dumps/sots.exe: file format pei-i386 Disassembly of section .text: 0079a150 <.text+0x399150>: 79a150: 55 push ebp 79a151: 8b ec mov ebp,esp 79a153: 6a ff push 0xffffffff 79a155: 68 39 9f 98 00 push 0x989f39 79a15a: 64 a1 00 00 00 00 mov eax,fs:0x0 79a160: 50 push eax 79a161: 51 push ecx 79a162: 56 push esi 79a163: 57 push edi 79a164: a1 78 8b af 00 mov eax,ds:0xaf8b78 79a169: 33 c5 xor eax,ebp 79a16b: 50 push eax 79a16c: 8d 45 f4 lea eax,[ebp-0xc] 79a16f: 64 a3 00 00 00 00 mov fs:0x0,eax 79a175: 8b 75 0c mov esi,DWORD PTR [ebp+0xc] 79a178: 89 75 f0 mov DWORD PTR [ebp-0x10],esi 79a17b: 33 c0 xor eax,eax 79a17d: 89 45 fc mov DWORD PTR [ebp-0x4],eax 79a180: 3b f0 cmp esi,eax 79a182: 74 44 je 0x79a1c8 79a184: 8b 7d 10 mov edi,DWORD PTR [ebp+0x10] 79a187: c7 06 9c 43 a2 00 mov DWORD PTR [esi],0xa2439c 79a18d: 66 8b 4f 04 mov cx,WORD PTR [edi+0x4] 79a191: 66 89 4e 04 mov WORD PTR [esi+0x4],cx 79a195: 66 8b 57 06 mov dx,WORD PTR [edi+0x6] 79a199: 66 89 56 06 mov WORD PTR [esi+0x6],dx 79a19d: 8a 4f 08 mov cl,BYTE PTR [edi+0x8] 79a1a0: 88 4e 08 mov BYTE PTR [esi+0x8],cl 79a1a3: 6a ff push 0xffffffff 79a1a5: 8d 4e 0c lea ecx,[esi+0xc] 79a1a8: 50 push eax 79a1a9: 8d 57 0c lea edx,[edi+0xc] 79a1ac: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf 79a1b3: 89 41 10 mov DWORD PTR [ecx+0x10],eax 79a1b6: 52 push edx 79a1b7: c6 45 fc 01 mov BYTE PTR [ebp-0x4],0x1 79a1bb: 88 01 mov BYTE PTR [ecx],al 79a1bd: e8 6e b2 c8 ff call 0x425430 79a1c2: 8b 47 28 mov eax,DWORD PTR [edi+0x28] 79a1c5: 89 46 28 mov DWORD PTR [esi+0x28],eax 79a1c8: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc] 79a1cb: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx 79a1d2: 59 pop ecx 79a1d3: 5f pop edi 79a1d4: 5e pop esi 79a1d5: 8b e5 mov esp,ebp 79a1d7: 5d pop ebp 79a1d8: c3 ret 79a1d9: cc int3 79a1da: cc int3 79a1db: cc int3 79a1dc: cc int3 79a1dd: cc int3 79a1de: cc int3 79a1df: cc int3