#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(char *);
char *malloc(unsigned int);
int /*<<< orphan*/ printf(char *, char);
int /*<<< orphan*/ putchar(char);
unsigned int strlen(char *);
void main(int argc, char *argv[]) {
  char *str[] = {
      "First Letter down as user: User - FLAG(1)=\"I\"\n",
      "Second Letter down as userid: Root - FLAG(2)=\"Wrote\"\n",
      "Third Letter down as userid: Administrator - FLAG(3)=\"A\"\n",
      "Now you are getting some place - FLAG(4)=\"Kernel\"\n",
      "Back to user: User? - FLAG(5)=\"With\"\n",
      "Oh I get it, its a loop - FLAG(6)=\"A\"\n",
      "But where did the UIDs come from? - FLAG(7)=\"Shell\"\n",
      "Windows and Unix? - FLAG(8)=\"What've\"\n",
      "So close I can almost taste it - FLAG(9)=\"You\"\n",
      "Last of the flags - FLAG(10)=\"Done?\"\n",
  };
  char *enc;
  char *key = "cocksucker";
  unsigned int i = 0;
  unsigned int j = 0;
  int uid[3] = {100, 0, 500};
  for (i = 0; i < 10; i++) {
    enc = malloc(strlen(str[i]));
    for (j = 0; j <= strlen(str[i]); j++) {
      enc[j] = str[i][j] ^ key[i] ^ (uid[i % 3] + 96);
      printf("\\x%02x", enc[j] & 0xff);
    }
    free(enc);
    putchar('\n');
  }
  return;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
mov    %edi,-0x4(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x60(%rbp),%rdi
lea    0x2c53(%rip),%rsi
mov    $0x50,%edx
call   1070 <memcpy@plt>
lea    0x1043(%rip),%rax
mov    %rax,-0x70(%rbp)
movl   $0x0,-0x74(%rbp)
movl   $0x0,-0x78(%rbp)
mov    0x103d(%rip),%rax
mov    %rax,-0x84(%rbp)
mov    0x1038(%rip),%eax
mov    %eax,-0x7c(%rbp)
movl   $0x0,-0x74(%rbp)
cmpl   $0xa,-0x74(%rbp)
jae    12a9 <main+0x149>
mov    -0x74(%rbp),%eax
mov    -0x60(%rbp,%rax,8),%rdi
call   1050 <strlen@plt>
mov    %eax,%edi
call   1080 <malloc@plt>
mov    %rax,-0x68(%rbp)
movl   $0x0,-0x78(%rbp)
mov    -0x78(%rbp),%eax
mov    %eax,-0x88(%rbp)
mov    -0x74(%rbp),%eax
mov    -0x60(%rbp,%rax,8),%rdi
call   1050 <strlen@plt>
mov    %eax,%ecx
mov    -0x88(%rbp),%eax
cmp    %ecx,%eax
ja     1288 <main+0x128>
mov    -0x74(%rbp),%eax
mov    -0x60(%rbp,%rax,8),%rax
mov    -0x78(%rbp),%ecx
movsbl (%rax,%rcx,1),%eax
mov    -0x70(%rbp),%rcx
mov    -0x74(%rbp),%edx
movsbl (%rcx,%rdx,1),%ecx
xor    %ecx,%eax
mov    %eax,-0x8c(%rbp)
mov    -0x74(%rbp),%eax
mov    $0x3,%ecx
xor    %edx,%edx
div    %ecx
mov    -0x8c(%rbp),%eax
mov    %edx,%ecx
mov    -0x84(%rbp,%rcx,4),%ecx
add    $0x60,%ecx
xor    %ecx,%eax
mov    %al,%dl
mov    -0x68(%rbp),%rax
mov    -0x78(%rbp),%ecx
mov    %dl,(%rax,%rcx,1)
mov    -0x68(%rbp),%rax
mov    -0x78(%rbp),%ecx
movsbl (%rax,%rcx,1),%eax
and    $0xff,%eax
lea    0xf6a(%rip),%rdi
movsbl %al,%esi
call   1060 <printf@plt>
mov    -0x78(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x78(%rbp)
jmp    11e7 <main+0x87>
mov    -0x68(%rbp),%rdi
call   1030 <free@plt>
mov    $0xa,%edi
call   1040 <putchar@plt>
mov    -0x74(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x74(%rbp)
jmp    11be <main+0x5e>
add    $0x90,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
xor    %ebp,%ebp
lea    0x1078(%rip),%r14
cs nopw 0x0(%rax,%rax,1)
xchg   %ax,%ax
lea    0x2c59(%rip),%rax
mov    (%rax,%rbp,8),%rbx
mov    %rbx,%rdi
call   1050 <strlen@plt>
mov    %eax,%edi
call   1070 <malloc@plt>
mov    %rax,%r15
mov    %rbx,%rdi
call   1050 <strlen@plt>
lea    0x1035(%rip),%rax
mov    0x0(%rbp,%rax,1),%r13b
mov    %ebp,%eax
mov    $0xaaaaaaab,%ecx
imul   %rcx,%rax
shr    $0x21,%rax
lea    (%rax,%rax,2),%eax
mov    %rbp,(%rsp)
mov    %ebp,%ecx
sub    %eax,%ecx
lea    0x1022(%rip),%rax
mov    (%rax,%rcx,4),%bpl
add    $0x60,%bpl
xor    %r12d,%r12d
nopl   (%rax)
mov    %r12d,%eax
movzbl (%rbx,%rax,1),%ecx
xor    %r13b,%cl
xor    %bpl,%cl
mov    %cl,(%r15,%rax,1)
movsbl %cl,%esi
mov    %r14,%rdi
call   1060 <printf@plt>
add    $0x1,%r12d
mov    %rbx,%rdi
call   1050 <strlen@plt>
cmp    %eax,%r12d
jbe    11d0 <main+0x80>
mov    %r15,%rdi
call   1030 <free@plt>
mov    $0xa,%edi
call   1040 <putchar@plt>
mov    (%rsp),%rbp
add    $0x1,%rbp
cmp    $0xa,%rbp
jne    1170 <main+0x20>
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [47 x i8] c"First Letter down as user: User - FLAG(1)=\22I\22\0A\00"
@.str.1 = [54 x i8] c"Second Letter down as userid: Root - FLAG(2)=\22Wrote\22\0A\00"
@.str.2 = [58 x i8] c"Third Letter down as userid: Administrator - FLAG(3)=\22A\22\0A\00"
@.str.3 = [51 x i8] c"Now you are getting some place - FLAG(4)=\22Kernel\22\0A\00"
@.str.4 = [38 x i8] c"Back to user: User? - FLAG(5)=\22With\22\0A\00"
@.str.5 = [39 x i8] c"Oh I get it, its a loop - FLAG(6)=\22A\22\0A\00"
@.str.6 = [53 x i8] c"But where did the UIDs come from? - FLAG(7)=\22Shell\22\0A\00"
@.str.7 = [39 x i8] c"Windows and Unix? - FLAG(8)=\22What've\22\0A\00"
@.str.8 = [48 x i8] c"So close I can almost taste it - FLAG(9)=\22You\22\0A\00"
@.str.9 = [38 x i8] c"Last of the flags - FLAG(10)=\22Done?\22\0A\00"
@__const.main.str = [10 x i8*] [i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str, i32 0, i32 0), i8* getelementptr inbounds ([54 x i8], [54 x i8]* @.str.1, i32 0, i32 0), i8* getelementptr inbounds ([58 x i8], [58 x i8]* @.str.2, i32 0, i32 0), i8* getelementptr inbounds ([51 x i8], [51 x i8]* @.str.3, i32 0, i32 0), i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.4, i32 0, i32 0), i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.5, i32 0, i32 0), i8* getelementptr inbounds ([53 x i8], [53 x i8]* @.str.6, i32 0, i32 0), i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.7, i32 0, i32 0), i8* getelementptr inbounds ([48 x i8], [48 x i8]* @.str.8, i32 0, i32 0), i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.9, i32 0, i32 0)]
@.str.10 = [11 x i8] c"cocksucker\00"
@__const.main.uid = [3 x i32] [i32 100, i32 0, i32 500]
@.str.11 = [7 x i8] c"\\x%02x\00"
define void @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i8**
%5 = alloca [10 x i8*]
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i32
%9 = alloca i32
%10 = alloca [3 x i32]
store i32 %0, i32* %3
store i8** %1, i8*** %4
%11 = bitcast [10 x i8*]* %5 to i8*
store i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.10, i64 0, i64 0), i8** %7
store i32 0, i32* %8
store i32 0, i32* %9
%12 = bitcast [3 x i32]* %10 to i8*
store i32 0, i32* %8
br label %13
13: ; preds = %76, %2
%14 = load i32, i32* %8
%15 = icmp ult i32 %14, 10
br i1 %15, label %16, label %79
16: ; preds = %13
%17 = load i32, i32* %8
%18 = zext i32 %17 to i64
%19 = getelementptr inbounds [10 x i8*], [10 x i8*]* %5, i64 0, i64 %18
%20 = load i8*, i8** %19
%21 = call i32 @strlen(i8* %20)
%22 = call i8* @malloc(i32 %21)
store i8* %22, i8** %6
store i32 0, i32* %9
br label %23
23: ; preds = %69, %16
%24 = load i32, i32* %9
%25 = load i32, i32* %8
%26 = zext i32 %25 to i64
%27 = getelementptr inbounds [10 x i8*], [10 x i8*]* %5, i64 0, i64 %26
%28 = load i8*, i8** %27
%29 = call i32 @strlen(i8* %28)
%30 = icmp ule i32 %24, %29
br i1 %30, label %31, label %72
31: ; preds = %23
%32 = load i32, i32* %8
%33 = zext i32 %32 to i64
%34 = getelementptr inbounds [10 x i8*], [10 x i8*]* %5, i64 0, i64 %33
%35 = load i8*, i8** %34
%36 = load i32, i32* %9
%37 = zext i32 %36 to i64
%38 = getelementptr inbounds i8, i8* %35, i64 %37
%39 = load i8, i8* %38
%40 = sext i8 %39 to i32
%41 = load i8*, i8** %7
%42 = load i32, i32* %8
%43 = zext i32 %42 to i64
%44 = getelementptr inbounds i8, i8* %41, i64 %43
%45 = load i8, i8* %44
%46 = sext i8 %45 to i32
%47 = xor i32 %40, %46
%48 = load i32, i32* %8
%49 = urem i32 %48, 3
%50 = zext i32 %49 to i64
%51 = getelementptr inbounds [3 x i32], [3 x i32]* %10, i64 0, i64 %50
%52 = load i32, i32* %51
%53 = add nsw i32 %52, 96
%54 = xor i32 %47, %53
%55 = trunc i32 %54 to i8
%56 = load i8*, i8** %6
%57 = load i32, i32* %9
%58 = zext i32 %57 to i64
%59 = getelementptr inbounds i8, i8* %56, i64 %58
store i8 %55, i8* %59
%60 = load i8*, i8** %6
%61 = load i32, i32* %9
%62 = zext i32 %61 to i64
%63 = getelementptr inbounds i8, i8* %60, i64 %62
%64 = load i8, i8* %63
%65 = sext i8 %64 to i32
%66 = and i32 %65, 255
%67 = trunc i32 %66 to i8
%68 = call i32 @printf(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.11, i64 0, i64 0), i8 signext %67)
br label %69
69: ; preds = %31
%70 = load i32, i32* %9
%71 = add i32 %70, 1
store i32 %71, i32* %9
br label %23
72: ; preds = %23
%73 = load i8*, i8** %6
%74 = call i32 @free(i8* %73)
%75 = call i32 @putchar(i8 signext 10)
br label %76
76: ; preds = %72
%77 = load i32, i32* %8
%78 = add i32 %77, 1
store i32 %78, i32* %8
br label %13
79: ; preds = %13
ret void
}

LLVM IR (-O2):
@.str = [47 x i8] c"First Letter down as user: User - FLAG(1)=\22I\22\0A\00"
@.str.1 = [54 x i8] c"Second Letter down as userid: Root - FLAG(2)=\22Wrote\22\0A\00"
@.str.2 = [58 x i8] c"Third Letter down as userid: Administrator - FLAG(3)=\22A\22\0A\00"
@.str.3 = [51 x i8] c"Now you are getting some place - FLAG(4)=\22Kernel\22\0A\00"
@.str.4 = [38 x i8] c"Back to user: User? - FLAG(5)=\22With\22\0A\00"
@.str.5 = [39 x i8] c"Oh I get it, its a loop - FLAG(6)=\22A\22\0A\00"
@.str.6 = [53 x i8] c"But where did the UIDs come from? - FLAG(7)=\22Shell\22\0A\00"
@.str.7 = [39 x i8] c"Windows and Unix? - FLAG(8)=\22What've\22\0A\00"
@.str.8 = [48 x i8] c"So close I can almost taste it - FLAG(9)=\22You\22\0A\00"
@.str.9 = [38 x i8] c"Last of the flags - FLAG(10)=\22Done?\22\0A\00"
@__const.main.str = [10 x i8*] [i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str, i32 0, i32 0), i8* getelementptr inbounds ([54 x i8], [54 x i8]* @.str.1, i32 0, i32 0), i8* getelementptr inbounds ([58 x i8], [58 x i8]* @.str.2, i32 0, i32 0), i8* getelementptr inbounds ([51 x i8], [51 x i8]* @.str.3, i32 0, i32 0), i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.4, i32 0, i32 0), i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.5, i32 0, i32 0), i8* getelementptr inbounds ([53 x i8], [53 x i8]* @.str.6, i32 0, i32 0), i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.7, i32 0, i32 0), i8* getelementptr inbounds ([48 x i8], [48 x i8]* @.str.8, i32 0, i32 0), i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.9, i32 0, i32 0)]
@.str.10 = [11 x i8] c"cocksucker\00"
@__const.main.uid = [3 x i32] [i32 100, i32 0, i32 500]
@.str.11 = [7 x i8] c"\\x%02x\00"
define void @main(i32 %0, i8** nocapture readnone %1) {
br label %3
3: ; preds = %2, %31
%4 = phi i64 [ 0, %2 ], [ %34, %31 ]
%5 = getelementptr inbounds [10 x i8*], [10 x i8*]* @__const.main.str, i64 0, i64 %4
%6 = load i8*, i8** %5
%7 = tail call i32 @strlen(i8* %6)
%8 = tail call i8* @malloc(i32 %7)
%9 = tail call i32 @strlen(i8* %6)
%10 = getelementptr inbounds [11 x i8], [11 x i8]* @.str.10, i64 0, i64 %4
%11 = load i8, i8* %10
%12 = trunc i64 %4 to i32
%13 = urem i32 %12, 3
%14 = zext i32 %13 to i64
%15 = getelementptr inbounds [3 x i32], [3 x i32]* @__const.main.uid, i64 0, i64 %14
%16 = load i32, i32* %15
%17 = trunc i32 %16 to i8
%18 = add i8 %17, 96
br label %19
19: ; preds = %3, %19
%20 = phi i32 [ 0, %3 ], [ %28, %19 ]
%21 = zext i32 %20 to i64
%22 = getelementptr inbounds i8, i8* %6, i64 %21
%23 = load i8, i8* %22
%24 = xor i8 %11, %23
%25 = xor i8 %24, %18
%26 = getelementptr inbounds i8, i8* %8, i64 %21
store i8 %25, i8* %26
%27 = tail call i32 @printf(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.11, i64 0, i64 0), i8 signext %25)
%28 = add i32 %20, 1
%29 = tail call i32 @strlen(i8* %6)
%30 = icmp ugt i32 %28, %29
br i1 %30, label %31, label %19
31: ; preds = %19
%32 = tail call i32 @free(i8* %8)
%33 = tail call i32 @putchar(i8 signext 10)
%34 = add nuw nsw i64 %4, 1
%35 = icmp eq i64 %34, 10
br i1 %35, label %36, label %3
36: ; preds = %31
ret void
}