	.file	"649829.c"
	.intel_syntax noprefix
	.text
	.globl	un_init_func_table
	.bss
	.align 32
	.type	un_init_func_table, @object
	.size	un_init_func_table, 128
un_init_func_table:
	.zero	128
	.text
	.globl	second_gate
	.type	second_gate, @function
second_gate:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	mov	DWORD PTR -8[rbp], esi
	mov	edx, DWORD PTR -4[rbp]
	mov	eax, DWORD PTR -8[rbp]
	add	eax, edx
	test	eax, eax
	jne	.L4
	mov	eax, DWORD PTR -4[rbp]
	cdqe
	lea	rdx, 0[0+rax*8]
	lea	rax, un_init_func_table[rip]
	mov	rdx, QWORD PTR [rdx+rax]
	mov	eax, DWORD PTR -8[rbp]
	mov	edi, eax
	call	rdx
	jmp	.L1
.L4:
	nop
.L1:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	second_gate, .-second_gate
	.globl	second_gate_dup
	.type	second_gate_dup, @function
second_gate_dup:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	mov	DWORD PTR -8[rbp], esi
	mov	edx, DWORD PTR -4[rbp]
	mov	eax, DWORD PTR -8[rbp]
	add	eax, edx
	test	eax, eax
	je	.L8
	mov	eax, DWORD PTR -4[rbp]
	cdqe
	lea	rdx, 0[0+rax*8]
	lea	rax, un_init_func_table[rip]
	mov	rdx, QWORD PTR [rdx+rax]
	mov	eax, DWORD PTR -8[rbp]
	mov	edi, eax
	call	rdx
	jmp	.L5
.L8:
	nop
.L5:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	second_gate_dup, .-second_gate_dup
	.globl	init_func_table
	.section	.data.rel.local,"aw"
	.align 32
	.type	init_func_table, @object
	.size	init_func_table, 128
init_func_table:
	.quad	second_gate
	.quad	second_gate_dup
	.quad	0
	.zero	104
	.section	.rodata
.LC0:
	.string	"Target!"
	.text
	.globl	target
	.type	target, @function
target:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	lea	rdi, .LC0[rip]
	call	puts@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	target, .-target
	.section	.rodata
	.align 8
.LC1:
	.string	"we point the %p! and arg is %d! WOW!\n"
	.text
	.globl	origin_flow
	.type	origin_flow, @function
origin_flow:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	DWORD PTR -12[rbp], esi
	mov	edx, DWORD PTR -12[rbp]
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC1[rip]
	mov	eax, 0
	call	printf@PLT
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	origin_flow, .-origin_flow
	.globl	first_gate
	.type	first_gate, @function
first_gate:
.LFB10:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	DWORD PTR -12[rbp], esi
	cmp	DWORD PTR -12[rbp], -1
	jne	.L13
	mov	eax, -1
	jmp	.L14
.L13:
	cmp	DWORD PTR -12[rbp], 0
	jne	.L15
	mov	eax, DWORD PTR -12[rbp]
	mov	rdx, QWORD PTR -8[rbp]
	mov	esi, 0
	mov	edi, eax
	call	rdx
	jmp	.L16
.L15:
	mov	rdx, QWORD PTR init_func_table[rip]
	mov	eax, DWORD PTR -12[rbp]
	mov	esi, -1
	mov	edi, eax
	call	rdx
.L16:
	mov	eax, 0
.L14:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE10:
	.size	first_gate, .-first_gate
	.globl	third_gate
	.type	third_gate, @function
third_gate:
.LFB11:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	cmp	DWORD PTR -4[rbp], 0
	jne	.L20
	mov	eax, DWORD PTR -4[rbp]
	mov	edi, eax
	call	target
	jmp	.L17
.L20:
	nop
.L17:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE11:
	.size	third_gate, .-third_gate
	.section	.rodata
	.align 8
.LC2:
	.string	"first gate is %p, second gate is %p\n"
.LC3:
	.string	"%p"
.LC4:
	.string	"%d"
	.text
	.globl	vuln
	.type	vuln, @function
vuln:
.LFB12:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rax, origin_flow[rip]
	mov	QWORD PTR -24[rbp], rax
	lea	rdx, second_gate[rip]
	lea	rsi, first_gate[rip]
	lea	rdi, .LC2[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rax, -24[rbp]
	mov	rsi, rax
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	__isoc99_scanf@PLT
	mov	QWORD PTR -16[rbp], 0
	lea	rax, -16[rbp]
	mov	rsi, rax
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	__isoc99_scanf@PLT
	mov	DWORD PTR -28[rbp], 0
	lea	rax, -28[rbp]
	mov	rsi, rax
	lea	rdi, .LC4[rip]
	mov	eax, 0
	call	__isoc99_scanf@PLT
	mov	rcx, QWORD PTR -24[rbp]
	mov	edx, DWORD PTR -28[rbp]
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, edx
	mov	rdi, rax
	call	rcx
	mov	eax, 0
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L23
	call	__stack_chk_fail@PLT
.L23:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE12:
	.size	vuln, .-vuln
	.globl	init_table_on_runtime
	.type	init_table_on_runtime, @function
init_table_on_runtime:
.LFB13:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	lea	rax, third_gate[rip]
	mov	QWORD PTR un_init_func_table[rip], rax
	mov	eax, 0
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE13:
	.size	init_table_on_runtime, .-init_table_on_runtime
	.globl	main
	.type	main, @function
main:
.LFB14:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	mov	eax, 0
	call	init_table_on_runtime
	mov	esi, 0
	mov	edi, 0
	call	second_gate_dup
	mov	eax, 0
	call	vuln
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE14:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"649829.c"
	.text
	.global	un_init_func_table
	.bss
	.align	2
	.type	un_init_func_table, %object
	.size	un_init_func_table, 64
un_init_func_table:
	.space	64
	.text
	.align	2
	.global	second_gate
	.syntax unified
	.arm
	.fpu softvfp
	.type	second_gate, %function
second_gate:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
	ldr	r2, [fp, #-8]
	ldr	r3, [fp, #-12]
	add	r3, r2, r3
	cmp	r3, #0
	bne	.L4
	ldr	r2, .L5
	ldr	r3, [fp, #-8]
	ldr	r3, [r2, r3, lsl #2]
	ldr	r0, [fp, #-12]
	blx	r3
	b	.L1
.L4:
	nop
.L1:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L6:
	.align	2
.L5:
	.word	un_init_func_table
	.size	second_gate, .-second_gate
	.align	2
	.global	second_gate_dup
	.syntax unified
	.arm
	.fpu softvfp
	.type	second_gate_dup, %function
second_gate_dup:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
	ldr	r2, [fp, #-8]
	ldr	r3, [fp, #-12]
	add	r3, r2, r3
	cmp	r3, #0
	beq	.L10
	ldr	r2, .L11
	ldr	r3, [fp, #-8]
	ldr	r3, [r2, r3, lsl #2]
	ldr	r0, [fp, #-12]
	blx	r3
	b	.L7
.L10:
	nop
.L7:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L12:
	.align	2
.L11:
	.word	un_init_func_table
	.size	second_gate_dup, .-second_gate_dup
	.global	init_func_table
	.data
	.align	2
	.type	init_func_table, %object
	.size	init_func_table, 64
init_func_table:
	.word	second_gate
	.word	second_gate_dup
	.word	0
	.space	52
	.section	.rodata
	.align	2
.LC0:
	.ascii	"Target!\000"
	.text
	.align	2
	.global	target
	.syntax unified
	.arm
	.fpu softvfp
	.type	target, %function
target:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r0, .L14
	bl	puts
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L15:
	.align	2
.L14:
	.word	.LC0
	.size	target, .-target
	.section	.rodata
	.align	2
.LC1:
	.ascii	"we point the %p! and arg is %d! WOW!\012\000"
	.text
	.align	2
	.global	origin_flow
	.syntax unified
	.arm
	.fpu softvfp
	.type	origin_flow, %function
origin_flow:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
	ldr	r2, [fp, #-12]
	ldr	r1, [fp, #-8]
	ldr	r0, .L18
	bl	printf
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L19:
	.align	2
.L18:
	.word	.LC1
	.size	origin_flow, .-origin_flow
	.align	2
	.global	first_gate
	.syntax unified
	.arm
	.fpu softvfp
	.type	first_gate, %function
first_gate:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
	ldr	r3, [fp, #-12]
	cmn	r3, #1
	bne	.L21
	mvn	r3, #0
	b	.L22
.L21:
	ldr	r3, [fp, #-12]
	cmp	r3, #0
	bne	.L23
	ldr	r3, [fp, #-8]
	mov	r1, #0
	ldr	r0, [fp, #-12]
	blx	r3
	b	.L24
.L23:
	ldr	r3, .L25
	ldr	r3, [r3]
	mvn	r1, #0
	ldr	r0, [fp, #-12]
	blx	r3
.L24:
	mov	r3, #0
.L22:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L26:
	.align	2
.L25:
	.word	init_func_table
	.size	first_gate, .-first_gate
	.align	2
	.global	third_gate
	.syntax unified
	.arm
	.fpu softvfp
	.type	third_gate, %function
third_gate:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	bne	.L30
	ldr	r0, [fp, #-8]
	bl	target
	b	.L27
.L30:
	nop
.L27:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	third_gate, .-third_gate
	.section	.rodata
	.align	2
.LC2:
	.ascii	"first gate is %p, second gate is %p\012\000"
	.align	2
.LC3:
	.ascii	"%p\000"
	.align	2
.LC4:
	.ascii	"%d\000"
	.align	2
.LC5:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	vuln
	.syntax unified
	.arm
	.fpu softvfp
	.type	vuln, %function
vuln:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	ldr	r3, .L34
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L34+4
	str	r3, [fp, #-20]
	ldr	r2, .L34+8
	ldr	r1, .L34+12
	ldr	r0, .L34+16
	bl	printf
	sub	r3, fp, #20
	mov	r1, r3
	ldr	r0, .L34+20
	bl	__isoc99_scanf
	mov	r3, #0
	str	r3, [fp, #-16]
	sub	r3, fp, #16
	mov	r1, r3
	ldr	r0, .L34+20
	bl	__isoc99_scanf
	mov	r3, #0
	str	r3, [fp, #-12]
	sub	r3, fp, #12
	mov	r1, r3
	ldr	r0, .L34+24
	bl	__isoc99_scanf
	ldr	r3, [fp, #-20]
	ldr	r2, [fp, #-16]
	ldr	r1, [fp, #-12]
	mov	r0, r2
	blx	r3
	mov	r3, #0
	ldr	r2, .L34
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L33
	bl	__stack_chk_fail
.L33:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L35:
	.align	2
.L34:
	.word	.LC5
	.word	origin_flow
	.word	second_gate
	.word	first_gate
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.size	vuln, .-vuln
	.align	2
	.global	init_table_on_runtime
	.syntax unified
	.arm
	.fpu softvfp
	.type	init_table_on_runtime, %function
init_table_on_runtime:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	@ link register save eliminated.
	str	fp, [sp, #-4]!
	add	fp, sp, #0
	ldr	r3, .L38
	ldr	r2, .L38+4
	str	r2, [r3]
	mov	r3, #0
	mov	r0, r3
	add	sp, fp, #0
	@ sp needed
	ldr	fp, [sp], #4
	bx	lr
.L39:
	.align	2
.L38:
	.word	un_init_func_table
	.word	third_gate
	.size	init_table_on_runtime, .-init_table_on_runtime
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	bl	init_table_on_runtime
	mov	r1, #0
	mov	r0, #0
	bl	second_gate_dup
	bl	vuln
	mov	r3, r0
	mov	r0, r3
	pop	{fp, pc}
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
