一个VMP1.20程序伪指令总结
参照几位牛人的精华贴，依葫芦画瓢总结如下：
1、VMP1.20的伪指令和VMP1.22略有不同：VMP1.20很多双字节的指令到1.22中是单字节的，1.22的SWITCH到跳转表通常使用的是jmp命令，1.20通常使用retn。。。。
2、使用堆栈进行交互和传递参数。
3、分为单字节、双字节（操作数1个字节），三字节（操作数2个字节），5字节指令（操作数4字节）如下几个伪指令
序 号 :[跳转表地址]->跳转地址 ||[机器码地址]->机器码 操作数 | 栈 |伪指令
第000061条:[0x1000141A]->0x100017DE||[0x10023F87]->0x29 |0036|VM_PUSH_ESP
第000062条:[0x10001726]->0x10001A41||[0x10023F88]->0xec 32b3b174 |0032|VM_PUSH_IMM
第000063条:[0x1000153E]->0x10001B68||[0x10023F8D]->0x72 9b61 |0030|VM_PUSHW_IMMW
第000064条:[0x1000165E]->0x100012FD||[0x10023F90]->0xba 07 |0032|VM_POPW_CONTEXT
4、按功能分：POP类，PUSH类，MOV类，Shift类，MUL/ADD/DIV类，Float类，杂类（包括RET和wait等）
助记名称规则：W为字操作指令，B为byte操作指令，_F为有标志位操作
PUSH类：
VM_PUSHW 1000177F
VM_PUSHW_CONTEXT 10001957
VM_PUSHW_CONTEXTBH 100019A7
VM_PUSHW_CONTEXTBL 10001A61
VM_PUSHW_IMMW 10001B68
VM_PUSH_CONTEXT 10001AB3
VM_PUSH_CR0 1000185E
VM_PUSH_CR1 10001164
VM_PUSH_CR2 10001820
VM_PUSH_CR3 100012D9
VM_PUSH_CR4 10001776
VM_PUSH_CR5 10001A31
VM_PUSH_CR6 10001AF6
VM_PUSH_CR7 100012F4
VM_PUSH_CS 10001B44
VM_PUSH_DR0 100045CB
VM_PUSH_DR1 100012EB
VM_PUSH_DR2 10001180
VM_PUSH_DR3 10001090
VM_PUSH_DR4 10001087
VM_PUSH_DR5 10001019
VM_PUSH_DR6 100010F6
VM_PUSH_DR7 10001855
VM_PUSH_DS 1000123B
VM_PUSH_ES 1000122C
VM_PUSH_ESP 100017DE
VM_PUSH_FS 1000114D
VM_PUSH_GS 100045A7
VM_PUSH_IMM 10001A41
VM_PUSH_IMMB 10001099
VM_PUSH_IMMW 100019F7
VM_PUSH_SP 1000458F
VM_PUSH_SS 1000184B
POP类：
VM_POPW_CONTEXT 100012FD
VM_POPW_CONTEXTBH 10001867
VM_POPW_CONTEXTBL 10001BE1
VM_POP_CONTEXT 10001BBB
VM_POP_CR0 100012E2
VM_POP_CR1 100018E7
VM_POP_CR2 100012A8
VM_POP_CR3 10001032
VM_POP_CR4 100018DE
VM_POP_CR5 10001A9E
VM_POP_CR6 1000116D
VM_POP_CR7 10001A7B
VM_POP_CX 10001368
VM_POP_DR0 100017B7
VM_POP_DR1 1000119F
VM_POP_DR2 10001AED
VM_POP_DR3 10001BFB
VM_POP_DR4 10001BA7
VM_POP_DR5 10001945
VM_POP_DR6 1000113A
VM_POP_DR7 100011B0
VM_POP_DS 100018F0
VM_POP_ECX 100018B4
VM_POP_ES 100012CF
VM_POP_ESP 100011CB
VM_POP_FS 100011A8
VM_POP_GS 100045C1
VM_POP_SP 1000102B
MUL/ADD/DIV类：
VM_ADD 10001838
VM_ADDB 100010DD
VM_ADDB_F 10001AA7
VM_ADDW 10001BB0
VM_ADDW_F 100012B1
VM_ADD_F 100019C2
VM_DIV 1000190A
VM_DIVW 100010CB
VM_DIVW_QUOTIENT 10001123
VM_IDIV 100018A8
VM_IDIVW 1000121A
VM_IDIVW_QUOTIENT 10001B24
VM_IMULB_F 1000104A
VM_IMULW_F 1000124A
VM_IMUL_F 10001157
VM_MULB_F 1000196D
VM_MULW_F 1000197C
VM_MUL_F 100019EA
FLOAT类：
VM_F2XM1 10001898
VM_FABS 100011F9
VM_FADD 100018BA
VM_FADDQ 10001060
VM_FCHS 10001998
VM_FCOMP 10001AE5
VM_FCOMPQ 1000199F
VM_FCOS 1000136F
VM_FDECSTP 10001AFF
VM_FDIV 10001233
VM_FDIVQ 100017EF
VM_FILD 1000455C
VM_FILDQ 10001916
VM_FINCSTP 10001071
VM_FISTP 10004554
VM_FISTPQ 100012A0
VM_FISTPW 1000100A
VM_FISUB 10001200
VM_FISUBW 10001B52
VM_FLD 10001932
VM_FLD1 100010FF
VM_FLDCW 100017A8
VM_FLDLG2 100017B0
VM_FLDLN2 10001346
VM_FLDPI 10001A3A
VM_FLDQ 10001208
VM_FLDT 10001B15
VM_FLDZ 10001B1D
VM_FMUL 10001242
VM_FMULQ 10001A84
VM_FNCLEX 10001059
VM_FNINIT 100017CA
VM_FNSTCWW 100018F7
VM_FNSTSWW 10001A28
VM_FPATAN 10001829
VM_FPREM 1000453A
VM_FPREM1 100010EF
VM_FPTAN 10001B4B
VM_FRNDINT 100019DC
VM_FSIN 1000133F
VM_FSQRT 10001012
VM_FST 100010E7
VM_FSTP 10001830
VM_FSTPQ 1000457D
VM_FSTPT 10001890
VM_FSTQ 100018CF
VM_FSUB 10001B85
VM_FSUBQ 10001805
VM_FSUBR 10001197
VM_FSUBRQ 100011C3
VM_FTST 100018D7
VM_FYL2X 100019E3
MOV类（分为byte,Word,DW几种），将[esp+0]定义为参数A,[esp+sizeof(operand)]定义为参数B,
VM_MOVB_A_TO_B 10004571
VM_MOVB_B_TO_A 100011EF
VM_MOVB_B_TO_CSA 10001ACA
VM_MOVB_B_TO_ESA 100011E4
VM_MOVB_B_TO_FSA 100017E4
VM_MOVB_B_TO_GSA 1000193A
VM_MOVB_B_TO_SSA 1000135D
VM_MOVB_CSA_TO_B 1000191E
VM_MOVB_GSA_TO_B 100010C0
VM_MOVW_A_TO_B 10001887
VM_MOVW_A_TO_SS 100011B9
VM_MOVW_B_TO_A 10001B31
VM_MOVW_B_TO_CSA 10001176
VM_MOVW_B_TO_ESA 100017C0
VM_MOVW_B_TO_FSA 1000125C
VM_MOVW_B_TO_GSA 100045AF
VM_MOVW_B_TO_SSA 1000198E
VM_MOVW_CSA_TO_B 10001B3A
VM_MOVW_ESA_TO_B 10001143
VM_MOVW_FSA_TO_B 10001130
VM_MOVW_GSA_TO_B 10001841
VM_MOVW_SSA_TO_B 10004585
VM_MOVZXB_ESA_TO_B 10001B9A
VM_MOVZXB_FSA_TO_B 100018C2
VM_MOVZXB_SSA_TO_B 10001BD4
VM_MOV_A_TO_B 10004541
VM_MOV_B_TO_A 100045B9
VM_MOV_B_TO_CSA 10001068
VM_MOV_B_TO_ESA 10001078
VM_MOV_B_TO_FSA 1000194E
VM_MOV_B_TO_GSA 10001A95
VM_MOV_B_TO_SSA 10001929
VM_MOV_CSA_TO_B 10001A8C
VM_MOV_ESA_TO_B 1000179F
VM_MOV_FSA_TO_B 10001022
VM_MOV_GSA_TO_B 1000189F
VM_MOV_SSA_TO_B 1000111A
移位类
VM_SHL 10004549
VM_SHLB 10004564
VM_SHLB_F 100019CD
VM_SHLD_F 10001811
VM_SHLW 10004599
VM_SHLW_F 1000134D
VM_SHL_F 10001B8D
VM_SHR 100018FF
VM_SHRB 10001322
VM_SHRB_F 10001313
VM_SHRD_F 10001B06
VM_SHRW 10001B5A
VM_SHRW_F 10001AD5
VM_SHR_F 100017D1
变形类
VM_NA_B_ANDW 100017F7
VM_NA_B_ANDW_F 1000132F
VM_NA_NB_AND 10001189
VM_NA_NB_ANDW 100012BE
VM_NA_NB_ANDW_F 100011D1
VM_NA_NB_AND_F 10001A14
杂类
VM_RETF 1000180D
VM_RETN 10001A24
VM_WAIT 10001081
5、伪指令
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_DR5: ;
mov ecx, dr5
push ecx
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOV_FSA_TO_B: ; DATA XREF: ????13CEo
pop edx
push dword ptr fs:[edx]
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_SP proc near
pop sp
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_SP endp
; ???????????????????????????????????????????????????????????????????????????
VM_POP_CR3:
pop edx
mov cr3, edx
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_IMULB_F proc near
pop dx
pop ax
imul dl
push ax
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_IMULB_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FNCLEX proc near ; DATA XREF: ????1602o
fnclex
jmp VMLoop_EP ; fetch Instruction Byte
VM_FNCLEX endp
; ???????????????????????????????????????????????????????????????????????????
VM_FADDQ: ; DATA XREF: ????137Eo
fadd qword ptr [esp]
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOV_B_TO_CSA: ; DATA XREF: ????1392o
pop ecx ; des?
pop dword ptr cs:[ecx] ; src?
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FINCSTP proc near ; DATA XREF: ????15B2o
; ????15D6o
fincstp
jmp VMLoop_EP ; fetch Instruction Byte
VM_FINCSTP endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOV_B_TO_ESA proc near ; DATA XREF: ????14B6o
pop edx
pop dword ptr es:[edx]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOV_B_TO_ESA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_WAIT proc near ; DATA XREF: ????146Eo
wait
jmp VMLoop_EP ; fetch Instruction Byte
VM_WAIT endp
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_DR4: ; DATA XREF: ????1516o
mov edx, dr4
push edx
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_DR3: ; DATA XREF: ????170Eo
mov eax, dr3
push eax
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_IMMB proc near ; DATA XREF: ????145Eo
movzx eax, byte ptr [esi]
add al, bl
sub al, 0C4h
lea esi, [esi+1]
not al
inc al
ror al, 5
inc al
ror al, 6
not al
add al, 85h
ror al, 1
add bl, al
cbw
cwde
push eax
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_IMMB endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_GSA_TO_B proc near ; DATA XREF: ????1592o
pop edx
mov al, gs:[edx]
push ax
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVB_GSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_DIVW proc near ; DATA XREF: ????1562o
pop dx
pop ax
pop cx
div cx
push ax
push dx
jmp VMLoop_EP ; fetch Instruction Byte
VM_DIVW endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_ADDB proc near ; DATA XREF: ????16D6o
pop dx
add [esp+0], dl
jmp VMLoop_EP ; fetch Instruction Byte
VM_ADDB endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FST proc near ; DATA XREF: ????1652o
fst dword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FST endp
; ???????????????????????????????????????????????????????????????????????????
VM_FPREM1: ; DATA XREF: ????13BAo
fprem1 ; è?óàêy￡¨IEEE￡?￡?í?FPREM￡?μ?ê?ê1ó?IEEE±ê×?[486]
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_DR6 proc near ; DATA XREF: ????166Ao
mov ecx, dr6
push ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_DR6 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FLD1 proc near ; DATA XREF: ????168Ao
fld1
jmp VMLoop_EP ; fetch Instruction Byte
VM_FLD1 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOV_SSA_TO_B proc near ; DATA XREF: ????1416o
pop eax
push dword ptr ss:[eax]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOV_SSA_TO_B endp
; ???????????????????????????????????????????????????????????????????????????
VM_DIVW_QUOTIENT: ; DATA XREF: .text:VM_OP_TABLEo
pop ax
pop cx
div cl
push ax
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_FSA_TO_B proc near ; DATA XREF: ????15A2o
pop eax
push small word ptr fs:[eax]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVW_FSA_TO_B endp
; ???????????????????????????????????????????????????????????????????????????
VM_POP_DR6: ; DATA XREF: ????139Eo
pop ecx
mov dr6, ecx
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_ESA_TO_B proc near ; DATA XREF: ????1556o
pop eax
push small word ptr es:[eax]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVW_ESA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_FS proc near ; DATA XREF: ????13AAo
mov cx, fs
push cx
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_FS endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_IMUL_F proc near ; DATA XREF: ????169Eo
pop edx
pop eax
imul edx
push eax
push edx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_IMUL_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR1 proc near ; DATA XREF: ????155Eo
mov edx, cr1
push edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_CR1 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR6 proc near ; DATA XREF: ????16DEo
pop ecx
mov cr6, ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_CR6 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_B_TO_CSA proc near ; DATA XREF: ????1476o
pop edx
pop small word ptr cs:[edx]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVW_B_TO_CSA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_DR2 proc near ; DATA XREF: ????13DAo
; ????15C6o
mov eax, dr2
push eax
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_DR2 endp
; ???????????????????????????????????????????????????????????????????????????
VM_NA_NB_AND: ; DATA XREF: ????163Ao
pop eax
not eax
not dword ptr [esp]
and [esp], eax
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSUBR proc near ; DATA XREF: ????1552o
; ????15DEo
fsubr dword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FSUBR endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR1 proc near ; DATA XREF: ????1422o
pop ecx
mov dr1, ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_DR1 endp
; ???????????????????????????????????????????????????????????????????????????
VM_POP_FS: ; DATA XREF: ????170Ao
db 66h
pop fs
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR7 proc near ; DATA XREF: ????172Eo
pop eax
mov dr7, eax
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_DR7 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_A_TO_SS proc near ; DATA XREF: ????16CAo
pop ax
db 66h
mov ss, ax
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVW_A_TO_SS endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSUBRQ proc near ; DATA XREF: ????1656o
fsubr qword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FSUBRQ endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_ESP proc near ; DATA XREF: ????144Ao
pop esp
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_ESP endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_NA_NB_ANDW_F proc near ; DATA XREF: ????14AAo
pop dx
pop cx
not dl
not cl
and dl, cl
push dx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_NA_NB_ANDW_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_B_TO_ESA proc near ; DATA XREF: ????140Eo
pop ecx
pop dx
mov es:[ecx], dl
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVB_B_TO_ESA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_B_TO_A proc near ; DATA XREF: ????14EAo
pop eax
pop cx
mov [eax], cl
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVB_B_TO_A endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; abs(st(0))=>st(0)
VM_FABS proc near ; DATA XREF: ????14D2o
; ????1696o
fabs
jmp VMLoop_EP ; fetch Instruction Byte
VM_FABS endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; float sub int
VM_FISUB proc near ; DATA XREF: ????13D6o
fisub dword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FISUB endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FLDQ proc near ; DATA XREF: ????1606o
fld qword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FLDQ endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_IDIVW proc near ; DATA XREF: ????1436o
pop dx
pop ax
pop cx
idiv cx
push ax
push dx
jmp VMLoop_EP ; fetch Instruction Byte
VM_IDIVW endp
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_ES: ; DATA XREF: ????13E2o
db 66h
push es
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FDIV proc near ; DATA XREF: ????16FEo
fdiv dword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FDIV endp
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_DS: ; DATA XREF: ????1642o
db 66h
push ds
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FMUL proc near ; DATA XREF: ????13CAo
fmul dword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FMUL endp
; ???????????????????????????????????????????????????????????????????????????
VM_IMULW_F: ; DATA XREF: ????13A6o
pop dx
pop ax
imul dx
push ax
push dx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_B_TO_FSA proc near ; DATA XREF: ????16B2o
pop ecx
pop small word ptr fs:[ecx]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVW_B_TO_FSA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FISTPQ proc near ; DATA XREF: ????1646o
fistp qword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FISTPQ endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR2 proc near ; DATA XREF: ????1512o
pop edx
mov cr2, edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_CR2 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_ADDW_F proc near ; DATA XREF: ????15FAo
pop ax
add [esp+0], ax
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_ADDW_F endp
; ???????????????????????????????????????????????????????????????????????????
VM_NA_NB_ANDW: ; DATA XREF: ????138Ao
pop cx
pop dx
not cl
not dl
and cl, dl
push cx
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_ES proc near ; DATA XREF: ????1396o
pop cx
db 66h
mov es, cx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_ES endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR3 proc near ; DATA XREF: ????161Eo
mov edx, cr3
push edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_CR3 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR0 proc near ; DATA XREF: ????158Eo
pop ecx
mov cr0, ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_CR0 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_DR1 proc near ; DATA XREF: ????157Ao
mov ecx, dr1
push ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_DR1 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR7 proc near ; DATA XREF: ????13EEo
; ????1682o
mov eax, cr7
push eax
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_CR7 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POPW_CONTEXT proc near ; DATA XREF: ????165Eo
VM_CONTEXT = edi
lodsb
add al, bl
inc al
not al
add al, 1Bh
xor al, 0A8h
add bl, al
pop small word ptr [VM_CONTEXT+eax*4]
jmp VMLoop_EP ; fetch Instruction Byte
VM_POPW_CONTEXT endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHRB_F proc near ; DATA XREF: ????1546o
pop ax
pop cx
shr al, cl
push ax
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_SHRB_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHRB proc near ; DATA XREF: ????148Ao
pop dx
pop cx
shr dl, cl
push dx
jmp VMLoop_EP ; fetch Instruction Byte
VM_SHRB endp
; ???????????????????????????????????????????????????????????????????????????
VM_NA_B_ANDW_F: ; DATA XREF: ????1402o
not dword ptr [esp]
pop dx
and [esp], dx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSIN proc near ; DATA XREF: ????138Eo
fsin
jmp VMLoop_EP ; fetch Instruction Byte
VM_FSIN endp
; ???????????????????????????????????????????????????????????????????????????
VM_FLDLN2: ; DATA XREF: ????13F2o
fldln2
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHLW_F proc near ; DATA XREF: ????143Eo
; ????14EEo
pop ax
pop cx
shl ax, cl
push ax
ushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_SHLW_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_B_TO_SSA proc near ; DATA XREF: ????1446o
pop eax
pop dx
mov ss:[eax], dl
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVB_B_TO_SSA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CX proc near ; DATA XREF: ????1582o
pop cx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_CX endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FCOS proc near ; DATA XREF: ????13B2o
fcos
jmp VMLoop_EP ; fetch Instruction Byte
VM_FCOS endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR4 proc near ; DATA XREF: ????174Ao
mov edx, cr4
push edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_CR4 endp
; ???????????????????????????????????????????????????????????????????????????
VM_PUSHW: ; DATA XREF: ????14DAo
lodsb
add al, bl
sub al, 0C4h
not al
inc al
ror al, 5
inc al
ror al, 6
not al
add al, 85h
ror al, 1
add bl, al
push ax
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOV_ESA_TO_B: ; DATA XREF: ????14E6o
pop ecx
push dword ptr es:[ecx]
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; load src to FPU CW(control word)
VM_FLDCW proc near ; DATA XREF: ????1706o
fldcw word ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FLDCW endp
; ???????????????????????????????????????????????????????????????????????????
VM_FLDLG2: ; DATA XREF: ????14D6o
fldlg2 ; load log2 to st0
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR0 proc near ; DATA XREF: ????16C6o
pop ecx
mov dr0, ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_DR0 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_B_TO_ESA proc near ; DATA XREF: ????143Ao
pop eax
pop small word ptr es:[eax]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVW_B_TO_ESA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; Initilize FPU without checking out FP exception
VM_FNINIT proc near ; DATA XREF: ????14F2o
fninit
jmp VMLoop_EP ; fetch Instruction Byte
VM_FNINIT endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHR_F proc near ; DATA XREF: ????16A2o
pop edx
pop cx
shr edx, cl
push edx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_SHR_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_ESP proc near ; DATA XREF: ????141Ao
push esp
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_ESP endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_B_TO_FSA proc near ; DATA XREF: ????160Eo
pop ecx
pop dx
mov fs:[ecx], dl
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVB_B_TO_FSA endp
; ???????????????????????????????????????????????????????????????????????????
VM_FDIVQ: ; DATA XREF: ????14CEo
fdiv qword ptr [esp]
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_NA_B_ANDW proc near ; DATA XREF: ????1686o
not dword ptr [esp+0]
pop ax
and [esp+0], ax
jmp VMLoop_EP ; fetch Instruction Byte
VM_NA_B_ANDW endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSUBQ proc near ; DATA XREF: ????175Eo
fsub qword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FSUBQ endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_RETF proc far ; DATA XREF: ????1596o
pop eax
popa
popf
retf
VM_RETF endp ; sp = 28h
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHLD_F proc near ; DATA XREF: ????141Eo
; ????16EEo
pop eax
pop edx
pop cx
shld eax, edx, cl
push eax
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_SHLD_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR2 proc near ; DATA XREF: ????1466o
mov eax, cr2
push eax
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_CR2 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FPATAN proc near ; DATA XREF: ????1616o
fpatan
jmp VMLoop_EP ; fetch Instruction Byte
VM_FPATAN endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSTP proc near ; DATA XREF: ????1662o
fstp dword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FSTP endp
; ???????????????????????????????????????????????????????????????????????????
VM_ADD: ; DATA XREF: ????15EAo
pop edx
add [esp], edx
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_GSA_TO_B proc near ; DATA XREF: ????14AEo
pop edx
push small word ptr gs:[edx]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVW_GSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_SS proc near ; DATA XREF: ????173Ao
mov ax, ss
push ax
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_SS endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_DR7 proc near ; DATA XREF: ????15F2o
mov ecx, dr7
push ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_DR7 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR0 proc near ; DATA XREF: ????15CAo
mov edx, cr0
push edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_CR0 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POPW_CONTEXTBH proc near ; DATA XREF: ????151Eo
movzx eax, byte ptr [esi]
add al, bl
xor al, 0B9h
inc al
not al
ror al, 6
add al, 0F2h
add bl, al
lea esi, [esi+1]
pop cx
mov [edi+eax*4+1], cl
jmp VMLoop_EP ; fetch Instruction Byte
VM_POPW_CONTEXTBH endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_A_TO_B proc near ; DATA XREF: ????162Eo
pop ecx
push small word ptr [ecx]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVW_A_TO_B endp
; ???????????????????????????????????????????????????????????????????????????
VM_FSTPT: ; DATA XREF: ????14DEo
fstp tbyte ptr [esp]
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; (2^x)-1
VM_F2XM1 proc near ; DATA XREF: ????14CAo
f2xm1
jmp VMLoop_EP ; fetch Instruction Byte
VM_F2XM1 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOV_GSA_TO_B proc near ; DATA XREF: ????15B6o
pop eax
push dword ptr gs:[eax]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOV_GSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_IDIV proc near ; DATA XREF: ????15FEo
pop edx
pop eax
pop ecx
idiv ecx
push eax
push edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_IDIV endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_ECX proc near ; DATA XREF: ????1442o
pop ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_ECX endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FADD proc near ; DATA XREF: ????1462o
fadd dword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FADD endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVZXB_FSA_TO_B proc near ; DATA XREF: ????14A2o
pop ecx
movzx dx, byte ptr fs:[ecx]
push dx
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVZXB_FSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSTQ proc near ; DATA XREF: ????167Ao
fst qword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FSTQ endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FTST proc near ; DATA XREF: ????16BAo
ftst
jmp VMLoop_EP ; fetch Instruction Byte
VM_FTST endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR4 proc near ; DATA XREF: ????1626o
pop edx
mov cr4, edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_CR4 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR1 proc near ; DATA XREF: ????155Ao
pop eax
mov cr1, eax
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_CR1 endp
; ???????????????????????????????????????????????????????????????????????????
VM_POP_DS: ; DATA XREF: ????14BAo
db 66h
pop ds
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FNSTCWW proc near ; DATA XREF: ????160Ao
fnstcw word ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FNSTCWW endp
; ???????????????????????????????????????????????????????????????????????????
VM_SHR: ; DATA XREF: ????14C6o
pop eax
pop cx
shr eax, cl
push eax
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_DIV proc near ; DATA XREF: ????16F6o
pop edx
pop eax
pop ecx
div ecx
push eax
push edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_DIV endp
; ???????????????????????????????????????????????????????????????????????????
VM_FILDQ: ; DATA XREF: ????13C6o
; ????145Ao
fild qword ptr [esp]
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOVB_CSA_TO_B: ; DATA XREF: ????1542o
pop ecx
mov al, cs:[ecx]
push ax
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOV_B_TO_SSA: ; DATA XREF: ????1576o
pop edx
pop dword ptr ss:[edx]
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_FLD: ; DATA XREF: ????1426o
; ????1756o
fld dword ptr [esp]
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOVB_B_TO_GSA: ; DATA XREF: ????1716o
pop ecx
pop dx
mov gs:[ecx], dl
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR5 proc near ; DATA XREF: ????154Ao
pop edx
mov dr5, edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_DR5 endp
; ???????????????????????????????????????????????????????????????????????????
VM_MOV_B_TO_FSA: ; DATA XREF: ????1712o
pop edx
pop dword ptr fs:[edx]
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_PUSHW_CONTEXT: ; DATA XREF: ????139Ao
lodsb
add al, bl
inc al
not al
add al, 1Bh
xor al, 0A8h
add bl, al
push small word ptr [edi+eax*4]
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MULB_F: ; DATA XREF: ????1456o
; ????176Eo
pop dx
pop ax
mul dl
push ax
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MULW_F: ; DATA XREF: ????1382o
pop dx
pop ax
mul dx
push ax
push dx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_MOVW_B_TO_SSA: ; DATA XREF: ????151Ao
pop ecx
pop small word ptr ss:[ecx]
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FCHS proc near ; DATA XREF: ????1676o
fchs
jmp VMLoop_EP ; fetch Instruction Byte
VM_FCHS endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FCOMPQ proc near ; DATA XREF: ????1692o
fcomp qword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FCOMPQ endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSHW_CONTEXTBH proc near ; DATA XREF: ????150Ao
lodsb
add al, bl
xor al, 0B9h
inc al
not al
ror al, 6
add al, 0F2h
add bl, al
mov al, [edi+eax*4+1]
push ax
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSHW_CONTEXTBH endp
; ???????????????????????????????????????????????????????????????????????????
VM_ADD_F: ; DATA XREF: ????1772o
pop edx
add [esp], edx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHLB_F proc near ; DATA XREF: ????14FAo
pop dx
pop cx
shl dl, cl
push dx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_SHLB_F endp
; ???????????????????????????????????????????????????????????????????????????
VM_FRNDINT: ; DATA XREF: ????13FEo
frndint ; st(0) <- INT( st(0) ); depends on RC flag
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FYL2X proc near ; DATA XREF: ????1536o
fyl2x
jmp VMLoop_EP ; fetch Instruction Byte
VM_FYL2X endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MUL_F proc near ; DATA XREF: ????1566o
pop edx
pop eax
mul edx
push eax
push edx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_MUL_F endp
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_IMMW: ; DATA XREF: ????13DEo
lodsw
add ax, bx
xor ax, 6609h
not ax
ror ax, 8
dec ax
add bx, ax
cwde
push eax
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_NA_NB_AND_F: ; DATA XREF: ????1526o
pop ecx
not ecx
not dword ptr [esp]
and [esp], ecx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_RETN: ; DATA XREF: ????1406o
pop eax
popa
popf
retn
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; save status word to dest
VM_FNSTSWW proc near ; DATA XREF: ????16BEo
fnstsw ax
push ax
jmp VMLoop_EP ; fetch Instruction Byte
VM_FNSTSWW endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR5 proc near ; DATA XREF: ????174Eo
mov edx, cr5
push edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_CR5 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
; st(0) <- ?(ie, pi)
VM_FLDPI proc near ; DATA XREF: ????16AAo
fldpi
jmp VMLoop_EP ; fetch Instruction Byte
VM_FLDPI endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_IMM proc near ; DATA XREF: ????1726o
mov eax, [esi]
add eax, ebx
add eax, 23D30F4Fh ; <suspicious>
rol eax, 1Fh
inc eax
add esi, 4
rol eax, 0Bh
sub eax, 8E5C6C84h
add ebx, eax
push eax
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_IMM endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSHW_CONTEXTBL proc near ; DATA XREF: ????158Ao
lodsb
add al, bl
xor al, 0B9h
inc al
not al
ror al, 6
add al, 0F2h
add bl, al
mov al, [edi+eax*4]
push ax
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSHW_CONTEXTBL endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR7 proc near ; DATA XREF: ????14B2o
pop edx
mov cr7, edx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_CR7 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FMULQ proc near ; DATA XREF: ????171Eo
fmul qword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FMULQ endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOV_CSA_TO_B proc near ; DATA XREF: ????147Eo
pop ecx
push dword ptr cs:[ecx]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOV_CSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOV_B_TO_GSA proc near ; DATA XREF: ????1472o
pop eax
pop dword ptr gs:[eax]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOV_B_TO_GSA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CR5 proc near ; DATA XREF: ????153Ao
pop eax
mov cr5, eax
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_CR5 endp
; ???????????????????????????????????????????????????????????????????????????
VM_ADDB_F: ; DATA XREF: ????13AEo
; ????13C2o
pop cx
add [esp], cl
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CONTEXT proc near ; DATA XREF: ????1502o
lodsb
add al, bl
xor al, 4Ah
ror al, 4
sub al, 0B7h
rol al, 6
add bl, al
push dword ptr [edi+eax*4]
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_CONTEXT endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVB_B_TO_CSA proc near ; DATA XREF: ????13A2o
pop ecx
pop ax
mov cs:[ecx], al
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVB_B_TO_CSA endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHRW_F proc near ; DATA XREF: ????173Eo
pop ax
pop cx
shr ax, cl
push ax
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_SHRW_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FCOMP proc near ; DATA XREF: ????15A6o
fcomp dword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FCOMP endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR2 proc near ; DATA XREF: ????13FAo
pop ecx
mov dr2, ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_DR2 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSH_CR6 proc near ; DATA XREF: ????13EAo
mov ecx, cr6
push ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSH_CR6 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FDECSTP proc near ; DATA XREF: ????1432o
fdecstp
jmp VMLoop_EP ; fetch Instruction Byte
VM_FDECSTP endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHRD_F proc near ; DATA XREF: ????1522o
pop eax
pop edx
pop cx
shrd eax, edx, cl
push eax
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_SHRD_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FLDT proc near ; DATA XREF: ????1762o
fld tbyte ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FLDT endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FLDZ proc near ; DATA XREF: ????14FEo
fldz
jmp VMLoop_EP ; fetch Instruction Byte
VM_FLDZ endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_IDIVW_QUOTIENT proc near ; DATA XREF: ????15CEo
pop ax
pop cx
idiv cl
push ax
jmp VMLoop_EP ; fetch Instruction Byte
VM_IDIVW_QUOTIENT endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVW_B_TO_A proc near ; DATA XREF: ????15E2o
pop edx
pop small word ptr [edx]
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVW_B_TO_A endp
; ???????????????????????????????????????????????????????????????????????????
VM_MOVW_CSA_TO_B: ; DATA XREF: ????13E6o
pop eax
push small word ptr cs:[eax]
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
VM_PUSH_CS: ; DATA XREF: ????149Ao
db 66h
push cs
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FPTAN proc near ; DATA XREF: ????1482o
fptan
jmp VMLoop_EP ; fetch Instruction Byte
VM_FPTAN endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FISUBW proc near ; DATA XREF: ????16A6o
fisub word ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FISUBW endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHRW proc near ; DATA XREF: ????15AEo
pop ax
pop cx
shr ax, cl
push ax
jmp VMLoop_EP ; fetch Instruction Byte
VM_SHRW endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_PUSHW_IMMW proc near ; DATA XREF: ????153Eo
lodsw
add ax, bx
xor ax, 6609h
not ax
ror ax, 8
dec ax
add bx, ax
push ax
jmp VMLoop_EP ; fetch Instruction Byte
VM_PUSHW_IMMW endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FSUB proc near ; DATA XREF: ????1492o
fsub dword ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FSUB endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_SHL_F proc near ; DATA XREF: ????168Eo
pop edx
pop cx
shl edx, cl
push edx
pushfw
jmp VMLoop_EP ; fetch Instruction Byte
VM_SHL_F endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVZXB_ESA_TO_B proc near ; DATA XREF: ????1622o
pop eax
movzx dx, byte ptr es:[eax]
push dx
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVZXB_ESA_TO_B endp
; ???????????????????????????????????????????????????????????????????????????
VM_POP_DR4: ; DATA XREF: ????159Ao
; ????1732o
pop edx
mov dr4, edx
jmp VMLoop_EP ; fetch Instruction Byte
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_ADDW proc near ; DATA XREF: ????1752o
pop cx
add [esp+0], cx
jmp VMLoop_EP ; fetch Instruction Byte
VM_ADDW endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_CONTEXT proc near ; DATA XREF: ????171Ao
mov al, [esi]
add al, bl
xor al, 4Ah
ror al, 4
sub al, 0B7h
rol al, 6
add bl, al
pop dword ptr [edi+eax*4]
inc esi
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_CONTEXT endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_MOVZXB_SSA_TO_B proc near ; DATA XREF: ????140Ao
pop eax
movzx dx, byte ptr ss:[eax]
push dx
jmp VMLoop_EP ; fetch Instruction Byte
VM_MOVZXB_SSA_TO_B endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POPW_CONTEXTBL proc near ; DATA XREF: ????1612o
lodsb
add al, bl
xor al, 0B9h
inc al
not al
ror al, 6
add al, 0F2h
add bl, al
pop cx
mov [edi+eax*4], cl
jmp VMLoop_EP ; fetch Instruction Byte
VM_POPW_CONTEXTBL endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_POP_DR3 proc near ; DATA XREF: ????15F6o
pop ecx
mov dr3, ecx
jmp VMLoop_EP ; fetch Instruction Byte
VM_POP_DR3 endp
; ??????????????? S U B R O U T I N E ???????????????????????????????????????
VM_FISTPW proc near
fistp word ptr [esp+0]
jmp VMLoop_EP ; fetch Instruction Byte
VM_FISTPW endp
; ???????????????????????????????????????????????????????????????????????????
VM_FSQRT:
fsqrt
jmp VMLoop_EP ; fetch Instruction Byte
; ???????????????????????????????????????????????????????????????????????????
6、伪指令块
通常每个伪指令块从一组VM_POP_CONTEXT开始，到一组VM_PUSH_CONTEXT+VM_RET结束。每个块可以
认为是更高一级的伪指令，或视为函数。指令执行记录顺序如下：
第000368条:[0x1000171A]->0x10001BBB||[0x10036BFE]->0xe9 00 |-012|VM_POP_CONTEXT
第000369条:[0x1000171A]->0x10001BBB||[0x10036C00]->0xe9 02 |-008|VM_POP_CONTEXT
第000370条:[0x1000171A]->0x10001BBB||[0x10036C02]->0xe9 0c |-004|VM_POP_CONTEXT
第000371条:[0x1000171A]->0x10001BBB||[0x10036C04]->0xe9 0b |0000|VM_POP_CONTEXT
第000372条:[0x1000171A]->0x10001BBB||[0x10036C06]->0xe9 04 |0004|VM_POP_CONTEXT
第000373条:[0x1000171A]->0x10001BBB||[0x10036C08]->0xe9 0a |0008|VM_POP_CONTEXT
第000374条:[0x1000171A]->0x10001BBB||[0x10036C0A]->0xe9 01 |0012|VM_POP_CONTEXT
第000375条:[0x1000171A]->0x10001BBB||[0x10036C0C]->0xe9 03 |0016|VM_POP_CONTEXT
第000376条:[0x1000171A]->0x10001BBB||[0x10036C0E]->0xe9 08 |0020|VM_POP_CONTEXT
第000377条:[0x1000171A]->0x10001BBB||[0x10036C10]->0xe9 04 |0024|VM_POP_CONTEXT
第000378条:[0x10001442]->0x100018B4||[0x10036C12]->0x33 |0028|VM_POP_ECX
第000379条:[0x10001726]->0x10001A41||[0x10036C13]->0xec 2d236673 |0024|VM_PUSH_IMM
第000380条:[0x100014DA]->0x1000177F||[0x10036C18]->0x59 78 |0022|VM_PUSHW
第000381条:[0x1000165E]->0x100012FD||[0x10036C1A]->0xba 05 |0024|VM_POPW_CONTEXT
第000382条:[0x10001726]->0x10001A41||[0x10036C1C]->0xec d2dc9a72 |0020|VM_PUSH_IMM
...........
第000423条:[0x10001686]->0x100017F7||[0x10036C70]->0xc4 |0022|VM_NA_B_ANDW
第000424条:[0x10001502]->0x10001AB3||[0x10036C71]->0x63 06 |0018|VM_PUSH_CONTEXT
第000425条:[0x100015E2]->0x10001B31||[0x10036C73]->0x9b |0024|VM_MOVW_B_TO_A
第000426条:[0x10001502]->0x10001AB3||[0x10036C74]->0x63 04 |0020|VM_PUSH_CONTEXT
第000427条:[0x10001502]->0x10001AB3||[0x10036C76]->0x63 09 |0016|VM_PUSH_CONTEXT
第000428条:[0x10001502]->0x10001AB3||[0x10036C78]->0x63 03 |0012|VM_PUSH_CONTEXT
第000429条:[0x10001502]->0x10001AB3||[0x10036C7A]->0x63 08 |0008|VM_PUSH_CONTEXT
第000430条:[0x10001502]->0x10001AB3||[0x10036C7C]->0x63 0a |0004|VM_PUSH_CONTEXT
第000431条:[0x10001502]->0x10001AB3||[0x10036C7E]->0x63 09 |0000|VM_PUSH_CONTEXT
第000432条:[0x10001502]->0x10001AB3||[0x10036C80]->0x63 0b |-004|VM_PUSH_CONTEXT
第000433条:[0x10001502]->0x10001AB3||[0x10036C82]->0x63 0c |-008|VM_PUSH_CONTEXT
第000434条:[0x10001502]->0x10001AB3||[0x10036C84]->0x63 02 |-012|VM_PUSH_CONTEXT
第000435条:[0x10001502]->0x10001AB3||[0x10036C86]->0x63 00 |-016|VM_PUSH_CONTEXT
第000436条:[0x10001406]->0x10001A24||[0x10036C88]->0x24 |0024|VM_RETN
对应的伪指令块如下：
VMInsBuff_03 db 1Dh ; VM_POP_CONTEXT
db 0E1h ; á
db 32h ; 2 ; VM_POP_CONTEXT
db 79h ; y
db 3Dh ; = ; VM_POP_CONTEXT
db 0C4h ; ?
db 49h ; I ; VM_POP_CONTEXT
db 92h ; ’
db 5Ch ; \ ; VM_POP_CONTEXT
db 26h ; &
db 69h ; i ; VM_POP_CONTEXT
db 6Dh ; m
db 7Fh ; ; VM_POP_CONTEXT
db 8
db 93h ; “ ; VM_POP_CONTEXT
db 0DDh ; Y
db 0A2h ; ￠ ; VM_POP_CONTEXT
db 0EBh ; ?
db 92h ; ’ ; VM_POP_ECX
db 8 ; VM_PUSH_IMM
dd 8A186535h
db 0Bh ; VM_PUSHW
db 6
db 0Bh ; VM_POPW_CONTEXT
db 0
db 19h ; VM_PUSH_IMM
dd 5C9E6D93h
db 63h ; c ; VM_ADD
db 98h ; ? ; VM_POP_CONTEXT
db 0A2h ; ￠
db 86h ; ? ; VM_PUSH_ESP
db 7Dh ; } ; VM_POP_CONTEXT
db 0C7h ; ?
db 12h ; VM_PUSH_IMM
dd 0FA3FCC82h
db 0A9h ; ? ; VM_OP_114
dw 0DAC5h
db 0DEh ; T ; VM_PUSH_SP
db 25h ; % ; VM_POP_CX
db 4Dh ; M ; VM_PUSH_ESP
db 0A4h ; ¤ ; VM_MOV_SSA_TO_B
db 0D5h ; ? ; VM_POPW_CONTEXT
db 0D2h ; ò
db 55h ; U ; VM_POP_CONTEXT
db 59h ; Y
db 0F1h ; ? ; VM_PUSH_IMM
dd 0AC9EC40Ah
db 85h ; … ; VM_ADD
db 7Fh ; ; VM_PUSH_CONTEXT
db 84h
db 85h ; … ; VM_ADD
db 40h ; @ ; VM_PUSH_IMM
dd 0BDC0F22Dh
db 11h ; VM_PUSH_REG
db 5Bh ; [
db 28h ; ( ; VM_SHRB_F
db 72h ; r ; VM_POP_CONTEXT
db 7Bh ; {
db 64h ; d ; VM_PUSH_ESP
db 0A6h ; | ; VM_MOVZXB_SSA_TO_B
db 0AEh ; ? ; VM_POPW_CONTEXT
db 0A7h ; §
db 0C0h ; à ; VM_PUSH_IMM
dd 8BC56656h
db 59h ; Y ; VM_ADD
db 6Eh ; n ; VM_PUSH_ESP
db 0DEh ; T ; VM_PUSH_IMMB
db 28h ; (
db 55h ; U ; VM_ADD
db 49h ; I ; VM_MOV_SSA_TO_B
db 0EBh ; ? ; VM_PUSH_ESP
db 0A1h ; ? ; VM_MOV_SSA_TO_B
db 63h ; c ; VM_POP_CONTEXT
db 2Ch ; ,
db 0EDh ; í ; VM_PUSH_IMMB
db 27h ; '
db 65h ; e ; VM_ADD
db 6 ; VM_MOV_B_TO_A
db 0C7h ; ? ; VM_PUSHW_IMMW
dw 123Bh
db 6Ch ; l ; VM_PUSH_IMM
dd 82EB9F59h
db 0DCh ; ü ; VM_POP_IMMWL
db 0D5h ; ?
db 21h ; ! ; VM_POPW_CONTEXT
db 16h
db 0E6h ; ? ; VM_PUSHW_IMMW
dw 0DAAAh
db 9Fh ; ? ; VM_NA_B_ANDW
db 6 ; VM_PUSH_CONTEXT
db 90h ; ?
db 21h ; ! ; VM_MOVW_B_TO_A
db 2 ; VM_PUSH_CONTEXT
db 0Ch
db 9Bh ; ? ; VM_PUSH_CONTEXT
db 66h ; f
db 2Fh ; / ; VM_PUSH_CONTEXT
db 79h ; y
db 0C9h ; é ; VM_PUSH_CONTEXT
db 0D4h ; ?
db 5Eh ; ^ ; VM_PUSH_CONTEXT
db 0E9h ; é
db 0F1h ; ? ; VM_PUSH_CONTEXT
db 0BCh ; ?
db 85h ; … ; VM_PUSH_CONTEXT
db 0CDh ; í
db 17h ; VM_PUSH_CONTEXT
db 1Fh
db 0A8h ; ¨ ; VM_PUSH_CONTEXT
db 2Dh ; -
db 43h ; C ; VM_PUSH_CONTEXT
db 48h ; H
db 85h ; … ; VM_RETN
7、多个伪指令块记录范例如下：
第0139次跳转，跳转到:0x10021F0F(VMInsBuff_14)
第0140次跳转，跳转到:0x10021622(VMInsBuff_20)
第0141次跳转，跳转到:0x1002186A(VMInsBuff_21)
第0142次跳转，跳转到:0x10022A11(VMInsBuff_22)
第0143次跳转，跳转到:0x1002202E(VMInsBuff_23)
第0144次跳转，跳转到:0x10021622(VMInsBuff_20)
第0145次跳转，跳转到:0x1002186A(VMInsBuff_21)
第0146次跳转，跳转到:0x10022A11(VMInsBuff_22)
第0147次跳转，跳转到:0x1002202E(VMInsBuff_23)
第0148次跳转，跳转到:0x10021622(VMInsBuff_20)
第0149次跳转，跳转到:0x1002186A(VMInsBuff_21)
第0150次跳转，跳转到:0x10022A11(VMInsBuff_22)
第0151次跳转，跳转到:0x1002202E(VMInsBuff_23)
第0152次跳转，跳转到:0x10021622(VMInsBuff_20)
第0153次跳转，跳转到:0x1002186A(VMInsBuff_21)
第0154次跳转，跳转到:0x10022A11(VMInsBuff_22)
第0155次跳转，跳转到:0x1002202E(VMInsBuff_23)
。。。。。。。。。
如上伪指令块执行记录，其中VMInsBuff_20到VMInsBuff_23循环执行