#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ printf(char *);
void help() {
  printf(
      "Usage: interrogate [OPTION]... [FILE]...\n"
      "Search for cryptographic keys in the FILEs (memory dumps).\n"
      "\n"
      "  -a algorithm    search for keys of a certain type (algorithm).\n"
      "                    Valid parameters: aes, rsa, win-rsa, serpent,\n"
      "                    [tc-]twofish. Use the -k switch to specify AES\n"
      "                    key lengths (128, 198, or 256 bits). RSA keys are\n"
      "                    found independent of their length, while SERPENT\n"
      "                    and TWOFISH keys are required to be 256 bits.\n"
      "                    The rsa parameter specifies DER-encoded rsa keys,\n"
      "                    while win-rsa requires Private Key BLOB (Windows)\n"
      "                    structure.\n"
      "  -h                prints usage and help information (this message).\n"
      "  -i interval     only search within interval. Format of interval is\n"
      "                    from_offset:to_offset where the offset values\n"
      "                    are interpreted as hexadecimal values. Omitting\n"
      "                    one of the offsets will indicate the start or\n"
      "                    the end of the FILEs, respectively. Used with\n"
      "                    the -r switch, the interval will be interpreted\n"
      "                    as the virtual address space that are to be\n"
      "                    reconstructed.\n"
      "  -k keylength    length of key to be searched for (NB: in BITS)\n"
      "  -n                naive mode, calculates true entropy instead of\n"
      "                    counting unique bytes (which is the normal\n"
      "                    mode). This may be useful if you get bad quality\n"
      "                    results, but may yield some performance\n"
      "                    degradation.\n"
      "  -p filename     print entropy values for each window separated\n"
      "                    by newlines to file specified by filename. This\n"
      "                    may be used as input to plotting tools (gnuplot)\n"
      "                    WARNING: Slow and generates large files, one\n"
      "                    input byte maps to potentially six output bytes.\n"
      "  -q              quick mode, does not use overlapping windows. The\n"
      "                    larger the window size, the quicker. Use -w to\n"
      "                    specify window size.\n"
      "  -r CR3          reconstructs the virtual address space for the\n"
      "                    process at offset PDB. The PDB is the location of\n"
      "                    the page directory base, and can be found by\n"
      "                    scanning for EPROCESSes using PTfinder,\n"
      "                    Volatility or other similar tools. The\n"
      "                    regonstructed memory is written to file\n"
      "                    'pages', and are searched subsequently for\n"
      "                    keys. The -i option may be used to specify a\n"
      "                    virtual address space interval.\n"
      "  -t threshold    sets the entropy threshold (default = 7.0).\n"
      "  -w windowsize   sets the window size. Not compatible with the -a\n"
      "                    option.\n");
}


x86 assembly (clang, -O0):
<help>:
push   %rbp
mov    %rsp,%rbp
lea    0xee5(%rip),%rdi
call   1030 <printf@plt>
pop    %rbp
ret

x86 assembly (clang, -O2):
<help>:
lea    0xee9(%rip),%rdi
jmp    1030 <puts@plt>

LLVM IR (-O0):
@.str = [2833 x i8] c"Usage: interrogate [OPTION]... [FILE]...\0ASearch for cryptographic keys in the FILEs (memory dumps).\0A\0A -a algorithm search for keys of a certain type (algorithm).\0A Valid parameters: aes, rsa, win-rsa, serpent,\0A [tc-]twofish. Use the -k switch to specify AES\0A key lengths (128, 198, or 256 bits). RSA keys are\0A found independent of their length, while SERPENT\0A and TWOFISH keys are required to be 256 bits.\0A The rsa parameter specifies DER-encoded rsa keys,\0A while win-rsa requires Private Key BLOB (Windows)\0A structure.\0A -h prints usage and help information (this message).\0A -i interval only search within interval. Format of interval is\0A from_offset:to_offset where the offset values\0A are interpreted as hexadecimal values. Omitting\0A one of the offsets will indicate the start or\0A the end of the FILEs, respectively. Used with\0A the -r switch, the interval will be interpreted\0A as the virtual address space that are to be\0A reconstructed.\0A -k keylength length of key to be searched for (NB: in BITS)\0A -n naive mode, calculates true entropy instead of\0A counting unique bytes (which is the normal\0A mode). This may be useful if you get bad quality\0A results, but may yield some performance\0A degradation.\0A -p filename print entropy values for each window separated\0A by newlines to file specified by filename. This\0A may be used as input to plotting tools (gnuplot)\0A WARNING: Slow and generates large files, one\0A input byte maps to potentially six output bytes.\0A -q quick mode, does not use overlapping windows. The\0A larger the window size, the quicker. Use -w to\0A specify window size.\0A -r CR3 reconstructs the virtual address space for the\0A process at offset PDB. The PDB is the location of\0A the page directory base, and can be found by\0A scanning for EPROCESSes using PTfinder,\0A Volatility or other similar tools. The\0A regonstructed memory is written to file\0A 'pages', and are searched subsequently for\0A keys. The -i option may be used to specify a\0A virtual address space interval.\0A -t threshold sets the entropy threshold (default = 7.0).\0A -w windowsize sets the window size. Not compatible with the -a\0A option.\0A\00"
define void @help() {
%1 = call i32 @printf(i8* getelementptr inbounds ([2833 x i8], [2833 x i8]* @.str, i64 0, i64 0))
ret void
}

LLVM IR (-O2):
@str = [2832 x i8] c"Usage: interrogate [OPTION]... [FILE]...\0ASearch for cryptographic keys in the FILEs (memory dumps).\0A\0A -a algorithm search for keys of a certain type (algorithm).\0A Valid parameters: aes, rsa, win-rsa, serpent,\0A [tc-]twofish. Use the -k switch to specify AES\0A key lengths (128, 198, or 256 bits). RSA keys are\0A found independent of their length, while SERPENT\0A and TWOFISH keys are required to be 256 bits.\0A The rsa parameter specifies DER-encoded rsa keys,\0A while win-rsa requires Private Key BLOB (Windows)\0A structure.\0A -h prints usage and help information (this message).\0A -i interval only search within interval. Format of interval is\0A from_offset:to_offset where the offset values\0A are interpreted as hexadecimal values. Omitting\0A one of the offsets will indicate the start or\0A the end of the FILEs, respectively. Used with\0A the -r switch, the interval will be interpreted\0A as the virtual address space that are to be\0A reconstructed.\0A -k keylength length of key to be searched for (NB: in BITS)\0A -n naive mode, calculates true entropy instead of\0A counting unique bytes (which is the normal\0A mode). This may be useful if you get bad quality\0A results, but may yield some performance\0A degradation.\0A -p filename print entropy values for each window separated\0A by newlines to file specified by filename. This\0A may be used as input to plotting tools (gnuplot)\0A WARNING: Slow and generates large files, one\0A input byte maps to potentially six output bytes.\0A -q quick mode, does not use overlapping windows. The\0A larger the window size, the quicker. Use -w to\0A specify window size.\0A -r CR3 reconstructs the virtual address space for the\0A process at offset PDB. The PDB is the location of\0A the page directory base, and can be found by\0A scanning for EPROCESSes using PTfinder,\0A Volatility or other similar tools. The\0A regonstructed memory is written to file\0A 'pages', and are searched subsequently for\0A keys. The -i option may be used to specify a\0A virtual address space interval.\0A -t threshold sets the entropy threshold (default = 7.0).\0A -w windowsize sets the window size. Not compatible with the -a\0A option.\00"
define void @help() {
%1 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([2832 x i8], [2832 x i8]* @str, i64 0, i64 0))
ret void
}