	.file	"581879.c"
	.intel_syntax noprefix
	.text
	.globl	hey
	.bss
	.align 16
	.type	hey, @object
	.size	hey, 24
hey:
	.zero	24
	.text
	.globl	flushit
	.type	flushit, @function
flushit:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	nop
.L3:
	call	getchar@PLT
	mov	BYTE PTR -1[rbp], al
	cmp	BYTE PTR -1[rbp], 10
	je	.L4
	cmp	BYTE PTR -1[rbp], -1
	jne	.L3
.L4:
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	flushit, .-flushit
	.section	.rodata
.LC0:
	.string	"/proc/self/maps"
.LC1:
	.string	"\n%s\n\n"
	.text
	.globl	printmaps
	.type	printmaps, @function
printmaps:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 3024
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	esi, 0
	lea	rdi, .LC0[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -3012[rbp], eax
	cmp	DWORD PTR -3012[rbp], 0
	jne	.L6
	mov	edi, 1
	call	exit@PLT
.L6:
	lea	rax, -3008[rbp]
	mov	edx, 3000
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	lea	rcx, -3008[rbp]
	mov	eax, DWORD PTR -3012[rbp]
	mov	edx, 2990
	mov	rsi, rcx
	mov	edi, eax
	call	read@PLT
	mov	eax, DWORD PTR -3012[rbp]
	mov	edi, eax
	call	close@PLT
	mov	DWORD PTR -3016[rbp], 0
	jmp	.L7
.L10:
	mov	eax, DWORD PTR -3016[rbp]
	cdqe
	movzx	eax, BYTE PTR -3008[rbp+rax]
	test	al, al
	jns	.L8
	mov	eax, DWORD PTR -3016[rbp]
	cdqe
	mov	BYTE PTR -3008[rbp+rax], 0
	jmp	.L9
.L8:
	add	DWORD PTR -3016[rbp], 1
.L7:
	cmp	DWORD PTR -3016[rbp], 2999
	jle	.L10
.L9:
	lea	rax, -3008[rbp]
	mov	rsi, rax
	lea	rdi, .LC1[rip]
	mov	eax, 0
	call	printf@PLT
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L11
	call	__stack_chk_fail@PLT
.L11:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	printmaps, .-printmaps
	.section	.rodata
.LC2:
	.string	"rb"
	.text
	.globl	copy
	.type	copy, @function
copy:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	QWORD PTR -24[rbp], rdi
	mov	QWORD PTR -32[rbp], rsi
	mov	DWORD PTR -36[rbp], edx
	mov	rax, QWORD PTR -24[rbp]
	lea	rsi, .LC2[rip]
	mov	rdi, rax
	call	fopen@PLT
	mov	QWORD PTR -8[rbp], rax
	cmp	QWORD PTR -8[rbp], 0
	jne	.L13
	mov	edi, 1
	call	exit@PLT
.L13:
	mov	eax, DWORD PTR -36[rbp]
	movsx	rsi, eax
	mov	rdx, QWORD PTR -8[rbp]
	mov	rax, QWORD PTR -32[rbp]
	mov	rcx, rdx
	mov	edx, 1
	mov	rdi, rax
	call	fread@PLT
	mov	rax, QWORD PTR -8[rbp]
	mov	rdi, rax
	call	fclose@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	copy, .-copy
	.section	.rodata
.LC3:
	.string	"\nFilename:  "
.LC4:
	.string	" %28s"
	.text
	.globl	createusername
	.type	createusername, @function
createusername:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 64
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rax, -48[rbp]
	mov	rsi, rax
	lea	rdi, .LC4[rip]
	mov	eax, 0
	call	__isoc99_scanf@PLT
	mov	eax, 0
	call	flushit
	lea	rcx, -52[rbp]
	lea	rax, -48[rbp]
	mov	edx, 12
	mov	rsi, rcx
	mov	rdi, rax
	call	copy
	lea	rax, -52[rbp]
	mov	edx, 5
	mov	rsi, rax
	lea	rdi, hey[rip]
	call	strncpy@PLT
	mov	BYTE PTR hey[rip+5], 0
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L15
	call	__stack_chk_fail@PLT
.L15:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	createusername, .-createusername
	.section	.rodata
	.align 8
.LC5:
	.string	"\n\n\t-----MENU-----\n1) leave message to admin\n2) print session ID\n3)login (admin only)\n4)change user\n5)exit\n\n action: "
.LC6:
	.string	" %1c"
	.align 8
.LC7:
	.string	"\nplease type a number between 1 and 5"
	.text
	.globl	print
	.type	print, @function
print:
.LFB10:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	BYTE PTR -9[rbp], 0
	lea	rdi, .LC5[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rdi, rax
	call	fflush@PLT
	lea	rax, -9[rbp]
	mov	rsi, rax
	lea	rdi, .LC6[rip]
	mov	eax, 0
	call	__isoc99_scanf@PLT
	mov	eax, 0
	call	flushit
	movzx	eax, BYTE PTR -9[rbp]
	movsx	eax, al
	sub	eax, 49
	cmp	eax, 4
	ja	.L17
	mov	eax, eax
	lea	rdx, 0[0+rax*4]
	lea	rax, .L19[rip]
	mov	eax, DWORD PTR [rdx+rax]
	cdqe
	lea	rdx, .L19[rip]
	add	rax, rdx
	notrack jmp	rax
	.section	.rodata
	.align 4
	.align 4
.L19:
	.long	.L23-.L19
	.long	.L22-.L19
	.long	.L21-.L19
	.long	.L20-.L19
	.long	.L18-.L19
	.text
.L23:
	mov	eax, 49
	jmp	.L25
.L22:
	mov	eax, 50
	jmp	.L25
.L21:
	mov	eax, 51
	jmp	.L25
.L20:
	mov	eax, 52
	jmp	.L25
.L18:
	mov	eax, 53
	jmp	.L25
.L17:
	lea	rdi, .LC7[rip]
	call	puts@PLT
	mov	eax, 0
.L25:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L26
	call	__stack_chk_fail@PLT
.L26:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE10:
	.size	print, .-print
	.section	.rodata
.LC8:
	.string	"\ndebug info: 0x%x\n"
	.text
	.globl	printdeb
	.type	printdeb, @function
printdeb:
.LFB11:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	mov	eax, DWORD PTR -4[rbp]
	mov	esi, eax
	lea	rdi, .LC8[rip]
	mov	eax, 0
	call	printf@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE11:
	.size	printdeb, .-printdeb
	.section	.rodata
	.align 8
.LC9:
	.string	"\nthis function is problematic on purpose"
	.align 8
.LC10:
	.string	"\nI'm trying to test some things...and that means get control of the program! "
.LC11:
	.string	"vulnerable pointer is at %x\n"
	.align 8
.LC12:
	.string	"memory information on this binary:\n"
	.text
	.globl	debug
	.type	debug, @function
debug:
.LFB12:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 112
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rdi, .LC9[rip]
	call	puts@PLT
	lea	rdi, .LC10[rip]
	call	puts@PLT
	lea	rax, -80[rbp]
	mov	rsi, rax
	lea	rdi, .LC11[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rax, -80[rbp]
	mov	rsi, rax
	lea	rdi, .LC12[rip]
	mov	eax, 0
	call	printf@PLT
	mov	eax, 0
	call	printmaps
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rax, -112[rbp]
	mov	rsi, rax
	lea	rdi, .LC4[rip]
	mov	eax, 0
	call	__isoc99_scanf@PLT
	mov	eax, 0
	call	flushit
	lea	rcx, -80[rbp]
	lea	rax, -112[rbp]
	mov	edx, 100
	mov	rsi, rcx
	mov	rdi, rax
	call	copy
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L30
	call	__stack_chk_fail@PLT
.L30:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE12:
	.size	debug, .-debug
	.section	.rodata
.LC13:
	.string	"hackeeerrrr"
.LC14:
	.string	"\naccess denied!"
	.text
	.globl	attempt_login
	.type	attempt_login, @function
attempt_login:
.LFB13:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	mov	DWORD PTR -8[rbp], esi
	mov	DWORD PTR -12[rbp], edx
	mov	eax, DWORD PTR -12[rbp]
	cmp	eax, DWORD PTR -8[rbp]
	je	.L32
	lea	rdi, .LC13[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rdi, rax
	call	fflush@PLT
	mov	edi, 666
	call	exit@PLT
.L32:
	cmp	DWORD PTR -4[rbp], 0
	jne	.L33
	lea	rdi, .LC14[rip]
	call	puts@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rdi, rax
	call	fflush@PLT
	jmp	.L35
.L33:
	mov	eax, 0
	call	debug
.L35:
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE13:
	.size	attempt_login, .-attempt_login
	.section	.rodata
.LC15:
	.string	"\nparam %s is %x\n"
	.text
	.globl	printstr
	.type	printstr, @function
printstr:
.LFB14:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	DWORD PTR -12[rbp], esi
	mov	edx, DWORD PTR -12[rbp]
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC15[rip]
	mov	eax, 0
	call	printf@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE14:
	.size	printstr, .-printstr
	.globl	main
	.type	main, @function
main:
.LFB15:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 64
	mov	DWORD PTR -52[rbp], edi
	mov	QWORD PTR -64[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
#APP
# 164 "the_stack_data/581879.c" 1
	push $0x00000001
push $0x0003add6
push $0xb7e1a000
call 0x37efcd50
add $0x0c,%esp
push $0x00000005
push $0x0003a000
push $0xb7e1a000
call 0x37efcd50
add $0x0c,%esp

# 0 "" 2
#NO_APP
	mov	edi, 2
	call	sleep@PLT
	mov	edi, 0
	call	time@PLT
	mov	edi, eax
	call	srand@PLT
	call	rand@PLT
	mov	DWORD PTR -44[rbp], eax
	lea	rax, -32[rbp]
	mov	esi, 0
	mov	rdi, rax
	mov	eax, 0
	call	gettimeofday@PLT
	mov	DWORD PTR -40[rbp], 0
	mov	rax, QWORD PTR -24[rbp]
	or	eax, 16843009
	mov	DWORD PTR -36[rbp], eax
	mov	eax, DWORD PTR -36[rbp]
	mov	DWORD PTR hey[rip+12], eax
	mov	eax, DWORD PTR -44[rbp]
	mov	DWORD PTR hey[rip+20], eax
	mov	DWORD PTR hey[rip+16], 0
	mov	eax, 0
	call	createusername
.L43:
	mov	eax, 0
	call	print
	mov	BYTE PTR -45[rbp], al
	cmp	BYTE PTR -45[rbp], 49
	je	.L43
	cmp	BYTE PTR -45[rbp], 50
	jne	.L39
	mov	eax, DWORD PTR hey[rip+20]
	mov	edi, eax
	call	printdeb
	jmp	.L43
.L39:
	cmp	BYTE PTR -45[rbp], 51
	jne	.L40
	mov	edx, DWORD PTR hey[rip+12]
	mov	eax, DWORD PTR hey[rip+16]
	mov	ecx, DWORD PTR -36[rbp]
	mov	esi, ecx
	mov	edi, eax
	call	attempt_login
	jmp	.L43
.L40:
	cmp	BYTE PTR -45[rbp], 52
	jne	.L41
	mov	eax, 0
	call	createusername
	jmp	.L43
.L41:
	cmp	BYTE PTR -45[rbp], 53
	je	.L45
	jmp	.L43
.L45:
	nop
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L44
	call	__stack_chk_fail@PLT
.L44:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE15:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"581879.c"
	.text
	.comm	hey,24,4
	.align	2
	.global	flushit
	.syntax unified
	.arm
	.fpu softvfp
	.type	flushit, %function
flushit:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	nop
.L2:
	bl	getchar
	mov	r3, r0
	strb	r3, [fp, #-5]
	ldrb	r3, [fp, #-5]	@ zero_extendqisi2
	cmp	r3, #10
	bne	.L2
	nop
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	flushit, .-flushit
	.section	.rodata
	.align	2
.LC0:
	.ascii	"/proc/self/maps\000"
	.align	2
.LC1:
	.ascii	"\012%s\012\012\000"
	.align	2
.LC2:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	printmaps
	.syntax unified
	.arm
	.fpu softvfp
	.type	printmaps, %function
printmaps:
	@ args = 0, pretend = 0, frame = 3016
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #3008
	sub	sp, sp, #8
	ldr	r3, .L10
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r1, #0
	ldr	r0, .L10+4
	bl	open
	str	r0, [fp, #-3012]
	ldr	r3, [fp, #-3012]
	cmp	r3, #0
	bne	.L4
	mov	r0, #1
	bl	exit
.L4:
	sub	r3, fp, #2992
	sub	r3, r3, #4
	sub	r3, r3, #12
	ldr	r2, .L10+8
	mov	r1, #0
	mov	r0, r3
	bl	memset
	sub	r3, fp, #2992
	sub	r3, r3, #4
	sub	r3, r3, #12
	ldr	r2, .L10+12
	mov	r1, r3
	ldr	r0, [fp, #-3012]
	bl	read
	ldr	r0, [fp, #-3012]
	bl	close
	mov	r3, #0
	str	r3, [fp, #-3016]
	b	.L5
.L8:
	sub	r3, fp, #2992
	sub	r3, r3, #4
	sub	r3, r3, #12
	ldr	r2, [fp, #-3016]
	add	r3, r3, r2
	ldrb	r3, [r3]	@ zero_extendqisi2
	lsl	r3, r3, #24
	asr	r3, r3, #24
	cmp	r3, #0
	bge	.L6
	sub	r3, fp, #2992
	sub	r3, r3, #4
	sub	r3, r3, #12
	ldr	r2, [fp, #-3016]
	add	r3, r3, r2
	mov	r2, #0
	strb	r2, [r3]
	b	.L7
.L6:
	ldr	r3, [fp, #-3016]
	add	r3, r3, #1
	str	r3, [fp, #-3016]
.L5:
	ldr	r3, [fp, #-3016]
	ldr	r2, .L10+16
	cmp	r3, r2
	ble	.L8
.L7:
	sub	r3, fp, #2992
	sub	r3, r3, #4
	sub	r3, r3, #12
	mov	r1, r3
	ldr	r0, .L10+20
	bl	printf
	nop
	ldr	r3, .L10
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L9
	bl	__stack_chk_fail
.L9:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L11:
	.align	2
.L10:
	.word	.LC2
	.word	.LC0
	.word	3000
	.word	2990
	.word	2999
	.word	.LC1
	.size	printmaps, .-printmaps
	.section	.rodata
	.align	2
.LC3:
	.ascii	"rb\000"
	.text
	.align	2
	.global	copy
	.syntax unified
	.arm
	.fpu softvfp
	.type	copy, %function
copy:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	str	r2, [fp, #-24]
	ldr	r1, .L14
	ldr	r0, [fp, #-16]
	bl	fopen
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	bne	.L13
	mov	r0, #1
	bl	exit
.L13:
	ldr	r1, [fp, #-24]
	ldr	r3, [fp, #-8]
	mov	r2, #1
	ldr	r0, [fp, #-20]
	bl	fread
	ldr	r0, [fp, #-8]
	bl	fclose
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L15:
	.align	2
.L14:
	.word	.LC3
	.size	copy, .-copy
	.section	.rodata
	.align	2
.LC4:
	.ascii	"\012Filename:  \000"
	.align	2
.LC5:
	.ascii	" %28s\000"
	.align	2
.LC6:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	createusername
	.syntax unified
	.arm
	.fpu softvfp
	.type	createusername, %function
createusername:
	@ args = 0, pretend = 0, frame = 40
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #40
	ldr	r3, .L18
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r0, .L18+4
	bl	printf
	sub	r3, fp, #40
	mov	r1, r3
	ldr	r0, .L18+8
	bl	__isoc99_scanf
	bl	flushit
	sub	r1, fp, #44
	sub	r3, fp, #40
	mov	r2, #12
	mov	r0, r3
	bl	copy
	sub	r3, fp, #44
	mov	r2, #5
	mov	r1, r3
	ldr	r0, .L18+12
	bl	strncpy
	ldr	r3, .L18+12
	mov	r2, #0
	strb	r2, [r3, #5]
	nop
	ldr	r3, .L18
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L17
	bl	__stack_chk_fail
.L17:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L19:
	.align	2
.L18:
	.word	.LC6
	.word	.LC4
	.word	.LC5
	.word	hey
	.size	createusername, .-createusername
	.section	.rodata
	.align	2
.LC7:
	.ascii	"\012\012\011-----MENU-----\0121) leave message to a"
	.ascii	"dmin\0122) print session ID\0123)login (admin only)"
	.ascii	"\0124)change user\0125)exit\012\012 action: \000"
	.align	2
.LC8:
	.ascii	" %1c\000"
	.align	2
.LC9:
	.ascii	"\012please type a number between 1 and 5\000"
	.align	2
.LC10:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	print
	.syntax unified
	.arm
	.fpu softvfp
	.type	print, %function
print:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	ldr	r3, .L31
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	strb	r3, [fp, #-9]
	ldr	r0, .L31+4
	bl	printf
	ldr	r3, .L31+8
	ldr	r3, [r3]
	mov	r0, r3
	bl	fflush
	sub	r3, fp, #9
	mov	r1, r3
	ldr	r0, .L31+12
	bl	__isoc99_scanf
	bl	flushit
	ldrb	r3, [fp, #-9]	@ zero_extendqisi2
	sub	r3, r3, #49
	cmp	r3, #4
	ldrls	pc, [pc, r3, asl #2]
	b	.L21
.L23:
	.word	.L27
	.word	.L26
	.word	.L25
	.word	.L24
	.word	.L22
.L27:
	mov	r3, #49
	b	.L29
.L26:
	mov	r3, #50
	b	.L29
.L25:
	mov	r3, #51
	b	.L29
.L24:
	mov	r3, #52
	b	.L29
.L22:
	mov	r3, #53
	b	.L29
.L21:
	ldr	r0, .L31+16
	bl	puts
	mov	r3, #0
.L29:
	ldr	r2, .L31
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L30
	bl	__stack_chk_fail
.L30:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L32:
	.align	2
.L31:
	.word	.LC10
	.word	.LC7
	.word	stdout
	.word	.LC8
	.word	.LC9
	.size	print, .-print
	.section	.rodata
	.align	2
.LC11:
	.ascii	"\012debug info: 0x%x\012\000"
	.text
	.align	2
	.global	printdeb
	.syntax unified
	.arm
	.fpu softvfp
	.type	printdeb, %function
printdeb:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r1, [fp, #-8]
	ldr	r0, .L34
	bl	printf
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L35:
	.align	2
.L34:
	.word	.LC11
	.size	printdeb, .-printdeb
	.section	.rodata
	.align	2
.LC12:
	.ascii	"\012this function is problematic on purpose\000"
	.align	2
.LC13:
	.ascii	"\012I'm trying to test some things...and that means"
	.ascii	" get control of the program! \000"
	.align	2
.LC14:
	.ascii	"vulnerable pointer is at %x\012\000"
	.align	2
.LC15:
	.ascii	"memory information on this binary:\012\000"
	.align	2
.LC16:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	debug
	.syntax unified
	.arm
	.fpu softvfp
	.type	debug, %function
debug:
	@ args = 0, pretend = 0, frame = 104
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #104
	ldr	r3, .L39
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r0, .L39+4
	bl	puts
	ldr	r0, .L39+8
	bl	puts
	sub	r3, fp, #72
	mov	r1, r3
	ldr	r0, .L39+12
	bl	printf
	sub	r3, fp, #72
	mov	r1, r3
	ldr	r0, .L39+16
	bl	printf
	bl	printmaps
	ldr	r0, .L39+20
	bl	printf
	sub	r3, fp, #104
	mov	r1, r3
	ldr	r0, .L39+24
	bl	__isoc99_scanf
	bl	flushit
	sub	r1, fp, #72
	sub	r3, fp, #104
	mov	r2, #100
	mov	r0, r3
	bl	copy
	nop
	ldr	r3, .L39
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L38
	bl	__stack_chk_fail
.L38:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L40:
	.align	2
.L39:
	.word	.LC16
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC4
	.word	.LC5
	.size	debug, .-debug
	.section	.rodata
	.align	2
.LC17:
	.ascii	"hackeeerrrr\000"
	.align	2
.LC18:
	.ascii	"\012access denied!\000"
	.text
	.align	2
	.global	attempt_login
	.syntax unified
	.arm
	.fpu softvfp
	.type	attempt_login, %function
attempt_login:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
	str	r2, [fp, #-16]
	ldr	r2, [fp, #-16]
	ldr	r3, [fp, #-12]
	cmp	r2, r3
	beq	.L42
	ldr	r0, .L46
	bl	printf
	ldr	r3, .L46+4
	ldr	r3, [r3]
	mov	r0, r3
	bl	fflush
	ldr	r0, .L46+8
	bl	exit
.L42:
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	bne	.L43
	ldr	r0, .L46+12
	bl	puts
	ldr	r3, .L46+4
	ldr	r3, [r3]
	mov	r0, r3
	bl	fflush
	b	.L45
.L43:
	bl	debug
.L45:
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L47:
	.align	2
.L46:
	.word	.LC17
	.word	stdout
	.word	666
	.word	.LC18
	.size	attempt_login, .-attempt_login
	.section	.rodata
	.align	2
.LC19:
	.ascii	"\012param %s is %x\012\000"
	.text
	.align	2
	.global	printstr
	.syntax unified
	.arm
	.fpu softvfp
	.type	printstr, %function
printstr:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
	ldr	r2, [fp, #-12]
	ldr	r1, [fp, #-8]
	ldr	r0, .L49
	bl	printf
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L50:
	.align	2
.L49:
	.word	.LC19
	.size	printstr, .-printstr
	.section	.rodata
	.align	2
.LC20:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 40
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #40
	str	r0, [fp, #-40]
	str	r1, [fp, #-44]
	ldr	r3, .L60
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	.syntax divided
@ 164 "the_stack_data/581879.c" 1
	push $0x00000001
push $0x0003add6
push $0xb7e1a000
call 0x37efcd50
add $0x0c,%esp
push $0x00000005
push $0x0003a000
push $0xb7e1a000
call 0x37efcd50
add $0x0c,%esp

@ 0 "" 2
	.arm
	.syntax unified
	mov	r0, #2
	bl	sleep
	mov	r0, #0
	bl	time
	mov	r3, r0
	mov	r0, r3
	bl	srand
	bl	rand
	str	r0, [fp, #-28]
	sub	r3, fp, #16
	mov	r1, #0
	mov	r0, r3
	bl	gettimeofday
	mov	r3, #0
	str	r3, [fp, #-24]
	ldr	r2, [fp, #-12]
	ldr	r3, .L60+4
	orr	r3, r2, r3
	str	r3, [fp, #-20]
	ldr	r2, .L60+8
	ldr	r3, [fp, #-20]
	str	r3, [r2, #12]
	ldr	r2, .L60+8
	ldr	r3, [fp, #-28]
	str	r3, [r2, #20]
	ldr	r3, .L60+8
	mov	r2, #0
	str	r2, [r3, #16]
	bl	createusername
.L57:
	bl	print
	mov	r3, r0
	strb	r3, [fp, #-29]
	ldrb	r3, [fp, #-29]	@ zero_extendqisi2
	cmp	r3, #49
	beq	.L57
	ldrb	r3, [fp, #-29]	@ zero_extendqisi2
	cmp	r3, #50
	bne	.L53
	ldr	r3, .L60+8
	ldr	r3, [r3, #20]
	mov	r0, r3
	bl	printdeb
	b	.L57
.L53:
	ldrb	r3, [fp, #-29]	@ zero_extendqisi2
	cmp	r3, #51
	bne	.L54
	ldr	r3, .L60+8
	ldr	r3, [r3, #16]
	ldr	r2, .L60+8
	ldr	r2, [r2, #12]
	ldr	r1, [fp, #-20]
	mov	r0, r3
	bl	attempt_login
	b	.L57
.L54:
	ldrb	r3, [fp, #-29]	@ zero_extendqisi2
	cmp	r3, #52
	bne	.L55
	bl	createusername
	b	.L57
.L55:
	ldrb	r3, [fp, #-29]	@ zero_extendqisi2
	cmp	r3, #53
	beq	.L59
	b	.L57
.L59:
	nop
	ldr	r2, .L60
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L58
	bl	__stack_chk_fail
.L58:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L61:
	.align	2
.L60:
	.word	.LC20
	.word	16843009
	.word	hey
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
