[*] Binary protection state of cgibin
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of cgibin
addiu v0, zero, 2
b 0x404718
sw a1, 0x118(s1)
beqz s0, 0x4044b8
addiu v0, zero, 2
lw v0, 0x114(s1)
nop
bnez v0, 0x4041d4
nop
lw t9, -sym.sobj_empty(gp)
lw a0, 0x128(s1)
sw a1, (s1)
jalr t9
sw zero, 0x118(s1)
lw gp, 0x18(sp)
bnez v0, 0x404718
nop
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
addiu s0, sp, 0x30
lui v1, 0x43
lw a3, 0xdd0(v1)
lw gp, 0x18(sp)
addiu v1, a3, 1
lw t9, -sym.imp.sprintf(gp)
lui a0, 0x43
lui a1, 0x42
sw v1, 0xdd0(a0)
move a2, v0
move a0, s0
jalr t9
addiu a1, a1, -0x2480
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.fopen(gp)
addiu a1, a1, -0x2468
jalr t9
move a0, s0
lw gp, 0x18(sp)
beqz v0, 0x404718
sw v0, 0x12c(s1)
lw t9, -sym.sobj_free(gp)
lw a0, 0x128(s1)
jalr t9
nop
--
lw t9, -sym.sobj_get_length(gp)
beqz s0, 0x4051b0
move a0, s0
jalr t9
nop
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.sobj_strncasecmp(gp)
addiu a1, a1, -0x22ac
addiu a2, zero, 0xe
beqz v0, 0x4051b0
move a0, s0
jalr t9
nop
lw gp, 0x10(sp)
nop
lw v1, -sym.sobj_get_length(gp)
lw t9, -sym.sobj_get_string(gp)
bnez v0, 0x405168
move a0, s0
move t9, v1
jalr t9
move a0, s3
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a2, v0
move a0, fp
jalr t9
addiu a1, a1, -0x229c
lw gp, 0x10(sp)
move a0, s5
lw t9, -sym.imp.strcat(gp)
nop
jalr t9
move a1, fp
lw gp, 0x10(sp)
b 0x4051a4
addiu s2, s2, 1
jalr t9
nop
lw gp, 0x10(sp)
move a1, v0
lw t9, -sym.imp.strcat(gp)
nop
jalr t9
move a0, s5
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.strcat(gp)
move a0, s5
jalr t9
addiu a1, a1, -0x1c3c
lw gp, 0x10(sp)
addiu s1, s1, 4
bne s7, s1, 0x4050c8
nop
bnez s2, 0x405208
nop
lw t9, -sym.sobj_get_length(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
addiu s0, sp, 0x18
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
addiu a1, a1, -0x229c
move a2, v0
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a1, s0
lw t9, -sym.imp.strcat(gp)
nop
jalr t9
move a0, s5
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.strcat(gp)
lui a1, 0x42
addiu a1, a1, -0x1c3c
jalr t9
move a0, s5
lw gp, 0x10(sp)
move a0, s3
--
lui a3, 0x42
sw v0, 0x14(sp)
sw zero, 0x10(sp)
addiu a1, a1, -0x1ff0
addiu a2, a2, -0x1fe4
addiu a3, a3, -0x1fdc
jalr t9
addiu a0, zero, 1
b 0x4059cc
nop
lui a1, 0x42
addiu a1, a1, -0x1fc8
lw t9, -sym.cgibin_print_http_status(gp)
nop
jalr t9
move a2, a1
lw gp, 0x18(sp)
b 0x405ac4
nop
lw t9, -sym.sess_validate(gp)
nop
jalr t9
addiu s0, sp, 0x20
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a2, v0
move a0, s0
jalr t9
addiu a1, a1, -0x1fac
lw gp, 0x18(sp)
move a1, s0
lw t9, -sym.sobj_add_string(gp)
nop
jalr t9
move a0, s1
lw gp, 0x18(sp)
move a0, s1
lw t9, -sym.sobj_add_char(gp)
nop
jalr t9
addiu a1, zero, 0xa
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.sobj_add_string(gp)
addiu a1, a1, -0x1f98
--
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
beqz fp, 0x406380
lui a0, 0x42
lw t9, -sym.imp.system(gp)
nop
jalr t9
addiu a0, a0, -0x1e84
lw gp, 0x10(sp)
lui a0, 0x42
lw t9, -sym.imp.unlink(gp)
nop
jalr t9
addiu a0, a0, -0x1e98
lw gp, 0x10(sp)
addiu s4, s4, 1
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
addiu s2, sp, 0x28
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
addiu a1, a1, -0x1e60
move a2, s1
jalr t9
move a0, s2
lw gp, 0x10(sp)
lui a0, 0x42
lw t9, -sym.imp.fopen(gp)
lui a1, 0x42
addiu a0, a0, -0x1e5c
jalr t9
addiu a1, a1, -0x2468
lw gp, 0x10(sp)
beqz v0, 0x406668
move s0, v0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
--
move a3, s0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s0
lw gp, 0x10(sp)
b 0x40666c
move s0, zero
beqz s7, 0x406518
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
lui v0, 0x43
lw t9, -sym.imp.rename(gp)
lw a0, 0xe60(v0)
lui a1, 0x42
jalr t9
addiu a1, a1, -0x1e44
lw gp, 0x10(sp)
addiu s2, sp, 0x28
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
addiu a1, a1, -0x1e60
move a2, s1
jalr t9
move a0, s2
lw gp, 0x10(sp)
lui a0, 0x42
lw t9, -sym.imp.fopen(gp)
lui a1, 0x42
addiu a0, a0, -0x1e30
jalr t9
addiu a1, a1, -0x2468
lw gp, 0x10(sp)
beqz v0, 0x4064ec
move s0, v0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
--
lw gp, 0x18(sp)
beqz v0, 0x4068e8
lui a0, 0x42
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, v0
lui v0, 0x42
b 0x40696c
addiu s0, v0, -0x1ffc
lw t9, -sym.imp.getenv(gp)
addiu a0, a0, -0x27f0
sw zero, 0x20(sp)
sw zero, 0x24(sp)
sw zero, 0x28(sp)
jalr t9
sw zero, 0x2c(sp)
lw gp, 0x18(sp)
move a0, v0
lw t9, -sym.imp.atoi(gp)
nop
jalr t9
addiu s2, sp, 0x20
lw gp, 0x18(sp)
lui s1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a2, v0
move a0, s2
jalr t9
addiu a1, s1, -0x79c
lw gp, 0x18(sp)
addiu s0, sp, 0x28
lw t9, -sym.imp.sprintf(gp)
addiu a1, s1, -0x79c
move a2, s5
jalr t9
move a0, s0
lw gp, 0x18(sp)
move a1, s0
lw t9, -sym.cgibin_print_http_status(gp)
move a2, s2
b 0x4069d0
addiu a0, zero, 0x19d
jal 0x40667c
move a0, s6
lw gp, 0x18(sp)
nop
lw t9, -sym.sobj_get_string(gp)
nop
jalr t9
move a0, s6
lw gp, 0x18(sp)
lui a2, 0x42
--
b 0x406e2c
addiu s1, v0, -0x1fe4
addiu s1, v0, -0x1d60
lw t9, -sym.sobj_get_string(gp)
nop
jalr t9
move a0, s4
lw gp, 0x18(sp)
move a0, s6
lw t9, -sym.sobj_get_string(gp)
nop
jalr t9
move s0, v0
lw gp, 0x18(sp)
sw v0, 0x14(sp)
lw t9, -sym.cgibin_print_http_resp(gp)
sw s7, 0x10(sp)
move a2, s1
move a3, s0
move a0, fp
jalr t9
move a1, s5
lw gp, 0x18(sp)
bnez s3, 0x406ec0
addiu s0, sp, 0x30
lw t9, -sym.imp.sprintf(gp)
lw a2, 0x1a0(sp)
lui a1, 0x42
move a0, s0
jalr t9
addiu a1, a1, -0x1d40
lw gp, 0x18(sp)
move a2, s0
lw t9, -sym.xmldbc_timer(gp)
move a0, zero
jalr t9
move a1, zero
lw gp, 0x18(sp)
b 0x406ed8
move s0, zero
lw t9, -sym.fwupgrade_log(gp)
nop
jalr t9
addiu a0, zero, 2
lw gp, 0x18(sp)
move s0, zero
--
nop
jalr t9
move a0, s0
lw gp, 0x10(sp)
beqz s1, 0x407e88
nop
lw t9, -sym.xs_close(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
lw ra, 0x2c(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 0x44
addiu sp, sp, -0x68
addiu gp, gp, -0x75f0
sw ra, 0x64(sp)
sw s2, 0x60(sp)
sw s1, 0x5c(sp)
sw s0, 0x58(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.sprintf(gp)
move a3, a1
addiu s0, sp, 0x18
move s1, a2
lui a1, 0x42
lui a2, 0x42
move s2, a0
addiu a1, a1, -0x1a58
addiu a2, a2, -0x1a50
jalr t9
move a0, s0
lw gp, 0x10(sp)
beqz s1, 0x407f08
addiu v0, zero, 1
bne s1, v0, 0x407fec
move a0, s0
b 0x407f70
addiu a1, zero, 0x302
lw t9, -sym.imp.open(gp)
move a0, s0
jalr t9
--
addiu s0, zero, -1
lw t9, -sym.imp.close(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
b 0x407ff0
nop
addiu s0, zero, -1
lw ra, 0x64(sp)
move v0, s0
lw s2, 0x60(sp)
lw s1, 0x5c(sp)
lw s0, 0x58(sp)
jr ra
addiu sp, sp, 0x68
lui gp, 0x44
addiu sp, sp, -0xa8
addiu gp, gp, -0x75f0
sw ra, 0xa4(sp)
sw s2, 0xa0(sp)
sw s1, 0x9c(sp)
sw s0, 0x98(sp)
sw gp, 0x10(sp)
addiu s1, sp, 0x18
lw t9, -sym.imp.sprintf(gp)
move s2, a1
lui a2, 0x42
lui a1, 0x42
move s0, a0
addiu a3, a0, 8
addiu a2, a2, -0x1a40
move a0, s1
jalr t9
addiu a1, a1, -0x1564
lw gp, 0x10(sp)
move a2, s1
lw t9, -sym.xmldbc_del(gp)
move a0, zero
jalr t9
move a1, zero
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.imp.memset(gp)
move a1, zero
jalr t9
--
sw s1, 0x1d4(sp)
sw s0, 0x1d0(sp)
sw gp, 0x10(sp)
jal 0x407b10
addiu a0, sp, 0x18
lui v0, 0x42
addiu fp, v0, -0x1564
lui v0, 0x42
addiu s7, v0, -0x1a40
lui v0, 0x42
addiu s6, v0, -0x1a58
lui v0, 0x42
lw gp, 0x10(sp)
addiu s5, v0, -0x1a50
addiu s0, zero, 1
addiu s4, sp, 0xe8
addiu s2, sp, 0x68
addiu s3, sp, 0xf0
b 0x408490
addiu s1, sp, 0x28
jal 0x407ea0
nop
lw gp, 0x10(sp)
bnez v0, 0x40845c
move a3, s3
lw t9, -sym.imp.sprintf(gp)
move a0, s2
move a1, fp
jalr t9
move a2, s7
lw gp, 0x10(sp)
move a0, zero
lw t9, -sym.xmldbc_del(gp)
move a1, zero
jalr t9
move a2, s2
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.sprintf(gp)
move a3, s0
move a0, s1
move a1, s6
jalr t9
move a2, s5
lw gp, 0x10(sp)
move a0, s1
lw t9, -sym.imp.unlink(gp)
nop
jalr t9
addiu s0, s0, 1
lw gp, 0x10(sp)
lw v0, 0x1c(sp)
move a1, s0
slt v0, v0, s0
move a0, s4
beqz v0, 0x408414
move a2, zero
lw ra, 0x1f4(sp)
lw fp, 0x1f0(sp)
--
nop
lw t9, -sym.sess_generate_captcha(gp)
nop
jalr t9
addiu a0, sp, 0x18
lw gp, 0x10(sp)
bnez v0, 0x4093dc
move s1, v0
b 0x4093c4
lui a0, 0x42
lui a1, 0x42
lui a2, 0x42
lw t9, -sym.cgibin_print_http_status(gp)
addiu a1, a1, -0x7e4
addiu a2, a2, -0x1fc8
jalr t9
addiu a0, zero, 0x190
b 0x40942c
addiu s0, zero, -1
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, -0x19b4
b 0x40942c
move s0, zero
lw t9, -sym.imp.sprintf(gp)
addiu s0, sp, 0x100
lui a1, 0x42
addiu a1, a1, -0x1918
move a2, v0
addiu a3, sp, 0xf0
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.imp.system(gp)
nop
jalr t9
move s0, zero
lw gp, 0x10(sp)
lui a0, 0x42
lw t9, -sym.imp.printf(gp)
addiu a0, a0, -0x18c8
jalr t9
move a1, s1
jal 0x409200
--
jalr t9
nop
lw gp, 0x10(sp)
nop
lw t9, -sym.sobj_new(gp)
nop
jalr t9
move s5, v0
lw gp, 0x10(sp)
beqz s5, 0x40a31c
move fp, v0
beqz v0, 0x40a320
lui v0, 0x42
lw t9, -sym.sess_get_uid(gp)
nop
jalr t9
move a0, s5
lw gp, 0x10(sp)
nop
lw t9, -sym.sobj_get_string(gp)
nop
jalr t9
move a0, s5
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a3, v0
move a2, s2
addiu a1, a1, -0x1790
jalr t9
move a0, s1
lw gp, 0x10(sp)
move a2, s1
lw t9, -sym.xmldbc_del(gp)
move a0, zero
jalr t9
move a1, zero
lw gp, 0x10(sp)
lui a0, 0x42
lw t9, -sym.imp.fopen(gp)
lui a1, 0x42
addiu a0, a0, -0x1780
jalr t9
addiu a1, a1, -0x176c
lw gp, 0x10(sp)
bnez v0, 0x409f94
--
move a1, zero
lw t9, -sym.imp.lockf(gp)
move a2, zero
jalr t9
move a0, v0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
addiu a0, s0, -0x1780
lw t9, -sym.imp.remove(gp)
nop
jalr t9
addiu s0, sp, 0xc0
lw gp, 0x10(sp)
nop
lw t9, -sym.sobj_get_string(gp)
nop
jalr t9
move a0, s5
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
lui a2, 0x42
addiu a1, a1, -0x1690
addiu a2, a2, -0x1a40
move a3, v0
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a2, s0
lw v0, -0x7dd8(gp)
lw t9, -sym.xmldbc_ephp(gp)
lw a3, (v0)
move a0, zero
jalr t9
move a1, zero
lw gp, 0x10(sp)
beqz s7, 0x40a28c
lui v0, 0x43
move a1, zero
lw t9, -sym.imp.printf(gp)
lui a0, 0x42
--
jalr t9
addiu a1, zero, 0x2c
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.strcmp(gp)
move a0, s0
addiu a1, a1, -0x1584
beqz v0, 0x40a6c0
move s1, v0
sb zero, (v0)
addiu s1, v0, 1
jalr t9
nop
lw gp, 0x18(sp)
lui a1, 0x42
lw v1, -sym.sobj_get_string(gp)
move a0, s3
lw t9, -sym.imp.strcmp(gp)
bnez v0, 0x40a744
addiu a1, a1, -0x1544
move t9, v1
jalr t9
nop
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
lui a2, 0x42
lui a3, 0x42
move a0, s4
sw v0, 0x10(sp)
addiu a1, a1, -0x157c
addiu a2, a2, -0x155c
jalr t9
addiu a3, a3, -0x1a40
lw gp, 0x18(sp)
sw s6, 0x10(sp)
lw t9, -sym.xmldbc_ephp_wb(gp)
move a0, zero
move a1, zero
move a2, s4
jalr t9
move a3, fp
b 0x40a82c
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
lui a1, 0x42
lw v1, -sym.sobj_get_string(gp)
move a0, s3
lw t9, -sym.imp.strcmp(gp)
bnez v0, 0x40a804
addiu a1, a1, -0x14c8
move t9, v1
jalr t9
nop
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
lui a2, 0x42
lui a3, 0x42
move a0, s4
sw v0, 0x10(sp)
sw s7, 0x14(sp)
addiu a1, a1, -0x1538
addiu a2, a2, -0x155c
jalr t9
addiu a3, a3, -0x1a40
lw gp, 0x18(sp)
move a2, s4
lw t9, -sym.xmldbc_ephp_wb(gp)
move a3, fp
sw s6, 0x10(sp)
move a0, zero
jalr t9
move a1, zero
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a0, s4
move a2, s5
addiu a1, a1, -0x14f4
jalr t9
move a3, s7
lw gp, 0x18(sp)
move a0, zero
lw t9, -sym.xmldbc_timer(gp)
move a1, zero
jalr t9
move a2, s4
b 0x40a82c
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
bnez v0, 0x40a830
nop
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
--
move s0, zero
lw s2, 0x28(s1)
bnez s0, 0x40b310
nop
beqz s2, 0x40b314
nop
lw t9, -sym.imp.strcmp(gp)
lw a0, (s1)
lw a1, (s2)
jalr t9
nop
lw gp, 0x18(sp)
bnez v0, 0x40b314
nop
addiu s0, s0, 1
lw a3, 4(s1)
nop
beqz a3, 0x40b338
move a0, zero
lw t9, -sym.xmldbc_set(gp)
move a1, zero
jalr t9
move a2, s4
lw gp, 0x18(sp)
lw a3, (s1)
lw t9, -sym.imp.sprintf(gp)
beqz s0, 0x40b360
move a0, s3
sw s0, 0x10(sp)
move a1, s5
jalr t9
move a2, s4
b 0x40b36c
nop
move a1, s6
jalr t9
move a2, s4
lw a1, 0x20(s1)
lw gp, 0x18(sp)
beqz a1, 0x40b38c
move s1, s2
jal 0x40b26c
move a0, s3
lw gp, 0x18(sp)
move s1, s2
bnez s1, 0x40b2dc
--
jalr t9
addiu a2, zero, 0x100
lw v1, (s0)
addiu v0, zero, 2
lw gp, 0x10(sp)
bne v1, v0, 0x40b4e8
nop
lw t9, -sym.sobj_get_string(gp)
lw a0, 4(s0)
jalr t9
nop
lw gp, 0x10(sp)
nop
lw t9, -sym.ixmlParseBuffer(gp)
nop
jalr t9
move a0, v0
lw gp, 0x10(sp)
beqz v0, 0x40b4e8
nop
jal sym.get_parameter_nodehead
move a0, v0
lw gp, 0x10(sp)
beqz v0, 0x40b4e8
move s2, v0
lw t9, -sym.imp.sprintf(gp)
lui s1, 0x43
lui a1, 0x42
addiu a1, a1, -0x1170
move a0, s3
jalr t9
addiu a2, s1, 0xe90
lw gp, 0x10(sp)
lui s0, 0x43
lw t9, -sym.xmldbc_set(gp)
lw a3, 0x22d0(s0)
move a0, zero
move a1, zero
jalr t9
move a2, s3
lw gp, 0x10(sp)
lw a3, 0x22d0(s0)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
addiu a1, a1, -0x1564
addiu a2, s1, 0xe90
jalr t9
move a0, s3
lw a1, 0x20(s2)
lw gp, 0x10(sp)
beqz a1, 0x40b4d4
nop
jal 0x40b26c
move a0, s3
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.free(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
lw ra, 0x12c(sp)
lw s3, 0x128(sp)
--
addiu v0, v0, 1
lui a1, 0x42
sb zero, (v1)
move a0, s5
sw v0, 0x22d0(s2)
jalr t9
addiu a1, a1, -0x2010
lw gp, 0x30(sp)
beqz v0, 0x40b8f4
lui a1, 0x42
lui a2, 0x42
lw t9, -sym.cgibin_print_http_status(gp)
addiu a1, a1, -0x7e4
addiu a2, a2, -0x1fc8
addiu a0, zero, 0x190
jalr t9
addiu s0, zero, -1
b 0x40bb5c
nop
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
lui s0, 0x43
lw gp, 0x30(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
lui a2, 0x42
move a3, v0
addiu a0, s0, 0xe90
addiu a1, a1, -0x1124
jalr t9
addiu a2, a2, -0x1118
lw gp, 0x30(sp)
lui a0, 0x41
lw t9, -sym.cgibin_parse_request(gp)
move a1, zero
lui a2, 1
jalr t9
addiu a0, a0, -0x4c44
lw gp, 0x30(sp)
lui a0, 0x42
lw t9, -sym.imp.getenv(gp)
nop
jalr t9
addiu a0, a0, -0x1278
lw gp, 0x30(sp)
nop
lw t9, -sym.imp.getpid(gp)
lw s2, 0x22d0(s2)
jalr t9
move s1, v0
lw gp, 0x30(sp)
lui v1, 0x42
lw t9, -sym.imp.sprintf(gp)
addiu s5, s3, 9
addiu v1, v1, -0x1088
addiu s0, s0, 0xe90
lui s3, 0x43
lui a1, 0x42
lui a2, 0x42
sw s0, 0x10(sp)
sw v1, 0x20(sp)
addiu a1, a1, -0x1100
addiu a2, a2, -0x1098
addiu a0, s3, 0x1ed0
move a3, s5
sw s1, 0x14(sp)
sw s4, 0x18(sp)
sw s2, 0x1c(sp)
sw v0, 0x28(sp)
jalr t9
sw s5, 0x24(sp)
lw gp, 0x30(sp)
addiu v0, zero, 0x1000
--
jalr t9
addiu a3, s0, 0xed0
lw gp, 0x30(sp)
bnez v0, 0x40bb38
nop
lw t9, -sym.cgibin_fill_http_content_len(gp)
addiu a0, s0, 0xed0
jalr t9
addiu a1, zero, 0x1000
lw gp, 0x30(sp)
bnez v0, 0x40ba34
nop
lw t9, -sym.imp.printf(gp)
lui a0, 0x42
addiu a0, a0, -0x2064
jalr t9
addiu a1, s0, 0xed0
lw gp, 0x30(sp)
nop
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
lui s2, 0x43
lw gp, 0x30(sp)
lui s1, 0x42
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
addiu a1, a1, -0xf5c
addiu a0, s2, 0x1ed0
addiu a2, s1, -0x1088
move a3, s5
jalr t9
sw v0, 0x10(sp)
lw gp, 0x30(sp)
lui a1, 0x42
lw t9, -sym.imp.fopen(gp)
addiu a1, a1, -0x107c
jalr t9
addiu a0, s2, 0x1ed0
lw gp, 0x30(sp)
beqz v0, 0x40bb38
move s0, v0
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
nop
lw gp, 0x30(sp)
lui a1, 0x42
lw t9, -sym.imp.fprintf(gp)
addiu a1, a1, -0x1078
addiu a2, s1, -0x1088
move a3, s5
move a0, s0
jalr t9
sw v0, 0x10(sp)
lw gp, 0x30(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s0
lw gp, 0x30(sp)
nop
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
nop
lw gp, 0x30(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
addiu a1, a1, -0x1064
addiu a2, s1, -0x1088
move a3, s5
addiu a0, s2, 0x1ed0
jalr t9
sw v0, 0x10(sp)
lw gp, 0x30(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
addiu a0, s2, 0x1ed0
lw gp, 0x30(sp)
nop
lw t9, -sym.xmldbc_del(gp)
lui a2, 0x43
addiu a2, a2, 0xe90
move a0, zero
jalr t9
move a1, zero
--
sltiu v0, v0, 1
addu s0, s0, v0
lui a1, 0x42
addiu a1, a1, -0x1de4
move a0, s0
jalr t9
addiu a2, zero, 7
lw gp, 0x30(sp)
bnez v0, 0x40bf40
addiu a0, zero, 0x19c
lw t9, -sym.imp.strchr(gp)
addiu s3, s0, 7
move a0, s3
jalr t9
addiu a1, zero, 0x2f
lw gp, 0x30(sp)
beqz v0, 0x40bf3c
move s1, v0
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
sb zero, (v0)
lw gp, 0x30(sp)
lui s0, 0x42
addiu v1, s1, 1
lw t9, -sym.imp.sprintf(gp)
addiu s1, sp, 0x38
addiu s0, s0, -0x1088
lui a1, 0x42
lui a2, 0x42
sw v1, 0x18(sp)
move a3, s7
move a0, s1
sw s3, 0x14(sp)
sw s4, 0x1c(sp)
sw s6, 0x20(sp)
sw v0, 0x2c(sp)
addiu a1, a1, -0xfec
addiu a2, a2, -0xf84
sw s5, 0x10(sp)
sw s0, 0x24(sp)
lw s2, -0x7dd8(gp)
jalr t9
sw s5, 0x28(sp)
lw gp, 0x30(sp)
lw a3, (s2)
lw t9, -sym.xmldbc_ephp(gp)
move a2, s1
move a1, zero
jalr t9
move a0, zero
lw gp, 0x30(sp)
lw a0, (s2)
lw t9, -sym.imp.fflush(gp)
nop
jalr t9
nop
lw gp, 0x30(sp)
nop
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
nop
lw gp, 0x30(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a2, s0
move a0, s1
sw v0, 0x10(sp)
addiu a1, a1, -0xf68
jalr t9
move a3, s5
lw gp, 0x30(sp)
move a2, s1
lw t9, -sym.xmldbc_timer(gp)
move a0, zero
jalr t9
move a1, zero
b 0x40bf58
nop
bnez s0, 0x40bf40
addiu a0, zero, 0x190
bnez s1, 0x40bf44
lui a1, 0x42
lw t9, -sym.imp.strcasecmp(gp)
lui a1, 0x42
addiu a1, a1, -0x1004
jalr t9
move a0, s2
lw gp, 0x30(sp)
beqz v0, 0x40bed4
move v1, zero
lw t9, -sym.imp.strncasecmp(gp)
lui a1, 0x42
addiu a1, a1, -0xff4
move a0, s2
jalr t9
addiu a2, zero, 7
lw gp, 0x30(sp)
bnez v0, 0x40bf40
addiu a0, zero, 0x190
lw t9, -sym.imp.atoi(gp)
nop
jalr t9
addiu a0, s2, 7
lw gp, 0x30(sp)
move v1, v0
lui v0, 0x42
lw t9, -sym.imp.sprintf(gp)
addiu s0, sp, 0x38
addiu v0, v0, -0x1088
lui a1, 0x42
lui a2, 0x42
move a3, s7
move a0, s0
sw s3, 0x14(sp)
sw v1, 0x18(sp)
sw v0, 0x1c(sp)
sw s5, 0x20(sp)
addiu a1, a1, -0xf50
addiu a2, a2, -0xf84
jalr t9
sw s5, 0x10(sp)
lw gp, 0x30(sp)
move a2, s0
lw v0, -0x7dd8(gp)
lw t9, -sym.xmldbc_ephp(gp)
lw a3, (v0)
move a0, zero
--
jalr t9
addiu a0, a0, -0x1018
lw gp, 0x18(sp)
beqz v0, 0x40c040
nop
lui a1, 0x42
addiu a1, a1, -0x7e4
lw t9, -sym.cgibin_print_http_status(gp)
addiu a0, zero, 0x190
jalr t9
move a2, a1
b 0x40c0b8
nop
lw t9, -sym.imp.getenv(gp)
nop
jalr t9
addiu a0, s1, -0x1278
lw gp, 0x18(sp)
addiu a0, s0, -0x1044
lw t9, -sym.imp.getenv(gp)
nop
jalr t9
move s1, v0
lw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
lui a2, 0x42
addiu a1, a1, -0xf00
addiu a2, a2, -0xf84
move a3, s1
move a0, s0
sw s2, 0x10(sp)
jalr t9
sw v0, 0x14(sp)
lw gp, 0x18(sp)
move a2, s0
lw v0, -0x7dd8(gp)
lw t9, -sym.xmldbc_ephp(gp)
lw a3, (v0)
move a0, zero
jalr t9
move a1, zero
lw ra, 0x22c(sp)
lw gp, 0x18(sp)
move v0, zero
--
lui gp, 0x44
addiu sp, sp, -0x1048
addiu gp, gp, -0x75f0
sw ra, 0x1044(sp)
sw s5, 0x1040(sp)
sw s4, 0x103c(sp)
sw s3, 0x1038(sp)
sw s2, 0x1034(sp)
sw s1, 0x1030(sp)
sw s0, 0x102c(sp)
sw gp, 0x20(sp)
addiu v0, zero, 0xc8
move s0, a0
move s3, a1
move s4, a2
move s1, a3
lw s5, 0x1058(sp)
lw t9, -sym.imp.puts(gp)
bne a0, v0, 0x40c314
addiu s2, sp, 0x28
lui a0, 0x42
jalr t9
addiu a0, a0, -0x1ccc
lw gp, 0x20(sp)
lui v0, 0x43
lw t9, -sym.imp.sprintf(gp)
lw a1, 0x3b8(v0)
jalr t9
move a0, s2
lw gp, 0x20(sp)
beqz s1, 0x40c2cc
move s0, v0
lw t9, -sym.imp.sprintf(gp)
beqz s5, 0x40c2a8
addu a0, s2, v0
lui a1, 0x42
sw s5, 0x14(sp)
sw s1, 0x18(sp)
sw s1, 0x10(sp)
sw s3, 0x1c(sp)
addiu a1, a1, -0xeb4
move a2, s3
jalr t9
move a3, s4
b 0x40c2e8
nop
lui a1, 0x42
sw s1, 0x10(sp)
sw s3, 0x14(sp)
addiu a1, a1, -0xe7c
move a2, s3
jalr t9
move a3, s4
b 0x40c2e8
nop
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
addu a0, s2, v0
addiu a1, a1, -0xe48
move a2, s3
jalr t9
move a3, s4
lw gp, 0x20(sp)
addu s0, v0, s0
lui v0, 0x43
lw t9, -sym.imp.sprintf(gp)
lw a1, 0x3b4(v0)
addiu a0, sp, 0x28
jalr t9
addu a0, a0, s0
lw gp, 0x20(sp)
b 0x40c34c
addu a1, s0, v0
lui a0, 0x42
jalr t9
addiu a0, a0, -0xe28
lw gp, 0x20(sp)
lui v0, 0x43
lw t9, -sym.imp.sprintf(gp)
lw a1, 0x3b0(v0)
lui a3, 0x42
move a0, s2
move a2, s0
jalr t9
addiu a3, a3, -0xe04
lw gp, 0x20(sp)
move a1, v0
lui v0, 0x43
lw t9, -sym.imp.printf(gp)
lw a0, 0x3bc(v0)
jalr t9
nop
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, sp, 0x28
lw ra, 0x1044(sp)
--
lw gp, 0x20(sp)
lui a2, 0x42
lw t9, -sym.imp.snprintf(gp)
move a3, s0
move a0, s1
addiu a2, a2, -0x870
jalr t9
addiu a1, zero, 0x80
lw gp, 0x20(sp)
addiu s0, sp, 0x188
lw t9, -sym.xmldbc_get_wb(gp)
move a3, s0
move a2, s1
move a1, zero
sw s2, 0x10(sp)
jalr t9
move a0, zero
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.atoi(gp)
nop
jalr t9
move a0, s0
lw gp, 0x20(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
addiu a1, a1, -0x79c
move a0, s0
addiu a2, v0, 1
jalr t9
move s2, v0
lw gp, 0x20(sp)
move a2, s1
lw t9, -sym.xmldbc_set(gp)
move a3, s0
move a1, zero
jalr t9
move a0, zero
lw gp, 0x20(sp)
move a0, s6
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
addiu s1, zero, -1
lw gp, 0x20(sp)
lui a2, 0x42
--
move s0, zero
lw s2, 0x28(s1)
bnez s0, 0x40ef28
nop
beqz s2, 0x40ef2c
nop
lw t9, -sym.imp.strcmp(gp)
lw a0, (s1)
lw a1, (s2)
jalr t9
nop
lw gp, 0x18(sp)
bnez v0, 0x40ef2c
nop
addiu s0, s0, 1
lw a3, 4(s1)
nop
beqz a3, 0x40ef50
move a0, zero
lw t9, -sym.xmldbc_set(gp)
move a1, zero
jalr t9
move a2, s4
lw gp, 0x18(sp)
lw a3, (s1)
lw t9, -sym.imp.sprintf(gp)
beqz s0, 0x40ef78
move a0, s3
sw s0, 0x10(sp)
move a1, s5
jalr t9
move a2, s4
b 0x40ef84
nop
move a1, s6
jalr t9
move a2, s4
lw a1, 0x20(s1)
lw gp, 0x18(sp)
beqz a1, 0x40efa4
move s1, s2
jal 0x40ee84
move a0, s3
lw gp, 0x18(sp)
move s1, s2
bnez s1, 0x40eef4
--
lw t9, -sym.imp.memset(gp)
addiu s1, sp, 0x18
move s0, a1
move s4, a0
move a1, zero
move a0, s1
move s3, a2
jalr t9
addiu a2, zero, 0x100
lw gp, 0x10(sp)
nop
lw t9, -sym.ixmlParseBuffer(gp)
nop
jalr t9
move a0, s0
lw gp, 0x10(sp)
beqz v0, 0x40f108
move s0, v0
lw t9, -sym.get_parameter_nodehead(gp)
nop
jalr t9
move a0, v0
lw gp, 0x10(sp)
beqz v0, 0x40f108
move s2, v0
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
addiu a1, a1, -0x390
move a0, s1
jalr t9
move a2, s3
lw gp, 0x10(sp)
move a0, zero
lw t9, -sym.xmldbc_set(gp)
move a1, zero
move a2, s1
jalr t9
move a3, s4
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
addiu a1, a1, -0x380
move a2, s3
move a3, s4
jalr t9
move a0, s1
lw gp, 0x10(sp)
move a1, zero
lw t9, -sym.xmldbc_del(gp)
move a0, zero
jalr t9
move a2, s1
lw a1, 0x20(s2)
lw gp, 0x10(sp)
beqz a1, 0x40f0ec
nop
jal 0x40ee84
move a0, s1
lw gp, 0x10(sp)
nop
lw t9, -sym.ixmlDocument_free(gp)
--
lui a0, 0x41
lw t9, -sym.cgibin_parse_request(gp)
sw v0, 0x2300(s2)
addiu a0, a0, -0x1200
move a1, zero
jalr t9
lui a2, 1
lw gp, 0x18(sp)
bltz v0, 0x40f70c
move s1, v0
lw t9, -sym.sobj_get_string(gp)
lw a0, 0x2300(s2)
jalr t9
addiu s1, zero, -1
lui a2, 0x42
move a1, v0
addiu a2, a2, -0x220
jal 0x40efd4
move a0, s0
lw gp, 0x18(sp)
bnez v0, 0x40f5ec
lui v0, 0x42
move s1, zero
lui v0, 0x42
addiu s2, sp, 0xa4
lw t9, -sym.imp.sprintf(gp)
addiu s4, v0, -0x1dc
lui a1, 0x42
lui a2, 0x42
addiu a1, a1, -0x210
addiu a2, a2, -0x1f4
move a0, s2
move a3, s0
sw s4, 0x10(sp)
jalr t9
sw s0, 0x14(sp)
lw gp, 0x18(sp)
move a2, s2
lw v0, -0x7dd8(gp)
lw t9, -sym.xmldbc_ephp(gp)
lw a3, (v0)
move a0, zero
jalr t9
move a1, zero
lw gp, 0x18(sp)
move a0, s2
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, s0
lui a1, 0x42
addiu a1, a1, -0x1d0
jal 0x40eb80
move a0, s2
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.sprintf(gp)
bnez v0, 0x40f684
lui a1, 0x42
move a0, s2
b 0x40f690
addiu a1, a1, -0x1ac
lui a1, 0x42
move a0, s2
addiu a1, a1, -0x190
move a3, s0
jalr t9
move a2, s4
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
addiu a0, sp, 0xa4
lw gp, 0x18(sp)
addiu a1, zero, 2
lw t9, -sym.imp.lockf(gp)
[*] Function sprintf used 41 times cgibin
