#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ memcpy(char *, ...);
char *inject_param(char *buf, size_t pos, void *arg) {
  if (pos < 6) {
    const unsigned char movs[] = {
        0xbf, 0xbe, 0xba, 0xb9, 0xb8, 0xb9,
    };
    buf[0] = (pos < 4) ? 0x48 : 0x49;
    buf[1] = movs[pos];
    memcpy(buf + 2, &arg, 8);
    return buf + 10;
  } else {
    char *param;
    buf[0] = buf[8] = 0xc7;
    buf[1] = buf[9] = 0x44;
    buf[2] = buf[10] = 0x24;
    buf[3] = (unsigned char)((pos - 6) * 8);
    buf[11] = buf[3] + 4;
    param = (void *)&arg;
    memcpy(buf + 4, param, 4);
    memcpy(buf + 12, param + 4, 4);
    return buf + 16;
  }
}


x86 assembly (clang, -O0):
<inject_param>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
cmpq   $0x6,-0x18(%rbp)
jae    1198 <inject_param+0x88>
mov    0xecb(%rip),%eax
mov    %eax,-0x26(%rbp)
mov    0xec5(%rip),%ax
mov    %ax,-0x22(%rbp)
mov    -0x18(%rbp),%rdx
mov    $0x49,%eax
mov    $0x48,%ecx
cmp    $0x4,%rdx
cmovb  %ecx,%eax
mov    %al,%cl
mov    -0x10(%rbp),%rax
mov    %cl,(%rax)
mov    -0x18(%rbp),%rax
mov    -0x26(%rbp,%rax,1),%cl
mov    -0x10(%rbp),%rax
mov    %cl,0x1(%rax)
mov    -0x10(%rbp),%rdi
add    $0x2,%rdi
xor    %eax,%eax
lea    -0x20(%rbp),%rsi
mov    $0x8,%edx
call   1030 <memcpy@plt>
mov    -0x10(%rbp),%rax
add    $0xa,%rax
mov    %rax,-0x8(%rbp)
jmp    1238 <inject_param+0x128>
mov    -0x10(%rbp),%rax
movb   $0xc7,0x8(%rax)
mov    -0x10(%rbp),%rax
movb   $0xc7,(%rax)
mov    -0x10(%rbp),%rax
movb   $0x44,0x9(%rax)
mov    -0x10(%rbp),%rax
movb   $0x44,0x1(%rax)
mov    -0x10(%rbp),%rax
movb   $0x24,0xa(%rax)
mov    -0x10(%rbp),%rax
movb   $0x24,0x2(%rax)
mov    -0x18(%rbp),%rax
sub    $0x6,%rax
shl    $0x3,%rax
mov    %al,%cl
mov    -0x10(%rbp),%rax
mov    %cl,0x3(%rax)
mov    -0x10(%rbp),%rax
movsbl 0x3(%rax),%eax
add    $0x4,%eax
mov    %al,%cl
mov    -0x10(%rbp),%rax
mov    %cl,0xb(%rax)
lea    -0x20(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    -0x10(%rbp),%rdi
add    $0x4,%rdi
mov    -0x30(%rbp),%rsi
xor    %eax,%eax
mov    $0x4,%edx
call   1030 <memcpy@plt>
mov    -0x10(%rbp),%rdi
add    $0xc,%rdi
mov    -0x30(%rbp),%rsi
add    $0x4,%rsi
xor    %eax,%eax
mov    $0x4,%edx
call   1030 <memcpy@plt>
mov    -0x10(%rbp),%rax
add    $0x10,%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<inject_param>:
push   %rbx
sub    $0x10,%rsp
mov    %rdi,%rbx
mov    %rdx,0x8(%rsp)
cmp    $0x5,%rsi
ja     1156 <inject_param+0x46>
cmp    $0x4,%rsi
mov    $0x49,%al
sbb    $0x0,%al
mov    %al,(%rbx)
lea    0xecc(%rip),%rax
mov    (%rsi,%rax,1),%al
mov    %al,0x1(%rbx)
lea    0x2(%rbx),%rdi
lea    0x8(%rsp),%rsi
mov    $0x8,%edx
xor    %eax,%eax
call   1030 <memcpy@plt>
mov    $0xa,%eax
jmp    11aa <inject_param+0x9a>
movw   $0x44c7,0x8(%rbx)
movb   $0xc7,(%rbx)
movw   $0x2444,0x1(%rbx)
movb   $0x24,0xa(%rbx)
shl    $0x3,%sil
lea    -0x30(%rsi),%eax
mov    %al,0x3(%rbx)
add    $0xd4,%sil
mov    %sil,0xb(%rbx)
lea    0x4(%rbx),%rdi
lea    0x8(%rsp),%rsi
mov    $0x4,%edx
xor    %eax,%eax
call   1030 <memcpy@plt>
lea    0xc(%rbx),%rdi
lea    0xc(%rsp),%rsi
mov    $0x4,%edx
xor    %eax,%eax
call   1030 <memcpy@plt>
mov    $0x10,%eax
add    %rax,%rbx
mov    %rbx,%rax
add    $0x10,%rsp
pop    %rbx
ret

LLVM IR (-O0):
@__const.inject_param.movs = [6 x i8] c"\BF\BE\BA\B9\B8\B9"
define i8* @inject_param(i8* %0, i64 %1, i8* %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i64
%7 = alloca i8*
%8 = alloca [6 x i8]
%9 = alloca i8*
store i8* %0, i8** %5
store i64 %1, i64* %6
store i8* %2, i8** %7
%10 = load i64, i64* %6
%11 = icmp ult i64 %10, 6
br i1 %11, label %12, label %31
12: ; preds = %3
%13 = bitcast [6 x i8]* %8 to i8*
%14 = load i64, i64* %6
%15 = icmp ult i64 %14, 4
%16 = zext i1 %15 to i64
%17 = select i1 %15, i32 72, i32 73
%18 = trunc i32 %17 to i8
%19 = load i8*, i8** %5
%20 = getelementptr inbounds i8, i8* %19, i64 0
store i8 %18, i8* %20
%21 = load i64, i64* %6
%22 = getelementptr inbounds [6 x i8], [6 x i8]* %8, i64 0, i64 %21
%23 = load i8, i8* %22
%24 = load i8*, i8** %5
%25 = getelementptr inbounds i8, i8* %24, i64 1
store i8 %23, i8* %25
%26 = load i8*, i8** %5
%27 = getelementptr inbounds i8, i8* %26, i64 2
%28 = call i32 (i8*, ...) @memcpy(i8* %27, i8** %7, i32 8)
%29 = load i8*, i8** %5
%30 = getelementptr inbounds i8, i8* %29, i64 10
store i8* %30, i8** %4
br label %70
31: ; preds = %3
%32 = load i8*, i8** %5
%33 = getelementptr inbounds i8, i8* %32, i64 8
store i8 -57, i8* %33
%34 = load i8*, i8** %5
%35 = getelementptr inbounds i8, i8* %34, i64 0
store i8 -57, i8* %35
%36 = load i8*, i8** %5
%37 = getelementptr inbounds i8, i8* %36, i64 9
store i8 68, i8* %37
%38 = load i8*, i8** %5
%39 = getelementptr inbounds i8, i8* %38, i64 1
store i8 68, i8* %39
%40 = load i8*, i8** %5
%41 = getelementptr inbounds i8, i8* %40, i64 10
store i8 36, i8* %41
%42 = load i8*, i8** %5
%43 = getelementptr inbounds i8, i8* %42, i64 2
store i8 36, i8* %43
%44 = load i64, i64* %6
%45 = sub i64 %44, 6
%46 = mul i64 %45, 8
%47 = trunc i64 %46 to i8
%48 = load i8*, i8** %5
%49 = getelementptr inbounds i8, i8* %48, i64 3
store i8 %47, i8* %49
%50 = load i8*, i8** %5
%51 = getelementptr inbounds i8, i8* %50, i64 3
%52 = load i8, i8* %51
%53 = sext i8 %52 to i32
%54 = add nsw i32 %53, 4
%55 = trunc i32 %54 to i8
%56 = load i8*, i8** %5
%57 = getelementptr inbounds i8, i8* %56, i64 11
store i8 %55, i8* %57
%58 = bitcast i8** %7 to i8*
store i8* %58, i8** %9
%59 = load i8*, i8** %5
%60 = getelementptr inbounds i8, i8* %59, i64 4
%61 = load i8*, i8** %9
%62 = call i32 (i8*, ...) @memcpy(i8* %60, i8* %61, i32 4)
%63 = load i8*, i8** %5
%64 = getelementptr inbounds i8, i8* %63, i64 12
%65 = load i8*, i8** %9
%66 = getelementptr inbounds i8, i8* %65, i64 4
%67 = call i32 (i8*, ...) @memcpy(i8* %64, i8* %66, i32 4)
%68 = load i8*, i8** %5
%69 = getelementptr inbounds i8, i8* %68, i64 16
store i8* %69, i8** %4
br label %70
70: ; preds = %31, %12
%71 = load i8*, i8** %4
ret i8* %71
}

LLVM IR (-O2):
@__const.inject_param.movs = [6 x i8] c"\BF\BE\BA\B9\B8\B9"
define i8* @inject_param(i8* %0, i64 %1, i8* %2) {
%4 = alloca i8*
store i8* %2, i8** %4
%5 = icmp ult i64 %1, 6
br i1 %5, label %6, label %14
6: ; preds = %3
%7 = icmp ult i64 %1, 4
%8 = select i1 %7, i8 72, i8 73
store i8 %8, i8* %0
%9 = getelementptr inbounds [6 x i8], [6 x i8]* @__const.inject_param.movs, i64 0, i64 %1
%10 = load i8, i8* %9
%11 = getelementptr inbounds i8, i8* %0, i64 1
store i8 %10, i8* %11
%12 = getelementptr inbounds i8, i8* %0, i64 2
%13 = call i32 (i8*, ...) @memcpy(i8* %12, i8** %4, i32 8)
br label %32
14: ; preds = %3
%15 = getelementptr inbounds i8, i8* %0, i64 8
store i8 -57, i8* %15
store i8 -57, i8* %0
%16 = getelementptr inbounds i8, i8* %0, i64 9
store i8 68, i8* %16
%17 = getelementptr inbounds i8, i8* %0, i64 1
store i8 68, i8* %17
%18 = getelementptr inbounds i8, i8* %0, i64 10
store i8 36, i8* %18
%19 = getelementptr inbounds i8, i8* %0, i64 2
store i8 36, i8* %19
%20 = trunc i64 %1 to i8
%21 = shl i8 %20, 3
%22 = add i8 %21, -48
%23 = getelementptr inbounds i8, i8* %0, i64 3
store i8 %22, i8* %23
%24 = or i8 %22, 4
%25 = getelementptr inbounds i8, i8* %0, i64 11
store i8 %24, i8* %25
%26 = bitcast i8** %4 to i8*
%27 = getelementptr inbounds i8, i8* %0, i64 4
%28 = call i32 (i8*, ...) @memcpy(i8* %27, i8** %4, i32 4)
%29 = getelementptr inbounds i8, i8* %0, i64 12
%30 = getelementptr inbounds i8, i8* %26, i64 4
%31 = call i32 (i8*, ...) @memcpy(i8* %29, i8* %30, i32 4)
br label %32
32: ; preds = %14, %6
%33 = phi i64 [ 16, %14 ], [ 10, %6 ]
%34 = getelementptr inbounds i8, i8* %0, i64 %33
ret i8* %34
}