#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(char *);
unsigned int iDoRemoteFunc(unsigned char *, unsigned int, int);
unsigned int iGetParaInt(int /*<<< orphan*/);
char *malloc(int);
int /*<<< orphan*/ memcpy(char *, unsigned char *, int);
unsigned int sprintf(char *, char *, ...);
int /*<<< orphan*/ vWriteLogTxt(char *, unsigned int);
unsigned int _uiRcMifAuth(unsigned char ucSecNo, unsigned char ucKeyAB,
                          unsigned char *psKey) {
  unsigned int uiDataLen, uiRet;
  char *psFunCall = malloc(100);
  uiDataLen = sprintf(psFunCall, "%u(%u,%u,b006", 2005, ucSecNo, ucKeyAB);
  memcpy(psFunCall + uiDataLen, psKey, 6);
  uiDataLen += 6;
  uiDataLen += sprintf(psFunCall + uiDataLen, ")");
  uiRet = iDoRemoteFunc((unsigned char *)psFunCall, uiDataLen, 1);
  free(psFunCall);
  if (uiRet) {
    vWriteLogTxt("_uiRcMifAuth iDoRemoteFunc ret = %d", uiRet);
    return 1;
  }
  return iGetParaInt(0);
}


x86 assembly (clang, -O0):
<_uiRcMifAuth>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %sil,%al
mov    %dil,%cl
mov    %cl,-0x5(%rbp)
mov    %al,-0x6(%rbp)
mov    %rdx,-0x10(%rbp)
mov    $0x64,%edi
call   1070 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
movzbl -0x5(%rbp),%ecx
movzbl -0x6(%rbp),%r8d
lea    0xe56(%rip),%rsi
mov    $0x7d5,%edx
mov    $0x0,%al
call   1090 <sprintf@plt>
mov    %eax,-0x14(%rbp)
mov    -0x20(%rbp),%rdi
mov    -0x14(%rbp),%eax
add    %rax,%rdi
mov    -0x10(%rbp),%rsi
mov    $0x6,%edx
call   1060 <memcpy@plt>
mov    -0x14(%rbp),%eax
add    $0x6,%eax
mov    %eax,-0x14(%rbp)
mov    -0x20(%rbp),%rdi
mov    -0x14(%rbp),%eax
add    %rax,%rdi
lea    0xe23(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
add    -0x14(%rbp),%eax
mov    %eax,-0x14(%rbp)
mov    -0x20(%rbp),%rdi
mov    -0x14(%rbp),%esi
mov    $0x1,%edx
call   1080 <iDoRemoteFunc@plt>
mov    %eax,-0x18(%rbp)
mov    -0x20(%rbp),%rdi
call   1030 <free@plt>
cmpl   $0x0,-0x18(%rbp)
je     123a <_uiRcMifAuth+0xca>
mov    -0x18(%rbp),%esi
lea    0xde7(%rip),%rdi
call   1050 <vWriteLogTxt@plt>
movl   $0x1,-0x4(%rbp)
jmp    1244 <_uiRcMifAuth+0xd4>
xor    %edi,%edi
call   1040 <iGetParaInt@plt>
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<_uiRcMifAuth>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
mov    %rdx,%r14
mov    %esi,%r15d
mov    %edi,%ebp
mov    $0x64,%edi
call   1070 <malloc@plt>
mov    %rax,%rbx
lea    0xe6d(%rip),%rsi
mov    %rax,%rdi
mov    $0x7d5,%edx
mov    %ebp,%ecx
mov    %r15d,%r8d
xor    %eax,%eax
call   1090 <sprintf@plt>
mov    %eax,%ebp
mov    %eax,%edi
add    %rbx,%rdi
mov    %r14,%rsi
mov    $0x6,%edx
call   1060 <memcpy@plt>
lea    0x6(%rbp),%eax
movw   $0x29,(%rbx,%rax,1)
add    $0x7,%ebp
mov    %rbx,%rdi
mov    %ebp,%esi
mov    $0x1,%edx
call   1080 <iDoRemoteFunc@plt>
mov    %eax,%ebp
mov    %rbx,%rdi
call   1030 <free@plt>
test   %ebp,%ebp
je     1202 <_uiRcMifAuth+0x92>
lea    0xe23(%rip),%rdi
mov    %ebp,%esi
call   1050 <vWriteLogTxt@plt>
mov    $0x1,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
xor    %edi,%edi
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
jmp    1040 <iGetParaInt@plt>

LLVM IR (-O0):
@.str = [14 x i8] c"%u(%u,%u,b006\00"
@.str.1 = [2 x i8] c")\00"
@.str.2 = [36 x i8] c"_uiRcMifAuth iDoRemoteFunc ret = %d\00"
define i32 @_uiRcMifAuth(i8 zeroext %0, i8 zeroext %1, i8* %2) {
%4 = alloca i32
%5 = alloca i8
%6 = alloca i8
%7 = alloca i8*
%8 = alloca i32
%9 = alloca i32
%10 = alloca i8*
store i8 %0, i8* %5
store i8 %1, i8* %6
store i8* %2, i8** %7
%11 = call i8* @malloc(i32 100)
store i8* %11, i8** %10
%12 = load i8*, i8** %10
%13 = load i8, i8* %5
%14 = zext i8 %13 to i32
%15 = load i8, i8* %6
%16 = zext i8 %15 to i32
%17 = call i32 (i8*, i8*, ...) @sprintf(i8* %12, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i32 2005, i32 %14, i32 %16)
store i32 %17, i32* %8
%18 = load i8*, i8** %10
%19 = load i32, i32* %8
%20 = zext i32 %19 to i64
%21 = getelementptr inbounds i8, i8* %18, i64 %20
%22 = load i8*, i8** %7
%23 = call i32 @memcpy(i8* %21, i8* %22, i32 6)
%24 = load i32, i32* %8
%25 = add i32 %24, 6
store i32 %25, i32* %8
%26 = load i8*, i8** %10
%27 = load i32, i32* %8
%28 = zext i32 %27 to i64
%29 = getelementptr inbounds i8, i8* %26, i64 %28
%30 = call i32 (i8*, i8*, ...) @sprintf(i8* %29, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%31 = load i32, i32* %8
%32 = add i32 %31, %30
store i32 %32, i32* %8
%33 = load i8*, i8** %10
%34 = load i32, i32* %8
%35 = call i32 @iDoRemoteFunc(i8* %33, i32 %34, i32 1)
store i32 %35, i32* %9
%36 = load i8*, i8** %10
%37 = call i32 @free(i8* %36)
%38 = load i32, i32* %9
%39 = icmp ne i32 %38, 0
br i1 %39, label %40, label %43
40: ; preds = %3
%41 = load i32, i32* %9
%42 = call i32 @vWriteLogTxt(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.2, i64 0, i64 0), i32 %41)
store i32 1, i32* %4
br label %45
43: ; preds = %3
%44 = call i32 @iGetParaInt(i32 0)
store i32 %44, i32* %4
br label %45
45: ; preds = %43, %40
%46 = load i32, i32* %4
ret i32 %46
}

LLVM IR (-O2):
@.str = [14 x i8] c"%u(%u,%u,b006\00"
@.str.2 = [36 x i8] c"_uiRcMifAuth iDoRemoteFunc ret = %d\00"
define i32 @_uiRcMifAuth(i8 zeroext %0, i8 zeroext %1, i8* %2) {
%4 = tail call dereferenceable_or_null(100) i8* @malloc(i32 100)
%5 = zext i8 %0 to i32
%6 = zext i8 %1 to i32
%7 = tail call i32 (i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %4, i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i32 2005, i32 %5, i32 %6)
%8 = zext i32 %7 to i64
%9 = getelementptr inbounds i8, i8* %4, i64 %8
%10 = tail call i32 @memcpy(i8* %9, i8* %2, i32 6)
%11 = add i32 %7, 6
%12 = zext i32 %11 to i64
%13 = getelementptr inbounds i8, i8* %4, i64 %12
%14 = bitcast i8* %13 to i16*
store i16 41, i16* %14
%15 = add i32 %7, 7
%16 = tail call i32 @iDoRemoteFunc(i8* %4, i32 %15, i32 1)
%17 = tail call i32 @free(i8* %4)
%18 = icmp eq i32 %16, 0
br i1 %18, label %21, label %19
19: ; preds = %3
%20 = tail call i32 @vWriteLogTxt(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.2, i64 0, i64 0), i32 %16)
br label %23
21: ; preds = %3
%22 = tail call i32 @iGetParaInt(i32 0)
br label %23
23: ; preds = %21, %19
%24 = phi i32 [ 1, %19 ], [ %22, %21 ]
ret i32 %24
}