#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ printf(char *, int);
int /*<<< orphan*/ sprintf(char *, char *, int);
int system(char *);
int main() {
  int ret;
  char comm[15];
  int pass = 0;
  for (pass = 1000; pass < 10000; pass++) {
    sprintf(comm, "./hack %d", pass);
    ret = system(comm);
    if (ret == 0)
      break;
  }
  printf("password is %d \n", pass);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0x0,-0x1c(%rbp)
movl   $0x3e8,-0x1c(%rbp)
cmpl   $0x2710,-0x1c(%rbp)
jge    119b <main+0x6b>
lea    -0x17(%rbp),%rdi
mov    -0x1c(%rbp),%edx
lea    0xe98(%rip),%rsi
call   1050 <sprintf@plt>
lea    -0x17(%rbp),%rdi
call   1030 <system@plt>
mov    %eax,-0x8(%rbp)
cmpl   $0x0,-0x8(%rbp)
jne    1188 <main+0x58>
jmp    119b <main+0x6b>
jmp    118d <main+0x5d>
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    114d <main+0x1d>
mov    -0x1c(%rbp),%esi
lea    0xe65(%rip),%rdi
call   1040 <printf@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %rbx
sub    $0x10,%rsp
mov    $0x3e8,%ebx
lea    0xebb(%rip),%r14
lea    0x1(%rsp),%r15
nopw   0x0(%rax,%rax,1)
mov    %r15,%rdi
mov    %r14,%rsi
mov    %ebx,%edx
call   1050 <sprintf@plt>
mov    %r15,%rdi
call   1030 <system@plt>
test   %eax,%eax
je     1179 <main+0x49>
add    $0x1,%ebx
cmp    $0x2710,%ebx
jne    1150 <main+0x20>
mov    $0x2710,%ebx
lea    0xe8a(%rip),%rdi
mov    %ebx,%esi
call   1040 <printf@plt>
xor    %eax,%eax
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [10 x i8] c"./hack %d\00"
@.str.1 = [17 x i8] c"password is %d \0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca [15 x i8]
%4 = alloca i32
store i32 0, i32* %1
store i32 0, i32* %4
store i32 1000, i32* %4
br label %5
5: ; preds = %18, %0
%6 = load i32, i32* %4
%7 = icmp slt i32 %6, 10000
br i1 %7, label %8, label %21
8: ; preds = %5
%9 = getelementptr inbounds [15 x i8], [15 x i8]* %3, i64 0, i64 0
%10 = load i32, i32* %4
%11 = call i32 @sprintf(i8* %9, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 %10)
%12 = getelementptr inbounds [15 x i8], [15 x i8]* %3, i64 0, i64 0
%13 = call i32 @system(i8* %12)
store i32 %13, i32* %2
%14 = load i32, i32* %2
%15 = icmp eq i32 %14, 0
br i1 %15, label %16, label %17
16: ; preds = %8
br label %21
17: ; preds = %8
br label %18
18: ; preds = %17
%19 = load i32, i32* %4
%20 = add nsw i32 %19, 1
store i32 %20, i32* %4
br label %5
21: ; preds = %16, %5
%22 = load i32, i32* %4
%23 = call i32 @printf(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.1, i64 0, i64 0), i32 %22)
ret i32 0
}

LLVM IR (-O2):
@.str = [10 x i8] c"./hack %d\00"
@.str.1 = [17 x i8] c"password is %d \0A\00"
define i32 @main() {
%1 = alloca [15 x i8]
%2 = getelementptr inbounds [15 x i8], [15 x i8]* %1, i64 0, i64 0
br label %3
3: ; preds = %0, %8
%4 = phi i32 [ 1000, %0 ], [ %9, %8 ]
%5 = call i32 @sprintf(i8* %2, i8* dereferenceable(1) getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 %4)
%6 = call i32 @system(i8* %2)
%7 = icmp eq i32 %6, 0
br i1 %7, label %11, label %8
8: ; preds = %3
%9 = add nuw nsw i32 %4, 1
%10 = icmp eq i32 %9, 10000
br i1 %10, label %11, label %3
11: ; preds = %3, %8
%12 = phi i32 [ %4, %3 ], [ 10000, %8 ]
%13 = tail call i32 @printf(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.1, i64 0, i64 0), i32 %12)
ret i32 0
}