#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ xkey;
struct NetFrame {
  int dummy;
};
struct Ferret {
  int dummy;
};

/* Variables and functions */
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char const *, unsigned int);
int wep_decrypt(unsigned char *, unsigned int, int, unsigned char const *);
unsigned test_wep_decrypt(struct Ferret *ferret, struct NetFrame *frame,
                          const unsigned char *px, unsigned length,
                          unsigned char *new_px, unsigned *r_new_length) {
  unsigned i;
  struct XKey {
    unsigned len;
    const char *key;
  } xkey[] = {
      {104, "\xa3\x42\xee\x54\xc1\x2e\x5d\x23\x1f\xfe\xe0\x02\x00"},
      {40, "\x11\x11\x11\x11\x11"},
      {40, "\x4b\x78\x52\xd7\x80"},
      {40, "\x00\x00\x00\x00\x00"},
      {40, "\x12\x34\x56\x78\x90"},
      {104, "\x10\x01\x11\x11\x00\x00\x11\x11\x00\x00\x11\x11\x01"},
      {104, "\x12\x34\x56\x78\x90\xab\xcd\xef\x12\x34\x56\x78\x90"},
  };
  int foo;
  frame = (frame);
  ferret = (ferret);
  if (length > 4)
    *r_new_length = length - 4;
  else
    return 0;
  for (i = 0; i < sizeof(xkey) / sizeof(xkey[0]); i++) {
    memcpy(new_px, px, length);
    foo = wep_decrypt(new_px + 24, length - 24, xkey[i].len / 8,
                      (const unsigned char *)xkey[i].key);
    if (foo == 0)
      return 1;
  }
  return 0;
}


x86 assembly (clang, -O0):
<test_wep_decrypt>:
push   %rbp
mov    %rsp,%rbp
sub    $0xc0,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %ecx,-0x24(%rbp)
mov    %r8,-0x30(%rbp)
mov    %r9,-0x38(%rbp)
lea    -0xb0(%rbp),%rdi
lea    0x2c60(%rip),%rsi
mov    $0x70,%edx
call   1040 <memcpy@plt>
mov    -0x18(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x10(%rbp)
cmpl   $0x4,-0x24(%rbp)
jbe    1185 <test_wep_decrypt+0x65>
mov    -0x24(%rbp),%ecx
sub    $0x4,%ecx
mov    -0x38(%rbp),%rax
mov    %ecx,(%rax)
jmp    1191 <test_wep_decrypt+0x71>
movl   $0x0,-0x4(%rbp)
jmp    1230 <test_wep_decrypt+0x110>
movl   $0x0,-0x3c(%rbp)
mov    -0x3c(%rbp),%eax
cmp    $0x7,%rax
jae    1229 <test_wep_decrypt+0x109>
mov    -0x30(%rbp),%rdi
mov    -0x20(%rbp),%rsi
mov    -0x24(%rbp),%edx
call   1040 <memcpy@plt>
mov    -0x30(%rbp),%rdi
add    $0x18,%rdi
mov    -0x24(%rbp),%esi
sub    $0x18,%esi
mov    -0x3c(%rbp),%eax
mov    %eax,%ecx
lea    -0xb0(%rbp),%rax
shl    $0x4,%rcx
add    %rcx,%rax
mov    (%rax),%edx
shr    $0x3,%edx
mov    -0x3c(%rbp),%eax
mov    %eax,%ecx
lea    -0xb0(%rbp),%rax
shl    $0x4,%rcx
add    %rcx,%rax
mov    0x8(%rax),%rcx
call   1030 <wep_decrypt@plt>
mov    %eax,-0xb4(%rbp)
cmpl   $0x0,-0xb4(%rbp)
jne    1216 <test_wep_decrypt+0xf6>
movl   $0x1,-0x4(%rbp)
jmp    1230 <test_wep_decrypt+0x110>
jmp    121b <test_wep_decrypt+0xfb>
mov    -0x3c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x3c(%rbp)
jmp    1198 <test_wep_decrypt+0x78>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0xc0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test_wep_decrypt>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
xor    %ebp,%ebp
cmp    $0x5,%ecx
jb     1279 <test_wep_decrypt+0x159>
mov    %r8,%r14
mov    %ecx,%ebx
mov    %rdx,%r15
lea    -0x4(%rbx),%eax
mov    %eax,(%r9)
lea    0x18(%r8),%r12
lea    -0x18(%rbx),%r13d
mov    %r8,%rdi
mov    %rdx,%rsi
mov    %ecx,%edx
call   1040 <memcpy@plt>
lea    0xea0(%rip),%rcx
mov    %r12,%rdi
mov    %r13d,%esi
mov    $0xd,%edx
call   1030 <wep_decrypt@plt>
mov    $0x1,%ebp
test   %eax,%eax
je     1279 <test_wep_decrypt+0x159>
mov    %r14,%rdi
mov    %r15,%rsi
mov    %ebx,%edx
call   1040 <memcpy@plt>
lea    0xe91(%rip),%rcx
mov    %r12,%rdi
mov    %r13d,%esi
mov    $0x5,%edx
call   1030 <wep_decrypt@plt>
test   %eax,%eax
je     1279 <test_wep_decrypt+0x159>
mov    %r14,%rdi
mov    %r15,%rsi
mov    %ebx,%edx
call   1040 <memcpy@plt>
lea    0xe6b(%rip),%rcx
mov    %r12,%rdi
mov    %r13d,%esi
mov    $0x5,%edx
call   1030 <wep_decrypt@plt>
test   %eax,%eax
je     1279 <test_wep_decrypt+0x159>
mov    %r14,%rdi
mov    %r15,%rsi
mov    %ebx,%edx
call   1040 <memcpy@plt>
lea    0xe25(%rip),%rcx
mov    %r12,%rdi
mov    %r13d,%esi
mov    $0x5,%edx
call   1030 <wep_decrypt@plt>
test   %eax,%eax
je     1279 <test_wep_decrypt+0x159>
mov    %r14,%rdi
mov    %r15,%rsi
mov    %ebx,%edx
call   1040 <memcpy@plt>
lea    0xe25(%rip),%rcx
mov    %r12,%rdi
mov    %r13d,%esi
mov    $0x5,%edx
call   1030 <wep_decrypt@plt>
test   %eax,%eax
je     1279 <test_wep_decrypt+0x159>
mov    %r14,%rdi
mov    %r15,%rsi
mov    %ebx,%edx
call   1040 <memcpy@plt>
lea    0xddb(%rip),%rcx
mov    %r12,%rdi
mov    %r13d,%esi
mov    $0xd,%edx
call   1030 <wep_decrypt@plt>
test   %eax,%eax
je     1279 <test_wep_decrypt+0x159>
mov    %r14,%rdi
mov    %r15,%rsi
mov    %ebx,%edx
call   1040 <memcpy@plt>
lea    0xdcd(%rip),%rcx
mov    %r12,%rdi
mov    %r13d,%esi
mov    $0xd,%edx
call   1030 <wep_decrypt@plt>
xor    %ebp,%ebp
test   %eax,%eax
sete   %bpl
mov    %ebp,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.XKey = type { i32, i8* }
%struct.Ferret = type { i32 }
%struct.NetFrame = type { i32 }
@.str = [14 x i8] c"\A3B\EET\C1.]#\1F\FE\E0\02\00\00"
@.str.1 = [6 x i8] c"\11\11\11\11\11\00"
@.str.2 = [6 x i8] c"KxR\D7\80\00"
@.str.3 = [6 x i8] zeroinitializer
@.str.4 = [6 x i8] c"\124Vx\90\00"
@.str.5 = [14 x i8] c"\10\01\11\11\00\00\11\11\00\00\11\11\01\00"
@.str.6 = [14 x i8] c"\124Vx\90\AB\CD\EF\124Vx\90\00"
@__const.test_wep_decrypt.xkey = [7 x %struct.XKey] [%struct.XKey { i32 104, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i32 0, i32 0) }, %struct.XKey { i32 40, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i32 0, i32 0) }, %struct.XKey { i32 40, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i32 0, i32 0) }, %struct.XKey { i32 40, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i32 0, i32 0) }, %struct.XKey { i32 40, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.4, i32 0, i32 0) }, %struct.XKey { i32 104, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.5, i32 0, i32 0) }, %struct.XKey { i32 104, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.6, i32 0, i32 0) }]
define i32 @test_wep_decrypt(%struct.Ferret* %0, %struct.NetFrame* %1, i8* %2, i32 %3, i8* %4, i32* %5) {
%7 = alloca i32
%8 = alloca %struct.Ferret*
%9 = alloca %struct.NetFrame*
%10 = alloca i8*
%11 = alloca i32
%12 = alloca i8*
%13 = alloca i32*
%14 = alloca i32
%15 = alloca [7 x %struct.XKey]
%16 = alloca i32
store %struct.Ferret* %0, %struct.Ferret** %8
store %struct.NetFrame* %1, %struct.NetFrame** %9
store i8* %2, i8** %10
store i32 %3, i32* %11
store i8* %4, i8** %12
store i32* %5, i32** %13
%17 = bitcast [7 x %struct.XKey]* %15 to i8*
%18 = load %struct.NetFrame*, %struct.NetFrame** %9
store %struct.NetFrame* %18, %struct.NetFrame** %9
%19 = load %struct.Ferret*, %struct.Ferret** %8
store %struct.Ferret* %19, %struct.Ferret** %8
%20 = load i32, i32* %11
%21 = icmp ugt i32 %20, 4
br i1 %21, label %22, label %26
22: ; preds = %6
%23 = load i32, i32* %11
%24 = sub i32 %23, 4
%25 = load i32*, i32** %13
store i32 %24, i32* %25
br label %27
26: ; preds = %6
store i32 0, i32* %7
br label %61
27: ; preds = %22
store i32 0, i32* %14
br label %28
28: ; preds = %57, %27
%29 = load i32, i32* %14
%30 = zext i32 %29 to i64
%31 = icmp ult i64 %30, 7
br i1 %31, label %32, label %60
32: ; preds = %28
%33 = load i8*, i8** %12
%34 = load i8*, i8** %10
%35 = load i32, i32* %11
%36 = call i32 @memcpy(i8* %33, i8* %34, i32 %35)
%37 = load i8*, i8** %12
%38 = getelementptr inbounds i8, i8* %37, i64 24
%39 = load i32, i32* %11
%40 = sub i32 %39, 24
%41 = load i32, i32* %14
%42 = zext i32 %41 to i64
%43 = getelementptr inbounds [7 x %struct.XKey], [7 x %struct.XKey]* %15, i64 0, i64 %42
%44 = getelementptr inbounds %struct.XKey, %struct.XKey* %43, i32 0, i32 0
%45 = load i32, i32* %44
%46 = udiv i32 %45, 8
%47 = load i32, i32* %14
%48 = zext i32 %47 to i64
%49 = getelementptr inbounds [7 x %struct.XKey], [7 x %struct.XKey]* %15, i64 0, i64 %48
%50 = getelementptr inbounds %struct.XKey, %struct.XKey* %49, i32 0, i32 1
%51 = load i8*, i8** %50
%52 = call i32 @wep_decrypt(i8* %38, i32 %40, i32 %46, i8* %51)
store i32 %52, i32* %16
%53 = load i32, i32* %16
%54 = icmp eq i32 %53, 0
br i1 %54, label %55, label %56
55: ; preds = %32
store i32 1, i32* %7
br label %61
56: ; preds = %32
br label %57
57: ; preds = %56
%58 = load i32, i32* %14
%59 = add i32 %58, 1
store i32 %59, i32* %14
br label %28
60: ; preds = %28
store i32 0, i32* %7
br label %61
61: ; preds = %60, %55, %26
%62 = load i32, i32* %7
ret i32 %62
}

LLVM IR (-O2):
%struct.Ferret = type { i32 }
%struct.NetFrame = type { i32 }
@.str = [14 x i8] c"\A3B\EET\C1.]#\1F\FE\E0\02\00\00"
@.str.1 = [6 x i8] c"\11\11\11\11\11\00"
@.str.2 = [6 x i8] c"KxR\D7\80\00"
@.str.3 = [6 x i8] zeroinitializer
@.str.4 = [6 x i8] c"\124Vx\90\00"
@.str.5 = [14 x i8] c"\10\01\11\11\00\00\11\11\00\00\11\11\01\00"
@.str.6 = [14 x i8] c"\124Vx\90\AB\CD\EF\124Vx\90\00"
define i32 @test_wep_decrypt(%struct.Ferret* nocapture readnone %0, %struct.NetFrame* nocapture readnone %1, i8* %2, i32 %3, i8* %4, i32* nocapture writeonly %5) {
%7 = icmp ugt i32 %3, 4
br i1 %7, label %8, label %40
8: ; preds = %6
%9 = add i32 %3, -4
store i32 %9, i32* %5
%10 = getelementptr inbounds i8, i8* %4, i64 24
%11 = add i32 %3, -24
%12 = tail call i32 @memcpy(i8* %4, i8* %2, i32 %3)
%13 = tail call i32 @wep_decrypt(i8* %10, i32 %11, i32 13, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0))
%14 = icmp eq i32 %13, 0
br i1 %14, label %40, label %15
15: ; preds = %8
%16 = tail call i32 @memcpy(i8* %4, i8* %2, i32 %3)
%17 = tail call i32 @wep_decrypt(i8* %10, i32 %11, i32 5, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0))
%18 = icmp eq i32 %17, 0
br i1 %18, label %40, label %19
19: ; preds = %15
%20 = tail call i32 @memcpy(i8* %4, i8* %2, i32 %3)
%21 = tail call i32 @wep_decrypt(i8* %10, i32 %11, i32 5, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0))
%22 = icmp eq i32 %21, 0
br i1 %22, label %40, label %23
23: ; preds = %19
%24 = tail call i32 @memcpy(i8* %4, i8* %2, i32 %3)
%25 = tail call i32 @wep_decrypt(i8* %10, i32 %11, i32 5, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0))
%26 = icmp eq i32 %25, 0
br i1 %26, label %40, label %27
27: ; preds = %23
%28 = tail call i32 @memcpy(i8* %4, i8* %2, i32 %3)
%29 = tail call i32 @wep_decrypt(i8* %10, i32 %11, i32 5, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.4, i64 0, i64 0))
%30 = icmp eq i32 %29, 0
br i1 %30, label %40, label %31
31: ; preds = %27
%32 = tail call i32 @memcpy(i8* %4, i8* %2, i32 %3)
%33 = tail call i32 @wep_decrypt(i8* %10, i32 %11, i32 13, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.5, i64 0, i64 0))
%34 = icmp eq i32 %33, 0
br i1 %34, label %40, label %35
35: ; preds = %31
%36 = tail call i32 @memcpy(i8* %4, i8* %2, i32 %3)
%37 = tail call i32 @wep_decrypt(i8* %10, i32 %11, i32 13, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.6, i64 0, i64 0))
%38 = icmp eq i32 %37, 0
%39 = zext i1 %38 to i32
br label %40
40: ; preds = %35, %8, %15, %19, %23, %27, %31, %6
%41 = phi i32 [ 0, %6 ], [ 1, %8 ], [ 1, %15 ], [ 1, %19 ], [ 1, %23 ], [ 1, %27 ], [ 1, %31 ], [ %39, %35 ]
ret i32 %41
}