#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
scalar_t__ fgets(char *, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *);
scalar_t__ isspace(char);
int /*<<< orphan*/ memcpy(char *, char *, size_t);
int /*<<< orphan*/ pclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *popen(char *, char *);
int /*<<< orphan*/ printf(char *, char *);
int /*<<< orphan*/ stderr;
char *strchr(char *, char);
size_t strlen(char *);
int /*<<< orphan*/ strncmp(char *, char *, int);
int pixie_run(char *pixiecmd, char *pinbuf, size_t *pinlen) {
  int ret = 0;
  FILE *pr = popen(pixiecmd, "r");
  if (pr) {
    char buf[1024], *p;
    while (fgets(buf, sizeof buf, pr)) {
      printf("%s", buf);
      if (ret)
        continue;
      p = buf;
      while (isspace(*p))
        ++p;
      if (!strncmp(p, "[+] WPS pin:", sizeof("[+] WPS pin:") - 1)) {
        ret = 1;
        char *pin = p + sizeof("[+] WPS pin:") - 1;
        while (isspace(*pin))
          ++pin;
        if (!strncmp(pin, "<empty>", 7)) {
          *pinlen = 0;
          *pinbuf = 0;
        } else {
          char *q = strchr(pin, '\n');
          if (q)
            *q = 0;
          else {
            fprintf(stderr, "oops1\n");
            ret = 0;
          }
          size_t pl = strlen(pin);
          if (pl < *pinlen) {
            memcpy(pinbuf, pin, pl + 1);
            *pinlen = pl;
          } else {
            fprintf(stderr, "oops2\n");
            ret = 0;
          }
        }
      } else if (!strncmp(p, "[!] The AP /might be/ vulnerable",
                          sizeof("[!] The AP /might be/ vulnerable") - 1)) {
        ret = -1;
      }
    }
    pclose(pr);
  }
  return ret;
}


x86 assembly (clang, -O0):
<pixie_run>:
push   %rbp
mov    %rsp,%rbp
sub    $0x450,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
movl   $0x0,-0x1c(%rbp)
mov    -0x8(%rbp),%rdi
lea    0xe37(%rip),%rsi
call   10c0 <popen@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
je     140e <pixie_run+0x26e>
jmp    11e2 <pixie_run+0x42>
lea    -0x430(%rbp),%rdi
mov    -0x28(%rbp),%rdx
mov    $0x400,%esi
call   1090 <fgets@plt>
cmp    $0x0,%rax
je     1405 <pixie_run+0x265>
lea    -0x430(%rbp),%rsi
lea    0xdf3(%rip),%rdi
call   1060 <printf@plt>
cmpl   $0x0,-0x1c(%rbp)
je     1223 <pixie_run+0x83>
jmp    11e2 <pixie_run+0x42>
lea    -0x430(%rbp),%rax
mov    %rax,-0x438(%rbp)
mov    -0x438(%rbp),%rax
movsbl (%rax),%edi
call   1080 <isspace@plt>
cmp    $0x0,%rax
je     1261 <pixie_run+0xc1>
mov    -0x438(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x438(%rbp)
jmp    1231 <pixie_run+0x91>
mov    -0x438(%rbp),%rdi
lea    0xd96(%rip),%rsi
mov    $0xc,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%eax
jne    13d3 <pixie_run+0x233>
movl   $0x1,-0x1c(%rbp)
mov    -0x438(%rbp),%rax
add    $0xd,%rax
add    $0xffffffffffffffff,%rax
mov    %rax,-0x440(%rbp)
mov    -0x440(%rbp),%rax
movsbl (%rax),%edi
call   1080 <isspace@plt>
cmp    $0x0,%rax
je     12cf <pixie_run+0x12f>
mov    -0x440(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x440(%rbp)
jmp    129f <pixie_run+0xff>
mov    -0x440(%rbp),%rdi
lea    0xd35(%rip),%rsi
mov    $0x7,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%eax
jne    1307 <pixie_run+0x167>
mov    -0x18(%rbp),%rax
movq   $0x0,(%rax)
mov    -0x10(%rbp),%rax
movb   $0x0,(%rax)
jmp    13ce <pixie_run+0x22e>
mov    -0x440(%rbp),%rdi
mov    $0xa,%esi
call   1050 <strchr@plt>
mov    %rax,-0x448(%rbp)
cmpq   $0x0,-0x448(%rbp)
je     133c <pixie_run+0x19c>
mov    -0x448(%rbp),%rax
movb   $0x0,(%rax)
jmp    1358 <pixie_run+0x1b8>
mov    0x2c9d(%rip),%rax
mov    (%rax),%edi
lea    0xcce(%rip),%rsi
call   10a0 <fprintf@plt>
movl   $0x0,-0x1c(%rbp)
mov    -0x440(%rbp),%rdi
call   1040 <strlen@plt>
mov    %rax,-0x450(%rbp)
mov    -0x450(%rbp),%rax
mov    -0x18(%rbp),%rcx
cmp    (%rcx),%rax
jae    13ad <pixie_run+0x20d>
mov    -0x10(%rbp),%rdi
mov    -0x440(%rbp),%rsi
mov    -0x450(%rbp),%rdx
add    $0x1,%rdx
call   10b0 <memcpy@plt>
mov    -0x450(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
jmp    13c9 <pixie_run+0x229>
mov    0x2c2c(%rip),%rax
mov    (%rax),%edi
lea    0xc64(%rip),%rsi
call   10a0 <fprintf@plt>
movl   $0x0,-0x1c(%rbp)
jmp    13ce <pixie_run+0x22e>
jmp    1400 <pixie_run+0x260>
mov    -0x438(%rbp),%rdi
lea    0xc47(%rip),%rsi
mov    $0x20,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%eax
jne    13fb <pixie_run+0x25b>
movl   $0xffffffff,-0x1c(%rbp)
jmp    1400 <pixie_run+0x260>
jmp    11e2 <pixie_run+0x42>
mov    -0x28(%rbp),%rdi
call   1070 <pclose@plt>
mov    -0x1c(%rbp),%eax
add    $0x450,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<pixie_run>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x418,%rsp
mov    %rdx,%rbx
mov    %rsi,%rbp
lea    0xe42(%rip),%rsi
call   10c0 <popen@plt>
test   %rax,%rax
je     1365 <pixie_run+0x1c5>
mov    %rax,%r15
mov    %rbp,(%rsp)
mov    %rbx,0x8(%rsp)
lea    0xf(%rsp),%rbx
xor    %r14d,%r14d
lea    0x1b(%rsp),%rbp
lea    0x10(%rsp),%r12
lea    0xe11(%rip),%r13
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
mov    %r12,%rdi
mov    $0x400,%esi
mov    %r15,%rdx
call   1090 <fgets@plt>
test   %rax,%rax
je     135b <pixie_run+0x1bb>
mov    %r13,%rdi
mov    %r12,%rsi
call   1060 <printf@plt>
test   %r14d,%r14d
jne    1200 <pixie_run+0x60>
mov    %rbp,%rcx
nopl   0x0(%rax)
mov    %rcx,%rbp
movsbl 0x1(%rbx),%edi
add    $0x1,%rbx
call   1080 <isspace@plt>
lea    0x1(%rbp),%rcx
test   %rax,%rax
jne    1230 <pixie_run+0x90>
mov    %rbx,%rdi
lea    0xdb2(%rip),%rsi
mov    $0xc,%edx
call   1030 <strncmp@plt>
test   %eax,%eax
je     1290 <pixie_run+0xf0>
mov    %rbx,%rdi
lea    0xdbd(%rip),%rsi
mov    $0x20,%edx
call   1030 <strncmp@plt>
cmp    $0x1,%eax
sbb    %r14d,%r14d
lea    0xf(%rsp),%rbx
lea    0x1b(%rsp),%rbp
jmp    1200 <pixie_run+0x60>
nopw   0x0(%rax,%rax,1)
movsbl 0x1(%rbp),%edi
add    $0x1,%rbp
call   1080 <isspace@plt>
test   %rax,%rax
jne    1290 <pixie_run+0xf0>
mov    %rbp,%rdi
lea    0xd66(%rip),%rsi
mov    $0x7,%edx
call   1030 <strncmp@plt>
test   %eax,%eax
je     12d7 <pixie_run+0x137>
mov    %rbp,%rdi
mov    $0xa,%esi
call   1050 <strchr@plt>
test   %rax,%rax
je     12f2 <pixie_run+0x152>
movb   $0x0,(%rax)
mov    $0x1,%r14d
jmp    130a <pixie_run+0x16a>
mov    0x8(%rsp),%rax
movq   $0x0,(%rax)
mov    (%rsp),%rax
movb   $0x0,(%rax)
mov    $0x1,%r14d
jmp    127b <pixie_run+0xdb>
mov    0x2ce7(%rip),%rax
mov    (%rax),%edi
lea    0xd18(%rip),%rsi
call   10a0 <fprintf@plt>
xor    %r14d,%r14d
mov    %rbp,%rdi
call   1040 <strlen@plt>
mov    %rax,%rbx
mov    0x8(%rsp),%rax
cmp    (%rax),%rbx
jae    133e <pixie_run+0x19e>
mov    %rbx,%rdx
add    $0x1,%rdx
mov    (%rsp),%rdi
mov    %rbp,%rsi
mov    %rax,%rbp
call   10b0 <memcpy@plt>
mov    %rbx,0x0(%rbp)
jmp    127b <pixie_run+0xdb>
mov    0x2c9b(%rip),%rax
mov    (%rax),%edi
lea    0xcd3(%rip),%rsi
call   10a0 <fprintf@plt>
xor    %r14d,%r14d
jmp    127b <pixie_run+0xdb>
mov    %r15,%rdi
call   1070 <pclose@plt>
jmp    1368 <pixie_run+0x1c8>
xor    %r14d,%r14d
mov    %r14d,%eax
add    $0x418,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [2 x i8] c"r\00"
@.str.1 = [3 x i8] c"%s\00"
@.str.2 = [13 x i8] c"[+] WPS pin:\00"
@.str.3 = [8 x i8] c"<empty>\00"
@stderr = global i32 0
@.str.4 = [7 x i8] c"oops1\0A\00"
@.str.5 = [7 x i8] c"oops2\0A\00"
@.str.6 = [33 x i8] c"[!] The AP /might be/ vulnerable\00"
define i32 @pixie_run(i8* %0, i8* %1, i64* %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i64*
%7 = alloca i32
%8 = alloca i32*
%9 = alloca [1024 x i8]
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca i64
store i8* %0, i8** %4
store i8* %1, i8** %5
store i64* %2, i64** %6
store i32 0, i32* %7
%14 = load i8*, i8** %4
%15 = call i32* @popen(i8* %14, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
store i32* %15, i32** %8
%16 = load i32*, i32** %8
%17 = icmp ne i32* %16, null
br i1 %17, label %18, label %103
18: ; preds = %3
br label %19
19: ; preds = %99, %29, %18
%20 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%21 = load i32*, i32** %8
%22 = call i64 @fgets(i8* %20, i32 1024, i32* %21)
%23 = icmp ne i64 %22, 0
br i1 %23, label %24, label %100
24: ; preds = %19
%25 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
%26 = call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8* %25)
%27 = load i32, i32* %7
%28 = icmp ne i32 %27, 0
br i1 %28, label %29, label %30
29: ; preds = %24
br label %19
30: ; preds = %24
%31 = getelementptr inbounds [1024 x i8], [1024 x i8]* %9, i64 0, i64 0
store i8* %31, i8** %10
br label %32
32: ; preds = %37, %30
%33 = load i8*, i8** %10
%34 = load i8, i8* %33
%35 = call i64 @isspace(i8 signext %34)
%36 = icmp ne i64 %35, 0
br i1 %36, label %37, label %40
37: ; preds = %32
%38 = load i8*, i8** %10
%39 = getelementptr inbounds i8, i8* %38, i32 1
store i8* %39, i8** %10
br label %32
40: ; preds = %32
%41 = load i8*, i8** %10
%42 = call i32 @strncmp(i8* %41, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.2, i64 0, i64 0), i32 12)
%43 = icmp ne i32 %42, 0
br i1 %43, label %93, label %44
44: ; preds = %40
store i32 1, i32* %7
%45 = load i8*, i8** %10
%46 = getelementptr inbounds i8, i8* %45, i64 13
%47 = getelementptr inbounds i8, i8* %46, i64 -1
store i8* %47, i8** %11
br label %48
48: ; preds = %53, %44
%49 = load i8*, i8** %11
%50 = load i8, i8* %49
%51 = call i64 @isspace(i8 signext %50)
%52 = icmp ne i64 %51, 0
br i1 %52, label %53, label %56
53: ; preds = %48
%54 = load i8*, i8** %11
%55 = getelementptr inbounds i8, i8* %54, i32 1
store i8* %55, i8** %11
br label %48
56: ; preds = %48
%57 = load i8*, i8** %11
%58 = call i32 @strncmp(i8* %57, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i32 7)
%59 = icmp ne i32 %58, 0
br i1 %59, label %63, label %60
60: ; preds = %56
%61 = load i64*, i64** %6
store i64 0, i64* %61
%62 = load i8*, i8** %5
store i8 0, i8* %62
br label %92
63: ; preds = %56
%64 = load i8*, i8** %11
%65 = call i8* @strchr(i8* %64, i8 signext 10)
store i8* %65, i8** %12
%66 = load i8*, i8** %12
%67 = icmp ne i8* %66, null
br i1 %67, label %68, label %70
68: ; preds = %63
%69 = load i8*, i8** %12
store i8 0, i8* %69
br label %73
70: ; preds = %63
%71 = load i32, i32* @stderr
%72 = call i32 @fprintf(i32 %71, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.4, i64 0, i64 0))
store i32 0, i32* %7
br label %73
73: ; preds = %70, %68
%74 = load i8*, i8** %11
%75 = call i64 @strlen(i8* %74)
store i64 %75, i64* %13
%76 = load i64, i64* %13
%77 = load i64*, i64** %6
%78 = load i64, i64* %77
%79 = icmp ult i64 %76, %78
br i1 %79, label %80, label %88
80: ; preds = %73
%81 = load i8*, i8** %5
%82 = load i8*, i8** %11
%83 = load i64, i64* %13
%84 = add i64 %83, 1
%85 = call i32 @memcpy(i8* %81, i8* %82, i64 %84)
%86 = load i64, i64* %13
%87 = load i64*, i64** %6
store i64 %86, i64* %87
br label %91
88: ; preds = %73
%89 = load i32, i32* @stderr
%90 = call i32 @fprintf(i32 %89, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0))
store i32 0, i32* %7
br label %91
91: ; preds = %88, %80
br label %92
92: ; preds = %91, %60
br label %99
93: ; preds = %40
%94 = load i8*, i8** %10
%95 = call i32 @strncmp(i8* %94, i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.6, i64 0, i64 0), i32 32)
%96 = icmp ne i32 %95, 0
br i1 %96, label %98, label %97
97: ; preds = %93
store i32 -1, i32* %7
br label %98
98: ; preds = %97, %93
br label %99
99: ; preds = %98, %92
br label %19
100: ; preds = %19
%101 = load i32*, i32** %8
%102 = call i32 @pclose(i32* %101)
br label %103
103: ; preds = %100, %3
%104 = load i32, i32* %7
ret i32 %104
}

LLVM IR (-O2):
@.str = [2 x i8] c"r\00"
@.str.1 = [3 x i8] c"%s\00"
@.str.2 = [13 x i8] c"[+] WPS pin:\00"
@.str.3 = [8 x i8] c"<empty>\00"
@stderr = global i32 0
@.str.4 = [7 x i8] c"oops1\0A\00"
@.str.5 = [7 x i8] c"oops2\0A\00"
@.str.6 = [33 x i8] c"[!] The AP /might be/ vulnerable\00"
define i32 @pixie_run(i8* nocapture %0, i8* %1, i64* nocapture %2) {
%4 = alloca [1024 x i8]
%5 = tail call i32* @popen(i8* %0, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%6 = icmp eq i32* %5, null
br i1 %6, label %64, label %7
7: ; preds = %3
%8 = getelementptr inbounds [1024 x i8], [1024 x i8]* %4, i64 0, i64 0
br label %9
9: ; preds = %60, %7
%10 = phi i32 [ 0, %7 ], [ %61, %60 ]
%11 = icmp eq i32 %10, 0
br label %12
12: ; preds = %9, %15
%13 = call i64 @fgets(i8* %8, i32 1024, i32* %5)
%14 = icmp eq i64 %13, 0
br i1 %14, label %62, label %15
15: ; preds = %12
%16 = call i32 @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8* %8)
br i1 %11, label %17, label %12
17: ; preds = %15, %17
%18 = phi i8* [ %22, %17 ], [ %8, %15 ]
%19 = load i8, i8* %18
%20 = call i64 @isspace(i8 signext %19)
%21 = icmp eq i64 %20, 0
%22 = getelementptr inbounds i8, i8* %18, i64 1
br i1 %21, label %23, label %17
23: ; preds = %17
%24 = call i32 @strncmp(i8* %18, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.2, i64 0, i64 0), i32 12)
%25 = icmp eq i32 %24, 0
br i1 %25, label %26, label %56
26: ; preds = %23
%27 = getelementptr inbounds i8, i8* %18, i64 12
br label %28
28: ; preds = %28, %26
%29 = phi i8* [ %27, %26 ], [ %33, %28 ]
%30 = load i8, i8* %29
%31 = call i64 @isspace(i8 signext %30)
%32 = icmp eq i64 %31, 0
%33 = getelementptr inbounds i8, i8* %29, i64 1
br i1 %32, label %34, label %28
34: ; preds = %28
%35 = call i32 @strncmp(i8* %29, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i32 7)
%36 = icmp eq i32 %35, 0
br i1 %36, label %37, label %38
37: ; preds = %34
store i64 0, i64* %2
store i8 0, i8* %1
br label %60
38: ; preds = %34
%39 = call i8* @strchr(i8* %29, i8 signext 10)
%40 = icmp eq i8* %39, null
br i1 %40, label %42, label %41
41: ; preds = %38
store i8 0, i8* %39
br label %45
42: ; preds = %38
%43 = load i32, i32* @stderr
%44 = call i32 @fprintf(i32 %43, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.4, i64 0, i64 0))
br label %45
45: ; preds = %42, %41
%46 = phi i32 [ 1, %41 ], [ 0, %42 ]
%47 = call i64 @strlen(i8* %29)
%48 = load i64, i64* %2
%49 = icmp ult i64 %47, %48
br i1 %49, label %50, label %53
50: ; preds = %45
%51 = add nuw i64 %47, 1
%52 = call i32 @memcpy(i8* %1, i8* %29, i64 %51)
store i64 %47, i64* %2
br label %60
53: ; preds = %45
%54 = load i32, i32* @stderr
%55 = call i32 @fprintf(i32 %54, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0))
br label %60
56: ; preds = %23
%57 = call i32 @strncmp(i8* %18, i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.6, i64 0, i64 0), i32 32)
%58 = icmp eq i32 %57, 0
%59 = sext i1 %58 to i32
br label %60
60: ; preds = %56, %37, %53, %50
%61 = phi i32 [ 1, %37 ], [ %46, %50 ], [ 0, %53 ], [ %59, %56 ]
br label %9
62: ; preds = %12
%63 = call i32 @pclose(i32* %5)
br label %64
64: ; preds = %62, %3
%65 = phi i32 [ %10, %62 ], [ 0, %3 ]
ret i32 %65
}