#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int st_size;
};

/* Variables and functions */
void *MAP_FAILED;
int /*<<< orphan*/ MAP_PRIVATE;
int /*<<< orphan*/ O_RDONLY;
int /*<<< orphan*/ PROT_READ;
scalar_t__ fstat(int, struct stat *);
int /*<<< orphan*/ memcmp(void *, char *, int);
void *mmap(int /*<<< orphan*/, int, int /*<<< orphan*/, int /*<<< orphan*/, int,
           int /*<<< orphan*/);
int open(char const *, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
int loki_find(const char *aboot_image) {
  int aboot_fd;
  struct stat st;
  void *aboot, *ptr;
  unsigned long aboot_base, check_sigs, boot_mmc;
  aboot_fd = open(aboot_image, O_RDONLY);
  if (aboot_fd < 0) {
    printf("[-] Failed to open %s for reading.\n", aboot_image);
    return 1;
  }
  if (fstat(aboot_fd, &st)) {
    printf("[-] fstat() failed.\n");
    return 1;
  }
  aboot = mmap(0, (st.st_size + 0xfff) & ~0xfff, PROT_READ, MAP_PRIVATE,
               aboot_fd, 0);
  if (aboot == MAP_FAILED) {
    printf("[-] Failed to mmap aboot.\n");
    return 1;
  }
  check_sigs = 0;
  aboot_base = *(unsigned int *)(aboot + 12) - 0x28;
  for (ptr = aboot; ptr < aboot + st.st_size - 0x1000; ptr++) {
    if (!memcmp(ptr, "\xf0\xb5\x8f\xb0\x06\x46\xf0\xf7", 8) ||
        !memcmp(ptr, "\xf0\xb5\x8f\xb0\x07\x46\xf0\xf7", 8) ||
        !memcmp(ptr, "\x2d\xe9\xf0\x41\x86\xb0\xf1\xf7", 8) ||
        !memcmp(ptr, "\x2d\xe9\xf0\x4f\xad\xf5\xc6\x6d", 8) ||
        !memcmp(ptr, "\x2d\xe9\xf0\x4f\xad\xf5\x21\x7d", 8)) {
      check_sigs = (unsigned long)ptr - (unsigned long)aboot + aboot_base;
      break;
    }
    if (!memcmp(ptr, "\x2d\xe9\xf0\x4f\xf3\xb0\x05\x46", 8)) {
      check_sigs = (unsigned long)ptr - (unsigned long)aboot + aboot_base;
      continue;
    }
  }
  if (!check_sigs) {
    printf("[-] Could not find signature checking function.\n");
    return 1;
  }
  printf("[+] Signature check function: %.08lx\n", check_sigs);
  boot_mmc = 0;
  for (ptr = aboot; ptr < aboot + st.st_size - 0x1000; ptr++) {
    if (!memcmp(ptr, "\x4f\xf4\x70\x40\xb3\x49\x2d\xe9", 8) ||
        !memcmp(ptr, "\x2d\xe9\xf0\x4f\xad\xf5\x82\x5d", 8) ||
        !memcmp(ptr, "\x2d\xe9\xf0\x4f\x4f\xf4\x70\x40", 8) ||
        !memcmp(ptr, "\x2d\xe9\xf0\x4f\xad\xf5\x80\x5d", 8)) {
      boot_mmc = (unsigned long)ptr - (unsigned long)aboot + aboot_base;
      break;
    }
  }
  if (!boot_mmc) {
    printf("[-] Could not find boot_linux_from_mmc.\n");
    return 1;
  }
  printf("[+] boot_linux_from_mmc: %.08lx\n", boot_mmc);
  return 0;
}


x86 assembly (clang, -O0):
<loki_find>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
mov    0x2e79(%rip),%rax
mov    (%rax),%esi
call   1060 <open@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
jge    1199 <loki_find+0x49>
mov    -0x10(%rbp),%rsi
lea    0xe7a(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    14ae <loki_find+0x35e>
mov    -0x14(%rbp),%edi
lea    -0x18(%rbp),%rsi
call   1070 <fstat@plt>
cmp    $0x0,%rax
je     11c9 <loki_find+0x79>
lea    0xe6e(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    14ae <loki_find+0x35e>
mov    -0x18(%rbp),%esi
add    $0xfff,%esi
and    $0xfffff000,%esi
mov    0x2e19(%rip),%rax
mov    (%rax),%edx
mov    0x2de8(%rip),%rax
mov    (%rax),%ecx
mov    -0x14(%rbp),%r8d
xor    %r9d,%r9d
mov    %r9d,%edi
call   1030 <mmap@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    0x2dc0(%rip),%rcx
cmp    (%rcx),%rax
jne    122b <loki_find+0xdb>
lea    0xe21(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    14ae <loki_find+0x35e>
movq   $0x0,-0x38(%rbp)
mov    -0x20(%rbp),%rax
mov    0xc(%rax),%eax
sub    $0x28,%eax
mov    %eax,%eax
mov    %rax,-0x30(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    -0x20(%rbp),%rcx
movslq -0x18(%rbp),%rdx
add    %rdx,%rcx
add    $0xfffffffffffff000,%rcx
cmp    %rcx,%rax
jae    1364 <loki_find+0x214>
mov    -0x28(%rbp),%rdi
lea    0xddf(%rip),%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
cmp    $0x0,%eax
je     1300 <loki_find+0x1b0>
mov    -0x28(%rbp),%rdi
lea    0xdca(%rip),%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
cmp    $0x0,%eax
je     1300 <loki_find+0x1b0>
mov    -0x28(%rbp),%rdi
lea    0xdb5(%rip),%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
cmp    $0x0,%eax
je     1300 <loki_find+0x1b0>
mov    -0x28(%rbp),%rdi
lea    0xda0(%rip),%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
cmp    $0x0,%eax
je     1300 <loki_find+0x1b0>
mov    -0x28(%rbp),%rdi
lea    0xd8b(%rip),%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
cmp    $0x0,%eax
jne    1318 <loki_find+0x1c8>
mov    -0x28(%rbp),%rax
mov    -0x20(%rbp),%rcx
sub    %rcx,%rax
add    -0x30(%rbp),%rax
mov    %rax,-0x38(%rbp)
jmp    1364 <loki_find+0x214>
mov    -0x28(%rbp),%rdi
lea    0xd5e(%rip),%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
cmp    $0x0,%eax
jne    134e <loki_find+0x1fe>
mov    -0x28(%rbp),%rax
mov    -0x20(%rbp),%rcx
sub    %rcx,%rax
add    -0x30(%rbp),%rax
mov    %rax,-0x38(%rbp)
jmp    1353 <loki_find+0x203>
jmp    1353 <loki_find+0x203>
mov    -0x28(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x28(%rbp)
jmp    124b <loki_find+0xfb>
cmpq   $0x0,-0x38(%rbp)
jne    1389 <loki_find+0x239>
lea    0xd14(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    14ae <loki_find+0x35e>
mov    -0x38(%rbp),%rsi
lea    0xd27(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movq   $0x0,-0x40(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    -0x20(%rbp),%rcx
movslq -0x18(%rbp),%rdx
add    %rdx,%rcx
add    $0xfffffffffffff000,%rcx
cmp    %rcx,%rax
jae    1470 <loki_find+0x320>
mov    -0x28(%rbp),%rdi
lea    0xd0c(%rip),%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
cmp    $0x0,%eax
je     1442 <loki_find+0x2f2>
mov    -0x28(%rbp),%rdi
lea    0xcf7(%rip),%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
cmp    $0x0,%eax
je     1442 <loki_find+0x2f2>
mov    -0x28(%rbp),%rdi
lea    0xce2(%rip),%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
cmp    $0x0,%eax
je     1442 <loki_find+0x2f2>
mov    -0x28(%rbp),%rdi
lea    0xccd(%rip),%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
cmp    $0x0,%eax
jne    145a <loki_find+0x30a>
mov    -0x28(%rbp),%rax
mov    -0x20(%rbp),%rcx
sub    %rcx,%rax
add    -0x30(%rbp),%rax
mov    %rax,-0x40(%rbp)
jmp    1470 <loki_find+0x320>
jmp    145f <loki_find+0x30f>
mov    -0x28(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x28(%rbp)
jmp    13ab <loki_find+0x25b>
cmpq   $0x0,-0x40(%rbp)
jne    1495 <loki_find+0x345>
lea    0xc83(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    14ae <loki_find+0x35e>
mov    -0x40(%rbp),%rsi
lea    0xc8e(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<loki_find>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rdi,%rbp
mov    0x2e68(%rip),%rax
mov    (%rax),%esi
call   1070 <open@plt>
test   %eax,%eax
js     11a0 <loki_find+0x40>
mov    %eax,%ebx
mov    %rsp,%rsi
mov    %eax,%edi
call   1080 <fstat@plt>
test   %rax,%rax
je     11b6 <loki_find+0x56>
lea    0xf9c(%rip),%rdi
jmp    13af <loki_find+0x24f>
lea    0xe59(%rip),%rdi
mov    %rbp,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
jmp    13b4 <loki_find+0x254>
movslq (%rsp),%rbp
lea    0xfff(%rbp),%esi
and    $0xfffff000,%esi
mov    0x2e2b(%rip),%rax
mov    (%rax),%edx
mov    0x2dfa(%rip),%rax
mov    (%rax),%ecx
xor    %edi,%edi
mov    %ebx,%r8d
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,%r14
mov    0x2dd9(%rip),%rax
cmp    (%rax),%r14
je     12de <loki_find+0x17e>
lea    (%r14,%rbp,1),%rax
add    $0xfffffffffffff000,%rax
cmp    %rax,%r14
jae    1398 <loki_find+0x238>
mov    %rax,0x10(%rsp)
mov    0xc(%r14),%ebx
add    $0xffffffd8,%ebx
lea    -0x1000(%rbp),%r13
xor    %r12d,%r12d
mov    %rbx,0x8(%rsp)
mov    %r14,%r15
nopl   0x0(%rax)
mov    %r15,%rdi
lea    0xdea(%rip),%rsi
mov    $0x8,%edx
call   1060 <memcmp@plt>
test   %eax,%eax
je     12ea <loki_find+0x18a>
mov    %r15,%rdi
lea    0xdd7(%rip),%rsi
mov    $0x8,%edx
call   1060 <memcmp@plt>
test   %eax,%eax
je     12ea <loki_find+0x18a>
mov    %r15,%rdi
lea    0xdc4(%rip),%rsi
mov    $0x8,%edx
call   1060 <memcmp@plt>
test   %eax,%eax
je     12ea <loki_find+0x18a>
mov    %r15,%rdi
lea    0xdb5(%rip),%rsi
mov    $0x8,%edx
call   1060 <memcmp@plt>
test   %eax,%eax
je     12ea <loki_find+0x18a>
mov    %r15,%rdi
lea    0xda6(%rip),%rsi
mov    $0x8,%edx
call   1060 <memcmp@plt>
test   %eax,%eax
je     12ea <loki_find+0x18a>
mov    %r15,%rdi
lea    0xd97(%rip),%rsi
mov    $0x8,%edx
call   1060 <memcmp@plt>
test   %eax,%eax
cmove  %rbx,%r12
add    $0x1,%r15
add    $0x1,%rbx
add    $0xffffffffffffffff,%r13
jne    1230 <loki_find+0xd0>
jmp    12ed <loki_find+0x18d>
lea    0xe38(%rip),%rdi
jmp    13af <loki_find+0x24f>
mov    %rbx,%r12
test   %r12,%r12
mov    0x10(%rsp),%rbx
je     1398 <loki_find+0x238>
lea    0xd58(%rip),%rdi
mov    %r12,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
cmp    %rbx,%r14
jae    13a8 <loki_find+0x248>
mov    $0x1000,%ebx
sub    %rbp,%rbx
xor    %r12d,%r12d
lea    0xd59(%rip),%rbp
lea    0xd5b(%rip),%r13
lea    0xd5d(%rip),%r15
mov    %r14,%rdi
mov    %rbp,%rsi
mov    $0x8,%edx
call   1060 <memcmp@plt>
test   %eax,%eax
je     13a1 <loki_find+0x241>
mov    %r14,%rdi
mov    %r13,%rsi
mov    $0x8,%edx
call   1060 <memcmp@plt>
test   %eax,%eax
je     13a1 <loki_find+0x241>
mov    %r14,%rdi
mov    %r15,%rsi
mov    $0x8,%edx
call   1060 <memcmp@plt>
test   %eax,%eax
je     13a1 <loki_find+0x241>
mov    %r14,%rdi
lea    0xd20(%rip),%rsi
mov    $0x8,%edx
call   1060 <memcmp@plt>
test   %eax,%eax
je     13a1 <loki_find+0x241>
add    $0x1,%r14
add    $0xffffffffffffffff,%r12
cmp    %r12,%rbx
jne    1335 <loki_find+0x1d5>
jmp    13a8 <loki_find+0x248>
lea    0xd26(%rip),%rdi
jmp    13af <loki_find+0x24f>
sub    %r12,0x8(%rsp)
jne    13ca <loki_find+0x26a>
lea    0xd46(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%ebx
mov    %ebx,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xcd3(%rip),%rdi
xor    %ebx,%ebx
mov    0x8(%rsp),%rsi
xor    %eax,%eax
call   1050 <printf@plt>
jmp    13b9 <loki_find+0x259>

LLVM IR (-O0):
%struct.stat = type { i32 }
@O_RDONLY = global i32 0
@.str = [36 x i8] c"[-] Failed to open %s for reading.\0A\00"
@.str.1 = [21 x i8] c"[-] fstat() failed.\0A\00"
@PROT_READ = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_FAILED = global i8* null
@.str.2 = [27 x i8] c"[-] Failed to mmap aboot.\0A\00"
@.str.3 = [9 x i8] c"\F0\B5\8F\B0\06F\F0\F7\00"
@.str.4 = [9 x i8] c"\F0\B5\8F\B0\07F\F0\F7\00"
@.str.5 = [9 x i8] c"-\E9\F0A\86\B0\F1\F7\00"
@.str.6 = [9 x i8] c"-\E9\F0O\AD\F5\C6m\00"
@.str.7 = [9 x i8] c"-\E9\F0O\AD\F5!}\00"
@.str.8 = [9 x i8] c"-\E9\F0O\F3\B0\05F\00"
@.str.9 = [49 x i8] c"[-] Could not find signature checking function.\0A\00"
@.str.10 = [38 x i8] c"[+] Signature check function: %.08lx\0A\00"
@.str.11 = [9 x i8] c"O\F4p@\B3I-\E9\00"
@.str.12 = [9 x i8] c"-\E9\F0O\AD\F5\82]\00"
@.str.13 = [9 x i8] c"-\E9\F0OO\F4p@\00"
@.str.14 = [9 x i8] c"-\E9\F0O\AD\F5\80]\00"
@.str.15 = [41 x i8] c"[-] Could not find boot_linux_from_mmc.\0A\00"
@.str.16 = [33 x i8] c"[+] boot_linux_from_mmc: %.08lx\0A\00"
define i32 @loki_find(i8* %0) {
%2 = alloca i32
%3 = alloca i8*
%4 = alloca i32
%5 = alloca %struct.stat
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i64
%9 = alloca i64
%10 = alloca i64
store i8* %0, i8** %3
%11 = load i8*, i8** %3
%12 = load i32, i32* @O_RDONLY
%13 = call i32 @open(i8* %11, i32 %12)
store i32 %13, i32* %4
%14 = load i32, i32* %4
%15 = icmp slt i32 %14, 0
br i1 %15, label %16, label %19
16: ; preds = %1
%17 = load i8*, i8** %3
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str, i64 0, i64 0), i8* %17)
store i32 1, i32* %2
br label %154
19: ; preds = %1
%20 = load i32, i32* %4
%21 = call i64 @fstat(i32 %20, %struct.stat* %5)
%22 = icmp ne i64 %21, 0
br i1 %22, label %23, label %25
23: ; preds = %19
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.1, i64 0, i64 0))
store i32 1, i32* %2
br label %154
25: ; preds = %19
%26 = getelementptr inbounds %struct.stat, %struct.stat* %5, i32 0, i32 0
%27 = load i32, i32* %26
%28 = add nsw i32 %27, 4095
%29 = and i32 %28, -4096
%30 = load i32, i32* @PROT_READ
%31 = load i32, i32* @MAP_PRIVATE
%32 = load i32, i32* %4
%33 = call i8* @mmap(i32 0, i32 %29, i32 %30, i32 %31, i32 %32, i32 0)
store i8* %33, i8** %6
%34 = load i8*, i8** %6
%35 = load i8*, i8** @MAP_FAILED
%36 = icmp eq i8* %34, %35
br i1 %36, label %37, label %39
37: ; preds = %25
%38 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i64 0, i64 0))
store i32 1, i32* %2
br label %154
39: ; preds = %25
store i64 0, i64* %9
%40 = load i8*, i8** %6
%41 = getelementptr i8, i8* %40, i64 12
%42 = bitcast i8* %41 to i32*
%43 = load i32, i32* %42
%44 = sub i32 %43, 40
%45 = zext i32 %44 to i64
store i64 %45, i64* %8
%46 = load i8*, i8** %6
store i8* %46, i8** %7
br label %47
47: ; preds = %97, %39
%48 = load i8*, i8** %7
%49 = load i8*, i8** %6
%50 = getelementptr inbounds %struct.stat, %struct.stat* %5, i32 0, i32 0
%51 = load i32, i32* %50
%52 = sext i32 %51 to i64
%53 = getelementptr i8, i8* %49, i64 %52
%54 = getelementptr i8, i8* %53, i64 -4096
%55 = icmp ult i8* %48, %54
br i1 %55, label %56, label %100
56: ; preds = %47
%57 = load i8*, i8** %7
%58 = call i32 @memcmp(i8* %57, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i32 8)
%59 = icmp ne i32 %58, 0
br i1 %59, label %60, label %76
60: ; preds = %56
%61 = load i8*, i8** %7
%62 = call i32 @memcmp(i8* %61, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 8)
%63 = icmp ne i32 %62, 0
br i1 %63, label %64, label %76
64: ; preds = %60
%65 = load i8*, i8** %7
%66 = call i32 @memcmp(i8* %65, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0), i32 8)
%67 = icmp ne i32 %66, 0
br i1 %67, label %68, label %76
68: ; preds = %64
%69 = load i8*, i8** %7
%70 = call i32 @memcmp(i8* %69, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.6, i64 0, i64 0), i32 8)
%71 = icmp ne i32 %70, 0
br i1 %71, label %72, label %76
72: ; preds = %68
%73 = load i8*, i8** %7
%74 = call i32 @memcmp(i8* %73, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.7, i64 0, i64 0), i32 8)
%75 = icmp ne i32 %74, 0
br i1 %75, label %84, label %76
76: ; preds = %72, %68, %64, %60, %56
%77 = load i8*, i8** %7
%78 = ptrtoint i8* %77 to i64
%79 = load i8*, i8** %6
%80 = ptrtoint i8* %79 to i64
%81 = sub i64 %78, %80
%82 = load i64, i64* %8
%83 = add i64 %81, %82
store i64 %83, i64* %9
br label %100
84: ; preds = %72
%85 = load i8*, i8** %7
%86 = call i32 @memcmp(i8* %85, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.8, i64 0, i64 0), i32 8)
%87 = icmp ne i32 %86, 0
br i1 %87, label %96, label %88
88: ; preds = %84
%89 = load i8*, i8** %7
%90 = ptrtoint i8* %89 to i64
%91 = load i8*, i8** %6
%92 = ptrtoint i8* %91 to i64
%93 = sub i64 %90, %92
%94 = load i64, i64* %8
%95 = add i64 %93, %94
store i64 %95, i64* %9
br label %97
96: ; preds = %84
br label %97
97: ; preds = %96, %88
%98 = load i8*, i8** %7
%99 = getelementptr inbounds i8, i8* %98, i32 1
store i8* %99, i8** %7
br label %47
100: ; preds = %76, %47
%101 = load i64, i64* %9
%102 = icmp ne i64 %101, 0
br i1 %102, label %105, label %103
103: ; preds = %100
%104 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([49 x i8], [49 x i8]* @.str.9, i64 0, i64 0))
store i32 1, i32* %2
br label %154
105: ; preds = %100
%106 = load i64, i64* %9
%107 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.10, i64 0, i64 0), i64 %106)
store i64 0, i64* %10
%108 = load i8*, i8** %6
store i8* %108, i8** %7
br label %109
109: ; preds = %143, %105
%110 = load i8*, i8** %7
%111 = load i8*, i8** %6
%112 = getelementptr inbounds %struct.stat, %struct.stat* %5, i32 0, i32 0
%113 = load i32, i32* %112
%114 = sext i32 %113 to i64
%115 = getelementptr i8, i8* %111, i64 %114
%116 = getelementptr i8, i8* %115, i64 -4096
%117 = icmp ult i8* %110, %116
br i1 %117, label %118, label %146
118: ; preds = %109
%119 = load i8*, i8** %7
%120 = call i32 @memcmp(i8* %119, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.11, i64 0, i64 0), i32 8)
%121 = icmp ne i32 %120, 0
br i1 %121, label %122, label %134
122: ; preds = %118
%123 = load i8*, i8** %7
%124 = call i32 @memcmp(i8* %123, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.12, i64 0, i64 0), i32 8)
%125 = icmp ne i32 %124, 0
br i1 %125, label %126, label %134
126: ; preds = %122
%127 = load i8*, i8** %7
%128 = call i32 @memcmp(i8* %127, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.13, i64 0, i64 0), i32 8)
%129 = icmp ne i32 %128, 0
br i1 %129, label %130, label %134
130: ; preds = %126
%131 = load i8*, i8** %7
%132 = call i32 @memcmp(i8* %131, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.14, i64 0, i64 0), i32 8)
%133 = icmp ne i32 %132, 0
br i1 %133, label %142, label %134
134: ; preds = %130, %126, %122, %118
%135 = load i8*, i8** %7
%136 = ptrtoint i8* %135 to i64
%137 = load i8*, i8** %6
%138 = ptrtoint i8* %137 to i64
%139 = sub i64 %136, %138
%140 = load i64, i64* %8
%141 = add i64 %139, %140
store i64 %141, i64* %10
br label %146
142: ; preds = %130
br label %143
143: ; preds = %142
%144 = load i8*, i8** %7
%145 = getelementptr inbounds i8, i8* %144, i32 1
store i8* %145, i8** %7
br label %109
146: ; preds = %134, %109
%147 = load i64, i64* %10
%148 = icmp ne i64 %147, 0
br i1 %148, label %151, label %149
149: ; preds = %146
%150 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.15, i64 0, i64 0))
store i32 1, i32* %2
br label %154
151: ; preds = %146
%152 = load i64, i64* %10
%153 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.16, i64 0, i64 0), i64 %152)
store i32 0, i32* %2
br label %154
154: ; preds = %151, %149, %103, %37, %23, %16
%155 = load i32, i32* %2
ret i32 %155
}

LLVM IR (-O2):
%struct.stat = type { i32 }
@O_RDONLY = global i32 0
@.str = [36 x i8] c"[-] Failed to open %s for reading.\0A\00"
@PROT_READ = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_FAILED = global i8* null
@.str.3 = [9 x i8] c"\F0\B5\8F\B0\06F\F0\F7\00"
@.str.4 = [9 x i8] c"\F0\B5\8F\B0\07F\F0\F7\00"
@.str.5 = [9 x i8] c"-\E9\F0A\86\B0\F1\F7\00"
@.str.6 = [9 x i8] c"-\E9\F0O\AD\F5\C6m\00"
@.str.7 = [9 x i8] c"-\E9\F0O\AD\F5!}\00"
@.str.8 = [9 x i8] c"-\E9\F0O\F3\B0\05F\00"
@.str.10 = [38 x i8] c"[+] Signature check function: %.08lx\0A\00"
@.str.11 = [9 x i8] c"O\F4p@\B3I-\E9\00"
@.str.12 = [9 x i8] c"-\E9\F0O\AD\F5\82]\00"
@.str.13 = [9 x i8] c"-\E9\F0OO\F4p@\00"
@.str.14 = [9 x i8] c"-\E9\F0O\AD\F5\80]\00"
@.str.16 = [33 x i8] c"[+] boot_linux_from_mmc: %.08lx\0A\00"
@str = [48 x i8] c"[-] Could not find signature checking function.\00"
@str.17 = [40 x i8] c"[-] Could not find boot_linux_from_mmc.\00"
@str.18 = [26 x i8] c"[-] Failed to mmap aboot.\00"
@str.19 = [20 x i8] c"[-] fstat() failed.\00"
define i32 @loki_find(i8* %0) {
%2 = alloca %struct.stat
%3 = bitcast %struct.stat* %2 to i8*
%4 = load i32, i32* @O_RDONLY
%5 = tail call i32 @open(i8* %0, i32 %4)
%6 = icmp slt i32 %5, 0
br i1 %6, label %7, label %9
7: ; preds = %1
%8 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([36 x i8], [36 x i8]* @.str, i64 0, i64 0), i8* %0)
br label %100
9: ; preds = %1
%10 = call i64 @fstat(i32 %5, %struct.stat* %2)
%11 = icmp eq i64 %10, 0
br i1 %11, label %14, label %12
12: ; preds = %9
%13 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @str.19, i64 0, i64 0))
br label %100
14: ; preds = %9
%15 = getelementptr inbounds %struct.stat, %struct.stat* %2, i64 0, i32 0
%16 = load i32, i32* %15
%17 = add nsw i32 %16, 4095
%18 = and i32 %17, -4096
%19 = load i32, i32* @PROT_READ
%20 = load i32, i32* @MAP_PRIVATE
%21 = tail call i8* @mmap(i32 0, i32 %18, i32 %19, i32 %20, i32 %5, i32 0)
%22 = load i8*, i8** @MAP_FAILED
%23 = icmp eq i8* %21, %22
br i1 %23, label %24, label %26
24: ; preds = %14
%25 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([26 x i8], [26 x i8]* @str.18, i64 0, i64 0))
br label %100
26: ; preds = %14
%27 = getelementptr i8, i8* %21, i64 12
%28 = bitcast i8* %27 to i32*
%29 = load i32, i32* %28
%30 = add i32 %29, -40
%31 = zext i32 %30 to i64
%32 = sext i32 %16 to i64
%33 = getelementptr i8, i8* %21, i64 %32
%34 = getelementptr i8, i8* %33, i64 -4096
%35 = icmp ult i8* %21, %34
br i1 %35, label %36, label %70
36: ; preds = %26
%37 = ptrtoint i8* %21 to i64
%38 = sub i64 %31, %37
br label %39
39: ; preds = %36, %59
%40 = phi i64 [ 0, %36 ], [ %64, %59 ]
%41 = phi i8* [ %21, %36 ], [ %65, %59 ]
%42 = tail call i32 @memcmp(i8* %41, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i32 8)
%43 = icmp eq i32 %42, 0
br i1 %43, label %56, label %44
44: ; preds = %39
%45 = tail call i32 @memcmp(i8* %41, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 8)
%46 = icmp eq i32 %45, 0
br i1 %46, label %56, label %47
47: ; preds = %44
%48 = tail call i32 @memcmp(i8* %41, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0), i32 8)
%49 = icmp eq i32 %48, 0
br i1 %49, label %56, label %50
50: ; preds = %47
%51 = tail call i32 @memcmp(i8* %41, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.6, i64 0, i64 0), i32 8)
%52 = icmp eq i32 %51, 0
br i1 %52, label %56, label %53
53: ; preds = %50
%54 = tail call i32 @memcmp(i8* %41, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.7, i64 0, i64 0), i32 8)
%55 = icmp eq i32 %54, 0
br i1 %55, label %56, label %59
56: ; preds = %53, %50, %47, %44, %39
%57 = ptrtoint i8* %41 to i64
%58 = add i64 %38, %57
br label %67
59: ; preds = %53
%60 = tail call i32 @memcmp(i8* %41, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.8, i64 0, i64 0), i32 8)
%61 = icmp eq i32 %60, 0
%62 = ptrtoint i8* %41 to i64
%63 = add i64 %38, %62
%64 = select i1 %61, i64 %63, i64 %40
%65 = getelementptr inbounds i8, i8* %41, i64 1
%66 = icmp eq i8* %65, %34
br i1 %66, label %67, label %39
67: ; preds = %59, %56
%68 = phi i64 [ %58, %56 ], [ %64, %59 ]
%69 = icmp eq i64 %68, 0
br i1 %69, label %70, label %72
70: ; preds = %26, %67
%71 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([48 x i8], [48 x i8]* @str, i64 0, i64 0))
br label %100
72: ; preds = %67
%73 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([38 x i8], [38 x i8]* @.str.10, i64 0, i64 0), i64 %68)
br i1 %35, label %74, label %96
74: ; preds = %72, %87
%75 = phi i8* [ %88, %87 ], [ %21, %72 ]
%76 = tail call i32 @memcmp(i8* %75, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.11, i64 0, i64 0), i32 8)
%77 = icmp eq i32 %76, 0
br i1 %77, label %90, label %78
78: ; preds = %74
%79 = tail call i32 @memcmp(i8* %75, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.12, i64 0, i64 0), i32 8)
%80 = icmp eq i32 %79, 0
br i1 %80, label %90, label %81
81: ; preds = %78
%82 = tail call i32 @memcmp(i8* %75, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.13, i64 0, i64 0), i32 8)
%83 = icmp eq i32 %82, 0
br i1 %83, label %90, label %84
84: ; preds = %81
%85 = tail call i32 @memcmp(i8* %75, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.14, i64 0, i64 0), i32 8)
%86 = icmp eq i32 %85, 0
br i1 %86, label %90, label %87
87: ; preds = %84
%88 = getelementptr inbounds i8, i8* %75, i64 1
%89 = icmp eq i8* %88, %34
br i1 %89, label %96, label %74
90: ; preds = %74, %78, %81, %84
%91 = ptrtoint i8* %75 to i64
%92 = ptrtoint i8* %21 to i64
%93 = sub i64 %91, %92
%94 = add i64 %93, %31
%95 = icmp eq i64 %94, 0
br i1 %95, label %96, label %98
96: ; preds = %87, %72, %90
%97 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([40 x i8], [40 x i8]* @str.17, i64 0, i64 0))
br label %100
98: ; preds = %90
%99 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @.str.16, i64 0, i64 0), i64 %94)
br label %100
100: ; preds = %98, %96, %70, %24, %12, %7
%101 = phi i32 [ 1, %7 ], [ 1, %12 ], [ 1, %24 ], [ 0, %98 ], [ 1, %96 ], [ 1, %70 ]
ret i32 %101
}