#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ md5_buffer(char *, int /*<<< orphan*/, unsigned char *);
int /*<<< orphan*/ sanei_debug_sanei_auth_call(int, char *, char const *);
int /*<<< orphan*/ sprintf(char *, char *, ...);
scalar_t__ strcmp(char const *, char const *);
int /*<<< orphan*/ strlen(char *);
scalar_t__ strncmp(char const *, char *, int);
char *strstr(char const *, char *);
int check_passwd(const char *upassword, const char *password,
                 const char *randomstring, const char *username) {
  unsigned char md5digest[16];
  char tmpstr[512];
  if (strncmp(upassword, "$MD5$", 5) == 0) {
    sprintf(tmpstr, "%s%.128s", strstr(randomstring, "$MD5$") + 5, password);
    md5_buffer(tmpstr, strlen(tmpstr), md5digest);
    sprintf(tmpstr,
            "$MD5$%02x%02x%02x%02x%02x%02x%02x%02x"
            "%02x%02x%02x%02x%02x%02x%02x%02x",
            md5digest[0], md5digest[1], md5digest[2], md5digest[3],
            md5digest[4], md5digest[5], md5digest[6], md5digest[7],
            md5digest[8], md5digest[9], md5digest[10], md5digest[11],
            md5digest[12], md5digest[13], md5digest[14], md5digest[15]);
    return (strcmp(upassword, tmpstr) == 0);
  } else {
    sanei_debug_sanei_auth_call(
        1, "check_passwd: received plain-text reply from user ``%s''\n",
        username);
    return (strcmp(upassword, password) == 0);
  }
}


x86 assembly (clang, -O0):
<check_passwd>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x2b8,%rsp
mov    %rdi,-0x38(%rbp)
mov    %rsi,-0x40(%rbp)
mov    %rdx,-0x48(%rbp)
mov    %rcx,-0x50(%rbp)
mov    -0x38(%rbp),%rdi
lea    0xe61(%rip),%rsi
mov    $0x5,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%rax
jne    1303 <check_passwd+0x193>
lea    -0x260(%rbp),%rax
mov    %rax,-0x280(%rbp)
mov    -0x48(%rbp),%rdi
lea    0xe34(%rip),%rsi
call   1090 <strstr@plt>
mov    -0x280(%rbp),%rdi
mov    %rax,%rdx
add    $0x5,%rdx
mov    -0x40(%rbp),%rcx
lea    0xe1c(%rip),%rsi
mov    $0x0,%al
call   1080 <sprintf@plt>
lea    -0x260(%rbp),%rax
mov    %rax,-0x278(%rbp)
lea    -0x260(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x278(%rbp),%rdi
mov    %eax,%esi
lea    -0x60(%rbp),%rdx
call   1060 <md5_buffer@plt>
lea    -0x260(%rbp),%rdi
movzbl -0x60(%rbp),%edx
movzbl -0x5f(%rbp),%ecx
movzbl -0x5e(%rbp),%r8d
movzbl -0x5d(%rbp),%r9d
movzbl -0x5c(%rbp),%eax
movzbl -0x5b(%rbp),%esi
mov    %esi,-0x270(%rbp)
movzbl -0x5a(%rbp),%esi
mov    %esi,-0x26c(%rbp)
movzbl -0x59(%rbp),%esi
mov    %esi,-0x268(%rbp)
movzbl -0x58(%rbp),%r13d
movzbl -0x57(%rbp),%r12d
movzbl -0x56(%rbp),%r15d
movzbl -0x55(%rbp),%r14d
movzbl -0x54(%rbp),%ebx
movzbl -0x53(%rbp),%r11d
movzbl -0x52(%rbp),%r10d
movzbl -0x51(%rbp),%esi
mov    %esi,-0x264(%rbp)
lea    0xd84(%rip),%rsi
mov    %eax,(%rsp)
mov    -0x270(%rbp),%eax
mov    %eax,0x8(%rsp)
mov    -0x26c(%rbp),%eax
mov    %eax,0x10(%rsp)
mov    -0x268(%rbp),%eax
mov    %eax,0x18(%rsp)
mov    -0x264(%rbp),%eax
mov    %r13d,0x20(%rsp)
mov    %r12d,0x28(%rsp)
mov    %r15d,0x30(%rsp)
mov    %r14d,0x38(%rsp)
mov    %ebx,0x40(%rsp)
mov    %r11d,0x48(%rsp)
mov    %r10d,0x50(%rsp)
mov    %eax,0x58(%rsp)
mov    $0x0,%al
call   1080 <sprintf@plt>
mov    -0x38(%rbp),%rdi
lea    -0x260(%rbp),%rsi
call   1050 <strcmp@plt>
cmp    $0x0,%rax
sete   %al
and    $0x1,%al
movzbl %al,%eax
mov    %eax,-0x2c(%rbp)
jmp    1334 <check_passwd+0x1c4>
mov    -0x50(%rbp),%rdx
mov    $0x1,%edi
lea    0xd42(%rip),%rsi
call   1070 <sanei_debug_sanei_auth_call@plt>
mov    -0x38(%rbp),%rdi
mov    -0x40(%rbp),%rsi
call   1050 <strcmp@plt>
cmp    $0x0,%rax
sete   %al
and    $0x1,%al
movzbl %al,%eax
mov    %eax,-0x2c(%rbp)
mov    -0x2c(%rbp),%eax
add    $0x2b8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

x86 assembly (clang, -O2):
<check_passwd>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x248,%rsp
mov    %rcx,%rbx
mov    %rdx,%r14
mov    %rsi,%r12
mov    %rdi,%r15
lea    0xe6c(%rip),%rsi
mov    $0x5,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
je     11c2 <check_passwd+0x52>
lea    0xeab(%rip),%rsi
mov    $0x1,%edi
mov    %rbx,%rdx
call   1070 <sanei_debug_sanei_auth_call@plt>
mov    %r15,%rdi
mov    %r12,%rsi
jmp    12b7 <check_passwd+0x147>
lea    0xe37(%rip),%rsi
mov    %r14,%rdi
call   1090 <strstr@plt>
lea    0x5(%rax),%rdx
lea    0xe2a(%rip),%rsi
lea    0x40(%rsp),%rbx
mov    %rbx,%rdi
mov    %r12,%rcx
xor    %eax,%eax
call   1080 <sprintf@plt>
mov    %rbx,%rdi
call   1040 <strlen@plt>
mov    %rsp,%rdx
mov    %rbx,%rdi
mov    %eax,%esi
call   1060 <md5_buffer@plt>
movzbl (%rsp),%edx
movzbl 0x1(%rsp),%ecx
movzbl 0x2(%rsp),%r8d
movzbl 0x3(%rsp),%r9d
movzbl 0x4(%rsp),%eax
mov    %rax,0x38(%rsp)
movzbl 0x5(%rsp),%eax
mov    %rax,0x30(%rsp)
movzbl 0x6(%rsp),%eax
mov    %rax,0x28(%rsp)
movzbl 0x7(%rsp),%eax
mov    %rax,0x20(%rsp)
movzbl 0x8(%rsp),%eax
mov    %rax,0x18(%rsp)
movzbl 0x9(%rsp),%ebp
movzbl 0xa(%rsp),%r10d
movzbl 0xb(%rsp),%r11d
movzbl 0xc(%rsp),%r14d
movzbl 0xd(%rsp),%r12d
movzbl 0xe(%rsp),%r13d
movzbl 0xf(%rsp),%ebx
lea    0xd96(%rip),%rsi
lea    0x40(%rsp),%rdi
xor    %eax,%eax
push   %rbx
push   %r13
push   %r12
push   %r14
push   %r11
push   %r10
push   %rbp
push   0x50(%rsp)
push   0x60(%rsp)
push   0x70(%rsp)
push   0x80(%rsp)
push   0x90(%rsp)
call   1080 <sprintf@plt>
add    $0x60,%rsp
mov    %r15,%rdi
lea    0x40(%rsp),%rsi
call   1050 <strcmp@plt>
xor    %ecx,%ecx
test   %rax,%rax
sete   %cl
mov    %ecx,%eax
add    $0x248,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [6 x i8] c"$MD5$\00"
@.str.1 = [9 x i8] c"%s%.128s\00"
@.str.2 = [70 x i8] c"$MD5$%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\00"
@.str.3 = [58 x i8] c"check_passwd: received plain-text reply from user ``%s''\0A\00"
define i32 @check_passwd(i8* %0, i8* %1, i8* %2, i8* %3) {
%5 = alloca i32
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca [16 x i8]
%11 = alloca [512 x i8]
store i8* %0, i8** %6
store i8* %1, i8** %7
store i8* %2, i8** %8
store i8* %3, i8** %9
%12 = load i8*, i8** %6
%13 = call i64 @strncmp(i8* %12, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i32 5)
%14 = icmp eq i64 %13, 0
br i1 %14, label %15, label %82
15: ; preds = %4
%16 = getelementptr inbounds [512 x i8], [512 x i8]* %11, i64 0, i64 0
%17 = load i8*, i8** %8
%18 = call i8* @strstr(i8* %17, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
%19 = getelementptr inbounds i8, i8* %18, i64 5
%20 = load i8*, i8** %7
%21 = call i32 (i8*, i8*, ...) @sprintf(i8* %16, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i8* %19, i8* %20)
%22 = getelementptr inbounds [512 x i8], [512 x i8]* %11, i64 0, i64 0
%23 = getelementptr inbounds [512 x i8], [512 x i8]* %11, i64 0, i64 0
%24 = call i32 @strlen(i8* %23)
%25 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 0
%26 = call i32 @md5_buffer(i8* %22, i32 %24, i8* %25)
%27 = getelementptr inbounds [512 x i8], [512 x i8]* %11, i64 0, i64 0
%28 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 0
%29 = load i8, i8* %28
%30 = zext i8 %29 to i32
%31 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 1
%32 = load i8, i8* %31
%33 = zext i8 %32 to i32
%34 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 2
%35 = load i8, i8* %34
%36 = zext i8 %35 to i32
%37 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 3
%38 = load i8, i8* %37
%39 = zext i8 %38 to i32
%40 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 4
%41 = load i8, i8* %40
%42 = zext i8 %41 to i32
%43 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 5
%44 = load i8, i8* %43
%45 = zext i8 %44 to i32
%46 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 6
%47 = load i8, i8* %46
%48 = zext i8 %47 to i32
%49 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 7
%50 = load i8, i8* %49
%51 = zext i8 %50 to i32
%52 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 8
%53 = load i8, i8* %52
%54 = zext i8 %53 to i32
%55 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 9
%56 = load i8, i8* %55
%57 = zext i8 %56 to i32
%58 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 10
%59 = load i8, i8* %58
%60 = zext i8 %59 to i32
%61 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 11
%62 = load i8, i8* %61
%63 = zext i8 %62 to i32
%64 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 12
%65 = load i8, i8* %64
%66 = zext i8 %65 to i32
%67 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 13
%68 = load i8, i8* %67
%69 = zext i8 %68 to i32
%70 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 14
%71 = load i8, i8* %70
%72 = zext i8 %71 to i32
%73 = getelementptr inbounds [16 x i8], [16 x i8]* %10, i64 0, i64 15
%74 = load i8, i8* %73
%75 = zext i8 %74 to i32
%76 = call i32 (i8*, i8*, ...) @sprintf(i8* %27, i8* getelementptr inbounds ([70 x i8], [70 x i8]* @.str.2, i64 0, i64 0), i32 %30, i32 %33, i32 %36, i32 %39, i32 %42, i32 %45, i32 %48, i32 %51, i32 %54, i32 %57, i32 %60, i32 %63, i32 %66, i32 %69, i32 %72, i32 %75)
%77 = load i8*, i8** %6
%78 = getelementptr inbounds [512 x i8], [512 x i8]* %11, i64 0, i64 0
%79 = call i64 @strcmp(i8* %77, i8* %78)
%80 = icmp eq i64 %79, 0
%81 = zext i1 %80 to i32
store i32 %81, i32* %5
br label %90
82: ; preds = %4
%83 = load i8*, i8** %9
%84 = call i32 @sanei_debug_sanei_auth_call(i32 1, i8* getelementptr inbounds ([58 x i8], [58 x i8]* @.str.3, i64 0, i64 0), i8* %83)
%85 = load i8*, i8** %6
%86 = load i8*, i8** %7
%87 = call i64 @strcmp(i8* %85, i8* %86)
%88 = icmp eq i64 %87, 0
%89 = zext i1 %88 to i32
store i32 %89, i32* %5
br label %90
90: ; preds = %82, %15
%91 = load i32, i32* %5
ret i32 %91
}

LLVM IR (-O2):
@.str = [6 x i8] c"$MD5$\00"
@.str.1 = [9 x i8] c"%s%.128s\00"
@.str.2 = [70 x i8] c"$MD5$%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\00"
@.str.3 = [58 x i8] c"check_passwd: received plain-text reply from user ``%s''\0A\00"
define i32 @check_passwd(i8* %0, i8* %1, i8* %2, i8* %3) {
%5 = alloca [16 x i8]
%6 = alloca [512 x i8]
%7 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 0
%8 = getelementptr inbounds [512 x i8], [512 x i8]* %6, i64 0, i64 0
%9 = tail call i64 @strncmp(i8* %0, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i32 5)
%10 = icmp eq i64 %9, 0
br i1 %10, label %11, label %66
11: ; preds = %4
%12 = tail call i8* @strstr(i8* dereferenceable(1) %2, i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
%13 = getelementptr inbounds i8, i8* %12, i64 5
%14 = call i32 (i8*, i8*, ...) @sprintf(i8* %8, i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i8* %13, i8* %1)
%15 = call i32 @strlen(i8* %8)
%16 = call i32 @md5_buffer(i8* %8, i32 %15, i8* %7)
%17 = load i8, i8* %7
%18 = zext i8 %17 to i32
%19 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 1
%20 = load i8, i8* %19
%21 = zext i8 %20 to i32
%22 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 2
%23 = load i8, i8* %22
%24 = zext i8 %23 to i32
%25 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 3
%26 = load i8, i8* %25
%27 = zext i8 %26 to i32
%28 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 4
%29 = load i8, i8* %28
%30 = zext i8 %29 to i32
%31 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 5
%32 = load i8, i8* %31
%33 = zext i8 %32 to i32
%34 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 6
%35 = load i8, i8* %34
%36 = zext i8 %35 to i32
%37 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 7
%38 = load i8, i8* %37
%39 = zext i8 %38 to i32
%40 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 8
%41 = load i8, i8* %40
%42 = zext i8 %41 to i32
%43 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 9
%44 = load i8, i8* %43
%45 = zext i8 %44 to i32
%46 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 10
%47 = load i8, i8* %46
%48 = zext i8 %47 to i32
%49 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 11
%50 = load i8, i8* %49
%51 = zext i8 %50 to i32
%52 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 12
%53 = load i8, i8* %52
%54 = zext i8 %53 to i32
%55 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 13
%56 = load i8, i8* %55
%57 = zext i8 %56 to i32
%58 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 14
%59 = load i8, i8* %58
%60 = zext i8 %59 to i32
%61 = getelementptr inbounds [16 x i8], [16 x i8]* %5, i64 0, i64 15
%62 = load i8, i8* %61
%63 = zext i8 %62 to i32
%64 = call i32 (i8*, i8*, ...) @sprintf(i8* %8, i8* dereferenceable(1) getelementptr inbounds ([70 x i8], [70 x i8]* @.str.2, i64 0, i64 0), i32 %18, i32 %21, i32 %24, i32 %27, i32 %30, i32 %33, i32 %36, i32 %39, i32 %42, i32 %45, i32 %48, i32 %51, i32 %54, i32 %57, i32 %60, i32 %63)
%65 = call i64 @strcmp(i8* %0, i8* %8)
br label %69
66: ; preds = %4
%67 = tail call i32 @sanei_debug_sanei_auth_call(i32 1, i8* getelementptr inbounds ([58 x i8], [58 x i8]* @.str.3, i64 0, i64 0), i8* %3)
%68 = tail call i64 @strcmp(i8* %0, i8* %1)
br label %69
69: ; preds = %66, %11
%70 = phi i64 [ %65, %11 ], [ %68, %66 ]
%71 = icmp eq i64 %70, 0
%72 = zext i1 %71 to i32
ret i32 %72
}