167 lines
8.3 KiB
Text
167 lines
8.3 KiB
Text
# Read-only local capture. Input: dumps/sots.exe
|
|
# SHA-256: 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841
|
|
# Tool: GNU objdump 2.38, Intel syntax. Commands and selected raw instruction windows:
|
|
# objdump -D -Mintel --start-address=0x008562a0 --stop-address=0x0085630d dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x007b7320 --stop-address=0x007b739f dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x007b34e0 --stop-address=0x007b35ef dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x0079a150 --stop-address=0x0079a1d9 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x0086c580 --stop-address=0x0086c62e dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x007693f0 --stop-address=0x007694c0 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x0061ae90 --stop-address=0x0061aefc dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x0057e590 --stop-address=0x0057e5e4 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x004249a0 --stop-address=0x00424ada dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x00924faa --stop-address=0x00924fbc dumps/sots.exe
|
|
|
|
008562a0 <.text+0x4552a0>:
|
|
8562c5: 8b f1 mov esi,ecx
|
|
8562cc: 8d 4e 0c lea ecx,[esi+0xc]
|
|
8562cf: c7 06 9c 43 a2 00 mov DWORD PTR [esi],0xa2439c
|
|
8562d5: 53 push ebx
|
|
8562d6: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
|
|
8562dd: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
|
|
8562e0: 68 0c 10 9e 00 push 0x9e100c
|
|
8562e8: 88 19 mov BYTE PTR [ecx],bl
|
|
8562ea: e8 61 f2 bc ff call 0x425550
|
|
8562ef: 33 c0 xor eax,eax
|
|
8562f1: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
8562f4: 88 5e 08 mov BYTE PTR [esi+0x8],bl
|
|
8562f7: 89 5e 28 mov DWORD PTR [esi+0x28],ebx
|
|
8562fa: 8b c6 mov eax,esi
|
|
85630c: c3 ret
|
|
|
|
007b7320 <.text+0x3b6320>:
|
|
7b734a: 3b 4e 08 cmp ecx,DWORD PTR [esi+0x8]
|
|
7b734d: 75 09 jne 0x7b7358
|
|
7b734f: 6a 01 push 0x1
|
|
7b7351: 8b ce mov ecx,esi
|
|
7b7353: e8 c8 e4 ff ff call 0x7b5820
|
|
7b7358: 8b 46 04 mov eax,DWORD PTR [esi+0x4]
|
|
7b735b: 6b ff 2c imul edi,edi,0x2c
|
|
7b735e: 03 3e add edi,DWORD PTR [esi]
|
|
7b7360: 8d 4e 0c lea ecx,[esi+0xc]
|
|
7b7363: 57 push edi
|
|
7b7364: 50 push eax
|
|
7b7365: 51 push ecx
|
|
7b7366: e8 e5 2d fe ff call 0x79a150
|
|
7b736b: 83 c4 0c add esp,0xc
|
|
7b736e: 83 46 04 2c add DWORD PTR [esi+0x4],0x2c
|
|
7b7375: c2 04 00 ret 0x4
|
|
|
|
0079a150 <.text+0x399150>:
|
|
79a175: 8b 75 0c mov esi,DWORD PTR [ebp+0xc]
|
|
79a184: 8b 7d 10 mov edi,DWORD PTR [ebp+0x10]
|
|
79a187: c7 06 9c 43 a2 00 mov DWORD PTR [esi],0xa2439c
|
|
79a18d: 66 8b 4f 04 mov cx,WORD PTR [edi+0x4]
|
|
79a191: 66 89 4e 04 mov WORD PTR [esi+0x4],cx
|
|
79a195: 66 8b 57 06 mov dx,WORD PTR [edi+0x6]
|
|
79a199: 66 89 56 06 mov WORD PTR [esi+0x6],dx
|
|
79a19d: 8a 4f 08 mov cl,BYTE PTR [edi+0x8]
|
|
79a1a0: 88 4e 08 mov BYTE PTR [esi+0x8],cl
|
|
79a1a3: 6a ff push 0xffffffff
|
|
79a1a5: 8d 4e 0c lea ecx,[esi+0xc]
|
|
79a1a8: 50 push eax
|
|
79a1a9: 8d 57 0c lea edx,[edi+0xc]
|
|
79a1ac: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
|
|
79a1b3: 89 41 10 mov DWORD PTR [ecx+0x10],eax
|
|
79a1b6: 52 push edx
|
|
79a1bb: 88 01 mov BYTE PTR [ecx],al
|
|
79a1bd: e8 6e b2 c8 ff call 0x425430
|
|
79a1c2: 8b 47 28 mov eax,DWORD PTR [edi+0x28]
|
|
79a1c5: 89 46 28 mov DWORD PTR [esi+0x28],eax
|
|
79a1d8: c3 ret
|
|
|
|
007b34e0 <.text+0x3b24e0>:
|
|
7b3541: 8d 7e 0c lea edi,[esi+0xc]
|
|
7b3544: 53 push ebx
|
|
7b3545: 8b cf mov ecx,edi
|
|
7b3547: e8 44 b0 dc ff call 0x57e590
|
|
7b3557: 50 push eax
|
|
7b3558: 8b 45 ec mov eax,DWORD PTR [ebp-0x14]
|
|
7b355b: 6a 00 push 0x0
|
|
7b355d: 57 push edi
|
|
7b355e: 50 push eax
|
|
7b355f: 51 push ecx
|
|
7b3560: 52 push edx
|
|
7b3568: e8 e3 b0 0a 00 call 0x85e650
|
|
7b35a0: 8b 13 mov edx,DWORD PTR [ebx]
|
|
7b35a2: 8b 02 mov eax,DWORD PTR [edx]
|
|
7b35a4: 6a 00 push 0x0
|
|
7b35a6: 8b cb mov ecx,ebx
|
|
7b35a8: ff d0 call eax
|
|
7b35aa: 83 c3 2c add ebx,0x2c
|
|
7b35b2: 8b 0e mov ecx,DWORD PTR [esi]
|
|
7b35b4: 51 push ecx
|
|
7b35b5: e8 f0 19 17 00 call 0x924faa
|
|
7b35c0: 8b ce mov ecx,esi
|
|
7b35c2: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
|
|
|
|
0057e590 <.text+0x17d590>:
|
|
57e5a7: 6b c9 2c imul ecx,ecx,0x2c
|
|
57e5aa: 51 push ecx
|
|
57e5ab: e8 06 6a 3a 00 call 0x924fb6
|
|
57e5e3: c2 04 00 ret 0x4
|
|
|
|
0086c580 <.text+0x46b580>:
|
|
86c5cc: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
|
|
86c5cf: 75 09 jne 0x86c5da
|
|
86c5d1: 6a 01 push 0x1
|
|
86c5d3: 8b cf mov ecx,edi
|
|
86c5d5: e8 26 cf ff ff call 0x869500
|
|
86c5da: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
|
|
86c5dd: 6b f6 74 imul esi,esi,0x74
|
|
86c5e0: 03 37 add esi,DWORD PTR [edi]
|
|
86c60f: 85 c9 test ecx,ecx
|
|
86c611: 74 06 je 0x86c619
|
|
86c613: 56 push esi
|
|
86c614: e8 d7 cd ef ff call 0x7693f0
|
|
86c619: 83 47 04 74 add DWORD PTR [edi+0x4],0x74
|
|
86c62d: c2 04 00 ret 0x4
|
|
|
|
007693f0 <.text+0x3683f0>:
|
|
76941b: 8b 7d 08 mov edi,DWORD PTR [ebp+0x8]
|
|
76941e: c7 06 58 19 a2 00 mov DWORD PTR [esi],0xa21958
|
|
769424: 8b 47 04 mov eax,DWORD PTR [edi+0x4]
|
|
76942b: 8d 4e 08 lea ecx,[esi+0x8]
|
|
769435: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
|
|
769445: e8 e6 bf cb ff call 0x425430
|
|
76944c: 8d 4e 24 lea ecx,[esi+0x24]
|
|
769464: e8 c7 bf cb ff call 0x425430
|
|
769469: 8b 4f 40 mov ecx,DWORD PTR [edi+0x40]
|
|
76946c: 89 4e 40 mov DWORD PTR [esi+0x40],ecx
|
|
769481: 6a ff push 0xffffffff
|
|
769483: 8d 4e 50 lea ecx,[esi+0x50]
|
|
76949b: e8 90 bf cb ff call 0x425430
|
|
7694a0: 8b 47 6c mov eax,DWORD PTR [edi+0x6c]
|
|
7694a3: 89 46 6c mov DWORD PTR [esi+0x6c],eax
|
|
7694a6: 8b 4f 70 mov ecx,DWORD PTR [edi+0x70]
|
|
7694a9: 89 4e 70 mov DWORD PTR [esi+0x70],ecx
|
|
7694bf: c2 04 00 ret 0x4
|
|
|
|
0061ae90 <.text+0x219e90>:
|
|
61ae94: 83 7e 64 10 cmp DWORD PTR [esi+0x64],0x10
|
|
61ae9a: 8b 46 50 mov eax,DWORD PTR [esi+0x50]
|
|
61ae9d: 50 push eax
|
|
61ae9e: e8 07 a1 30 00 call 0x924faa
|
|
61aeb5: 83 7e 38 10 cmp DWORD PTR [esi+0x38],0x10
|
|
61aebb: 8b 4e 24 mov ecx,DWORD PTR [esi+0x24]
|
|
61aebe: 51 push ecx
|
|
61aebf: e8 e6 a0 30 00 call 0x924faa
|
|
61aed4: 83 7e 1c 10 cmp DWORD PTR [esi+0x1c],0x10
|
|
61aeda: 8b 56 08 mov edx,DWORD PTR [esi+0x8]
|
|
61aedd: 52 push edx
|
|
61aede: e8 c7 a0 30 00 call 0x924faa
|
|
61aefb: c3 ret
|
|
|
|
004249a0 <.text+0x239a0>:
|
|
424a19: 51 push ecx
|
|
424a1a: e8 97 05 50 00 call 0x924fb6
|
|
424aa4: 8b 0f mov ecx,DWORD PTR [edi]
|
|
424aa6: 51 push ecx
|
|
424aa7: e8 fe 04 50 00 call 0x924faa
|
|
424ab5: 89 07 mov DWORD PTR [edi],eax
|
|
424ab7: 89 77 14 mov DWORD PTR [edi+0x14],esi
|
|
424aba: 89 5f 10 mov DWORD PTR [edi+0x10],ebx
|
|
|
|
00924faa <.text+0x523faa>:
|
|
924faa: ff 25 c8 d1 9d 00 jmp DWORD PTR ds:0x9dd1c8
|
|
924fb6: ff 25 d0 d1 9d 00 jmp DWORD PTR ds:0x9dd1d0
|