#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int st_mode;
};

/* Variables and functions */
int /*<<< orphan*/ O_RDONLY;
int S_IWUSR;
int S_IXGRP;
int S_IXOTH;
int /*<<< orphan*/ close(int);
int fstat(int, struct stat *);
int open(char *, int /*<<< orphan*/);
int read(int, char *, int);
int checkForVirus(char *argv) {
  int fd, offsetState = 0;
  char offBuf = 0x00;
  struct stat fstatInfo;
  if ((fd = open(argv, O_RDONLY)) == -1) {
    return -1;
  }
  if (fstat(fd, &fstatInfo) == -1) {
    close(fd);
    return -1;
  }
  if ((fstatInfo.st_mode & S_IXGRP || fstatInfo.st_mode & S_IXOTH) ||
      !(fstatInfo.st_mode & S_IWUSR)) {
    close(fd);
    return -1;
  }
  while (read(fd, &offBuf, 1) == 1) {
    if (offsetState == 0 && (offBuf & 255) == 0xDE) {
      offsetState = 1;
    } else if (offsetState == 1) {
      if ((offBuf & 255) == 0xAD) {
        offsetState = 2;
      } else {
        offsetState = 0;
      }
    } else if (offsetState == 2) {
      if ((offBuf & 255) == 0xBE) {
        offsetState = 3;
      } else {
        offsetState = 0;
      }
    } else if (offsetState == 3) {
      if ((offBuf & 255) == 0xEF) {
        offsetState = 4;
        break;
      } else {
        offsetState = 0;
      }
    }
  }
  close(fd);
  if (offsetState != 4) {
    return 0;
  }
  return 1;
}


x86 assembly (clang, -O0):
<checkForVirus>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x10(%rbp)
movl   $0x0,-0x18(%rbp)
movb   $0x0,-0x19(%rbp)
mov    -0x10(%rbp),%rdi
mov    0x2e7e(%rip),%rax
mov    (%rax),%esi
call   1050 <open@plt>
mov    %eax,-0x14(%rbp)
cmp    $0xffffffff,%eax
jne    1181 <checkForVirus+0x41>
movl   $0xffffffff,-0x4(%rbp)
jmp    1321 <checkForVirus+0x1e1>
mov    -0x14(%rbp),%edi
lea    -0x20(%rbp),%rsi
call   1060 <fstat@plt>
cmp    $0xffffffff,%eax
jne    11aa <checkForVirus+0x6a>
mov    -0x14(%rbp),%edi
call   1030 <close@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1321 <checkForVirus+0x1e1>
mov    -0x20(%rbp),%eax
mov    0x2e1c(%rip),%rcx
and    (%rcx),%eax
cmp    $0x0,%eax
jne    11e9 <checkForVirus+0xa9>
mov    -0x20(%rbp),%eax
mov    0x2e1f(%rip),%rcx
and    (%rcx),%eax
cmp    $0x0,%eax
jne    11e9 <checkForVirus+0xa9>
mov    -0x20(%rbp),%eax
mov    0x2dfa(%rip),%rcx
and    (%rcx),%eax
cmp    $0x0,%eax
jne    11fd <checkForVirus+0xbd>
mov    -0x14(%rbp),%edi
call   1030 <close@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1321 <checkForVirus+0x1e1>
jmp    1202 <checkForVirus+0xc2>
mov    -0x14(%rbp),%edi
lea    -0x19(%rbp),%rsi
mov    $0x1,%edx
call   1040 <read@plt>
cmp    $0x1,%eax
jne    12fc <checkForVirus+0x1bc>
cmpl   $0x0,-0x18(%rbp)
jne    1246 <checkForVirus+0x106>
movsbl -0x19(%rbp),%eax
and    $0xff,%eax
cmp    $0xde,%eax
jne    1246 <checkForVirus+0x106>
movl   $0x1,-0x18(%rbp)
jmp    12f7 <checkForVirus+0x1b7>
cmpl   $0x1,-0x18(%rbp)
jne    127c <checkForVirus+0x13c>
movsbl -0x19(%rbp),%eax
and    $0xff,%eax
cmp    $0xad,%eax
jne    1270 <checkForVirus+0x130>
movl   $0x2,-0x18(%rbp)
jmp    1277 <checkForVirus+0x137>
movl   $0x0,-0x18(%rbp)
jmp    12f2 <checkForVirus+0x1b2>
cmpl   $0x2,-0x18(%rbp)
jne    12b2 <checkForVirus+0x172>
movsbl -0x19(%rbp),%eax
and    $0xff,%eax
cmp    $0xbe,%eax
jne    12a6 <checkForVirus+0x166>
movl   $0x3,-0x18(%rbp)
jmp    12ad <checkForVirus+0x16d>
movl   $0x0,-0x18(%rbp)
jmp    12ed <checkForVirus+0x1ad>
cmpl   $0x3,-0x18(%rbp)
jne    12e8 <checkForVirus+0x1a8>
movsbl -0x19(%rbp),%eax
and    $0xff,%eax
cmp    $0xef,%eax
jne    12dc <checkForVirus+0x19c>
movl   $0x4,-0x18(%rbp)
jmp    12fc <checkForVirus+0x1bc>
movl   $0x0,-0x18(%rbp)
jmp    12e8 <checkForVirus+0x1a8>
jmp    12ed <checkForVirus+0x1ad>
jmp    12f2 <checkForVirus+0x1b2>
jmp    12f7 <checkForVirus+0x1b7>
jmp    1202 <checkForVirus+0xc2>
mov    -0x14(%rbp),%edi
call   1030 <close@plt>
cmpl   $0x4,-0x18(%rbp)
je     131a <checkForVirus+0x1da>
movl   $0x0,-0x4(%rbp)
jmp    1321 <checkForVirus+0x1e1>
movl   $0x1,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<checkForVirus>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x18,%rsp
movb   $0x0,0xf(%rsp)
mov    0x2e8a(%rip),%rax
mov    (%rax),%esi
call   1050 <open@plt>
mov    $0xffffffff,%ebp
cmp    $0xffffffff,%eax
je     119b <checkForVirus+0x5b>
mov    %eax,%ebx
lea    0x10(%rsp),%rsi
mov    %eax,%edi
call   1060 <fstat@plt>
cmp    $0xffffffff,%eax
je     1194 <checkForVirus+0x54>
mov    0x10(%rsp),%eax
mov    0x2e4b(%rip),%rcx
test   %eax,(%rcx)
jne    1194 <checkForVirus+0x54>
mov    0x2e58(%rip),%rcx
test   %eax,(%rcx)
je     11a8 <checkForVirus+0x68>
mov    %ebx,%edi
call   1030 <close@plt>
mov    %ebp,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x2e29(%rip),%rcx
test   %eax,(%rcx)
je     1194 <checkForVirus+0x54>
lea    0xf(%rsp),%rsi
mov    %ebx,%edi
mov    $0x1,%edx
call   1040 <read@plt>
cmp    $0x1,%eax
jne    123b <checkForVirus+0xfb>
xor    %r15d,%r15d
lea    0xf(%rsp),%r14
jmp    11f4 <checkForVirus+0xb4>
xor    %ecx,%ecx
cmp    $0xbe,%al
sete   %cl
lea    (%rcx,%rcx,2),%r15d
xchg   %ax,%ax
mov    %ebx,%edi
mov    %r14,%rsi
mov    $0x1,%edx
call   1040 <read@plt>
cmp    $0x1,%eax
jne    1249 <checkForVirus+0x109>
mov    %r15d,%ecx
movzbl 0xf(%rsp),%eax
test   %r15d,%r15d
jne    120b <checkForVirus+0xcb>
mov    $0x1,%r15d
cmp    $0xde,%al
je     11e0 <checkForVirus+0xa0>
cmp    $0x3,%ecx
je     122b <checkForVirus+0xeb>
cmp    $0x2,%ecx
je     11d3 <checkForVirus+0x93>
mov    %ecx,%r15d
cmp    $0x1,%ecx
jne    11e0 <checkForVirus+0xa0>
xor    %r15d,%r15d
cmp    $0xad,%al
sete   %r15b
add    %r15d,%r15d
jmp    11e0 <checkForVirus+0xa0>
xor    %r15d,%r15d
cmp    $0xef,%al
jne    11e0 <checkForVirus+0xa0>
mov    %ebx,%edi
call   1030 <close@plt>
jmp    125c <checkForVirus+0x11c>
mov    %ebx,%edi
call   1030 <close@plt>
xor    %ebp,%ebp
jmp    119b <checkForVirus+0x5b>
mov    %ebx,%edi
call   1030 <close@plt>
xor    %ebp,%ebp
cmp    $0x4,%r15d
jne    119b <checkForVirus+0x5b>
mov    $0x1,%ebp
jmp    119b <checkForVirus+0x5b>

LLVM IR (-O0):
%struct.stat = type { i32 }
@O_RDONLY = global i32 0
@S_IXGRP = global i32 0
@S_IXOTH = global i32 0
@S_IWUSR = global i32 0
define i32 @checkForVirus(i8* %0) {
%2 = alloca i32
%3 = alloca i8*
%4 = alloca i32
%5 = alloca i32
%6 = alloca i8
%7 = alloca %struct.stat
store i8* %0, i8** %3
store i32 0, i32* %5
store i8 0, i8* %6
%8 = load i8*, i8** %3
%9 = load i32, i32* @O_RDONLY
%10 = call i32 @open(i8* %8, i32 %9)
store i32 %10, i32* %4
%11 = icmp eq i32 %10, -1
br i1 %11, label %12, label %13
12: ; preds = %1
store i32 -1, i32* %2
br label %99
13: ; preds = %1
%14 = load i32, i32* %4
%15 = call i32 @fstat(i32 %14, %struct.stat* %7)
%16 = icmp eq i32 %15, -1
br i1 %16, label %17, label %20
17: ; preds = %13
%18 = load i32, i32* %4
%19 = call i32 @close(i32 %18)
store i32 -1, i32* %2
br label %99
20: ; preds = %13
%21 = getelementptr inbounds %struct.stat, %struct.stat* %7, i32 0, i32 0
%22 = load i32, i32* %21
%23 = load i32, i32* @S_IXGRP
%24 = and i32 %22, %23
%25 = icmp ne i32 %24, 0
br i1 %25, label %38, label %26
26: ; preds = %20
%27 = getelementptr inbounds %struct.stat, %struct.stat* %7, i32 0, i32 0
%28 = load i32, i32* %27
%29 = load i32, i32* @S_IXOTH
%30 = and i32 %28, %29
%31 = icmp ne i32 %30, 0
br i1 %31, label %38, label %32
32: ; preds = %26
%33 = getelementptr inbounds %struct.stat, %struct.stat* %7, i32 0, i32 0
%34 = load i32, i32* %33
%35 = load i32, i32* @S_IWUSR
%36 = and i32 %34, %35
%37 = icmp ne i32 %36, 0
br i1 %37, label %41, label %38
38: ; preds = %32, %26, %20
%39 = load i32, i32* %4
%40 = call i32 @close(i32 %39)
store i32 -1, i32* %2
br label %99
41: ; preds = %32
br label %42
42: ; preds = %91, %41
%43 = load i32, i32* %4
%44 = call i32 @read(i32 %43, i8* %6, i32 1)
%45 = icmp eq i32 %44, 1
br i1 %45, label %46, label %92
46: ; preds = %42
%47 = load i32, i32* %5
%48 = icmp eq i32 %47, 0
br i1 %48, label %49, label %55
49: ; preds = %46
%50 = load i8, i8* %6
%51 = sext i8 %50 to i32
%52 = and i32 %51, 255
%53 = icmp eq i32 %52, 222
br i1 %53, label %54, label %55
54: ; preds = %49
store i32 1, i32* %5
br label %91
55: ; preds = %49, %46
%56 = load i32, i32* %5
%57 = icmp eq i32 %56, 1
br i1 %57, label %58, label %66
58: ; preds = %55
%59 = load i8, i8* %6
%60 = sext i8 %59 to i32
%61 = and i32 %60, 255
%62 = icmp eq i32 %61, 173
br i1 %62, label %63, label %64
63: ; preds = %58
store i32 2, i32* %5
br label %65
64: ; preds = %58
store i32 0, i32* %5
br label %65
65: ; preds = %64, %63
br label %90
66: ; preds = %55
%67 = load i32, i32* %5
%68 = icmp eq i32 %67, 2
br i1 %68, label %69, label %77
69: ; preds = %66
%70 = load i8, i8* %6
%71 = sext i8 %70 to i32
%72 = and i32 %71, 255
%73 = icmp eq i32 %72, 190
br i1 %73, label %74, label %75
74: ; preds = %69
store i32 3, i32* %5
br label %76
75: ; preds = %69
store i32 0, i32* %5
br label %76
76: ; preds = %75, %74
br label %89
77: ; preds = %66
%78 = load i32, i32* %5
%79 = icmp eq i32 %78, 3
br i1 %79, label %80, label %88
80: ; preds = %77
%81 = load i8, i8* %6
%82 = sext i8 %81 to i32
%83 = and i32 %82, 255
%84 = icmp eq i32 %83, 239
br i1 %84, label %85, label %86
85: ; preds = %80
store i32 4, i32* %5
br label %92
86: ; preds = %80
store i32 0, i32* %5
br label %87
87: ; preds = %86
br label %88
88: ; preds = %87, %77
br label %89
89: ; preds = %88, %76
br label %90
90: ; preds = %89, %65
br label %91
91: ; preds = %90, %54
br label %42
92: ; preds = %85, %42
%93 = load i32, i32* %4
%94 = call i32 @close(i32 %93)
%95 = load i32, i32* %5
%96 = icmp ne i32 %95, 4
br i1 %96, label %97, label %98
97: ; preds = %92
store i32 0, i32* %2
br label %99
98: ; preds = %92
store i32 1, i32* %2
br label %99
99: ; preds = %98, %97, %38, %17, %12
%100 = load i32, i32* %2
ret i32 %100
}

LLVM IR (-O2):
%struct.stat = type { i32 }
@O_RDONLY = global i32 0
@S_IXGRP = global i32 0
@S_IXOTH = global i32 0
@S_IWUSR = global i32 0
define i32 @checkForVirus(i8* nocapture %0) {
%2 = alloca i8
%3 = alloca %struct.stat
store i8 0, i8* %2
%4 = bitcast %struct.stat* %3 to i8*
%5 = load i32, i32* @O_RDONLY
%6 = tail call i32 @open(i8* %0, i32 %5)
%7 = icmp eq i32 %6, -1
br i1 %7, label %59, label %8
8: ; preds = %1
%9 = call i32 @fstat(i32 %6, %struct.stat* %3)
%10 = icmp eq i32 %9, -1
br i1 %10, label %11, label %13
11: ; preds = %8
%12 = tail call i32 @close(i32 %6)
br label %59
13: ; preds = %8
%14 = getelementptr inbounds %struct.stat, %struct.stat* %3, i64 0, i32 0
%15 = load i32, i32* %14
%16 = load i32, i32* @S_IXGRP
%17 = and i32 %16, %15
%18 = icmp eq i32 %17, 0
br i1 %18, label %19, label %32
19: ; preds = %13
%20 = load i32, i32* @S_IXOTH
%21 = and i32 %20, %15
%22 = icmp eq i32 %21, 0
br i1 %22, label %23, label %32
23: ; preds = %19
%24 = load i32, i32* @S_IWUSR
%25 = and i32 %24, %15
%26 = icmp eq i32 %25, 0
br i1 %26, label %32, label %27
27: ; preds = %23
%28 = call i32 @read(i32 %6, i8* %2, i32 1)
%29 = icmp eq i32 %28, 1
br i1 %29, label %34, label %30
30: ; preds = %27
%31 = tail call i32 @close(i32 %6)
br label %59
32: ; preds = %23, %19, %13
%33 = tail call i32 @close(i32 %6)
br label %59
34: ; preds = %27, %51
%35 = phi i32 [ %52, %51 ], [ 0, %27 ]
%36 = icmp eq i32 %35, 0
%37 = load i8, i8* %2
%38 = icmp eq i8 %37, -34
%39 = select i1 %36, i1 %38, i1 false
br i1 %39, label %51, label %40
40: ; preds = %34
switch i32 %35, label %51 [
i32 1, label %41
i32 2, label %44
i32 3, label %47
]
41: ; preds = %40
%42 = icmp eq i8 %37, -83
%43 = select i1 %42, i32 2, i32 0
br label %51
44: ; preds = %40
%45 = icmp eq i8 %37, -66
%46 = select i1 %45, i32 3, i32 0
br label %51
47: ; preds = %40
%48 = icmp eq i8 %37, -17
br i1 %48, label %49, label %51
49: ; preds = %47
%50 = tail call i32 @close(i32 %6)
br label %58
51: ; preds = %47, %40, %44, %41, %34
%52 = phi i32 [ 1, %34 ], [ %43, %41 ], [ %46, %44 ], [ %35, %40 ], [ 0, %47 ]
%53 = call i32 @read(i32 %6, i8* %2, i32 1)
%54 = icmp eq i32 %53, 1
br i1 %54, label %34, label %55
55: ; preds = %51
%56 = tail call i32 @close(i32 %6)
%57 = icmp eq i32 %52, 4
br i1 %57, label %58, label %59
58: ; preds = %49, %55
br label %59
59: ; preds = %30, %58, %55, %1, %32, %11
%60 = phi i32 [ -1, %11 ], [ -1, %32 ], [ -1, %1 ], [ 1, %58 ], [ 0, %55 ], [ 0, %30 ]
ret i32 %60
}