288 lines
13 KiB
Text
288 lines
13 KiB
Text
# Read-only local capture. Input: dumps/sots.exe
|
|
# SHA-256: 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841
|
|
# Tool: GNU objdump (GNU Binutils for Ubuntu) 2.38, Intel syntax.
|
|
# Every command below exited 0. Output is unfiltered.
|
|
#
|
|
# $ objdump -D -Mintel --start-address=0x00825d40 --stop-address=0x00825e65 dumps/sots.exe
|
|
|
|
dumps/sots.exe: file format pei-i386
|
|
|
|
|
|
Disassembly of section .text:
|
|
|
|
00825d40 <.text+0x424d40>:
|
|
825d40: 55 push ebp
|
|
825d41: 8b ec mov ebp,esp
|
|
825d43: 51 push ecx
|
|
825d44: 53 push ebx
|
|
825d45: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
|
|
825d48: 56 push esi
|
|
825d49: 33 f6 xor esi,esi
|
|
825d4b: 3b de cmp ebx,esi
|
|
825d4d: 75 0a jne 0x825d59
|
|
825d4f: 5e pop esi
|
|
825d50: 33 c0 xor eax,eax
|
|
825d52: 5b pop ebx
|
|
825d53: 8b e5 mov esp,ebp
|
|
825d55: 5d pop ebp
|
|
825d56: c2 08 00 ret 0x8
|
|
825d59: 8b 4b 0c mov ecx,DWORD PTR [ebx+0xc]
|
|
825d5c: 2b 4b 08 sub ecx,DWORD PTR [ebx+0x8]
|
|
825d5f: b8 09 cb 3d 8d mov eax,0x8d3dcb09
|
|
825d64: f7 e9 imul ecx
|
|
825d66: 03 d1 add edx,ecx
|
|
825d68: c1 fa 06 sar edx,0x6
|
|
825d6b: 8b c2 mov eax,edx
|
|
825d6d: c1 e8 1f shr eax,0x1f
|
|
825d70: 03 c2 add eax,edx
|
|
825d72: 57 push edi
|
|
825d73: 89 75 fc mov DWORD PTR [ebp-0x4],esi
|
|
825d76: 0f 84 d5 00 00 00 je 0x825e51
|
|
825d7c: 8b 7d 0c mov edi,DWORD PTR [ebp+0xc]
|
|
825d7f: 89 75 08 mov DWORD PTR [ebp+0x8],esi
|
|
825d82: 8b 73 08 mov esi,DWORD PTR [ebx+0x8]
|
|
825d85: 03 75 08 add esi,DWORD PTR [ebp+0x8]
|
|
825d88: 8b 4e 6c mov ecx,DWORD PTR [esi+0x6c]
|
|
825d8b: 3b 4f 6c cmp ecx,DWORD PTR [edi+0x6c]
|
|
825d8e: 0f 85 91 00 00 00 jne 0x825e25
|
|
825d94: 8b 56 40 mov edx,DWORD PTR [esi+0x40]
|
|
825d97: 3b 57 40 cmp edx,DWORD PTR [edi+0x40]
|
|
825d9a: 0f 85 85 00 00 00 jne 0x825e25
|
|
825da0: d9 46 44 fld DWORD PTR [esi+0x44]
|
|
825da3: d9 47 44 fld DWORD PTR [edi+0x44]
|
|
825da6: da e9 fucompp
|
|
825da8: df e0 fnstsw ax
|
|
825daa: f6 c4 44 test ah,0x44
|
|
825dad: 7a 76 jp 0x825e25
|
|
825daf: d9 46 48 fld DWORD PTR [esi+0x48]
|
|
825db2: d9 47 48 fld DWORD PTR [edi+0x48]
|
|
825db5: da e9 fucompp
|
|
825db7: df e0 fnstsw ax
|
|
825db9: f6 c4 44 test ah,0x44
|
|
825dbc: 7a 67 jp 0x825e25
|
|
825dbe: d9 46 4c fld DWORD PTR [esi+0x4c]
|
|
825dc1: d9 47 4c fld DWORD PTR [edi+0x4c]
|
|
825dc4: da e9 fucompp
|
|
825dc6: df e0 fnstsw ax
|
|
825dc8: f6 c4 44 test ah,0x44
|
|
825dcb: 7a 58 jp 0x825e25
|
|
825dcd: 83 7f 38 10 cmp DWORD PTR [edi+0x38],0x10
|
|
825dd1: 8b 57 34 mov edx,DWORD PTR [edi+0x34]
|
|
825dd4: 8d 47 24 lea eax,[edi+0x24]
|
|
825dd7: 8d 4e 24 lea ecx,[esi+0x24]
|
|
825dda: 72 02 jb 0x825dde
|
|
825ddc: 8b 00 mov eax,DWORD PTR [eax]
|
|
825dde: 52 push edx
|
|
825ddf: 50 push eax
|
|
825de0: 8b 41 10 mov eax,DWORD PTR [ecx+0x10]
|
|
825de3: 50 push eax
|
|
825de4: 6a 00 push 0x0
|
|
825de6: e8 b5 d8 bf ff call 0x4236a0
|
|
825deb: 85 c0 test eax,eax
|
|
825ded: 75 36 jne 0x825e25
|
|
825def: 83 7f 64 10 cmp DWORD PTR [edi+0x64],0x10
|
|
825df3: 8b 57 60 mov edx,DWORD PTR [edi+0x60]
|
|
825df6: 8d 47 50 lea eax,[edi+0x50]
|
|
825df9: 8d 4e 50 lea ecx,[esi+0x50]
|
|
825dfc: 72 02 jb 0x825e00
|
|
825dfe: 8b 00 mov eax,DWORD PTR [eax]
|
|
825e00: 52 push edx
|
|
825e01: 8b 51 10 mov edx,DWORD PTR [ecx+0x10]
|
|
825e04: 50 push eax
|
|
825e05: 52 push edx
|
|
825e06: 6a 00 push 0x0
|
|
825e08: e8 93 d8 bf ff call 0x4236a0
|
|
825e0d: 85 c0 test eax,eax
|
|
825e0f: 75 14 jne 0x825e25
|
|
825e11: 8d 47 08 lea eax,[edi+0x8]
|
|
825e14: 50 push eax
|
|
825e15: 8d 4e 08 lea ecx,[esi+0x8]
|
|
825e18: 51 push ecx
|
|
825e19: e8 a2 9a c4 ff call 0x46f8c0
|
|
825e1e: 83 c4 08 add esp,0x8
|
|
825e21: 84 c0 test al,al
|
|
825e23: 74 37 je 0x825e5c
|
|
825e25: 8b 4b 0c mov ecx,DWORD PTR [ebx+0xc]
|
|
825e28: 2b 4b 08 sub ecx,DWORD PTR [ebx+0x8]
|
|
825e2b: 8b 75 fc mov esi,DWORD PTR [ebp-0x4]
|
|
825e2e: 83 45 08 74 add DWORD PTR [ebp+0x8],0x74
|
|
825e32: b8 09 cb 3d 8d mov eax,0x8d3dcb09
|
|
825e37: f7 e9 imul ecx
|
|
825e39: 03 d1 add edx,ecx
|
|
825e3b: c1 fa 06 sar edx,0x6
|
|
825e3e: 8b c2 mov eax,edx
|
|
825e40: c1 e8 1f shr eax,0x1f
|
|
825e43: 46 inc esi
|
|
825e44: 03 c2 add eax,edx
|
|
825e46: 89 75 fc mov DWORD PTR [ebp-0x4],esi
|
|
825e49: 3b f0 cmp esi,eax
|
|
825e4b: 0f 82 31 ff ff ff jb 0x825d82
|
|
825e51: 5f pop edi
|
|
825e52: 5e pop esi
|
|
825e53: 33 c0 xor eax,eax
|
|
825e55: 5b pop ebx
|
|
825e56: 8b e5 mov esp,ebp
|
|
825e58: 5d pop ebp
|
|
825e59: c2 08 00 ret 0x8
|
|
825e5c: 5f pop edi
|
|
825e5d: 8b c6 mov eax,esi
|
|
825e5f: 5e pop esi
|
|
825e60: 5b pop ebx
|
|
825e61: 8b e5 mov esp,ebp
|
|
825e63: 5d pop ebp
|
|
825e64: c2 08 00 ret 0x8
|
|
|
|
# $ objdump -D -Mintel --start-address=0x0046f8c0 --stop-address=0x0046f8f0 dumps/sots.exe
|
|
|
|
dumps/sots.exe: file format pei-i386
|
|
|
|
|
|
Disassembly of section .text:
|
|
|
|
0046f8c0 <.text+0x6e8c0>:
|
|
46f8c0: 55 push ebp
|
|
46f8c1: 8b ec mov ebp,esp
|
|
46f8c3: 8b 45 0c mov eax,DWORD PTR [ebp+0xc]
|
|
46f8c6: 83 78 14 10 cmp DWORD PTR [eax+0x14],0x10
|
|
46f8ca: 8b 48 10 mov ecx,DWORD PTR [eax+0x10]
|
|
46f8cd: 72 02 jb 0x46f8d1
|
|
46f8cf: 8b 00 mov eax,DWORD PTR [eax]
|
|
46f8d1: 51 push ecx
|
|
46f8d2: 8b 4d 08 mov ecx,DWORD PTR [ebp+0x8]
|
|
46f8d5: 50 push eax
|
|
46f8d6: 8b 41 10 mov eax,DWORD PTR [ecx+0x10]
|
|
46f8d9: 50 push eax
|
|
46f8da: 6a 00 push 0x0
|
|
46f8dc: e8 bf 3d fb ff call 0x4236a0
|
|
46f8e1: f7 d8 neg eax
|
|
46f8e3: 1b c0 sbb eax,eax
|
|
46f8e5: f7 d8 neg eax
|
|
46f8e7: 5d pop ebp
|
|
46f8e8: c3 ret
|
|
46f8e9: cc int3
|
|
46f8ea: cc int3
|
|
46f8eb: cc int3
|
|
46f8ec: cc int3
|
|
46f8ed: cc int3
|
|
46f8ee: cc int3
|
|
46f8ef: cc int3
|
|
|
|
# $ objdump -D -Mintel --start-address=0x004236a0 --stop-address=0x0042370d dumps/sots.exe
|
|
|
|
dumps/sots.exe: file format pei-i386
|
|
|
|
|
|
Disassembly of section .text:
|
|
|
|
004236a0 <.text+0x226a0>:
|
|
4236a0: 55 push ebp
|
|
4236a1: 8b ec mov ebp,esp
|
|
4236a3: 8b 41 10 mov eax,DWORD PTR [ecx+0x10]
|
|
4236a6: 53 push ebx
|
|
4236a7: 56 push esi
|
|
4236a8: 57 push edi
|
|
4236a9: 8b 7d 08 mov edi,DWORD PTR [ebp+0x8]
|
|
4236ac: 3b c7 cmp eax,edi
|
|
4236ae: 73 0b jae 0x4236bb
|
|
4236b0: 68 60 1f 9e 00 push 0x9e1f60
|
|
4236b5: ff 15 54 d1 9d 00 call DWORD PTR ds:0x9dd154
|
|
4236bb: 8b 75 0c mov esi,DWORD PTR [ebp+0xc]
|
|
4236be: 2b c7 sub eax,edi
|
|
4236c0: 3b c6 cmp eax,esi
|
|
4236c2: 73 02 jae 0x4236c6
|
|
4236c4: 8b f0 mov esi,eax
|
|
4236c6: 8b 5d 14 mov ebx,DWORD PTR [ebp+0x14]
|
|
4236c9: 8b d6 mov edx,esi
|
|
4236cb: 3b f3 cmp esi,ebx
|
|
4236cd: 72 02 jb 0x4236d1
|
|
4236cf: 8b d3 mov edx,ebx
|
|
4236d1: 83 79 14 10 cmp DWORD PTR [ecx+0x14],0x10
|
|
4236d5: 72 04 jb 0x4236db
|
|
4236d7: 8b 01 mov eax,DWORD PTR [ecx]
|
|
4236d9: eb 02 jmp 0x4236dd
|
|
4236db: 8b c1 mov eax,ecx
|
|
4236dd: 8b 4d 10 mov ecx,DWORD PTR [ebp+0x10]
|
|
4236e0: 52 push edx
|
|
4236e1: 51 push ecx
|
|
4236e2: 03 c7 add eax,edi
|
|
4236e4: 50 push eax
|
|
4236e5: e8 36 f0 ff ff call 0x422720
|
|
4236ea: 83 c4 0c add esp,0xc
|
|
4236ed: 85 c0 test eax,eax
|
|
4236ef: 75 15 jne 0x423706
|
|
4236f1: 3b f3 cmp esi,ebx
|
|
4236f3: 73 0a jae 0x4236ff
|
|
4236f5: 5f pop edi
|
|
4236f6: 5e pop esi
|
|
4236f7: 83 c8 ff or eax,0xffffffff
|
|
4236fa: 5b pop ebx
|
|
4236fb: 5d pop ebp
|
|
4236fc: c2 10 00 ret 0x10
|
|
4236ff: 33 c0 xor eax,eax
|
|
423701: 3b f3 cmp esi,ebx
|
|
423703: 0f 95 c0 setne al
|
|
423706: 5f pop edi
|
|
423707: 5e pop esi
|
|
423708: 5b pop ebx
|
|
423709: 5d pop ebp
|
|
42370a: c2 10 00 ret 0x10
|
|
|
|
# $ objdump -D -Mintel --start-address=0x00422720 --stop-address=0x00422796 dumps/sots.exe
|
|
|
|
dumps/sots.exe: file format pei-i386
|
|
|
|
|
|
Disassembly of section .text:
|
|
|
|
00422720 <.text+0x21720>:
|
|
422720: 55 push ebp
|
|
422721: 8b ec mov ebp,esp
|
|
422723: 8b 4d 0c mov ecx,DWORD PTR [ebp+0xc]
|
|
422726: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
|
|
422729: 56 push esi
|
|
42272a: 8b 75 10 mov esi,DWORD PTR [ebp+0x10]
|
|
42272d: 57 push edi
|
|
42272e: 83 fe 04 cmp esi,0x4
|
|
422731: 72 14 jb 0x422747
|
|
422733: 8b 02 mov eax,DWORD PTR [edx]
|
|
422735: 3b 01 cmp eax,DWORD PTR [ecx]
|
|
422737: 75 12 jne 0x42274b
|
|
422739: 83 ee 04 sub esi,0x4
|
|
42273c: 83 c1 04 add ecx,0x4
|
|
42273f: 83 c2 04 add edx,0x4
|
|
422742: 83 fe 04 cmp esi,0x4
|
|
422745: 73 ec jae 0x422733
|
|
422747: 85 f6 test esi,esi
|
|
422749: 74 45 je 0x422790
|
|
42274b: 0f b6 02 movzx eax,BYTE PTR [edx]
|
|
42274e: 0f b6 39 movzx edi,BYTE PTR [ecx]
|
|
422751: 2b c7 sub eax,edi
|
|
422753: 75 31 jne 0x422786
|
|
422755: 83 fe 01 cmp esi,0x1
|
|
422758: 76 36 jbe 0x422790
|
|
42275a: 0f b6 42 01 movzx eax,BYTE PTR [edx+0x1]
|
|
42275e: 0f b6 79 01 movzx edi,BYTE PTR [ecx+0x1]
|
|
422762: 2b c7 sub eax,edi
|
|
422764: 75 20 jne 0x422786
|
|
422766: 83 fe 02 cmp esi,0x2
|
|
422769: 76 25 jbe 0x422790
|
|
42276b: 0f b6 42 02 movzx eax,BYTE PTR [edx+0x2]
|
|
42276f: 0f b6 79 02 movzx edi,BYTE PTR [ecx+0x2]
|
|
422773: 2b c7 sub eax,edi
|
|
422775: 75 0f jne 0x422786
|
|
422777: 83 fe 03 cmp esi,0x3
|
|
42277a: 76 14 jbe 0x422790
|
|
42277c: 0f b6 42 03 movzx eax,BYTE PTR [edx+0x3]
|
|
422780: 0f b6 49 03 movzx ecx,BYTE PTR [ecx+0x3]
|
|
422784: 2b c1 sub eax,ecx
|
|
422786: c1 f8 1f sar eax,0x1f
|
|
422789: 5f pop edi
|
|
42278a: 83 c8 01 or eax,0x1
|
|
42278d: 5e pop esi
|
|
42278e: 5d pop ebp
|
|
42278f: c3 ret
|
|
422790: 5f pop edi
|
|
422791: 33 c0 xor eax,eax
|
|
422793: 5e pop esi
|
|
422794: 5d pop ebp
|
|
422795: c3 ret
|