#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef size_t uint32_t;

/* Variables and functions */
size_t strlen(char *);
int /*<<< orphan*/ strncmp(char *, char *, size_t);
const char *find_firmware_key(const unsigned char *buffer, size_t len) {
  char szkey1[] = "34d1";
  size_t cchkey1 = strlen(szkey1);
  char szkey2[] = "TbnCboEbn";
  size_t cchkey2 = strlen(szkey2);
  uint32_t i;
  for (i = 0; i < (uint32_t)len; i++) {
    if (len >= cchkey1) {
      if (!strncmp((char *)&buffer[i], szkey1, cchkey1))
        return (const char *)&buffer[i];
    }
    if (len >= cchkey2) {
      if (!strncmp((char *)&buffer[i], szkey2, cchkey2))
        return (const char *)&buffer[i];
    }
  }
  return NULL;
}


x86 assembly (clang, -O0):
<find_firmware_key>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    0xeca(%rip),%eax
mov    %eax,-0x1d(%rbp)
mov    0xec5(%rip),%al
mov    %al,-0x19(%rbp)
lea    -0x1d(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,-0x28(%rbp)
mov    0xeaf(%rip),%rax
mov    %rax,-0x32(%rbp)
mov    0xeac(%rip),%ax
mov    %ax,-0x2a(%rbp)
lea    -0x32(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,-0x40(%rbp)
movq   $0x0,-0x48(%rbp)
mov    -0x48(%rbp),%rax
cmp    -0x18(%rbp),%rax
jae    1222 <find_firmware_key+0x102>
mov    -0x18(%rbp),%rax
cmp    -0x28(%rbp),%rax
jb     11ca <find_firmware_key+0xaa>
mov    -0x10(%rbp),%rdi
add    -0x48(%rbp),%rdi
lea    -0x1d(%rbp),%rsi
mov    -0x28(%rbp),%rdx
call   1030 <strncmp@plt>
cmp    $0x0,%eax
jne    11c5 <find_firmware_key+0xa5>
mov    -0x10(%rbp),%rax
add    -0x48(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    122a <find_firmware_key+0x10a>
jmp    11ca <find_firmware_key+0xaa>
mov    -0x18(%rbp),%rax
cmp    -0x40(%rbp),%rax
jb     120c <find_firmware_key+0xec>
mov    -0x10(%rbp),%rdi
add    -0x48(%rbp),%rdi
lea    -0x32(%rbp),%rsi
mov    -0x40(%rbp),%rdx
call   1030 <strncmp@plt>
cmp    $0x0,%eax
jne    1207 <find_firmware_key+0xe7>
mov    -0x10(%rbp),%rax
add    -0x48(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    122a <find_firmware_key+0x10a>
jmp    120c <find_firmware_key+0xec>
jmp    1211 <find_firmware_key+0xf1>
mov    -0x48(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x48(%rbp)
jmp    117a <find_firmware_key+0x5a>
movq   $0x0,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<find_firmware_key>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
test   %rsi,%rsi
je     118b <find_firmware_key+0x7b>
mov    %rsi,%r14
lea    0xed6(%rip),%r12
lea    0xed4(%rip),%r13
mov    %rdi,(%rsp)
mov    %rdi,%rbx
mov    %rsi,%r15
xor    %ebp,%ebp
jmp    114e <find_firmware_key+0x3e>
nop
add    $0x1,%rbp
add    $0x1,%rbx
add    $0xffffffffffffffff,%r15
je     118b <find_firmware_key+0x7b>
cmp    $0x4,%r14
jb     1140 <find_firmware_key+0x30>
mov    $0x4,%edx
mov    %rbx,%rdi
mov    %r12,%rsi
call   1030 <strncmp@plt>
test   %eax,%eax
je     118d <find_firmware_key+0x7d>
cmp    $0x9,%r14
jb     1140 <find_firmware_key+0x30>
mov    $0x9,%edx
mov    %rbx,%rdi
mov    %r13,%rsi
call   1030 <strncmp@plt>
test   %eax,%eax
jne    1140 <find_firmware_key+0x30>
mov    (%rsp),%rbx
add    %rbp,%rbx
jmp    118d <find_firmware_key+0x7d>
xor    %ebx,%ebx
mov    %rbx,%rax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@__const.find_firmware_key.szkey1 = [5 x i8] c"34d1\00"
@__const.find_firmware_key.szkey2 = [10 x i8] c"TbnCboEbn\00"
define i8* @find_firmware_key(i8* %0, i64 %1) {
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca i64
%6 = alloca [5 x i8]
%7 = alloca i64
%8 = alloca [10 x i8]
%9 = alloca i64
%10 = alloca i64
store i8* %0, i8** %4
store i64 %1, i64* %5
%11 = bitcast [5 x i8]* %6 to i8*
%12 = getelementptr inbounds [5 x i8], [5 x i8]* %6, i64 0, i64 0
%13 = call i64 @strlen(i8* %12)
store i64 %13, i64* %7
%14 = bitcast [10 x i8]* %8 to i8*
%15 = getelementptr inbounds [10 x i8], [10 x i8]* %8, i64 0, i64 0
%16 = call i64 @strlen(i8* %15)
store i64 %16, i64* %9
store i64 0, i64* %10
br label %17
17: ; preds = %56, %2
%18 = load i64, i64* %10
%19 = load i64, i64* %5
%20 = icmp ult i64 %18, %19
br i1 %20, label %21, label %59
21: ; preds = %17
%22 = load i64, i64* %5
%23 = load i64, i64* %7
%24 = icmp uge i64 %22, %23
br i1 %24, label %25, label %38
25: ; preds = %21
%26 = load i8*, i8** %4
%27 = load i64, i64* %10
%28 = getelementptr inbounds i8, i8* %26, i64 %27
%29 = getelementptr inbounds [5 x i8], [5 x i8]* %6, i64 0, i64 0
%30 = load i64, i64* %7
%31 = call i32 @strncmp(i8* %28, i8* %29, i64 %30)
%32 = icmp ne i32 %31, 0
br i1 %32, label %37, label %33
33: ; preds = %25
%34 = load i8*, i8** %4
%35 = load i64, i64* %10
%36 = getelementptr inbounds i8, i8* %34, i64 %35
store i8* %36, i8** %3
br label %60
37: ; preds = %25
br label %38
38: ; preds = %37, %21
%39 = load i64, i64* %5
%40 = load i64, i64* %9
%41 = icmp uge i64 %39, %40
br i1 %41, label %42, label %55
42: ; preds = %38
%43 = load i8*, i8** %4
%44 = load i64, i64* %10
%45 = getelementptr inbounds i8, i8* %43, i64 %44
%46 = getelementptr inbounds [10 x i8], [10 x i8]* %8, i64 0, i64 0
%47 = load i64, i64* %9
%48 = call i32 @strncmp(i8* %45, i8* %46, i64 %47)
%49 = icmp ne i32 %48, 0
br i1 %49, label %54, label %50
50: ; preds = %42
%51 = load i8*, i8** %4
%52 = load i64, i64* %10
%53 = getelementptr inbounds i8, i8* %51, i64 %52
store i8* %53, i8** %3
br label %60
54: ; preds = %42
br label %55
55: ; preds = %54, %38
br label %56
56: ; preds = %55
%57 = load i64, i64* %10
%58 = add i64 %57, 1
store i64 %58, i64* %10
br label %17
59: ; preds = %17
store i8* null, i8** %3
br label %60
60: ; preds = %59, %50, %33
%61 = load i8*, i8** %3
ret i8* %61
}

LLVM IR (-O2):
@__const.find_firmware_key.szkey1 = [5 x i8] c"34d1\00"
@__const.find_firmware_key.szkey2 = [10 x i8] c"TbnCboEbn\00"
define i8* @find_firmware_key(i8* %0, i64 %1) {
%3 = icmp eq i64 %1, 0
br i1 %3, label %20, label %4
4: ; preds = %2
%5 = icmp ugt i64 %1, 3
%6 = icmp ugt i64 %1, 8
br label %7
7: ; preds = %4, %17
%8 = phi i64 [ 0, %4 ], [ %18, %17 ]
br i1 %5, label %9, label %17
9: ; preds = %7
%10 = getelementptr inbounds i8, i8* %0, i64 %8
%11 = tail call i32 @strncmp(i8* dereferenceable(1) %10, i8* dereferenceable(5) getelementptr inbounds ([5 x i8], [5 x i8]* @__const.find_firmware_key.szkey1, i64 0, i64 0), i64 4)
%12 = icmp eq i32 %11, 0
br i1 %12, label %20, label %13
13: ; preds = %9
br i1 %6, label %14, label %17
14: ; preds = %13
%15 = tail call i32 @strncmp(i8* dereferenceable(1) %10, i8* dereferenceable(10) getelementptr inbounds ([10 x i8], [10 x i8]* @__const.find_firmware_key.szkey2, i64 0, i64 0), i64 9)
%16 = icmp eq i32 %15, 0
br i1 %16, label %20, label %17
17: ; preds = %7, %13, %14
%18 = add nuw i64 %8, 1
%19 = icmp eq i64 %18, %1
br i1 %19, label %20, label %7
20: ; preds = %9, %14, %17, %2
%21 = phi i8* [ null, %2 ], [ null, %17 ], [ %10, %14 ], [ %10, %9 ]
ret i8* %21
}