260 lines
12 KiB
Text
260 lines
12 KiB
Text
|
|
dumps/sots.exe: file format pei-i386
|
|
|
|
|
|
Disassembly of section .text:
|
|
|
|
00865ee0 <.text+0x464ee0>:
|
|
865ee0: 55 push ebp
|
|
865ee1: 8b ec mov ebp,esp
|
|
865ee3: 6a ff push 0xffffffff
|
|
865ee5: 68 d0 80 99 00 push 0x9980d0
|
|
865eea: 64 a1 00 00 00 00 mov eax,fs:0x0
|
|
865ef0: 50 push eax
|
|
865ef1: 83 ec 0c sub esp,0xc
|
|
865ef4: 53 push ebx
|
|
865ef5: 56 push esi
|
|
865ef6: 57 push edi
|
|
865ef7: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
|
865efc: 33 c5 xor eax,ebp
|
|
865efe: 50 push eax
|
|
865eff: 8d 45 f4 lea eax,[ebp-0xc]
|
|
865f02: 64 a3 00 00 00 00 mov fs:0x0,eax
|
|
865f08: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
|
|
865f0b: 8b f1 mov esi,ecx
|
|
865f0d: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
|
|
865f10: 81 fb 2c f7 34 02 cmp ebx,0x234f72c
|
|
865f16: 76 0b jbe 0x865f23
|
|
865f18: 68 90 1f 9e 00 push 0x9e1f90
|
|
865f1d: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
|
|
865f23: 8b 4e 08 mov ecx,DWORD PTR [esi+0x8]
|
|
865f26: 2b 0e sub ecx,DWORD PTR [esi]
|
|
865f28: b8 09 cb 3d 8d mov eax,0x8d3dcb09
|
|
865f2d: f7 e9 imul ecx
|
|
865f2f: 03 d1 add edx,ecx
|
|
865f31: c1 fa 06 sar edx,0x6
|
|
865f34: 8b c2 mov eax,edx
|
|
865f36: c1 e8 1f shr eax,0x1f
|
|
865f39: 03 c2 add eax,edx
|
|
865f3b: 3b c3 cmp eax,ebx
|
|
865f3d: 0f 83 9a 00 00 00 jae 0x865fdd
|
|
865f43: 8d 7e 0c lea edi,[esi+0xc]
|
|
865f46: 53 push ebx
|
|
865f47: 8b cf mov ecx,edi
|
|
865f49: e8 f2 4f f2 ff call 0x78af40
|
|
865f4e: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
|
|
865f51: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
|
|
865f54: 8b 16 mov edx,DWORD PTR [esi]
|
|
865f56: 53 push ebx
|
|
865f57: 6a 00 push 0x0
|
|
865f59: 57 push edi
|
|
865f5a: 50 push eax
|
|
865f5b: 51 push ecx
|
|
865f5c: 52 push edx
|
|
865f5d: 89 45 e8 mov DWORD PTR [ebp-0x18],eax
|
|
865f60: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
|
|
865f67: e8 c4 c4 f0 ff call 0x772430
|
|
865f6c: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
|
|
865f6f: 8b 1e mov ebx,DWORD PTR [esi]
|
|
865f71: 89 4d ec mov DWORD PTR [ebp-0x14],ecx
|
|
865f74: 2b cb sub ecx,ebx
|
|
865f76: b8 09 cb 3d 8d mov eax,0x8d3dcb09
|
|
865f7b: f7 e9 imul ecx
|
|
865f7d: 03 d1 add edx,ecx
|
|
865f7f: c1 fa 06 sar edx,0x6
|
|
865f82: 8b fa mov edi,edx
|
|
865f84: c1 ef 1f shr edi,0x1f
|
|
865f87: 83 c4 18 add esp,0x18
|
|
865f8a: 03 fa add edi,edx
|
|
865f8c: c7 45 fc ff ff ff ff mov DWORD PTR [ebp-0x4],0xffffffff
|
|
865f93: 85 db test ebx,ebx
|
|
865f95: 74 26 je 0x865fbd
|
|
865f97: 3b 5d ec cmp ebx,DWORD PTR [ebp-0x14]
|
|
865f9a: 74 16 je 0x865fb2
|
|
865f9c: 8d 64 24 00 lea esp,[esp+0x0]
|
|
865fa0: 8b 13 mov edx,DWORD PTR [ebx]
|
|
865fa2: 8b 02 mov eax,DWORD PTR [edx]
|
|
865fa4: 6a 00 push 0x0
|
|
865fa6: 8b cb mov ecx,ebx
|
|
865fa8: ff d0 call eax
|
|
865faa: 83 c3 74 add ebx,0x74
|
|
865fad: 3b 5d ec cmp ebx,DWORD PTR [ebp-0x14]
|
|
865fb0: 75 ee jne 0x865fa0
|
|
865fb2: 8b 0e mov ecx,DWORD PTR [esi]
|
|
865fb4: 51 push ecx
|
|
865fb5: e8 f0 ef 0b 00 call 0x924faa
|
|
865fba: 83 c4 04 add esp,0x4
|
|
865fbd: 8b ce mov ecx,esi
|
|
865fbf: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
|
|
865fc5: 6b ff 74 imul edi,edi,0x74
|
|
865fc8: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
|
|
865fcb: 8b 4d e8 mov ecx,DWORD PTR [ebp-0x18]
|
|
865fce: 6b c0 74 imul eax,eax,0x74
|
|
865fd1: 03 c1 add eax,ecx
|
|
865fd3: 03 f9 add edi,ecx
|
|
865fd5: 89 46 08 mov DWORD PTR [esi+0x8],eax
|
|
865fd8: 89 7e 04 mov DWORD PTR [esi+0x4],edi
|
|
865fdb: 89 0e mov DWORD PTR [esi],ecx
|
|
865fdd: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
|
865fe0: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
|
865fe7: 59 pop ecx
|
|
865fe8: 5f pop edi
|
|
865fe9: 5e pop esi
|
|
865fea: 5b pop ebx
|
|
865feb: 8b e5 mov esp,ebp
|
|
865fed: 5d pop ebp
|
|
865fee: c2 04 00 ret 0x4
|
|
865ff1: 8b 55 e8 mov edx,DWORD PTR [ebp-0x18]
|
|
865ff4: 52 push edx
|
|
865ff5: e8 b0 ef 0b 00 call 0x924faa
|
|
865ffa: 83 c4 04 add esp,0x4
|
|
865ffd: 6a 00 push 0x0
|
|
865fff: 6a 00 push 0x0
|
|
866001: e8 b6 ef 0b 00 call 0x924fbc
|
|
866006: cc int3
|
|
866007: cc int3
|
|
866008: cc int3
|
|
866009: cc int3
|
|
86600a: cc int3
|
|
86600b: cc int3
|
|
86600c: cc int3
|
|
86600d: cc int3
|
|
86600e: cc int3
|
|
86600f: cc int3
|
|
866010: 55 push ebp
|
|
866011: 8b ec mov ebp,esp
|
|
866013: 6a ff push 0xffffffff
|
|
866015: 68 08 79 98 00 push 0x987908
|
|
86601a: 64 a1 00 00 00 00 mov eax,fs:0x0
|
|
866020: 50 push eax
|
|
866021: 83 ec 08 sub esp,0x8
|
|
866024: 53 push ebx
|
|
866025: 56 push esi
|
|
866026: 57 push edi
|
|
866027: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
|
86602c: 33 c5 xor eax,ebp
|
|
86602e: 50 push eax
|
|
86602f: 8d 45 f4 lea eax,[ebp-0xc]
|
|
866032: 64 a3 00 00 00 00 mov fs:0x0,eax
|
|
866038: 89 4d ec mov DWORD PTR [ebp-0x14],ecx
|
|
86603b: 8b 01 mov eax,DWORD PTR [ecx]
|
|
86603d: 8b 38 mov edi,DWORD PTR [eax]
|
|
86603f: 89 00 mov DWORD PTR [eax],eax
|
|
866041: 8b 01 mov eax,DWORD PTR [ecx]
|
|
866043: 89 40 04 mov DWORD PTR [eax+0x4],eax
|
|
866046: 33 d2 xor edx,edx
|
|
866048: 89 51 04 mov DWORD PTR [ecx+0x4],edx
|
|
86604b: 3b 39 cmp edi,DWORD PTR [ecx]
|
|
86604d: 74 55 je 0x8660a4
|
|
86604f: eb 02 jmp 0x866053
|
|
866051: 33 d2 xor edx,edx
|
|
866053: 8b 1f mov ebx,DWORD PTR [edi]
|
|
866055: 8d 47 08 lea eax,[edi+0x8]
|
|
866058: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
|
|
86605b: 8d 70 08 lea esi,[eax+0x8]
|
|
86605e: 89 55 fc mov DWORD PTR [ebp-0x4],edx
|
|
866061: 39 16 cmp DWORD PTR [esi],edx
|
|
866063: 74 18 je 0x86607d
|
|
866065: 8b ce mov ecx,esi
|
|
866067: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
|
|
86606d: 8b 06 mov eax,DWORD PTR [esi]
|
|
86606f: 50 push eax
|
|
866070: e8 35 ef 0b 00 call 0x924faa
|
|
866075: 8b 45 f0 mov eax,DWORD PTR [ebp-0x10]
|
|
866078: 83 c4 04 add esp,0x4
|
|
86607b: 33 d2 xor edx,edx
|
|
86607d: 89 16 mov DWORD PTR [esi],edx
|
|
86607f: 89 56 04 mov DWORD PTR [esi+0x4],edx
|
|
866082: 89 56 08 mov DWORD PTR [esi+0x8],edx
|
|
866085: 57 push edi
|
|
866086: c7 45 fc ff ff ff ff mov DWORD PTR [ebp-0x4],0xffffffff
|
|
86608d: c7 00 bc 22 9e 00 mov DWORD PTR [eax],0x9e22bc
|
|
866093: e8 12 ef 0b 00 call 0x924faa
|
|
866098: 8b 45 ec mov eax,DWORD PTR [ebp-0x14]
|
|
86609b: 83 c4 04 add esp,0x4
|
|
86609e: 8b fb mov edi,ebx
|
|
8660a0: 3b 18 cmp ebx,DWORD PTR [eax]
|
|
8660a2: 75 ad jne 0x866051
|
|
8660a4: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
|
8660a7: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
|
8660ae: 59 pop ecx
|
|
8660af: 5f pop edi
|
|
8660b0: 5e pop esi
|
|
8660b1: 5b pop ebx
|
|
8660b2: 8b e5 mov esp,ebp
|
|
8660b4: 5d pop ebp
|
|
8660b5: c3 ret
|
|
8660b6: cc int3
|
|
8660b7: cc int3
|
|
8660b8: cc int3
|
|
8660b9: cc int3
|
|
8660ba: cc int3
|
|
8660bb: cc int3
|
|
8660bc: cc int3
|
|
8660bd: cc int3
|
|
8660be: cc int3
|
|
8660bf: cc int3
|
|
8660c0: 55 push ebp
|
|
8660c1: 8b ec mov ebp,esp
|
|
8660c3: 51 push ecx
|
|
8660c4: 53 push ebx
|
|
8660c5: 8b d9 mov ebx,ecx
|
|
8660c7: 8b 03 mov eax,DWORD PTR [ebx]
|
|
8660c9: 57 push edi
|
|
8660ca: 8b 38 mov edi,DWORD PTR [eax]
|
|
8660cc: 89 00 mov DWORD PTR [eax],eax
|
|
8660ce: 8b 03 mov eax,DWORD PTR [ebx]
|
|
8660d0: 89 40 04 mov DWORD PTR [eax+0x4],eax
|
|
8660d3: c7 43 04 00 00 00 00 mov DWORD PTR [ebx+0x4],0x0
|
|
8660da: 3b 3b cmp edi,DWORD PTR [ebx]
|
|
8660dc: 74 3e je 0x86611c
|
|
8660de: 56 push esi
|
|
8660df: 90 nop
|
|
8660e0: 83 7f 20 00 cmp DWORD PTR [edi+0x20],0x0
|
|
8660e4: 8b 07 mov eax,DWORD PTR [edi]
|
|
8660e6: 89 45 fc mov DWORD PTR [ebp-0x4],eax
|
|
8660e9: 74 15 je 0x866100
|
|
8660eb: 8d 4f 20 lea ecx,[edi+0x20]
|
|
8660ee: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
|
|
8660f4: 8b 4f 20 mov ecx,DWORD PTR [edi+0x20]
|
|
8660f7: 51 push ecx
|
|
8660f8: e8 ad ee 0b 00 call 0x924faa
|
|
8660fd: 83 c4 04 add esp,0x4
|
|
866100: 33 c0 xor eax,eax
|
|
866102: 57 push edi
|
|
866103: 89 47 20 mov DWORD PTR [edi+0x20],eax
|
|
866106: 89 47 24 mov DWORD PTR [edi+0x24],eax
|
|
866109: 89 47 28 mov DWORD PTR [edi+0x28],eax
|
|
86610c: e8 99 ee 0b 00 call 0x924faa
|
|
866111: 8b 7d fc mov edi,DWORD PTR [ebp-0x4]
|
|
866114: 83 c4 04 add esp,0x4
|
|
866117: 3b 3b cmp edi,DWORD PTR [ebx]
|
|
866119: 75 c5 jne 0x8660e0
|
|
86611b: 5e pop esi
|
|
86611c: 5f pop edi
|
|
86611d: 5b pop ebx
|
|
86611e: 8b e5 mov esp,ebp
|
|
866120: 5d pop ebp
|
|
866121: c3 ret
|
|
866122: cc int3
|
|
866123: cc int3
|
|
866124: cc int3
|
|
866125: cc int3
|
|
866126: cc int3
|
|
866127: cc int3
|
|
866128: cc int3
|
|
866129: cc int3
|
|
86612a: cc int3
|
|
86612b: cc int3
|
|
86612c: cc int3
|
|
86612d: cc int3
|
|
86612e: cc int3
|
|
86612f: cc int3
|
|
866130: 55 push ebp
|
|
866131: 8b ec mov ebp,esp
|
|
866133: 83 ec 0c sub esp,0xc
|
|
866136: 53 push ebx
|
|
866137: 8b 5d 0c mov ebx,DWORD PTR [ebp+0xc]
|
|
86613a: 80 7b 25 00 cmp BYTE PTR [ebx+0x25],0x0
|
|
86613e: 56 push esi
|
|
86613f: 57 push edi
|