#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ SEEK_SET;
int atoi(int /*<<< orphan*/);
scalar_t__ decode_boot(unsigned char *, int);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int find_head_offset(unsigned char *);
int /*<<< orphan*/ *fopen(char *, char *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *);
int fread(unsigned char *, int, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ free(unsigned char *);
int /*<<< orphan*/ fseek(int /*<<< orphan*/ *, int /*<<< orphan*/,
                         int /*<<< orphan*/);
int fwrite(unsigned char *, int, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ getenv(char *);
scalar_t__ malloc(int);
int /*<<< orphan*/ memset(unsigned char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ *stdin;
int /*<<< orphan*/ stdout;
int main() {
  FILE *art_fp;
  int art_len;
  unsigned char *art_ptr;
  int art_head_offset = 0;
  int f_size = 0;
  fprintf(stdout, "Content-type:text/html\r\n\r\n");
  fprintf(stdout, "<html><title>art upgrade</title>\n");
  fprintf(stdout, "<body>\n");
  art_len = atoi(getenv("CONTENT_LENGTH"));
  art_ptr = (unsigned char *)malloc(sizeof(unsigned char) * art_len);
  if (art_ptr == NULL) {
    printf("<br>malloc failed <br>");
    goto error_exit;
  }
  f_size = fread(art_ptr, 1, art_len, stdin);
  if (f_size != art_len) {
    printf("<br>fread failed <br>");
    goto error_exit;
  }
  f_size = 0;
  art_head_offset = find_head_offset(art_ptr);
  if (art_head_offset == -1) {
    printf("<br>find head offset failed <br>");
    goto error_exit;
  }
  art_ptr += art_head_offset;
  int art_en_len = 0X10000 + 12;
  if (decode_boot(art_ptr, art_en_len) != 0) {
    printf("invalid art! <br>");
    goto error_exit;
  }
  FILE *fp_mtd = NULL;
  fp_mtd = fopen("/dev/mtdblock4", "rb+");
  if (fp_mtd == NULL) {
    printf("open /dev/mtdblock4 failed\n");
    goto error_exit;
  }
  f_size = 0;
  f_size = fwrite(art_ptr + 12, 1, 0X10000, fp_mtd);
  if (f_size != 0X10000) {
    printf("<br>fwrite failed <br>");
    goto error_exit;
  }
  fseek(fp_mtd, 0, SEEK_SET);
  unsigned char *read_buf = NULL;
  unsigned int en_num = 0;
  unsigned int en_num_tmp = 0;
  unsigned int *ibuf = NULL;
  int i = 0;
  en_num = *(unsigned int *)(art_ptr + 8);
  int read_len = 0;
  read_buf = (unsigned char *)malloc(0X10000);
  memset(read_buf, 0, 0X10000);
  read_len = fread(read_buf, 1, 0X10000, fp_mtd);
  if (read_len != 0X10000) {
    printf("<br>read uboot from mtdblock4 failed <br>");
    goto error_exit;
  }
  ibuf = (unsigned int *)(read_buf);
  for (i = 0; i < 0X10000 / 4; i++) {
    en_num_tmp ^= *(ibuf + i);
  }
  if (en_num_tmp != en_num) {
    printf("<br>uboot check failed <br>");
    goto error_exit;
  }
  fclose(fp_mtd);
  free(art_ptr);
  free(read_buf);
  printf("<br>ART upgrade successful :)<br>");
  fprintf(stdout, "</body>\n");
  fprintf(stdout, "\n</html>\n");
  return 0;
error_exit:
  printf("<br>ART upgrade failed :(<br>");
  fprintf(stdout, "</body>\n");
  fprintf(stdout, "\n</html>\n");
  return 1;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0x0,-0x24(%rbp)
movl   $0x0,-0x28(%rbp)
mov    0x2dcc(%rip),%rax
mov    (%rax),%edi
lea    0xdf3(%rip),%rsi
call   10a0 <fprintf@plt>
mov    0x2db7(%rip),%rax
mov    (%rax),%edi
lea    0xdf9(%rip),%rsi
call   10a0 <fprintf@plt>
mov    0x2da2(%rip),%rax
mov    (%rax),%edi
lea    0xe06(%rip),%rsi
call   10a0 <fprintf@plt>
lea    0xe02(%rip),%rdi
call   1030 <getenv@plt>
mov    %eax,%edi
call   10f0 <atoi@plt>
mov    %eax,-0x14(%rbp)
movslq -0x14(%rbp),%rax
shl    $0x0,%rax
mov    %eax,%edi
call   10b0 <malloc@plt>
mov    %rax,-0x20(%rbp)
cmpq   $0x0,-0x20(%rbp)
jne    1281 <main+0xa1>
lea    0xddd(%rip),%rdi
call   1070 <printf@plt>
jmp    14fc <main+0x31c>
mov    -0x20(%rbp),%rdi
mov    -0x14(%rbp),%edx
mov    0x2d59(%rip),%rax
mov    (%rax),%rcx
mov    $0x1,%esi
call   1050 <fread@plt>
mov    %eax,-0x28(%rbp)
mov    -0x28(%rbp),%eax
cmp    -0x14(%rbp),%eax
je     12bc <main+0xdc>
lea    0xdb9(%rip),%rdi
call   1070 <printf@plt>
jmp    14fc <main+0x31c>
movl   $0x0,-0x28(%rbp)
mov    -0x20(%rbp),%rdi
call   10c0 <find_head_offset@plt>
mov    %eax,-0x24(%rbp)
cmpl   $0xffffffff,-0x24(%rbp)
jne    12ea <main+0x10a>
lea    0xda1(%rip),%rdi
call   1070 <printf@plt>
jmp    14fc <main+0x31c>
mov    -0x24(%rbp),%ecx
mov    -0x20(%rbp),%rax
movslq %ecx,%rcx
add    %rcx,%rax
mov    %rax,-0x20(%rbp)
movl   $0x1000c,-0x2c(%rbp)
mov    -0x20(%rbp),%rdi
mov    -0x2c(%rbp),%esi
call   1080 <decode_boot@plt>
cmp    $0x0,%rax
je     1329 <main+0x149>
lea    0xd83(%rip),%rdi
call   1070 <printf@plt>
jmp    14fc <main+0x31c>
movq   $0x0,-0x38(%rbp)
lea    0xd7c(%rip),%rdi
lea    0xd84(%rip),%rsi
call   10e0 <fopen@plt>
mov    %rax,-0x38(%rbp)
cmpq   $0x0,-0x38(%rbp)
jne    1364 <main+0x184>
lea    0xd6d(%rip),%rdi
call   1070 <printf@plt>
jmp    14fc <main+0x31c>
movl   $0x0,-0x28(%rbp)
mov    -0x20(%rbp),%rdi
add    $0xc,%rdi
mov    -0x38(%rbp),%rcx
mov    $0x1,%esi
mov    $0x10000,%edx
call   1100 <fwrite@plt>
mov    %eax,-0x28(%rbp)
cmpl   $0x10000,-0x28(%rbp)
je     13a7 <main+0x1c7>
lea    0xd46(%rip),%rdi
call   1070 <printf@plt>
jmp    14fc <main+0x31c>
mov    -0x38(%rbp),%rdi
mov    0x2c26(%rip),%rax
mov    (%rax),%edx
xor    %esi,%esi
call   10d0 <fseek@plt>
movq   $0x0,-0x40(%rbp)
movl   $0x0,-0x44(%rbp)
movl   $0x0,-0x48(%rbp)
movq   $0x0,-0x50(%rbp)
movl   $0x0,-0x54(%rbp)
mov    -0x20(%rbp),%rax
mov    0x8(%rax),%eax
mov    %eax,-0x44(%rbp)
movl   $0x0,-0x58(%rbp)
mov    $0x10000,%edi
call   10b0 <malloc@plt>
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rdi
xor    %esi,%esi
mov    $0x10000,%edx
call   1090 <memset@plt>
mov    -0x40(%rbp),%rdi
mov    -0x38(%rbp),%rcx
mov    $0x1,%esi
mov    $0x10000,%edx
call   1050 <fread@plt>
mov    %eax,-0x58(%rbp)
cmpl   $0x10000,-0x58(%rbp)
je     1447 <main+0x267>
lea    0xcbd(%rip),%rdi
call   1070 <printf@plt>
jmp    14fc <main+0x31c>
mov    -0x40(%rbp),%rax
mov    %rax,-0x50(%rbp)
movl   $0x0,-0x54(%rbp)
cmpl   $0x4000,-0x54(%rbp)
jge    1482 <main+0x2a2>
mov    -0x50(%rbp),%rax
movslq -0x54(%rbp),%rcx
mov    (%rax,%rcx,4),%eax
xor    -0x48(%rbp),%eax
mov    %eax,-0x48(%rbp)
mov    -0x54(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x54(%rbp)
jmp    1456 <main+0x276>
mov    -0x48(%rbp),%eax
cmp    -0x44(%rbp),%eax
je     149f <main+0x2bf>
lea    0xc8f(%rip),%rdi
call   1070 <printf@plt>
jmp    14fc <main+0x31c>
mov    -0x38(%rbp),%rdi
call   1060 <fclose@plt>
mov    -0x20(%rbp),%rdi
call   1040 <free@plt>
mov    -0x40(%rbp),%rdi
call   1040 <free@plt>
lea    0xc7f(%rip),%rdi
call   1070 <printf@plt>
mov    0x2b03(%rip),%rax
mov    (%rax),%edi
lea    0xc8c(%rip),%rsi
call   10a0 <fprintf@plt>
mov    0x2aee(%rip),%rax
mov    (%rax),%edi
lea    0xc80(%rip),%rsi
call   10a0 <fprintf@plt>
movl   $0x0,-0x4(%rbp)
jmp    1539 <main+0x359>
lea    0xc72(%rip),%rdi
call   1070 <printf@plt>
mov    0x2ac1(%rip),%rax
mov    (%rax),%edi
lea    0xc4a(%rip),%rsi
call   10a0 <fprintf@plt>
mov    0x2aac(%rip),%rax
mov    (%rax),%edi
lea    0xc3e(%rip),%rsi
call   10a0 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    0x2dce(%rip),%r12
mov    (%r12),%edi
lea    0xdf3(%rip),%rsi
call   10b0 <fprintf@plt>
mov    (%r12),%edi
lea    0xdfe(%rip),%rsi
call   10b0 <fprintf@plt>
mov    (%r12),%edi
lea    0xe10(%rip),%rsi
call   10b0 <fprintf@plt>
lea    0xe0c(%rip),%rdi
call   1030 <getenv@plt>
mov    %eax,%edi
call   1100 <atoi@plt>
mov    %eax,%ebp
mov    %eax,%edi
call   10c0 <malloc@plt>
test   %rax,%rax
je     12a6 <main+0xb6>
mov    %rax,%rbx
mov    0x2d8b(%rip),%rax
mov    (%rax),%rcx
mov    $0x1,%r15d
mov    %rbx,%rdi
mov    $0x1,%esi
mov    %ebp,%edx
call   1060 <fread@plt>
cmp    %ebp,%eax
jne    12ba <main+0xca>
mov    %rbx,%rdi
call   10d0 <find_head_offset@plt>
cmp    $0xffffffff,%eax
je     12c3 <main+0xd3>
cltq
add    %rax,%rbx
mov    %rbx,%rdi
mov    $0x1000c,%esi
call   1090 <decode_boot@plt>
test   %rax,%rax
je     130d <main+0x11d>
lea    0xdfe(%rip),%rdi
jmp    12ca <main+0xda>
lea    0xda7(%rip),%rdi
call   1080 <printf@plt>
mov    $0x1,%r15d
jmp    12cf <main+0xdf>
lea    0xdaa(%rip),%rdi
jmp    12ca <main+0xda>
lea    0xdb7(%rip),%rdi
call   1080 <printf@plt>
lea    0xe83(%rip),%rdi
call   1080 <printf@plt>
mov    (%r12),%edi
lea    0xe60(%rip),%rsi
call   10b0 <fprintf@plt>
mov    (%r12),%edi
lea    0xe59(%rip),%rsi
call   10b0 <fprintf@plt>
mov    %r15d,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xda0(%rip),%rdi
lea    0xda8(%rip),%rsi
call   10f0 <fopen@plt>
test   %rax,%rax
je     1462 <main+0x272>
mov    %rax,%r14
lea    0xc(%rbx),%rdi
mov    $0x1,%r15d
mov    $0x1,%esi
mov    $0x10000,%edx
mov    %rax,%rcx
call   1110 <fwrite@plt>
cmp    $0x10000,%eax
jne    1473 <main+0x283>
mov    0x2c7e(%rip),%rax
mov    (%rax),%edx
mov    %r14,%rdi
xor    %esi,%esi
call   10e0 <fseek@plt>
mov    0x8(%rbx),%r13d
mov    $0x10000,%edi
call   10c0 <malloc@plt>
mov    %rax,%rbp
mov    %rax,%rdi
xor    %esi,%esi
mov    $0x10000,%edx
call   10a0 <memset@plt>
mov    $0x1,%r15d
mov    %rbp,%rdi
mov    $0x1,%esi
mov    $0x10000,%edx
mov    %r14,%rcx
call   1060 <fread@plt>
cmp    $0x10000,%eax
jne    147f <main+0x28f>
pxor   %xmm0,%xmm0
xor    %eax,%eax
pxor   %xmm1,%xmm1
cs nopw 0x0(%rax,%rax,1)
movdqu 0x0(%rbp,%rax,4),%xmm2
pxor   %xmm0,%xmm2
movdqu 0x10(%rbp,%rax,4),%xmm0
pxor   %xmm1,%xmm0
movdqu 0x20(%rbp,%rax,4),%xmm1
movdqu 0x30(%rbp,%rax,4),%xmm3
movdqu 0x40(%rbp,%rax,4),%xmm4
pxor   %xmm1,%xmm4
pxor   %xmm2,%xmm4
movdqu 0x50(%rbp,%rax,4),%xmm2
pxor   %xmm3,%xmm2
pxor   %xmm0,%xmm2
movdqu 0x60(%rbp,%rax,4),%xmm0
pxor   %xmm4,%xmm0
movdqu 0x70(%rbp,%rax,4),%xmm1
pxor   %xmm2,%xmm1
add    $0x20,%rax
cmp    $0x4000,%rax
jne    13c0 <main+0x1d0>
pxor   %xmm0,%xmm1
pshufd $0xee,%xmm1,%xmm0
pxor   %xmm1,%xmm0
pshufd $0x55,%xmm0,%xmm1
pxor   %xmm0,%xmm1
movd   %xmm1,%eax
cmp    %r13d,%eax
jne    148b <main+0x29b>
mov    %r14,%rdi
call   1070 <fclose@plt>
mov    %rbx,%rdi
call   1040 <free@plt>
mov    %rbp,%rdi
call   1040 <free@plt>
xor    %r15d,%r15d
lea    0xcc7(%rip),%rdi
jmp    12d6 <main+0xe6>
lea    0xd0e(%rip),%rdi
call   1050 <puts@plt>
jmp    12cf <main+0xdf>
lea    0xc4d(%rip),%rdi
jmp    12ca <main+0xda>
lea    0xc58(%rip),%rdi
jmp    12ca <main+0xda>
lea    0xc76(%rip),%rdi
jmp    12ca <main+0xda>

LLVM IR (-O0):
@stdout = global i32 0
@.str = [27 x i8] c"Content-type:text/html\0D\0A\0D\0A\00"
@.str.1 = [34 x i8] c"<html><title>art upgrade</title>\0A\00"
@.str.2 = [8 x i8] c"<body>\0A\00"
@.str.3 = [15 x i8] c"CONTENT_LENGTH\00"
@.str.4 = [23 x i8] c"<br>malloc failed <br>\00"
@stdin = global i32* null
@.str.5 = [22 x i8] c"<br>fread failed <br>\00"
@.str.6 = [33 x i8] c"<br>find head offset failed <br>\00"
@.str.7 = [18 x i8] c"invalid art! <br>\00"
@.str.8 = [15 x i8] c"/dev/mtdblock4\00"
@.str.9 = [4 x i8] c"rb+\00"
@.str.10 = [28 x i8] c"open /dev/mtdblock4 failed\0A\00"
@.str.11 = [23 x i8] c"<br>fwrite failed <br>\00"
@SEEK_SET = global i32 0
@.str.12 = [42 x i8] c"<br>read uboot from mtdblock4 failed <br>\00"
@.str.13 = [28 x i8] c"<br>uboot check failed <br>\00"
@.str.14 = [34 x i8] c"<br>ART upgrade successful :)<br>\00"
@.str.15 = [9 x i8] c"</body>\0A\00"
@.str.16 = [10 x i8] c"\0A</html>\0A\00"
@.str.17 = [30 x i8] c"<br>ART upgrade failed :(<br>\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca i32
%4 = alloca i8*
%5 = alloca i32
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32*
%9 = alloca i8*
%10 = alloca i32
%11 = alloca i32
%12 = alloca i32*
%13 = alloca i32
%14 = alloca i32
store i32 0, i32* %1
store i32 0, i32* %5
store i32 0, i32* %6
%15 = load i32, i32* @stdout
%16 = call i32 @fprintf(i32 %15, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str, i64 0, i64 0))
%17 = load i32, i32* @stdout
%18 = call i32 @fprintf(i32 %17, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0))
%19 = load i32, i32* @stdout
%20 = call i32 @fprintf(i32 %19, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0))
%21 = call i32 @getenv(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.3, i64 0, i64 0))
%22 = call i32 @atoi(i32 %21)
store i32 %22, i32* %3
%23 = load i32, i32* %3
%24 = sext i32 %23 to i64
%25 = mul i64 1, %24
%26 = trunc i64 %25 to i32
%27 = call i64 @malloc(i32 %26)
%28 = inttoptr i64 %27 to i8*
store i8* %28, i8** %4
%29 = load i8*, i8** %4
%30 = icmp eq i8* %29, null
br i1 %30, label %31, label %33
31: ; preds = %0
%32 = call i32 @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0))
br label %130
33: ; preds = %0
%34 = load i8*, i8** %4
%35 = load i32, i32* %3
%36 = load i32*, i32** @stdin
%37 = call i32 @fread(i8* %34, i32 1, i32 %35, i32* %36)
store i32 %37, i32* %6
%38 = load i32, i32* %6
%39 = load i32, i32* %3
%40 = icmp ne i32 %38, %39
br i1 %40, label %41, label %43
41: ; preds = %33
%42 = call i32 @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.5, i64 0, i64 0))
br label %130
43: ; preds = %33
store i32 0, i32* %6
%44 = load i8*, i8** %4
%45 = call i32 @find_head_offset(i8* %44)
store i32 %45, i32* %5
%46 = load i32, i32* %5
%47 = icmp eq i32 %46, -1
br i1 %47, label %48, label %50
48: ; preds = %43
%49 = call i32 @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.6, i64 0, i64 0))
br label %130
50: ; preds = %43
%51 = load i32, i32* %5
%52 = load i8*, i8** %4
%53 = sext i32 %51 to i64
%54 = getelementptr inbounds i8, i8* %52, i64 %53
store i8* %54, i8** %4
store i32 65548, i32* %7
%55 = load i8*, i8** %4
%56 = load i32, i32* %7
%57 = call i64 @decode_boot(i8* %55, i32 %56)
%58 = icmp ne i64 %57, 0
br i1 %58, label %59, label %61
59: ; preds = %50
%60 = call i32 @printf(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.7, i64 0, i64 0))
br label %130
61: ; preds = %50
store i32* null, i32** %8
%62 = call i32* @fopen(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.8, i64 0, i64 0), i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.9, i64 0, i64 0))
store i32* %62, i32** %8
%63 = load i32*, i32** %8
%64 = icmp eq i32* %63, null
br i1 %64, label %65, label %67
65: ; preds = %61
%66 = call i32 @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.10, i64 0, i64 0))
br label %130
67: ; preds = %61
store i32 0, i32* %6
%68 = load i8*, i8** %4
%69 = getelementptr inbounds i8, i8* %68, i64 12
%70 = load i32*, i32** %8
%71 = call i32 @fwrite(i8* %69, i32 1, i32 65536, i32* %70)
store i32 %71, i32* %6
%72 = load i32, i32* %6
%73 = icmp ne i32 %72, 65536
br i1 %73, label %74, label %76
74: ; preds = %67
%75 = call i32 @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.11, i64 0, i64 0))
br label %130
76: ; preds = %67
%77 = load i32*, i32** %8
%78 = load i32, i32* @SEEK_SET
%79 = call i32 @fseek(i32* %77, i32 0, i32 %78)
store i8* null, i8** %9
store i32 0, i32* %10
store i32 0, i32* %11
store i32* null, i32** %12
store i32 0, i32* %13
%80 = load i8*, i8** %4
%81 = getelementptr inbounds i8, i8* %80, i64 8
%82 = bitcast i8* %81 to i32*
%83 = load i32, i32* %82
store i32 %83, i32* %10
store i32 0, i32* %14
%84 = call i64 @malloc(i32 65536)
%85 = inttoptr i64 %84 to i8*
store i8* %85, i8** %9
%86 = load i8*, i8** %9
%87 = call i32 @memset(i8* %86, i32 0, i32 65536)
%88 = load i8*, i8** %9
%89 = load i32*, i32** %8
%90 = call i32 @fread(i8* %88, i32 1, i32 65536, i32* %89)
store i32 %90, i32* %14
%91 = load i32, i32* %14
%92 = icmp ne i32 %91, 65536
br i1 %92, label %93, label %95
93: ; preds = %76
%94 = call i32 @printf(i8* getelementptr inbounds ([42 x i8], [42 x i8]* @.str.12, i64 0, i64 0))
br label %130
95: ; preds = %76
%96 = load i8*, i8** %9
%97 = bitcast i8* %96 to i32*
store i32* %97, i32** %12
store i32 0, i32* %13
br label %98
98: ; preds = %109, %95
%99 = load i32, i32* %13
%100 = icmp slt i32 %99, 16384
br i1 %100, label %101, label %112
101: ; preds = %98
%102 = load i32*, i32** %12
%103 = load i32, i32* %13
%104 = sext i32 %103 to i64
%105 = getelementptr inbounds i32, i32* %102, i64 %104
%106 = load i32, i32* %105
%107 = load i32, i32* %11
%108 = xor i32 %107, %106
store i32 %108, i32* %11
br label %109
109: ; preds = %101
%110 = load i32, i32* %13
%111 = add nsw i32 %110, 1
store i32 %111, i32* %13
br label %98
112: ; preds = %98
%113 = load i32, i32* %11
%114 = load i32, i32* %10
%115 = icmp ne i32 %113, %114
br i1 %115, label %116, label %118
116: ; preds = %112
%117 = call i32 @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.13, i64 0, i64 0))
br label %130
118: ; preds = %112
%119 = load i32*, i32** %8
%120 = call i32 @fclose(i32* %119)
%121 = load i8*, i8** %4
%122 = call i32 @free(i8* %121)
%123 = load i8*, i8** %9
%124 = call i32 @free(i8* %123)
%125 = call i32 @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.14, i64 0, i64 0))
%126 = load i32, i32* @stdout
%127 = call i32 @fprintf(i32 %126, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.15, i64 0, i64 0))
%128 = load i32, i32* @stdout
%129 = call i32 @fprintf(i32 %128, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.16, i64 0, i64 0))
store i32 0, i32* %1
br label %136
130: ; preds = %116, %93, %74, %65, %59, %48, %41, %31
%131 = call i32 @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.17, i64 0, i64 0))
%132 = load i32, i32* @stdout
%133 = call i32 @fprintf(i32 %132, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.15, i64 0, i64 0))
%134 = load i32, i32* @stdout
%135 = call i32 @fprintf(i32 %134, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.16, i64 0, i64 0))
store i32 1, i32* %1
br label %136
136: ; preds = %130, %118
%137 = load i32, i32* %1
ret i32 %137
}

LLVM IR (-O2):
@stdout = global i32 0
@.str = [27 x i8] c"Content-type:text/html\0D\0A\0D\0A\00"
@.str.1 = [34 x i8] c"<html><title>art upgrade</title>\0A\00"
@.str.2 = [8 x i8] c"<body>\0A\00"
@.str.3 = [15 x i8] c"CONTENT_LENGTH\00"
@.str.4 = [23 x i8] c"<br>malloc failed <br>\00"
@stdin = global i32* null
@.str.5 = [22 x i8] c"<br>fread failed <br>\00"
@.str.6 = [33 x i8] c"<br>find head offset failed <br>\00"
@.str.7 = [18 x i8] c"invalid art! <br>\00"
@.str.8 = [15 x i8] c"/dev/mtdblock4\00"
@.str.9 = [4 x i8] c"rb+\00"
@.str.11 = [23 x i8] c"<br>fwrite failed <br>\00"
@SEEK_SET = global i32 0
@.str.12 = [42 x i8] c"<br>read uboot from mtdblock4 failed <br>\00"
@.str.13 = [28 x i8] c"<br>uboot check failed <br>\00"
@.str.14 = [34 x i8] c"<br>ART upgrade successful :)<br>\00"
@.str.15 = [9 x i8] c"</body>\0A\00"
@.str.16 = [10 x i8] c"\0A</html>\0A\00"
@.str.17 = [30 x i8] c"<br>ART upgrade failed :(<br>\00"
@str = [27 x i8] c"open /dev/mtdblock4 failed\00"
define i32 @main() {
%1 = load i32, i32* @stdout
%2 = tail call i32 @fprintf(i32 %1, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str, i64 0, i64 0))
%3 = load i32, i32* @stdout
%4 = tail call i32 @fprintf(i32 %3, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0))
%5 = load i32, i32* @stdout
%6 = tail call i32 @fprintf(i32 %5, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0))
%7 = tail call i32 @getenv(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.3, i64 0, i64 0))
%8 = tail call i32 @atoi(i32 %7)
%9 = tail call i64 @malloc(i32 %8)
%10 = inttoptr i64 %9 to i8*
%11 = icmp eq i64 %9, 0
br i1 %11, label %12, label %14
12: ; preds = %0
%13 = tail call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0))
br label %109
14: ; preds = %0
%15 = load i32*, i32** @stdin
%16 = tail call i32 @fread(i8* %10, i32 1, i32 %8, i32* %15)
%17 = icmp eq i32 %16, %8
br i1 %17, label %20, label %18
18: ; preds = %14
%19 = tail call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str.5, i64 0, i64 0))
br label %109
20: ; preds = %14
%21 = tail call i32 @find_head_offset(i8* %10)
%22 = icmp eq i32 %21, -1
br i1 %22, label %23, label %25
23: ; preds = %20
%24 = tail call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @.str.6, i64 0, i64 0))
br label %109
25: ; preds = %20
%26 = sext i32 %21 to i64
%27 = getelementptr inbounds i8, i8* %10, i64 %26
%28 = tail call i64 @decode_boot(i8* %27, i32 65548)
%29 = icmp eq i64 %28, 0
br i1 %29, label %32, label %30
30: ; preds = %25
%31 = tail call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @.str.7, i64 0, i64 0))
br label %109
32: ; preds = %25
%33 = tail call i32* @fopen(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.8, i64 0, i64 0), i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.9, i64 0, i64 0))
%34 = icmp eq i32* %33, null
br i1 %34, label %35, label %37
35: ; preds = %32
%36 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @str, i64 0, i64 0))
br label %109
37: ; preds = %32
%38 = getelementptr inbounds i8, i8* %27, i64 12
%39 = tail call i32 @fwrite(i8* %38, i32 1, i32 65536, i32* %33)
%40 = icmp eq i32 %39, 65536
br i1 %40, label %43, label %41
41: ; preds = %37
%42 = tail call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.11, i64 0, i64 0))
br label %109
43: ; preds = %37
%44 = load i32, i32* @SEEK_SET
%45 = tail call i32 @fseek(i32* %33, i32 0, i32 %44)
%46 = getelementptr inbounds i8, i8* %27, i64 8
%47 = bitcast i8* %46 to i32*
%48 = load i32, i32* %47
%49 = tail call i64 @malloc(i32 65536)
%50 = inttoptr i64 %49 to i8*
%51 = tail call i32 @memset(i8* %50, i32 0, i32 65536)
%52 = tail call i32 @fread(i8* %50, i32 1, i32 65536, i32* %33)
%53 = icmp eq i32 %52, 65536
br i1 %53, label %56, label %54
54: ; preds = %43
%55 = tail call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([42 x i8], [42 x i8]* @.str.12, i64 0, i64 0))
br label %109
56: ; preds = %43
%57 = inttoptr i64 %49 to i32*
br label %58
58: ; preds = %58, %56
%59 = phi i64 [ 0, %56 ], [ %97, %58 ]
%60 = phi <4 x i32> [ zeroinitializer, %56 ], [ %95, %58 ]
%61 = phi <4 x i32> [ zeroinitializer, %56 ], [ %96, %58 ]
%62 = getelementptr inbounds i32, i32* %57, i64 %59
%63 = bitcast i32* %62 to <4 x i32>*
%64 = load <4 x i32>, <4 x i32>* %63
%65 = getelementptr inbounds i32, i32* %62, i64 4
%66 = bitcast i32* %65 to <4 x i32>*
%67 = load <4 x i32>, <4 x i32>* %66
%68 = xor <4 x i32> %64, %60
%69 = xor <4 x i32> %67, %61
%70 = or i64 %59, 8
%71 = getelementptr inbounds i32, i32* %57, i64 %70
%72 = bitcast i32* %71 to <4 x i32>*
%73 = load <4 x i32>, <4 x i32>* %72
%74 = getelementptr inbounds i32, i32* %71, i64 4
%75 = bitcast i32* %74 to <4 x i32>*
%76 = load <4 x i32>, <4 x i32>* %75
%77 = xor <4 x i32> %73, %68
%78 = xor <4 x i32> %76, %69
%79 = or i64 %59, 16
%80 = getelementptr inbounds i32, i32* %57, i64 %79
%81 = bitcast i32* %80 to <4 x i32>*
%82 = load <4 x i32>, <4 x i32>* %81
%83 = getelementptr inbounds i32, i32* %80, i64 4
%84 = bitcast i32* %83 to <4 x i32>*
%85 = load <4 x i32>, <4 x i32>* %84
%86 = xor <4 x i32> %82, %77
%87 = xor <4 x i32> %85, %78
%88 = or i64 %59, 24
%89 = getelementptr inbounds i32, i32* %57, i64 %88
%90 = bitcast i32* %89 to <4 x i32>*
%91 = load <4 x i32>, <4 x i32>* %90
%92 = getelementptr inbounds i32, i32* %89, i64 4
%93 = bitcast i32* %92 to <4 x i32>*
%94 = load <4 x i32>, <4 x i32>* %93
%95 = xor <4 x i32> %91, %86
%96 = xor <4 x i32> %94, %87
%97 = add nuw nsw i64 %59, 32
%98 = icmp eq i64 %97, 16384
br i1 %98, label %99, label %58
99: ; preds = %58
%100 = xor <4 x i32> %96, %95
%101 = call i32 @llvm.vector.reduce.xor.v4i32(<4 x i32> %100)
%102 = icmp eq i32 %101, %48
br i1 %102, label %105, label %103
103: ; preds = %99
%104 = tail call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @.str.13, i64 0, i64 0))
br label %109
105: ; preds = %99
%106 = tail call i32 @fclose(i32* %33)
%107 = tail call i32 @free(i8* %27)
%108 = tail call i32 @free(i8* %50)
br label %109
109: ; preds = %12, %18, %23, %30, %35, %41, %54, %103, %105
%110 = phi i8* [ getelementptr inbounds ([34 x i8], [34 x i8]* @.str.14, i64 0, i64 0), %105 ], [ getelementptr inbounds ([30 x i8], [30 x i8]* @.str.17, i64 0, i64 0), %103 ], [ getelementptr inbounds ([30 x i8], [30 x i8]* @.str.17, i64 0, i64 0), %54 ], [ getelementptr inbounds ([30 x i8], [30 x i8]* @.str.17, i64 0, i64 0), %41 ], [ getelementptr inbounds ([30 x i8], [30 x i8]* @.str.17, i64 0, i64 0), %35 ], [ getelementptr inbounds ([30 x i8], [30 x i8]* @.str.17, i64 0, i64 0), %30 ], [ getelementptr inbounds ([30 x i8], [30 x i8]* @.str.17, i64 0, i64 0), %23 ], [ getelementptr inbounds ([30 x i8], [30 x i8]* @.str.17, i64 0, i64 0), %18 ], [ getelementptr inbounds ([30 x i8], [30 x i8]* @.str.17, i64 0, i64 0), %12 ]
%111 = phi i32 [ 0, %105 ], [ 1, %103 ], [ 1, %54 ], [ 1, %41 ], [ 1, %35 ], [ 1, %30 ], [ 1, %23 ], [ 1, %18 ], [ 1, %12 ]
%112 = tail call i32 @printf(i8* dereferenceable(1) %110)
%113 = load i32, i32* @stdout
%114 = tail call i32 @fprintf(i32 %113, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.15, i64 0, i64 0))
%115 = load i32, i32* @stdout
%116 = tail call i32 @fprintf(i32 %115, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.16, i64 0, i64 0))
ret i32 %111
}