#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint8_t;

/* Variables and functions */
int /*<<< orphan*/ EVP_md5();
int /*<<< orphan*/ HMAC(int /*<<< orphan*/, int *, int, int *, int, int *,
                        int /*<<< orphan*/ *);
int /*<<< orphan*/ abort();
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *, int, char *);
int /*<<< orphan*/ memcpy(int *, int const *, int);
int /*<<< orphan*/ ntlmv2_create_hash(int const *, char const *, char const *,
                                      int *);
int /*<<< orphan*/ safe_free(int *);
int *safe_malloc_internal(int, char *, int);
int /*<<< orphan*/ stderr;
void ntlmv2_create_response(const uint8_t ntlm[16], const char *username,
                            const char *domain, const uint8_t challenge[8],
                            uint8_t *result, uint8_t *result_size) {
  size_t i;
  uint8_t v2hash[16];
  uint8_t *data;
  uint8_t blip[8];
  uint8_t *blob;
  uint8_t blob_length;
  for (i = 0; i < 8; i++)
    blip[i] = i;
  if (*result_size < 24) {
    {
      fprintf(
          stderr, "Unrecoverable error in %s(%d): %s\n\n",
          "/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/"
          "2022-01-22/02-19-57/repos/iagox86/nbtool/refs/heads/master/crypto.c",
          187, "Result size is too low!");
      abort();
    };
  } else if (*result_size == 24) {
    blob = safe_malloc_internal(
        8,
        "/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/"
        "2022-01-22/02-19-57/repos/iagox86/nbtool/refs/heads/master/crypto.c",
        192);
    memcpy(blob, blip, 8);
    blob_length = 8;
  } else {
    blob = safe_malloc_internal(
        24,
        "/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/"
        "2022-01-22/02-19-57/repos/iagox86/nbtool/refs/heads/master/crypto.c",
        198);
    for (i = 0; i < 24; i++)
      blob[i] = i;
    blob_length = 24;
  }
  data = safe_malloc_internal(
      8 + blob_length,
      "/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/"
      "2022-01-22/02-19-57/repos/iagox86/nbtool/refs/heads/master/crypto.c",
      205);
  memcpy(data, challenge, 8);
  memcpy(data + 8, blob, blob_length);
  ntlmv2_create_hash(ntlm, username, domain, v2hash);
  HMAC(EVP_md5(), v2hash, 16, data, 8 + blob_length, result, NULL);
  memcpy(result + 16, blob, blob_length);
  *result_size = blob_length + 16;
  safe_free(data);
  safe_free(blob);
}


x86 assembly (clang, -O0):
<ntlmv2_create_response>:
push   %rbp
mov    %rsp,%rbp
sub    $0xd0,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
mov    %r8,-0x28(%rbp)
mov    %r9,-0x30(%rbp)
movq   $0x0,-0x38(%rbp)
cmpq   $0x8,-0x38(%rbp)
jae    11d8 <ntlmv2_create_response+0x58>
mov    -0x38(%rbp),%rax
mov    %eax,%ecx
mov    -0x38(%rbp),%rax
mov    %ecx,-0xb0(%rbp,%rax,4)
mov    -0x38(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
jmp    11ab <ntlmv2_create_response+0x2b>
mov    -0x30(%rbp),%rax
cmpl   $0x18,(%rax)
jge    1214 <ntlmv2_create_response+0x94>
mov    0x2df4(%rip),%rax
mov    (%rax),%edi
lea    0xe0b(%rip),%rsi
lea    0xe28(%rip),%rdx
mov    $0xbb,%ecx
lea    0xea0(%rip),%r8
call   1060 <fprintf@plt>
mov    $0x0,%al
call   1030 <abort@plt>
mov    -0x30(%rbp),%rax
cmpl   $0x18,(%rax)
jne    1265 <ntlmv2_create_response+0xe5>
mov    $0x8,%edi
lea    0xdf7(%rip),%rsi
mov    $0xc0,%edx
call   1050 <safe_malloc_internal@plt>
mov    %rax,-0xb8(%rbp)
mov    -0xb8(%rbp),%rdi
lea    -0xb0(%rbp),%rsi
mov    $0x8,%edx
call   1070 <memcpy@plt>
movl   $0x8,-0xbc(%rbp)
jmp    12c4 <ntlmv2_create_response+0x144>
mov    $0x18,%edi
lea    0xdb3(%rip),%rsi
mov    $0xc6,%edx
call   1050 <safe_malloc_internal@plt>
mov    %rax,-0xb8(%rbp)
movq   $0x0,-0x38(%rbp)
cmpq   $0x18,-0x38(%rbp)
jae    12ba <ntlmv2_create_response+0x13a>
mov    -0x38(%rbp),%rax
mov    %eax,%edx
mov    -0xb8(%rbp),%rax
mov    -0x38(%rbp),%rcx
mov    %edx,(%rax,%rcx,4)
mov    -0x38(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x38(%rbp)
jmp    128a <ntlmv2_create_response+0x10a>
movl   $0x18,-0xbc(%rbp)
jmp    12c9 <ntlmv2_create_response+0x149>
mov    -0xbc(%rbp),%edi
add    $0x8,%edi
lea    0xd4b(%rip),%rsi
mov    $0xcd,%edx
call   1050 <safe_malloc_internal@plt>
mov    %rax,-0x88(%rbp)
mov    -0x88(%rbp),%rdi
mov    -0x20(%rbp),%rsi
mov    $0x8,%edx
call   1070 <memcpy@plt>
mov    -0x88(%rbp),%rdi
add    $0x20,%rdi
mov    -0xb8(%rbp),%rsi
mov    -0xbc(%rbp),%edx
call   1070 <memcpy@plt>
mov    -0x8(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x18(%rbp),%rdx
lea    -0x80(%rbp),%rcx
call   10a0 <ntlmv2_create_hash@plt>
mov    $0x0,%al
call   1040 <EVP_md5@plt>
mov    %eax,%edi
lea    -0x80(%rbp),%rsi
mov    -0x88(%rbp),%rcx
mov    -0xbc(%rbp),%r8d
add    $0x8,%r8d
mov    -0x28(%rbp),%r9
mov    $0x10,%edx
xor    %eax,%eax
movq   $0x0,(%rsp)
call   1080 <HMAC@plt>
mov    -0x28(%rbp),%rdi
add    $0x40,%rdi
mov    -0xb8(%rbp),%rsi
mov    -0xbc(%rbp),%edx
call   1070 <memcpy@plt>
mov    -0xbc(%rbp),%ecx
add    $0x10,%ecx
mov    -0x30(%rbp),%rax
mov    %ecx,(%rax)
mov    -0x88(%rbp),%rdi
call   1090 <safe_free@plt>
mov    -0xb8(%rbp),%rdi
call   1090 <safe_free@plt>
add    $0xd0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<ntlmv2_create_response>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x98,%rsp
movaps 0xe68(%rip),%xmm0
movaps %xmm0,0x30(%rsp)
movaps 0xe6c(%rip),%xmm1
movaps %xmm1,0x40(%rsp)
mov    (%r9),%eax
cmp    $0x17,%eax
jle    131d <ntlmv2_create_response+0x19d>
mov    %r8,%r15
mov    %rcx,%r14
cmp    $0x18,%eax
mov    %r9,0x28(%rsp)
mov    %rdx,0x20(%rsp)
mov    %rsi,0x18(%rsp)
mov    %rdi,0x10(%rsp)
lea    0xeab(%rip),%rsi
jne    1207 <ntlmv2_create_response+0x87>
mov    $0x8,%r12d
mov    $0x8,%edi
mov    $0xc0,%edx
call   1050 <safe_malloc_internal@plt>
mov    %rax,%rbx
lea    0x30(%rsp),%rsi
mov    %rax,%rdi
mov    $0x8,%edx
call   1070 <memcpy@plt>
jmp    1260 <ntlmv2_create_response+0xe0>
mov    $0x18,%r12d
mov    $0x18,%edi
mov    $0xc6,%edx
call   1050 <safe_malloc_internal@plt>
mov    %rax,%rbx
movaps 0xdda(%rip),%xmm0
movups %xmm0,(%rax)
movaps 0xde0(%rip),%xmm0
movups %xmm0,0x10(%rax)
movaps 0xde5(%rip),%xmm0
movups %xmm0,0x20(%rax)
movaps 0xdea(%rip),%xmm0
movups %xmm0,0x30(%rax)
movaps 0xdef(%rip),%xmm0
movups %xmm0,0x40(%rax)
movaps 0xdf4(%rip),%xmm0
movups %xmm0,0x50(%rax)
lea    0x8(%r12),%ebp
lea    0xe18(%rip),%rsi
mov    %ebp,%edi
mov    $0xcd,%edx
call   1050 <safe_malloc_internal@plt>
mov    %rax,%r13
mov    %rax,%rdi
mov    %r14,%rsi
mov    $0x8,%edx
call   1070 <memcpy@plt>
lea    0x20(%r13),%rdi
mov    %rbx,%rsi
mov    %r12d,%edx
call   1070 <memcpy@plt>
lea    0x50(%rsp),%r14
mov    0x10(%rsp),%rdi
mov    0x18(%rsp),%rsi
mov    0x20(%rsp),%rdx
mov    %r14,%rcx
call   10a0 <ntlmv2_create_hash@plt>
xor    %eax,%eax
call   1040 <EVP_md5@plt>
movq   $0x0,(%rsp)
mov    %eax,%edi
mov    %r14,%rsi
mov    $0x10,%edx
mov    %r13,%rcx
mov    %ebp,%r8d
mov    %r15,%r9
call   1080 <HMAC@plt>
add    $0x40,%r15
mov    %r15,%rdi
mov    %rbx,%rsi
mov    %r12d,%edx
call   1070 <memcpy@plt>
add    $0x10,%r12d
mov    0x28(%rsp),%rax
mov    %r12d,(%rax)
mov    %r13,%rdi
call   1090 <safe_free@plt>
mov    %rbx,%rdi
call   1090 <safe_free@plt>
add    $0x98,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x2cbc(%rip),%rax
mov    (%rax),%edi
lea    0xd33(%rip),%rsi
lea    0xd50(%rip),%rdx
lea    0xdcd(%rip),%r8
mov    $0xbb,%ecx
call   1060 <fprintf@plt>
xor    %eax,%eax
call   1030 <abort@plt>

LLVM IR (-O0):
@stderr = global i32 0
@.str = [36 x i8] c"Unrecoverable error in %s(%d): %s\0A\0A\00"
@.str.1 = [132 x i8] c"/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/2022-01-22/02-19-57/repos/iagox86/nbtool/refs/heads/master/crypto.c\00"
@.str.2 = [24 x i8] c"Result size is too low!\00"
define void @ntlmv2_create_response(i32* %0, i8* %1, i8* %2, i32* %3, i32* %4, i32* %5) {
%7 = alloca i32*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i32*
%11 = alloca i32*
%12 = alloca i32*
%13 = alloca i64
%14 = alloca [16 x i32]
%15 = alloca i32*
%16 = alloca [8 x i32]
%17 = alloca i32*
%18 = alloca i32
store i32* %0, i32** %7
store i8* %1, i8** %8
store i8* %2, i8** %9
store i32* %3, i32** %10
store i32* %4, i32** %11
store i32* %5, i32** %12
store i64 0, i64* %13
br label %19
19: ; preds = %27, %6
%20 = load i64, i64* %13
%21 = icmp ult i64 %20, 8
br i1 %21, label %22, label %30
22: ; preds = %19
%23 = load i64, i64* %13
%24 = trunc i64 %23 to i32
%25 = load i64, i64* %13
%26 = getelementptr inbounds [8 x i32], [8 x i32]* %16, i64 0, i64 %25
store i32 %24, i32* %26
br label %27
27: ; preds = %22
%28 = load i64, i64* %13
%29 = add i64 %28, 1
store i64 %29, i64* %13
br label %19
30: ; preds = %19
%31 = load i32*, i32** %12
%32 = load i32, i32* %31
%33 = icmp slt i32 %32, 24
br i1 %33, label %34, label %38
34: ; preds = %30
%35 = load i32, i32* @stderr
%36 = call i32 @fprintf(i32 %35, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([132 x i8], [132 x i8]* @.str.1, i64 0, i64 0), i32 187, i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.2, i64 0, i64 0))
%37 = call i32 (...) @abort()
unreachable
38: ; preds = %30
%39 = load i32*, i32** %12
%40 = load i32, i32* %39
%41 = icmp eq i32 %40, 24
br i1 %41, label %42, label %47
42: ; preds = %38
%43 = call i32* @safe_malloc_internal(i32 8, i8* getelementptr inbounds ([132 x i8], [132 x i8]* @.str.1, i64 0, i64 0), i32 192)
store i32* %43, i32** %17
%44 = load i32*, i32** %17
%45 = getelementptr inbounds [8 x i32], [8 x i32]* %16, i64 0, i64 0
%46 = call i32 @memcpy(i32* %44, i32* %45, i32 8)
store i32 8, i32* %18
br label %62
47: ; preds = %38
%48 = call i32* @safe_malloc_internal(i32 24, i8* getelementptr inbounds ([132 x i8], [132 x i8]* @.str.1, i64 0, i64 0), i32 198)
store i32* %48, i32** %17
store i64 0, i64* %13
br label %49
49: ; preds = %58, %47
%50 = load i64, i64* %13
%51 = icmp ult i64 %50, 24
br i1 %51, label %52, label %61
52: ; preds = %49
%53 = load i64, i64* %13
%54 = trunc i64 %53 to i32
%55 = load i32*, i32** %17
%56 = load i64, i64* %13
%57 = getelementptr inbounds i32, i32* %55, i64 %56
store i32 %54, i32* %57
br label %58
58: ; preds = %52
%59 = load i64, i64* %13
%60 = add i64 %59, 1
store i64 %60, i64* %13
br label %49
61: ; preds = %49
store i32 24, i32* %18
br label %62
62: ; preds = %61, %42
br label %63
63: ; preds = %62
%64 = load i32, i32* %18
%65 = add nsw i32 8, %64
%66 = call i32* @safe_malloc_internal(i32 %65, i8* getelementptr inbounds ([132 x i8], [132 x i8]* @.str.1, i64 0, i64 0), i32 205)
store i32* %66, i32** %15
%67 = load i32*, i32** %15
%68 = load i32*, i32** %10
%69 = call i32 @memcpy(i32* %67, i32* %68, i32 8)
%70 = load i32*, i32** %15
%71 = getelementptr inbounds i32, i32* %70, i64 8
%72 = load i32*, i32** %17
%73 = load i32, i32* %18
%74 = call i32 @memcpy(i32* %71, i32* %72, i32 %73)
%75 = load i32*, i32** %7
%76 = load i8*, i8** %8
%77 = load i8*, i8** %9
%78 = getelementptr inbounds [16 x i32], [16 x i32]* %14, i64 0, i64 0
%79 = call i32 @ntlmv2_create_hash(i32* %75, i8* %76, i8* %77, i32* %78)
%80 = call i32 (...) @EVP_md5()
%81 = getelementptr inbounds [16 x i32], [16 x i32]* %14, i64 0, i64 0
%82 = load i32*, i32** %15
%83 = load i32, i32* %18
%84 = add nsw i32 8, %83
%85 = load i32*, i32** %11
%86 = call i32 @HMAC(i32 %80, i32* %81, i32 16, i32* %82, i32 %84, i32* %85, i32* null)
%87 = load i32*, i32** %11
%88 = getelementptr inbounds i32, i32* %87, i64 16
%89 = load i32*, i32** %17
%90 = load i32, i32* %18
%91 = call i32 @memcpy(i32* %88, i32* %89, i32 %90)
%92 = load i32, i32* %18
%93 = add nsw i32 %92, 16
%94 = load i32*, i32** %12
store i32 %93, i32* %94
%95 = load i32*, i32** %15
%96 = call i32 @safe_free(i32* %95)
%97 = load i32*, i32** %17
%98 = call i32 @safe_free(i32* %97)
ret void
}

LLVM IR (-O2):
@stderr = global i32 0
@.str = [36 x i8] c"Unrecoverable error in %s(%d): %s\0A\0A\00"
@.str.1 = [132 x i8] c"/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/2022-01-22/02-19-57/repos/iagox86/nbtool/refs/heads/master/crypto.c\00"
@.str.2 = [24 x i8] c"Result size is too low!\00"
define void @ntlmv2_create_response(i32* %0, i8* %1, i8* %2, i32* %3, i32* %4, i32* nocapture %5) {
%7 = alloca [16 x i32]
%8 = alloca [8 x i32]
%9 = bitcast [16 x i32]* %7 to i8*
%10 = bitcast [8 x i32]* %8 to i8*
%11 = getelementptr inbounds [8 x i32], [8 x i32]* %8, i64 0, i64 0
%12 = bitcast [8 x i32]* %8 to <4 x i32>*
store <4 x i32> <i32 0, i32 1, i32 2, i32 3>, <4 x i32>* %12
%13 = getelementptr inbounds [8 x i32], [8 x i32]* %8, i64 0, i64 4
%14 = bitcast i32* %13 to <4 x i32>*
store <4 x i32> <i32 4, i32 5, i32 6, i32 7>, <4 x i32>* %14
%15 = load i32, i32* %5
%16 = icmp slt i32 %15, 24
br i1 %16, label %17, label %21
17: ; preds = %6
%18 = load i32, i32* @stderr
%19 = tail call i32 @fprintf(i32 %18, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([132 x i8], [132 x i8]* @.str.1, i64 0, i64 0), i32 187, i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.2, i64 0, i64 0))
%20 = tail call i32 (...) @abort()
unreachable
21: ; preds = %6
%22 = icmp eq i32 %15, 24
br i1 %22, label %23, label %26
23: ; preds = %21
%24 = tail call i32* @safe_malloc_internal(i32 8, i8* getelementptr inbounds ([132 x i8], [132 x i8]* @.str.1, i64 0, i64 0), i32 192)
%25 = call i32 @memcpy(i32* %24, i32* %11, i32 8)
br label %39
26: ; preds = %21
%27 = tail call i32* @safe_malloc_internal(i32 24, i8* getelementptr inbounds ([132 x i8], [132 x i8]* @.str.1, i64 0, i64 0), i32 198)
%28 = bitcast i32* %27 to <4 x i32>*
store <4 x i32> <i32 0, i32 1, i32 2, i32 3>, <4 x i32>* %28
%29 = getelementptr inbounds i32, i32* %27, i64 4
%30 = bitcast i32* %29 to <4 x i32>*
store <4 x i32> <i32 4, i32 5, i32 6, i32 7>, <4 x i32>* %30
%31 = getelementptr inbounds i32, i32* %27, i64 8
%32 = bitcast i32* %31 to <4 x i32>*
store <4 x i32> <i32 8, i32 9, i32 10, i32 11>, <4 x i32>* %32
%33 = getelementptr inbounds i32, i32* %27, i64 12
%34 = bitcast i32* %33 to <4 x i32>*
store <4 x i32> <i32 12, i32 13, i32 14, i32 15>, <4 x i32>* %34
%35 = getelementptr inbounds i32, i32* %27, i64 16
%36 = bitcast i32* %35 to <4 x i32>*
store <4 x i32> <i32 16, i32 17, i32 18, i32 19>, <4 x i32>* %36
%37 = getelementptr inbounds i32, i32* %27, i64 20
%38 = bitcast i32* %37 to <4 x i32>*
store <4 x i32> <i32 20, i32 21, i32 22, i32 23>, <4 x i32>* %38
br label %39
39: ; preds = %26, %23
%40 = phi i32* [ %24, %23 ], [ %27, %26 ]
%41 = phi i32 [ 8, %23 ], [ 24, %26 ]
%42 = add nuw nsw i32 %41, 8
%43 = call i32* @safe_malloc_internal(i32 %42, i8* getelementptr inbounds ([132 x i8], [132 x i8]* @.str.1, i64 0, i64 0), i32 205)
%44 = call i32 @memcpy(i32* %43, i32* %3, i32 8)
%45 = getelementptr inbounds i32, i32* %43, i64 8
%46 = call i32 @memcpy(i32* %45, i32* %40, i32 %41)
%47 = getelementptr inbounds [16 x i32], [16 x i32]* %7, i64 0, i64 0
%48 = call i32 @ntlmv2_create_hash(i32* %0, i8* %1, i8* %2, i32* %47)
%49 = call i32 (...) @EVP_md5()
%50 = call i32 @HMAC(i32 %49, i32* %47, i32 16, i32* %43, i32 %42, i32* %4, i32* null)
%51 = getelementptr inbounds i32, i32* %4, i64 16
%52 = call i32 @memcpy(i32* %51, i32* %40, i32 %41)
%53 = add nuw nsw i32 %41, 16
store i32 %53, i32* %5
%54 = call i32 @safe_free(i32* %43)
%55 = call i32 @safe_free(i32* %40)
ret void
}