#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int atoi(char *);
scalar_t__ chdir(char *);
scalar_t__ chroot(char *);
scalar_t__ execve(char *, char **, char **);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, ...);
scalar_t__ setuid(int);
int /*<<< orphan*/ snprintf(char *, int, char *, ...);
int /*<<< orphan*/ stderr;
int strlen(char const *);
int /*<<< orphan*/ strncat(char *, char *, int);
int /*<<< orphan*/ strncpy(char *, char const *, int);
int /*<<< orphan*/ uidSecure(int);
int main(int argc, char **argv) {
  char *tok[20];
  char buf[4096], buf2[4096], buf3[4096];
  char *newEnv[] = {buf2, buf3, NULL};
  const char *homedir = "/home/";
  int i = 0, j = 4;
  if (argc < 5) {
    fprintf(
        stderr,
        "Usage: launcher <uid> <rootdir> <playerName> <executable> [options>]");
    return -1;
  }
  while (i < 20 - 1 && j < argc) {
    tok[i++] = argv[j++];
  }
  tok[i] = NULL;
  if (chroot(argv[2])) {
    fprintf(stderr, "Can not chroot to %s\n", argv[2]);
    return -1;
  }
  strncpy(buf, homedir, 4096 - 1);
  strncat(buf, argv[3], 4096 - strlen(homedir) - 1);
  snprintf(buf2, 4096, "HOME=%s", buf);
  buf2[4096 - 1] = '\0';
  snprintf(buf3, 4096, "LD_PRELOAD=/filter.so");
  buf3[4096 - 1] = '\0';
  if (chdir(buf)) {
    fprintf(stderr, "Can't chdir to %s\n", buf);
    return -1;
  }
  int newUid = atoi(argv[1]);
  if (!uidSecure(newUid)) {
    fprintf(stderr, "Uid is not secure: %d\n", newUid);
    return -1;
  }
  if (setuid(newUid)) {
    fprintf(stderr, "Can't setuid to %d\n", newUid);
    return -1;
  }
  if (execve(tok[0], tok, newEnv)) {
    fprintf(stderr, "Couldn't evec %s\n", argv[4]);
    return -1;
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x3100,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x20b0(%rbp),%rax
mov    %rax,-0x30d0(%rbp)
lea    -0x30b0(%rbp),%rax
mov    %rax,-0x30c8(%rbp)
movq   $0x0,-0x30c0(%rbp)
lea    0xe09(%rip),%rax
mov    %rax,-0x30d8(%rbp)
movl   $0x0,-0x30dc(%rbp)
movl   $0x4,-0x30e0(%rbp)
cmpl   $0x5,-0x8(%rbp)
jge    123f <main+0x8f>
mov    0x2dbd(%rip),%rax
mov    (%rax),%edi
lea    0xddb(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    14da <main+0x32a>
jmp    1244 <main+0x94>
xor    %eax,%eax
cmpl   $0x13,-0x30dc(%rbp)
mov    %al,-0x30e5(%rbp)
jge    126b <main+0xbb>
mov    -0x30e0(%rbp),%eax
cmp    -0x8(%rbp),%eax
setl   %al
mov    %al,-0x30e5(%rbp)
mov    -0x30e5(%rbp),%al
test   $0x1,%al
jne    127e <main+0xce>
jmp    12ba <main+0x10a>
mov    -0x10(%rbp),%rax
mov    -0x30e0(%rbp),%ecx
mov    %ecx,%edx
add    $0x1,%edx
mov    %edx,-0x30e0(%rbp)
movslq %ecx,%rcx
mov    (%rax,%rcx,8),%rcx
mov    -0x30dc(%rbp),%eax
mov    %eax,%edx
add    $0x1,%edx
mov    %edx,-0x30dc(%rbp)
cltq
mov    %rcx,-0xb0(%rbp,%rax,8)
ff
jmp    1244 <main+0x94>
movslq -0x30dc(%rbp),%rax
movq   $0x0,-0xb0(%rbp,%rax,8)
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
call   1040 <chroot@plt>
cmp    $0x0,%rax
je     130f <main+0x15f>
mov    0x2cf5(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdx
lea    0xd50(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    14da <main+0x32a>
lea    -0x10b0(%rbp),%rdi
mov    -0x30d8(%rbp),%rsi
mov    $0xfff,%edx
call   1030 <strncpy@plt>
lea    -0x10b0(%rbp),%rax
mov    %rax,-0x30f8(%rbp)
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%rax
mov    %rax,-0x30f0(%rbp)
mov    -0x30d8(%rbp),%rdi
call   1050 <strlen@plt>
mov    -0x30f8(%rbp),%rdi
mov    -0x30f0(%rbp),%rsi
mov    $0x1000,%edx
sub    %eax,%edx
sub    $0x1,%edx
call   1080 <strncat@plt>
lea    -0x20b0(%rbp),%rdi
lea    -0x10b0(%rbp),%rcx
mov    $0x1000,%esi
lea    0xcdb(%rip),%rdx
mov    $0x0,%al
call   1070 <snprintf@plt>
movb   $0x0,-0x10b1(%rbp)
lea    -0x30b0(%rbp),%rdi
mov    $0x1000,%esi
lea    0xcc2(%rip),%rdx
mov    $0x0,%al
call   1070 <snprintf@plt>
movb   $0x0,-0x20b1(%rbp)
lea    -0x10b0(%rbp),%rdi
call   1060 <chdir@plt>
cmp    $0x0,%rax
je     13f6 <main+0x246>
mov    0x2c0d(%rip),%rax
mov    (%rax),%edi
lea    -0x10b0(%rbp),%rdx
lea    0xc9d(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    14da <main+0x32a>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   10c0 <atoi@plt>
mov    %eax,-0x30e4(%rbp)
mov    -0x30e4(%rbp),%edi
call   10b0 <uidSecure@plt>
cmp    $0x0,%eax
jne    1446 <main+0x296>
mov    0x2bbc(%rip),%rax
mov    (%rax),%edi
mov    -0x30e4(%rbp),%edx
lea    0xc60(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    14da <main+0x32a>
mov    -0x30e4(%rbp),%edi
call   10d0 <setuid@plt>
cmp    $0x0,%rax
je     1484 <main+0x2d4>
mov    0x2b7e(%rip),%rax
mov    (%rax),%edi
mov    -0x30e4(%rbp),%edx
lea    0xc39(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    14da <main+0x32a>
mov    -0xb0(%rbp),%rdi
lea    -0xb0(%rbp),%rsi
lea    -0x30d0(%rbp),%rdx
call   1090 <execve@plt>
cmp    $0x0,%rax
je     14d3 <main+0x323>
mov    0x2b31(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    0x20(%rax),%rdx
lea    0xbfe(%rip),%rsi
mov    $0x0,%al
call   10a0 <fprintf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    14da <main+0x32a>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x3100,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x30c0,%rsp
lea    0x10c0(%rsp),%rax
mov    %rax,(%rsp)
lea    0xc0(%rsp),%rax
mov    %rax,0x8(%rsp)
movq   $0x0,0x10(%rsp)
cmp    $0x4,%edi
jg     1212 <main+0x52>
mov    0x2de3(%rip),%rax
mov    (%rax),%edi
lea    0xe01(%rip),%rsi
xor    %eax,%eax
call   10a0 <fprintf@plt>
jmp    131c <main+0x15c>
mov    %rsi,%rbx
add    $0x20,%rsi
add    $0xfffffffb,%edi
cmp    $0x12,%edi
mov    $0x12,%ebp
cmovb  %edi,%ebp
lea    0x8(,%rbp,8),%edx
lea    0x20(%rsp),%rdi
call   10b0 <memcpy@plt>
movq   $0x0,0x28(%rsp,%rbp,8)
mov    0x10(%rbx),%rdi
call   1040 <chroot@plt>
test   %rax,%rax
je     1268 <main+0xa8>
mov    0x2d8a(%rip),%rax
mov    (%rax),%edi
mov    0x10(%rbx),%rdx
lea    0xde9(%rip),%rsi
jmp    1315 <main+0x155>
lea    0xd91(%rip),%r15
lea    0x20c0(%rsp),%r14
mov    $0xfff,%ebp
mov    %r14,%rdi
mov    %r15,%rsi
mov    $0xfff,%edx
call   1030 <strncpy@plt>
mov    0x18(%rbx),%r12
mov    %r15,%rdi
call   1050 <strlen@plt>
sub    %eax,%ebp
mov    %r14,%rdi
mov    %r12,%rsi
mov    %ebp,%edx
call   1080 <strncat@plt>
lea    0xdb4(%rip),%rdx
lea    0x10c0(%rsp),%rdi
mov    $0x1000,%esi
mov    %r14,%rcx
xor    %eax,%eax
call   1070 <snprintf@plt>
movb   $0x0,0x20bf(%rsp)
lea    0xd96(%rip),%rdx
lea    0xc0(%rsp),%rdi
mov    $0x1000,%esi
xor    %eax,%eax
call   1070 <snprintf@plt>
movb   $0x0,0x10bf(%rsp)
mov    %r14,%rdi
call   1060 <chdir@plt>
test   %rax,%rax
je     1331 <main+0x171>
mov    0x2cdc(%rip),%rax
mov    (%rax),%edi
lea    0xd73(%rip),%rsi
lea    0x20c0(%rsp),%rdx
xor    %eax,%eax
call   10a0 <fprintf@plt>
mov    $0xffffffff,%eax
add    $0x30c0,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x8(%rbx),%rdi
call   10d0 <atoi@plt>
mov    %eax,%ebp
mov    %eax,%edi
call   10c0 <uidSecure@plt>
test   %eax,%eax
je     1365 <main+0x1a5>
mov    %ebp,%edi
call   10e0 <setuid@plt>
test   %rax,%rax
je     1380 <main+0x1c0>
mov    0x2c86(%rip),%rax
mov    (%rax),%edi
lea    0xd47(%rip),%rsi
jmp    1375 <main+0x1b5>
mov    0x2c74(%rip),%rax
mov    (%rax),%edi
lea    0xd1e(%rip),%rsi
mov    %ebp,%edx
xor    %eax,%eax
call   10a0 <fprintf@plt>
jmp    131c <main+0x15c>
mov    0x20(%rsp),%rdi
lea    0x20(%rsp),%rsi
mov    %rsp,%rdx
call   1090 <execve@plt>
test   %rax,%rax
je     13b0 <main+0x1f0>
mov    0x2c42(%rip),%rax
mov    (%rax),%edi
mov    0x20(%rbx),%rdx
lea    0xd13(%rip),%rsi
jmp    1315 <main+0x155>
xor    %eax,%eax
jmp    1321 <main+0x161>

LLVM IR (-O0):
@.str = [7 x i8] c"/home/\00"
@stderr = global i32 0
@.str.1 = [69 x i8] c"Usage: launcher <uid> <rootdir> <playerName> <executable> [options>]\00"
@.str.2 = [22 x i8] c"Can not chroot to %s\0A\00"
@.str.3 = [8 x i8] c"HOME=%s\00"
@.str.4 = [22 x i8] c"LD_PRELOAD=/filter.so\00"
@.str.5 = [19 x i8] c"Can't chdir to %s\0A\00"
@.str.6 = [23 x i8] c"Uid is not secure: %d\0A\00"
@.str.7 = [20 x i8] c"Can't setuid to %d\0A\00"
@.str.8 = [18 x i8] c"Couldn't evec %s\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca [20 x i8*]
%7 = alloca [4096 x i8]
%8 = alloca [4096 x i8]
%9 = alloca [4096 x i8]
%10 = alloca [3 x i8*]
%11 = alloca i8*
%12 = alloca i32
%13 = alloca i32
%14 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%15 = getelementptr inbounds [3 x i8*], [3 x i8*]* %10, i64 0, i64 0
%16 = getelementptr inbounds [4096 x i8], [4096 x i8]* %8, i64 0, i64 0
store i8* %16, i8** %15
%17 = getelementptr inbounds i8*, i8** %15, i64 1
%18 = getelementptr inbounds [4096 x i8], [4096 x i8]* %9, i64 0, i64 0
store i8* %18, i8** %17
%19 = getelementptr inbounds i8*, i8** %17, i64 1
store i8* null, i8** %19
store i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0), i8** %11
store i32 0, i32* %12
store i32 4, i32* %13
%20 = load i32, i32* %4
%21 = icmp slt i32 %20, 5
br i1 %21, label %22, label %25
22: ; preds = %2
%23 = load i32, i32* @stderr
%24 = call i32 (i32, i8*, ...) @fprintf(i32 %23, i8* getelementptr inbounds ([69 x i8], [69 x i8]* @.str.1, i64 0, i64 0))
store i32 -1, i32* %3
br label %122
25: ; preds = %2
br label %26
26: ; preds = %35, %25
%27 = load i32, i32* %12
%28 = icmp slt i32 %27, 19
br i1 %28, label %29, label %33
29: ; preds = %26
%30 = load i32, i32* %13
%31 = load i32, i32* %4
%32 = icmp slt i32 %30, %31
br label %33
33: ; preds = %29, %26
%34 = phi i1 [ false, %26 ], [ %32, %29 ]
br i1 %34, label %35, label %46
35: ; preds = %33
%36 = load i8**, i8*** %5
%37 = load i32, i32* %13
%38 = add nsw i32 %37, 1
store i32 %38, i32* %13
%39 = sext i32 %37 to i64
%40 = getelementptr inbounds i8*, i8** %36, i64 %39
%41 = load i8*, i8** %40
%42 = load i32, i32* %12
%43 = add nsw i32 %42, 1
store i32 %43, i32* %12
%44 = sext i32 %42 to i64
%45 = getelementptr inbounds [20 x i8*], [20 x i8*]* %6, i64 0, i64 %44
store i8* %41, i8** %45
br label %26
46: ; preds = %33
%47 = load i32, i32* %12
%48 = sext i32 %47 to i64
%49 = getelementptr inbounds [20 x i8*], [20 x i8*]* %6, i64 0, i64 %48
store i8* null, i8** %49
%50 = load i8**, i8*** %5
%51 = getelementptr inbounds i8*, i8** %50, i64 2
%52 = load i8*, i8** %51
%53 = call i64 @chroot(i8* %52)
%54 = icmp ne i64 %53, 0
br i1 %54, label %55, label %61
55: ; preds = %46
%56 = load i32, i32* @stderr
%57 = load i8**, i8*** %5
%58 = getelementptr inbounds i8*, i8** %57, i64 2
%59 = load i8*, i8** %58
%60 = call i32 (i32, i8*, ...) @fprintf(i32 %56, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.2, i64 0, i64 0), i8* %59)
store i32 -1, i32* %3
br label %122
61: ; preds = %46
%62 = getelementptr inbounds [4096 x i8], [4096 x i8]* %7, i64 0, i64 0
%63 = load i8*, i8** %11
%64 = call i32 @strncpy(i8* %62, i8* %63, i32 4095)
%65 = getelementptr inbounds [4096 x i8], [4096 x i8]* %7, i64 0, i64 0
%66 = load i8**, i8*** %5
%67 = getelementptr inbounds i8*, i8** %66, i64 3
%68 = load i8*, i8** %67
%69 = load i8*, i8** %11
%70 = call i32 @strlen(i8* %69)
%71 = sub nsw i32 4096, %70
%72 = sub nsw i32 %71, 1
%73 = call i32 @strncat(i8* %65, i8* %68, i32 %72)
%74 = getelementptr inbounds [4096 x i8], [4096 x i8]* %8, i64 0, i64 0
%75 = getelementptr inbounds [4096 x i8], [4096 x i8]* %7, i64 0, i64 0
%76 = call i32 (i8*, i32, i8*, ...) @snprintf(i8* %74, i32 4096, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i8* %75)
%77 = getelementptr inbounds [4096 x i8], [4096 x i8]* %8, i64 0, i64 4095
store i8 0, i8* %77
%78 = getelementptr inbounds [4096 x i8], [4096 x i8]* %9, i64 0, i64 0
%79 = call i32 (i8*, i32, i8*, ...) @snprintf(i8* %78, i32 4096, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.4, i64 0, i64 0))
%80 = getelementptr inbounds [4096 x i8], [4096 x i8]* %9, i64 0, i64 4095
store i8 0, i8* %80
%81 = getelementptr inbounds [4096 x i8], [4096 x i8]* %7, i64 0, i64 0
%82 = call i64 @chdir(i8* %81)
%83 = icmp ne i64 %82, 0
br i1 %83, label %84, label %88
84: ; preds = %61
%85 = load i32, i32* @stderr
%86 = getelementptr inbounds [4096 x i8], [4096 x i8]* %7, i64 0, i64 0
%87 = call i32 (i32, i8*, ...) @fprintf(i32 %85, i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.5, i64 0, i64 0), i8* %86)
store i32 -1, i32* %3
br label %122
88: ; preds = %61
%89 = load i8**, i8*** %5
%90 = getelementptr inbounds i8*, i8** %89, i64 1
%91 = load i8*, i8** %90
%92 = call i32 @atoi(i8* %91)
store i32 %92, i32* %14
%93 = load i32, i32* %14
%94 = call i32 @uidSecure(i32 %93)
%95 = icmp ne i32 %94, 0
br i1 %95, label %100, label %96
96: ; preds = %88
%97 = load i32, i32* @stderr
%98 = load i32, i32* %14
%99 = call i32 (i32, i8*, ...) @fprintf(i32 %97, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.6, i64 0, i64 0), i32 %98)
store i32 -1, i32* %3
br label %122
100: ; preds = %88
%101 = load i32, i32* %14
%102 = call i64 @setuid(i32 %101)
%103 = icmp ne i64 %102, 0
br i1 %103, label %104, label %108
104: ; preds = %100
%105 = load i32, i32* @stderr
%106 = load i32, i32* %14
%107 = call i32 (i32, i8*, ...) @fprintf(i32 %105, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.7, i64 0, i64 0), i32 %106)
store i32 -1, i32* %3
br label %122
108: ; preds = %100
%109 = getelementptr inbounds [20 x i8*], [20 x i8*]* %6, i64 0, i64 0
%110 = load i8*, i8** %109
%111 = getelementptr inbounds [20 x i8*], [20 x i8*]* %6, i64 0, i64 0
%112 = getelementptr inbounds [3 x i8*], [3 x i8*]* %10, i64 0, i64 0
%113 = call i64 @execve(i8* %110, i8** %111, i8** %112)
%114 = icmp ne i64 %113, 0
br i1 %114, label %115, label %121
115: ; preds = %108
%116 = load i32, i32* @stderr
%117 = load i8**, i8*** %5
%118 = getelementptr inbounds i8*, i8** %117, i64 4
%119 = load i8*, i8** %118
%120 = call i32 (i32, i8*, ...) @fprintf(i32 %116, i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.8, i64 0, i64 0), i8* %119)
store i32 -1, i32* %3
br label %122
121: ; preds = %108
store i32 0, i32* %3
br label %122
122: ; preds = %121, %115, %104, %96, %84, %55, %22
%123 = load i32, i32* %3
ret i32 %123
}

LLVM IR (-O2):
@.str = [7 x i8] c"/home/\00"
@stderr = global i32 0
@.str.1 = [69 x i8] c"Usage: launcher <uid> <rootdir> <playerName> <executable> [options>]\00"
@.str.2 = [22 x i8] c"Can not chroot to %s\0A\00"
@.str.3 = [8 x i8] c"HOME=%s\00"
@.str.4 = [22 x i8] c"LD_PRELOAD=/filter.so\00"
@.str.5 = [19 x i8] c"Can't chdir to %s\0A\00"
@.str.6 = [23 x i8] c"Uid is not secure: %d\0A\00"
@.str.7 = [20 x i8] c"Can't setuid to %d\0A\00"
@.str.8 = [18 x i8] c"Couldn't evec %s\0A\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [20 x i8*]
%4 = bitcast [20 x i8*]* %3 to i8*
%5 = alloca [4096 x i8]
%6 = alloca [4096 x i8]
%7 = alloca [4096 x i8]
%8 = alloca [3 x i8*]
%9 = getelementptr inbounds [4096 x i8], [4096 x i8]* %5, i64 0, i64 0
%10 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%11 = getelementptr inbounds [4096 x i8], [4096 x i8]* %7, i64 0, i64 0
%12 = bitcast [3 x i8*]* %8 to i8*
%13 = getelementptr inbounds [3 x i8*], [3 x i8*]* %8, i64 0, i64 0
store i8* %10, i8** %13
%14 = getelementptr inbounds [3 x i8*], [3 x i8*]* %8, i64 0, i64 1
store i8* %11, i8** %14
%15 = getelementptr inbounds [3 x i8*], [3 x i8*]* %8, i64 0, i64 2
store i8* null, i8** %15
%16 = icmp slt i32 %0, 5
br i1 %16, label %17, label %20
17: ; preds = %2
%18 = load i32, i32* @stderr
%19 = call i32 (i32, i8*, ...) @fprintf(i32 %18, i8* getelementptr inbounds ([69 x i8], [69 x i8]* @.str.1, i64 0, i64 0))
br label %80
20: ; preds = %2
%21 = getelementptr i8*, i8** %1, i64 4
%22 = bitcast i8** %21 to i8*
%23 = add nsw i32 %0, -5
%24 = call i32 @llvm.umin.i32(i32 %23, i32 18)
%25 = shl nuw nsw i32 %24, 3
%26 = add nuw nsw i32 %25, 8
%27 = zext i32 %26 to i64
%28 = add nuw nsw i32 %24, 1
%29 = zext i32 %28 to i64
%30 = getelementptr inbounds [20 x i8*], [20 x i8*]* %3, i64 0, i64 %29
store i8* null, i8** %30
%31 = getelementptr inbounds i8*, i8** %1, i64 2
%32 = load i8*, i8** %31
%33 = call i64 @chroot(i8* %32)
%34 = icmp eq i64 %33, 0
br i1 %34, label %39, label %35
35: ; preds = %20
%36 = load i32, i32* @stderr
%37 = load i8*, i8** %31
%38 = call i32 (i32, i8*, ...) @fprintf(i32 %36, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.2, i64 0, i64 0), i8* %37)
br label %80
39: ; preds = %20
%40 = call i32 @strncpy(i8* %9, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0), i32 4095)
%41 = getelementptr inbounds i8*, i8** %1, i64 3
%42 = load i8*, i8** %41
%43 = call i32 @strlen(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0))
%44 = sub i32 4095, %43
%45 = call i32 @strncat(i8* %9, i8* %42, i32 %44)
%46 = call i32 (i8*, i32, i8*, ...) @snprintf(i8* %10, i32 4096, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i8* %9)
%47 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 4095
store i8 0, i8* %47
%48 = call i32 (i8*, i32, i8*, ...) @snprintf(i8* %11, i32 4096, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.4, i64 0, i64 0))
%49 = getelementptr inbounds [4096 x i8], [4096 x i8]* %7, i64 0, i64 4095
store i8 0, i8* %49
%50 = call i64 @chdir(i8* %9)
%51 = icmp eq i64 %50, 0
br i1 %51, label %55, label %52
52: ; preds = %39
%53 = load i32, i32* @stderr
%54 = call i32 (i32, i8*, ...) @fprintf(i32 %53, i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.5, i64 0, i64 0), i8* %9)
br label %80
55: ; preds = %39
%56 = getelementptr inbounds i8*, i8** %1, i64 1
%57 = load i8*, i8** %56
%58 = call i32 @atoi(i8* %57)
%59 = call i32 @uidSecure(i32 %58)
%60 = icmp eq i32 %59, 0
br i1 %60, label %61, label %64
61: ; preds = %55
%62 = load i32, i32* @stderr
%63 = call i32 (i32, i8*, ...) @fprintf(i32 %62, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.6, i64 0, i64 0), i32 %58)
br label %80
64: ; preds = %55
%65 = call i64 @setuid(i32 %58)
%66 = icmp eq i64 %65, 0
br i1 %66, label %70, label %67
67: ; preds = %64
%68 = load i32, i32* @stderr
%69 = call i32 (i32, i8*, ...) @fprintf(i32 %68, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.7, i64 0, i64 0), i32 %58)
br label %80
70: ; preds = %64
%71 = getelementptr inbounds [20 x i8*], [20 x i8*]* %3, i64 0, i64 0
%72 = load i8*, i8** %71
%73 = call i64 @execve(i8* %72, i8** %71, i8** %13)
%74 = icmp eq i64 %73, 0
br i1 %74, label %80, label %75
75: ; preds = %70
%76 = load i32, i32* @stderr
%77 = getelementptr inbounds i8*, i8** %1, i64 4
%78 = load i8*, i8** %77
%79 = call i32 (i32, i8*, ...) @fprintf(i32 %76, i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.8, i64 0, i64 0), i8* %78)
br label %80
80: ; preds = %61, %67, %75, %70, %52, %35, %17
%81 = phi i32 [ -1, %17 ], [ -1, %35 ], [ -1, %52 ], [ -1, %67 ], [ -1, %75 ], [ -1, %61 ], [ 0, %70 ]
ret i32 %81
}