#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ aImage;
typedef int /*<<< orphan*/ aHeader;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
unsigned long Read32(unsigned char *);
int /*<<< orphan*/ Write32(unsigned char *, unsigned long);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int fread(unsigned char *, int, int, int /*<<< orphan*/ *);
unsigned long fwrite(unsigned char *, int, unsigned long, int /*<<< orphan*/ *);
int /*<<< orphan*/ printf(char *, ...);
int main(int argc, char *argv[]) {
  FILE *pInFile;
  FILE *pOutFile;
  unsigned char aHeader[6];
  unsigned char aImage[256 * 1024];
  unsigned long i;
  unsigned long uiSize, uiStart;
  unsigned short usChecksum = 0;
  if (argc < 2) {
    printf("Extract the software image out of an original Archos Flash ROM "
           "dump.\n");
    printf("Result is a scrambled file, use the descramble tool to get the "
           "binary,\n");
    printf(" always without the -fm option, even if processing an FM "
           "software.\n\n");
    printf("Usage: extract <flash dump file> <output file>\n");
    printf("Example: extract internal_rom_2000000-203FFFF.bin archos.ajz\n");
    exit(0);
  }
  pInFile = fopen(argv[1], "rb");
  if (pInFile == NULL) {
    printf("Error opening input file %s\n", argv[1]);
    exit(1);
  }
  if (fread(aImage, 1, sizeof(aImage), pInFile) != sizeof(aImage)) {
    printf("Error reading input file %s, must be 256kB in size.\n", argv[1]);
    fclose(pInFile);
    exit(2);
  }
  fclose(pInFile);
  uiStart = Read32(aImage + 8);
  uiSize = Read32(aImage + 12);
  if (uiStart == 0x02000100 && uiSize > 20000) {
    uiStart = 0x0100;
  } else {
    uiStart = 0x6020;
    uiSize = Read32(aImage + 0x6000 + 4);
  }
  if (uiSize > sizeof(aImage) - uiStart || uiSize < 40000) {
    printf("Error: Impossible image size %d bytes.\n", uiSize);
    exit(3);
  }
  for (i = 0; i < uiSize; i++) {
    unsigned char byte;
    byte = aImage[uiStart + i];
    byte = ~((byte >> 1) | ((byte << 7) & 0x80));
    usChecksum += byte;
  }
  Write32(aHeader + 2, usChecksum);
  Write32(aHeader, uiSize);
  pOutFile = fopen(argv[2], "wb");
  if (pOutFile == NULL) {
    printf("Error opening output file %s\n", argv[2]);
    exit(4);
  }
  if (fwrite(aHeader, 1, sizeof(aHeader), pOutFile) != sizeof(aHeader) ||
      fwrite(aImage + uiStart, 1, uiSize, pOutFile) != uiSize) {
    printf("Write error\n");
    fclose(pOutFile);
    exit(5);
  }
  fclose(pOutFile);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40050,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movw   $0x0,-0x4004a(%rbp)
cmpl   $0x2,-0x8(%rbp)
jge    11f9 <main+0x79>
lea    0xe4d(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xe85(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xebf(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xef6(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xf18(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
xor    %edi,%edi
call   1090 <exit@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xf39(%rip),%rsi
call   1080 <fopen@plt>
mov    %rax,-0x18(%rbp)
cmpq   $0x0,-0x18(%rbp)
jne    123c <main+0xbc>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rsi
lea    0xf19(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x1,%edi
call   1090 <exit@plt>
lea    -0x40030(%rbp),%rdi
mov    -0x18(%rbp),%rcx
mov    $0x1,%esi
mov    $0x40000,%edx
call   1030 <fread@plt>
cltq
cmp    $0x40000,%rax
je     128d <main+0x10d>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rsi
lea    0xeee(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x18(%rbp),%rdi
call   1040 <fclose@plt>
mov    $0x2,%edi
call   1090 <exit@plt>
mov    -0x18(%rbp),%rdi
call   1040 <fclose@plt>
lea    -0x40030(%rbp),%rdi
add    $0x8,%rdi
call   1070 <Read32@plt>
mov    %rax,-0x40048(%rbp)
lea    -0x40030(%rbp),%rdi
add    $0xc,%rdi
call   1070 <Read32@plt>
mov    %rax,-0x40040(%rbp)
cmpq   $0x2000100,-0x40048(%rbp)
jne    12f6 <main+0x176>
cmpq   $0x4e20,-0x40040(%rbp)
jbe    12f6 <main+0x176>
movq   $0x100,-0x40048(%rbp)
jmp    131f <main+0x19f>
movq   $0x6020,-0x40048(%rbp)
lea    -0x40030(%rbp),%rdi
add    $0x6000,%rdi
add    $0x4,%rdi
call   1070 <Read32@plt>
mov    %rax,-0x40040(%rbp)
mov    -0x40040(%rbp),%rax
mov    $0x40000,%ecx
sub    -0x40048(%rbp),%rcx
cmp    %rcx,%rax
ja     134c <main+0x1cc>
cmpq   $0x9c40,-0x40040(%rbp)
jae    136b <main+0x1eb>
mov    -0x40040(%rbp),%rsi
lea    0xe3c(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x3,%edi
call   1090 <exit@plt>
movq   $0x0,-0x40038(%rbp)
mov    -0x40038(%rbp),%rax
cmp    -0x40040(%rbp),%rax
jae    13f8 <main+0x278>
mov    -0x40048(%rbp),%rax
add    -0x40038(%rbp),%rax
mov    -0x40030(%rbp,%rax,1),%al
mov    %al,-0x4004b(%rbp)
movzbl -0x4004b(%rbp),%eax
sar    $0x1,%eax
movzbl -0x4004b(%rbp),%ecx
shl    $0x7,%ecx
and    $0x80,%ecx
or     %ecx,%eax
xor    $0xffffffff,%eax
mov    %al,-0x4004b(%rbp)
movzbl -0x4004b(%rbp),%ecx
movzwl -0x4004a(%rbp),%eax
add    %ecx,%eax
mov    %ax,-0x4004a(%rbp)
mov    -0x40038(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x40038(%rbp)
jmp    1376 <main+0x1f6>
lea    -0x26(%rbp),%rdi
add    $0x2,%rdi
movzwl -0x4004a(%rbp),%eax
mov    %eax,%esi
call   1060 <Write32@plt>
lea    -0x26(%rbp),%rdi
mov    -0x40040(%rbp),%rsi
call   1060 <Write32@plt>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
lea    0xd91(%rip),%rsi
call   1080 <fopen@plt>
mov    %rax,-0x20(%rbp)
cmpq   $0x0,-0x20(%rbp)
jne    1461 <main+0x2e1>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rsi
lea    0xd71(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x4,%edi
call   1090 <exit@plt>
lea    -0x26(%rbp),%rdi
mov    -0x20(%rbp),%rcx
mov    $0x1,%esi
mov    $0x6,%edx
call   10a0 <fwrite@plt>
cmp    $0x6,%rax
jne    14b2 <main+0x332>
lea    -0x40030(%rbp),%rdi
add    -0x40048(%rbp),%rdi
mov    -0x40040(%rbp),%rdx
mov    -0x20(%rbp),%rcx
mov    $0x1,%esi
call   10a0 <fwrite@plt>
cmp    -0x40040(%rbp),%rax
je     14d3 <main+0x353>
lea    0xd26(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x20(%rbp),%rdi
call   1040 <fclose@plt>
mov    $0x5,%edi
call   1090 <exit@plt>
mov    -0x20(%rbp),%rdi
call   1040 <fclose@plt>
xor    %eax,%eax
add    $0x40050,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x40010,%rsp
cmp    $0x1,%edi
jle    140f <main+0x27f>
mov    %rsi,%r14
mov    0x8(%rsi),%rdi
lea    0xe59(%rip),%rsi
call   1090 <fopen@plt>
test   %rax,%rax
je     1452 <main+0x2c2>
mov    %rax,%rbx
lea    0x10(%rsp),%r15
mov    %r15,%rdi
mov    $0x1,%esi
mov    $0x40000,%edx
mov    %rax,%rcx
call   1040 <fread@plt>
cmp    $0x40000,%eax
jne    146e <main+0x2de>
mov    %rbx,%rdi
call   1050 <fclose@plt>
lea    0x18(%rsp),%rdi
call   1080 <Read32@plt>
mov    %rax,%r12
lea    0x1c(%rsp),%rdi
call   1080 <Read32@plt>
cmp    $0x2000100,%r12
jne    1228 <main+0x98>
mov    %rax,%r13
cmp    $0x4e20,%rax
jbe    1228 <main+0x98>
mov    $0x100,%r12d
jmp    123e <main+0xae>
lea    0x6014(%rsp),%rdi
call   1080 <Read32@plt>
mov    %rax,%r13
mov    $0x6020,%r12d
cmp    $0x9c40,%r13
jb     1492 <main+0x302>
mov    $0x40000,%eax
sub    %r12,%rax
cmp    %rax,%r13
ja     1492 <main+0x302>
mov    %r13,%rax
and    $0xfffffffffffffff0,%rax
lea    (%r12,%r15,1),%rcx
add    $0x8,%rcx
pxor   %xmm0,%xmm0
xor    %edx,%edx
movdqa 0xd87(%rip),%xmm2
pcmpeqd %xmm4,%xmm4
pxor   %xmm3,%xmm3
pxor   %xmm1,%xmm1
cs nopw 0x0(%rax,%rax,1)
nop
movq   -0x8(%rcx,%rdx,1),%xmm6
movq   (%rcx,%rdx,1),%xmm5
movdqa %xmm6,%xmm7
punpcklbw %xmm0,%xmm7
psllw  $0x7,%xmm7
psrlw  $0x8,%xmm7
packuswb %xmm7,%xmm7
punpcklbw %xmm6,%xmm6
psllw  $0x7,%xmm6
pand   %xmm2,%xmm6
packuswb %xmm6,%xmm6
por    %xmm7,%xmm6
movdqa %xmm5,%xmm7
punpcklbw %xmm0,%xmm7
psllw  $0x7,%xmm7
psrlw  $0x8,%xmm7
packuswb %xmm7,%xmm7
punpcklbw %xmm5,%xmm5
psllw  $0x7,%xmm5
pand   %xmm2,%xmm5
packuswb %xmm5,%xmm5
por    %xmm7,%xmm5
pxor   %xmm4,%xmm6
pxor   %xmm4,%xmm5
punpcklbw %xmm0,%xmm6
paddw  %xmm6,%xmm3
punpcklbw %xmm0,%xmm5
paddw  %xmm5,%xmm1
add    $0x10,%rdx
cmp    %rdx,%rax
jne    1290 <main+0x100>
paddw  %xmm3,%xmm1
pshufd $0xee,%xmm1,%xmm0
paddw  %xmm1,%xmm0
pshufd $0x55,%xmm0,%xmm1
paddw  %xmm0,%xmm1
movdqa %xmm1,%xmm0
psrld  $0x10,%xmm0
paddw  %xmm1,%xmm0
movd   %xmm0,%ecx
cmp    %rax,%r13
je     1366 <main+0x1d6>
lea    (%rsp,%r12,1),%rdx
add    $0x10,%rdx
nopw   0x0(%rax,%rax,1)
movzbl (%rdx,%rax,1),%ebx
ror    %bl
not    %bl
movzbl %bl,%esi
add    %esi,%ecx
add    $0x1,%rax
cmp    %rax,%r13
jne    1350 <main+0x1c0>
movzwl %cx,%esi
lea    0xc(%rsp),%rdi
call   1070 <Write32@plt>
lea    0xa(%rsp),%rdi
mov    %r13,%rsi
call   1070 <Write32@plt>
mov    0x10(%r14),%rdi
lea    0xd02(%rip),%rsi
call   1090 <fopen@plt>
test   %rax,%rax
je     14ad <main+0x31d>
mov    %rax,%r15
lea    0xa(%rsp),%rdi
mov    $0x6,%edx
mov    $0x1,%esi
mov    %rax,%rcx
call   10b0 <fwrite@plt>
cmp    $0x6,%rax
jne    13f1 <main+0x261>
lea    (%rsp,%r12,1),%rdi
add    $0x10,%rdi
mov    $0x1,%esi
mov    %r13,%rdx
mov    %r15,%rcx
call   10b0 <fwrite@plt>
cmp    %r13,%rax
jne    13f1 <main+0x261>
mov    %r15,%rdi
call   1050 <fclose@plt>
xor    %eax,%eax
add    $0x40010,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret
lea    0xcb6(%rip),%rdi
call   1030 <puts@plt>
mov    %r15,%rdi
call   1050 <fclose@plt>
mov    $0x5,%edi
call   10a0 <exit@plt>
lea    0xca4(%rip),%rdi
call   1030 <puts@plt>
lea    0xcdd(%rip),%rdi
call   1030 <puts@plt>
lea    0xd18(%rip),%rdi
call   1030 <puts@plt>
lea    0xd50(%rip),%rdi
call   1030 <puts@plt>
lea    0xd73(%rip),%rdi
call   1030 <puts@plt>
xor    %edi,%edi
call   10a0 <exit@plt>
mov    0x8(%r14),%rsi
lea    0xbb6(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
mov    $0x1,%edi
call   10a0 <exit@plt>
mov    0x8(%r14),%rsi
lea    0xbb7(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
mov    %rbx,%rdi
call   1050 <fclose@plt>
mov    $0x2,%edi
call   10a0 <exit@plt>
lea    0xbcc(%rip),%rdi
mov    %r13,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
mov    $0x3,%edi
call   10a0 <exit@plt>
mov    0x10(%r14),%rsi
lea    0xbd8(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
mov    $0x4,%edi
call   10a0 <exit@plt>

LLVM IR (-O0):
@.str = [70 x i8] c"Extract the software image out of an original Archos Flash ROM dump.\0A\00"
@.str.1 = [72 x i8] c"Result is a scrambled file, use the descramble tool to get the binary,\0A\00"
@.str.2 = [69 x i8] c" always without the -fm option, even if processing an FM software.\0A\0A\00"
@.str.3 = [48 x i8] c"Usage: extract <flash dump file> <output file>\0A\00"
@.str.4 = [62 x i8] c"Example: extract internal_rom_2000000-203FFFF.bin archos.ajz\0A\00"
@.str.5 = [3 x i8] c"rb\00"
@.str.6 = [29 x i8] c"Error opening input file %s\0A\00"
@.str.7 = [53 x i8] c"Error reading input file %s, must be 256kB in size.\0A\00"
@.str.8 = [40 x i8] c"Error: Impossible image size %d bytes.\0A\00"
@.str.9 = [3 x i8] c"wb\00"
@.str.10 = [30 x i8] c"Error opening output file %s\0A\00"
@.str.11 = [13 x i8] c"Write error\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32*
%7 = alloca i32*
%8 = alloca [6 x i8]
%9 = alloca [262144 x i8]
%10 = alloca i64
%11 = alloca i64
%12 = alloca i64
%13 = alloca i16
%14 = alloca i8
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i16 0, i16* %13
%15 = load i32, i32* %4
%16 = icmp slt i32 %15, 2
br i1 %16, label %17, label %24
17: ; preds = %2
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([70 x i8], [70 x i8]* @.str, i64 0, i64 0))
%19 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([72 x i8], [72 x i8]* @.str.1, i64 0, i64 0))
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([69 x i8], [69 x i8]* @.str.2, i64 0, i64 0))
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([48 x i8], [48 x i8]* @.str.3, i64 0, i64 0))
%22 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([62 x i8], [62 x i8]* @.str.4, i64 0, i64 0))
%23 = call i32 @exit(i32 0)
unreachable
24: ; preds = %2
%25 = load i8**, i8*** %5
%26 = getelementptr inbounds i8*, i8** %25, i64 1
%27 = load i8*, i8** %26
%28 = call i32* @fopen(i8* %27, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
store i32* %28, i32** %6
%29 = load i32*, i32** %6
%30 = icmp eq i32* %29, null
br i1 %30, label %31, label %37
31: ; preds = %24
%32 = load i8**, i8*** %5
%33 = getelementptr inbounds i8*, i8** %32, i64 1
%34 = load i8*, i8** %33
%35 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.6, i64 0, i64 0), i8* %34)
%36 = call i32 @exit(i32 1)
unreachable
37: ; preds = %24
%38 = getelementptr inbounds [262144 x i8], [262144 x i8]* %9, i64 0, i64 0
%39 = load i32*, i32** %6
%40 = call i32 @fread(i8* %38, i32 1, i32 262144, i32* %39)
%41 = sext i32 %40 to i64
%42 = icmp ne i64 %41, 262144
br i1 %42, label %43, label %51
43: ; preds = %37
%44 = load i8**, i8*** %5
%45 = getelementptr inbounds i8*, i8** %44, i64 1
%46 = load i8*, i8** %45
%47 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([53 x i8], [53 x i8]* @.str.7, i64 0, i64 0), i8* %46)
%48 = load i32*, i32** %6
%49 = call i32 @fclose(i32* %48)
%50 = call i32 @exit(i32 2)
unreachable
51: ; preds = %37
%52 = load i32*, i32** %6
%53 = call i32 @fclose(i32* %52)
%54 = getelementptr inbounds [262144 x i8], [262144 x i8]* %9, i64 0, i64 0
%55 = getelementptr inbounds i8, i8* %54, i64 8
%56 = call i64 @Read32(i8* %55)
store i64 %56, i64* %12
%57 = getelementptr inbounds [262144 x i8], [262144 x i8]* %9, i64 0, i64 0
%58 = getelementptr inbounds i8, i8* %57, i64 12
%59 = call i64 @Read32(i8* %58)
store i64 %59, i64* %11
%60 = load i64, i64* %12
%61 = icmp eq i64 %60, 33554688
br i1 %61, label %62, label %66
62: ; preds = %51
%63 = load i64, i64* %11
%64 = icmp ugt i64 %63, 20000
br i1 %64, label %65, label %66
65: ; preds = %62
store i64 256, i64* %12
br label %71
66: ; preds = %62, %51
store i64 24608, i64* %12
%67 = getelementptr inbounds [262144 x i8], [262144 x i8]* %9, i64 0, i64 0
%68 = getelementptr inbounds i8, i8* %67, i64 24576
%69 = getelementptr inbounds i8, i8* %68, i64 4
%70 = call i64 @Read32(i8* %69)
store i64 %70, i64* %11
br label %71
71: ; preds = %66, %65
%72 = load i64, i64* %11
%73 = load i64, i64* %12
%74 = sub i64 262144, %73
%75 = icmp ugt i64 %72, %74
br i1 %75, label %79, label %76
76: ; preds = %71
%77 = load i64, i64* %11
%78 = icmp ult i64 %77, 40000
br i1 %78, label %79, label %83
79: ; preds = %76, %71
%80 = load i64, i64* %11
%81 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.8, i64 0, i64 0), i64 %80)
%82 = call i32 @exit(i32 3)
unreachable
83: ; preds = %76
store i64 0, i64* %10
br label %84
84: ; preds = %110, %83
%85 = load i64, i64* %10
%86 = load i64, i64* %11
%87 = icmp ult i64 %85, %86
br i1 %87, label %88, label %113
88: ; preds = %84
%89 = load i64, i64* %12
%90 = load i64, i64* %10
%91 = add i64 %89, %90
%92 = getelementptr inbounds [262144 x i8], [262144 x i8]* %9, i64 0, i64 %91
%93 = load i8, i8* %92
store i8 %93, i8* %14
%94 = load i8, i8* %14
%95 = zext i8 %94 to i32
%96 = ashr i32 %95, 1
%97 = load i8, i8* %14
%98 = zext i8 %97 to i32
%99 = shl i32 %98, 7
%100 = and i32 %99, 128
%101 = or i32 %96, %100
%102 = xor i32 %101, -1
%103 = trunc i32 %102 to i8
store i8 %103, i8* %14
%104 = load i8, i8* %14
%105 = zext i8 %104 to i32
%106 = load i16, i16* %13
%107 = zext i16 %106 to i32
%108 = add nsw i32 %107, %105
%109 = trunc i32 %108 to i16
store i16 %109, i16* %13
br label %110
110: ; preds = %88
%111 = load i64, i64* %10
%112 = add i64 %111, 1
store i64 %112, i64* %10
br label %84
113: ; preds = %84
%114 = getelementptr inbounds [6 x i8], [6 x i8]* %8, i64 0, i64 0
%115 = getelementptr inbounds i8, i8* %114, i64 2
%116 = load i16, i16* %13
%117 = zext i16 %116 to i64
%118 = call i32 @Write32(i8* %115, i64 %117)
%119 = getelementptr inbounds [6 x i8], [6 x i8]* %8, i64 0, i64 0
%120 = load i64, i64* %11
%121 = call i32 @Write32(i8* %119, i64 %120)
%122 = load i8**, i8*** %5
%123 = getelementptr inbounds i8*, i8** %122, i64 2
%124 = load i8*, i8** %123
%125 = call i32* @fopen(i8* %124, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.9, i64 0, i64 0))
store i32* %125, i32** %7
%126 = load i32*, i32** %7
%127 = icmp eq i32* %126, null
br i1 %127, label %128, label %134
128: ; preds = %113
%129 = load i8**, i8*** %5
%130 = getelementptr inbounds i8*, i8** %129, i64 2
%131 = load i8*, i8** %130
%132 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.10, i64 0, i64 0), i8* %131)
%133 = call i32 @exit(i32 4)
unreachable
134: ; preds = %113
%135 = getelementptr inbounds [6 x i8], [6 x i8]* %8, i64 0, i64 0
%136 = load i32*, i32** %7
%137 = call i64 @fwrite(i8* %135, i32 1, i64 6, i32* %136)
%138 = icmp ne i64 %137, 6
br i1 %138, label %148, label %139
139: ; preds = %134
%140 = getelementptr inbounds [262144 x i8], [262144 x i8]* %9, i64 0, i64 0
%141 = load i64, i64* %12
%142 = getelementptr inbounds i8, i8* %140, i64 %141
%143 = load i64, i64* %11
%144 = load i32*, i32** %7
%145 = call i64 @fwrite(i8* %142, i32 1, i64 %143, i32* %144)
%146 = load i64, i64* %11
%147 = icmp ne i64 %145, %146
br i1 %147, label %148, label %153
148: ; preds = %139, %134
%149 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.11, i64 0, i64 0))
%150 = load i32*, i32** %7
%151 = call i32 @fclose(i32* %150)
%152 = call i32 @exit(i32 5)
unreachable
153: ; preds = %139
%154 = load i32*, i32** %7
%155 = call i32 @fclose(i32* %154)
ret i32 0
}

LLVM IR (-O2):
@.str.5 = [3 x i8] c"rb\00"
@.str.6 = [29 x i8] c"Error opening input file %s\0A\00"
@.str.7 = [53 x i8] c"Error reading input file %s, must be 256kB in size.\0A\00"
@.str.8 = [40 x i8] c"Error: Impossible image size %d bytes.\0A\00"
@.str.9 = [3 x i8] c"wb\00"
@.str.10 = [30 x i8] c"Error opening output file %s\0A\00"
@str = [12 x i8] c"Write error\00"
@str.12 = [69 x i8] c"Extract the software image out of an original Archos Flash ROM dump.\00"
@str.13 = [71 x i8] c"Result is a scrambled file, use the descramble tool to get the binary,\00"
@str.14 = [68 x i8] c" always without the -fm option, even if processing an FM software.\0A\00"
@str.15 = [47 x i8] c"Usage: extract <flash dump file> <output file>\00"
@str.16 = [61 x i8] c"Example: extract internal_rom_2000000-203FFFF.bin archos.ajz\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [6 x i8]
%4 = alloca [262144 x i8]
%5 = getelementptr inbounds [6 x i8], [6 x i8]* %3, i64 0, i64 0
%6 = getelementptr inbounds [262144 x i8], [262144 x i8]* %4, i64 0, i64 0
%7 = icmp slt i32 %0, 2
br i1 %7, label %8, label %15
8: ; preds = %2
%9 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([69 x i8], [69 x i8]* @str.12, i64 0, i64 0))
%10 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([71 x i8], [71 x i8]* @str.13, i64 0, i64 0))
%11 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([68 x i8], [68 x i8]* @str.14, i64 0, i64 0))
%12 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([47 x i8], [47 x i8]* @str.15, i64 0, i64 0))
%13 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([61 x i8], [61 x i8]* @str.16, i64 0, i64 0))
%14 = tail call i32 @exit(i32 0)
unreachable
15: ; preds = %2
%16 = getelementptr inbounds i8*, i8** %1, i64 1
%17 = load i8*, i8** %16
%18 = tail call i32* @fopen(i8* %17, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
%19 = icmp eq i32* %18, null
br i1 %19, label %20, label %24
20: ; preds = %15
%21 = load i8*, i8** %16
%22 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @.str.6, i64 0, i64 0), i8* %21)
%23 = tail call i32 @exit(i32 1)
unreachable
24: ; preds = %15
%25 = call i32 @fread(i8* %6, i32 1, i32 262144, i32* %18)
%26 = icmp eq i32 %25, 262144
br i1 %26, label %32, label %27
27: ; preds = %24
%28 = load i8*, i8** %16
%29 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([53 x i8], [53 x i8]* @.str.7, i64 0, i64 0), i8* %28)
%30 = tail call i32 @fclose(i32* %18)
%31 = tail call i32 @exit(i32 2)
unreachable
32: ; preds = %24
%33 = tail call i32 @fclose(i32* %18)
%34 = getelementptr inbounds [262144 x i8], [262144 x i8]* %4, i64 0, i64 8
%35 = call i64 @Read32(i8* %34)
%36 = getelementptr inbounds [262144 x i8], [262144 x i8]* %4, i64 0, i64 12
%37 = call i64 @Read32(i8* %36)
%38 = icmp eq i64 %35, 33554688
%39 = icmp ugt i64 %37, 20000
%40 = select i1 %38, i1 %39, i1 false
br i1 %40, label %44, label %41
41: ; preds = %32
%42 = getelementptr inbounds [262144 x i8], [262144 x i8]* %4, i64 0, i64 24580
%43 = call i64 @Read32(i8* %42)
br label %44
44: ; preds = %32, %41
%45 = phi i64 [ %43, %41 ], [ %37, %32 ]
%46 = phi i64 [ 24608, %41 ], [ 256, %32 ]
%47 = sub nuw nsw i64 262144, %46
%48 = icmp ugt i64 %45, %47
%49 = icmp ult i64 %45, 40000
%50 = or i1 %49, %48
br i1 %50, label %78, label %51
51: ; preds = %44
%52 = and i64 %45, -16
br label %53
53: ; preds = %53, %51
%54 = phi i64 [ 0, %51 ], [ %72, %53 ]
%55 = phi <8 x i16> [ zeroinitializer, %51 ], [ %70, %53 ]
%56 = phi <8 x i16> [ zeroinitializer, %51 ], [ %71, %53 ]
%57 = add i64 %54, %46
%58 = getelementptr inbounds [262144 x i8], [262144 x i8]* %4, i64 0, i64 %57
%59 = bitcast i8* %58 to <8 x i8>*
%60 = load <8 x i8>, <8 x i8>* %59
%61 = getelementptr inbounds i8, i8* %58, i64 8
%62 = bitcast i8* %61 to <8 x i8>*
%63 = load <8 x i8>, <8 x i8>* %62
%64 = call <8 x i8> @llvm.fshl.v8i8(<8 x i8> %60, <8 x i8> %60, <8 x i8> <i8 7, i8 7, i8 7, i8 7, i8 7, i8 7, i8 7, i8 7>)
%65 = call <8 x i8> @llvm.fshl.v8i8(<8 x i8> %63, <8 x i8> %63, <8 x i8> <i8 7, i8 7, i8 7, i8 7, i8 7, i8 7, i8 7, i8 7>)
%66 = xor <8 x i8> %64, <i8 -1, i8 -1, i8 -1, i8 -1, i8 -1, i8 -1, i8 -1, i8 -1>
%67 = xor <8 x i8> %65, <i8 -1, i8 -1, i8 -1, i8 -1, i8 -1, i8 -1, i8 -1, i8 -1>
%68 = zext <8 x i8> %66 to <8 x i16>
%69 = zext <8 x i8> %67 to <8 x i16>
%70 = add <8 x i16> %55, %68
%71 = add <8 x i16> %56, %69
%72 = add nuw i64 %54, 16
%73 = icmp eq i64 %72, %52
br i1 %73, label %74, label %53
74: ; preds = %53
%75 = add <8 x i16> %71, %70
%76 = call i16 @llvm.vector.reduce.add.v8i16(<8 x i16> %75)
%77 = icmp eq i64 %45, %52
br i1 %77, label %93, label %81
78: ; preds = %44
%79 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([40 x i8], [40 x i8]* @.str.8, i64 0, i64 0), i64 %45)
%80 = call i32 @exit(i32 3)
unreachable
81: ; preds = %74, %81
%82 = phi i64 [ %91, %81 ], [ %52, %74 ]
%83 = phi i16 [ %90, %81 ], [ %76, %74 ]
%84 = add i64 %82, %46
%85 = getelementptr inbounds [262144 x i8], [262144 x i8]* %4, i64 0, i64 %84
%86 = load i8, i8* %85
%87 = call i8 @llvm.fshl.i8(i8 %86, i8 %86, i8 7)
%88 = xor i8 %87, -1
%89 = zext i8 %88 to i16
%90 = add i16 %83, %89
%91 = add nuw i64 %82, 1
%92 = icmp eq i64 %91, %45
br i1 %92, label %93, label %81
93: ; preds = %81, %74
%94 = phi i16 [ %76, %74 ], [ %90, %81 ]
%95 = zext i16 %94 to i64
%96 = getelementptr inbounds [6 x i8], [6 x i8]* %3, i64 0, i64 2
%97 = call i32 @Write32(i8* %96, i64 %95)
%98 = call i32 @Write32(i8* %5, i64 %45)
%99 = getelementptr inbounds i8*, i8** %1, i64 2
%100 = load i8*, i8** %99
%101 = call i32* @fopen(i8* %100, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.9, i64 0, i64 0))
%102 = icmp eq i32* %101, null
br i1 %102, label %103, label %107
103: ; preds = %93
%104 = load i8*, i8** %99
%105 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.10, i64 0, i64 0), i8* %104)
%106 = call i32 @exit(i32 4)
unreachable
107: ; preds = %93
%108 = call i64 @fwrite(i8* %5, i32 1, i64 6, i32* %101)
%109 = icmp eq i64 %108, 6
br i1 %109, label %110, label %114
110: ; preds = %107
%111 = getelementptr inbounds [262144 x i8], [262144 x i8]* %4, i64 0, i64 %46
%112 = call i64 @fwrite(i8* %111, i32 1, i64 %45, i32* %101)
%113 = icmp eq i64 %112, %45
br i1 %113, label %118, label %114
114: ; preds = %110, %107
%115 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([12 x i8], [12 x i8]* @str, i64 0, i64 0))
%116 = call i32 @fclose(i32* %101)
%117 = call i32 @exit(i32 5)
unreachable
118: ; preds = %110
%119 = call i32 @fclose(i32* %101)
ret i32 0
}