158 lines
7.8 KiB
Text
158 lines
7.8 KiB
Text
|
|
dumps/sots.exe: file format pei-i386
|
|
|
|
|
|
Disassembly of section .text:
|
|
|
|
007ba1a0 <.text+0x3b91a0>:
|
|
7ba1a0: 55 push ebp
|
|
7ba1a1: 8b ec mov ebp,esp
|
|
7ba1a3: 6a ff push 0xffffffff
|
|
7ba1a5: 68 58 d4 98 00 push 0x98d458
|
|
7ba1aa: 64 a1 00 00 00 00 mov eax,fs:0x0
|
|
7ba1b0: 50 push eax
|
|
7ba1b1: 83 ec 38 sub esp,0x38
|
|
7ba1b4: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
|
7ba1b9: 33 c5 xor eax,ebp
|
|
7ba1bb: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
|
|
7ba1be: 53 push ebx
|
|
7ba1bf: 56 push esi
|
|
7ba1c0: 57 push edi
|
|
7ba1c1: 50 push eax
|
|
7ba1c2: 8d 45 f4 lea eax,[ebp-0xc]
|
|
7ba1c5: 64 a3 00 00 00 00 mov fs:0x0,eax
|
|
7ba1cb: 8b d9 mov ebx,ecx
|
|
7ba1cd: 89 5d bc mov DWORD PTR [ebp-0x44],ebx
|
|
7ba1d0: 8b 75 08 mov esi,DWORD PTR [ebp+0x8]
|
|
7ba1d3: 8b 45 10 mov eax,DWORD PTR [ebp+0x10]
|
|
7ba1d6: 89 45 c0 mov DWORD PTR [ebp-0x40],eax
|
|
7ba1d9: 85 f6 test esi,esi
|
|
7ba1db: 0f 84 2f 01 00 00 je 0x7ba310
|
|
7ba1e1: 8b 4d 0c mov ecx,DWORD PTR [ebp+0xc]
|
|
7ba1e4: 85 c9 test ecx,ecx
|
|
7ba1e6: 0f 84 24 01 00 00 je 0x7ba310
|
|
7ba1ec: 85 c0 test eax,eax
|
|
7ba1ee: 0f 84 1c 01 00 00 je 0x7ba310
|
|
7ba1f4: 80 b9 fb 00 00 00 00 cmp BYTE PTR [ecx+0xfb],0x0
|
|
7ba1fb: 74 0d je 0x7ba20a
|
|
7ba1fd: 80 b9 fc 00 00 00 00 cmp BYTE PTR [ecx+0xfc],0x0
|
|
7ba204: 0f 84 06 01 00 00 je 0x7ba310
|
|
7ba20a: 8b 8e f4 00 00 00 mov ecx,DWORD PTR [esi+0xf4]
|
|
7ba210: 8b 49 04 mov ecx,DWORD PTR [ecx+0x4]
|
|
7ba213: 50 push eax
|
|
7ba214: e8 b7 44 dc ff call 0x57e6d0
|
|
7ba219: 84 c0 test al,al
|
|
7ba21b: 0f 85 ef 00 00 00 jne 0x7ba310
|
|
7ba221: 8b be 74 02 00 00 mov edi,DWORD PTR [esi+0x274]
|
|
7ba227: 3b be 78 02 00 00 cmp edi,DWORD PTR [esi+0x278]
|
|
7ba22d: 74 45 je 0x7ba274
|
|
7ba22f: 8b 5d c0 mov ebx,DWORD PTR [ebp-0x40]
|
|
7ba232: 83 7b 18 10 cmp DWORD PTR [ebx+0x18],0x10
|
|
7ba236: 8b 4b 14 mov ecx,DWORD PTR [ebx+0x14]
|
|
7ba239: 72 05 jb 0x7ba240
|
|
7ba23b: 8b 43 04 mov eax,DWORD PTR [ebx+0x4]
|
|
7ba23e: eb 03 jmp 0x7ba243
|
|
7ba240: 8d 43 04 lea eax,[ebx+0x4]
|
|
7ba243: 8b 57 1c mov edx,DWORD PTR [edi+0x1c]
|
|
7ba246: 51 push ecx
|
|
7ba247: 50 push eax
|
|
7ba248: 52 push edx
|
|
7ba249: 6a 00 push 0x0
|
|
7ba24b: 8d 4f 0c lea ecx,[edi+0xc]
|
|
7ba24e: e8 4d 94 c6 ff call 0x4236a0
|
|
7ba253: 85 c0 test eax,eax
|
|
7ba255: 74 0b je 0x7ba262
|
|
7ba257: 83 c7 2c add edi,0x2c
|
|
7ba25a: 3b be 78 02 00 00 cmp edi,DWORD PTR [esi+0x278]
|
|
7ba260: 75 d0 jne 0x7ba232
|
|
7ba262: 8b 5d bc mov ebx,DWORD PTR [ebp-0x44]
|
|
7ba265: 3b be 78 02 00 00 cmp edi,DWORD PTR [esi+0x278]
|
|
7ba26b: 74 07 je 0x7ba274
|
|
7ba26d: 8b f7 mov esi,edi
|
|
7ba26f: e9 84 00 00 00 jmp 0x7ba2f8
|
|
7ba274: 8d 4d c4 lea ecx,[ebp-0x3c]
|
|
7ba277: e8 24 c0 09 00 call 0x8562a0
|
|
7ba27c: 33 ff xor edi,edi
|
|
7ba27e: 50 push eax
|
|
7ba27f: 8d 8e 74 02 00 00 lea ecx,[esi+0x274]
|
|
7ba285: 89 7d fc mov DWORD PTR [ebp-0x4],edi
|
|
7ba288: e8 93 d0 ff ff call 0x7b7320
|
|
7ba28d: 83 7d e4 10 cmp DWORD PTR [ebp-0x1c],0x10
|
|
7ba291: c7 45 fc ff ff ff ff mov DWORD PTR [ebp-0x4],0xffffffff
|
|
7ba298: 72 0c jb 0x7ba2a6
|
|
7ba29a: 8b 45 d0 mov eax,DWORD PTR [ebp-0x30]
|
|
7ba29d: 50 push eax
|
|
7ba29e: e8 07 ad 16 00 call 0x924faa
|
|
7ba2a3: 83 c4 04 add esp,0x4
|
|
7ba2a6: 8b 86 78 02 00 00 mov eax,DWORD PTR [esi+0x278]
|
|
7ba2ac: 66 8b 4b 0c mov cx,WORD PTR [ebx+0xc]
|
|
7ba2b0: 66 89 48 d8 mov WORD PTR [eax-0x28],cx
|
|
7ba2b4: 8b 86 78 02 00 00 mov eax,DWORD PTR [esi+0x278]
|
|
7ba2ba: 66 8b 53 0c mov dx,WORD PTR [ebx+0xc]
|
|
7ba2be: 8b 4d c0 mov ecx,DWORD PTR [ebp-0x40]
|
|
7ba2c1: 6a ff push 0xffffffff
|
|
7ba2c3: 83 c1 04 add ecx,0x4
|
|
7ba2c6: 66 89 50 da mov WORD PTR [eax-0x26],dx
|
|
7ba2ca: 8b 86 78 02 00 00 mov eax,DWORD PTR [esi+0x278]
|
|
7ba2d0: 57 push edi
|
|
7ba2d1: 51 push ecx
|
|
7ba2d2: 8d 48 e0 lea ecx,[eax-0x20]
|
|
7ba2d5: c7 45 e4 0f 00 00 00 mov DWORD PTR [ebp-0x1c],0xf
|
|
7ba2dc: 89 7d e0 mov DWORD PTR [ebp-0x20],edi
|
|
7ba2df: c6 45 d0 00 mov BYTE PTR [ebp-0x30],0x0
|
|
7ba2e3: c7 45 c4 bc 22 9e 00 mov DWORD PTR [ebp-0x3c],0x9e22bc
|
|
7ba2ea: e8 41 b1 c6 ff call 0x425430
|
|
7ba2ef: 8b b6 78 02 00 00 mov esi,DWORD PTR [esi+0x278]
|
|
7ba2f5: 83 ee 2c sub esi,0x2c
|
|
7ba2f8: 66 8b 43 0c mov ax,WORD PTR [ebx+0xc]
|
|
7ba2fc: 66 89 46 06 mov WORD PTR [esi+0x6],ax
|
|
7ba300: 8b 45 0c mov eax,DWORD PTR [ebp+0xc]
|
|
7ba303: 8b 48 28 mov ecx,DWORD PTR [eax+0x28]
|
|
7ba306: ba 01 00 00 00 mov edx,0x1
|
|
7ba30b: d3 e2 shl edx,cl
|
|
7ba30d: 09 56 28 or DWORD PTR [esi+0x28],edx
|
|
7ba310: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
|
7ba313: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
|
7ba31a: 59 pop ecx
|
|
7ba31b: 5f pop edi
|
|
7ba31c: 5e pop esi
|
|
7ba31d: 5b pop ebx
|
|
7ba31e: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
|
|
7ba321: 33 cd xor ecx,ebp
|
|
7ba323: e8 5a aa 16 00 call 0x924d82
|
|
7ba328: 8b e5 mov esp,ebp
|
|
7ba32a: 5d pop ebp
|
|
7ba32b: c2 0c 00 ret 0xc
|
|
7ba32e: cc int3
|
|
7ba32f: cc int3
|
|
7ba330: 55 push ebp
|
|
7ba331: 8b ec mov ebp,esp
|
|
7ba333: 53 push ebx
|
|
7ba334: 56 push esi
|
|
7ba335: 8b 75 08 mov esi,DWORD PTR [ebp+0x8]
|
|
7ba338: 57 push edi
|
|
7ba339: 8b f9 mov edi,ecx
|
|
7ba33b: 8b 5f 04 mov ebx,DWORD PTR [edi+0x4]
|
|
7ba33e: 8b cb mov ecx,ebx
|
|
7ba340: 2b 0f sub ecx,DWORD PTR [edi]
|
|
7ba342: b8 43 08 21 84 mov eax,0x84210843
|
|
7ba347: f7 e9 imul ecx
|
|
7ba349: 03 d1 add edx,ecx
|
|
7ba34b: c1 fa 06 sar edx,0x6
|
|
7ba34e: 8b c2 mov eax,edx
|
|
7ba350: c1 e8 1f shr eax,0x1f
|
|
7ba353: 03 c2 add eax,edx
|
|
7ba355: 3b c6 cmp eax,esi
|
|
7ba357: 76 3a jbe 0x7ba393
|
|
7ba359: 6b f6 7c imul esi,esi,0x7c
|
|
7ba35c: 03 37 add esi,DWORD PTR [edi]
|
|
7ba35e: 3b f3 cmp esi,ebx
|
|
7ba360: 0f 84 93 00 00 00 je 0x7ba3f9
|
|
7ba366: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
|
|
7ba369: 50 push eax
|
|
7ba36a: 56 push esi
|
|
7ba36b: 53 push ebx
|
|
7ba36c: 53 push ebx
|
|
7ba36d: e8 .byte 0xe8
|
|
7ba36e: 0e push cs
|
|
7ba36f: cd .byte 0xcd
|