292 lines
9.4 KiB
Markdown
292 lines
9.4 KiB
Markdown
# Analysis Context
|
|
|
|
- Target binary: `/home/jan/projects/rrt/rt3_wineprefix/drive_c/rt3/RT3.exe`
|
|
- Function names prefer the curated ledger when a committed mapping exists.
|
|
|
|
## Function Targets
|
|
|
|
### `0x004ba3d0` -> `0x004ba3d0` `fcn.004ba3d0`
|
|
|
|
- Size: `2380`
|
|
- Calling convention: `cdecl`
|
|
- Signature: `fcn.004ba3d0();`
|
|
|
|
Entry excerpt:
|
|
|
|
```asm
|
|
4ba3b0: jl 0x4ba355 <.text+0xb9355>
|
|
4ba3b2: decl %ebx
|
|
4ba3b3: addb %ah, 0x4ba3(%ebp)
|
|
4ba3b9: addl %eax, (%ebx)
|
|
4ba3bb: addl (%ebx), %eax
|
|
4ba3bd: addl (%ebx), %eax
|
|
4ba3bf: addb (%ebx), %al
|
|
4ba3c1: addl (%eax), %eax
|
|
4ba3c3: addl %eax, (%eax)
|
|
4ba3c5: addl %edx, -0x6f6f6f70(%eax)
|
|
4ba3cb: nop
|
|
4ba3cc: nop
|
|
4ba3cd: nop
|
|
4ba3ce: nop
|
|
4ba3cf: nop
|
|
4ba3d0: pushl %ebp
|
|
4ba3d1: movl %esp, %ebp
|
|
4ba3d3: andl $-0x8, %esp
|
|
4ba3d6: subl $0x318, %esp # imm = 0x318
|
|
4ba3dc: pushl %ebx
|
|
4ba3dd: pushl %ebp
|
|
4ba3de: pushl %esi
|
|
4ba3df: pushl %edi
|
|
4ba3e0: movl %ecx, %ebp
|
|
4ba3e2: movl 0x6cfe04, %eax
|
|
4ba3e7: cmpb $0x0, (%eax)
|
|
4ba3ea: jbe 0x4ba72f <.text+0xb972f>
|
|
```
|
|
|
|
Callers:
|
|
- `0x004baedd` in `0x004bad20` `fcn.004bad20`
|
|
- `0x004bb8dc` in `0x004baef0` `fcn.004baef0`
|
|
- `0x004bbc89`
|
|
- `0x004bbd6a`
|
|
- `0x004bc02b`
|
|
|
|
Caller xref excerpts:
|
|
|
|
#### `0x004baedd`
|
|
|
|
```asm
|
|
4baebd: addb %cl, 0x6cfe0415(%ebx)
|
|
4baec3: addb %cl, (%edi)
|
|
4baec5: movb $0x42, %dh
|
|
4baec7: andl %ebp, (%edx)
|
|
4baeca: pushl $0x0
|
|
4baecc: pushl %eax
|
|
4baecd: pushl $0x7d0e # imm = 0x7D0E
|
|
4baed2: pushl $0x66
|
|
4baed4: movl %esi, %ecx
|
|
4baed6: calll 0x540120 <.text+0x13f120>
|
|
4baedb: movl %esi, %ecx
|
|
4baedd: calll 0x4ba3d0 <.text+0xb93d0>
|
|
4baee2: popl %edi
|
|
4baee3: popl %esi
|
|
4baee4: popl %ebx
|
|
4baee5: retl $0x4
|
|
4baee8: nop
|
|
4baee9: nop
|
|
4baeea: nop
|
|
4baeeb: nop
|
|
4baeec: nop
|
|
4baeed: nop
|
|
4baeee: nop
|
|
4baeef: nop
|
|
4baef0: pushl %ebp
|
|
4baef1: movl %esp, %ebp
|
|
4baef3: andl $-0x8, %esp
|
|
4baef6: subl $0x270, %esp # imm = 0x270
|
|
4baefc: movl 0x6cfe04, %eax
|
|
```
|
|
|
|
#### `0x004bb8dc`
|
|
|
|
```asm
|
|
4bb8bc: incl %ebx
|
|
4bb8bd: movl %ebx, 0x2c(%esp)
|
|
4bb8c1: incl %ebp
|
|
4bb8c2: movl 0x62ba8c, %ecx
|
|
4bb8c8: incl %edi
|
|
4bb8c9: movl %edi, 0x18(%esp)
|
|
4bb8cd: calll 0x517cf0 <.text+0x116cf0>
|
|
4bb8d2: cmpl %eax, %edi
|
|
4bb8d4: jl 0x4bb490 <.text+0xba490>
|
|
4bb8da: movl %esi, %ecx
|
|
4bb8dc: calll 0x4ba3d0 <.text+0xb93d0>
|
|
4bb8e1: movl %esi, %ecx
|
|
4bb8e3: calll 0x4b9a20 <.text+0xb8a20>
|
|
4bb8e8: pushl $0x7d0b # imm = 0x7D0B
|
|
4bb8ed: movl %esi, %ecx
|
|
4bb8ef: calll 0x53f830 <.text+0x13e830>
|
|
4bb8f4: movl 0x6cec20, %ecx
|
|
4bb8fa: movl %eax, %edi
|
|
```
|
|
|
|
#### `0x004bbc89`
|
|
|
|
```asm
|
|
4bbc69: pushl $0x7d96 # imm = 0x7D96
|
|
4bbc6e: movl %ebp, %ecx
|
|
4bbc70: calll 0x53fe00 <.text+0x13ee00>
|
|
4bbc75: pushl %edi
|
|
4bbc76: pushl $0x8051 # imm = 0x8051
|
|
4bbc7b: pushl $0x8020 # imm = 0x8020
|
|
4bbc80: movl %ebp, %ecx
|
|
4bbc82: calll 0x53fe00 <.text+0x13ee00>
|
|
4bbc87: movl %ebp, %ecx
|
|
4bbc89: calll 0x4ba3d0 <.text+0xb93d0>
|
|
4bbc8e: movl 0x6cfe08, %edx
|
|
4bbc94: movb 0xc(%edx), %al
|
|
4bbc97: testb %al, %al
|
|
4bbc99: je 0x4bbca2 <.text+0xbaca2>
|
|
4bbc9b: movl %ebp, %ecx
|
|
4bbc9d: calll 0x4b9ec0 <.text+0xb8ec0>
|
|
4bbca2: popl %edi
|
|
4bbca3: popl %ebx
|
|
4bbca4: popl %esi
|
|
4bbca5: xorl %eax, %eax
|
|
4bbca7: popl %ebp
|
|
4bbca8: retl $0x4
|
|
```
|
|
|
|
#### `0x004bbd6a`
|
|
|
|
```asm
|
|
4bbd4a: movzbl (%eax), %ecx
|
|
4bbd4d: movl %edx, -0x3(%eax,%ecx,4)
|
|
4bbd51: jmp 0x4bbd68 <.text+0xbad68>
|
|
4bbd53: leal -0x3(%eax), %ecx
|
|
4bbd56: calll 0x4b99c0 <.text+0xb89c0>
|
|
4bbd5b: movl 0x6cfe04, %ecx
|
|
4bbd61: movzbl (%ecx), %edx
|
|
4bbd64: movl %eax, -0x3(%ecx,%edx,4)
|
|
4bbd68: movl %ebp, %ecx
|
|
4bbd6a: calll 0x4ba3d0 <.text+0xb93d0>
|
|
4bbd6f: movl 0x6cfe08, %eax
|
|
4bbd74: movb 0xc(%eax), %cl
|
|
4bbd77: testb %cl, %cl
|
|
4bbd79: je 0x4bbca2 <.text+0xbaca2>
|
|
4bbd7f: movl %ebp, %ecx
|
|
4bbd81: calll 0x4b9ec0 <.text+0xb8ec0>
|
|
4bbd86: popl %edi
|
|
4bbd87: popl %ebx
|
|
4bbd88: popl %esi
|
|
4bbd89: xorl %eax, %eax
|
|
```
|
|
|
|
#### `0x004bc02b`
|
|
|
|
```asm
|
|
4bc00b: addb %dl, 0x68(%edi)
|
|
4bc00e: pushl %ecx
|
|
4bc00f: addb $0x0, (%eax)
|
|
4bc012: pushl $0x8020 # imm = 0x8020
|
|
4bc017: movl %ebp, %ecx
|
|
4bc019: calll 0x53fe00 <.text+0x13ee00>
|
|
4bc01e: movl 0x6cfe04, %eax
|
|
4bc023: testb $0x40, 0x28(%eax)
|
|
4bc027: movl %ebp, %ecx
|
|
4bc029: je 0x4bc039 <.text+0xbb039>
|
|
4bc02b: calll 0x4ba3d0 <.text+0xb93d0>
|
|
4bc030: popl %edi
|
|
4bc031: popl %ebx
|
|
4bc032: popl %esi
|
|
4bc033: xorl %eax, %eax
|
|
4bc035: popl %ebp
|
|
4bc036: retl $0x4
|
|
4bc039: calll 0x4b9a20 <.text+0xb8a20>
|
|
4bc03e: popl %edi
|
|
4bc03f: popl %ebx
|
|
4bc040: popl %esi
|
|
4bc041: xorl %eax, %eax
|
|
4bc043: popl %ebp
|
|
4bc044: retl $0x4
|
|
4bc047: cmpl %edi, 0x6cfe10
|
|
```
|
|
|
|
Direct internal callees:
|
|
- `0x004ba53d` -> `0x00517d40` `fcn.00517d40`
|
|
- `0x004ba556` -> `0x00518140` `fcn.00518140`
|
|
- `0x004ba5b6` -> `0x00518de0` `fcn.00518de0`
|
|
- `0x004ba606` -> `0x005193f0` `fcn.005193f0`
|
|
- `0x004ba489` -> `0x0051d820` `fcn.0051d820`
|
|
- `0x004ba5e6` -> `0x0051d820` `fcn.0051d820`
|
|
- `0x004ba611` -> `0x0051d820` `fcn.0051d820`
|
|
- `0x004ba78a` -> `0x0051d820` `fcn.0051d820`
|
|
- `0x004ba830` -> `0x0051d820` `fcn.0051d820`
|
|
- `0x004ba8cb` -> `0x0051d820` `fcn.0051d820`
|
|
- `0x004ba997` -> `0x0051d820` `fcn.0051d820`
|
|
- `0x004bac73` -> `0x0051d820` `fcn.0051d820`
|
|
- `0x004ba493` -> `0x0053b070` `fcn.0053b070`
|
|
- `0x004ba61b` -> `0x0053b070` `fcn.0053b070`
|
|
- `0x004ba6d9` -> `0x0053b070` `fcn.0053b070`
|
|
- `0x004ba794` -> `0x0053b070` `fcn.0053b070`
|
|
- `0x004ba83a` -> `0x0053b070` `fcn.0053b070`
|
|
- `0x004ba8d5` -> `0x0053b070` `fcn.0053b070`
|
|
- `0x004ba9a1` -> `0x0053b070` `fcn.0053b070`
|
|
- `0x004baa6d` -> `0x0053b070` `fcn.0053b070`
|
|
- `0x004bab24` -> `0x0053b070` `fcn.0053b070`
|
|
- `0x004bac8f` -> `0x0053b070` `fcn.0053b070`
|
|
- `0x004ba5cd` -> `0x0053c930` `fcn.0053c930`
|
|
- `0x004ba40b` -> `0x0053f830` `fcn.0053f830`
|
|
- `0x004ba4c9` -> `0x0053f830` `fcn.0053f830`
|
|
- `0x004ba661` -> `0x0053f830` `fcn.0053f830`
|
|
- `0x004ba9f4` -> `0x0053f830` `fcn.0053f830`
|
|
- `0x004baaab` -> `0x0053f830` `fcn.0053f830`
|
|
- `0x004bab53` -> `0x0053f830` `fcn.0053f830`
|
|
- `0x004ba4b4` -> `0x0053f9c0` `fcn.0053f9c0`
|
|
- `0x004ba63c` -> `0x0053f9c0` `fcn.0053f9c0`
|
|
- `0x004ba6fd` -> `0x0053f9c0` `fcn.0053f9c0`
|
|
- `0x004ba7b6` -> `0x0053f9c0` `fcn.0053f9c0`
|
|
- `0x004ba85a` -> `0x0053f9c0` `fcn.0053f9c0`
|
|
- `0x004ba8f5` -> `0x0053f9c0` `fcn.0053f9c0`
|
|
- `0x004ba9c1` -> `0x0053f9c0` `fcn.0053f9c0`
|
|
- `0x004baa90` -> `0x0053f9c0` `fcn.0053f9c0`
|
|
- `0x004bab47` -> `0x0053f9c0` `fcn.0053f9c0`
|
|
- `0x004bacb2` -> `0x0053f9c0` `fcn.0053f9c0`
|
|
- `0x004ba421` -> `0x0053fe00` `fcn.0053fe00`
|
|
- `0x004ba4dc` -> `0x0053fe00` `fcn.0053fe00`
|
|
- `0x004ba674` -> `0x0053fe00` `fcn.0053fe00`
|
|
- `0x004baa0a` -> `0x0053fe00` `fcn.0053fe00`
|
|
- `0x004baac1` -> `0x0053fe00` `fcn.0053fe00`
|
|
- `0x004bab69` -> `0x0053fe00` `fcn.0053fe00`
|
|
- `0x004bacda` -> `0x00540120` `fcn.00540120`
|
|
- `0x004bacf4` -> `0x00540120` `fcn.00540120`
|
|
- `0x004bad0f` -> `0x00540120` `fcn.00540120`
|
|
- `0x004ba4a6` -> `0x0055a040` `fcn.0055a040`
|
|
- `0x004ba62e` -> `0x0055a040` `fcn.0055a040`
|
|
- `0x004ba7a9` -> `0x0055a040` `fcn.0055a040`
|
|
- `0x004ba84d` -> `0x0055a040` `fcn.0055a040`
|
|
- `0x004ba8e8` -> `0x0055a040` `fcn.0055a040`
|
|
- `0x004ba9b4` -> `0x0055a040` `fcn.0055a040`
|
|
- `0x004baca5` -> `0x0055ab50` `fcn.0055ab50`
|
|
- `0x004ba6ef` -> `0x00563210` `fcn.00563210`
|
|
- `0x004baa83` -> `0x00563210` `fcn.00563210`
|
|
- `0x004bab3a` -> `0x00563210` `fcn.00563210`
|
|
- `0x004ba4be` -> `0x005a1145` `fcn.005a1145`
|
|
- `0x004ba646` -> `0x005a1145` `fcn.005a1145`
|
|
- `0x004ba650` -> `0x005a1145` `fcn.005a1145`
|
|
- `0x004ba7c0` -> `0x005a1145` `fcn.005a1145`
|
|
- `0x004ba864` -> `0x005a1145` `fcn.005a1145`
|
|
- `0x004ba8ff` -> `0x005a1145` `fcn.005a1145`
|
|
- `0x004ba9cb` -> `0x005a1145` `fcn.005a1145`
|
|
- `0x004bacbf` -> `0x005a1145` `fcn.005a1145`
|
|
- `0x004ba56c` -> `0x005a19c4` `fcn.005a19c4`
|
|
|
|
Data refs:
|
|
- `0x004bacc9` -> `0x004ba270`
|
|
- `0x004ba5e1` -> `0x005d0194`
|
|
- `0x004ba952` -> `0x005d0608`
|
|
- `0x004ba889` -> `0x005d0614` "Caboose.imb"
|
|
- `0x004ba59a` -> `0x005d0620` "PassMail.imb"
|
|
- `0x004ba593` -> `0x005d0630` "AnyFreight.imb"
|
|
- `0x004ba587` -> `0x005d0640` "AnyCargo.imb"
|
|
- `0x004ba566` -> `0x005d0650` "%s.imb"
|
|
- `0x004ba44e` -> `0x005d0658` "Cargo.imb"
|
|
- `0x004ba74e` -> `0x005d0658` "Cargo.imb"
|
|
- `0x004ba7f4` -> `0x005d0658` "Cargo.imb"
|
|
- `0x004bac25` -> `0x005d0658` "Cargo.imb"
|
|
- `0x004ba536` -> `0x0062ba8c`
|
|
- `0x004ba54f` -> `0x0062ba8c`
|
|
- `0x004ba3e2` -> `0x006cfe04`
|
|
- `0x004ba4fa` -> `0x006cfe04`
|
|
- `0x004ba546` -> `0x006cfe04`
|
|
- `0x004ba576` -> `0x006cfe04`
|
|
- `0x004ba711` -> `0x006cfe04`
|
|
- `0x004ba7c5` -> `0x006cfe04`
|
|
- `0x004ba869` -> `0x006cfe04`
|
|
- `0x004ba904` -> `0x006cfe04`
|
|
- `0x004ba9d0` -> `0x006cfe04`
|
|
- `0x004baa95` -> `0x006cfe04`
|
|
- `0x004bab81` -> `0x006cfe04`
|
|
- `0x004bacdf` -> `0x006cfe04`
|
|
- `0x004bacf9` -> `0x006cfe04`
|
|
- `0x004ba5bb` -> `0x006d4020`
|
|
|