	.file	"109488.c"
	.intel_syntax noprefix
	.text
	.globl	secret
	.bss
	.align 4
	.type	secret, @object
	.size	secret, 4
secret:
	.zero	4
	.text
	.globl	checkSecret
	.type	checkSecret, @function
checkSecret:
.LFB0:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	mov	DWORD PTR -36[rbp], edi
	mov	DWORD PTR -40[rbp], esi
	mov	DWORD PTR -44[rbp], edx
	mov	DWORD PTR -4[rbp], 20
	mov	DWORD PTR -24[rbp], 0
	mov	eax, DWORD PTR -40[rbp]
	cmp	eax, DWORD PTR -36[rbp]
	jg	.L2
	cmp	DWORD PTR -44[rbp], 1
	jne	.L3
	add	DWORD PTR -24[rbp], 1
	jmp	.L4
.L3:
	cmp	DWORD PTR -44[rbp], 2
	jne	.L5
	mov	DWORD PTR -20[rbp], 0
	jmp	.L6
.L7:
	add	DWORD PTR -24[rbp], 1
	add	DWORD PTR -20[rbp], 1
.L6:
	mov	eax, DWORD PTR -20[rbp]
	cmp	eax, DWORD PTR -4[rbp]
	jl	.L7
	jmp	.L4
.L5:
	mov	DWORD PTR -16[rbp], 0
	jmp	.L8
.L9:
	add	DWORD PTR -24[rbp], 1
	add	DWORD PTR -16[rbp], 1
.L8:
	mov	eax, DWORD PTR -4[rbp]
	imul	eax, eax
	imul	eax, DWORD PTR -4[rbp]
	cmp	DWORD PTR -16[rbp], eax
	jl	.L9
	jmp	.L4
.L2:
	cmp	DWORD PTR -44[rbp], 1
	jne	.L10
	add	DWORD PTR -24[rbp], 1
	jmp	.L4
.L10:
	cmp	DWORD PTR -44[rbp], 2
	jne	.L11
	mov	DWORD PTR -12[rbp], 0
	jmp	.L12
.L13:
	add	DWORD PTR -24[rbp], 1
	add	DWORD PTR -12[rbp], 1
.L12:
	mov	eax, DWORD PTR -4[rbp]
	imul	eax, eax
	cmp	DWORD PTR -12[rbp], eax
	jl	.L13
	jmp	.L4
.L11:
	mov	DWORD PTR -8[rbp], 0
	jmp	.L14
.L15:
	add	DWORD PTR -24[rbp], 1
	add	DWORD PTR -8[rbp], 1
.L14:
	mov	eax, DWORD PTR -4[rbp]
	imul	eax, eax
	imul	eax, DWORD PTR -4[rbp]
	cmp	DWORD PTR -8[rbp], eax
	jl	.L15
.L4:
	mov	eax, DWORD PTR -24[rbp]
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE0:
	.size	checkSecret, .-checkSecret
	.globl	attack
	.type	attack, @function
attack:
.LFB1:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	DWORD PTR -20[rbp], 0
	mov	DWORD PTR -16[rbp], 1000000
	mov	DWORD PTR -12[rbp], 0
	mov	eax, DWORD PTR secret[rip]
	test	eax, eax
	js	.L18
	mov	eax, DWORD PTR secret[rip]
	cmp	eax, 999999
	jg	.L18
	mov	eax, 1
	jmp	.L19
.L18:
	mov	eax, 0
.L19:
	mov	edi, eax
	mov	eax, 0
	call	__VERIFIER_assume@PLT
	jmp	.L20
.L26:
	mov	eax, DWORD PTR secret[rip]
	cmp	DWORD PTR -20[rbp], eax
	jg	.L21
	mov	edx, DWORD PTR -20[rbp]
	mov	eax, DWORD PTR -16[rbp]
	add	edx, eax
	mov	eax, DWORD PTR secret[rip]
	cmp	edx, eax
	jle	.L21
	mov	eax, 1
	jmp	.L22
.L21:
	mov	eax, 0
.L22:
	mov	edi, eax
	mov	eax, 0
	call	__VERIFIER_assert@PLT
	mov	eax, DWORD PTR secret[rip]
	cmp	DWORD PTR -20[rbp], eax
	jg	.L23
	mov	edx, DWORD PTR -20[rbp]
	mov	eax, DWORD PTR -16[rbp]
	add	edx, eax
	mov	eax, DWORD PTR secret[rip]
	cmp	edx, eax
	jle	.L23
	mov	eax, 1
	jmp	.L24
.L23:
	mov	eax, 0
.L24:
	mov	edi, eax
	mov	eax, 0
	call	__VERIFIER_assume@PLT
	mov	eax, DWORD PTR -16[rbp]
	add	eax, 1
	mov	edx, eax
	shr	edx, 31
	add	eax, edx
	sar	eax
	mov	DWORD PTR -16[rbp], eax
	mov	edx, DWORD PTR -20[rbp]
	mov	eax, DWORD PTR -16[rbp]
	add	eax, edx
	mov	DWORD PTR -8[rbp], eax
	mov	eax, DWORD PTR secret[rip]
	mov	ecx, DWORD PTR -8[rbp]
	mov	edx, 2
	mov	esi, ecx
	mov	edi, eax
	call	checkSecret
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], 209
	jg	.L25
	mov	eax, DWORD PTR -8[rbp]
	mov	DWORD PTR -20[rbp], eax
.L25:
	add	DWORD PTR -12[rbp], 1
	mov	eax, DWORD PTR -12[rbp]
	mov	edi, eax
	mov	eax, 0
	call	__VERIFIER_print_hull@PLT
.L20:
	cmp	DWORD PTR -16[rbp], 1
	jg	.L26
	mov	eax, DWORD PTR secret[rip]
	cmp	DWORD PTR -20[rbp], eax
	sete	al
	movzx	eax, al
	mov	edi, eax
	mov	eax, 0
	call	__VERIFIER_assert@PLT
	mov	eax, DWORD PTR -12[rbp]
	mov	edi, eax
	mov	eax, 0
	call	__VERIFIER_print_hull@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE1:
	.size	attack, .-attack
	.globl	main
	.type	main, @function
main:
.LFB2:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	DWORD PTR -20[rbp], edi
	mov	QWORD PTR -32[rbp], rsi
	mov	eax, 0
	call	__VERIFIER_nondet_int@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], 0
	js	.L28
	cmp	DWORD PTR -4[rbp], 999999
	jg	.L28
	mov	eax, 1
	jmp	.L29
.L28:
	mov	eax, 0
.L29:
	mov	edi, eax
	mov	eax, 0
	call	__VERIFIER_assume@PLT
	mov	eax, 0
	call	attack
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE2:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"109488.c"
	.text
	.comm	secret,4,4
	.align	2
	.global	checkSecret
	.syntax unified
	.arm
	.fpu softvfp
	.type	checkSecret, %function
checkSecret:
	@ args = 0, pretend = 0, frame = 40
	@ frame_needed = 1, uses_anonymous_args = 0
	@ link register save eliminated.
	str	fp, [sp, #-4]!
	add	fp, sp, #0
	sub	sp, sp, #44
	str	r0, [fp, #-32]
	str	r1, [fp, #-36]
	str	r2, [fp, #-40]
	mov	r3, #20
	str	r3, [fp, #-8]
	mov	r3, #0
	str	r3, [fp, #-28]
	ldr	r2, [fp, #-36]
	ldr	r3, [fp, #-32]
	cmp	r2, r3
	bgt	.L2
	ldr	r3, [fp, #-40]
	cmp	r3, #1
	bne	.L3
	ldr	r3, [fp, #-28]
	add	r3, r3, #1
	str	r3, [fp, #-28]
	b	.L4
.L3:
	ldr	r3, [fp, #-40]
	cmp	r3, #2
	bne	.L5
	mov	r3, #0
	str	r3, [fp, #-24]
	b	.L6
.L7:
	ldr	r3, [fp, #-28]
	add	r3, r3, #1
	str	r3, [fp, #-28]
	ldr	r3, [fp, #-24]
	add	r3, r3, #1
	str	r3, [fp, #-24]
.L6:
	ldr	r2, [fp, #-24]
	ldr	r3, [fp, #-8]
	cmp	r2, r3
	blt	.L7
	b	.L4
.L5:
	mov	r3, #0
	str	r3, [fp, #-20]
	b	.L8
.L9:
	ldr	r3, [fp, #-28]
	add	r3, r3, #1
	str	r3, [fp, #-28]
	ldr	r3, [fp, #-20]
	add	r3, r3, #1
	str	r3, [fp, #-20]
.L8:
	ldr	r3, [fp, #-8]
	mov	r2, r3
	mul	r2, r3, r2
	mov	r3, r2
	ldr	r2, [fp, #-8]
	mul	r3, r2, r3
	ldr	r2, [fp, #-20]
	cmp	r2, r3
	blt	.L9
	b	.L4
.L2:
	ldr	r3, [fp, #-40]
	cmp	r3, #1
	bne	.L10
	ldr	r3, [fp, #-28]
	add	r3, r3, #1
	str	r3, [fp, #-28]
	b	.L4
.L10:
	ldr	r3, [fp, #-40]
	cmp	r3, #2
	bne	.L11
	mov	r3, #0
	str	r3, [fp, #-16]
	b	.L12
.L13:
	ldr	r3, [fp, #-28]
	add	r3, r3, #1
	str	r3, [fp, #-28]
	ldr	r3, [fp, #-16]
	add	r3, r3, #1
	str	r3, [fp, #-16]
.L12:
	ldr	r3, [fp, #-8]
	mov	r2, r3
	mul	r2, r3, r2
	mov	r3, r2
	ldr	r2, [fp, #-16]
	cmp	r2, r3
	blt	.L13
	b	.L4
.L11:
	mov	r3, #0
	str	r3, [fp, #-12]
	b	.L14
.L15:
	ldr	r3, [fp, #-28]
	add	r3, r3, #1
	str	r3, [fp, #-28]
	ldr	r3, [fp, #-12]
	add	r3, r3, #1
	str	r3, [fp, #-12]
.L14:
	ldr	r3, [fp, #-8]
	mov	r2, r3
	mul	r2, r3, r2
	mov	r3, r2
	ldr	r2, [fp, #-8]
	mul	r3, r2, r3
	ldr	r2, [fp, #-12]
	cmp	r2, r3
	blt	.L15
.L4:
	ldr	r3, [fp, #-28]
	mov	r0, r3
	add	sp, fp, #0
	@ sp needed
	ldr	fp, [sp], #4
	bx	lr
	.size	checkSecret, .-checkSecret
	.align	2
	.global	attack
	.syntax unified
	.arm
	.fpu softvfp
	.type	attack, %function
attack:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	mov	r3, #0
	str	r3, [fp, #-24]
	ldr	r3, .L27
	str	r3, [fp, #-20]
	mov	r3, #0
	str	r3, [fp, #-16]
	ldr	r3, .L27+4
	ldr	r3, [r3]
	cmp	r3, #0
	blt	.L18
	ldr	r3, .L27+4
	ldr	r3, [r3]
	ldr	r2, .L27
	cmp	r3, r2
	bge	.L18
	mov	r3, #1
	b	.L19
.L18:
	mov	r3, #0
.L19:
	mov	r0, r3
	bl	__VERIFIER_assume
	b	.L20
.L26:
	ldr	r3, .L27+4
	ldr	r3, [r3]
	ldr	r2, [fp, #-24]
	cmp	r2, r3
	bgt	.L21
	ldr	r2, [fp, #-24]
	ldr	r3, [fp, #-20]
	add	r2, r2, r3
	ldr	r3, .L27+4
	ldr	r3, [r3]
	cmp	r2, r3
	ble	.L21
	mov	r3, #1
	b	.L22
.L21:
	mov	r3, #0
.L22:
	mov	r0, r3
	bl	__VERIFIER_assert
	ldr	r3, .L27+4
	ldr	r3, [r3]
	ldr	r2, [fp, #-24]
	cmp	r2, r3
	bgt	.L23
	ldr	r2, [fp, #-24]
	ldr	r3, [fp, #-20]
	add	r2, r2, r3
	ldr	r3, .L27+4
	ldr	r3, [r3]
	cmp	r2, r3
	ble	.L23
	mov	r3, #1
	b	.L24
.L23:
	mov	r3, #0
.L24:
	mov	r0, r3
	bl	__VERIFIER_assume
	ldr	r3, [fp, #-20]
	add	r3, r3, #1
	lsr	r2, r3, #31
	add	r3, r2, r3
	asr	r3, r3, #1
	str	r3, [fp, #-20]
	ldr	r2, [fp, #-24]
	ldr	r3, [fp, #-20]
	add	r3, r2, r3
	str	r3, [fp, #-12]
	ldr	r3, .L27+4
	ldr	r3, [r3]
	mov	r2, #2
	ldr	r1, [fp, #-12]
	mov	r0, r3
	bl	checkSecret
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #209
	bgt	.L25
	ldr	r3, [fp, #-12]
	str	r3, [fp, #-24]
.L25:
	ldr	r3, [fp, #-16]
	add	r3, r3, #1
	str	r3, [fp, #-16]
	ldr	r0, [fp, #-16]
	bl	__VERIFIER_print_hull
.L20:
	ldr	r3, [fp, #-20]
	cmp	r3, #1
	bgt	.L26
	ldr	r3, .L27+4
	ldr	r3, [r3]
	ldr	r2, [fp, #-24]
	cmp	r2, r3
	moveq	r3, #1
	movne	r3, #0
	and	r3, r3, #255
	mov	r0, r3
	bl	__VERIFIER_assert
	ldr	r0, [fp, #-16]
	bl	__VERIFIER_print_hull
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L28:
	.align	2
.L27:
	.word	1000000
	.word	secret
	.size	attack, .-attack
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	bl	__VERIFIER_nondet_int
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	blt	.L30
	ldr	r3, [fp, #-8]
	ldr	r2, .L33
	cmp	r3, r2
	bge	.L30
	mov	r3, #1
	b	.L31
.L30:
	mov	r3, #0
.L31:
	mov	r0, r3
	bl	__VERIFIER_assume
	bl	attack
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L34:
	.align	2
.L33:
	.word	1000000
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
