#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ setLeds(int, int /*<<< orphan*/);
int /*<<< orphan*/ vTaskDelay(int);
void payload(void) {
  const char *hacked =
      "\n##     ##    ###     ######  ##    ## ######## ########  \n"
      "##     ##   ## ##   ##    ## ##   ##  ##       ##     ## \n"
      "##     ##  ##   ##  ##       ##  ##   ##       ##     ## \n"
      "######### ##     ## ##       #####    ######   ##     ## \n"
      "##     ## ######### ##       ##  ##   ##       ##     ## \n"
      "##     ## ##     ## ##    ## ##   ##  ##       ##     ## \n"
      "##     ## ##     ##  ######  ##    ## ######## ########  \n";
  for (;;) {
    setLeds(0x9700, 0);
    for (int a = 0; a < 10; a++) {
      printf("\f");
      for (int i = 0; i < a; i++) {
        printf("\n");
      }
      printf("%s", hacked);
      vTaskDelay(100);
    }
    for (int a = 10; a > 0; a--) {
      printf("\f");
      for (int i = 0; i < a; i++) {
        printf("\n");
      }
      printf("%s", hacked);
      vTaskDelay(100);
    }
  }
}


x86 assembly (clang, -O0):
<payload>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
lea    0xec1(%rip),%rax
mov    %rax,-0x8(%rbp)
mov    $0x9700,%edi
xor    %esi,%esi
call   1040 <setLeds@plt>
movl   $0x0,-0xc(%rbp)
cmpl   $0xa,-0xc(%rbp)
jge    11c7 <payload+0x97>
lea    0x1031(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x0,-0x10(%rbp)
mov    -0x10(%rbp),%eax
cmp    -0xc(%rbp),%eax
jge    119d <payload+0x6d>
lea    0x100e(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x10(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x10(%rbp)
jmp    1175 <payload+0x45>
mov    -0x8(%rbp),%rsi
lea    0xff2(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    $0x64,%edi
call   1050 <vTaskDelay@plt>
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    1156 <payload+0x26>
movl   $0xa,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
jle    123f <payload+0x10f>
lea    0xfb9(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x0,-0x18(%rbp)
mov    -0x18(%rbp),%eax
cmp    -0x14(%rbp),%eax
jge    1215 <payload+0xe5>
lea    0xf96(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x18(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x18(%rbp)
jmp    11ed <payload+0xbd>
mov    -0x8(%rbp),%rsi
lea    0xf7a(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    $0x64,%edi
call   1050 <vTaskDelay@plt>
mov    -0x14(%rbp),%eax
add    $0xffffffff,%eax
mov    %eax,-0x14(%rbp)
jmp    11ce <payload+0x9e>
jmp    1143 <payload+0x13>

x86 assembly (clang, -O2):
<payload>:
push   %rbp
push   %r14
push   %rbx
lea    0xeb5(%rip),%r14
nopl   0x0(%rax,%rax,1)
xor    %ebx,%ebx
mov    $0x9700,%edi
xor    %esi,%esi
call   1050 <setLeds@plt>
jmp    117a <payload+0x3a>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
add    $0x1,%ebx
cmp    $0xa,%ebx
je     11b0 <payload+0x70>
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    %ebx,%ebp
test   %ebx,%ebx
je     1160 <payload+0x20>
nopw   0x0(%rax,%rax,1)
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebp
jne    1190 <payload+0x50>
jmp    1160 <payload+0x20>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    $0xa,%ebx
nop
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebx
jne    11c0 <payload+0x80>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    $0x9,%ebx
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebx
jne    11f0 <payload+0xb0>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    $0x8,%ebx
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebx
jne    1220 <payload+0xe0>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    $0x7,%ebx
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebx
jne    1250 <payload+0x110>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    $0x6,%ebx
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebx
jne    1280 <payload+0x140>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    $0x5,%ebx
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebx
jne    12b0 <payload+0x170>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    $0x4,%ebx
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebx
jne    12e0 <payload+0x1a0>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    $0x3,%ebx
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebx
jne    1310 <payload+0x1d0>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    $0x2,%ebx
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebx
jne    1340 <payload+0x200>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
mov    $0xc,%edi
call   1030 <putchar@plt>
mov    $0x1,%ebx
mov    $0xa,%edi
call   1030 <putchar@plt>
add    $0xffffffff,%ebx
jne    1370 <payload+0x230>
mov    %r14,%rdi
call   1040 <puts@plt>
mov    $0x64,%edi
call   1060 <vTaskDelay@plt>
jmp    1150 <payload+0x10>

LLVM IR (-O0):
@.str = [408 x i8] c"\0A## ## ### ###### ## ## ######## ######## \0A## ## ## ## ## ## ## ## ## ## ## \0A## ## ## ## ## ## ## ## ## ## \0A######### ## ## ## ##### ###### ## ## \0A## ## ######### ## ## ## ## ## ## \0A## ## ## ## ## ## ## ## ## ## ## \0A## ## ## ## ###### ## ## ######## ######## \0A\00"
@.str.1 = [2 x i8] c"\0C\00"
@.str.2 = [2 x i8] c"\0A\00"
@.str.3 = [3 x i8] c"%s\00"
define void @payload() {
%1 = alloca i8*
%2 = alloca i32
%3 = alloca i32
%4 = alloca i32
%5 = alloca i32
store i8* getelementptr inbounds ([408 x i8], [408 x i8]* @.str, i64 0, i64 0), i8** %1
br label %6
6: ; preds = %51, %0
%7 = call i32 @setLeds(i32 38656, i32 0)
store i32 0, i32* %2
br label %8
8: ; preds = %26, %6
%9 = load i32, i32* %2
%10 = icmp slt i32 %9, 10
br i1 %10, label %11, label %29
11: ; preds = %8
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
store i32 0, i32* %3
br label %13
13: ; preds = %19, %11
%14 = load i32, i32* %3
%15 = load i32, i32* %2
%16 = icmp slt i32 %14, %15
br i1 %16, label %17, label %22
17: ; preds = %13
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
br label %19
19: ; preds = %17
%20 = load i32, i32* %3
%21 = add nsw i32 %20, 1
store i32 %21, i32* %3
br label %13
22: ; preds = %13
%23 = load i8*, i8** %1
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0), i8* %23)
%25 = call i32 @vTaskDelay(i32 100)
br label %26
26: ; preds = %22
%27 = load i32, i32* %2
%28 = add nsw i32 %27, 1
store i32 %28, i32* %2
br label %8
29: ; preds = %8
store i32 10, i32* %4
br label %30
30: ; preds = %48, %29
%31 = load i32, i32* %4
%32 = icmp sgt i32 %31, 0
br i1 %32, label %33, label %51
33: ; preds = %30
%34 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
store i32 0, i32* %5
br label %35
35: ; preds = %41, %33
%36 = load i32, i32* %5
%37 = load i32, i32* %4
%38 = icmp slt i32 %36, %37
br i1 %38, label %39, label %44
39: ; preds = %35
%40 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
br label %41
41: ; preds = %39
%42 = load i32, i32* %5
%43 = add nsw i32 %42, 1
store i32 %43, i32* %5
br label %35
44: ; preds = %35
%45 = load i8*, i8** %1
%46 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0), i8* %45)
%47 = call i32 @vTaskDelay(i32 100)
br label %48
48: ; preds = %44
%49 = load i32, i32* %4
%50 = add nsw i32 %49, -1
store i32 %50, i32* %4
br label %30
51: ; preds = %30
br label %6
}

LLVM IR (-O2):
@str.4 = [407 x i8] c"\0A## ## ### ###### ## ## ######## ######## \0A## ## ## ## ## ## ## ## ## ## ## \0A## ## ## ## ## ## ## ## ## ## \0A######### ## ## ## ##### ###### ## ## \0A## ## ######### ## ## ## ## ## ## \0A## ## ## ## ## ## ## ## ## ## ## \0A## ## ## ## ###### ## ## ######## ######## \00"
define void @payload() {
br label %1
1: ; preds = %100, %0
%2 = tail call i32 @setLeds(i32 38656, i32 0)
br label %3
3: ; preds = %1, %7
%4 = phi i32 [ 0, %1 ], [ %10, %7 ]
%5 = tail call i32 @putchar(i32 12)
%6 = icmp eq i32 %4, 0
br i1 %6, label %7, label %12
7: ; preds = %12, %3
%8 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%9 = tail call i32 @vTaskDelay(i32 100)
%10 = add nuw nsw i32 %4, 1
%11 = icmp eq i32 %10, 10
br i1 %11, label %17, label %3
12: ; preds = %3, %12
%13 = phi i32 [ %15, %12 ], [ 0, %3 ]
%14 = tail call i32 @putchar(i32 10)
%15 = add nuw nsw i32 %13, 1
%16 = icmp eq i32 %15, %4
br i1 %16, label %7, label %12
17: ; preds = %7
%18 = tail call i32 @putchar(i32 12)
br label %103
19: ; preds = %103
%20 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%21 = tail call i32 @vTaskDelay(i32 100)
%22 = tail call i32 @putchar(i32 12)
br label %23
23: ; preds = %23, %19
%24 = phi i32 [ %26, %23 ], [ 0, %19 ]
%25 = tail call i32 @putchar(i32 10)
%26 = add nuw nsw i32 %24, 1
%27 = icmp eq i32 %26, 9
br i1 %27, label %28, label %23
28: ; preds = %23
%29 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%30 = tail call i32 @vTaskDelay(i32 100)
%31 = tail call i32 @putchar(i32 12)
br label %32
32: ; preds = %32, %28
%33 = phi i32 [ %35, %32 ], [ 0, %28 ]
%34 = tail call i32 @putchar(i32 10)
%35 = add nuw nsw i32 %33, 1
%36 = icmp eq i32 %35, 8
br i1 %36, label %37, label %32
37: ; preds = %32
%38 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%39 = tail call i32 @vTaskDelay(i32 100)
%40 = tail call i32 @putchar(i32 12)
br label %41
41: ; preds = %41, %37
%42 = phi i32 [ %44, %41 ], [ 0, %37 ]
%43 = tail call i32 @putchar(i32 10)
%44 = add nuw nsw i32 %42, 1
%45 = icmp eq i32 %44, 7
br i1 %45, label %46, label %41
46: ; preds = %41
%47 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%48 = tail call i32 @vTaskDelay(i32 100)
%49 = tail call i32 @putchar(i32 12)
br label %50
50: ; preds = %50, %46
%51 = phi i32 [ %53, %50 ], [ 0, %46 ]
%52 = tail call i32 @putchar(i32 10)
%53 = add nuw nsw i32 %51, 1
%54 = icmp eq i32 %53, 6
br i1 %54, label %55, label %50
55: ; preds = %50
%56 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%57 = tail call i32 @vTaskDelay(i32 100)
%58 = tail call i32 @putchar(i32 12)
br label %59
59: ; preds = %59, %55
%60 = phi i32 [ %62, %59 ], [ 0, %55 ]
%61 = tail call i32 @putchar(i32 10)
%62 = add nuw nsw i32 %60, 1
%63 = icmp eq i32 %62, 5
br i1 %63, label %64, label %59
64: ; preds = %59
%65 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%66 = tail call i32 @vTaskDelay(i32 100)
%67 = tail call i32 @putchar(i32 12)
br label %68
68: ; preds = %68, %64
%69 = phi i32 [ %71, %68 ], [ 0, %64 ]
%70 = tail call i32 @putchar(i32 10)
%71 = add nuw nsw i32 %69, 1
%72 = icmp eq i32 %71, 4
br i1 %72, label %73, label %68
73: ; preds = %68
%74 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%75 = tail call i32 @vTaskDelay(i32 100)
%76 = tail call i32 @putchar(i32 12)
br label %77
77: ; preds = %77, %73
%78 = phi i32 [ %80, %77 ], [ 0, %73 ]
%79 = tail call i32 @putchar(i32 10)
%80 = add nuw nsw i32 %78, 1
%81 = icmp eq i32 %80, 3
br i1 %81, label %82, label %77
82: ; preds = %77
%83 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%84 = tail call i32 @vTaskDelay(i32 100)
%85 = tail call i32 @putchar(i32 12)
br label %86
86: ; preds = %86, %82
%87 = phi i32 [ %89, %86 ], [ 0, %82 ]
%88 = tail call i32 @putchar(i32 10)
%89 = add nuw nsw i32 %87, 1
%90 = icmp eq i32 %89, 2
br i1 %90, label %91, label %86
91: ; preds = %86
%92 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%93 = tail call i32 @vTaskDelay(i32 100)
%94 = tail call i32 @putchar(i32 12)
br label %95
95: ; preds = %95, %91
%96 = phi i32 [ %98, %95 ], [ 0, %91 ]
%97 = tail call i32 @putchar(i32 10)
%98 = add nuw nsw i32 %96, 1
%99 = icmp eq i32 %96, 0
br i1 %99, label %100, label %95
100: ; preds = %95
%101 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([407 x i8], [407 x i8]* @str.4, i64 0, i64 0))
%102 = tail call i32 @vTaskDelay(i32 100)
br label %1
103: ; preds = %17, %103
%104 = phi i32 [ %106, %103 ], [ 0, %17 ]
%105 = tail call i32 @putchar(i32 10)
%106 = add nuw nsw i32 %104, 1
%107 = icmp eq i32 %106, 10
br i1 %107, label %19, label %103
}