177 lines
8.4 KiB
Text
177 lines
8.4 KiB
Text
|
|
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
|
|
|
|
|
|
Disassembly of section .text:
|
|
|
|
00779850 <.text+0x378850>:
|
|
779850: 55 push ebp
|
|
779851: 8b ec mov ebp,esp
|
|
779853: 6a ff push 0xffffffff
|
|
779855: 68 10 7b 98 00 push 0x987b10
|
|
77985a: 64 a1 00 00 00 00 mov eax,fs:0x0
|
|
779860: 50 push eax
|
|
779861: 83 ec 08 sub esp,0x8
|
|
779864: 53 push ebx
|
|
779865: 56 push esi
|
|
779866: 57 push edi
|
|
779867: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
|
77986c: 33 c5 xor eax,ebp
|
|
77986e: 50 push eax
|
|
77986f: 8d 45 f4 lea eax,[ebp-0xc]
|
|
779872: 64 a3 00 00 00 00 mov fs:0x0,eax
|
|
779878: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
|
|
77987b: 8b f1 mov esi,ecx
|
|
77987d: 89 75 ec mov DWORD PTR [ebp-0x14],esi
|
|
779880: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
|
|
779883: 33 c0 xor eax,eax
|
|
779885: 89 06 mov DWORD PTR [esi],eax
|
|
779887: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
77988a: 89 46 08 mov DWORD PTR [esi+0x8],eax
|
|
77988d: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
|
|
779890: 2b 0b sub ecx,DWORD PTR [ebx]
|
|
779892: b8 09 cb 3d 8d mov eax,0x8d3dcb09
|
|
779897: f7 e9 imul ecx
|
|
779899: 03 d1 add edx,ecx
|
|
77989b: c1 fa 06 sar edx,0x6
|
|
77989e: 8b fa mov edi,edx
|
|
7798a0: b8 00 00 00 00 mov eax,0x0
|
|
7798a5: c1 ef 1f shr edi,0x1f
|
|
7798a8: 03 fa add edi,edx
|
|
7798aa: 89 06 mov DWORD PTR [esi],eax
|
|
7798ac: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
7798af: 89 46 08 mov DWORD PTR [esi+0x8],eax
|
|
7798b2: 74 4b je 0x7798ff
|
|
7798b4: 81 ff 2c f7 34 02 cmp edi,0x234f72c
|
|
7798ba: 76 0b jbe 0x7798c7
|
|
7798bc: 68 90 1f 9e 00 push 0x9e1f90
|
|
7798c1: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
|
|
7798c7: 8d 4e 0c lea ecx,[esi+0xc]
|
|
7798ca: 57 push edi
|
|
7798cb: e8 70 16 01 00 call 0x78af40
|
|
7798d0: 6b ff 74 imul edi,edi,0x74
|
|
7798d3: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
|
|
7798d6: 52 push edx
|
|
7798d7: 8d 56 0c lea edx,[esi+0xc]
|
|
7798da: 52 push edx
|
|
7798db: 03 f8 add edi,eax
|
|
7798dd: 89 06 mov DWORD PTR [esi],eax
|
|
7798df: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
7798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi
|
|
7798e5: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
|
|
7798e8: 8b 1b mov ebx,DWORD PTR [ebx]
|
|
7798ea: 50 push eax
|
|
7798eb: 51 push ecx
|
|
7798ec: 53 push ebx
|
|
7798ed: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
|
|
7798f4: e8 a7 8c ff ff call 0x7725a0
|
|
7798f9: 83 c4 14 add esp,0x14
|
|
7798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
|
7798ff: 8b c6 mov eax,esi
|
|
779901: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
|
779904: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
|
77990b: 59 pop ecx
|
|
77990c: 5f pop edi
|
|
77990d: 5e pop esi
|
|
77990e: 5b pop ebx
|
|
77990f: 8b e5 mov esp,ebp
|
|
779911: 5d pop ebp
|
|
779912: c2 04 00 ret 0x4
|
|
779915: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
|
|
779918: e8 63 fc ea ff call 0x629580
|
|
77991d: 6a 00 push 0x0
|
|
77991f: 6a 00 push 0x0
|
|
779921: e8 96 b6 1a 00 call 0x924fbc
|
|
779926: cc int3
|
|
779927: cc int3
|
|
779928: cc int3
|
|
779929: cc int3
|
|
77992a: cc int3
|
|
77992b: cc int3
|
|
77992c: cc int3
|
|
77992d: cc int3
|
|
77992e: cc int3
|
|
77992f: cc int3
|
|
779930: 55 push ebp
|
|
779931: 8b ec mov ebp,esp
|
|
779933: 6a ff push 0xffffffff
|
|
779935: 68 38 06 97 00 push 0x970638
|
|
77993a: 64 a1 00 00 00 00 mov eax,fs:0x0
|
|
779940: 50 push eax
|
|
779941: 83 ec 20 sub esp,0x20
|
|
779944: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
|
779949: 33 c5 xor eax,ebp
|
|
77994b: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
|
|
77994e: 56 push esi
|
|
77994f: 50 push eax
|
|
779950: 8d 45 f4 lea eax,[ebp-0xc]
|
|
779953: 64 a3 00 00 00 00 mov fs:0x0,eax
|
|
779959: 8b f1 mov esi,ecx
|
|
77995b: 8b 86 8c 00 00 00 mov eax,DWORD PTR [esi+0x8c]
|
|
779961: 85 c0 test eax,eax
|
|
779963: 75 0c jne 0x779971
|
|
779965: 68 34 24 a2 00 push 0xa22434
|
|
77996a: e8 e1 05 14 00 call 0x8b9f50
|
|
77996f: eb 7e jmp 0x7799ef
|
|
779971: 50 push eax
|
|
779972: e8 09 cc c9 ff call 0x416580
|
|
779977: 83 c4 04 add esp,0x4
|
|
77997a: 85 c0 test eax,eax
|
|
77997c: 74 0c je 0x77998a
|
|
77997e: 68 f8 23 a2 00 push 0xa223f8
|
|
779983: e8 58 08 14 00 call 0x8ba1e0
|
|
779988: eb 65 jmp 0x7799ef
|
|
77998a: e8 d1 58 dc ff call 0x53f260
|
|
77998f: c7 45 e8 0f 00 00 00 mov DWORD PTR [ebp-0x18],0xf
|
|
779996: c7 45 e4 00 00 00 00 mov DWORD PTR [ebp-0x1c],0x0
|
|
77999d: c6 45 d4 00 mov BYTE PTR [ebp-0x2c],0x0
|
|
7799a1: 8d 4d d4 lea ecx,[ebp-0x2c]
|
|
7799a4: 51 push ecx
|
|
7799a5: 50 push eax
|
|
7799a6: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
|
|
7799ad: e8 fe 52 dc ff call 0x53ecb0
|
|
7799b2: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
|
|
7799b5: 83 c4 08 add esp,0x8
|
|
7799b8: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
|
|
7799bc: 73 03 jae 0x7799c1
|
|
7799be: 8d 45 d4 lea eax,[ebp-0x2c]
|
|
7799c1: 8b 96 8c 00 00 00 mov edx,DWORD PTR [esi+0x8c]
|
|
7799c7: 6a 00 push 0x0
|
|
7799c9: 56 push esi
|
|
7799ca: 68 a0 8d 77 00 push 0x778da0
|
|
7799cf: 68 e0 ea 76 00 push 0x76eae0
|
|
7799d4: 6a 00 push 0x0
|
|
7799d6: 50 push eax
|
|
7799d7: 52 push edx
|
|
7799d8: e8 f3 d7 c9 ff call 0x4171d0
|
|
7799dd: 83 c4 1c add esp,0x1c
|
|
7799e0: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
|
|
7799e4: 72 0c jb 0x7799f2
|
|
7799e6: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
|
|
7799e9: 50 push eax
|
|
7799ea: e8 bb b5 1a 00 call 0x924faa
|
|
7799ef: 83 c4 04 add esp,0x4
|
|
7799f2: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
|
7799f5: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
|
7799fc: 59 pop ecx
|
|
7799fd: 5e pop esi
|
|
7799fe: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
|
|
779a01: 33 cd xor ecx,ebp
|
|
779a03: e8 7a b3 1a 00 call 0x924d82
|
|
779a08: 8b e5 mov esp,ebp
|
|
779a0a: 5d pop ebp
|
|
779a0b: c3 ret
|
|
779a0c: cc int3
|
|
779a0d: cc int3
|
|
779a0e: cc int3
|
|
779a0f: cc int3
|
|
779a10: 53 push ebx
|
|
779a11: 56 push esi
|
|
779a12: 8b f1 mov esi,ecx
|
|
779a14: 57 push edi
|
|
779a15: 8b be 24 01 00 00 mov edi,DWORD PTR [esi+0x124]
|
|
779a1b: 33 db xor ebx,ebx
|
|
779a1d: 3b fb cmp edi,ebx
|
|
779a1f: 74 10 je 0x779a31
|
|
779a21: 8b cf mov ecx,edi
|
|
779a23: e8 28 6a ff ff call 0x770450
|