#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ crypt(char *, char *, char);
int /*<<< orphan*/ printf(char *, char *);
scalar_t__ strncmp(char *, char *, int);
int main(int argc, char **argv) {
  unsigned int i = 0;
  char one[12] = "8.4,425#-.25";
  char two[12] = "?>!\\%#(0608?";
  char three[12] = ",\" LWQRWV''%";
  char four[12] = "4!8\\2708=KVY";
  char keys[8] = {'c', 's', 'q', 'r', 'a', 'f', 'o', 'h'};
  char flag[13];
  for (i = 0; i < 9; i++) {
    crypt(three, flag, keys[i]);
    if (strncmp(flag, "MCA", 3) == 0) {
      printf("Your flag: %s", flag);
    }
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x14(%rbp)
mov    0xeac(%rip),%rax
mov    %rax,-0x20(%rbp)
mov    0xeaa(%rip),%eax
mov    %eax,-0x18(%rbp)
mov    0xea4(%rip),%rax
mov    %rax,-0x2c(%rbp)
mov    0xea2(%rip),%eax
mov    %eax,-0x24(%rbp)
mov    0xe9c(%rip),%rax
mov    %rax,-0x38(%rbp)
mov    0xe9a(%rip),%eax
mov    %eax,-0x30(%rbp)
mov    0xe94(%rip),%rax
mov    %rax,-0x44(%rbp)
mov    0xe92(%rip),%eax
mov    %eax,-0x3c(%rbp)
mov    0xe8c(%rip),%rax
mov    %rax,-0x4c(%rbp)
movl   $0x0,-0x14(%rbp)
cmpl   $0x9,-0x14(%rbp)
jae    1210 <main+0xe0>
lea    -0x38(%rbp),%rdi
lea    -0x59(%rbp),%rsi
mov    -0x14(%rbp),%eax
movsbl -0x4c(%rbp,%rax,1),%edx
call   1040 <crypt@plt>
lea    -0x59(%rbp),%rdi
lea    0xe5f(%rip),%rsi
mov    $0x3,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%rax
jne    11fd <main+0xcd>
lea    -0x59(%rbp),%rsi
lea    0xe44(%rip),%rdi
call   1050 <printf@plt>
jmp    1202 <main+0xd2>
mov    -0x14(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    11af <main+0x7f>
mov    -0x4(%rbp),%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
sub    $0x20,%rsp
movabs $0x575251574c20222c,%rax
51 52 57
mov    %rax,0x10(%rsp)
movl   $0x25272756,0x18(%rsp)
25
lea    0x10(%rsp),%rdi
lea    0x3(%rsp),%rbx
mov    %rbx,%rsi
mov    $0x63,%edx
call   1040 <crypt@plt>
lea    0xea2(%rip),%rsi
mov    %rbx,%rdi
mov    $0x3,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    118d <main+0x5d>
lea    0xe8d(%rip),%rdi
lea    0x3(%rsp),%rsi
call   1050 <printf@plt>
lea    0x10(%rsp),%rdi
lea    0x3(%rsp),%rbx
mov    %rbx,%rsi
mov    $0x73,%edx
call   1040 <crypt@plt>
lea    0xe61(%rip),%rsi
mov    %rbx,%rdi
mov    $0x3,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    11ce <main+0x9e>
lea    0xe4c(%rip),%rdi
lea    0x3(%rsp),%rsi
call   1050 <printf@plt>
lea    0x10(%rsp),%rdi
lea    0x3(%rsp),%rbx
mov    %rbx,%rsi
mov    $0x71,%edx
call   1040 <crypt@plt>
lea    0xe20(%rip),%rsi
mov    %rbx,%rdi
mov    $0x3,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    120f <main+0xdf>
lea    0xe0b(%rip),%rdi
lea    0x3(%rsp),%rsi
call   1050 <printf@plt>
lea    0x10(%rsp),%rdi
lea    0x3(%rsp),%rbx
mov    %rbx,%rsi
mov    $0x72,%edx
call   1040 <crypt@plt>
lea    0xddf(%rip),%rsi
mov    %rbx,%rdi
mov    $0x3,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    1250 <main+0x120>
lea    0xdca(%rip),%rdi
lea    0x3(%rsp),%rsi
call   1050 <printf@plt>
lea    0x10(%rsp),%rdi
lea    0x3(%rsp),%rbx
mov    %rbx,%rsi
mov    $0x61,%edx
call   1040 <crypt@plt>
lea    0xd9e(%rip),%rsi
mov    %rbx,%rdi
mov    $0x3,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    1291 <main+0x161>
lea    0xd89(%rip),%rdi
lea    0x3(%rsp),%rsi
call   1050 <printf@plt>
lea    0x10(%rsp),%rdi
lea    0x3(%rsp),%rbx
mov    %rbx,%rsi
mov    $0x66,%edx
call   1040 <crypt@plt>
lea    0xd5d(%rip),%rsi
mov    %rbx,%rdi
mov    $0x3,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    12d2 <main+0x1a2>
lea    0xd48(%rip),%rdi
lea    0x3(%rsp),%rsi
call   1050 <printf@plt>
lea    0x10(%rsp),%rdi
lea    0x3(%rsp),%rbx
mov    %rbx,%rsi
mov    $0x6f,%edx
call   1040 <crypt@plt>
lea    0xd1c(%rip),%rsi
mov    %rbx,%rdi
mov    $0x3,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    1313 <main+0x1e3>
lea    0xd07(%rip),%rdi
lea    0x3(%rsp),%rsi
call   1050 <printf@plt>
lea    0x10(%rsp),%rdi
lea    0x3(%rsp),%rbx
mov    %rbx,%rsi
mov    $0x68,%edx
call   1040 <crypt@plt>
lea    0xcdb(%rip),%rsi
mov    %rbx,%rdi
mov    $0x3,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    1354 <main+0x224>
lea    0xcc6(%rip),%rdi
lea    0x3(%rsp),%rsi
call   1050 <printf@plt>
lea    0x10(%rsp),%rdi
lea    0x3(%rsp),%rbx
mov    %rbx,%rsi
xor    %edx,%edx
call   1040 <crypt@plt>
lea    0xc9d(%rip),%rsi
mov    %rbx,%rdi
mov    $0x3,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    1392 <main+0x262>
lea    0xc88(%rip),%rdi
lea    0x3(%rsp),%rsi
call   1050 <printf@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbx
ret

LLVM IR (-O0):
@__const.main.one = [12 x i8] c"8.4,425#-.25"
@__const.main.two = [12 x i8] c"?>!\\%#(0608?"
@__const.main.three = [12 x i8] c",\22 LWQRWV''%"
@__const.main.four = [12 x i8] c"4!8\\2708=KVY"
@__const.main.keys = [8 x i8] c"csqrafoh"
@.str = [4 x i8] c"MCA\00"
@.str.1 = [14 x i8] c"Your flag: %s\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca [12 x i8]
%8 = alloca [12 x i8]
%9 = alloca [12 x i8]
%10 = alloca [12 x i8]
%11 = alloca [8 x i8]
%12 = alloca [13 x i8]
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %6
%13 = bitcast [12 x i8]* %7 to i8*
%14 = bitcast [12 x i8]* %8 to i8*
%15 = bitcast [12 x i8]* %9 to i8*
%16 = bitcast [12 x i8]* %10 to i8*
%17 = bitcast [8 x i8]* %11 to i8*
store i32 0, i32* %6
br label %18
18: ; preds = %36, %2
%19 = load i32, i32* %6
%20 = icmp ult i32 %19, 9
br i1 %20, label %21, label %39
21: ; preds = %18
%22 = getelementptr inbounds [12 x i8], [12 x i8]* %9, i64 0, i64 0
%23 = getelementptr inbounds [13 x i8], [13 x i8]* %12, i64 0, i64 0
%24 = load i32, i32* %6
%25 = zext i32 %24 to i64
%26 = getelementptr inbounds [8 x i8], [8 x i8]* %11, i64 0, i64 %25
%27 = load i8, i8* %26
%28 = call i32 @crypt(i8* %22, i8* %23, i8 signext %27)
%29 = getelementptr inbounds [13 x i8], [13 x i8]* %12, i64 0, i64 0
%30 = call i64 @strncmp(i8* %29, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%31 = icmp eq i64 %30, 0
br i1 %31, label %32, label %35
32: ; preds = %21
%33 = getelementptr inbounds [13 x i8], [13 x i8]* %12, i64 0, i64 0
%34 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %33)
br label %35
35: ; preds = %32, %21
br label %36
36: ; preds = %35
%37 = load i32, i32* %6
%38 = add i32 %37, 1
store i32 %38, i32* %6
br label %18
39: ; preds = %18
%40 = load i32, i32* %3
ret i32 %40
}

LLVM IR (-O2):
@__const.main.three = [12 x i8] c",\22 LWQRWV''%"
@.str = [4 x i8] c"MCA\00"
@.str.1 = [14 x i8] c"Your flag: %s\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [12 x i8]
%4 = alloca [13 x i8]
%5 = getelementptr inbounds [12 x i8], [12 x i8]* %3, i64 0, i64 0
%6 = getelementptr inbounds [13 x i8], [13 x i8]* %4, i64 0, i64 0
%7 = call i32 @crypt(i8* %5, i8* %6, i8 signext 99)
%8 = call i64 @strncmp(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%9 = icmp eq i64 %8, 0
br i1 %9, label %10, label %12
10: ; preds = %2
%11 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %6)
br label %12
12: ; preds = %2, %10
%13 = call i32 @crypt(i8* %5, i8* %6, i8 signext 115)
%14 = call i64 @strncmp(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%15 = icmp eq i64 %14, 0
br i1 %15, label %16, label %18
16: ; preds = %12
%17 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %6)
br label %18
18: ; preds = %16, %12
%19 = call i32 @crypt(i8* %5, i8* %6, i8 signext 113)
%20 = call i64 @strncmp(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%21 = icmp eq i64 %20, 0
br i1 %21, label %22, label %24
22: ; preds = %18
%23 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %6)
br label %24
24: ; preds = %22, %18
%25 = call i32 @crypt(i8* %5, i8* %6, i8 signext 114)
%26 = call i64 @strncmp(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%27 = icmp eq i64 %26, 0
br i1 %27, label %28, label %30
28: ; preds = %24
%29 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %6)
br label %30
30: ; preds = %28, %24
%31 = call i32 @crypt(i8* %5, i8* %6, i8 signext 97)
%32 = call i64 @strncmp(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%33 = icmp eq i64 %32, 0
br i1 %33, label %34, label %36
34: ; preds = %30
%35 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %6)
br label %36
36: ; preds = %34, %30
%37 = call i32 @crypt(i8* %5, i8* %6, i8 signext 102)
%38 = call i64 @strncmp(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%39 = icmp eq i64 %38, 0
br i1 %39, label %40, label %42
40: ; preds = %36
%41 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %6)
br label %42
42: ; preds = %40, %36
%43 = call i32 @crypt(i8* %5, i8* %6, i8 signext 111)
%44 = call i64 @strncmp(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%45 = icmp eq i64 %44, 0
br i1 %45, label %46, label %48
46: ; preds = %42
%47 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %6)
br label %48
48: ; preds = %46, %42
%49 = call i32 @crypt(i8* %5, i8* %6, i8 signext 104)
%50 = call i64 @strncmp(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%51 = icmp eq i64 %50, 0
br i1 %51, label %52, label %54
52: ; preds = %48
%53 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %6)
br label %54
54: ; preds = %52, %48
%55 = call i32 @crypt(i8* %5, i8* %6, i8 signext undef)
%56 = call i64 @strncmp(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%57 = icmp eq i64 %56, 0
br i1 %57, label %58, label %60
58: ; preds = %54
%59 = call i32 @printf(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0), i8* %6)
br label %60
60: ; preds = %58, %54
ret i32 0
}