbp)
movzbl -0x11(%rbp), %eax
cmpl $0x1, %eax
jne 0xa0f0
leaq 0x614c(%rip), %rax      # 0x10236
movq %rax, -0x60(%rbp)
jmp 0xa10d
movzbl -0x11(%rbp), %edx
leaq 0x6140(%rip), %rax      # 0x1023b
leaq 0x613a(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0x60(%rbp)
movl -0x50(%rbp), %edx
movl -0x54(%rbp), %esi
movq -0x60(%rbp), %rcx
leaq 0x60f7(%rip), %rdi      # 0x10215
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x81ab(%rip)      # 0x122d8
je 0xa195
movq 0x81a2(%rip), %rax      # 0x122d8
movq %rax, -0x70(%rbp)
movl -0x1c(%rbp), %eax
movl %eax, -0x68(%rbp)
movl -0x2c(%rbp), %eax
movl %eax, -0x64(%rbp)
movzbl -0x11(%rbp), %eax
cmpl $0x1, %eax
jne 0xa15c
leaq 0x60e0(%rip), %rax      # 0x10236
movq %rax, -0x78(%rbp)
jmp 0xa179
movzbl -0x11(%rbp), %edx
leaq 0x60d4(%rip), %rax      # 0x1023b
leaq 0x60ce(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0x78(%rbp)
movl -0x64(%rbp), %ecx
movl -0x68(%rbp), %edx
movq -0x70(%rbp), %rdi
movq -0x78(%rbp), %r8
leaq 0x6087(%rip), %rsi      # 0x10215
movb $0x0, %al
callq 0x22d0
jmp 0xa197
cmpb $0x0, 0x8164(%rip)      # 0x12302
je 0xa1a5
jmp 0xa4f7
movb $0x1, -0x1(%rbp)
jmp 0xa519
movl 0x8214(%rip), %eax      # 0x123c8
cmpl 0x806a(%rip), %eax      # 0x12224
jbe 0xa1d0
movl 0x819e(%rip), %eax      # 0x12360
addl $0x1, %eax
movl %eax, 0x8195(%rip)      # 0x12360
jmp 0xa33c
movq -0x28(%rbp), %rdi
movl $0x1, %esi
callq 0x8770
movb %al, -0x2d(%rbp)
cmpb $0x0, %al
je 0xa33a
jmp 0xa1eb
movl -0x1c(%rbp), %eax
movl %eax, -0x80(%rbp)
movl -0x2c(%rbp), %eax
movl %eax, -0x7c(%rbp)
movzbl -0x11(%rbp), %eax
cmpl $0x1, %eax
jne 0xa210
leaq 0x602f(%rip), %rax      # 0x10236
movq %rax, -0x88(%rbp)
jmp 0xa230
movzbl -0x11(%rbp), %edx
leaq 0x6020(%rip), %rax      # 0x1023b
leaq 0x601a(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0x88(%rbp)
movl -0x7c(%rbp), %edx
movl -0x80(%rbp), %esi
movq -0x88(%rbp), %rcx
leaq 0x5ffd(%rip), %rdi      # 0x10241
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x8085(%rip)      # 0x122d8
je 0xa2da
movq 0x8078(%rip), %rax      # 0x122d8
movq %rax, -0x98(%rbp)
movl -0x1c(%rbp), %eax
movl %eax, -0x90(%rbp)
movl -0x2c(%rbp), %eax
movl %eax, -0x8c(%rbp)
movzbl -0x11(%rbp), %eax
cmpl $0x1, %eax
jne 0xa292
leaq 0x5fad(%rip), %rax      # 0x10236
movq %rax, -0xa0(%rbp)
jmp 0xa2b2
movzbl -0x11(%rbp), %edx
leaq 0x5f9e(%rip), %rax      # 0x1023b
leaq 0x5f98(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0xa0(%rbp)
movl -0x8c(%rbp), %ecx
movl -0x90(%rbp), %edx
movq -0x98(%rbp), %rdi
movq -0xa0(%rbp), %r8
leaq 0x5f6e(%rip), %rsi      # 0x10241
movb $0x0, %al
callq 0x22d0
jmp 0xa2dc
movl 0x80e6(%rip), %eax      # 0x123c8
addl $0x1, %eax
movl %eax, 0x80dd(%rip)      # 0x123c8
movl 0x80d7(%rip), %eax      # 0x123c8
cmpl 0x7f2d(%rip), %eax      # 0x12224
jbe 0xa338
jmp 0xa2fb
movl 0x7f23(%rip), %esi      # 0x12224
leaq 0x5f6c(%rip), %rdi      # 0x10274
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x7fc1(%rip)      # 0x122d8
je 0xa334
movq 0x7fb8(%rip), %rdi      # 0x122d8
movl 0x7efe(%rip), %edx      # 0x12224
leaq 0x5f47(%rip), %rsi      # 0x10274
movb $0x0, %al
callq 0x22d0
jmp 0xa336
jmp 0xa338
jmp 0xa33a
jmp 0xa33c
movl 0x808a(%rip), %eax      # 0x123cc
cmpl 0x7ee0(%rip), %eax      # 0x12228
jbe 0xa35e
movl 0x8018(%rip), %eax      # 0x12368
addl $0x1, %eax
movl %eax, 0x800f(%rip)      # 0x12368
jmp 0xa4e1
movq -0x28(%rbp), %rdi
movl -0x1c(%rbp), %esi
movb -0x11(%rbp), %al
movl $0x1, %ecx
movzbl %al, %edx
movzbl -0x2d(%rbp), %r8d
callq 0x8b80
cmpb $0x0, %al
je 0xa4df
jmp 0xa384
movl -0x1c(%rbp), %eax
movl %eax, -0xa8(%rbp)
movl -0x2c(%rbp), %eax
movl %eax, -0xa4(%rbp)
movzbl -0x11(%rbp), %eax
cmpl $0x1, %eax
jne 0xa3af
leaq 0x5e90(%rip), %rax      # 0x10236
movq %rax, -0xb0(%rbp)
jmp 0xa3cf
movzbl -0x11(%rbp), %edx
leaq 0x5e81(%rip), %rax      # 0x1023b
leaq 0x5e7b(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0xb0(%rbp)
movl -0xa4(%rbp), %edx
movl -0xa8(%rbp), %esi
movq -0xb0(%rbp), %rcx
leaq 0x5e58(%rip), %rdi      # 0x10241
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x7ee0(%rip)      # 0x122d8
je 0xa47f
movq 0x7ed3(%rip), %rax      # 0x122d8
movq %rax, -0xc0(%rbp)
movl -0x1c(%rbp), %eax
movl %eax, -0xb8(%rbp)
movl -0x2c(%rbp), %eax
movl %eax, -0xb4(%rbp)
movzbl -0x11(%rbp), %eax
cmpl $0x1, %eax
jne 0xa437
leaq 0x5e08(%rip), %rax      # 0x10236
movq %rax, -0xc8(%rbp)
jmp 0xa457
movzbl -0x11(%rbp), %edx
leaq 0x5df9(%rip), %rax      # 0x1023b
leaq 0x5df3(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0xc8(%rbp)
movl -0xb4(%rbp), %ecx
movl -0xb8(%rbp), %edx
movq -0xc0(%rbp), %rdi
movq -0xc8(%rbp), %r8
leaq 0x5dc9(%rip), %rsi      # 0x10241
movb $0x0, %al
callq 0x22d0
jmp 0xa481
movl 0x7f45(%rip), %eax      # 0x123cc
addl $0x1, %eax
movl %eax, 0x7f3c(%rip)      # 0x123cc
movl 0x7f36(%rip), %eax      # 0x123cc
cmpl 0x7d8c(%rip), %eax      # 0x12228
jbe 0xa4dd
jmp 0xa4a0
movl 0x7d82(%rip), %esi      # 0x12228
leaq 0x5e0f(%rip), %rdi      # 0x102bc
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x7e1c(%rip)      # 0x122d8
je 0xa4d9
movq 0x7e13(%rip), %rdi      # 0x122d8
movl 0x7d5d(%rip), %edx      # 0x12228
leaq 0x5dea(%rip), %rsi      # 0x102bc
movb $0x0, %al
callq 0x22d0
jmp 0xa4db
jmp 0xa4dd
jmp 0xa4df
jmp 0xa4e1
cmpb $0x0, -0x2d(%rbp)
jne 0xa4f5
movq -0x28(%rbp), %rdi
movl $0x1, %esi
callq 0x8570
jmp 0xa4f7
movl -0x1c(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x1c(%rbp)
jmp 0x9fe3
jmp 0xa507
movl -0x18(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x18(%rbp)
jmp 0x9fcd
movb $0x0, -0x1(%rbp)
movb -0x1(%rbp), %al
addq $0xd0, %rsp
popq %rbp
retq
nopw %cs:(%rax,%rax)