#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_8__ TYPE_4__;
typedef struct TYPE_7__ TYPE_3__;
typedef struct TYPE_6__ TYPE_2__;
typedef struct TYPE_5__ TYPE_1__;

/* Type definitions */
struct stat {
  int st_size;
};
struct TYPE_8__ {
  int e_phoff;
  int e_shoff;
};
struct TYPE_7__ {
  scalar_t__ p_type;
  int p_vaddr;
};
struct TYPE_6__ {
  scalar_t__ sh_type;
  int sh_offset;
};
struct TYPE_5__ {
  int st_value;
  int /*<<< orphan*/ st_name;
};
typedef TYPE_1__ Elf32_Sym;
typedef TYPE_2__ Elf32_Shdr;
typedef TYPE_3__ Elf32_Phdr;
typedef TYPE_4__ Elf32_Ehdr;

/* Variables and functions */
long AT_BASE;
long AT_NULL;
int /*<<< orphan*/ EXIT_FAILURE;
int MAP_ANONYMOUS;
int MAP_PRIVATE;
int /*<<< orphan*/ O_RDONLY;
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
scalar_t__ PT_DYNAMIC;
scalar_t__ SHT_SYMTAB;
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ fstat(long, struct stat *);
void *mmap(int /*<<< orphan*/, int, int, int, long, int /*<<< orphan*/);
long open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ st_str(unsigned char *, int /*<<< orphan*/);
scalar_t__ strcmp(int /*<<< orphan*/, char *);
int main(int argc, char **argv) {
  long testfile, testelf;
  struct stat *statbuf;
  unsigned char *testbuf, *t;
  void (*e_entry)(long *, long *);
  long got, rela, relasz, rel, relsz;
  long stack[9] = {0};
  long *dynv;
  statbuf = mmap(0, sizeof(struct stat), PROT_WRITE | PROT_READ,
                 MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
  if (argc < 3) {
    printf("loader [bin file] [elf file]\n");
    exit(EXIT_FAILURE);
  }
  testfile = open(argv[1], O_RDONLY);
  if (testfile < 0) {
    perror(argv[1]);
    exit(EXIT_FAILURE);
  }
  testelf = open(argv[2], O_RDONLY);
  if (testelf < 0) {
    perror(argv[2]);
    exit(EXIT_FAILURE);
  }
  fstat(testfile, statbuf);
  testbuf = mmap(0, statbuf->st_size, PROT_EXEC | PROT_WRITE | PROT_READ,
                 MAP_PRIVATE, testfile, 0);
  fstat(testelf, statbuf);
  t = mmap(0, statbuf->st_size, PROT_EXEC | PROT_WRITE | PROT_READ, MAP_PRIVATE,
           testelf, 0);
  Elf32_Ehdr *ehdr = (Elf32_Ehdr *)t;
  Elf32_Phdr *phdr = (Elf32_Phdr *)(t + ehdr->e_phoff);
  Elf32_Shdr *shdr = (Elf32_Shdr *)(t + ehdr->e_shoff);
  while (shdr->sh_type != SHT_SYMTAB)
    shdr++;
  Elf32_Sym *symb = (Elf32_Sym *)(t + shdr->sh_offset);
  while (strcmp(st_str(t, symb->st_name), "_start_c") != 0)
    symb++;
  e_entry = (void *)(testbuf + symb->st_value);
  stack[0] = 1;
  stack[1] = (intptr_t) "libc.so";
  stack[2] = 0;
  stack[3] = (intptr_t) "LANG=C";
  stack[4] = 0;
  stack[5] = AT_BASE;
  stack[6] = (intptr_t)testbuf;
  stack[7] = AT_NULL;
  stack[8] = 0;
  while (phdr->p_type != PT_DYNAMIC)
    phdr++;
  dynv = (void *)(testbuf + phdr->p_vaddr);
  printf("Jumping to %p in %s loaded at %p\n", e_entry, argv[1], testbuf);
  e_entry(stack, dynv);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0xe0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0xb0(%rbp),%rdi
xor    %esi,%esi
mov    $0x48,%edx
call   1050 <memset@plt>
mov    0x2de5(%rip),%rax
mov    (%rax),%edx
mov    0x2e2c(%rip),%rax
or     (%rax),%edx
mov    0x2dcb(%rip),%rax
mov    (%rax),%ecx
mov    0x2dfa(%rip),%rax
or     (%rax),%ecx
xor    %r9d,%r9d
mov    $0x4,%esi
xor    %eax,%eax
mov    %eax,%r8d
mov    %r9d,%edi
call   1030 <mmap@plt>
mov    %rax,-0x28(%rbp)
cmpl   $0x3,-0x8(%rbp)
jge    121f <main+0x8f>
lea    0xdf6(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    0x2d98(%rip),%rax
mov    (%rax),%edi
call   10a0 <exit@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
mov    0x2db2(%rip),%rax
mov    (%rax),%esi
call   1080 <open@plt>
mov    %rax,-0x18(%rbp)
cmpq   $0x0,-0x18(%rbp)
jge    125f <main+0xcf>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1090 <perror@plt>
mov    0x2d58(%rip),%rax
mov    (%rax),%edi
call   10a0 <exit@plt>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
mov    0x2d72(%rip),%rax
mov    (%rax),%esi
call   1080 <open@plt>
mov    %rax,-0x20(%rbp)
cmpq   $0x0,-0x20(%rbp)
jge    129f <main+0x10f>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
call   1090 <perror@plt>
mov    0x2d18(%rip),%rax
mov    (%rax),%edi
call   10a0 <exit@plt>
mov    -0x18(%rbp),%rdi
mov    -0x28(%rbp),%rsi
call   10b0 <fstat@plt>
mov    -0x28(%rbp),%rax
mov    (%rax),%esi
mov    0x2d17(%rip),%rax
mov    (%rax),%edx
mov    0x2ce6(%rip),%rax
or     (%rax),%edx
mov    0x2d2d(%rip),%rax
or     (%rax),%edx
mov    0x2ccc(%rip),%rax
mov    (%rax),%ecx
mov    -0x18(%rbp),%r8
xor    %r9d,%r9d
mov    %r9d,%edi
call   1030 <mmap@plt>
mov    %rax,-0x30(%rbp)
mov    -0x20(%rbp),%rdi
mov    -0x28(%rbp),%rsi
call   10b0 <fstat@plt>
mov    -0x28(%rbp),%rax
mov    (%rax),%esi
mov    0x2ccd(%rip),%rax
mov    (%rax),%edx
mov    0x2c9c(%rip),%rax
or     (%rax),%edx
mov    0x2ce3(%rip),%rax
or     (%rax),%edx
mov    0x2c82(%rip),%rax
mov    (%rax),%ecx
mov    -0x20(%rbp),%r8
xor    %r9d,%r9d
mov    %r9d,%edi
call   1030 <mmap@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    %rax,-0xc0(%rbp)
mov    -0x38(%rbp),%rax
mov    -0xc0(%rbp),%rcx
movslq (%rcx),%rcx
add    %rcx,%rax
mov    %rax,-0xc8(%rbp)
mov    -0x38(%rbp),%rax
mov    -0xc0(%rbp),%rcx
movslq 0x4(%rcx),%rcx
add    %rcx,%rax
mov    %rax,-0xd0(%rbp)
mov    -0xd0(%rbp),%rax
mov    (%rax),%rax
mov    0x2c40(%rip),%rcx
cmp    (%rcx),%rax
je     13a0 <main+0x210>
mov    -0xd0(%rbp),%rax
add    $0x10,%rax
mov    %rax,-0xd0(%rbp)
jmp    136f <main+0x1df>
mov    -0x38(%rbp),%rax
mov    -0xd0(%rbp),%rcx
movslq 0x8(%rcx),%rcx
add    %rcx,%rax
mov    %rax,-0xd8(%rbp)
mov    -0x38(%rbp),%rdi
mov    -0xd8(%rbp),%rax
mov    0x4(%rax),%esi
call   1070 <st_str@plt>
mov    %eax,%edi
lea    0xc49(%rip),%rsi
call   1060 <strcmp@plt>
cmp    $0x0,%rax
je     13fb <main+0x26b>
mov    -0xd8(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0xd8(%rbp)
jmp    13b9 <main+0x229>
mov    -0x30(%rbp),%rax
mov    -0xd8(%rbp),%rcx
movslq (%rcx),%rcx
add    %rcx,%rax
mov    %rax,-0x40(%rbp)
movq   $0x1,-0xb0(%rbp)
lea    0xc05(%rip),%rax
mov    %rax,-0xa8(%rbp)
movq   $0x0,-0xa0(%rbp)
lea    0xbf4(%rip),%rax
mov    %rax,-0x98(%rbp)
movq   $0x0,-0x90(%rbp)
mov    0x2b64(%rip),%rax
mov    (%rax),%rax
mov    %rax,-0x88(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x80(%rbp)
mov    0x2b1b(%rip),%rax
mov    (%rax),%rax
mov    %rax,-0x78(%rbp)
movq   $0x0,-0x70(%rbp)
mov    -0xc8(%rbp),%rax
mov    (%rax),%rax
mov    0x2b03(%rip),%rcx
cmp    (%rcx),%rax
je     14ad <main+0x31d>
mov    -0xc8(%rbp),%rax
add    $0x10,%rax
mov    %rax,-0xc8(%rbp)
jmp    147c <main+0x2ec>
mov    -0x30(%rbp),%rax
mov    -0xc8(%rbp),%rcx
movslq 0x8(%rcx),%rcx
add    %rcx,%rax
mov    %rax,-0xb8(%rbp)
mov    -0x40(%rbp),%rsi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdx
mov    -0x30(%rbp),%rcx
lea    0xb59(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x40(%rbp),%rax
lea    -0xb0(%rbp),%rdi
mov    -0xb8(%rbp),%rsi
call   *%rax
xor    %eax,%eax
add    $0xe0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x58,%rsp
mov    %rsi,%rbp
mov    %edi,%ebx
mov    0x2dfe(%rip),%rax
mov    0x2e47(%rip),%r15
mov    (%r15),%edx
or     (%rax),%edx
mov    0x2de3(%rip),%rsi
mov    0x2e14(%rip),%rax
mov    (%rax),%ecx
or     (%rsi),%ecx
xor    %edi,%edi
mov    $0x4,%esi
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1040 <mmap@plt>
cmp    $0x2,%ebx
jle    13aa <main+0x21a>
mov    %rax,%r13
mov    0x8(%rbp),%rdi
mov    0x2def(%rip),%r14
mov    (%r14),%esi
call   1080 <open@plt>
test   %rax,%rax
js     13b8 <main+0x228>
mov    %rax,%rbx
mov    %rbp,0x8(%rsp)
mov    0x10(%rbp),%rdi
mov    (%r14),%esi
call   1080 <open@plt>
test   %rax,%rax
js     13be <main+0x22e>
mov    %rax,%r12
mov    %rbx,%rdi
mov    %r13,%rsi
call   10b0 <fstat@plt>
mov    0x2d9c(%rip),%rcx
mov    0x2d6d(%rip),%r14
mov    (%r14),%edx
or     (%rcx),%edx
mov    0x0(%r13),%esi
or     (%r15),%edx
mov    0x2d52(%rip),%rbp
mov    0x0(%rbp),%ecx
xor    %edi,%edi
mov    %rbx,%r8
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %r15,%rbx
mov    %rax,%r15
mov    %r12,%rdi
mov    %r13,%rsi
call   10b0 <fstat@plt>
mov    (%r14),%edx
mov    0x2d57(%rip),%rax
or     (%rax),%edx
mov    0x0(%r13),%esi
or     (%rbx),%edx
mov    0x0(%rbp),%ecx
xor    %edi,%edi
mov    %r12,%r8
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,%r13
movslq (%rax),%rbp
add    %rax,%rbp
movslq 0x4(%rax),%rax
add    %r13,%rax
mov    0x2d18(%rip),%rcx
mov    (%rcx),%rcx
nopl   0x0(%rax,%rax,1)
mov    %rax,%rdx
add    $0x10,%rax
cmp    %rcx,(%rdx)
jne    12b0 <main+0x120>
movslq -0x8(%rax),%rax
lea    (%rax,%r13,1),%rbx
add    $0x4,%rbx
lea    0xd31(%rip),%r12
nop
mov    (%rbx),%esi
mov    %r13,%rdi
call   1070 <st_str@plt>
mov    %eax,%edi
mov    %r12,%rsi
call   1060 <strcmp@plt>
add    $0x8,%rbx
test   %rax,%rax
jne    12d0 <main+0x140>
movslq -0xc(%rbx),%r12
movq   $0x1,0x10(%rsp)
lea    0xd08(%rip),%rax
mov    %rax,0x18(%rsp)
movq   $0x0,0x20(%rsp)
lea    0xcfb(%rip),%rax
mov    %rax,0x28(%rsp)
movq   $0x0,0x30(%rsp)
mov    0x2c8d(%rip),%rax
mov    (%rax),%rax
mov    %rax,0x38(%rsp)
mov    %r15,0x40(%rsp)
mov    0x2c49(%rip),%rax
mov    (%rax),%rax
mov    %rax,0x48(%rsp)
movq   $0x0,0x50(%rsp)
mov    0x2c39(%rip),%rax
mov    (%rax),%rax
mov    0x8(%rsp),%rdx
nop
mov    %rbp,%rcx
add    $0x10,%rbp
cmp    %rax,(%rcx)
jne    1360 <main+0x1d0>
add    %r15,%r12
movslq -0x8(%rbp),%rbx
add    %r15,%rbx
mov    0x8(%rdx),%rdx
lea    0xc97(%rip),%rdi
mov    %r12,%rsi
mov    %r15,%rcx
xor    %eax,%eax
call   1050 <printf@plt>
lea    0x10(%rsp),%rdi
mov    %rbx,%rsi
call   *%r12
xor    %eax,%eax
add    $0x58,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xc89(%rip),%rdi
call   1030 <puts@plt>
jmp    13cc <main+0x23c>
mov    0x8(%rbp),%rdi
jmp    13c7 <main+0x237>
mov    0x8(%rsp),%rax
mov    0x10(%rax),%rdi
call   1090 <perror@plt>
mov    0x2bdd(%rip),%rax
mov    (%rax),%edi
call   10a0 <exit@plt>

LLVM IR (-O0):
%struct.stat = type { i32 }
%struct.TYPE_8__ = type { i32, i32 }
%struct.TYPE_7__ = type { i64, i32 }
%struct.TYPE_6__ = type { i64, i32 }
%struct.TYPE_5__ = type { i32, i32 }
@PROT_WRITE = global i32 0
@PROT_READ = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@.str = [30 x i8] c"loader [bin file] [elf file]\0A\00"
@EXIT_FAILURE = global i32 0
@O_RDONLY = global i32 0
@PROT_EXEC = global i32 0
@SHT_SYMTAB = global i64 0
@.str.1 = [9 x i8] c"_start_c\00"
@.str.2 = [8 x i8] c"libc.so\00"
@.str.3 = [7 x i8] c"LANG=C\00"
@AT_BASE = global i64 0
@AT_NULL = global i64 0
@PT_DYNAMIC = global i64 0
@.str.4 = [34 x i8] c"Jumping to %p in %s loaded at %p\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i64
%7 = alloca i64
%8 = alloca %struct.stat*
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca void (i64*, i64*)*
%12 = alloca i64
%13 = alloca i64
%14 = alloca i64
%15 = alloca i64
%16 = alloca i64
%17 = alloca [9 x i64]
%18 = alloca i64*
%19 = alloca %struct.TYPE_8__*
%20 = alloca %struct.TYPE_7__*
%21 = alloca %struct.TYPE_6__*
%22 = alloca %struct.TYPE_5__*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%23 = bitcast [9 x i64]* %17 to i8*
%24 = load i32, i32* @PROT_WRITE
%25 = load i32, i32* @PROT_READ
%26 = or i32 %24, %25
%27 = load i32, i32* @MAP_PRIVATE
%28 = load i32, i32* @MAP_ANONYMOUS
%29 = or i32 %27, %28
%30 = call i8* @mmap(i32 0, i32 4, i32 %26, i32 %29, i64 0, i32 0)
%31 = bitcast i8* %30 to %struct.stat*
store %struct.stat* %31, %struct.stat** %8
%32 = load i32, i32* %4
%33 = icmp slt i32 %32, 3
br i1 %33, label %34, label %38
34: ; preds = %2
%35 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str, i64 0, i64 0))
%36 = load i32, i32* @EXIT_FAILURE
%37 = call i32 @exit(i32 %36)
unreachable
38: ; preds = %2
%39 = load i8**, i8*** %5
%40 = getelementptr inbounds i8*, i8** %39, i64 1
%41 = load i8*, i8** %40
%42 = load i32, i32* @O_RDONLY
%43 = call i64 @open(i8* %41, i32 %42)
store i64 %43, i64* %6
%44 = load i64, i64* %6
%45 = icmp slt i64 %44, 0
br i1 %45, label %46, label %53
46: ; preds = %38
%47 = load i8**, i8*** %5
%48 = getelementptr inbounds i8*, i8** %47, i64 1
%49 = load i8*, i8** %48
%50 = call i32 @perror(i8* %49)
%51 = load i32, i32* @EXIT_FAILURE
%52 = call i32 @exit(i32 %51)
unreachable
53: ; preds = %38
%54 = load i8**, i8*** %5
%55 = getelementptr inbounds i8*, i8** %54, i64 2
%56 = load i8*, i8** %55
%57 = load i32, i32* @O_RDONLY
%58 = call i64 @open(i8* %56, i32 %57)
store i64 %58, i64* %7
%59 = load i64, i64* %7
%60 = icmp slt i64 %59, 0
br i1 %60, label %61, label %68
61: ; preds = %53
%62 = load i8**, i8*** %5
%63 = getelementptr inbounds i8*, i8** %62, i64 2
%64 = load i8*, i8** %63
%65 = call i32 @perror(i8* %64)
%66 = load i32, i32* @EXIT_FAILURE
%67 = call i32 @exit(i32 %66)
unreachable
68: ; preds = %53
%69 = load i64, i64* %6
%70 = load %struct.stat*, %struct.stat** %8
%71 = call i32 @fstat(i64 %69, %struct.stat* %70)
%72 = load %struct.stat*, %struct.stat** %8
%73 = getelementptr inbounds %struct.stat, %struct.stat* %72, i32 0, i32 0
%74 = load i32, i32* %73
%75 = load i32, i32* @PROT_EXEC
%76 = load i32, i32* @PROT_WRITE
%77 = or i32 %75, %76
%78 = load i32, i32* @PROT_READ
%79 = or i32 %77, %78
%80 = load i32, i32* @MAP_PRIVATE
%81 = load i64, i64* %6
%82 = call i8* @mmap(i32 0, i32 %74, i32 %79, i32 %80, i64 %81, i32 0)
store i8* %82, i8** %9
%83 = load i64, i64* %7
%84 = load %struct.stat*, %struct.stat** %8
%85 = call i32 @fstat(i64 %83, %struct.stat* %84)
%86 = load %struct.stat*, %struct.stat** %8
%87 = getelementptr inbounds %struct.stat, %struct.stat* %86, i32 0, i32 0
%88 = load i32, i32* %87
%89 = load i32, i32* @PROT_EXEC
%90 = load i32, i32* @PROT_WRITE
%91 = or i32 %89, %90
%92 = load i32, i32* @PROT_READ
%93 = or i32 %91, %92
%94 = load i32, i32* @MAP_PRIVATE
%95 = load i64, i64* %7
%96 = call i8* @mmap(i32 0, i32 %88, i32 %93, i32 %94, i64 %95, i32 0)
store i8* %96, i8** %10
%97 = load i8*, i8** %10
%98 = bitcast i8* %97 to %struct.TYPE_8__*
store %struct.TYPE_8__* %98, %struct.TYPE_8__** %19
%99 = load i8*, i8** %10
%100 = load %struct.TYPE_8__*, %struct.TYPE_8__** %19
%101 = getelementptr inbounds %struct.TYPE_8__, %struct.TYPE_8__* %100, i32 0, i32 0
%102 = load i32, i32* %101
%103 = sext i32 %102 to i64
%104 = getelementptr inbounds i8, i8* %99, i64 %103
%105 = bitcast i8* %104 to %struct.TYPE_7__*
store %struct.TYPE_7__* %105, %struct.TYPE_7__** %20
%106 = load i8*, i8** %10
%107 = load %struct.TYPE_8__*, %struct.TYPE_8__** %19
%108 = getelementptr inbounds %struct.TYPE_8__, %struct.TYPE_8__* %107, i32 0, i32 1
%109 = load i32, i32* %108
%110 = sext i32 %109 to i64
%111 = getelementptr inbounds i8, i8* %106, i64 %110
%112 = bitcast i8* %111 to %struct.TYPE_6__*
store %struct.TYPE_6__* %112, %struct.TYPE_6__** %21
br label %113
113: ; preds = %119, %68
%114 = load %struct.TYPE_6__*, %struct.TYPE_6__** %21
%115 = getelementptr inbounds %struct.TYPE_6__, %struct.TYPE_6__* %114, i32 0, i32 0
%116 = load i64, i64* %115
%117 = load i64, i64* @SHT_SYMTAB
%118 = icmp ne i64 %116, %117
br i1 %118, label %119, label %122
119: ; preds = %113
%120 = load %struct.TYPE_6__*, %struct.TYPE_6__** %21
%121 = getelementptr inbounds %struct.TYPE_6__, %struct.TYPE_6__* %120, i32 1
store %struct.TYPE_6__* %121, %struct.TYPE_6__** %21
br label %113
122: ; preds = %113
%123 = load i8*, i8** %10
%124 = load %struct.TYPE_6__*, %struct.TYPE_6__** %21
%125 = getelementptr inbounds %struct.TYPE_6__, %struct.TYPE_6__* %124, i32 0, i32 1
%126 = load i32, i32* %125
%127 = sext i32 %126 to i64
%128 = getelementptr inbounds i8, i8* %123, i64 %127
%129 = bitcast i8* %128 to %struct.TYPE_5__*
store %struct.TYPE_5__* %129, %struct.TYPE_5__** %22
br label %130
130: ; preds = %138, %122
%131 = load i8*, i8** %10
%132 = load %struct.TYPE_5__*, %struct.TYPE_5__** %22
%133 = getelementptr inbounds %struct.TYPE_5__, %struct.TYPE_5__* %132, i32 0, i32 1
%134 = load i32, i32* %133
%135 = call i32 @st_str(i8* %131, i32 %134)
%136 = call i64 @strcmp(i32 %135, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0))
%137 = icmp ne i64 %136, 0
br i1 %137, label %138, label %141
138: ; preds = %130
%139 = load %struct.TYPE_5__*, %struct.TYPE_5__** %22
%140 = getelementptr inbounds %struct.TYPE_5__, %struct.TYPE_5__* %139, i32 1
store %struct.TYPE_5__* %140, %struct.TYPE_5__** %22
br label %130
141: ; preds = %130
%142 = load i8*, i8** %9
%143 = load %struct.TYPE_5__*, %struct.TYPE_5__** %22
%144 = getelementptr inbounds %struct.TYPE_5__, %struct.TYPE_5__* %143, i32 0, i32 0
%145 = load i32, i32* %144
%146 = sext i32 %145 to i64
%147 = getelementptr inbounds i8, i8* %142, i64 %146
%148 = bitcast i8* %147 to void (i64*, i64*)*
store void (i64*, i64*)* %148, void (i64*, i64*)** %11
%149 = getelementptr inbounds [9 x i64], [9 x i64]* %17, i64 0, i64 0
store i64 1, i64* %149
%150 = getelementptr inbounds [9 x i64], [9 x i64]* %17, i64 0, i64 1
store i64 ptrtoint ([8 x i8]* @.str.2 to i64), i64* %150
%151 = getelementptr inbounds [9 x i64], [9 x i64]* %17, i64 0, i64 2
store i64 0, i64* %151
%152 = getelementptr inbounds [9 x i64], [9 x i64]* %17, i64 0, i64 3
store i64 ptrtoint ([7 x i8]* @.str.3 to i64), i64* %152
%153 = getelementptr inbounds [9 x i64], [9 x i64]* %17, i64 0, i64 4
store i64 0, i64* %153
%154 = load i64, i64* @AT_BASE
%155 = getelementptr inbounds [9 x i64], [9 x i64]* %17, i64 0, i64 5
store i64 %154, i64* %155
%156 = load i8*, i8** %9
%157 = ptrtoint i8* %156 to i64
%158 = getelementptr inbounds [9 x i64], [9 x i64]* %17, i64 0, i64 6
store i64 %157, i64* %158
%159 = load i64, i64* @AT_NULL
%160 = getelementptr inbounds [9 x i64], [9 x i64]* %17, i64 0, i64 7
store i64 %159, i64* %160
%161 = getelementptr inbounds [9 x i64], [9 x i64]* %17, i64 0, i64 8
store i64 0, i64* %161
br label %162
162: ; preds = %168, %141
%163 = load %struct.TYPE_7__*, %struct.TYPE_7__** %20
%164 = getelementptr inbounds %struct.TYPE_7__, %struct.TYPE_7__* %163, i32 0, i32 0
%165 = load i64, i64* %164
%166 = load i64, i64* @PT_DYNAMIC
%167 = icmp ne i64 %165, %166
br i1 %167, label %168, label %171
168: ; preds = %162
%169 = load %struct.TYPE_7__*, %struct.TYPE_7__** %20
%170 = getelementptr inbounds %struct.TYPE_7__, %struct.TYPE_7__* %169, i32 1
store %struct.TYPE_7__* %170, %struct.TYPE_7__** %20
br label %162
171: ; preds = %162
%172 = load i8*, i8** %9
%173 = load %struct.TYPE_7__*, %struct.TYPE_7__** %20
%174 = getelementptr inbounds %struct.TYPE_7__, %struct.TYPE_7__* %173, i32 0, i32 1
%175 = load i32, i32* %174
%176 = sext i32 %175 to i64
%177 = getelementptr inbounds i8, i8* %172, i64 %176
%178 = bitcast i8* %177 to i64*
store i64* %178, i64** %18
%179 = load void (i64*, i64*)*, void (i64*, i64*)** %11
%180 = load i8**, i8*** %5
%181 = getelementptr inbounds i8*, i8** %180, i64 1
%182 = load i8*, i8** %181
%183 = load i8*, i8** %9
%184 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.4, i64 0, i64 0), void (i64*, i64*)* %179, i8* %182, i8* %183)
%185 = load void (i64*, i64*)*, void (i64*, i64*)** %11
%186 = getelementptr inbounds [9 x i64], [9 x i64]* %17, i64 0, i64 0
%187 = load i64*, i64** %18
ret i32 0
}

LLVM IR (-O2):
%struct.stat = type { i32 }
%struct.TYPE_6__ = type { i64, i32 }
%struct.TYPE_5__ = type { i32, i32 }
%struct.TYPE_7__ = type { i64, i32 }
@PROT_WRITE = global i32 0
@PROT_READ = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@EXIT_FAILURE = global i32 0
@O_RDONLY = global i32 0
@PROT_EXEC = global i32 0
@SHT_SYMTAB = global i64 0
@.str.1 = [9 x i8] c"_start_c\00"
@.str.2 = [8 x i8] c"libc.so\00"
@.str.3 = [7 x i8] c"LANG=C\00"
@AT_BASE = global i64 0
@AT_NULL = global i64 0
@PT_DYNAMIC = global i64 0
@.str.4 = [34 x i8] c"Jumping to %p in %s loaded at %p\0A\00"
@str = [29 x i8] c"loader [bin file] [elf file]\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [9 x i64]
%4 = bitcast [9 x i64]* %3 to i8*
%5 = load i32, i32* @PROT_WRITE
%6 = load i32, i32* @PROT_READ
%7 = or i32 %6, %5
%8 = load i32, i32* @MAP_PRIVATE
%9 = load i32, i32* @MAP_ANONYMOUS
%10 = or i32 %9, %8
%11 = tail call i8* @mmap(i32 0, i32 4, i32 %7, i32 %10, i64 0, i32 0)
%12 = bitcast i8* %11 to %struct.stat*
%13 = icmp slt i32 %0, 3
br i1 %13, label %14, label %18
14: ; preds = %2
%15 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @str, i64 0, i64 0))
%16 = load i32, i32* @EXIT_FAILURE
%17 = tail call i32 @exit(i32 %16)
unreachable
18: ; preds = %2
%19 = getelementptr inbounds i8*, i8** %1, i64 1
%20 = load i8*, i8** %19
%21 = load i32, i32* @O_RDONLY
%22 = tail call i64 @open(i8* %20, i32 %21)
%23 = icmp slt i64 %22, 0
br i1 %23, label %24, label %29
24: ; preds = %18
%25 = load i8*, i8** %19
%26 = tail call i32 @perror(i8* %25)
%27 = load i32, i32* @EXIT_FAILURE
%28 = tail call i32 @exit(i32 %27)
unreachable
29: ; preds = %18
%30 = getelementptr inbounds i8*, i8** %1, i64 2
%31 = load i8*, i8** %30
%32 = load i32, i32* @O_RDONLY
%33 = tail call i64 @open(i8* %31, i32 %32)
%34 = icmp slt i64 %33, 0
br i1 %34, label %35, label %40
35: ; preds = %29
%36 = load i8*, i8** %30
%37 = tail call i32 @perror(i8* %36)
%38 = load i32, i32* @EXIT_FAILURE
%39 = tail call i32 @exit(i32 %38)
unreachable
40: ; preds = %29
%41 = tail call i32 @fstat(i64 %22, %struct.stat* %12)
%42 = bitcast i8* %11 to i32*
%43 = load i32, i32* %42
%44 = load i32, i32* @PROT_EXEC
%45 = load i32, i32* @PROT_WRITE
%46 = or i32 %45, %44
%47 = load i32, i32* @PROT_READ
%48 = or i32 %46, %47
%49 = load i32, i32* @MAP_PRIVATE
%50 = tail call i8* @mmap(i32 0, i32 %43, i32 %48, i32 %49, i64 %22, i32 0)
%51 = tail call i32 @fstat(i64 %33, %struct.stat* %12)
%52 = load i32, i32* %42
%53 = load i32, i32* @PROT_EXEC
%54 = load i32, i32* @PROT_WRITE
%55 = or i32 %54, %53
%56 = load i32, i32* @PROT_READ
%57 = or i32 %55, %56
%58 = load i32, i32* @MAP_PRIVATE
%59 = tail call i8* @mmap(i32 0, i32 %52, i32 %57, i32 %58, i64 %33, i32 0)
%60 = bitcast i8* %59 to i32*
%61 = load i32, i32* %60
%62 = sext i32 %61 to i64
%63 = getelementptr inbounds i8, i8* %59, i64 %62
%64 = getelementptr inbounds i8, i8* %59, i64 4
%65 = bitcast i8* %64 to i32*
%66 = load i32, i32* %65
%67 = sext i32 %66 to i64
%68 = getelementptr inbounds i8, i8* %59, i64 %67
%69 = bitcast i8* %68 to %struct.TYPE_6__*
%70 = load i64, i64* @SHT_SYMTAB
br label %71
71: ; preds = %71, %40
%72 = phi %struct.TYPE_6__* [ %69, %40 ], [ %76, %71 ]
%73 = getelementptr inbounds %struct.TYPE_6__, %struct.TYPE_6__* %72, i64 0, i32 0
%74 = load i64, i64* %73
%75 = icmp eq i64 %74, %70
%76 = getelementptr inbounds %struct.TYPE_6__, %struct.TYPE_6__* %72, i64 1
br i1 %75, label %77, label %71
77: ; preds = %71
%78 = getelementptr inbounds %struct.TYPE_6__, %struct.TYPE_6__* %72, i64 0, i32 1
%79 = load i32, i32* %78
%80 = sext i32 %79 to i64
%81 = getelementptr inbounds i8, i8* %59, i64 %80
%82 = bitcast i8* %81 to %struct.TYPE_5__*
br label %83
83: ; preds = %83, %77
%84 = phi %struct.TYPE_5__* [ %82, %77 ], [ %90, %83 ]
%85 = getelementptr inbounds %struct.TYPE_5__, %struct.TYPE_5__* %84, i64 0, i32 1
%86 = load i32, i32* %85
%87 = tail call i32 @st_str(i8* %59, i32 %86)
%88 = tail call i64 @strcmp(i32 %87, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0))
%89 = icmp eq i64 %88, 0
%90 = getelementptr inbounds %struct.TYPE_5__, %struct.TYPE_5__* %84, i64 1
br i1 %89, label %91, label %83
91: ; preds = %83
%92 = bitcast i8* %63 to %struct.TYPE_7__*
%93 = getelementptr inbounds %struct.TYPE_5__, %struct.TYPE_5__* %84, i64 0, i32 0
%94 = load i32, i32* %93
%95 = getelementptr inbounds [9 x i64], [9 x i64]* %3, i64 0, i64 0
store i64 1, i64* %95
%96 = getelementptr inbounds [9 x i64], [9 x i64]* %3, i64 0, i64 1
store i64 ptrtoint ([8 x i8]* @.str.2 to i64), i64* %96
%97 = getelementptr inbounds [9 x i64], [9 x i64]* %3, i64 0, i64 2
store i64 0, i64* %97
%98 = getelementptr inbounds [9 x i64], [9 x i64]* %3, i64 0, i64 3
store i64 ptrtoint ([7 x i8]* @.str.3 to i64), i64* %98
%99 = getelementptr inbounds [9 x i64], [9 x i64]* %3, i64 0, i64 4
store i64 0, i64* %99
%100 = load i64, i64* @AT_BASE
%101 = getelementptr inbounds [9 x i64], [9 x i64]* %3, i64 0, i64 5
store i64 %100, i64* %101
%102 = ptrtoint i8* %50 to i64
%103 = getelementptr inbounds [9 x i64], [9 x i64]* %3, i64 0, i64 6
store i64 %102, i64* %103
%104 = load i64, i64* @AT_NULL
%105 = getelementptr inbounds [9 x i64], [9 x i64]* %3, i64 0, i64 7
store i64 %104, i64* %105
%106 = getelementptr inbounds [9 x i64], [9 x i64]* %3, i64 0, i64 8
store i64 0, i64* %106
%107 = load i64, i64* @PT_DYNAMIC
br label %108
108: ; preds = %108, %91
%109 = phi %struct.TYPE_7__* [ %92, %91 ], [ %113, %108 ]
%110 = getelementptr inbounds %struct.TYPE_7__, %struct.TYPE_7__* %109, i64 0, i32 0
%111 = load i64, i64* %110
%112 = icmp eq i64 %111, %107
%113 = getelementptr inbounds %struct.TYPE_7__, %struct.TYPE_7__* %109, i64 1
br i1 %112, label %114, label %108
114: ; preds = %108
%115 = sext i32 %94 to i64
%116 = getelementptr inbounds i8, i8* %50, i64 %115
%117 = bitcast i8* %116 to void (i64*, i64*)*
%118 = getelementptr inbounds %struct.TYPE_7__, %struct.TYPE_7__* %109, i64 0, i32 1
%119 = load i32, i32* %118
%120 = sext i32 %119 to i64
%121 = getelementptr inbounds i8, i8* %50, i64 %120
%122 = bitcast i8* %121 to i64*
%123 = load i8*, i8** %19
%124 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @.str.4, i64 0, i64 0), i8* %116, i8* %123, i8* %50)
ret i32 0
}