// File: /workspace/github_c_makefile_star2_O2/mabdi[P]bunney/bunny-main.c
// Function: chunk_walk
static _u8 chunk_walk(struct bunny_traceitem* t, _u32 oper, _u32 csize) {
  _s32 shift, pos, rev;

  if (reg_execs > cycle_branch_limit && (zero_range || reg_params > cycle_value_limit)) return 1;

  if (oper == FLOW_INSERT && t->fuzzable >= size_limit) {
    outf("      >>> Fuzzable input limit of %u exceeded (use -F to adjust).\n",size_limit);
    return 1;
  }

  /* FLOW_SWAP is symmetrical; the rest should be tested for +/- shifts */

  for (rev=0;rev < 1 + (oper != FLOW_SWAP);rev++) 
    for (shift = 1; shift < chunk_off_max; shift++) {

      _s32 max = t->fuzzable - csize - shift;

      for (pos=0;pos <= max;pos++) {
        struct bunny_traceitem* n;
        _u8 rne = 0;
        _u32 src, dst;
  
        flow_command(FLOW_RESET,0,0,0);

        if (!rev) { src = pos; dst = pos + shift; }
          else { src = pos + shift; dst = pos; }

        flow_command(oper,dst,csize,src);

        n = run_program();

        if (check_crash(n)) {
          outf("%s %u bytes from offset #%u to #%u.\n\n",
            (oper == FLOW_INSERT) ? "cloning" : 
            (oper == FLOW_SWAP) ? "swapping" : "pasting over",
            csize, src, dst);
          if (keep_fault) continue;
          return 1;
        }

        if (reg_execs > cycle_branch_limit) epath_ign++;
          else if ((rne=register_new_exec(n,1))) {
            outf("      Triggered by %s %u bytes from offset #%u to #%u.\n",
              (oper == FLOW_INSERT) ? "cloning" : 
              (oper == FLOW_SWAP) ? "swapping" : "pasting over",
              csize, src, dst);
  
            reg_execs++;
            if (reg_execs > cycle_branch_limit) 
              outf("      >>> Per-cycle call path limit of %u exceeded (use -N to adjust).\n",cycle_branch_limit);
          }

        if (reg_params > cycle_value_limit) ppath_ign++;
          else if (register_new_param(n,0,0,1,rne)) {
            outf("      Triggered by %s %u bytes from offset #%u to #%u.\n",
              (oper == FLOW_INSERT) ? "cloning" : 
              (oper == FLOW_SWAP) ? "swapping" : "pasting over",
              csize, src, dst);
            reg_params++;
            if (reg_params > cycle_value_limit) 
              outf("      >>> Per-cycle function parameter limit of %u exceeded (use -P to adjust).\n",cycle_value_limit);
          }
      
        /* Context not saved */
        if (!rne) discard_context(n,1);
      
      }
  
    }


  return 0;
  
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0x48, %rsp
movl %esi, %r12d
movl 0x7132(%rip), %eax      # 0x10358
cmpl 0x6ffc(%rip), %eax      # 0x10228
jbe 0x9250
movb $0x1, %r14b
cmpb $0x0, 0x705d(%rip)      # 0x10295
jne 0x9582
movl 0x7118(%rip), %eax      # 0x1035c
cmpl 0x6fe2(%rip), %eax      # 0x1022c
ja 0x9582
cmpl $0x6a, %r12d
jne 0x9265
movl 0x703c(%rip), %esi      # 0x10298
cmpl %esi, 0x4(%rdi)
jae 0x9594
xorl %esi, %esi
cmpl $0x6b, %r12d
setne %sil
leaq 0x43a2(%rip), %rax      # 0xd618
leaq 0x43a4(%rip), %rcx      # 0xd621
cmoveq %rax, %rcx
incl %esi
cmpl $0x6a, %r12d
leaq 0x4382(%rip), %rax      # 0xd610
cmovneq %rcx, %rax
xorl %r15d, %r15d
movl %r12d, 0x30(%rsp)
movq %rdi, 0x38(%rsp)
movl %esi, 0x2c(%rsp)
movq %rax, 0x10(%rsp)
movq %rdx, 0x20(%rsp)
cmpl %esi, %r15d
je 0x95c7
pushq $0x1
popq %rcx
movl %ecx, %r14d
movl %r15d, 0xc(%rsp)
cmpl 0x6f48(%rip), %r14d     # 0x10210
jae 0x9577
movl 0x4(%rdi), %ecx
subl %r14d, %ecx
subl %edx, %ecx
movl %ecx, 0x34(%rsp)
xorl %ebp, %ebp
movq %r14, 0x40(%rsp)
cmpl 0x34(%rsp), %ebp
jg 0x9561
pushq $0x2
popq %rdi
xorl %esi, %esi
xorl %edx, %edx
xorl %ecx, %ecx
callq 0x713e
leal (%r14,%rbp), %r13d
testl %r15d, %r15d
movl %r13d, %r14d
cmovel %ebp, %r14d
movq %rbp, 0x18(%rsp)
cmovnel %ebp, %r13d
movl %r12d, %ebx
movl %r12d, %edi
movl %r13d, %esi
movq 0x20(%rsp), %rbp
movl %ebp, %edx
movl %r14d, %ecx
callq 0x713e
callq 0x7471
movq %rax, %r12
movq %rax, %rdi
callq 0x9e9c
testb %al, %al
je 0x939a
leaq 0x42a7(%rip), %r15      # 0xd5ea
movq %r15, %rdi
movq 0x10(%rsp), %r12
movq %r12, %rsi
movl %ebp, %edx
movl %r14d, %ecx
movl %r13d, %r8d
xorl %eax, %eax
callq 0x2030
movq 0x6f04(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x937e
movq %r15, %rsi
movq %r12, %rdx
movl %ebp, %ecx
movl %r14d, %r8d
movl %r13d, %r9d
xorl %eax, %eax
callq 0x22d0
cmpb $0x0, 0x6f0d(%rip)      # 0x10292
movl 0xc(%rsp), %r15d
movq 0x18(%rsp), %rbp
jne 0x9552
jmp 0x957f
movl 0x6fb8(%rip), %eax      # 0x10358
cmpl 0x6e82(%rip), %eax      # 0x10228
jbe 0x93ba
incl 0x6f42(%rip)            # 0x102f0
movb $0x1, %bl
movq 0x18(%rsp), %rbp
jmp 0x9474
movq %r12, %rdi
pushq $0x1
popq %rsi
callq 0x82d0
testb %al, %al
movq 0x18(%rsp), %rbp
je 0x946b
movq 0x20(%rsp), %r15
leaq 0x4250(%rip), %rbx      # 0xd62e
movq %rbx, %rdi
movq 0x10(%rsp), %rsi
movl %r15d, %edx
movl %r14d, %ecx
movl %r13d, %r8d
xorl %eax, %eax
callq 0x2030
movq 0x6e6b(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x941a
movq %rbx, %rsi
movq 0x10(%rsp), %rdx
movl %r15d, %ecx
movl %r14d, %r8d
movl %r13d, %r9d
xorl %eax, %eax
callq 0x22d0
movl 0x6f38(%rip), %eax      # 0x10358
incl %eax
movl %eax, 0x6f30(%rip)      # 0x10358
movl 0x6dfa(%rip), %esi      # 0x10228
xorl %ebx, %ebx
cmpl %esi, %eax
jbe 0x946f
leaq 0x3ec3(%rip), %rdi      # 0xd2fe
xorl %eax, %eax
callq 0x2030
movq 0x6e1f(%rip), %rdi      # 0x10268
testq %rdi, %rdi
movl 0xc(%rsp), %r15d
je 0x9474
movl 0x6dcf(%rip), %edx      # 0x10228
xorl %ebx, %ebx
leaq 0x3e9c(%rip), %rsi      # 0xd2fe
xorl %eax, %eax
callq 0x22d0
jmp 0x9474
movb $0x1, %bl
jmp 0x9474
movl 0xc(%rsp), %r15d
movl 0x6ee2(%rip), %eax      # 0x1035c
cmpl 0x6dac(%rip), %eax      # 0x1022c
jbe 0x948d
incl 0x6e70(%rip)            # 0x102f8
jmp 0x953f
movq %r12, %rdi
xorl %esi, %esi
xorl %edx, %edx
pushq $0x1
popq %rcx
callq 0x859d
testb %al, %al
je 0x953f
movl %ebx, 0x18(%rsp)
movq 0x20(%rsp), %r15
leaq 0x417a(%rip), %rbx      # 0xd62e
movq %rbx, %rdi
movq 0x10(%rsp), %rsi
movl %r15d, %edx
movl %r14d, %ecx
movl %r13d, %r8d
xorl %eax, %eax
callq 0x2030
movq 0x6d95(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x94f0
movq %rbx, %rsi
movq 0x10(%rsp), %rdx
movl %r15d, %ecx
movl %r14d, %r8d
movl %r13d, %r9d
xorl %eax, %eax
callq 0x22d0
movl 0x6e66(%rip), %eax      # 0x1035c
incl %eax
movl %eax, 0x6e5e(%rip)      # 0x1035c
movl 0x6d28(%rip), %esi      # 0x1022c
cmpl %esi, %eax
movl 0xc(%rsp), %r15d
movl 0x18(%rsp), %ebx
jbe 0x953f
leaq 0x3e2e(%rip), %rdi      # 0xd346
xorl %eax, %eax
callq 0x2030
movq 0x6d42(%rip), %rdi      # 0x10268
testq %rdi, %rdi
je 0x953f
movl 0x6cfb(%rip), %edx      # 0x1022c
leaq 0x3e0e(%rip), %rsi      # 0xd346
xorl %eax, %eax
callq 0x22d0
testb %bl, %bl
movl 0x30(%rsp), %ebx
je 0x9552
movq %r12, %rdi
pushq $0x1
popq %rsi
callq 0x8190
incl %ebp
movq 0x40(%rsp), %r14
movl %ebx, %r12d
jmp 0x92e1
incl %r14d
movq 0x38(%rsp), %rdi
movl 0x2c(%rsp), %esi
movq 0x20(%rsp), %rdx
jmp 0x92c1
incl %r15d
jmp 0x92ad
movb $0x1, %r14b
movl %r14d, %eax
addq $0x48, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
leaq 0x400c(%rip), %rdi      # 0xd5a7
xorl %eax, %eax
callq 0x2030
movq 0x6cbf(%rip), %rdi      # 0x10268
movb $0x1, %r14b
testq %rdi, %rdi
je 0x9582
movl 0x6ce1(%rip), %edx      # 0x10298
leaq 0x3fe9(%rip), %rsi      # 0xd5a7
xorl %eax, %eax
callq 0x22d0
jmp 0x9582
xorl %r14d, %r14d
jmp 0x9582