#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ assert(int /*<<< orphan*/);
char **calloc(int, int);
int /*<<< orphan*/ chdir(char *);
int execve(char *, char **, char **);
char *getenv(char *);
int /*<<< orphan*/ geteuid();
char *malloc(size_t);
int /*<<< orphan*/ setreuid(int /*<<< orphan*/, int /*<<< orphan*/);
size_t snprintf(int /*<<< orphan*/, int /*<<< orphan*/, char *, char *, ...);
int /*<<< orphan*/ sprintf(char *, char *, char *, ...);
int launch_nxserver(const char *username, int comm_fd, int argc, char **argv) {
  size_t env_string_length;
  char *env_string;
  char **new_env;
  char **new_argv;
  int i;
  setreuid(geteuid(), geteuid());
  new_env = calloc(5 + 1, sizeof(char *));
  i = 0;
  env_string_length = snprintf(0, 0, "%s=%s", "NX_TRUSTED_USER", username);
  env_string = malloc(env_string_length + 1);
  assert(env_string != NULL);
  sprintf(env_string, "%s=%s", "NX_TRUSTED_USER", username);
  new_env[i++] = env_string;
  env_string_length = snprintf(0, 0, "%s=%d", "NX_COMMFD", comm_fd);
  env_string = malloc(env_string_length + 1);
  assert(env_string != NULL);
  sprintf(env_string, "%s=%d", "NX_COMMFD", comm_fd);
  new_env[i++] = env_string;
  env_string_length = snprintf(0, 0, "%s=%s", "USER", "nx");
  env_string = malloc(env_string_length + 1);
  assert(env_string != NULL);
  sprintf(env_string, "%s=%s", "USER", "nx");
  new_env[i++] = env_string;
  if (getenv("SSH_CLIENT") != NULL) {
    env_string_length =
        snprintf(0, 0, "%s=%s", "SSH_CLIENT", getenv("SSH_CLIENT"));
    env_string = malloc(env_string_length + 1);
    assert(env_string != NULL);
    sprintf(env_string, "%s=%s", "SSH_CLIENT", getenv("SSH_CLIENT"));
    new_env[i++] = env_string;
  }
  if (getenv("SSH_CLIENT2") != NULL) {
    env_string_length =
        snprintf(0, 0, "%s=%s", "SSH_CLIENT2", getenv("SSH_CLIENT2"));
    env_string = malloc(env_string_length + 1);
    assert(env_string != NULL);
    sprintf(env_string, "%s=%s", "SSH_CLIENT2", getenv("SSH_CLIENT2"));
    new_env[i++] = env_string;
  }
  new_argv = calloc(argc + 1, sizeof(char *));
  new_argv[0] = "/usr/NX/bin/nxserver";
  for (i = 1; i < argc; ++i) {
    new_argv[i] = argv[i];
  }
  chdir("/usr/NX/bin/");
  return execve("/usr/NX/bin/nxserver", new_argv, new_env);
}


x86 assembly (clang, -O0):
<launch_nxserver>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    %edx,-0x10(%rbp)
mov    %rcx,-0x18(%rbp)
mov    $0x0,%al
call   1060 <geteuid@plt>
mov    %eax,-0x40(%rbp)
mov    $0x0,%al
call   1060 <geteuid@plt>
mov    -0x40(%rbp),%edi
mov    %eax,%esi
call   10b0 <setreuid@plt>
mov    $0x6,%edi
mov    $0x8,%esi
call   1080 <calloc@plt>
mov    %rax,-0x30(%rbp)
movl   $0x0,-0x3c(%rbp)
mov    -0x8(%rbp),%r8
xor    %esi,%esi
lea    0xe08(%rip),%rdx
lea    0xe07(%rip),%rcx
mov    %esi,%edi
mov    $0x0,%al
call   1050 <snprintf@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
add    $0x1,%rdi
call   10a0 <malloc@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
setne  %al
and    $0x1,%al
movzbl %al,%edi
call   1090 <assert@plt>
mov    -0x28(%rbp),%rdi
mov    -0x8(%rbp),%rcx
lea    0xdc2(%rip),%rsi
lea    0xdc1(%rip),%rdx
mov    $0x0,%al
call   10c0 <sprintf@plt>
mov    -0x28(%rbp),%rdx
mov    -0x30(%rbp),%rax
mov    -0x3c(%rbp),%ecx
mov    %ecx,%esi
add    $0x1,%esi
mov    %esi,-0x3c(%rbp)
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0xc(%rbp),%r8d
xor    %esi,%esi
lea    0xda3(%rip),%rdx
lea    0xda2(%rip),%rcx
mov    %esi,%edi
mov    $0x0,%al
call   1050 <snprintf@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
add    $0x1,%rdi
call   10a0 <malloc@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
setne  %al
and    $0x1,%al
movzbl %al,%edi
call   1090 <assert@plt>
mov    -0x28(%rbp),%rdi
mov    -0xc(%rbp),%ecx
lea    0xd5e(%rip),%rsi
lea    0xd5d(%rip),%rdx
mov    $0x0,%al
call   10c0 <sprintf@plt>
mov    -0x28(%rbp),%rdx
mov    -0x30(%rbp),%rax
mov    -0x3c(%rbp),%ecx
mov    %ecx,%esi
add    $0x1,%esi
mov    %esi,-0x3c(%rbp)
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
xor    %esi,%esi
lea    0xd17(%rip),%rdx
lea    0xd21(%rip),%rcx
lea    0xd2f(%rip),%r8
mov    %esi,%edi
mov    $0x0,%al
call   1050 <snprintf@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
add    $0x1,%rdi
call   10a0 <malloc@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
setne  %al
and    $0x1,%al
movzbl %al,%edi
call   1090 <assert@plt>
mov    -0x28(%rbp),%rdi
lea    0xcce(%rip),%rsi
lea    0xcd8(%rip),%rdx
lea    0xce6(%rip),%rcx
mov    $0x0,%al
call   10c0 <sprintf@plt>
mov    -0x28(%rbp),%rdx
mov    -0x30(%rbp),%rax
mov    -0x3c(%rbp),%ecx
mov    %ecx,%esi
add    $0x1,%esi
mov    %esi,-0x3c(%rbp)
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
lea    0xcc1(%rip),%rdi
call   1030 <getenv@plt>
cmp    $0x0,%rax
je     1410 <launch_nxserver+0x270>
lea    0xcab(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,%r8
xor    %esi,%esi
lea    0xc71(%rip),%rdx
lea    0xc93(%rip),%rcx
mov    %esi,%edi
mov    $0x0,%al
call   1050 <snprintf@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
add    $0x1,%rdi
call   10a0 <malloc@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
setne  %al
and    $0x1,%al
movzbl %al,%edi
call   1090 <assert@plt>
mov    -0x28(%rbp),%rax
mov    %rax,-0x48(%rbp)
lea    0xc54(%rip),%rdi
call   1030 <getenv@plt>
mov    -0x48(%rbp),%rdi
mov    %rax,%rcx
lea    0xc18(%rip),%rsi
lea    0xc3a(%rip),%rdx
mov    $0x0,%al
call   10c0 <sprintf@plt>
mov    -0x28(%rbp),%rdx
mov    -0x30(%rbp),%rax
mov    -0x3c(%rbp),%ecx
mov    %ecx,%esi
add    $0x1,%esi
mov    %esi,-0x3c(%rbp)
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
lea    0xc1d(%rip),%rdi
call   1030 <getenv@plt>
cmp    $0x0,%rax
je     14bf <launch_nxserver+0x31f>
lea    0xc07(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,%r8
xor    %esi,%esi
lea    0xbc2(%rip),%rdx
lea    0xbef(%rip),%rcx
mov    %esi,%edi
mov    $0x0,%al
call   1050 <snprintf@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
add    $0x1,%rdi
call   10a0 <malloc@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
setne  %al
and    $0x1,%al
movzbl %al,%edi
call   1090 <assert@plt>
mov    -0x28(%rbp),%rax
mov    %rax,-0x50(%rbp)
lea    0xbb0(%rip),%rdi
call   1030 <getenv@plt>
mov    -0x50(%rbp),%rdi
mov    %rax,%rcx
lea    0xb69(%rip),%rsi
lea    0xb96(%rip),%rdx
mov    $0x0,%al
call   10c0 <sprintf@plt>
mov    -0x28(%rbp),%rdx
mov    -0x30(%rbp),%rax
mov    -0x3c(%rbp),%ecx
mov    %ecx,%esi
add    $0x1,%esi
mov    %esi,-0x3c(%rbp)
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0x10(%rbp),%edi
add    $0x1,%edi
mov    $0x8,%esi
call   1080 <calloc@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
lea    0xb62(%rip),%rcx
mov    %rcx,(%rax)
movl   $0x1,-0x3c(%rbp)
mov    -0x3c(%rbp),%eax
cmp    -0x10(%rbp),%eax
jge    151a <launch_nxserver+0x37a>
mov    -0x18(%rbp),%rax
movslq -0x3c(%rbp),%rcx
mov    (%rax,%rcx,8),%rdx
mov    -0x38(%rbp),%rax
movslq -0x3c(%rbp),%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0x3c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x3c(%rbp)
jmp    14e8 <launch_nxserver+0x348>
lea    0xb34(%rip),%rdi
call   1040 <chdir@plt>
mov    -0x38(%rbp),%rsi
mov    -0x30(%rbp),%rdx
lea    0xb0b(%rip),%rdi
call   1070 <execve@plt>
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<launch_nxserver>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rcx,0x8(%rsp)
mov    %rdx,0x10(%rsp)
mov    %esi,%r14d
mov    %rdi,%rbx
xor    %eax,%eax
call   1060 <geteuid@plt>
mov    %eax,%ebp
xor    %eax,%eax
call   1060 <geteuid@plt>
mov    %ebp,%edi
mov    %eax,%esi
call   10c0 <setreuid@plt>
mov    $0x6,%edi
mov    $0x8,%esi
call   1080 <calloc@plt>
mov    %rax,%r13
lea    0xe00(%rip),%r12
lea    0xdff(%rip),%rbp
xor    %edi,%edi
xor    %esi,%esi
mov    %r12,%rdx
mov    %rbp,%rcx
mov    %rbx,%r8
xor    %eax,%eax
call   1050 <snprintf@plt>
lea    0x1(%rax),%rdi
call   10b0 <malloc@plt>
mov    %rax,%r15
xor    %edi,%edi
test   %rax,%rax
setne  %dil
call   1090 <assert@plt>
mov    %r15,%rdi
mov    %r12,%rsi
mov    %rbp,%rdx
mov    %rbx,%rcx
xor    %eax,%eax
call   10d0 <sprintf@plt>
mov    %r15,0x0(%r13)
lea    0xdc3(%rip),%r15
lea    0xdc2(%rip),%rbp
xor    %edi,%edi
xor    %esi,%esi
mov    %r15,%rdx
mov    %rbp,%rcx
mov    %r14d,%r8d
xor    %eax,%eax
call   1050 <snprintf@plt>
lea    0x1(%rax),%rdi
call   10b0 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
test   %rax,%rax
setne  %dil
call   1090 <assert@plt>
mov    %rbx,%rdi
mov    %r15,%rsi
mov    %rbp,%rdx
mov    %r14d,%ecx
xor    %eax,%eax
call   10d0 <sprintf@plt>
mov    %rbx,0x8(%r13)
lea    0xd6b(%rip),%r14
lea    0xd79(%rip),%rbp
xor    %edi,%edi
xor    %esi,%esi
mov    %r12,%rdx
mov    %r14,%rcx
mov    %rbp,%r8
xor    %eax,%eax
call   1050 <snprintf@plt>
lea    0x1(%rax),%rdi
call   10b0 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
test   %rax,%rax
setne  %dil
call   1090 <assert@plt>
mov    %rbx,%rdi
mov    %r12,%rsi
mov    %r14,%rdx
mov    %rbp,%rcx
xor    %eax,%eax
call   10d0 <sprintf@plt>
mov    %rbx,0x10(%r13)
lea    0xd30(%rip),%rdi
call   1030 <getenv@plt>
test   %rax,%rax
je     1366 <launch_nxserver+0x1b6>
lea    0xcf6(%rip),%r14
lea    0xd18(%rip),%rbp
xor    %edi,%edi
xor    %esi,%esi
mov    %r14,%rdx
mov    %rbp,%rcx
mov    %rax,%r8
xor    %eax,%eax
call   1050 <snprintf@plt>
lea    0x1(%rax),%rdi
call   10b0 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
test   %rax,%rax
setne  %dil
call   1090 <assert@plt>
mov    %rbp,%rdi
call   1030 <getenv@plt>
mov    %rbx,%rdi
mov    %r14,%rsi
mov    %rbp,%rdx
mov    %rax,%rcx
xor    %eax,%eax
call   10d0 <sprintf@plt>
mov    %rbx,0x18(%r13)
mov    $0x4,%r15d
jmp    136c <launch_nxserver+0x1bc>
mov    $0x3,%r15d
lea    0xcc1(%rip),%rdi
call   1030 <getenv@plt>
test   %rax,%rax
je     13d9 <launch_nxserver+0x229>
lea    0xc7c(%rip),%r14
lea    0xca9(%rip),%rbp
xor    %edi,%edi
xor    %esi,%esi
mov    %r14,%rdx
mov    %rbp,%rcx
mov    %rax,%r8
xor    %eax,%eax
call   1050 <snprintf@plt>
lea    0x1(%rax),%rdi
call   10b0 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
test   %rax,%rax
setne  %dil
call   1090 <assert@plt>
mov    %rbp,%rdi
call   1030 <getenv@plt>
mov    %rbx,%rdi
mov    %r14,%rsi
mov    %rbp,%rdx
mov    %rax,%rcx
xor    %eax,%eax
call   10d0 <sprintf@plt>
mov    %rbx,0x0(%r13,%r15,8)
mov    0x10(%rsp),%rbp
lea    0x1(%rbp),%edi
mov    $0x8,%esi
call   1080 <calloc@plt>
mov    %rax,%rbx
lea    0xc4b(%rip),%rax
mov    %rax,(%rbx)
cmp    $0x2,%ebp
jl     141c <launch_nxserver+0x26c>
mov    %rbx,%rdi
add    $0x8,%rdi
mov    0x8(%rsp),%rsi
add    $0x8,%rsi
add    $0xffffffff,%ebp
shl    $0x3,%rbp
mov    %rbp,%rdx
call   10a0 <memcpy@plt>
lea    0xc32(%rip),%rdi
call   1040 <chdir@plt>
lea    0xc11(%rip),%rdi
mov    %rbx,%rsi
mov    %r13,%rdx
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
jmp    1070 <execve@plt>

LLVM IR (-O0):
@.str = [6 x i8] c"%s=%s\00"
@.str.1 = [16 x i8] c"NX_TRUSTED_USER\00"
@.str.2 = [6 x i8] c"%s=%d\00"
@.str.3 = [10 x i8] c"NX_COMMFD\00"
@.str.4 = [5 x i8] c"USER\00"
@.str.5 = [3 x i8] c"nx\00"
@.str.6 = [11 x i8] c"SSH_CLIENT\00"
@.str.7 = [12 x i8] c"SSH_CLIENT2\00"
@.str.8 = [21 x i8] c"/usr/NX/bin/nxserver\00"
@.str.9 = [13 x i8] c"/usr/NX/bin/\00"
define i32 @launch_nxserver(i8* %0, i32 %1, i32 %2, i8** %3) {
%5 = alloca i8*
%6 = alloca i32
%7 = alloca i32
%8 = alloca i8**
%9 = alloca i64
%10 = alloca i8*
%11 = alloca i8**
%12 = alloca i8**
%13 = alloca i32
store i8* %0, i8** %5
store i32 %1, i32* %6
store i32 %2, i32* %7
store i8** %3, i8*** %8
%14 = call i32 (...) @geteuid()
%15 = call i32 (...) @geteuid()
%16 = call i32 @setreuid(i32 %14, i32 %15)
%17 = call i8** @calloc(i32 6, i32 8)
store i8** %17, i8*** %11
store i32 0, i32* %13
%18 = load i8*, i8** %5
%19 = call i64 (i32, i32, i8*, i8*, ...) @snprintf(i32 0, i32 0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i8* %18)
store i64 %19, i64* %9
%20 = load i64, i64* %9
%21 = add i64 %20, 1
%22 = call i8* @malloc(i64 %21)
store i8* %22, i8** %10
%23 = load i8*, i8** %10
%24 = icmp ne i8* %23, null
%25 = zext i1 %24 to i32
%26 = call i32 @assert(i32 %25)
%27 = load i8*, i8** %10
%28 = load i8*, i8** %5
%29 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %27, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i8* %28)
%30 = load i8*, i8** %10
%31 = load i8**, i8*** %11
%32 = load i32, i32* %13
%33 = add nsw i32 %32, 1
store i32 %33, i32* %13
%34 = sext i32 %32 to i64
%35 = getelementptr inbounds i8*, i8** %31, i64 %34
store i8* %30, i8** %35
%36 = load i32, i32* %6
%37 = call i64 (i32, i32, i8*, i8*, ...) @snprintf(i32 0, i32 0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i64 0, i64 0), i32 %36)
store i64 %37, i64* %9
%38 = load i64, i64* %9
%39 = add i64 %38, 1
%40 = call i8* @malloc(i64 %39)
store i8* %40, i8** %10
%41 = load i8*, i8** %10
%42 = icmp ne i8* %41, null
%43 = zext i1 %42 to i32
%44 = call i32 @assert(i32 %43)
%45 = load i8*, i8** %10
%46 = load i32, i32* %6
%47 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %45, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i64 0, i64 0), i32 %46)
%48 = load i8*, i8** %10
%49 = load i8**, i8*** %11
%50 = load i32, i32* %13
%51 = add nsw i32 %50, 1
store i32 %51, i32* %13
%52 = sext i32 %50 to i64
%53 = getelementptr inbounds i8*, i8** %49, i64 %52
store i8* %48, i8** %53
%54 = call i64 (i32, i32, i8*, i8*, ...) @snprintf(i32 0, i32 0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
store i64 %54, i64* %9
%55 = load i64, i64* %9
%56 = add i64 %55, 1
%57 = call i8* @malloc(i64 %56)
store i8* %57, i8** %10
%58 = load i8*, i8** %10
%59 = icmp ne i8* %58, null
%60 = zext i1 %59 to i32
%61 = call i32 @assert(i32 %60)
%62 = load i8*, i8** %10
%63 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %62, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
%64 = load i8*, i8** %10
%65 = load i8**, i8*** %11
%66 = load i32, i32* %13
%67 = add nsw i32 %66, 1
store i32 %67, i32* %13
%68 = sext i32 %66 to i64
%69 = getelementptr inbounds i8*, i8** %65, i64 %68
store i8* %64, i8** %69
%70 = call i8* @getenv(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0))
%71 = icmp ne i8* %70, null
br i1 %71, label %72, label %91
72: ; preds = %4
%73 = call i8* @getenv(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0))
%74 = call i64 (i32, i32, i8*, i8*, ...) @snprintf(i32 0, i32 0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0), i8* %73)
store i64 %74, i64* %9
%75 = load i64, i64* %9
%76 = add i64 %75, 1
%77 = call i8* @malloc(i64 %76)
store i8* %77, i8** %10
%78 = load i8*, i8** %10
%79 = icmp ne i8* %78, null
%80 = zext i1 %79 to i32
%81 = call i32 @assert(i32 %80)
%82 = load i8*, i8** %10
%83 = call i8* @getenv(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0))
%84 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %82, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0), i8* %83)
%85 = load i8*, i8** %10
%86 = load i8**, i8*** %11
%87 = load i32, i32* %13
%88 = add nsw i32 %87, 1
store i32 %88, i32* %13
%89 = sext i32 %87 to i64
%90 = getelementptr inbounds i8*, i8** %86, i64 %89
store i8* %85, i8** %90
br label %91
91: ; preds = %72, %4
%92 = call i8* @getenv(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%93 = icmp ne i8* %92, null
br i1 %93, label %94, label %113
94: ; preds = %91
%95 = call i8* @getenv(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%96 = call i64 (i32, i32, i8*, i8*, ...) @snprintf(i32 0, i32 0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0), i8* %95)
store i64 %96, i64* %9
%97 = load i64, i64* %9
%98 = add i64 %97, 1
%99 = call i8* @malloc(i64 %98)
store i8* %99, i8** %10
%100 = load i8*, i8** %10
%101 = icmp ne i8* %100, null
%102 = zext i1 %101 to i32
%103 = call i32 @assert(i32 %102)
%104 = load i8*, i8** %10
%105 = call i8* @getenv(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%106 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %104, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0), i8* %105)
%107 = load i8*, i8** %10
%108 = load i8**, i8*** %11
%109 = load i32, i32* %13
%110 = add nsw i32 %109, 1
store i32 %110, i32* %13
%111 = sext i32 %109 to i64
%112 = getelementptr inbounds i8*, i8** %108, i64 %111
store i8* %107, i8** %112
br label %113
113: ; preds = %94, %91
%114 = load i32, i32* %7
%115 = add nsw i32 %114, 1
%116 = call i8** @calloc(i32 %115, i32 8)
store i8** %116, i8*** %12
%117 = load i8**, i8*** %12
%118 = getelementptr inbounds i8*, i8** %117, i64 0
store i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.8, i64 0, i64 0), i8** %118
store i32 1, i32* %13
br label %119
119: ; preds = %133, %113
%120 = load i32, i32* %13
%121 = load i32, i32* %7
%122 = icmp slt i32 %120, %121
br i1 %122, label %123, label %136
123: ; preds = %119
%124 = load i8**, i8*** %8
%125 = load i32, i32* %13
%126 = sext i32 %125 to i64
%127 = getelementptr inbounds i8*, i8** %124, i64 %126
%128 = load i8*, i8** %127
%129 = load i8**, i8*** %12
%130 = load i32, i32* %13
%131 = sext i32 %130 to i64
%132 = getelementptr inbounds i8*, i8** %129, i64 %131
store i8* %128, i8** %132
br label %133
133: ; preds = %123
%134 = load i32, i32* %13
%135 = add nsw i32 %134, 1
store i32 %135, i32* %13
br label %119
136: ; preds = %119
%137 = call i32 @chdir(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.9, i64 0, i64 0))
%138 = load i8**, i8*** %12
%139 = load i8**, i8*** %11
%140 = call i32 @execve(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.8, i64 0, i64 0), i8** %138, i8** %139)
ret i32 %140
}

LLVM IR (-O2):
@.str = [6 x i8] c"%s=%s\00"
@.str.1 = [16 x i8] c"NX_TRUSTED_USER\00"
@.str.2 = [6 x i8] c"%s=%d\00"
@.str.3 = [10 x i8] c"NX_COMMFD\00"
@.str.4 = [5 x i8] c"USER\00"
@.str.5 = [3 x i8] c"nx\00"
@.str.6 = [11 x i8] c"SSH_CLIENT\00"
@.str.7 = [12 x i8] c"SSH_CLIENT2\00"
@.str.8 = [21 x i8] c"/usr/NX/bin/nxserver\00"
@.str.9 = [13 x i8] c"/usr/NX/bin/\00"
define i32 @launch_nxserver(i8* %0, i32 %1, i32 %2, i8** nocapture %3) {
%5 = tail call i32 (...) @geteuid()
%6 = tail call i32 (...) @geteuid()
%7 = tail call i32 @setreuid(i32 %5, i32 %6)
%8 = tail call i8** @calloc(i32 6, i32 8)
%9 = tail call i64 (i32, i32, i8*, i8*, ...) @snprintf(i32 0, i32 0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i8* %0)
%10 = add i64 %9, 1
%11 = tail call i8* @malloc(i64 %10)
%12 = icmp ne i8* %11, null
%13 = zext i1 %12 to i32
%14 = tail call i32 @assert(i32 %13)
%15 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %11, i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i8* %0)
store i8* %11, i8** %8
%16 = tail call i64 (i32, i32, i8*, i8*, ...) @snprintf(i32 0, i32 0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i64 0, i64 0), i32 %1)
%17 = add i64 %16, 1
%18 = tail call i8* @malloc(i64 %17)
%19 = icmp ne i8* %18, null
%20 = zext i1 %19 to i32
%21 = tail call i32 @assert(i32 %20)
%22 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %18, i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i64 0, i64 0), i32 %1)
%23 = getelementptr inbounds i8*, i8** %8, i64 1
store i8* %18, i8** %23
%24 = tail call i64 (i32, i32, i8*, i8*, ...) @snprintf(i32 0, i32 0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
%25 = add i64 %24, 1
%26 = tail call i8* @malloc(i64 %25)
%27 = icmp ne i8* %26, null
%28 = zext i1 %27 to i32
%29 = tail call i32 @assert(i32 %28)
%30 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %26, i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
%31 = getelementptr inbounds i8*, i8** %8, i64 2
store i8* %26, i8** %31
%32 = tail call i8* @getenv(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0))
%33 = icmp eq i8* %32, null
br i1 %33, label %44, label %34
34: ; preds = %4
%35 = tail call i64 (i32, i32, i8*, i8*, ...) @snprintf(i32 0, i32 0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0), i8* %32)
%36 = add i64 %35, 1
%37 = tail call i8* @malloc(i64 %36)
%38 = icmp ne i8* %37, null
%39 = zext i1 %38 to i32
%40 = tail call i32 @assert(i32 %39)
%41 = tail call i8* @getenv(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0))
%42 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %37, i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.6, i64 0, i64 0), i8* %41)
%43 = getelementptr inbounds i8*, i8** %8, i64 3
store i8* %37, i8** %43
br label %44
44: ; preds = %34, %4
%45 = phi i64 [ 4, %34 ], [ 3, %4 ]
%46 = tail call i8* @getenv(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%47 = icmp eq i8* %46, null
br i1 %47, label %58, label %48
48: ; preds = %44
%49 = tail call i64 (i32, i32, i8*, i8*, ...) @snprintf(i32 0, i32 0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0), i8* %46)
%50 = add i64 %49, 1
%51 = tail call i8* @malloc(i64 %50)
%52 = icmp ne i8* %51, null
%53 = zext i1 %52 to i32
%54 = tail call i32 @assert(i32 %53)
%55 = tail call i8* @getenv(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0))
%56 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %51, i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.7, i64 0, i64 0), i8* %55)
%57 = getelementptr inbounds i8*, i8** %8, i64 %45
store i8* %51, i8** %57
br label %58
58: ; preds = %48, %44
%59 = add nsw i32 %2, 1
%60 = tail call i8** @calloc(i32 %59, i32 8)
store i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.8, i64 0, i64 0), i8** %60
%61 = icmp sgt i32 %2, 1
br i1 %61, label %62, label %70
62: ; preds = %58
%63 = getelementptr i8*, i8** %60, i64 1
%64 = bitcast i8** %63 to i8*
%65 = getelementptr i8*, i8** %3, i64 1
%66 = bitcast i8** %65 to i8*
%67 = add nsw i32 %2, -1
%68 = zext i32 %67 to i64
%69 = shl nuw nsw i64 %68, 3
br label %70
70: ; preds = %62, %58
%71 = tail call i32 @chdir(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.9, i64 0, i64 0))
%72 = tail call i32 @execve(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.8, i64 0, i64 0), i8** %60, i8** %8)
ret i32 %72
}