241 lines
11 KiB
Text
241 lines
11 KiB
Text
|
|
dumps/sots.exe: file format pei-i386
|
|
|
|
|
|
Disassembly of section .text:
|
|
|
|
007693e0 <.text+0x3683e0>:
|
|
7693e0: c2 04 00 ret 0x4
|
|
7693e3: cc int3
|
|
7693e4: cc int3
|
|
7693e5: cc int3
|
|
7693e6: cc int3
|
|
7693e7: cc int3
|
|
7693e8: cc int3
|
|
7693e9: cc int3
|
|
7693ea: cc int3
|
|
7693eb: cc int3
|
|
7693ec: cc int3
|
|
7693ed: cc int3
|
|
7693ee: cc int3
|
|
7693ef: cc int3
|
|
7693f0: 55 push ebp
|
|
7693f1: 8b ec mov ebp,esp
|
|
7693f3: 6a ff push 0xffffffff
|
|
7693f5: 68 de 62 98 00 push 0x9862de
|
|
7693fa: 64 a1 00 00 00 00 mov eax,fs:0x0
|
|
769400: 50 push eax
|
|
769401: 51 push ecx
|
|
769402: 53 push ebx
|
|
769403: 56 push esi
|
|
769404: 57 push edi
|
|
769405: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
|
76940a: 33 c5 xor eax,ebp
|
|
76940c: 50 push eax
|
|
76940d: 8d 45 f4 lea eax,[ebp-0xc]
|
|
769410: 64 a3 00 00 00 00 mov fs:0x0,eax
|
|
769416: 8b f1 mov esi,ecx
|
|
769418: 89 75 f0 mov DWORD PTR [ebp-0x10],esi
|
|
76941b: 8b 7d 08 mov edi,DWORD PTR [ebp+0x8]
|
|
76941e: c7 06 58 19 a2 00 mov DWORD PTR [esi],0xa21958
|
|
769424: 8b 47 04 mov eax,DWORD PTR [edi+0x4]
|
|
769427: 33 db xor ebx,ebx
|
|
769429: 6a ff push 0xffffffff
|
|
76942b: 8d 4e 08 lea ecx,[esi+0x8]
|
|
76942e: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
769431: 53 push ebx
|
|
769432: 8d 57 08 lea edx,[edi+0x8]
|
|
769435: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
|
|
76943c: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
|
|
76943f: 52 push edx
|
|
769440: 89 5d fc mov DWORD PTR [ebp-0x4],ebx
|
|
769443: 88 19 mov BYTE PTR [ecx],bl
|
|
769445: e8 e6 bf cb ff call 0x425430
|
|
76944a: 6a ff push 0xffffffff
|
|
76944c: 8d 4e 24 lea ecx,[esi+0x24]
|
|
76944f: 53 push ebx
|
|
769450: 8d 47 24 lea eax,[edi+0x24]
|
|
769453: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
|
|
76945a: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
|
|
76945d: 50 push eax
|
|
76945e: c6 45 fc 01 mov BYTE PTR [ebp-0x4],0x1
|
|
769462: 88 19 mov BYTE PTR [ecx],bl
|
|
769464: e8 c7 bf cb ff call 0x425430
|
|
769469: 8b 4f 40 mov ecx,DWORD PTR [edi+0x40]
|
|
76946c: 89 4e 40 mov DWORD PTR [esi+0x40],ecx
|
|
76946f: 8b 57 44 mov edx,DWORD PTR [edi+0x44]
|
|
769472: 89 56 44 mov DWORD PTR [esi+0x44],edx
|
|
769475: 8b 47 48 mov eax,DWORD PTR [edi+0x48]
|
|
769478: 89 46 48 mov DWORD PTR [esi+0x48],eax
|
|
76947b: 8b 4f 4c mov ecx,DWORD PTR [edi+0x4c]
|
|
76947e: 89 4e 4c mov DWORD PTR [esi+0x4c],ecx
|
|
769481: 6a ff push 0xffffffff
|
|
769483: 8d 4e 50 lea ecx,[esi+0x50]
|
|
769486: 53 push ebx
|
|
769487: 8d 57 50 lea edx,[edi+0x50]
|
|
76948a: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
|
|
769491: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
|
|
769494: 52 push edx
|
|
769495: c6 45 fc 02 mov BYTE PTR [ebp-0x4],0x2
|
|
769499: 88 19 mov BYTE PTR [ecx],bl
|
|
76949b: e8 90 bf cb ff call 0x425430
|
|
7694a0: 8b 47 6c mov eax,DWORD PTR [edi+0x6c]
|
|
7694a3: 89 46 6c mov DWORD PTR [esi+0x6c],eax
|
|
7694a6: 8b 4f 70 mov ecx,DWORD PTR [edi+0x70]
|
|
7694a9: 89 4e 70 mov DWORD PTR [esi+0x70],ecx
|
|
7694ac: 8b c6 mov eax,esi
|
|
7694ae: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
|
7694b1: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
|
7694b8: 59 pop ecx
|
|
7694b9: 5f pop edi
|
|
7694ba: 5e pop esi
|
|
7694bb: 5b pop ebx
|
|
7694bc: 8b e5 mov esp,ebp
|
|
7694be: 5d pop ebp
|
|
7694bf: c2 04 00 ret 0x4
|
|
7694c2: cc int3
|
|
7694c3: cc int3
|
|
7694c4: cc int3
|
|
7694c5: cc int3
|
|
7694c6: cc int3
|
|
7694c7: cc int3
|
|
7694c8: cc int3
|
|
7694c9: cc int3
|
|
7694ca: cc int3
|
|
7694cb: cc int3
|
|
7694cc: cc int3
|
|
7694cd: cc int3
|
|
7694ce: cc int3
|
|
7694cf: cc int3
|
|
7694d0: 55 push ebp
|
|
7694d1: 8b ec mov ebp,esp
|
|
7694d3: 56 push esi
|
|
7694d4: 8b f1 mov esi,ecx
|
|
7694d6: e8 b5 19 eb ff call 0x61ae90
|
|
7694db: f6 45 08 01 test BYTE PTR [ebp+0x8],0x1
|
|
7694df: 74 09 je 0x7694ea
|
|
7694e1: 56 push esi
|
|
7694e2: e8 c3 ba 1b 00 call 0x924faa
|
|
7694e7: 83 c4 04 add esp,0x4
|
|
7694ea: 8b c6 mov eax,esi
|
|
7694ec: 5e pop esi
|
|
7694ed: 5d pop ebp
|
|
7694ee: c2 04 00 ret 0x4
|
|
7694f1: cc int3
|
|
7694f2: cc int3
|
|
7694f3: cc int3
|
|
7694f4: cc int3
|
|
7694f5: cc int3
|
|
7694f6: cc int3
|
|
7694f7: cc int3
|
|
7694f8: cc int3
|
|
7694f9: cc int3
|
|
7694fa: cc int3
|
|
7694fb: cc int3
|
|
7694fc: cc int3
|
|
7694fd: cc int3
|
|
7694fe: cc int3
|
|
7694ff: cc int3
|
|
769500: 55 push ebp
|
|
769501: 8b ec mov ebp,esp
|
|
769503: 51 push ecx
|
|
769504: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
|
|
769507: 53 push ebx
|
|
769508: 56 push esi
|
|
769509: 8b 30 mov esi,DWORD PTR [eax]
|
|
76950b: 8b d9 mov ebx,ecx
|
|
76950d: 8b 48 04 mov ecx,DWORD PTR [eax+0x4]
|
|
769510: 57 push edi
|
|
769511: 3b f1 cmp esi,ecx
|
|
769513: 74 22 je 0x769537
|
|
769515: 8b c1 mov eax,ecx
|
|
769517: 2b c1 sub eax,ecx
|
|
769519: c1 f8 02 sar eax,0x2
|
|
76951c: 8d 3c 85 00 00 00 00 lea edi,[eax*4+0x0]
|
|
769523: 57 push edi
|
|
769524: 51 push ecx
|
|
769525: 56 push esi
|
|
769526: ff 15 0c d3 9d 00 call DWORD PTR ds:0x9dd30c
|
|
76952c: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
|
|
76952f: 83 c4 0c add esp,0xc
|
|
769532: 03 fe add edi,esi
|
|
769534: 89 78 04 mov DWORD PTR [eax+0x4],edi
|
|
769537: 8b 8b f8 06 00 00 mov ecx,DWORD PTR [ebx+0x6f8]
|
|
76953d: 8b 01 mov eax,DWORD PTR [ecx]
|
|
76953f: 8b 30 mov esi,DWORD PTR [eax]
|
|
769541: 3b f0 cmp esi,eax
|
|
769543: 74 3d je 0x769582
|
|
769545: 8b 46 10 mov eax,DWORD PTR [esi+0x10]
|
|
769548: 3b 45 0c cmp eax,DWORD PTR [ebp+0xc]
|
|
76954b: 7c 29 jl 0x769576
|
|
76954d: 3b 45 10 cmp eax,DWORD PTR [ebp+0x10]
|
|
769550: 7f 24 jg 0x769576
|
|
769552: 8b 93 50 01 00 00 mov edx,DWORD PTR [ebx+0x150]
|
|
769558: 8d 7e 08 lea edi,[esi+0x8]
|
|
76955b: 52 push edx
|
|
76955c: 8b cf mov ecx,edi
|
|
76955e: e8 0d 28 e3 ff call 0x59bd70
|
|
769563: 85 c0 test eax,eax
|
|
769565: 74 0f je 0x769576
|
|
769567: 8b 4d 08 mov ecx,DWORD PTR [ebp+0x8]
|
|
76956a: 8d 45 fc lea eax,[ebp-0x4]
|
|
76956d: 50 push eax
|
|
76956e: 89 7d fc mov DWORD PTR [ebp-0x4],edi
|
|
769571: e8 2a 5c e3 ff call 0x59f1a0
|
|
769576: 8b 36 mov esi,DWORD PTR [esi]
|
|
769578: 8b 8b f8 06 00 00 mov ecx,DWORD PTR [ebx+0x6f8]
|
|
76957e: 3b 31 cmp esi,DWORD PTR [ecx]
|
|
769580: 75 c3 jne 0x769545
|
|
769582: 5f pop edi
|
|
769583: 5e pop esi
|
|
769584: 5b pop ebx
|
|
769585: 8b e5 mov esp,ebp
|
|
769587: 5d pop ebp
|
|
769588: c2 0c 00 ret 0xc
|
|
76958b: cc int3
|
|
76958c: cc int3
|
|
76958d: cc int3
|
|
76958e: cc int3
|
|
76958f: cc int3
|
|
769590: 55 push ebp
|
|
769591: 8b ec mov ebp,esp
|
|
769593: 53 push ebx
|
|
769594: 56 push esi
|
|
769595: 57 push edi
|
|
769596: 8b 7d 08 mov edi,DWORD PTR [ebp+0x8]
|
|
769599: 8b 37 mov esi,DWORD PTR [edi]
|
|
76959b: 8b d9 mov ebx,ecx
|
|
76959d: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
|
|
7695a0: 3b f1 cmp esi,ecx
|
|
7695a2: 74 24 je 0x7695c8
|
|
7695a4: 8b c1 mov eax,ecx
|
|
7695a6: 2b c1 sub eax,ecx
|
|
7695a8: c1 f8 02 sar eax,0x2
|
|
7695ab: 8d 3c 85 00 00 00 00 lea edi,[eax*4+0x0]
|
|
7695b2: 57 push edi
|
|
7695b3: 51 push ecx
|
|
7695b4: 56 push esi
|
|
7695b5: ff 15 0c d3 9d 00 call DWORD PTR ds:0x9dd30c
|
|
7695bb: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
|
|
7695be: 83 c4 0c add esp,0xc
|
|
7695c1: 03 fe add edi,esi
|
|
7695c3: 89 78 04 mov DWORD PTR [eax+0x4],edi
|
|
7695c6: 8b f8 mov edi,eax
|
|
7695c8: b9 98 9f b2 00 mov ecx,0xb29f98
|
|
7695cd: e8 7e ce e8 ff call 0x5f6450
|
|
7695d2: 8b 8b 50 01 00 00 mov ecx,DWORD PTR [ebx+0x150]
|
|
7695d8: 8b 51 28 mov edx,DWORD PTR [ecx+0x28]
|
|
7695db: 8b 80 00 02 00 00 mov eax,DWORD PTR [eax+0x200]
|
|
7695e1: 52 push edx
|
|
7695e2: 8b c8 mov ecx,eax
|
|
7695e4: e8 67 0a 0d 00 call 0x83a050
|
|
7695e9: 8b f0 mov esi,eax
|
|
7695eb: 85 f6 test esi,esi
|
|
7695ed: 74 3f je 0x76962e
|
|
7695ef: 8b 4e 0c mov ecx,DWORD PTR [esi+0xc]
|
|
7695f2: 8b 01 mov eax,DWORD PTR [ecx]
|
|
7695f4: 89 45 08 mov DWORD PTR [ebp+0x8],eax
|
|
7695f7: 3b c1 cmp eax,ecx
|
|
7695f9: 74 33 je 0x76962e
|
|
7695fb: 8b 5d 0c mov ebx,DWORD PTR [ebp+0xc]
|
|
7695fe: 8b ff mov edi,edi
|