	.file	"363869.c"
	.intel_syntax noprefix
	.text
	.section	.rodata
.LC0:
	.string	"Welcome to pwnable.kr"
	.align 8
.LC1:
	.string	"Let's see if you know how to give input to program"
	.align 8
.LC2:
	.string	"Just give me correct inputs then you will get the flag :)"
.LC3:
	.string	" \n\r"
.LC4:
	.string	"Stage 1 clear!"
.LC5:
	.string	""
	.string	"\n"
	.string	"\377"
.LC6:
	.string	""
	.string	"\n\002\377"
.LC7:
	.string	"Stage 2 clear!"
.LC8:
	.string	"\336\255\276\357"
.LC9:
	.string	"\312\376\272\276"
.LC10:
	.string	"Stage 3 clear!"
.LC11:
	.string	"r"
.LC12:
	.string	"\n"
.LC13:
	.string	""
	.string	""
	.string	""
	.string	""
	.string	""
.LC14:
	.string	"Stage 4 clear!"
.LC15:
	.string	"socket error, tell admin"
.LC16:
	.string	"bind error, use another port"
.LC17:
	.string	"accept error, tell admin"
.LC18:
	.string	"Stage 5 clear!"
.LC19:
	.string	"/bin/cat flag"
	.text
	.globl	main
	.type	main, @function
main:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 112
	mov	DWORD PTR -84[rbp], edi
	mov	QWORD PTR -96[rbp], rsi
	mov	QWORD PTR -104[rbp], rdx
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rdi, .LC0[rip]
	call	puts@PLT
	lea	rdi, .LC1[rip]
	call	puts@PLT
	lea	rdi, .LC2[rip]
	call	puts@PLT
	cmp	DWORD PTR -84[rbp], 100
	je	.L2
	mov	eax, 0
	jmp	.L17
.L2:
	mov	rax, QWORD PTR -96[rbp]
	add	rax, 520
	mov	rax, QWORD PTR [rax]
	movzx	eax, BYTE PTR [rax]
	movzx	eax, al
	test	eax, eax
	je	.L4
	mov	eax, 0
	jmp	.L17
.L4:
	mov	rax, QWORD PTR -96[rbp]
	add	rax, 528
	mov	rax, QWORD PTR [rax]
	lea	rsi, .LC3[rip]
	mov	rdi, rax
	call	strcmp@PLT
	test	eax, eax
	je	.L5
	mov	eax, 0
	jmp	.L17
.L5:
	lea	rdi, .LC4[rip]
	call	puts@PLT
	lea	rax, -12[rbp]
	mov	edx, 4
	mov	rsi, rax
	mov	edi, 0
	mov	eax, 0
	call	read@PLT
	lea	rax, -12[rbp]
	mov	edx, 4
	lea	rsi, .LC5[rip]
	mov	rdi, rax
	call	memcmp@PLT
	test	eax, eax
	je	.L6
	mov	eax, 0
	jmp	.L17
.L6:
	lea	rax, -12[rbp]
	mov	edx, 4
	mov	rsi, rax
	mov	edi, 2
	mov	eax, 0
	call	read@PLT
	lea	rax, -12[rbp]
	mov	edx, 4
	lea	rsi, .LC6[rip]
	mov	rdi, rax
	call	memcmp@PLT
	test	eax, eax
	je	.L7
	mov	eax, 0
	jmp	.L17
.L7:
	lea	rdi, .LC7[rip]
	call	puts@PLT
	lea	rdi, .LC8[rip]
	call	getenv@PLT
	mov	rsi, rax
	lea	rdi, .LC9[rip]
	call	strcmp@PLT
	test	eax, eax
	je	.L8
	mov	eax, 0
	jmp	.L17
.L8:
	lea	rdi, .LC10[rip]
	call	puts@PLT
	lea	rsi, .LC11[rip]
	lea	rdi, .LC12[rip]
	call	fopen@PLT
	mov	QWORD PTR -56[rbp], rax
	cmp	QWORD PTR -56[rbp], 0
	jne	.L9
	mov	eax, 0
	jmp	.L17
.L9:
	mov	rdx, QWORD PTR -56[rbp]
	lea	rax, -12[rbp]
	mov	rcx, rdx
	mov	edx, 1
	mov	esi, 4
	mov	rdi, rax
	call	fread@PLT
	cmp	rax, 1
	je	.L10
	mov	eax, 0
	jmp	.L17
.L10:
	lea	rax, -12[rbp]
	mov	edx, 4
	lea	rsi, .LC13[rip]
	mov	rdi, rax
	call	memcmp@PLT
	test	eax, eax
	je	.L11
	mov	eax, 0
	jmp	.L17
.L11:
	mov	rax, QWORD PTR -56[rbp]
	mov	rdi, rax
	call	fclose@PLT
	lea	rdi, .LC14[rip]
	call	puts@PLT
	mov	edx, 0
	mov	esi, 1
	mov	edi, 2
	call	socket@PLT
	mov	DWORD PTR -64[rbp], eax
	cmp	DWORD PTR -64[rbp], -1
	jne	.L12
	lea	rdi, .LC15[rip]
	call	puts@PLT
	mov	eax, 0
	jmp	.L17
.L12:
	mov	WORD PTR -48[rbp], 2
	mov	DWORD PTR -44[rbp], 0
	mov	rax, QWORD PTR -96[rbp]
	add	rax, 536
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	atoi@PLT
	movzx	eax, ax
	mov	edi, eax
	call	htons@PLT
	mov	WORD PTR -46[rbp], ax
	lea	rcx, -48[rbp]
	mov	eax, DWORD PTR -64[rbp]
	mov	edx, 16
	mov	rsi, rcx
	mov	edi, eax
	call	bind@PLT
	test	eax, eax
	jns	.L13
	lea	rdi, .LC16[rip]
	call	puts@PLT
	mov	eax, 1
	jmp	.L17
.L13:
	mov	eax, DWORD PTR -64[rbp]
	mov	esi, 1
	mov	edi, eax
	call	listen@PLT
	mov	DWORD PTR -68[rbp], 16
	lea	rdx, -68[rbp]
	lea	rcx, -32[rbp]
	mov	eax, DWORD PTR -64[rbp]
	mov	rsi, rcx
	mov	edi, eax
	call	accept@PLT
	mov	DWORD PTR -60[rbp], eax
	cmp	DWORD PTR -60[rbp], 0
	jns	.L14
	lea	rdi, .LC17[rip]
	call	puts@PLT
	mov	eax, 0
	jmp	.L17
.L14:
	lea	rsi, -12[rbp]
	mov	eax, DWORD PTR -60[rbp]
	mov	ecx, 0
	mov	edx, 4
	mov	edi, eax
	call	recv@PLT
	cmp	rax, 4
	je	.L15
	mov	eax, 0
	jmp	.L17
.L15:
	lea	rax, -12[rbp]
	mov	edx, 4
	lea	rsi, .LC8[rip]
	mov	rdi, rax
	call	memcmp@PLT
	test	eax, eax
	je	.L16
	mov	eax, 0
	jmp	.L17
.L16:
	lea	rdi, .LC18[rip]
	call	puts@PLT
	lea	rdi, .LC19[rip]
	call	system@PLT
	mov	eax, 0
.L17:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L18
	call	__stack_chk_fail@PLT
.L18:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"363869.c"
	.text
	.section	.rodata
	.align	2
.LC0:
	.ascii	"Welcome to pwnable.kr\000"
	.align	2
.LC1:
	.ascii	"Let's see if you know how to give input to program\000"
	.align	2
.LC2:
	.ascii	"Just give me correct inputs then you will get the f"
	.ascii	"lag :)\000"
	.align	2
.LC3:
	.ascii	" \012\015\000"
	.align	2
.LC4:
	.ascii	"Stage 1 clear!\000"
	.align	2
.LC5:
	.ascii	"\000\012\000\377\000"
	.align	2
.LC6:
	.ascii	"\000\012\002\377\000"
	.align	2
.LC7:
	.ascii	"Stage 2 clear!\000"
	.align	2
.LC8:
	.ascii	"\336\255\276\357\000"
	.align	2
.LC9:
	.ascii	"\312\376\272\276\000"
	.align	2
.LC10:
	.ascii	"Stage 3 clear!\000"
	.align	2
.LC11:
	.ascii	"r\000"
	.align	2
.LC12:
	.ascii	"\012\000"
	.align	2
.LC13:
	.ascii	"\000\000\000\000\000"
	.align	2
.LC14:
	.ascii	"Stage 4 clear!\000"
	.align	2
.LC15:
	.ascii	"socket error, tell admin\000"
	.align	2
.LC16:
	.ascii	"bind error, use another port\000"
	.align	2
.LC17:
	.ascii	"accept error, tell admin\000"
	.align	2
.LC18:
	.ascii	"Stage 5 clear!\000"
	.align	2
.LC19:
	.ascii	"/bin/cat flag\000"
	.align	2
.LC20:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 72
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #72
	str	r0, [fp, #-64]
	str	r1, [fp, #-68]
	str	r2, [fp, #-72]
	ldr	r3, .L19
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r0, .L19+4
	bl	puts
	ldr	r0, .L19+8
	bl	puts
	ldr	r0, .L19+12
	bl	puts
	ldr	r3, [fp, #-64]
	cmp	r3, #100
	beq	.L2
	mov	r3, #0
	b	.L17
.L2:
	ldr	r3, [fp, #-68]
	add	r3, r3, #260
	ldr	r3, [r3]
	ldrb	r3, [r3]	@ zero_extendqisi2
	cmp	r3, #0
	beq	.L4
	mov	r3, #0
	b	.L17
.L4:
	ldr	r3, [fp, #-68]
	add	r3, r3, #264
	ldr	r3, [r3]
	ldr	r1, .L19+16
	mov	r0, r3
	bl	strcmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L5
	mov	r3, #0
	b	.L17
.L5:
	ldr	r0, .L19+20
	bl	puts
	sub	r3, fp, #12
	mov	r2, #4
	mov	r1, r3
	mov	r0, #0
	bl	read
	sub	r3, fp, #12
	mov	r2, #4
	ldr	r1, .L19+24
	mov	r0, r3
	bl	memcmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L6
	mov	r3, #0
	b	.L17
.L6:
	sub	r3, fp, #12
	mov	r2, #4
	mov	r1, r3
	mov	r0, #2
	bl	read
	sub	r3, fp, #12
	mov	r2, #4
	ldr	r1, .L19+28
	mov	r0, r3
	bl	memcmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L7
	mov	r3, #0
	b	.L17
.L7:
	ldr	r0, .L19+32
	bl	puts
	ldr	r0, .L19+36
	bl	getenv
	mov	r3, r0
	mov	r1, r3
	ldr	r0, .L19+40
	bl	strcmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L8
	mov	r3, #0
	b	.L17
.L8:
	ldr	r0, .L19+44
	bl	puts
	ldr	r1, .L19+48
	ldr	r0, .L19+52
	bl	fopen
	str	r0, [fp, #-56]
	ldr	r3, [fp, #-56]
	cmp	r3, #0
	bne	.L9
	mov	r3, #0
	b	.L17
.L9:
	sub	r0, fp, #12
	ldr	r3, [fp, #-56]
	mov	r2, #1
	mov	r1, #4
	bl	fread
	mov	r3, r0
	cmp	r3, #1
	beq	.L10
	mov	r3, #0
	b	.L17
.L10:
	sub	r3, fp, #12
	mov	r2, #4
	ldr	r1, .L19+56
	mov	r0, r3
	bl	memcmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L11
	mov	r3, #0
	b	.L17
.L11:
	ldr	r0, [fp, #-56]
	bl	fclose
	ldr	r0, .L19+60
	bl	puts
	mov	r2, #0
	mov	r1, #1
	mov	r0, #2
	bl	socket
	str	r0, [fp, #-52]
	ldr	r3, [fp, #-52]
	cmn	r3, #1
	bne	.L12
	ldr	r0, .L19+64
	bl	puts
	mov	r3, #0
	b	.L17
.L12:
	mov	r3, #2
	strh	r3, [fp, #-44]	@ movhi
	mov	r3, #0
	str	r3, [fp, #-40]
	ldr	r3, [fp, #-68]
	add	r3, r3, #268
	ldr	r3, [r3]
	mov	r0, r3
	bl	atoi
	mov	r3, r0
	lsl	r3, r3, #16
	lsr	r3, r3, #16
	mov	r0, r3
	bl	htons
	mov	r3, r0
	strh	r3, [fp, #-42]	@ movhi
	sub	r3, fp, #44
	mov	r2, #16
	mov	r1, r3
	ldr	r0, [fp, #-52]
	bl	bind
	mov	r3, r0
	cmp	r3, #0
	bge	.L13
	ldr	r0, .L19+68
	bl	puts
	mov	r3, #1
	b	.L17
.L13:
	mov	r1, #1
	ldr	r0, [fp, #-52]
	bl	listen
	mov	r3, #16
	str	r3, [fp, #-60]
	sub	r2, fp, #60
	sub	r3, fp, #28
	mov	r1, r3
	ldr	r0, [fp, #-52]
	bl	accept
	str	r0, [fp, #-48]
	ldr	r3, [fp, #-48]
	cmp	r3, #0
	bge	.L14
	ldr	r0, .L19+72
	bl	puts
	mov	r3, #0
	b	.L17
.L14:
	sub	r1, fp, #12
	mov	r3, #0
	mov	r2, #4
	ldr	r0, [fp, #-48]
	bl	recv
	mov	r3, r0
	cmp	r3, #4
	beq	.L15
	mov	r3, #0
	b	.L17
.L15:
	sub	r3, fp, #12
	mov	r2, #4
	ldr	r1, .L19+36
	mov	r0, r3
	bl	memcmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L16
	mov	r3, #0
	b	.L17
.L16:
	ldr	r0, .L19+76
	bl	puts
	ldr	r0, .L19+80
	bl	system
	mov	r3, #0
.L17:
	ldr	r2, .L19
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L18
	bl	__stack_chk_fail
.L18:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L20:
	.align	2
.L19:
	.word	.LC20
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	.LC19
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
