# Read-only local capture. Input: dumps/sots.exe # SHA-256: 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 # Tool: GNU objdump 2.38, Intel syntax. Commands and selected raw instruction windows: # objdump -D -Mintel --start-address=0x008562a0 --stop-address=0x0085630d dumps/sots.exe # objdump -D -Mintel --start-address=0x007b7320 --stop-address=0x007b739f dumps/sots.exe # objdump -D -Mintel --start-address=0x007b34e0 --stop-address=0x007b35ef dumps/sots.exe # objdump -D -Mintel --start-address=0x0079a150 --stop-address=0x0079a1d9 dumps/sots.exe # objdump -D -Mintel --start-address=0x0086c580 --stop-address=0x0086c62e dumps/sots.exe # objdump -D -Mintel --start-address=0x007693f0 --stop-address=0x007694c0 dumps/sots.exe # objdump -D -Mintel --start-address=0x0061ae90 --stop-address=0x0061aefc dumps/sots.exe # objdump -D -Mintel --start-address=0x0057e590 --stop-address=0x0057e5e4 dumps/sots.exe # objdump -D -Mintel --start-address=0x004249a0 --stop-address=0x00424ada dumps/sots.exe # objdump -D -Mintel --start-address=0x00924faa --stop-address=0x00924fbc dumps/sots.exe 008562a0 <.text+0x4552a0>: 8562c5: 8b f1 mov esi,ecx 8562cc: 8d 4e 0c lea ecx,[esi+0xc] 8562cf: c7 06 9c 43 a2 00 mov DWORD PTR [esi],0xa2439c 8562d5: 53 push ebx 8562d6: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf 8562dd: 89 59 10 mov DWORD PTR [ecx+0x10],ebx 8562e0: 68 0c 10 9e 00 push 0x9e100c 8562e8: 88 19 mov BYTE PTR [ecx],bl 8562ea: e8 61 f2 bc ff call 0x425550 8562ef: 33 c0 xor eax,eax 8562f1: 89 46 04 mov DWORD PTR [esi+0x4],eax 8562f4: 88 5e 08 mov BYTE PTR [esi+0x8],bl 8562f7: 89 5e 28 mov DWORD PTR [esi+0x28],ebx 8562fa: 8b c6 mov eax,esi 85630c: c3 ret 007b7320 <.text+0x3b6320>: 7b734a: 3b 4e 08 cmp ecx,DWORD PTR [esi+0x8] 7b734d: 75 09 jne 0x7b7358 7b734f: 6a 01 push 0x1 7b7351: 8b ce mov ecx,esi 7b7353: e8 c8 e4 ff ff call 0x7b5820 7b7358: 8b 46 04 mov eax,DWORD PTR [esi+0x4] 7b735b: 6b ff 2c imul edi,edi,0x2c 7b735e: 03 3e add edi,DWORD PTR [esi] 7b7360: 8d 4e 0c lea ecx,[esi+0xc] 7b7363: 57 push edi 7b7364: 50 push eax 7b7365: 51 push ecx 7b7366: e8 e5 2d fe ff call 0x79a150 7b736b: 83 c4 0c add esp,0xc 7b736e: 83 46 04 2c add DWORD PTR [esi+0x4],0x2c 7b7375: c2 04 00 ret 0x4 0079a150 <.text+0x399150>: 79a175: 8b 75 0c mov esi,DWORD PTR [ebp+0xc] 79a184: 8b 7d 10 mov edi,DWORD PTR [ebp+0x10] 79a187: c7 06 9c 43 a2 00 mov DWORD PTR [esi],0xa2439c 79a18d: 66 8b 4f 04 mov cx,WORD PTR [edi+0x4] 79a191: 66 89 4e 04 mov WORD PTR [esi+0x4],cx 79a195: 66 8b 57 06 mov dx,WORD PTR [edi+0x6] 79a199: 66 89 56 06 mov WORD PTR [esi+0x6],dx 79a19d: 8a 4f 08 mov cl,BYTE PTR [edi+0x8] 79a1a0: 88 4e 08 mov BYTE PTR [esi+0x8],cl 79a1a3: 6a ff push 0xffffffff 79a1a5: 8d 4e 0c lea ecx,[esi+0xc] 79a1a8: 50 push eax 79a1a9: 8d 57 0c lea edx,[edi+0xc] 79a1ac: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf 79a1b3: 89 41 10 mov DWORD PTR [ecx+0x10],eax 79a1b6: 52 push edx 79a1bb: 88 01 mov BYTE PTR [ecx],al 79a1bd: e8 6e b2 c8 ff call 0x425430 79a1c2: 8b 47 28 mov eax,DWORD PTR [edi+0x28] 79a1c5: 89 46 28 mov DWORD PTR [esi+0x28],eax 79a1d8: c3 ret 007b34e0 <.text+0x3b24e0>: 7b3541: 8d 7e 0c lea edi,[esi+0xc] 7b3544: 53 push ebx 7b3545: 8b cf mov ecx,edi 7b3547: e8 44 b0 dc ff call 0x57e590 7b3557: 50 push eax 7b3558: 8b 45 ec mov eax,DWORD PTR [ebp-0x14] 7b355b: 6a 00 push 0x0 7b355d: 57 push edi 7b355e: 50 push eax 7b355f: 51 push ecx 7b3560: 52 push edx 7b3568: e8 e3 b0 0a 00 call 0x85e650 7b35a0: 8b 13 mov edx,DWORD PTR [ebx] 7b35a2: 8b 02 mov eax,DWORD PTR [edx] 7b35a4: 6a 00 push 0x0 7b35a6: 8b cb mov ecx,ebx 7b35a8: ff d0 call eax 7b35aa: 83 c3 2c add ebx,0x2c 7b35b2: 8b 0e mov ecx,DWORD PTR [esi] 7b35b4: 51 push ecx 7b35b5: e8 f0 19 17 00 call 0x924faa 7b35c0: 8b ce mov ecx,esi 7b35c2: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c 0057e590 <.text+0x17d590>: 57e5a7: 6b c9 2c imul ecx,ecx,0x2c 57e5aa: 51 push ecx 57e5ab: e8 06 6a 3a 00 call 0x924fb6 57e5e3: c2 04 00 ret 0x4 0086c580 <.text+0x46b580>: 86c5cc: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8] 86c5cf: 75 09 jne 0x86c5da 86c5d1: 6a 01 push 0x1 86c5d3: 8b cf mov ecx,edi 86c5d5: e8 26 cf ff ff call 0x869500 86c5da: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4] 86c5dd: 6b f6 74 imul esi,esi,0x74 86c5e0: 03 37 add esi,DWORD PTR [edi] 86c60f: 85 c9 test ecx,ecx 86c611: 74 06 je 0x86c619 86c613: 56 push esi 86c614: e8 d7 cd ef ff call 0x7693f0 86c619: 83 47 04 74 add DWORD PTR [edi+0x4],0x74 86c62d: c2 04 00 ret 0x4 007693f0 <.text+0x3683f0>: 76941b: 8b 7d 08 mov edi,DWORD PTR [ebp+0x8] 76941e: c7 06 58 19 a2 00 mov DWORD PTR [esi],0xa21958 769424: 8b 47 04 mov eax,DWORD PTR [edi+0x4] 76942b: 8d 4e 08 lea ecx,[esi+0x8] 769435: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf 769445: e8 e6 bf cb ff call 0x425430 76944c: 8d 4e 24 lea ecx,[esi+0x24] 769464: e8 c7 bf cb ff call 0x425430 769469: 8b 4f 40 mov ecx,DWORD PTR [edi+0x40] 76946c: 89 4e 40 mov DWORD PTR [esi+0x40],ecx 769481: 6a ff push 0xffffffff 769483: 8d 4e 50 lea ecx,[esi+0x50] 76949b: e8 90 bf cb ff call 0x425430 7694a0: 8b 47 6c mov eax,DWORD PTR [edi+0x6c] 7694a3: 89 46 6c mov DWORD PTR [esi+0x6c],eax 7694a6: 8b 4f 70 mov ecx,DWORD PTR [edi+0x70] 7694a9: 89 4e 70 mov DWORD PTR [esi+0x70],ecx 7694bf: c2 04 00 ret 0x4 0061ae90 <.text+0x219e90>: 61ae94: 83 7e 64 10 cmp DWORD PTR [esi+0x64],0x10 61ae9a: 8b 46 50 mov eax,DWORD PTR [esi+0x50] 61ae9d: 50 push eax 61ae9e: e8 07 a1 30 00 call 0x924faa 61aeb5: 83 7e 38 10 cmp DWORD PTR [esi+0x38],0x10 61aebb: 8b 4e 24 mov ecx,DWORD PTR [esi+0x24] 61aebe: 51 push ecx 61aebf: e8 e6 a0 30 00 call 0x924faa 61aed4: 83 7e 1c 10 cmp DWORD PTR [esi+0x1c],0x10 61aeda: 8b 56 08 mov edx,DWORD PTR [esi+0x8] 61aedd: 52 push edx 61aede: e8 c7 a0 30 00 call 0x924faa 61aefb: c3 ret 004249a0 <.text+0x239a0>: 424a19: 51 push ecx 424a1a: e8 97 05 50 00 call 0x924fb6 424aa4: 8b 0f mov ecx,DWORD PTR [edi] 424aa6: 51 push ecx 424aa7: e8 fe 04 50 00 call 0x924faa 424ab5: 89 07 mov DWORD PTR [edi],eax 424ab7: 89 77 14 mov DWORD PTR [edi+0x14],esi 424aba: 89 5f 10 mov DWORD PTR [edi+0x10],ebx 00924faa <.text+0x523faa>: 924faa: ff 25 c8 d1 9d 00 jmp DWORD PTR ds:0x9dd1c8 924fb6: ff 25 d0 d1 9d 00 jmp DWORD PTR ds:0x9dd1d0