rendered paste bodyobjdump -x -D bfab4d3c076ac4059f3c1e680c7a6933.exe
bfab4d3c076ac4059f3c1e680c7a6933.exe: file format pei-i386
bfab4d3c076ac4059f3c1e680c7a6933.exe
architecture: i386, flags 0x0000012e:
EXEC_P, HAS_LINENO, HAS_DEBUG, HAS_LOCALS, D_PAGED
start address 0x00401020
Characteristics 0x103
relocations stripped
executable
32 bit words
Time/Date Sun Feb 3 18:13:25 2008
Magic 010b (PE32)
MajorLinkerVersion 8
MinorLinkerVersion 0
SizeOfCode 00000200
SizeOfInitializedData 00000200
SizeOfUninitializedData 00000000
AddressOfEntryPoint 00001020
BaseOfCode 00001000
BaseOfData 00002000
ImageBase 00400000
SectionAlignment 00001000
FileAlignment 00000200
MajorOSystemVersion 4
MinorOSystemVersion 0
MajorImageVersion 0
MinorImageVersion 0
MajorSubsystemVersion 4
MinorSubsystemVersion 0
Win32Version 00000000
SizeOfImage 00003000
SizeOfHeaders 00000200
CheckSum 00000000
Subsystem 00000002 (Windows GUI)
DllCharacteristics 00000400
SizeOfStackReserve 00100000
SizeOfStackCommit 00001000
SizeOfHeapReserve 00100000
SizeOfHeapCommit 00001000
LoaderFlags 00000000
NumberOfRvaAndSizes 00000010
The Data Directory
Entry 0 00000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 00000000 00000000 Import Directory [parts of .idata]
Entry 2 00000000 00000000 Resource Directory [.rsrc]
Entry 3 00000000 00000000 Exception Directory [.pdata]
Entry 4 00000000 00000000 Security Directory
Entry 5 00000000 00000000 Base Relocation Directory [.reloc]
Entry 6 00000000 00000000 Debug Directory
Entry 7 00000000 00000000 Description Directory
Entry 8 00000000 00000000 Special Directory
Entry 9 00000000 00000000 Thread Storage Directory [.tls]
Entry a 00000000 00000000 Load Configuration Directory
Entry b 00000000 00000000 Bound Import Directory
Entry c 00000000 00000000 Import Address Table Directory
Entry d 00000000 00000000 Delay Import Directory
Entry e 00000000 00000000 CLR Runtime Header
Entry f 00000000 00000000 Reserved
Sections:
Idx Name Size VMA LMA File off Algn
0 .text 00000041 00401000 00401000 00000200 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
1 .data 0000004b 00402000 00402000 00000400 2**2
CONTENTS, ALLOC, LOAD, DATA
SYMBOL TABLE:
no symbols
Disassembly of section .text:
00401000 <.text>:
401000: 55 push %ebp
401001: 8b ec mov %esp,%ebp
401003: 51 push %ecx
401004: c7 45 fc ee ff c0 00 movl $0xc0ffee,-0x4(%ebp)
40100b: 8b 45 fc mov -0x4(%ebp),%eax
40100e: 35 00 10 40 00 xor $0x401000,%eax
401013: 35 ee 44 87 00 xor $0x8744ee,%eax
401018: 8b e5 mov %ebp,%esp
40101a: 5d pop %ebp
40101b: c3 ret
40101c: cc int3
40101d: cc int3
40101e: cc int3
40101f: cc int3
401020: 55 push %ebp
401021: 8b ec mov %esp,%ebp
401023: 51 push %ecx
401024: c7 45 fc 00 00 00 00 movl $0x0,-0x4(%ebp)
40102b: 68 00 20 40 00 push $0x402000
401030: e8 cb ff ff ff call 0x401000
401035: 83 c4 04 add $0x4,%esp
401038: 89 45 fc mov %eax,-0x4(%ebp)
40103b: 33 c0 xor %eax,%eax
40103d: 8b e5 mov %ebp,%esp
40103f: 5d pop %ebp
401040: c3 ret
Disassembly of section .data:
00402000 <.data>:
402000: 45 inc %ebp
402001: 6d insl (%dx),%es:(%edi)
402002: 61 popa
402003: 69 6c 20 69 73 20 72 imul $0x65722073,0x69(%eax,%eiz,1),%ebp
40200a: 65
40200b: 74 75 je 0x402082
40200d: 72 6e jb 0x40207d
40200f: 20 76 61 and %dh,0x61(%esi)
402012: 6c insb (%dx),%es:(%edi)
402013: 75 65 jne 0x40207a
402015: 20 6f 66 and %ch,0x66(%edi)
402018: 20 66 6e and %ah,0x6e(%esi)
40201b: 20 69 6e and %ch,0x6e(%ecx)
40201e: 20 66 6f and %ah,0x6f(%esi)
402021: 72 6d jb 0x402090
402023: 20 30 and %dh,(%eax)
402025: 78 31 js 0x402058
402027: 32 33 xor (%ebx),%dh
402029: 34 35 xor $0x35,%al
40202b: 36 ss
40202c: 37 aaa
40202d: 38 20 cmp %ah,(%eax)
40202f: 7a 65 jp 0x402096
402031: 72 6f jb 0x4020a2
402033: 20 70 61 and %dh,0x61(%eax)
402036: 64 64 65 64 20 74 6f and %dh,%fs:%gs:0x20(%edi,%ebp,2)
40203d: 20
40203e: 65 69 67 68 74 20 64 imul $0x69642074,%gs:0x68(%edi),%esp
402045: 69
402046: 67 addr16
402047: 69 .byte 0x69
402048: 74 73 je 0x4020bd
...