#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ memmove(void *, void const *, unsigned int);
int payload_get_offset_by_name(char *, char const *, unsigned int const);
int strlen(char const *);
int payload_insert_host(const char *host, const char *buf,
                        const unsigned int n_buf) {
  unsigned int i = 0;
  unsigned int n_host = strlen(host);
  int offset = 0;
  while (i < n_host && (buf[++i] != 0x1)) {
  }
  if (i != (6 + 1))
    return -1;
  if ((offset = payload_get_offset_by_name("UName", buf, n_buf)) == -1)
    return 1;
  memmove((void *)&buf[offset + strlen("UName") + 1], (const void *)host, 6);
  if ((offset = payload_get_offset_by_name("PWD", buf, n_buf)) == -1)
    return 1;
  memmove((void *)&buf[offset + strlen("PWD") + 1], (const void *)host, 6);
  if ((offset = payload_get_offset_by_name("Domain0", buf, n_buf)) == -1 ||
      (offset + n_host) >= n_buf)
    return 1;
  memmove((void *)&buf[offset + strlen("Domain0") + 1], (const void *)host,
          n_host);
  return 0;
}


x86 assembly (clang, -O0):
<payload_insert_host>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %edx,-0x1c(%rbp)
movl   $0x0,-0x20(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,-0x24(%rbp)
movl   $0x0,-0x28(%rbp)
mov    -0x20(%rbp),%ecx
xor    %eax,%eax
cmp    -0x24(%rbp),%ecx
mov    %al,-0x29(%rbp)
jae    118a <payload_insert_host+0x5a>
mov    -0x18(%rbp),%rax
mov    -0x20(%rbp),%ecx
add    $0x1,%ecx
mov    %ecx,-0x20(%rbp)
mov    %ecx,%ecx
movsbl (%rax,%rcx,1),%eax
cmp    $0x1,%eax
setne  %al
mov    %al,-0x29(%rbp)
mov    -0x29(%rbp),%al
test   $0x1,%al
jne    119a <payload_insert_host+0x6a>
jmp    119f <payload_insert_host+0x6f>
jmp    115d <payload_insert_host+0x2d>
cmpl   $0x7,-0x20(%rbp)
je     11b5 <payload_insert_host+0x85>
movl   $0xffffffff,-0x4(%rbp)
jmp    12fb <payload_insert_host+0x1cb>
mov    -0x18(%rbp),%rsi
mov    -0x1c(%rbp),%edx
lea    0xe3d(%rip),%rdi
call   1050 <payload_get_offset_by_name@plt>
mov    %eax,-0x28(%rbp)
cmp    $0xffffffff,%eax
jne    11e0 <payload_insert_host+0xb0>
movl   $0x1,-0x4(%rbp)
jmp    12fb <payload_insert_host+0x1cb>
mov    -0x18(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    -0x28(%rbp),%eax
mov    %eax,-0x30(%rbp)
lea    0xe0b(%rip),%rdi
call   1030 <strlen@plt>
mov    -0x38(%rbp),%rdi
mov    %eax,%ecx
mov    -0x30(%rbp),%eax
add    %ecx,%eax
add    $0x1,%eax
cltq
add    %rax,%rdi
mov    -0x10(%rbp),%rsi
mov    $0x6,%edx
call   1040 <memmove@plt>
mov    -0x18(%rbp),%rsi
mov    -0x1c(%rbp),%edx
lea    0xddd(%rip),%rdi
call   1050 <payload_get_offset_by_name@plt>
mov    %eax,-0x28(%rbp)
cmp    $0xffffffff,%eax
jne    1246 <payload_insert_host+0x116>
movl   $0x1,-0x4(%rbp)
jmp    12fb <payload_insert_host+0x1cb>
mov    -0x18(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    -0x28(%rbp),%eax
mov    %eax,-0x3c(%rbp)
lea    0xdab(%rip),%rdi
call   1030 <strlen@plt>
mov    -0x48(%rbp),%rdi
mov    %eax,%ecx
mov    -0x3c(%rbp),%eax
add    %ecx,%eax
add    $0x1,%eax
cltq
add    %rax,%rdi
mov    -0x10(%rbp),%rsi
mov    $0x6,%edx
call   1040 <memmove@plt>
mov    -0x18(%rbp),%rsi
mov    -0x1c(%rbp),%edx
lea    0xd7b(%rip),%rdi
call   1050 <payload_get_offset_by_name@plt>
mov    %eax,-0x28(%rbp)
cmp    $0xffffffff,%eax
je     12af <payload_insert_host+0x17f>
mov    -0x28(%rbp),%eax
add    -0x24(%rbp),%eax
cmp    -0x1c(%rbp),%eax
jb     12bb <payload_insert_host+0x18b>
movl   $0x1,-0x4(%rbp)
jmp    12fb <payload_insert_host+0x1cb>
mov    -0x18(%rbp),%rax
mov    %rax,-0x58(%rbp)
mov    -0x28(%rbp),%eax
mov    %eax,-0x4c(%rbp)
lea    0xd3a(%rip),%rdi
call   1030 <strlen@plt>
mov    -0x58(%rbp),%rdi
mov    %eax,%ecx
mov    -0x4c(%rbp),%eax
add    %ecx,%eax
add    $0x1,%eax
cltq
add    %rax,%rdi
mov    -0x10(%rbp),%rsi
mov    -0x24(%rbp),%edx
call   1040 <memmove@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<payload_insert_host>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %edx,%r12d
mov    %rsi,%r15
mov    %rdi,%r14
call   1030 <strlen@plt>
mov    %eax,%ebx
xor    %ecx,%ecx
nopl   (%rax)
cmp    %rcx,%rbx
je     1166 <payload_insert_host+0x36>
lea    0x1(%rcx),%rax
cmpb   $0x1,0x1(%r15,%rcx,1)
mov    %rax,%rcx
jne    1150 <payload_insert_host+0x20>
jmp    1168 <payload_insert_host+0x38>
mov    %ebx,%eax
mov    $0xffffffff,%r13d
cmp    $0x7,%eax
jne    1242 <payload_insert_host+0x112>
lea    0xe82(%rip),%rdi
mov    %r15,%rsi
mov    %r12d,%edx
call   1050 <payload_get_offset_by_name@plt>
mov    $0x1,%r13d
cmp    $0xffffffff,%eax
je     1242 <payload_insert_host+0x112>
mov    %eax,%ebp
lea    0xe5f(%rip),%rdi
call   1030 <strlen@plt>
add    %ebp,%eax
add    $0x1,%eax
movslq %eax,%rdi
add    %r15,%rdi
mov    %r14,%rsi
mov    $0x6,%edx
call   1040 <memmove@plt>
lea    0xe41(%rip),%rdi
mov    %r15,%rsi
mov    %r12d,%edx
call   1050 <payload_get_offset_by_name@plt>
cmp    $0xffffffff,%eax
je     1242 <payload_insert_host+0x112>
mov    %eax,%ebp
lea    0xe28(%rip),%rdi
call   1030 <strlen@plt>
add    %ebp,%eax
add    $0x1,%eax
movslq %eax,%rdi
add    %r15,%rdi
mov    %r14,%rsi
mov    $0x6,%edx
call   1040 <memmove@plt>
lea    0xe08(%rip),%rdi
mov    %r15,%rsi
mov    %r12d,%edx
call   1050 <payload_get_offset_by_name@plt>
cmp    $0xffffffff,%eax
je     1242 <payload_insert_host+0x112>
mov    %eax,%ebp
lea    (%rbx,%rbp,1),%eax
cmp    %r12d,%eax
jae    1242 <payload_insert_host+0x112>
lea    0xde7(%rip),%rdi
call   1030 <strlen@plt>
add    %ebp,%eax
add    $0x1,%eax
cltq
add    %rax,%r15
mov    %r15,%rdi
mov    %r14,%rsi
mov    %ebx,%edx
call   1040 <memmove@plt>
xor    %r13d,%r13d
mov    %r13d,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [6 x i8] c"UName\00"
@.str.1 = [4 x i8] c"PWD\00"
@.str.2 = [8 x i8] c"Domain0\00"
define i32 @payload_insert_host(i8* %0, i8* %1, i32 %2) {
%4 = alloca i32
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
store i8* %0, i8** %5
store i8* %1, i8** %6
store i32 %2, i32* %7
store i32 0, i32* %8
%11 = load i8*, i8** %5
%12 = call i32 @strlen(i8* %11)
store i32 %12, i32* %9
store i32 0, i32* %10
br label %13
13: ; preds = %28, %3
%14 = load i32, i32* %8
%15 = load i32, i32* %9
%16 = icmp ult i32 %14, %15
br i1 %16, label %17, label %26
17: ; preds = %13
%18 = load i8*, i8** %6
%19 = load i32, i32* %8
%20 = add i32 %19, 1
store i32 %20, i32* %8
%21 = zext i32 %20 to i64
%22 = getelementptr inbounds i8, i8* %18, i64 %21
%23 = load i8, i8* %22
%24 = sext i8 %23 to i32
%25 = icmp ne i32 %24, 1
br label %26
26: ; preds = %17, %13
%27 = phi i1 [ false, %13 ], [ %25, %17 ]
br i1 %27, label %28, label %29
28: ; preds = %26
br label %13
29: ; preds = %26
%30 = load i32, i32* %8
%31 = icmp ne i32 %30, 7
br i1 %31, label %32, label %33
32: ; preds = %29
store i32 -1, i32* %4
br label %86
33: ; preds = %29
%34 = load i8*, i8** %6
%35 = load i32, i32* %7
%36 = call i32 @payload_get_offset_by_name(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* %34, i32 %35)
store i32 %36, i32* %10
%37 = icmp eq i32 %36, -1
br i1 %37, label %38, label %39
38: ; preds = %33
store i32 1, i32* %4
br label %86
39: ; preds = %33
%40 = load i8*, i8** %6
%41 = load i32, i32* %10
%42 = call i32 @strlen(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
%43 = add nsw i32 %41, %42
%44 = add nsw i32 %43, 1
%45 = sext i32 %44 to i64
%46 = getelementptr inbounds i8, i8* %40, i64 %45
%47 = load i8*, i8** %5
%48 = call i32 @memmove(i8* %46, i8* %47, i32 6)
%49 = load i8*, i8** %6
%50 = load i32, i32* %7
%51 = call i32 @payload_get_offset_by_name(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i8* %49, i32 %50)
store i32 %51, i32* %10
%52 = icmp eq i32 %51, -1
br i1 %52, label %53, label %54
53: ; preds = %39
store i32 1, i32* %4
br label %86
54: ; preds = %39
%55 = load i8*, i8** %6
%56 = load i32, i32* %10
%57 = call i32 @strlen(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0))
%58 = add nsw i32 %56, %57
%59 = add nsw i32 %58, 1
%60 = sext i32 %59 to i64
%61 = getelementptr inbounds i8, i8* %55, i64 %60
%62 = load i8*, i8** %5
%63 = call i32 @memmove(i8* %61, i8* %62, i32 6)
%64 = load i8*, i8** %6
%65 = load i32, i32* %7
%66 = call i32 @payload_get_offset_by_name(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8* %64, i32 %65)
store i32 %66, i32* %10
%67 = icmp eq i32 %66, -1
br i1 %67, label %74, label %68
68: ; preds = %54
%69 = load i32, i32* %10
%70 = load i32, i32* %9
%71 = add i32 %69, %70
%72 = load i32, i32* %7
%73 = icmp uge i32 %71, %72
br i1 %73, label %74, label %75
74: ; preds = %68, %54
store i32 1, i32* %4
br label %86
75: ; preds = %68
%76 = load i8*, i8** %6
%77 = load i32, i32* %10
%78 = call i32 @strlen(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0))
%79 = add nsw i32 %77, %78
%80 = add nsw i32 %79, 1
%81 = sext i32 %80 to i64
%82 = getelementptr inbounds i8, i8* %76, i64 %81
%83 = load i8*, i8** %5
%84 = load i32, i32* %9
%85 = call i32 @memmove(i8* %82, i8* %83, i32 %84)
store i32 0, i32* %4
br label %86
86: ; preds = %75, %74, %53, %38, %32
%87 = load i32, i32* %4
ret i32 %87
}

LLVM IR (-O2):
@.str = [6 x i8] c"UName\00"
@.str.1 = [4 x i8] c"PWD\00"
@.str.2 = [8 x i8] c"Domain0\00"
define i32 @payload_insert_host(i8* %0, i8* %1, i32 %2) {
%4 = tail call i32 @strlen(i8* %0)
%5 = zext i32 %4 to i64
br label %6
6: ; preds = %9, %3
%7 = phi i64 [ %10, %9 ], [ 0, %3 ]
%8 = icmp eq i64 %7, %5
br i1 %8, label %16, label %9
9: ; preds = %6
%10 = add nuw nsw i64 %7, 1
%11 = getelementptr inbounds i8, i8* %1, i64 %10
%12 = load i8, i8* %11
%13 = icmp eq i8 %12, 1
br i1 %13, label %14, label %6
14: ; preds = %9
%15 = trunc i64 %10 to i32
br label %16
16: ; preds = %6, %14
%17 = phi i32 [ %15, %14 ], [ %4, %6 ]
%18 = icmp eq i32 %17, 7
br i1 %18, label %19, label %50
19: ; preds = %16
%20 = tail call i32 @payload_get_offset_by_name(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8* %1, i32 %2)
%21 = icmp eq i32 %20, -1
br i1 %21, label %50, label %22
22: ; preds = %19
%23 = tail call i32 @strlen(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
%24 = add nuw i32 %20, 1
%25 = add i32 %24, %23
%26 = sext i32 %25 to i64
%27 = getelementptr inbounds i8, i8* %1, i64 %26
%28 = tail call i32 @memmove(i8* %27, i8* %0, i32 6)
%29 = tail call i32 @payload_get_offset_by_name(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i8* %1, i32 %2)
%30 = icmp eq i32 %29, -1
br i1 %30, label %50, label %31
31: ; preds = %22
%32 = tail call i32 @strlen(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0))
%33 = add nuw i32 %29, 1
%34 = add i32 %33, %32
%35 = sext i32 %34 to i64
%36 = getelementptr inbounds i8, i8* %1, i64 %35
%37 = tail call i32 @memmove(i8* %36, i8* %0, i32 6)
%38 = tail call i32 @payload_get_offset_by_name(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8* %1, i32 %2)
%39 = icmp ne i32 %38, -1
%40 = add i32 %38, %4
%41 = icmp ult i32 %40, %2
%42 = select i1 %39, i1 %41, i1 false
br i1 %42, label %43, label %50
43: ; preds = %31
%44 = tail call i32 @strlen(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0))
%45 = add nuw i32 %38, 1
%46 = add i32 %45, %44
%47 = sext i32 %46 to i64
%48 = getelementptr inbounds i8, i8* %1, i64 %47
%49 = tail call i32 @memmove(i8* %48, i8* %0, i32 %4)
br label %50
50: ; preds = %31, %22, %19, %16, %43
%51 = phi i32 [ 0, %43 ], [ -1, %16 ], [ 1, %19 ], [ 1, %22 ], [ 1, %31 ]
ret i32 %51
}