143 lines
6.8 KiB
Text
143 lines
6.8 KiB
Text
|
|
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
|
|
|
|
|
|
Disassembly of section .text:
|
|
|
|
00885380 <.text+0x484380>:
|
|
885380: 55 push ebp
|
|
885381: 8b ec mov ebp,esp
|
|
885383: 6a ff push 0xffffffff
|
|
885385: 68 30 af 99 00 push 0x99af30
|
|
88538a: 64 a1 00 00 00 00 mov eax,fs:0x0
|
|
885390: 50 push eax
|
|
885391: 83 ec 18 sub esp,0x18
|
|
885394: 53 push ebx
|
|
885395: 56 push esi
|
|
885396: 57 push edi
|
|
885397: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
|
88539c: 33 c5 xor eax,ebp
|
|
88539e: 50 push eax
|
|
88539f: 8d 45 f4 lea eax,[ebp-0xc]
|
|
8853a2: 64 a3 00 00 00 00 mov fs:0x0,eax
|
|
8853a8: 8b f1 mov esi,ecx
|
|
8853aa: 8b 56 08 mov edx,DWORD PTR [esi+0x8]
|
|
8853ad: 2b 56 04 sub edx,DWORD PTR [esi+0x4]
|
|
8853b0: 8d 4e 04 lea ecx,[esi+0x4]
|
|
8853b3: b8 ab aa aa 2a mov eax,0x2aaaaaab
|
|
8853b8: f7 ea imul edx
|
|
8853ba: c1 fa 02 sar edx,0x2
|
|
8853bd: 8b c2 mov eax,edx
|
|
8853bf: c1 e8 1f shr eax,0x1f
|
|
8853c2: 33 db xor ebx,ebx
|
|
8853c4: 03 c2 add eax,edx
|
|
8853c6: 33 ff xor edi,edi
|
|
8853c8: 3b c3 cmp eax,ebx
|
|
8853ca: 7e 30 jle 0x8853fc
|
|
8853cc: 8b 11 mov edx,DWORD PTR [ecx]
|
|
8853ce: 8b ff mov edi,edi
|
|
8853d0: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
|
|
8853d3: 39 5a 04 cmp DWORD PTR [edx+0x4],ebx
|
|
8853d6: 75 02 jne 0x8853da
|
|
8853d8: 8b fa mov edi,edx
|
|
8853da: 83 c2 18 add edx,0x18
|
|
8853dd: 48 dec eax
|
|
8853de: 75 f0 jne 0x8853d0
|
|
8853e0: 33 db xor ebx,ebx
|
|
8853e2: 3b fb cmp edi,ebx
|
|
8853e4: 74 16 je 0x8853fc
|
|
8853e6: 8b c7 mov eax,edi
|
|
8853e8: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
|
8853eb: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
|
8853f2: 59 pop ecx
|
|
8853f3: 5f pop edi
|
|
8853f4: 5e pop esi
|
|
8853f5: 5b pop ebx
|
|
8853f6: 8b e5 mov esp,ebp
|
|
8853f8: 5d pop ebp
|
|
8853f9: c2 04 00 ret 0x4
|
|
8853fc: c7 45 dc 7c f0 a0 00 mov DWORD PTR [ebp-0x24],0xa0f07c
|
|
885403: 89 5d e4 mov DWORD PTR [ebp-0x1c],ebx
|
|
885406: 89 5d e8 mov DWORD PTR [ebp-0x18],ebx
|
|
885409: 89 5d ec mov DWORD PTR [ebp-0x14],ebx
|
|
88540c: 8d 45 dc lea eax,[ebp-0x24]
|
|
88540f: 50 push eax
|
|
885410: 89 5d fc mov DWORD PTR [ebp-0x4],ebx
|
|
885413: e8 98 f8 ff ff call 0x884cb0
|
|
885418: 8d 4d e4 lea ecx,[ebp-0x1c]
|
|
88541b: c7 45 fc 01 00 00 00 mov DWORD PTR [ebp-0x4],0x1
|
|
885422: e8 59 41 da ff call 0x629580
|
|
885427: 8b 46 08 mov eax,DWORD PTR [esi+0x8]
|
|
88542a: 8b 4d 08 mov ecx,DWORD PTR [ebp+0x8]
|
|
88542d: 89 48 ec mov DWORD PTR [eax-0x14],ecx
|
|
885430: 8b 46 08 mov eax,DWORD PTR [esi+0x8]
|
|
885433: 83 e8 18 sub eax,0x18
|
|
885436: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
|
885439: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
|
885440: 59 pop ecx
|
|
885441: 5f pop edi
|
|
885442: 5e pop esi
|
|
885443: 5b pop ebx
|
|
885444: 8b e5 mov esp,ebp
|
|
885446: 5d pop ebp
|
|
885447: c2 04 00 ret 0x4
|
|
88544a: cc int3
|
|
88544b: cc int3
|
|
88544c: cc int3
|
|
88544d: cc int3
|
|
88544e: cc int3
|
|
88544f: cc int3
|
|
885450: 55 push ebp
|
|
885451: 8b ec mov ebp,esp
|
|
885453: 6a ff push 0xffffffff
|
|
885455: 68 73 af 99 00 push 0x99af73
|
|
88545a: 64 a1 00 00 00 00 mov eax,fs:0x0
|
|
885460: 50 push eax
|
|
885461: 81 ec 90 00 00 00 sub esp,0x90
|
|
885467: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
|
88546c: 33 c5 xor eax,ebp
|
|
88546e: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
|
|
885471: 53 push ebx
|
|
885472: 56 push esi
|
|
885473: 57 push edi
|
|
885474: 50 push eax
|
|
885475: 8d 45 f4 lea eax,[ebp-0xc]
|
|
885478: 64 a3 00 00 00 00 mov fs:0x0,eax
|
|
88547e: 8b 7d 08 mov edi,DWORD PTR [ebp+0x8]
|
|
885481: 8b 07 mov eax,DWORD PTR [edi]
|
|
885483: 8b 50 10 mov edx,DWORD PTR [eax+0x10]
|
|
885486: 89 8d 70 ff ff ff mov DWORD PTR [ebp-0x90],ecx
|
|
88548c: 8d 71 04 lea esi,[ecx+0x4]
|
|
88548f: 6a ff push 0xffffffff
|
|
885491: 8d 8d 78 ff ff ff lea ecx,[ebp-0x88]
|
|
885497: 51 push ecx
|
|
885498: 68 34 b3 a2 00 push 0xa2b334
|
|
88549d: 8b cf mov ecx,edi
|
|
88549f: 89 bd 74 ff ff ff mov DWORD PTR [ebp-0x8c],edi
|
|
8854a5: ff d2 call edx
|
|
8854a7: 33 db xor ebx,ebx
|
|
8854a9: 3a c3 cmp al,bl
|
|
8854ab: 74 0c je 0x8854b9
|
|
8854ad: 3b f3 cmp esi,ebx
|
|
8854af: 74 08 je 0x8854b9
|
|
8854b1: 8b 85 78 ff ff ff mov eax,DWORD PTR [ebp-0x88]
|
|
8854b7: 89 06 mov DWORD PTR [esi],eax
|
|
8854b9: 88 9d 7f ff ff ff mov BYTE PTR [ebp-0x81],bl
|
|
8854bf: 90 nop
|
|
8854c0: 8d 4d 80 lea ecx,[ebp-0x80]
|
|
8854c3: e8 98 2a fc ff call 0x847f60
|
|
8854c8: 8d 4d 80 lea ecx,[ebp-0x80]
|
|
8854cb: 89 5d fc mov DWORD PTR [ebp-0x4],ebx
|
|
8854ce: c7 85 64 ff ff ff 0c mov DWORD PTR [ebp-0x9c],0xa2df0c
|
|
8854d5: df a2 00
|
|
8854d8: 89 8d 68 ff ff ff mov DWORD PTR [ebp-0x98],ecx
|
|
8854de: 89 9d 6c ff ff ff mov DWORD PTR [ebp-0x94],ebx
|
|
8854e4: 8b 17 mov edx,DWORD PTR [edi]
|
|
8854e6: 8b 52 14 mov edx,DWORD PTR [edx+0x14]
|
|
8854e9: 8d 85 64 ff ff ff lea eax,[ebp-0x9c]
|
|
8854ef: 50 push eax
|
|
8854f0: 68 e8 b2 a2 00 push 0xa2b2e8
|
|
8854f5: 8b cf mov ecx,edi
|
|
8854f7: c6 45 fc 01 mov BYTE PTR [ebp-0x4],0x1
|
|
8854fb: ff d2 call edx
|
|
8854fd: 88 5d fc mov BYTE PTR [ebp-0x4],bl
|