int iRcTSFID_RUDLL_EnrollFinger(char fpflag[3], int order,
                                unsigned char fpminu1[200],
                                unsigned char fpminu2[100]) {
  unsigned int uiDataLen, uiRet;
  char *psFunCall = malloc(100);
  uiDataLen = sprintf(psFunCall, "%u(b003", 4105);
  memcpy(psFunCall + uiDataLen, fpflag, 3);
  uiDataLen += 3;
  uiDataLen += sprintf(psFunCall + uiDataLen, ",%d,b000,b000)", order);
  uiRet = iDoRemoteFunc((unsigned char *)psFunCall, uiDataLen, 61);
  free(psFunCall);
  if (uiRet) {
    vWriteLogTxt("iRcTSFID_RUDLL_EnrollFinger iDoRemoteFunc ret = %d", uiRet);
    return 99;
  }
  if (iGetParaInt(0) == 0) {
    memcpy(fpminu1, psGetParaBuf(4), 200);
    memcpy(fpminu2, psGetParaBuf(5), 100);
  }
  return iGetParaInt(0);
}


x86 assembly (clang, -O0):
<iRcTSFID_RUDLL_EnrollFinger>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    $0x64,%edi
call   1080 <malloc@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rdi
lea    0xe50(%rip),%rsi
mov    $0x1009,%edx
mov    $0x0,%al
call   10a0 <sprintf@plt>
mov    %eax,-0x2c(%rbp)
mov    -0x38(%rbp),%rax
mov    -0x2c(%rbp),%ecx
mov    -0x10(%rbp),%rdx
mov    (%rdx),%si
mov    %si,(%rax,%rcx,1)
mov    0x2(%rdx),%dl
mov    %dl,0x2(%rax,%rcx,1)
mov    -0x2c(%rbp),%eax
add    $0x3,%eax
mov    %eax,-0x2c(%rbp)
mov    -0x38(%rbp),%rdi
mov    -0x2c(%rbp),%eax
add    %rax,%rdi
mov    -0x14(%rbp),%edx
lea    0xe13(%rip),%rsi
mov    $0x0,%al
call   10a0 <sprintf@plt>
add    -0x2c(%rbp),%eax
mov    %eax,-0x2c(%rbp)
mov    -0x38(%rbp),%rdi
mov    -0x2c(%rbp),%esi
mov    $0x3d,%edx
mov    $0x0,%al
call   1090 <iDoRemoteFunc@plt>
mov    %eax,-0x30(%rbp)
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
cmpl   $0x0,-0x30(%rbp)
je     1248 <iRcTSFID_RUDLL_EnrollFinger+0xc8>
mov    -0x30(%rbp),%esi
lea    0xde2(%rip),%rdi
mov    $0x0,%al
call   1060 <vWriteLogTxt@plt>
movl   $0x63,-0x4(%rbp)
jmp    12b0 <iRcTSFID_RUDLL_EnrollFinger+0x130>
xor    %edi,%edi
mov    $0x0,%al
call   1040 <iGetParaInt@plt>
cmp    $0x0,%eax
jne    12a4 <iRcTSFID_RUDLL_EnrollFinger+0x124>
mov    -0x20(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    $0x4,%edi
mov    $0x0,%al
call   1050 <psGetParaBuf@plt>
mov    -0x48(%rbp),%rdi
movslq %eax,%rsi
mov    $0xc8,%edx
call   1070 <memcpy@plt>
mov    -0x28(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    $0x5,%edi
mov    $0x0,%al
call   1050 <psGetParaBuf@plt>
mov    -0x40(%rbp),%rdi
movslq %eax,%rsi
mov    $0x64,%edx
call   1070 <memcpy@plt>
xor    %edi,%edi
mov    $0x0,%al
call   1040 <iGetParaInt@plt>
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<iRcTSFID_RUDLL_EnrollFinger>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rcx,%r15
mov    %rdx,%r14
mov    %esi,%r12d
mov    %rdi,%r13
mov    $0x64,%edi
call   1080 <malloc@plt>
mov    %rax,%rbx
lea    0xe55(%rip),%rsi
mov    %rax,%rdi
mov    $0x1009,%edx
xor    %eax,%eax
call   10a0 <sprintf@plt>
mov    %eax,%ebp
mov    %eax,%eax
movzwl 0x0(%r13),%ecx
mov    %cx,(%rbx,%rax,1)
mov    0x2(%r13),%cl
mov    %cl,0x2(%rbx,%rax,1)
lea    0x3(%rbp),%edi
add    %rbx,%rdi
lea    0xe2c(%rip),%rsi
mov    %r12d,%edx
xor    %eax,%eax
call   10a0 <sprintf@plt>
lea    (%rax,%rbp,1),%esi
add    $0x3,%esi
mov    %rbx,%rdi
mov    $0x3d,%edx
xor    %eax,%eax
call   1090 <iDoRemoteFunc@plt>
mov    %eax,%ebp
mov    %rbx,%rdi
call   1030 <free@plt>
test   %ebp,%ebp
je     122d <iRcTSFID_RUDLL_EnrollFinger+0xad>
lea    0xe07(%rip),%rdi
mov    %ebp,%esi
xor    %eax,%eax
call   1060 <vWriteLogTxt@plt>
mov    $0x63,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
xor    %edi,%edi
xor    %eax,%eax
call   1040 <iGetParaInt@plt>
test   %eax,%eax
jne    129f <iRcTSFID_RUDLL_EnrollFinger+0x11f>
mov    $0x4,%edi
xor    %eax,%eax
call   1050 <psGetParaBuf@plt>
movslq %eax,%rsi
mov    $0xc8,%edx
mov    %r14,%rdi
call   1070 <memcpy@plt>
mov    $0x5,%edi
xor    %eax,%eax
call   1050 <psGetParaBuf@plt>
cltq
movups (%rax),%xmm0
movups 0x10(%rax),%xmm1
movups 0x20(%rax),%xmm2
movups 0x30(%rax),%xmm3
movups %xmm0,(%r15)
movups %xmm1,0x10(%r15)
movups %xmm2,0x20(%r15)
movups %xmm3,0x30(%r15)
movups 0x40(%rax),%xmm0
movups %xmm0,0x40(%r15)
movups 0x50(%rax),%xmm0
movups %xmm0,0x50(%r15)
mov    0x60(%rax),%eax
mov    %eax,0x60(%r15)
xor    %edi,%edi
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
jmp    1040 <iGetParaInt@plt>

LLVM IR (-O0):
@.str = [8 x i8] c"%u(b003\00"
@.str.1 = [15 x i8] c",%d,b000,b000)\00"
@.str.2 = [51 x i8] c"iRcTSFID_RUDLL_EnrollFinger iDoRemoteFunc ret = %d\00"
define i32 @iRcTSFID_RUDLL_EnrollFinger(i8* %0, i32 %1, i8* %2, i8* %3) {
%5 = alloca i32
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i32
%11 = alloca i32
%12 = alloca i8*
store i8* %0, i8** %6
store i32 %1, i32* %7
store i8* %2, i8** %8
store i8* %3, i8** %9
%13 = call i8* @malloc(i64 100)
store i8* %13, i8** %12
%14 = load i8*, i8** %12
%15 = call i32 (i8*, i8*, ...) @sprintf(i8* %14, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i32 4105)
store i32 %15, i32* %10
%16 = load i8*, i8** %12
%17 = load i32, i32* %10
%18 = zext i32 %17 to i64
%19 = getelementptr inbounds i8, i8* %16, i64 %18
%20 = load i8*, i8** %6
%21 = load i32, i32* %10
%22 = add i32 %21, 3
store i32 %22, i32* %10
%23 = load i8*, i8** %12
%24 = load i32, i32* %10
%25 = zext i32 %24 to i64
%26 = getelementptr inbounds i8, i8* %23, i64 %25
%27 = load i32, i32* %7
%28 = call i32 (i8*, i8*, ...) @sprintf(i8* %26, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 %27)
%29 = load i32, i32* %10
%30 = add i32 %29, %28
store i32 %30, i32* %10
%31 = load i8*, i8** %12
%32 = load i32, i32* %10
%33 = call i32 (i8*, i32, i32, ...) bitcast (i32 (...)* @iDoRemoteFunc to i32 (i8*, i32, i32, ...)*)(i8* %31, i32 %32, i32 61)
store i32 %33, i32* %11
%34 = load i8*, i8** %12
%35 = load i32, i32* %11
%36 = icmp ne i32 %35, 0
br i1 %36, label %37, label %40
37: ; preds = %4
%38 = load i32, i32* %11
%39 = call i32 (i8*, i32, ...) bitcast (i32 (...)* @vWriteLogTxt to i32 (i8*, i32, ...)*)(i8* getelementptr inbounds ([51 x i8], [51 x i8]* @.str.2, i64 0, i64 0), i32 %38)
store i32 99, i32* %5
br label %54
40: ; preds = %4
%41 = call i32 (i32, ...) bitcast (i32 (...)* @iGetParaInt to i32 (i32, ...)*)(i32 0)
%42 = icmp eq i32 %41, 0
br i1 %42, label %43, label %52
43: ; preds = %40
%44 = load i8*, i8** %8
%45 = call i32 (i32, ...) bitcast (i32 (...)* @psGetParaBuf to i32 (i32, ...)*)(i32 4)
%46 = sext i32 %45 to i64
%47 = inttoptr i64 %46 to i8*
%48 = load i8*, i8** %9
%49 = call i32 (i32, ...) bitcast (i32 (...)* @psGetParaBuf to i32 (i32, ...)*)(i32 5)
%50 = sext i32 %49 to i64
%51 = inttoptr i64 %50 to i8*
br label %52
52: ; preds = %43, %40
%53 = call i32 (i32, ...) bitcast (i32 (...)* @iGetParaInt to i32 (i32, ...)*)(i32 0)
store i32 %53, i32* %5
br label %54
54: ; preds = %52, %37
%55 = load i32, i32* %5
ret i32 %55
}

LLVM IR (-O2):
@.str = [8 x i8] c"%u(b003\00"
@.str.1 = [15 x i8] c",%d,b000,b000)\00"
@.str.2 = [51 x i8] c"iRcTSFID_RUDLL_EnrollFinger iDoRemoteFunc ret = %d\00"
define i32 @iRcTSFID_RUDLL_EnrollFinger(i8* nocapture %0, i32 %1, i8* nocapture writeonly %2, i8* nocapture writeonly %3) {
%5 = tail call dereferenceable_or_null(100) i8* @malloc(i64 100)
%6 = tail call i32 (i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %5, i8* dereferenceable(1) getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i32 4105)
%7 = zext i32 %6 to i64
%8 = getelementptr inbounds i8, i8* %5, i64 %7
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 dereferenceable(3) %8, i8* align 1 dereferenceable(3) %0, i64 3, i1 false)
%9 = add i32 %6, 3
%10 = zext i32 %9 to i64
%11 = getelementptr inbounds i8, i8* %5, i64 %10
%12 = tail call i32 (i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %11, i8* dereferenceable(1) getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 %1)
%13 = add i32 %12, %9
%14 = tail call i32 (i8*, i32, i32, ...) bitcast (i32 (...)* @iDoRemoteFunc to i32 (i8*, i32, i32, ...)*)(i8* %5, i32 %13, i32 61)
tail call void @free(i8* %5)
%15 = icmp eq i32 %14, 0
br i1 %15, label %18, label %16
16: ; preds = %4
%17 = tail call i32 (i8*, i32, ...) bitcast (i32 (...)* @vWriteLogTxt to i32 (i8*, i32, ...)*)(i8* getelementptr inbounds ([51 x i8], [51 x i8]* @.str.2, i64 0, i64 0), i32 %14)
br label %30
18: ; preds = %4
%19 = tail call i32 (i32, ...) bitcast (i32 (...)* @iGetParaInt to i32 (i32, ...)*)(i32 0)
%20 = icmp eq i32 %19, 0
br i1 %20, label %21, label %28
21: ; preds = %18
%22 = tail call i32 (i32, ...) bitcast (i32 (...)* @psGetParaBuf to i32 (i32, ...)*)(i32 4)
%23 = sext i32 %22 to i64
%24 = inttoptr i64 %23 to i8*
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 dereferenceable(200) %2, i8* align 1 dereferenceable(200) %24, i64 200, i1 false)
%25 = tail call i32 (i32, ...) bitcast (i32 (...)* @psGetParaBuf to i32 (i32, ...)*)(i32 5)
%26 = sext i32 %25 to i64
%27 = inttoptr i64 %26 to i8*
tail call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 1 dereferenceable(100) %3, i8* align 1 dereferenceable(100) %27, i64 100, i1 false)
br label %28
28: ; preds = %21, %18
%29 = tail call i32 (i32, ...) bitcast (i32 (...)* @iGetParaInt to i32 (i32, ...)*)(i32 0)
br label %30
30: ; preds = %28, %16
%31 = phi i32 [ 99, %16 ], [ %29, %28 ]
ret i32 %31
}