#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int st_mode;
};

/* Variables and functions */
int PATH_MAX;
int /*<<< orphan*/ S_ISDIR(int);
int S_IXUSR;
char *dirname(char *);
char const *realpath(char const *, char *);
int /*<<< orphan*/ snprintf(char *, int, char *, char const *, char const *,
                            char const *);
int stat(char *, struct stat *);
const char *subcommand_path(const char *command, const char **rel_paths,
                            const char *subcommand) {
  char command_path[PATH_MAX];
  realpath(command, command_path);
  const char *command_dir = dirname(command_path);
  const char **relpath;
  for (relpath = rel_paths; *relpath; relpath++) {
    char subcommand_path[PATH_MAX];
    snprintf(subcommand_path, PATH_MAX, "%s/%s%s", command_dir, *relpath,
             subcommand);
    struct stat st;
    int err = stat(subcommand_path, &st);
    if (err != -1 && !S_ISDIR(st.st_mode) && (st.st_mode & S_IXUSR)) {
      return realpath(subcommand_path, NULL);
    }
  }
  return NULL;
}


x86 assembly (clang, -O0):
<subcommand_path>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    0x2e85(%rip),%rax
mov    (%rax),%eax
mov    %rsp,%rcx
mov    %rcx,-0x28(%rbp)
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
mov    %rsp,%rsi
sub    %rcx,%rsi
mov    %rsi,-0x68(%rbp)
mov    %rsi,%rsp
mov    %rax,-0x30(%rbp)
mov    -0x10(%rbp),%rdi
call   1070 <realpath@plt>
mov    -0x68(%rbp),%rdi
call   1050 <dirname@plt>
mov    %rax,-0x38(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rax
cmpq   $0x0,(%rax)
je     129d <subcommand_path+0x14d>
mov    0x2e2d(%rip),%rax
mov    (%rax),%eax
mov    %rsp,%rcx
mov    %rcx,-0x48(%rbp)
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
mov    %rsp,%rdi
sub    %rcx,%rdi
mov    %rdi,-0x70(%rbp)
mov    %rdi,%rsp
mov    %rax,-0x50(%rbp)
mov    0x2e01(%rip),%rax
mov    (%rax),%esi
mov    -0x38(%rbp),%rcx
mov    -0x40(%rbp),%rax
mov    (%rax),%r8
mov    -0x20(%rbp),%r9
lea    0xdf9(%rip),%rdx
call   1040 <snprintf@plt>
mov    -0x70(%rbp),%rdi
lea    -0x58(%rbp),%rsi
call   1060 <stat@plt>
mov    %eax,-0x5c(%rbp)
cmpl   $0xffffffff,-0x5c(%rbp)
je     1269 <subcommand_path+0x119>
mov    -0x58(%rbp),%edi
call   1030 <S_ISDIR@plt>
cmp    $0x0,%eax
jne    1269 <subcommand_path+0x119>
mov    -0x58(%rbp),%eax
mov    0x2d9f(%rip),%rcx
and    (%rcx),%eax
cmp    $0x0,%eax
je     1269 <subcommand_path+0x119>
mov    -0x70(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
call   1070 <realpath@plt>
mov    %rax,-0x8(%rbp)
movl   $0x1,-0x60(%rbp)
jmp    1270 <subcommand_path+0x120>
movl   $0x0,-0x60(%rbp)
mov    -0x48(%rbp),%rax
mov    %rax,%rsp
mov    -0x60(%rbp),%eax
test   %eax,%eax
jne    12ac <subcommand_path+0x15c>
jmp    1287 <subcommand_path+0x137>
jmp    128c <subcommand_path+0x13c>
mov    -0x40(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0x40(%rbp)
jmp    11ae <subcommand_path+0x5e>
movq   $0x0,-0x8(%rbp)
movl   $0x1,-0x60(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,%rsp
mov    -0x8(%rbp),%rax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<subcommand_path>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rdx,-0x38(%rbp)
mov    %rsi,%rbx
mov    0x2e81(%rip),%rax
mov    (%rax),%eax
mov    %rsp,%r15
add    $0xf,%rax
and    $0xfffffffffffffff0,%rax
sub    %rax,%r15
mov    %r15,%rsp
mov    %r15,%rsi
call   1070 <realpath@plt>
mov    %r15,%rdi
call   1050 <dirname@plt>
cmpq   $0x0,(%rbx)
je     1232 <subcommand_path+0xe2>
mov    %rax,%r12
add    $0x8,%rbx
jmp    11bd <subcommand_path+0x6d>
cs nopw 0x0(%rax,%rax,1)
nop
mov    %r14,%rsp
cmpq   $0x0,(%rbx)
lea    0x8(%rbx),%rbx
je     1232 <subcommand_path+0xe2>
mov    %rsp,%r14
mov    0x2e29(%rip),%rcx
mov    (%rcx),%eax
mov    %rsp,%r13
add    $0xf,%rax
and    $0xfffffffffffffff0,%rax
sub    %rax,%r13
mov    %r13,%rsp
mov    (%rcx),%esi
mov    -0x8(%rbx),%r8
mov    %r13,%rdi
lea    0xe16(%rip),%rdx
mov    %r12,%rcx
mov    -0x38(%rbp),%r9
call   1040 <snprintf@plt>
mov    %r13,%rdi
lea    -0x30(%rbp),%rsi
call   1060 <stat@plt>
cmp    $0xffffffff,%eax
je     11b0 <subcommand_path+0x60>
mov    -0x30(%rbp),%r15d
mov    %r15d,%edi
call   1030 <S_ISDIR@plt>
test   %eax,%eax
jne    11b0 <subcommand_path+0x60>
mov    0x2dc2(%rip),%rax
test   %r15d,(%rax)
je     11b0 <subcommand_path+0x60>
mov    %r13,%rdi
xor    %esi,%esi
call   1070 <realpath@plt>
mov    %r14,%rsp
jmp    1234 <subcommand_path+0xe4>
xor    %eax,%eax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.stat = type { i32 }
@PATH_MAX = global i32 0
@.str = [8 x i8] c"%s/%s%s\00"
@S_IXUSR = global i32 0
define i8* @subcommand_path(i8* %0, i8** %1, i8* %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8**
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i64
%10 = alloca i8*
%11 = alloca i8**
%12 = alloca i8*
%13 = alloca i64
%14 = alloca %struct.stat
%15 = alloca i32
%16 = alloca i32
store i8* %0, i8** %5
store i8** %1, i8*** %6
store i8* %2, i8** %7
%17 = load i32, i32* @PATH_MAX
%18 = zext i32 %17 to i64
%19 = call i8* @llvm.stacksave()
store i8* %19, i8** %8
%20 = alloca i8, i64 %18
store i64 %18, i64* %9
%21 = load i8*, i8** %5
%22 = call i8* @realpath(i8* %21, i8* %20)
%23 = call i8* @dirname(i8* %20)
store i8* %23, i8** %10
%24 = load i8**, i8*** %6
store i8** %24, i8*** %11
br label %25
25: ; preds = %61, %3
%26 = load i8**, i8*** %11
%27 = load i8*, i8** %26
%28 = icmp ne i8* %27, null
br i1 %28, label %29, label %64
29: ; preds = %25
%30 = load i32, i32* @PATH_MAX
%31 = zext i32 %30 to i64
%32 = call i8* @llvm.stacksave()
store i8* %32, i8** %12
%33 = alloca i8, i64 %31
store i64 %31, i64* %13
%34 = load i32, i32* @PATH_MAX
%35 = load i8*, i8** %10
%36 = load i8**, i8*** %11
%37 = load i8*, i8** %36
%38 = load i8*, i8** %7
%39 = call i32 @snprintf(i8* %33, i32 %34, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* %35, i8* %37, i8* %38)
%40 = call i32 @stat(i8* %33, %struct.stat* %14)
store i32 %40, i32* %15
%41 = load i32, i32* %15
%42 = icmp ne i32 %41, -1
br i1 %42, label %43, label %56
43: ; preds = %29
%44 = getelementptr inbounds %struct.stat, %struct.stat* %14, i32 0, i32 0
%45 = load i32, i32* %44
%46 = call i32 @S_ISDIR(i32 %45)
%47 = icmp ne i32 %46, 0
br i1 %47, label %56, label %48
48: ; preds = %43
%49 = getelementptr inbounds %struct.stat, %struct.stat* %14, i32 0, i32 0
%50 = load i32, i32* %49
%51 = load i32, i32* @S_IXUSR
%52 = and i32 %50, %51
%53 = icmp ne i32 %52, 0
br i1 %53, label %54, label %56
54: ; preds = %48
%55 = call i8* @realpath(i8* %33, i8* null)
store i8* %55, i8** %4
store i32 1, i32* %16
br label %57
56: ; preds = %48, %43, %29
store i32 0, i32* %16
br label %57
57: ; preds = %56, %54
%58 = load i8*, i8** %12
%59 = load i32, i32* %16
switch i32 %59, label %65 [
i32 0, label %60
]
60: ; preds = %57
br label %61
61: ; preds = %60
%62 = load i8**, i8*** %11
%63 = getelementptr inbounds i8*, i8** %62, i32 1
store i8** %63, i8*** %11
br label %25
64: ; preds = %25
store i8* null, i8** %4
store i32 1, i32* %16
br label %65
65: ; preds = %64, %57
%66 = load i8*, i8** %8
%67 = load i8*, i8** %4
ret i8* %67
}

LLVM IR (-O2):
%struct.stat = type { i32 }
@PATH_MAX = global i32 0
@.str = [8 x i8] c"%s/%s%s\00"
@S_IXUSR = global i32 0
define i8* @subcommand_path(i8* nocapture %0, i8** nocapture %1, i8* %2) {
%4 = alloca %struct.stat
%5 = load i32, i32* @PATH_MAX
%6 = zext i32 %5 to i64
%7 = alloca i8, i64 %6
%8 = call i8* @realpath(i8* %0, i8* %7)
%9 = call i8* @dirname(i8* %7)
%10 = load i8*, i8** %1
%11 = icmp eq i8* %10, null
br i1 %11, label %40, label %12
12: ; preds = %3
%13 = bitcast %struct.stat* %4 to i8*
%14 = getelementptr inbounds %struct.stat, %struct.stat* %4, i64 0, i32 0
br label %15
15: ; preds = %12, %36
%16 = phi i8** [ %1, %12 ], [ %37, %36 ]
%17 = load i32, i32* @PATH_MAX
%18 = zext i32 %17 to i64
%19 = call i8* @llvm.stacksave()
%20 = alloca i8, i64 %18
%21 = load i32, i32* @PATH_MAX
%22 = load i8*, i8** %16
%23 = call i32 @snprintf(i8* %20, i32 %21, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* %9, i8* %22, i8* %2)
%24 = call i32 @stat(i8* %20, %struct.stat* %4)
%25 = icmp eq i32 %24, -1
br i1 %25, label %36, label %26
26: ; preds = %15
%27 = load i32, i32* %14
%28 = call i32 @S_ISDIR(i32 %27)
%29 = icmp eq i32 %28, 0
br i1 %29, label %30, label %36
30: ; preds = %26
%31 = load i32, i32* @S_IXUSR
%32 = and i32 %31, %27
%33 = icmp eq i32 %32, 0
br i1 %33, label %36, label %34
34: ; preds = %30
%35 = call i8* @realpath(i8* %20, i8* null)
br label %40
36: ; preds = %30, %26, %15
%37 = getelementptr inbounds i8*, i8** %16, i64 1
%38 = load i8*, i8** %37
%39 = icmp eq i8* %38, null
br i1 %39, label %40, label %15
40: ; preds = %36, %3, %34
%41 = phi i8* [ %35, %34 ], [ null, %3 ], [ null, %36 ]
ret i8* %41
}