#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ uint8_t;

/* Variables and functions */
int /*<<< orphan*/ *asciitomac(char *);
int atoi(char *);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fillbuf(int /*<<< orphan*/ *, int);
int /*<<< orphan*/ fillstr(char *, int, char *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *);
int /*<<< orphan*/ free(int /*<<< orphan*/ *);
int /*<<< orphan*/ *getbssidfromessid(char *, char *);
int getopt(int, char **, char *);
int getrand16();
scalar_t__ malloc(int);
char *optarg;
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ sendeap(int /*<<< orphan*/ *, int /*<<< orphan*/ *, char *,
                           char *, char *);
int /*<<< orphan*/ setchannel(char *, int);
int /*<<< orphan*/ setmonitor(char *);
int /*<<< orphan*/ sleep(int);
int /*<<< orphan*/ stderr;
int /*<<< orphan*/ strtok(char *, char *);
int /*<<< orphan*/ usage(char *);
int main(int argc, char *argv[]) {
  int c;
  int seconds = 0;
  int prob = 0;
  int sleeptime;
  int channel = 0;
  char *psk = NULL;
  char *essid = NULL;
  char *intname = "mon0";
  uint8_t *bssid = NULL;
  uint8_t *supmac = NULL;
  while ((c = getopt(argc, argv, "c:k:b:e:ht:p:i")) != -1) {
    switch (c) {
    case 'b':
      bssid = asciitomac(optarg);
      if (bssid == NULL) {
        fprintf(stderr, "Can't read BSSID\n");
      }
      break;
    case 'e':
      essid = optarg;
      if (essid != NULL) {
        strtok(essid, "\n\r");
      }
      break;
    case 'k':
      psk = optarg;
      break;
    case 'c':
      channel = atoi(optarg);
      break;
    case 't':
      seconds = atoi(optarg);
      break;
    case 'p':
      seconds = atoi(optarg);
      break;
    case 'i':
      intname = optarg;
      break;
    case 'h':
      usage(argv[0]);
      exit(0);
      break;
    default:
      break;
    }
  }
  if ((bssid == NULL) && (essid == NULL)) {
    usage(argv[0]);
    exit(0);
  }
  if (channel != 0) {
    setmonitor(intname);
    setchannel(intname, channel);
  }
  if ((bssid == NULL) && (essid != NULL)) {
    bssid = getbssidfromessid(essid, intname);
  }
  if (bssid == NULL) {
    bssid = (uint8_t *)malloc(6);
    if (bssid == NULL) {
      perror("can't allocate memory");
      exit(1);
    }
    fillbuf(bssid, 6);
  }
  if (psk == NULL) {
    psk = (char *)malloc(64);
    if (psk == NULL) {
      perror("can't allocate memory");
      exit(1);
    }
    fillstr(psk, 20,
            "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890~!@"
            "#$%^&*()_+`-={}|[]:\"\\;':<>?,./");
    psk[20] = 0x00;
  } else {
    strtok(psk, "\n\r");
  }
  if (supmac == NULL) {
    supmac = (uint8_t *)malloc(6);
    if (supmac == NULL) {
      perror("can't allocate memory");
      exit(1);
    }
    fillbuf(supmac, 6);
  }
  if (seconds == 0) {
    sendeap(bssid, supmac, essid, psk, intname);
  } else {
    for (;;) {
      sendeap(bssid, supmac, essid, psk, intname);
      if (prob) {
        sleeptime = getrand16() % (seconds * 2);
      } else {
        sleeptime = seconds;
      }
      sleep(sleeptime);
    }
  }
  free(bssid);
  return (0);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x18(%rbp)
movl   $0x0,-0x1c(%rbp)
movl   $0x0,-0x24(%rbp)
movq   $0x0,-0x30(%rbp)
movq   $0x0,-0x38(%rbp)
lea    0xdea(%rip),%rax
mov    %rax,-0x40(%rbp)
movq   $0x0,-0x48(%rbp)
movq   $0x0,-0x50(%rbp)
mov    -0x8(%rbp),%edi
mov    -0x10(%rbp),%rsi
lea    0xdcd(%rip),%rdx
call   10f0 <getopt@plt>
mov    %eax,-0x14(%rbp)
cmp    $0xffffffff,%eax
je     13ac <main+0x18c>
mov    -0x14(%rbp),%eax
add    $0xffffff9e,%eax
mov    %eax,%ecx
mov    %rcx,-0x58(%rbp)
sub    $0x12,%eax
ja     13a2 <main+0x182>
mov    -0x58(%rbp),%rax
lea    0xd4b(%rip),%rcx
movslq (%rcx,%rax,4),%rax
add    %rcx,%rax
jmp    *%rax
mov    0x2d33(%rip),%rax
mov    (%rax),%rdi
call   1070 <asciitomac@plt>
mov    %rax,-0x48(%rbp)
cmpq   $0x0,-0x48(%rbp)
jne    12f1 <main+0xd1>
mov    0x2cf5(%rip),%rax
mov    (%rax),%edi
lea    0xd74(%rip),%rsi
call   1090 <fprintf@plt>
jmp    13a7 <main+0x187>
mov    0x2cfb(%rip),%rax
mov    (%rax),%rax
mov    %rax,-0x38(%rbp)
cmpq   $0x0,-0x38(%rbp)
je     131f <main+0xff>
mov    -0x38(%rbp),%rdi
lea    0xd58(%rip),%rsi
call   10e0 <strtok@plt>
jmp    13a7 <main+0x187>
mov    0x2ccd(%rip),%rax
mov    (%rax),%rax
mov    %rax,-0x30(%rbp)
jmp    13a7 <main+0x187>
mov    0x2cba(%rip),%rax
mov    (%rax),%rdi
call   1110 <atoi@plt>
mov    %eax,-0x24(%rbp)
jmp    13a7 <main+0x187>
mov    0x2ca3(%rip),%rax
mov    (%rax),%rdi
call   1110 <atoi@plt>
mov    %eax,-0x18(%rbp)
jmp    13a7 <main+0x187>
mov    0x2c8c(%rip),%rax
mov    (%rax),%rdi
call   1110 <atoi@plt>
mov    %eax,-0x18(%rbp)
jmp    13a7 <main+0x187>
mov    0x2c75(%rip),%rax
mov    (%rax),%rax
mov    %rax,-0x40(%rbp)
jmp    13a7 <main+0x187>
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
call   10c0 <usage@plt>
xor    %edi,%edi
call   1130 <exit@plt>
jmp    13a7 <main+0x187>
jmp    1276 <main+0x56>
cmpq   $0x0,-0x48(%rbp)
jne    13d5 <main+0x1b5>
cmpq   $0x0,-0x38(%rbp)
jne    13d5 <main+0x1b5>
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
call   10c0 <usage@plt>
xor    %edi,%edi
call   1130 <exit@plt>
cmpl   $0x0,-0x24(%rbp)
je     13f4 <main+0x1d4>
mov    -0x40(%rbp),%rdi
call   1060 <setmonitor@plt>
mov    -0x40(%rbp),%rdi
mov    -0x24(%rbp),%esi
call   1050 <setchannel@plt>
cmpq   $0x0,-0x48(%rbp)
jne    141b <main+0x1fb>
cmpq   $0x0,-0x38(%rbp)
je     141b <main+0x1fb>
mov    -0x38(%rbp),%rdi
mov    -0x40(%rbp),%rsi
call   1040 <getbssidfromessid@plt>
mov    %rax,-0x48(%rbp)
cmpq   $0x0,-0x48(%rbp)
jne    1463 <main+0x243>
mov    $0x6,%edi
call   10a0 <malloc@plt>
mov    %rax,-0x48(%rbp)
cmpq   $0x0,-0x48(%rbp)
jne    1455 <main+0x235>
lea    0xc2f(%rip),%rdi
call   10d0 <perror@plt>
mov    $0x1,%edi
call   1130 <exit@plt>
mov    -0x48(%rbp),%rdi
mov    $0x6,%esi
call   1080 <fillbuf@plt>
cmpq   $0x0,-0x30(%rbp)
jne    14bf <main+0x29f>
mov    $0x40,%edi
call   10a0 <malloc@plt>
mov    %rax,-0x30(%rbp)
cmpq   $0x0,-0x30(%rbp)
jne    149d <main+0x27d>
lea    0xbe7(%rip),%rdi
call   10d0 <perror@plt>
mov    $0x1,%edi
call   1130 <exit@plt>
mov    -0x30(%rbp),%rdi
mov    $0x14,%esi
lea    0xbde(%rip),%rdx
call   1120 <fillstr@plt>
mov    -0x30(%rbp),%rax
movb   $0x0,0x14(%rax)
jmp    14cf <main+0x2af>
mov    -0x30(%rbp),%rdi
lea    0xba8(%rip),%rsi
call   10e0 <strtok@plt>
cmpq   $0x0,-0x50(%rbp)
jne    1517 <main+0x2f7>
mov    $0x6,%edi
call   10a0 <malloc@plt>
mov    %rax,-0x50(%rbp)
cmpq   $0x0,-0x50(%rbp)
jne    1509 <main+0x2e9>
lea    0xb7b(%rip),%rdi
call   10d0 <perror@plt>
mov    $0x1,%edi
call   1130 <exit@plt>
mov    -0x50(%rbp),%rdi
mov    $0x6,%esi
call   1080 <fillbuf@plt>
cmpl   $0x0,-0x18(%rbp)
jne    153f <main+0x31f>
mov    -0x48(%rbp),%rdi
mov    -0x50(%rbp),%rsi
mov    -0x38(%rbp),%rdx
mov    -0x30(%rbp),%rcx
mov    -0x40(%rbp),%r8
call   10b0 <sendeap@plt>
jmp    1592 <main+0x372>
jmp    1544 <main+0x324>
mov    -0x48(%rbp),%rdi
mov    -0x50(%rbp),%rsi
mov    -0x38(%rbp),%rdx
mov    -0x30(%rbp),%rcx
mov    -0x40(%rbp),%r8
call   10b0 <sendeap@plt>
cmpl   $0x0,-0x1c(%rbp)
je     157f <main+0x35f>
mov    $0x0,%al
call   1100 <getrand16@plt>
mov    -0x18(%rbp),%ecx
shl    $0x1,%ecx
cltd
idiv   %ecx
mov    %edx,-0x20(%rbp)
jmp    1585 <main+0x365>
mov    -0x18(%rbp),%eax
mov    %eax,-0x20(%rbp)
mov    -0x20(%rbp),%edi
call   1140 <sleep@plt>
jmp    1544 <main+0x324>
mov    -0x48(%rbp),%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rsi,0x8(%rsp)
mov    %edi,0x14(%rsp)
lea    0xe1e(%rip),%r14
xor    %r12d,%r12d
movl   $0x0,0x4(%rsp)
xor    %r15d,%r15d
xor    %r13d,%r13d
jmp    1265 <main+0x55>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
mov    0x2d81(%rip),%rax
mov    (%rax),%edi
lea    0xe00(%rip),%rsi
call   1090 <fprintf@plt>
xor    %ebx,%ebx
jmp    1280 <main+0x70>
mov    0x2d88(%rip),%rax
mov    (%rax),%r15
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
mov    0x14(%rsp),%edi
mov    0x8(%rsp),%rsi
lea    0xdc1(%rip),%rdx
call   10f0 <getopt@plt>
lea    -0x62(%rax),%ecx
cmp    $0x12,%ecx
ja     1335 <main+0x125>
lea    0xd58(%rip),%rdx
movslq (%rdx,%rcx,4),%rax
add    %rdx,%rax
jmp    *%rax
mov    0x2d40(%rip),%rax
mov    (%rax),%rdi
call   1100 <atoi@plt>
mov    %eax,%r12d
jmp    1280 <main+0x70>
mov    0x2d2c(%rip),%rax
mov    (%rax),%rdi
call   1070 <asciitomac@plt>
mov    %rax,%rbx
test   %rax,%rax
jne    1280 <main+0x70>
jmp    1250 <main+0x40>
mov    0x2d10(%rip),%rax
mov    (%rax),%rdi
call   1100 <atoi@plt>
mov    %eax,0x4(%rsp)
jmp    1280 <main+0x70>
mov    0x2cfb(%rip),%rax
mov    (%rax),%rbp
mov    $0x0,%r13d
test   %rbp,%rbp
je     1280 <main+0x70>
mov    %rbp,%rdi
lea    0xd59(%rip),%rsi
call   10e0 <strtok@plt>
mov    %rbp,%r13
jmp    1280 <main+0x70>
mov    0x2ccb(%rip),%rax
mov    (%rax),%r14
jmp    1280 <main+0x70>
cmp    $0xffffffff,%eax
jne    1280 <main+0x70>
test   %rbx,%rbx
jne    134c <main+0x13c>
test   %r13,%r13
je     146b <main+0x25b>
mov    0x4(%rsp),%ebp
test   %ebp,%ebp
je     1366 <main+0x156>
mov    %r14,%rdi
call   1060 <setmonitor@plt>
mov    %r14,%rdi
mov    %ebp,%esi
call   1050 <setchannel@plt>
test   %rbx,%rbx
jne    137e <main+0x16e>
test   %r13,%r13
je     137e <main+0x16e>
mov    %r13,%rdi
mov    %r14,%rsi
call   1040 <getbssidfromessid@plt>
mov    %rax,%rbx
test   %rbx,%rbx
je     1399 <main+0x189>
test   %r15,%r15
je     13c1 <main+0x1b1>
lea    0xce3(%rip),%rsi
mov    %r15,%rdi
call   10e0 <strtok@plt>
jmp    13f0 <main+0x1e0>
mov    $0x6,%edi
call   10a0 <malloc@plt>
test   %rax,%rax
je     147f <main+0x26f>
mov    %rax,%rbx
mov    %rax,%rdi
mov    $0x6,%esi
call   1080 <fillbuf@plt>
test   %r15,%r15
jne    1388 <main+0x178>
mov    $0x40,%edi
call   10a0 <malloc@plt>
test   %rax,%rax
je     147f <main+0x26f>
mov    %rax,%r15
lea    0xcad(%rip),%rdx
mov    %rax,%rdi
mov    $0x14,%esi
call   1110 <fillstr@plt>
movb   $0x0,0x14(%r15)
mov    $0x6,%edi
call   10a0 <malloc@plt>
test   %rax,%rax
je     147f <main+0x26f>
mov    %rax,%rbp
mov    %rax,%rdi
mov    $0x6,%esi
call   1080 <fillbuf@plt>
test   %r12d,%r12d
je     143e <main+0x22e>
nopl   0x0(%rax,%rax,1)
mov    %rbx,%rdi
mov    %rbp,%rsi
mov    %r13,%rdx
mov    %r15,%rcx
mov    %r14,%r8
call   10b0 <sendeap@plt>
mov    %r12d,%edi
call   1130 <sleep@plt>
jmp    1420 <main+0x210>
mov    %rbx,%rdi
mov    %rbp,%rsi
mov    %r13,%rdx
mov    %r15,%rcx
mov    %r14,%r8
call   10b0 <sendeap@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x8(%rsp),%rax
mov    (%rax),%rdi
call   10c0 <usage@plt>
xor    %edi,%edi
call   1120 <exit@plt>
lea    0xbef(%rip),%rdi
call   10d0 <perror@plt>
mov    $0x1,%edi
call   1120 <exit@plt>

LLVM IR (-O0):
@.str = [5 x i8] c"mon0\00"
@.str.1 = [15 x i8] c"c:k:b:e:ht:p:i\00"
@optarg = global i8* null
@stderr = global i32 0
@.str.2 = [18 x i8] c"Can't read BSSID\0A\00"
@.str.3 = [3 x i8] c"\0A\0D\00"
@.str.4 = [22 x i8] c"can't allocate memory\00"
@.str.5 = [97 x i8] c"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890~!@#$%^&*()_+`-={}|[]:\22\\;':<>?,./\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca i8*
%14 = alloca i32*
%15 = alloca i32*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %7
store i32 0, i32* %8
store i32 0, i32* %10
store i8* null, i8** %11
store i8* null, i8** %12
store i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i8** %13
store i32* null, i32** %14
store i32* null, i32** %15
br label %16
16: ; preds = %60, %2
%17 = load i32, i32* %4
%18 = load i8**, i8*** %5
%19 = call i32 @getopt(i32 %17, i8** %18, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0))
store i32 %19, i32* %6
%20 = icmp ne i32 %19, -1
br i1 %20, label %21, label %61
21: ; preds = %16
%22 = load i32, i32* %6
switch i32 %22, label %59 [
i32 98, label %23
i32 101, label %32
i32 107, label %40
i32 99, label %42
i32 116, label %45
i32 112, label %48
i32 105, label %51
i32 104, label %53
]
23: ; preds = %21
%24 = load i8*, i8** @optarg
%25 = call i32* @asciitomac(i8* %24)
store i32* %25, i32** %14
%26 = load i32*, i32** %14
%27 = icmp eq i32* %26, null
br i1 %27, label %28, label %31
28: ; preds = %23
%29 = load i32, i32* @stderr
%30 = call i32 @fprintf(i32 %29, i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.2, i64 0, i64 0))
br label %31
31: ; preds = %28, %23
br label %60
32: ; preds = %21
%33 = load i8*, i8** @optarg
store i8* %33, i8** %12
%34 = load i8*, i8** %12
%35 = icmp ne i8* %34, null
br i1 %35, label %36, label %39
36: ; preds = %32
%37 = load i8*, i8** %12
%38 = call i32 @strtok(i8* %37, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0))
br label %39
39: ; preds = %36, %32
br label %60
40: ; preds = %21
%41 = load i8*, i8** @optarg
store i8* %41, i8** %11
br label %60
42: ; preds = %21
%43 = load i8*, i8** @optarg
%44 = call i32 @atoi(i8* %43)
store i32 %44, i32* %10
br label %60
45: ; preds = %21
%46 = load i8*, i8** @optarg
%47 = call i32 @atoi(i8* %46)
store i32 %47, i32* %7
br label %60
48: ; preds = %21
%49 = load i8*, i8** @optarg
%50 = call i32 @atoi(i8* %49)
store i32 %50, i32* %7
br label %60
51: ; preds = %21
%52 = load i8*, i8** @optarg
store i8* %52, i8** %13
br label %60
53: ; preds = %21
%54 = load i8**, i8*** %5
%55 = getelementptr inbounds i8*, i8** %54, i64 0
%56 = load i8*, i8** %55
%57 = call i32 @usage(i8* %56)
%58 = call i32 @exit(i32 0)
unreachable
59: ; preds = %21
br label %60
60: ; preds = %59, %51, %48, %45, %42, %40, %39, %31
br label %16
61: ; preds = %16
%62 = load i32*, i32** %14
%63 = icmp eq i32* %62, null
br i1 %63, label %64, label %73
64: ; preds = %61
%65 = load i8*, i8** %12
%66 = icmp eq i8* %65, null
br i1 %66, label %67, label %73
67: ; preds = %64
%68 = load i8**, i8*** %5
%69 = getelementptr inbounds i8*, i8** %68, i64 0
%70 = load i8*, i8** %69
%71 = call i32 @usage(i8* %70)
%72 = call i32 @exit(i32 0)
unreachable
73: ; preds = %64, %61
%74 = load i32, i32* %10
%75 = icmp ne i32 %74, 0
br i1 %75, label %76, label %82
76: ; preds = %73
%77 = load i8*, i8** %13
%78 = call i32 @setmonitor(i8* %77)
%79 = load i8*, i8** %13
%80 = load i32, i32* %10
%81 = call i32 @setchannel(i8* %79, i32 %80)
br label %82
82: ; preds = %76, %73
%83 = load i32*, i32** %14
%84 = icmp eq i32* %83, null
br i1 %84, label %85, label %92
85: ; preds = %82
%86 = load i8*, i8** %12
%87 = icmp ne i8* %86, null
br i1 %87, label %88, label %92
88: ; preds = %85
%89 = load i8*, i8** %12
%90 = load i8*, i8** %13
%91 = call i32* @getbssidfromessid(i8* %89, i8* %90)
store i32* %91, i32** %14
br label %92
92: ; preds = %88, %85, %82
%93 = load i32*, i32** %14
%94 = icmp eq i32* %93, null
br i1 %94, label %95, label %106
95: ; preds = %92
%96 = call i64 @malloc(i32 6)
%97 = inttoptr i64 %96 to i32*
store i32* %97, i32** %14
%98 = load i32*, i32** %14
%99 = icmp eq i32* %98, null
br i1 %99, label %100, label %103
100: ; preds = %95
%101 = call i32 @perror(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.4, i64 0, i64 0))
%102 = call i32 @exit(i32 1)
unreachable
103: ; preds = %95
%104 = load i32*, i32** %14
%105 = call i32 @fillbuf(i32* %104, i32 6)
br label %106
106: ; preds = %103, %92
%107 = load i8*, i8** %11
%108 = icmp eq i8* %107, null
br i1 %108, label %109, label %122
109: ; preds = %106
%110 = call i64 @malloc(i32 64)
%111 = inttoptr i64 %110 to i8*
store i8* %111, i8** %11
%112 = load i8*, i8** %11
%113 = icmp eq i8* %112, null
br i1 %113, label %114, label %117
114: ; preds = %109
%115 = call i32 @perror(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.4, i64 0, i64 0))
%116 = call i32 @exit(i32 1)
unreachable
117: ; preds = %109
%118 = load i8*, i8** %11
%119 = call i32 @fillstr(i8* %118, i32 20, i8* getelementptr inbounds ([97 x i8], [97 x i8]* @.str.5, i64 0, i64 0))
%120 = load i8*, i8** %11
%121 = getelementptr inbounds i8, i8* %120, i64 20
store i8 0, i8* %121
br label %125
122: ; preds = %106
%123 = load i8*, i8** %11
%124 = call i32 @strtok(i8* %123, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0))
br label %125
125: ; preds = %122, %117
%126 = load i32*, i32** %15
%127 = icmp eq i32* %126, null
br i1 %127, label %128, label %139
128: ; preds = %125
%129 = call i64 @malloc(i32 6)
%130 = inttoptr i64 %129 to i32*
store i32* %130, i32** %15
%131 = load i32*, i32** %15
%132 = icmp eq i32* %131, null
br i1 %132, label %133, label %136
133: ; preds = %128
%134 = call i32 @perror(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.4, i64 0, i64 0))
%135 = call i32 @exit(i32 1)
unreachable
136: ; preds = %128
%137 = load i32*, i32** %15
%138 = call i32 @fillbuf(i32* %137, i32 6)
br label %139
139: ; preds = %136, %125
%140 = load i32, i32* %7
%141 = icmp eq i32 %140, 0
br i1 %141, label %142, label %149
142: ; preds = %139
%143 = load i32*, i32** %14
%144 = load i32*, i32** %15
%145 = load i8*, i8** %12
%146 = load i8*, i8** %11
%147 = load i8*, i8** %13
%148 = call i32 @sendeap(i32* %143, i32* %144, i8* %145, i8* %146, i8* %147)
br label %169
149: ; preds = %139
br label %150
150: ; preds = %166, %149
%151 = load i32*, i32** %14
%152 = load i32*, i32** %15
%153 = load i8*, i8** %12
%154 = load i8*, i8** %11
%155 = load i8*, i8** %13
%156 = call i32 @sendeap(i32* %151, i32* %152, i8* %153, i8* %154, i8* %155)
%157 = load i32, i32* %8
%158 = icmp ne i32 %157, 0
br i1 %158, label %159, label %164
159: ; preds = %150
%160 = call i32 (...) @getrand16()
%161 = load i32, i32* %7
%162 = mul nsw i32 %161, 2
%163 = srem i32 %160, %162
store i32 %163, i32* %9
br label %166
164: ; preds = %150
%165 = load i32, i32* %7
store i32 %165, i32* %9
br label %166
166: ; preds = %164, %159
%167 = load i32, i32* %9
%168 = call i32 @sleep(i32 %167)
br label %150
169: ; preds = %142
%170 = load i32*, i32** %14
%171 = call i32 @free(i32* %170)
ret i32 0
}

LLVM IR (-O2):
@.str = [5 x i8] c"mon0\00"
@.str.1 = [15 x i8] c"c:k:b:e:ht:p:i\00"
@optarg = global i8* null
@stderr = global i32 0
@.str.2 = [18 x i8] c"Can't read BSSID\0A\00"
@.str.3 = [3 x i8] c"\0A\0D\00"
@.str.4 = [22 x i8] c"can't allocate memory\00"
@.str.5 = [97 x i8] c"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890~!@#$%^&*()_+`-={}|[]:\22\\;':<>?,./\00"
define i32 @main(i32 %0, i8** %1) {
br label %3
3: ; preds = %11, %2
%4 = phi i32 [ 0, %2 ], [ %12, %11 ]
%5 = phi i32 [ 0, %2 ], [ %13, %11 ]
%6 = phi i8* [ null, %2 ], [ %14, %11 ]
%7 = phi i8* [ null, %2 ], [ %15, %11 ]
%8 = phi i8* [ getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), %2 ], [ %16, %11 ]
%9 = phi i32* [ null, %2 ], [ %17, %11 ]
%10 = tail call i32 @getopt(i32 %0, i8** %1, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0))
switch i32 %10, label %11 [
i32 -1, label %47
i32 98, label %18
i32 101, label %25
i32 107, label %30
i32 99, label %32
i32 116, label %35
i32 112, label %38
i32 105, label %41
i32 104, label %43
]
11: ; preds = %3, %25, %28, %18, %22, %41, %38, %35, %32, %30
%12 = phi i32 [ %4, %41 ], [ %40, %38 ], [ %37, %35 ], [ %4, %32 ], [ %4, %30 ], [ %4, %28 ], [ %4, %25 ], [ %4, %22 ], [ %4, %18 ], [ %4, %3 ]
%13 = phi i32 [ %5, %41 ], [ %5, %38 ], [ %5, %35 ], [ %34, %32 ], [ %5, %30 ], [ %5, %28 ], [ %5, %25 ], [ %5, %22 ], [ %5, %18 ], [ %5, %3 ]
%14 = phi i8* [ %6, %41 ], [ %6, %38 ], [ %6, %35 ], [ %6, %32 ], [ %31, %30 ], [ %6, %28 ], [ %6, %25 ], [ %6, %22 ], [ %6, %18 ], [ %6, %3 ]
%15 = phi i8* [ %7, %41 ], [ %7, %38 ], [ %7, %35 ], [ %7, %32 ], [ %7, %30 ], [ %26, %28 ], [ null, %25 ], [ %7, %22 ], [ %7, %18 ], [ %7, %3 ]
%16 = phi i8* [ %42, %41 ], [ %8, %38 ], [ %8, %35 ], [ %8, %32 ], [ %8, %30 ], [ %8, %28 ], [ %8, %25 ], [ %8, %22 ], [ %8, %18 ], [ %8, %3 ]
%17 = phi i32* [ %9, %41 ], [ %9, %38 ], [ %9, %35 ], [ %9, %32 ], [ %9, %30 ], [ %9, %28 ], [ %9, %25 ], [ null, %22 ], [ %20, %18 ], [ %9, %3 ]
br label %3
18: ; preds = %3
%19 = load i8*, i8** @optarg
%20 = tail call i32* @asciitomac(i8* %19)
%21 = icmp eq i32* %20, null
br i1 %21, label %22, label %11
22: ; preds = %18
%23 = load i32, i32* @stderr
%24 = tail call i32 @fprintf(i32 %23, i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.2, i64 0, i64 0))
br label %11
25: ; preds = %3
%26 = load i8*, i8** @optarg
%27 = icmp eq i8* %26, null
br i1 %27, label %11, label %28
28: ; preds = %25
%29 = tail call i32 @strtok(i8* %26, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0))
br label %11
30: ; preds = %3
%31 = load i8*, i8** @optarg
br label %11
32: ; preds = %3
%33 = load i8*, i8** @optarg
%34 = tail call i32 @atoi(i8* %33)
br label %11
35: ; preds = %3
%36 = load i8*, i8** @optarg
%37 = tail call i32 @atoi(i8* %36)
br label %11
38: ; preds = %3
%39 = load i8*, i8** @optarg
%40 = tail call i32 @atoi(i8* %39)
br label %11
41: ; preds = %3
%42 = load i8*, i8** @optarg
br label %11
43: ; preds = %3
%44 = load i8*, i8** %1
%45 = tail call i32 @usage(i8* %44)
%46 = tail call i32 @exit(i32 0)
unreachable
47: ; preds = %3
%48 = icmp eq i32* %9, null
%49 = icmp eq i8* %7, null
%50 = select i1 %48, i1 %49, i1 false
br i1 %50, label %51, label %55
51: ; preds = %47
%52 = load i8*, i8** %1
%53 = tail call i32 @usage(i8* %52)
%54 = tail call i32 @exit(i32 0)
unreachable
55: ; preds = %47
%56 = icmp eq i32 %5, 0
br i1 %56, label %60, label %57
57: ; preds = %55
%58 = tail call i32 @setmonitor(i8* %8)
%59 = tail call i32 @setchannel(i8* %8, i32 %5)
br label %60
60: ; preds = %57, %55
%61 = icmp ne i8* %7, null
%62 = select i1 %48, i1 %61, i1 false
br i1 %62, label %63, label %65
63: ; preds = %60
%64 = tail call i32* @getbssidfromessid(i8* %7, i8* %8)
br label %65
65: ; preds = %63, %60
%66 = phi i32* [ %64, %63 ], [ %9, %60 ]
%67 = icmp eq i32* %66, null
br i1 %67, label %68, label %77
68: ; preds = %65
%69 = tail call i64 @malloc(i32 6)
%70 = inttoptr i64 %69 to i32*
%71 = icmp eq i64 %69, 0
br i1 %71, label %72, label %75
72: ; preds = %68
%73 = tail call i32 @perror(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.4, i64 0, i64 0))
%74 = tail call i32 @exit(i32 1)
unreachable
75: ; preds = %68
%76 = tail call i32 @fillbuf(i32* %70, i32 6)
br label %77
77: ; preds = %75, %65
%78 = phi i32* [ %70, %75 ], [ %66, %65 ]
%79 = icmp eq i8* %6, null
br i1 %79, label %80, label %90
80: ; preds = %77
%81 = tail call i64 @malloc(i32 64)
%82 = inttoptr i64 %81 to i8*
%83 = icmp eq i64 %81, 0
br i1 %83, label %84, label %87
84: ; preds = %80
%85 = tail call i32 @perror(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.4, i64 0, i64 0))
%86 = tail call i32 @exit(i32 1)
unreachable
87: ; preds = %80
%88 = tail call i32 @fillstr(i8* %82, i32 20, i8* getelementptr inbounds ([97 x i8], [97 x i8]* @.str.5, i64 0, i64 0))
%89 = getelementptr inbounds i8, i8* %82, i64 20
store i8 0, i8* %89
br label %92
90: ; preds = %77
%91 = tail call i32 @strtok(i8* %6, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0))
br label %92
92: ; preds = %87, %90
%93 = phi i8* [ %82, %87 ], [ %6, %90 ]
%94 = tail call i64 @malloc(i32 6)
%95 = inttoptr i64 %94 to i32*
%96 = icmp eq i64 %94, 0
br i1 %96, label %97, label %100
97: ; preds = %92
%98 = tail call i32 @perror(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.4, i64 0, i64 0))
%99 = tail call i32 @exit(i32 1)
unreachable
100: ; preds = %92
%101 = tail call i32 @fillbuf(i32* %95, i32 6)
%102 = icmp eq i32 %4, 0
br i1 %102, label %103, label %106
103: ; preds = %100
%104 = tail call i32 @sendeap(i32* %78, i32* %95, i8* %7, i8* %93, i8* %8)
%105 = tail call i32 @free(i32* %78)
ret i32 0
106: ; preds = %100, %106
%107 = tail call i32 @sendeap(i32* %78, i32* %95, i8* %7, i8* %93, i8* %8)
%108 = tail call i32 @sleep(i32 %4)
br label %106
}