[*] Binary protection state of sshd

  
  	Full RELRO     Canary found      NX enabled   PIE enabled  No RPATH     No RUNPATH   No Symbols


[*] Function popen tear down of sshd

    ; assembly                               | /* r2dec pseudo code output */
                                             | /* /logs/firmware/unblob_extracted/firmware_extract/4325012-58052244.squashfs_v4_le_extract/usr/sbin/sshd @ 0x2ac74 */
                                             | #include <stdint.h>
                                             |  
    ; (fcn) sym.do_child ()                  | void do_child () {
    0x0002ac74 lui gp, 0xd                   |     
    0x0002ac78 addiu gp, gp, 0x767c          |     
    0x0002ac7c addu gp, gp, t9               |     gp += t9;
    0x0002ac80 addiu sp, sp, -0x740          |     
    0x0002ac84 lw v0, -0x6fc4(gp)            |     v0 = *((gp - 7153));
    0x0002ac88 sw ra, 0x73c(sp)              |     *(var_73ch) = ra;
    0x0002ac8c sw gp, 0x28(sp)               |     *(var_28h) = gp;
    0x0002ac90 sw s7, 0x734(sp)              |     *(var_734h) = s7;
    0x0002ac94 sw s4, 0x728(sp)              |     *(var_728h) = s4;
    0x0002ac98 sw s0, 0x718(sp)              |     *(var_718h) = s0;
    0x0002ac9c sw fp, 0x738(sp)              |     *(var_738h) = fp;
    0x0002aca0 sw s6, 0x730(sp)              |     *(var_730h) = s6;
    0x0002aca4 sw s5, 0x72c(sp)              |     *(var_72ch) = s5;
    0x0002aca8 sw s3, 0x724(sp)              |     *(var_724h) = s3;
    0x0002acac sw s2, 0x720(sp)              |     *(var_720h) = s2;
    0x0002acb0 sw s1, 0x71c(sp)              |     *(var_71ch) = s1;
    0x0002acb4 move s0, a1                   |     s0 = a1;
    0x0002acb8 lw v0, (v0)                   |     v0 = *(v0);
    0x0002acbc addiu v1, sp, 0x114           |     v1 = sp + aav.0x00000114;
    0x0002acc0 sw v0, 0x714(sp)              |     *(var_714h) = v0;
    0x0002acc4 lw v0, 0xc(s0)                |     v0 = *((s0 + 3));
    0x0002acc8 lw t9, -0x7b54(gp)            |     t9 = sym.sshpkt_fmt_connection_id;
    0x0002accc sw v0, 0x30(sp)               |     *(var_30h) = v0;
    0x0002acd0 sw v1, 0x50(sp)               |     *(var_50h) = v1;
    0x0002acd4 move a1, v1                   |     a1 = v1;
    0x0002acd8 sw a2, 0x38(sp)               |     *(var_38h) = a2;
    0x0002acdc addiu a2, zero, 0x200         |     a2 = segment.REGINFO;
    0x0002ace0 move s4, a0                   |     s4 = a0;
    0x0002ace4 jalr t9                       |     t9 ();
    0x0002ace8 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002acec lw t9, -0x7974(gp)            |     t9 = *(gp);
    0x0002acf0 bal 0x13f40                   |     sym_destroy_sensitive_data ();
    0x0002acf4 nop                           |     
    0x0002acf8 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002acfc lw t9, -0x7d0c(gp)            |     t9 = sym.ssh_packet_clear_keys;
    0x0002ad00 move a0, s4                   |     a0 = s4;
    0x0002ad04 jalr t9                       |     t9 ();
    0x0002ad08 lw v0, 0x10(s0)               |     v0 = *((s0 + 4));
    0x0002ad0c lw s7, 0x1c(v0)               |     s7 = *((v0 + 7));
    0x0002ad10 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (s7 != 0) {
    0x0002ad14 bnez s7, 0x2b6e4              |         goto label_31;
                                             |     }
    0x0002ad18 lw s3, -0x7fd8(gp)            |     s3 = *(gp);
    0x0002ad1c lw v0, 0x1180(s3)             |     v0 = *((s3 + 1120));
    0x0002ad20 lw v0, 0x30(sp)               |     v0 = *(var_30h);
                                             |     if (v0 == 0) {
    0x0002ad24 beqz v0, 0x2b4f8              |         goto label_32;
                                             |     }
                                             | label_4:
    0x0002ad28 lw t9, -0x7d04(gp)            |     t9 = sym.do_setusercontext;
                                             | label_3:
    0x0002ad2c lw a0, 0x30(sp)               |     a0 = *(var_30h);
    0x0002ad30 bal 0x2a8e4                   |     sym_do_setusercontext ();
    0x0002ad34 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002ad38 lw a1, 0x38(sp)               |     a1 = *(var_38h);
    0x0002ad3c lw t9, -0x7970(gp)            |     t9 = sym.check_quietlogin;
    0x0002ad40 move a0, s0                   |     a0 = s0;
    0x0002ad44 bal 0x2a828                   |     sym_check_quietlogin ();
    0x0002ad48 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == 0) {
    0x0002ad4c beqz v0, 0x2b65c              |         goto label_33;
                                             |     }
                                             | label_6:
    0x0002ad50 lw v0, 0x30(sp)               |     v0 = *(var_30h);
    0x0002ad54 lw v0, 0x18(v0)               |     v0 = *((v0 + 6));
    0x0002ad58 sw v0, 0x3c(sp)               |     *(var_3ch) = v0;
    0x0002ad5c lb v0, (v0)                   |     v0 = *(v0);
    0x0002ad60 lw v0, -0x7f34(gp)            |     v0 = *(gp);
                                             |     if (v0 == 0) {
    0x0002ad64 beqz v0, 0x2b4cc              |         goto label_34;
                                             |     }
                                             | label_2:
    0x0002ad68 lw v0, 0xc(s0)                |     v0 = *((s0 + 3));
    0x0002ad6c lw t9, -0x7f18(gp)            |     t9 = sym.xcalloc;
    0x0002ad70 sw v0, 0x40(sp)               |     *(var_40h) = v0;
    0x0002ad74 addiu v0, zero, 0x64          |     v0 = 0x64;
    0x0002ad78 addiu a1, zero, 4             |     a1 = 4;
    0x0002ad7c addiu a0, zero, 0x64          |     a0 = 0x64;
    0x0002ad80 sw v0, 0x60(sp)               |     *(var_60h) = v0;
    0x0002ad84 jalr t9                       |     t9 ();
    0x0002ad88 sw v0, 0x64(sp)               |     *(var_64h) = v0;
    0x0002ad8c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002ad90 sw zero, (v0)                 |     *(v0) = 0;
    0x0002ad94 lw v0, 0xa8(s0)               |     v0 = *((s0 + 42));
    0x0002ad98 move s5, zero                 |     s5 = 0;
                                             |     if (v0 == 0) {
    0x0002ad9c beqz v0, 0x2bd9c              |         goto label_35;
                                             |     }
    0x0002ada0 addiu s2, sp, 0x60            |     s2 = sp + 0x60;
    0x0002ada4 addiu s1, sp, 0x64            |     s1 = sp + 0x64;
                                             |     do {
    0x0002ada8 lw v0, 0xac(s0)               |         v0 = *((s0 + 43));
    0x0002adac sll v1, s5, 3                 |         v1 = s5 << 3;
    0x0002adb0 addu v0, v0, v1               |         v0 += v1;
    0x0002adb4 lw t9, -0x796c(gp)            |         t9 = *(gp);
    0x0002adb8 lw a3, 4(v0)                  |         a3 = *((v0 + 1));
    0x0002adbc lw a2, (v0)                   |         a2 = *(v0);
    0x0002adc0 move a1, s2                   |         a1 = s2;
    0x0002adc4 move a0, s1                   |         a0 = s1;
    0x0002adc8 jalr t9                       |         t9 ();
    0x0002adcc lw v0, 0xa8(s0)               |         v0 = *((s0 + 42));
    0x0002add0 addiu s5, s5, 1               |         s5++;
    0x0002add4 sltu v0, s5, v0               |         v0 = (s5 < v0) ? 1 : 0;
    0x0002add8 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002addc bnez v0, 0x2ada8              |         
                                             |     } while (v0 != 0);
                                             | label_25:
    0x0002ade0 lw s5, 0x40(sp)               |     s5 = *(var_40h);
    0x0002ade4 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002ade8 lw t9, -0x796c(gp)            |     t9 = *(gp);
    0x0002adec lw a3, (s5)                   |     a3 = *(s5);
                                             |     /* str.USER */
    0x0002adf0 addiu a2, a2, -0x3160         |     a2 += -0x3160;
    0x0002adf4 move a1, s2                   |     a1 = s2;
    0x0002adf8 move a0, s1                   |     a0 = s1;
    0x0002adfc jalr t9                       |     t9 ();
    0x0002ae00 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002ae04 lw a3, (s5)                   |     a3 = *(s5);
    0x0002ae08 move a1, s2                   |     a1 = s2;
    0x0002ae0c lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002ae10 lw t9, -0x796c(gp)            |     t9 = *(gp);
                                             |     /* str.LOGNAME */
    0x0002ae14 addiu a2, a2, -0x3158         |     a2 += -0x3158;
    0x0002ae18 move a0, s1                   |     a0 = s1;
    0x0002ae1c jalr t9                       |     t9 ();
    0x0002ae20 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002ae24 lw a3, 0x14(s5)               |     a3 = *((s5 + 5));
    0x0002ae28 move a1, s2                   |     a1 = s2;
    0x0002ae2c lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002ae30 lw t9, -0x796c(gp)            |     t9 = *(gp);
                                             |     /* str.HOME */
    0x0002ae34 addiu a2, a2, -0x3150         |     a2 += -aav.0x00003150;
    0x0002ae38 move a0, s1                   |     a0 = s1;
    0x0002ae3c jalr t9                       |     t9 ();
    0x0002ae40 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002ae44 move a1, s2                   |     a1 = s2;
    0x0002ae48 move a0, s1                   |     a0 = s1;
    0x0002ae4c lw a3, -0x7f34(gp)            |     a3 = *(gp);
    0x0002ae50 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002ae54 lw t9, -0x796c(gp)            |     t9 = *(gp);
                                             |     /* str._usr_bin:_bin:_usr_sbin:_sbin */
    0x0002ae58 addiu a3, a3, -0x3148         |     a3 += -0x3148;
                                             |     /* str.PATH */
    0x0002ae5c addiu a2, a2, -0x3128         |     a2 += -0x3128;
    0x0002ae60 jalr t9                       |     t9 ();
    0x0002ae64 lw v0, 0x1180(s3)             |     v0 = *((s3 + 1120));
    0x0002ae68 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == 0) {
    0x0002ae6c beqz v0, 0x2b5f4              |         goto label_36;
                                             |     }
                                             | label_5:
    0x0002ae70 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002ae74 lw t9, -0x796c(gp)            |     t9 = *(gp);
    0x0002ae78 lw a3, 0x3c(sp)               |     a3 = *(var_3ch);
                                             |     /* str.SHELL */
    0x0002ae7c addiu a2, a2, -0x30fc         |     a2 += -0x30fc;
    0x0002ae80 move a1, s2                   |     a1 = s2;
    0x0002ae84 lw s5, -0x7f34(gp)            |     s5 = *(gp);
    0x0002ae88 move a0, s1                   |     a0 = s1;
    0x0002ae8c jalr t9                       |     t9 ();
    0x0002ae90 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002ae94 lw t9, -0x6d50(gp)            |     t9 = sym.imp.getenv;
                                             |     /* esilref: 'TZ' */
    0x0002ae98 addiu a0, s5, -0x30f4         |     a0 = s5 + -0x30f4;
    0x0002ae9c jalr t9                       |     t9 ();
    0x0002aea0 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 != 0) {
    0x0002aea4 beqz v0, 0x2aed4              |         
    0x0002aea8 lw t9, -0x6d50(gp)            |         t9 = sym.imp.getenv;
                                             |         /* esilref: 'TZ' */
    0x0002aeac addiu a0, s5, -0x30f4         |         a0 = s5 + -0x30f4;
    0x0002aeb0 jalr t9                       |         t9 ();
    0x0002aeb4 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002aeb8 move a3, v0                   |         a3 = v0;
                                             |         /* esilref: 'TZ' */
    0x0002aebc addiu a2, s5, -0x30f4         |         a2 = s5 + -0x30f4;
    0x0002aec0 lw t9, -0x796c(gp)            |         t9 = *(gp);
    0x0002aec4 move a1, s2                   |         a1 = s2;
    0x0002aec8 move a0, s1                   |         a0 = s1;
    0x0002aecc jalr t9                       |         t9 ();
    0x0002aed0 lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |     }
    0x0002aed4 lw a3, 0x1c(s0)               |     a3 = *((s0 + 7));
    0x0002aed8 lw a2, -0x7f34(gp)            |     a2 = *(gp);
                                             |     if (a3 != 0) {
    0x0002aedc beqz a3, 0x2aef8              |         
    0x0002aee0 lw t9, -0x796c(gp)            |         t9 = *(gp);
                                             |         /* str.TERM */
    0x0002aee4 addiu a2, a2, -0x30f0         |         a2 += -0x30f0;
    0x0002aee8 move a1, s2                   |         a1 = s2;
    0x0002aeec move a0, s1                   |         a0 = s1;
    0x0002aef0 jalr t9                       |         t9 ();
    0x0002aef4 lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |     }
    0x0002aef8 lw a3, 0x80(s0)               |     a3 = *((s0 + 32));
    0x0002aefc lw a2, -0x7f34(gp)            |     a2 = *(gp);
                                             |     if (a3 != 0) {
    0x0002af00 beqz a3, 0x2af1c              |         
    0x0002af04 lw t9, -0x796c(gp)            |         t9 = *(gp);
                                             |         /* str.DISPLAY */
    0x0002af08 addiu a2, a2, -0x30e8         |         a2 += -0x30e8;
    0x0002af0c move a1, s2                   |         a1 = s2;
    0x0002af10 move a0, s1                   |         a0 = s1;
    0x0002af14 jalr t9                       |         t9 ();
    0x0002af18 lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |     }
    0x0002af1c lw s5, -0x7fb4(gp)            |     s5 = *(gp);
    0x0002af20 lw t9, -0x6d50(gp)            |     t9 = sym.imp.getenv;
                                             |     /* str.KRB5CCNAME */
    0x0002af24 addiu a0, s5, 0x6a4c          |     a0 = s5 + 0x6a4c;
    0x0002af28 jalr t9                       |     t9 ();
    0x0002af2c lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 != 0) {
    0x0002af30 beqz v0, 0x2af50              |         
    0x0002af34 lw t9, -0x796c(gp)            |         t9 = *(gp);
    0x0002af38 move a3, v0                   |         a3 = v0;
                                             |         /* str.KRB5CCNAME */
    0x0002af3c addiu a2, s5, 0x6a4c          |         a2 = s5 + 0x6a4c;
    0x0002af40 move a1, s2                   |         a1 = s2;
    0x0002af44 move a0, s1                   |         a0 = s1;
    0x0002af48 jalr t9                       |         t9 ();
    0x0002af4c lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |     }
    0x0002af50 lw v0, -0x7fdc(gp)            |     v0 = *((gp - 8183));
    0x0002af54 lw a3, -0x4380(v0)            |     a3 = *((v0 - 4320));
    0x0002af58 lw a2, -0x7fb4(gp)            |     a2 = *(gp);
                                             |     if (a3 != 0) {
    0x0002af5c beqz a3, 0x2af78              |         
    0x0002af60 lw t9, -0x796c(gp)            |         t9 = *(gp);
                                             |         /* str.SSH_AUTH_SOCK */
    0x0002af64 addiu a2, a2, 0x6bec          |         a2 += 0x6bec;
    0x0002af68 move a1, s2                   |         a1 = s2;
    0x0002af6c move a0, s1                   |         a0 = s1;
    0x0002af70 jalr t9                       |         t9 ();
    0x0002af74 lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |     }
    0x0002af78 lw v0, 0x4f4(s3)              |     v0 = *((s3 + 317));
                                             |     if (v0 == 0) {
    0x0002af7c beql v0, zero, 0x2b070        |         goto label_37;
                                             |     }
    0x0002af80 lw v0, 0x113c(s3)             |     v0 = *((s3 + 1103));
    0x0002af84 lw v0, -0x7d7c(gp)            |     v0 = *(gp);
    0x0002af88 sw v0, 0x34(sp)               |     *(var_34h) = v0;
    0x0002af8c lw v1, (v0)                   |     v1 = *(v0);
    0x0002af90 lw v0, 0x30(v1)               |     v0 = *((v1 + 12));
    0x0002af94 move s6, zero                 |     s6 = 0;
                                             |     if (v0 != 0) {
    0x0002af98 bnez v0, 0x2afe4              |         goto label_38;
                                             |     }
    0x0002af9c lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002afa0 b 0x2b7b8                     |     goto label_39;
                                             | label_0:
    0x0002afa4 move a2, zero                 |     a2 = 0;
    0x0002afa8 move a0, s5                   |     a0 = s5;
    0x0002afac jalr t9                       |     t9 ();
    0x0002afb0 addiu v1, zero, 1             |     v1 = 1;
    0x0002afb4 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == v1) {
    0x0002afb8 beq v0, v1, 0x2b02c           |         goto label_40;
                                             |     }
                                             |     do {
                                             | label_1:
    0x0002afbc lw t9, -0x6e6c(gp)            |         t9 = sym.imp.free;
    0x0002afc0 move a0, s5                   |         a0 = s5;
    0x0002afc4 jalr t9                       |         t9 ();
    0x0002afc8 lw v0, 0x34(sp)               |         v0 = *(var_34h);
    0x0002afcc addiu s6, s6, 1               |         s6++;
    0x0002afd0 lw v1, (v0)                   |         v1 = *(v0);
    0x0002afd4 lw v0, 0x30(v1)               |         v0 = *((v1 + 12));
    0x0002afd8 sltu v0, s6, v0               |         v0 = (s6 < v0) ? 1 : 0;
    0x0002afdc lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |         if (v0 == 0) {
    0x0002afe0 beqz v0, 0x2b7ac              |             goto label_41;
                                             |         }
                                             | label_38:
    0x0002afe4 lw v0, 0x34(v1)               |         v0 = *((v1 + 13));
    0x0002afe8 sll a0, s6, 2                 |         a0 = s6 << 2;
    0x0002afec lw t9, -0x7ef4(gp)            |         t9 = sym.xstrdup;
    0x0002aff0 lwx a0, a0(v0)                |         __asm ("lwx a0, a0(v0)");
    0x0002aff4 jalr t9                       |         t9 ();
    0x0002aff8 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002affc addiu a1, zero, 0x3d          |         a1 = 0x3d;
    0x0002b000 move a0, v0                   |         a0 = v0;
    0x0002b004 lw t9, -0x6d4c(gp)            |         t9 = sym.imp.strchr;
    0x0002b008 move s5, v0                   |         s5 = v0;
    0x0002b00c jalr t9                       |         t9 ();
    0x0002b010 move fp, v0                   |         fp = v0;
    0x0002b014 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b018 beqz v0, 0x2afbc              |         
                                             |     } while (v0 == 0);
    0x0002b01c sb zero, (v0)                 |     *(v0) = 0;
    0x0002b020 lw a1, 0x4f8(s3)              |     a1 = *(s3);
    0x0002b024 lw t9, -0x7f38(gp)            |     t9 = sym.match_pattern_list;
                                             |     if (a1 != 0) {
    0x0002b028 bnez a1, 0x2afa4              |         goto label_0;
                                             |     }
                                             | label_40:
    0x0002b02c lw t9, -0x796c(gp)            |     t9 = *(gp);
    0x0002b030 addiu a3, fp, 1               |     a3 = fp + 1;
    0x0002b034 move a2, s5                   |     a2 = s5;
    0x0002b038 move a1, s2                   |     a1 = s2;
    0x0002b03c move a0, s1                   |     a0 = s1;
    0x0002b040 jalr t9                       |     t9 ();
    0x0002b044 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b048 b 0x2afbc                     |     goto label_1;
                                             | label_11:
    0x0002b04c lw t9, -0x6e6c(gp)            |     t9 = sym.imp.free;
    0x0002b050 lw a0, 0x68(sp)               |     a0 = *(var_68h);
    0x0002b054 jalr t9                       |     t9 ();
    0x0002b058 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b05c lw t9, -0x6f38(gp)            |     t9 = sym.imp.fclose;
    0x0002b060 lw a0, 0x40(sp)               |     a0 = *(var_40h);
    0x0002b064 jalr t9                       |     t9 ();
    0x0002b068 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             | label_10:
    0x0002b06c lw v0, 0x113c(s3)             |     v0 = *((s3 + 1103));
                                             | label_37:
    0x0002b070 move s5, zero                 |     s5 = 0;
                                             |     if (v0 == 0) {
    0x0002b074 beqz v0, 0x2b0e4              |         goto label_42;
                                             |     }
                                             |     do {
    0x0002b078 lw a0, 0x1140(s3)             |         a0 = *((s3 + 1104));
    0x0002b07c sll v1, s5, 2                 |         v1 = s5 << 2;
    0x0002b080 lw t9, -0x7ef4(gp)            |         t9 = sym.xstrdup;
    0x0002b084 lwx a0, v1(a0)                |         __asm ("lwx a0, v1(a0)");
    0x0002b088 sw v1, 0x34(sp)               |         *(var_34h) = v1;
    0x0002b08c jalr t9                       |         t9 ();
    0x0002b090 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b094 addiu a1, zero, 0x3d          |         a1 = 0x3d;
    0x0002b098 move a0, v0                   |         a0 = v0;
    0x0002b09c lw t9, -0x6d4c(gp)            |         t9 = sym.imp.strchr;
    0x0002b0a0 move s6, v0                   |         s6 = v0;
    0x0002b0a4 jalr t9                       |         t9 ();
    0x0002b0a8 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b0ac lw v1, 0x34(sp)               |         v1 = *(var_34h);
                                             |         if (v0 == 0) {
    0x0002b0b0 beqz v0, 0x2beb8              |             goto label_43;
                                             |         }
    0x0002b0b4 lw t9, -0x796c(gp)            |         t9 = *(gp);
    0x0002b0b8 sb zero, (v0)                 |         *(v0) = 0;
    0x0002b0bc addiu a3, v0, 1               |         a3 = v0 + 1;
    0x0002b0c0 move a2, s6                   |         a2 = s6;
    0x0002b0c4 move a1, s2                   |         a1 = s2;
    0x0002b0c8 move a0, s1                   |         a0 = s1;
    0x0002b0cc jalr t9                       |         t9 ();
    0x0002b0d0 lw v0, 0x113c(s3)             |         v0 = *((s3 + 1103));
    0x0002b0d4 addiu s5, s5, 1               |         s5++;
    0x0002b0d8 sltu v0, s5, v0               |         v0 = (s5 < v0) ? 1 : 0;
    0x0002b0dc lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b0e0 bnez v0, 0x2b078              |         
                                             |     } while (v0 != 0);
                                             | label_42:
    0x0002b0e4 lw t9, -0x7fbc(gp)            |     t9 = sym.ssh_remote_ipaddr;
    0x0002b0e8 move a0, s4                   |     a0 = s4;
    0x0002b0ec jalr t9                       |     t9 ();
    0x0002b0f0 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b0f4 move a0, s4                   |     a0 = s4;
    0x0002b0f8 move s5, v0                   |     s5 = v0;
    0x0002b0fc lw t9, -0x7fb8(gp)            |     t9 = sym.ssh_remote_port;
    0x0002b100 addiu s6, sp, 0x314           |     s6 = sp + aav.0x00000314;
    0x0002b104 jalr t9                       |     t9 ();
    0x0002b108 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b10c move a0, s4                   |     a0 = s4;
    0x0002b110 lw t9, -0x7d94(gp)            |     t9 = sym.ssh_local_port;
    0x0002b114 sw v0, 0x34(sp)               |     *(var_34h) = v0;
    0x0002b118 jalr t9                       |     t9 ();
    0x0002b11c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b120 sw v0, 0x1c(sp)               |     *(var_1ch) = v0;
    0x0002b124 lw v1, 0x34(sp)               |     v1 = *(var_34h);
    0x0002b128 lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002b12c lw t9, -0x7180(gp)            |     t9 = sym.imp.__snprintf_chk;
                                             |     /* str._.50s__d__d */
    0x0002b130 addiu v0, v0, -0x3080         |     v0 += -0x3080;
    0x0002b134 sw v1, 0x18(sp)               |     *(var_18h) = v1;
    0x0002b138 addiu a3, zero, 0x100         |     a3 = aav.0x00000100;
    0x0002b13c addiu a2, zero, 1             |     a2 = 1;
    0x0002b140 addiu a1, zero, 0x100         |     a1 = aav.0x00000100;
    0x0002b144 move a0, s6                   |     a0 = s6;
    0x0002b148 sw s5, 0x14(sp)               |     *(var_14h) = s5;
    0x0002b14c sw s6, 0x54(sp)               |     *(var_54h) = s6;
    0x0002b150 sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002b154 jalr t9                       |     t9 ();
    0x0002b158 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b15c move a3, s6                   |     a3 = s6;
    0x0002b160 move a1, s2                   |     a1 = s2;
    0x0002b164 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002b168 lw t9, -0x796c(gp)            |     t9 = *(gp);
                                             |     /* str.SSH_CLIENT */
    0x0002b16c addiu a2, a2, -0x3074         |     a2 += -0x3074;
    0x0002b170 move a0, s1                   |     a0 = s1;
    0x0002b174 jalr t9                       |     t9 ();
    0x0002b178 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b17c lw t9, -0x7e28(gp)            |     t9 = sym.ssh_packet_get_connection_in;
    0x0002b180 move a0, s4                   |     a0 = s4;
    0x0002b184 jalr t9                       |     t9 ();
    0x0002b188 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b18c lw t9, -0x7dc8(gp)            |     t9 = sym.get_local_ipaddr;
    0x0002b190 move a0, v0                   |     a0 = v0;
    0x0002b194 jalr t9                       |     t9 ();
    0x0002b198 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b19c move a0, s4                   |     a0 = s4;
    0x0002b1a0 lw t9, -0x7fbc(gp)            |     t9 = sym.ssh_remote_ipaddr;
    0x0002b1a4 move s5, v0                   |     s5 = v0;
    0x0002b1a8 jalr t9                       |     t9 ();
    0x0002b1ac lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b1b0 move a0, s4                   |     a0 = s4;
    0x0002b1b4 lw t9, -0x7fb8(gp)            |     t9 = sym.ssh_remote_port;
    0x0002b1b8 sw v0, 0x40(sp)               |     *(var_40h) = v0;
    0x0002b1bc jalr t9                       |     t9 ();
    0x0002b1c0 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b1c4 move a0, s4                   |     a0 = s4;
    0x0002b1c8 lw t9, -0x7d94(gp)            |     t9 = sym.ssh_local_port;
    0x0002b1cc sw v0, 0x34(sp)               |     *(var_34h) = v0;
    0x0002b1d0 jalr t9                       |     t9 ();
    0x0002b1d4 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b1d8 sw v0, 0x20(sp)               |     *(var_20h) = v0;
    0x0002b1dc lw t0, 0x34(sp)               |     t0 = *(var_34h);
    0x0002b1e0 lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002b1e4 lw v1, 0x40(sp)               |     v1 = *(var_40h);
                                             |     /* str._.50s__d__.50s__d */
    0x0002b1e8 addiu v0, v0, -0x3068         |     v0 += -0x3068;
    0x0002b1ec lw t9, -0x7180(gp)            |     t9 = sym.imp.__snprintf_chk;
    0x0002b1f0 addiu a3, zero, 0x100         |     a3 = aav.0x00000100;
    0x0002b1f4 addiu a2, zero, 1             |     a2 = 1;
    0x0002b1f8 addiu a1, zero, 0x100         |     a1 = aav.0x00000100;
    0x0002b1fc sw t0, 0x18(sp)               |     *(var_18h) = t0;
    0x0002b200 sw v1, 0x14(sp)               |     *(var_14h) = v1;
    0x0002b204 move a0, s6                   |     a0 = s6;
    0x0002b208 sw s5, 0x1c(sp)               |     *(var_1ch) = s5;
    0x0002b20c sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002b210 jalr t9                       |     t9 ();
    0x0002b214 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b218 lw t9, -0x6e6c(gp)            |     t9 = sym.imp.free;
    0x0002b21c move a0, s5                   |     a0 = s5;
    0x0002b220 jalr t9                       |     t9 ();
    0x0002b224 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b228 move a3, s6                   |     a3 = s6;
    0x0002b22c move a1, s2                   |     a1 = s2;
    0x0002b230 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002b234 lw t9, -0x796c(gp)            |     t9 = *(gp);
                                             |     /* str.SSH_CONNECTION */
    0x0002b238 addiu a2, a2, -0x3054         |     a2 += -aav.0x00003054;
    0x0002b23c move a0, s1                   |     a0 = s1;
    0x0002b240 jalr t9                       |     t9 ();
    0x0002b244 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b248 lw v0, -0x7b7c(gp)            |     v0 = *(gp);
    0x0002b24c lw a3, (v0)                   |     a3 = *(v0);
    0x0002b250 lw a2, -0x7f34(gp)            |     a2 = *(gp);
                                             |     if (a3 != 0) {
    0x0002b254 beqz a3, 0x2b270              |         
    0x0002b258 lw t9, -0x796c(gp)            |         t9 = *(gp);
                                             |         /* str.SSH_TUNNEL */
    0x0002b25c addiu a2, a2, -0x3028         |         a2 += -0x3028;
    0x0002b260 move a1, s2                   |         a1 = s2;
    0x0002b264 move a0, s1                   |         a0 = s1;
    0x0002b268 jalr t9                       |         t9 ();
    0x0002b26c lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |     }
    0x0002b270 lw v0, -0x7fdc(gp)            |     v0 = *((gp - 8183));
    0x0002b274 lw a3, -0x437c(v0)            |     a3 = *((v0 - 4319));
    0x0002b278 lw a2, -0x7f34(gp)            |     a2 = *(gp);
                                             |     if (a3 != 0) {
    0x0002b27c beqz a3, 0x2b298              |         
    0x0002b280 lw t9, -0x796c(gp)            |         t9 = *(gp);
                                             |         /* str.SSH_USER_AUTH */
    0x0002b284 addiu a2, a2, -0x301c         |         a2 += -0x301c;
    0x0002b288 move a1, s2                   |         a1 = s2;
    0x0002b28c move a0, s1                   |         a0 = s1;
    0x0002b290 jalr t9                       |         t9 ();
    0x0002b294 lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |     }
    0x0002b298 lw v1, 0x24(s0)               |     v1 = *((s0 + 9));
    0x0002b29c addiu v0, zero, -1            |     v0 = -1;
    0x0002b2a0 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002b2a4 bne v1, v0, 0x2b4d8           |     
                                             |     while (1) {
    0x0002b2a8 lw v0, -0x7968(gp)            |         v0 = *(gp);
    0x0002b2ac lw a3, (v0)                   |         a3 = *(v0);
    0x0002b2b0 lw a2, -0x7f34(gp)            |         a2 = *(gp);
                                             |         if (a3 != 0) {
    0x0002b2b4 beqz a3, 0x2b2d0              |             
    0x0002b2b8 lw t9, -0x796c(gp)            |             t9 = *(gp);
                                             |             /* str.SSH_ORIGINAL_COMMAND */
    0x0002b2bc addiu a2, a2, -0x3004         |             a2 += -0x3004;
    0x0002b2c0 move a1, s2                   |             a1 = s2;
    0x0002b2c4 move a0, s1                   |             a0 = s1;
    0x0002b2c8 jalr t9                       |             t9 ();
    0x0002b2cc lw gp, 0x28(sp)               |             gp = *(var_28h);
                                             |         }
    0x0002b2d0 lw s2, -0x7ed8(gp)            |         s2 = *(gp);
    0x0002b2d4 lw v0, (s2)                   |         v0 = *(s2);
    0x0002b2d8 lw s1, 0x64(sp)               |         s1 = *(var_64h);
                                             |         if (v0 != 0) {
    0x0002b2dc bnez v0, 0x2b674              |             goto label_44;
                                             |         }
                                             | label_7:
    0x0002b2e0 lw t9, -0x79a0(gp)            |         t9 = *(gp);
                                             |         /* fcn.0002958c */
                                             | label_8:
    0x0002b2e4 addiu t9, t9, -0x6a74         |         t9 += -0x6a74;
    0x0002b2e8 move a0, s4                   |         a0 = s4;
    0x0002b2ec bal 0x2958c                   |         fcn_0002958c ();
    0x0002b2f0 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b2f4 lw v0, 0x30(sp)               |         v0 = *(var_30h);
    0x0002b2f8 lw t9, -0x6fcc(gp)            |         t9 = sym.imp.chdir;
    0x0002b2fc lw a0, 0x14(v0)               |         a0 = *((v0 + 5));
    0x0002b300 lw v0, -0x6fdc(gp)            |         v0 = *((gp - 7159));
    0x0002b304 sw s1, (v0)                   |         *(v0) = s1;
    0x0002b308 jalr t9                       |         t9 ();
    0x0002b30c addiu v1, zero, -1            |         v1 = -1;
    0x0002b310 lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |         if (v0 == v1) {
    0x0002b314 beq v0, v1, 0x2b974           |             goto label_45;
                                             |         }
                                             | label_16:
    0x0002b318 lw t9, -0x7eac(gp)            |         t9 = sym.closefrom;
                                             | label_15:
    0x0002b31c addiu a0, zero, 3             |         a0 = 3;
    0x0002b320 jalr t9                       |         t9 ();
    0x0002b324 lw v0, 0x80(s0)               |         v0 = *((s0 + 32));
    0x0002b328 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b32c sw zero, 0x68(sp)             |         *(var_68h) = 0;
    0x0002b330 sw zero, 0x6c(sp)             |         *(var_6ch) = 0;
                                             |         if (v0 == 0) {
    0x0002b334 beqz v0, 0x2b7a4              |             goto label_46;
                                             |         }
    0x0002b338 lw v0, 0x8c(s0)               |         v0 = *((s0 + 35));
    0x0002b33c move fp, zero                 |         fp = 0;
                                             |         if (v0 != 0) {
    0x0002b340 beqz v0, 0x2b34c              |             
    0x0002b344 lw fp, 0x90(s0)               |             fp = *((s0 + 36));
    0x0002b348 sltu fp, zero, fp             |             fp = (0 < fp) ? 1 : 0;
                                             |         }
                                             | label_9:
    0x0002b34c lw v0, 0xc(s0)                |         v0 = *((s0 + 3));
    0x0002b350 lw a3, -0x7f34(gp)            |         a3 = *(gp);
    0x0002b354 lw a1, -0x7f34(gp)            |         a1 = *(gp);
    0x0002b358 lw t9, -0x7c50(gp)            |         t9 = sym.xasprintf;
    0x0002b35c lw a2, 0x14(v0)               |         a2 = *((v0 + 5));
                                             |         /* str..ssh_rc */
    0x0002b360 addiu a3, a3, -0x2fa4         |         a3 += -0x2fa4;
                                             |         /* esilref: '&s/&s' */
    0x0002b364 addiu a1, a1, -0x78f8         |         a1 += -0x78f8;
    0x0002b368 addiu a0, sp, 0x6c            |         a0 = sp + 0x6c;
    0x0002b36c jalr t9                       |         t9 ();
    0x0002b370 lw v0, 0xa0(s0)               |         v0 = *((s0 + 40));
    0x0002b374 lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |         if (v0 == 0) {
    0x0002b378 bnez v0, 0x2b388              |             
    0x0002b37c lw v0, 0x117c(s3)             |             v0 = *((s3 + 1119));
    0x0002b380 lw v0, -0x7d7c(gp)            |             v0 = *(gp);
                                             |             if (v0 == 0) {
    0x0002b384 beqz v0, 0x2ba78              |                 goto label_47;
                                             |             }
                                             |         }
    0x0002b388 addiu s4, sp, 0x70            |         s4 = sp + 0x70;
                                             | label_18:
    0x0002b38c lw s5, -0x7f34(gp)            |         s5 = *(gp);
                                             | label_19:
    0x0002b390 lw t9, -0x6d1c(gp)            |         t9 = sym.imp.__xstat64;
    0x0002b394 move a2, s4                   |         a2 = s4;
                                             |         /* esilref: '/etc/ssh/sshrc' */
    0x0002b398 addiu a1, s5, -0x2f44         |         a1 = s5 + -0x2f44;
    0x0002b39c addiu a0, zero, 3             |         a0 = 3;
    0x0002b3a0 jalr t9                       |         t9 ();
    0x0002b3a4 lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |         if (v0 < 0) {
    0x0002b3a8 bltz v0, 0x2b8bc              |             goto label_48;
                                             |         }
    0x0002b3ac lw v0, (s2)                   |         v0 = *(s2);
    0x0002b3b0 lw v1, -0x6f44(gp)            |         v1 = *((gp - 7121));
                                             |         if (v0 != 0) {
    0x0002b3b4 bnez v0, 0x2bca0              |             goto label_49;
                                             |         }
                                             | label_21:
    0x0002b3b8 lw a1, -0x7fb4(gp)            |         a1 = *(gp);
    0x0002b3bc lw a0, -0x7f34(gp)            |         a0 = *(gp);
    0x0002b3c0 lw t9, -0x6e0c(gp)            |         t9 = sym.imp.popen
    0x0002b3c4 addiu a1, a1, 0x704c          |         a1 += 0x704c;
                                             |         /* str._bin_sh__etc_ssh_sshrc */
    0x0002b3c8 addiu a0, a0, -0x2f4c         |         a0 += -0x2f4c;
    0x0002b3cc jalr t9                       |         t9 ();
    0x0002b3d0 move s2, v0                   |         s2 = v0;
    0x0002b3d4 lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |         if (v0 == 0) {
    0x0002b3d8 beqz v0, 0x2bda8              |             goto label_50;
                                             |         }
                                             | label_20:
    0x0002b3dc lw a2, -0x7f34(gp)            |         a2 = *(gp);
                                             |         if (fp != 0) {
    0x0002b3e0 bnez fp, 0x2bd20              |             goto label_51;
                                             |         }
                                             | label_14:
    0x0002b3e4 lw t9, -0x706c(gp)            |         t9 = sym.imp.pclose;
    0x0002b3e8 move a0, s2                   |         a0 = s2;
    0x0002b3ec jalr t9                       |         t9 ();
    0x0002b3f0 lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             | label_26:
    0x0002b3f4 lw t9, -0x6e6c(gp)            |         t9 = sym.imp.free;
                                             | label_13:
    0x0002b3f8 lw a0, 0x68(sp)               |         a0 = *(var_68h);
    0x0002b3fc jalr t9                       |         t9 ();
    0x0002b400 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b404 lw t9, -0x6e6c(gp)            |         t9 = sym.imp.free;
    0x0002b408 lw a0, 0x6c(sp)               |         a0 = *(var_6ch);
    0x0002b40c jalr t9                       |         t9 ();
    0x0002b410 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b414 move a1, zero                 |         a1 = 0;
    0x0002b418 lw t9, -0x7fac(gp)            |         t9 = sym.ssh_signal;
    0x0002b41c addiu a0, zero, 0xd           |         a0 = 0xd;
    0x0002b420 jalr t9                       |         t9 ();
    0x0002b424 lw v0, 0xa0(s0)               |         v0 = *((s0 + 40));
    0x0002b428 addiu v1, zero, 3             |         v1 = 3;
    0x0002b42c lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |         if (v0 == v1) {
    0x0002b430 beq v0, v1, 0x2bc2c           |             goto label_52;
                                             |         }
    0x0002b434 addiu v1, zero, 2             |         v1 = 2;
    0x0002b438 lw t9, -0x6ec0(gp)            |         t9 = sym.imp.fflush;
                                             |         if (v0 == v1) {
    0x0002b43c beq v0, v1, 0x2bb28           |             goto label_53;
                                             |         }
    0x0002b440 move a0, zero                 |         a0 = 0;
    0x0002b444 jalr t9                       |         t9 ();
    0x0002b448 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b44c lw a0, 0x3c(sp)               |         a0 = *(var_3ch);
    0x0002b450 lw t9, -0x6dfc(gp)            |         t9 = sym.imp.strrchr;
    0x0002b454 addiu a1, zero, 0x2f          |         a1 = 0x2f;
    0x0002b458 jalr t9                       |         t9 ();
    0x0002b45c lw gp, 0x28(sp)               |         gp = *(var_28h);
                                             |         if (v0 == 0) {
    0x0002b460 beqz v0, 0x2bd94              |             goto label_54;
                                             |         }
    0x0002b464 addiu v0, v0, 1               |         v0++;
                                             | label_24:
    0x0002b468 lw v1, 0x38(sp)               |         v1 = *(var_38h);
    0x0002b46c lw t9, -0x7044(gp)            |         t9 = sym.imp.execve;
                                             |         if (v1 == 0) {
    0x0002b470 beqz v1, 0x2bd48              |             goto label_55;
                                             |         }
    0x0002b474 sw v0, 0x70(sp)               |         *(var_70h) = v0;
    0x0002b478 lw v0, -0x7e48(gp)            |         v0 = *(gp);
    0x0002b47c lw s0, 0x3c(sp)               |         s0 = *(var_3ch);
                                             |         /* esilref: '-c' */
    0x0002b480 addiu v0, v0, -0x5108         |         v0 += -0x5108;
    0x0002b484 sw v0, 0x74(sp)               |         *(var_74h) = v0;
    0x0002b488 lw v0, 0x38(sp)               |         v0 = *(var_38h);
    0x0002b48c move a2, s1                   |         a2 = s1;
    0x0002b490 move a1, s4                   |         a1 = s4;
    0x0002b494 move a0, s0                   |         a0 = s0;
    0x0002b498 sw v0, 0x78(sp)               |         *(var_78h) = v0;
    0x0002b49c sw zero, 0x7c(sp)             |         *(var_7ch) = 0;
                                             | label_28:
    0x0002b4a0 jalr t9                       |         t9 ();
    0x0002b4a4 nop                           |         
    0x0002b4a8 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b4ac move a0, s0                   |         a0 = s0;
    0x0002b4b0 lw t9, -0x6e2c(gp)            |         t9 = sym.imp.perror;
                                             | label_23:
    0x0002b4b4 jalr t9                       |         t9 ();
    0x0002b4b8 nop                           |         
    0x0002b4bc lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b4c0 lw t9, -0x7210(gp)            |         t9 = sym.imp.exit;
    0x0002b4c4 addiu a0, zero, 1             |         a0 = 1;
    0x0002b4c8 jalr t9                       |         t9 ();
                                             | label_34:
    0x0002b4cc addiu v0, v0, -0x4aac         |         v0 += -aav.0x00004aac;
    0x0002b4d0 sw v0, 0x3c(sp)               |         *(var_3ch) = v0;
    0x0002b4d4 b 0x2ad68                     |         goto label_2;
    0x0002b4d8 lw t9, -0x796c(gp)            |         t9 = *(gp);
    0x0002b4dc addiu a3, s0, 0x3c            |         a3 = s0 + 0x3c;
                                             |         /* str.SSH_TTY */
    0x0002b4e0 addiu a2, a2, -0x300c         |         a2 += -0x300c;
    0x0002b4e4 move a1, s2                   |         a1 = s2;
    0x0002b4e8 move a0, s1                   |         a0 = s1;
    0x0002b4ec jalr t9                       |         t9 ();
    0x0002b4f0 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b4f4 b 0x2b2a8                     |         
                                             |     }
                                             | label_32:
    0x0002b4f8 lw v0, 8(v0)                  |     v0 = *((v0 + 2));
    0x0002b4fc lw t9, -0x7d04(gp)            |     t9 = sym.do_setusercontext;
                                             |     if (v0 == 0) {
    0x0002b500 beqz v0, 0x2ad2c              |         goto label_3;
                                             |     }
    0x0002b504 lw s1, -0x7f34(gp)            |     s1 = *(gp);
    0x0002b508 lw t9, -0x6d1c(gp)            |     t9 = sym.imp.__xstat64;
    0x0002b50c addiu a2, sp, 0x70            |     a2 = sp + 0x70;
                                             |     /* str._etc_nologin */
    0x0002b510 addiu a1, s1, -0x319c         |     a1 = s1 + -0x319c;
    0x0002b514 addiu a0, zero, 3             |     a0 = 3;
    0x0002b518 jalr t9                       |     t9 ();
    0x0002b51c addiu v1, zero, -1            |     v1 = -1;
    0x0002b520 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == v1) {
    0x0002b524 beq v0, v1, 0x2ad28           |         goto label_4;
                                             |     }
    0x0002b528 lw v0, 0x30(sp)               |     v0 = *(var_30h);
                                             |     /* str._etc_nologin */
    0x0002b52c addiu s1, s1, -0x319c         |     s1 += -0x319c;
    0x0002b530 sw s1, 0x20(sp)               |     *(var_20h) = s1;
    0x0002b534 lw v0, (v0)                   |     v0 = *(v0);
    0x0002b538 lw a1, -0x7f34(gp)            |     a1 = *(gp);
    0x0002b53c sw v0, 0x1c(sp)               |     *(var_1ch) = v0;
    0x0002b540 lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002b544 lw a0, -0x7f34(gp)            |     a0 = *(gp);
                                             |     /* str.User__.100s_not_allowed_because__s_exists */
    0x0002b548 addiu v0, v0, -0x318c         |     v0 += -0x318c;
    0x0002b54c lw t9, -0x7f6c(gp)            |     t9 = sym.sshlog;
    0x0002b550 sw v0, 0x18(sp)               |     *(var_18h) = v0;
    0x0002b554 addiu v0, zero, 3             |     v0 = 3;
    0x0002b558 move a3, zero                 |     a3 = 0;
    0x0002b55c addiu a2, zero, 0x50e         |     a2 = 0x50e;
                                             |     /* str.do_nologin */
    0x0002b560 addiu a1, a1, -0x2110         |     a1 += -0x2110;
                                             |     /* str.session.c */
    0x0002b564 addiu a0, a0, -0x3620         |     a0 += -0x3620;
    0x0002b568 sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002b56c sw zero, 0x14(sp)             |     *(var_14h) = 0;
    0x0002b570 jalr t9                       |     t9 ();
    0x0002b574 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b578 move a0, s1                   |     a0 = s1;
    0x0002b57c lw a1, -0x7f34(gp)            |     a1 = *(gp);
    0x0002b580 lw t9, -0x7238(gp)            |     t9 = sym.imp.fopen64;
    0x0002b584 addiu a1, a1, -0x6b8c         |     a1 += -0x6b8c;
    0x0002b588 jalr t9                       |     t9 ();
    0x0002b58c move s0, v0                   |     s0 = v0;
    0x0002b590 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == 0) {
    0x0002b594 beqz v0, 0x2b5e8              |         goto label_56;
                                             |     }
    0x0002b598 addiu v0, sp, 0x314           |     v0 = sp + aav.0x00000314;
    0x0002b59c sw v0, 0x54(sp)               |     *(var_54h) = v0;
    0x0002b5a0 lw s1, -0x6f44(gp)            |     s1 = *((gp - 7121));
    0x0002b5a4 b 0x2b5bc                     |     
                                             |     while (v0 != 0) {
    0x0002b5a8 lw t9, -0x6c50(gp)            |         t9 = sym.imp.fputs;
    0x0002b5ac lw a1, (s1)                   |         a1 = *(s1);
    0x0002b5b0 lw a0, 0x54(sp)               |         a0 = *(var_54h);
    0x0002b5b4 jalr t9                       |         t9 ();
    0x0002b5b8 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b5bc lw t9, -0x6da4(gp)            |         t9 = sym.imp.fgets;
    0x0002b5c0 lw a0, 0x54(sp)               |         a0 = *(var_54h);
    0x0002b5c4 move a2, s0                   |         a2 = s0;
    0x0002b5c8 addiu a1, zero, 0x400         |         a1 = aav.0x00000400;
    0x0002b5cc jalr t9                       |         t9 ();
    0x0002b5d0 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b5d4 bnez v0, 0x2b5a8              |         
                                             |     }
    0x0002b5d8 lw t9, -0x6f38(gp)            |     t9 = sym.imp.fclose;
    0x0002b5dc move a0, s0                   |     a0 = s0;
    0x0002b5e0 jalr t9                       |     t9 ();
    0x0002b5e4 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             | label_56:
    0x0002b5e8 lw t9, -0x7210(gp)            |     t9 = sym.imp.exit;
    0x0002b5ec addiu a0, zero, 0xfe          |     a0 = 0xfe;
    0x0002b5f0 jalr t9                       |     t9 ();
                                             | label_36:
    0x0002b5f4 lw v0, 0x40(sp)               |     v0 = *(var_40h);
    0x0002b5f8 lw t9, -0x7180(gp)            |     t9 = sym.imp.__snprintf_chk;
    0x0002b5fc addiu s5, sp, 0x314           |     s5 = sp + aav.0x00000314;
    0x0002b600 lw v0, (v0)                   |     v0 = *(v0);
    0x0002b604 addiu a3, zero, 0x100         |     a3 = aav.0x00000100;
    0x0002b608 sw v0, 0x18(sp)               |     *(var_18h) = v0;
    0x0002b60c lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002b610 addiu a2, zero, 1             |     a2 = 1;
                                             |     /* str._var_mail */
    0x0002b614 addiu v0, v0, -0x3120         |     v0 += -0x3120;
    0x0002b618 sw v0, 0x14(sp)               |     *(var_14h) = v0;
    0x0002b61c lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002b620 addiu a1, zero, 0x100         |     a1 = aav.0x00000100;
                                             |     /* str._.200s__.50s */
    0x0002b624 addiu v0, v0, -0x3114         |     v0 += -0x3114;
    0x0002b628 move a0, s5                   |     a0 = s5;
    0x0002b62c sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002b630 jalr t9                       |     t9 ();
    0x0002b634 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b638 move a3, s5                   |     a3 = s5;
    0x0002b63c move a1, s2                   |     a1 = s2;
    0x0002b640 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002b644 lw t9, -0x796c(gp)            |     t9 = *(gp);
                                             |     /* str.MAIL */
    0x0002b648 addiu a2, a2, -0x3104         |     a2 += -0x3104;
    0x0002b64c move a0, s1                   |     a0 = s1;
    0x0002b650 jalr t9                       |     t9 ();
    0x0002b654 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b658 b 0x2ae70                     |     goto label_5;
                                             | label_33:
    0x0002b65c lw t9, -0x79a0(gp)            |     t9 = *(gp);
                                             |     /* fcn.00029880 */
    0x0002b660 addiu t9, t9, -0x6780         |     t9 += -0x6780;
    0x0002b664 bal 0x29880                   |     fcn_00029880 ();
    0x0002b668 nop                           |     
    0x0002b66c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b670 b 0x2ad50                     |     goto label_6;
                                             | label_44:
    0x0002b674 lw s6, -0x6f44(gp)            |     s6 = *((gp - 7121));
    0x0002b678 lw a0, -0x7f34(gp)            |     a0 = *(gp);
    0x0002b67c lw t9, -0x702c(gp)            |     t9 = sym.imp.fwrite;
    0x0002b680 lw a3, (s6)                   |     a3 = *(s6);
    0x0002b684 addiu a2, zero, 0xd           |     a2 = 0xd;
    0x0002b688 addiu a1, zero, 1             |     a1 = 1;
                                             |     /* str.Environment:_n */
    0x0002b68c addiu a0, a0, -0x2fec         |     a0 += -aav.0x00002fec;
    0x0002b690 jalr t9                       |     t9 ();
    0x0002b694 lw s1, 0x64(sp)               |     s1 = *(var_64h);
    0x0002b698 lw a3, (s1)                   |     a3 = *(s1);
    0x0002b69c lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (a3 == 0) {
    0x0002b6a0 beqz a3, 0x2b2e0              |         goto label_7;
                                             |     }
    0x0002b6a4 lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002b6a8 addiu s5, zero, 4             |     s5 = 4;
                                             |     /* str.___.200s_n */
    0x0002b6ac addiu v0, v0, -0x2fdc         |     v0 += -0x2fdc;
    0x0002b6b0 move fp, v0                   |     fp = v0;
                                             |     do {
    0x0002b6b4 lw t9, -0x6ce8(gp)            |         t9 = sym.imp.__fprintf_chk;
    0x0002b6b8 lw a0, (s6)                   |         a0 = *(s6);
    0x0002b6bc move a2, fp                   |         a2 = fp;
    0x0002b6c0 addiu a1, zero, 1             |         a1 = 1;
    0x0002b6c4 jalr t9                       |         t9 ();
    0x0002b6c8 lw s1, 0x64(sp)               |         s1 = *(var_64h);
    0x0002b6cc lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002b6d0 lwx a3, s5(s1)                |         __asm ("lwx a3, s5(s1)");
    0x0002b6d4 addiu s5, s5, 4               |         s5 += 4;
    0x0002b6d8 bnez a3, 0x2b6b4              |         
                                             |     } while (a3 != 0);
    0x0002b6dc lw t9, -0x79a0(gp)            |     t9 = *(gp);
    0x0002b6e0 b 0x2b2e4                     |     goto label_8;
                                             | label_31:
    0x0002b6e4 lw t9, -0x7d04(gp)            |     t9 = sym.do_setusercontext;
    0x0002b6e8 lw a0, 0x30(sp)               |     a0 = *(var_30h);
    0x0002b6ec bal 0x2a8e4                   |     sym_do_setusercontext ();
    0x0002b6f0 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b6f4 lw t9, -0x79a0(gp)            |     t9 = *(gp);
    0x0002b6f8 lw s1, -0x6f44(gp)            |     s1 = *((gp - 7121));
                                             |     /* fcn.0002958c */
    0x0002b6fc addiu t9, t9, -0x6a74         |     t9 += -0x6a74;
    0x0002b700 move a0, s4                   |     a0 = s4;
    0x0002b704 bal 0x2958c                   |     fcn_0002958c ();
    0x0002b708 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b70c lw t9, -0x6ec0(gp)            |     t9 = sym.imp.fflush;
    0x0002b710 move a0, zero                 |     a0 = 0;
    0x0002b714 jalr t9                       |     t9 ();
    0x0002b718 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b71c lw a3, (s1)                   |     a3 = *(s1);
    0x0002b720 addiu a2, zero, 0x24          |     a2 = 0x24;
    0x0002b724 lw a0, -0x7f34(gp)            |     a0 = *(gp);
    0x0002b728 lw t9, -0x702c(gp)            |     t9 = sym.imp.fwrite;
    0x0002b72c addiu a1, zero, 1             |     a1 = 1;
                                             |     /* str.WARNING:_Your_password_has_expired._n */
    0x0002b730 addiu a0, a0, -0x3240         |     a0 += -0x3240;
    0x0002b734 jalr t9                       |     t9 ();
    0x0002b738 lw v1, 0x24(s0)               |     v1 = *((s0 + 9));
    0x0002b73c addiu v0, zero, -1            |     v0 = -1;
    0x0002b740 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v1 == v0) {
    0x0002b744 beq v1, v0, 0x2bcd0           |         goto label_57;
                                             |     }
    0x0002b748 lw a0, -0x7f34(gp)            |     a0 = *(gp);
    0x0002b74c lw t9, -0x702c(gp)            |     t9 = sym.imp.fwrite;
    0x0002b750 lw a3, (s1)                   |     a3 = *(s1);
    0x0002b754 addiu a2, zero, 0x33          |     a2 = 0x33;
    0x0002b758 addiu a1, zero, 1             |     a1 = 1;
                                             |     /* str.You_must_change_your_password_now_and_login_again__n */
    0x0002b75c addiu a0, a0, -0x3218         |     a0 += -0x3218;
    0x0002b760 jalr t9                       |     t9 ();
    0x0002b764 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b768 move a2, zero                 |     a2 = 0;
    0x0002b76c lw s0, -0x7f34(gp)            |     s0 = *(gp);
    0x0002b770 lw a0, -0x7f34(gp)            |     a0 = *(gp);
    0x0002b774 lw t9, -0x6de4(gp)            |     t9 = sym.imp.execl;
                                             |     /* str.passwd */
    0x0002b778 addiu a1, s0, -0x31e4         |     a1 = s0 + -0x31e4;
                                             |     /* str._usr_bin_passwd */
    0x0002b77c addiu a0, a0, -0x31dc         |     a0 += -0x31dc;
    0x0002b780 jalr t9                       |     t9 ();
    0x0002b784 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b788 lw t9, -0x6e2c(gp)            |     t9 = sym.imp.perror;
                                             |     /* str.passwd */
    0x0002b78c addiu a0, s0, -0x31e4         |     a0 = s0 + -0x31e4;
    0x0002b790 jalr t9                       |     t9 ();
    0x0002b794 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             | label_22:
    0x0002b798 lw t9, -0x7210(gp)            |     t9 = sym.imp.exit;
    0x0002b79c addiu a0, zero, 1             |     a0 = 1;
    0x0002b7a0 jalr t9                       |     t9 ();
                                             | label_46:
    0x0002b7a4 move fp, zero                 |     fp = 0;
    0x0002b7a8 b 0x2b34c                     |     goto label_9;
                                             | label_41:
    0x0002b7ac lw v0, 0x4f4(s3)              |     v0 = *((s3 + 317));
    0x0002b7b0 lw v0, -0x7f34(gp)            |     v0 = *(gp);
                                             |     if (v0 == 0) {
    0x0002b7b4 beqz v0, 0x2b06c              |         goto label_10;
                                             |     }
                                             | label_39:
    0x0002b7b8 lw t9, -0x7180(gp)            |     t9 = sym.imp.__snprintf_chk;
                                             |     /* str..ssh */
    0x0002b7bc addiu v0, v0, -0x30e0         |     v0 += -0x30e0;
    0x0002b7c0 sw v0, 0x18(sp)               |     *(var_18h) = v0;
    0x0002b7c4 lw v0, 0x40(sp)               |     v0 = *(var_40h);
    0x0002b7c8 addiu s5, sp, 0x314           |     s5 = sp + aav.0x00000314;
    0x0002b7cc addiu a3, zero, 0x100         |     a3 = aav.0x00000100;
    0x0002b7d0 lw v0, 0x14(v0)               |     v0 = *((v0 + 5));
    0x0002b7d4 addiu a2, zero, 1             |     a2 = 1;
    0x0002b7d8 sw v0, 0x14(sp)               |     *(var_14h) = v0;
    0x0002b7dc lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002b7e0 addiu a1, zero, 0x100         |     a1 = aav.0x00000100;
                                             |     /* str._.200s__s_environment */
    0x0002b7e4 addiu v0, v0, -0x30d8         |     v0 += -aav.0x000030d8;
    0x0002b7e8 move a0, s5                   |     a0 = s5;
    0x0002b7ec sw s5, 0x54(sp)               |     *(var_54h) = s5;
    0x0002b7f0 sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002b7f4 jalr t9                       |     t9 ();
    0x0002b7f8 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b7fc lw v0, 0x4f8(s3)              |     v0 = *(s3);
    0x0002b800 move a0, s5                   |     a0 = s5;
    0x0002b804 lw a1, -0x7f34(gp)            |     a1 = *(gp);
    0x0002b808 lw t9, -0x7238(gp)            |     t9 = sym.imp.fopen64;
    0x0002b80c addiu a1, a1, -0x6b8c         |     a1 += -0x6b8c;
    0x0002b810 sw v0, 0x44(sp)               |     *(var_44h) = v0;
    0x0002b814 sw zero, 0x68(sp)             |     *(var_68h) = 0;
    0x0002b818 sw zero, 0x6c(sp)             |     *(var_6ch) = 0;
    0x0002b81c jalr t9                       |     t9 ();
    0x0002b820 sw v0, 0x40(sp)               |     *(var_40h) = v0;
    0x0002b824 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == 0) {
    0x0002b828 beqz v0, 0x2b06c              |         goto label_10;
                                             |     }
    0x0002b82c lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002b830 sw zero, 0x34(sp)             |     *(var_34h) = 0;
    0x0002b834 addiu v0, v0, 0x48bc          |     v0 += 0x48bc;
    0x0002b838 sw v0, 0x4c(sp)               |     *(var_4ch) = v0;
    0x0002b83c lw v0, -0x6f44(gp)            |     v0 = *((gp - 7121));
    0x0002b840 addiu fp, sp, 0x6c            |     fp = sp + 0x6c;
    0x0002b844 sw v0, 0x58(sp)               |     *(var_58h) = v0;
    0x0002b848 lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002b84c addiu s6, sp, 0x68            |     s6 = sp + 0x68;
                                             |     /* str.Bad_line__u_in__.100s_n */
    0x0002b850 addiu v0, v0, -0x3098         |     v0 += -0x3098;
    0x0002b854 sw v0, 0x5c(sp)               |     *(var_5ch) = v0;
                                             | label_17:
    0x0002b858 lw t9, -0x6d04(gp)            |     t9 = sym.imp.__getdelim;
    0x0002b85c lw a3, 0x40(sp)               |     a3 = *(var_40h);
    0x0002b860 addiu a2, zero, 0xa           |     a2 = 0xa;
    0x0002b864 move a1, fp                   |     a1 = fp;
    0x0002b868 move a0, s6                   |     a0 = s6;
    0x0002b86c jalr t9                       |     t9 ();
    0x0002b870 addiu v1, zero, -1            |     v1 = -1;
    0x0002b874 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == v1) {
    0x0002b878 beq v0, v1, 0x2b04c           |         goto label_11;
                                             |     }
    0x0002b87c lw v0, 0x34(sp)               |     v0 = *(var_34h);
    0x0002b880 addiu v0, v0, 1               |     v0++;
    0x0002b884 move v1, v0                   |     v1 = v0;
    0x0002b888 sw v0, 0x34(sp)               |     *(var_34h) = v0;
    0x0002b88c addiu v0, zero, 0x3e9         |     v0 = 0x3e9;
    0x0002b890 lw s5, 0x68(sp)               |     s5 = *(var_68h);
                                             |     if (v1 == v0) {
    0x0002b894 beq v1, v0, 0x2be78           |         goto label_58;
                                             |     }
    0x0002b898 addiu a1, zero, 0x20          |     a1 = 0x20;
    0x0002b89c addiu a0, zero, 9             |     a0 = 9;
                                             |     do {
                                             | label_12:
    0x0002b8a0 lb v0, (s5)                   |         v0 = *(s5);
    0x0002b8a4 beql v0, a1, 0x2b8a0          |         
                                             |     } while (v0 == a1);
    0x0002b8a8 addiu s5, s5, 1               |     s5++;
                                             |     if (v0 != a0) {
    0x0002b8ac bne v0, a0, 0x2b9d8           |         goto label_59;
                                             |     }
    0x0002b8b0 nop                           |     
    0x0002b8b4 addiu s5, s5, 1               |     s5++;
    0x0002b8b8 b 0x2b8a0                     |     goto label_12;
                                             | label_48:
    0x0002b8bc lw t9, -0x6e6c(gp)            |     t9 = sym.imp.free;
                                             |     if (fp == 0) {
    0x0002b8c0 beqz fp, 0x2b3f8              |         goto label_13;
                                             |     }
    0x0002b8c4 lw a3, 0x464(s3)              |     a3 = *(s3);
                                             |     if (a3 == 0) {
    0x0002b8c8 beqz a3, 0x2b3f8              |         goto label_13;
                                             |     }
    0x0002b8cc nop                           |     
    0x0002b8d0 lw v0, (s2)                   |     v0 = *(s2);
    0x0002b8d4 lw s2, -0x6f44(gp)            |     s2 = *((gp - 7121));
                                             |     if (v0 != 0) {
    0x0002b8d8 bnez v0, 0x2be04              |         goto label_60;
                                             |     }
                                             | label_29:
    0x0002b8dc lw a1, -0x7f34(gp)            |     a1 = *(gp);
    0x0002b8e0 lw t9, -0x7c50(gp)            |     t9 = sym.xasprintf;
    0x0002b8e4 lw a2, 0x464(s3)              |     a2 = *(s3);
                                             |     /* str._s__q__ */
    0x0002b8e8 addiu a1, a1, -0x2ef0         |     a1 += -0x2ef0;
    0x0002b8ec addiu a0, sp, 0x68            |     a0 = sp + 0x68;
    0x0002b8f0 jalr t9                       |     t9 ();
    0x0002b8f4 addiu v1, zero, -1            |     v1 = -1;
    0x0002b8f8 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == v1) {
    0x0002b8fc beq v0, v1, 0x2bf7c           |         goto label_61;
                                             |     }
    0x0002b900 lw a1, -0x7fb4(gp)            |     a1 = *(gp);
    0x0002b904 lw t9, -0x6e0c(gp)            |     t9 = sym.imp.popen
    0x0002b908 lw a0, 0x68(sp)               |     a0 = *(var_68h);
    0x0002b90c addiu a1, a1, 0x704c          |     a1 += 0x704c;
    0x0002b910 jalr t9                       |     t9 ();
    0x0002b914 move s2, v0                   |     s2 = v0;
    0x0002b918 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == 0) {
    0x0002b91c beqz v0, 0x2be64              |         goto label_62;
                                             |     }
    0x0002b920 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002b924 lw t9, -0x6ce8(gp)            |     t9 = sym.imp.__fprintf_chk;
    0x0002b928 lw a3, 0x88(s0)               |     a3 = *((s0 + 34));
                                             |     /* str.remove__s_n */
    0x0002b92c addiu a2, a2, -0x2ee8         |     a2 += -0x2ee8;
    0x0002b930 addiu a1, zero, 1             |     a1 = 1;
    0x0002b934 move a0, v0                   |     a0 = v0;
    0x0002b938 jalr t9                       |     t9 ();
    0x0002b93c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b940 lw v1, 0x90(s0)               |     v1 = *((s0 + 36));
    0x0002b944 lw v0, 0x8c(s0)               |     v0 = *((s0 + 35));
    0x0002b948 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002b94c lw a3, 0x88(s0)               |     a3 = *((s0 + 34));
    0x0002b950 lw t9, -0x6ce8(gp)            |     t9 = sym.imp.__fprintf_chk;
                                             |     /* str.add__s__s__s_n */
    0x0002b954 addiu a2, a2, -0x2edc         |     a2 += -0x2edc;
    0x0002b958 addiu a1, zero, 1             |     a1 = 1;
    0x0002b95c move a0, s2                   |     a0 = s2;
    0x0002b960 sw v1, 0x14(sp)               |     *(var_14h) = v1;
    0x0002b964 sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002b968 jalr t9                       |     t9 ();
    0x0002b96c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b970 b 0x2b3e4                     |     goto label_14;
                                             | label_45:
    0x0002b974 lw v0, -0x7fdc(gp)            |     v0 = *((gp - 8183));
    0x0002b978 lw v0, -0x4378(v0)            |     v0 = *((v0 - 4318));
    0x0002b97c lw t9, -0x7eac(gp)            |     t9 = sym.closefrom;
                                             |     if (v0 != 0) {
    0x0002b980 bnez v0, 0x2b31c              |         goto label_15;
                                             |     }
    0x0002b984 lw v0, 0x30(sp)               |     v0 = *(var_30h);
    0x0002b988 lw t9, -0x6c58(gp)            |     t9 = sym.imp.__errno_location;
    0x0002b98c lw s5, 0x14(v0)               |     s5 = *((v0 + 5));
    0x0002b990 lw v0, -0x6f44(gp)            |     v0 = *((gp - 7121));
    0x0002b994 lw s4, (v0)                   |     s4 = *(v0);
    0x0002b998 jalr t9                       |     t9 ();
    0x0002b99c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b9a0 lw t9, -0x6c90(gp)            |     t9 = sym.imp.strerror;
    0x0002b9a4 lw a0, (v0)                   |     a0 = *(v0);
    0x0002b9a8 jalr t9                       |     t9 ();
    0x0002b9ac lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b9b0 sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002b9b4 move a3, s5                   |     a3 = s5;
    0x0002b9b8 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002b9bc lw t9, -0x6ce8(gp)            |     t9 = sym.imp.__fprintf_chk;
                                             |     /* str.Could_not_chdir_to_home_directory__s:__s_n */
    0x0002b9c0 addiu a2, a2, -0x2fd0         |     a2 += -0x2fd0;
    0x0002b9c4 addiu a1, zero, 1             |     a1 = 1;
    0x0002b9c8 move a0, s4                   |     a0 = s4;
    0x0002b9cc jalr t9                       |     t9 ();
    0x0002b9d0 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002b9d4 b 0x2b318                     |     goto label_16;
                                             | label_59:
    0x0002b9d8 addiu a0, zero, 0x23          |     a0 = 0x23;
                                             |     if (v0 == 0) {
    0x0002b9dc beqz v0, 0x2b858              |         goto label_17;
                                             |     }
    0x0002b9e0 addiu a0, zero, 0xa           |     a0 = 0xa;
                                             |     if (v0 == a0) {
    0x0002b9e4 beq v0, a0, 0x2b858           |         goto label_17;
                                             |     }
    0x0002b9e8 lw t9, -0x71d8(gp)            |     t9 = sym.imp.strcspn;
                                             |     if (v0 == a0) {
    0x0002b9ec beq v0, a0, 0x2b858           |         goto label_17;
                                             |     }
    0x0002b9f0 lw a1, 0x4c(sp)               |     a1 = *(var_4ch);
    0x0002b9f4 move a0, s5                   |     a0 = s5;
    0x0002b9f8 jalr t9                       |     t9 ();
    0x0002b9fc lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002ba00 addu v0, s5, v0               |     v0 = s5 + v0;
    0x0002ba04 addiu a1, zero, 0x3d          |     a1 = 0x3d;
    0x0002ba08 lw t9, -0x6d4c(gp)            |     t9 = sym.imp.strchr;
    0x0002ba0c sb zero, (v0)                 |     *(v0) = 0;
    0x0002ba10 move a0, s5                   |     a0 = s5;
    0x0002ba14 jalr t9                       |     t9 ();
    0x0002ba18 move a3, v0                   |     a3 = v0;
    0x0002ba1c lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == 0) {
    0x0002ba20 beqz v0, 0x2bcf4              |         goto label_63;
                                             |     }
    0x0002ba24 sb zero, (v0)                 |     *(v0) = 0;
    0x0002ba28 lw v0, 0x44(sp)               |     v0 = *(var_44h);
    0x0002ba2c lw t9, -0x7f38(gp)            |     t9 = sym.match_pattern_list;
                                             |     if (v0 == 0) {
    0x0002ba30 beqz v0, 0x2ba58              |         goto label_64;
                                             |     }
    0x0002ba34 lw a1, 0x44(sp)               |     a1 = *(var_44h);
    0x0002ba38 sw a3, 0x48(sp)               |     *(var_48h) = a3;
    0x0002ba3c move a0, s5                   |     a0 = s5;
    0x0002ba40 move a2, zero                 |     a2 = 0;
    0x0002ba44 jalr t9                       |     t9 ();
    0x0002ba48 addiu a0, zero, 1             |     a0 = 1;
    0x0002ba4c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002ba50 lw a3, 0x48(sp)               |     a3 = *(var_48h);
                                             |     if (v0 != a0) {
    0x0002ba54 bne v0, a0, 0x2b858           |         goto label_17;
                                             |     }
                                             | label_64:
    0x0002ba58 lw t9, -0x796c(gp)            |     t9 = *(gp);
    0x0002ba5c addiu a3, a3, 1               |     a3++;
    0x0002ba60 move a2, s5                   |     a2 = s5;
    0x0002ba64 move a1, s2                   |     a1 = s2;
    0x0002ba68 move a0, s1                   |     a0 = s1;
    0x0002ba6c jalr t9                       |     t9 ();
    0x0002ba70 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002ba74 b 0x2b858                     |     goto label_17;
                                             | label_47:
    0x0002ba78 lw v0, (v0)                   |     v0 = *(v0);
    0x0002ba7c lw v0, 0x10(v0)               |     v0 = *((v0 + 4));
    0x0002ba80 addiu s4, sp, 0x70            |     s4 = sp + 0x70;
                                             |     if (v0 == 0) {
    0x0002ba84 beqz v0, 0x2b38c              |         goto label_18;
                                             |     }
    0x0002ba88 lw v0, 0x46c(s3)              |     v0 = *(s3);
    0x0002ba8c lw s5, -0x7f34(gp)            |     s5 = *(gp);
                                             |     if (v0 == 0) {
    0x0002ba90 beqz v0, 0x2b390              |         goto label_19;
                                             |     }
    0x0002ba94 lw t9, -0x6d1c(gp)            |     t9 = sym.imp.__xstat64;
    0x0002ba98 addiu s4, sp, 0x70            |     s4 = sp + 0x70;
    0x0002ba9c lw a1, 0x6c(sp)               |     a1 = *(var_6ch);
    0x0002baa0 move a2, s4                   |     a2 = s4;
    0x0002baa4 addiu a0, zero, 3             |     a0 = 3;
    0x0002baa8 jalr t9                       |     t9 ();
    0x0002baac lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 < 0) {
    0x0002bab0 bltz v0, 0x2b38c              |         goto label_18;
                                             |     }
    0x0002bab4 lw a3, -0x7f34(gp)            |     a3 = *(gp);
    0x0002bab8 lw a1, -0x7f34(gp)            |     a1 = *(gp);
    0x0002babc lw v0, 0x6c(sp)               |     v0 = *(var_6ch);
    0x0002bac0 lw t9, -0x7c50(gp)            |     t9 = sym.xasprintf;
    0x0002bac4 lw a2, 0x3c(sp)               |     a2 = *(var_3ch);
    0x0002bac8 sw v0, 0x10(sp)               |     *(var_10h) = v0;
                                             |     /* str._bin_sh */
    0x0002bacc addiu a3, a3, -0x4aac         |     a3 += -aav.0x00004aac;
                                             |     /* str._s__c__s__s */
    0x0002bad0 addiu a1, a1, -0x2f9c         |     a1 += -0x2f9c;
    0x0002bad4 addiu a0, sp, 0x68            |     a0 = sp + 0x68;
    0x0002bad8 jalr t9                       |     t9 ();
    0x0002badc addiu v1, zero, -1            |     v1 = -1;
    0x0002bae0 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == v1) {
    0x0002bae4 beq v0, v1, 0x2bf20           |         goto label_65;
                                             |     }
    0x0002bae8 lw v0, (s2)                   |     v0 = *(s2);
    0x0002baec lw v0, -0x6f44(gp)            |     v0 = *((gp - 7121));
                                             |     if (v0 != 0) {
    0x0002baf0 bnez v0, 0x2befc              |         goto label_66;
                                             |     }
                                             | label_30:
    0x0002baf4 lw a1, -0x7fb4(gp)            |     a1 = *(gp);
    0x0002baf8 lw t9, -0x6e0c(gp)            |     t9 = sym.imp.popen
    0x0002bafc lw a0, 0x68(sp)               |     a0 = *(var_68h);
    0x0002bb00 addiu a1, a1, 0x704c          |     a1 += 0x704c;
    0x0002bb04 jalr t9                       |     t9 ();
    0x0002bb08 move s2, v0                   |     s2 = v0;
    0x0002bb0c lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 != 0) {
    0x0002bb10 bnez v0, 0x2b3dc              |         goto label_20;
                                             |     }
    0x0002bb14 lw v0, -0x6f44(gp)            |     v0 = *((gp - 7121));
    0x0002bb18 lw t9, -0x6ce8(gp)            |     t9 = sym.imp.__fprintf_chk;
    0x0002bb1c lw a3, 0x6c(sp)               |     a3 = *(var_6ch);
    0x0002bb20 lw a0, (v0)                   |     a0 = *(v0);
    0x0002bb24 b 0x2bdb8                     |     goto label_67;
                                             | label_53:
    0x0002bb28 lw v0, 0xc(s0)                |     v0 = *((s0 + 3));
    0x0002bb2c lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002bb30 lw a0, -0x7f34(gp)            |     a0 = *(gp);
    0x0002bb34 lw t9, -0x7e68(gp)            |     t9 = sym.setproctitle;
    0x0002bb38 lw a1, (v0)                   |     a1 = *(v0);
                                             |     /* str.internal_sftp */
    0x0002bb3c addiu a2, a2, -0x2e70         |     a2 += -0x2e70;
                                             |     /* str._s__s */
    0x0002bb40 addiu a0, a0, -0x2e60         |     a0 += -0x2e60;
    0x0002bb44 jalr t9                       |     t9 ();
    0x0002bb48 lw v0, 0x38(sp)               |     v0 = *(var_38h);
    0x0002bb4c lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == 0) {
    0x0002bb50 beqz v0, 0x2bdd0              |         goto label_68;
                                             |     }
                                             | label_27:
    0x0002bb54 lw t9, -0x7ef4(gp)            |     t9 = sym.xstrdup;
    0x0002bb58 lw s2, -0x7e48(gp)            |     s2 = *(gp);
    0x0002bb5c lw a0, 0x38(sp)               |     a0 = *(var_38h);
    0x0002bb60 jalr t9                       |     t9 ();
    0x0002bb64 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bb68 addiu a1, s2, -0x52c8         |     a1 = s2 + -0x52c8;
    0x0002bb6c lw t9, -0x7090(gp)            |     t9 = sym.imp.strtok;
    0x0002bb70 move a0, v0                   |     a0 = v0;
    0x0002bb74 jalr t9                       |     t9 ();
    0x0002bb78 move s1, v0                   |     s1 = v0;
    0x0002bb7c lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 == 0) {
    0x0002bb80 beqz v0, 0x2bbd8              |         goto label_69;
                                             |     }
    0x0002bb84 addiu s2, s2, -0x52c8         |     s2 += -0x52c8;
                                             |     do {
    0x0002bb88 slti v0, s7, 9                |         v0 = (s7 < 9) ? 1 : 0;
    0x0002bb8c lw t9, -0x7090(gp)            |         t9 = sym.imp.strtok;
                                             |         if (v0 != 0) {
    0x0002bb90 beqz v0, 0x2bbc0              |             
    0x0002bb94 lw t9, -0x7f44(gp)            |             t9 = *(gp);
    0x0002bb98 move a0, s7                   |             a0 = s7;
    0x0002bb9c addiu a1, zero, 1             |             a1 = 1;
    0x0002bba0 jalr t9                       |             t9 ();
    0x0002bba4 sll s7, s7, 2                 |             s7 <<= 2;
    0x0002bba8 addiu v1, sp, 0x718           |             v1 = sp + 0x718;
    0x0002bbac addu v1, v1, s7               |             v1 += s7;
    0x0002bbb0 lw gp, 0x28(sp)               |             gp = *(var_28h);
    0x0002bbb4 move s7, v0                   |             s7 = v0;
    0x0002bbb8 sw s1, -0x6a8(v1)             |             *((v1 - 426)) = s1;
    0x0002bbbc lw t9, -0x7090(gp)            |             t9 = sym.imp.strtok;
                                             |         }
    0x0002bbc0 move a1, s2                   |         a1 = s2;
    0x0002bbc4 move a0, zero                 |         a0 = 0;
    0x0002bbc8 jalr t9                       |         t9 ();
    0x0002bbcc move s1, v0                   |         s1 = v0;
    0x0002bbd0 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002bbd4 bnez v0, 0x2bb88              |         
                                             |     } while (v0 != 0);
                                             | label_69:
    0x0002bbd8 addiu v1, sp, 0x718           |     v1 = sp + 0x718;
    0x0002bbdc sll v0, s7, 2                 |     v0 = s7 << 2;
    0x0002bbe0 addu v0, v1, v0               |     v0 = v1 + v0;
    0x0002bbe4 lw v1, -0x7964(gp)            |     v1 = *(gp);
    0x0002bbe8 sw zero, -0x6a8(v0)           |     *((v0 - 426)) = 0;
    0x0002bbec addiu v0, zero, 1             |     v0 = 1;
    0x0002bbf0 sw v0, (v1)                   |     *(v1) = v0;
    0x0002bbf4 lw v1, -0x7e90(gp)            |     v1 = *(gp);
    0x0002bbf8 lw t9, -0x7960(gp)            |     t9 = sym.sftp_server_main;
    0x0002bbfc lw a2, 0xc(s0)                |     a2 = *((s0 + 3));
    0x0002bc00 sw v0, (v1)                   |     *(v1) = v0;
    0x0002bc04 lw v0, -0x6d10(gp)            |     v0 = *((gp - 6980));
    0x0002bc08 lw v1, 0x70(sp)               |     v1 = *(var_70h);
    0x0002bc0c move a0, s7                   |     a0 = s7;
    0x0002bc10 move a1, s4                   |     a1 = s4;
    0x0002bc14 sw v1, (v0)                   |     *(v0) = v1;
    0x0002bc18 bal 0x46c20                   |     sym_sftp_server_main ();
    0x0002bc1c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bc20 lw t9, -0x7210(gp)            |     t9 = sym.imp.exit;
    0x0002bc24 move a0, v0                   |     a0 = v0;
    0x0002bc28 jalr t9                       |     t9 ();
                                             | label_52:
    0x0002bc2c lw v0, 0x50(sp)               |     v0 = *(var_50h);
    0x0002bc30 lw a1, -0x7f34(gp)            |     a1 = *(gp);
    0x0002bc34 sw v0, 0x1c(sp)               |     *(var_1ch) = v0;
    0x0002bc38 lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002bc3c lw a0, -0x7f34(gp)            |     a0 = *(gp);
                                             |     /* str.Connection_from__s:_refusing_non_sftp_session */
    0x0002bc40 addiu v0, v0, -0x2ecc         |     v0 += -0x2ecc;
    0x0002bc44 lw t9, -0x7f6c(gp)            |     t9 = sym.sshlog;
    0x0002bc48 sw v0, 0x18(sp)               |     *(var_18h) = v0;
    0x0002bc4c addiu v0, zero, 2             |     v0 = 2;
    0x0002bc50 move a3, zero                 |     a3 = 0;
    0x0002bc54 addiu a2, zero, 0x670         |     a2 = 0x670;
                                             |     /* str.do_child */
    0x0002bc58 addiu a1, a1, -0x2104         |     a1 += -0x2104;
                                             |     /* str.session.c */
    0x0002bc5c addiu a0, a0, -0x3620         |     a0 += -0x3620;
    0x0002bc60 sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002bc64 sw zero, 0x14(sp)             |     *(var_14h) = 0;
    0x0002bc68 jalr t9                       |     t9 ();
    0x0002bc6c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bc70 lw a0, -0x7f34(gp)            |     a0 = *(gp);
    0x0002bc74 lw t9, -0x7114(gp)            |     t9 = sym.imp.puts;
                                             |     /* str.This_service_allows_sftp_connections_only. */
    0x0002bc78 addiu a0, a0, -0x2e9c         |     a0 += -0x2e9c;
    0x0002bc7c jalr t9                       |     t9 ();
    0x0002bc80 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bc84 lw t9, -0x6ec0(gp)            |     t9 = sym.imp.fflush;
    0x0002bc88 move a0, zero                 |     a0 = 0;
    0x0002bc8c jalr t9                       |     t9 ();
    0x0002bc90 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bc94 lw t9, -0x7210(gp)            |     t9 = sym.imp.exit;
    0x0002bc98 addiu a0, zero, 1             |     a0 = 1;
    0x0002bc9c jalr t9                       |     t9 ();
                                             | label_49:
    0x0002bca0 lw a3, -0x7f34(gp)            |     a3 = *(gp);
    0x0002bca4 lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002bca8 lw t9, -0x6ce8(gp)            |     t9 = sym.imp.__fprintf_chk;
                                             |     /* esilref: '/etc/ssh/sshrc' */
    0x0002bcac addiu v0, s5, -0x2f44         |     v0 = s5 + -0x2f44;
    0x0002bcb0 lw a0, (v1)                   |     a0 = *(v1);
                                             |     /* str._bin_sh */
    0x0002bcb4 addiu a3, a3, -0x4aac         |     a3 += -aav.0x00004aac;
    0x0002bcb8 sw v0, 0x10(sp)               |     *(var_10h) = v0;
                                             |     /* str.Running__s__s_n */
    0x0002bcbc addiu a2, a2, -0x2f5c         |     a2 += -0x2f5c;
    0x0002bcc0 addiu a1, zero, 1             |     a1 = 1;
    0x0002bcc4 jalr t9                       |     t9 ();
    0x0002bcc8 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bccc b 0x2b3b8                     |     goto label_21;
                                             | label_57:
    0x0002bcd0 lw a0, -0x7f34(gp)            |     a0 = *(gp);
    0x0002bcd4 lw t9, -0x702c(gp)            |     t9 = sym.imp.fwrite;
    0x0002bcd8 lw a3, (s1)                   |     a3 = *(s1);
    0x0002bcdc addiu a2, zero, 0x2f          |     a2 = 0x2f;
    0x0002bce0 addiu a1, zero, 1             |     a1 = 1;
                                             |     /* str.Password_change_required_but_no_TTY_available._n */
    0x0002bce4 addiu a0, a0, -0x31cc         |     a0 += -0x31cc;
    0x0002bce8 jalr t9                       |     t9 ();
    0x0002bcec lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bcf0 b 0x2b798                     |     goto label_22;
                                             | label_63:
    0x0002bcf4 lw v0, 0x58(sp)               |     v0 = *(var_58h);
    0x0002bcf8 lw t9, -0x6ce8(gp)            |     t9 = sym.imp.__fprintf_chk;
    0x0002bcfc lw a3, 0x34(sp)               |     a3 = *(var_34h);
    0x0002bd00 lw a0, (v0)                   |     a0 = *(v0);
    0x0002bd04 lw v0, 0x54(sp)               |     v0 = *(var_54h);
    0x0002bd08 lw a2, 0x5c(sp)               |     a2 = *(var_5ch);
    0x0002bd0c sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002bd10 addiu a1, zero, 1             |     a1 = 1;
    0x0002bd14 jalr t9                       |     t9 ();
    0x0002bd18 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bd1c b 0x2b858                     |     goto label_17;
                                             | label_51:
    0x0002bd20 lw v0, 0x90(s0)               |     v0 = *((s0 + 36));
    0x0002bd24 lw t9, -0x6ce8(gp)            |     t9 = sym.imp.__fprintf_chk;
    0x0002bd28 lw a3, 0x8c(s0)               |     a3 = *((s0 + 35));
                                             |     /* esilref: '&s &s
' */
    0x0002bd2c addiu a2, a2, -0x2f54         |     a2 += -0x2f54;
    0x0002bd30 sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002bd34 addiu a1, zero, 1             |     a1 = 1;
    0x0002bd38 move a0, s2                   |     a0 = s2;
    0x0002bd3c jalr t9                       |     t9 ();
    0x0002bd40 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bd44 b 0x2b3e4                     |     goto label_14;
                                             | label_55:
    0x0002bd48 lw t9, -0x7ccc(gp)            |     t9 = sym.strlcpy;
    0x0002bd4c move a1, v0                   |     a1 = v0;
    0x0002bd50 addiu v0, zero, 0x2d          |     v0 = 0x2d;
    0x0002bd54 addiu a2, zero, 0xff          |     a2 = 0xff;
    0x0002bd58 addiu a0, sp, 0x315           |     a0 = sp + 0x315;
    0x0002bd5c sb v0, 0x314(sp)              |     *(var_314h) = v0;
    0x0002bd60 jalr t9                       |     t9 ();
    0x0002bd64 sltiu v0, v0, 0xff            |     v0 = (v0 < 0xff) ? 1 : 0;
    0x0002bd68 lw gp, 0x28(sp)               |     gp = *(var_28h);
                                             |     if (v0 != 0) {
    0x0002bd6c bnez v0, 0x2bde0              |         goto label_70;
                                             |     }
    0x0002bd70 lw t9, -0x6c58(gp)            |     t9 = sym.imp.__errno_location;
    0x0002bd74 jalr t9                       |     t9 ();
    0x0002bd78 nop                           |     
    0x0002bd7c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bd80 addiu v1, zero, 0x16          |     v1 = 0x16;
    0x0002bd84 lw a0, 0x3c(sp)               |     a0 = *(var_3ch);
    0x0002bd88 lw t9, -0x6e2c(gp)            |     t9 = sym.imp.perror;
    0x0002bd8c sw v1, (v0)                   |     *(v0) = v1;
    0x0002bd90 b 0x2b4b4                     |     goto label_23;
                                             | label_54:
    0x0002bd94 lw v0, 0x3c(sp)               |     v0 = *(var_3ch);
    0x0002bd98 b 0x2b468                     |     goto label_24;
                                             | label_35:
    0x0002bd9c addiu s2, sp, 0x60            |     s2 = sp + 0x60;
    0x0002bda0 addiu s1, sp, 0x64            |     s1 = sp + 0x64;
    0x0002bda4 b 0x2ade0                     |     goto label_25;
                                             | label_50:
    0x0002bda8 lw v0, -0x6f44(gp)            |     v0 = *((gp - 7121));
    0x0002bdac lw t9, -0x6ce8(gp)            |     t9 = sym.imp.__fprintf_chk;
                                             |     /* esilref: '/etc/ssh/sshrc' */
    0x0002bdb0 addiu a3, s5, -0x2f44         |     a3 = s5 + -0x2f44;
    0x0002bdb4 lw a0, (v0)                   |     a0 = *(v0);
                                             |     do {
                                             | label_67:
    0x0002bdb8 lw a2, -0x7f34(gp)            |         a2 = *(gp);
    0x0002bdbc addiu a1, zero, 1             |         a1 = 1;
                                             |         /* str.Could_not_run__s_n */
    0x0002bdc0 addiu a2, a2, -0x2f70         |         a2 += -0x2f70;
    0x0002bdc4 jalr t9                       |         t9 ();
    0x0002bdc8 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002bdcc b 0x2b3f4                     |         goto label_26;
                                             | label_68:
    0x0002bdd0 lw v0, -0x7f34(gp)            |         v0 = *(gp);
                                             |         /* str.sftp_server */
    0x0002bdd4 addiu v0, v0, -0x324c         |         v0 += -aav.0x0000324c;
    0x0002bdd8 sw v0, 0x38(sp)               |         *(var_38h) = v0;
    0x0002bddc b 0x2bb54                     |         goto label_27;
                                             | label_70:
    0x0002bde0 lw s0, 0x3c(sp)               |         s0 = *(var_3ch);
    0x0002bde4 lw v0, 0x54(sp)               |         v0 = *(var_54h);
    0x0002bde8 lw t9, -0x7044(gp)            |         t9 = sym.imp.execve;
    0x0002bdec move a2, s1                   |         a2 = s1;
    0x0002bdf0 move a1, s4                   |         a1 = s4;
    0x0002bdf4 move a0, s0                   |         a0 = s0;
    0x0002bdf8 sw v0, 0x70(sp)               |         *(var_70h) = v0;
    0x0002bdfc sw zero, 0x74(sp)             |         *(var_74h) = 0;
    0x0002be00 b 0x2b4a0                     |         goto label_28;
                                             | label_60:
    0x0002be04 lw a2, -0x7f34(gp)            |         a2 = *(gp);
    0x0002be08 lw v0, 0x88(s0)               |         v0 = *((s0 + 34));
    0x0002be0c lw t9, -0x6ce8(gp)            |         t9 = sym.imp.__fprintf_chk;
    0x0002be10 lw a0, (s2)                   |         a0 = *(s2);
                                             |         /* str.Running__.500s_remove__.100s_n */
    0x0002be14 addiu a2, a2, -0x2f34         |         a2 += -0x2f34;
    0x0002be18 addiu a1, zero, 1             |         a1 = 1;
    0x0002be1c sw v0, 0x10(sp)               |         *(var_10h) = v0;
    0x0002be20 jalr t9                       |         t9 ();
    0x0002be24 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002be28 lw a1, 0x90(s0)               |         a1 = *((s0 + 36));
    0x0002be2c lw v1, 0x8c(s0)               |         v1 = *((s0 + 35));
    0x0002be30 lw v0, 0x88(s0)               |         v0 = *((s0 + 34));
    0x0002be34 lw a2, -0x7f34(gp)            |         a2 = *(gp);
    0x0002be38 lw a3, 0x464(s3)              |         a3 = *(s3);
    0x0002be3c lw a0, (s2)                   |         a0 = *(s2);
    0x0002be40 lw t9, -0x6ce8(gp)            |         t9 = sym.imp.__fprintf_chk;
    0x0002be44 sw a1, 0x18(sp)               |         *(var_18h) = a1;
    0x0002be48 sw v1, 0x14(sp)               |         *(var_14h) = v1;
    0x0002be4c sw v0, 0x10(sp)               |         *(var_10h) = v0;
                                             |         /* str._.500s_add__.100s__.100s__.100s_n */
    0x0002be50 addiu a2, a2, -0x2f14         |         a2 += -0x2f14;
    0x0002be54 addiu a1, zero, 1             |         a1 = 1;
    0x0002be58 jalr t9                       |         t9 ();
    0x0002be5c lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002be60 b 0x2b8dc                     |         goto label_29;
                                             | label_62:
    0x0002be64 lw v0, -0x6f44(gp)            |         v0 = *((gp - 7121));
    0x0002be68 lw t9, -0x6ce8(gp)            |         t9 = sym.imp.__fprintf_chk;
    0x0002be6c lw a3, 0x68(sp)               |         a3 = *(var_68h);
    0x0002be70 lw a0, (v0)                   |         a0 = *(v0);
    0x0002be74 b 0x2bdb8                     |         
                                             |     } while (1);
                                             | label_58:
    0x0002be78 lw v0, 0x54(sp)               |     v0 = *(var_54h);
    0x0002be7c lw a1, -0x7f34(gp)            |     a1 = *(gp);
    0x0002be80 sw v0, 0x1c(sp)               |     *(var_1ch) = v0;
    0x0002be84 lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002be88 lw a0, -0x7f34(gp)            |     a0 = *(gp);
                                             |     /* str.Too_many_lines_in_environment_file__s */
    0x0002be8c addiu v0, v0, -0x30c0         |     v0 += -0x30c0;
    0x0002be90 sw v0, 0x18(sp)               |     *(var_18h) = v0;
    0x0002be94 lw t9, -0x7f74(gp)            |     t9 = sym.sshfatal;
    0x0002be98 addiu v0, zero, 1             |     v0 = 1;
    0x0002be9c sw zero, 0x14(sp)             |     *(var_14h) = 0;
    0x0002bea0 sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002bea4 move a3, zero                 |     a3 = 0;
    0x0002bea8 addiu a2, zero, 0x35c         |     a2 = aav.0x0000035c;
                                             |     /* str.read_environment_file */
    0x0002beac addiu a1, a1, -0x2138         |     a1 += -0x2138;
                                             |     /* str.session.c */
    0x0002beb0 addiu a0, a0, -0x3620         |     a0 += -0x3620;
    0x0002beb4 jalr t9                       |     t9 ();
                                             | label_43:
    0x0002beb8 lw v0, 0x1140(s3)             |     v0 = *((s3 + 1104));
    0x0002bebc lw a1, -0x7f34(gp)            |     a1 = *(gp);
    0x0002bec0 lw a0, -0x7f34(gp)            |     a0 = *(gp);
    0x0002bec4 lwx v1, v1(v0)                |     __asm ("lwx v1, v1(v0)");
    0x0002bec8 lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002becc lw t9, -0x7f74(gp)            |     t9 = sym.sshfatal;
                                             |     /* str.Invalid_config_SetEnv:__s */
    0x0002bed0 addiu v0, v0, -0x3044         |     v0 += -0x3044;
    0x0002bed4 sw v0, 0x18(sp)               |     *(var_18h) = v0;
    0x0002bed8 addiu v0, zero, 1             |     v0 = 1;
    0x0002bedc sw v1, 0x1c(sp)               |     *(var_1ch) = v1;
    0x0002bee0 sw zero, 0x14(sp)             |     *(var_14h) = 0;
    0x0002bee4 sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002bee8 move a3, zero                 |     a3 = 0;
    0x0002beec addiu a2, zero, 0x487         |     a2 = 0x487;
                                             |     /* str.do_setup_env */
    0x0002bef0 addiu a1, a1, -0x2120         |     a1 += -0x2120;
                                             |     /* str.session.c */
    0x0002bef4 addiu a0, a0, -0x3620         |     a0 += -0x3620;
    0x0002bef8 jalr t9                       |     t9 ();
                                             | label_66:
    0x0002befc lw a2, -0x7f34(gp)            |     a2 = *(gp);
    0x0002bf00 lw t9, -0x6ce8(gp)            |     t9 = sym.imp.__fprintf_chk;
    0x0002bf04 lw a3, 0x68(sp)               |     a3 = *(var_68h);
    0x0002bf08 lw a0, (v0)                   |     a0 = *(v0);
                                             |     /* str.Running__s_n */
    0x0002bf0c addiu a2, a2, -0x2f7c         |     a2 += -0x2f7c;
    0x0002bf10 addiu a1, zero, 1             |     a1 = 1;
    0x0002bf14 jalr t9                       |     t9 ();
    0x0002bf18 lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bf1c b 0x2baf4                     |     goto label_30;
                                             | label_65:
    0x0002bf20 lw t9, -0x6c58(gp)            |     t9 = sym.imp.__errno_location;
    0x0002bf24 jalr t9                       |     t9 ();
    0x0002bf28 nop                           |     
    0x0002bf2c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bf30 lw t9, -0x6c90(gp)            |     t9 = sym.imp.strerror;
    0x0002bf34 lw a0, (v0)                   |     a0 = *(v0);
    0x0002bf38 jalr t9                       |     t9 ();
    0x0002bf3c lw gp, 0x28(sp)               |     gp = *(var_28h);
    0x0002bf40 sw v0, 0x1c(sp)               |     *(var_1ch) = v0;
    0x0002bf44 sw zero, 0x14(sp)             |     *(var_14h) = 0;
    0x0002bf48 lw v0, -0x7f34(gp)            |     v0 = *(gp);
    0x0002bf4c lw t9, -0x7f74(gp)            |     t9 = sym.sshfatal;
                                             |     /* str.xasprintf:__s */
    0x0002bf50 addiu v0, v0, -0x2f8c         |     v0 += -0x2f8c;
    0x0002bf54 sw v0, 0x18(sp)               |     *(var_18h) = v0;
    0x0002bf58 addiu v0, zero, 1             |     v0 = 1;
    0x0002bf5c sw v0, 0x10(sp)               |     *(var_10h) = v0;
    0x0002bf60 addiu a3, zero, 1             |     a3 = 1;
    0x0002bf64 addiu a2, zero, 0x4c3         |     a2 = 0x4c3;
                                             |     do {
    0x0002bf68 lw a1, -0x7f34(gp)            |         a1 = *(gp);
    0x0002bf6c lw a0, -0x7f34(gp)            |         a0 = *(gp);
                                             |         /* str.do_rc_files */
    0x0002bf70 addiu a1, a1, -0x2144         |         a1 += -0x2144;
                                             |         /* str.session.c */
    0x0002bf74 addiu a0, a0, -0x3620         |         a0 += -0x3620;
    0x0002bf78 jalr t9                       |         t9 ();
                                             | label_61:
    0x0002bf7c lw t9, -0x6c58(gp)            |         t9 = sym.imp.__errno_location;
    0x0002bf80 jalr t9                       |         t9 ();
    0x0002bf84 nop                           |         
    0x0002bf88 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002bf8c lw t9, -0x6c90(gp)            |         t9 = sym.imp.strerror;
    0x0002bf90 lw a0, (v0)                   |         a0 = *(v0);
    0x0002bf94 jalr t9                       |         t9 ();
    0x0002bf98 lw gp, 0x28(sp)               |         gp = *(var_28h);
    0x0002bf9c sw v0, 0x1c(sp)               |         *(var_1ch) = v0;
    0x0002bfa0 sw zero, 0x14(sp)             |         *(var_14h) = 0;
    0x0002bfa4 lw v0, -0x7f34(gp)            |         v0 = *(gp);
    0x0002bfa8 lw t9, -0x7f74(gp)            |         t9 = sym.sshfatal;
                                             |         /* str.xasprintf:__s */
    0x0002bfac addiu v0, v0, -0x2f8c         |         v0 += -0x2f8c;
    0x0002bfb0 sw v0, 0x18(sp)               |         *(var_18h) = v0;
    0x0002bfb4 addiu v0, zero, 1             |         v0 = 1;
    0x0002bfb8 sw v0, 0x10(sp)               |         *(var_10h) = v0;
    0x0002bfbc addiu a3, zero, 1             |         a3 = 1;
    0x0002bfc0 addiu a2, zero, 0x4e8         |         a2 = 0x4e8;
    0x0002bfc4 b 0x2bf68                     |         
                                             |     } while (1);
                                             | }

[*] Function popen used 4 times sshd