[*] Binary protection state of ssh-keygen
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of ssh-keygen
bal sym.sshkey_fingerprint
move a1, s2
lw gp, 0x28(sp)
lw a0, 0x24(s1)
addiu a2, zero, 4
lw v1, -0x7fcc(gp)
lw t9, -sym.sshkey_fingerprint(gp)
move s2, v0
bal sym.sshkey_fingerprint
lw a1, 0x405c(v1)
move s3, v0
beqz s2, 0xe684
lw gp, 0x28(sp)
beqz v0, 0xe684
lw t9, -sym.sshkey_type(gp)
lw a0, 0x24(s1)
bal sym.sshkey_type
lw s0, (s0)
lw t0, 0x28(s1)
lb v1, (t0)
bnez v1, 0xe634
lw gp, 0x28(sp)
lw v1, -0x7fdc(gp)
addiu v1, v1, 0x5744
lw a0, -0x7fdc(gp)
lw t9, -sym.mprintf(gp)
move a3, s2
move a2, v0
move a1, s0
addiu a0, a0, -0x814
sw t0, 0x14(sp)
jalr t9
sw v1, 0x10(sp)
lw gp, 0x28(sp)
lw t9, -sym.log_level_get(gp)
jalr t9
nop
slti v0, v0, 4
beqz v0, 0xe668
lw gp, 0x28(sp)
lw t9, -sym.imp.free(gp)
jalr t9
move a0, s3
lw gp, 0x28(sp)
lw t9, -sym.imp.free(gp)
jalr t9
--
move a0, s0
lw gp, 0x20(sp)
lw a1, 0x405c(s1)
addiu a2, zero, 4
lw t9, -sym.sshkey_fingerprint(gp)
move a0, s0
bal sym.sshkey_fingerprint
move s1, v0
move s3, v0
beqz s1, 0xe808
lw gp, 0x20(sp)
beqz v0, 0xe808
lw t9, -sym.sshkey_size(gp)
bal sym.sshkey_size
move a0, s0
move s4, v0
beqz s2, 0xe7fc
lw gp, 0x20(sp)
lw t9, -sym.sshkey_type(gp)
bal sym.sshkey_type
move a0, s0
lw gp, 0x20(sp)
move a3, s2
move a2, s1
lw a0, -0x7fdc(gp)
lw t9, -sym.mprintf(gp)
move a1, s4
addiu a0, a0, -0x7f8
jalr t9
sw v0, 0x10(sp)
lw gp, 0x20(sp)
lw t9, -sym.log_level_get(gp)
jalr t9
nop
slti v0, v0, 4
beqz v0, 0xe7e8
lw gp, 0x20(sp)
lw t9, -sym.imp.free(gp)
jalr t9
move a0, s3
lw gp, 0x20(sp)
lw ra, 0x3c(sp)
lw s4, 0x38(sp)
lw s3, 0x34(sp)
lw s2, 0x30(sp)
lw s0, 0x28(sp)
--
lw gp, 0x28(sp)
b 0xeb5c
move s4, zero
lw t9, -sym.ssh_err(gp)
bal sym.ssh_err
move a0, v0
lw gp, 0x28(sp)
sw v0, 0x14(sp)
addiu v0, zero, 2
lw v1, -0x7fdc(gp)
lw a1, -0x7fdc(gp)
lw a0, -0x7fdc(gp)
lw t9, -sym.sshlog(gp)
addiu v1, v1, -0x738
sw s6, 0x1c(sp)
sw v1, 0x18(sp)
sw v0, 0x10(sp)
move a3, zero
addiu a2, zero, 0x9f2
addiu a1, a1, 0x1da8
jalr t9
addiu a0, a0, -0xe90
move s4, zero
b 0xeb5c
lw gp, 0x28(sp)
lw t9, -sym.xasprintf(gp)
move a2, s6
addiu a1, a1, -0x714
jalr t9
addiu a0, sp, 0x44
lw gp, 0x28(sp)
lw t9, -0x7f2c(gp)
addiu t9, t9, -0x170c
bal 0xe8f4
lw a0, 0x44(sp)
move s0, v0
beqz v0, 0xeb5c
lw gp, 0x28(sp)
lw t9, -sym.imp.open64(gp)
lw a0, 0x44(sp)
addiu a2, zero, 0x1b6
jalr t9
addiu a1, zero, 0x301
move s3, v0
addiu v0, zero, -1
beq s3, v0, 0xf010
--
bal sym.sshbuf_free
lw a0, 0x3c(sp)
lw gp, 0x28(sp)
lw t9, -sym.imp.close(gp)
jalr t9
move a0, s3
b 0xebd4
lw gp, 0x28(sp)
lw v0, -0x76c4(gp)
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.__fprintf_chk(gp)
lw a0, (v0)
addiu a2, a2, -0x6e0
jalr t9
addiu a1, zero, 1
lw gp, 0x28(sp)
b 0xee4c
lw a3, 0x44(sp)
lw t9, -sym.sshkey_type(gp)
bal sym.sshkey_type
move a0, s4
lw gp, 0x28(sp)
move a2, v0
addiu a0, sp, 0x48
lw a1, -0x7fdc(gp)
lw t9, -sym.xasprintf(gp)
jalr t9
addiu a1, a1, -0x78c
lw gp, 0x28(sp)
lw a0, 0x48(sp)
lw t9, -sym.read_passphrase(gp)
jalr t9
addiu a1, zero, 2
move s1, v0
beqz v0, 0xf0cc
lw gp, 0x28(sp)
b 0xec34
lbu v0, 0x38(s4)
lw v0, -0x7fdc(gp)
lw a1, -0x7fdc(gp)
lw a0, -0x7fdc(gp)
addiu v0, v0, -0x724
lw t9, -sym.sshlog(gp)
sw v0, 0x18(sp)
addiu v0, zero, 2
sw zero, 0x14(sp)
--
lw a1, -0x7fdc(gp)
lw t9, -sym.notify_complete(gp)
jalr t9
addiu a1, a1, -0x18c
bnez s0, 0x10f7c
lw gp, 0x40(sp)
lw s0, 0x7c(sp)
lw t9, -sym.imp.strrchr(gp)
addiu a1, zero, 0x2e
jalr t9
move a0, s0
beqz v0, 0x10704
lw gp, 0x40(sp)
lw a1, -0x7fdc(gp)
lw t9, -sym.imp.strcmp(gp)
addiu a1, a1, 0x790
move a0, v0
jalr t9
sw v0, 0x54(sp)
bnez v0, 0x10704
lw gp, 0x40(sp)
lw v1, 0x54(sp)
sb zero, (v1)
lw s0, 0x7c(sp)
lw a1, -0x7fdc(gp)
lw t9, -sym.xasprintf(gp)
move a2, s0
addiu a1, a1, -0x15c
jalr t9
addiu a0, sp, 0x80
lw gp, 0x40(sp)
lw t9, -sym.imp.free(gp)
jalr t9
lw a0, 0x7c(sp)
lw gp, 0x40(sp)
lw a2, 0x84(sp)
lw a1, 0x80(sp)
lw t9, -sym.sshkey_save_public(gp)
jalr t9
lw a0, 0x78(sp)
bnez v0, 0x10f14
lw gp, 0x40(sp)
lw v0, -0x7fcc(gp)
lw v0, 0x6144(v0)
beqz v0, 0x10970
lw a0, 0x78(sp)
--
jalr t9
nop
lw gp, 0x28(sp)
move s4, v0
lw t9, -sym.sshkey_load_private(gp)
move a3, s3
move a2, s2
move a1, s4
bal sym.sshkey_load_private
addiu a0, s0, 0x513c
lw gp, 0x28(sp)
move a0, s4
lw t9, -sym.imp.strlen(gp)
jalr t9
move s1, v0
lw gp, 0x28(sp)
move a1, v0
lw t9, -sym.freezero(gp)
jalr t9
move a0, s4
bnez s1, 0x129c8
lw gp, 0x28(sp)
lw a1, 0x30(sp)
beqz a1, 0x12a9c
lw a0, -0x7fdc(gp)
lw t9, -sym.mprintf(gp)
jalr t9
addiu a0, a0, 0x45c
lw gp, 0x28(sp)
lw v0, -0x7fcc(gp)
lw a0, 0x5130(v0)
beql a0, zero, 0x12ca8
lw a0, -0x7fdc(gp)
lw t9, -sym.xstrdup(gp)
jalr t9
nop
lw gp, 0x28(sp)
move s1, v0
lw v0, -0x7fcc(gp)
lw t9, -sym.sshkey_save_private(gp)
lw a3, 0x30(sp)
lw a1, 0x50f8(v0)
lw v0, -0x7fcc(gp)
lw a0, 0x34(sp)
sw a1, 0x18(sp)
lw v1, 0x50fc(v0)
--
lw s2, -0x7fcc(gp)
sw v0, 0x30(sp)
lw v0, -0x7fdc(gp)
lw s6, -0x7fdc(gp)
sw v0, 0x34(sp)
lw v0, -0x7f2c(gp)
addiu s0, sp, 0x70
addiu v0, v0, -0x2758
sw v0, 0x38(sp)
lw v0, -0x7fcc(gp)
move s4, zero
addiu v0, v0, 0x4cf4
sw v0, 0x40(sp)
lw v0, -0x7fdc(gp)
addiu fp, sp, 0x64
addiu v0, v0, 0x800
addiu s7, sp, 0xa8
b 0x1454c
sw v0, 0x44(sp)
lw v0, 0xe0(sp)
lw a0, 0xe4(sp)
or v0, v0, a0
bnez v0, 0x144e4
lw t9, -sym.sshkey_free(gp)
lw v0, 0x30(sp)
lw t9, -sym.xasprintf(gp)
move a3, s1
addiu a2, s2, 0x513c
addiu a1, v0, 0x768
jalr t9
addiu a0, sp, 0x5c
lw gp, 0x28(sp)
lw v0, 0x34(sp)
move a3, s1
lw t9, -sym.xasprintf(gp)
addiu a2, s2, 0x513c
addiu a1, v0, 0x778
jalr t9
addiu a0, sp, 0x60
lw gp, 0x28(sp)
move a3, s1
addiu a2, s2, 0x513c
lw a1, -0x7fdc(gp)
lw t9, -sym.xasprintf(gp)
addiu a1, a1, 0x78c
jalr t9
addiu a0, sp, 0x68
beqz s4, 0x1460c
lw gp, 0x28(sp)
lw a1, -0x7fdc(gp)
lw a2, (s0)
lw t9, -sym.imp.__printf_chk(gp)
addiu a1, a1, 0x7b8
jalr t9
addiu a0, zero, 1
lw gp, 0x28(sp)
addiu s5, zero, -1
lw v0, -0x7858(gp)
lw t9, -sym.imp.fflush(gp)
jalr t9
lw a0, (v0)
lw gp, 0x28(sp)
lw t9, -sym.sshkey_type_from_name(gp)
bal sym.sshkey_type_from_name
--
addiu s0, s0, 0xc
lw gp, 0x28(sp)
lw t9, -sym.sshkey_free(gp)
bal sym.sshkey_free
lw a0, 0x58(sp)
lw gp, 0x28(sp)
lw t9, -sym.imp.free(gp)
jalr t9
lw a0, 0x5c(sp)
lw gp, 0x28(sp)
lw t9, -sym.imp.free(gp)
jalr t9
lw a0, 0x60(sp)
lw gp, 0x28(sp)
lw t9, -sym.imp.free(gp)
jalr t9
lw a0, 0x64(sp)
lw gp, 0x28(sp)
lw t9, -sym.imp.free(gp)
jalr t9
lw a0, 0x68(sp)
lw s3, -4(s0)
beqz s3, 0x147a4
lw gp, 0x28(sp)
lw s1, 4(s0)
lw t9, -sym.xasprintf(gp)
move a3, s1
addiu a2, s2, 0x513c
addiu a1, s6, 0x1588
move a0, fp
sw zero, 0x54(sp)
sw zero, 0x58(sp)
sw zero, 0x68(sp)
sw zero, 0x64(sp)
sw zero, 0x60(sp)
jalr t9
sw zero, 0x5c(sp)
lw gp, 0x28(sp)
lw a1, 0x64(sp)
move a2, s7
lw t9, -sym.imp.__xstat64(gp)
jalr t9
addiu a0, zero, 3
beqz v0, 0x14294
lw gp, 0x28(sp)
lw t9, -sym.imp.__errno_location(gp)
--
move a0, s0
jalr t9
sw v0, 0x10(sp)
lw t9, 0x2c(sp)
jalr t9
move a0, s2
move s2, v0
bnez v0, 0x2fc8c
lw gp, 0x20(sp)
lw s6, 8(s1)
bnel s6, zero, 0x2fcf4
lw v0, 4(s6)
b 0x2fd80
lw s1, 0xc(s1)
lw v0, 4(s6)
bnel v0, zero, 0x2fcf0
move s6, v0
lw v0, 0x34(sp)
lui v1, 0x7fff
addiu s2, sp, 0x44
addiu s7, sp, 0x48
ori fp, v1, 0xffff
addiu s5, v0, 0x40ac
sw fp, 0x44(sp)
lw v0, (s6)
lw t9, -sym.asmprintf(gp)
move a3, s3
move a2, s2
move a1, fp
move a0, s7
bal sym.asmprintf
sw v0, 0x10(sp)
lw gp, 0x20(sp)
lw a3, 0x48(sp)
move a2, s5
lw t9, -sym.imp.__fprintf_chk(gp)
addiu a1, zero, 1
jalr t9
move a0, s0
lw gp, 0x20(sp)
lw t9, -sym.imp.free(gp)
jalr t9
lw a0, 0x48(sp)
move t9, s4
bal 0x2a9dc
move a0, s6
--
lw gp, 0x20(sp)
bnez s1, 0x2fba0
sw v0, 0x30(sp)
b 0x2fd8c
lw v0, 0x3c(sp)
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.fwrite(gp)
move a3, s0
addiu a2, zero, 0xe
addiu a1, zero, 1
jalr t9
addiu a0, a0, 0x4068
b 0x2fc20
lw gp, 0x20(sp)
lw v0, 0x34(sp)
lw t9, -sym.sshlog(gp)
sw v0, 0x18(sp)
addiu v0, zero, 2
sw zero, 0x14(sp)
sw v0, 0x10(sp)
move a3, zero
b 0x2fa28
addiu a2, zero, 0x56c
lui v1, 0x7fff
ori v1, v1, 0xffff
lw t9, -sym.asmprintf(gp)
move a1, v1
sw v1, 0x44(sp)
addiu a3, a3, -0x964
addiu a2, sp, 0x44
addiu a0, sp, 0x48
bal sym.asmprintf
sw v0, 0x10(sp)
lw gp, 0x20(sp)
lw a3, 0x48(sp)
addiu a1, zero, 1
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.__fprintf_chk(gp)
addiu a2, a2, 0x400c
jalr t9
move a0, s0
lw gp, 0x20(sp)
lw t9, -sym.imp.free(gp)
jalr t9
lw a0, 0x48(sp)
lw gp, 0x20(sp)
--
move v0, s2
lw ra, 0x434(sp)
lw s2, 0x430(sp)
lw s1, 0x42c(sp)
lw s0, 0x428(sp)
jr ra
addiu sp, sp, 0x438
beq v0, v1, 0x3ae58
lw a1, -0x7fdc(gp)
lw t9, -sym.imp.strcasecmp(gp)
addiu a1, a1, 0x5374
jalr t9
move a0, s0
sltiu s2, v0, 1
b 0x3ae5c
lw gp, 0x18(sp)
b 0x3ae6c
move s2, zero
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
lui gp, 6
addiu gp, gp, 0x11d4
addu gp, gp, t9
addiu sp, sp, -0x58
lw t9, -sym.xvasprintf(gp)
sw s1, 0x44(sp)
lw s1, -0x773c(gp)
sw gp, 0x28(sp)
sw ra, 0x54(sp)
sw s0, 0x40(sp)
sw s4, 0x50(sp)
sw s3, 0x4c(sp)
sw s2, 0x48(sp)
lw v1, (s1)
addiu v0, sp, 0x60
sw a2, 0x60(sp)
sw a3, 0x64(sp)
move a2, v0
sw v1, 0x3c(sp)
move s0, a0
sw v0, 0x34(sp)
sw zero, 0x38(sp)
bal sym.xvasprintf
addiu a0, sp, 0x38
lw gp, 0x28(sp)
--
sw v0, 0x10(sp)
b 0x3b274
addiu a2, zero, 0x122
lui gp, 6
addiu gp, gp, 0xd48
addu gp, gp, t9
addiu sp, sp, -0x50
sw s3, 0x48(sp)
lw s3, -0x773c(gp)
sw s0, 0x3c(sp)
sw gp, 0x20(sp)
sw ra, 0x4c(sp)
sw s2, 0x44(sp)
sw s1, 0x40(sp)
lw v0, (s3)
move s0, a0
sw a2, 0x58(sp)
sw a3, 0x5c(sp)
sw v0, 0x34(sp)
beqz a0, 0x3b41c
sw zero, 0x2c(sp)
beqz a1, 0x3b3b4
lw a0, (a0)
addiu v0, zero, -1
beq a0, v0, 0x3b454
lw t9, -sym.xvasprintf(gp)
blez a0, 0x3b41c
lw t9, -sym.imp.kill(gp)
jalr t9
addiu a1, zero, 0xf
addiu s1, zero, -1
lw gp, 0x20(sp)
b 0x3b3ec
addiu s2, zero, 4
lw t9, -sym.imp.__errno_location(gp)
jalr t9
nop
lw a0, (v0)
bne a0, s2, 0x3b4a4
lw gp, 0x20(sp)
lw t9, -sym.imp.waitpid(gp)
lw a0, (s0)
move a2, zero
jalr t9
move a1, zero
beq v0, s1, 0x3b3d4
--
addiu sp, sp, 0x30
lw v0, -0x7fdc(gp)
lw a1, -0x7fdc(gp)
addiu v0, v0, 0x5550
lw a0, -0x7fdc(gp)
sw v0, 0x18(sp)
lw t9, -sym.sshfatal(gp)
addiu v0, zero, 1
sw zero, 0x14(sp)
sw v0, 0x10(sp)
move a3, zero
addiu a2, zero, 0x69
addiu a1, a1, 0x5580
bal sym.sshfatal
addiu a0, a0, 0x5420
lui gp, 6
addiu gp, gp, 0x7d4
addu gp, gp, t9
addiu sp, sp, -0x28
addiu v0, sp, 0x30
sw s0, 0x20(sp)
lw s0, -0x773c(gp)
sw gp, 0x10(sp)
sw ra, 0x24(sp)
lw v1, (s0)
lw t9, -sym.xvasprintf(gp)
sw a2, 0x30(sp)
sw v1, 0x1c(sp)
sw a3, 0x34(sp)
sw v0, 0x18(sp)
bal sym.xvasprintf
move a2, v0
lw a0, 0x1c(sp)
lw v1, (s0)
bne a0, v1, 0x3b930
lw gp, 0x10(sp)
lw ra, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x28
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
nop
lui gp, 6
addiu gp, gp, 0x760
--
lw t9, -sym.imp.strlen(gp)
jalr t9
move a0, s3
bnez v0, 0x3eff0
lw gp, 0x20(sp)
lw a3, -0x7fdc(gp)
addiu a3, a3, 0x5678
b 0x3ef64
addiu s0, s1, 1
lw t9, -sym.imp.getpwuid(gp)
jalr t9
move a0, s3
beqz v0, 0x3f058
lw gp, 0x20(sp)
lw s3, 0x14(v0)
lw t9, -sym.imp.strlen(gp)
jalr t9
move a0, s3
bnez v0, 0x3efd0
lw gp, 0x20(sp)
lw a3, -0x7fdc(gp)
addiu a3, a3, 0x5678
bnel s1, zero, 0x3ef64
addiu s0, s1, 1
lw a1, -0x7fdc(gp)
lw t9, -sym.xasprintf(gp)
sw s0, 0x10(sp)
move a2, s3
addiu a1, a1, 0x5c2c
bal sym.xasprintf
addiu a0, sp, 0x28
slti v0, v0, 0x1000
beqz v0, 0x3f020
lw gp, 0x20(sp)
lw v0, 0x28(sp)
lw a0, 0xac(sp)
lw v1, (s2)
bne a0, v1, 0x3f014
lw ra, 0xc4(sp)
lw s4, 0xc0(sp)
lw s3, 0xbc(sp)
lw s2, 0xb8(sp)
lw s1, 0xb4(sp)
lw s0, 0xb0(sp)
jr ra
addiu sp, sp, 0xc8
--
jr ra
addiu sp, sp, 0x48
lw a0, -0x7fdc(gp)
lw t9, -sym.xstrdup(gp)
bal sym.xstrdup
addiu a0, a0, 0x5c94
move s4, v0
b 0x3f598
lw gp, 0x18(sp)
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
lui gp, 6
addiu gp, gp, -0x3558
addu gp, gp, t9
addiu sp, sp, -0x40
move v1, a2
sw s1, 0x34(sp)
lw s1, -0x773c(gp)
sw gp, 0x18(sp)
sw s2, 0x38(sp)
sw s0, 0x30(sp)
sw ra, 0x3c(sp)
lw v0, (s1)
addiu a2, sp, 0x4c
lw t9, -sym.xvasprintf(gp)
move s0, a0
sw a2, 0x20(sp)
move s2, a1
sw a3, 0x4c(sp)
move a1, v1
addiu a0, sp, 0x24
sw v0, 0x2c(sp)
bal sym.xvasprintf
nop
lw a2, (s0)
beqz a2, 0x3f6e4
lw gp, 0x18(sp)
lb v0, (a2)
beqz v0, 0x3f6e8
lw t9, -sym.imp.free(gp)
beql s2, zero, 0x3f700
lw s2, -0x7fdc(gp)
lw a1, -0x7fdc(gp)
lw v0, 0x24(sp)
lw t9, -sym.xasprintf(gp)
move a3, s2
addiu a1, a1, 0x5c2c
addiu a0, sp, 0x28
bal sym.xasprintf
sw v0, 0x10(sp)
lw gp, 0x18(sp)
lw t9, -sym.imp.free(gp)
jalr t9
lw a0, 0x24(sp)
lw gp, 0x18(sp)
lw t9, -sym.imp.free(gp)
jalr t9
lw a0, (s0)
lw v0, 0x28(sp)
lw gp, 0x18(sp)
sw v0, (s0)
lw v1, 0x2c(sp)
lw v0, (s1)
bne v1, v0, 0x3f708
lw ra, 0x3c(sp)
--
lw a0, -0x7fdc(gp)
sw gp, 0x20(sp)
sw s0, 0x2c(sp)
sw ra, 0x34(sp)
addiu a0, a0, 0x5cd0
jalr t9
move s0, a1
beqz v0, 0x405c8
lw gp, 0x20(sp)
sw v0, 0x14(sp)
lw v0, -0x7fdc(gp)
lw t9, -sym.imp.__snprintf_chk(gp)
addiu v0, v0, 0x5cf0
sw v0, 0x10(sp)
addiu a3, zero, -1
addiu a2, zero, 1
move a1, s0
jalr t9
move a0, s1
blez v0, 0x405c8
lw gp, 0x20(sp)
sltu v0, v0, s0
bnez v0, 0x405f0
lw ra, 0x34(sp)
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.snprintf(gp)
move a1, s0
addiu a2, a2, 0x5cd8
move a0, s1
jalr t9
sltiu s0, s0, 0x16
bnez s0, 0x40600
lw gp, 0x20(sp)
lw ra, 0x34(sp)
lw s1, 0x30(sp)
lw s0, 0x2c(sp)
jr ra
addiu sp, sp, 0x38
lw v0, -0x7fdc(gp)
lw a1, -0x7fdc(gp)
addiu v0, v0, 0x5d04
lw a0, -0x7fdc(gp)
sw v0, 0x18(sp)
lw t9, -sym.sshfatal(gp)
addiu v0, zero, 1
sw zero, 0x14(sp)
--
beqz s3, 0x41964
lw t9, -sym.imp.strcmp(gp)
move a1, s0
jalr t9
addiu a0, sp, 0x10cc
beqz v0, 0x419c4
lw gp, 0x20(sp)
lw t9, -sym.imp.strcmp(gp)
move a1, s0
jalr t9
move a0, s1
beqz v0, 0x419c4
lw gp, 0x20(sp)
lw t9, -sym.imp.strcmp(gp)
move a1, s0
jalr t9
move a0, s2
beqz v0, 0x419c4
lw gp, 0x20(sp)
lw t9, -sym.imp.dirname(gp)
jalr t9
move a0, s0
bnez v0, 0x418dc
lw gp, 0x20(sp)
lw a2, -0x7fdc(gp)
lw t9, -sym.imp.snprintf(gp)
lw a1, 0x210c(sp)
addiu a2, a2, 0x5ed4
jalr t9
move a0, s6
lw gp, 0x20(sp)
addiu v0, zero, -1
lw a0, 0x20cc(sp)
lw v1, (s5)
bne a0, v1, 0x41ac0
lw ra, 0x20f4(sp)
lw s7, 0x20f0(sp)
lw s6, 0x20ec(sp)
lw s5, 0x20e8(sp)
lw s4, 0x20e4(sp)
lw s3, 0x20e0(sp)
lw s2, 0x20dc(sp)
lw s1, 0x20d8(sp)
lw s0, 0x20d4(sp)
jr ra
addiu sp, sp, 0x20f8
--
sb zero, (s4)
lw v0, 0x30(sp)
sw s5, (v0)
lw v0, 0x1c(sp)
beqz v0, 0x44328
lw v1, 0x18(sp)
sw v1, (v0)
b 0x4404c
addiu s1, zero, -1
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
lui gp, 5
addiu gp, gp, 0x7d64
addu gp, gp, t9
addiu sp, sp, -0x48
addiu v0, sp, 0x58
sw s0, 0x34(sp)
lw s0, -0x773c(gp)
sw gp, 0x18(sp)
sw s3, 0x40(sp)
sw s2, 0x3c(sp)
sw s1, 0x38(sp)
sw ra, 0x44(sp)
lw v1, (s0)
lw t9, -sym.vasnmprintf(gp)
move s2, a0
sw v0, 0x10(sp)
addiu a0, sp, 0x28
sw v1, 0x2c(sp)
sw zero, 0x28(sp)
sw v0, 0x24(sp)
bal sym.vasnmprintf
move s3, a1
lw a1, 0x28(sp)
lw gp, 0x18(sp)
beqz a1, 0x443f4
move s1, v0
lw t9, -sym.strlcpy(gp)
move a2, s3
bal sym.strlcpy
move a0, s2
lw gp, 0x18(sp)
lw t9, -sym.imp.free(gp)
jalr t9
lw a0, 0x28(sp)
--
lw v1, (s0)
bne a0, v1, 0x443fc
move v0, s1
lw ra, 0x44(sp)
lw s3, 0x40(sp)
lw s2, 0x3c(sp)
lw s1, 0x38(sp)
lw s0, 0x34(sp)
jr ra
addiu sp, sp, 0x48
b 0x443c8
sb zero, (s2)
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
lui gp, 5
addiu gp, gp, 0x7c98
addu gp, gp, t9
addiu sp, sp, -0x30
addiu v0, sp, 0x40
sw s0, 0x28(sp)
lw s0, -0x773c(gp)
sw gp, 0x18(sp)
sw ra, 0x2c(sp)
lw v1, (s0)
lw t9, -sym.vasnmprintf(gp)
sw v0, 0x10(sp)
sw v1, 0x24(sp)
sw zero, (a0)
bal sym.vasnmprintf
sw v0, 0x20(sp)
lw a0, 0x24(sp)
lw v1, (s0)
bne a0, v1, 0x44468
lw gp, 0x18(sp)
lw ra, 0x2c(sp)
lw s0, 0x28(sp)
jr ra
addiu sp, sp, 0x30
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
lui gp, 5
addiu gp, gp, 0x7c2c
addu gp, gp, t9
addiu sp, sp, -0x38
move a3, a1
sw s1, 0x2c(sp)
lw s1, -0x773c(gp)
sw gp, 0x18(sp)
sw s2, 0x30(sp)
sw ra, 0x34(sp)
sw s0, 0x28(sp)
lw v0, (s1)
lw t9, -sym.vasnmprintf(gp)
lui a1, 0x7fff
sw a2, 0x10(sp)
move s2, a0
move a2, zero
ori a1, a1, 0xffff
addiu a0, sp, 0x20
sw v0, 0x24(sp)
sw zero, 0x20(sp)
bal sym.vasnmprintf
nop
bltz v0, 0x44534
lw gp, 0x18(sp)
lw t9, -sym.imp.fputs(gp)
lw a0, 0x20(sp)
move a1, s2
jalr t9
move s0, v0
lw gp, 0x18(sp)
lw a0, 0x20(sp)
nor v0, zero, v0
--
lw ra, 0x34(sp)
lw s2, 0x30(sp)
lw s1, 0x2c(sp)
lw s0, 0x28(sp)
jr ra
addiu sp, sp, 0x38
lw t9, -sym.imp.free(gp)
lw a0, 0x20(sp)
jalr t9
addiu s0, zero, -1
b 0x4450c
lw gp, 0x18(sp)
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
lui gp, 5
addiu gp, gp, 0x7b48
addu gp, gp, t9
addiu sp, sp, -0x28
addiu v0, sp, 0x30
sw s0, 0x20(sp)
lw s0, -0x773c(gp)
sw gp, 0x10(sp)
sw ra, 0x24(sp)
lw v1, (s0)
lw t9, -sym.vfmprintf(gp)
sw a2, 0x30(sp)
sw v1, 0x1c(sp)
sw a3, 0x34(sp)
sw v0, 0x18(sp)
bal sym.vfmprintf
move a2, v0
lw a0, 0x1c(sp)
lw v1, (s0)
bne a0, v1, 0x445bc
lw gp, 0x10(sp)
lw ra, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x28
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
lui gp, 5
addiu gp, gp, 0x7ad8
addu gp, gp, t9
addiu sp, sp, -0x28
addiu v0, sp, 0x2c
sw s0, 0x20(sp)
lw s0, -0x773c(gp)
sw a1, 0x2c(sp)
move a1, a0
lw a0, -0x7858(gp)
sw gp, 0x10(sp)
sw ra, 0x24(sp)
lw v1, (s0)
lw a0, (a0)
lw t9, -sym.vfmprintf(gp)
sw a2, 0x30(sp)
sw v1, 0x1c(sp)
sw a3, 0x34(sp)
sw v0, 0x18(sp)
bal sym.vfmprintf
move a2, v0
lw a0, 0x1c(sp)
lw v1, (s0)
bne a0, v1, 0x4463c
lw gp, 0x10(sp)
lw ra, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x28
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
lui gp, 5
addiu gp, gp, 0x7a58
addu gp, gp, t9
[*] Function printf used 30 times ssh-keygen
