#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct inotify_event {
  scalar_t__ len;
  int /*<<< orphan*/ name;
};
typedef int ssize_t;

/* Variables and functions */
int NAME_MAX;
int /*<<< orphan*/ analyzeInotifyEvent(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_bash_aliases(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_bashrc(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_crontab(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_group(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_host_allow(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_host_deny(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_id_rsa(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_securetty(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_shadow(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_sources_list(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_ssh_config(struct inotify_event *);
int /*<<< orphan*/ analyzeInotifyEvent_sudoers(struct inotify_event *);
int /*<<< orphan*/ printf(char *);
int read(int, char *, int);
scalar_t__ strcmp(int /*<<< orphan*/, char *);
void analyze_activity(
    int inotifyFd,
    char buf[(10 * (sizeof(struct inotify_event) + NAME_MAX + 1))]) {
  ssize_t numRead = read(inotifyFd, buf,
                         (10 * (sizeof(struct inotify_event) + NAME_MAX + 1)));
  struct inotify_event *event;
  if (numRead == 0) {
    printf("read() from inotify fd returned 0!\n");
    return;
  }
  if (numRead == -1) {
    printf("read");
    return;
  }
  char *p = buf;
  while (p < buf + numRead) {
    event = (struct inotify_event *)p;
    if (strcmp(event->name, "shadow") == 0)
      analyzeInotifyEvent_shadow(event);
    else if (strcmp(event->name, "ssh_config") == 0)
      analyzeInotifyEvent_ssh_config(event);
    else if (strcmp(event->name, "sudoers") == 0)
      analyzeInotifyEvent_sudoers(event);
    else if (strcmp(event->name, "group") == 0)
      analyzeInotifyEvent_group(event);
    else if (strcmp(event->name, "securetty") == 0)
      analyzeInotifyEvent_securetty(event);
    else if (strcmp(event->name, "hosts.allow") == 0)
      analyzeInotifyEvent_host_allow(event);
    else if (strcmp(event->name, "hosts.deny") == 0)
      analyzeInotifyEvent_host_deny(event);
    else if (strcmp(event->name, "sources.list") == 0)
      analyzeInotifyEvent_sources_list(event);
    else if (strcmp(event->name, "crontab") == 0)
      analyzeInotifyEvent_crontab(event);
    else if (strcmp(event->name, ".bashrc") == 0)
      analyzeInotifyEvent_bashrc(event);
    else if (strcmp(event->name, ".bash_aliases") == 0)
      analyzeInotifyEvent_bash_aliases(event);
    else if ((strcmp(event->name, "id_rsa") == 0) ||
             (strcmp(event->name, "authorized_key") == 0) ||
             (strcmp(event->name, "authorized_key2") == 0))
      analyzeInotifyEvent_id_rsa(event);
    analyzeInotifyEvent(event);
    p += sizeof(struct inotify_event) + event->len;
  }
}


x86 assembly (clang, -O0):
<analyze_activity>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    %edi,-0x4(%rbp)
mov    %rsi,-0x10(%rbp)
mov    -0x4(%rbp),%edi
mov    -0x10(%rbp),%rsi
mov    0x2dbb(%rip),%rax
movslq (%rax),%rax
add    $0x10,%rax
add    $0x1,%rax
imul   $0xa,%rax,%rax
mov    %eax,%edx
call   1080 <read@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
jne    1251 <analyze_activity+0x51>
lea    0xdb9(%rip),%rdi
call   1050 <printf@plt>
jmp    1525 <analyze_activity+0x325>
cmpl   $0xffffffff,-0x14(%rbp)
jne    126c <analyze_activity+0x6c>
lea    0xdc2(%rip),%rdi
call   1050 <printf@plt>
jmp    1525 <analyze_activity+0x325>
mov    -0x10(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    -0x10(%rbp),%rcx
movslq -0x14(%rbp),%rdx
add    %rdx,%rcx
cmp    %rcx,%rax
jae    1525 <analyze_activity+0x325>
mov    -0x28(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xd87(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    12bf <analyze_activity+0xbf>
mov    -0x20(%rbp),%rdi
call   10b0 <analyzeInotifyEvent_shadow@plt>
jmp    1504 <analyze_activity+0x304>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xd63(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    12ea <analyze_activity+0xea>
mov    -0x20(%rbp),%rdi
call   1100 <analyzeInotifyEvent_ssh_config@plt>
jmp    14ff <analyze_activity+0x2ff>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xd43(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    1315 <analyze_activity+0x115>
mov    -0x20(%rbp),%rdi
call   1120 <analyzeInotifyEvent_sudoers@plt>
jmp    14fa <analyze_activity+0x2fa>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xd20(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    1340 <analyze_activity+0x140>
mov    -0x20(%rbp),%rdi
call   10e0 <analyzeInotifyEvent_group@plt>
jmp    14f5 <analyze_activity+0x2f5>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xcfb(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    136b <analyze_activity+0x16b>
mov    -0x20(%rbp),%rdi
call   1040 <analyzeInotifyEvent_securetty@plt>
jmp    14f0 <analyze_activity+0x2f0>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xcda(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    1396 <analyze_activity+0x196>
mov    -0x20(%rbp),%rdi
call   10d0 <analyzeInotifyEvent_host_allow@plt>
jmp    14eb <analyze_activity+0x2eb>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xcbb(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    13c1 <analyze_activity+0x1c1>
mov    -0x20(%rbp),%rdi
call   1070 <analyzeInotifyEvent_host_deny@plt>
jmp    14e6 <analyze_activity+0x2e6>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xc9b(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    13ec <analyze_activity+0x1ec>
mov    -0x20(%rbp),%rdi
call   1110 <analyzeInotifyEvent_sources_list@plt>
jmp    14e1 <analyze_activity+0x2e1>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xc7d(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    1417 <analyze_activity+0x217>
mov    -0x20(%rbp),%rdi
call   10c0 <analyzeInotifyEvent_crontab@plt>
jmp    14dc <analyze_activity+0x2dc>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xc5a(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    1442 <analyze_activity+0x242>
mov    -0x20(%rbp),%rdi
call   10a0 <analyzeInotifyEvent_bashrc@plt>
jmp    14d7 <analyze_activity+0x2d7>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xc37(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    146d <analyze_activity+0x26d>
mov    -0x20(%rbp),%rdi
call   10f0 <analyzeInotifyEvent_bash_aliases@plt>
jmp    14d2 <analyze_activity+0x2d2>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xc1a(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
je     14c4 <analyze_activity+0x2c4>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xc04(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
je     14c4 <analyze_activity+0x2c4>
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%edi
lea    0xbf6(%rip),%rsi
call   1090 <strcmp@plt>
cmp    $0x0,%rax
jne    14cd <analyze_activity+0x2cd>
mov    -0x20(%rbp),%rdi
call   1030 <analyzeInotifyEvent_id_rsa@plt>
jmp    14d2 <analyze_activity+0x2d2>
jmp    14d7 <analyze_activity+0x2d7>
jmp    14dc <analyze_activity+0x2dc>
jmp    14e1 <analyze_activity+0x2e1>
jmp    14e6 <analyze_activity+0x2e6>
jmp    14eb <analyze_activity+0x2eb>
jmp    14f0 <analyze_activity+0x2f0>
jmp    14f5 <analyze_activity+0x2f5>
jmp    14fa <analyze_activity+0x2fa>
jmp    14ff <analyze_activity+0x2ff>
jmp    1504 <analyze_activity+0x304>
mov    -0x20(%rbp),%rdi
call   1060 <analyzeInotifyEvent@plt>
mov    -0x20(%rbp),%rax
mov    (%rax),%rax
add    $0x10,%rax
add    -0x28(%rbp),%rax
mov    %rax,-0x28(%rbp)
jmp    1274 <analyze_activity+0x74>
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<analyze_activity>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rsi,%rbx
mov    0x2db3(%rip),%rax
mov    (%rax),%eax
lea    (%rax,%rax,4),%eax
lea    (%rax,%rax,1),%edx
add    $0xaa,%edx
call   1090 <read@plt>
cmp    $0xffffffff,%eax
je     125b <analyze_activity+0x4b>
test   %eax,%eax
jne    1275 <analyze_activity+0x65>
lea    0xe4f(%rip),%rdi
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
jmp    1030 <puts@plt>
lea    0xd9e(%rip),%rdi
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
jmp    1060 <printf@plt>
jle    1492 <analyze_activity+0x282>
movslq %eax,%rbp
add    %rbx,%rbp
lea    0xd7d(%rip),%r14
lea    0xd7d(%rip),%r15
lea    0xd81(%rip),%r12
lea    0xd82(%rip),%r13
jmp    12c3 <analyze_activity+0xb3>
nop
mov    %rbx,%rdi
call   10c0 <analyzeInotifyEvent_shadow@plt>
mov    %rbx,%rdi
call   1070 <analyzeInotifyEvent@plt>
mov    (%rbx),%rax
add    %rax,%rbx
add    $0x10,%rbx
cmp    %rbp,%rbx
jae    1492 <analyze_activity+0x282>
mov    0x8(%rbx),%edi
mov    %r14,%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     12a0 <analyze_activity+0x90>
mov    0x8(%rbx),%edi
mov    %r15,%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     1410 <analyze_activity+0x200>
mov    0x8(%rbx),%edi
mov    %r12,%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     141d <analyze_activity+0x20d>
mov    0x8(%rbx),%edi
mov    %r13,%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     142a <analyze_activity+0x21a>
mov    0x8(%rbx),%edi
lea    0xd0c(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     1437 <analyze_activity+0x227>
mov    0x8(%rbx),%edi
lea    0xcfe(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     1444 <analyze_activity+0x234>
mov    0x8(%rbx),%edi
lea    0xcf2(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     1451 <analyze_activity+0x241>
mov    0x8(%rbx),%edi
lea    0xce5(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     145e <analyze_activity+0x24e>
mov    0x8(%rbx),%edi
lea    0xcda(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     146b <analyze_activity+0x25b>
mov    0x8(%rbx),%edi
lea    0xcca(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     1478 <analyze_activity+0x268>
mov    0x8(%rbx),%edi
lea    0xcba(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     1485 <analyze_activity+0x275>
mov    0x8(%rbx),%edi
lea    0xcb0(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     13f7 <analyze_activity+0x1e7>
mov    0x8(%rbx),%edi
lea    0xca3(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
je     13f7 <analyze_activity+0x1e7>
mov    0x8(%rbx),%edi
lea    0xc9e(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
jne    12a8 <analyze_activity+0x98>
mov    %rbx,%rdi
call   1040 <analyzeInotifyEvent_id_rsa@plt>
jmp    12a8 <analyze_activity+0x98>
cs nopw 0x0(%rax,%rax,1)
xchg   %ax,%ax
mov    %rbx,%rdi
call   1110 <analyzeInotifyEvent_ssh_config@plt>
jmp    12a8 <analyze_activity+0x98>
mov    %rbx,%rdi
call   1130 <analyzeInotifyEvent_sudoers@plt>
jmp    12a8 <analyze_activity+0x98>
mov    %rbx,%rdi
call   10f0 <analyzeInotifyEvent_group@plt>
jmp    12a8 <analyze_activity+0x98>
mov    %rbx,%rdi
call   1050 <analyzeInotifyEvent_securetty@plt>
jmp    12a8 <analyze_activity+0x98>
mov    %rbx,%rdi
call   10e0 <analyzeInotifyEvent_host_allow@plt>
jmp    12a8 <analyze_activity+0x98>
mov    %rbx,%rdi
call   1080 <analyzeInotifyEvent_host_deny@plt>
jmp    12a8 <analyze_activity+0x98>
mov    %rbx,%rdi
call   1120 <analyzeInotifyEvent_sources_list@plt>
jmp    12a8 <analyze_activity+0x98>
mov    %rbx,%rdi
call   10d0 <analyzeInotifyEvent_crontab@plt>
jmp    12a8 <analyze_activity+0x98>
mov    %rbx,%rdi
call   10b0 <analyzeInotifyEvent_bashrc@plt>
jmp    12a8 <analyze_activity+0x98>
mov    %rbx,%rdi
call   1100 <analyzeInotifyEvent_bash_aliases@plt>
jmp    12a8 <analyze_activity+0x98>
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.inotify_event = type { i64, i32 }
@NAME_MAX = global i32 0
@.str = [36 x i8] c"read() from inotify fd returned 0!\0A\00"
@.str.1 = [5 x i8] c"read\00"
@.str.2 = [7 x i8] c"shadow\00"
@.str.3 = [11 x i8] c"ssh_config\00"
@.str.4 = [8 x i8] c"sudoers\00"
@.str.5 = [6 x i8] c"group\00"
@.str.6 = [10 x i8] c"securetty\00"
@.str.7 = [12 x i8] c"hosts.allow\00"
@.str.8 = [11 x i8] c"hosts.deny\00"
@.str.9 = [13 x i8] c"sources.list\00"
@.str.10 = [8 x i8] c"crontab\00"
@.str.11 = [8 x i8] c".bashrc\00"
@.str.12 = [14 x i8] c".bash_aliases\00"
@.str.13 = [7 x i8] c"id_rsa\00"
@.str.14 = [15 x i8] c"authorized_key\00"
@.str.15 = [16 x i8] c"authorized_key2\00"
define void @analyze_activity(i32 %0, i8* %1) {
%3 = alloca i32
%4 = alloca i8*
%5 = alloca i32
%6 = alloca %struct.inotify_event*
%7 = alloca i8*
store i32 %0, i32* %3
store i8* %1, i8** %4
%8 = load i32, i32* @NAME_MAX
%9 = sext i32 %8 to i64
%10 = add i64 16, %9
%11 = add i64 %10, 1
%12 = mul i64 10, %11
%13 = load i32, i32* %3
%14 = load i8*, i8** %4
%15 = load i32, i32* @NAME_MAX
%16 = sext i32 %15 to i64
%17 = add i64 16, %16
%18 = add i64 %17, 1
%19 = mul i64 10, %18
%20 = trunc i64 %19 to i32
%21 = call i32 @read(i32 %13, i8* %14, i32 %20)
store i32 %21, i32* %5
%22 = load i32, i32* %5
%23 = icmp eq i32 %22, 0
br i1 %23, label %24, label %26
24: ; preds = %2
%25 = call i32 @printf(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str, i64 0, i64 0))
br label %182
26: ; preds = %2
%27 = load i32, i32* %5
%28 = icmp eq i32 %27, -1
br i1 %28, label %29, label %31
29: ; preds = %26
%30 = call i32 @printf(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0))
br label %182
31: ; preds = %26
%32 = load i8*, i8** %4
store i8* %32, i8** %7
br label %33
33: ; preds = %173, %31
%34 = load i8*, i8** %7
%35 = load i8*, i8** %4
%36 = load i32, i32* %5
%37 = sext i32 %36 to i64
%38 = getelementptr inbounds i8, i8* %35, i64 %37
%39 = icmp ult i8* %34, %38
br i1 %39, label %40, label %182
40: ; preds = %33
%41 = load i8*, i8** %7
%42 = bitcast i8* %41 to %struct.inotify_event*
store %struct.inotify_event* %42, %struct.inotify_event** %6
%43 = load %struct.inotify_event*, %struct.inotify_event** %6
%44 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %43, i32 0, i32 1
%45 = load i32, i32* %44
%46 = call i64 @strcmp(i32 %45, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
%47 = icmp eq i64 %46, 0
br i1 %47, label %48, label %51
48: ; preds = %40
%49 = load %struct.inotify_event*, %struct.inotify_event** %6
%50 = call i32 @analyzeInotifyEvent_shadow(%struct.inotify_event* %49)
br label %173
51: ; preds = %40
%52 = load %struct.inotify_event*, %struct.inotify_event** %6
%53 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %52, i32 0, i32 1
%54 = load i32, i32* %53
%55 = call i64 @strcmp(i32 %54, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.3, i64 0, i64 0))
%56 = icmp eq i64 %55, 0
br i1 %56, label %57, label %60
57: ; preds = %51
%58 = load %struct.inotify_event*, %struct.inotify_event** %6
%59 = call i32 @analyzeInotifyEvent_ssh_config(%struct.inotify_event* %58)
br label %172
60: ; preds = %51
%61 = load %struct.inotify_event*, %struct.inotify_event** %6
%62 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %61, i32 0, i32 1
%63 = load i32, i32* %62
%64 = call i64 @strcmp(i32 %63, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0))
%65 = icmp eq i64 %64, 0
br i1 %65, label %66, label %69
66: ; preds = %60
%67 = load %struct.inotify_event*, %struct.inotify_event** %6
%68 = call i32 @analyzeInotifyEvent_sudoers(%struct.inotify_event* %67)
br label %171
69: ; preds = %60
%70 = load %struct.inotify_event*, %struct.inotify_event** %6
%71 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %70, i32 0, i32 1
%72 = load i32, i32* %71
%73 = call i64 @strcmp(i32 %72, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.5, i64 0, i64 0))
%74 = icmp eq i64 %73, 0
br i1 %74, label %75, label %78
75: ; preds = %69
%76 = load %struct.inotify_event*, %struct.inotify_event** %6
%77 = call i32 @analyzeInotifyEvent_group(%struct.inotify_event* %76)
br label %170
78: ; preds = %69
%79 = load %struct.inotify_event*, %struct.inotify_event** %6
%80 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %79, i32 0, i32 1
%81 = load i32, i32* %80
%82 = call i64 @strcmp(i32 %81, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.6, i64 0, i64 0))
%83 = icmp eq i64 %82, 0
br i1 %83, label %84, label %87
84: ; preds = %78
%85 = load %struct.inotify_event*, %struct.inotify_event** %6
%86 = call i32 @analyzeInotifyEvent_securetty(%struct.inotify_event* %85)
br label %169
87: ; preds = %78
%88 = load %struct.inotify_event*, %struct.inotify_event** %6
%89 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %88, i32 0, i32 1
%90 = load i32, i32* %89
%91 = call i64 @strcmp(i32 %90, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%92 = icmp eq i64 %91, 0
br i1 %92, label %93, label %96
93: ; preds = %87
%94 = load %struct.inotify_event*, %struct.inotify_event** %6
%95 = call i32 @analyzeInotifyEvent_host_allow(%struct.inotify_event* %94)
br label %168
96: ; preds = %87
%97 = load %struct.inotify_event*, %struct.inotify_event** %6
%98 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %97, i32 0, i32 1
%99 = load i32, i32* %98
%100 = call i64 @strcmp(i32 %99, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.8, i64 0, i64 0))
%101 = icmp eq i64 %100, 0
br i1 %101, label %102, label %105
102: ; preds = %96
%103 = load %struct.inotify_event*, %struct.inotify_event** %6
%104 = call i32 @analyzeInotifyEvent_host_deny(%struct.inotify_event* %103)
br label %167
105: ; preds = %96
%106 = load %struct.inotify_event*, %struct.inotify_event** %6
%107 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %106, i32 0, i32 1
%108 = load i32, i32* %107
%109 = call i64 @strcmp(i32 %108, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.9, i64 0, i64 0))
%110 = icmp eq i64 %109, 0
br i1 %110, label %111, label %114
111: ; preds = %105
%112 = load %struct.inotify_event*, %struct.inotify_event** %6
%113 = call i32 @analyzeInotifyEvent_sources_list(%struct.inotify_event* %112)
br label %166
114: ; preds = %105
%115 = load %struct.inotify_event*, %struct.inotify_event** %6
%116 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %115, i32 0, i32 1
%117 = load i32, i32* %116
%118 = call i64 @strcmp(i32 %117, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.10, i64 0, i64 0))
%119 = icmp eq i64 %118, 0
br i1 %119, label %120, label %123
120: ; preds = %114
%121 = load %struct.inotify_event*, %struct.inotify_event** %6
%122 = call i32 @analyzeInotifyEvent_crontab(%struct.inotify_event* %121)
br label %165
123: ; preds = %114
%124 = load %struct.inotify_event*, %struct.inotify_event** %6
%125 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %124, i32 0, i32 1
%126 = load i32, i32* %125
%127 = call i64 @strcmp(i32 %126, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.11, i64 0, i64 0))
%128 = icmp eq i64 %127, 0
br i1 %128, label %129, label %132
129: ; preds = %123
%130 = load %struct.inotify_event*, %struct.inotify_event** %6
%131 = call i32 @analyzeInotifyEvent_bashrc(%struct.inotify_event* %130)
br label %164
132: ; preds = %123
%133 = load %struct.inotify_event*, %struct.inotify_event** %6
%134 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %133, i32 0, i32 1
%135 = load i32, i32* %134
%136 = call i64 @strcmp(i32 %135, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.12, i64 0, i64 0))
%137 = icmp eq i64 %136, 0
br i1 %137, label %138, label %141
138: ; preds = %132
%139 = load %struct.inotify_event*, %struct.inotify_event** %6
%140 = call i32 @analyzeInotifyEvent_bash_aliases(%struct.inotify_event* %139)
br label %163
141: ; preds = %132
%142 = load %struct.inotify_event*, %struct.inotify_event** %6
%143 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %142, i32 0, i32 1
%144 = load i32, i32* %143
%145 = call i64 @strcmp(i32 %144, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.13, i64 0, i64 0))
%146 = icmp eq i64 %145, 0
br i1 %146, label %159, label %147
147: ; preds = %141
%148 = load %struct.inotify_event*, %struct.inotify_event** %6
%149 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %148, i32 0, i32 1
%150 = load i32, i32* %149
%151 = call i64 @strcmp(i32 %150, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.14, i64 0, i64 0))
%152 = icmp eq i64 %151, 0
br i1 %152, label %159, label %153
153: ; preds = %147
%154 = load %struct.inotify_event*, %struct.inotify_event** %6
%155 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %154, i32 0, i32 1
%156 = load i32, i32* %155
%157 = call i64 @strcmp(i32 %156, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.15, i64 0, i64 0))
%158 = icmp eq i64 %157, 0
br i1 %158, label %159, label %162
159: ; preds = %153, %147, %141
%160 = load %struct.inotify_event*, %struct.inotify_event** %6
%161 = call i32 @analyzeInotifyEvent_id_rsa(%struct.inotify_event* %160)
br label %162
162: ; preds = %159, %153
br label %163
163: ; preds = %162, %138
br label %164
164: ; preds = %163, %129
br label %165
165: ; preds = %164, %120
br label %166
166: ; preds = %165, %111
br label %167
167: ; preds = %166, %102
br label %168
168: ; preds = %167, %93
br label %169
169: ; preds = %168, %84
br label %170
170: ; preds = %169, %75
br label %171
171: ; preds = %170, %66
br label %172
172: ; preds = %171, %57
br label %173
173: ; preds = %172, %48
%174 = load %struct.inotify_event*, %struct.inotify_event** %6
%175 = call i32 @analyzeInotifyEvent(%struct.inotify_event* %174)
%176 = load %struct.inotify_event*, %struct.inotify_event** %6
%177 = getelementptr inbounds %struct.inotify_event, %struct.inotify_event* %176, i32 0, i32 0
%178 = load i64, i64* %177
%179 = add i64 16, %178
%180 = load i8*, i8** %7
%181 = getelementptr inbounds i8, i8* %180, i64 %179
store i8* %181, i8** %7
br label %33
182: ; preds = %24, %29, %33
ret void
}

LLVM IR (-O2):
%struct.inotify_event = type { i64, i32 }
@NAME_MAX = global i32 0
@.str.1 = [5 x i8] c"read\00"
@.str.2 = [7 x i8] c"shadow\00"
@.str.3 = [11 x i8] c"ssh_config\00"
@.str.4 = [8 x i8] c"sudoers\00"
@.str.5 = [6 x i8] c"group\00"
@.str.6 = [10 x i8] c"securetty\00"
@.str.7 = [12 x i8] c"hosts.allow\00"
@.str.8 = [11 x i8] c"hosts.deny\00"
@.str.9 = [13 x i8] c"sources.list\00"
@.str.10 = [8 x i8] c"crontab\00"
@.str.11 = [8 x i8] c".bashrc\00"
@.str.12 = [14 x i8] c".bash_aliases\00"
@.str.13 = [7 x i8] c"id_rsa\00"
@.str.14 = [15 x i8] c"authorized_key\00"
@.str.15 = [16 x i8] c"authorized_key2\00"
@str = [35 x i8] c"read() from inotify fd returned 0!\00"
define void @analyze_activity(i32 %0, i8* %1) {
%3 = load i32, i32* @NAME_MAX
%4 = mul i32 %3, 10
%5 = add i32 %4, 170
%6 = tail call i32 @read(i32 %0, i8* %1, i32 %5)
switch i32 %6, label %7 [
i32 0, label %11
i32 -1, label %13
]
7: ; preds = %2
%8 = sext i32 %6 to i64
%9 = getelementptr inbounds i8, i8* %1, i64 %8
%10 = icmp sgt i32 %6, 0
br i1 %10, label %15, label %106
11: ; preds = %2
%12 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @str, i64 0, i64 0))
br label %106
13: ; preds = %2
%14 = tail call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0))
br label %106
15: ; preds = %7, %99
%16 = phi i8* [ %104, %99 ], [ %1, %7 ]
%17 = bitcast i8* %16 to %struct.inotify_event*
%18 = getelementptr inbounds i8, i8* %16, i64 8
%19 = bitcast i8* %18 to i32*
%20 = load i32, i32* %19
%21 = tail call i64 @strcmp(i32 %20, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
%22 = icmp eq i64 %21, 0
br i1 %22, label %23, label %25
23: ; preds = %15
%24 = tail call i32 @analyzeInotifyEvent_shadow(%struct.inotify_event* %17)
br label %99
25: ; preds = %15
%26 = load i32, i32* %19
%27 = tail call i64 @strcmp(i32 %26, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.3, i64 0, i64 0))
%28 = icmp eq i64 %27, 0
br i1 %28, label %29, label %31
29: ; preds = %25
%30 = tail call i32 @analyzeInotifyEvent_ssh_config(%struct.inotify_event* %17)
br label %99
31: ; preds = %25
%32 = load i32, i32* %19
%33 = tail call i64 @strcmp(i32 %32, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0))
%34 = icmp eq i64 %33, 0
br i1 %34, label %35, label %37
35: ; preds = %31
%36 = tail call i32 @analyzeInotifyEvent_sudoers(%struct.inotify_event* %17)
br label %99
37: ; preds = %31
%38 = load i32, i32* %19
%39 = tail call i64 @strcmp(i32 %38, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.5, i64 0, i64 0))
%40 = icmp eq i64 %39, 0
br i1 %40, label %41, label %43
41: ; preds = %37
%42 = tail call i32 @analyzeInotifyEvent_group(%struct.inotify_event* %17)
br label %99
43: ; preds = %37
%44 = load i32, i32* %19
%45 = tail call i64 @strcmp(i32 %44, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.6, i64 0, i64 0))
%46 = icmp eq i64 %45, 0
br i1 %46, label %47, label %49
47: ; preds = %43
%48 = tail call i32 @analyzeInotifyEvent_securetty(%struct.inotify_event* %17)
br label %99
49: ; preds = %43
%50 = load i32, i32* %19
%51 = tail call i64 @strcmp(i32 %50, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%52 = icmp eq i64 %51, 0
br i1 %52, label %53, label %55
53: ; preds = %49
%54 = tail call i32 @analyzeInotifyEvent_host_allow(%struct.inotify_event* %17)
br label %99
55: ; preds = %49
%56 = load i32, i32* %19
%57 = tail call i64 @strcmp(i32 %56, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.8, i64 0, i64 0))
%58 = icmp eq i64 %57, 0
br i1 %58, label %59, label %61
59: ; preds = %55
%60 = tail call i32 @analyzeInotifyEvent_host_deny(%struct.inotify_event* %17)
br label %99
61: ; preds = %55
%62 = load i32, i32* %19
%63 = tail call i64 @strcmp(i32 %62, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.9, i64 0, i64 0))
%64 = icmp eq i64 %63, 0
br i1 %64, label %65, label %67
65: ; preds = %61
%66 = tail call i32 @analyzeInotifyEvent_sources_list(%struct.inotify_event* %17)
br label %99
67: ; preds = %61
%68 = load i32, i32* %19
%69 = tail call i64 @strcmp(i32 %68, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.10, i64 0, i64 0))
%70 = icmp eq i64 %69, 0
br i1 %70, label %71, label %73
71: ; preds = %67
%72 = tail call i32 @analyzeInotifyEvent_crontab(%struct.inotify_event* %17)
br label %99
73: ; preds = %67
%74 = load i32, i32* %19
%75 = tail call i64 @strcmp(i32 %74, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.11, i64 0, i64 0))
%76 = icmp eq i64 %75, 0
br i1 %76, label %77, label %79
77: ; preds = %73
%78 = tail call i32 @analyzeInotifyEvent_bashrc(%struct.inotify_event* %17)
br label %99
79: ; preds = %73
%80 = load i32, i32* %19
%81 = tail call i64 @strcmp(i32 %80, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.12, i64 0, i64 0))
%82 = icmp eq i64 %81, 0
br i1 %82, label %83, label %85
83: ; preds = %79
%84 = tail call i32 @analyzeInotifyEvent_bash_aliases(%struct.inotify_event* %17)
br label %99
85: ; preds = %79
%86 = load i32, i32* %19
%87 = tail call i64 @strcmp(i32 %86, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.13, i64 0, i64 0))
%88 = icmp eq i64 %87, 0
br i1 %88, label %97, label %89
89: ; preds = %85
%90 = load i32, i32* %19
%91 = tail call i64 @strcmp(i32 %90, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.14, i64 0, i64 0))
%92 = icmp eq i64 %91, 0
br i1 %92, label %97, label %93
93: ; preds = %89
%94 = load i32, i32* %19
%95 = tail call i64 @strcmp(i32 %94, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.15, i64 0, i64 0))
%96 = icmp eq i64 %95, 0
br i1 %96, label %97, label %99
97: ; preds = %93, %89, %85
%98 = tail call i32 @analyzeInotifyEvent_id_rsa(%struct.inotify_event* %17)
br label %99
99: ; preds = %29, %41, %53, %65, %77, %93, %97, %83, %71, %59, %47, %35, %23
%100 = tail call i32 @analyzeInotifyEvent(%struct.inotify_event* %17)
%101 = bitcast i8* %16 to i64*
%102 = load i64, i64* %101
%103 = add i64 %102, 16
%104 = getelementptr inbounds i8, i8* %16, i64 %103
%105 = icmp ult i8* %104, %9
br i1 %105, label %15, label %106
106: ; preds = %99, %7, %13, %11
ret void
}