//-----------------------------映射过的代码---------------------------//
PUSH 1E81CH
POP EDX
POP DWORD PTR [EDX]
PUSH 1E814H
POP EDX
POP DWORD PTR [EDX]
PUSH 1E800H
POP EDX
POP DWORD PTR [EDX]
PUSH 1E810H
POP EDX
POP DWORD PTR [EDX]
PUSH 1E80CH
POP EDX
POP DWORD PTR [EDX]
MOV BYTE PTR [1E828H], 1
PUSH 1E80CH
POP EDX
POP DWORD PTR [EDX]
PUSH 1E808H
POP EDX
POP DWORD PTR [EDX]
PUSH 1E804H
POP EDX
POP DWORD PTR [EDX]
PUSH 1E818H
POP EDX
POP DWORD PTR [EDX]
MOV EDX, ESP
PUSH EDX
PUSH 4
POP EAX
ADD [ESP], EAX
POP ESP
PUSH 1E810H
POP EDX
PUSH DWORD PTR [EDX]
PUSH ESP
PUSH 1E810H
POP EDX
PUSH EDX
PUSH 1E804H
PUSH 1E810H
POP EDX
POP EDX
POP EDX
POP DWORD PTR [EDX]
PUSH ESP
PUSH 14H
POP EAX
SUB [ESP], EAX
PUSHF
POP DWORD PTR [1E81CH]
POP ESP
PUSH 1E80CH
POP EDX
PUSH DWORD PTR [EDX]
PUSH 1E800H
POP EDX
PUSH DWORD PTR [EDX]
PUSH EDX
PUSH 1E800H
POP EDX
PUSH DWORD PTR [EDX]
POP EDX
PUSH 1E80CH
POP EDX
PUSH DWORD PTR [EDX]
POP EDX
POP EDX
PUSH 1E814H
PUSH 1E818H
POP EDX
PUSH DWORD PTR [EDX]
POP EDX
POP EDX
PUSH DWORD PTR [EDX]
PUSH 1E80CH
POP EDX
PUSH DWORD PTR [EDX]
PUSH 1E80CH
POP EDX
PUSH DWORD PTR [EDX]
PUSH 1E810H
POP EDX
PUSH DWORD PTR [EDX]
PUSH 1E80CH
POP EDX
PUSH DWORD PTR [EDX]
POP EAX
ADD [ESP], EAX
PUSHF
POP DWORD PTR [1E81CH]
POP EDX
POP EAX
XOR [ESP], EAX
PUSHF
POP DWORD PTR [1E81CH]
PUSH 1E80CH
POP EDX
PUSH EDX
PUSH EDX
PUSH 4
POP EAX
ADD [ESP], EAX
POP EDX
POP EDX
POP DWORD PTR [EDX]
PUSH 1E818H
POP EDX
PUSH DWORD PTR [EDX]
PUSH 1E818H
PUSH 1E800H
PUSH 1E814H
POP EDX
POP EDX
PUSH DWORD PTR [EDX]
POP EDX
POP EDX
PUSH DWORD PTR [EDX]
POP EAX
XOR [ESP], EAX
PUSHF
POP DWORD PTR [1E81CH]
PUSH 1E818H
POP EDX
PUSH EDX
PUSH SMALL 6B21H
PUSH 1E808H
POP EDX
PUSH DWORD PTR [EDX]
POP EDX
PUSH SMALL 9594H
POP EDX
POP EDX
POP DWORD PTR [EDX]
PUSH 1E80CH
POP EDX
PUSH SMALL WORD PTR [EDX]
PUSH DWORD PTR [1E810H]
POP EDX
PUSH EDX
PUSH 0FFFFFFF4H
POP EAX
ADD [ESP], EAX
POP EDX
PUSH EDX
PUSH 1E804H
POP EDX
PUSH DWORD PTR [EDX]
PUSH SMALL 6C0EH
PUSH SMALL 0D566H
POP EDX
POP EDX
POP EDX
POP SMALL WORD PTR [EDX]
PUSH DWORD PTR [1E810H]
POP EDX
PUSH EDX
PUSH 0FFFFFFF6H
POP EAX
ADD [ESP], EAX
PUSH SMALL 8E94H
PUSH SMALL 5A8FH
POP EDX
POP EDX
PUSH EDX
PUSH EDX
PUSH 1E810H
PUSH SMALL 0CE98H
PUSH SMALL 152DH
POP EDX
POP EDX
POP EDX
PUSH 1E814H
POP EDX
POP DWORD PTR [EDX]
MOV EBX, 0
PUSH 1E818H
POP EDX
PUSH EDX
PUSH 1E818H
POP EDX
PUSH DWORD PTR [EDX]
POP EDX
POP EDX
MOV EBX, 0
PUSH DWORD PTR [EDX]
MOV EBX, 0
PUSH EDX
PUSH SMALL 0BD8FH
PUSH SMALL 0C90CH
POP EDX
POP EDX
PUSH DWORD PTR [1E814H]
POP EDX
MOV EBX, 0
POP DWORD PTR [EDX]
PUSH EDX
PUSH 1E808H
POP EDX
POP EDX
MOV EBX, 0
JXXX 3000011H
JNX 23B6CH
//-----------------------------------------------------------//
Themida 的VMCode也是经过混淆的(该死的多态变形)
一开始的代码大概意思就是
POPF
POP EDI
POP ESI
POP EBP
POP ESP//VM 是堆栈机 不用ESP 再说了 POPA 也不改ESP
POP EBX
POP EDX
POP ECX
POP EAX