#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ a_button();
int /*<<< orphan*/ drone_remote_control(double, double, double);
int /*<<< orphan*/ init_receive_blobs();
int /*<<< orphan*/ msleep(int);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ system(char *);
int main() {
  printf("Hooking firmware...\n");
  system("(\nsleep 5\necho \"/update/snarc/run_hook.sh\"\nsleep 5\n) | telnet "
         "-l root 192.168.1.1 23 &");
  printf("Press A when lights turn green.\n");
  while (!a_button())
    msleep(5);
  while (a_button())
    msleep(5);
  printf("Starting blob tracker...\n");
  system(
      "(\nsleep 5\necho \"touch /tmp/video0_enable_0; touch "
      "/tmp/video1_enable_0; touch /tmp/video0_enable_1; touch "
      "/tmp/video1_enable_1; /update/snarc/TelnetInterfaceBlueMarker\"\nsleep "
      "1\n) | telnet -l root 192.168.1.1 23 &");
  printf("Starting blob receive...\n");
  msleep(10000);
  init_receive_blobs();
  drone_remote_control(0.1, 0.1, 0.1);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
movl   $0x0,-0x4(%rbp)
lea    0xe92(%rip),%rdi
call   1070 <printf@plt>
lea    0xe9b(%rip),%rdi
call   1050 <system@plt>
lea    0xee6(%rip),%rdi
call   1070 <printf@plt>
mov    $0x0,%al
call   1030 <a_button@plt>
cmp    $0x0,%rax
setne  %al
xor    $0xff,%al
test   $0x1,%al
jne    11b0 <main+0x50>
jmp    11bf <main+0x5f>
mov    $0x5,%edi
call   1060 <msleep@plt>
jmp    1193 <main+0x33>
jmp    11c4 <main+0x64>
mov    $0x0,%al
call   1030 <a_button@plt>
cmp    $0x0,%rax
je     11e4 <main+0x84>
mov    $0x5,%edi
call   1060 <msleep@plt>
jmp    11c4 <main+0x64>
lea    0xeaa(%rip),%rdi
call   1070 <printf@plt>
lea    0xeb8(%rip),%rdi
call   1050 <system@plt>
lea    0xf81(%rip),%rdi
call   1070 <printf@plt>
mov    $0x2710,%edi
call   1060 <msleep@plt>
mov    $0x0,%al
call   1080 <init_receive_blobs@plt>
movsd  0xddf(%rip),%xmm2
movaps %xmm2,%xmm0
movaps %xmm2,%xmm1
call   1040 <drone_remote_control@plt>
mov    -0x4(%rbp),%eax
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rax
lea    0xfcc(%rip),%rdi
call   1040 <puts@plt>
lea    0xe94(%rip),%rdi
call   1060 <system@plt>
lea    0xfc8(%rip),%rdi
call   1040 <puts@plt>
cs nopw 0x0(%rax,%rax,1)
nop
xor    %eax,%eax
call   1030 <a_button@plt>
test   %rax,%rax
jne    11ba <main+0x5a>
mov    $0x5,%edi
call   1070 <msleep@plt>
jmp    1190 <main+0x30>
nopl   0x0(%rax,%rax,1)
mov    $0x5,%edi
call   1070 <msleep@plt>
xor    %eax,%eax
call   1030 <a_button@plt>
test   %rax,%rax
jne    11b0 <main+0x50>
lea    0xf9b(%rip),%rdi
call   1040 <puts@plt>
lea    0xe86(%rip),%rdi
call   1060 <system@plt>
lea    0xf9c(%rip),%rdi
call   1040 <puts@plt>
mov    $0x2710,%edi
call   1070 <msleep@plt>
xor    %eax,%eax
call   1080 <init_receive_blobs@plt>
movsd  0xdfd(%rip),%xmm0
movaps %xmm0,%xmm1
movaps %xmm0,%xmm2
call   1050 <drone_remote_control@plt>
xor    %eax,%eax
pop    %rcx
ret

LLVM IR (-O0):
@.str = [21 x i8] c"Hooking firmware...\0A\00"
@.str.1 = [87 x i8] c"(\0Asleep 5\0Aecho \22/update/snarc/run_hook.sh\22\0Asleep 5\0A) | telnet -l root 192.168.1.1 23 &\00"
@.str.2 = [33 x i8] c"Press A when lights turn green.\0A\00"
@.str.3 = [26 x i8] c"Starting blob tracker...\0A\00"
@.str.4 = [213 x i8] c"(\0Asleep 5\0Aecho \22touch /tmp/video0_enable_0; touch /tmp/video1_enable_0; touch /tmp/video0_enable_1; touch /tmp/video1_enable_1; /update/snarc/TelnetInterfaceBlueMarker\22\0Asleep 1\0A) | telnet -l root 192.168.1.1 23 &\00"
@.str.5 = [26 x i8] c"Starting blob receive...\0A\00"
define i32 @main() {
%1 = alloca i32
store i32 0, i32* %1
%2 = call i32 @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str, i64 0, i64 0))
%3 = call i32 @system(i8* getelementptr inbounds ([87 x i8], [87 x i8]* @.str.1, i64 0, i64 0))
%4 = call i32 @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.2, i64 0, i64 0))
br label %5
5: ; preds = %9, %0
%6 = call i64 (...) @a_button()
%7 = icmp ne i64 %6, 0
%8 = xor i1 %7, true
br i1 %8, label %9, label %11
9: ; preds = %5
%10 = call i32 @msleep(i32 5)
br label %5
11: ; preds = %5
br label %12
12: ; preds = %15, %11
%13 = call i64 (...) @a_button()
%14 = icmp ne i64 %13, 0
br i1 %14, label %15, label %17
15: ; preds = %12
%16 = call i32 @msleep(i32 5)
br label %12
17: ; preds = %12
%18 = call i32 @printf(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.3, i64 0, i64 0))
%19 = call i32 @system(i8* getelementptr inbounds ([213 x i8], [213 x i8]* @.str.4, i64 0, i64 0))
%20 = call i32 @printf(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.5, i64 0, i64 0))
%21 = call i32 @msleep(i32 10000)
%22 = call i32 (...) @init_receive_blobs()
%23 = call i32 @drone_remote_control(double 1.000000e-01, double 1.000000e-01, double 1.000000e-01)
%24 = load i32, i32* %1
ret i32 %24
}

LLVM IR (-O2):
@.str.1 = [87 x i8] c"(\0Asleep 5\0Aecho \22/update/snarc/run_hook.sh\22\0Asleep 5\0A) | telnet -l root 192.168.1.1 23 &\00"
@.str.4 = [213 x i8] c"(\0Asleep 5\0Aecho \22touch /tmp/video0_enable_0; touch /tmp/video1_enable_0; touch /tmp/video0_enable_1; touch /tmp/video1_enable_1; /update/snarc/TelnetInterfaceBlueMarker\22\0Asleep 1\0A) | telnet -l root 192.168.1.1 23 &\00"
@str = [20 x i8] c"Hooking firmware...\00"
@str.6 = [32 x i8] c"Press A when lights turn green.\00"
@str.7 = [25 x i8] c"Starting blob tracker...\00"
@str.8 = [25 x i8] c"Starting blob receive...\00"
define i32 @main() {
%1 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @str, i64 0, i64 0))
%2 = tail call i32 @system(i8* getelementptr inbounds ([87 x i8], [87 x i8]* @.str.1, i64 0, i64 0))
%3 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @str.6, i64 0, i64 0))
%4 = tail call i64 (...) @a_button()
%5 = icmp eq i64 %4, 0
br i1 %5, label %9, label %6
6: ; preds = %9, %0
%7 = tail call i64 (...) @a_button()
%8 = icmp eq i64 %7, 0
br i1 %8, label %17, label %13
9: ; preds = %0, %9
%10 = tail call i32 @msleep(i32 5)
%11 = tail call i64 (...) @a_button()
%12 = icmp eq i64 %11, 0
br i1 %12, label %9, label %6
13: ; preds = %6, %13
%14 = tail call i32 @msleep(i32 5)
%15 = tail call i64 (...) @a_button()
%16 = icmp eq i64 %15, 0
br i1 %16, label %17, label %13
17: ; preds = %13, %6
%18 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([25 x i8], [25 x i8]* @str.7, i64 0, i64 0))
%19 = tail call i32 @system(i8* getelementptr inbounds ([213 x i8], [213 x i8]* @.str.4, i64 0, i64 0))
%20 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([25 x i8], [25 x i8]* @str.8, i64 0, i64 0))
%21 = tail call i32 @msleep(i32 10000)
%22 = tail call i32 (...) @init_receive_blobs()
%23 = tail call i32 @drone_remote_control(double 1.000000e-01, double 1.000000e-01, double 1.000000e-01)
ret i32 0
}