signed int readtga(char *name, signed int *xres, signed int *yres,
                   unsigned char **imgdata) {
  signed int format;
  signed int width;
  signed int height;
  signed int w1;
  signed int w2;
  signed int h1;
  signed int h2;
  signed int depth;
  signed int flags;
  signed int imgsize;
  signed int bytesread;
  signed int i;
  signed int tmp;
  struct _IO_FILE$link43 *ifp;
  ifp = fopen(name, "r");
  if (ifp == ((struct _IO_FILE$link43 *)((void *)0)))
    return 1;
  _IO_getc(ifp);
  _IO_getc(ifp);
  format = _IO_getc(ifp);
  _IO_getc(ifp);
  _IO_getc(ifp);
  _IO_getc(ifp);
  _IO_getc(ifp);
  _IO_getc(ifp);
  _IO_getc(ifp);
  _IO_getc(ifp);
  _IO_getc(ifp);
  _IO_getc(ifp);
  w1 = _IO_getc(ifp);
  w2 = _IO_getc(ifp);
  h1 = _IO_getc(ifp);
  h2 = _IO_getc(ifp);
  depth = _IO_getc(ifp);
  flags = _IO_getc(ifp);
  if (format == 2) {
    if (depth != 24)
      goto __CPROVER_DUMP_L2;
  } else {
  __CPROVER_DUMP_L2:;
    fclose(ifp);
    return 2;
  }
  width = w2 << 8 | w1;
  height = h2 << 8 | h1;
  imgsize = 3 * width * height;
  void *return_value_malloc$1;
  return_value_malloc$1 = malloc((unsigned long int)imgsize);
  *imgdata = (unsigned char *)return_value_malloc$1;
  unsigned long int return_value_fread$2;
  return_value_fread$2 = fread((void *)*imgdata, (unsigned long int)1,
                               (unsigned long int)imgsize, ifp);
  bytesread = (signed int)return_value_fread$2;
  fclose(ifp);
  if (flags == 32) {
    signed int rowsize = 3 * width;
    unsigned char *copytmp;
    void *return_value_malloc$3;
    return_value_malloc$3 = malloc((unsigned long int)rowsize);
    copytmp = (unsigned char *)return_value_malloc$3;
    i = 0;
    while (!(i >= height / 2)) {
      memcpy((void *)copytmp,
             (const void *)&(*imgdata)[(signed long int)(rowsize * i)],
             (unsigned long int)rowsize);
      memcpy((void *)&(*imgdata)[(signed long int)(rowsize * i)],
             (const void *)&(
                 *imgdata)[(signed long int)(rowsize * ((height - 1) - i))],
             (unsigned long int)rowsize);
      memcpy(
          (void *)&(*imgdata)[(signed long int)(rowsize * ((height - 1) - i))],
          (const void *)copytmp, (unsigned long int)rowsize);
      i = i + 1;
    }
    free((void *)copytmp);
  }
  i = 0;
  while (!(i >= imgsize)) {
    tmp = (signed int)(*imgdata)[(signed long int)i];
    (*imgdata)[(signed long int)i] = (*imgdata)[(signed long int)(i + 2)];
    (*imgdata)[(signed long int)(i + 2)] = (unsigned char)tmp;
    i = i + 3;
  }
  *xres = width;
  *yres = height;
  if (!(bytesread == imgsize))
    return 4;
  return 0;
}


x86 assembly (clang, -O0):
<readtga>:
push   %rbp
mov    %rsp,%rbp
sub    $0xa0,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    -0x10(%rbp),%rdi
lea    0xe6a(%rip),%rsi
mov    $0x0,%al
call   1090 <fopen@plt>
cltq
mov    %rax,-0x68(%rbp)
cmpq   $0x0,-0x68(%rbp)
jne    11ba <readtga+0x4a>
movl   $0x1,-0x4(%rbp)
jmp    14eb <readtga+0x37b>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    %eax,-0x2c(%rbp)
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    %eax,-0x38(%rbp)
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    %eax,-0x3c(%rbp)
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    %eax,-0x40(%rbp)
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    %eax,-0x44(%rbp)
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    %eax,-0x48(%rbp)
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1080 <_IO_getc@plt>
mov    %eax,-0x4c(%rbp)
cmpl   $0x2,-0x2c(%rbp)
jne    12b3 <readtga+0x143>
cmpl   $0x18,-0x48(%rbp)
je     12ae <readtga+0x13e>
jmp    12b8 <readtga+0x148>
jmp    12cf <readtga+0x15f>
jmp    12b8 <readtga+0x148>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1050 <fclose@plt>
movl   $0x2,-0x4(%rbp)
jmp    14eb <readtga+0x37b>
mov    -0x3c(%rbp),%eax
shl    $0x8,%eax
or     -0x38(%rbp),%eax
mov    %eax,-0x30(%rbp)
mov    -0x44(%rbp),%eax
shl    $0x8,%eax
or     -0x40(%rbp),%eax
mov    %eax,-0x34(%rbp)
imul   $0x3,-0x30(%rbp),%eax
imul   -0x34(%rbp),%eax
mov    %eax,-0x50(%rbp)
movslq -0x50(%rbp),%rdi
call   1070 <malloc@plt>
mov    %rax,-0x70(%rbp)
mov    -0x70(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x28(%rbp),%rax
mov    (%rax),%rdi
movslq -0x50(%rbp),%rdx
mov    -0x68(%rbp),%rcx
mov    $0x1,%esi
mov    $0x0,%al
call   1040 <fread@plt>
cltq
mov    %rax,-0x78(%rbp)
mov    -0x78(%rbp),%rax
mov    %eax,-0x54(%rbp)
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1050 <fclose@plt>
cmpl   $0x20,-0x4c(%rbp)
jne    1442 <readtga+0x2d2>
imul   $0x3,-0x30(%rbp),%eax
mov    %eax,-0x7c(%rbp)
movslq -0x7c(%rbp),%rdi
call   1070 <malloc@plt>
mov    %rax,-0x90(%rbp)
mov    -0x90(%rbp),%rax
mov    %rax,-0x88(%rbp)
movl   $0x0,-0x58(%rbp)
mov    -0x58(%rbp),%eax
mov    %eax,-0x94(%rbp)
mov    -0x34(%rbp),%eax
mov    $0x2,%ecx
cltd
idiv   %ecx
mov    %eax,%ecx
mov    -0x94(%rbp),%eax
cmp    %ecx,%eax
setge  %al
xor    $0xff,%al
test   $0x1,%al
jne    13a3 <readtga+0x233>
jmp    1436 <readtga+0x2c6>
mov    -0x88(%rbp),%rdi
mov    -0x28(%rbp),%rax
mov    (%rax),%rsi
mov    -0x7c(%rbp),%eax
imul   -0x58(%rbp),%eax
cltq
add    %rax,%rsi
movslq -0x7c(%rbp),%rdx
call   1060 <memcpy@plt>
mov    -0x28(%rbp),%rax
mov    (%rax),%rdi
mov    -0x7c(%rbp),%eax
imul   -0x58(%rbp),%eax
cltq
add    %rax,%rdi
mov    -0x28(%rbp),%rax
mov    (%rax),%rsi
mov    -0x7c(%rbp),%eax
mov    -0x34(%rbp),%ecx
sub    $0x1,%ecx
sub    -0x58(%rbp),%ecx
imul   %ecx,%eax
cltq
add    %rax,%rsi
movslq -0x7c(%rbp),%rdx
call   1060 <memcpy@plt>
mov    -0x28(%rbp),%rax
mov    (%rax),%rdi
mov    -0x7c(%rbp),%eax
mov    -0x34(%rbp),%ecx
sub    $0x1,%ecx
sub    -0x58(%rbp),%ecx
imul   %ecx,%eax
cltq
add    %rax,%rdi
mov    -0x88(%rbp),%rsi
movslq -0x7c(%rbp),%rdx
call   1060 <memcpy@plt>
mov    -0x58(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x58(%rbp)
jmp    1373 <readtga+0x203>
mov    -0x88(%rbp),%rdi
call   1030 <free@plt>
movl   $0x0,-0x58(%rbp)
mov    -0x58(%rbp),%eax
cmp    -0x50(%rbp),%eax
setge  %al
xor    $0xff,%al
test   $0x1,%al
jne    1461 <readtga+0x2f1>
jmp    14ba <readtga+0x34a>
mov    -0x28(%rbp),%rax
mov    (%rax),%rax
movslq -0x58(%rbp),%rcx
movzbl (%rax,%rcx,1),%eax
mov    %eax,-0x5c(%rbp)
mov    -0x28(%rbp),%rax
mov    (%rax),%rax
mov    -0x58(%rbp),%ecx
add    $0x2,%ecx
movslq %ecx,%rcx
mov    (%rax,%rcx,1),%dl
mov    -0x28(%rbp),%rax
mov    (%rax),%rax
movslq -0x58(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x5c(%rbp),%eax
mov    %al,%dl
mov    -0x28(%rbp),%rax
mov    (%rax),%rax
mov    -0x58(%rbp),%ecx
add    $0x2,%ecx
movslq %ecx,%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x58(%rbp),%eax
add    $0x3,%eax
mov    %eax,-0x58(%rbp)
jmp    1449 <readtga+0x2d9>
mov    -0x30(%rbp),%ecx
mov    -0x18(%rbp),%rax
mov    %ecx,(%rax)
mov    -0x34(%rbp),%ecx
mov    -0x20(%rbp),%rax
mov    %ecx,(%rax)
mov    -0x54(%rbp),%eax
cmp    -0x50(%rbp),%eax
je     14e4 <readtga+0x374>
movl   $0x4,-0x4(%rbp)
jmp    14eb <readtga+0x37b>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0xa0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<readtga>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x48,%rsp
mov    %rcx,%r14
mov    %rdx,%rbp
mov    %rsi,%rbx
lea    0xe72(%rip),%rsi
xor    %eax,%eax
call   1090 <fopen@plt>
test   %eax,%eax
je     13d8 <readtga+0x268>
mov    %rbp,0x28(%rsp)
mov    %r14,0x30(%rsp)
mov    %rbx,0x40(%rsp)
movslq %eax,%r12
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %eax,0x8(%rsp)
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %eax,%ebx
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %eax,%ebp
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %eax,%r14d
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %eax,%r15d
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
mov    %eax,%r13d
mov    %r12,%rdi
xor    %eax,%eax
call   1080 <_IO_getc@plt>
cmpl   $0x2,0x8(%rsp)
jne    13e2 <readtga+0x272>
cmp    $0x18,%r13d
jne    13e2 <readtga+0x272>
shl    $0x8,%ebp
or     %ebx,%ebp
shl    $0x8,%r15d
or     %r14d,%r15d
mov    %rbp,0x20(%rsp)
lea    0x0(%rbp,%rbp,2),%r13d
mov    %r15d,%r14d
imul   %r13d,%r14d
movslq %r14d,%rbx
mov    %rbx,%rdi
mov    %eax,0x8(%rsp)
call   1070 <malloc@plt>
mov    0x30(%rsp),%rbp
mov    %rax,0x0(%rbp)
mov    $0x1,%esi
mov    %rax,%rdi
mov    %rbx,0x38(%rsp)
mov    %rbx,%rdx
mov    %r12,%rcx
xor    %eax,%eax
call   1040 <fread@plt>
mov    %eax,%ebx
mov    %r12,%rdi
xor    %eax,%eax
call   1050 <fclose@plt>
cmpl   $0x20,0x8(%rsp)
mov    0x28(%rsp),%r8
jne    13a2 <readtga+0x232>
mov    %ebx,0x10(%rsp)
mov    %r14d,0x14(%rsp)
movslq %r13d,%r14
mov    %r14,%rdi
call   1070 <malloc@plt>
mov    %rax,%r13
mov    %r15,0x18(%rsp)
cmp    $0x2,%r15d
jl     1387 <readtga+0x217>
mov    0x18(%rsp),%rax
mov    %eax,%ecx
shr    %ecx
add    $0xffffffff,%eax
imul   0x20(%rsp),%eax
lea    (%rax,%rax,2),%r12d
xor    %r15d,%r15d
xchg   %ax,%ax
mov    %rcx,0x8(%rsp)
mov    0x0(%rbp),%rbx
lea    (%rbx,%r15,1),%rbp
mov    %r13,%rdi
mov    %rbp,%rsi
mov    %r14,%rdx
call   1060 <memcpy@plt>
movslq %r12d,%r12
add    %r12,%rbx
mov    %rbp,%rdi
mov    0x30(%rsp),%rbp
mov    %rbx,%rsi
mov    %r14,%rdx
call   1060 <memcpy@plt>
mov    0x0(%rbp),%rdi
add    %r12,%rdi
mov    %r13,%rsi
mov    %r14,%rdx
call   1060 <memcpy@plt>
mov    0x8(%rsp),%rcx
sub    %r14d,%r12d
add    %r14,%r15
add    $0xffffffffffffffff,%rcx
jne    1330 <readtga+0x1c0>
mov    %r13,%rdi
call   1030 <free@plt>
mov    0x28(%rsp),%r8
mov    0x18(%rsp),%r15
mov    0x14(%rsp),%r14d
mov    0x10(%rsp),%ebx
test   %r14d,%r14d
jle    146f <readtga+0x2ff>
mov    %ebx,%r9d
mov    0x38(%rsp),%rsi
add    $0xffffffffffffffff,%rsi
movabs $0xaaaaaaaaaaaaaaab,%rcx
aa aa aa
mov    %rsi,%rax
mul    %rcx
shr    %rdx
add    $0x1,%rdx
cmp    $0x3,%rsi
jae    13f6 <readtga+0x286>
xor    %eax,%eax
jmp    144e <readtga+0x2de>
mov    $0x1,%eax
jmp    1489 <readtga+0x319>
mov    %r12,%rdi
xor    %eax,%eax
call   1050 <fclose@plt>
mov    $0x2,%eax
jmp    1489 <readtga+0x319>
movabs $0x7ffffffffffffffe,%rcx
ff ff 7f
and    %rdx,%rcx
xor    %eax,%eax
cs nopw 0x0(%rax,%rax,1)
nop
mov    0x0(%rbp),%rsi
movzbl (%rsi,%rax,1),%edi
movzbl 0x2(%rsi,%rax,1),%ebx
mov    %bl,(%rsi,%rax,1)
mov    0x0(%rbp),%rsi
mov    %dil,0x2(%rsi,%rax,1)
mov    0x0(%rbp),%rsi
movzbl 0x3(%rsi,%rax,1),%edi
movzbl 0x5(%rsi,%rax,1),%ebx
mov    %bl,0x3(%rsi,%rax,1)
mov    0x0(%rbp),%rsi
mov    %dil,0x5(%rsi,%rax,1)
add    $0x6,%rax
add    $0xfffffffffffffffe,%rcx
jne    1410 <readtga+0x2a0>
test   $0x1,%dl
mov    %r9d,%ebx
je     146f <readtga+0x2ff>
mov    0x0(%rbp),%rcx
mov    (%rcx,%rax,1),%dl
mov    0x2(%rcx,%rax,1),%bl
mov    %bl,(%rcx,%rax,1)
mov    %r9d,%ebx
mov    0x0(%rbp),%rcx
mov    %dl,0x2(%rcx,%rax,1)
mov    0x40(%rsp),%rax
mov    0x20(%rsp),%rcx
mov    %ecx,(%rax)
mov    %r15d,(%r8)
xor    %eax,%eax
cmp    %r14d,%ebx
setne  %al
shl    $0x2,%eax
add    $0x48,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%"struct._IO_FILE$link43" = type opaque
@.str = [2 x i8] c"r\00"
define i32 @readtga(i8* %0, i32* %1, i32* %2, i8** %3) {
%5 = alloca i32
%6 = alloca i8*
%7 = alloca i32*
%8 = alloca i32*
%9 = alloca i8**
%10 = alloca i32
%11 = alloca i32
%12 = alloca i32
%13 = alloca i32
%14 = alloca i32
%15 = alloca i32
%16 = alloca i32
%17 = alloca i32
%18 = alloca i32
%19 = alloca i32
%20 = alloca i32
%21 = alloca i32
%22 = alloca i32
%23 = alloca %"struct._IO_FILE$link43"*
%24 = alloca i8*
%25 = alloca i64
%26 = alloca i32
%27 = alloca i8*
%28 = alloca i8*
store i8* %0, i8** %6
store i32* %1, i32** %7
store i32* %2, i32** %8
store i8** %3, i8*** %9
%29 = load i8*, i8** %6
%30 = call i32 (i8*, i8*, ...) bitcast (i32 (...)* @fopen to i32 (i8*, i8*, ...)*)(i8* %29, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%31 = sext i32 %30 to i64
%32 = inttoptr i64 %31 to %"struct._IO_FILE$link43"*
store %"struct._IO_FILE$link43"* %32, %"struct._IO_FILE$link43"** %23
%33 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%34 = icmp eq %"struct._IO_FILE$link43"* %33, null
br i1 %34, label %35, label %36
35: ; preds = %4
store i32 1, i32* %5
br label %221
36: ; preds = %4
%37 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%38 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %37)
%39 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%40 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %39)
%41 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%42 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %41)
store i32 %42, i32* %10
%43 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%44 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %43)
%45 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%46 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %45)
%47 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%48 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %47)
%49 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%50 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %49)
%51 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%52 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %51)
%53 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%54 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %53)
%55 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%56 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %55)
%57 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%58 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %57)
%59 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%60 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %59)
%61 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%62 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %61)
store i32 %62, i32* %13
%63 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%64 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %63)
store i32 %64, i32* %14
%65 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%66 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %65)
store i32 %66, i32* %15
%67 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%68 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %67)
store i32 %68, i32* %16
%69 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%70 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %69)
store i32 %70, i32* %17
%71 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%72 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %71)
store i32 %72, i32* %18
%73 = load i32, i32* %10
%74 = icmp eq i32 %73, 2
br i1 %74, label %75, label %80
75: ; preds = %36
%76 = load i32, i32* %17
%77 = icmp ne i32 %76, 24
br i1 %77, label %78, label %79
78: ; preds = %75
br label %81
79: ; preds = %75
br label %84
80: ; preds = %36
br label %81
81: ; preds = %80, %78
%82 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%83 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @fclose to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %82)
store i32 2, i32* %5
br label %221
84: ; preds = %79
%85 = load i32, i32* %14
%86 = shl i32 %85, 8
%87 = load i32, i32* %13
%88 = or i32 %86, %87
store i32 %88, i32* %11
%89 = load i32, i32* %16
%90 = shl i32 %89, 8
%91 = load i32, i32* %15
%92 = or i32 %90, %91
store i32 %92, i32* %12
%93 = load i32, i32* %11
%94 = mul nsw i32 3, %93
%95 = load i32, i32* %12
%96 = mul nsw i32 %94, %95
store i32 %96, i32* %19
%97 = load i32, i32* %19
%98 = sext i32 %97 to i64
%99 = call i8* @malloc(i64 %98)
store i8* %99, i8** %24
%100 = load i8*, i8** %24
%101 = load i8**, i8*** %9
store i8* %100, i8** %101
%102 = load i8**, i8*** %9
%103 = load i8*, i8** %102
%104 = load i32, i32* %19
%105 = sext i32 %104 to i64
%106 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%107 = call i32 (i8*, i64, i64, %"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @fread to i32 (i8*, i64, i64, %"struct._IO_FILE$link43"*, ...)*)(i8* %103, i64 1, i64 %105, %"struct._IO_FILE$link43"* %106)
%108 = sext i32 %107 to i64
store i64 %108, i64* %25
%109 = load i64, i64* %25
%110 = trunc i64 %109 to i32
store i32 %110, i32* %20
%111 = load %"struct._IO_FILE$link43"*, %"struct._IO_FILE$link43"** %23
%112 = call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @fclose to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %111)
%113 = load i32, i32* %18
%114 = icmp eq i32 %113, 32
br i1 %114, label %115, label %175
115: ; preds = %84
%116 = load i32, i32* %11
%117 = mul nsw i32 3, %116
store i32 %117, i32* %26
%118 = load i32, i32* %26
%119 = sext i32 %118 to i64
%120 = call i8* @malloc(i64 %119)
store i8* %120, i8** %28
%121 = load i8*, i8** %28
store i8* %121, i8** %27
store i32 0, i32* %21
br label %122
122: ; preds = %128, %115
%123 = load i32, i32* %21
%124 = load i32, i32* %12
%125 = sdiv i32 %124, 2
%126 = icmp sge i32 %123, %125
%127 = xor i1 %126, true
br i1 %127, label %128, label %173
128: ; preds = %122
%129 = load i8*, i8** %27
%130 = load i8**, i8*** %9
%131 = load i8*, i8** %130
%132 = load i32, i32* %26
%133 = load i32, i32* %21
%134 = mul nsw i32 %132, %133
%135 = sext i32 %134 to i64
%136 = getelementptr inbounds i8, i8* %131, i64 %135
%137 = load i32, i32* %26
%138 = sext i32 %137 to i64
%139 = load i8**, i8*** %9
%140 = load i8*, i8** %139
%141 = load i32, i32* %26
%142 = load i32, i32* %21
%143 = mul nsw i32 %141, %142
%144 = sext i32 %143 to i64
%145 = getelementptr inbounds i8, i8* %140, i64 %144
%146 = load i8**, i8*** %9
%147 = load i8*, i8** %146
%148 = load i32, i32* %26
%149 = load i32, i32* %12
%150 = sub nsw i32 %149, 1
%151 = load i32, i32* %21
%152 = sub nsw i32 %150, %151
%153 = mul nsw i32 %148, %152
%154 = sext i32 %153 to i64
%155 = getelementptr inbounds i8, i8* %147, i64 %154
%156 = load i32, i32* %26
%157 = sext i32 %156 to i64
%158 = load i8**, i8*** %9
%159 = load i8*, i8** %158
%160 = load i32, i32* %26
%161 = load i32, i32* %12
%162 = sub nsw i32 %161, 1
%163 = load i32, i32* %21
%164 = sub nsw i32 %162, %163
%165 = mul nsw i32 %160, %164
%166 = sext i32 %165 to i64
%167 = getelementptr inbounds i8, i8* %159, i64 %166
%168 = load i8*, i8** %27
%169 = load i32, i32* %26
%170 = sext i32 %169 to i64
%171 = load i32, i32* %21
%172 = add nsw i32 %171, 1
store i32 %172, i32* %21
br label %122
173: ; preds = %122
%174 = load i8*, i8** %27
br label %175
175: ; preds = %173, %84
store i32 0, i32* %21
br label %176
176: ; preds = %181, %175
%177 = load i32, i32* %21
%178 = load i32, i32* %19
%179 = icmp sge i32 %177, %178
%180 = xor i1 %179, true
br i1 %180, label %181, label %211
181: ; preds = %176
%182 = load i8**, i8*** %9
%183 = load i8*, i8** %182
%184 = load i32, i32* %21
%185 = sext i32 %184 to i64
%186 = getelementptr inbounds i8, i8* %183, i64 %185
%187 = load i8, i8* %186
%188 = zext i8 %187 to i32
store i32 %188, i32* %22
%189 = load i8**, i8*** %9
%190 = load i8*, i8** %189
%191 = load i32, i32* %21
%192 = add nsw i32 %191, 2
%193 = sext i32 %192 to i64
%194 = getelementptr inbounds i8, i8* %190, i64 %193
%195 = load i8, i8* %194
%196 = load i8**, i8*** %9
%197 = load i8*, i8** %196
%198 = load i32, i32* %21
%199 = sext i32 %198 to i64
%200 = getelementptr inbounds i8, i8* %197, i64 %199
store i8 %195, i8* %200
%201 = load i32, i32* %22
%202 = trunc i32 %201 to i8
%203 = load i8**, i8*** %9
%204 = load i8*, i8** %203
%205 = load i32, i32* %21
%206 = add nsw i32 %205, 2
%207 = sext i32 %206 to i64
%208 = getelementptr inbounds i8, i8* %204, i64 %207
store i8 %202, i8* %208
%209 = load i32, i32* %21
%210 = add nsw i32 %209, 3
store i32 %210, i32* %21
br label %176
211: ; preds = %176
%212 = load i32, i32* %11
%213 = load i32*, i32** %7
store i32 %212, i32* %213
%214 = load i32, i32* %12
%215 = load i32*, i32** %8
store i32 %214, i32* %215
%216 = load i32, i32* %20
%217 = load i32, i32* %19
%218 = icmp eq i32 %216, %217
br i1 %218, label %220, label %219
219: ; preds = %211
store i32 4, i32* %5
br label %221
220: ; preds = %211
store i32 0, i32* %5
br label %221
221: ; preds = %220, %219, %81, %35
%222 = load i32, i32* %5
ret i32 %222
}

LLVM IR (-O2):
%"struct._IO_FILE$link43" = type opaque
@.str = [2 x i8] c"r\00"
define i32 @readtga(i8* %0, i32* nocapture writeonly %1, i32* nocapture writeonly %2, i8** nocapture %3) {
%5 = tail call i32 (i8*, i8*, ...) bitcast (i32 (...)* @fopen to i32 (i8*, i8*, ...)*)(i8* %0, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%6 = sext i32 %5 to i64
%7 = inttoptr i64 %6 to %"struct._IO_FILE$link43"*
%8 = icmp eq i32 %5, 0
br i1 %8, label %116, label %9
9: ; preds = %4
%10 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%11 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%12 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%13 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%14 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%15 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%16 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%17 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%18 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%19 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%20 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%21 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%22 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%23 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%24 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%25 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%26 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%27 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @_IO_getc to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%28 = icmp ne i32 %12, 2
%29 = icmp ne i32 %26, 24
%30 = select i1 %28, i1 true, i1 %29
br i1 %30, label %31, label %33
31: ; preds = %9
%32 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @fclose to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
br label %116
33: ; preds = %9
%34 = shl i32 %23, 8
%35 = or i32 %34, %22
%36 = shl i32 %25, 8
%37 = or i32 %36, %24
%38 = mul nsw i32 %35, 3
%39 = mul nsw i32 %37, %38
%40 = sext i32 %39 to i64
%41 = tail call i8* @malloc(i64 %40)
store i8* %41, i8** %3
%42 = tail call i32 (i8*, i64, i64, %"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @fread to i32 (i8*, i64, i64, %"struct._IO_FILE$link43"*, ...)*)(i8* %41, i64 1, i64 %40, %"struct._IO_FILE$link43"* %7)
%43 = tail call i32 (%"struct._IO_FILE$link43"*, ...) bitcast (i32 (...)* @fclose to i32 (%"struct._IO_FILE$link43"*, ...)*)(%"struct._IO_FILE$link43"* %7)
%44 = icmp eq i32 %27, 32
br i1 %44, label %45, label %68
45: ; preds = %33
%46 = sext i32 %38 to i64
%47 = tail call i8* @malloc(i64 %46)
%48 = icmp sgt i32 %37, 1
br i1 %48, label %49, label %67
49: ; preds = %45
%50 = lshr i32 %37, 1
%51 = zext i32 %50 to i64
br label %52
52: ; preds = %49, %52
%53 = phi i64 [ 0, %49 ], [ %65, %52 ]
%54 = load i8*, i8** %3
%55 = mul nsw i64 %53, %46
%56 = getelementptr inbounds i8, i8* %54, i64 %55
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 %47, i8* align 1 %56, i64 %46, i1 false)
%57 = trunc i64 %53 to i32
%58 = xor i32 %57, -1
%59 = add i32 %37, %58
%60 = mul nsw i32 %59, %38
%61 = sext i32 %60 to i64
%62 = getelementptr inbounds i8, i8* %54, i64 %61
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 %56, i8* align 1 %62, i64 %46, i1 false)
%63 = load i8*, i8** %3
%64 = getelementptr inbounds i8, i8* %63, i64 %61
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 %64, i8* align 1 %47, i64 %46, i1 false)
%65 = add nuw nsw i64 %53, 1
%66 = icmp eq i64 %65, %51
br i1 %66, label %67, label %52
67: ; preds = %52, %45
tail call void @free(i8* %47)
br label %68
68: ; preds = %67, %33
%69 = icmp sgt i32 %39, 0
br i1 %69, label %70, label %113
70: ; preds = %68
%71 = add nsw i64 %40, -1
%72 = udiv i64 %71, 3
%73 = add nuw nsw i64 %72, 1
%74 = and i64 %73, 1
%75 = icmp ult i64 %71, 3
br i1 %75, label %101, label %76
76: ; preds = %70
%77 = and i64 %73, 9223372036854775806
br label %78
78: ; preds = %78, %76
%79 = phi i64 [ 0, %76 ], [ %98, %78 ]
%80 = phi i64 [ 0, %76 ], [ %99, %78 ]
%81 = load i8*, i8** %3
%82 = getelementptr inbounds i8, i8* %81, i64 %79
%83 = load i8, i8* %82
%84 = add nuw nsw i64 %79, 2
%85 = getelementptr inbounds i8, i8* %81, i64 %84
%86 = load i8, i8* %85
store i8 %86, i8* %82
%87 = load i8*, i8** %3
%88 = getelementptr inbounds i8, i8* %87, i64 %84
store i8 %83, i8* %88
%89 = add nuw nsw i64 %79, 3
%90 = load i8*, i8** %3
%91 = getelementptr inbounds i8, i8* %90, i64 %89
%92 = load i8, i8* %91
%93 = add nuw nsw i64 %79, 5
%94 = getelementptr inbounds i8, i8* %90, i64 %93
%95 = load i8, i8* %94
store i8 %95, i8* %91
%96 = load i8*, i8** %3
%97 = getelementptr inbounds i8, i8* %96, i64 %93
store i8 %92, i8* %97
%98 = add nuw nsw i64 %79, 6
%99 = add i64 %80, 2
%100 = icmp eq i64 %99, %77
br i1 %100, label %101, label %78
101: ; preds = %78, %70
%102 = phi i64 [ 0, %70 ], [ %98, %78 ]
%103 = icmp eq i64 %74, 0
br i1 %103, label %113, label %104
104: ; preds = %101
%105 = load i8*, i8** %3
%106 = getelementptr inbounds i8, i8* %105, i64 %102
%107 = load i8, i8* %106
%108 = add nuw nsw i64 %102, 2
%109 = getelementptr inbounds i8, i8* %105, i64 %108
%110 = load i8, i8* %109
store i8 %110, i8* %106
%111 = load i8*, i8** %3
%112 = getelementptr inbounds i8, i8* %111, i64 %108
store i8 %107, i8* %112
br label %113
113: ; preds = %104, %101, %68
store i32 %35, i32* %1
store i32 %37, i32* %2
%114 = icmp eq i32 %42, %39
%115 = select i1 %114, i32 0, i32 4
br label %116
116: ; preds = %113, %4, %31
%117 = phi i32 [ 2, %31 ], [ 1, %4 ], [ %115, %113 ]
ret i32 %117
}