#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ SetGUIRequestMode(int);
int /*<<< orphan*/ bmp_fill(int, int /*<<< orphan*/, int /*<<< orphan*/, int,
                            int);
int /*<<< orphan*/ bmp_printf(int, int /*<<< orphan*/, int /*<<< orphan*/,
                              char *);
int /*<<< orphan*/ gui_uilock(int);
int /*<<< orphan*/ msleep(int);
void hook_on_canon_menu() {
  gui_uilock(0x4100017f);
  if ((*(int *)0x7768C) != 2) {
    SetGUIRequestMode(2);
    for (int i = 0; i < 10; i++) {
      msleep(100);
      bmp_fill(0x02, 0, 0, 720, 480);
      bmp_printf((0 | (((4) << 16) & (0xFFFF0000)) | ((0) & 0xFF) << 8 |
                  ((0) & 0xFF) << 0),
                 0, 0, "Magic Lantern install");
    }
  } else {
    bmp_fill(0x02, 0, 0, 720, 480);
  }
}


x86 assembly (clang, -O0):
<hook_on_canon_menu>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    $0x4100017f,%edi
call   1040 <gui_uilock@plt>
mov    $0x7768c,%eax
cmpl   $0x2,(%rax)
je     11d6 <hook_on_canon_menu+0x86>
mov    $0x2,%edi
call   1070 <SetGUIRequestMode@plt>
movl   $0x0,-0x4(%rbp)
cmpl   $0xa,-0x4(%rbp)
jge    11d1 <hook_on_canon_menu+0x81>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
mov    %edx,%esi
call   1050 <bmp_fill@plt>
mov    $0x40000,%edi
xor    %edx,%edx
lea    0xe44(%rip),%rcx
mov    %edx,%esi
call   1030 <bmp_printf@plt>
mov    -0x4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x4(%rbp)
jmp    1181 <hook_on_canon_menu+0x31>
jmp    11ef <hook_on_canon_menu+0x9f>
mov    $0x2,%edi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
mov    %edx,%esi
call   1050 <bmp_fill@plt>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<hook_on_canon_menu>:
push   %rbx
mov    $0x4100017f,%edi
call   1040 <gui_uilock@plt>
cmpl   $0x2,0x7768c
02
jne    117f <hook_on_canon_menu+0x2f>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
pop    %rbx
jmp    1050 <bmp_fill@plt>
mov    $0x2,%edi
call   1070 <SetGUIRequestMode@plt>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
call   1050 <bmp_fill@plt>
lea    0xe4d(%rip),%rbx
mov    $0x40000,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    %rbx,%rcx
call   1030 <bmp_printf@plt>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
call   1050 <bmp_fill@plt>
mov    $0x40000,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    %rbx,%rcx
call   1030 <bmp_printf@plt>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
call   1050 <bmp_fill@plt>
mov    $0x40000,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    %rbx,%rcx
call   1030 <bmp_printf@plt>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
call   1050 <bmp_fill@plt>
mov    $0x40000,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    %rbx,%rcx
call   1030 <bmp_printf@plt>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
call   1050 <bmp_fill@plt>
mov    $0x40000,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    %rbx,%rcx
call   1030 <bmp_printf@plt>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
call   1050 <bmp_fill@plt>
mov    $0x40000,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    %rbx,%rcx
call   1030 <bmp_printf@plt>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
call   1050 <bmp_fill@plt>
mov    $0x40000,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    %rbx,%rcx
call   1030 <bmp_printf@plt>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
call   1050 <bmp_fill@plt>
mov    $0x40000,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    %rbx,%rcx
call   1030 <bmp_printf@plt>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
call   1050 <bmp_fill@plt>
mov    $0x40000,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    %rbx,%rcx
call   1030 <bmp_printf@plt>
mov    $0x64,%edi
call   1060 <msleep@plt>
mov    $0x2,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    $0x2d0,%ecx
mov    $0x1e0,%r8d
call   1050 <bmp_fill@plt>
mov    $0x40000,%edi
xor    %esi,%esi
xor    %edx,%edx
mov    %rbx,%rcx
pop    %rbx
jmp    1030 <bmp_printf@plt>

LLVM IR (-O0):
@.str = [22 x i8] c"Magic Lantern install\00"
define void @hook_on_canon_menu() {
%1 = alloca i32
%2 = call i32 @gui_uilock(i32 1090519423)
%3 = load i32, i32* inttoptr (i64 489100 to i32*)
%4 = icmp ne i32 %3, 2
br i1 %4, label %5, label %18
5: ; preds = %0
%6 = call i32 @SetGUIRequestMode(i32 2)
store i32 0, i32* %1
br label %7
7: ; preds = %14, %5
%8 = load i32, i32* %1
%9 = icmp slt i32 %8, 10
br i1 %9, label %10, label %17
10: ; preds = %7
%11 = call i32 @msleep(i32 100)
%12 = call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%13 = call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
br label %14
14: ; preds = %10
%15 = load i32, i32* %1
%16 = add nsw i32 %15, 1
store i32 %16, i32* %1
br label %7
17: ; preds = %7
br label %20
18: ; preds = %0
%19 = call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
br label %20
20: ; preds = %18, %17
ret void
}

LLVM IR (-O2):
@.str = [22 x i8] c"Magic Lantern install\00"
define void @hook_on_canon_menu() {
%1 = tail call i32 @gui_uilock(i32 1090519423)
%2 = load i32, i32* inttoptr (i64 489100 to i32*)
%3 = icmp eq i32 %2, 2
br i1 %3, label %36, label %4
4: ; preds = %0
%5 = tail call i32 @SetGUIRequestMode(i32 2)
%6 = tail call i32 @msleep(i32 100)
%7 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%8 = tail call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%9 = tail call i32 @msleep(i32 100)
%10 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%11 = tail call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%12 = tail call i32 @msleep(i32 100)
%13 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%14 = tail call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%15 = tail call i32 @msleep(i32 100)
%16 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%17 = tail call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%18 = tail call i32 @msleep(i32 100)
%19 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%20 = tail call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%21 = tail call i32 @msleep(i32 100)
%22 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%23 = tail call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%24 = tail call i32 @msleep(i32 100)
%25 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%26 = tail call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%27 = tail call i32 @msleep(i32 100)
%28 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%29 = tail call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%30 = tail call i32 @msleep(i32 100)
%31 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%32 = tail call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%33 = tail call i32 @msleep(i32 100)
%34 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
%35 = tail call i32 @bmp_printf(i32 262144, i32 0, i32 0, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
br label %38
36: ; preds = %0
%37 = tail call i32 @bmp_fill(i32 2, i32 0, i32 0, i32 720, i32 480)
br label %38
38: ; preds = %4, %36
ret void
}