void replace2(char *token, char *new) {
  char buff[20], temp[20], *token2;
  strcpy(temp, token);
  if (token[0] != '?') {
    strcpy(buff, strtok(token, "?"));
    strcpy(token, temp);
    token2 = token + strlen(token) - strlen(buff) + 2;
    strcat(buff, new);
  } else {
    strcpy(buff, new);
    token2 = token + 2;
  }
  strcat(buff, token2);
  strcpy(token, buff);
}


x86 assembly (clang, -O0):
<replace2>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x50(%rbp),%rdi
mov    -0x8(%rbp),%rsi
call   1030 <strcpy@plt>
mov    -0x8(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x3f,%eax
je     11ef <replace2+0xaf>
lea    -0x30(%rbp),%rax
mov    %rax,-0x70(%rbp)
mov    -0x8(%rbp),%rdi
lea    0xe80(%rip),%rsi
call   1050 <strtok@plt>
mov    -0x70(%rbp),%rdi
mov    %rax,%rsi
call   1030 <strcpy@plt>
mov    -0x8(%rbp),%rdi
lea    -0x50(%rbp),%rsi
call   1030 <strcpy@plt>
mov    -0x8(%rbp),%rax
mov    %rax,-0x68(%rbp)
mov    -0x8(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,%rcx
mov    -0x68(%rbp),%rax
add    %rcx,%rax
mov    %rax,-0x60(%rbp)
lea    -0x30(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,%rdx
mov    -0x60(%rbp),%rax
xor    %ecx,%ecx
sub    %rdx,%rcx
add    %rcx,%rax
add    $0x2,%rax
mov    %rax,-0x58(%rbp)
lea    -0x30(%rbp),%rdi
mov    -0x10(%rbp),%rsi
call   1060 <strcat@plt>
jmp    1208 <replace2+0xc8>
lea    -0x30(%rbp),%rdi
mov    -0x10(%rbp),%rsi
call   1030 <strcpy@plt>
mov    -0x8(%rbp),%rax
add    $0x2,%rax
mov    %rax,-0x58(%rbp)
lea    -0x30(%rbp),%rdi
mov    -0x58(%rbp),%rsi
call   1060 <strcat@plt>
mov    -0x8(%rbp),%rdi
lea    -0x30(%rbp),%rsi
call   1030 <strcpy@plt>
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<replace2>:
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x38,%rsp
mov    %rsi,%r14
mov    %rdi,%r15
lea    0x20(%rsp),%rdi
mov    %r15,%rsi
call   1030 <strcpy@plt>
cmpb   $0x3f,(%r15)
jne    1174 <replace2+0x34>
mov    %rsp,%rdi
mov    %r14,%rsi
call   1030 <strcpy@plt>
mov    %r15,%rbx
jmp    11c2 <replace2+0x82>
lea    0xe85(%rip),%rsi
mov    %r15,%rdi
call   1050 <strtok@plt>
mov    %rsp,%r12
mov    %r12,%rdi
mov    %rax,%rsi
call   1030 <strcpy@plt>
lea    0x20(%rsp),%rsi
mov    %r15,%rdi
call   1030 <strcpy@plt>
mov    %r15,%rdi
call   1040 <strlen@plt>
mov    %rax,%rbx
add    %r15,%rbx
mov    %r12,%rdi
call   1040 <strlen@plt>
sub    %rax,%rbx
mov    %r12,%rdi
mov    %r14,%rsi
call   1060 <strcat@plt>
add    $0x2,%rbx
mov    %rsp,%r14
mov    %r14,%rdi
mov    %rbx,%rsi
call   1060 <strcat@plt>
mov    %r15,%rdi
mov    %r14,%rsi
call   1030 <strcpy@plt>
add    $0x38,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [2 x i8] c"?\00"
define void @replace2(i8* %0, i8* %1) {
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca [20 x i8]
%6 = alloca [20 x i8]
%7 = alloca i8*
store i8* %0, i8** %3
store i8* %1, i8** %4
%8 = getelementptr inbounds [20 x i8], [20 x i8]* %6, i64 0, i64 0
%9 = load i8*, i8** %3
%10 = call i8* @strcpy(i8* %8, i8* %9)
%11 = load i8*, i8** %3
%12 = getelementptr inbounds i8, i8* %11, i64 0
%13 = load i8, i8* %12
%14 = sext i8 %13 to i32
%15 = icmp ne i32 %14, 63
br i1 %15, label %16, label %36
16: ; preds = %2
%17 = getelementptr inbounds [20 x i8], [20 x i8]* %5, i64 0, i64 0
%18 = load i8*, i8** %3
%19 = call i8* @strtok(i8* %18, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%20 = call i8* @strcpy(i8* %17, i8* %19)
%21 = load i8*, i8** %3
%22 = getelementptr inbounds [20 x i8], [20 x i8]* %6, i64 0, i64 0
%23 = call i8* @strcpy(i8* %21, i8* %22)
%24 = load i8*, i8** %3
%25 = load i8*, i8** %3
%26 = call i64 @strlen(i8* %25)
%27 = getelementptr inbounds i8, i8* %24, i64 %26
%28 = getelementptr inbounds [20 x i8], [20 x i8]* %5, i64 0, i64 0
%29 = call i64 @strlen(i8* %28)
%30 = sub i64 0, %29
%31 = getelementptr inbounds i8, i8* %27, i64 %30
%32 = getelementptr inbounds i8, i8* %31, i64 2
store i8* %32, i8** %7
%33 = getelementptr inbounds [20 x i8], [20 x i8]* %5, i64 0, i64 0
%34 = load i8*, i8** %4
%35 = call i8* @strcat(i8* %33, i8* %34)
br label %42
36: ; preds = %2
%37 = getelementptr inbounds [20 x i8], [20 x i8]* %5, i64 0, i64 0
%38 = load i8*, i8** %4
%39 = call i8* @strcpy(i8* %37, i8* %38)
%40 = load i8*, i8** %3
%41 = getelementptr inbounds i8, i8* %40, i64 2
store i8* %41, i8** %7
br label %42
42: ; preds = %36, %16
%43 = getelementptr inbounds [20 x i8], [20 x i8]* %5, i64 0, i64 0
%44 = load i8*, i8** %7
%45 = call i8* @strcat(i8* %43, i8* %44)
%46 = load i8*, i8** %3
%47 = getelementptr inbounds [20 x i8], [20 x i8]* %5, i64 0, i64 0
%48 = call i8* @strcpy(i8* %46, i8* %47)
ret void
}

LLVM IR (-O2):
@.str = [2 x i8] c"?\00"
define void @replace2(i8* %0, i8* nocapture %1) {
%3 = alloca [20 x i8]
%4 = alloca [20 x i8]
%5 = getelementptr inbounds [20 x i8], [20 x i8]* %3, i64 0, i64 0
%6 = getelementptr inbounds [20 x i8], [20 x i8]* %4, i64 0, i64 0
%7 = call i8* @strcpy(i8* %6, i8* dereferenceable(1) %0)
%8 = load i8, i8* %0
%9 = icmp eq i8 %8, 63
br i1 %9, label %20, label %10
10: ; preds = %2
%11 = call i8* @strtok(i8* %0, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%12 = call i8* @strcpy(i8* %5, i8* dereferenceable(1) %11)
%13 = call i8* @strcpy(i8* %0, i8* %6)
%14 = call i64 @strlen(i8* %0)
%15 = getelementptr inbounds i8, i8* %0, i64 %14
%16 = call i64 @strlen(i8* %5)
%17 = sub i64 0, %16
%18 = getelementptr inbounds i8, i8* %15, i64 %17
%19 = call i8* @strcat(i8* %5, i8* dereferenceable(1) %1)
br label %22
20: ; preds = %2
%21 = call i8* @strcpy(i8* %5, i8* dereferenceable(1) %1)
br label %22
22: ; preds = %20, %10
%23 = phi i8* [ %18, %10 ], [ %0, %20 ]
%24 = getelementptr inbounds i8, i8* %23, i64 2
%25 = call i8* @strcat(i8* %5, i8* %24)
%26 = call i8* @strcpy(i8* %0, i8* %5)
ret void
}