#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ uid_t;
struct passwd {
  int /*<<< orphan*/ pw_uid;
};
typedef int /*<<< orphan*/ program;

/* Variables and functions */
int change_state(char *);
int /*<<< orphan*/ err(int, char *);
int /*<<< orphan*/ errx(int, char *);
int execlp(char *, char *, char *, char *, int /*<<< orphan*/ *, char **,
           int /*<<< orphan*/ *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *);
char *getenv(char *);
struct passwd *getpwnam(char *);
int /*<<< orphan*/ perror(char *);
scalar_t__ seteuid(int /*<<< orphan*/);
scalar_t__ setuid(int /*<<< orphan*/);
int /*<<< orphan*/ snprintf(char *, int, char *, char *);
int /*<<< orphan*/ stderr;
scalar_t__ strcmp(char *, char *);
int main(int argc, char **argv, char **envp __attribute__((__unused__))) {
  char *perlprog = "/usr/bin/perl";
  char program[1024];
  char *boithohome;
  int ret;
  struct passwd *pwd;
  uid_t webuid, execuid;
  char *perlenv[] = {NULL};
  if (argc < 2)
    errx(1, "Usage: ./setuidcaller cmd");
  if ((pwd = getpwnam("apache")) == NULL) {
    perror("Could not find web user");
    return 80;
  }
  webuid = pwd->pw_uid;
  if ((pwd = getpwnam("phonehome")) == NULL) {
    perror("Could not find exec user");
    return 81;
  }
  execuid = pwd->pw_uid;
  if (argc < 2) {
    fprintf(stderr, "Wrong number of arguments.\n");
    return 98;
  }
  boithohome = getenv("BOITHOHOME");
  if (boithohome == NULL) {
    err(1, "getenv(BOITHOHOME)");
    return 105;
  }
  snprintf(program, sizeof(program), "%s/bin/bb-client.pl", boithohome);
  if (setuid(0) != 0) {
    perror("Could not setuid(0)");
    return 97;
  }
  if (seteuid(0) != 0) {
    perror("Could not seteuid(0)");
    return 96;
  }
  if (setuid(execuid) != 0) {
    perror("Could not setuid()");
    return 95;
  }
  if (seteuid(execuid) != 0) {
    perror("Could not seteuid()");
    return 94;
  }
  if (strcmp(argv[1], "start") == 0) {
    ret = change_state("alive");
    ret = execlp(perlprog, "perl", program, "start", NULL, perlenv, NULL);
  } else if (strcmp(argv[1], "stop") == 0) {
    ret = change_state("dead");
    ret = execlp(perlprog, "perl", program, "stop", NULL, perlenv, NULL);
  } else {
    ret = execlp(perlprog, "perl", program, "running", NULL, perlenv, NULL);
  }
  perror("Unable to exec program");
  return ret;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x450,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
lea    0xe0c(%rip),%rax
mov    %rax,-0x20(%rbp)
lea    -0x448(%rbp),%rdi
xor    %esi,%esi
mov    $0x8,%edx
call   1060 <memset@plt>
cmpl   $0x2,-0x8(%rbp)
jge    1226 <main+0x56>
mov    $0x1,%edi
lea    0xded(%rip),%rsi
call   1040 <errx@plt>
lea    0xdfb(%rip),%rdi
call   1090 <getpwnam@plt>
mov    %rax,-0x438(%rbp)
cmp    $0x0,%rax
jne    125b <main+0x8b>
lea    0xde5(%rip),%rdi
call   10c0 <perror@plt>
movl   $0x50,-0x4(%rbp)
jmp    150e <main+0x33e>
mov    -0x438(%rbp),%rax
mov    (%rax),%eax
mov    %eax,-0x43c(%rbp)
lea    0xdd6(%rip),%rdi
call   1090 <getpwnam@plt>
mov    %rax,-0x438(%rbp)
cmp    $0x0,%rax
jne    129f <main+0xcf>
lea    0xdc3(%rip),%rdi
call   10c0 <perror@plt>
movl   $0x51,-0x4(%rbp)
jmp    150e <main+0x33e>
mov    -0x438(%rbp),%rax
mov    (%rax),%eax
mov    %eax,-0x440(%rbp)
cmpl   $0x2,-0x8(%rbp)
jge    12d9 <main+0x109>
mov    0x2d21(%rip),%rax
mov    (%rax),%edi
lea    0xda2(%rip),%rsi
call   10a0 <fprintf@plt>
movl   $0x62,-0x4(%rbp)
jmp    150e <main+0x33e>
lea    0xda6(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,-0x428(%rbp)
cmpq   $0x0,-0x428(%rbp)
jne    1317 <main+0x147>
mov    $0x1,%edi
lea    0xd8b(%rip),%rsi
call   10b0 <err@plt>
movl   $0x69,-0x4(%rbp)
jmp    150e <main+0x33e>
lea    -0x420(%rbp),%rdi
mov    -0x428(%rbp),%rcx
mov    $0x400,%esi
lea    0xd73(%rip),%rdx
call   1050 <snprintf@plt>
xor    %edi,%edi
call   10d0 <setuid@plt>
cmp    $0x0,%rax
je     135f <main+0x18f>
lea    0xd6a(%rip),%rdi
call   10c0 <perror@plt>
movl   $0x61,-0x4(%rbp)
jmp    150e <main+0x33e>
xor    %edi,%edi
call   10f0 <seteuid@plt>
cmp    $0x0,%rax
je     1388 <main+0x1b8>
lea    0xd55(%rip),%rdi
call   10c0 <perror@plt>
movl   $0x60,-0x4(%rbp)
jmp    150e <main+0x33e>
mov    -0x440(%rbp),%edi
call   10d0 <setuid@plt>
cmp    $0x0,%rax
je     13b5 <main+0x1e5>
lea    0xd3d(%rip),%rdi
call   10c0 <perror@plt>
movl   $0x5f,-0x4(%rbp)
jmp    150e <main+0x33e>
mov    -0x440(%rbp),%edi
call   10f0 <seteuid@plt>
cmp    $0x0,%rax
je     13e2 <main+0x212>
lea    0xd23(%rip),%rdi
call   10c0 <perror@plt>
movl   $0x5e,-0x4(%rbp)
jmp    150e <main+0x33e>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xd17(%rip),%rsi
call   1080 <strcmp@plt>
cmp    $0x0,%rax
jne    144f <main+0x27f>
lea    0xd07(%rip),%rdi
call   1070 <change_state@plt>
mov    %eax,-0x42c(%rbp)
mov    -0x20(%rbp),%rdi
lea    -0x420(%rbp),%rdx
lea    -0x448(%rbp),%r9
lea    0xbde(%rip),%rsi
lea    0xcd6(%rip),%rcx
xor    %eax,%eax
mov    %eax,%r8d
movq   $0x0,(%rsp)
call   10e0 <execlp@plt>
mov    %eax,-0x42c(%rbp)
jmp    14f9 <main+0x329>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xcb6(%rip),%rsi
call   1080 <strcmp@plt>
cmp    $0x0,%rax
jne    14bc <main+0x2ec>
lea    0xca5(%rip),%rdi
call   1070 <change_state@plt>
mov    %eax,-0x42c(%rbp)
mov    -0x20(%rbp),%rdi
lea    -0x420(%rbp),%rdx
lea    -0x448(%rbp),%r9
lea    0xb71(%rip),%rsi
lea    0xc75(%rip),%rcx
xor    %eax,%eax
mov    %eax,%r8d
movq   $0x0,(%rsp)
call   10e0 <execlp@plt>
mov    %eax,-0x42c(%rbp)
jmp    14f4 <main+0x324>
mov    -0x20(%rbp),%rdi
lea    -0x420(%rbp),%rdx
lea    -0x448(%rbp),%r9
lea    0xb34(%rip),%rsi
lea    0xc42(%rip),%rcx
xor    %eax,%eax
mov    %eax,%r8d
movq   $0x0,(%rsp)
call   10e0 <execlp@plt>
mov    %eax,-0x42c(%rbp)
jmp    14f9 <main+0x329>
lea    0xc26(%rip),%rdi
call   10c0 <perror@plt>
mov    -0x42c(%rbp),%eax
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x450,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %rbx
sub    $0x418,%rsp
mov    %rsi,%rbx
mov    %edi,%ebp
movq   $0x0,0x8(%rsp)
cmp    $0x1,%edi
jg     11ed <main+0x2d>
lea    0xe2b(%rip),%rsi
mov    $0x1,%edi
call   1040 <errx@plt>
lea    0xe34(%rip),%rdi
call   1080 <getpwnam@plt>
test   %rax,%rax
je     1265 <main+0xa5>
lea    0xe42(%rip),%rdi
call   1080 <getpwnam@plt>
test   %rax,%rax
je     1278 <main+0xb8>
cmp    $0x1,%ebp
jg     1230 <main+0x70>
mov    0x2dc5(%rip),%rax
mov    (%rax),%edi
lea    0xe46(%rip),%rsi
call   1090 <fprintf@plt>
mov    $0x62,%ebx
jmp    1259 <main+0x99>
mov    (%rax),%ebp
lea    0xe4d(%rip),%rdi
call   1030 <getenv@plt>
test   %rax,%rax
jne    128b <main+0xcb>
lea    0xe47(%rip),%rsi
mov    $0x1,%edi
call   10a0 <err@plt>
mov    $0x69,%ebx
mov    %ebx,%eax
add    $0x418,%rsp
pop    %rbx
pop    %rbp
ret
lea    0xdc3(%rip),%rdi
call   10b0 <perror@plt>
mov    $0x50,%ebx
jmp    1259 <main+0x99>
lea    0xdd2(%rip),%rdi
call   10b0 <perror@plt>
mov    $0x51,%ebx
jmp    1259 <main+0x99>
lea    0xe12(%rip),%rdx
lea    0x10(%rsp),%rdi
mov    $0x400,%esi
mov    %rax,%rcx
call   1050 <snprintf@plt>
xor    %edi,%edi
call   10c0 <setuid@plt>
test   %rax,%rax
jne    12f5 <main+0x135>
xor    %edi,%edi
call   10e0 <seteuid@plt>
test   %rax,%rax
jne    130b <main+0x14b>
mov    %ebp,%edi
call   10c0 <setuid@plt>
test   %rax,%rax
jne    1321 <main+0x161>
mov    %ebp,%edi
call   10e0 <seteuid@plt>
test   %rax,%rax
jne    1337 <main+0x177>
mov    0x8(%rbx),%rdi
lea    0xe29(%rip),%rbp
mov    %rbp,%rsi
call   1070 <strcmp@plt>
test   %rax,%rax
jne    134d <main+0x18d>
lea    0xe1b(%rip),%rdi
jmp    136c <main+0x1ac>
lea    0xdbc(%rip),%rdi
call   10b0 <perror@plt>
mov    $0x61,%ebx
jmp    1259 <main+0x99>
lea    0xdba(%rip),%rdi
call   10b0 <perror@plt>
mov    $0x60,%ebx
jmp    1259 <main+0x99>
lea    0xdb9(%rip),%rdi
call   10b0 <perror@plt>
mov    $0x5f,%ebx
jmp    1259 <main+0x99>
lea    0xdb6(%rip),%rdi
call   10b0 <perror@plt>
mov    $0x5e,%ebx
jmp    1259 <main+0x99>
mov    0x8(%rbx),%rdi
lea    0xdbc(%rip),%rbp
mov    %rbp,%rsi
call   1070 <strcmp@plt>
test   %rax,%rax
jne    1373 <main+0x1b3>
lea    0xdad(%rip),%rdi
call   1060 <change_state@plt>
jmp    137a <main+0x1ba>
lea    0xda4(%rip),%rbp
movq   $0x0,(%rsp)
lea    0xc77(%rip),%rdi
lea    0xc79(%rip),%rsi
lea    0x10(%rsp),%rdx
lea    0x8(%rsp),%r9
mov    %rbp,%rcx
xor    %r8d,%r8d
call   10d0 <execlp@plt>
mov    %eax,%ebx
lea    0xd78(%rip),%rdi
call   10b0 <perror@plt>
jmp    1259 <main+0x99>

LLVM IR (-O0):
%struct.passwd = type { i32 }
@.str = [14 x i8] c"/usr/bin/perl\00"
@.str.1 = [26 x i8] c"Usage: ./setuidcaller cmd\00"
@.str.2 = [7 x i8] c"apache\00"
@.str.3 = [24 x i8] c"Could not find web user\00"
@.str.4 = [10 x i8] c"phonehome\00"
@.str.5 = [25 x i8] c"Could not find exec user\00"
@stderr = global i32 0
@.str.6 = [28 x i8] c"Wrong number of arguments.\0A\00"
@.str.7 = [11 x i8] c"BOITHOHOME\00"
@.str.8 = [19 x i8] c"getenv(BOITHOHOME)\00"
@.str.9 = [20 x i8] c"%s/bin/bb-client.pl\00"
@.str.10 = [20 x i8] c"Could not setuid(0)\00"
@.str.11 = [21 x i8] c"Could not seteuid(0)\00"
@.str.12 = [19 x i8] c"Could not setuid()\00"
@.str.13 = [20 x i8] c"Could not seteuid()\00"
@.str.14 = [6 x i8] c"start\00"
@.str.15 = [6 x i8] c"alive\00"
@.str.16 = [5 x i8] c"perl\00"
@.str.17 = [5 x i8] c"stop\00"
@.str.18 = [5 x i8] c"dead\00"
@.str.19 = [8 x i8] c"running\00"
@.str.20 = [23 x i8] c"Unable to exec program\00"
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca i32
%5 = alloca i32
%6 = alloca i8**
%7 = alloca i8**
%8 = alloca i8*
%9 = alloca [1024 x i8]
%10 = alloca i8*
%11 = alloca i32
%12 = alloca %struct.passwd*
%13 = alloca i32
%14 = alloca i32
%15 = alloca [1 x i8*]
store i32 0, i32* %4
store i32 %0, i32* %5
store i8** %1, i8*** %6
store i8** %2, i8*** %7
store i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i8** %8
%16 = bitcast [1 x i8*]* %15 to i8*
%17 = load i32, i32* %5
%18 = icmp slt i32 %17, 2
br i1 %18, label %19, label %21
19: ; preds = %3
%20 = call i32 @errx(i32 1, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.1, i64 0, i64 0))
br label %21
21: ; preds = %19, %3
%22 = call %struct.passwd* @getpwnam(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
store %struct.passwd* %22, %struct.passwd** %12
%23 = icmp eq %struct.passwd* %22, null
br i1 %23, label %24, label %26
24: ; preds = %21
%25 = call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.3, i64 0, i64 0))
store i32 80, i32* %4
br label %107
26: ; preds = %21
%27 = load %struct.passwd*, %struct.passwd** %12
%28 = getelementptr inbounds %struct.passwd, %struct.passwd* %27, i32 0, i32 0
%29 = load i32, i32* %28
store i32 %29, i32* %13
%30 = call %struct.passwd* @getpwnam(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.4, i64 0, i64 0))
store %struct.passwd* %30, %struct.passwd** %12
%31 = icmp eq %struct.passwd* %30, null
br i1 %31, label %32, label %34
32: ; preds = %26
%33 = call i32 @perror(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.5, i64 0, i64 0))
store i32 81, i32* %4
br label %107
34: ; preds = %26
%35 = load %struct.passwd*, %struct.passwd** %12
%36 = getelementptr inbounds %struct.passwd, %struct.passwd* %35, i32 0, i32 0
%37 = load i32, i32* %36
store i32 %37, i32* %14
%38 = load i32, i32* %5
%39 = icmp slt i32 %38, 2
br i1 %39, label %40, label %43
40: ; preds = %34
%41 = load i32, i32* @stderr
%42 = call i32 @fprintf(i32 %41, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.6, i64 0, i64 0))
store i32 98, i32* %4
br label %107
43: ; preds = %34
%44 = call i8* @getenv(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.7, i64 0, i64 0))
store i8* %44, i8** %10
%45 = load i8*, i8** %10
%46 = icmp eq i8* %45, null
br i1 %46, label %47, label %49
47: ; preds = %43
%48 = call i32 @err(i32 1, i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.8, i64 0, i64 0))
store i32 105, i32* %4
br label %107
49: ; preds = %43
%50 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%51 = load i8*, i8** %10
%52 = call i32 @snprintf(i8* %50, i32 1024, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.9, i64 0, i64 0), i8* %51)
%53 = call i64 @setuid(i32 0)
%54 = icmp ne i64 %53, 0
br i1 %54, label %55, label %57
55: ; preds = %49
%56 = call i32 @perror(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.10, i64 0, i64 0))
store i32 97, i32* %4
br label %107
57: ; preds = %49
%58 = call i64 @seteuid(i32 0)
%59 = icmp ne i64 %58, 0
br i1 %59, label %60, label %62
60: ; preds = %57
%61 = call i32 @perror(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.11, i64 0, i64 0))
store i32 96, i32* %4
br label %107
62: ; preds = %57
%63 = load i32, i32* %14
%64 = call i64 @setuid(i32 %63)
%65 = icmp ne i64 %64, 0
br i1 %65, label %66, label %68
66: ; preds = %62
%67 = call i32 @perror(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.12, i64 0, i64 0))
store i32 95, i32* %4
br label %107
68: ; preds = %62
%69 = load i32, i32* %14
%70 = call i64 @seteuid(i32 %69)
%71 = icmp ne i64 %70, 0
br i1 %71, label %72, label %74
72: ; preds = %68
%73 = call i32 @perror(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.13, i64 0, i64 0))
store i32 94, i32* %4
br label %107
74: ; preds = %68
%75 = load i8**, i8*** %6
%76 = getelementptr inbounds i8*, i8** %75, i64 1
%77 = load i8*, i8** %76
%78 = call i64 @strcmp(i8* %77, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.14, i64 0, i64 0))
%79 = icmp eq i64 %78, 0
br i1 %79, label %80, label %86
80: ; preds = %74
%81 = call i32 @change_state(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.15, i64 0, i64 0))
store i32 %81, i32* %11
%82 = load i8*, i8** %8
%83 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%84 = getelementptr inbounds [1 x i8*], [1 x i8*]* %15, i64 0, i64 0
%85 = call i32 @execlp(i8* %82, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.16, i64 0, i64 0), i8* %83, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.14, i64 0, i64 0), i32* null, i8** %84, i32* null)
store i32 %85, i32* %11
br label %104
86: ; preds = %74
%87 = load i8**, i8*** %6
%88 = getelementptr inbounds i8*, i8** %87, i64 1
%89 = load i8*, i8** %88
%90 = call i64 @strcmp(i8* %89, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.17, i64 0, i64 0))
%91 = icmp eq i64 %90, 0
br i1 %91, label %92, label %98
92: ; preds = %86
%93 = call i32 @change_state(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.18, i64 0, i64 0))
store i32 %93, i32* %11
%94 = load i8*, i8** %8
%95 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%96 = getelementptr inbounds [1 x i8*], [1 x i8*]* %15, i64 0, i64 0
%97 = call i32 @execlp(i8* %94, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.16, i64 0, i64 0), i8* %95, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.17, i64 0, i64 0), i32* null, i8** %96, i32* null)
store i32 %97, i32* %11
br label %103
98: ; preds = %86
%99 = load i8*, i8** %8
%100 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%101 = getelementptr inbounds [1 x i8*], [1 x i8*]* %15, i64 0, i64 0
%102 = call i32 @execlp(i8* %99, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.16, i64 0, i64 0), i8* %100, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.19, i64 0, i64 0), i32* null, i8** %101, i32* null)
store i32 %102, i32* %11
br label %103
103: ; preds = %98, %92
br label %104
104: ; preds = %103, %80
%105 = call i32 @perror(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.20, i64 0, i64 0))
%106 = load i32, i32* %11
store i32 %106, i32* %4
br label %107
107: ; preds = %104, %72, %66, %60, %55, %47, %40, %32, %24
%108 = load i32, i32* %4
ret i32 %108
}

LLVM IR (-O2):
%struct.passwd = type { i32 }
@.str = [14 x i8] c"/usr/bin/perl\00"
@.str.1 = [26 x i8] c"Usage: ./setuidcaller cmd\00"
@.str.2 = [7 x i8] c"apache\00"
@.str.3 = [24 x i8] c"Could not find web user\00"
@.str.4 = [10 x i8] c"phonehome\00"
@.str.5 = [25 x i8] c"Could not find exec user\00"
@stderr = global i32 0
@.str.6 = [28 x i8] c"Wrong number of arguments.\0A\00"
@.str.7 = [11 x i8] c"BOITHOHOME\00"
@.str.8 = [19 x i8] c"getenv(BOITHOHOME)\00"
@.str.9 = [20 x i8] c"%s/bin/bb-client.pl\00"
@.str.10 = [20 x i8] c"Could not setuid(0)\00"
@.str.11 = [21 x i8] c"Could not seteuid(0)\00"
@.str.12 = [19 x i8] c"Could not setuid()\00"
@.str.13 = [20 x i8] c"Could not seteuid()\00"
@.str.14 = [6 x i8] c"start\00"
@.str.15 = [6 x i8] c"alive\00"
@.str.16 = [5 x i8] c"perl\00"
@.str.17 = [5 x i8] c"stop\00"
@.str.18 = [5 x i8] c"dead\00"
@.str.19 = [8 x i8] c"running\00"
@.str.20 = [23 x i8] c"Unable to exec program\00"
define i32 @main(i32 %0, i8** nocapture %1, i8** nocapture readnone %2) {
%4 = alloca [1024 x i8]
%5 = alloca [1 x i8*]
%6 = getelementptr inbounds [1024 x i8], [1024 x i8]* %4, i64 0, i64 0
%7 = bitcast [1 x i8*]* %5 to i8*
%8 = bitcast [1 x i8*]* %5 to i64*
store i64 0, i64* %8
%9 = icmp slt i32 %0, 2
br i1 %9, label %10, label %12
10: ; preds = %3
%11 = tail call i32 @errx(i32 1, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.1, i64 0, i64 0))
br label %12
12: ; preds = %10, %3
%13 = tail call %struct.passwd* @getpwnam(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
%14 = icmp eq %struct.passwd* %13, null
br i1 %14, label %15, label %17
15: ; preds = %12
%16 = tail call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.3, i64 0, i64 0))
br label %72
17: ; preds = %12
%18 = tail call %struct.passwd* @getpwnam(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.4, i64 0, i64 0))
%19 = icmp eq %struct.passwd* %18, null
br i1 %19, label %20, label %22
20: ; preds = %17
%21 = tail call i32 @perror(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.5, i64 0, i64 0))
br label %72
22: ; preds = %17
%23 = getelementptr inbounds %struct.passwd, %struct.passwd* %18, i64 0, i32 0
%24 = load i32, i32* %23
br i1 %9, label %25, label %28
25: ; preds = %22
%26 = load i32, i32* @stderr
%27 = tail call i32 @fprintf(i32 %26, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.6, i64 0, i64 0))
br label %72
28: ; preds = %22
%29 = tail call i8* @getenv(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.7, i64 0, i64 0))
%30 = icmp eq i8* %29, null
br i1 %30, label %31, label %33
31: ; preds = %28
%32 = tail call i32 @err(i32 1, i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.8, i64 0, i64 0))
br label %72
33: ; preds = %28
%34 = call i32 @snprintf(i8* %6, i32 1024, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.9, i64 0, i64 0), i8* %29)
%35 = call i64 @setuid(i32 0)
%36 = icmp eq i64 %35, 0
br i1 %36, label %39, label %37
37: ; preds = %33
%38 = call i32 @perror(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.10, i64 0, i64 0))
br label %72
39: ; preds = %33
%40 = call i64 @seteuid(i32 0)
%41 = icmp eq i64 %40, 0
br i1 %41, label %44, label %42
42: ; preds = %39
%43 = call i32 @perror(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.11, i64 0, i64 0))
br label %72
44: ; preds = %39
%45 = call i64 @setuid(i32 %24)
%46 = icmp eq i64 %45, 0
br i1 %46, label %49, label %47
47: ; preds = %44
%48 = call i32 @perror(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.12, i64 0, i64 0))
br label %72
49: ; preds = %44
%50 = call i64 @seteuid(i32 %24)
%51 = icmp eq i64 %50, 0
br i1 %51, label %54, label %52
52: ; preds = %49
%53 = call i32 @perror(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.13, i64 0, i64 0))
br label %72
54: ; preds = %49
%55 = getelementptr inbounds i8*, i8** %1, i64 1
%56 = load i8*, i8** %55
%57 = call i64 @strcmp(i8* %56, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.14, i64 0, i64 0))
%58 = icmp eq i64 %57, 0
br i1 %58, label %63, label %59
59: ; preds = %54
%60 = load i8*, i8** %55
%61 = call i64 @strcmp(i8* %60, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.17, i64 0, i64 0))
%62 = icmp eq i64 %61, 0
br i1 %62, label %63, label %67
63: ; preds = %59, %54
%64 = phi i8* [ getelementptr inbounds ([6 x i8], [6 x i8]* @.str.15, i64 0, i64 0), %54 ], [ getelementptr inbounds ([5 x i8], [5 x i8]* @.str.18, i64 0, i64 0), %59 ]
%65 = phi i8* [ getelementptr inbounds ([6 x i8], [6 x i8]* @.str.14, i64 0, i64 0), %54 ], [ getelementptr inbounds ([5 x i8], [5 x i8]* @.str.17, i64 0, i64 0), %59 ]
%66 = call i32 @change_state(i8* %64)
br label %67
67: ; preds = %63, %59
%68 = phi i8* [ getelementptr inbounds ([8 x i8], [8 x i8]* @.str.19, i64 0, i64 0), %59 ], [ %65, %63 ]
%69 = getelementptr inbounds [1 x i8*], [1 x i8*]* %5, i64 0, i64 0
%70 = call i32 @execlp(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.16, i64 0, i64 0), i8* %6, i8* %68, i32* null, i8** %69, i32* null)
%71 = call i32 @perror(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.20, i64 0, i64 0))
br label %72
72: ; preds = %67, %52, %47, %42, %37, %31, %25, %20, %15
%73 = phi i32 [ 80, %15 ], [ 81, %20 ], [ 98, %25 ], [ 105, %31 ], [ 97, %37 ], [ 96, %42 ], [ 95, %47 ], [ 94, %52 ], [ %70, %67 ]
ret i32 %73
}