#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ execl(char const *, char const *, int /*<<< orphan*/);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ getuid();
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
char *strrchr(char const *, char);
void done(const char *shell) {
  register int i;
  const char *sp = strrchr(shell, '/');
  if (sp)
    sp++;
  else
    sp = shell;
  setuid(getuid());
  for (i = 3; i < 15; i++)
    close(i);
  execl(shell, sp, 0);
  printf("No shell!\n");
  exit(0);
}


x86 assembly (clang, -O0):
<done>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x8(%rbp)
mov    -0x8(%rbp),%rdi
mov    $0x2f,%esi
call   1050 <strrchr@plt>
mov    %rax,-0x18(%rbp)
cmpq   $0x0,-0x18(%rbp)
je     11aa <done+0x3a>
mov    -0x18(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x18(%rbp)
jmp    11b2 <done+0x42>
mov    -0x8(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    $0x0,%al
call   1030 <getuid@plt>
mov    %eax,%edi
call   1080 <setuid@plt>
movl   $0x3,-0xc(%rbp)
cmpl   $0xf,-0xc(%rbp)
jge    11e7 <done+0x77>
mov    -0xc(%rbp),%edi
call   1060 <close@plt>
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    11c7 <done+0x57>
mov    -0x8(%rbp),%rdi
mov    -0x18(%rbp),%rsi
xor    %edx,%edx
call   1090 <execl@plt>
lea    0xe03(%rip),%rdi
call   1040 <printf@plt>
xor    %edi,%edi
call   1070 <exit@plt>

x86 assembly (clang, -O2):
<done>:
push   %r14
push   %rbx
push   %rax
mov    %rdi,%rbx
mov    $0x2f,%esi
call   1050 <strrchr@plt>
mov    %rax,%r14
xor    %eax,%eax
call   1040 <getuid@plt>
mov    %eax,%edi
call   1080 <setuid@plt>
mov    $0x3,%edi
call   1060 <close@plt>
mov    $0x4,%edi
call   1060 <close@plt>
mov    $0x5,%edi
call   1060 <close@plt>
mov    $0x6,%edi
call   1060 <close@plt>
mov    $0x7,%edi
call   1060 <close@plt>
mov    $0x8,%edi
call   1060 <close@plt>
mov    $0x9,%edi
call   1060 <close@plt>
mov    $0xa,%edi
call   1060 <close@plt>
mov    $0xb,%edi
call   1060 <close@plt>
mov    $0xc,%edi
call   1060 <close@plt>
mov    $0xd,%edi
call   1060 <close@plt>
mov    $0xe,%edi
call   1060 <close@plt>
lea    0x1(%r14),%rsi
test   %r14,%r14
cmove  %rbx,%rsi
mov    %rbx,%rdi
xor    %edx,%edx
call   1090 <execl@plt>
lea    0xdda(%rip),%rdi
call   1030 <puts@plt>
xor    %edi,%edi
call   1070 <exit@plt>

LLVM IR (-O0):
@.str = [11 x i8] c"No shell!\0A\00"
define void @done(i8* %0) {
%2 = alloca i8*
%3 = alloca i32
%4 = alloca i8*
store i8* %0, i8** %2
%5 = load i8*, i8** %2
%6 = call i8* @strrchr(i8* %5, i8 signext 47)
store i8* %6, i8** %4
%7 = load i8*, i8** %4
%8 = icmp ne i8* %7, null
br i1 %8, label %9, label %12
9: ; preds = %1
%10 = load i8*, i8** %4
%11 = getelementptr inbounds i8, i8* %10, i32 1
store i8* %11, i8** %4
br label %14
12: ; preds = %1
%13 = load i8*, i8** %2
store i8* %13, i8** %4
br label %14
14: ; preds = %12, %9
%15 = call i32 (...) @getuid()
%16 = call i32 @setuid(i32 %15)
store i32 3, i32* %3
br label %17
17: ; preds = %23, %14
%18 = load i32, i32* %3
%19 = icmp slt i32 %18, 15
br i1 %19, label %20, label %26
20: ; preds = %17
%21 = load i32, i32* %3
%22 = call i32 @close(i32 %21)
br label %23
23: ; preds = %20
%24 = load i32, i32* %3
%25 = add nsw i32 %24, 1
store i32 %25, i32* %3
br label %17
26: ; preds = %17
%27 = load i8*, i8** %2
%28 = load i8*, i8** %4
%29 = call i32 @execl(i8* %27, i8* %28, i32 0)
%30 = call i32 @printf(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0))
%31 = call i32 @exit(i32 0)
unreachable
}

LLVM IR (-O2):
@str = [10 x i8] c"No shell!\00"
define void @done(i8* %0) {
%2 = tail call i8* @strrchr(i8* dereferenceable(1) %0, i8 signext 47)
%3 = tail call i32 (...) @getuid()
%4 = tail call i32 @setuid(i32 %3)
%5 = tail call i32 @close(i32 3)
%6 = tail call i32 @close(i32 4)
%7 = tail call i32 @close(i32 5)
%8 = tail call i32 @close(i32 6)
%9 = tail call i32 @close(i32 7)
%10 = tail call i32 @close(i32 8)
%11 = tail call i32 @close(i32 9)
%12 = tail call i32 @close(i32 10)
%13 = tail call i32 @close(i32 11)
%14 = tail call i32 @close(i32 12)
%15 = tail call i32 @close(i32 13)
%16 = tail call i32 @close(i32 14)
%17 = icmp eq i8* %2, null
%18 = getelementptr inbounds i8, i8* %2, i64 1
%19 = select i1 %17, i8* %0, i8* %18
%20 = tail call i32 @execl(i8* %0, i8* %19, i32 0)
%21 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([10 x i8], [10 x i8]* @str, i64 0, i64 0))
%22 = tail call i32 @exit(i32 0)
unreachable
}