// File: /workspace/github_c_makefile_star2_O0/mabdi[P]bunney/bunny-main.c
// Function: eff_valset_walk
static _u8 eff_valset_walk(struct bunny_traceitem* t) {
  struct naive_list_int* l = 0;
  struct bunny_traceitem* n;
  _u32 i, j, rne = 0, eno;

  for (i=0;i < rand_phase_cycles; i++) {

    flow_command(FLOW_RESET,0,0,0);

    for (j=0;j<rand_phase_stacking;j++) {
      struct naive_list_int2* eff;
      _s32 rval = 0;

      if (reg_execs > cycle_branch_limit && (zero_range || reg_params > cycle_value_limit)) return 1;

      eff = t->eff + t->has_eff.v[R(t->has_eff.c)];

      do { eno = R(eff->c); } while (eff->v1[eno] == EFF_UNUSED);

      if (R(2)) {

        switch (eff->v2[eno]) {
          case 1:  l = &byte_val_list;  break;
          case 2:  l = &word_val_list;  break;
          default: l = &dword_val_list; break;
        }
	
        rval = l->v[R(l->c)];

      } else
        rval = R32();

      switch (eff->v2[eno]) {
        case 1:  rval = (_s8)rval;
                 flow_command(FLOW_SETBYTE , eff->v1[eno], rval, 0); break;
        case 2:  rval = (_s16)rval;
                 flow_command(FLOW_SETWORD , eff->v1[eno], rval, 0); break;
        default: flow_command(FLOW_SETDWORD, eff->v1[eno], rval, 0); break;
      }

      n = run_program();
 
      if (check_crash(n)) {
        outf("setting offset #%u to %d (%s).\n\n",eff->v1[eno], rval,
             (eff->v2[eno] == 1) ? "byte" : (eff->v2[eno] == 2) ? "word" : "dword" );
        if (keep_fault) continue;
        return 1;
      }

      if (reg_execs > cycle_branch_limit) epath_ign++;
        else if ((rne=register_new_exec(n,1))) {
        outf("      Triggered by setting offset #%u to %d (%s).\n",eff->v1[eno], rval,
             (eff->v2[eno] == 1) ? "byte" : (eff->v2[eno] == 2) ? "word" : "dword" );
        reg_execs++;
        if (reg_execs > cycle_branch_limit) 
          outf("      >>> Per-cycle call path limit of %u exceeded (use -N to adjust).\n",cycle_branch_limit);
      }

      if (reg_params > cycle_value_limit) ppath_ign++;
        else if (register_new_param(n,eff->v1[eno],eff->v2[eno],1,rne)) {
          outf("      Triggered by setting offset #%u to %d (%s).\n",eff->v1[eno], rval,
               (eff->v2[eno] == 1) ? "byte" : (eff->v2[eno] == 2) ? "word" : "dword" );
        reg_params++;
        if (reg_params > cycle_value_limit) 
          outf("      >>> Per-cycle function parameter limit of %u exceeded (use -P to adjust).\n",cycle_value_limit);
      }
      
      /* Context not saved */
      if (!rne) discard_context(n,1);

    }

  }

  
  return 0;
  
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0xf0, %rsp
movq %rdi, -0x10(%rbp)
movq $0x0, -0x18(%rbp)
movl $0x0, -0x2c(%rbp)
movl $0x0, -0x24(%rbp)
movl -0x24(%rbp), %eax
cmpl 0x92fe(%rip), %eax      # 0x1221c
jae 0x966c
movl $0x2, %edi
xorl %ecx, %ecx
movl %ecx, %esi
movl %ecx, %edx
callq 0x7590
movl $0x0, -0x28(%rbp)
movl -0x28(%rbp), %eax
cmpl 0x92dc(%rip), %eax      # 0x12220
jae 0x965c
movl $0x0, -0x3c(%rbp)
movl 0x9471(%rip), %eax      # 0x123c8
cmpl 0x92c7(%rip), %eax      # 0x12224
jbe 0x8f82
movzbl 0x939f(%rip), %eax      # 0x12305
cmpl $0x0, %eax
jne 0x8f79
movl 0x945b(%rip), %eax      # 0x123cc
cmpl 0x92b1(%rip), %eax      # 0x12228
jbe 0x8f82
movb $0x1, -0x1(%rbp)
jmp 0x9670
movq -0x10(%rbp), %rax
movq 0x58(%rax), %rax
movq %rax, -0x48(%rbp)
movq -0x10(%rbp), %rax
movq 0x60(%rax), %rax
movq %rax, -0x50(%rbp)
callq 0x2120
movq -0x50(%rbp), %rcx
movq -0x10(%rbp), %rdx
movl 0x68(%rdx), %edx
movl %edx, %esi
cqto
idivq %rsi
movq -0x48(%rbp), %rax
movl (%rcx,%rdx,4), %ecx
imulq $0x18, %rcx, %rcx
addq %rcx, %rax
movq %rax, -0x38(%rbp)
callq 0x2120
movq -0x38(%rbp), %rcx
movl 0x10(%rcx), %ecx
cqto
idivq %rcx
movl %edx, %eax
movl %eax, -0x30(%rbp)
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
cmpl $0xf0000000, (%rax,%rcx,4) # imm = 0xF0000000
je 0x8fc3
callq 0x2120
movl $0x2, %ecx
cqto
idivq %rcx
cmpq $0x0, %rdx
je 0x9070
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %eax
movl %eax, -0x54(%rbp)
subl $0x1, %eax
je 0x9023
jmp 0x9019
movl -0x54(%rbp), %eax
subl $0x2, %eax
je 0x9030
jmp 0x903d
leaq 0x92e6(%rip), %rax      # 0x12310
movq %rax, -0x18(%rbp)
jmp 0x9048
leaq 0x92e9(%rip), %rax      # 0x12320
movq %rax, -0x18(%rbp)
jmp 0x9048
leaq 0x92ec(%rip), %rax      # 0x12330
movq %rax, -0x18(%rbp)
movq -0x18(%rbp), %rax
movq (%rax), %rax
movq %rax, -0x60(%rbp)
callq 0x2120
movq -0x18(%rbp), %rcx
movl 0x8(%rcx), %ecx
cqto
idivq %rcx
movq -0x60(%rbp), %rax
movl (%rax,%rdx,4), %eax
movl %eax, -0x3c(%rbp)
jmp 0x908f
callq 0x2120
shlq $0x10, %rax
movq %rax, -0x68(%rbp)
callq 0x2120
movq %rax, %rcx
movq -0x68(%rbp), %rax
xorq %rcx, %rax
movl %eax, -0x3c(%rbp)
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %eax
movl %eax, -0x6c(%rbp)
subl $0x1, %eax
je 0x90b1
jmp 0x90a7
movl -0x6c(%rbp), %eax
subl $0x2, %eax
je 0x90d8
jmp 0x90fd
movl -0x3c(%rbp), %eax
movsbl %al, %eax
movl %eax, -0x3c(%rbp)
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %esi
movl -0x3c(%rbp), %edx
movl $0x65, %edi
xorl %ecx, %ecx
callq 0x7590
jmp 0x9119
movl -0x3c(%rbp), %eax
cwtl
movl %eax, -0x3c(%rbp)
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %esi
movl -0x3c(%rbp), %edx
movl $0x66, %edi
xorl %ecx, %ecx
callq 0x7590
jmp 0x9119
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %esi
movl -0x3c(%rbp), %edx
movl $0x67, %edi
xorl %ecx, %ecx
callq 0x7590
callq 0x7b70
movq %rax, -0x20(%rbp)
movq -0x20(%rbp), %rdi
callq 0xcf40
cmpb $0x0, %al
je 0x926c
jmp 0x9135
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %eax
movl %eax, -0x74(%rbp)
movl -0x3c(%rbp), %eax
movl %eax, -0x70(%rbp)
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
cmpl $0x1, (%rax,%rcx,4)
jne 0x9169
leaq 0x70d3(%rip), %rax      # 0x10236
movq %rax, -0x80(%rbp)
jmp 0x9190
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %edx
leaq 0x70bd(%rip), %rax      # 0x1023b
leaq 0x70b7(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0x80(%rbp)
movl -0x70(%rbp), %edx
movl -0x74(%rbp), %esi
movq -0x80(%rbp), %rcx
leaq 0x7074(%rip), %rdi      # 0x10215
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x9128(%rip)      # 0x122d8
je 0x9253
movq 0x911b(%rip), %rax      # 0x122d8
movq %rax, -0x90(%rbp)
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %eax
movl %eax, -0x88(%rbp)
movl -0x3c(%rbp), %eax
movl %eax, -0x84(%rbp)
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
cmpl $0x1, (%rax,%rcx,4)
jne 0x9201
leaq 0x703e(%rip), %rax      # 0x10236
movq %rax, -0x98(%rbp)
jmp 0x922b
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %edx
leaq 0x7025(%rip), %rax      # 0x1023b
leaq 0x701f(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0x98(%rbp)
movl -0x84(%rbp), %ecx
movl -0x88(%rbp), %edx
movq -0x90(%rbp), %rdi
movq -0x98(%rbp), %r8
leaq 0x6fc9(%rip), %rsi      # 0x10215
movb $0x0, %al
callq 0x22d0
jmp 0x9255
cmpb $0x0, 0x90a6(%rip)      # 0x12302
je 0x9263
jmp 0x964e
movb $0x1, -0x1(%rbp)
jmp 0x9670
movl 0x9156(%rip), %eax      # 0x123c8
cmpl 0x8fac(%rip), %eax      # 0x12224
jbe 0x928e
movl 0x90e0(%rip), %eax      # 0x12360
addl $0x1, %eax
movl %eax, 0x90d7(%rip)      # 0x12360
jmp 0x9442
movq -0x20(%rbp), %rdi
movl $0x1, %esi
callq 0x8770
movzbl %al, %eax
movl %eax, -0x2c(%rbp)
cmpl $0x0, %eax
je 0x9440
jmp 0x92ad
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %eax
movl %eax, -0xa0(%rbp)
movl -0x3c(%rbp), %eax
movl %eax, -0x9c(%rbp)
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
cmpl $0x1, (%rax,%rcx,4)
jne 0x92ea
leaq 0x6f55(%rip), %rax      # 0x10236
movq %rax, -0xa8(%rbp)
jmp 0x9314
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %edx
leaq 0x6f3c(%rip), %rax      # 0x1023b
leaq 0x6f36(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0xa8(%rbp)
movl -0x9c(%rbp), %edx
movl -0xa0(%rbp), %esi
movq -0xa8(%rbp), %rcx
leaq 0x6f13(%rip), %rdi      # 0x10241
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x8f9b(%rip)      # 0x122d8
je 0x93e0
movq 0x8f8e(%rip), %rax      # 0x122d8
movq %rax, -0xb8(%rbp)
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %eax
movl %eax, -0xb0(%rbp)
movl -0x3c(%rbp), %eax
movl %eax, -0xac(%rbp)
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
cmpl $0x1, (%rax,%rcx,4)
jne 0x938e
leaq 0x6eb1(%rip), %rax      # 0x10236
movq %rax, -0xc0(%rbp)
jmp 0x93b8
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %edx
leaq 0x6e98(%rip), %rax      # 0x1023b
leaq 0x6e92(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0xc0(%rbp)
movl -0xac(%rbp), %ecx
movl -0xb0(%rbp), %edx
movq -0xb8(%rbp), %rdi
movq -0xc0(%rbp), %r8
leaq 0x6e68(%rip), %rsi      # 0x10241
movb $0x0, %al
callq 0x22d0
jmp 0x93e2
movl 0x8fe0(%rip), %eax      # 0x123c8
addl $0x1, %eax
movl %eax, 0x8fd7(%rip)      # 0x123c8
movl 0x8fd1(%rip), %eax      # 0x123c8
cmpl 0x8e27(%rip), %eax      # 0x12224
jbe 0x943e
jmp 0x9401
movl 0x8e1d(%rip), %esi      # 0x12224
leaq 0x6e66(%rip), %rdi      # 0x10274
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x8ebb(%rip)      # 0x122d8
je 0x943a
movq 0x8eb2(%rip), %rdi      # 0x122d8
movl 0x8df8(%rip), %edx      # 0x12224
leaq 0x6e41(%rip), %rsi      # 0x10274
movb $0x0, %al
callq 0x22d0
jmp 0x943c
jmp 0x943e
jmp 0x9440
jmp 0x9442
movl 0x8f84(%rip), %eax      # 0x123cc
cmpl 0x8dda(%rip), %eax      # 0x12228
jbe 0x9464
movl 0x8f12(%rip), %eax      # 0x12368
addl $0x1, %eax
movl %eax, 0x8f09(%rip)      # 0x12368
jmp 0x9638
movq -0x20(%rbp), %rdi
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %esi
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %eax
movb %al, %dl
movl -0x2c(%rbp), %eax
movl $0x1, %ecx
movzbl %dl, %edx
movzbl %al, %r8d
callq 0x8b80
cmpb $0x0, %al
je 0x9636
jmp 0x94a3
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %eax
movl %eax, -0xc8(%rbp)
movl -0x3c(%rbp), %eax
movl %eax, -0xc4(%rbp)
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
cmpl $0x1, (%rax,%rcx,4)
jne 0x94e0
leaq 0x6d5f(%rip), %rax      # 0x10236
movq %rax, -0xd0(%rbp)
jmp 0x950a
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %edx
leaq 0x6d46(%rip), %rax      # 0x1023b
leaq 0x6d40(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0xd0(%rbp)
movl -0xc4(%rbp), %edx
movl -0xc8(%rbp), %esi
movq -0xd0(%rbp), %rcx
leaq 0x6d1d(%rip), %rdi      # 0x10241
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x8da5(%rip)      # 0x122d8
je 0x95d6
movq 0x8d98(%rip), %rax      # 0x122d8
movq %rax, -0xe0(%rbp)
movq -0x38(%rbp), %rax
movq (%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %eax
movl %eax, -0xd8(%rbp)
movl -0x3c(%rbp), %eax
movl %eax, -0xd4(%rbp)
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
cmpl $0x1, (%rax,%rcx,4)
jne 0x9584
leaq 0x6cbb(%rip), %rax      # 0x10236
movq %rax, -0xe8(%rbp)
jmp 0x95ae
movq -0x38(%rbp), %rax
movq 0x8(%rax), %rax
movl -0x30(%rbp), %ecx
movl (%rax,%rcx,4), %edx
leaq 0x6ca2(%rip), %rax      # 0x1023b
leaq 0x6c9c(%rip), %rcx      # 0x1023c
cmpl $0x2, %edx
cmoveq %rcx, %rax
movq %rax, -0xe8(%rbp)
movl -0xd4(%rbp), %ecx
movl -0xd8(%rbp), %edx
movq -0xe0(%rbp), %rdi
movq -0xe8(%rbp), %r8
leaq 0x6c72(%rip), %rsi      # 0x10241
movb $0x0, %al
callq 0x22d0
jmp 0x95d8
movl 0x8dee(%rip), %eax      # 0x123cc
addl $0x1, %eax
movl %eax, 0x8de5(%rip)      # 0x123cc
movl 0x8ddf(%rip), %eax      # 0x123cc
cmpl 0x8c35(%rip), %eax      # 0x12228
jbe 0x9634
jmp 0x95f7
movl 0x8c2b(%rip), %esi      # 0x12228
leaq 0x6cb8(%rip), %rdi      # 0x102bc
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x8cc5(%rip)      # 0x122d8
je 0x9630
movq 0x8cbc(%rip), %rdi      # 0x122d8
movl 0x8c06(%rip), %edx      # 0x12228
leaq 0x6c93(%rip), %rsi      # 0x102bc
movb $0x0, %al
callq 0x22d0
jmp 0x9632
jmp 0x9634
jmp 0x9636
jmp 0x9638
cmpl $0x0, -0x2c(%rbp)
jne 0x964c
movq -0x20(%rbp), %rdi
movl $0x1, %esi
callq 0x8570
jmp 0x964e
movl -0x28(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x28(%rbp)
jmp 0x8f3b
jmp 0x965e
movl -0x24(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x24(%rbp)
jmp 0x8f15
movb $0x0, -0x1(%rbp)
movb -0x1(%rbp), %al
addq $0xf0, %rsp
popq %rbp
retq
nopl (%rax)