/* This file was generated by the Hex-Rays decompiler version 8.3.0.230608.
   Copyright (c) 2007-2021 Hex-Rays <info@hex-rays.com>

   Detected compiler: GNU C++
*/

#include <defs.h>


//-------------------------------------------------------------------------
// Function declarations

void *init_proc();
__int64 sub_4004B0(); // weak
// int system(const char *command);
// ssize_t read(int fd, void *buf, size_t nbytes);
// int __fastcall __libc_start_main(int (__fastcall *main)(int, char **, char **), int argc, char **ubp_av, void (*init)(void), void (*fini)(void), void (*rtld_fini)(void), void *stack_end);
// __int64 __gmon_start__(void); weak
void __fastcall __noreturn start(__int64 a1, __int64 a2, void (*a3)(void));
signed __int64 deregister_tm_clones();
__int64 register_tm_clones(void); // weak
signed __int64 _do_global_dtors_aux();
__int64 __fastcall frame_dummy(_QWORD, _QWORD, _QWORD); // weak
ssize_t vulnerable_function();
int __fastcall main(int argc, const char **argv, const char **envp);
void _libc_csu_fini(void); // idb
void term_proc();

//-------------------------------------------------------------------------
// Data declarations

_UNKNOWN _libc_csu_init;
__int64 (__fastcall *_frame_dummy_init_array_entry[2])() = { &frame_dummy, &_do_global_dtors_aux }; // weak
__int64 (__fastcall *_do_global_dtors_aux_fini_array_entry)() = &_do_global_dtors_aux; // weak
__int64 (*qword_600A58)(void) = NULL; // weak
char _bss_start; // weak
_UNKNOWN unk_600A9F; // weak
// extern _UNKNOWN _gmon_start__; weak


//----- (0000000000400488) ----------------------------------------------------
void *init_proc()
{
  void *result; // rax

  result = &_gmon_start__;
  if ( &_gmon_start__ )
    return (void *)__gmon_start__();
  return result;
}
// 4004F0: using guessed type __int64 __gmon_start__(void);

//----- (00000000004004B0) ----------------------------------------------------
__int64 sub_4004B0()
{
  return qword_600A58();
}
// 4004B0: using guessed type __int64 sub_4004B0();
// 600A58: using guessed type __int64 (*qword_600A58)(void);

//----- (0000000000400500) ----------------------------------------------------
// positive sp value has been detected, the output may be wrong!
void __fastcall __noreturn start(__int64 a1, __int64 a2, void (*a3)(void))
{
  __int64 v3; // rax
  int v4; // esi
  __int64 v5; // [rsp-8h] [rbp-8h] BYREF
  char *retaddr; // [rsp+0h] [rbp+0h] BYREF

  v4 = v5;
  v5 = v3;
  __libc_start_main(
    (int (__fastcall *)(int, char **, char **))main,
    v4,
    &retaddr,
    (void (*)(void))_libc_csu_init,
    _libc_csu_fini,
    a3,
    &v5);
  __halt();
}
// 400506: positive sp value 8 has been found
// 40050D: variable 'v3' is possibly undefined

//----- (0000000000400530) ----------------------------------------------------
signed __int64 deregister_tm_clones()
{
  signed __int64 result; // rax

  result = &unk_600A9F - (_UNKNOWN *)&_bss_start;
  if ( (unsigned __int64)(&unk_600A9F - (_UNKNOWN *)&_bss_start) > 0xE )
    return 0LL;
  return result;
}
// 600A98: using guessed type char _bss_start;

//----- (0000000000400570) ----------------------------------------------------
__int64 register_tm_clones()
{
  return 0LL;
}
// 400570: using guessed type __int64 register_tm_clones();

//----- (00000000004005B0) ----------------------------------------------------
signed __int64 _do_global_dtors_aux()
{
  signed __int64 result; // rax

  if ( !_bss_start )
  {
    result = deregister_tm_clones();
    _bss_start = 1;
  }
  return result;
}
// 600A98: using guessed type char _bss_start;

//----- (00000000004005D0) ----------------------------------------------------
__int64 frame_dummy()
{
  return register_tm_clones();
}
// 4005D0: could not find valid save-restore pair for rbp
// 400570: using guessed type __int64 register_tm_clones(void);
// 4005D0: using guessed type __int64 frame_dummy();

//----- (00000000004005F6) ----------------------------------------------------
ssize_t vulnerable_function()
{
  char buf[128]; // [rsp+0h] [rbp-80h] BYREF

  system("echo Input:");
  return read(0, buf, 0x200uLL);
}
// 4005F6: using guessed type char buf[128];

//----- (0000000000400620) ----------------------------------------------------
int __fastcall main(int argc, const char **argv, const char **envp)
{
  vulnerable_function();
  return system("echo 'Hello World!'");
}

//----- (0000000000400650) ----------------------------------------------------
void __fastcall _libc_csu_init(unsigned int a1, __int64 a2, __int64 a3)
{
  __int64 v4; // rbx
  signed __int64 v5; // rbp

  v4 = 0LL;
  v5 = &_do_global_dtors_aux_fini_array_entry - _frame_dummy_init_array_entry;
  init_proc();
  if ( v5 )
  {
    do
      ((void (__fastcall *)(_QWORD, __int64, __int64))_frame_dummy_init_array_entry[v4++])(a1, a2, a3);
    while ( v4 != v5 );
  }
}
// 4005D0: using guessed type __int64 __fastcall frame_dummy(_QWORD, _QWORD, _QWORD);
// 600848: using guessed type __int64 (__fastcall *_frame_dummy_init_array_entry[2])();
// 600850: using guessed type __int64 (__fastcall *_do_global_dtors_aux_fini_array_entry)();

//----- (00000000004006C4) ----------------------------------------------------
void term_proc()
{
  ;
}

// nfuncs=20 queued=11 decompiled=11 lumina nreq=0 worse=0 better=0
// ALL OK, 11 function(s) have been successfully decompiled
