#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ R_OK;
scalar_t__ access(char *, int /*<<< orphan*/);
int /*<<< orphan*/ *fopen(char *, char *);
int /*<<< orphan*/ fread(void *, int, int, int /*<<< orphan*/ *);
void *malloc(int);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ sprintf(char *, char *, char *, char *, ...);
int /*<<< orphan*/ strcpy(char *, char *);
int system(char *);
int main(int argc, char **argv) {
  FILE *pF;
  void *pBuf;
  char sTemp[1024];
  char *sImgName;
  char sTempFileLocation[256];
  char *sServerIp;
  int bLocalFile = 0;
  int ret = -1;
  unsigned int *pWrd;
  if (argc != 2 && argc != 3) {
    printf("Usage: %s <image file> [<ip>]\n", argv[0]);
    return -1;
  }
  sImgName = argv[1];
  if (argc == 3) {
    sServerIp = argv[2];
  } else {
    if (access(sImgName, R_OK) == 0) {
      printf("Using local copy \"%s\".\n", sImgName);
      bLocalFile = 1;
      sTempFileLocation[0] = '\0';
    }
    sServerIp = "`fw_printenv | grep \"serverip=\" | sed -e s/serverip=//g`";
  }
  if (!bLocalFile) {
    strcpy(sTempFileLocation, "/tmp/");
    printf("Transferring %s over tftp...\n", sImgName);
    sprintf(sTemp, "tftp %s -g -l %s%s -r %s\n", sServerIp, sTempFileLocation,
            sImgName, sImgName);
    printf("%s\n", sTemp);
    ret = system(sTemp);
    if (ret != 0) {
      printf("Transfer failed! Aborting...\n");
      return -1;
    }
  }
  printf("Analyzing file header of \"%s\".\n", sImgName);
  sprintf(sTemp, "%s%s", sTempFileLocation, sImgName);
  pF = fopen(sTemp, "rb");
  if (!pF) {
    printf("Unable to open %s!\n", sImgName);
    return -1;
  }
  pBuf = malloc(1024);
  fread(pBuf, 4, 1, pF);
  pWrd = (unsigned int *)pBuf;
  switch (*pWrd) {
  case 0xFF800020:
  case 0xFF800040:
  case 0xFF800060:
  case 0xFFA00000:
    printf("Magic word of U-Boot image found\n");
    printf("Copying to %s...\n", "/dev/uboot");
    sprintf(sTemp, "cp %s%s `readlink -f %s`\n", sTempFileLocation, sImgName,
            "/dev/uboot");
    ret = system(sTemp);
    goto cleanup;
    break;
  case 0x56190527:
    printf("Magic word of OS image found!\n");
    printf("Copying to %s...\n", "/dev/linux");
    sprintf(sTemp, "cp %s%s `readlink -f %s`\n", sTempFileLocation, sImgName,
            "/dev/linux");
    ret = system(sTemp);
    goto cleanup;
    break;
  default:
    printf("Image not recognized!\n");
    goto cleanup;
    break;
  }
cleanup:
  if (!bLocalFile) {
    sprintf(sTemp, "rm %s%s\n", sTempFileLocation, sImgName);
    system(sTemp);
  }
  return ret;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x550,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x53c(%rbp)
movl   $0xffffffff,-0x540(%rbp)
ff ff ff
cmpl   $0x2,-0x8(%rbp)
je     11e2 <main+0x62>
cmpl   $0x3,-0x8(%rbp)
je     11e2 <main+0x62>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
lea    0xe31(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1558 <main+0x3d8>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
mov    %rax,-0x428(%rbp)
cmpl   $0x3,-0x8(%rbp)
jne    120f <main+0x8f>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rax
mov    %rax,-0x538(%rbp)
jmp    1262 <main+0xe2>
mov    -0x428(%rbp),%rdi
mov    0x2dc3(%rip),%rax
mov    (%rax),%esi
call   1080 <access@plt>
cmp    $0x0,%rax
jne    1254 <main+0xd4>
mov    -0x428(%rbp),%rsi
lea    0xde3(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0x1,-0x53c(%rbp)
movb   $0x0,-0x530(%rbp)
lea    0xddc(%rip),%rax
mov    %rax,-0x538(%rbp)
cmpl   $0x0,-0x53c(%rbp)
jne    131b <main+0x19b>
lea    -0x530(%rbp),%rdi
lea    0xdf3(%rip),%rsi
call   1030 <strcpy@plt>
mov    -0x428(%rbp),%rsi
lea    0xde6(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    -0x420(%rbp),%rdi
mov    -0x538(%rbp),%rdx
lea    -0x530(%rbp),%rcx
mov    -0x428(%rbp),%r8
mov    -0x428(%rbp),%r9
lea    0xdd3(%rip),%rsi
mov    $0x0,%al
call   10a0 <sprintf@plt>
lea    -0x420(%rbp),%rsi
lea    0xdd4(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    -0x420(%rbp),%rdi
call   1050 <system@plt>
mov    %eax,-0x540(%rbp)
cmpl   $0x0,-0x540(%rbp)
je     1316 <main+0x196>
lea    0xdab(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1558 <main+0x3d8>
jmp    131b <main+0x19b>
mov    -0x428(%rbp),%rsi
lea    0xda3(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    -0x420(%rbp),%rdi
lea    -0x530(%rbp),%rdx
mov    -0x428(%rbp),%rcx
lea    0xda0(%rip),%rsi
mov    $0x0,%al
call   10a0 <sprintf@plt>
lea    -0x420(%rbp),%rdi
lea    0xd90(%rip),%rsi
call   1090 <fopen@plt>
mov    %rax,-0x18(%rbp)
cmpq   $0x0,-0x18(%rbp)
jne    1396 <main+0x216>
mov    -0x428(%rbp),%rsi
lea    0xd71(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1558 <main+0x3d8>
mov    $0x400,%edi
call   1070 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
mov    -0x18(%rbp),%rcx
mov    $0x4,%esi
mov    $0x1,%edx
call   1040 <fread@plt>
mov    -0x20(%rbp),%rax
mov    %rax,-0x548(%rbp)
mov    -0x548(%rbp),%rax
mov    (%rax),%eax
mov    %eax,-0x54c(%rbp)
sub    $0xff800020,%eax
je     143d <main+0x2bd>
jmp    13e5 <main+0x265>
mov    -0x54c(%rbp),%eax
sub    $0xff800040,%eax
je     143d <main+0x2bd>
jmp    13fb <main+0x27b>
mov    -0x54c(%rbp),%eax
sub    $0xff800060,%eax
je     143d <main+0x2bd>
jmp    1411 <main+0x291>
mov    -0x54c(%rbp),%eax
sub    $0xffa00000,%eax
je     143d <main+0x2bd>
jmp    1427 <main+0x2a7>
mov    -0x54c(%rbp),%eax
sub    $0x56190527,%eax
je     14a1 <main+0x321>
jmp    1505 <main+0x385>
lea    0xcc4(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xcd8(%rip),%rdi
lea    0xce3(%rip),%rsi
mov    $0x0,%al
call   1060 <printf@plt>
lea    -0x420(%rbp),%rdi
lea    -0x530(%rbp),%rdx
mov    -0x428(%rbp),%rcx
lea    0xccb(%rip),%rsi
lea    0xcb9(%rip),%r8
mov    $0x0,%al
call   10a0 <sprintf@plt>
lea    -0x420(%rbp),%rdi
call   1050 <system@plt>
mov    %eax,-0x540(%rbp)
jmp    1513 <main+0x393>
lea    0xcb9(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xc74(%rip),%rdi
lea    0xcc3(%rip),%rsi
mov    $0x0,%al
call   1060 <printf@plt>
lea    -0x420(%rbp),%rdi
lea    -0x530(%rbp),%rdx
mov    -0x428(%rbp),%rcx
lea    0xc67(%rip),%rsi
lea    0xc99(%rip),%r8
mov    $0x0,%al
call   10a0 <sprintf@plt>
lea    -0x420(%rbp),%rdi
call   1050 <system@plt>
mov    %eax,-0x540(%rbp)
jmp    1513 <main+0x393>
lea    0xc7f(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
cmpl   $0x0,-0x53c(%rbp)
jne    154f <main+0x3cf>
lea    -0x420(%rbp),%rdi
lea    -0x530(%rbp),%rdx
mov    -0x428(%rbp),%rcx
lea    0xc66(%rip),%rsi
mov    $0x0,%al
call   10a0 <sprintf@plt>
lea    -0x420(%rbp),%rdi
call   1050 <system@plt>
mov    -0x540(%rbp),%eax
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x550,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x500,%rsp
mov    %edi,%eax
and    $0xfffffffe,%eax
cmp    $0x2,%eax
jne    11b8 <main+0x28>
mov    0x8(%rsi),%r14
cmp    $0x3,%edi
jne    11ce <main+0x3e>
mov    0x10(%rsi),%rbx
jmp    11ef <main+0x5f>
mov    (%rsi),%rsi
lea    0xe3e(%rip),%rdi
xor    %eax,%eax
call   1070 <printf@plt>
jmp    125a <main+0xca>
mov    0x2e0b(%rip),%rax
mov    (%rax),%esi
mov    %r14,%rdi
call   1090 <access@plt>
test   %rax,%rax
je     1278 <main+0xe8>
lea    0xe48(%rip),%rbx
lea    0xe7a(%rip),%rsi
mov    %rsp,%r12
mov    %r12,%rdi
call   1030 <strcpy@plt>
lea    0xe6e(%rip),%rdi
xor    %r15d,%r15d
mov    %r14,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
lea    0xe78(%rip),%rsi
lea    0x100(%rsp),%rbp
mov    %rbp,%rdi
mov    %rbx,%rdx
mov    %r12,%rcx
mov    %r14,%r8
mov    %r14,%r9
xor    %eax,%eax
call   10b0 <sprintf@plt>
mov    %rbp,%rdi
call   1040 <puts@plt>
mov    %rbp,%rdi
call   1060 <system@plt>
test   %eax,%eax
je     1273 <main+0xe3>
lea    0xf35(%rip),%rdi
call   1040 <puts@plt>
mov    $0xffffffff,%r15d
mov    %r15d,%eax
add    $0x500,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret
mov    $0x1,%r12b
jmp    1296 <main+0x106>
lea    0xda0(%rip),%rdi
xor    %r12d,%r12d
mov    %r14,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
movb   $0x0,(%rsp)
mov    $0xffffffff,%r15d
lea    0xe11(%rip),%rdi
mov    %r14,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
lea    0xe20(%rip),%rsi
lea    0x100(%rsp),%rbx
mov    %rsp,%rdx
mov    %rbx,%rdi
mov    %r14,%rcx
xor    %eax,%eax
call   10b0 <sprintf@plt>
lea    0xe06(%rip),%rsi
mov    %rbx,%rdi
call   10a0 <fopen@plt>
test   %rax,%rax
je     1323 <main+0x193>
mov    %rax,%rbx
mov    $0x400,%edi
call   1080 <malloc@plt>
mov    %rax,%rbp
mov    %rax,%rdi
mov    $0x4,%esi
mov    $0x1,%edx
mov    %rbx,%rcx
call   1050 <fread@plt>
mov    0x0(%rbp),%eax
cmp    $0xff80005f,%eax
jle    1332 <main+0x1a2>
cmp    $0xff800060,%eax
je     1344 <main+0x1b4>
cmp    $0x56190527,%eax
je     1360 <main+0x1d0>
cmp    $0xffa00000,%eax
je     1344 <main+0x1b4>
jmp    13e6 <main+0x256>
lea    0xdac(%rip),%rdi
mov    %r14,%rsi
jmp    11c2 <main+0x32>
cmp    $0xff800020,%eax
je     1344 <main+0x1b4>
cmp    $0xff800040,%eax
jne    13e6 <main+0x256>
lea    0xe08(%rip),%rdi
call   1040 <puts@plt>
lea    0xd93(%rip),%rdi
lea    0xd9e(%rip),%rbx
jmp    137a <main+0x1ea>
lea    0xdce(%rip),%rdi
call   1040 <puts@plt>
lea    0xd77(%rip),%rdi
lea    0xda7(%rip),%rbx
mov    %rbx,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
lea    0xd7c(%rip),%rsi
lea    0x100(%rsp),%rbp
mov    %rsp,%rdx
mov    %rbp,%rdi
mov    %r14,%rcx
mov    %rbx,%r8
xor    %eax,%eax
call   10b0 <sprintf@plt>
mov    %rbp,%rdi
call   1060 <system@plt>
mov    %eax,%r15d
test   %r12b,%r12b
je     1260 <main+0xd0>
lea    0xd6b(%rip),%rsi
lea    0x100(%rsp),%rbx
mov    %rsp,%rdx
mov    %rbx,%rdi
mov    %r14,%rcx
xor    %eax,%eax
call   10b0 <sprintf@plt>
mov    %rbx,%rdi
call   1060 <system@plt>
jmp    1260 <main+0xd0>
lea    0xd87(%rip),%rdi
call   1040 <puts@plt>
test   %r12b,%r12b
je     1260 <main+0xd0>
jmp    13ba <main+0x22a>

LLVM IR (-O0):
@.str = [31 x i8] c"Usage: %s <image file> [<ip>]\0A\00"
@R_OK = global i32 0
@.str.1 = [24 x i8] c"Using local copy \22%s\22.\0A\00"
@.str.2 = [57 x i8] c"`fw_printenv | grep \22serverip=\22 | sed -e s/serverip=//g`\00"
@.str.3 = [6 x i8] c"/tmp/\00"
@.str.4 = [30 x i8] c"Transferring %s over tftp...\0A\00"
@.str.5 = [26 x i8] c"tftp %s -g -l %s%s -r %s\0A\00"
@.str.6 = [4 x i8] c"%s\0A\00"
@.str.7 = [30 x i8] c"Transfer failed! Aborting...\0A\00"
@.str.8 = [32 x i8] c"Analyzing file header of \22%s\22.\0A\00"
@.str.9 = [5 x i8] c"%s%s\00"
@.str.10 = [3 x i8] c"rb\00"
@.str.11 = [20 x i8] c"Unable to open %s!\0A\00"
@.str.12 = [34 x i8] c"Magic word of U-Boot image found\0A\00"
@.str.13 = [18 x i8] c"Copying to %s...\0A\00"
@.str.14 = [11 x i8] c"/dev/uboot\00"
@.str.15 = [26 x i8] c"cp %s%s `readlink -f %s`\0A\00"
@.str.16 = [31 x i8] c"Magic word of OS image found!\0A\00"
@.str.17 = [11 x i8] c"/dev/linux\00"
@.str.18 = [23 x i8] c"Image not recognized!\0A\00"
@.str.19 = [9 x i8] c"rm %s%s\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32*
%7 = alloca i8*
%8 = alloca [1024 x i8]
%9 = alloca i8*
%10 = alloca [256 x i8]
%11 = alloca i8*
%12 = alloca i32
%13 = alloca i32
%14 = alloca i32*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %12
store i32 -1, i32* %13
%15 = load i32, i32* %4
%16 = icmp ne i32 %15, 2
br i1 %16, label %17, label %25
17: ; preds = %2
%18 = load i32, i32* %4
%19 = icmp ne i32 %18, 3
br i1 %19, label %20, label %25
20: ; preds = %17
%21 = load i8**, i8*** %5
%22 = getelementptr inbounds i8*, i8** %21, i64 0
%23 = load i8*, i8** %22
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str, i64 0, i64 0), i8* %23)
store i32 -1, i32* %3
br label %123
25: ; preds = %17, %2
%26 = load i8**, i8*** %5
%27 = getelementptr inbounds i8*, i8** %26, i64 1
%28 = load i8*, i8** %27
store i8* %28, i8** %9
%29 = load i32, i32* %4
%30 = icmp eq i32 %29, 3
br i1 %30, label %31, label %35
31: ; preds = %25
%32 = load i8**, i8*** %5
%33 = getelementptr inbounds i8*, i8** %32, i64 2
%34 = load i8*, i8** %33
store i8* %34, i8** %11
br label %45
35: ; preds = %25
%36 = load i8*, i8** %9
%37 = load i32, i32* @R_OK
%38 = call i64 @access(i8* %36, i32 %37)
%39 = icmp eq i64 %38, 0
br i1 %39, label %40, label %44
40: ; preds = %35
%41 = load i8*, i8** %9
%42 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.1, i64 0, i64 0), i8* %41)
store i32 1, i32* %12
%43 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
store i8 0, i8* %43
br label %44
44: ; preds = %40, %35
store i8* getelementptr inbounds ([57 x i8], [57 x i8]* @.str.2, i64 0, i64 0), i8** %11
br label %45
45: ; preds = %44, %31
%46 = load i32, i32* %12
%47 = icmp ne i32 %46, 0
br i1 %47, label %68, label %48
48: ; preds = %45
%49 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%50 = call i32 @strcpy(i8* %49, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0))
%51 = load i8*, i8** %9
%52 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.4, i64 0, i64 0), i8* %51)
%53 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%54 = load i8*, i8** %11
%55 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%56 = load i8*, i8** %9
%57 = load i8*, i8** %9
%58 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %53, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.5, i64 0, i64 0), i8* %54, i8* %55, i8* %56, i8* %57)
%59 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%60 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.6, i64 0, i64 0), i8* %59)
%61 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%62 = call i32 @system(i8* %61)
store i32 %62, i32* %13
%63 = load i32, i32* %13
%64 = icmp ne i32 %63, 0
br i1 %64, label %65, label %67
65: ; preds = %48
%66 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.7, i64 0, i64 0))
store i32 -1, i32* %3
br label %123
67: ; preds = %48
br label %68
68: ; preds = %67, %45
%69 = load i8*, i8** %9
%70 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([32 x i8], [32 x i8]* @.str.8, i64 0, i64 0), i8* %69)
%71 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%72 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%73 = load i8*, i8** %9
%74 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %71, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.9, i64 0, i64 0), i8* %72, i8* %73)
%75 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%76 = call i32* @fopen(i8* %75, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.10, i64 0, i64 0))
store i32* %76, i32** %6
%77 = load i32*, i32** %6
%78 = icmp ne i32* %77, null
br i1 %78, label %82, label %79
79: ; preds = %68
%80 = load i8*, i8** %9
%81 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.11, i64 0, i64 0), i8* %80)
store i32 -1, i32* %3
br label %123
82: ; preds = %68
%83 = call i8* @malloc(i32 1024)
store i8* %83, i8** %7
%84 = load i8*, i8** %7
%85 = load i32*, i32** %6
%86 = call i32 @fread(i8* %84, i32 4, i32 1, i32* %85)
%87 = load i8*, i8** %7
%88 = bitcast i8* %87 to i32*
store i32* %88, i32** %14
%89 = load i32*, i32** %14
%90 = load i32, i32* %89
switch i32 %90, label %109 [
i32 -8388576, label %91
i32 -8388544, label %91
i32 -8388512, label %91
i32 -6291456, label %91
i32 1444480295, label %100
]
91: ; preds = %82, %82, %82, %82
%92 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.12, i64 0, i64 0))
%93 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.13, i64 0, i64 0), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.14, i64 0, i64 0))
%94 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%95 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%96 = load i8*, i8** %9
%97 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %94, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.15, i64 0, i64 0), i8* %95, i8* %96, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.14, i64 0, i64 0))
%98 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%99 = call i32 @system(i8* %98)
store i32 %99, i32* %13
br label %111
100: ; preds = %82
%101 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.16, i64 0, i64 0))
%102 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.13, i64 0, i64 0), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.17, i64 0, i64 0))
%103 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%104 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%105 = load i8*, i8** %9
%106 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %103, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.15, i64 0, i64 0), i8* %104, i8* %105, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.17, i64 0, i64 0))
%107 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%108 = call i32 @system(i8* %107)
store i32 %108, i32* %13
br label %111
109: ; preds = %82
%110 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.18, i64 0, i64 0))
br label %111
111: ; preds = %109, %100, %91
%112 = load i32, i32* %12
%113 = icmp ne i32 %112, 0
br i1 %113, label %121, label %114
114: ; preds = %111
%115 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%116 = getelementptr inbounds [256 x i8], [256 x i8]* %10, i64 0, i64 0
%117 = load i8*, i8** %9
%118 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %115, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.19, i64 0, i64 0), i8* %116, i8* %117)
%119 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%120 = call i32 @system(i8* %119)
br label %121
121: ; preds = %114, %111
%122 = load i32, i32* %13
store i32 %122, i32* %3
br label %123
123: ; preds = %121, %79, %65, %20
%124 = load i32, i32* %3
ret i32 %124
}

LLVM IR (-O2):
@.str = [31 x i8] c"Usage: %s <image file> [<ip>]\0A\00"
@R_OK = global i32 0
@.str.1 = [24 x i8] c"Using local copy \22%s\22.\0A\00"
@.str.2 = [57 x i8] c"`fw_printenv | grep \22serverip=\22 | sed -e s/serverip=//g`\00"
@.str.3 = [6 x i8] c"/tmp/\00"
@.str.4 = [30 x i8] c"Transferring %s over tftp...\0A\00"
@.str.5 = [26 x i8] c"tftp %s -g -l %s%s -r %s\0A\00"
@.str.8 = [32 x i8] c"Analyzing file header of \22%s\22.\0A\00"
@.str.9 = [5 x i8] c"%s%s\00"
@.str.10 = [3 x i8] c"rb\00"
@.str.11 = [20 x i8] c"Unable to open %s!\0A\00"
@.str.13 = [18 x i8] c"Copying to %s...\0A\00"
@.str.14 = [11 x i8] c"/dev/uboot\00"
@.str.15 = [26 x i8] c"cp %s%s `readlink -f %s`\0A\00"
@.str.17 = [11 x i8] c"/dev/linux\00"
@.str.19 = [9 x i8] c"rm %s%s\0A\00"
@str = [30 x i8] c"Magic word of OS image found!\00"
@str.20 = [33 x i8] c"Magic word of U-Boot image found\00"
@str.21 = [22 x i8] c"Image not recognized!\00"
@str.22 = [29 x i8] c"Transfer failed! Aborting...\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [1024 x i8]
%4 = alloca [256 x i8]
%5 = getelementptr inbounds [1024 x i8], [1024 x i8]* %3, i64 0, i64 0
%6 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%7 = and i32 %0, -2
%8 = icmp eq i32 %7, 2
br i1 %8, label %12, label %9
9: ; preds = %2
%10 = load i8*, i8** %1
%11 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([31 x i8], [31 x i8]* @.str, i64 0, i64 0), i8* %10)
br label %66
12: ; preds = %2
%13 = getelementptr inbounds i8*, i8** %1, i64 1
%14 = load i8*, i8** %13
%15 = icmp eq i32 %0, 3
br i1 %15, label %16, label %19
16: ; preds = %12
%17 = getelementptr inbounds i8*, i8** %1, i64 2
%18 = load i8*, i8** %17
br label %25
19: ; preds = %12
%20 = load i32, i32* @R_OK
%21 = tail call i64 @access(i8* %14, i32 %20)
%22 = icmp eq i64 %21, 0
br i1 %22, label %23, label %25
23: ; preds = %19
%24 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @.str.1, i64 0, i64 0), i8* %14)
store i8 0, i8* %6
br label %35
25: ; preds = %16, %19
%26 = phi i8* [ getelementptr inbounds ([57 x i8], [57 x i8]* @.str.2, i64 0, i64 0), %19 ], [ %18, %16 ]
%27 = call i32 @strcpy(i8* %6, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0))
%28 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.4, i64 0, i64 0), i8* %14)
%29 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %5, i8* dereferenceable(1) getelementptr inbounds ([26 x i8], [26 x i8]* @.str.5, i64 0, i64 0), i8* %26, i8* %6, i8* %14, i8* %14)
%30 = call i32 @puts(i8* %5)
%31 = call i32 @system(i8* %5)
%32 = icmp eq i32 %31, 0
br i1 %32, label %35, label %33
33: ; preds = %25
%34 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @str.22, i64 0, i64 0))
br label %66
35: ; preds = %23, %25
%36 = phi i1 [ false, %23 ], [ true, %25 ]
%37 = phi i32 [ -1, %23 ], [ 0, %25 ]
%38 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @.str.8, i64 0, i64 0), i8* %14)
%39 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %5, i8* dereferenceable(1) getelementptr inbounds ([5 x i8], [5 x i8]* @.str.9, i64 0, i64 0), i8* %6, i8* %14)
%40 = call i32* @fopen(i8* %5, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.10, i64 0, i64 0))
%41 = icmp eq i32* %40, null
br i1 %41, label %42, label %44
42: ; preds = %35
%43 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.11, i64 0, i64 0), i8* %14)
br label %66
44: ; preds = %35
%45 = call dereferenceable_or_null(1024) i8* @malloc(i32 1024)
%46 = call i32 @fread(i8* %45, i32 4, i32 1, i32* %40)
%47 = bitcast i8* %45 to i32*
%48 = load i32, i32* %47
switch i32 %48, label %59 [
i32 -8388576, label %49
i32 -8388544, label %49
i32 -8388512, label %49
i32 -6291456, label %49
i32 1444480295, label %54
]
49: ; preds = %44, %44, %44, %44
%50 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @str.20, i64 0, i64 0))
%51 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @.str.13, i64 0, i64 0), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.14, i64 0, i64 0))
%52 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %5, i8* dereferenceable(1) getelementptr inbounds ([26 x i8], [26 x i8]* @.str.15, i64 0, i64 0), i8* %6, i8* %14, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.14, i64 0, i64 0))
%53 = call i32 @system(i8* %5)
br label %61
54: ; preds = %44
%55 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @str, i64 0, i64 0))
%56 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @.str.13, i64 0, i64 0), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.17, i64 0, i64 0))
%57 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %5, i8* dereferenceable(1) getelementptr inbounds ([26 x i8], [26 x i8]* @.str.15, i64 0, i64 0), i8* %6, i8* %14, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.17, i64 0, i64 0))
%58 = call i32 @system(i8* %5)
br label %61
59: ; preds = %44
%60 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @str.21, i64 0, i64 0))
br label %61
61: ; preds = %59, %54, %49
%62 = phi i32 [ %37, %59 ], [ %58, %54 ], [ %53, %49 ]
br i1 %36, label %63, label %66
63: ; preds = %61
%64 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %5, i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.19, i64 0, i64 0), i8* %6, i8* %14)
%65 = call i32 @system(i8* %5)
br label %66
66: ; preds = %61, %63, %42, %33, %9
%67 = phi i32 [ -1, %9 ], [ -1, %42 ], [ -1, %33 ], [ %62, %63 ], [ %62, %61 ]
ret i32 %67
}