#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ buffer;

/* Variables and functions */
int /*<<< orphan*/ O_RDWR;
int /*<<< orphan*/ SEEK_END;
int /*<<< orphan*/ SEEK_SET;
int atoi(int /*<<< orphan*/);
int /*<<< orphan*/ close(int);
char getopt(int, char **, char *);
int lseek(int, int, int /*<<< orphan*/);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ optarg;
int optind;
int /*<<< orphan*/ printf(char *, ...);
int rand();
int read(int, unsigned char *, int);
int /*<<< orphan*/ srand(int /*<<< orphan*/);
int /*<<< orphan*/ time(int /*<<< orphan*/);
int /*<<< orphan*/ write(int, unsigned char *, int);
int main(int argc, char *argv[]) {
  int prob = 10000;
  int h;
  int flen = 0;
  int changesPerBuffer = 0;
  int b;
  char c;
  unsigned char buffer[1000000];
  int bufsize;
  int x;
  int i;
  int nbuffers;
  while ((c = getopt(argc, argv, "p:")) != -1) {
    switch (c) {
    case 'p':
      prob = atoi(optarg);
      break;
    }
  }
  if (prob < 100) {
    printf("-p value less than 100 is invalid\n");
    return 1;
  }
  if (optind >= argc) {
    printf(" Needs a file name to fuzz\n");
    return 1;
  }
  h = open(argv[optind], O_RDWR);
  flen = lseek(h, 0, SEEK_END);
  lseek(h, 0, SEEK_SET);
  if (flen < 1) {
    printf(" File is too short\n");
    return 1;
  }
  nbuffers = (flen + sizeof(buffer) - 1) / sizeof(buffer);
  changesPerBuffer = 1 + (sizeof(buffer) * 8) / prob;
  printf("Fuzzing file %s. Size %d, probablity 1/%d, changing %d bits in each "
         "of %d buffers\n",
         argv[optind], flen, prob, changesPerBuffer, nbuffers);
  srand(time(0));
  for (b = 0; b < nbuffers; b++) {
    lseek(h, b * sizeof(buffer), SEEK_SET);
    bufsize = read(h, buffer, sizeof(buffer));
    for (i = 0; i < changesPerBuffer; i++) {
      x = rand() % (sizeof(buffer) * 8);
      buffer[x >> 3] ^= (1 << (x & 7));
    }
    lseek(h, b * sizeof(buffer), SEEK_SET);
    write(h, buffer, bufsize);
  }
  close(h);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0xf4280,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x2710,-0x14(%rbp)
movl   $0x0,-0x1c(%rbp)
movl   $0x0,-0x20(%rbp)
mov    -0x8(%rbp),%edi
mov    -0x10(%rbp),%rsi
lea    0xe14(%rip),%rdx
call   10b0 <getopt@plt>
mov    %al,-0x25(%rbp)
movsbl %al,%eax
cmp    $0xffffffff,%eax
je     1226 <main+0x76>
mov    -0x25(%rbp),%al
sub    $0x70,%al
jne    1221 <main+0x71>
jmp    1210 <main+0x60>
mov    0x2de1(%rip),%rax
mov    (%rax),%edi
call   10c0 <atoi@plt>
mov    %eax,-0x14(%rbp)
jmp    11de <main+0x2e>
cmpl   $0x64,-0x14(%rbp)
jge    124a <main+0x9a>
lea    0xdcc(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    146a <main+0x2ba>
mov    0x2d7f(%rip),%rax
mov    (%rax),%eax
cmp    -0x8(%rbp),%eax
jl     1276 <main+0xc6>
lea    0xdc3(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    146a <main+0x2ba>
mov    -0x10(%rbp),%rax
mov    0x2d4f(%rip),%rcx
movslq (%rcx),%rcx
mov    (%rax,%rcx,8),%rdi
mov    0x2d51(%rip),%rax
mov    (%rax),%esi
call   10a0 <open@plt>
mov    %eax,-0x18(%rbp)
mov    -0x18(%rbp),%edi
mov    0x2d35(%rip),%rax
mov    (%rax),%edx
xor    %esi,%esi
call   1050 <lseek@plt>
mov    %eax,-0x1c(%rbp)
mov    -0x18(%rbp),%edi
mov    0x2d07(%rip),%rax
mov    (%rax),%edx
xor    %esi,%esi
call   1050 <lseek@plt>
cmpl   $0x1,-0x1c(%rbp)
jge    12e6 <main+0x136>
lea    0xd6f(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    146a <main+0x2ba>
movslq -0x1c(%rbp),%rax
add    $0xf4240,%rax
sub    $0x1,%rax
mov    $0xf4240,%ecx
xor    %edx,%edx
div    %rcx
mov    %eax,-0xf4280(%rbp)
movslq -0x14(%rbp),%rcx
mov    $0x7a1200,%eax
xor    %edx,%edx
div    %rcx
add    $0x1,%rax
mov    %eax,-0x20(%rbp)
mov    -0x10(%rbp),%rax
mov    0x2cac(%rip),%rcx
movslq (%rcx),%rcx
mov    (%rax,%rcx,8),%rsi
mov    -0x1c(%rbp),%edx
mov    -0x14(%rbp),%ecx
mov    -0x20(%rbp),%r8d
mov    -0xf4280(%rbp),%r9d
lea    0xd13(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
xor    %edi,%edi
call   1090 <time@plt>
mov    %eax,%edi
call   1080 <srand@plt>
movl   $0x0,-0x24(%rbp)
mov    -0x24(%rbp),%eax
cmp    -0xf4280(%rbp),%eax
jge    145b <main+0x2ab>
mov    -0x18(%rbp),%edi
movslq -0x24(%rbp),%rax
imul   $0xf4240,%rax,%rax
mov    %eax,%esi
mov    0x2c3b(%rip),%rax
mov    (%rax),%edx
call   1050 <lseek@plt>
mov    -0x18(%rbp),%edi
lea    -0xf4270(%rbp),%rsi
mov    $0xf4240,%edx
call   1070 <read@plt>
mov    %eax,-0xf4274(%rbp)
movl   $0x0,-0xf427c(%rbp)
mov    -0xf427c(%rbp),%eax
cmp    -0x20(%rbp),%eax
jge    141a <main+0x26a>
mov    $0x0,%al
call   10d0 <rand@plt>
cltq
mov    $0x7a1200,%ecx
xor    %edx,%edx
div    %rcx
mov    %edx,%eax
mov    %eax,-0xf4278(%rbp)
mov    -0xf4278(%rbp),%ecx
and    $0x7,%ecx
mov    $0x1,%edx
shl    %cl,%edx
mov    -0xf4278(%rbp),%eax
sar    $0x3,%eax
cltq
movzbl -0xf4270(%rbp,%rax,1),%ecx
ff
xor    %edx,%ecx
mov    %cl,-0xf4270(%rbp,%rax,1)
mov    -0xf427c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xf427c(%rbp)
jmp    13b0 <main+0x200>
mov    -0x18(%rbp),%edi
movslq -0x24(%rbp),%rax
imul   $0xf4240,%rax,%rax
mov    %eax,%esi
mov    0x2b8f(%rip),%rax
mov    (%rax),%edx
call   1050 <lseek@plt>
mov    -0x18(%rbp),%edi
lea    -0xf4270(%rbp),%rsi
mov    -0xf4274(%rbp),%edx
call   1030 <write@plt>
mov    -0x24(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x24(%rbp)
jmp    135f <main+0x1af>
mov    -0x18(%rbp),%edi
call   1060 <close@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0xf4280,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0xf4268,%rsp
mov    %rsi,%r13
mov    %edi,%ebx
mov    $0x2710,%r12d
lea    0xe1d(%rip),%rbp
mov    0x2e0e(%rip),%r14
nopw   0x0(%rax,%rax,1)
mov    %ebx,%edi
mov    %r13,%rsi
mov    %rbp,%rdx
call   10c0 <getopt@plt>
cmp    $0xff,%al
je     1212 <main+0x52>
cmp    $0x70,%al
jne    11f0 <main+0x30>
mov    (%r14),%edi
call   10d0 <atoi@plt>
mov    %eax,%r12d
jmp    11f0 <main+0x30>
cmp    $0x63,%r12d
jg     1224 <main+0x64>
lea    0xe65(%rip),%rdi
jmp    13b2 <main+0x1f2>
mov    0x2da5(%rip),%r14
movslq (%r14),%rax
cmp    %ebx,%eax
jge    13a2 <main+0x1e2>
mov    0x0(%r13,%rax,8),%rdi
mov    0x2d9e(%rip),%rax
mov    (%rax),%esi
call   10b0 <open@plt>
mov    %eax,%r15d
mov    0x2d85(%rip),%rax
mov    (%rax),%edx
mov    %r15d,%edi
xor    %esi,%esi
call   1060 <lseek@plt>
mov    %eax,%ebp
mov    0x2d58(%rip),%rax
mov    (%rax),%edx
mov    %r15d,%edi
xor    %esi,%esi
call   1060 <lseek@plt>
test   %ebp,%ebp
jle    13ab <main+0x1eb>
mov    %ebp,%eax
add    $0xf423f,%eax
imul   $0x431bde83,%rax,%r9
shr    $0x32,%r9
mov    $0x7a1200,%eax
xor    %edx,%edx
div    %r12d
mov    %eax,%ebx
lea    0x1(%rbx),%r8d
movslq (%r14),%rax
mov    0x0(%r13,%rax,8),%rsi
lea    0xd56(%rip),%rdi
mov    %ebp,%edx
mov    %r12d,%ecx
mov    %r9,0x18(%rsp)
xor    %eax,%eax
call   1050 <printf@plt>
xor    %edi,%edi
call   10a0 <time@plt>
mov    %eax,%edi
call   1090 <srand@plt>
lea    0x20(%rsp),%r13
movabs $0x431bde82d7b634db,%r14
de 1b 43
xor    %r12d,%r12d
mov    0x2cdb(%rip),%rbp
mov    %r15d,0xc(%rsp)
nopw   0x0(%rax,%rax,1)
imul   $0xf4240,%r12d,%esi
mov    0x0(%rbp),%edx
mov    %r15d,%edi
mov    %esi,0x14(%rsp)
call   1060 <lseek@plt>
mov    %r15d,%edi
mov    %r13,%rsi
mov    $0xf4240,%edx
call   1080 <read@plt>
mov    %eax,0x10(%rsp)
mov    $0xffffffff,%r15d
xor    %eax,%eax
call   10e0 <rand@plt>
movslq %eax,%rsi
mov    %rsi,%rax
mul    %r14
shr    $0x15,%rdx
imul   $0x7a1200,%rdx,%rax
sub    %rax,%rsi
mov    %esi,%ecx
and    $0x7,%cl
mov    $0x1,%al
shl    %cl,%al
shr    $0x3,%rsi
xor    %al,0x20(%rsp,%rsi,1)
add    $0x1,%r15d
cmp    %ebx,%r15d
jne    1320 <main+0x160>
mov    0x2c61(%rip),%rbp
mov    0x0(%rbp),%edx
mov    0xc(%rsp),%r15d
mov    %r15d,%edi
mov    0x14(%rsp),%esi
call   1060 <lseek@plt>
mov    %r15d,%edi
lea    0x20(%rsp),%r13
mov    %r13,%rsi
mov    0x10(%rsp),%edx
call   1040 <write@plt>
add    $0x1,%r12d
cmp    0x18(%rsp),%r12d
jne    12f0 <main+0x130>
mov    %r15d,%edi
call   1070 <close@plt>
xor    %eax,%eax
jmp    13bc <main+0x1fc>
lea    0xcc0(%rip),%rdi
jmp    13b2 <main+0x1f2>
lea    0xca4(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%eax
add    $0xf4268,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [3 x i8] c"p:\00"
@optarg = global i32 0
@.str.1 = [35 x i8] c"-p value less than 100 is invalid\0A\00"
@optind = global i32 0
@.str.2 = [28 x i8] c" Needs a file name to fuzz\0A\00"
@O_RDWR = global i32 0
@SEEK_END = global i32 0
@SEEK_SET = global i32 0
@.str.3 = [20 x i8] c" File is too short\0A\00"
@.str.4 = [83 x i8] c"Fuzzing file %s. Size %d, probablity 1/%d, changing %d bits in each of %d buffers\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i8
%12 = alloca [1000000 x i8]
%13 = alloca i32
%14 = alloca i32
%15 = alloca i32
%16 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 10000, i32* %6
store i32 0, i32* %8
store i32 0, i32* %9
br label %17
17: ; preds = %29, %2
%18 = load i32, i32* %4
%19 = load i8**, i8*** %5
%20 = call signext i8 @getopt(i32 %18, i8** %19, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0))
store i8 %20, i8* %11
%21 = sext i8 %20 to i32
%22 = icmp ne i32 %21, -1
br i1 %22, label %23, label %30
23: ; preds = %17
%24 = load i8, i8* %11
%25 = sext i8 %24 to i32
switch i32 %25, label %29 [
i32 112, label %26
]
26: ; preds = %23
%27 = load i32, i32* @optarg
%28 = call i32 @atoi(i32 %27)
store i32 %28, i32* %6
br label %29
29: ; preds = %23, %26
br label %17
30: ; preds = %17
%31 = load i32, i32* %6
%32 = icmp slt i32 %31, 100
br i1 %32, label %33, label %35
33: ; preds = %30
%34 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.1, i64 0, i64 0))
store i32 1, i32* %3
br label %139
35: ; preds = %30
%36 = load i32, i32* @optind
%37 = load i32, i32* %4
%38 = icmp sge i32 %36, %37
br i1 %38, label %39, label %41
39: ; preds = %35
%40 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.2, i64 0, i64 0))
store i32 1, i32* %3
br label %139
41: ; preds = %35
%42 = load i8**, i8*** %5
%43 = load i32, i32* @optind
%44 = sext i32 %43 to i64
%45 = getelementptr inbounds i8*, i8** %42, i64 %44
%46 = load i8*, i8** %45
%47 = load i32, i32* @O_RDWR
%48 = call i32 @open(i8* %46, i32 %47)
store i32 %48, i32* %7
%49 = load i32, i32* %7
%50 = load i32, i32* @SEEK_END
%51 = call i32 @lseek(i32 %49, i32 0, i32 %50)
store i32 %51, i32* %8
%52 = load i32, i32* %7
%53 = load i32, i32* @SEEK_SET
%54 = call i32 @lseek(i32 %52, i32 0, i32 %53)
%55 = load i32, i32* %8
%56 = icmp slt i32 %55, 1
br i1 %56, label %57, label %59
57: ; preds = %41
%58 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.3, i64 0, i64 0))
store i32 1, i32* %3
br label %139
59: ; preds = %41
%60 = load i32, i32* %8
%61 = sext i32 %60 to i64
%62 = add i64 %61, 1000000
%63 = sub i64 %62, 1
%64 = udiv i64 %63, 1000000
%65 = trunc i64 %64 to i32
store i32 %65, i32* %16
%66 = load i32, i32* %6
%67 = sext i32 %66 to i64
%68 = udiv i64 8000000, %67
%69 = add i64 1, %68
%70 = trunc i64 %69 to i32
store i32 %70, i32* %9
%71 = load i8**, i8*** %5
%72 = load i32, i32* @optind
%73 = sext i32 %72 to i64
%74 = getelementptr inbounds i8*, i8** %71, i64 %73
%75 = load i8*, i8** %74
%76 = load i32, i32* %8
%77 = load i32, i32* %6
%78 = load i32, i32* %9
%79 = load i32, i32* %16
%80 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([83 x i8], [83 x i8]* @.str.4, i64 0, i64 0), i8* %75, i32 %76, i32 %77, i32 %78, i32 %79)
%81 = call i32 @time(i32 0)
%82 = call i32 @srand(i32 %81)
store i32 0, i32* %10
br label %83
83: ; preds = %133, %59
%84 = load i32, i32* %10
%85 = load i32, i32* %16
%86 = icmp slt i32 %84, %85
br i1 %86, label %87, label %136
87: ; preds = %83
%88 = load i32, i32* %7
%89 = load i32, i32* %10
%90 = sext i32 %89 to i64
%91 = mul i64 %90, 1000000
%92 = trunc i64 %91 to i32
%93 = load i32, i32* @SEEK_SET
%94 = call i32 @lseek(i32 %88, i32 %92, i32 %93)
%95 = load i32, i32* %7
%96 = getelementptr inbounds [1000000 x i8], [1000000 x i8]* %12, i64 0, i64 0
%97 = call i32 @read(i32 %95, i8* %96, i32 1000000)
store i32 %97, i32* %13
store i32 0, i32* %15
br label %98
98: ; preds = %118, %87
%99 = load i32, i32* %15
%100 = load i32, i32* %9
%101 = icmp slt i32 %99, %100
br i1 %101, label %102, label %121
102: ; preds = %98
%103 = call i32 (...) @rand()
%104 = sext i32 %103 to i64
%105 = urem i64 %104, 8000000
%106 = trunc i64 %105 to i32
store i32 %106, i32* %14
%107 = load i32, i32* %14
%108 = and i32 %107, 7
%109 = shl i32 1, %108
%110 = load i32, i32* %14
%111 = ashr i32 %110, 3
%112 = sext i32 %111 to i64
%113 = getelementptr inbounds [1000000 x i8], [1000000 x i8]* %12, i64 0, i64 %112
%114 = load i8, i8* %113
%115 = zext i8 %114 to i32
%116 = xor i32 %115, %109
%117 = trunc i32 %116 to i8
store i8 %117, i8* %113
br label %118
118: ; preds = %102
%119 = load i32, i32* %15
%120 = add nsw i32 %119, 1
store i32 %120, i32* %15
br label %98
121: ; preds = %98
%122 = load i32, i32* %7
%123 = load i32, i32* %10
%124 = sext i32 %123 to i64
%125 = mul i64 %124, 1000000
%126 = trunc i64 %125 to i32
%127 = load i32, i32* @SEEK_SET
%128 = call i32 @lseek(i32 %122, i32 %126, i32 %127)
%129 = load i32, i32* %7
%130 = getelementptr inbounds [1000000 x i8], [1000000 x i8]* %12, i64 0, i64 0
%131 = load i32, i32* %13
%132 = call i32 @write(i32 %129, i8* %130, i32 %131)
br label %133
133: ; preds = %121
%134 = load i32, i32* %10
%135 = add nsw i32 %134, 1
store i32 %135, i32* %10
br label %83
136: ; preds = %83
%137 = load i32, i32* %7
%138 = call i32 @close(i32 %137)
store i32 0, i32* %3
br label %139
139: ; preds = %136, %57, %39, %33
%140 = load i32, i32* %3
ret i32 %140
}

LLVM IR (-O2):
@.str = [3 x i8] c"p:\00"
@optarg = global i32 0
@optind = global i32 0
@O_RDWR = global i32 0
@SEEK_END = global i32 0
@SEEK_SET = global i32 0
@.str.4 = [83 x i8] c"Fuzzing file %s. Size %d, probablity 1/%d, changing %d bits in each of %d buffers\0A\00"
@str = [19 x i8] c" File is too short\00"
@str.5 = [27 x i8] c" Needs a file name to fuzz\00"
@str.6 = [34 x i8] c"-p value less than 100 is invalid\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca [1000000 x i8]
%4 = getelementptr inbounds [1000000 x i8], [1000000 x i8]* %3, i64 0, i64 0
br label %5
5: ; preds = %9, %2
%6 = phi i32 [ %11, %9 ], [ 10000, %2 ]
br label %7
7: ; preds = %5, %7
%8 = tail call signext i8 @getopt(i32 %0, i8** %1, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0))
switch i8 %8, label %7 [
i8 -1, label %12
i8 112, label %9
]
9: ; preds = %7
%10 = load i32, i32* @optarg
%11 = tail call i32 @atoi(i32 %10)
br label %5
12: ; preds = %7
%13 = icmp slt i32 %6, 100
br i1 %13, label %14, label %16
14: ; preds = %12
%15 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @str.6, i64 0, i64 0))
br label %74
16: ; preds = %12
%17 = load i32, i32* @optind
%18 = icmp slt i32 %17, %0
br i1 %18, label %21, label %19
19: ; preds = %16
%20 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @str.5, i64 0, i64 0))
br label %74
21: ; preds = %16
%22 = sext i32 %17 to i64
%23 = getelementptr inbounds i8*, i8** %1, i64 %22
%24 = load i8*, i8** %23
%25 = load i32, i32* @O_RDWR
%26 = tail call i32 @open(i8* %24, i32 %25)
%27 = load i32, i32* @SEEK_END
%28 = tail call i32 @lseek(i32 %26, i32 0, i32 %27)
%29 = load i32, i32* @SEEK_SET
%30 = tail call i32 @lseek(i32 %26, i32 0, i32 %29)
%31 = icmp slt i32 %28, 1
br i1 %31, label %32, label %34
32: ; preds = %21
%33 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @str, i64 0, i64 0))
br label %74
34: ; preds = %21
%35 = add nuw i32 %28, 999999
%36 = udiv i32 %35, 1000000
%37 = udiv i32 8000000, %6
%38 = add nuw nsw i32 %37, 1
%39 = load i32, i32* @optind
%40 = sext i32 %39 to i64
%41 = getelementptr inbounds i8*, i8** %1, i64 %40
%42 = load i8*, i8** %41
%43 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([83 x i8], [83 x i8]* @.str.4, i64 0, i64 0), i8* %42, i32 %28, i32 %6, i32 %38, i32 %36)
%44 = tail call i32 @time(i32 0)
%45 = tail call i32 @srand(i32 %44)
br label %46
46: ; preds = %34, %66
%47 = phi i32 [ %70, %66 ], [ 0, %34 ]
%48 = mul nuw i32 %47, 1000000
%49 = load i32, i32* @SEEK_SET
%50 = tail call i32 @lseek(i32 %26, i32 %48, i32 %49)
%51 = call i32 @read(i32 %26, i8* %4, i32 1000000)
br label %52
52: ; preds = %46, %52
%53 = phi i32 [ 0, %46 ], [ %64, %52 ]
%54 = tail call i32 (...) @rand()
%55 = sext i32 %54 to i64
%56 = urem i64 %55, 8000000
%57 = trunc i64 %56 to i8
%58 = and i8 %57, 7
%59 = shl nuw i8 1, %58
%60 = lshr i64 %56, 3
%61 = getelementptr inbounds [1000000 x i8], [1000000 x i8]* %3, i64 0, i64 %60
%62 = load i8, i8* %61
%63 = xor i8 %59, %62
store i8 %63, i8* %61
%64 = add nuw nsw i32 %53, 1
%65 = icmp eq i32 %53, %37
br i1 %65, label %66, label %52
66: ; preds = %52
%67 = load i32, i32* @SEEK_SET
%68 = tail call i32 @lseek(i32 %26, i32 %48, i32 %67)
%69 = call i32 @write(i32 %26, i8* %4, i32 %51)
%70 = add nuw nsw i32 %47, 1
%71 = icmp eq i32 %70, %36
br i1 %71, label %72, label %46
72: ; preds = %66
%73 = tail call i32 @close(i32 %26)
br label %74
74: ; preds = %72, %32, %19, %14
%75 = phi i32 [ 1, %14 ], [ 1, %19 ], [ 1, %32 ], [ 0, %72 ]
ret i32 %75
}