	.file	"193688.c"
	.intel_syntax noprefix
	.text
	.section	.rodata
	.align 8
.LC0:
	.string	"/sbin:/usr/sbin:/usr/local/sbin:"
.LC1:
	.string	"PATH"
	.text
	.globl	add_sbin_to_path
	.type	add_sbin_to_path, @function
add_sbin_to_path:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	r15
	push	r14
	push	r12
	push	rbx
	sub	rsp, 64
	.cfi_offset 15, -24
	.cfi_offset 14, -32
	.cfi_offset 12, -40
	.cfi_offset 3, -48
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -40[rbp], rax
	xor	eax, eax
	mov	rax, rsp
	mov	r12, rax
	lea	rax, .LC0[rip]
	mov	QWORD PTR -80[rbp], rax
	lea	rdi, .LC1[rip]
	call	getenv@PLT
	mov	QWORD PTR -72[rbp], rax
	cmp	QWORD PTR -72[rbp], 0
	jne	.L2
	mov	eax, 1
	jmp	.L3
.L2:
	mov	rax, QWORD PTR -72[rbp]
	mov	rdi, rax
	call	strlen@PLT
	mov	rbx, rax
	mov	rax, QWORD PTR -80[rbp]
	mov	rdi, rax
	call	strlen@PLT
	add	rax, rbx
	mov	QWORD PTR -64[rbp], rax
	mov	rax, QWORD PTR -64[rbp]
	mov	rdx, rax
	sub	rdx, 1
	mov	QWORD PTR -56[rbp], rdx
	mov	QWORD PTR -96[rbp], rax
	mov	QWORD PTR -88[rbp], 0
	mov	r14, rax
	mov	r15d, 0
	mov	edx, 16
	sub	rdx, 1
	add	rax, rdx
	mov	ebx, 16
	mov	edx, 0
	div	rbx
	imul	rax, rax, 16
	mov	rcx, rax
	and	rcx, -4096
	mov	rdx, rsp
	sub	rdx, rcx
.L4:
	cmp	rsp, rdx
	je	.L5
	sub	rsp, 4096
	or	QWORD PTR 4088[rsp], 0
	jmp	.L4
.L5:
	mov	rdx, rax
	and	edx, 4095
	sub	rsp, rdx
	mov	rdx, rax
	and	edx, 4095
	test	rdx, rdx
	je	.L6
	and	eax, 4095
	sub	rax, 8
	add	rax, rsp
	or	QWORD PTR [rax], 0
.L6:
	mov	rax, rsp
	add	rax, 0
	mov	QWORD PTR -48[rbp], rax
	mov	rdx, QWORD PTR -64[rbp]
	mov	rax, QWORD PTR -48[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR -80[rbp]
	mov	rdi, rax
	call	strlen@PLT
	mov	rdx, rax
	mov	rcx, QWORD PTR -80[rbp]
	mov	rax, QWORD PTR -48[rbp]
	mov	rsi, rcx
	mov	rdi, rax
	call	strncat@PLT
	mov	rax, QWORD PTR -72[rbp]
	mov	rdi, rax
	call	strlen@PLT
	mov	rdx, rax
	mov	rcx, QWORD PTR -72[rbp]
	mov	rax, QWORD PTR -48[rbp]
	mov	rsi, rcx
	mov	rdi, rax
	call	strncat@PLT
	mov	rax, QWORD PTR -48[rbp]
	mov	edx, 1
	mov	rsi, rax
	lea	rdi, .LC1[rip]
	call	setenv@PLT
.L3:
	mov	rsp, r12
	mov	rbx, QWORD PTR -40[rbp]
	sub	rbx, QWORD PTR fs:40
	je	.L8
	call	__stack_chk_fail@PLT
.L8:
	lea	rsp, -32[rbp]
	pop	rbx
	pop	r12
	pop	r14
	pop	r15
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	add_sbin_to_path, .-add_sbin_to_path
	.section	.rodata
.LC2:
	.string	"SHELL"
.LC3:
	.string	"sh"
.LC4:
	.string	"-l"
.LC5:
	.string	"Unable to execute %s\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 64
	mov	DWORD PTR -52[rbp], edi
	mov	QWORD PTR -64[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	eax, 0
	call	add_sbin_to_path
	mov	rax, QWORD PTR -64[rbp]
	add	rax, 8
	mov	QWORD PTR -48[rbp], rax
	mov	rax, QWORD PTR -48[rbp]
	mov	rax, QWORD PTR [rax]
	test	rax, rax
	jne	.L10
	lea	rdi, .LC2[rip]
	call	getenv@PLT
	mov	QWORD PTR -40[rbp], rax
	cmp	QWORD PTR -40[rbp], 0
	jne	.L11
	lea	rax, .LC3[rip]
	mov	QWORD PTR -40[rbp], rax
.L11:
	mov	rax, QWORD PTR -40[rbp]
	mov	QWORD PTR -32[rbp], rax
	lea	rax, .LC4[rip]
	mov	QWORD PTR -24[rbp], rax
	mov	QWORD PTR -16[rbp], 0
	lea	rax, -32[rbp]
	mov	QWORD PTR -48[rbp], rax
.L10:
	mov	edi, 0
	call	setuid@PLT
	mov	rax, QWORD PTR -48[rbp]
	mov	rax, QWORD PTR [rax]
	mov	rdx, QWORD PTR -48[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	execvp@PLT
	test	eax, eax
	je	.L12
	mov	rax, QWORD PTR -48[rbp]
	mov	rdx, QWORD PTR [rax]
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC5[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	eax, 1
	jmp	.L13
.L12:
	mov	eax, 0
.L13:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L14
	call	__stack_chk_fail@PLT
.L14:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"193688.c"
	.text
	.section	.rodata
	.align	2
.LC0:
	.ascii	"/sbin:/usr/sbin:/usr/local/sbin:\000"
	.align	2
.LC1:
	.ascii	"PATH\000"
	.align	2
.LC2:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	add_sbin_to_path
	.syntax unified
	.arm
	.fpu softvfp
	.type	add_sbin_to_path, %function
add_sbin_to_path:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, r5, fp, lr}
	add	fp, sp, #12
	sub	sp, sp, #24
	ldr	r3, .L6
	ldr	r3, [r3]
	str	r3, [fp, #-16]
	mov	r3,#0
	mov	r3, sp
	mov	r5, r3
	ldr	r3, .L6+4
	str	r3, [fp, #-36]
	ldr	r0, .L6+8
	bl	getenv
	str	r0, [fp, #-32]
	ldr	r3, [fp, #-32]
	cmp	r3, #0
	bne	.L2
	mov	r3, #1
	b	.L3
.L2:
	ldr	r0, [fp, #-32]
	bl	strlen
	mov	r4, r0
	ldr	r0, [fp, #-36]
	bl	strlen
	mov	r3, r0
	add	r3, r4, r3
	str	r3, [fp, #-28]
	ldr	ip, [fp, #-28]
	mov	r3, ip
	sub	r3, r3, #1
	str	r3, [fp, #-24]
	mov	r0, ip
	mov	r1, #0
	mov	r2, #0
	mov	r3, #0
	lsl	r3, r1, #3
	orr	r3, r3, r0, lsr #29
	lsl	r2, r0, #3
	mov	r0, ip
	mov	r1, #0
	mov	r2, #0
	mov	r3, #0
	lsl	r3, r1, #3
	orr	r3, r3, r0, lsr #29
	lsl	r2, r0, #3
	add	r3, ip, #7
	lsr	r3, r3, #3
	lsl	r3, r3, #3
	sub	sp, sp, r3
	mov	r3, sp
	add	r3, r3, #0
	str	r3, [fp, #-20]
	ldr	r2, [fp, #-28]
	mov	r1, #0
	ldr	r0, [fp, #-20]
	bl	memset
	ldr	r0, [fp, #-36]
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r1, [fp, #-36]
	ldr	r0, [fp, #-20]
	bl	strncat
	ldr	r0, [fp, #-32]
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r1, [fp, #-32]
	ldr	r0, [fp, #-20]
	bl	strncat
	mov	r2, #1
	ldr	r1, [fp, #-20]
	ldr	r0, .L6+8
	bl	setenv
	mov	r3, r0
.L3:
	mov	sp, r5
	ldr	r2, .L6
	ldr	r1, [r2]
	ldr	r2, [fp, #-16]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L5
	bl	__stack_chk_fail
.L5:
	mov	r0, r3
	sub	sp, fp, #12
	@ sp needed
	pop	{r4, r5, fp, pc}
.L7:
	.align	2
.L6:
	.word	.LC2
	.word	.LC0
	.word	.LC1
	.size	add_sbin_to_path, .-add_sbin_to_path
	.section	.rodata
	.align	2
.LC3:
	.ascii	"SHELL\000"
	.align	2
.LC4:
	.ascii	"sh\000"
	.align	2
.LC5:
	.ascii	"-l\000"
	.align	2
.LC6:
	.ascii	"Unable to execute %s\012\000"
	.align	2
.LC7:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 32
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #32
	str	r0, [fp, #-32]
	str	r1, [fp, #-36]
	ldr	r3, .L14
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	bl	add_sbin_to_path
	ldr	r3, [fp, #-36]
	add	r3, r3, #4
	str	r3, [fp, #-28]
	ldr	r3, [fp, #-28]
	ldr	r3, [r3]
	cmp	r3, #0
	bne	.L9
	ldr	r0, .L14+4
	bl	getenv
	str	r0, [fp, #-24]
	ldr	r3, [fp, #-24]
	cmp	r3, #0
	bne	.L10
	ldr	r3, .L14+8
	str	r3, [fp, #-24]
.L10:
	ldr	r3, [fp, #-24]
	str	r3, [fp, #-20]
	ldr	r3, .L14+12
	str	r3, [fp, #-16]
	mov	r3, #0
	str	r3, [fp, #-12]
	sub	r3, fp, #20
	str	r3, [fp, #-28]
.L9:
	mov	r0, #0
	bl	setuid
	ldr	r3, [fp, #-28]
	ldr	r3, [r3]
	ldr	r1, [fp, #-28]
	mov	r0, r3
	bl	execvp
	mov	r3, r0
	cmp	r3, #0
	beq	.L11
	ldr	r3, .L14+16
	ldr	r0, [r3]
	ldr	r3, [fp, #-28]
	ldr	r3, [r3]
	mov	r2, r3
	ldr	r1, .L14+20
	bl	fprintf
	mov	r3, #1
	b	.L12
.L11:
	mov	r3, #0
.L12:
	ldr	r2, .L14
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L13
	bl	__stack_chk_fail
.L13:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L15:
	.align	2
.L14:
	.word	.LC7
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	stderr
	.word	.LC6
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
