# Read-only local capture. Input: dumps/sots.exe # SHA-256: 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 # Tool: GNU objdump 2.38, Intel syntax. Commands: # objdump -D -Mintel --start-address=0x00885380 --stop-address=0x00885500 dumps/sots.exe # objdump -D -Mintel --start-address=0x00825d40 --stop-address=0x00825f80 dumps/sots.exe # objdump -D -Mintel --start-address=0x00879eb0 --stop-address=0x0087a020 dumps/sots.exe # objdump -D -Mintel --start-address=0x00884cb0 --stop-address=0x00884dc0 dumps/sots.exe # objdump -D -Mintel --start-address=0x008841a0 --stop-address=0x00884440 dumps/sots.exe # objdump -D -Mintel --start-address=0x00629580 --stop-address=0x00629620 dumps/sots.exe # objdump -D -Mintel --start-address=0x00779850 --stop-address=0x00779a20 dumps/sots.exe # objdump -D -Mintel --start-address=0x0062e120 --stop-address=0x0062e190 dumps/sots.exe # objdump -D -Mintel --start-address=0x006e8f50 --stop-address=0x006e8fb0 dumps/sots.exe # objdump -D -Mintel --start-address=0x0077fed0 --stop-address=0x00780040 dumps/sots.exe # objdump -D -Mintel --start-address=0x007725a0 --stop-address=0x007726d0 dumps/sots.exe # objdump -D -Mintel --start-address=0x0078af40 --stop-address=0x0078afa8 dumps/sots.exe # objdump -s --start-address=0x00a0f070 --stop-address=0x00a0f0a0 dumps/sots.exe # EventStorage::GetOrCreateTurnBucket: count/stride, last-match scan, construction/append. 008853aa: 8b 56 08 mov edx,DWORD PTR [esi+0x8] 008853ad: 2b 56 04 sub edx,DWORD PTR [esi+0x4] 008853b3: b8 ab aa aa 2a mov eax,0x2aaaaaab 008853d3: 39 5a 04 cmp DWORD PTR [edx+0x4],ebx 008853d6: 75 02 jne 0x8853da 008853d8: 8b fa mov edi,edx 008853da: 83 c2 18 add edx,0x18 008853e2: 3b fb cmp edi,ebx 008853e4: 74 16 je 0x8853fc 008853e6: 8b c7 mov eax,edi 008853f9: c2 04 00 ret 0x4 008853fc: c7 45 dc 7c f0 a0 00 mov DWORD PTR [ebp-0x24],0xa0f07c 00885403: 89 5d e4 mov DWORD PTR [ebp-0x1c],ebx 00885406: 89 5d e8 mov DWORD PTR [ebp-0x18],ebx 00885409: 89 5d ec mov DWORD PTR [ebp-0x14],ebx 0088540c: 8d 45 dc lea eax,[ebp-0x24] 0088540f: 50 push eax 00885413: e8 98 f8 ff ff call 0x884cb0 00885418: 8d 4d e4 lea ecx,[ebp-0x1c] 00885422: e8 59 41 da ff call 0x629580 00885427: 8b 46 08 mov eax,DWORD PTR [esi+0x8] 0088542a: 8b 4d 08 mov ecx,DWORD PTR [ebp+0x8] 0088542d: 89 48 ec mov DWORD PTR [eax-0x14],ecx 00885430: 8b 46 08 mov eax,DWORD PTR [esi+0x8] 00885433: 83 e8 18 sub eax,0x18 00885447: c2 04 00 ret 0x4 # vector::push_back: alias-sensitive source and 0x18 deep copy. 00884cda: 8b 75 08 mov esi,DWORD PTR [ebp+0x8] 00884cdd: 3b f1 cmp esi,ecx 00884cdf: 73 59 jae 0x884d3a 00884ce3: 3b c6 cmp eax,esi 00884ce5: 77 53 ja 0x884d3a 00884cfa: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8] 00884cff: 6a 01 push 0x1 00884d03: e8 98 f4 ff ff call 0x8841a0 00884d24: c7 00 7c f0 a0 00 mov DWORD PTR [eax],0xa0f07c 00884d2a: 8b 51 04 mov edx,DWORD PTR [ecx+0x4] 00884d34: 89 50 04 mov DWORD PTR [eax+0x4],edx 00884d37: 51 push ecx 00884d3a: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8] 00884d43: e8 58 f4 ff ff call 0x8841a0 00884d5c: c7 00 7c f0 a0 00 mov DWORD PTR [eax],0xa0f07c 00884d62: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4] 00884d6c: 89 48 04 mov DWORD PTR [eax+0x4],ecx 00884d6f: 56 push esi 00884d70: 8d 48 08 lea ecx,[eax+0x8] 00884d73: e8 d8 4a ef ff call 0x779850 00884d78: 83 47 04 18 add DWORD PTR [edi+0x4],0x18 00884d8c: c2 04 00 ret 0x4 # Outer vector growth and allocation: 1.5x, count*0x18, deep-copy then destroy/free old range. 008841ee: 3b f0 cmp esi,eax 008841f2: 8b d0 mov edx,eax 008841f4: d1 ea shr edx,1 00884205: 03 c2 add eax,edx 0088420d: 50 push eax 0088420e: e8 4d f8 ff ff call 0x883a60 00883ac4: 57 push edi 00883ac7: e8 84 54 e6 ff call 0x6e8f50 00883add: 89 7d e8 mov DWORD PTR [ebp-0x18],edi 00883ae7: e8 e4 c3 ef ff call 0x77fed0 00883b20: 8b 07 mov eax,DWORD PTR [edi] 00883b22: 8b 10 mov edx,DWORD PTR [eax] 00883b24: 6a 00 push 0x0 00883b28: ff d2 call edx 00883b2a: 83 c7 18 add edi,0x18 00883b35: e8 70 14 0a 00 call 0x924faa 00883b57: 89 56 08 mov DWORD PTR [esi+0x8],edx 00883b5a: 89 4e 04 mov DWORD PTR [esi+0x4],ecx 00883b5d: 89 3e mov DWORD PTR [esi],edi 00883b73: 8b 55 e8 mov edx,DWORD PTR [ebp-0x18] 00883b76: 52 push edx 00883b77: e8 2e 14 0a 00 call 0x924faa 00883b7f: 6a 00 push 0x0 00883b81: 6a 00 push 0x0 00883b83: e8 34 14 0a 00 call 0x924fbc 006e8f67: 8d 04 49 lea eax,[ecx+ecx*2] 006e8f6a: 03 c0 add eax,eax 006e8f6c: 03 c0 add eax,eax 006e8f6e: 03 c0 add eax,eax 006e8f70: 50 push eax 006e8f71: e8 40 c0 23 00 call 0x924fb6 006e8fa9: c2 04 00 ret 0x4 # TurnEvents range copy: vptr/turn plus deep copy of nested vector; unwind destroys completed elements. 0077ff10: 3b 7d 0c cmp edi,DWORD PTR [ebp+0xc] 0077ff1c: 8d 4f 08 lea ecx,[edi+0x8] 0077ff1f: c7 06 7c f0 a0 00 mov DWORD PTR [esi],0xa0f07c 0077ff25: 8b 47 04 mov eax,DWORD PTR [edi+0x4] 0077ff29: 8d 4e 08 lea ecx,[esi+0x8] 0077ff2f: 89 46 04 mov DWORD PTR [esi+0x4],eax 0077ff32: e8 19 99 ff ff call 0x779850 0077ff37: 83 c6 18 add esi,0x18 0077ff41: 83 c7 18 add edi,0x18 0077ff46: 8b 75 ec mov esi,DWORD PTR [ebp-0x14] 0077ff50: 8b 16 mov edx,DWORD PTR [esi] 0077ff52: 8b 02 mov eax,DWORD PTR [edx] 0077ff54: 6a 00 push 0x0 0077ff58: ff d0 call eax 0077ff5a: 83 c6 18 add esi,0x18 0077ff61: 6a 00 push 0x0 0077ff63: 6a 00 push 0x0 0077ff65: e8 52 50 1a 00 call 0x924fbc # Nested vector copy and allocation; partial-copy unwind destroys completed events. 00779883: 33 c0 xor eax,eax 00779885: 89 06 mov DWORD PTR [esi],eax 00779887: 89 46 04 mov DWORD PTR [esi+0x4],eax 0077988a: 89 46 08 mov DWORD PTR [esi+0x8],eax 007798b2: 74 4b je 0x7798ff 007798ca: 57 push edi 007798cb: e8 70 16 01 00 call 0x78af40 007798d0: 6b ff 74 imul edi,edi,0x74 007798dd: 89 06 mov DWORD PTR [esi],eax 007798df: 89 46 04 mov DWORD PTR [esi+0x4],eax 007798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi 007798f4: e8 a7 8c ff ff call 0x7725a0 007798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax 00779912: c2 04 00 ret 0x4 00779915: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14] 00779918: e8 63 fc ea ff call 0x629580 0077991d: 6a 00 push 0x0 0077991f: 6a 00 push 0x0 00779921: e8 96 b6 1a 00 call 0x924fbc 0078af57: 6b c9 74 imul ecx,ecx,0x74 0078af5a: 51 push ecx 0078af5b: e8 56 a0 19 00 call 0x924fb6 0078af93: c2 04 00 ret 0x4 007725e0: 3b 45 0c cmp eax,DWORD PTR [ebp+0xc] 007725f2: 50 push eax 007725f5: e8 f6 6d ff ff call 0x7693f0 007725fd: 83 c6 74 add esi,0x74 00772600: 83 c0 74 add eax,0x74 0077260f: 8b 75 ec mov esi,DWORD PTR [ebp-0x14] 00772620: 8b 06 mov eax,DWORD PTR [esi] 00772622: 8b 10 mov edx,DWORD PTR [eax] 00772624: 6a 00 push 0x0 00772628: ff d2 call edx 0077262a: 83 c6 74 add esi,0x74 00772631: 6a 00 push 0x0 00772633: 6a 00 push 0x0 00772635: e8 82 29 1b 00 call 0x924fbc # TurnEvents and nested-vector destruction. Vtable 0x00a0f07c begins with 0x0062e120. 00a0f070: 701e6100 90b28500 14b5a700 20e16200 00a0f080: b05b8200 405c8200 60b5a700 d0e26200 0062e149: 8d 4e 08 lea ecx,[esi+0x8] 0062e153: e8 28 b4 ff ff call 0x629580 0062e158: f6 45 08 01 test BYTE PTR [ebp+0x8],0x1 0062e15c: c7 06 bc 22 9e 00 mov DWORD PTR [esi],0x9e22bc 0062e164: 56 push esi 0062e165: e8 40 6e 2f 00 call 0x924faa 0062e17e: c2 04 00 ret 0x4 00629583: 83 3f 00 cmp DWORD PTR [edi],0x0 00629590: 8b 5f 04 mov ebx,DWORD PTR [edi+0x4] 00629593: 8b 37 mov esi,DWORD PTR [edi] 006295a0: 8b 06 mov eax,DWORD PTR [esi] 006295a2: 8b 10 mov edx,DWORD PTR [eax] 006295a4: 6a 00 push 0x0 006295a8: ff d2 call edx 006295aa: 83 c6 74 add esi,0x74 006295b3: 50 push eax 006295b4: e8 f1 b9 2f 00 call 0x924faa 006295be: 33 c0 xor eax,eax 006295c0: 89 07 mov DWORD PTR [edi],eax 006295c2: 89 47 04 mov DWORD PTR [edi+0x4],eax 006295c5: 89 47 08 mov DWORD PTR [edi+0x8],eax # FindDuplicate: NULL/empty, comparator order, 0x74 iteration, return matched element. 00825d4b: 3b de cmp ebx,esi 00825d4d: 75 0a jne 0x825d59 00825d50: 33 c0 xor eax,eax 00825d56: c2 08 00 ret 0x8 00825d59: 8b 4b 0c mov ecx,DWORD PTR [ebx+0xc] 00825d5c: 2b 4b 08 sub ecx,DWORD PTR [ebx+0x8] 00825d5f: b8 09 cb 3d 8d mov eax,0x8d3dcb09 00825d88: 8b 4e 6c mov ecx,DWORD PTR [esi+0x6c] 00825d8b: 3b 4f 6c cmp ecx,DWORD PTR [edi+0x6c] 00825d94: 8b 56 40 mov edx,DWORD PTR [esi+0x40] 00825d97: 3b 57 40 cmp edx,DWORD PTR [edi+0x40] 00825da0: d9 46 44 fld DWORD PTR [esi+0x44] 00825da3: d9 47 44 fld DWORD PTR [edi+0x44] 00825da6: da e9 fucompp 00825daf: d9 46 48 fld DWORD PTR [esi+0x48] 00825db2: d9 47 48 fld DWORD PTR [edi+0x48] 00825dbe: d9 46 4c fld DWORD PTR [esi+0x4c] 00825dc1: d9 47 4c fld DWORD PTR [edi+0x4c] 00825dcd: 83 7f 38 10 cmp DWORD PTR [edi+0x38],0x10 00825de6: e8 b5 d8 bf ff call 0x4236a0 00825def: 83 7f 64 10 cmp DWORD PTR [edi+0x64],0x10 00825e08: e8 93 d8 bf ff call 0x4236a0 00825e11: 8d 47 08 lea eax,[edi+0x8] 00825e15: 8d 4e 08 lea ecx,[esi+0x8] 00825e19: e8 a2 9a c4 ff call 0x46f8c0 00825e2e: 83 45 08 74 add DWORD PTR [ebp+0x8],0x74 00825e51: 5f pop edi 00825e53: 33 c0 xor eax,eax 00825e59: c2 08 00 ret 0x8 00825e5c: 5f pop edi 00825e5d: 8b c6 mov eax,esi 00825e64: c2 08 00 ret 0x8 # PruneOldTurns: cutoff, leading-run selection, deep left shift, trailing destruction. 00879eb5: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8] 00879eba: 8b 4a 08 mov ecx,DWORD PTR [edx+0x8] 00879ebe: 8b 72 04 mov esi,DWORD PTR [edx+0x4] 00879ec3: 83 c3 ce add ebx,0xffffffce 00879eca: 8b f9 mov edi,ecx 00879ed0: 39 58 04 cmp DWORD PTR [eax+0x4],ebx 00879ed3: 7d 09 jge 0x879ede 00879ed5: 8b f8 mov edi,eax 00879ed7: 83 c0 18 add eax,0x18 00879ede: 3b f9 cmp edi,ecx 00879ee0: 74 56 je 0x879f38 00879ee2: 3b f7 cmp esi,edi 00879ee4: 74 52 je 0x879f38 00879ef8: 8b 44 30 04 mov eax,DWORD PTR [eax+esi*1+0x4] 00879efc: 8d 4f 08 lea ecx,[edi+0x8] 00879eff: 51 push ecx 00879f00: 8d 4e 08 lea ecx,[esi+0x8] 00879f03: 89 46 04 mov DWORD PTR [esi+0x4],eax 00879f06: e8 a5 07 f0 ff call 0x77a6b0 00879f0b: 83 c7 18 add edi,0x18 00879f0e: 83 c6 18 add esi,0x18 00879f21: 8b 17 mov edx,DWORD PTR [edi] 00879f23: 8b 02 mov eax,DWORD PTR [edx] 00879f25: 6a 00 push 0x0 00879f29: ff d0 call eax 00879f2b: 83 c7 18 add edi,0x18 00879f35: 89 72 08 mov DWORD PTR [edx+0x8],esi 00879f3e: c2 04 00 ret 0x4