unsigned int _uiRcSDSCTransmitEx(unsigned char *psCommand,
                                 unsigned int uiCommandLen,
                                 unsigned int uiTimeOutMode,
                                 unsigned char *psOutData,
                                 unsigned int *puiOutDataLen) {
  unsigned int uiDataLen;
  int iRet;
  unsigned int uiTimeout;
  char *psFunCall = malloc(1024);
  uiDataLen = sprintf(psFunCall, "%u(b%03u", 5027, uiCommandLen);
  memcpy(psFunCall + uiDataLen, psCommand, uiCommandLen);
  uiDataLen += uiCommandLen;
  uiDataLen += sprintf(psFunCall + uiDataLen, ",%u,%u,b000,%u)", uiCommandLen,
                       uiTimeOutMode, *puiOutDataLen);
  uiTimeout = 5;
  if (uiTimeOutMode)
    uiTimeout = 46;
  iRet = iDoRemoteFunc((unsigned char *)psFunCall, uiDataLen, uiTimeout);
  free(psFunCall);
  if (iRet == -2)
    return 9;
  if (iRet) {
    vWriteLogTxt("_uiRcSDSCTransmitEx iDoRemoteFunc ret = %d", iRet);
    return 1;
  }
  iRet = iGetParaInt(0);
  if (iRet != 0)
    return 1;
  uiDataLen = iGetParaInt(6);
  if (uiDataLen < 2)
    return 1;
  *puiOutDataLen = uiDataLen;
  memcpy(psOutData, psGetParaBuf(5), uiDataLen);
  return (0);
}


x86 assembly (clang, -O0):
<_uiRcSDSCTransmitEx>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
mov    %edx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
mov    %r8,-0x28(%rbp)
mov    $0x400,%edi
call   1080 <malloc@plt>
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x14(%rbp),%ecx
lea    0xe4a(%rip),%rsi
mov    $0x13a3,%edx
mov    $0x0,%al
call   10a0 <sprintf@plt>
mov    %eax,-0x2c(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x2c(%rbp),%eax
add    %rax,%rdi
mov    -0x10(%rbp),%rsi
mov    -0x14(%rbp),%eax
mov    %eax,%edx
call   1070 <memcpy@plt>
mov    -0x14(%rbp),%eax
add    -0x2c(%rbp),%eax
mov    %eax,-0x2c(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x2c(%rbp),%eax
add    %rax,%rdi
mov    -0x14(%rbp),%edx
mov    -0x18(%rbp),%ecx
mov    -0x28(%rbp),%rax
mov    (%rax),%r8d
lea    0xe05(%rip),%rsi
mov    $0x0,%al
call   10a0 <sprintf@plt>
add    -0x2c(%rbp),%eax
mov    %eax,-0x2c(%rbp)
movl   $0x5,-0x34(%rbp)
cmpl   $0x0,-0x18(%rbp)
je     1229 <_uiRcSDSCTransmitEx+0xa9>
movl   $0x2e,-0x34(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x2c(%rbp),%esi
mov    -0x34(%rbp),%edx
mov    $0x0,%al
call   1090 <iDoRemoteFunc@plt>
mov    %eax,-0x30(%rbp)
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
cmpl   $0xfffffffe,-0x30(%rbp)
jne    125c <_uiRcSDSCTransmitEx+0xdc>
movl   $0x9,-0x4(%rbp)
jmp    12ff <_uiRcSDSCTransmitEx+0x17f>
cmpl   $0x0,-0x30(%rbp)
je     1283 <_uiRcSDSCTransmitEx+0x103>
mov    -0x30(%rbp),%esi
lea    0xda9(%rip),%rdi
mov    $0x0,%al
call   1060 <vWriteLogTxt@plt>
movl   $0x1,-0x4(%rbp)
jmp    12ff <_uiRcSDSCTransmitEx+0x17f>
xor    %edi,%edi
mov    $0x0,%al
call   1040 <iGetParaInt@plt>
mov    %eax,-0x30(%rbp)
cmpl   $0x0,-0x30(%rbp)
je     12a5 <_uiRcSDSCTransmitEx+0x125>
movl   $0x1,-0x4(%rbp)
jmp    12ff <_uiRcSDSCTransmitEx+0x17f>
mov    $0x6,%edi
mov    $0x0,%al
call   1040 <iGetParaInt@plt>
mov    %eax,-0x2c(%rbp)
cmpl   $0x2,-0x2c(%rbp)
jae    12ca <_uiRcSDSCTransmitEx+0x14a>
movl   $0x1,-0x4(%rbp)
jmp    12ff <_uiRcSDSCTransmitEx+0x17f>
mov    -0x2c(%rbp),%ecx
mov    -0x28(%rbp),%rax
mov    %ecx,(%rax)
mov    -0x20(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    $0x5,%edi
mov    $0x0,%al
call   1050 <psGetParaBuf@plt>
mov    -0x48(%rbp),%rdi
movslq %eax,%rsi
mov    -0x2c(%rbp),%eax
mov    %eax,%edx
call   1070 <memcpy@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<_uiRcSDSCTransmitEx>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %r8,%r15
mov    %rcx,(%rsp)
mov    %edx,%r12d
mov    %esi,%ebp
mov    %rdi,%r14
mov    $0x400,%edi
call   1080 <malloc@plt>
mov    %rax,%r13
lea    0xe52(%rip),%rsi
mov    %rax,%rdi
mov    $0x13a3,%edx
mov    %ebp,%ecx
xor    %eax,%eax
call   10a0 <sprintf@plt>
mov    %eax,%ebx
mov    %eax,%edi
add    %r13,%rdi
mov    %ebp,%edx
mov    %r14,%rsi
call   1070 <memcpy@plt>
add    %ebp,%ebx
lea    (%rbx,%r13,1),%rdi
mov    (%r15),%r8d
lea    0xe29(%rip),%rsi
mov    %ebp,%edx
mov    %r12d,%ecx
xor    %eax,%eax
call   10a0 <sprintf@plt>
add    %eax,%ebx
test   %r12d,%r12d
mov    $0x5,%eax
mov    $0x2e,%edx
cmove  %eax,%edx
mov    %r13,%rdi
mov    %ebx,%esi
xor    %eax,%eax
call   1090 <iDoRemoteFunc@plt>
mov    %eax,%ebx
mov    %r13,%rdi
call   1030 <free@plt>
cmp    $0xfffffffe,%ebx
je     1263 <_uiRcSDSCTransmitEx+0xe3>
test   %ebx,%ebx
jne    126a <_uiRcSDSCTransmitEx+0xea>
xor    %edi,%edi
xor    %eax,%eax
call   1040 <iGetParaInt@plt>
mov    $0x1,%ebx
test   %eax,%eax
jne    127f <_uiRcSDSCTransmitEx+0xff>
mov    $0x6,%edi
xor    %eax,%eax
call   1040 <iGetParaInt@plt>
cmp    $0x2,%eax
jb     127f <_uiRcSDSCTransmitEx+0xff>
mov    %eax,%ebp
mov    %eax,(%r15)
mov    $0x5,%edi
xor    %eax,%eax
call   1050 <psGetParaBuf@plt>
movslq %eax,%rsi
mov    %ebp,%edx
mov    (%rsp),%rdi
call   1070 <memcpy@plt>
xor    %ebx,%ebx
jmp    127f <_uiRcSDSCTransmitEx+0xff>
mov    $0x9,%ebx
jmp    127f <_uiRcSDSCTransmitEx+0xff>
lea    0xda8(%rip),%rdi
mov    %ebx,%esi
xor    %eax,%eax
call   1060 <vWriteLogTxt@plt>
mov    $0x1,%ebx
mov    %ebx,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [9 x i8] c"%u(b%03u\00"
@.str.1 = [16 x i8] c",%u,%u,b000,%u)\00"
@.str.2 = [43 x i8] c"_uiRcSDSCTransmitEx iDoRemoteFunc ret = %d\00"
define i32 @_uiRcSDSCTransmitEx(i8* %0, i32 %1, i32 %2, i8* %3, i32* %4) {
%6 = alloca i32
%7 = alloca i8*
%8 = alloca i32
%9 = alloca i32
%10 = alloca i8*
%11 = alloca i32*
%12 = alloca i32
%13 = alloca i32
%14 = alloca i32
%15 = alloca i8*
store i8* %0, i8** %7
store i32 %1, i32* %8
store i32 %2, i32* %9
store i8* %3, i8** %10
store i32* %4, i32** %11
%16 = call i8* @malloc(i64 1024)
store i8* %16, i8** %15
%17 = load i8*, i8** %15
%18 = load i32, i32* %8
%19 = call i32 (i8*, i8*, ...) @sprintf(i8* %17, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0), i32 5027, i32 %18)
store i32 %19, i32* %12
%20 = load i8*, i8** %15
%21 = load i32, i32* %12
%22 = zext i32 %21 to i64
%23 = getelementptr inbounds i8, i8* %20, i64 %22
%24 = load i8*, i8** %7
%25 = load i32, i32* %8
%26 = zext i32 %25 to i64
%27 = load i32, i32* %8
%28 = load i32, i32* %12
%29 = add i32 %28, %27
store i32 %29, i32* %12
%30 = load i8*, i8** %15
%31 = load i32, i32* %12
%32 = zext i32 %31 to i64
%33 = getelementptr inbounds i8, i8* %30, i64 %32
%34 = load i32, i32* %8
%35 = load i32, i32* %9
%36 = load i32*, i32** %11
%37 = load i32, i32* %36
%38 = call i32 (i8*, i8*, ...) @sprintf(i8* %33, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i32 %34, i32 %35, i32 %37)
%39 = load i32, i32* %12
%40 = add i32 %39, %38
store i32 %40, i32* %12
store i32 5, i32* %14
%41 = load i32, i32* %9
%42 = icmp ne i32 %41, 0
br i1 %42, label %43, label %44
43: ; preds = %5
store i32 46, i32* %14
br label %44
44: ; preds = %43, %5
%45 = load i8*, i8** %15
%46 = load i32, i32* %12
%47 = load i32, i32* %14
%48 = call i32 (i8*, i32, i32, ...) bitcast (i32 (...)* @iDoRemoteFunc to i32 (i8*, i32, i32, ...)*)(i8* %45, i32 %46, i32 %47)
store i32 %48, i32* %13
%49 = load i8*, i8** %15
%50 = load i32, i32* %13
%51 = icmp eq i32 %50, -2
br i1 %51, label %52, label %53
52: ; preds = %44
store i32 9, i32* %6
br label %78
53: ; preds = %44
%54 = load i32, i32* %13
%55 = icmp ne i32 %54, 0
br i1 %55, label %56, label %59
56: ; preds = %53
%57 = load i32, i32* %13
%58 = call i32 (i8*, i32, ...) bitcast (i32 (...)* @vWriteLogTxt to i32 (i8*, i32, ...)*)(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str.2, i64 0, i64 0), i32 %57)
store i32 1, i32* %6
br label %78
59: ; preds = %53
%60 = call i32 (i32, ...) bitcast (i32 (...)* @iGetParaInt to i32 (i32, ...)*)(i32 0)
store i32 %60, i32* %13
%61 = load i32, i32* %13
%62 = icmp ne i32 %61, 0
br i1 %62, label %63, label %64
63: ; preds = %59
store i32 1, i32* %6
br label %78
64: ; preds = %59
%65 = call i32 (i32, ...) bitcast (i32 (...)* @iGetParaInt to i32 (i32, ...)*)(i32 6)
store i32 %65, i32* %12
%66 = load i32, i32* %12
%67 = icmp ult i32 %66, 2
br i1 %67, label %68, label %69
68: ; preds = %64
store i32 1, i32* %6
br label %78
69: ; preds = %64
%70 = load i32, i32* %12
%71 = load i32*, i32** %11
store i32 %70, i32* %71
%72 = load i8*, i8** %10
%73 = call i32 (i32, ...) bitcast (i32 (...)* @psGetParaBuf to i32 (i32, ...)*)(i32 5)
%74 = sext i32 %73 to i64
%75 = inttoptr i64 %74 to i8*
%76 = load i32, i32* %12
%77 = zext i32 %76 to i64
store i32 0, i32* %6
br label %78
78: ; preds = %69, %68, %63, %56, %52
%79 = load i32, i32* %6
ret i32 %79
}

LLVM IR (-O2):
@.str = [9 x i8] c"%u(b%03u\00"
@.str.1 = [16 x i8] c",%u,%u,b000,%u)\00"
@.str.2 = [43 x i8] c"_uiRcSDSCTransmitEx iDoRemoteFunc ret = %d\00"
define i32 @_uiRcSDSCTransmitEx(i8* nocapture %0, i32 %1, i32 %2, i8* nocapture writeonly %3, i32* nocapture %4) {
%6 = tail call dereferenceable_or_null(1024) i8* @malloc(i64 1024)
%7 = tail call i32 (i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %6, i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0), i32 5027, i32 %1)
%8 = zext i32 %7 to i64
%9 = getelementptr inbounds i8, i8* %6, i64 %8
%10 = zext i32 %1 to i64
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 %9, i8* align 1 %0, i64 %10, i1 false)
%11 = add i32 %7, %1
%12 = zext i32 %11 to i64
%13 = getelementptr inbounds i8, i8* %6, i64 %12
%14 = load i32, i32* %4
%15 = tail call i32 (i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %13, i8* dereferenceable(1) getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i32 %1, i32 %2, i32 %14)
%16 = add i32 %15, %11
%17 = icmp eq i32 %2, 0
%18 = select i1 %17, i32 5, i32 46
%19 = tail call i32 (i8*, i32, i32, ...) bitcast (i32 (...)* @iDoRemoteFunc to i32 (i8*, i32, i32, ...)*)(i8* %6, i32 %16, i32 %18)
tail call void @free(i8* %6)
switch i32 %19, label %20 [
i32 -2, label %33
i32 0, label %22
]
20: ; preds = %5
%21 = tail call i32 (i8*, i32, ...) bitcast (i32 (...)* @vWriteLogTxt to i32 (i8*, i32, ...)*)(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str.2, i64 0, i64 0), i32 %19)
br label %33
22: ; preds = %5
%23 = tail call i32 (i32, ...) bitcast (i32 (...)* @iGetParaInt to i32 (i32, ...)*)(i32 0)
%24 = icmp eq i32 %23, 0
br i1 %24, label %25, label %33
25: ; preds = %22
%26 = tail call i32 (i32, ...) bitcast (i32 (...)* @iGetParaInt to i32 (i32, ...)*)(i32 6)
%27 = icmp ult i32 %26, 2
br i1 %27, label %33, label %28
28: ; preds = %25
store i32 %26, i32* %4
%29 = tail call i32 (i32, ...) bitcast (i32 (...)* @psGetParaBuf to i32 (i32, ...)*)(i32 5)
%30 = sext i32 %29 to i64
%31 = inttoptr i64 %30 to i8*
%32 = zext i32 %26 to i64
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 %3, i8* align 1 %31, i64 %32, i1 false)
br label %33
33: ; preds = %25, %22, %5, %28, %20
%34 = phi i32 [ 1, %20 ], [ 0, %28 ], [ 9, %5 ], [ 1, %22 ], [ 1, %25 ]
ret i32 %34
}