#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ crypt(char *, char *);
int /*<<< orphan*/ free(char *);
scalar_t__ strncmp(char *, int /*<<< orphan*/, int);
char *crack(char *input, int length, char *salt, char *key, int pos) {
  for (int c = 32; c <= 126; c++) {
    key[pos] = c;
    if (pos + 1 < length) {
      char *tmp = crack(input, length, salt, key, pos + 1);
      if (tmp != NULL)
        return tmp;
      free(tmp);
    }
    if (strncmp(input, crypt(key, salt), 13) == 0)
      return key;
  }
  return NULL;
}


x86 assembly (clang, -O0):
<crack>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8d,-0x2c(%rbp)
movl   $0x20,-0x30(%rbp)
cmpl   $0x7e,-0x30(%rbp)
jg     121b <crack+0xdb>
mov    -0x30(%rbp),%eax
mov    %al,%dl
mov    -0x28(%rbp),%rax
movslq -0x2c(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x2c(%rbp),%eax
add    $0x1,%eax
cmp    -0x14(%rbp),%eax
jge    11cc <crack+0x8c>
mov    -0x10(%rbp),%rdi
mov    -0x14(%rbp),%esi
mov    -0x20(%rbp),%rdx
mov    -0x28(%rbp),%rcx
mov    -0x2c(%rbp),%r8d
add    $0x1,%r8d
call   1060 <crack@plt>
mov    %rax,-0x38(%rbp)
cmpq   $0x0,-0x38(%rbp)
je     11c3 <crack+0x83>
mov    -0x38(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    1223 <crack+0xe3>
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
mov    -0x10(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    -0x28(%rbp),%rdi
mov    -0x20(%rbp),%rsi
call   1050 <crypt@plt>
mov    -0x40(%rbp),%rdi
mov    %eax,%esi
mov    $0xd,%edx
call   1040 <strncmp@plt>
cmp    $0x0,%rax
jne    1208 <crack+0xc8>
mov    -0x28(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    1223 <crack+0xe3>
jmp    120d <crack+0xcd>
mov    -0x30(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x30(%rbp)
jmp    1162 <crack+0x22>
movq   $0x0,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<crack>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rcx,%rbx
mov    %rdx,%r14
mov    %esi,%r15d
mov    %rdi,%r12
movslq %r8d,%rcx
mov    %rcx,%rax
mov    %rcx,(%rsp)
lea    0x1(%rcx),%ebp
mov    $0xffffffa1,%r13d
nopw   0x0(%rax,%rax,1)
lea    0x7f(%r13),%eax
mov    (%rsp),%rcx
mov    %al,(%rbx,%rcx,1)
cmp    %r15d,%ebp
jge    11a0 <crack+0x60>
mov    %r12,%rdi
mov    %r15d,%esi
mov    %r14,%rdx
mov    %rbx,%rcx
mov    %ebp,%r8d
call   1060 <crack@plt>
test   %rax,%rax
jne    11c8 <crack+0x88>
xor    %edi,%edi
call   1030 <free@plt>
mov    %rbx,%rdi
mov    %r14,%rsi
call   1050 <crypt@plt>
mov    %r12,%rdi
mov    %eax,%esi
mov    $0xd,%edx
call   1040 <strncmp@plt>
test   %rax,%rax
je     11cb <crack+0x8b>
inc    %r13d
jne    1170 <crack+0x30>
xor    %ebx,%ebx
jmp    11cb <crack+0x8b>
mov    %rax,%rbx
mov    %rbx,%rax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i8* @crack(i8* %0, i32 %1, i8* %2, i8* %3, i32 %4) {
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i32
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca i32
%12 = alloca i32
%13 = alloca i8*
store i8* %0, i8** %7
store i32 %1, i32* %8
store i8* %2, i8** %9
store i8* %3, i8** %10
store i32 %4, i32* %11
store i32 32, i32* %12
br label %14
14: ; preds = %53, %5
%15 = load i32, i32* %12
%16 = icmp sle i32 %15, 126
br i1 %16, label %17, label %56
17: ; preds = %14
%18 = load i32, i32* %12
%19 = trunc i32 %18 to i8
%20 = load i8*, i8** %10
%21 = load i32, i32* %11
%22 = sext i32 %21 to i64
%23 = getelementptr inbounds i8, i8* %20, i64 %22
store i8 %19, i8* %23
%24 = load i32, i32* %11
%25 = add nsw i32 %24, 1
%26 = load i32, i32* %8
%27 = icmp slt i32 %25, %26
br i1 %27, label %28, label %43
28: ; preds = %17
%29 = load i8*, i8** %7
%30 = load i32, i32* %8
%31 = load i8*, i8** %9
%32 = load i8*, i8** %10
%33 = load i32, i32* %11
%34 = add nsw i32 %33, 1
%35 = call i8* @crack(i8* %29, i32 %30, i8* %31, i8* %32, i32 %34)
store i8* %35, i8** %13
%36 = load i8*, i8** %13
%37 = icmp ne i8* %36, null
br i1 %37, label %38, label %40
38: ; preds = %28
%39 = load i8*, i8** %13
store i8* %39, i8** %6
br label %57
40: ; preds = %28
%41 = load i8*, i8** %13
%42 = call i32 @free(i8* %41)
br label %43
43: ; preds = %40, %17
%44 = load i8*, i8** %7
%45 = load i8*, i8** %10
%46 = load i8*, i8** %9
%47 = call i32 @crypt(i8* %45, i8* %46)
%48 = call i64 @strncmp(i8* %44, i32 %47, i32 13)
%49 = icmp eq i64 %48, 0
br i1 %49, label %50, label %52
50: ; preds = %43
%51 = load i8*, i8** %10
store i8* %51, i8** %6
br label %57
52: ; preds = %43
br label %53
53: ; preds = %52
%54 = load i32, i32* %12
%55 = add nsw i32 %54, 1
store i32 %55, i32* %12
br label %14
56: ; preds = %14
store i8* null, i8** %6
br label %57
57: ; preds = %56, %50, %38
%58 = load i8*, i8** %6
ret i8* %58
}

LLVM IR (-O2):
define i8* @crack(i8* %0, i32 %1, i8* %2, i8* %3, i32 %4) {
%6 = sext i32 %4 to i64
%7 = getelementptr inbounds i8, i8* %3, i64 %6
%8 = add nsw i32 %4, 1
%9 = icmp slt i32 %8, %1
br label %13
10: ; preds = %21
%11 = add nuw nsw i32 %14, 1
%12 = icmp eq i32 %11, 127
br i1 %12, label %25, label %13
13: ; preds = %5, %10
%14 = phi i32 [ 32, %5 ], [ %11, %10 ]
%15 = trunc i32 %14 to i8
store i8 %15, i8* %7
br i1 %9, label %16, label %21
16: ; preds = %13
%17 = tail call i8* @crack(i8* %0, i32 %1, i8* %2, i8* %3, i32 %8)
%18 = icmp eq i8* %17, null
br i1 %18, label %19, label %25
19: ; preds = %16
%20 = tail call i32 @free(i8* null)
br label %21
21: ; preds = %19, %13
%22 = tail call i32 @crypt(i8* %3, i8* %2)
%23 = tail call i64 @strncmp(i8* %0, i32 %22, i32 13)
%24 = icmp eq i64 %23, 0
br i1 %24, label %25, label %10
25: ; preds = %16, %21, %10
%26 = phi i8* [ %17, %16 ], [ %3, %21 ], [ null, %10 ]
ret i8* %26
}