#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint8_t;

/* Variables and functions */
int INT_MAX;
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ genpass589(int, unsigned char *);
int /*<<< orphan*/ genpass599(int, unsigned char *);
int /*<<< orphan*/ genpassBelkinOld(int *);
char *genpassXHS(int *);
int /*<<< orphan*/ list_att_supported_models();
int /*<<< orphan*/ list_belkin_supported_models();
int /*<<< orphan*/ list_xfintiy_supported_models();
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ specify_bssid(char *);
int /*<<< orphan*/ strcmp(char *, char *);
int /*<<< orphan*/ usage_err();
void bruteforce(char *target, uint8_t mode, uint8_t guest, uint8_t force,
                uint8_t *pMac) {
  if (mode == 0) {
    if (force) {
      if (!strcmp("att", target)) {
        int i;
        unsigned char psk[13];
        for (i = 0; i < INT_MAX; i++) {
          genpass589(i, psk);
          printf("%s\n", psk);
          genpass599(i, psk);
          printf("%s\n", psk);
        }
      } else if (!strcmp("belkin", target)) {
        if (pMac != NULL) {
          genpassBelkinOld(pMac);
        } else {
          specify_bssid(target);
        }
      } else if (!strcmp("xfinity", target) || !strcmp("comcast", target)) {
        if (pMac != NULL) {
          printf("PSK: %s\n", genpassXHS(pMac));
        } else {
          specify_bssid(target);
        }
      }
    } else if (guest) {
      exit(0);
    } else {
      if (!strcmp("nvg589", target)) {
        int i;
        unsigned char psk[13];
        for (i = 0; i < INT_MAX; i++) {
          genpass589(i, psk);
          printf("%s\n", psk);
        }
      } else if (!strcmp("nvg599", target)) {
        int i;
        unsigned char psk[13];
        for (i = 0; i < INT_MAX; i++) {
          genpass599(i, psk);
          printf("%s\n", psk);
        }
      } else if (!strcmp("dpc3939", target) || !strcmp("dpc3941", target) ||
                 !strcmp("tg1682g", target)) {
        if (pMac != NULL) {
          printf("PSK: %s\n", genpassXHS(pMac));
        } else {
          specify_bssid(target);
        }
      } else if (!strcmp("att", target)) {
        list_att_supported_models();
      } else if (!strcmp("belkin", target)) {
        list_belkin_supported_models();
      } else if (!strcmp("xfinity", target) || !strcmp("comcast", target)) {
        list_xfintiy_supported_models();
      } else {
        printf("[!] WPA not supported for target %s\n", target);
      }
    }
  } else if (mode == 1) {
    printf("[!] WPS not supported for target %s\n", target);
  } else {
    usage_err();
  }
}


x86 assembly (clang, -O0):
<bruteforce>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    %edx,-0x10(%rbp)
mov    %ecx,-0x14(%rbp)
mov    %r8,-0x20(%rbp)
cmpl   $0x0,-0xc(%rbp)
jne    1543 <bruteforce+0x383>
cmpl   $0x0,-0x14(%rbp)
je     1327 <bruteforce+0x167>
mov    -0x8(%rbp),%rsi
lea    0xe08(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
jne    126e <bruteforce+0xae>
movl   $0x0,-0x24(%rbp)
mov    -0x24(%rbp),%eax
mov    0x2dd1(%rip),%rcx
cmp    (%rcx),%eax
jge    1269 <bruteforce+0xa9>
mov    -0x24(%rbp),%edi
lea    -0x31(%rbp),%rsi
call   1090 <genpass589@plt>
lea    -0x31(%rbp),%rsi
lea    0xdea(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x24(%rbp),%edi
lea    -0x31(%rbp),%rsi
call   10d0 <genpass599@plt>
lea    -0x31(%rbp),%rsi
lea    0xdcc(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x24(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x24(%rbp)
jmp    120d <bruteforce+0x4d>
jmp    1322 <bruteforce+0x162>
mov    -0x8(%rbp),%rsi
lea    0xd8b(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
jne    12ae <bruteforce+0xee>
cmpq   $0x0,-0x20(%rbp)
je     12a0 <bruteforce+0xe0>
mov    -0x20(%rbp),%rdi
call   10e0 <genpassBelkinOld@plt>
jmp    12a9 <bruteforce+0xe9>
mov    -0x8(%rbp),%rdi
call   1040 <specify_bssid@plt>
jmp    131d <bruteforce+0x15d>
mov    -0x8(%rbp),%rsi
lea    0xd52(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
je     12e0 <bruteforce+0x120>
mov    -0x8(%rbp),%rsi
lea    0xd41(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
jne    1318 <bruteforce+0x158>
cmpq   $0x0,-0x20(%rbp)
je     130a <bruteforce+0x14a>
mov    -0x20(%rbp),%rdi
call   1080 <genpassXHS@plt>
mov    %rax,%rsi
lea    0xd1d(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
jmp    1313 <bruteforce+0x153>
mov    -0x8(%rbp),%rdi
call   1040 <specify_bssid@plt>
jmp    1318 <bruteforce+0x158>
jmp    131d <bruteforce+0x15d>
jmp    1322 <bruteforce+0x162>
jmp    153e <bruteforce+0x37e>
cmpl   $0x0,-0x10(%rbp)
je     1338 <bruteforce+0x178>
xor    %edi,%edi
call   10c0 <exit@plt>
mov    -0x8(%rbp),%rsi
lea    0xce1(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
jne    139b <bruteforce+0x1db>
movl   $0x0,-0x38(%rbp)
mov    -0x38(%rbp),%eax
mov    0x2c86(%rip),%rcx
cmp    (%rcx),%eax
jge    1396 <bruteforce+0x1d6>
mov    -0x38(%rbp),%edi
lea    -0x45(%rbp),%rsi
call   1090 <genpass589@plt>
lea    -0x45(%rbp),%rsi
lea    0xc9f(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x38(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x38(%rbp)
jmp    1358 <bruteforce+0x198>
jmp    1534 <bruteforce+0x374>
mov    -0x8(%rbp),%rsi
lea    0xc85(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
jne    13fe <bruteforce+0x23e>
movl   $0x0,-0x4c(%rbp)
mov    -0x4c(%rbp),%eax
mov    0x2c23(%rip),%rcx
cmp    (%rcx),%eax
jge    13f9 <bruteforce+0x239>
mov    -0x4c(%rbp),%edi
lea    -0x59(%rbp),%rsi
call   10d0 <genpass599@plt>
lea    -0x59(%rbp),%rsi
lea    0xc3c(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x4c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x4c(%rbp)
jmp    13bb <bruteforce+0x1fb>
jmp    152f <bruteforce+0x36f>
mov    -0x8(%rbp),%rsi
lea    0xc29(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
je     1449 <bruteforce+0x289>
mov    -0x8(%rbp),%rsi
lea    0xc18(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
je     1449 <bruteforce+0x289>
mov    -0x8(%rbp),%rsi
lea    0xc07(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
jne    1481 <bruteforce+0x2c1>
cmpq   $0x0,-0x20(%rbp)
je     1473 <bruteforce+0x2b3>
mov    -0x20(%rbp),%rdi
call   1080 <genpassXHS@plt>
mov    %rax,%rsi
lea    0xbb4(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
jmp    147c <bruteforce+0x2bc>
mov    -0x8(%rbp),%rdi
call   1040 <specify_bssid@plt>
jmp    152a <bruteforce+0x36a>
mov    -0x8(%rbp),%rsi
lea    0xb74(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
jne    14a6 <bruteforce+0x2e6>
mov    $0x0,%al
call   10b0 <list_att_supported_models@plt>
jmp    1525 <bruteforce+0x365>
mov    -0x8(%rbp),%rsi
lea    0xb53(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
jne    14cb <bruteforce+0x30b>
mov    $0x0,%al
call   1050 <list_belkin_supported_models@plt>
jmp    1520 <bruteforce+0x360>
mov    -0x8(%rbp),%rsi
lea    0xb35(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
je     14fd <bruteforce+0x33d>
mov    -0x8(%rbp),%rsi
lea    0xb24(%rip),%rdi
call   1070 <strcmp@plt>
cmp    $0x0,%eax
jne    1509 <bruteforce+0x349>
mov    $0x0,%al
call   1030 <list_xfintiy_supported_models@plt>
jmp    151b <bruteforce+0x35b>
mov    -0x8(%rbp),%rsi
lea    0xb36(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
jmp    1520 <bruteforce+0x360>
jmp    1525 <bruteforce+0x365>
jmp    152a <bruteforce+0x36a>
jmp    152f <bruteforce+0x36f>
jmp    1534 <bruteforce+0x374>
jmp    1539 <bruteforce+0x379>
jmp    153e <bruteforce+0x37e>
jmp    1570 <bruteforce+0x3b0>
cmpl   $0x1,-0xc(%rbp)
jne    1564 <bruteforce+0x3a4>
mov    -0x8(%rbp),%rsi
lea    0xb17(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
jmp    156b <bruteforce+0x3ab>
mov    $0x0,%al
call   10a0 <usage_err@plt>
jmp    1570 <bruteforce+0x3b0>
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<bruteforce>:
push   %r15
push   %r14
push   %rbx
sub    $0x10,%rsp
mov    %rdi,%rbx
cmp    $0x1,%esi
je     1255 <bruteforce+0x85>
test   %esi,%esi
jne    126f <bruteforce+0x9f>
mov    %r8,%r14
test   %ecx,%ecx
je     127f <bruteforce+0xaf>
lea    0xe05(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     137a <bruteforce+0x1aa>
lea    0xdf2(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     13d1 <bruteforce+0x201>
lea    0xde2(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     135a <bruteforce+0x18a>
lea    0xdd3(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
jne    145a <bruteforce+0x28a>
jmp    135a <bruteforce+0x18a>
lea    0xe13(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
jmp    1070 <printf@plt>
xor    %eax,%eax
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
jmp    10b0 <usage_err@plt>
test   %edx,%edx
jne    1494 <bruteforce+0x2c4>
lea    0xd96(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     13f8 <bruteforce+0x228>
lea    0xd86(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     142c <bruteforce+0x25c>
lea    0xd76(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     135a <bruteforce+0x18a>
lea    0xd67(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     135a <bruteforce+0x18a>
lea    0xd5c(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     135a <bruteforce+0x18a>
lea    0xd07(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     1464 <bruteforce+0x294>
lea    0xcf4(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     1484 <bruteforce+0x2b4>
lea    0xce4(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     1474 <bruteforce+0x2a4>
lea    0xcd5(%rip),%rdi
mov    %rbx,%rsi
call   1080 <strcmp@plt>
test   %eax,%eax
je     1474 <bruteforce+0x2a4>
lea    0xcf5(%rip),%rdi
jmp    125c <bruteforce+0x8c>
test   %r14,%r14
je     13e7 <bruteforce+0x217>
mov    %r14,%rdi
call   1090 <genpassXHS@plt>
lea    0xca9(%rip),%rdi
mov    %rax,%rsi
jmp    125f <bruteforce+0x8f>
mov    0x2c67(%rip),%r15
cmpl   $0x0,(%r15)
jle    145a <bruteforce+0x28a>
xor    %ebx,%ebx
lea    0x3(%rsp),%r14
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
mov    %ebx,%edi
mov    %r14,%rsi
call   10a0 <genpass589@plt>
mov    %r14,%rdi
call   1060 <puts@plt>
mov    %ebx,%edi
mov    %r14,%rsi
call   10e0 <genpass599@plt>
mov    %r14,%rdi
call   1060 <puts@plt>
add    $0x1,%ebx
cmp    (%r15),%ebx
jl     13a0 <bruteforce+0x1d0>
jmp    145a <bruteforce+0x28a>
test   %r14,%r14
je     13e7 <bruteforce+0x217>
mov    %r14,%rdi
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
jmp    10f0 <genpassBelkinOld@plt>
mov    %rbx,%rdi
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
jmp    1040 <specify_bssid@plt>
mov    0x2be9(%rip),%r15
cmpl   $0x0,(%r15)
jle    145a <bruteforce+0x28a>
xor    %ebx,%ebx
lea    0x3(%rsp),%r14
nopl   0x0(%rax)
mov    %ebx,%edi
mov    %r14,%rsi
call   10a0 <genpass589@plt>
mov    %r14,%rdi
call   1060 <puts@plt>
add    $0x1,%ebx
cmp    (%r15),%ebx
jl     1410 <bruteforce+0x240>
jmp    145a <bruteforce+0x28a>
mov    0x2bb5(%rip),%r15
cmpl   $0x0,(%r15)
jle    145a <bruteforce+0x28a>
xor    %ebx,%ebx
lea    0x3(%rsp),%r14
mov    %ebx,%edi
mov    %r14,%rsi
call   10e0 <genpass599@plt>
mov    %r14,%rdi
call   1060 <puts@plt>
add    $0x1,%ebx
cmp    (%r15),%ebx
jl     1440 <bruteforce+0x270>
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
ret
xor    %eax,%eax
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
jmp    10c0 <list_att_supported_models@plt>
xor    %eax,%eax
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
jmp    1030 <list_xfintiy_supported_models@plt>
xor    %eax,%eax
add    $0x10,%rsp
pop    %rbx
pop    %r14
pop    %r15
jmp    1050 <list_belkin_supported_models@plt>
xor    %edi,%edi
call   10d0 <exit@plt>

LLVM IR (-O0):
@.str = [4 x i8] c"att\00"
@INT_MAX = global i32 0
@.str.1 = [4 x i8] c"%s\0A\00"
@.str.2 = [7 x i8] c"belkin\00"
@.str.3 = [8 x i8] c"xfinity\00"
@.str.4 = [8 x i8] c"comcast\00"
@.str.5 = [9 x i8] c"PSK: %s\0A\00"
@.str.6 = [7 x i8] c"nvg589\00"
@.str.7 = [7 x i8] c"nvg599\00"
@.str.8 = [8 x i8] c"dpc3939\00"
@.str.9 = [8 x i8] c"dpc3941\00"
@.str.10 = [8 x i8] c"tg1682g\00"
@.str.11 = [37 x i8] c"[!] WPA not supported for target %s\0A\00"
@.str.12 = [37 x i8] c"[!] WPS not supported for target %s\0A\00"
define void @bruteforce(i8* %0, i32 %1, i32 %2, i32 %3, i32* %4) {
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32*
%11 = alloca i32
%12 = alloca [13 x i8]
%13 = alloca i32
%14 = alloca [13 x i8]
%15 = alloca i32
%16 = alloca [13 x i8]
store i8* %0, i8** %6
store i32 %1, i32* %7
store i32 %2, i32* %8
store i32 %3, i32* %9
store i32* %4, i32** %10
%17 = load i32, i32* %7
%18 = icmp eq i32 %17, 0
br i1 %18, label %19, label %181
19: ; preds = %5
%20 = load i32, i32* %9
%21 = icmp ne i32 %20, 0
br i1 %21, label %22, label %82
22: ; preds = %19
%23 = load i8*, i8** %6
%24 = call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8* %23)
%25 = icmp ne i32 %24, 0
br i1 %25, label %46, label %26
26: ; preds = %22
store i32 0, i32* %11
br label %27
27: ; preds = %42, %26
%28 = load i32, i32* %11
%29 = load i32, i32* @INT_MAX
%30 = icmp slt i32 %28, %29
br i1 %30, label %31, label %45
31: ; preds = %27
%32 = load i32, i32* %11
%33 = getelementptr inbounds [13 x i8], [13 x i8]* %12, i64 0, i64 0
%34 = call i32 @genpass589(i32 %32, i8* %33)
%35 = getelementptr inbounds [13 x i8], [13 x i8]* %12, i64 0, i64 0
%36 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i8* %35)
%37 = load i32, i32* %11
%38 = getelementptr inbounds [13 x i8], [13 x i8]* %12, i64 0, i64 0
%39 = call i32 @genpass599(i32 %37, i8* %38)
%40 = getelementptr inbounds [13 x i8], [13 x i8]* %12, i64 0, i64 0
%41 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i8* %40)
br label %42
42: ; preds = %31
%43 = load i32, i32* %11
%44 = add nsw i32 %43, 1
store i32 %44, i32* %11
br label %27
45: ; preds = %27
br label %81
46: ; preds = %22
%47 = load i8*, i8** %6
%48 = call i32 @strcmp(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0), i8* %47)
%49 = icmp ne i32 %48, 0
br i1 %49, label %60, label %50
50: ; preds = %46
%51 = load i32*, i32** %10
%52 = icmp ne i32* %51, null
br i1 %52, label %53, label %56
53: ; preds = %50
%54 = load i32*, i32** %10
%55 = call i32 @genpassBelkinOld(i32* %54)
br label %59
56: ; preds = %50
%57 = load i8*, i8** %6
%58 = call i32 @specify_bssid(i8* %57)
br label %59
59: ; preds = %56, %53
br label %80
60: ; preds = %46
%61 = load i8*, i8** %6
%62 = call i32 @strcmp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i8* %61)
%63 = icmp ne i32 %62, 0
br i1 %63, label %64, label %68
64: ; preds = %60
%65 = load i8*, i8** %6
%66 = call i32 @strcmp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0), i8* %65)
%67 = icmp ne i32 %66, 0
br i1 %67, label %79, label %68
68: ; preds = %64, %60
%69 = load i32*, i32** %10
%70 = icmp ne i32* %69, null
br i1 %70, label %71, label %75
71: ; preds = %68
%72 = load i32*, i32** %10
%73 = call i8* @genpassXHS(i32* %72)
%74 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0), i8* %73)
br label %78
75: ; preds = %68
%76 = load i8*, i8** %6
%77 = call i32 @specify_bssid(i8* %76)
br label %78
78: ; preds = %75, %71
br label %79
79: ; preds = %78, %64
br label %80
80: ; preds = %79, %59
br label %81
81: ; preds = %80, %45
br label %180
82: ; preds = %19
%83 = load i32, i32* %8
%84 = icmp ne i32 %83, 0
br i1 %84, label %85, label %87
85: ; preds = %82
%86 = call i32 @exit(i32 0)
unreachable
87: ; preds = %82
%88 = load i8*, i8** %6
%89 = call i32 @strcmp(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.6, i64 0, i64 0), i8* %88)
%90 = icmp ne i32 %89, 0
br i1 %90, label %106, label %91
91: ; preds = %87
store i32 0, i32* %13
br label %92
92: ; preds = %102, %91
%93 = load i32, i32* %13
%94 = load i32, i32* @INT_MAX
%95 = icmp slt i32 %93, %94
br i1 %95, label %96, label %105
96: ; preds = %92
%97 = load i32, i32* %13
%98 = getelementptr inbounds [13 x i8], [13 x i8]* %14, i64 0, i64 0
%99 = call i32 @genpass589(i32 %97, i8* %98)
%100 = getelementptr inbounds [13 x i8], [13 x i8]* %14, i64 0, i64 0
%101 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i8* %100)
br label %102
102: ; preds = %96
%103 = load i32, i32* %13
%104 = add nsw i32 %103, 1
store i32 %104, i32* %13
br label %92
105: ; preds = %92
br label %178
106: ; preds = %87
%107 = load i8*, i8** %6
%108 = call i32 @strcmp(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.7, i64 0, i64 0), i8* %107)
%109 = icmp ne i32 %108, 0
br i1 %109, label %125, label %110
110: ; preds = %106
store i32 0, i32* %15
br label %111
111: ; preds = %121, %110
%112 = load i32, i32* %15
%113 = load i32, i32* @INT_MAX
%114 = icmp slt i32 %112, %113
br i1 %114, label %115, label %124
115: ; preds = %111
%116 = load i32, i32* %15
%117 = getelementptr inbounds [13 x i8], [13 x i8]* %16, i64 0, i64 0
%118 = call i32 @genpass599(i32 %116, i8* %117)
%119 = getelementptr inbounds [13 x i8], [13 x i8]* %16, i64 0, i64 0
%120 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i8* %119)
br label %121
121: ; preds = %115
%122 = load i32, i32* %15
%123 = add nsw i32 %122, 1
store i32 %123, i32* %15
br label %111
124: ; preds = %111
br label %177
125: ; preds = %106
%126 = load i8*, i8** %6
%127 = call i32 @strcmp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.8, i64 0, i64 0), i8* %126)
%128 = icmp ne i32 %127, 0
br i1 %128, label %129, label %137
129: ; preds = %125
%130 = load i8*, i8** %6
%131 = call i32 @strcmp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.9, i64 0, i64 0), i8* %130)
%132 = icmp ne i32 %131, 0
br i1 %132, label %133, label %137
133: ; preds = %129
%134 = load i8*, i8** %6
%135 = call i32 @strcmp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.10, i64 0, i64 0), i8* %134)
%136 = icmp ne i32 %135, 0
br i1 %136, label %148, label %137
137: ; preds = %133, %129, %125
%138 = load i32*, i32** %10
%139 = icmp ne i32* %138, null
br i1 %139, label %140, label %144
140: ; preds = %137
%141 = load i32*, i32** %10
%142 = call i8* @genpassXHS(i32* %141)
%143 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0), i8* %142)
br label %147
144: ; preds = %137
%145 = load i8*, i8** %6
%146 = call i32 @specify_bssid(i8* %145)
br label %147
147: ; preds = %144, %140
br label %176
148: ; preds = %133
%149 = load i8*, i8** %6
%150 = call i32 @strcmp(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8* %149)
%151 = icmp ne i32 %150, 0
br i1 %151, label %154, label %152
152: ; preds = %148
%153 = call i32 (...) @list_att_supported_models()
br label %175
154: ; preds = %148
%155 = load i8*, i8** %6
%156 = call i32 @strcmp(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0), i8* %155)
%157 = icmp ne i32 %156, 0
br i1 %157, label %160, label %158
158: ; preds = %154
%159 = call i32 (...) @list_belkin_supported_models()
br label %174
160: ; preds = %154
%161 = load i8*, i8** %6
%162 = call i32 @strcmp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i8* %161)
%163 = icmp ne i32 %162, 0
br i1 %163, label %164, label %168
164: ; preds = %160
%165 = load i8*, i8** %6
%166 = call i32 @strcmp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0), i8* %165)
%167 = icmp ne i32 %166, 0
br i1 %167, label %170, label %168
168: ; preds = %164, %160
%169 = call i32 (...) @list_xfintiy_supported_models()
br label %173
170: ; preds = %164
%171 = load i8*, i8** %6
%172 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.11, i64 0, i64 0), i8* %171)
br label %173
173: ; preds = %170, %168
br label %174
174: ; preds = %173, %158
br label %175
175: ; preds = %174, %152
br label %176
176: ; preds = %175, %147
br label %177
177: ; preds = %176, %124
br label %178
178: ; preds = %177, %105
br label %179
179: ; preds = %178
br label %180
180: ; preds = %179, %81
br label %190
181: ; preds = %5
%182 = load i32, i32* %7
%183 = icmp eq i32 %182, 1
br i1 %183, label %184, label %187
184: ; preds = %181
%185 = load i8*, i8** %6
%186 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.12, i64 0, i64 0), i8* %185)
br label %189
187: ; preds = %181
%188 = call i32 (...) @usage_err()
br label %189
189: ; preds = %187, %184
br label %190
190: ; preds = %189, %180
ret void
}

LLVM IR (-O2):
@.str = [4 x i8] c"att\00"
@INT_MAX = global i32 0
@.str.2 = [7 x i8] c"belkin\00"
@.str.3 = [8 x i8] c"xfinity\00"
@.str.4 = [8 x i8] c"comcast\00"
@.str.5 = [9 x i8] c"PSK: %s\0A\00"
@.str.6 = [7 x i8] c"nvg589\00"
@.str.7 = [7 x i8] c"nvg599\00"
@.str.8 = [8 x i8] c"dpc3939\00"
@.str.9 = [8 x i8] c"dpc3941\00"
@.str.10 = [8 x i8] c"tg1682g\00"
@.str.11 = [37 x i8] c"[!] WPA not supported for target %s\0A\00"
@.str.12 = [37 x i8] c"[!] WPS not supported for target %s\0A\00"
define void @bruteforce(i8* %0, i32 %1, i32 %2, i32 %3, i32* %4) {
%6 = alloca [13 x i8]
%7 = alloca [13 x i8]
%8 = alloca [13 x i8]
switch i32 %1, label %122 [
i32 0, label %9
i32 1, label %120
]
9: ; preds = %5
%10 = icmp eq i32 %3, 0
br i1 %10, label %50, label %11
11: ; preds = %9
%12 = tail call i32 @strcmp(i8* dereferenceable(4) getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8* dereferenceable(1) %0)
%13 = icmp eq i32 %12, 0
br i1 %13, label %14, label %28
14: ; preds = %11
%15 = getelementptr inbounds [13 x i8], [13 x i8]* %6, i64 0, i64 0
%16 = load i32, i32* @INT_MAX
%17 = icmp sgt i32 %16, 0
br i1 %17, label %18, label %27
18: ; preds = %14, %18
%19 = phi i32 [ %24, %18 ], [ 0, %14 ]
%20 = call i32 @genpass589(i32 %19, i8* %15)
%21 = call i32 @puts(i8* %15)
%22 = call i32 @genpass599(i32 %19, i8* %15)
%23 = call i32 @puts(i8* %15)
%24 = add nuw nsw i32 %19, 1
%25 = load i32, i32* @INT_MAX
%26 = icmp slt i32 %24, %25
br i1 %26, label %18, label %27
27: ; preds = %18, %14
br label %124
28: ; preds = %11
%29 = tail call i32 @strcmp(i8* dereferenceable(7) getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0), i8* dereferenceable(1) %0)
%30 = icmp eq i32 %29, 0
br i1 %30, label %31, label %37
31: ; preds = %28
%32 = icmp eq i32* %4, null
br i1 %32, label %35, label %33
33: ; preds = %31
%34 = tail call i32 @genpassBelkinOld(i32* %4)
br label %124
35: ; preds = %31
%36 = tail call i32 @specify_bssid(i8* %0)
br label %124
37: ; preds = %28
%38 = tail call i32 @strcmp(i8* dereferenceable(8) getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i8* dereferenceable(1) %0)
%39 = icmp eq i32 %38, 0
br i1 %39, label %43, label %40
40: ; preds = %37
%41 = tail call i32 @strcmp(i8* dereferenceable(8) getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0), i8* dereferenceable(1) %0)
%42 = icmp eq i32 %41, 0
br i1 %42, label %43, label %124
43: ; preds = %40, %37
%44 = icmp eq i32* %4, null
br i1 %44, label %48, label %45
45: ; preds = %43
%46 = tail call i8* @genpassXHS(i32* %4)
%47 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0), i8* %46)
br label %124
48: ; preds = %43
%49 = tail call i32 @specify_bssid(i8* %0)
br label %124
50: ; preds = %9
%51 = icmp eq i32 %2, 0
br i1 %51, label %54, label %52
52: ; preds = %50
%53 = tail call i32 @exit(i32 0)
unreachable
54: ; preds = %50
%55 = tail call i32 @strcmp(i8* dereferenceable(7) getelementptr inbounds ([7 x i8], [7 x i8]* @.str.6, i64 0, i64 0), i8* dereferenceable(1) %0)
%56 = icmp eq i32 %55, 0
br i1 %56, label %57, label %69
57: ; preds = %54
%58 = getelementptr inbounds [13 x i8], [13 x i8]* %7, i64 0, i64 0
%59 = load i32, i32* @INT_MAX
%60 = icmp sgt i32 %59, 0
br i1 %60, label %61, label %68
61: ; preds = %57, %61
%62 = phi i32 [ %65, %61 ], [ 0, %57 ]
%63 = call i32 @genpass589(i32 %62, i8* %58)
%64 = call i32 @puts(i8* %58)
%65 = add nuw nsw i32 %62, 1
%66 = load i32, i32* @INT_MAX
%67 = icmp slt i32 %65, %66
br i1 %67, label %61, label %68
68: ; preds = %61, %57
br label %124
69: ; preds = %54
%70 = tail call i32 @strcmp(i8* dereferenceable(7) getelementptr inbounds ([7 x i8], [7 x i8]* @.str.7, i64 0, i64 0), i8* dereferenceable(1) %0)
%71 = icmp eq i32 %70, 0
br i1 %71, label %72, label %84
72: ; preds = %69
%73 = getelementptr inbounds [13 x i8], [13 x i8]* %8, i64 0, i64 0
%74 = load i32, i32* @INT_MAX
%75 = icmp sgt i32 %74, 0
br i1 %75, label %76, label %83
76: ; preds = %72, %76
%77 = phi i32 [ %80, %76 ], [ 0, %72 ]
%78 = call i32 @genpass599(i32 %77, i8* %73)
%79 = call i32 @puts(i8* %73)
%80 = add nuw nsw i32 %77, 1
%81 = load i32, i32* @INT_MAX
%82 = icmp slt i32 %80, %81
br i1 %82, label %76, label %83
83: ; preds = %76, %72
br label %124
84: ; preds = %69
%85 = tail call i32 @strcmp(i8* dereferenceable(8) getelementptr inbounds ([8 x i8], [8 x i8]* @.str.8, i64 0, i64 0), i8* dereferenceable(1) %0)
%86 = icmp eq i32 %85, 0
br i1 %86, label %93, label %87
87: ; preds = %84
%88 = tail call i32 @strcmp(i8* dereferenceable(8) getelementptr inbounds ([8 x i8], [8 x i8]* @.str.9, i64 0, i64 0), i8* dereferenceable(1) %0)
%89 = icmp eq i32 %88, 0
br i1 %89, label %93, label %90
90: ; preds = %87
%91 = tail call i32 @strcmp(i8* dereferenceable(8) getelementptr inbounds ([8 x i8], [8 x i8]* @.str.10, i64 0, i64 0), i8* dereferenceable(1) %0)
%92 = icmp eq i32 %91, 0
br i1 %92, label %93, label %100
93: ; preds = %90, %87, %84
%94 = icmp eq i32* %4, null
br i1 %94, label %98, label %95
95: ; preds = %93
%96 = tail call i8* @genpassXHS(i32* %4)
%97 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.5, i64 0, i64 0), i8* %96)
br label %124
98: ; preds = %93
%99 = tail call i32 @specify_bssid(i8* %0)
br label %124
100: ; preds = %90
%101 = tail call i32 @strcmp(i8* dereferenceable(4) getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8* dereferenceable(1) %0)
%102 = icmp eq i32 %101, 0
br i1 %102, label %103, label %105
103: ; preds = %100
%104 = tail call i32 (...) @list_att_supported_models()
br label %124
105: ; preds = %100
%106 = tail call i32 @strcmp(i8* dereferenceable(7) getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0), i8* dereferenceable(1) %0)
%107 = icmp eq i32 %106, 0
br i1 %107, label %108, label %110
108: ; preds = %105
%109 = tail call i32 (...) @list_belkin_supported_models()
br label %124
110: ; preds = %105
%111 = tail call i32 @strcmp(i8* dereferenceable(8) getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i8* dereferenceable(1) %0)
%112 = icmp eq i32 %111, 0
br i1 %112, label %116, label %113
113: ; preds = %110
%114 = tail call i32 @strcmp(i8* dereferenceable(8) getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0), i8* dereferenceable(1) %0)
%115 = icmp eq i32 %114, 0
br i1 %115, label %116, label %118
116: ; preds = %113, %110
%117 = tail call i32 (...) @list_xfintiy_supported_models()
br label %124
118: ; preds = %113
%119 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @.str.11, i64 0, i64 0), i8* %0)
br label %124
120: ; preds = %5
%121 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @.str.12, i64 0, i64 0), i8* %0)
br label %124
122: ; preds = %5
%123 = tail call i32 (...) @usage_err()
br label %124
124: ; preds = %120, %122, %35, %33, %45, %48, %40, %27, %68, %98, %95, %108, %118, %116, %103, %83
ret void
}