Statically Reverse Engineering Shellcode - IDA to Ghidra

Question

I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/

Hash: 9d7e34250477acf632c6c32fc2c50d3b

In the example, after decryption of the stage 2 this is the result:

When I repeat the same steps with Ghidra I get the following result:

I've been following the assembly trying to see if I could figure out what when wrong or what is going on with no results yet.

While searching, I came across these references: https://c9x.me/x86/html/file_module_x86_id_139.html https://en.wikipedia.org/wiki/HLT_(x86_instruction)

It would be appreciated if someone could point me in the right direction.

EDIT: After Paweł Łukasik pointed out my error, it works:

Answer 1

Starting from address 0x56 all your instructions seems to be off. And if you look closely it there is a pattern how much off they are from the original.

For example, at offset 0x58, there's supposed to be push edx so the byte should be 0x52, but you have push esp which is 0x54. Since the article mentions that this part is encrypted with a xor (with a single digit key), let's see how those values are off

In [7]: 0x52 ^ 0x54
Out[7]: 6

So this is exactly the key mentioned in the article. If we compare the rest of those off instruction we will notice that they are off by the same value.

Conclusion - this part of code shown in Ghidra was not decrypted and should be preprocessed before analysis.