#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ fgets(char *, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ puts(char *);
int /*<<< orphan*/ scanf(char *, char *);
int /*<<< orphan*/ sleep(int);
int /*<<< orphan*/ strlen(char *);
int /*<<< orphan*/ strncmp(char *, char *, int /*<<< orphan*/);
int /*<<< orphan*/ system(char *);
int time(int /*<<< orphan*/);
int main(void) {
  char user_password[256];
  char real_password[256];
  FILE *fp = NULL;
  fp = fopen("/home/auth/password", "rt");
  if (fp == NULL) {
    puts("fopen() error");
    return 1;
  }
  memset(real_password, 0, 256);
  fgets(real_password, 256, fp);
  printf("password: ");
  memset(user_password, 0, 256);
  scanf("%256s", user_password);
  puts("do not bruteforce...");
  sleep(time(0) % 20);
  if (!strncmp(user_password, real_password, strlen(real_password))) {
    puts("Great! Here is flag :)");
    system("/bin/cat flag");
  } else
    puts("Wrong :(");
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x230,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x218(%rbp)
lea    0xe2c(%rip),%rdi
lea    0xe39(%rip),%rsi
call   10c0 <fopen@plt>
mov    %rax,-0x218(%rbp)
cmpq   $0x0,-0x218(%rbp)
jne    120d <main+0x5d>
lea    0xe1b(%rip),%rdi
call   1040 <puts@plt>
movl   $0x1,-0x4(%rbp)
jmp    1302 <main+0x152>
lea    -0x210(%rbp),%rdi
xor    %esi,%esi
mov    $0x100,%edx
call   1080 <memset@plt>
lea    -0x210(%rbp),%rdi
mov    -0x218(%rbp),%rdx
mov    $0x100,%esi
call   1090 <fgets@plt>
lea    0xde6(%rip),%rdi
call   1070 <printf@plt>
lea    -0x110(%rbp),%rdi
xor    %esi,%esi
mov    $0x100,%edx
call   1080 <memset@plt>
lea    -0x110(%rbp),%rsi
lea    0xdcb(%rip),%rdi
call   10b0 <scanf@plt>
lea    0xdc5(%rip),%rdi
call   1040 <puts@plt>
xor    %edi,%edi
call   10a0 <time@plt>
mov    $0x14,%ecx
cltd
idiv   %ecx
mov    %edx,%edi
call   10d0 <sleep@plt>
lea    -0x110(%rbp),%rax
mov    %rax,-0x228(%rbp)
lea    -0x210(%rbp),%rax
mov    %rax,-0x220(%rbp)
lea    -0x210(%rbp),%rdi
call   1050 <strlen@plt>
mov    -0x228(%rbp),%rdi
mov    -0x220(%rbp),%rsi
mov    %eax,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%eax
jne    12ef <main+0x13f>
lea    0xd72(%rip),%rdi
call   1040 <puts@plt>
lea    0xd7d(%rip),%rdi
call   1060 <system@plt>
jmp    12fb <main+0x14b>
lea    0xd7a(%rip),%rdi
call   1040 <puts@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x230,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r14
push   %rbx
sub    $0x200,%rsp
lea    0xe3e(%rip),%rdi
lea    0xe4b(%rip),%rsi
call   10c0 <fopen@plt>
test   %rax,%rax
je     128f <main+0xdf>
mov    %rax,%rbp
mov    %rsp,%rbx
xor    %r14d,%r14d
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x100,%edx
call   1080 <memset@plt>
mov    %rbx,%rdi
mov    $0x100,%esi
mov    %rbp,%rdx
call   1090 <fgets@plt>
lea    0xe1f(%rip),%rdi
call   1070 <printf@plt>
lea    0x100(%rsp),%rbp
mov    %rbp,%rdi
xor    %esi,%esi
mov    $0x100,%edx
call   1080 <memset@plt>
lea    0xe07(%rip),%rdi
mov    %rbp,%rsi
call   10b0 <scanf@plt>
lea    0xdfe(%rip),%rdi
call   1040 <puts@plt>
xor    %edi,%edi
call   10a0 <time@plt>
movslq %eax,%rdi
imul   $0x66666667,%rdi,%rax
mov    %rax,%rcx
shr    $0x3f,%rcx
sar    $0x23,%rax
add    %ecx,%eax
shl    $0x2,%eax
lea    (%rax,%rax,4),%eax
sub    %eax,%edi
call   10d0 <sleep@plt>
mov    %rbx,%rdi
call   1050 <strlen@plt>
mov    %rbp,%rdi
mov    %rbx,%rsi
mov    %eax,%edx
call   1030 <strncmp@plt>
test   %eax,%eax
je     12a3 <main+0xf3>
lea    0xde8(%rip),%rdi
call   1040 <puts@plt>
jmp    12bb <main+0x10b>
lea    0xd81(%rip),%rdi
call   1040 <puts@plt>
mov    $0x1,%r14d
jmp    12bb <main+0x10b>
lea    0xda1(%rip),%rdi
call   1040 <puts@plt>
lea    0xdac(%rip),%rdi
call   1060 <system@plt>
mov    %r14d,%eax
add    $0x200,%rsp
pop    %rbx
pop    %r14
pop    %rbp
ret

LLVM IR (-O0):
@.str = [20 x i8] c"/home/auth/password\00"
@.str.1 = [3 x i8] c"rt\00"
@.str.2 = [14 x i8] c"fopen() error\00"
@.str.3 = [11 x i8] c"password: \00"
@.str.4 = [6 x i8] c"%256s\00"
@.str.5 = [21 x i8] c"do not bruteforce...\00"
@.str.6 = [23 x i8] c"Great! Here is flag :)\00"
@.str.7 = [14 x i8] c"/bin/cat flag\00"
@.str.8 = [9 x i8] c"Wrong :(\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [256 x i8]
%3 = alloca [256 x i8]
%4 = alloca i32*
store i32 0, i32* %1
store i32* null, i32** %4
%5 = call i32* @fopen(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
store i32* %5, i32** %4
%6 = load i32*, i32** %4
%7 = icmp eq i32* %6, null
br i1 %7, label %8, label %10
8: ; preds = %0
%9 = call i32 @puts(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0))
store i32 1, i32* %1
br label %37
10: ; preds = %0
%11 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%12 = call i32 @memset(i8* %11, i32 0, i32 256)
%13 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%14 = load i32*, i32** %4
%15 = call i32 @fgets(i8* %13, i32 256, i32* %14)
%16 = call i32 @printf(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.3, i64 0, i64 0))
%17 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%18 = call i32 @memset(i8* %17, i32 0, i32 256)
%19 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%20 = call i32 @scanf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.4, i64 0, i64 0), i8* %19)
%21 = call i32 @puts(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.5, i64 0, i64 0))
%22 = call i32 @time(i32 0)
%23 = srem i32 %22, 20
%24 = call i32 @sleep(i32 %23)
%25 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%26 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%27 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%28 = call i32 @strlen(i8* %27)
%29 = call i32 @strncmp(i8* %25, i8* %26, i32 %28)
%30 = icmp ne i32 %29, 0
br i1 %30, label %34, label %31
31: ; preds = %10
%32 = call i32 @puts(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.6, i64 0, i64 0))
%33 = call i32 @system(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.7, i64 0, i64 0))
br label %36
34: ; preds = %10
%35 = call i32 @puts(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.8, i64 0, i64 0))
br label %36
36: ; preds = %34, %31
store i32 0, i32* %1
br label %37
37: ; preds = %36, %8
%38 = load i32, i32* %1
ret i32 %38
}

LLVM IR (-O2):
@.str = [20 x i8] c"/home/auth/password\00"
@.str.1 = [3 x i8] c"rt\00"
@.str.2 = [14 x i8] c"fopen() error\00"
@.str.3 = [11 x i8] c"password: \00"
@.str.4 = [6 x i8] c"%256s\00"
@.str.5 = [21 x i8] c"do not bruteforce...\00"
@.str.6 = [23 x i8] c"Great! Here is flag :)\00"
@.str.7 = [14 x i8] c"/bin/cat flag\00"
@.str.8 = [9 x i8] c"Wrong :(\00"
define i32 @main() {
%1 = alloca [256 x i8]
%2 = alloca [256 x i8]
%3 = getelementptr inbounds [256 x i8], [256 x i8]* %1, i64 0, i64 0
%4 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%5 = tail call i32* @fopen(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%6 = icmp eq i32* %5, null
br i1 %6, label %7, label %9
7: ; preds = %0
%8 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0))
br label %27
9: ; preds = %0
%10 = call i32 @memset(i8* %4, i32 0, i32 256)
%11 = call i32 @fgets(i8* %4, i32 256, i32* %5)
%12 = call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([11 x i8], [11 x i8]* @.str.3, i64 0, i64 0))
%13 = call i32 @memset(i8* %3, i32 0, i32 256)
%14 = call i32 @scanf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.4, i64 0, i64 0), i8* %3)
%15 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @.str.5, i64 0, i64 0))
%16 = call i32 @time(i32 0)
%17 = srem i32 %16, 20
%18 = call i32 @sleep(i32 %17)
%19 = call i32 @strlen(i8* %4)
%20 = call i32 @strncmp(i8* %3, i8* %4, i32 %19)
%21 = icmp eq i32 %20, 0
br i1 %21, label %22, label %25
22: ; preds = %9
%23 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.6, i64 0, i64 0))
%24 = call i32 @system(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.7, i64 0, i64 0))
br label %27
25: ; preds = %9
%26 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.8, i64 0, i64 0))
br label %27
27: ; preds = %22, %25, %7
%28 = phi i32 [ 1, %7 ], [ 0, %25 ], [ 0, %22 ]
ret i32 %28
}