find condition to satisfy to explore the complete exec graph of a function (a *very* simple/weak fuzzgrind clone)