250 lines
13 KiB
Text
250 lines
13 KiB
Text
# Read-only local capture. Input: dumps/sots.exe
|
|
# SHA-256: 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841
|
|
# Tool: GNU objdump 2.38, Intel syntax. Commands:
|
|
# objdump -D -Mintel --start-address=0x00885380 --stop-address=0x00885500 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x00825d40 --stop-address=0x00825f80 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x00879eb0 --stop-address=0x0087a020 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x00884cb0 --stop-address=0x00884dc0 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x008841a0 --stop-address=0x00884440 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x00629580 --stop-address=0x00629620 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x00779850 --stop-address=0x00779a20 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x0062e120 --stop-address=0x0062e190 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x006e8f50 --stop-address=0x006e8fb0 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x0077fed0 --stop-address=0x00780040 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x007725a0 --stop-address=0x007726d0 dumps/sots.exe
|
|
# objdump -D -Mintel --start-address=0x0078af40 --stop-address=0x0078afa8 dumps/sots.exe
|
|
# objdump -s --start-address=0x00a0f070 --stop-address=0x00a0f0a0 dumps/sots.exe
|
|
|
|
# EventStorage::GetOrCreateTurnBucket: count/stride, last-match scan, construction/append.
|
|
008853aa: 8b 56 08 mov edx,DWORD PTR [esi+0x8]
|
|
008853ad: 2b 56 04 sub edx,DWORD PTR [esi+0x4]
|
|
008853b3: b8 ab aa aa 2a mov eax,0x2aaaaaab
|
|
008853d3: 39 5a 04 cmp DWORD PTR [edx+0x4],ebx
|
|
008853d6: 75 02 jne 0x8853da
|
|
008853d8: 8b fa mov edi,edx
|
|
008853da: 83 c2 18 add edx,0x18
|
|
008853e2: 3b fb cmp edi,ebx
|
|
008853e4: 74 16 je 0x8853fc
|
|
008853e6: 8b c7 mov eax,edi
|
|
008853f9: c2 04 00 ret 0x4
|
|
008853fc: c7 45 dc 7c f0 a0 00 mov DWORD PTR [ebp-0x24],0xa0f07c
|
|
00885403: 89 5d e4 mov DWORD PTR [ebp-0x1c],ebx
|
|
00885406: 89 5d e8 mov DWORD PTR [ebp-0x18],ebx
|
|
00885409: 89 5d ec mov DWORD PTR [ebp-0x14],ebx
|
|
0088540c: 8d 45 dc lea eax,[ebp-0x24]
|
|
0088540f: 50 push eax
|
|
00885413: e8 98 f8 ff ff call 0x884cb0
|
|
00885418: 8d 4d e4 lea ecx,[ebp-0x1c]
|
|
00885422: e8 59 41 da ff call 0x629580
|
|
00885427: 8b 46 08 mov eax,DWORD PTR [esi+0x8]
|
|
0088542a: 8b 4d 08 mov ecx,DWORD PTR [ebp+0x8]
|
|
0088542d: 89 48 ec mov DWORD PTR [eax-0x14],ecx
|
|
00885430: 8b 46 08 mov eax,DWORD PTR [esi+0x8]
|
|
00885433: 83 e8 18 sub eax,0x18
|
|
00885447: c2 04 00 ret 0x4
|
|
|
|
# vector<TurnEvents>::push_back: alias-sensitive source and 0x18 deep copy.
|
|
00884cda: 8b 75 08 mov esi,DWORD PTR [ebp+0x8]
|
|
00884cdd: 3b f1 cmp esi,ecx
|
|
00884cdf: 73 59 jae 0x884d3a
|
|
00884ce3: 3b c6 cmp eax,esi
|
|
00884ce5: 77 53 ja 0x884d3a
|
|
00884cfa: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
|
|
00884cff: 6a 01 push 0x1
|
|
00884d03: e8 98 f4 ff ff call 0x8841a0
|
|
00884d24: c7 00 7c f0 a0 00 mov DWORD PTR [eax],0xa0f07c
|
|
00884d2a: 8b 51 04 mov edx,DWORD PTR [ecx+0x4]
|
|
00884d34: 89 50 04 mov DWORD PTR [eax+0x4],edx
|
|
00884d37: 51 push ecx
|
|
00884d3a: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
|
|
00884d43: e8 58 f4 ff ff call 0x8841a0
|
|
00884d5c: c7 00 7c f0 a0 00 mov DWORD PTR [eax],0xa0f07c
|
|
00884d62: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
|
|
00884d6c: 89 48 04 mov DWORD PTR [eax+0x4],ecx
|
|
00884d6f: 56 push esi
|
|
00884d70: 8d 48 08 lea ecx,[eax+0x8]
|
|
00884d73: e8 d8 4a ef ff call 0x779850
|
|
00884d78: 83 47 04 18 add DWORD PTR [edi+0x4],0x18
|
|
00884d8c: c2 04 00 ret 0x4
|
|
|
|
# Outer vector growth and allocation: 1.5x, count*0x18, deep-copy then destroy/free old range.
|
|
008841ee: 3b f0 cmp esi,eax
|
|
008841f2: 8b d0 mov edx,eax
|
|
008841f4: d1 ea shr edx,1
|
|
00884205: 03 c2 add eax,edx
|
|
0088420d: 50 push eax
|
|
0088420e: e8 4d f8 ff ff call 0x883a60
|
|
00883ac4: 57 push edi
|
|
00883ac7: e8 84 54 e6 ff call 0x6e8f50
|
|
00883add: 89 7d e8 mov DWORD PTR [ebp-0x18],edi
|
|
00883ae7: e8 e4 c3 ef ff call 0x77fed0
|
|
00883b20: 8b 07 mov eax,DWORD PTR [edi]
|
|
00883b22: 8b 10 mov edx,DWORD PTR [eax]
|
|
00883b24: 6a 00 push 0x0
|
|
00883b28: ff d2 call edx
|
|
00883b2a: 83 c7 18 add edi,0x18
|
|
00883b35: e8 70 14 0a 00 call 0x924faa
|
|
00883b57: 89 56 08 mov DWORD PTR [esi+0x8],edx
|
|
00883b5a: 89 4e 04 mov DWORD PTR [esi+0x4],ecx
|
|
00883b5d: 89 3e mov DWORD PTR [esi],edi
|
|
00883b73: 8b 55 e8 mov edx,DWORD PTR [ebp-0x18]
|
|
00883b76: 52 push edx
|
|
00883b77: e8 2e 14 0a 00 call 0x924faa
|
|
00883b7f: 6a 00 push 0x0
|
|
00883b81: 6a 00 push 0x0
|
|
00883b83: e8 34 14 0a 00 call 0x924fbc
|
|
006e8f67: 8d 04 49 lea eax,[ecx+ecx*2]
|
|
006e8f6a: 03 c0 add eax,eax
|
|
006e8f6c: 03 c0 add eax,eax
|
|
006e8f6e: 03 c0 add eax,eax
|
|
006e8f70: 50 push eax
|
|
006e8f71: e8 40 c0 23 00 call 0x924fb6
|
|
006e8fa9: c2 04 00 ret 0x4
|
|
|
|
# TurnEvents range copy: vptr/turn plus deep copy of nested vector; unwind destroys completed elements.
|
|
0077ff10: 3b 7d 0c cmp edi,DWORD PTR [ebp+0xc]
|
|
0077ff1c: 8d 4f 08 lea ecx,[edi+0x8]
|
|
0077ff1f: c7 06 7c f0 a0 00 mov DWORD PTR [esi],0xa0f07c
|
|
0077ff25: 8b 47 04 mov eax,DWORD PTR [edi+0x4]
|
|
0077ff29: 8d 4e 08 lea ecx,[esi+0x8]
|
|
0077ff2f: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
0077ff32: e8 19 99 ff ff call 0x779850
|
|
0077ff37: 83 c6 18 add esi,0x18
|
|
0077ff41: 83 c7 18 add edi,0x18
|
|
0077ff46: 8b 75 ec mov esi,DWORD PTR [ebp-0x14]
|
|
0077ff50: 8b 16 mov edx,DWORD PTR [esi]
|
|
0077ff52: 8b 02 mov eax,DWORD PTR [edx]
|
|
0077ff54: 6a 00 push 0x0
|
|
0077ff58: ff d0 call eax
|
|
0077ff5a: 83 c6 18 add esi,0x18
|
|
0077ff61: 6a 00 push 0x0
|
|
0077ff63: 6a 00 push 0x0
|
|
0077ff65: e8 52 50 1a 00 call 0x924fbc
|
|
|
|
# Nested vector<PlayerEvent> copy and allocation; partial-copy unwind destroys completed events.
|
|
00779883: 33 c0 xor eax,eax
|
|
00779885: 89 06 mov DWORD PTR [esi],eax
|
|
00779887: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
0077988a: 89 46 08 mov DWORD PTR [esi+0x8],eax
|
|
007798b2: 74 4b je 0x7798ff
|
|
007798ca: 57 push edi
|
|
007798cb: e8 70 16 01 00 call 0x78af40
|
|
007798d0: 6b ff 74 imul edi,edi,0x74
|
|
007798dd: 89 06 mov DWORD PTR [esi],eax
|
|
007798df: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
007798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi
|
|
007798f4: e8 a7 8c ff ff call 0x7725a0
|
|
007798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
00779912: c2 04 00 ret 0x4
|
|
00779915: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
|
|
00779918: e8 63 fc ea ff call 0x629580
|
|
0077991d: 6a 00 push 0x0
|
|
0077991f: 6a 00 push 0x0
|
|
00779921: e8 96 b6 1a 00 call 0x924fbc
|
|
0078af57: 6b c9 74 imul ecx,ecx,0x74
|
|
0078af5a: 51 push ecx
|
|
0078af5b: e8 56 a0 19 00 call 0x924fb6
|
|
0078af93: c2 04 00 ret 0x4
|
|
007725e0: 3b 45 0c cmp eax,DWORD PTR [ebp+0xc]
|
|
007725f2: 50 push eax
|
|
007725f5: e8 f6 6d ff ff call 0x7693f0
|
|
007725fd: 83 c6 74 add esi,0x74
|
|
00772600: 83 c0 74 add eax,0x74
|
|
0077260f: 8b 75 ec mov esi,DWORD PTR [ebp-0x14]
|
|
00772620: 8b 06 mov eax,DWORD PTR [esi]
|
|
00772622: 8b 10 mov edx,DWORD PTR [eax]
|
|
00772624: 6a 00 push 0x0
|
|
00772628: ff d2 call edx
|
|
0077262a: 83 c6 74 add esi,0x74
|
|
00772631: 6a 00 push 0x0
|
|
00772633: 6a 00 push 0x0
|
|
00772635: e8 82 29 1b 00 call 0x924fbc
|
|
|
|
# TurnEvents and nested-vector destruction. Vtable 0x00a0f07c begins with 0x0062e120.
|
|
00a0f070: 701e6100 90b28500 14b5a700 20e16200
|
|
00a0f080: b05b8200 405c8200 60b5a700 d0e26200
|
|
0062e149: 8d 4e 08 lea ecx,[esi+0x8]
|
|
0062e153: e8 28 b4 ff ff call 0x629580
|
|
0062e158: f6 45 08 01 test BYTE PTR [ebp+0x8],0x1
|
|
0062e15c: c7 06 bc 22 9e 00 mov DWORD PTR [esi],0x9e22bc
|
|
0062e164: 56 push esi
|
|
0062e165: e8 40 6e 2f 00 call 0x924faa
|
|
0062e17e: c2 04 00 ret 0x4
|
|
00629583: 83 3f 00 cmp DWORD PTR [edi],0x0
|
|
00629590: 8b 5f 04 mov ebx,DWORD PTR [edi+0x4]
|
|
00629593: 8b 37 mov esi,DWORD PTR [edi]
|
|
006295a0: 8b 06 mov eax,DWORD PTR [esi]
|
|
006295a2: 8b 10 mov edx,DWORD PTR [eax]
|
|
006295a4: 6a 00 push 0x0
|
|
006295a8: ff d2 call edx
|
|
006295aa: 83 c6 74 add esi,0x74
|
|
006295b3: 50 push eax
|
|
006295b4: e8 f1 b9 2f 00 call 0x924faa
|
|
006295be: 33 c0 xor eax,eax
|
|
006295c0: 89 07 mov DWORD PTR [edi],eax
|
|
006295c2: 89 47 04 mov DWORD PTR [edi+0x4],eax
|
|
006295c5: 89 47 08 mov DWORD PTR [edi+0x8],eax
|
|
|
|
# FindDuplicate: NULL/empty, comparator order, 0x74 iteration, return matched element.
|
|
00825d4b: 3b de cmp ebx,esi
|
|
00825d4d: 75 0a jne 0x825d59
|
|
00825d50: 33 c0 xor eax,eax
|
|
00825d56: c2 08 00 ret 0x8
|
|
00825d59: 8b 4b 0c mov ecx,DWORD PTR [ebx+0xc]
|
|
00825d5c: 2b 4b 08 sub ecx,DWORD PTR [ebx+0x8]
|
|
00825d5f: b8 09 cb 3d 8d mov eax,0x8d3dcb09
|
|
00825d88: 8b 4e 6c mov ecx,DWORD PTR [esi+0x6c]
|
|
00825d8b: 3b 4f 6c cmp ecx,DWORD PTR [edi+0x6c]
|
|
00825d94: 8b 56 40 mov edx,DWORD PTR [esi+0x40]
|
|
00825d97: 3b 57 40 cmp edx,DWORD PTR [edi+0x40]
|
|
00825da0: d9 46 44 fld DWORD PTR [esi+0x44]
|
|
00825da3: d9 47 44 fld DWORD PTR [edi+0x44]
|
|
00825da6: da e9 fucompp
|
|
00825daf: d9 46 48 fld DWORD PTR [esi+0x48]
|
|
00825db2: d9 47 48 fld DWORD PTR [edi+0x48]
|
|
00825dbe: d9 46 4c fld DWORD PTR [esi+0x4c]
|
|
00825dc1: d9 47 4c fld DWORD PTR [edi+0x4c]
|
|
00825dcd: 83 7f 38 10 cmp DWORD PTR [edi+0x38],0x10
|
|
00825de6: e8 b5 d8 bf ff call 0x4236a0
|
|
00825def: 83 7f 64 10 cmp DWORD PTR [edi+0x64],0x10
|
|
00825e08: e8 93 d8 bf ff call 0x4236a0
|
|
00825e11: 8d 47 08 lea eax,[edi+0x8]
|
|
00825e15: 8d 4e 08 lea ecx,[esi+0x8]
|
|
00825e19: e8 a2 9a c4 ff call 0x46f8c0
|
|
00825e2e: 83 45 08 74 add DWORD PTR [ebp+0x8],0x74
|
|
00825e51: 5f pop edi
|
|
00825e53: 33 c0 xor eax,eax
|
|
00825e59: c2 08 00 ret 0x8
|
|
00825e5c: 5f pop edi
|
|
00825e5d: 8b c6 mov eax,esi
|
|
00825e64: c2 08 00 ret 0x8
|
|
|
|
# PruneOldTurns: cutoff, leading-run selection, deep left shift, trailing destruction.
|
|
00879eb5: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
|
|
00879eba: 8b 4a 08 mov ecx,DWORD PTR [edx+0x8]
|
|
00879ebe: 8b 72 04 mov esi,DWORD PTR [edx+0x4]
|
|
00879ec3: 83 c3 ce add ebx,0xffffffce
|
|
00879eca: 8b f9 mov edi,ecx
|
|
00879ed0: 39 58 04 cmp DWORD PTR [eax+0x4],ebx
|
|
00879ed3: 7d 09 jge 0x879ede
|
|
00879ed5: 8b f8 mov edi,eax
|
|
00879ed7: 83 c0 18 add eax,0x18
|
|
00879ede: 3b f9 cmp edi,ecx
|
|
00879ee0: 74 56 je 0x879f38
|
|
00879ee2: 3b f7 cmp esi,edi
|
|
00879ee4: 74 52 je 0x879f38
|
|
00879ef8: 8b 44 30 04 mov eax,DWORD PTR [eax+esi*1+0x4]
|
|
00879efc: 8d 4f 08 lea ecx,[edi+0x8]
|
|
00879eff: 51 push ecx
|
|
00879f00: 8d 4e 08 lea ecx,[esi+0x8]
|
|
00879f03: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
00879f06: e8 a5 07 f0 ff call 0x77a6b0
|
|
00879f0b: 83 c7 18 add edi,0x18
|
|
00879f0e: 83 c6 18 add esi,0x18
|
|
00879f21: 8b 17 mov edx,DWORD PTR [edi]
|
|
00879f23: 8b 02 mov eax,DWORD PTR [edx]
|
|
00879f25: 6a 00 push 0x0
|
|
00879f29: ff d0 call eax
|
|
00879f2b: 83 c7 18 add edi,0x18
|
|
00879f35: 89 72 08 mov DWORD PTR [edx+0x8],esi
|
|
00879f3e: c2 04 00 ret 0x4
|