#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ crypt(char *, char *);
int /*<<< orphan*/ printf(char *, ...);
scalar_t__ strcmp(int /*<<< orphan*/, char *);
scalar_t__ strlen(char const *);
int main(int argc, char *argv[]) {
  if (argc != 2) {
    printf("Usage: ./crack hash\n");
    return 1;
  }
  const char alphabet[] =
      "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
  char word[5] = {0};
  int alphabet_len = (int)strlen(alphabet);
  for (int i = 0; i < alphabet_len; ++i) {
    for (int j = 0; j < alphabet_len; ++j) {
      for (int k = 0; k < alphabet_len; ++k) {
        for (int l = 0; l < alphabet_len; ++l) {
          if (strcmp(crypt(word, "50"), argv[1]) == 0) {
            goto exit_loop;
          }
          word[0] = alphabet[l];
        }
        word[1] = alphabet[k];
      }
      word[2] = alphabet[j];
    }
    word[3] = alphabet[i];
  }
exit_loop:;
  printf("%s\n", word);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
cmpl   $0x2,-0x8(%rbp)
je     119a <main+0x3a>
lea    0xe79(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    12c7 <main+0x167>
lea    -0x50(%rbp),%rdi
lea    0xe7b(%rip),%rsi
mov    $0x35,%edx
call   1080 <memcpy@plt>
lea    -0x55(%rbp),%rdi
xor    %esi,%esi
mov    $0x5,%edx
call   1060 <memset@plt>
lea    -0x50(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x5c(%rbp)
movl   $0x0,-0x60(%rbp)
mov    -0x60(%rbp),%eax
cmp    -0x5c(%rbp),%eax
jge    12a9 <main+0x149>
movl   $0x0,-0x64(%rbp)
mov    -0x64(%rbp),%eax
cmp    -0x5c(%rbp),%eax
jge    1290 <main+0x130>
movl   $0x0,-0x68(%rbp)
mov    -0x68(%rbp),%eax
cmp    -0x5c(%rbp),%eax
jge    1277 <main+0x117>
movl   $0x0,-0x6c(%rbp)
mov    -0x6c(%rbp),%eax
cmp    -0x5c(%rbp),%eax
jge    125e <main+0xfe>
lea    -0x55(%rbp),%rdi
lea    0xdf3(%rip),%rsi
call   1030 <crypt@plt>
mov    %eax,%edi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rsi
call   1070 <strcmp@plt>
cmp    $0x0,%rax
jne    1245 <main+0xe5>
jmp    12ae <main+0x14e>
movslq -0x6c(%rbp),%rax
mov    -0x50(%rbp,%rax,1),%al
mov    %al,-0x55(%rbp)
mov    -0x6c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x6c(%rbp)
jmp    120b <main+0xab>
movslq -0x68(%rbp),%rax
mov    -0x50(%rbp,%rax,1),%al
mov    %al,-0x54(%rbp)
mov    -0x68(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x68(%rbp)
jmp    11f8 <main+0x98>
movslq -0x64(%rbp),%rax
mov    -0x50(%rbp,%rax,1),%al
mov    %al,-0x53(%rbp)
mov    -0x64(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x64(%rbp)
jmp    11e5 <main+0x85>
movslq -0x60(%rbp),%rax
mov    -0x50(%rbp,%rax,1),%al
mov    %al,-0x52(%rbp)
mov    -0x60(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x60(%rbp)
jmp    11d2 <main+0x72>
jmp    12ae <main+0x14e>
lea    -0x55(%rbp),%rsi
lea    0xd5f(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
cmp    $0x2,%edi
jne    1206 <main+0xd6>
mov    %rsi,%rbx
movb   $0x0,0x4(%rsp)
movl   $0x0,(%rsp)
xor    %eax,%eax
mov    %rax,0x8(%rsp)
lea    0xed1(%rip),%r14
mov    %rsp,%r15
lea    0xe92(%rip),%r13
xor    %ecx,%ecx
mov    %rcx,0x10(%rsp)
xor    %r12d,%r12d
xor    %ebp,%ebp
nopw   0x0(%rax,%rax,1)
mov    %r15,%rdi
mov    %r14,%rsi
call   1040 <crypt@plt>
mov    0x8(%rbx),%rsi
mov    %eax,%edi
call   1050 <strcmp@plt>
test   %rax,%rax
je     11fa <main+0xca>
movzbl 0x0(%rbp,%r13,1),%eax
mov    %al,(%rsp)
add    $0x1,%rbp
cmp    $0x34,%rbp
jne    1180 <main+0x50>
mov    (%r12,%r13,1),%al
mov    %al,0x1(%rsp)
add    $0x1,%r12
cmp    $0x34,%r12
jne    1178 <main+0x48>
mov    0x10(%rsp),%rcx
mov    (%rcx,%r13,1),%al
mov    %al,0x2(%rsp)
add    $0x1,%rcx
cmp    $0x34,%rcx
jne    1170 <main+0x40>
mov    0x8(%rsp),%rcx
mov    (%rcx,%r13,1),%al
mov    %al,0x3(%rsp)
add    $0x1,%rcx
mov    %rcx,%rax
mov    %rcx,0x8(%rsp)
cmp    $0x34,%rcx
jne    116e <main+0x3e>
mov    %rsp,%rdi
call   1030 <puts@plt>
xor    %eax,%eax
jmp    1217 <main+0xe7>
lea    0xe2b(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [21 x i8] c"Usage: ./crack hash\0A\00"
@__const.main.alphabet = [53 x i8] c"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz\00"
@.str.1 = [3 x i8] c"50\00"
@.str.2 = [4 x i8] c"%s\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca [53 x i8]
%7 = alloca [5 x i8]
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%13 = load i32, i32* %4
%14 = icmp ne i32 %13, 2
br i1 %14, label %15, label %17
15: ; preds = %2
%16 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str, i64 0, i64 0))
store i32 1, i32* %3
br label %91
17: ; preds = %2
%18 = bitcast [53 x i8]* %6 to i8*
%19 = bitcast [5 x i8]* %7 to i8*
%20 = getelementptr inbounds [53 x i8], [53 x i8]* %6, i64 0, i64 0
%21 = call i64 @strlen(i8* %20)
%22 = trunc i64 %21 to i32
store i32 %22, i32* %8
store i32 0, i32* %9
br label %23
23: ; preds = %84, %17
%24 = load i32, i32* %9
%25 = load i32, i32* %8
%26 = icmp slt i32 %24, %25
br i1 %26, label %27, label %87
27: ; preds = %23
store i32 0, i32* %10
br label %28
28: ; preds = %75, %27
%29 = load i32, i32* %10
%30 = load i32, i32* %8
%31 = icmp slt i32 %29, %30
br i1 %31, label %32, label %78
32: ; preds = %28
store i32 0, i32* %11
br label %33
33: ; preds = %66, %32
%34 = load i32, i32* %11
%35 = load i32, i32* %8
%36 = icmp slt i32 %34, %35
br i1 %36, label %37, label %69
37: ; preds = %33
store i32 0, i32* %12
br label %38
38: ; preds = %57, %37
%39 = load i32, i32* %12
%40 = load i32, i32* %8
%41 = icmp slt i32 %39, %40
br i1 %41, label %42, label %60
42: ; preds = %38
%43 = getelementptr inbounds [5 x i8], [5 x i8]* %7, i64 0, i64 0
%44 = call i32 @crypt(i8* %43, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%45 = load i8**, i8*** %5
%46 = getelementptr inbounds i8*, i8** %45, i64 1
%47 = load i8*, i8** %46
%48 = call i64 @strcmp(i32 %44, i8* %47)
%49 = icmp eq i64 %48, 0
br i1 %49, label %50, label %51
50: ; preds = %42
br label %88
51: ; preds = %42
%52 = load i32, i32* %12
%53 = sext i32 %52 to i64
%54 = getelementptr inbounds [53 x i8], [53 x i8]* %6, i64 0, i64 %53
%55 = load i8, i8* %54
%56 = getelementptr inbounds [5 x i8], [5 x i8]* %7, i64 0, i64 0
store i8 %55, i8* %56
br label %57
57: ; preds = %51
%58 = load i32, i32* %12
%59 = add nsw i32 %58, 1
store i32 %59, i32* %12
br label %38
60: ; preds = %38
%61 = load i32, i32* %11
%62 = sext i32 %61 to i64
%63 = getelementptr inbounds [53 x i8], [53 x i8]* %6, i64 0, i64 %62
%64 = load i8, i8* %63
%65 = getelementptr inbounds [5 x i8], [5 x i8]* %7, i64 0, i64 1
store i8 %64, i8* %65
br label %66
66: ; preds = %60
%67 = load i32, i32* %11
%68 = add nsw i32 %67, 1
store i32 %68, i32* %11
br label %33
69: ; preds = %33
%70 = load i32, i32* %10
%71 = sext i32 %70 to i64
%72 = getelementptr inbounds [53 x i8], [53 x i8]* %6, i64 0, i64 %71
%73 = load i8, i8* %72
%74 = getelementptr inbounds [5 x i8], [5 x i8]* %7, i64 0, i64 2
store i8 %73, i8* %74
br label %75
75: ; preds = %69
%76 = load i32, i32* %10
%77 = add nsw i32 %76, 1
store i32 %77, i32* %10
br label %28
78: ; preds = %28
%79 = load i32, i32* %9
%80 = sext i32 %79 to i64
%81 = getelementptr inbounds [53 x i8], [53 x i8]* %6, i64 0, i64 %80
%82 = load i8, i8* %81
%83 = getelementptr inbounds [5 x i8], [5 x i8]* %7, i64 0, i64 3
store i8 %82, i8* %83
br label %84
84: ; preds = %78
%85 = load i32, i32* %9
%86 = add nsw i32 %85, 1
store i32 %86, i32* %9
br label %23
87: ; preds = %23
br label %88
88: ; preds = %87, %50
%89 = getelementptr inbounds [5 x i8], [5 x i8]* %7, i64 0, i64 0
%90 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0), i8* %89)
store i32 0, i32* %3
br label %91
91: ; preds = %88, %15
%92 = load i32, i32* %3
ret i32 %92
}

LLVM IR (-O2):
@__const.main.alphabet = [53 x i8] c"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz\00"
@.str.1 = [3 x i8] c"50\00"
@str = [20 x i8] c"Usage: ./crack hash\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [5 x i8]
%4 = icmp eq i32 %0, 2
br i1 %4, label %7, label %5
5: ; preds = %2
%6 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @str, i64 0, i64 0))
br label %47
7: ; preds = %2
%8 = getelementptr inbounds [5 x i8], [5 x i8]* %3, i64 0, i64 0
%9 = getelementptr inbounds i8*, i8** %1, i64 1
%10 = getelementptr inbounds [5 x i8], [5 x i8]* %3, i64 0, i64 1
%11 = getelementptr inbounds [5 x i8], [5 x i8]* %3, i64 0, i64 2
%12 = getelementptr inbounds [5 x i8], [5 x i8]* %3, i64 0, i64 3
br label %13
13: ; preds = %7, %40
%14 = phi i64 [ 0, %7 ], [ %43, %40 ]
br label %15
15: ; preds = %13, %35
%16 = phi i64 [ 0, %13 ], [ %38, %35 ]
br label %17
17: ; preds = %15, %30
%18 = phi i64 [ 0, %15 ], [ %33, %30 ]
br label %19
19: ; preds = %17, %25
%20 = phi i64 [ 0, %17 ], [ %28, %25 ]
%21 = call i32 @crypt(i8* %8, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%22 = load i8*, i8** %9
%23 = call i64 @strcmp(i32 %21, i8* %22)
%24 = icmp eq i64 %23, 0
br i1 %24, label %45, label %25
25: ; preds = %19
%26 = getelementptr inbounds [53 x i8], [53 x i8]* @__const.main.alphabet, i64 0, i64 %20
%27 = load i8, i8* %26
store i8 %27, i8* %8
%28 = add nuw nsw i64 %20, 1
%29 = icmp eq i64 %28, 52
br i1 %29, label %30, label %19
30: ; preds = %25
%31 = getelementptr inbounds [53 x i8], [53 x i8]* @__const.main.alphabet, i64 0, i64 %18
%32 = load i8, i8* %31
store i8 %32, i8* %10
%33 = add nuw nsw i64 %18, 1
%34 = icmp eq i64 %33, 52
br i1 %34, label %35, label %17
35: ; preds = %30
%36 = getelementptr inbounds [53 x i8], [53 x i8]* @__const.main.alphabet, i64 0, i64 %16
%37 = load i8, i8* %36
store i8 %37, i8* %11
%38 = add nuw nsw i64 %16, 1
%39 = icmp eq i64 %38, 52
br i1 %39, label %40, label %15
40: ; preds = %35
%41 = getelementptr inbounds [53 x i8], [53 x i8]* @__const.main.alphabet, i64 0, i64 %14
%42 = load i8, i8* %41
store i8 %42, i8* %12
%43 = add nuw nsw i64 %14, 1
%44 = icmp eq i64 %43, 52
br i1 %44, label %45, label %13
45: ; preds = %40, %19
%46 = call i32 @puts(i8* %8)
br label %47
47: ; preds = %45, %5
%48 = phi i32 [ 1, %5 ], [ 0, %45 ]
ret i32 %48
}