# Read-only local capture. Input: dumps/sots.exe # SHA-256: 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 # Tool: GNU objdump (GNU Binutils for Ubuntu) 2.38, Intel syntax. # Every command below exited 0. Output is unfiltered. # # $ objdump -D -Mintel --start-address=0x00825d40 --stop-address=0x00825e65 dumps/sots.exe dumps/sots.exe: file format pei-i386 Disassembly of section .text: 00825d40 <.text+0x424d40>: 825d40: 55 push ebp 825d41: 8b ec mov ebp,esp 825d43: 51 push ecx 825d44: 53 push ebx 825d45: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8] 825d48: 56 push esi 825d49: 33 f6 xor esi,esi 825d4b: 3b de cmp ebx,esi 825d4d: 75 0a jne 0x825d59 825d4f: 5e pop esi 825d50: 33 c0 xor eax,eax 825d52: 5b pop ebx 825d53: 8b e5 mov esp,ebp 825d55: 5d pop ebp 825d56: c2 08 00 ret 0x8 825d59: 8b 4b 0c mov ecx,DWORD PTR [ebx+0xc] 825d5c: 2b 4b 08 sub ecx,DWORD PTR [ebx+0x8] 825d5f: b8 09 cb 3d 8d mov eax,0x8d3dcb09 825d64: f7 e9 imul ecx 825d66: 03 d1 add edx,ecx 825d68: c1 fa 06 sar edx,0x6 825d6b: 8b c2 mov eax,edx 825d6d: c1 e8 1f shr eax,0x1f 825d70: 03 c2 add eax,edx 825d72: 57 push edi 825d73: 89 75 fc mov DWORD PTR [ebp-0x4],esi 825d76: 0f 84 d5 00 00 00 je 0x825e51 825d7c: 8b 7d 0c mov edi,DWORD PTR [ebp+0xc] 825d7f: 89 75 08 mov DWORD PTR [ebp+0x8],esi 825d82: 8b 73 08 mov esi,DWORD PTR [ebx+0x8] 825d85: 03 75 08 add esi,DWORD PTR [ebp+0x8] 825d88: 8b 4e 6c mov ecx,DWORD PTR [esi+0x6c] 825d8b: 3b 4f 6c cmp ecx,DWORD PTR [edi+0x6c] 825d8e: 0f 85 91 00 00 00 jne 0x825e25 825d94: 8b 56 40 mov edx,DWORD PTR [esi+0x40] 825d97: 3b 57 40 cmp edx,DWORD PTR [edi+0x40] 825d9a: 0f 85 85 00 00 00 jne 0x825e25 825da0: d9 46 44 fld DWORD PTR [esi+0x44] 825da3: d9 47 44 fld DWORD PTR [edi+0x44] 825da6: da e9 fucompp 825da8: df e0 fnstsw ax 825daa: f6 c4 44 test ah,0x44 825dad: 7a 76 jp 0x825e25 825daf: d9 46 48 fld DWORD PTR [esi+0x48] 825db2: d9 47 48 fld DWORD PTR [edi+0x48] 825db5: da e9 fucompp 825db7: df e0 fnstsw ax 825db9: f6 c4 44 test ah,0x44 825dbc: 7a 67 jp 0x825e25 825dbe: d9 46 4c fld DWORD PTR [esi+0x4c] 825dc1: d9 47 4c fld DWORD PTR [edi+0x4c] 825dc4: da e9 fucompp 825dc6: df e0 fnstsw ax 825dc8: f6 c4 44 test ah,0x44 825dcb: 7a 58 jp 0x825e25 825dcd: 83 7f 38 10 cmp DWORD PTR [edi+0x38],0x10 825dd1: 8b 57 34 mov edx,DWORD PTR [edi+0x34] 825dd4: 8d 47 24 lea eax,[edi+0x24] 825dd7: 8d 4e 24 lea ecx,[esi+0x24] 825dda: 72 02 jb 0x825dde 825ddc: 8b 00 mov eax,DWORD PTR [eax] 825dde: 52 push edx 825ddf: 50 push eax 825de0: 8b 41 10 mov eax,DWORD PTR [ecx+0x10] 825de3: 50 push eax 825de4: 6a 00 push 0x0 825de6: e8 b5 d8 bf ff call 0x4236a0 825deb: 85 c0 test eax,eax 825ded: 75 36 jne 0x825e25 825def: 83 7f 64 10 cmp DWORD PTR [edi+0x64],0x10 825df3: 8b 57 60 mov edx,DWORD PTR [edi+0x60] 825df6: 8d 47 50 lea eax,[edi+0x50] 825df9: 8d 4e 50 lea ecx,[esi+0x50] 825dfc: 72 02 jb 0x825e00 825dfe: 8b 00 mov eax,DWORD PTR [eax] 825e00: 52 push edx 825e01: 8b 51 10 mov edx,DWORD PTR [ecx+0x10] 825e04: 50 push eax 825e05: 52 push edx 825e06: 6a 00 push 0x0 825e08: e8 93 d8 bf ff call 0x4236a0 825e0d: 85 c0 test eax,eax 825e0f: 75 14 jne 0x825e25 825e11: 8d 47 08 lea eax,[edi+0x8] 825e14: 50 push eax 825e15: 8d 4e 08 lea ecx,[esi+0x8] 825e18: 51 push ecx 825e19: e8 a2 9a c4 ff call 0x46f8c0 825e1e: 83 c4 08 add esp,0x8 825e21: 84 c0 test al,al 825e23: 74 37 je 0x825e5c 825e25: 8b 4b 0c mov ecx,DWORD PTR [ebx+0xc] 825e28: 2b 4b 08 sub ecx,DWORD PTR [ebx+0x8] 825e2b: 8b 75 fc mov esi,DWORD PTR [ebp-0x4] 825e2e: 83 45 08 74 add DWORD PTR [ebp+0x8],0x74 825e32: b8 09 cb 3d 8d mov eax,0x8d3dcb09 825e37: f7 e9 imul ecx 825e39: 03 d1 add edx,ecx 825e3b: c1 fa 06 sar edx,0x6 825e3e: 8b c2 mov eax,edx 825e40: c1 e8 1f shr eax,0x1f 825e43: 46 inc esi 825e44: 03 c2 add eax,edx 825e46: 89 75 fc mov DWORD PTR [ebp-0x4],esi 825e49: 3b f0 cmp esi,eax 825e4b: 0f 82 31 ff ff ff jb 0x825d82 825e51: 5f pop edi 825e52: 5e pop esi 825e53: 33 c0 xor eax,eax 825e55: 5b pop ebx 825e56: 8b e5 mov esp,ebp 825e58: 5d pop ebp 825e59: c2 08 00 ret 0x8 825e5c: 5f pop edi 825e5d: 8b c6 mov eax,esi 825e5f: 5e pop esi 825e60: 5b pop ebx 825e61: 8b e5 mov esp,ebp 825e63: 5d pop ebp 825e64: c2 08 00 ret 0x8 # $ objdump -D -Mintel --start-address=0x0046f8c0 --stop-address=0x0046f8f0 dumps/sots.exe dumps/sots.exe: file format pei-i386 Disassembly of section .text: 0046f8c0 <.text+0x6e8c0>: 46f8c0: 55 push ebp 46f8c1: 8b ec mov ebp,esp 46f8c3: 8b 45 0c mov eax,DWORD PTR [ebp+0xc] 46f8c6: 83 78 14 10 cmp DWORD PTR [eax+0x14],0x10 46f8ca: 8b 48 10 mov ecx,DWORD PTR [eax+0x10] 46f8cd: 72 02 jb 0x46f8d1 46f8cf: 8b 00 mov eax,DWORD PTR [eax] 46f8d1: 51 push ecx 46f8d2: 8b 4d 08 mov ecx,DWORD PTR [ebp+0x8] 46f8d5: 50 push eax 46f8d6: 8b 41 10 mov eax,DWORD PTR [ecx+0x10] 46f8d9: 50 push eax 46f8da: 6a 00 push 0x0 46f8dc: e8 bf 3d fb ff call 0x4236a0 46f8e1: f7 d8 neg eax 46f8e3: 1b c0 sbb eax,eax 46f8e5: f7 d8 neg eax 46f8e7: 5d pop ebp 46f8e8: c3 ret 46f8e9: cc int3 46f8ea: cc int3 46f8eb: cc int3 46f8ec: cc int3 46f8ed: cc int3 46f8ee: cc int3 46f8ef: cc int3 # $ objdump -D -Mintel --start-address=0x004236a0 --stop-address=0x0042370d dumps/sots.exe dumps/sots.exe: file format pei-i386 Disassembly of section .text: 004236a0 <.text+0x226a0>: 4236a0: 55 push ebp 4236a1: 8b ec mov ebp,esp 4236a3: 8b 41 10 mov eax,DWORD PTR [ecx+0x10] 4236a6: 53 push ebx 4236a7: 56 push esi 4236a8: 57 push edi 4236a9: 8b 7d 08 mov edi,DWORD PTR [ebp+0x8] 4236ac: 3b c7 cmp eax,edi 4236ae: 73 0b jae 0x4236bb 4236b0: 68 60 1f 9e 00 push 0x9e1f60 4236b5: ff 15 54 d1 9d 00 call DWORD PTR ds:0x9dd154 4236bb: 8b 75 0c mov esi,DWORD PTR [ebp+0xc] 4236be: 2b c7 sub eax,edi 4236c0: 3b c6 cmp eax,esi 4236c2: 73 02 jae 0x4236c6 4236c4: 8b f0 mov esi,eax 4236c6: 8b 5d 14 mov ebx,DWORD PTR [ebp+0x14] 4236c9: 8b d6 mov edx,esi 4236cb: 3b f3 cmp esi,ebx 4236cd: 72 02 jb 0x4236d1 4236cf: 8b d3 mov edx,ebx 4236d1: 83 79 14 10 cmp DWORD PTR [ecx+0x14],0x10 4236d5: 72 04 jb 0x4236db 4236d7: 8b 01 mov eax,DWORD PTR [ecx] 4236d9: eb 02 jmp 0x4236dd 4236db: 8b c1 mov eax,ecx 4236dd: 8b 4d 10 mov ecx,DWORD PTR [ebp+0x10] 4236e0: 52 push edx 4236e1: 51 push ecx 4236e2: 03 c7 add eax,edi 4236e4: 50 push eax 4236e5: e8 36 f0 ff ff call 0x422720 4236ea: 83 c4 0c add esp,0xc 4236ed: 85 c0 test eax,eax 4236ef: 75 15 jne 0x423706 4236f1: 3b f3 cmp esi,ebx 4236f3: 73 0a jae 0x4236ff 4236f5: 5f pop edi 4236f6: 5e pop esi 4236f7: 83 c8 ff or eax,0xffffffff 4236fa: 5b pop ebx 4236fb: 5d pop ebp 4236fc: c2 10 00 ret 0x10 4236ff: 33 c0 xor eax,eax 423701: 3b f3 cmp esi,ebx 423703: 0f 95 c0 setne al 423706: 5f pop edi 423707: 5e pop esi 423708: 5b pop ebx 423709: 5d pop ebp 42370a: c2 10 00 ret 0x10 # $ objdump -D -Mintel --start-address=0x00422720 --stop-address=0x00422796 dumps/sots.exe dumps/sots.exe: file format pei-i386 Disassembly of section .text: 00422720 <.text+0x21720>: 422720: 55 push ebp 422721: 8b ec mov ebp,esp 422723: 8b 4d 0c mov ecx,DWORD PTR [ebp+0xc] 422726: 8b 55 08 mov edx,DWORD PTR [ebp+0x8] 422729: 56 push esi 42272a: 8b 75 10 mov esi,DWORD PTR [ebp+0x10] 42272d: 57 push edi 42272e: 83 fe 04 cmp esi,0x4 422731: 72 14 jb 0x422747 422733: 8b 02 mov eax,DWORD PTR [edx] 422735: 3b 01 cmp eax,DWORD PTR [ecx] 422737: 75 12 jne 0x42274b 422739: 83 ee 04 sub esi,0x4 42273c: 83 c1 04 add ecx,0x4 42273f: 83 c2 04 add edx,0x4 422742: 83 fe 04 cmp esi,0x4 422745: 73 ec jae 0x422733 422747: 85 f6 test esi,esi 422749: 74 45 je 0x422790 42274b: 0f b6 02 movzx eax,BYTE PTR [edx] 42274e: 0f b6 39 movzx edi,BYTE PTR [ecx] 422751: 2b c7 sub eax,edi 422753: 75 31 jne 0x422786 422755: 83 fe 01 cmp esi,0x1 422758: 76 36 jbe 0x422790 42275a: 0f b6 42 01 movzx eax,BYTE PTR [edx+0x1] 42275e: 0f b6 79 01 movzx edi,BYTE PTR [ecx+0x1] 422762: 2b c7 sub eax,edi 422764: 75 20 jne 0x422786 422766: 83 fe 02 cmp esi,0x2 422769: 76 25 jbe 0x422790 42276b: 0f b6 42 02 movzx eax,BYTE PTR [edx+0x2] 42276f: 0f b6 79 02 movzx edi,BYTE PTR [ecx+0x2] 422773: 2b c7 sub eax,edi 422775: 75 0f jne 0x422786 422777: 83 fe 03 cmp esi,0x3 42277a: 76 14 jbe 0x422790 42277c: 0f b6 42 03 movzx eax,BYTE PTR [edx+0x3] 422780: 0f b6 49 03 movzx ecx,BYTE PTR [ecx+0x3] 422784: 2b c1 sub eax,ecx 422786: c1 f8 1f sar eax,0x1f 422789: 5f pop edi 42278a: 83 c8 01 or eax,0x1 42278d: 5e pop esi 42278e: 5d pop ebp 42278f: c3 ret 422790: 5f pop edi 422791: 33 c0 xor eax,eax 422793: 5e pop esi 422794: 5d pop ebp 422795: c3 ret