#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint64_t;
typedef int /*<<< orphan*/ uint32_t;

/* Variables and functions */
int /*<<< orphan*/ __NR_clone;
int /*<<< orphan*/ __NR_perf_event_open;
int /*<<< orphan*/ __NR_sendmsg;
int /*<<< orphan*/ memcpy(void *, char *, int);
int /*<<< orphan*/ syscall(int /*<<< orphan*/, unsigned long, unsigned long,
                           int, ...);
int /*<<< orphan*/ syz_usb_connect(int /*<<< orphan*/, int, int,
                                   int /*<<< orphan*/);
void execute_call(int call) {
  switch (call) {
  case 0:
    *(uint64_t *)0x20002800 = 0;
    *(uint32_t *)0x20002808 = 0;
    *(uint64_t *)0x20002810 = 0x200006c0;
    *(uint64_t *)0x200006c0 = 0x20000000;
    memcpy((void *)0x20000000,
           "\x34\x00\x00\x00\x10\x00\x00\x00\x21\x00\x00\x00\x00\x00\x00\x00"
           "\x00\x00\x00\x00",
           20);
    *(uint32_t *)0x20000014 = 0;
    memcpy((void *)0x20000018,
           "\x00\x00\x00\x00\x00\x00\x00\x00\x0d\x00\x12\x80\x09\x00\x01\x00"
           "\x69\x70\x69\x70\x00\x00\x00\x00\x04\x00\x02\x80",
           28);
    *(uint64_t *)0x200006c8 = 0x34;
    *(uint64_t *)0x20002818 = 1;
    *(uint64_t *)0x20002820 = 0;
    *(uint64_t *)0x20002828 = 0;
    *(uint32_t *)0x20002830 = 0;
    syscall(__NR_sendmsg, -1, 0x20002800ul, 0ul);
    break;
  case 1:
    memcpy(
        (void *)0x20000000,
        "\x12\x01\x00\x00\xc4\x81\xbf\x08\x4c\x05\xe1\x02\x01\xb4\x00\x00\x00"
        "\x01\x09\x02\x24\x00\x01\x00\x00\x00\x00\x09\x04\x00\x00\x02\x00\x00"
        "\x00\x00\x09\x05\x09\x02\x00\xfa\xff\xff\xff\x09\x05\x82\x02",
        49);
    syz_usb_connect(0, 0x36, 0x20000000, 0);
    break;
  case 2:
    syscall(__NR_perf_event_open, 0ul, 0, 0ul, -1, 0ul);
    break;
  case 3:
    syscall(__NR_clone, 0ul, 0ul, 0x9999999999999999ul, 0ul, -1ul);
    break;
  }
}


x86 assembly (clang, -O0):
<execute_call>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %edi,-0x4(%rbp)
mov    -0x4(%rbp),%eax
mov    %rax,-0x10(%rbp)
sub    $0x3,%rax
ja     129a <execute_call+0x16a>
mov    -0x10(%rbp),%rax
lea    0xea9(%rip),%rcx
movslq (%rcx,%rax,4),%rax
add    %rcx,%rax
jmp    *%rax
mov    $0x20002800,%eax
movl   $0x0,(%rax)
mov    $0x20002808,%eax
movl   $0x0,(%rax)
mov    $0x20002810,%eax
movl   $0x200006c0,(%rax)
mov    $0x200006c0,%eax
movl   $0x20000000,(%rax)
lea    0xe7d(%rip),%rsi
mov    $0x20000000,%edi
mov    $0x14,%edx
call   1050 <memcpy@plt>
mov    $0x20000014,%eax
movl   $0x0,(%rax)
lea    0xe71(%rip),%rsi
mov    $0x20000018,%edi
mov    $0x1c,%edx
call   1050 <memcpy@plt>
mov    $0x200006c8,%eax
movl   $0x34,(%rax)
mov    $0x20002818,%eax
movl   $0x1,(%rax)
mov    $0x20002820,%eax
movl   $0x0,(%rax)
mov    $0x20002828,%eax
movl   $0x0,(%rax)
mov    $0x20002830,%eax
movl   $0x0,(%rax)
mov    0x2df7(%rip),%rax
mov    (%rax),%edi
mov    $0xffffffffffffffff,%rsi
mov    $0x20002800,%edx
xor    %ecx,%ecx
mov    $0x0,%al
call   1040 <syscall@plt>
jmp    129a <execute_call+0x16a>
lea    0xe1e(%rip),%rsi
mov    $0x20000000,%edi
mov    $0x31,%edx
call   1050 <memcpy@plt>
xor    %ecx,%ecx
mov    $0x36,%esi
mov    $0x20000000,%edx
mov    %ecx,%edi
call   1030 <syz_usb_connect@plt>
jmp    129a <execute_call+0x16a>
mov    0x2d7e(%rip),%rax
mov    (%rax),%edi
xor    %eax,%eax
mov    %eax,%r9d
xor    %ecx,%ecx
mov    $0xffffffff,%r8d
mov    %r9,%rsi
mov    %r9,%rdx
mov    $0x0,%al
call   1040 <syscall@plt>
jmp    129a <execute_call+0x16a>
mov    0x2d6e(%rip),%rax
mov    (%rax),%edi
xor    %eax,%eax
mov    %eax,%r8d
mov    $0x99999999,%ecx
mov    $0xffffffffffffffff,%r9
mov    %r8,%rsi
mov    %r8,%rdx
mov    $0x0,%al
call   1040 <syscall@plt>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<execute_call>:
push   %rax
cmp    $0x3,%edi
ja     1206 <execute_call+0xd6>
mov    %edi,%eax
lea    0xebd(%rip),%rcx
movslq (%rcx,%rax,4),%rax
add    %rcx,%rax
jmp    *%rax
movl   $0x0,0x20002800
movl   $0x0,0x20002808
movl   $0x200006c0,0x20002810
movl   $0x20000000,0x200006c0
lea    0xe91(%rip),%rsi
mov    $0x20000000,%edi
mov    $0x14,%edx
call   1050 <memcpy@plt>
movl   $0x0,0x20000014
lea    0xe85(%rip),%rsi
mov    $0x20000018,%edi
mov    $0x1c,%edx
call   1050 <memcpy@plt>
movl   $0x34,0x200006c8
movl   $0x1,0x20002818
movl   $0x0,0x20002820
movl   $0x0,0x20002828
movl   $0x0,0x20002830
mov    0x2e0b(%rip),%rax
mov    (%rax),%edi
mov    $0x20002800,%edx
mov    $0xffffffffffffffff,%rsi
xor    %ecx,%ecx
xor    %eax,%eax
pop    %r8
jmp    1040 <syscall@plt>
pop    %rax
ret
lea    0xe33(%rip),%rsi
mov    $0x20000000,%edi
mov    $0x31,%edx
call   1050 <memcpy@plt>
xor    %edi,%edi
mov    $0x36,%esi
mov    $0x20000000,%edx
xor    %ecx,%ecx
pop    %rax
jmp    1030 <syz_usb_connect@plt>
mov    0x2d97(%rip),%rax
mov    (%rax),%edi
xor    %esi,%esi
xor    %edx,%edx
xor    %ecx,%ecx
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
xor    %eax,%eax
pop    %r11
jmp    1040 <syscall@plt>
mov    0x2d8e(%rip),%rax
mov    (%rax),%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x99999999,%ecx
xor    %r8d,%r8d
mov    $0xffffffffffffffff,%r9
xor    %eax,%eax
pop    %r11
jmp    1040 <syscall@plt>

LLVM IR (-O0):
@.str = [21 x i8] c"4\00\00\00\10\00\00\00!\00\00\00\00\00\00\00\00\00\00\00\00"
@.str.1 = [29 x i8] c"\00\00\00\00\00\00\00\00\0D\00\12\80\09\00\01\00ipip\00\00\00\00\04\00\02\80\00"
@__NR_sendmsg = global i32 0
@.str.2 = [50 x i8] c"\12\01\00\00\C4\81\BF\08L\05\E1\02\01\B4\00\00\00\01\09\02$\00\01\00\00\00\00\09\04\00\00\02\00\00\00\00\09\05\09\02\00\FA\FF\FF\FF\09\05\82\02\00"
@__NR_perf_event_open = global i32 0
@__NR_clone = global i32 0
define void @execute_call(i32 %0) {
%2 = alloca i32
store i32 %0, i32* %2
%3 = load i32, i32* %2
switch i32 %3, label %18 [
i32 0, label %4
i32 1, label %9
i32 2, label %12
i32 3, label %15
]
4: ; preds = %1
store i32 0, i32* inttoptr (i64 536881152 to i32*)
store i32 0, i32* inttoptr (i64 536881160 to i32*)
store i32 536872640, i32* inttoptr (i64 536881168 to i32*)
store i32 536870912, i32* inttoptr (i64 536872640 to i32*)
%5 = call i32 @memcpy(i8* inttoptr (i64 536870912 to i8*), i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str, i64 0, i64 0), i32 20)
store i32 0, i32* inttoptr (i64 536870932 to i32*)
%6 = call i32 @memcpy(i8* inttoptr (i64 536870936 to i8*), i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0), i32 28)
store i32 52, i32* inttoptr (i64 536872648 to i32*)
store i32 1, i32* inttoptr (i64 536881176 to i32*)
store i32 0, i32* inttoptr (i64 536881184 to i32*)
store i32 0, i32* inttoptr (i64 536881192 to i32*)
store i32 0, i32* inttoptr (i64 536881200 to i32*)
%7 = load i32, i32* @__NR_sendmsg
%8 = call i32 (i32, i64, i64, i32, ...) @syscall(i32 %7, i64 -1, i64 536881152, i32 0)
br label %18
9: ; preds = %1
%10 = call i32 @memcpy(i8* inttoptr (i64 536870912 to i8*), i8* getelementptr inbounds ([50 x i8], [50 x i8]* @.str.2, i64 0, i64 0), i32 49)
%11 = call i32 @syz_usb_connect(i32 0, i32 54, i32 536870912, i32 0)
br label %18
12: ; preds = %1
%13 = load i32, i32* @__NR_perf_event_open
%14 = call i32 (i32, i64, i64, i32, ...) @syscall(i32 %13, i64 0, i64 0, i32 0, i32 -1, i64 0)
br label %18
15: ; preds = %1
%16 = load i32, i32* @__NR_clone
%17 = call i32 (i32, i64, i64, i32, ...) @syscall(i32 %16, i64 0, i64 0, i32 -1717986919, i64 0, i64 -1)
br label %18
18: ; preds = %1, %15, %12, %9, %4
ret void
}

LLVM IR (-O2):
@.str = [21 x i8] c"4\00\00\00\10\00\00\00!\00\00\00\00\00\00\00\00\00\00\00\00"
@.str.1 = [29 x i8] c"\00\00\00\00\00\00\00\00\0D\00\12\80\09\00\01\00ipip\00\00\00\00\04\00\02\80\00"
@__NR_sendmsg = global i32 0
@.str.2 = [50 x i8] c"\12\01\00\00\C4\81\BF\08L\05\E1\02\01\B4\00\00\00\01\09\02$\00\01\00\00\00\00\09\04\00\00\02\00\00\00\00\09\05\09\02\00\FA\FF\FF\FF\09\05\82\02\00"
@__NR_perf_event_open = global i32 0
@__NR_clone = global i32 0
define void @execute_call(i32 %0) {
switch i32 %0, label %16 [
i32 0, label %2
i32 1, label %7
i32 2, label %10
i32 3, label %13
]
2: ; preds = %1
store i32 0, i32* inttoptr (i64 536881152 to i32*)
store i32 0, i32* inttoptr (i64 536881160 to i32*)
store i32 536872640, i32* inttoptr (i64 536881168 to i32*)
store i32 536870912, i32* inttoptr (i64 536872640 to i32*)
%3 = tail call i32 @memcpy(i8* inttoptr (i64 536870912 to i8*), i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str, i64 0, i64 0), i32 20)
store i32 0, i32* inttoptr (i64 536870932 to i32*)
%4 = tail call i32 @memcpy(i8* inttoptr (i64 536870936 to i8*), i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0), i32 28)
store i32 52, i32* inttoptr (i64 536872648 to i32*)
store i32 1, i32* inttoptr (i64 536881176 to i32*)
store i32 0, i32* inttoptr (i64 536881184 to i32*)
store i32 0, i32* inttoptr (i64 536881192 to i32*)
store i32 0, i32* inttoptr (i64 536881200 to i32*)
%5 = load i32, i32* @__NR_sendmsg
%6 = tail call i32 (i32, i64, i64, i32, ...) @syscall(i32 %5, i64 -1, i64 536881152, i32 0)
br label %16
7: ; preds = %1
%8 = tail call i32 @memcpy(i8* inttoptr (i64 536870912 to i8*), i8* getelementptr inbounds ([50 x i8], [50 x i8]* @.str.2, i64 0, i64 0), i32 49)
%9 = tail call i32 @syz_usb_connect(i32 0, i32 54, i32 536870912, i32 0)
br label %16
10: ; preds = %1
%11 = load i32, i32* @__NR_perf_event_open
%12 = tail call i32 (i32, i64, i64, i32, ...) @syscall(i32 %11, i64 0, i64 0, i32 0, i32 -1, i64 0)
br label %16
13: ; preds = %1
%14 = load i32, i32* @__NR_clone
%15 = tail call i32 (i32, i64, i64, i32, ...) @syscall(i32 %14, i64 0, i64 0, i32 -1717986919, i64 0, i64 -1)
br label %16
16: ; preds = %1, %13, %10, %7, %2
ret void
}