int ftp_pasv(int sockfd) {
  char recvbuf[1024] = {'\0'};
  int result[6] = {'\0'};
  char ip[32] = {'\0'};
  int port = -1;
  int ret = -1;
  if (sockfd < 0) {
    return -1;
  }
  ret = send_socket(sockfd, "PASV\r\n", strlen("PASV\r\n"));
  if (ret == -1) {
    printf("###%s(),send ftp pasv failed!\n", __func__);
    return -1;
  }
  ret = read_socket(sockfd, recvbuf, sizeof(recvbuf));
  if (ret > 0) {
    if (strncmp(recvbuf, "227", 3) == 0) {
      printf("###%s(),send commend pasv sucessful!\n", __func__);
    } else {
      printf("###%s(),send commend pasv failed!\n", __func__);
      return -1;
    }
  }
  sscanf(recvbuf, "227 Entering Passive Mode (%d,%d,%d,%d,%d,%d).", &result[0],
         &result[1], &result[2], &result[3], &result[4], &result[5]);
  sprintf(ip, "%d.%d.%d.%d", result[0], result[1], result[2], result[3]);
  port = result[4] * 256 + result[5];
  printf("###%s(),ip:%s,port:%d\n", __func__, ip, port);
  return connect_to_ftpserver(ip, port);
}


x86 assembly (clang, -O0):
<ftp_pasv>:
push   %rbp
mov    %rsp,%rbp
sub    $0x470,%rsp
mov    %edi,-0x8(%rbp)
lea    -0x410(%rbp),%rdi
xor    %esi,%esi
mov    $0x400,%edx
call   1060 <memset@plt>
lea    -0x430(%rbp),%rdi
xor    %esi,%esi
mov    $0x18,%edx
call   1060 <memset@plt>
lea    -0x450(%rbp),%rdi
xor    %esi,%esi
mov    $0x20,%edx
call   1060 <memset@plt>
movl   $0xffffffff,-0x454(%rbp)
ff ff ff
movl   $0xffffffff,-0x458(%rbp)
ff ff ff
cmpl   $0x0,-0x8(%rbp)
jge    11f1 <ftp_pasv+0x71>
movl   $0xffffffff,-0x4(%rbp)
jmp    139e <ftp_pasv+0x21e>
mov    -0x8(%rbp),%edi
lea    0xe05(%rip),%rsi
mov    $0x6,%edx
mov    $0x0,%al
call   1090 <send_socket@plt>
mov    %eax,-0x458(%rbp)
cmpl   $0xffffffff,-0x458(%rbp)
jne    123b <ftp_pasv+0xbb>
lea    0xde6(%rip),%rdi
lea    0xdfe(%rip),%rsi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    139e <ftp_pasv+0x21e>
mov    -0x8(%rbp),%edi
lea    -0x410(%rbp),%rsi
mov    $0x400,%edx
mov    $0x0,%al
call   1050 <read_socket@plt>
mov    %eax,-0x458(%rbp)
cmpl   $0x0,-0x458(%rbp)
jle    12c5 <ftp_pasv+0x145>
lea    -0x410(%rbp),%rdi
lea    0xdbd(%rip),%rsi
mov    $0x3,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%eax
jne    129f <ftp_pasv+0x11f>
lea    0xda7(%rip),%rdi
lea    0xd93(%rip),%rsi
mov    $0x0,%al
call   1040 <printf@plt>
jmp    12c0 <ftp_pasv+0x140>
lea    0xdb3(%rip),%rdi
lea    0xd79(%rip),%rsi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    139e <ftp_pasv+0x21e>
jmp    12c5 <ftp_pasv+0x145>
lea    -0x410(%rbp),%rdi
lea    -0x430(%rbp),%rdx
lea    -0x430(%rbp),%rcx
add    $0x4,%rcx
lea    -0x430(%rbp),%r8
add    $0x8,%r8
lea    -0x430(%rbp),%r9
add    $0xc,%r9
lea    -0x430(%rbp),%r10
add    $0x10,%r10
lea    -0x430(%rbp),%rax
add    $0x14,%rax
lea    0xd6b(%rip),%rsi
mov    %r10,(%rsp)
mov    %rax,0x8(%rsp)
mov    $0x0,%al
call   1080 <sscanf@plt>
lea    -0x450(%rbp),%rdi
mov    -0x430(%rbp),%edx
mov    -0x42c(%rbp),%ecx
mov    -0x428(%rbp),%r8d
mov    -0x424(%rbp),%r9d
lea    0xd62(%rip),%rsi
mov    $0x0,%al
call   10a0 <sprintf@plt>
mov    -0x420(%rbp),%eax
shl    $0x8,%eax
add    -0x41c(%rbp),%eax
mov    %eax,-0x454(%rbp)
lea    -0x450(%rbp),%rdx
mov    -0x454(%rbp),%ecx
lea    0xd3e(%rip),%rdi
lea    0xca6(%rip),%rsi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x450(%rbp),%rdi
mov    -0x454(%rbp),%esi
mov    $0x0,%al
call   1070 <connect_to_ftpserver@plt>
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x470,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<ftp_pasv>:
push   %rbp
push   %rbx
sub    $0x448,%rsp
mov    %edi,%ebp
lea    0x40(%rsp),%rdi
mov    $0x400,%edx
xor    %esi,%esi
call   1050 <memset@plt>
xorps  %xmm0,%xmm0
movaps %xmm0,(%rsp)
movq   $0x0,0x10(%rsp)
movaps %xmm0,0x30(%rsp)
movaps %xmm0,0x20(%rsp)
mov    $0xffffffff,%ebx
test   %ebp,%ebp
js     12c1 <ftp_pasv+0x151>
lea    0xe46(%rip),%rsi
mov    $0x6,%edx
mov    %ebp,%edi
xor    %eax,%eax
call   1080 <send_socket@plt>
cmp    $0xffffffff,%eax
je     1203 <ftp_pasv+0x93>
lea    0x40(%rsp),%rsi
mov    $0x400,%edx
mov    %ebp,%edi
xor    %eax,%eax
call   1040 <read_socket@plt>
test   %eax,%eax
jle    1232 <ftp_pasv+0xc2>
mov    $0x3232,%eax
xor    0x40(%rsp),%eax
movzbl 0x42(%rsp),%ecx
xor    $0x37,%ecx
or     %ax,%cx
je     121d <ftp_pasv+0xad>
lea    0xe58(%rip),%rdi
jmp    120a <ftp_pasv+0x9a>
lea    0xdfd(%rip),%rdi
lea    0xe15(%rip),%rsi
xor    %eax,%eax
call   1030 <printf@plt>
jmp    12c1 <ftp_pasv+0x151>
lea    0xe0f(%rip),%rdi
lea    0xdfb(%rip),%rsi
xor    %eax,%eax
call   1030 <printf@plt>
lea    0x4(%rsp),%rcx
lea    0x8(%rsp),%r8
lea    0xc(%rsp),%r9
lea    0x10(%rsp),%rbp
lea    0x14(%rsp),%rbx
lea    0xe2a(%rip),%rsi
lea    0x40(%rsp),%rdi
mov    %rsp,%rdx
xor    %eax,%eax
push   %rbx
push   %rbp
call   1070 <sscanf@plt>
add    $0x10,%rsp
mov    (%rsp),%edx
mov    0x4(%rsp),%ecx
mov    0x8(%rsp),%r8d
mov    0xc(%rsp),%r9d
lea    0xe2c(%rip),%rsi
lea    0x20(%rsp),%rbx
mov    %rbx,%rdi
xor    %eax,%eax
call   1090 <sprintf@plt>
mov    0x10(%rsp),%ebp
shl    $0x8,%ebp
add    0x14(%rsp),%ebp
lea    0xe17(%rip),%rdi
lea    0xd7f(%rip),%rsi
mov    %rbx,%rdx
mov    %ebp,%ecx
xor    %eax,%eax
call   1030 <printf@plt>
mov    %rbx,%rdi
mov    %ebp,%esi
xor    %eax,%eax
call   1060 <connect_to_ftpserver@plt>
mov    %eax,%ebx
mov    %ebx,%eax
add    $0x448,%rsp
pop    %rbx
pop    %rbp
ret

LLVM IR (-O0):
@.str = [7 x i8] c"PASV\0D\0A\00"
@.str.1 = [31 x i8] c"###%s(),send ftp pasv failed!\0A\00"
@__func__.ftp_pasv = [9 x i8] c"ftp_pasv\00"
@.str.2 = [4 x i8] c"227\00"
@.str.3 = [38 x i8] c"###%s(),send commend pasv sucessful!\0A\00"
@.str.4 = [35 x i8] c"###%s(),send commend pasv failed!\0A\00"
@.str.5 = [47 x i8] c"227 Entering Passive Mode (%d,%d,%d,%d,%d,%d).\00"
@.str.6 = [12 x i8] c"%d.%d.%d.%d\00"
@.str.7 = [23 x i8] c"###%s(),ip:%s,port:%d\0A\00"
define i32 @ftp_pasv(i32 %0) {
%2 = alloca i32
%3 = alloca i32
%4 = alloca [1024 x i8]
%5 = alloca [6 x i32]
%6 = alloca [32 x i8]
%7 = alloca i32
%8 = alloca i32
store i32 %0, i32* %3
%9 = bitcast [1024 x i8]* %4 to i8*
%10 = bitcast [6 x i32]* %5 to i8*
%11 = bitcast [32 x i8]* %6 to i8*
store i32 -1, i32* %7
store i32 -1, i32* %8
%12 = load i32, i32* %3
%13 = icmp slt i32 %12, 0
br i1 %13, label %14, label %15
14: ; preds = %1
store i32 -1, i32* %2
br label %68
15: ; preds = %1
%16 = load i32, i32* %3
%17 = call i32 (i32, i8*, i64, ...) bitcast (i32 (...)* @send_socket to i32 (i32, i8*, i64, ...)*)(i32 %16, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0), i64 6)
store i32 %17, i32* %8
%18 = load i32, i32* %8
%19 = icmp eq i32 %18, -1
br i1 %19, label %20, label %22
20: ; preds = %15
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @__func__.ftp_pasv, i64 0, i64 0))
store i32 -1, i32* %2
br label %68
22: ; preds = %15
%23 = load i32, i32* %3
%24 = getelementptr inbounds [1024 x i8], [1024 x i8]* %4, i64 0, i64 0
%25 = call i32 (i32, i8*, i64, ...) bitcast (i32 (...)* @read_socket to i32 (i32, i8*, i64, ...)*)(i32 %23, i8* %24, i64 1024)
store i32 %25, i32* %8
%26 = load i32, i32* %8
%27 = icmp sgt i32 %26, 0
br i1 %27, label %28, label %37
28: ; preds = %22
%29 = getelementptr inbounds [1024 x i8], [1024 x i8]* %4, i64 0, i64 0
%30 = call i32 @strncmp(i8* %29, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0), i64 3)
%31 = icmp eq i32 %30, 0
br i1 %31, label %32, label %34
32: ; preds = %28
%33 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @__func__.ftp_pasv, i64 0, i64 0))
br label %36
34: ; preds = %28
%35 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @__func__.ftp_pasv, i64 0, i64 0))
store i32 -1, i32* %2
br label %68
36: ; preds = %32
br label %37
37: ; preds = %36, %22
%38 = getelementptr inbounds [1024 x i8], [1024 x i8]* %4, i64 0, i64 0
%39 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 0
%40 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 1
%41 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 2
%42 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 3
%43 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 4
%44 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 5
%45 = call i32 (i8*, i8*, ...) @sscanf(i8* %38, i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.5, i64 0, i64 0), i32* %39, i32* %40, i32* %41, i32* %42, i32* %43, i32* %44)
%46 = getelementptr inbounds [32 x i8], [32 x i8]* %6, i64 0, i64 0
%47 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 0
%48 = load i32, i32* %47
%49 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 1
%50 = load i32, i32* %49
%51 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 2
%52 = load i32, i32* %51
%53 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 3
%54 = load i32, i32* %53
%55 = call i32 (i8*, i8*, ...) @sprintf(i8* %46, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0), i32 %48, i32 %50, i32 %52, i32 %54)
%56 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 4
%57 = load i32, i32* %56
%58 = mul nsw i32 %57, 256
%59 = getelementptr inbounds [6 x i32], [6 x i32]* %5, i64 0, i64 5
%60 = load i32, i32* %59
%61 = add nsw i32 %58, %60
store i32 %61, i32* %7
%62 = getelementptr inbounds [32 x i8], [32 x i8]* %6, i64 0, i64 0
%63 = load i32, i32* %7
%64 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.7, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @__func__.ftp_pasv, i64 0, i64 0), i8* %62, i32 %63)
%65 = getelementptr inbounds [32 x i8], [32 x i8]* %6, i64 0, i64 0
%66 = load i32, i32* %7
%67 = call i32 (i8*, i32, ...) bitcast (i32 (...)* @connect_to_ftpserver to i32 (i8*, i32, ...)*)(i8* %65, i32 %66)
store i32 %67, i32* %2
br label %68
68: ; preds = %37, %34, %20, %14
%69 = load i32, i32* %2
ret i32 %69
}

LLVM IR (-O2):
@.str = [7 x i8] c"PASV\0D\0A\00"
@.str.1 = [31 x i8] c"###%s(),send ftp pasv failed!\0A\00"
@__func__.ftp_pasv = [9 x i8] c"ftp_pasv\00"
@.str.2 = [4 x i8] c"227\00"
@.str.3 = [38 x i8] c"###%s(),send commend pasv sucessful!\0A\00"
@.str.4 = [35 x i8] c"###%s(),send commend pasv failed!\0A\00"
@.str.5 = [47 x i8] c"227 Entering Passive Mode (%d,%d,%d,%d,%d,%d).\00"
@.str.6 = [12 x i8] c"%d.%d.%d.%d\00"
@.str.7 = [23 x i8] c"###%s(),ip:%s,port:%d\0A\00"
define i32 @ftp_pasv(i32 %0) {
%2 = alloca [1024 x i8]
%3 = alloca [6 x i32]
%4 = alloca [32 x i8]
%5 = getelementptr inbounds [1024 x i8], [1024 x i8]* %2, i64 0, i64 0
%6 = bitcast [6 x i32]* %3 to i8*
%7 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 0
%8 = icmp slt i32 %0, 0
br i1 %8, label %43, label %9
9: ; preds = %1
%10 = tail call i32 (i32, i8*, i64, ...) bitcast (i32 (...)* @send_socket to i32 (i32, i8*, i64, ...)*)(i32 %0, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str, i64 0, i64 0), i64 6)
%11 = icmp eq i32 %10, -1
br i1 %11, label %12, label %14
12: ; preds = %9
%13 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @__func__.ftp_pasv, i64 0, i64 0))
br label %43
14: ; preds = %9
%15 = call i32 (i32, i8*, i64, ...) bitcast (i32 (...)* @read_socket to i32 (i32, i8*, i64, ...)*)(i32 %0, i8* %5, i64 1024)
%16 = icmp sgt i32 %15, 0
br i1 %16, label %17, label %24
17: ; preds = %14
%18 = call i32 @bcmp(i8* dereferenceable(3) %5, i8* dereferenceable(3) getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0), i64 3)
%19 = icmp eq i32 %18, 0
br i1 %19, label %20, label %22
20: ; preds = %17
%21 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([38 x i8], [38 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @__func__.ftp_pasv, i64 0, i64 0))
br label %24
22: ; preds = %17
%23 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @.str.4, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @__func__.ftp_pasv, i64 0, i64 0))
br label %43
24: ; preds = %20, %14
%25 = getelementptr inbounds [6 x i32], [6 x i32]* %3, i64 0, i64 0
%26 = getelementptr inbounds [6 x i32], [6 x i32]* %3, i64 0, i64 1
%27 = getelementptr inbounds [6 x i32], [6 x i32]* %3, i64 0, i64 2
%28 = getelementptr inbounds [6 x i32], [6 x i32]* %3, i64 0, i64 3
%29 = getelementptr inbounds [6 x i32], [6 x i32]* %3, i64 0, i64 4
%30 = getelementptr inbounds [6 x i32], [6 x i32]* %3, i64 0, i64 5
%31 = call i32 (i8*, i8*, ...) @sscanf(i8* %5, i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.5, i64 0, i64 0), i32* %25, i32* %26, i32* %27, i32* %28, i32* %29, i32* %30)
%32 = load i32, i32* %25
%33 = load i32, i32* %26
%34 = load i32, i32* %27
%35 = load i32, i32* %28
%36 = call i32 (i8*, i8*, ...) @sprintf(i8* %7, i8* dereferenceable(1) getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0), i32 %32, i32 %33, i32 %34, i32 %35)
%37 = load i32, i32* %29
%38 = shl nsw i32 %37, 8
%39 = load i32, i32* %30
%40 = add nsw i32 %38, %39
%41 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.7, i64 0, i64 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @__func__.ftp_pasv, i64 0, i64 0), i8* %7, i32 %40)
%42 = call i32 (i8*, i32, ...) bitcast (i32 (...)* @connect_to_ftpserver to i32 (i8*, i32, ...)*)(i8* %7, i32 %40)
br label %43
43: ; preds = %1, %24, %22, %12
%44 = phi i32 [ -1, %12 ], [ %42, %24 ], [ -1, %22 ], [ -1, %1 ]
ret i32 %44
}