#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ HMAC_SHA1(unsigned char *, int, unsigned char *, int,
                             unsigned char *, int);
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char *, int);
scalar_t__ strlen(char *);
void F(char *password, unsigned char *ssid, int ssidlength, int iterations,
       int count, unsigned char *output) {
  unsigned char digest[36], digest1[20];
  int i, j;
  memcpy(digest, ssid, ssidlength);
  digest[ssidlength] = (unsigned char)((count >> 24) & 0xff);
  digest[ssidlength + 1] = (unsigned char)((count >> 16) & 0xff);
  digest[ssidlength + 2] = (unsigned char)((count >> 8) & 0xff);
  digest[ssidlength + 3] = (unsigned char)(count & 0xff);
  HMAC_SHA1((unsigned char *)password, (int)strlen(password), digest,
            ssidlength + 4, digest1, 20);
  memcpy(output, digest1, 20);
  for (i = 1; i < iterations; i++) {
    HMAC_SHA1((unsigned char *)password, (int)strlen(password), digest1, 20,
              digest, 20);
    memcpy(digest1, digest, 20);
    for (j = 0; j < 20; j++) {
      output[j] ^= digest[j];
    }
  }
}


x86 assembly (clang, -O0):
<F>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %edx,-0x14(%rbp)
mov    %ecx,-0x18(%rbp)
mov    %r8d,-0x1c(%rbp)
mov    %r9,-0x28(%rbp)
lea    -0x50(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x14(%rbp),%edx
call   1040 <memcpy@plt>
mov    -0x1c(%rbp),%eax
sar    $0x18,%eax
and    $0xff,%eax
mov    %al,%cl
movslq -0x14(%rbp),%rax
mov    %cl,-0x50(%rbp,%rax,1)
mov    -0x1c(%rbp),%eax
sar    $0x10,%eax
and    $0xff,%eax
mov    %al,%cl
mov    -0x14(%rbp),%eax
add    $0x1,%eax
cltq
mov    %cl,-0x50(%rbp,%rax,1)
mov    -0x1c(%rbp),%eax
sar    $0x8,%eax
and    $0xff,%eax
mov    %al,%cl
mov    -0x14(%rbp),%eax
add    $0x2,%eax
cltq
mov    %cl,-0x50(%rbp,%rax,1)
mov    -0x1c(%rbp),%eax
and    $0xff,%eax
mov    %al,%cl
mov    -0x14(%rbp),%eax
add    $0x3,%eax
cltq
mov    %cl,-0x50(%rbp,%rax,1)
mov    -0x8(%rbp),%rax
mov    %rax,-0x80(%rbp)
mov    -0x8(%rbp),%rdi
call   1030 <strlen@plt>
mov    -0x80(%rbp),%rdi
mov    %eax,%esi
lea    -0x50(%rbp),%rdx
mov    -0x14(%rbp),%ecx
add    $0x4,%ecx
lea    -0x70(%rbp),%r8
mov    $0x14,%r9d
call   1050 <HMAC_SHA1@plt>
mov    -0x28(%rbp),%rdi
lea    -0x70(%rbp),%rsi
mov    $0x14,%edx
call   1040 <memcpy@plt>
movl   $0x1,-0x74(%rbp)
mov    -0x74(%rbp),%eax
cmp    -0x18(%rbp),%eax
jge    12a4 <F+0x174>
mov    -0x8(%rbp),%rax
mov    %rax,-0x88(%rbp)
mov    -0x8(%rbp),%rdi
call   1030 <strlen@plt>
mov    -0x88(%rbp),%rdi
mov    %eax,%esi
lea    -0x70(%rbp),%rdx
lea    -0x50(%rbp),%r8
mov    $0x14,%r9d
mov    %r9d,%ecx
call   1050 <HMAC_SHA1@plt>
lea    -0x70(%rbp),%rdi
lea    -0x50(%rbp),%rsi
mov    $0x14,%edx
call   1040 <memcpy@plt>
movl   $0x0,-0x78(%rbp)
cmpl   $0x14,-0x78(%rbp)
jge    1291 <F+0x161>
movslq -0x78(%rbp),%rax
movzbl -0x50(%rbp,%rax,1),%esi
mov    -0x28(%rbp),%rax
movslq -0x78(%rbp),%rcx
movzbl (%rax,%rcx,1),%edx
xor    %esi,%edx
mov    %dl,(%rax,%rcx,1)
mov    -0x78(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x78(%rbp)
jmp    125f <F+0x12f>
jmp    1296 <F+0x166>
mov    -0x74(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x74(%rbp)
jmp    1207 <F+0xd7>
add    $0x90,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<F>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x48,%rsp
mov    %r9,%rbx
mov    %r8d,%r15d
mov    %ecx,%ebp
mov    %edx,%r12d
mov    %rdi,%r14
mov    %rsp,%r13
mov    %r13,%rdi
call   1040 <memcpy@plt>
movslq %r12d,%r12
bswap  %r15d
mov    %r15d,(%rsp,%r12,1)
mov    %r14,%rdi
call   1030 <strlen@plt>
add    $0x4,%r12d
lea    0x30(%rsp),%r15
mov    %r14,%rdi
mov    %eax,%esi
mov    %r13,%rdx
mov    %r12d,%ecx
mov    %r15,%r8
mov    $0x14,%r9d
call   1050 <HMAC_SHA1@plt>
mov    %rbx,%rdi
mov    %r15,%rsi
mov    $0x14,%edx
call   1040 <memcpy@plt>
cmp    $0x2,%ebp
jl     1212 <F+0xe2>
add    $0xffffffff,%ebp
lea    0x30(%rsp),%r15
mov    %rsp,%r12
nopl   0x0(%rax,%rax,1)
mov    %r14,%rdi
call   1030 <strlen@plt>
mov    %r14,%rdi
mov    %eax,%esi
mov    %r15,%rdx
mov    $0x14,%ecx
mov    %r12,%r8
mov    $0x14,%r9d
call   1050 <HMAC_SHA1@plt>
mov    %r15,%rdi
mov    %r12,%rsi
mov    $0x14,%edx
call   1040 <memcpy@plt>
movups (%rbx),%xmm0
xorps  (%rsp),%xmm0
movups %xmm0,(%rbx)
movzbl 0x10(%rsp),%eax
xor    %al,0x10(%rbx)
movzbl 0x11(%rsp),%eax
xor    %al,0x11(%rbx)
movzbl 0x12(%rsp),%eax
xor    %al,0x12(%rbx)
movzbl 0x13(%rsp),%eax
xor    %al,0x13(%rbx)
add    $0xffffffff,%ebp
jne    11b0 <F+0x80>
add    $0x48,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define void @F(i8* %0, i8* %1, i32 %2, i32 %3, i32 %4, i8* %5) {
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca i8*
%13 = alloca [36 x i8]
%14 = alloca [20 x i8]
%15 = alloca i32
%16 = alloca i32
store i8* %0, i8** %7
store i8* %1, i8** %8
store i32 %2, i32* %9
store i32 %3, i32* %10
store i32 %4, i32* %11
store i8* %5, i8** %12
%17 = getelementptr inbounds [36 x i8], [36 x i8]* %13, i64 0, i64 0
%18 = load i8*, i8** %8
%19 = load i32, i32* %9
%20 = call i32 @memcpy(i8* %17, i8* %18, i32 %19)
%21 = load i32, i32* %11
%22 = ashr i32 %21, 24
%23 = and i32 %22, 255
%24 = trunc i32 %23 to i8
%25 = load i32, i32* %9
%26 = sext i32 %25 to i64
%27 = getelementptr inbounds [36 x i8], [36 x i8]* %13, i64 0, i64 %26
store i8 %24, i8* %27
%28 = load i32, i32* %11
%29 = ashr i32 %28, 16
%30 = and i32 %29, 255
%31 = trunc i32 %30 to i8
%32 = load i32, i32* %9
%33 = add nsw i32 %32, 1
%34 = sext i32 %33 to i64
%35 = getelementptr inbounds [36 x i8], [36 x i8]* %13, i64 0, i64 %34
store i8 %31, i8* %35
%36 = load i32, i32* %11
%37 = ashr i32 %36, 8
%38 = and i32 %37, 255
%39 = trunc i32 %38 to i8
%40 = load i32, i32* %9
%41 = add nsw i32 %40, 2
%42 = sext i32 %41 to i64
%43 = getelementptr inbounds [36 x i8], [36 x i8]* %13, i64 0, i64 %42
store i8 %39, i8* %43
%44 = load i32, i32* %11
%45 = and i32 %44, 255
%46 = trunc i32 %45 to i8
%47 = load i32, i32* %9
%48 = add nsw i32 %47, 3
%49 = sext i32 %48 to i64
%50 = getelementptr inbounds [36 x i8], [36 x i8]* %13, i64 0, i64 %49
store i8 %46, i8* %50
%51 = load i8*, i8** %7
%52 = load i8*, i8** %7
%53 = call i64 @strlen(i8* %52)
%54 = trunc i64 %53 to i32
%55 = getelementptr inbounds [36 x i8], [36 x i8]* %13, i64 0, i64 0
%56 = load i32, i32* %9
%57 = add nsw i32 %56, 4
%58 = getelementptr inbounds [20 x i8], [20 x i8]* %14, i64 0, i64 0
%59 = call i32 @HMAC_SHA1(i8* %51, i32 %54, i8* %55, i32 %57, i8* %58, i32 20)
%60 = load i8*, i8** %12
%61 = getelementptr inbounds [20 x i8], [20 x i8]* %14, i64 0, i64 0
%62 = call i32 @memcpy(i8* %60, i8* %61, i32 20)
store i32 1, i32* %15
br label %63
63: ; preds = %99, %6
%64 = load i32, i32* %15
%65 = load i32, i32* %10
%66 = icmp slt i32 %64, %65
br i1 %66, label %67, label %102
67: ; preds = %63
%68 = load i8*, i8** %7
%69 = load i8*, i8** %7
%70 = call i64 @strlen(i8* %69)
%71 = trunc i64 %70 to i32
%72 = getelementptr inbounds [20 x i8], [20 x i8]* %14, i64 0, i64 0
%73 = getelementptr inbounds [36 x i8], [36 x i8]* %13, i64 0, i64 0
%74 = call i32 @HMAC_SHA1(i8* %68, i32 %71, i8* %72, i32 20, i8* %73, i32 20)
%75 = getelementptr inbounds [20 x i8], [20 x i8]* %14, i64 0, i64 0
%76 = getelementptr inbounds [36 x i8], [36 x i8]* %13, i64 0, i64 0
%77 = call i32 @memcpy(i8* %75, i8* %76, i32 20)
store i32 0, i32* %16
br label %78
78: ; preds = %95, %67
%79 = load i32, i32* %16
%80 = icmp slt i32 %79, 20
br i1 %80, label %81, label %98
81: ; preds = %78
%82 = load i32, i32* %16
%83 = sext i32 %82 to i64
%84 = getelementptr inbounds [36 x i8], [36 x i8]* %13, i64 0, i64 %83
%85 = load i8, i8* %84
%86 = zext i8 %85 to i32
%87 = load i8*, i8** %12
%88 = load i32, i32* %16
%89 = sext i32 %88 to i64
%90 = getelementptr inbounds i8, i8* %87, i64 %89
%91 = load i8, i8* %90
%92 = zext i8 %91 to i32
%93 = xor i32 %92, %86
%94 = trunc i32 %93 to i8
store i8 %94, i8* %90
br label %95
95: ; preds = %81
%96 = load i32, i32* %16
%97 = add nsw i32 %96, 1
store i32 %97, i32* %16
br label %78
98: ; preds = %78
br label %99
99: ; preds = %98
%100 = load i32, i32* %15
%101 = add nsw i32 %100, 1
store i32 %101, i32* %15
br label %63
102: ; preds = %63
ret void
}

LLVM IR (-O2):
define void @F(i8* %0, i8* %1, i32 %2, i32 %3, i32 %4, i8* %5) {
%7 = alloca [36 x i8]
%8 = alloca [20 x i8]
%9 = getelementptr inbounds [36 x i8], [36 x i8]* %7, i64 0, i64 0
%10 = getelementptr inbounds [20 x i8], [20 x i8]* %8, i64 0, i64 0
%11 = call i32 @memcpy(i8* %9, i8* %1, i32 %2)
%12 = lshr i32 %4, 24
%13 = trunc i32 %12 to i8
%14 = sext i32 %2 to i64
%15 = getelementptr inbounds [36 x i8], [36 x i8]* %7, i64 0, i64 %14
store i8 %13, i8* %15
%16 = lshr i32 %4, 16
%17 = trunc i32 %16 to i8
%18 = add nsw i32 %2, 1
%19 = sext i32 %18 to i64
%20 = getelementptr inbounds [36 x i8], [36 x i8]* %7, i64 0, i64 %19
store i8 %17, i8* %20
%21 = lshr i32 %4, 8
%22 = trunc i32 %21 to i8
%23 = add nsw i32 %2, 2
%24 = sext i32 %23 to i64
%25 = getelementptr inbounds [36 x i8], [36 x i8]* %7, i64 0, i64 %24
store i8 %22, i8* %25
%26 = trunc i32 %4 to i8
%27 = add nsw i32 %2, 3
%28 = sext i32 %27 to i64
%29 = getelementptr inbounds [36 x i8], [36 x i8]* %7, i64 0, i64 %28
store i8 %26, i8* %29
%30 = call i64 @strlen(i8* dereferenceable(1) %0)
%31 = trunc i64 %30 to i32
%32 = add nsw i32 %2, 4
%33 = call i32 @HMAC_SHA1(i8* %0, i32 %31, i8* %9, i32 %32, i8* %10, i32 20)
%34 = call i32 @memcpy(i8* %5, i8* %10, i32 20)
%35 = icmp sgt i32 %3, 1
br i1 %35, label %36, label %71
36: ; preds = %6
%37 = getelementptr inbounds [36 x i8], [36 x i8]* %7, i64 0, i64 16
%38 = getelementptr inbounds i8, i8* %5, i64 16
%39 = getelementptr inbounds [36 x i8], [36 x i8]* %7, i64 0, i64 17
%40 = getelementptr inbounds i8, i8* %5, i64 17
%41 = getelementptr inbounds [36 x i8], [36 x i8]* %7, i64 0, i64 18
%42 = getelementptr inbounds i8, i8* %5, i64 18
%43 = getelementptr inbounds [36 x i8], [36 x i8]* %7, i64 0, i64 19
%44 = getelementptr inbounds i8, i8* %5, i64 19
%45 = bitcast [36 x i8]* %7 to <16 x i8>*
%46 = bitcast i8* %5 to <16 x i8>*
%47 = bitcast i8* %5 to <16 x i8>*
br label %48
48: ; preds = %36, %48
%49 = phi i32 [ %69, %48 ], [ 1, %36 ]
%50 = call i64 @strlen(i8* dereferenceable(1) %0)
%51 = trunc i64 %50 to i32
%52 = call i32 @HMAC_SHA1(i8* %0, i32 %51, i8* %10, i32 20, i8* %9, i32 20)
%53 = call i32 @memcpy(i8* %10, i8* %9, i32 20)
%54 = load <16 x i8>, <16 x i8>* %45
%55 = load <16 x i8>, <16 x i8>* %46
%56 = xor <16 x i8> %55, %54
store <16 x i8> %56, <16 x i8>* %47
%57 = load i8, i8* %37
%58 = load i8, i8* %38
%59 = xor i8 %58, %57
store i8 %59, i8* %38
%60 = load i8, i8* %39
%61 = load i8, i8* %40
%62 = xor i8 %61, %60
store i8 %62, i8* %40
%63 = load i8, i8* %41
%64 = load i8, i8* %42
%65 = xor i8 %64, %63
store i8 %65, i8* %42
%66 = load i8, i8* %43
%67 = load i8, i8* %44
%68 = xor i8 %67, %66
store i8 %68, i8* %44
%69 = add nuw nsw i32 %49, 1
%70 = icmp eq i32 %69, %3
br i1 %70, label %71, label %48
71: ; preds = %48, %6
ret void
}