#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint64_t;

/* Variables and functions */
int get_mem_val(unsigned long, unsigned long, unsigned long);
int /*<<< orphan*/ printf(char *);
int reverse_bits(unsigned long, int);
int strlen(char *);
int /*<<< orphan*/ strncpy(char *, char *, int);
unsigned long strtoul(char *, int /*<<< orphan*/ *, int);
uint64_t keygen(char *challenge) {
  char ch_4[5];
  char ch_7[8];
  unsigned long a, x, y, z, breg, sreg, game_num, ecx, orresult, shift_bits,
      bits_to_reverse, bits, shift, edx, valid, rbp0x17cLower7, rbp0x184;
  if (strlen(challenge) != 12) {
    printf("Invalid challenge string length\n");
    return -1;
  }
  strncpy(ch_4, challenge + 1, 4);
  ch_4[4] = '\0';
  strncpy(ch_7, challenge + 5, 7);
  ch_7[7] = '\0';
  sreg = strtoul(ch_4, NULL, 10);
  breg = strtoul(ch_7, NULL, 10);
  x = (sreg * 0x3f) ^ breg;
  y = x / 0x103;
  z = y / 0x81;
  game_num = y % 0x81;
  edx = sreg & 0x7F;
  a = (z / 7) + (sreg >> 7) + edx + game_num + (z % 7);
  valid = a == x % 0x103;
  rbp0x17cLower7 = game_num & 0x7F;
  rbp0x184 = edx & 0xFF;
  rbp0x184 = (rbp0x184 << 3) & 0xFF;
  ecx = (z % 7) & 0xFF;
  orresult = rbp0x184 | ecx;
  uint64_t loworresult = orresult & 7;
  shift_bits = 1 << loworresult;
  bits_to_reverse = (shift_bits - 1) & (orresult >> 3);
  bits = shift_bits - reverse_bits(bits_to_reverse, loworresult) - 1;
  shift = loworresult + 1;
  uint64_t mem_val = get_mem_val(shift, bits, game_num);
  uint64_t reverse_game_mem = reverse_bits(game_num, 7) + mem_val + 0x18;
  uint64_t key = (reverse_game_mem - (reverse_game_mem & 0xFFF80) +
                  0x83 * ((mem_val ^ 0x1EA3) + 0x1700A1));
  return key;
}


x86 assembly (clang, -O0):
<keygen>:
push   %rbp
mov    %rsp,%rbp
sub    $0xd0,%rsp
mov    %rdi,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
call   1050 <strlen@plt>
cmp    $0xc,%eax
je     1199 <keygen+0x39>
lea    0xe78(%rip),%rdi
call   1070 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1418 <keygen+0x2b8>
lea    -0x15(%rbp),%rdi
mov    -0x10(%rbp),%rsi
add    $0x1,%rsi
mov    $0x4,%edx
call   1030 <strncpy@plt>
movb   $0x0,-0x11(%rbp)
lea    -0x1d(%rbp),%rdi
mov    -0x10(%rbp),%rsi
add    $0x5,%rsi
mov    $0x7,%edx
call   1030 <strncpy@plt>
movb   $0x0,-0x16(%rbp)
lea    -0x15(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
mov    $0xa,%edx
call   1080 <strtoul@plt>
mov    %rax,-0x50(%rbp)
lea    -0x1d(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
mov    $0xa,%edx
call   1080 <strtoul@plt>
mov    %rax,-0x48(%rbp)
imul   $0x3f,-0x50(%rbp),%rax
xor    -0x48(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rax
mov    $0x103,%ecx
xor    %edx,%edx
div    %rcx
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    $0x81,%ecx
xor    %edx,%edx
div    %rcx
mov    %rax,-0x40(%rbp)
mov    -0x38(%rbp),%rax
mov    $0x81,%ecx
xor    %edx,%edx
div    %rcx
mov    %rdx,-0x58(%rbp)
mov    -0x50(%rbp),%rax
and    $0x7f,%rax
mov    %rax,-0x90(%rbp)
mov    -0x40(%rbp),%rax
mov    $0x7,%ecx
xor    %edx,%edx
div    %rcx
mov    -0x50(%rbp),%rcx
shr    $0x7,%rcx
add    %rcx,%rax
add    -0x90(%rbp),%rax
add    -0x58(%rbp),%rax
mov    %rax,-0xd0(%rbp)
mov    -0x40(%rbp),%rax
mov    $0x7,%ecx
xor    %edx,%edx
div    %rcx
mov    -0xd0(%rbp),%rax
add    %rdx,%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0xc8(%rbp)
mov    -0x30(%rbp),%rax
mov    $0x103,%ecx
xor    %edx,%edx
div    %rcx
mov    -0xc8(%rbp),%rax
cmp    %rdx,%rax
sete   %al
and    $0x1,%al
movzbl %al,%eax
cltq
mov    %rax,-0x98(%rbp)
mov    -0x58(%rbp),%rax
and    $0x7f,%rax
mov    %rax,-0xa0(%rbp)
mov    -0x90(%rbp),%rax
and    $0xff,%rax
mov    %rax,-0xa8(%rbp)
mov    -0xa8(%rbp),%rax
shl    $0x3,%rax
and    $0xff,%rax
mov    %rax,-0xa8(%rbp)
mov    -0x40(%rbp),%rax
mov    $0x7,%ecx
xor    %edx,%edx
div    %rcx
and    $0xff,%rdx
mov    %rdx,-0x60(%rbp)
mov    -0xa8(%rbp),%rax
or     -0x60(%rbp),%rax
mov    %rax,-0x68(%rbp)
mov    -0x68(%rbp),%rax
and    $0x7,%rax
mov    %eax,-0xac(%rbp)
mov    -0xac(%rbp),%ecx
mov    $0x1,%eax
shl    %cl,%eax
cltq
mov    %rax,-0x70(%rbp)
mov    -0x70(%rbp),%rax
sub    $0x1,%rax
mov    -0x68(%rbp),%rcx
shr    $0x3,%rcx
and    %rcx,%rax
mov    %rax,-0x78(%rbp)
mov    -0x70(%rbp),%rax
mov    %rax,-0xc0(%rbp)
mov    -0x78(%rbp),%rdi
mov    -0xac(%rbp),%esi
call   1040 <reverse_bits@plt>
mov    %eax,%ecx
mov    -0xc0(%rbp),%rax
movslq %ecx,%rcx
sub    %rcx,%rax
sub    $0x1,%rax
mov    %rax,-0x80(%rbp)
mov    -0xac(%rbp),%eax
add    $0x1,%eax
cltq
mov    %rax,-0x88(%rbp)
mov    -0x88(%rbp),%rdi
mov    -0x80(%rbp),%rsi
mov    -0x58(%rbp),%rdx
call   1060 <get_mem_val@plt>
mov    %eax,-0xb0(%rbp)
mov    -0x58(%rbp),%rdi
mov    $0x7,%esi
call   1040 <reverse_bits@plt>
add    -0xb0(%rbp),%eax
add    $0x18,%eax
mov    %eax,-0xb4(%rbp)
mov    -0xb4(%rbp),%eax
mov    -0xb4(%rbp),%ecx
and    $0xfff80,%ecx
sub    %ecx,%eax
mov    -0xb0(%rbp),%ecx
xor    $0x1ea3,%ecx
add    $0x1700a1,%ecx
imul   $0x83,%ecx,%ecx
add    %ecx,%eax
mov    %eax,-0xb8(%rbp)
mov    -0xb8(%rbp),%eax
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0xd0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<keygen>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x10,%rsp
mov    %rdi,%rbx
call   1060 <strlen@plt>
cmp    $0xc,%eax
jne    12d6 <keygen+0x176>
lea    0x1(%rbx),%rsi
lea    0x3(%rsp),%r14
mov    %r14,%rdi
mov    $0x4,%edx
call   1030 <strncpy@plt>
movb   $0x0,0x7(%rsp)
add    $0x5,%rbx
lea    0x8(%rsp),%r15
mov    %r15,%rdi
mov    %rbx,%rsi
mov    $0x7,%edx
call   1030 <strncpy@plt>
movb   $0x0,0xf(%rsp)
mov    %r14,%rdi
xor    %esi,%esi
mov    $0xa,%edx
call   1080 <strtoul@plt>
mov    %rax,%r14
mov    %r15,%rdi
xor    %esi,%esi
mov    $0xa,%edx
call   1080 <strtoul@plt>
mov    %rax,%rcx
mov    %r14,%rax
shl    $0x6,%rax
sub    %r14,%rax
xor    %rax,%rcx
movabs $0xfa11caa01fa11cab,%rdx
ca 11 fa
mov    %rcx,%rax
mul    %rdx
mov    %rcx,%r12
sub    %rdx,%r12
shr    %r12
add    %rdx,%r12
shr    $0x8,%r12
movabs $0xfb12bfd06ef2a903,%rdx
bf 12 fb
mov    %rcx,%rax
mul    %rdx
mov    %rdx,%r15
shr    $0xf,%r15
movabs $0xfe03f80fe03f80ff,%rcx
f8 03 fe
mov    %r12,%rax
mul    %rcx
mov    %rdx,%rcx
shr    $0x7,%rcx
mov    %rcx,%rsi
shl    $0x7,%rsi
movabs $0x2492492492492493,%rdx
49 92 24
mov    %r15,%rax
mul    %rdx
add    %rcx,%rsi
mov    %r15,%rbx
sub    %rdx,%rbx
shr    %rbx
add    %rdx,%rbx
shr    $0x2,%rbx
lea    0x0(,%rbx,8),%rax
sub    %rax,%rbx
lea    (%r15,%rbx,1),%rcx
mov    $0x1,%r13d
shl    %cl,%r13d
sub    %rsi,%r12
lea    -0x1(%r13),%edi
and    %r14d,%edi
and    $0x1f,%edi
mov    %ecx,%esi
call   1050 <reverse_bits@plt>
not    %eax
movslq %eax,%rsi
add    %r13,%rsi
lea    (%r15,%rbx,1),%rdi
add    $0x1,%rdi
mov    %r12,%rdx
call   1070 <get_mem_val@plt>
mov    %eax,%r14d
mov    %r12,%rdi
mov    $0x7,%esi
call   1050 <reverse_bits@plt>
add    %r14d,%eax
add    $0x18,%eax
and    $0xfff0007f,%eax
xor    $0x1ea3,%r14d
imul   $0x83,%r14d,%ecx
add    %ecx,%eax
add    $0xbc55263,%eax
jmp    12e7 <keygen+0x187>
lea    0xd23(%rip),%rdi
call   1040 <puts@plt>
mov    $0xffffffff,%eax
add    $0x10,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [33 x i8] c"Invalid challenge string length\0A\00"
define i32 @keygen(i8* %0) {
%2 = alloca i32
%3 = alloca i8*
%4 = alloca [5 x i8]
%5 = alloca [8 x i8]
%6 = alloca i64
%7 = alloca i64
%8 = alloca i64
%9 = alloca i64
%10 = alloca i64
%11 = alloca i64
%12 = alloca i64
%13 = alloca i64
%14 = alloca i64
%15 = alloca i64
%16 = alloca i64
%17 = alloca i64
%18 = alloca i64
%19 = alloca i64
%20 = alloca i64
%21 = alloca i64
%22 = alloca i64
%23 = alloca i32
%24 = alloca i32
%25 = alloca i32
%26 = alloca i32
store i8* %0, i8** %3
%27 = load i8*, i8** %3
%28 = call i32 @strlen(i8* %27)
%29 = icmp ne i32 %28, 12
br i1 %29, label %30, label %32
30: ; preds = %1
%31 = call i32 @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str, i64 0, i64 0))
store i32 -1, i32* %2
br label %130
32: ; preds = %1
%33 = getelementptr inbounds [5 x i8], [5 x i8]* %4, i64 0, i64 0
%34 = load i8*, i8** %3
%35 = getelementptr inbounds i8, i8* %34, i64 1
%36 = call i32 @strncpy(i8* %33, i8* %35, i32 4)
%37 = getelementptr inbounds [5 x i8], [5 x i8]* %4, i64 0, i64 4
store i8 0, i8* %37
%38 = getelementptr inbounds [8 x i8], [8 x i8]* %5, i64 0, i64 0
%39 = load i8*, i8** %3
%40 = getelementptr inbounds i8, i8* %39, i64 5
%41 = call i32 @strncpy(i8* %38, i8* %40, i32 7)
%42 = getelementptr inbounds [8 x i8], [8 x i8]* %5, i64 0, i64 7
store i8 0, i8* %42
%43 = getelementptr inbounds [5 x i8], [5 x i8]* %4, i64 0, i64 0
%44 = call i64 @strtoul(i8* %43, i32* null, i32 10)
store i64 %44, i64* %11
%45 = getelementptr inbounds [8 x i8], [8 x i8]* %5, i64 0, i64 0
%46 = call i64 @strtoul(i8* %45, i32* null, i32 10)
store i64 %46, i64* %10
%47 = load i64, i64* %11
%48 = mul i64 %47, 63
%49 = load i64, i64* %10
%50 = xor i64 %48, %49
store i64 %50, i64* %7
%51 = load i64, i64* %7
%52 = udiv i64 %51, 259
store i64 %52, i64* %8
%53 = load i64, i64* %8
%54 = udiv i64 %53, 129
store i64 %54, i64* %9
%55 = load i64, i64* %8
%56 = urem i64 %55, 129
store i64 %56, i64* %12
%57 = load i64, i64* %11
%58 = and i64 %57, 127
store i64 %58, i64* %19
%59 = load i64, i64* %9
%60 = udiv i64 %59, 7
%61 = load i64, i64* %11
%62 = lshr i64 %61, 7
%63 = add i64 %60, %62
%64 = load i64, i64* %19
%65 = add i64 %63, %64
%66 = load i64, i64* %12
%67 = add i64 %65, %66
%68 = load i64, i64* %9
%69 = urem i64 %68, 7
%70 = add i64 %67, %69
store i64 %70, i64* %6
%71 = load i64, i64* %6
%72 = load i64, i64* %7
%73 = urem i64 %72, 259
%74 = icmp eq i64 %71, %73
%75 = zext i1 %74 to i32
%76 = sext i32 %75 to i64
store i64 %76, i64* %20
%77 = load i64, i64* %12
%78 = and i64 %77, 127
store i64 %78, i64* %21
%79 = load i64, i64* %19
%80 = and i64 %79, 255
store i64 %80, i64* %22
%81 = load i64, i64* %22
%82 = shl i64 %81, 3
%83 = and i64 %82, 255
store i64 %83, i64* %22
%84 = load i64, i64* %9
%85 = urem i64 %84, 7
%86 = and i64 %85, 255
store i64 %86, i64* %13
%87 = load i64, i64* %22
%88 = load i64, i64* %13
%89 = or i64 %87, %88
store i64 %89, i64* %14
%90 = load i64, i64* %14
%91 = and i64 %90, 7
%92 = trunc i64 %91 to i32
store i32 %92, i32* %23
%93 = load i32, i32* %23
%94 = shl i32 1, %93
%95 = sext i32 %94 to i64
store i64 %95, i64* %15
%96 = load i64, i64* %15
%97 = sub i64 %96, 1
%98 = load i64, i64* %14
%99 = lshr i64 %98, 3
%100 = and i64 %97, %99
store i64 %100, i64* %16
%101 = load i64, i64* %15
%102 = load i64, i64* %16
%103 = load i32, i32* %23
%104 = call i32 @reverse_bits(i64 %102, i32 %103)
%105 = sext i32 %104 to i64
%106 = sub i64 %101, %105
%107 = sub i64 %106, 1
store i64 %107, i64* %17
%108 = load i32, i32* %23
%109 = add nsw i32 %108, 1
%110 = sext i32 %109 to i64
store i64 %110, i64* %18
%111 = load i64, i64* %18
%112 = load i64, i64* %17
%113 = load i64, i64* %12
%114 = call i32 @get_mem_val(i64 %111, i64 %112, i64 %113)
store i32 %114, i32* %24
%115 = load i64, i64* %12
%116 = call i32 @reverse_bits(i64 %115, i32 7)
%117 = load i32, i32* %24
%118 = add nsw i32 %116, %117
%119 = add nsw i32 %118, 24
store i32 %119, i32* %25
%120 = load i32, i32* %25
%121 = load i32, i32* %25
%122 = and i32 %121, 1048448
%123 = sub nsw i32 %120, %122
%124 = load i32, i32* %24
%125 = xor i32 %124, 7843
%126 = add nsw i32 %125, 1507489
%127 = mul nsw i32 131, %126
%128 = add nsw i32 %123, %127
store i32 %128, i32* %26
%129 = load i32, i32* %26
store i32 %129, i32* %2
br label %130
130: ; preds = %32, %30
%131 = load i32, i32* %2
ret i32 %131
}

LLVM IR (-O2):
@str = [32 x i8] c"Invalid challenge string length\00"
define i32 @keygen(i8* %0) {
%2 = alloca [5 x i8]
%3 = alloca [8 x i8]
%4 = getelementptr inbounds [5 x i8], [5 x i8]* %2, i64 0, i64 0
%5 = getelementptr inbounds [8 x i8], [8 x i8]* %3, i64 0, i64 0
%6 = tail call i32 @strlen(i8* %0)
%7 = icmp eq i32 %6, 12
br i1 %7, label %10, label %8
8: ; preds = %1
%9 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @str, i64 0, i64 0))
br label %45
10: ; preds = %1
%11 = getelementptr inbounds i8, i8* %0, i64 1
%12 = call i32 @strncpy(i8* %4, i8* %11, i32 4)
%13 = getelementptr inbounds [5 x i8], [5 x i8]* %2, i64 0, i64 4
store i8 0, i8* %13
%14 = getelementptr inbounds i8, i8* %0, i64 5
%15 = call i32 @strncpy(i8* %5, i8* %14, i32 7)
%16 = getelementptr inbounds [8 x i8], [8 x i8]* %3, i64 0, i64 7
store i8 0, i8* %16
%17 = call i64 @strtoul(i8* nocapture %4, i32* null, i32 10)
%18 = call i64 @strtoul(i8* nocapture %5, i32* null, i32 10)
%19 = mul i64 %17, 63
%20 = xor i64 %19, %18
%21 = udiv i64 %20, 259
%22 = udiv i64 %20, 33411
%23 = urem i64 %21, 129
%24 = urem i64 %22, 7
%25 = and i64 %17, 31
%26 = trunc i64 %24 to i32
%27 = shl nuw nsw i32 1, %26
%28 = zext i32 %27 to i64
%29 = add nuw nsw i64 %28, 31
%30 = and i64 %25, %29
%31 = call i32 @reverse_bits(i64 %30, i32 %26)
%32 = xor i32 %31, -1
%33 = sext i32 %32 to i64
%34 = add nsw i64 %28, %33
%35 = add nuw nsw i64 %24, 1
%36 = call i32 @get_mem_val(i64 %35, i64 %34, i64 %23)
%37 = call i32 @reverse_bits(i64 %23, i32 7)
%38 = add i32 %36, 24
%39 = add i32 %38, %37
%40 = and i32 %39, -1048449
%41 = xor i32 %36, 7843
%42 = mul i32 %41, 131
%43 = add i32 %42, 197481059
%44 = add nsw i32 %43, %40
br label %45
45: ; preds = %10, %8
%46 = phi i32 [ -1, %8 ], [ %44, %10 ]
ret i32 %46
}