; ---------------------------------------------------------------------------
;
; The Headless Horsemen Engine v1.03
;
; (x) forgot 2k7 - 2k8
;
; Size = 94 bytes
;
; input:                esi = input buffer
;                       edi = output buffer
;                       edx = virtual address delta
;
; output:               eax = output size
;
; ---------------------------------------------------------------------------
hhe                     proc
 
                        push    esi
                        push    edi
 
                        lodsb
 
                        cmp     al, 0E8h
                        jz      __e8e9
 
                        cmp     al, 0E9h
                        jnz     __x0
 
__e8e9:                 stosb
 
__fixup_dword:          lodsd
 
__store_dword:          sub     eax, edx
                        stosd
 
__exit:                 pop     eax
                        sub     edi, eax
                        pop     esi
                        xchg    eax, edi
                        retn
 
; ---------------------------------------------------------------------------
 
__x0:                   cmp     al, 0Fh
                        jnz     __x1
 
                        lodsb
                        and     al, 0F0h
                        cmp     al, 80h
                        jnz     __exit
 
                        dec     esi
                        dec     esi
                        movsw
                        jmp     __fixup_dword
 
; ---------------------------------------------------------------------------
 
__x1:                   add     edx, 3
 
                        cmp     al, 0EBh
                        jnz     __x2
 
__eb:                   mov     al, 0E9h
                        stosb
 
__fixup_byte:           lodsb
                        movsx   eax, al
                        jmp     __store_dword
 
; ---------------------------------------------------------------------------
__x2:                   inc     edx
 
                        mov     ah, al
                        and     al, 0FCh
                        cmp     al, 0E0h
                        jz      __x3
 
                        and     al, 0F3h
                        cmp     al, 70h
                        jnz     __exit
 
                        xor     ah, 0F0h
                        mov     al, 0Fh
                        stosw
                        jmp     __fixup_byte
 
; ---------------------------------------------------------------------------
 
__x3:                   add     edx, 4
                        movzx   eax, ah
                        or      eax, 5EB0200h
                        stosd
                        jmp     __eb
 
hhe                     endp
; ---------------------------------------------------------------------------

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课