#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ uint64_t;

/* Variables and functions */
scalar_t__ mrtd_bac_challenge_ok(char *, char *, char *, char *, char *);
int /*<<< orphan*/ mrtd_bac_cmd_data(char *, char *, char *, char *, char *,
                                     char *);
int /*<<< orphan*/ mrtd_bac_get_ssc(char *, char *);
int /*<<< orphan*/ mrtd_bac_kenc_kmac(char *, char *, char *);
int /*<<< orphan*/ mrtd_bac_kmrz_to_kenc_kmac(char *, char *, char *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ printhex(char *, char *, int);
int /*<<< orphan*/ strncpy(char *, char *, int);
int main() {
  int i;
  char *mrp_number = "L898902C<";
  char *mrp_numbercd = "3";
  char *mrp_dob = "690806";
  char *mrp_dobcd = "1";
  char *mrp_expiry = "940623";
  char *mrp_expirycd = "6";
  char remotechallenge[8] = {0x46, 0x08, 0xf9, 0x19, 0x88, 0x70, 0x22, 0x12};
  char rnd_ifd[8] = {0x78, 0x17, 0x23, 0x86, 0x0c, 0x06, 0xc2, 0x26};
  char kifd[16] = {0x0b, 0x79, 0x52, 0x40, 0xcb, 0x70, 0x49, 0xb0,
                   0x1c, 0x19, 0xb3, 0x3e, 0x32, 0x80, 0x4f, 0x0b};
  char rx_data[40] = {0x46, 0xB9, 0x34, 0x2A, 0x41, 0x39, 0x6C, 0xD7,
                      0x38, 0x6B, 0xF5, 0x80, 0x31, 0x04, 0xD7, 0xCE,
                      0xDC, 0x12, 0x2B, 0x91, 0x32, 0x13, 0x9B, 0xAF,
                      0x2E, 0xED, 0xC9, 0x4E, 0xE1, 0x78, 0x53, 0x4F,
                      0x2f, 0x2D, 0x23, 0x5D, 0x07, 0x4D, 0x74, 0x49};
  char kmrz[25];
  char kenc[16];
  char kmac[16];
  char cmd_data[40];
  char rnd_icc[8];
  char kicc[16];
  char xored[16];
  char ksenc[16];
  char ksmac[16];
  uint64_t ssc_long;
  strncpy(kmrz, mrp_number, 9);
  strncpy(kmrz + 9, mrp_numbercd, 1);
  strncpy(kmrz + 10, mrp_dob, 6);
  strncpy(kmrz + 16, mrp_dobcd, 1);
  strncpy(kmrz + 17, mrp_expiry, 6);
  strncpy(kmrz + 23, mrp_expirycd, 1);
  mrtd_bac_kmrz_to_kenc_kmac(kmrz, kenc, kmac);
  printhex("kenc", kenc, 16);
  printhex("kmac", kmac, 16);
  mrtd_bac_cmd_data(rnd_ifd, kifd, remotechallenge, kenc, kmac, cmd_data);
  printhex("cmd_data", cmd_data, 40);
  if (mrtd_bac_challenge_ok(rx_data, kenc, rnd_ifd, rnd_icc, kicc)) {
    printf("======================\nChallenge "
           "successful!\n======================\n");
  } else {
    printf("======================\nChallenge "
           "failed...\n======================\n");
  }
  printhex("rnd_ifd", rnd_ifd, 8);
  printhex("kicc", kicc, 16);
  for (i = 0; i < 16; i++) {
    xored[i] = kifd[i] ^ kicc[i];
  }
  mrtd_bac_kenc_kmac(xored, ksenc, ksmac);
  printhex("ksenc", ksenc, 16);
  printhex("ksmac", ksmac, 16);
  ssc_long = mrtd_bac_get_ssc(remotechallenge, rnd_ifd);
  printf("ssc: %lx\n", ssc_long);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x160,%rsp
movl   $0x0,-0x4(%rbp)
lea    0xe57(%rip),%rax
mov    %rax,-0x10(%rbp)
lea    0xe64(%rip),%rax
mov    %rax,-0x18(%rbp)
lea    0xe4b(%rip),%rax
mov    %rax,-0x20(%rbp)
lea    0xe47(%rip),%rax
mov    %rax,-0x28(%rbp)
lea    0xe3e(%rip),%rax
mov    %rax,-0x30(%rbp)
lea    0xe2f(%rip),%rax
mov    %rax,-0x38(%rbp)
mov    0xeed(%rip),%rax
mov    %rax,-0x40(%rbp)
mov    0xeea(%rip),%rax
mov    %rax,-0x48(%rbp)
mov    0xeef(%rip),%rax
mov    %rax,-0x60(%rbp)
mov    0xeec(%rip),%rax
mov    %rax,-0x58(%rbp)
lea    -0x90(%rbp),%rdi
lea    0xee2(%rip),%rsi
mov    $0x28,%edx
call   1070 <memcpy@plt>
lea    -0xb0(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    $0x9,%edx
call   1040 <strncpy@plt>
lea    -0xb0(%rbp),%rdi
add    $0x9,%rdi
mov    -0x18(%rbp),%rsi
mov    $0x1,%edx
call   1040 <strncpy@plt>
lea    -0xb0(%rbp),%rdi
add    $0xa,%rdi
mov    -0x20(%rbp),%rsi
mov    $0x6,%edx
call   1040 <strncpy@plt>
lea    -0xb0(%rbp),%rdi
add    $0x10,%rdi
mov    -0x28(%rbp),%rsi
mov    $0x1,%edx
call   1040 <strncpy@plt>
lea    -0xb0(%rbp),%rdi
add    $0x11,%rdi
mov    -0x30(%rbp),%rsi
mov    $0x6,%edx
call   1040 <strncpy@plt>
lea    -0xb0(%rbp),%rdi
add    $0x17,%rdi
mov    -0x38(%rbp),%rsi
mov    $0x1,%edx
call   1040 <strncpy@plt>
lea    -0xb0(%rbp),%rdi
lea    -0xc0(%rbp),%rsi
lea    -0xd0(%rbp),%rdx
call   10a0 <mrtd_bac_kmrz_to_kenc_kmac@plt>
lea    -0xc0(%rbp),%rsi
lea    0xd38(%rip),%rdi
mov    $0x10,%edx
call   1080 <printhex@plt>
lea    -0xd0(%rbp),%rsi
lea    0xd25(%rip),%rdi
mov    $0x10,%edx
call   1080 <printhex@plt>
lea    -0x48(%rbp),%rdi
lea    -0x60(%rbp),%rsi
lea    -0x40(%rbp),%rdx
lea    -0xc0(%rbp),%rcx
lea    -0xd0(%rbp),%r8
lea    -0x100(%rbp),%r9
call   1030 <mrtd_bac_cmd_data@plt>
lea    -0x100(%rbp),%rsi
lea    0xcec(%rip),%rdi
mov    $0x28,%edx
call   1080 <printhex@plt>
lea    -0x90(%rbp),%rdi
lea    -0xc0(%rbp),%rsi
lea    -0x48(%rbp),%rdx
lea    -0x108(%rbp),%rcx
lea    -0x120(%rbp),%r8
call   1060 <mrtd_bac_challenge_ok@plt>
cmp    $0x0,%rax
je     1384 <main+0x1f4>
lea    0xcb5(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
jmp    1392 <main+0x202>
lea    0xce7(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    -0x48(%rbp),%rsi
lea    0xd18(%rip),%rdi
mov    $0x8,%edx
call   1080 <printhex@plt>
lea    -0x120(%rbp),%rsi
lea    0xd08(%rip),%rdi
mov    $0x10,%edx
call   1080 <printhex@plt>
movl   $0x0,-0x8(%rbp)
cmpl   $0x10,-0x8(%rbp)
jge    1402 <main+0x272>
movslq -0x8(%rbp),%rax
movsbl -0x60(%rbp,%rax,1),%eax
movslq -0x8(%rbp),%rcx
movsbl -0x120(%rbp,%rcx,1),%ecx
ff
xor    %ecx,%eax
mov    %al,%cl
movslq -0x8(%rbp),%rax
mov    %cl,-0x130(%rbp,%rax,1)
mov    -0x8(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x8(%rbp)
jmp    13c6 <main+0x236>
lea    -0x130(%rbp),%rdi
lea    -0x140(%rbp),%rsi
lea    -0x150(%rbp),%rdx
call   1090 <mrtd_bac_kenc_kmac@plt>
lea    -0x140(%rbp),%rsi
lea    0xc98(%rip),%rdi
mov    $0x10,%edx
call   1080 <printhex@plt>
lea    -0x150(%rbp),%rsi
lea    0xc86(%rip),%rdi
mov    $0x10,%edx
call   1080 <printhex@plt>
lea    -0x40(%rbp),%rdi
lea    -0x48(%rbp),%rsi
call   10b0 <mrtd_bac_get_ssc@plt>
mov    %eax,-0x154(%rbp)
mov    -0x154(%rbp),%esi
lea    0xc62(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
xor    %eax,%eax
add    $0x160,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x110,%rsp
movabs $0x1222708819f90846,%rax
70 22 12
mov    %rax,0x8(%rsp)
movabs $0x26c2060c86231778,%rax
06 c2 26
mov    %rax,(%rsp)
movaps 0xf1c(%rip),%xmm0
movaps %xmm0,0x30(%rsp)
movaps 0xf30(%rip),%xmm0
movaps %xmm0,0x80(%rsp)
movaps 0xf11(%rip),%xmm0
movaps %xmm0,0x70(%rsp)
movabs $0x49744d075d232d2f,%rax
4d 74 49
mov    %rax,0x90(%rsp)
lea    0xe03(%rip),%rsi
lea    0x10(%rsp),%r14
mov    %r14,%rdi
mov    $0x9,%edx
call   1040 <strncpy@plt>
lea    0x19(%rsp),%rdi
lea    0xdfd(%rip),%rsi
mov    $0x1,%edx
call   1040 <strncpy@plt>
lea    0x1a(%rsp),%rdi
lea    0xdd9(%rip),%rsi
mov    $0x6,%edx
call   1040 <strncpy@plt>
lea    0x20(%rsp),%rdi
lea    0xdca(%rip),%rsi
mov    $0x1,%edx
call   1040 <strncpy@plt>
lea    0x21(%rsp),%rdi
lea    0xdb6(%rip),%rsi
mov    $0x6,%edx
call   1040 <strncpy@plt>
lea    0x27(%rsp),%rdi
lea    0xd9c(%rip),%rsi
mov    $0x1,%edx
call   1040 <strncpy@plt>
lea    0xd0(%rsp),%r12
lea    0xc0(%rsp),%r13
mov    %r14,%rdi
mov    %r12,%rsi
mov    %r13,%rdx
call   10a0 <mrtd_bac_kmrz_to_kenc_kmac@plt>
lea    0xd78(%rip),%rdi
mov    %r12,%rsi
mov    $0x10,%edx
call   1080 <printhex@plt>
lea    0xd69(%rip),%rdi
mov    %r13,%rsi
mov    $0x10,%edx
call   1080 <printhex@plt>
mov    %rsp,%r15
lea    0x30(%rsp),%rsi
lea    0x8(%rsp),%r14
lea    0xe0(%rsp),%rbx
mov    %r15,%rdi
mov    %r14,%rdx
mov    %r12,%rcx
mov    %r13,%r8
mov    %rbx,%r9
call   1030 <mrtd_bac_cmd_data@plt>
lea    0xd31(%rip),%rdi
mov    %rbx,%rsi
mov    $0x28,%edx
call   1080 <printhex@plt>
lea    0x70(%rsp),%rdi
lea    0x68(%rsp),%rcx
lea    0x50(%rsp),%rbx
mov    %r12,%rsi
mov    %r15,%rdx
mov    %rbx,%r8
call   1070 <mrtd_bac_challenge_ok@plt>
test   %rax,%rax
lea    0xd29(%rip),%rax
lea    0xd64(%rip),%rdi
cmove  %rax,%rdi
call   1050 <puts@plt>
lea    0xcef(%rip),%rdi
mov    %r15,%rsi
mov    $0x8,%edx
call   1080 <printhex@plt>
lea    0xce3(%rip),%rdi
mov    %rbx,%rsi
mov    $0x10,%edx
call   1080 <printhex@plt>
movaps 0x50(%rsp),%xmm0
xorps  0x30(%rsp),%xmm0
movaps %xmm0,0x40(%rsp)
lea    0x40(%rsp),%rdi
lea    0xb0(%rsp),%rbx
lea    0xa0(%rsp),%r12
mov    %rbx,%rsi
mov    %r12,%rdx
call   1090 <mrtd_bac_kenc_kmac@plt>
lea    0xca5(%rip),%rdi
mov    %rbx,%rsi
mov    $0x10,%edx
call   1080 <printhex@plt>
lea    0xc97(%rip),%rdi
mov    %r12,%rsi
mov    $0x10,%edx
call   1080 <printhex@plt>
mov    %r14,%rdi
mov    %r15,%rsi
call   10b0 <mrtd_bac_get_ssc@plt>
lea    0xc7e(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1060 <printf@plt>
xor    %eax,%eax
add    $0x110,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [10 x i8] c"L898902C<\00"
@.str.1 = [2 x i8] c"3\00"
@.str.2 = [7 x i8] c"690806\00"
@.str.3 = [2 x i8] c"1\00"
@.str.4 = [7 x i8] c"940623\00"
@.str.5 = [2 x i8] c"6\00"
@__const.main.remotechallenge = [8 x i8] c"F\08\F9\19\88p\22\12"
@__const.main.rnd_ifd = [8 x i8] c"x\17#\86\0C\06\C2&"
@__const.main.kifd = [16 x i8] c"\0ByR@\CBpI\B0\1C\19\B3>2\80O\0B"
@__const.main.rx_data = [40 x i8] c"F\B94*A9l\D78k\F5\801\04\D7\CE\DC\12+\912\13\9B\AF.\ED\C9N\E1xSO/-#]\07MtI"
@.str.6 = [5 x i8] c"kenc\00"
@.str.7 = [5 x i8] c"kmac\00"
@.str.8 = [9 x i8] c"cmd_data\00"
@.str.9 = [69 x i8] c"======================\0AChallenge successful!\0A======================\0A\00"
@.str.10 = [67 x i8] c"======================\0AChallenge failed...\0A======================\0A\00"
@.str.11 = [8 x i8] c"rnd_ifd\00"
@.str.12 = [5 x i8] c"kicc\00"
@.str.13 = [6 x i8] c"ksenc\00"
@.str.14 = [6 x i8] c"ksmac\00"
@.str.15 = [10 x i8] c"ssc: %lx\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca [8 x i8]
%10 = alloca [8 x i8]
%11 = alloca [16 x i8]
%12 = alloca [40 x i8]
%13 = alloca [25 x i8]
%14 = alloca [16 x i8]
%15 = alloca [16 x i8]
%16 = alloca [40 x i8]
%17 = alloca [8 x i8]
%18 = alloca [16 x i8]
%19 = alloca [16 x i8]
%20 = alloca [16 x i8]
%21 = alloca [16 x i8]
%22 = alloca i32
store i32 0, i32* %1
store i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8** %3
store i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0), i8** %4
store i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0), i8** %5
store i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0), i8** %6
store i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.4, i64 0, i64 0), i8** %7
store i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0), i8** %8
%23 = bitcast [8 x i8]* %9 to i8*
%24 = bitcast [8 x i8]* %10 to i8*
%25 = bitcast [16 x i8]* %11 to i8*
%26 = bitcast [40 x i8]* %12 to i8*
%27 = getelementptr inbounds [25 x i8], [25 x i8]* %13, i64 0, i64 0
%28 = load i8*, i8** %3
%29 = call i32 @strncpy(i8* %27, i8* %28, i32 9)
%30 = getelementptr inbounds [25 x i8], [25 x i8]* %13, i64 0, i64 0
%31 = getelementptr inbounds i8, i8* %30, i64 9
%32 = load i8*, i8** %4
%33 = call i32 @strncpy(i8* %31, i8* %32, i32 1)
%34 = getelementptr inbounds [25 x i8], [25 x i8]* %13, i64 0, i64 0
%35 = getelementptr inbounds i8, i8* %34, i64 10
%36 = load i8*, i8** %5
%37 = call i32 @strncpy(i8* %35, i8* %36, i32 6)
%38 = getelementptr inbounds [25 x i8], [25 x i8]* %13, i64 0, i64 0
%39 = getelementptr inbounds i8, i8* %38, i64 16
%40 = load i8*, i8** %6
%41 = call i32 @strncpy(i8* %39, i8* %40, i32 1)
%42 = getelementptr inbounds [25 x i8], [25 x i8]* %13, i64 0, i64 0
%43 = getelementptr inbounds i8, i8* %42, i64 17
%44 = load i8*, i8** %7
%45 = call i32 @strncpy(i8* %43, i8* %44, i32 6)
%46 = getelementptr inbounds [25 x i8], [25 x i8]* %13, i64 0, i64 0
%47 = getelementptr inbounds i8, i8* %46, i64 23
%48 = load i8*, i8** %8
%49 = call i32 @strncpy(i8* %47, i8* %48, i32 1)
%50 = getelementptr inbounds [25 x i8], [25 x i8]* %13, i64 0, i64 0
%51 = getelementptr inbounds [16 x i8], [16 x i8]* %14, i64 0, i64 0
%52 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 0
%53 = call i32 @mrtd_bac_kmrz_to_kenc_kmac(i8* %50, i8* %51, i8* %52)
%54 = getelementptr inbounds [16 x i8], [16 x i8]* %14, i64 0, i64 0
%55 = call i32 @printhex(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.6, i64 0, i64 0), i8* %54, i32 16)
%56 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 0
%57 = call i32 @printhex(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.7, i64 0, i64 0), i8* %56, i32 16)
%58 = getelementptr inbounds [8 x i8], [8 x i8]* %10, i64 0, i64 0
%59 = getelementptr inbounds [16 x i8], [16 x i8]* %11, i64 0, i64 0
%60 = getelementptr inbounds [8 x i8], [8 x i8]* %9, i64 0, i64 0
%61 = getelementptr inbounds [16 x i8], [16 x i8]* %14, i64 0, i64 0
%62 = getelementptr inbounds [16 x i8], [16 x i8]* %15, i64 0, i64 0
%63 = getelementptr inbounds [40 x i8], [40 x i8]* %16, i64 0, i64 0
%64 = call i32 @mrtd_bac_cmd_data(i8* %58, i8* %59, i8* %60, i8* %61, i8* %62, i8* %63)
%65 = getelementptr inbounds [40 x i8], [40 x i8]* %16, i64 0, i64 0
%66 = call i32 @printhex(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.8, i64 0, i64 0), i8* %65, i32 40)
%67 = getelementptr inbounds [40 x i8], [40 x i8]* %12, i64 0, i64 0
%68 = getelementptr inbounds [16 x i8], [16 x i8]* %14, i64 0, i64 0
%69 = getelementptr inbounds [8 x i8], [8 x i8]* %10, i64 0, i64 0
%70 = getelementptr inbounds [8 x i8], [8 x i8]* %17, i64 0, i64 0
%71 = getelementptr inbounds [16 x i8], [16 x i8]* %18, i64 0, i64 0
%72 = call i64 @mrtd_bac_challenge_ok(i8* %67, i8* %68, i8* %69, i8* %70, i8* %71)
%73 = icmp ne i64 %72, 0
br i1 %73, label %74, label %76
74: ; preds = %0
%75 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([69 x i8], [69 x i8]* @.str.9, i64 0, i64 0))
br label %78
76: ; preds = %0
%77 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([67 x i8], [67 x i8]* @.str.10, i64 0, i64 0))
br label %78
78: ; preds = %76, %74
%79 = getelementptr inbounds [8 x i8], [8 x i8]* %10, i64 0, i64 0
%80 = call i32 @printhex(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.11, i64 0, i64 0), i8* %79, i32 8)
%81 = getelementptr inbounds [16 x i8], [16 x i8]* %18, i64 0, i64 0
%82 = call i32 @printhex(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.12, i64 0, i64 0), i8* %81, i32 16)
store i32 0, i32* %2
br label %83
83: ; preds = %102, %78
%84 = load i32, i32* %2
%85 = icmp slt i32 %84, 16
br i1 %85, label %86, label %105
86: ; preds = %83
%87 = load i32, i32* %2
%88 = sext i32 %87 to i64
%89 = getelementptr inbounds [16 x i8], [16 x i8]* %11, i64 0, i64 %88
%90 = load i8, i8* %89
%91 = sext i8 %90 to i32
%92 = load i32, i32* %2
%93 = sext i32 %92 to i64
%94 = getelementptr inbounds [16 x i8], [16 x i8]* %18, i64 0, i64 %93
%95 = load i8, i8* %94
%96 = sext i8 %95 to i32
%97 = xor i32 %91, %96
%98 = trunc i32 %97 to i8
%99 = load i32, i32* %2
%100 = sext i32 %99 to i64
%101 = getelementptr inbounds [16 x i8], [16 x i8]* %19, i64 0, i64 %100
store i8 %98, i8* %101
br label %102
102: ; preds = %86
%103 = load i32, i32* %2
%104 = add nsw i32 %103, 1
store i32 %104, i32* %2
br label %83
105: ; preds = %83
%106 = getelementptr inbounds [16 x i8], [16 x i8]* %19, i64 0, i64 0
%107 = getelementptr inbounds [16 x i8], [16 x i8]* %20, i64 0, i64 0
%108 = getelementptr inbounds [16 x i8], [16 x i8]* %21, i64 0, i64 0
%109 = call i32 @mrtd_bac_kenc_kmac(i8* %106, i8* %107, i8* %108)
%110 = getelementptr inbounds [16 x i8], [16 x i8]* %20, i64 0, i64 0
%111 = call i32 @printhex(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.13, i64 0, i64 0), i8* %110, i32 16)
%112 = getelementptr inbounds [16 x i8], [16 x i8]* %21, i64 0, i64 0
%113 = call i32 @printhex(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.14, i64 0, i64 0), i8* %112, i32 16)
%114 = getelementptr inbounds [8 x i8], [8 x i8]* %9, i64 0, i64 0
%115 = getelementptr inbounds [8 x i8], [8 x i8]* %10, i64 0, i64 0
%116 = call i32 @mrtd_bac_get_ssc(i8* %114, i8* %115)
store i32 %116, i32* %22
%117 = load i32, i32* %22
%118 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.15, i64 0, i64 0), i32 %117)
ret i32 0
}

LLVM IR (-O2):
@.str = [10 x i8] c"L898902C<\00"
@.str.1 = [2 x i8] c"3\00"
@.str.2 = [7 x i8] c"690806\00"
@.str.3 = [2 x i8] c"1\00"
@.str.4 = [7 x i8] c"940623\00"
@.str.5 = [2 x i8] c"6\00"
@__const.main.kifd = [16 x i8] c"\0ByR@\CBpI\B0\1C\19\B3>2\80O\0B"
@__const.main.rx_data = [40 x i8] c"F\B94*A9l\D78k\F5\801\04\D7\CE\DC\12+\912\13\9B\AF.\ED\C9N\E1xSO/-#]\07MtI"
@.str.6 = [5 x i8] c"kenc\00"
@.str.7 = [5 x i8] c"kmac\00"
@.str.8 = [9 x i8] c"cmd_data\00"
@.str.11 = [8 x i8] c"rnd_ifd\00"
@.str.12 = [5 x i8] c"kicc\00"
@.str.13 = [6 x i8] c"ksenc\00"
@.str.14 = [6 x i8] c"ksmac\00"
@.str.15 = [10 x i8] c"ssc: %lx\0A\00"
@str = [66 x i8] c"======================\0AChallenge failed...\0A======================\00"
@str.16 = [68 x i8] c"======================\0AChallenge successful!\0A======================\00"
define i32 @main() {
%1 = alloca i64
%2 = alloca i64
%3 = alloca <16 x i8>
%4 = alloca [40 x i8]
%5 = alloca [25 x i8]
%6 = alloca [16 x i8]
%7 = alloca [16 x i8]
%8 = alloca [40 x i8]
%9 = alloca [8 x i8]
%10 = alloca <16 x i8>
%11 = alloca <16 x i8>
%12 = alloca [16 x i8]
%13 = alloca [16 x i8]
%14 = bitcast i64* %1 to i8*
store i64 1306730571744479302, i64* %1
%15 = bitcast i64* %2 to i8*
store i64 2792801369782949752, i64* %2
%16 = getelementptr inbounds <16 x i8>, <16 x i8>* %3, i64 0, i64 0
%17 = getelementptr inbounds [40 x i8], [40 x i8]* %4, i64 0, i64 0
%18 = getelementptr inbounds [25 x i8], [25 x i8]* %5, i64 0, i64 0
%19 = getelementptr inbounds [16 x i8], [16 x i8]* %6, i64 0, i64 0
%20 = getelementptr inbounds [16 x i8], [16 x i8]* %7, i64 0, i64 0
%21 = getelementptr inbounds [40 x i8], [40 x i8]* %8, i64 0, i64 0
%22 = getelementptr inbounds [8 x i8], [8 x i8]* %9, i64 0, i64 0
%23 = getelementptr inbounds <16 x i8>, <16 x i8>* %10, i64 0, i64 0
%24 = getelementptr inbounds <16 x i8>, <16 x i8>* %11, i64 0, i64 0
%25 = getelementptr inbounds [16 x i8], [16 x i8]* %12, i64 0, i64 0
%26 = getelementptr inbounds [16 x i8], [16 x i8]* %13, i64 0, i64 0
%27 = call i32 @strncpy(i8* %18, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 9)
%28 = getelementptr inbounds [25 x i8], [25 x i8]* %5, i64 0, i64 9
%29 = call i32 @strncpy(i8* %28, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0), i32 1)
%30 = getelementptr inbounds [25 x i8], [25 x i8]* %5, i64 0, i64 10
%31 = call i32 @strncpy(i8* %30, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0), i32 6)
%32 = getelementptr inbounds [25 x i8], [25 x i8]* %5, i64 0, i64 16
%33 = call i32 @strncpy(i8* %32, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0), i32 1)
%34 = getelementptr inbounds [25 x i8], [25 x i8]* %5, i64 0, i64 17
%35 = call i32 @strncpy(i8* %34, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.4, i64 0, i64 0), i32 6)
%36 = getelementptr inbounds [25 x i8], [25 x i8]* %5, i64 0, i64 23
%37 = call i32 @strncpy(i8* %36, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0), i32 1)
%38 = call i32 @mrtd_bac_kmrz_to_kenc_kmac(i8* %18, i8* %19, i8* %20)
%39 = call i32 @printhex(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.6, i64 0, i64 0), i8* %19, i32 16)
%40 = call i32 @printhex(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.7, i64 0, i64 0), i8* %20, i32 16)
%41 = call i32 @mrtd_bac_cmd_data(i8* %15, i8* %16, i8* %14, i8* %19, i8* %20, i8* %21)
%42 = call i32 @printhex(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.8, i64 0, i64 0), i8* %21, i32 40)
%43 = call i64 @mrtd_bac_challenge_ok(i8* %17, i8* %19, i8* %15, i8* %22, i8* %23)
%44 = icmp eq i64 %43, 0
%45 = select i1 %44, i8* getelementptr inbounds ([66 x i8], [66 x i8]* @str, i64 0, i64 0), i8* getelementptr inbounds ([68 x i8], [68 x i8]* @str.16, i64 0, i64 0)
%46 = call i32 @puts(i8* dereferenceable(1) %45)
%47 = call i32 @printhex(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.11, i64 0, i64 0), i8* %15, i32 8)
%48 = call i32 @printhex(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.12, i64 0, i64 0), i8* %23, i32 16)
%49 = load <16 x i8>, <16 x i8>* %3
%50 = load <16 x i8>, <16 x i8>* %10
%51 = xor <16 x i8> %50, %49
store <16 x i8> %51, <16 x i8>* %11
%52 = call i32 @mrtd_bac_kenc_kmac(i8* %24, i8* %25, i8* %26)
%53 = call i32 @printhex(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.13, i64 0, i64 0), i8* %25, i32 16)
%54 = call i32 @printhex(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.14, i64 0, i64 0), i8* %26, i32 16)
%55 = call i32 @mrtd_bac_get_ssc(i8* %14, i8* %15)
%56 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([10 x i8], [10 x i8]* @.str.15, i64 0, i64 0), i32 %55)
ret i32 0
}