#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
unsigned char crc(unsigned char *, size_t);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, ...);
int /*<<< orphan*/ stderr;
int kwboot_check_image(unsigned char *img, size_t size) {
  size_t i;
  size_t header_size, image_size, image_offset;
  unsigned char csum = 0;
  unsigned char imgversion;
  if (size < 0x20) {
    fprintf(stderr, "Image too small to even contain a Main Header\n");
    return 1;
  }
  switch (img[0x0]) {
  case 0x69:
    break;
  case 0x5a:
  case 0x78:
  case 0x8b:
  case 0x9c:
    img[0x1f] -= img[0x0];
    img[0x1f] += 0x69;
    img[0x0] = 0x69;
    break;
  default:
    fprintf(stderr, "Unknown boot source: 0x%hhx\n", img[0x0]);
    return 1;
  }
  imgversion = img[0x8];
  if (imgversion > 1) {
    fprintf(stderr, "Unknown version: 0x%hhx\n", img[0x8]);
    return 1;
  }
  image_size = img[0x4] | (img[0x5] << 8) | (img[0x6] << 16) | (img[0x7] << 24);
  image_offset =
      img[0xc] | (img[0xd] << 8) | (img[0xe] << 16) | (img[0xf] << 24);
  if (imgversion == 0) {
    header_size = img[0x1e] * 0x200 + img[0x1d] * 0x800;
  } else {
    header_size = (img[0x9] << 16) | img[0xa] | (img[0xb] << 8);
  }
  if (header_size > image_offset) {
    fprintf(stderr, "Header (%zu) expands over image start (%zu)\n",
            header_size, image_offset);
    return 1;
  }
  if (image_offset + image_size != size) {
    fprintf(stderr, "Image doesn't end at file end (%zu + %zu != %zu)\n",
            image_offset, image_size, size);
    return 1;
  }
  if (imgversion == 0) {
    csum = crc(img, 0x1f);
    if (csum != img[0x1f]) {
      fprintf(stderr,
              "Main Header checksum mismatch: specified: 0x%02hhx, calculated: "
              "0x%02hhx\n",
              img[0x1f], csum);
      return 1;
    }
    for (i = 0; i < img[0x1e]; ++i) {
      csum = crc(img + 0x20 + i * 0x200, 0x1df);
      if (csum != img[i * 0x200 + 0x1ff]) {
        fprintf(stderr,
                "Extension Header #%zu checksum mismatch: specified: 0x%02hhx, "
                "calculated: 0x%02hhx\n",
                i, img[i * 0x200 + 0x1ff], csum);
        return 1;
      }
    }
  } else {
    csum = crc(img, header_size);
    csum -= img[0x1f];
    if (csum != img[0x1f]) {
      fprintf(stderr,
              "Checksum mismatch: specified: 0x%02hhx, calculated: 0x%02hhx\n",
              img[0x1f], csum);
      return 1;
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<kwboot_check_image>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
movb   $0x0,-0x39(%rbp)
cmpq   $0x20,-0x18(%rbp)
jae    1162 <kwboot_check_image+0x42>
mov    0x2e9a(%rip),%rax
mov    (%rax),%edi
lea    0xeb1(%rip),%rsi
mov    $0x0,%al
call   1030 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    1526 <kwboot_check_image+0x406>
mov    -0x10(%rbp),%rax
movzbl (%rax),%eax
mov    %eax,-0x40(%rbp)
sub    $0x5a,%eax
je     11c7 <kwboot_check_image+0xa7>
jmp    117a <kwboot_check_image+0x5a>
mov    -0x40(%rbp),%eax
sub    $0x69,%eax
je     11c2 <kwboot_check_image+0xa2>
jmp    118b <kwboot_check_image+0x6b>
mov    -0x40(%rbp),%eax
sub    $0x78,%eax
je     11c7 <kwboot_check_image+0xa7>
jmp    119c <kwboot_check_image+0x7c>
mov    -0x40(%rbp),%eax
sub    $0x8b,%eax
je     11c7 <kwboot_check_image+0xa7>
jmp    11af <kwboot_check_image+0x8f>
mov    -0x40(%rbp),%eax
sub    $0x9c,%eax
je     11c7 <kwboot_check_image+0xa7>
jmp    11f5 <kwboot_check_image+0xd5>
jmp    121f <kwboot_check_image+0xff>
mov    -0x10(%rbp),%rax
movzbl (%rax),%edx
mov    -0x10(%rbp),%rax
movzbl 0x1f(%rax),%ecx
sub    %edx,%ecx
mov    %cl,0x1f(%rax)
mov    -0x10(%rbp),%rax
movzbl 0x1f(%rax),%ecx
add    $0x69,%ecx
mov    %cl,0x1f(%rax)
mov    -0x10(%rbp),%rax
movb   $0x69,(%rax)
jmp    121f <kwboot_check_image+0xff>
mov    0x2de4(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
movzbl (%rax),%edx
lea    0xe23(%rip),%rsi
mov    $0x0,%al
call   1030 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    1526 <kwboot_check_image+0x406>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%al
mov    %al,-0x3a(%rbp)
movzbl -0x3a(%rbp),%eax
cmp    $0x1,%eax
jle    1261 <kwboot_check_image+0x141>
mov    0x2da3(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
movzbl 0x8(%rax),%edx
lea    0xdfe(%rip),%rsi
mov    $0x0,%al
call   1030 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    1526 <kwboot_check_image+0x406>
mov    -0x10(%rbp),%rax
movzbl 0x4(%rax),%eax
mov    -0x10(%rbp),%rcx
movzbl 0x5(%rcx),%ecx
shl    $0x8,%ecx
or     %ecx,%eax
mov    -0x10(%rbp),%rcx
movzbl 0x6(%rcx),%ecx
shl    $0x10,%ecx
or     %ecx,%eax
mov    -0x10(%rbp),%rcx
movzbl 0x7(%rcx),%ecx
shl    $0x18,%ecx
or     %ecx,%eax
cltq
mov    %rax,-0x30(%rbp)
mov    -0x10(%rbp),%rax
movzbl 0xc(%rax),%eax
mov    -0x10(%rbp),%rcx
movzbl 0xd(%rcx),%ecx
shl    $0x8,%ecx
or     %ecx,%eax
mov    -0x10(%rbp),%rcx
movzbl 0xe(%rcx),%ecx
shl    $0x10,%ecx
or     %ecx,%eax
mov    -0x10(%rbp),%rcx
movzbl 0xf(%rcx),%ecx
shl    $0x18,%ecx
or     %ecx,%eax
cltq
mov    %rax,-0x38(%rbp)
movzbl -0x3a(%rbp),%eax
cmp    $0x0,%eax
jne    12fb <kwboot_check_image+0x1db>
mov    -0x10(%rbp),%rax
movzbl 0x1e(%rax),%eax
shl    $0x9,%eax
mov    -0x10(%rbp),%rcx
movzbl 0x1d(%rcx),%ecx
shl    $0xb,%ecx
add    %ecx,%eax
cltq
mov    %rax,-0x28(%rbp)
jmp    1323 <kwboot_check_image+0x203>
mov    -0x10(%rbp),%rax
movzbl 0x9(%rax),%eax
shl    $0x10,%eax
mov    -0x10(%rbp),%rcx
movzbl 0xa(%rcx),%ecx
or     %ecx,%eax
mov    -0x10(%rbp),%rcx
movzbl 0xb(%rcx),%ecx
shl    $0x8,%ecx
or     %ecx,%eax
cltq
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
cmp    -0x38(%rbp),%rax
jbe    135c <kwboot_check_image+0x23c>
mov    0x2ca8(%rip),%rax
mov    (%rax),%edi
mov    -0x28(%rbp),%rdx
mov    -0x38(%rbp),%rcx
lea    0xd1c(%rip),%rsi
mov    $0x0,%al
call   1030 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    1526 <kwboot_check_image+0x406>
mov    -0x38(%rbp),%rax
add    -0x30(%rbp),%rax
cmp    -0x18(%rbp),%rax
je     139d <kwboot_check_image+0x27d>
mov    0x2c6b(%rip),%rax
mov    (%rax),%edi
mov    -0x38(%rbp),%rdx
mov    -0x30(%rbp),%rcx
mov    -0x18(%rbp),%r8
lea    0xd08(%rip),%rsi
mov    $0x0,%al
call   1030 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    1526 <kwboot_check_image+0x406>
movzbl -0x3a(%rbp),%eax
cmp    $0x0,%eax
jne    14b6 <kwboot_check_image+0x396>
mov    -0x10(%rbp),%rdi
mov    $0x1f,%esi
call   1040 <crc@plt>
mov    %al,-0x39(%rbp)
movzbl -0x39(%rbp),%eax
mov    -0x10(%rbp),%rcx
movzbl 0x1f(%rcx),%ecx
cmp    %ecx,%eax
je     13fe <kwboot_check_image+0x2de>
mov    0x2c0a(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
movzbl 0x1f(%rax),%edx
movzbl -0x39(%rbp),%ecx
lea    0xcd9(%rip),%rsi
mov    $0x0,%al
call   1030 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    1526 <kwboot_check_image+0x406>
movq   $0x0,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    -0x10(%rbp),%rcx
movzbl 0x1e(%rcx),%ecx
cmp    %rcx,%rax
jae    14b1 <kwboot_check_image+0x391>
mov    -0x10(%rbp),%rdi
add    $0x20,%rdi
mov    -0x20(%rbp),%rax
shl    $0x9,%rax
add    %rax,%rdi
mov    $0x1df,%esi
call   1040 <crc@plt>
mov    %al,-0x39(%rbp)
movzbl -0x39(%rbp),%eax
mov    -0x10(%rbp),%rcx
mov    -0x20(%rbp),%rdx
shl    $0x9,%rdx
movzbl 0x1ff(%rcx,%rdx,1),%ecx
cmp    %ecx,%eax
je     149b <kwboot_check_image+0x37b>
mov    0x2b7e(%rip),%rax
mov    (%rax),%edi
mov    -0x20(%rbp),%rdx
mov    -0x10(%rbp),%rax
mov    -0x20(%rbp),%rcx
shl    $0x9,%rcx
movzbl 0x1ff(%rax,%rcx,1),%ecx
movzbl -0x39(%rbp),%r8d
lea    0xc86(%rip),%rsi
mov    $0x0,%al
call   1030 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    1526 <kwboot_check_image+0x406>
jmp    14a0 <kwboot_check_image+0x380>
mov    -0x20(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x20(%rbp)
jmp    1406 <kwboot_check_image+0x2e6>
jmp    151f <kwboot_check_image+0x3ff>
mov    -0x10(%rbp),%rdi
mov    -0x28(%rbp),%rsi
call   1040 <crc@plt>
mov    %al,-0x39(%rbp)
mov    -0x10(%rbp),%rax
movzbl 0x1f(%rax),%ecx
movzbl -0x39(%rbp),%eax
sub    %ecx,%eax
mov    %al,-0x39(%rbp)
movzbl -0x39(%rbp),%eax
mov    -0x10(%rbp),%rcx
movzbl 0x1f(%rcx),%ecx
cmp    %ecx,%eax
je     151a <kwboot_check_image+0x3fa>
mov    0x2aee(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
movzbl 0x1f(%rax),%edx
movzbl -0x39(%rbp),%ecx
lea    0xc5b(%rip),%rsi
mov    $0x0,%al
call   1030 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    1526 <kwboot_check_image+0x406>
jmp    151f <kwboot_check_image+0x3ff>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<kwboot_check_image>:
push   %r15
push   %r14
push   %rbx
cmp    $0x1f,%rsi
ja     1147 <kwboot_check_image+0x27>
mov    0x2eae(%rip),%rax
mov    (%rax),%edi
lea    0xec5(%rip),%rsi
xor    %eax,%eax
call   1030 <fprintf@plt>
jmp    11ef <kwboot_check_image+0xcf>
mov    %rsi,%r8
mov    %rdi,%rbx
mov    (%rdi),%al
cmp    $0x59,%al
jle    1161 <kwboot_check_image+0x41>
cmp    $0x78,%al
je     1169 <kwboot_check_image+0x49>
cmp    $0x69,%al
je     1177 <kwboot_check_image+0x57>
cmp    $0x5a,%al
je     1169 <kwboot_check_image+0x49>
jmp    11d5 <kwboot_check_image+0xb5>
cmp    $0x8b,%al
je     1169 <kwboot_check_image+0x49>
cmp    $0x9c,%al
jne    11d5 <kwboot_check_image+0xb5>
mov    0x1f(%rbx),%cl
sub    %al,%cl
add    $0x69,%cl
mov    %cl,0x1f(%rbx)
movb   $0x69,(%rbx)
movzbl 0x8(%rbx),%edx
cmp    $0x2,%edx
jb     1192 <kwboot_check_image+0x72>
mov    0x2e59(%rip),%rax
mov    (%rax),%edi
lea    0xebc(%rip),%rsi
jmp    11e8 <kwboot_check_image+0xc8>
movslq 0xc(%rbx),%rcx
test   %edx,%edx
je     11fa <kwboot_check_image+0xda>
movzbl 0x9(%rbx),%eax
shl    $0x10,%rax
movzbl 0xa(%rbx),%esi
or     %rax,%rsi
movzbl 0xb(%rbx),%eax
shl    $0x8,%rax
or     %rsi,%rax
cmp    %rcx,%rax
jbe    1212 <kwboot_check_image+0xf2>
mov    0x2e20(%rip),%rdx
mov    (%rdx),%edi
lea    0xe9c(%rip),%rsi
mov    %rax,%rdx
xor    %eax,%eax
call   1030 <fprintf@plt>
jmp    11ef <kwboot_check_image+0xcf>
movzbl %al,%edx
mov    0x2e01(%rip),%rax
mov    (%rax),%edi
lea    0xe47(%rip),%rsi
xor    %eax,%eax
call   1030 <fprintf@plt>
mov    $0x1,%eax
pop    %rbx
pop    %r14
pop    %r15
ret
movzbl 0x1e(%rbx),%esi
shl    $0x9,%rsi
movzbl 0x1d(%rbx),%eax
shl    $0xb,%rax
add    %rsi,%rax
cmp    %rcx,%rax
ja     11b9 <kwboot_check_image+0x99>
movslq 0x4(%rbx),%r9
lea    (%rcx,%r9,1),%rsi
cmp    %r8,%rsi
jne    1254 <kwboot_check_image+0x134>
test   %dl,%dl
je     1276 <kwboot_check_image+0x156>
mov    %rbx,%rdi
mov    %rax,%rsi
call   1040 <crc@plt>
mov    %eax,%ecx
movzbl 0x1f(%rbx),%edx
sub    %dl,%cl
xor    %eax,%eax
cmp    %dl,%cl
je     11f4 <kwboot_check_image+0xd4>
movzbl %cl,%ecx
mov    0x2d9a(%rip),%rax
mov    (%rax),%edi
lea    0xf13(%rip),%rsi
jmp    12e2 <kwboot_check_image+0x1c2>
mov    0x2d85(%rip),%rax
mov    (%rax),%edi
lea    0xe2e(%rip),%rsi
mov    %rcx,%rdx
mov    %r9,%rcx
xor    %eax,%eax
call   1030 <fprintf@plt>
jmp    11ef <kwboot_check_image+0xcf>
mov    $0x1f,%esi
mov    %rbx,%rdi
call   1040 <crc@plt>
movzbl 0x1f(%rbx),%edx
cmp    %dl,%al
jne    12cf <kwboot_check_image+0x1af>
cmpb   $0x0,0x1e(%rbx)
je     12ee <kwboot_check_image+0x1ce>
lea    0x1ff(%rbx),%r15
xor    %r14d,%r14d
lea    -0x1df(%r15),%rdi
mov    $0x1df,%esi
call   1040 <crc@plt>
movzbl (%r15),%ecx
cmp    %cl,%al
jne    12f5 <kwboot_check_image+0x1d5>
add    $0x1,%r14
movzbl 0x1e(%rbx),%ecx
add    $0x200,%r15
xor    %eax,%eax
cmp    %rcx,%r14
jb     129b <kwboot_check_image+0x17b>
jmp    11f4 <kwboot_check_image+0xd4>
movzbl %al,%ecx
mov    0x2d07(%rip),%rax
mov    (%rax),%edi
lea    0xde2(%rip),%rsi
xor    %eax,%eax
call   1030 <fprintf@plt>
jmp    11ef <kwboot_check_image+0xcf>
xor    %eax,%eax
jmp    11f4 <kwboot_check_image+0xd4>
movzbl %al,%r8d
mov    0x2ce0(%rip),%rax
mov    (%rax),%edi
lea    0xe05(%rip),%rsi
mov    %r14,%rdx
xor    %eax,%eax
call   1030 <fprintf@plt>
jmp    11ef <kwboot_check_image+0xcf>

LLVM IR (-O0):
@stderr = global i32 0
@.str = [47 x i8] c"Image too small to even contain a Main Header\0A\00"
@.str.1 = [29 x i8] c"Unknown boot source: 0x%hhx\0A\00"
@.str.2 = [25 x i8] c"Unknown version: 0x%hhx\0A\00"
@.str.3 = [45 x i8] c"Header (%zu) expands over image start (%zu)\0A\00"
@.str.4 = [50 x i8] c"Image doesn't end at file end (%zu + %zu != %zu)\0A\00"
@.str.5 = [74 x i8] c"Main Header checksum mismatch: specified: 0x%02hhx, calculated: 0x%02hhx\0A\00"
@.str.6 = [84 x i8] c"Extension Header #%zu checksum mismatch: specified: 0x%02hhx, calculated: 0x%02hhx\0A\00"
@.str.7 = [62 x i8] c"Checksum mismatch: specified: 0x%02hhx, calculated: 0x%02hhx\0A\00"
define i32 @kwboot_check_image(i8* %0, i64 %1) {
%3 = alloca i32
%4 = alloca i8*
%5 = alloca i64
%6 = alloca i64
%7 = alloca i64
%8 = alloca i64
%9 = alloca i64
%10 = alloca i8
%11 = alloca i8
store i8* %0, i8** %4
store i64 %1, i64* %5
store i8 0, i8* %10
%12 = load i64, i64* %5
%13 = icmp ult i64 %12, 32
br i1 %13, label %14, label %17
14: ; preds = %2
%15 = load i32, i32* @stderr
%16 = call i32 (i32, i8*, ...) @fprintf(i32 %15, i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str, i64 0, i64 0))
store i32 1, i32* %3
br label %261
17: ; preds = %2
%18 = load i8*, i8** %4
%19 = getelementptr inbounds i8, i8* %18, i64 0
%20 = load i8, i8* %19
%21 = zext i8 %20 to i32
switch i32 %21, label %42 [
i32 105, label %22
i32 90, label %23
i32 120, label %23
i32 139, label %23
i32 156, label %23
]
22: ; preds = %17
br label %49
23: ; preds = %17, %17, %17, %17
%24 = load i8*, i8** %4
%25 = getelementptr inbounds i8, i8* %24, i64 0
%26 = load i8, i8* %25
%27 = zext i8 %26 to i32
%28 = load i8*, i8** %4
%29 = getelementptr inbounds i8, i8* %28, i64 31
%30 = load i8, i8* %29
%31 = zext i8 %30 to i32
%32 = sub nsw i32 %31, %27
%33 = trunc i32 %32 to i8
store i8 %33, i8* %29
%34 = load i8*, i8** %4
%35 = getelementptr inbounds i8, i8* %34, i64 31
%36 = load i8, i8* %35
%37 = zext i8 %36 to i32
%38 = add nsw i32 %37, 105
%39 = trunc i32 %38 to i8
store i8 %39, i8* %35
%40 = load i8*, i8** %4
%41 = getelementptr inbounds i8, i8* %40, i64 0
store i8 105, i8* %41
br label %49
42: ; preds = %17
%43 = load i32, i32* @stderr
%44 = load i8*, i8** %4
%45 = getelementptr inbounds i8, i8* %44, i64 0
%46 = load i8, i8* %45
%47 = zext i8 %46 to i32
%48 = call i32 (i32, i8*, ...) @fprintf(i32 %43, i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0), i32 %47)
store i32 1, i32* %3
br label %261
49: ; preds = %23, %22
%50 = load i8*, i8** %4
%51 = getelementptr inbounds i8, i8* %50, i64 8
%52 = load i8, i8* %51
store i8 %52, i8* %11
%53 = load i8, i8* %11
%54 = zext i8 %53 to i32
%55 = icmp sgt i32 %54, 1
br i1 %55, label %56, label %63
56: ; preds = %49
%57 = load i32, i32* @stderr
%58 = load i8*, i8** %4
%59 = getelementptr inbounds i8, i8* %58, i64 8
%60 = load i8, i8* %59
%61 = zext i8 %60 to i32
%62 = call i32 (i32, i8*, ...) @fprintf(i32 %57, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.2, i64 0, i64 0), i32 %61)
store i32 1, i32* %3
br label %261
63: ; preds = %49
%64 = load i8*, i8** %4
%65 = getelementptr inbounds i8, i8* %64, i64 4
%66 = load i8, i8* %65
%67 = zext i8 %66 to i32
%68 = load i8*, i8** %4
%69 = getelementptr inbounds i8, i8* %68, i64 5
%70 = load i8, i8* %69
%71 = zext i8 %70 to i32
%72 = shl i32 %71, 8
%73 = or i32 %67, %72
%74 = load i8*, i8** %4
%75 = getelementptr inbounds i8, i8* %74, i64 6
%76 = load i8, i8* %75
%77 = zext i8 %76 to i32
%78 = shl i32 %77, 16
%79 = or i32 %73, %78
%80 = load i8*, i8** %4
%81 = getelementptr inbounds i8, i8* %80, i64 7
%82 = load i8, i8* %81
%83 = zext i8 %82 to i32
%84 = shl i32 %83, 24
%85 = or i32 %79, %84
%86 = sext i32 %85 to i64
store i64 %86, i64* %8
%87 = load i8*, i8** %4
%88 = getelementptr inbounds i8, i8* %87, i64 12
%89 = load i8, i8* %88
%90 = zext i8 %89 to i32
%91 = load i8*, i8** %4
%92 = getelementptr inbounds i8, i8* %91, i64 13
%93 = load i8, i8* %92
%94 = zext i8 %93 to i32
%95 = shl i32 %94, 8
%96 = or i32 %90, %95
%97 = load i8*, i8** %4
%98 = getelementptr inbounds i8, i8* %97, i64 14
%99 = load i8, i8* %98
%100 = zext i8 %99 to i32
%101 = shl i32 %100, 16
%102 = or i32 %96, %101
%103 = load i8*, i8** %4
%104 = getelementptr inbounds i8, i8* %103, i64 15
%105 = load i8, i8* %104
%106 = zext i8 %105 to i32
%107 = shl i32 %106, 24
%108 = or i32 %102, %107
%109 = sext i32 %108 to i64
store i64 %109, i64* %9
%110 = load i8, i8* %11
%111 = zext i8 %110 to i32
%112 = icmp eq i32 %111, 0
br i1 %112, label %113, label %126
113: ; preds = %63
%114 = load i8*, i8** %4
%115 = getelementptr inbounds i8, i8* %114, i64 30
%116 = load i8, i8* %115
%117 = zext i8 %116 to i32
%118 = mul nsw i32 %117, 512
%119 = load i8*, i8** %4
%120 = getelementptr inbounds i8, i8* %119, i64 29
%121 = load i8, i8* %120
%122 = zext i8 %121 to i32
%123 = mul nsw i32 %122, 2048
%124 = add nsw i32 %118, %123
%125 = sext i32 %124 to i64
store i64 %125, i64* %7
br label %144
126: ; preds = %63
%127 = load i8*, i8** %4
%128 = getelementptr inbounds i8, i8* %127, i64 9
%129 = load i8, i8* %128
%130 = zext i8 %129 to i32
%131 = shl i32 %130, 16
%132 = load i8*, i8** %4
%133 = getelementptr inbounds i8, i8* %132, i64 10
%134 = load i8, i8* %133
%135 = zext i8 %134 to i32
%136 = or i32 %131, %135
%137 = load i8*, i8** %4
%138 = getelementptr inbounds i8, i8* %137, i64 11
%139 = load i8, i8* %138
%140 = zext i8 %139 to i32
%141 = shl i32 %140, 8
%142 = or i32 %136, %141
%143 = sext i32 %142 to i64
store i64 %143, i64* %7
br label %144
144: ; preds = %126, %113
%145 = load i64, i64* %7
%146 = load i64, i64* %9
%147 = icmp ugt i64 %145, %146
br i1 %147, label %148, label %153
148: ; preds = %144
%149 = load i32, i32* @stderr
%150 = load i64, i64* %7
%151 = load i64, i64* %9
%152 = call i32 (i32, i8*, ...) @fprintf(i32 %149, i8* getelementptr inbounds ([45 x i8], [45 x i8]* @.str.3, i64 0, i64 0), i64 %150, i64 %151)
store i32 1, i32* %3
br label %261
153: ; preds = %144
%154 = load i64, i64* %9
%155 = load i64, i64* %8
%156 = add i64 %154, %155
%157 = load i64, i64* %5
%158 = icmp ne i64 %156, %157
br i1 %158, label %159, label %165
159: ; preds = %153
%160 = load i32, i32* @stderr
%161 = load i64, i64* %9
%162 = load i64, i64* %8
%163 = load i64, i64* %5
%164 = call i32 (i32, i8*, ...) @fprintf(i32 %160, i8* getelementptr inbounds ([50 x i8], [50 x i8]* @.str.4, i64 0, i64 0), i64 %161, i64 %162, i64 %163)
store i32 1, i32* %3
br label %261
165: ; preds = %153
%166 = load i8, i8* %11
%167 = zext i8 %166 to i32
%168 = icmp eq i32 %167, 0
br i1 %168, label %169, label %231
169: ; preds = %165
%170 = load i8*, i8** %4
%171 = call zeroext i8 @crc(i8* %170, i64 31)
store i8 %171, i8* %10
%172 = load i8, i8* %10
%173 = zext i8 %172 to i32
%174 = load i8*, i8** %4
%175 = getelementptr inbounds i8, i8* %174, i64 31
%176 = load i8, i8* %175
%177 = zext i8 %176 to i32
%178 = icmp ne i32 %173, %177
br i1 %178, label %179, label %188
179: ; preds = %169
%180 = load i32, i32* @stderr
%181 = load i8*, i8** %4
%182 = getelementptr inbounds i8, i8* %181, i64 31
%183 = load i8, i8* %182
%184 = zext i8 %183 to i32
%185 = load i8, i8* %10
%186 = zext i8 %185 to i32
%187 = call i32 (i32, i8*, ...) @fprintf(i32 %180, i8* getelementptr inbounds ([74 x i8], [74 x i8]* @.str.5, i64 0, i64 0), i32 %184, i32 %186)
store i32 1, i32* %3
br label %261
188: ; preds = %169
store i64 0, i64* %6
br label %189
189: ; preds = %227, %188
%190 = load i64, i64* %6
%191 = load i8*, i8** %4
%192 = getelementptr inbounds i8, i8* %191, i64 30
%193 = load i8, i8* %192
%194 = zext i8 %193 to i64
%195 = icmp ult i64 %190, %194
br i1 %195, label %196, label %230
196: ; preds = %189
%197 = load i8*, i8** %4
%198 = getelementptr inbounds i8, i8* %197, i64 32
%199 = load i64, i64* %6
%200 = mul i64 %199, 512
%201 = getelementptr inbounds i8, i8* %198, i64 %200
%202 = call zeroext i8 @crc(i8* %201, i64 479)
store i8 %202, i8* %10
%203 = load i8, i8* %10
%204 = zext i8 %203 to i32
%205 = load i8*, i8** %4
%206 = load i64, i64* %6
%207 = mul i64 %206, 512
%208 = add i64 %207, 511
%209 = getelementptr inbounds i8, i8* %205, i64 %208
%210 = load i8, i8* %209
%211 = zext i8 %210 to i32
%212 = icmp ne i32 %204, %211
br i1 %212, label %213, label %226
213: ; preds = %196
%214 = load i32, i32* @stderr
%215 = load i64, i64* %6
%216 = load i8*, i8** %4
%217 = load i64, i64* %6
%218 = mul i64 %217, 512
%219 = add i64 %218, 511
%220 = getelementptr inbounds i8, i8* %216, i64 %219
%221 = load i8, i8* %220
%222 = zext i8 %221 to i32
%223 = load i8, i8* %10
%224 = zext i8 %223 to i32
%225 = call i32 (i32, i8*, ...) @fprintf(i32 %214, i8* getelementptr inbounds ([84 x i8], [84 x i8]* @.str.6, i64 0, i64 0), i64 %215, i32 %222, i32 %224)
store i32 1, i32* %3
br label %261
226: ; preds = %196
br label %227
227: ; preds = %226
%228 = load i64, i64* %6
%229 = add i64 %228, 1
store i64 %229, i64* %6
br label %189
230: ; preds = %189
br label %260
231: ; preds = %165
%232 = load i8*, i8** %4
%233 = load i64, i64* %7
%234 = call zeroext i8 @crc(i8* %232, i64 %233)
store i8 %234, i8* %10
%235 = load i8*, i8** %4
%236 = getelementptr inbounds i8, i8* %235, i64 31
%237 = load i8, i8* %236
%238 = zext i8 %237 to i32
%239 = load i8, i8* %10
%240 = zext i8 %239 to i32
%241 = sub nsw i32 %240, %238
%242 = trunc i32 %241 to i8
store i8 %242, i8* %10
%243 = load i8, i8* %10
%244 = zext i8 %243 to i32
%245 = load i8*, i8** %4
%246 = getelementptr inbounds i8, i8* %245, i64 31
%247 = load i8, i8* %246
%248 = zext i8 %247 to i32
%249 = icmp ne i32 %244, %248
br i1 %249, label %250, label %259
250: ; preds = %231
%251 = load i32, i32* @stderr
%252 = load i8*, i8** %4
%253 = getelementptr inbounds i8, i8* %252, i64 31
%254 = load i8, i8* %253
%255 = zext i8 %254 to i32
%256 = load i8, i8* %10
%257 = zext i8 %256 to i32
%258 = call i32 (i32, i8*, ...) @fprintf(i32 %251, i8* getelementptr inbounds ([62 x i8], [62 x i8]* @.str.7, i64 0, i64 0), i32 %255, i32 %257)
store i32 1, i32* %3
br label %261
259: ; preds = %231
br label %260
260: ; preds = %259, %230
store i32 0, i32* %3
br label %261
261: ; preds = %260, %250, %213, %179, %159, %148, %56, %42, %14
%262 = load i32, i32* %3
ret i32 %262
}

LLVM IR (-O2):
@stderr = global i32 0
@.str = [47 x i8] c"Image too small to even contain a Main Header\0A\00"
@.str.1 = [29 x i8] c"Unknown boot source: 0x%hhx\0A\00"
@.str.2 = [25 x i8] c"Unknown version: 0x%hhx\0A\00"
@.str.3 = [45 x i8] c"Header (%zu) expands over image start (%zu)\0A\00"
@.str.4 = [50 x i8] c"Image doesn't end at file end (%zu + %zu != %zu)\0A\00"
@.str.5 = [74 x i8] c"Main Header checksum mismatch: specified: 0x%02hhx, calculated: 0x%02hhx\0A\00"
@.str.6 = [84 x i8] c"Extension Header #%zu checksum mismatch: specified: 0x%02hhx, calculated: 0x%02hhx\0A\00"
@.str.7 = [62 x i8] c"Checksum mismatch: specified: 0x%02hhx, calculated: 0x%02hhx\0A\00"
define i32 @kwboot_check_image(i8* %0, i64 %1) {
%3 = icmp ult i64 %1, 32
br i1 %3, label %4, label %7
4: ; preds = %2
%5 = load i32, i32* @stderr
%6 = tail call i32 (i32, i8*, ...) @fprintf(i32 %5, i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str, i64 0, i64 0))
br label %149
7: ; preds = %2
%8 = load i8, i8* %0
switch i8 %8, label %14 [
i8 105, label %18
i8 90, label %9
i8 120, label %9
i8 -117, label %9
i8 -100, label %9
]
9: ; preds = %7, %7, %7, %7
%10 = getelementptr inbounds i8, i8* %0, i64 31
%11 = load i8, i8* %10
%12 = sub i8 105, %8
%13 = add i8 %12, %11
store i8 %13, i8* %10
store i8 105, i8* %0
br label %18
14: ; preds = %7
%15 = zext i8 %8 to i32
%16 = load i32, i32* @stderr
%17 = tail call i32 (i32, i8*, ...) @fprintf(i32 %16, i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0), i32 %15)
br label %149
18: ; preds = %9, %7
%19 = getelementptr inbounds i8, i8* %0, i64 8
%20 = load i8, i8* %19
%21 = icmp ugt i8 %20, 1
br i1 %21, label %22, label %26
22: ; preds = %18
%23 = zext i8 %20 to i32
%24 = load i32, i32* @stderr
%25 = tail call i32 (i32, i8*, ...) @fprintf(i32 %24, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.2, i64 0, i64 0), i32 %23)
br label %149
26: ; preds = %18
%27 = getelementptr inbounds i8, i8* %0, i64 4
%28 = load i8, i8* %27
%29 = zext i8 %28 to i32
%30 = getelementptr inbounds i8, i8* %0, i64 5
%31 = load i8, i8* %30
%32 = zext i8 %31 to i32
%33 = shl nuw nsw i32 %32, 8
%34 = or i32 %33, %29
%35 = getelementptr inbounds i8, i8* %0, i64 6
%36 = load i8, i8* %35
%37 = zext i8 %36 to i32
%38 = shl nuw nsw i32 %37, 16
%39 = or i32 %34, %38
%40 = getelementptr inbounds i8, i8* %0, i64 7
%41 = load i8, i8* %40
%42 = zext i8 %41 to i32
%43 = shl nuw i32 %42, 24
%44 = or i32 %39, %43
%45 = sext i32 %44 to i64
%46 = getelementptr inbounds i8, i8* %0, i64 12
%47 = load i8, i8* %46
%48 = zext i8 %47 to i32
%49 = getelementptr inbounds i8, i8* %0, i64 13
%50 = load i8, i8* %49
%51 = zext i8 %50 to i32
%52 = shl nuw nsw i32 %51, 8
%53 = or i32 %52, %48
%54 = getelementptr inbounds i8, i8* %0, i64 14
%55 = load i8, i8* %54
%56 = zext i8 %55 to i32
%57 = shl nuw nsw i32 %56, 16
%58 = or i32 %53, %57
%59 = getelementptr inbounds i8, i8* %0, i64 15
%60 = load i8, i8* %59
%61 = zext i8 %60 to i32
%62 = shl nuw i32 %61, 24
%63 = or i32 %58, %62
%64 = sext i32 %63 to i64
%65 = icmp eq i8 %20, 0
br i1 %65, label %66, label %76
66: ; preds = %26
%67 = getelementptr inbounds i8, i8* %0, i64 30
%68 = load i8, i8* %67
%69 = zext i8 %68 to i64
%70 = shl nuw nsw i64 %69, 9
%71 = getelementptr inbounds i8, i8* %0, i64 29
%72 = load i8, i8* %71
%73 = zext i8 %72 to i64
%74 = shl nuw nsw i64 %73, 11
%75 = add nuw nsw i64 %74, %70
br label %90
76: ; preds = %26
%77 = getelementptr inbounds i8, i8* %0, i64 9
%78 = load i8, i8* %77
%79 = zext i8 %78 to i64
%80 = shl nuw nsw i64 %79, 16
%81 = getelementptr inbounds i8, i8* %0, i64 10
%82 = load i8, i8* %81
%83 = zext i8 %82 to i64
%84 = or i64 %80, %83
%85 = getelementptr inbounds i8, i8* %0, i64 11
%86 = load i8, i8* %85
%87 = zext i8 %86 to i64
%88 = shl nuw nsw i64 %87, 8
%89 = or i64 %84, %88
br label %90
90: ; preds = %76, %66
%91 = phi i64 [ %75, %66 ], [ %89, %76 ]
%92 = icmp ugt i64 %91, %64
br i1 %92, label %93, label %96
93: ; preds = %90
%94 = load i32, i32* @stderr
%95 = tail call i32 (i32, i8*, ...) @fprintf(i32 %94, i8* getelementptr inbounds ([45 x i8], [45 x i8]* @.str.3, i64 0, i64 0), i64 %91, i64 %64)
br label %149
96: ; preds = %90
%97 = add nsw i64 %64, %45
%98 = icmp eq i64 %97, %1
br i1 %98, label %102, label %99
99: ; preds = %96
%100 = load i32, i32* @stderr
%101 = tail call i32 (i32, i8*, ...) @fprintf(i32 %100, i8* getelementptr inbounds ([50 x i8], [50 x i8]* @.str.4, i64 0, i64 0), i64 %64, i64 %45, i64 %1)
br label %149
102: ; preds = %96
br i1 %65, label %103, label %138
103: ; preds = %102
%104 = tail call zeroext i8 @crc(i8* %0, i64 31)
%105 = getelementptr inbounds i8, i8* %0, i64 31
%106 = load i8, i8* %105
%107 = icmp eq i8 %104, %106
br i1 %107, label %108, label %114
108: ; preds = %103
%109 = getelementptr inbounds i8, i8* %0, i64 30
%110 = load i8, i8* %109
%111 = icmp eq i8 %110, 0
br i1 %111, label %149, label %112
112: ; preds = %108
%113 = getelementptr inbounds i8, i8* %0, i64 32
br label %119
114: ; preds = %103
%115 = zext i8 %106 to i32
%116 = zext i8 %104 to i32
%117 = load i32, i32* @stderr
%118 = tail call i32 (i32, i8*, ...) @fprintf(i32 %117, i8* getelementptr inbounds ([74 x i8], [74 x i8]* @.str.5, i64 0, i64 0), i32 %115, i32 %116)
br label %149
119: ; preds = %112, %133
%120 = phi i64 [ 0, %112 ], [ %134, %133 ]
%121 = shl i64 %120, 9
%122 = getelementptr inbounds i8, i8* %113, i64 %121
%123 = tail call zeroext i8 @crc(i8* %122, i64 479)
%124 = or i64 %121, 511
%125 = getelementptr inbounds i8, i8* %0, i64 %124
%126 = load i8, i8* %125
%127 = icmp eq i8 %123, %126
br i1 %127, label %133, label %128
128: ; preds = %119
%129 = zext i8 %126 to i32
%130 = zext i8 %123 to i32
%131 = load i32, i32* @stderr
%132 = tail call i32 (i32, i8*, ...) @fprintf(i32 %131, i8* getelementptr inbounds ([84 x i8], [84 x i8]* @.str.6, i64 0, i64 0), i64 %120, i32 %129, i32 %130)
br label %149
133: ; preds = %119
%134 = add nuw nsw i64 %120, 1
%135 = load i8, i8* %109
%136 = zext i8 %135 to i64
%137 = icmp ult i64 %134, %136
br i1 %137, label %119, label %149
138: ; preds = %102
%139 = tail call zeroext i8 @crc(i8* %0, i64 %91)
%140 = getelementptr inbounds i8, i8* %0, i64 31
%141 = load i8, i8* %140
%142 = sub i8 %139, %141
%143 = icmp eq i8 %142, %141
br i1 %143, label %149, label %144
144: ; preds = %138
%145 = zext i8 %141 to i32
%146 = zext i8 %142 to i32
%147 = load i32, i32* @stderr
%148 = tail call i32 (i32, i8*, ...) @fprintf(i32 %147, i8* getelementptr inbounds ([62 x i8], [62 x i8]* @.str.7, i64 0, i64 0), i32 %145, i32 %146)
br label %149
149: ; preds = %133, %108, %138, %144, %128, %114, %99, %93, %22, %14, %4
%150 = phi i32 [ 1, %4 ], [ 1, %14 ], [ 1, %22 ], [ 1, %93 ], [ 1, %99 ], [ 1, %114 ], [ 1, %128 ], [ 1, %144 ], [ 0, %138 ], [ 0, %108 ], [ 0, %133 ]
ret i32 %150
}