dumps/sots.exe: file format pei-i386 Disassembly of section .text: 008562a0 <.text+0x4552a0>: 8562a0: 55 push ebp 8562a1: 8b ec mov ebp,esp 8562a3: 6a ff push 0xffffffff 8562a5: 68 48 6c 99 00 push 0x996c48 8562aa: 64 a1 00 00 00 00 mov eax,fs:0x0 8562b0: 50 push eax 8562b1: 51 push ecx 8562b2: 53 push ebx 8562b3: 56 push esi 8562b4: a1 78 8b af 00 mov eax,ds:0xaf8b78 8562b9: 33 c5 xor eax,ebp 8562bb: 50 push eax 8562bc: 8d 45 f4 lea eax,[ebp-0xc] 8562bf: 64 a3 00 00 00 00 mov fs:0x0,eax 8562c5: 8b f1 mov esi,ecx 8562c7: 89 75 f0 mov DWORD PTR [ebp-0x10],esi 8562ca: 33 db xor ebx,ebx 8562cc: 8d 4e 0c lea ecx,[esi+0xc] 8562cf: c7 06 9c 43 a2 00 mov DWORD PTR [esi],0xa2439c 8562d5: 53 push ebx 8562d6: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf 8562dd: 89 59 10 mov DWORD PTR [ecx+0x10],ebx 8562e0: 68 0c 10 9e 00 push 0x9e100c 8562e5: 89 5d fc mov DWORD PTR [ebp-0x4],ebx 8562e8: 88 19 mov BYTE PTR [ecx],bl 8562ea: e8 61 f2 bc ff call 0x425550 8562ef: 33 c0 xor eax,eax 8562f1: 89 46 04 mov DWORD PTR [esi+0x4],eax 8562f4: 88 5e 08 mov BYTE PTR [esi+0x8],bl 8562f7: 89 5e 28 mov DWORD PTR [esi+0x28],ebx 8562fa: 8b c6 mov eax,esi 8562fc: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc] 8562ff: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx 856306: 59 pop ecx 856307: 5e pop esi 856308: 5b pop ebx 856309: 8b e5 mov esp,ebp 85630b: 5d pop ebp 85630c: c3 ret