// File: /workspace/github_c_makefile_star2_O1/mabdi[P]bunney/bunny-main.c
// Function: chunk_walk
static _u8 chunk_walk(struct bunny_traceitem* t, _u32 oper, _u32 csize) {
  _s32 shift, pos, rev;

  if (reg_execs > cycle_branch_limit && (zero_range || reg_params > cycle_value_limit)) return 1;

  if (oper == FLOW_INSERT && t->fuzzable >= size_limit) {
    outf("      >>> Fuzzable input limit of %u exceeded (use -F to adjust).\n",size_limit);
    return 1;
  }

  /* FLOW_SWAP is symmetrical; the rest should be tested for +/- shifts */

  for (rev=0;rev < 1 + (oper != FLOW_SWAP);rev++) 
    for (shift = 1; shift < chunk_off_max; shift++) {

      _s32 max = t->fuzzable - csize - shift;

      for (pos=0;pos <= max;pos++) {
        struct bunny_traceitem* n;
        _u8 rne = 0;
        _u32 src, dst;
  
        flow_command(FLOW_RESET,0,0,0);

        if (!rev) { src = pos; dst = pos + shift; }
          else { src = pos + shift; dst = pos; }

        flow_command(oper,dst,csize,src);

        n = run_program();

        if (check_crash(n)) {
          outf("%s %u bytes from offset #%u to #%u.\n\n",
            (oper == FLOW_INSERT) ? "cloning" : 
            (oper == FLOW_SWAP) ? "swapping" : "pasting over",
            csize, src, dst);
          if (keep_fault) continue;
          return 1;
        }

        if (reg_execs > cycle_branch_limit) epath_ign++;
          else if ((rne=register_new_exec(n,1))) {
            outf("      Triggered by %s %u bytes from offset #%u to #%u.\n",
              (oper == FLOW_INSERT) ? "cloning" : 
              (oper == FLOW_SWAP) ? "swapping" : "pasting over",
              csize, src, dst);
  
            reg_execs++;
            if (reg_execs > cycle_branch_limit) 
              outf("      >>> Per-cycle call path limit of %u exceeded (use -N to adjust).\n",cycle_branch_limit);
          }

        if (reg_params > cycle_value_limit) ppath_ign++;
          else if (register_new_param(n,0,0,1,rne)) {
            outf("      Triggered by %s %u bytes from offset #%u to #%u.\n",
              (oper == FLOW_INSERT) ? "cloning" : 
              (oper == FLOW_SWAP) ? "swapping" : "pasting over",
              csize, src, dst);
            reg_params++;
            if (reg_params > cycle_value_limit) 
              outf("      >>> Per-cycle function parameter limit of %u exceeded (use -P to adjust).\n",cycle_value_limit);
          }
      
        /* Context not saved */
        if (!rne) discard_context(n,1);
      
      }
  
    }


  return 0;
  
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x38, %rsp
movl %edx, %ebx
movl %esi, 0x4(%rsp)
movq %rdi, 0x30(%rsp)
movl 0x6846(%rip), %eax      # 0x10358
cmpl 0x6710(%rip), %eax      # 0x10228
jbe 0x9b3c
movb $0x1, %r14b
cmpb $0x0, 0x6771(%rip)      # 0x10295
jne 0x9e9e
movl 0x682c(%rip), %eax      # 0x1035c
cmpl 0x66f6(%rip), %eax      # 0x1022c
ja 0x9e9e
cmpl $0x6a, 0x4(%rsp)
jne 0x9b57
movl 0x674f(%rip), %esi      # 0x10298
movq 0x30(%rsp), %rax
cmpl %esi, 0x4(%rax)
jae 0x9eb0
movl 0x4(%rsp), %edx
cmpl $0x6b, %edx
leaq 0x3abc(%rip), %rax      # 0xd621
leaq 0x3aac(%rip), %rcx      # 0xd618
cmovneq %rax, %rcx
cmpl $0x6a, %edx
leaq 0x3a96(%rip), %rax      # 0xd610
cmovneq %rcx, %rax
movq %rax, 0x8(%rsp)
movl %ebx, %eax
negl %eax
movl %eax, 0x24(%rsp)
movq $0x0, 0x18(%rsp)
cmpl $0x2, 0x6675(%rip)      # 0x10210
jb 0x9e7a
movl $0x1, %ebp
movl 0x24(%rsp), %ecx
movq 0x30(%rsp), %rax
movl 0x4(%rax), %edx
leal (%rbx,%rbp), %eax
cmpl %eax, %edx
js 0x9e6a
movl %ecx, 0x28(%rsp)
addl %ecx, %edx
xorl %r15d, %r15d
movq %rbp, 0x10(%rsp)
movl %edx, 0x2c(%rsp)
movl $0x2, %edi
xorl %esi, %esi
xorl %edx, %edx
xorl %ecx, %ecx
callq 0x7a97
leal (%r15,%rbp), %r12d
cmpl $0x0, 0x18(%rsp)
movl %r12d, %r13d
cmovel %r15d, %r13d
cmovnel %r15d, %r12d
movl 0x4(%rsp), %edi
movl %r12d, %esi
movl %ebx, %edx
movl %r13d, %ecx
callq 0x7a97
callq 0x7ddc
movq %rax, %r14
movq %rax, %rdi
callq 0xa57e
testb %al, %al
je 0x9c7a
leaq 0x39cb(%rip), %rbp      # 0xd5ea
movq %rbp, %rdi
movq 0x8(%rsp), %r14
movq %r14, %rsi
movl %ebx, %edx
movl %r13d, %ecx
movl %r12d, %r8d
xorl %eax, %eax
callq 0x2030
movq 0x6628(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x9c5a
movq %rbp, %rsi
movq %r14, %rdx
movl %ebx, %ecx
movl %r13d, %r8d
movl %r12d, %r9d
xorl %eax, %eax
callq 0x22d0
cmpb $0x0, 0x6631(%rip)      # 0x10292
movl $0x1, %r12d
movl $0xc, %eax
cmovnel %eax, %r12d
movq 0x10(%rsp), %rbp
jmp 0x9e2d
movl 0x66d8(%rip), %eax      # 0x10358
cmpl 0x65a2(%rip), %eax      # 0x10228
jbe 0x9c93
incl 0x6662(%rip)            # 0x102f0
jmp 0x9d4e
movq %r14, %rdi
movl $0x1, %esi
callq 0x8b23
testb %al, %al
je 0x9d4e
movq %rbx, %rbp
leaq 0x397c(%rip), %rbx      # 0xd62e
movq %rbx, %rdi
movq 0x8(%rsp), %rsi
movl %ebp, %edx
movl %r13d, %ecx
movl %r12d, %r8d
xorl %eax, %eax
callq 0x2030
movq 0x6598(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x9cec
movq %rbx, %rsi
movq 0x8(%rsp), %rdx
movl %ebp, %ecx
movl %r13d, %r8d
movl %r12d, %r9d
xorl %eax, %eax
callq 0x22d0
movl 0x6666(%rip), %eax      # 0x10358
incl %eax
movl %eax, 0x665e(%rip)      # 0x10358
movl 0x6528(%rip), %esi      # 0x10228
cmpl %esi, %eax
jbe 0x9e4a
movl $0x0, (%rsp)
leaq 0x35e8(%rip), %rdi      # 0xd2fe
xorl %eax, %eax
callq 0x2030
movq 0x6544(%rip), %rdi      # 0x10268
testq %rdi, %rdi
movq %rbp, %rbx
movq 0x10(%rsp), %rbp
je 0x9d53
movl 0x64f1(%rip), %edx      # 0x10228
movl $0x0, (%rsp)
leaq 0x35b9(%rip), %rsi      # 0xd2fe
xorl %eax, %eax
callq 0x22d0
jmp 0x9d53
movb $0x1, %al
movl %eax, (%rsp)
movl 0x6603(%rip), %eax      # 0x1035c
cmpl 0x64cd(%rip), %eax      # 0x1022c
jbe 0x9d6c
incl 0x6591(%rip)            # 0x102f8
jmp 0x9e17
movq %r14, %rdi
xorl %esi, %esi
xorl %edx, %edx
movl $0x1, %ecx
callq 0x8dfc
testb %al, %al
je 0x9e17
movq %rbx, %rbp
leaq 0x389f(%rip), %rbx      # 0xd62e
movq %rbx, %rdi
movq 0x8(%rsp), %rsi
movl %ebp, %edx
movl %r13d, %ecx
movl %r12d, %r8d
xorl %eax, %eax
callq 0x2030
movq 0x64bb(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x9dc9
movq %rbx, %rsi
movq 0x8(%rsp), %rdx
movl %ebp, %ecx
movl %r13d, %r8d
movl %r12d, %r9d
xorl %eax, %eax
callq 0x22d0
movl 0x658d(%rip), %eax      # 0x1035c
incl %eax
movl %eax, 0x6585(%rip)      # 0x1035c
movl 0x644f(%rip), %esi      # 0x1022c
cmpl %esi, %eax
movq %rbp, %rbx
movq 0x10(%rsp), %rbp
jbe 0x9e17
leaq 0x3556(%rip), %rdi      # 0xd346
xorl %eax, %eax
callq 0x2030
movq 0x646a(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x9e17
movl 0x6423(%rip), %edx      # 0x1022c
leaq 0x3536(%rip), %rsi      # 0xd346
xorl %eax, %eax
callq 0x22d0
xorl %r12d, %r12d
cmpb $0x0, (%rsp)
je 0x9e2d
movq %r14, %rdi
movl $0x1, %esi
callq 0x89b5
cmpl $0xc, %r12d
je 0x9e38
testl %r12d, %r12d
jne 0x9e61
incl %r15d
movl 0x2c(%rsp), %edx
cmpl %r15d, %edx
jne 0x9bcf
jmp 0x9e5e
movl $0x0, (%rsp)
movq %rbp, %rbx
movq 0x10(%rsp), %rbp
jmp 0x9d53
xorl %r12d, %r12d
testl %r12d, %r12d
movl 0x28(%rsp), %ecx
jne 0x9e9b
incl %ebp
decl %ecx
cmpl 0x639c(%rip), %ebp      # 0x10210
jb 0x9baa
xorl %r14d, %r14d
cmpl $0x6b, 0x4(%rsp)
je 0x9e9e
movq 0x18(%rsp), %rcx
leal 0x1(%rcx), %eax
testl %ecx, %ecx
movq %rax, 0x18(%rsp)
je 0x9b94
jmp 0x9e9e
movb $0x1, %r14b
movl %r14d, %eax
addq $0x38, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
leaq 0x36f0(%rip), %rdi      # 0xd5a7
xorl %eax, %eax
callq 0x2030
movq 0x63a3(%rip), %rdi      # 0x10268
movb $0x1, %r14b
testq %rdi, %rdi
je 0x9e9e
movl 0x63c5(%rip), %edx      # 0x10298
leaq 0x36cd(%rip), %rsi      # 0xd5a7
xorl %eax, %eax
callq 0x22d0
jmp 0x9e9e