#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int get_r_func(int);
int get_r_rd(int);
int get_r_rs(int);
int get_r_rt(int);
scalar_t__ is_conmutative(int);
scalar_t__ is_r_supported(int);
scalar_t__ is_type_r(int);
int /*<<< orphan*/ printf(char *, ...);
int rand();
int replace_instruction(int, int);
int set_r_func(int, int);
int set_r_rs(int, char);
int set_r_rt(int, char);
void analyze_code(int *instructions, int *new_shellcode, int num_inst) {
  int act_inst = 0x00000000;
  char act_rs = 0x00;
  char act_rt = 0x00;
  char act_rd = 0x00;
  for (unsigned volatile int i = 0x00; i < num_inst; i++) {
    act_inst = instructions[i];
    printf("Instruction: 0x%08x with registers -> RS: %d RT: %d RD: %d\n",
           instructions[i], get_r_rs(act_inst), get_r_rt(act_inst),
           get_r_rd(act_inst));
    if (is_type_r(act_inst)) {
      char change_order_regs = rand() % 2;
      char change_instruct = rand() % 2;
      if (is_r_supported(get_r_func(act_inst))) {
        if (change_order_regs) {
          printf("Applying change order registers to: 0x%08x -> ", act_inst);
          if (is_conmutative(get_r_func(act_inst))) {
            act_rs = get_r_rs(act_inst);
            act_rt = get_r_rt(act_inst);
            act_inst = set_r_rs(act_inst, act_rt);
            act_inst = set_r_rt(act_inst, act_rs);
          } else
            printf("Not changed due to lack of conmutative property\n\n");
        }
        if (change_instruct) {
          printf("Applying Sustitute Instruction to: 0x%08x -> ", act_inst);
          if (get_r_func(act_inst) % 2 == 0) {
            printf("Changed by 0x%08x \n",
                   replace_instruction(act_inst, get_r_func(act_inst) + 1));
            act_inst = set_r_func(act_inst, get_r_func(act_inst) + 1);
          } else {
            printf("Changed by 0x%08x \n",
                   set_r_func(act_inst, get_r_func(act_inst) - 1));
            act_inst = set_r_func(act_inst, get_r_func(act_inst) - 1);
          }
        } else
          printf("Any changes kind of changes are applicated to actual "
                 "instruction 0x%08x",
                 act_inst);
        printf("\n\n-------------------------------------------------\n\n");
      }
    }
    new_shellcode[i] = act_inst;
  }
}


x86 assembly (clang, -O0):
<analyze_code>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %edx,-0x14(%rbp)
movl   $0x0,-0x18(%rbp)
movb   $0x0,-0x19(%rbp)
movb   $0x0,-0x1a(%rbp)
movb   $0x0,-0x1b(%rbp)
movl   $0x0,-0x20(%rbp)
mov    -0x20(%rbp),%eax
cmp    -0x14(%rbp),%eax
jae    1443 <analyze_code+0x273>
mov    -0x8(%rbp),%rax
mov    -0x20(%rbp),%ecx
mov    %ecx,%ecx
mov    (%rax,%rcx,4),%eax
mov    %eax,-0x18(%rbp)
mov    -0x8(%rbp),%rax
mov    -0x20(%rbp),%ecx
mov    %ecx,%ecx
mov    (%rax,%rcx,4),%eax
mov    %eax,-0x30(%rbp)
mov    -0x18(%rbp),%edi
call   10e0 <get_r_rs@plt>
mov    %eax,-0x2c(%rbp)
mov    -0x18(%rbp),%edi
call   1090 <get_r_rt@plt>
mov    %eax,-0x28(%rbp)
mov    -0x18(%rbp),%edi
call   1070 <get_r_rd@plt>
mov    -0x30(%rbp),%esi
mov    -0x2c(%rbp),%edx
mov    -0x28(%rbp),%ecx
mov    %eax,%r8d
lea    0xda8(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x18(%rbp),%edi
call   1030 <is_type_r@plt>
cmp    $0x0,%rax
je     1426 <analyze_code+0x256>
mov    $0x0,%al
call   10f0 <rand@plt>
mov    $0x2,%ecx
cltd
idiv   %ecx
mov    %dl,%al
mov    %al,-0x21(%rbp)
mov    $0x0,%al
call   10f0 <rand@plt>
mov    $0x2,%ecx
cltd
idiv   %ecx
mov    %dl,%al
mov    %al,-0x22(%rbp)
mov    -0x18(%rbp),%edi
call   10b0 <get_r_func@plt>
mov    %eax,%edi
call   1060 <is_r_supported@plt>
cmp    $0x0,%rax
je     1421 <analyze_code+0x251>
cmpb   $0x0,-0x21(%rbp)
je     1332 <analyze_code+0x162>
mov    -0x18(%rbp),%esi
lea    0xd76(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x18(%rbp),%edi
call   10b0 <get_r_func@plt>
mov    %eax,%edi
call   1050 <is_conmutative@plt>
cmp    $0x0,%rax
je     131f <analyze_code+0x14f>
mov    -0x18(%rbp),%edi
call   10e0 <get_r_rs@plt>
mov    %al,-0x19(%rbp)
mov    -0x18(%rbp),%edi
call   1090 <get_r_rt@plt>
mov    %al,-0x1a(%rbp)
mov    -0x18(%rbp),%edi
movsbl -0x1a(%rbp),%esi
call   10c0 <set_r_rs@plt>
mov    %eax,-0x18(%rbp)
mov    -0x18(%rbp),%edi
movsbl -0x19(%rbp),%esi
call   1080 <set_r_rt@plt>
mov    %eax,-0x18(%rbp)
jmp    132d <analyze_code+0x15d>
lea    0xd45(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
jmp    1332 <analyze_code+0x162>
cmpb   $0x0,-0x22(%rbp)
je     1402 <analyze_code+0x232>
mov    -0x18(%rbp),%esi
lea    0xd57(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x18(%rbp),%edi
call   10b0 <get_r_func@plt>
mov    $0x2,%ecx
cltd
idiv   %ecx
cmp    $0x0,%edx
jne    13b4 <analyze_code+0x1e4>
mov    -0x18(%rbp),%eax
mov    %eax,-0x38(%rbp)
mov    -0x18(%rbp),%edi
call   10b0 <get_r_func@plt>
mov    -0x38(%rbp),%edi
mov    %eax,%esi
add    $0x1,%esi
call   10a0 <replace_instruction@plt>
mov    %eax,%esi
lea    0xd41(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x18(%rbp),%eax
mov    %eax,-0x34(%rbp)
mov    -0x18(%rbp),%edi
call   10b0 <get_r_func@plt>
mov    -0x34(%rbp),%edi
mov    %eax,%esi
add    $0x1,%esi
call   10d0 <set_r_func@plt>
mov    %eax,-0x18(%rbp)
jmp    13fd <analyze_code+0x22d>
mov    -0x18(%rbp),%eax
mov    %eax,-0x40(%rbp)
mov    -0x18(%rbp),%edi
call   10b0 <get_r_func@plt>
mov    -0x40(%rbp),%edi
mov    %eax,%esi
sub    $0x1,%esi
call   10d0 <set_r_func@plt>
mov    %eax,%esi
lea    0xcf3(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x18(%rbp),%eax
mov    %eax,-0x3c(%rbp)
mov    -0x18(%rbp),%edi
call   10b0 <get_r_func@plt>
mov    -0x3c(%rbp),%edi
mov    %eax,%esi
sub    $0x1,%esi
call   10d0 <set_r_func@plt>
mov    %eax,-0x18(%rbp)
jmp    1413 <analyze_code+0x243>
mov    -0x18(%rbp),%esi
lea    0xcd3(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    0xd0d(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
jmp    1426 <analyze_code+0x256>
mov    -0x18(%rbp),%edx
mov    -0x10(%rbp),%rax
mov    -0x20(%rbp),%ecx
mov    %ecx,%ecx
mov    %edx,(%rax,%rcx,4)
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x20(%rbp)
jmp    11fd <analyze_code+0x2d>
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<analyze_code>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rsi,0x10(%rsp)
movl   $0x0,0x8(%rsp)
mov    0x8(%rsp),%eax
mov    %edx,0xc(%rsp)
cmp    %edx,%eax
jae    13ee <analyze_code+0x20e>
mov    %rdi,%r14
jmp    124d <analyze_code+0x6d>
lea    0xe96(%rip),%rdi
mov    %r12d,%esi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xecd(%rip),%rdi
call   1040 <puts@plt>
mov    0x8(%rsp),%eax
mov    0x10(%rsp),%rcx
mov    %r12d,(%rcx,%rax,4)
addl   $0x1,0x8(%rsp)
mov    0x8(%rsp),%eax
cmp    0xc(%rsp),%eax
jae    13ee <analyze_code+0x20e>
mov    0x8(%rsp),%eax
mov    (%r14,%rax,4),%r12d
mov    0x8(%rsp),%eax
mov    (%r14,%rax,4),%r15d
mov    %r12d,%edi
call   10f0 <get_r_rs@plt>
mov    %eax,%ebx
mov    %r12d,%edi
call   10a0 <get_r_rt@plt>
mov    %eax,%ebp
mov    %r12d,%edi
call   1080 <get_r_rd@plt>
lea    0xd80(%rip),%rdi
mov    %r15d,%esi
mov    %ebx,%edx
mov    %ebp,%ecx
mov    %eax,%r8d
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r12d,%edi
call   1030 <is_type_r@plt>
test   %rax,%rax
je     122d <analyze_code+0x4d>
xor    %eax,%eax
call   1100 <rand@plt>
mov    %eax,%r15d
xor    %eax,%eax
call   1100 <rand@plt>
mov    %eax,%r13d
mov    %r12d,%edi
call   10c0 <get_r_func@plt>
mov    %eax,%edi
call   1070 <is_r_supported@plt>
test   %rax,%rax
je     122d <analyze_code+0x4d>
mov    %r13d,%eax
shr    $0x1f,%eax
add    %r13d,%eax
and    $0xfe,%eax
sub    %eax,%r13d
mov    %r15d,%eax
shr    $0x1f,%eax
add    %r15d,%eax
and    $0xfe,%eax
cmp    %al,%r15b
je     1341 <analyze_code+0x161>
lea    0xd47(%rip),%rdi
mov    %r12d,%esi
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r12d,%edi
call   10c0 <get_r_func@plt>
mov    %eax,%edi
call   1060 <is_conmutative@plt>
test   %rax,%rax
je     13d4 <analyze_code+0x1f4>
mov    %r12d,%edi
call   10f0 <get_r_rs@plt>
mov    %eax,%ebx
mov    %r12d,%edi
call   10a0 <get_r_rt@plt>
movsbl %al,%esi
mov    %r12d,%edi
call   10d0 <set_r_rs@plt>
movsbl %bl,%esi
mov    %eax,%edi
call   1090 <set_r_rt@plt>
mov    %eax,%r12d
test   %r13b,%r13b
je     1210 <analyze_code+0x30>
lea    0xd1a(%rip),%rdi
mov    %r12d,%esi
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r12d,%edi
call   10c0 <get_r_func@plt>
mov    %eax,%ebx
mov    %r12d,%edi
call   10c0 <get_r_func@plt>
test   $0x1,%bl
jne    139c <analyze_code+0x1bc>
add    $0x1,%eax
mov    %r12d,%edi
mov    %eax,%esi
call   10b0 <replace_instruction@plt>
lea    0xd13(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r12d,%edi
call   10c0 <get_r_func@plt>
lea    0x1(%rax),%esi
jmp    13c4 <analyze_code+0x1e4>
add    $0xffffffff,%eax
mov    %r12d,%edi
mov    %eax,%esi
call   10e0 <set_r_func@plt>
lea    0xce9(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r12d,%edi
call   10c0 <get_r_func@plt>
lea    -0x1(%rax),%esi
mov    %r12d,%edi
call   10e0 <set_r_func@plt>
mov    %eax,%r12d
jmp    1221 <analyze_code+0x41>
lea    0xd4f(%rip),%rdi
call   1040 <puts@plt>
test   %r13b,%r13b
jne    134a <analyze_code+0x16a>
jmp    1210 <analyze_code+0x30>
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [60 x i8] c"Instruction: 0x%08x with registers -> RS: %d RT: %d RD: %d\0A\00"
@.str.1 = [47 x i8] c"Applying change order registers to: 0x%08x -> \00"
@.str.2 = [50 x i8] c"Not changed due to lack of conmutative property\0A\0A\00"
@.str.3 = [46 x i8] c"Applying Sustitute Instruction to: 0x%08x -> \00"
@.str.4 = [20 x i8] c"Changed by 0x%08x \0A\00"
@.str.5 = [72 x i8] c"Any changes kind of changes are applicated to actual instruction 0x%08x\00"
@.str.6 = [54 x i8] c"\0A\0A-------------------------------------------------\0A\0A\00"
define void @analyze_code(i32* %0, i32* %1, i32 %2) {
%4 = alloca i32*
%5 = alloca i32*
%6 = alloca i32
%7 = alloca i32
%8 = alloca i8
%9 = alloca i8
%10 = alloca i8
%11 = alloca i32
%12 = alloca i8
%13 = alloca i8
store i32* %0, i32** %4
store i32* %1, i32** %5
store i32 %2, i32* %6
store i32 0, i32* %7
store i8 0, i8* %8
store i8 0, i8* %9
store i8 0, i8* %10
store volatile i32 0, i32* %11
br label %14
14: ; preds = %123, %3
%15 = load volatile i32, i32* %11
%16 = load i32, i32* %6
%17 = icmp ult i32 %15, %16
br i1 %17, label %18, label %126
18: ; preds = %14
%19 = load i32*, i32** %4
%20 = load volatile i32, i32* %11
%21 = zext i32 %20 to i64
%22 = getelementptr inbounds i32, i32* %19, i64 %21
%23 = load i32, i32* %22
store i32 %23, i32* %7
%24 = load i32*, i32** %4
%25 = load volatile i32, i32* %11
%26 = zext i32 %25 to i64
%27 = getelementptr inbounds i32, i32* %24, i64 %26
%28 = load i32, i32* %27
%29 = load i32, i32* %7
%30 = call i32 @get_r_rs(i32 %29)
%31 = load i32, i32* %7
%32 = call i32 @get_r_rt(i32 %31)
%33 = load i32, i32* %7
%34 = call i32 @get_r_rd(i32 %33)
%35 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([60 x i8], [60 x i8]* @.str, i64 0, i64 0), i32 %28, i32 %30, i32 %32, i32 %34)
%36 = load i32, i32* %7
%37 = call i64 @is_type_r(i32 %36)
%38 = icmp ne i64 %37, 0
br i1 %38, label %39, label %117
39: ; preds = %18
%40 = call i32 (...) @rand()
%41 = srem i32 %40, 2
%42 = trunc i32 %41 to i8
store i8 %42, i8* %12
%43 = call i32 (...) @rand()
%44 = srem i32 %43, 2
%45 = trunc i32 %44 to i8
store i8 %45, i8* %13
%46 = load i32, i32* %7
%47 = call i32 @get_r_func(i32 %46)
%48 = call i64 @is_r_supported(i32 %47)
%49 = icmp ne i64 %48, 0
br i1 %49, label %50, label %116
50: ; preds = %39
%51 = load i8, i8* %12
%52 = icmp ne i8 %51, 0
br i1 %52, label %53, label %76
53: ; preds = %50
%54 = load i32, i32* %7
%55 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.1, i64 0, i64 0), i32 %54)
%56 = load i32, i32* %7
%57 = call i32 @get_r_func(i32 %56)
%58 = call i64 @is_conmutative(i32 %57)
%59 = icmp ne i64 %58, 0
br i1 %59, label %60, label %73
60: ; preds = %53
%61 = load i32, i32* %7
%62 = call i32 @get_r_rs(i32 %61)
%63 = trunc i32 %62 to i8
store i8 %63, i8* %8
%64 = load i32, i32* %7
%65 = call i32 @get_r_rt(i32 %64)
%66 = trunc i32 %65 to i8
store i8 %66, i8* %9
%67 = load i32, i32* %7
%68 = load i8, i8* %9
%69 = call i32 @set_r_rs(i32 %67, i8 signext %68)
store i32 %69, i32* %7
%70 = load i32, i32* %7
%71 = load i8, i8* %8
%72 = call i32 @set_r_rt(i32 %70, i8 signext %71)
store i32 %72, i32* %7
br label %75
73: ; preds = %53
%74 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([50 x i8], [50 x i8]* @.str.2, i64 0, i64 0))
br label %75
75: ; preds = %73, %60
br label %76
76: ; preds = %75, %50
%77 = load i8, i8* %13
%78 = icmp ne i8 %77, 0
br i1 %78, label %79, label %111
79: ; preds = %76
%80 = load i32, i32* %7
%81 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str.3, i64 0, i64 0), i32 %80)
%82 = load i32, i32* %7
%83 = call i32 @get_r_func(i32 %82)
%84 = srem i32 %83, 2
%85 = icmp eq i32 %84, 0
br i1 %85, label %86, label %98
86: ; preds = %79
%87 = load i32, i32* %7
%88 = load i32, i32* %7
%89 = call i32 @get_r_func(i32 %88)
%90 = add nsw i32 %89, 1
%91 = call i32 @replace_instruction(i32 %87, i32 %90)
%92 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.4, i64 0, i64 0), i32 %91)
%93 = load i32, i32* %7
%94 = load i32, i32* %7
%95 = call i32 @get_r_func(i32 %94)
%96 = add nsw i32 %95, 1
%97 = call i32 @set_r_func(i32 %93, i32 %96)
store i32 %97, i32* %7
br label %110
98: ; preds = %79
%99 = load i32, i32* %7
%100 = load i32, i32* %7
%101 = call i32 @get_r_func(i32 %100)
%102 = sub nsw i32 %101, 1
%103 = call i32 @set_r_func(i32 %99, i32 %102)
%104 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.4, i64 0, i64 0), i32 %103)
%105 = load i32, i32* %7
%106 = load i32, i32* %7
%107 = call i32 @get_r_func(i32 %106)
%108 = sub nsw i32 %107, 1
%109 = call i32 @set_r_func(i32 %105, i32 %108)
store i32 %109, i32* %7
br label %110
110: ; preds = %98, %86
br label %114
111: ; preds = %76
%112 = load i32, i32* %7
%113 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([72 x i8], [72 x i8]* @.str.5, i64 0, i64 0), i32 %112)
br label %114
114: ; preds = %111, %110
%115 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([54 x i8], [54 x i8]* @.str.6, i64 0, i64 0))
br label %116
116: ; preds = %114, %39
br label %117
117: ; preds = %116, %18
%118 = load i32, i32* %7
%119 = load i32*, i32** %5
%120 = load volatile i32, i32* %11
%121 = zext i32 %120 to i64
%122 = getelementptr inbounds i32, i32* %119, i64 %121
store i32 %118, i32* %122
br label %123
123: ; preds = %117
%124 = load volatile i32, i32* %11
%125 = add i32 %124, 1
store volatile i32 %125, i32* %11
br label %14
126: ; preds = %14
ret void
}

LLVM IR (-O2):
@.str = [60 x i8] c"Instruction: 0x%08x with registers -> RS: %d RT: %d RD: %d\0A\00"
@.str.1 = [47 x i8] c"Applying change order registers to: 0x%08x -> \00"
@.str.3 = [46 x i8] c"Applying Sustitute Instruction to: 0x%08x -> \00"
@.str.4 = [20 x i8] c"Changed by 0x%08x \0A\00"
@.str.5 = [72 x i8] c"Any changes kind of changes are applicated to actual instruction 0x%08x\00"
@str = [53 x i8] c"\0A\0A-------------------------------------------------\0A\00"
@str.7 = [49 x i8] c"Not changed due to lack of conmutative property\0A\00"
define void @analyze_code(i32* nocapture %0, i32* nocapture writeonly %1, i32 %2) {
%4 = alloca i32
%5 = bitcast i32* %4 to i8*
store volatile i32 0, i32* %4
%6 = load volatile i32, i32* %4
%7 = icmp ult i32 %6, %2
br i1 %7, label %9, label %8
8: ; preds = %78, %3
ret void
9: ; preds = %3, %78
%10 = load volatile i32, i32* %4
%11 = zext i32 %10 to i64
%12 = getelementptr inbounds i32, i32* %0, i64 %11
%13 = load i32, i32* %12
%14 = load volatile i32, i32* %4
%15 = zext i32 %14 to i64
%16 = getelementptr inbounds i32, i32* %0, i64 %15
%17 = load i32, i32* %16
%18 = tail call i32 @get_r_rs(i32 %13)
%19 = tail call i32 @get_r_rt(i32 %13)
%20 = tail call i32 @get_r_rd(i32 %13)
%21 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([60 x i8], [60 x i8]* @.str, i64 0, i64 0), i32 %17, i32 %18, i32 %19, i32 %20)
%22 = tail call i64 @is_type_r(i32 %13)
%23 = icmp eq i64 %22, 0
br i1 %23, label %78, label %24
24: ; preds = %9
%25 = tail call i32 (...) @rand()
%26 = tail call i32 (...) @rand()
%27 = srem i32 %26, 2
%28 = trunc i32 %27 to i8
%29 = tail call i32 @get_r_func(i32 %13)
%30 = tail call i64 @is_r_supported(i32 %29)
%31 = icmp eq i64 %30, 0
br i1 %31, label %78, label %32
32: ; preds = %24
%33 = srem i32 %25, 2
%34 = trunc i32 %33 to i8
%35 = icmp eq i8 %34, 0
br i1 %35, label %50, label %36
36: ; preds = %32
%37 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([47 x i8], [47 x i8]* @.str.1, i64 0, i64 0), i32 %13)
%38 = tail call i32 @get_r_func(i32 %13)
%39 = tail call i64 @is_conmutative(i32 %38)
%40 = icmp eq i64 %39, 0
br i1 %40, label %48, label %41
41: ; preds = %36
%42 = tail call i32 @get_r_rs(i32 %13)
%43 = trunc i32 %42 to i8
%44 = tail call i32 @get_r_rt(i32 %13)
%45 = trunc i32 %44 to i8
%46 = tail call i32 @set_r_rs(i32 %13, i8 signext %45)
%47 = tail call i32 @set_r_rt(i32 %46, i8 signext %43)
br label %50
48: ; preds = %36
%49 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([49 x i8], [49 x i8]* @str.7, i64 0, i64 0))
br label %50
50: ; preds = %41, %48, %32
%51 = phi i32 [ %47, %41 ], [ %13, %48 ], [ %13, %32 ]
%52 = icmp eq i8 %28, 0
br i1 %52, label %73, label %53
53: ; preds = %50
%54 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([46 x i8], [46 x i8]* @.str.3, i64 0, i64 0), i32 %51)
%55 = tail call i32 @get_r_func(i32 %51)
%56 = and i32 %55, 1
%57 = icmp eq i32 %56, 0
%58 = tail call i32 @get_r_func(i32 %51)
br i1 %57, label %59, label %66
59: ; preds = %53
%60 = add nsw i32 %58, 1
%61 = tail call i32 @replace_instruction(i32 %51, i32 %60)
%62 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.4, i64 0, i64 0), i32 %61)
%63 = tail call i32 @get_r_func(i32 %51)
%64 = add nsw i32 %63, 1
%65 = tail call i32 @set_r_func(i32 %51, i32 %64)
br label %75
66: ; preds = %53
%67 = add nsw i32 %58, -1
%68 = tail call i32 @set_r_func(i32 %51, i32 %67)
%69 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str.4, i64 0, i64 0), i32 %68)
%70 = tail call i32 @get_r_func(i32 %51)
%71 = add nsw i32 %70, -1
%72 = tail call i32 @set_r_func(i32 %51, i32 %71)
br label %75
73: ; preds = %50
%74 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([72 x i8], [72 x i8]* @.str.5, i64 0, i64 0), i32 %51)
br label %75
75: ; preds = %59, %66, %73
%76 = phi i32 [ %65, %59 ], [ %72, %66 ], [ %51, %73 ]
%77 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([53 x i8], [53 x i8]* @str, i64 0, i64 0))
br label %78
78: ; preds = %24, %75, %9
%79 = phi i32 [ %13, %9 ], [ %76, %75 ], [ %13, %24 ]
%80 = load volatile i32, i32* %4
%81 = zext i32 %80 to i64
%82 = getelementptr inbounds i32, i32* %1, i64 %81
store i32 %79, i32* %82
%83 = load volatile i32, i32* %4
%84 = add i32 %83, 1
store volatile i32 %84, i32* %4
%85 = load volatile i32, i32* %4
%86 = icmp ult i32 %85, %2
br i1 %86, label %9, label %8
}