#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ printf(char *, ...);
void usage(char *progname) {
  printf("%s is a MiTM helper utility for Powershell Empire\n", progname);
  printf("  -h\tDisplays this help message.\n");
  printf("  -u\tURL for staging service\n");
  printf("  -c\tIP for your console/listener\n");
  printf("  -t\tPlaintext file for RC4 attacks\n");
  printf("  \t(Contents must match the server's expected plaintext message)\n");
  printf("  -s\tSession identifier for RC4 attacks\n");
  printf("  \t(the value of the \"session\" cookie)\n");
  printf("  -o\tOutput file to use instead of packet spoofing\n");
  printf("  -i\tNetwork interface for spoofing/sniffing ('eth0' is default)\n");
  printf("  -v\tVerbose mode\n");
  printf("  -p\tText file that has the plaintext payload\n");
  printf("Examples:\n");
  printf("%s -u http://10.1.1.10:8080/login/process.php -c 172.16.0.5\n",
         progname);
  printf("\tTargets Powershell Empire version 1.6 and directs hosts to\n");
  printf("\tsend 'connect back' shells to 172.16.0.5\n");
  printf("%s -s WVUP/J2edjRlqEH9ctiRu75mpOM= -u "
         "http://10.1.1.10/login/process.php -t ./t -c 172.16.0.5\n",
         progname);
  printf("\tTargets Powershell Empire version 2.0.\n");
  printf("\tThe session cookie (-s) is required for RC4 attacks.\n");
  printf("%s -u http://10.1.1.10:8080/login/process.php -c 172.16.0.5 -o "
         "payload.bin -i eth1\n",
         progname);
  printf("\tTargets PowershellEmpire 1.6, but write the attack payload to "
         "'payload.bin' instead of delivering it by packet spoofing. "
         "Redirecting powershell hosts to a web server that has 'payload.bin' "
         "should have the same effect as packet spoofing.\n");
  printf("\tThis example also uses the 'eth1' interface\n");
}


x86 assembly (clang, -O0):
<usage>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %rdi,-0x8(%rbp)
mov    -0x8(%rbp),%rsi
lea    0xed9(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xefe(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf12(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf22(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf37(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf4e(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf82(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf9d(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xfb7(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xfdd(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1011(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1016(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1037(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x1030(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x105f(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x108e(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x10a7(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x10f8(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1113(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x1138(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x117e(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x125f(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<usage>:
push   %rbx
mov    %rdi,%rbx
lea    0xed5(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0xfe7(%rip),%rdi
call   1030 <puts@plt>
lea    0xffc(%rip),%rdi
call   1030 <puts@plt>
lea    0x100d(%rip),%rdi
call   1030 <puts@plt>
lea    0x1023(%rip),%rdi
call   1030 <puts@plt>
lea    0x103b(%rip),%rdi
call   1030 <puts@plt>
lea    0x1070(%rip),%rdi
call   1030 <puts@plt>
lea    0x108c(%rip),%rdi
call   1030 <puts@plt>
lea    0x10a7(%rip),%rdi
call   1030 <puts@plt>
lea    0x10ce(%rip),%rdi
call   1030 <puts@plt>
lea    0x1103(%rip),%rdi
call   1030 <puts@plt>
lea    0x1109(%rip),%rdi
call   1030 <puts@plt>
lea    0x112b(%rip),%rdi
call   1030 <puts@plt>
lea    0xe67(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0x1118(%rip),%rdi
call   1030 <puts@plt>
lea    0x1148(%rip),%rdi
call   1030 <puts@plt>
lea    0xe7b(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0x1155(%rip),%rdi
call   1030 <puts@plt>
lea    0x1171(%rip),%rdi
call   1030 <puts@plt>
lea    0xeb1(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0x118a(%rip),%rdi
call   1030 <puts@plt>
lea    0x126c(%rip),%rdi
pop    %rbx
jmp    1030 <puts@plt>

LLVM IR (-O0):
@.str = [51 x i8] c"%s is a MiTM helper utility for Powershell Empire\0A\00"
@.str.1 = [34 x i8] c" -h\09Displays this help message.\0A\00"
@.str.2 = [30 x i8] c" -u\09URL for staging service\0A\00"
@.str.3 = [35 x i8] c" -c\09IP for your console/listener\0A\00"
@.str.4 = [37 x i8] c" -t\09Plaintext file for RC4 attacks\0A\00"
@.str.5 = [66 x i8] c" \09(Contents must match the server's expected plaintext message)\0A\00"
@.str.6 = [41 x i8] c" -s\09Session identifier for RC4 attacks\0A\00"
@.str.7 = [40 x i8] c" \09(the value of the \22session\22 cookie)\0A\00"
@.str.8 = [52 x i8] c" -o\09Output file to use instead of packet spoofing\0A\00"
@.str.9 = [66 x i8] c" -i\09Network interface for spoofing/sniffing ('eth0' is default)\0A\00"
@.str.10 = [19 x i8] c" -v\09Verbose mode\0A\00"
@.str.11 = [47 x i8] c" -p\09Text file that has the plaintext payload\0A\00"
@.str.12 = [11 x i8] c"Examples:\0A\00"
@.str.13 = [61 x i8] c"%s -u http://10.1.1.10:8080/login/process.php -c 172.16.0.5\0A\00"
@.str.14 = [61 x i8] c"\09Targets Powershell Empire version 1.6 and directs hosts to\0A\00"
@.str.15 = [43 x i8] c"\09send 'connect back' shells to 172.16.0.5\0A\00"
@.str.16 = [95 x i8] c"%s -s WVUP/J2edjRlqEH9ctiRu75mpOM= -u http://10.1.1.10/login/process.php -t ./t -c 172.16.0.5\0A\00"
@.str.17 = [41 x i8] c"\09Targets Powershell Empire version 2.0.\0A\00"
@.str.18 = [55 x i8] c"\09The session cookie (-s) is required for RC4 attacks.\0A\00"
@.str.19 = [84 x i8] c"%s -u http://10.1.1.10:8080/login/process.php -c 172.16.0.5 -o payload.bin -i eth1\0A\00"
@.str.20 = [239 x i8] c"\09Targets PowershellEmpire 1.6, but write the attack payload to 'payload.bin' instead of delivering it by packet spoofing. Redirecting powershell hosts to a web server that has 'payload.bin' should have the same effect as packet spoofing.\0A\00"
@.str.21 = [46 x i8] c"\09This example also uses the 'eth1' interface\0A\00"
define void @usage(i8* %0) {
%2 = alloca i8*
store i8* %0, i8** %2
%3 = load i8*, i8** %2
%4 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([51 x i8], [51 x i8]* @.str, i64 0, i64 0), i8* %3)
%5 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0))
%6 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.2, i64 0, i64 0))
%7 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.3, i64 0, i64 0))
%8 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.4, i64 0, i64 0))
%9 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([66 x i8], [66 x i8]* @.str.5, i64 0, i64 0))
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.6, i64 0, i64 0))
%11 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.7, i64 0, i64 0))
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([52 x i8], [52 x i8]* @.str.8, i64 0, i64 0))
%13 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([66 x i8], [66 x i8]* @.str.9, i64 0, i64 0))
%14 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.10, i64 0, i64 0))
%15 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.11, i64 0, i64 0))
%16 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.12, i64 0, i64 0))
%17 = load i8*, i8** %2
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([61 x i8], [61 x i8]* @.str.13, i64 0, i64 0), i8* %17)
%19 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([61 x i8], [61 x i8]* @.str.14, i64 0, i64 0))
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str.15, i64 0, i64 0))
%21 = load i8*, i8** %2
%22 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([95 x i8], [95 x i8]* @.str.16, i64 0, i64 0), i8* %21)
%23 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.17, i64 0, i64 0))
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([55 x i8], [55 x i8]* @.str.18, i64 0, i64 0))
%25 = load i8*, i8** %2
%26 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([84 x i8], [84 x i8]* @.str.19, i64 0, i64 0), i8* %25)
%27 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([239 x i8], [239 x i8]* @.str.20, i64 0, i64 0))
%28 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str.21, i64 0, i64 0))
ret void
}

LLVM IR (-O2):
@.str = [51 x i8] c"%s is a MiTM helper utility for Powershell Empire\0A\00"
@.str.13 = [61 x i8] c"%s -u http://10.1.1.10:8080/login/process.php -c 172.16.0.5\0A\00"
@.str.16 = [95 x i8] c"%s -s WVUP/J2edjRlqEH9ctiRu75mpOM= -u http://10.1.1.10/login/process.php -t ./t -c 172.16.0.5\0A\00"
@.str.19 = [84 x i8] c"%s -u http://10.1.1.10:8080/login/process.php -c 172.16.0.5 -o payload.bin -i eth1\0A\00"
@str = [33 x i8] c" -h\09Displays this help message.\00"
@str.22 = [29 x i8] c" -u\09URL for staging service\00"
@str.23 = [34 x i8] c" -c\09IP for your console/listener\00"
@str.24 = [36 x i8] c" -t\09Plaintext file for RC4 attacks\00"
@str.25 = [65 x i8] c" \09(Contents must match the server's expected plaintext message)\00"
@str.26 = [40 x i8] c" -s\09Session identifier for RC4 attacks\00"
@str.27 = [39 x i8] c" \09(the value of the \22session\22 cookie)\00"
@str.28 = [51 x i8] c" -o\09Output file to use instead of packet spoofing\00"
@str.29 = [65 x i8] c" -i\09Network interface for spoofing/sniffing ('eth0' is default)\00"
@str.30 = [18 x i8] c" -v\09Verbose mode\00"
@str.31 = [46 x i8] c" -p\09Text file that has the plaintext payload\00"
@str.32 = [10 x i8] c"Examples:\00"
@str.33 = [60 x i8] c"\09Targets Powershell Empire version 1.6 and directs hosts to\00"
@str.34 = [42 x i8] c"\09send 'connect back' shells to 172.16.0.5\00"
@str.35 = [40 x i8] c"\09Targets Powershell Empire version 2.0.\00"
@str.36 = [54 x i8] c"\09The session cookie (-s) is required for RC4 attacks.\00"
@str.37 = [238 x i8] c"\09Targets PowershellEmpire 1.6, but write the attack payload to 'payload.bin' instead of delivering it by packet spoofing. Redirecting powershell hosts to a web server that has 'payload.bin' should have the same effect as packet spoofing.\00"
@str.38 = [45 x i8] c"\09This example also uses the 'eth1' interface\00"
define void @usage(i8* %0) {
%2 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([51 x i8], [51 x i8]* @.str, i64 0, i64 0), i8* %0)
%3 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @str, i64 0, i64 0))
%4 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @str.22, i64 0, i64 0))
%5 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @str.23, i64 0, i64 0))
%6 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([36 x i8], [36 x i8]* @str.24, i64 0, i64 0))
%7 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([65 x i8], [65 x i8]* @str.25, i64 0, i64 0))
%8 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([40 x i8], [40 x i8]* @str.26, i64 0, i64 0))
%9 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([39 x i8], [39 x i8]* @str.27, i64 0, i64 0))
%10 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([51 x i8], [51 x i8]* @str.28, i64 0, i64 0))
%11 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([65 x i8], [65 x i8]* @str.29, i64 0, i64 0))
%12 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @str.30, i64 0, i64 0))
%13 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([46 x i8], [46 x i8]* @str.31, i64 0, i64 0))
%14 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([10 x i8], [10 x i8]* @str.32, i64 0, i64 0))
%15 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([61 x i8], [61 x i8]* @.str.13, i64 0, i64 0), i8* %0)
%16 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([60 x i8], [60 x i8]* @str.33, i64 0, i64 0))
%17 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([42 x i8], [42 x i8]* @str.34, i64 0, i64 0))
%18 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([95 x i8], [95 x i8]* @.str.16, i64 0, i64 0), i8* %0)
%19 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([40 x i8], [40 x i8]* @str.35, i64 0, i64 0))
%20 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([54 x i8], [54 x i8]* @str.36, i64 0, i64 0))
%21 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([84 x i8], [84 x i8]* @.str.19, i64 0, i64 0), i8* %0)
%22 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([238 x i8], [238 x i8]* @str.37, i64 0, i64 0))
%23 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([45 x i8], [45 x i8]* @str.38, i64 0, i64 0))
ret void
}