VM Reverse Engineering Part 2 - Disassembly

• Overview
• Code
• Instruction Set
• Manual Instruction Decoding (test)

Overview

This is a continuation of our previous work on Zeus VM. After reverse engineering the VM instruction handlers are now going to create an instruction set representation in python which will be our first step in creating a disassembler.

Code

CODE_HEX = '1a09029c96ff81020089249a881f8cc1ecfff903bc02414b249015aa648ad582c81d3615e6a6ee5c6bf9ab6fec5d09e3da29c71a0178ea5d76bc302819ba41474563b987c556f06aad9809c9b86c44bc4fafc9fede01008a518fe191d47d3881bf24a74bf05b6bd82e95bec48930e73714e72b8cf81be623ffaecdf2d694b9dd1d7ad773fd1cde891dd1bf31f3d676ab0528a0d45a05dd4cd75d6ece255154538218a7b761beebb01ac9e5b3569105a50655c156f2058ec4035752e405e27ca367cf0567b7e224f6050aa605ec38d97bffeeb0fe8104a70ea6d8702fa604debb0e8a31c0799904d170b0047ebf047d9d04b256413ece04f996a3eea9048d759f04bb0e268a0bd2234b09cf0bf1b20b801dc30e962cf50b43a4bc0eb5d00e7e9a0e3b1de3bee70e91fabc0ead0d200ca20f19378db5820de053be729e0f8bed0f28e2ff820d7c79d07d88ffb6dd8fffa50fd60715786465a703b3ae07c939fd7de60735139b07cb02ecc2bb3b970b4a189cbef40969ee07d4c64107a909fa907bc19bd60bd2158b37ff03b4fb1423ae07c109d2ff0167c5e502c36c8dbdcf19b4099fd719c309e09e99d4026bf73db58f09d00557e14e04c905c0fe8875ce05d61a8a05728555fe056215c7dbad0b78ccde05e00b00880af7c4ccaaf4aaee0a7be29a38ccaae0a4c60aa21ea20ba90ce4c7d2bcf80b73d3e105f1075a4ae477cd77bb0b28d30bb9f4ccfe0732d3eacc8cb7e57cd70bb704dda5dd06eaee04af7c0c6702d699d4b7c32a55ebfefe2651e18e51474e2e3c4fdacedbcc829663994d359c2f18bfe9b6a678e6db034557067661dbd17f6490436e7bc06e2e8389a47ced889fbe4bebc88d1d66c6f317952edf8268164c1179aa3df2afa40a4278903cd5d631dccc9022a4ceb5471c156a0010cd9cc18be07d01b85fb38bade4900eaf0371e433ec33e2e3a30f3ca9ef850738c2c354bcefaeffb2e7de074d910e94d2f39f0e53055733de0f7cb6a477c637f00e95d8f7c33fe703aeef0eceb973ad0eb20ce23de20bbfa30b7a9e0b8148f6bcd90b15f10c16ced20b880dae03e3369766eb33880d07c0f333960d2318a6e18d0d75b2d38cd3cf0db1077bd7f8015168ff07c020f40714f5d3fcad71be01bbc20749d09077a2014bb307166a06a6810148a11cc5ac07c8cabd06a707899967d60672d0dd15c667fb06b08c8801b901a18d09b9959472bc19d209d18f0920dbc609d90b0a01046d00c6ba5a8c5d937cc46fdd07a60254ce22fd22d30209ee07027d429dae073f71dc0790dee0229e72ac07bfc1fef00baa0233b00b843ef80283ffb2c622940bb60c0fda039683cccd085ecdf0082e9880086687b53296c5ea0c6fa9ccbf080e59491ea00562a7c89105dceee8058718abccbc8cbb08e600d6088d95d400275ef800e2b40d9e5d71a591dbba0b780ed56c8600e49d00b74be0bbc60d32e751daca00d1bbeddbf300a50000820c07879419b60b1030a7bcda0eb6691ddaa80bb0c9156ca30b9de6fb0bc1d4c50d6dc3005bdb005dd4e00dbf00d1b3c8d296dbbd4a8fb28c2763d854e7e9b119b2eaafe99d4d370cbc815a35ddd902d9ca8c4115173bb64258ab8e246782e4383dc6883045a27e9ae6035930c0d528bc112115863db19d903f000e325ac03f8fea1eaafc9040f538722d236e12d40adb4b42d81b56a06d291b430475edb9c58d4801f17e3093c070ee2ccb108a287986321680b230f3375c9804172a78f97e87736441f0669c698c54efccab07426d5083d9072b85174fc707c302a30f03992ff02fdc0217b4cc5ba32fd62fc0ffcb02bf08bcc168e48e00948800c4a8008cf3a3e9b7ef027688cd22f62884029aec90228e02ae96f7d3fde20aa80d9bf49b0cc5d5dced0aaf1756f89c0a7d8ead8eacd6ddf2add70aed15c60d68768ebbf90c66adcdec0aa47cff2d8a04a60b91bbaeba8c0425f90423e30b660e4488dcbbed4be004f4b4258d91048c3b7af7ec0490a15f619c04eb90040ec5090ced27ede104e40200800572ac712ac20873f19154c101dfc585c605e36de0569d01f79305c728b80801eb85850ccd0046cbce0190f601b2c318d3589bcc9281d80cbbdaa76b8b08679f01c86b2709d601f73fad0179ebfa068e58a306613c9616c20a8e8f06c081061ef906d3aae406a614e406c6081c72cb060168df1bac0a513e8534daa1cf065b9ced01b1cc0ab177e876d506800a88039288a3f7a3ff0a9c068401899961de19eb69d20648bcb506bcb4df368c062cc069af19cf19ac19c799bb11c399da99b206da9401f1b806f54fac06c61ba62da3dd3b3ba7139e66c7e6142096fc1589faae43e6371fa572a82fffeb8c01e66a88c4d70e83b3aa01ec6aa8d28701d14535c6323b7610aafc976af3b7da0f1da68b257048d6e1bcdcd970f0a5e87b7ace6892e8c415a02c1b1c49a777de00c28b0554e22c2434961a30d08e0f7cb4cb9839ce73a72ddd952ffeb6fb5a32a5fe0f419672e210ef5bee15d56995e3a30eb8c0e6582814c15126c7a974469fd70f82f8f685b4959dcc3cd5a73db435f4a609b2f0800db1a85583427a0250c285a8298bcb96d5210d3f30faef32b2641ec00c71ce3b2b4241afd6e23e33dab2c87fe40f43550bcea83b15b768537699a439cbe476d8ddab4fdf0780218cfa9919bbf085be70e89e14f716fcbc4e06098e263596d1650dd9f78c7a4d97e6256ffbf77e2ab617e5f1741db48e2464ad6df1c52f5b783d2eef52283514f08339faaab8230920b5918d939d010923647c0bb44b37e10e4cae80c0b3555966f1134e85791ec3e22b5736e1f11a2f52a56d038b0f00ea65f59ff657e0e40f97a6b312a70a6041801ed108fef6c98ad78ff40f798903ecaddf084f841043e308d042abf39c08ffa50f9be5ace1f90861cccb0f874be208beb8e5b40fac09ee64cdbaed0f33d399c499caf9a899f50fb2755151b299adf9baf9bc0fc18009f684f9a20fd0db2832ff0f05b1af0f491edb0fb0091eb00dd1d20933f9d00d155eeb0d3e31e10d1fe20df440c4e1980de1e07c7b463a18ca0ca13b1144a5c54784538679876d87398ad38be0eef2e748dc1546905c8c920e81a796bb02817efcc9eb62c89b25399bbe0c401f8e59cef9e2e246028a2324a6c9b2d9876d6f0f7fe9cfe0c889c1cc0cf36e893b478ad4a67452b1c328c6366d82cf23893a2d60014ac8aacfd3907877f82584ce3ff97930d075778f484c954b0053ba63126865acde0206e13993b9e5074847edf9c329fe7e540b01f1473b06ab05df350f20256417f190009bdf2e5fc456fa0c59b8ac888338c525469c1c75f296fd61c3400882e0cd776c0e39cff65951c98559b46f92267fe9a7c9f509aa0b762a91a8f39bfd0a02af24c58b9ac10b6a3e6139d29be30956420e8fd809d416e609b40a9908b14ea905353cd5f7b8a9fb0682a9ba96da0ab4d109a8ce0523dd96cb668a65b70adf8105cef2b8569a0968920aece5c70a21b57228af06039ecc06f18fbc54d5d87cfecc0ba8079407aa77cc77fc0bcc06a60fc5c406f5bcffd664ea06c100a00d39a00de901f4d908ef6dd411c0d8b608b70041db2230a100d1ec4d12d418cb8dd70db6c708da00bbfa0114ea18cd01bddc118e00e70eede1e994e8ee8a06e2f36498061383ec0631c90682125d12920edf8bf60e04d7ac0e61b50ed009008a01787dfa07efcaa6edec01b1e7045338705cd104571db90ee7e40772358a74af048c0916009e04b20e927bbae7a30ef7697160c507b790481f840e0be604d78a8a7317b608aa0dbed9bc07e8807ae5f30d63f9bca9948dddd79d77bd0df682f309b5c77f32b4086a0148a7d1d7f1086bf6ab07c10af4087a9a094fbb844cbbdd968dc277d608bc8a2b0610b9fd4e21a3e6a1f8bc76f8bee8820feaf1b90a2e763ecc39308dbdbeba137da1da45cc7b475152a8011f3a0b9262ee506084c7933225ee0e3a74cf9bcbfa6ceff1f127c0bb42c861dd068cf720fecf22c7508165e9a20f93e70f1bedd7e45040c79a606b7c62a96318637f0d28be26de6999ff54fd0e740b0f6e56fdb8837176ad63367b4a302cc0d101f14ec911d911e911ee071a0628ff9117f3018069c201a88469efb001c300a00a75ee0ae500addd07e3d5d100d9a200f4837aa700fd4ab76dd08906a50593dcab559a0629d75588658665de06e26501df2c274a8fccc2cdc9ad7c9852e6da0d3b80263c1fcba0fe6ce667d728a5d75ad1fe0e2e74790451fcf73e02476fb89979fdc809ab0fb5eb9b09beeabb040e6ca08c8d0f9ae3091844fa04cc0bb333caffb894b84fee448d04a89ed0448b94b509b30300800bb9f7900b684ec3ba840be7a89b6b4c569816733225425ff5c8a17a3d0acb499171560e261dc0395be11d1ef0c3a56bc9eea6902aef22be68c818d41ab8c691311c8f9489ee17e88b5d54dac4ccf42b498de4b031123e8248a8da2cdef9d5230232eb6057820a8b14174bf23275a2c4ed2dc5c3c6fac15010135d6528ebca8df1d46cf610cc495f88332d1c3f9a70e114646a3f9accdcfb8bfc543315249f29e10eaa68dfd5b5150ac72c25335f6f56f0529b0ff748b9b9810f8d0c12be003845e590b00ca0f0e403822d032c990f9193fe0ae8c0b203e88c0fd05db003324d9c0333dace99cd0fe98d0fec4f9900c50fb3a4d40fa78c0f8dde3cd30f42883cd90fede70fc395fdda07850420a207829334338e041ce507a8819807c9090082783a6aed9aa1f8ccae3405401e6535007d10d490c185cd1d7b22fda4477944d39b2f03cad9ba1f8d768a2dce5f682dbc09a3e08055cba491ecc6ab6e19aab9ddabf2052d55c1c2da86687821586c8ed241cda64016f0d7fc73163f57d593342ade542961464d9e7c3aa128ff1c041e40557f273679ea425bbc48b87d9fc4fcd302009d64555bd3fe602859a6e784df7fcd93b3b8820eb9a118cb49e3f2931562943b801975f2997450822cc595db2312b746b3084543a56142a791a5e47812564ce8ae9b4ee9f7afdb268aa187184e8de45971313d49f4bc11f64663abd317172c544c63d21d5afd3c959c099b00c146f200df5991a1e308c209f81cffe9fa092411f80806cf0bdec000c75c9a001e36e25caa98f609d151ed8bd008a74b1969960b7301ad083b44ec99fb0bda08e30fcd5f418731950173ef12e77508c99ff08dc0b0b2c08a8bf00c8d01f64dc011b80ccc1b27100a4fac18772770ed0591879605948fc8f1ef8099912500f93c19e60fac0bf169d80f6855c2858a0f2e779a0f256eca2b9ffb930733a7fbdd0fe813a80f3cde8e7b8b07e7d8a60f12d7b7ee0f0124d90fe17902d780c998cd76bc7d1d6dc7a2897a24ed4bb67a83e8a61950bafffae8bc0878f3d4967adb4d6421bad86104bfa731b1316b382650a7ddb2f17185ad6459ab524e1ba8a9ddd5c8adeb84ea5a586b82be5e39444a53acdb446aa642182f86b57e581981454f858589f7f1ab58f66a73e8f29c94f636db2c8bda99a003a20077ea03e99373b4df00d200f7091e9f03fcb430e030cd01ddc909c303a8d1d8078701db8817f5de11c50740f39e07c2d5ae04ad17c4f3a8418a0709c344a0019f27c4718541870767e0532af5078a6f7f368311ab07daaedec0d8c1027a57c322f60868e102d90d2f820e11bc91045dc54d890e29d93357904e9a0ef3d94ff08f0dd271950dc4f64db2b0e4add484d4eb0458a04d20a50e41a70e95ee04bfd304c40000000000'


CODE = bytes.fromhex(CODE_HEX)

Instruction Set

The context for the VM follows.

struct __declspec(align(4)) ctxt
{
  byte *code;
  byte *data;
  DWORD loop_count;
  DWORD regs[16];
};

Manual Instruction Decoding (test)

1a 09 02 9c 96 ff 81 02 00

• current_key: 0
• opcode: 1a
• opcode decrypted: 1a
• instruction: h_shift_data_imm_w
• op_key: 09
• key: 8f ^ 09 = 0x86
• size: 3
• instruction: 1a 09 02

9c 96 ff 81 02 00

• current_key: 86
• opcode: 9c
• opcode decrypted: 1a
• instruction: h_shift_data_imm_w
• op_key: 96
• key: 8f ^ 96 = 0x19
• size: 3
• instruction: 9c 96 ff

81 02 00

• current_key: 19
• opcode: 81
• opcode decrypted: 98 XXXXX (should be 18)
• instruction: h_rol_b_data_b
• op_key: 0
• key: 0xC ^ 96 = 0x9a
• size: 2
• instruction: 9c 96

from enum import Enum
import struct

class LoopCounter:
    text = "LoopCounter"

class Data:
    text = "Data"

class DP:
    text = "DP"

class PC:
    text = "PC"

class OPKey:
    text = "OPKey"


def create_register_class(register_name):
    class Register:
        text = register_name
    return Register


registers = [ create_register_class("Reg" + str(i))() for i in range(0,16)]

class DataSize:
    def __init__(self, value):
        self.value = value

    @classmethod
    def BYTE(cls):
        return cls(1)

    @classmethod
    def WORD(cls):
        return cls(2)

    @classmethod
    def DWORD(cls):
        return cls(4)

    def __str__(self):
        if self.value == 1:
            return 'BYTE'
        elif self.value == 2:
            return 'WORD'
        elif self.value == 4:
            return 'DWORD'
        else:
            return f'VALUE({self.value})'

class Operand:
    def __init__(self):
        self.text = ""
        self.op_size = 0

class OperandData(Operand):
    def __init__(self, data_size: DataSize):
        super().__init__()
        self.op_size = 0
        self.data_size = data_size
        self.text = f"{self.data_size}(Data[DP])"
    
    def parse(self, code):
        pass

class OperandDP(Operand):
    def __init__(self, data_size: DataSize):
        super().__init__()
        self.op_size = 0
        self.data_size = data_size
        self.text = f"{self.data_size}(DP)"
    
    def parse(self, code):
        pass

class OperandPC(Operand):
    def __init__(self, data_size: DataSize):
        super().__init__()
        self.op_size = 0
        self.data_size = data_size
        self.text = f"{self.data_size}(PC)"
    
    def parse(self, code):
        pass


class OperandRegisterLow(Operand):
    def __init__(self, data_size: DataSize):
        super().__init__()
        self.op_size = 1
        self.reg_index = None
        self.reg = None
        self.data_size = data_size
        self.text = ""
    
    def parse(self, code):
        self.reg_index = code[0] & 0x0F
        self.reg = registers[self.reg_index]
        self.data_size = self.data_size
        self.text = f"{self.data_size}({self.reg.text})"

class OperandRegisterHigh(Operand):
    def __init__(self, data_size: DataSize):
        super().__init__()
        self.op_size = 0
        self.reg_index = None
        self.reg = None
        self.data_size = data_size
        self.text = ""
    
    def parse(self, code):
        self.reg_index = (code[0] >> 4) & 0x0F
        self.reg = registers[self.reg_index]
        self.data_size = self.data_size
        self.text = f"{self.data_size}({self.reg.text})"

class OperandImmediate(Operand):
    def __init__(self, data_size: DataSize):
        super().__init__()
        self.op_size = data_size.value
        self.data_size = data_size
        self.value = None
        self.text = ""
    
    def parse(self, code):
        int_size = self.data_size.value
        if int_size == 1:
            self.value = ord(code[0:int_size])
            self.text = f"{self.data_size}({hex(self.value)})"
        elif int_size == 2:
            self.value = struct.unpack('<H', code[0:int_size])[0]
            self.text = f"{self.data_size}({hex(self.value)})"
        elif int_size == 4:
            self.value = struct.unpack('<I', code[0:int_size])[0]
            self.text = f"{self.data_size}({hex(self.value)})"
        else:
            self.value = code[0:int_size]
            self.text = f"{self.data_size}({self.value.hex()})"


class OperandLoopCounter(Operand):
    def __init__(self, data_size: DataSize):
        super().__init__()
        self.op_size = 0
        self.text = f"LoopCounter"
    
    def parse(self, code):
        pass

class OperandBuffer(Operand):
    def __init__(self, size: DataSize):
        super().__init__()
        self.op_size = size.value
        self.value = None
        self.text = ""
    
    def parse(self, code):
        self.value = code[0:self.op_size]
        self.text = f"Buffer[{self.value.hex()}]"


class Instruction:
    def __init__(self, code):
        self.size = 0
        self.text = ""
        self.key = 0
        self.operands = []
    
    def parse(self, code):
        for operand in self.operands:
            operand.parse(code[self.size:])
            self.size += operand.op_size
            self.text += " " + operand.text
        print("size: " + str(self.size))
        print("operand count: " + str(len(self.operands)))
        # Handle special case for nop of larger than one byte
        if self.size > 1 and len(self.operands) == 0:
            # We have real operands (bytes to skip) but no instruction operands
            # Use the first byte of the first operand as key
            print(f"self.key ^= code[1]({hex(code[1])})")
            self.key ^= code[1]
        else:
            # Assumption, the first operand is never larger than 1 byte
            if len(self.operands) == 0:
                # Key is the opcode
                print(f"self.key ^= code[0]({hex(code[0])})")
                self.key ^= code[0]
            elif len(self.operands) == 1:
                # Check if the operand is a real operand or a fake operand
                if self.operands[0].op_size != 0:
                    # Key is the first byte in the operand
                    print(f"self.key ^= code[1]({hex(code[1])})")
                    self.key ^= code[1]
                else:
                    # Key is the opcode
                    print(f"self.key ^= code[0]({hex(code[0])})")
                    self.key ^= code[0]
            elif len(self.operands) == 2:
                # If the both operands are real operands, the key is the first byte of the second operand
                if self.operands[0].op_size != 0 and self.operands[1].op_size != 0:
                    print(f"self.key ^= code[2]({hex(code[2])})")
                    self.key ^= code[2] 
                # If either of the operands is fake, the key is the first byte of the second operand (real operand 1)
                elif self.operands[0].op_size == 0 or self.operands[1].op_size == 0:
                    print(f"self.key ^= code[1]({hex(code[1])})")
                    self.key ^= code[1]
                else:
                    raise Exception("Invalid operands")
            elif len(self.operands) == 4:
                # There is only one case with more than 2 operands, rc4
                # key_len, data_len, key_buff[key_len], (fake)data_buff[data_len]
                # The key is the first byte in the third operand
                print(f"self.key ^= code[3]({hex(code[2])})")
                self.key ^= code[3]
            else:
                raise Exception("Invalid operands")




class nop_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "nop"
        self.key = 0xC7
        self.operands = []

class nop_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 2
        self.text = "nop"
        self.key = 0x45
        self.operands = []

class nop_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 4
        self.text = "nop"
        self.key = 0x25
        self.operands = []

class xor_data_imm_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x51
        self.operands = [OperandData(DataSize.BYTE()), OperandImmediate(DataSize.BYTE())]

class h_xor_data_imm_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x32
        self.operands = [OperandData(DataSize.WORD()), OperandImmediate(DataSize.WORD())]

class h_xor_data_imm_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x7C
        self.operands = [OperandData(DataSize.DWORD()), OperandImmediate(DataSize.DWORD())]

class h_add_data_imm_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0xB4
        self.operands = [OperandData(DataSize.BYTE()), OperandImmediate(DataSize.BYTE())]

class h_add_data_imm_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0x16
        self.operands = [OperandData(DataSize.WORD()), OperandImmediate(DataSize.WORD())]

class h_add_data_imm_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 2
        self.operands = [OperandData(DataSize.DWORD()), OperandImmediate(DataSize.DWORD())]

class h_sub_data_imm_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0xC9
        self.operands = [OperandData(DataSize.BYTE()), OperandImmediate(DataSize.BYTE())]

class h_sub_data_imm_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0xF7
        self.operands = [OperandData(DataSize.WORD()), OperandImmediate(DataSize.WORD())]

class h_sub_data_imm_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0x71
        self.operands = [OperandData(DataSize.DWORD()), OperandImmediate(DataSize.DWORD())]

class h_rol_b_data_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "rol"
        self.key = 0xC
        self.operands = [OperandData(DataSize.BYTE()), OperandImmediate(DataSize.BYTE())]

class h_rol_w_data_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "rol"
        self.key = 0xFA
        self.operands = [OperandData(DataSize.WORD()), OperandImmediate(DataSize.BYTE())]

class h_rol_dw_data_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "rol"
        self.key = 0x57
        self.operands = [OperandData(DataSize.DWORD()), OperandImmediate(DataSize.BYTE())]

class h_ror_b_data_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "ror"
        self.key = 0x98
        self.operands = [OperandData(DataSize.BYTE()), OperandImmediate(DataSize.BYTE())]

class h_ror_w_data_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "ror"
        self.key = 0xD3
        self.operands = [OperandData(DataSize.WORD()), OperandImmediate(DataSize.BYTE())]

class h_ror_dw_data_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "ror"
        self.key = 0xFB
        self.operands = [OperandData(DataSize.DWORD()), OperandImmediate(DataSize.BYTE())]

class h_not_b_data(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "not"
        self.key = 0xFA
        self.operands = [OperandData(DataSize.BYTE())]

class h_not_w_data(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "not"
        self.key = 0x28
        self.operands = [OperandData(DataSize.WORD())]

class h_not_dw_data(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "not"
        self.key = 4
        self.operands = [OperandData(DataSize.DWORD())]

class h_dw_data_shuffle(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "shuffle"
        self.key = 0x82
        self.operands = [OperandData(DataSize.DWORD()), OperandImmediate(DataSize.BYTE())]

class h_rc4(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "rc4"
        self.key = 0xC9
        self.operands = [OperandImmediate(DataSize.BYTE()), # key_len
                        OperandImmediate(DataSize.BYTE()),  # data_len
                        OperandBuffer(DataSize(code[1])), # key_buff[key_len]
                        OperandData(DataSize(code[2]))] # data_buff[data_len]

class h_set_loop_imm_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "set loop"
        self.key = 0x4e
        self.operands = [OperandLoopCounter(DataSize.DWORD()), OperandImmediate(DataSize.BYTE())]

class h_set_loop_imm_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "set loop"
        self.key = 0x9D
        self.operands = [OperandLoopCounter(DataSize.DWORD()), OperandImmediate(DataSize.WORD())]

class h_set_value_imm_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "set loop"
        self.key = 0x61
        self.operands = [OperandLoopCounter(DataSize.DWORD()), OperandImmediate(DataSize.DWORD())]

class h_shift_data_imm_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0x8F
        self.operands = [OperandDP(DataSize.DWORD()), OperandImmediate(DataSize.WORD())]

class h_loop_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "loop"
        self.key = 0xF8
        # Immediate is subtracted from PC (displacement)
        self.operands = [OperandPC(DataSize.DWORD()), OperandImmediate(DataSize.BYTE())]

class h_loop_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "loop"
        self.key = 0x2C
        # Immediate is subtracted from PC (displacement)
        self.operands = [OperandPC(DataSize.DWORD()), OperandImmediate(DataSize.WORD())]


class h_mov_reg_imm_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0xB3
        self.operands = [OperandRegisterLow(DataSize.BYTE()), OperandImmediate(DataSize.BYTE())]

class h_mov_reg_imm_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0x9D
        self.operands = [OperandRegisterLow(DataSize.WORD()), OperandImmediate(DataSize.WORD())]

class h_mov_reg_imm_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0xAF
        self.operands = [OperandRegisterLow(DataSize.DWORD()), OperandImmediate(DataSize.DWORD())]

class h_mov_reg_reg_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0xD5
        self.operands = [OperandRegisterLow(DataSize.BYTE()), OperandRegisterHigh(DataSize.BYTE())]

class h_mov_reg_reg_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0x9D
        self.operands = [OperandRegisterLow(DataSize.WORD()), OperandRegisterHigh(DataSize.WORD())]

class h_mov_reg_reg_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0x4C
        self.operands = [OperandRegisterLow(DataSize.DWORD()), OperandRegisterHigh(DataSize.DWORD())]

class h_add_reg_reg_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0x1F
        self.operands = [OperandRegisterLow(DataSize.BYTE()), OperandRegisterHigh(DataSize.BYTE())]

class h_add_reg_reg_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0xC9
        self.operands = [OperandRegisterLow(DataSize.WORD()), OperandRegisterHigh(DataSize.WORD())]

class h_add_reg_reg_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0xE0
        self.operands = [OperandRegisterLow(DataSize.DWORD()), OperandRegisterHigh(DataSize.DWORD())]

class h_sub_reg_reg_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0x75
        self.operands = [OperandRegisterLow(DataSize.BYTE()), OperandRegisterHigh(DataSize.BYTE())]

class h_sub_reg_reg_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0x8B
        self.operands = [OperandRegisterLow(DataSize.WORD()), OperandRegisterHigh(DataSize.WORD())]

class h_sub_reg_reg_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0xDD
        self.operands = [OperandRegisterLow(DataSize.DWORD()), OperandRegisterHigh(DataSize.DWORD())]

class h_xor_reg2_to_reg1_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x77
        self.operands = [OperandRegisterLow(DataSize.BYTE()), OperandRegisterHigh(DataSize.BYTE())]

class h_xor_reg2_to_reg1_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x79
        self.operands = [OperandRegisterLow(DataSize.WORD()), OperandRegisterHigh(DataSize.WORD())]

class h_xor_reg2_to_reg1_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x6A
        self.operands = [OperandRegisterLow(DataSize.DWORD()), OperandRegisterHigh(DataSize.DWORD())]

class h_reg_add_imm_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0x49
        self.operands = [OperandRegisterLow(DataSize.BYTE()), OperandImmediate(DataSize.BYTE())]

class h_reg_add_imm_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0xF3
        self.operands = [OperandRegisterLow(DataSize.WORD()), OperandImmediate(DataSize.WORD())]

class h_reg_add_imm_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0x1C
        self.operands = [OperandRegisterLow(DataSize.DWORD()), OperandImmediate(DataSize.DWORD())]

class h_reg_sub_imm_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0x54
        self.operands = [OperandRegisterLow(DataSize.BYTE()), OperandImmediate(DataSize.BYTE())]

class h_reg_sub_imm_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0x53
        self.operands = [OperandRegisterLow(DataSize.WORD()), OperandImmediate(DataSize.WORD())]

class h_reg_sub_imm_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0x23
        self.operands = [OperandRegisterLow(DataSize.DWORD()), OperandImmediate(DataSize.DWORD())]

class h_reg_xor_imm_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x6E
        self.operands = [OperandRegisterLow(DataSize.BYTE()), OperandImmediate(DataSize.BYTE())]

class h_reg_xor_imm_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x9A
        self.operands = [OperandRegisterLow(DataSize.WORD()), OperandImmediate(DataSize.WORD())]

class h_reg_xor_imm_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0xD1
        self.operands = [OperandRegisterLow(DataSize.DWORD()), OperandImmediate(DataSize.DWORD())]

class mw_add_reg_to_data_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0x46
        self.operands = [OperandData(DataSize.BYTE()), OperandRegisterLow(DataSize.BYTE())]

class mw_add_reg_to_data_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0x32
        self.operands = [OperandData(DataSize.WORD()), OperandRegisterLow(DataSize.WORD())]

class mw_add_reg_to_data_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "add"
        self.key = 0x3D
        self.operands = [OperandData(DataSize.DWORD()), OperandRegisterLow(DataSize.DWORD())]

class mw_subs_reg_from_data_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 4
        self.operands = [OperandData(DataSize.BYTE()), OperandRegisterLow(DataSize.BYTE())]

class mw_subs_reg_from_data_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0xDB
        self.operands = [OperandData(DataSize.WORD()), OperandRegisterLow(DataSize.WORD())]

class mw_subs_reg_from_data_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "sub"
        self.key = 0xC6
        self.operands = [OperandData(DataSize.DWORD()), OperandRegisterLow(DataSize.DWORD())]

class mw_xor_data_with_reg_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x7D
        self.operands = [OperandData(DataSize.BYTE()), OperandRegisterLow(DataSize.BYTE())]

class mw_xor_data_with_reg_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x71
        self.operands = [OperandData(DataSize.WORD()), OperandRegisterLow(DataSize.WORD())]

class mw_xor_data_with_reg_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "xor"
        self.key = 0x7A
        self.operands = [OperandData(DataSize.DWORD()), OperandRegisterLow(DataSize.DWORD())]

class h_mov_data_to_reg_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0xBC
        self.operands = [OperandRegisterLow(DataSize.BYTE()), OperandData(DataSize.BYTE())]

class h_mov_data_to_reg_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0x3D
        self.operands = [OperandRegisterLow(DataSize.WORD()), OperandData(DataSize.WORD())]

class h_mov_data_to_reg_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0x9F
        self.operands = [OperandRegisterLow(DataSize.DWORD()), OperandData(DataSize.DWORD())]

class mw_push_reg_to_data_b(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0x22
        self.operands = [OperandData(DataSize.BYTE()), OperandRegisterLow(DataSize.BYTE())]

class mw_push_reg_to_data_w(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0xF8
        self.operands = [OperandData(DataSize.WORD()), OperandRegisterLow(DataSize.WORD())]

class mw_push_reg_to_data_dw(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "mov"
        self.key = 0x56
        self.operands = [OperandData(DataSize.DWORD()), OperandRegisterLow(DataSize.DWORD())]

class h_vm_exit(Instruction):
    def __init__(self, code):
        super().__init__(code)
        self.size = 1
        self.text = "exit"
        self.key = 0x00
        self.operands = []

# Create an array of the instruction functions
instructions = [nop_b, nop_w, nop_dw, xor_data_imm_b, h_xor_data_imm_w, h_xor_data_imm_dw, h_add_data_imm_b, h_add_data_imm_w, h_add_data_imm_dw, h_sub_data_imm_b, h_sub_data_imm_w, h_sub_data_imm_dw, h_rol_b_data_b, h_rol_w_data_b, h_rol_dw_data_b, h_ror_b_data_b, h_ror_w_data_b, h_ror_dw_data_b, h_not_b_data, h_not_w_data, h_not_dw_data, h_dw_data_shuffle, h_rc4, h_set_loop_imm_b, h_set_loop_imm_w, h_set_value_imm_dw, h_shift_data_imm_w, h_loop_b, h_loop_w, h_mov_reg_imm_b, h_mov_reg_imm_w, h_mov_reg_imm_dw, h_mov_reg_reg_b, h_mov_reg_reg_w, h_mov_reg_reg_dw, h_add_reg_reg_b, h_add_reg_reg_w, h_add_reg_reg_dw, h_sub_reg_reg_b, h_sub_reg_reg_w, h_sub_reg_reg_dw, h_xor_reg2_to_reg1_b, h_xor_reg2_to_reg1_w, h_xor_reg2_to_reg1_dw, h_reg_add_imm_b, h_reg_add_imm_w, h_reg_add_imm_dw, h_reg_sub_imm_b, h_reg_sub_imm_w, h_reg_sub_imm_dw, h_reg_xor_imm_b, h_reg_xor_imm_w, h_reg_xor_imm_dw, mw_add_reg_to_data_b, mw_add_reg_to_data_w, mw_add_reg_to_data_dw, mw_subs_reg_from_data_b, mw_subs_reg_from_data_w, mw_subs_reg_from_data_dw, mw_xor_data_with_reg_b, mw_xor_data_with_reg_w, mw_xor_data_with_reg_dw, h_mov_data_to_reg_b, h_mov_data_to_reg_w, h_mov_data_to_reg_dw, mw_push_reg_to_data_b, mw_push_reg_to_data_w, mw_push_reg_to_data_dw, h_vm_exit]



def disassemble(code):
    key = 0x00
    ptr = 0
    disassembly = []
    while ptr < len(code):
        op = code[ptr]
        print(f"OP: {hex(op)}")
        op = (op ^ key) & 0x7F
        # Replace the ecrypted opcode with the decrypted one
        code = code[0:ptr] + bytes([op]) + code[ptr+1:]
        print(f"OP (decrypted): {hex(op)}")
        if op >= len(instructions):
            raise Exception(f"Invalid opcode {hex(op)}")
        inst = instructions[op](code[ptr:])
        print(f"INST: {type(inst).__name__}")
        inst.parse(code[ptr:])
        print(f"{hex(ptr)}: {op} -> {inst.text}")
        disassembly.append(inst)
        ptr += inst.size
        key = inst.key
        if inst.text == "exit":
            break
    return disassembly


disassembly = disassemble(CODE)

OP: 0x1a
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x9)
0x0: 26 -> add DWORD(DP) WORD(0x209)
OP: 0x9c
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x96)
0x3: 26 -> add DWORD(DP) WORD(0xff96)
OP: 0x81
OP (decrypted): 0x18
INST: h_set_loop_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x2)
0x6: 24 -> set loop LoopCounter WORD(0x2)
OP: 0x89
OP (decrypted): 0x16
INST: h_rc4
size: 39
operand count: 4
self.key ^= code[3](0x9a)
0x9: 22 -> rc4 BYTE(0x24) BYTE(0x9a) Buffer[881f8cc1ecfff903bc02414b249015aa648ad582c81d3615e6a6ee5c6bf9ab6fec5d09e3] VALUE(154)(Data[DP])
OP: 0xda
OP (decrypted): 0x1b
INST: h_loop_b
size: 2
operand count: 2
self.key ^= code[1](0x29)
0x30: 27 -> loop DWORD(PC) BYTE(0x29)
OP: 0xc7
OP (decrypted): 0x16
INST: h_rc4
size: 29
operand count: 4
self.key ^= code[3](0x1)
0x32: 22 -> rc4 BYTE(0x1a) BYTE(0x1) Buffer[78ea5d76bc302819ba41474563b987c556f06aad9809c9b86c44] BYTE(Data[DP])
OP: 0xbc
OP (decrypted): 0xd
INST: h_rol_w_data_b
size: 2
operand count: 2
self.key ^= code[1](0x4f)
0x4f: 13 -> rol WORD(Data[DP]) BYTE(0x4f)
OP: 0xaf
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0xc9)
0x51: 26 -> add DWORD(DP) WORD(0xfec9)
OP: 0xde
OP (decrypted): 0x18
INST: h_set_loop_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x1)
0x54: 24 -> set loop LoopCounter WORD(0x1)
OP: 0x8a
OP (decrypted): 0x16
INST: h_rc4
size: 84
operand count: 4
self.key ^= code[3](0x8f)
0x57: 22 -> rc4 BYTE(0x51) BYTE(0x8f) Buffer[e191d47d3881bf24a74bf05b6bd82e95bec48930e73714e72b8cf81be623ffaecdf2d694b9dd1d7ad773fd1cde891dd1bf31f3d676ab0528a0d45a05dd4cd75d6ece255154538218a7b761beebb01ac9e5] VALUE(143)(Data[DP])
OP: 0xb3
OP (decrypted): 0x1b
INST: h_loop_b
size: 2
operand count: 2
self.key ^= code[1](0x56)
0xab: 27 -> loop DWORD(PC) BYTE(0x56)
OP: 0x91
OP (decrypted): 0x3f
INST: h_mov_data_to_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x5)
0xad: 63 -> mov WORD(Reg5) WORD(Data[DP])
OP: 0xa5
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x55)
0xaf: 29 -> mov BYTE(Reg6) BYTE(0x55)
OP: 0xc1
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x56)
0xb2: 39 -> sub WORD(Reg6) WORD(Reg15)
OP: 0xf2
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x8e)
0xb4: 47 -> sub BYTE(Reg5) BYTE(0x8e)
OP: 0xc4
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x57)
0xb7: 30 -> mov WORD(Reg3) WORD(0x5257)
OP: 0xe4
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xe2)
0xbb: 46 -> add DWORD(Reg5) DWORD(0x67a37ce2)
OP: 0xcf
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x67)
0xc1: 49 -> sub DWORD(Reg5) DWORD(0x24e2b767)
OP: 0xf6
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xa)
0xc7: 50 -> xor BYTE(Reg5) BYTE(0xa)
OP: 0xa6
OP (decrypted): 0x42
INST: mw_push_reg_to_data_w
size: 2
operand count: 2
self.key ^= code[1](0x5)
0xca: 66 -> mov WORD(Data[DP]) WORD(Reg5)
OP: 0xec
OP (decrypted): 0x11
INST: h_ror_dw_data_b
size: 2
operand count: 2
self.key ^= code[1](0x38)
0xcc: 17 -> ror DWORD(Data[DP]) BYTE(0x38)
OP: 0xd9
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x7b)
0xce: 26 -> add DWORD(DP) WORD(0xff7b)
OP: 0xee
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0xb0)
0xd1: 26 -> add DWORD(DP) WORD(0xfeb0)
OP: 0x81
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x4)
0xd4: 62 -> mov BYTE(Reg4) BYTE(Data[DP])
OP: 0xa7
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xa6)
0xd6: 31 -> mov DWORD(Reg14) DWORD(0x2f70d8a6)
OP: 0xa6
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xde)
0xdc: 47 -> sub BYTE(Reg4) BYTE(0xde)
OP: 0xbb
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x8a)
0xdf: 49 -> sub DWORD(Reg14) DWORD(0x79c0318a)
OP: 0x99
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xd1)
0xe5: 48 -> sub WORD(Reg4) WORD(0x70d1)
OP: 0xb0
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x7e)
0xe9: 50 -> xor BYTE(Reg4) BYTE(0x7e)
OP: 0xbf
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x7d)
0xec: 47 -> sub BYTE(Reg4) BYTE(0x7d)
OP: 0x9d
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xb2)
0xef: 52 -> xor DWORD(Reg4) DWORD(0x3e4156b2)
OP: 0xce
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xf9)
0xf5: 45 -> add WORD(Reg4) WORD(0x96f9)
OP: 0xa3
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0xee)
0xf9: 41 -> xor BYTE(Reg14) BYTE(Reg10)
OP: 0xa9
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x8d)
0xfb: 48 -> sub WORD(Reg4) WORD(0x758d)
OP: 0x9f
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x4)
0xff: 65 -> mov BYTE(Data[DP]) BYTE(Reg4)
OP: 0xbb
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x26)
0x101: 29 -> mov BYTE(Reg14) BYTE(0x26)
OP: 0x8a
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xd2)
0x104: 31 -> mov DWORD(Reg11) DWORD(0x94b23d2)
OP: 0xcf
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xf1)
0x10a: 50 -> xor BYTE(Reg11) BYTE(0xf1)
OP: 0xb2
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x80)
0x10d: 45 -> add WORD(Reg11) WORD(0x1d80)
OP: 0xc3
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x96)
0x111: 48 -> sub WORD(Reg14) WORD(0x2c96)
OP: 0xf5
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x43)
0x115: 48 -> sub WORD(Reg11) WORD(0xa443)
OP: 0xbc
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xb5)
0x119: 44 -> add BYTE(Reg14) BYTE(0xb5)
OP: 0xd0
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x7e)
0x11c: 44 -> add BYTE(Reg14) BYTE(0x7e)
OP: 0x9a
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x3b)
0x11f: 45 -> add WORD(Reg14) WORD(0x1d3b)
OP: 0xe3
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xbe)
0x123: 43 -> xor DWORD(Reg14) DWORD(Reg14)
OP: 0xe7
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x91)
0x125: 51 -> xor WORD(Reg14) WORD(0xfa91)
OP: 0xbc
OP (decrypted): 0x37
INST: mw_add_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0xe)
0x129: 55 -> add DWORD(Data[DP]) DWORD(Reg14)
OP: 0xad
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x20)
0x12b: 30 -> mov WORD(Reg13) WORD(0xc20)
OP: 0xa2
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x19)
0x12f: 31 -> mov DWORD(Reg15) DWORD(0xb58d3719)
OP: 0x82
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xe0)
0x135: 52 -> xor DWORD(Reg13) DWORD(0x72be53e0)
OP: 0x9e
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x8b)
0x13b: 47 -> sub BYTE(Reg15) BYTE(0x8b)
OP: 0xed
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x28)
0x13e: 50 -> xor BYTE(Reg15) BYTE(0x28)
OP: 0xe2
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xff)
0x141: 36 -> add WORD(Reg15) WORD(Reg8)
OP: 0x82
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x7c)
0x143: 52 -> xor DWORD(Reg13) DWORD(0x7dd0797c)
OP: 0x88
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xff)
0x149: 37 -> add DWORD(Reg15) DWORD(Reg11)
OP: 0xb6
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0xdd)
0x14b: 41 -> xor BYTE(Reg13) BYTE(Reg8)
OP: 0x8f
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xff)
0x14d: 37 -> add DWORD(Reg15) DWORD(Reg10)
OP: 0xa5
OP (decrypted): 0x3a
INST: mw_subs_reg_from_data_dw
size: 2
operand count: 2
self.key ^= code[1](0xf)
0x14f: 58 -> sub DWORD(Data[DP]) DWORD(Reg15)
OP: 0xd6
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x15)
0x151: 31 -> mov DWORD(Reg7) DWORD(0x65647815)
OP: 0xa7
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xb3)
0x157: 29 -> mov BYTE(Reg3) BYTE(0xb3)
OP: 0xae
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xc9)
0x15a: 46 -> add DWORD(Reg7) DWORD(0x7dfd39c9)
OP: 0xe6
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x35)
0x160: 51 -> xor WORD(Reg7) WORD(0x1335)
OP: 0x9b
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xcb)
0x164: 52 -> xor DWORD(Reg7) DWORD(0xc2ec02cb)
OP: 0xbb
OP (decrypted): 0x21
INST: h_mov_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x3b)
0x16a: 33 -> mov WORD(Reg11) WORD(Reg9)
OP: 0x97
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x4a)
0x16c: 49 -> sub DWORD(Reg11) DWORD(0xbe9c184a)
OP: 0xf4
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x69)
0x172: 29 -> mov BYTE(Reg9) BYTE(0x69)
OP: 0xee
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xd4)
0x175: 52 -> xor DWORD(Reg7) DWORD(0x741c6d4)
OP: 0xa9
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xfa)
0x17b: 44 -> add BYTE(Reg9) BYTE(0xfa)
OP: 0x90
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x7b)
0x17e: 35 -> add BYTE(Reg11) BYTE(Reg12)
OP: 0xc1
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x9b)
0x180: 37 -> add DWORD(Reg11) DWORD(Reg13)
OP: 0xd6
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xd2)
0x182: 45 -> add WORD(Reg11) WORD(0x15d2)
OP: 0x8b
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x37)
0x186: 42 -> xor WORD(Reg7) WORD(Reg15)
OP: 0xff
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xb4)
0x188: 49 -> sub DWORD(Reg3) DWORD(0x2314fbb4)
OP: 0xae
OP (decrypted): 0x39
INST: mw_subs_reg_from_data_w
size: 2
operand count: 2
self.key ^= code[1](0x7)
0x18e: 57 -> sub WORD(Data[DP]) WORD(Reg7)
OP: 0xc1
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xd2)
0x190: 29 -> mov BYTE(Reg9) BYTE(0xd2)
OP: 0xff
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x67)
0x193: 30 -> mov WORD(Reg1) WORD(0xc567)
OP: 0xe5
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xc3)
0x197: 31 -> mov DWORD(Reg2) DWORD(0xbd8d6cc3)
OP: 0xcf
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x19)
0x19d: 35 -> add BYTE(Reg9) BYTE(Reg11)
OP: 0xb4
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x9f)
0x19f: 50 -> xor BYTE(Reg9) BYTE(0x9f)
OP: 0xd7
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x19)
0x1a2: 38 -> sub BYTE(Reg9) BYTE(Reg12)
OP: 0xc3
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xe0)
0x1a4: 47 -> sub BYTE(Reg9) BYTE(0xe0)
OP: 0x9e
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x99)
0x1a7: 42 -> xor WORD(Reg9) WORD(Reg13)
OP: 0xd4
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x6b)
0x1a9: 52 -> xor DWORD(Reg2) DWORD(0xb53df76b)
OP: 0x8f
OP (decrypted): 0x35
INST: mw_add_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x9)
0x1af: 53 -> add BYTE(Data[DP]) BYTE(Reg9)
OP: 0xd0
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x57)
0x1b1: 31 -> mov DWORD(Reg5) DWORD(0x44ee157)
OP: 0xc9
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xc0)
0x1b7: 49 -> sub DWORD(Reg5) DWORD(0x7588fec0)
OP: 0xce
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xd6)
0x1bd: 45 -> add WORD(Reg5) WORD(0x1ad6)
OP: 0x8a
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x72)
0x1c1: 47 -> sub BYTE(Reg5) BYTE(0x72)
OP: 0x85
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x55)
0x1c4: 35 -> add BYTE(Reg5) BYTE(Reg15)
OP: 0xfe
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x62)
0x1c6: 52 -> xor DWORD(Reg5) DWORD(0xdbc71562)
OP: 0xad
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x78)
0x1cc: 30 -> mov WORD(Reg11) WORD(0xcc78)
OP: 0xde
OP (decrypted): 0x3b
INST: mw_xor_data_with_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x5)
0x1d0: 59 -> xor BYTE(Data[DP]) BYTE(Reg5)
OP: 0xe0
OP (decrypted): 0x18
INST: h_set_loop_imm_w
size: 3
operand count: 2
self.key ^= code[1](0xb)
0x1d2: 24 -> set loop LoopCounter WORD(0xb)
OP: 0x88
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xf7)
0x1d5: 30 -> mov WORD(Reg10) WORD(0xc4f7)
OP: 0xcc
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xaa)
0x1d9: 38 -> sub BYTE(Reg10) BYTE(Reg15)
OP: 0xf4
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xaa)
0x1db: 43 -> xor DWORD(Reg10) DWORD(Reg14)
OP: 0xee
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x7b)
0x1dd: 46 -> add DWORD(Reg10) DWORD(0x389ae27b)
OP: 0xcc
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xaa)
0x1e3: 43 -> xor DWORD(Reg10) DWORD(Reg14)
OP: 0xe0
OP (decrypted): 0x20
INST: h_mov_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xa4)
0x1e5: 32 -> mov BYTE(Reg4) BYTE(Reg12)
OP: 0xc6
OP (decrypted): 0x37
INST: mw_add_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0xa)
0x1e7: 55 -> add DWORD(Data[DP]) DWORD(Reg10)
OP: 0xa2
OP (decrypted): 0x15
INST: h_dw_data_shuffle
size: 2
operand count: 2
self.key ^= code[1](0x1e)
0x1e9: 21 -> shuffle DWORD(Data[DP]) BYTE(0x1e)
OP: 0xa2
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xb)
0x1eb: 62 -> mov BYTE(Reg11) BYTE(Data[DP])
OP: 0xa9
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xe4)
0x1ed: 30 -> mov WORD(Reg12) WORD(0xc7e4)
OP: 0xd2
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xbc)
0x1f1: 43 -> xor DWORD(Reg12) DWORD(Reg15)
OP: 0xf8
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x73)
0x1f3: 46 -> add DWORD(Reg11) DWORD(0x5e1d373)
OP: 0xf1
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x5a)
0x1f9: 30 -> mov WORD(Reg7) WORD(0x4a5a)
OP: 0xe4
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x77)
0x1fd: 35 -> add BYTE(Reg7) BYTE(Reg12)
OP: 0xcd
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x77)
0x1ff: 37 -> add DWORD(Reg7) DWORD(Reg11)
OP: 0xbb
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x28)
0x201: 44 -> add BYTE(Reg11) BYTE(0x28)
OP: 0xd3
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xb9)
0x204: 50 -> xor BYTE(Reg11) BYTE(0xb9)
OP: 0xf4
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xcc)
0x207: 35 -> add BYTE(Reg12) BYTE(Reg15)
OP: 0xfe
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x32)
0x209: 45 -> add WORD(Reg7) WORD(0xd332)
OP: 0xea
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xcc)
0x20d: 43 -> xor DWORD(Reg12) DWORD(Reg8)
OP: 0x8c
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0xb7)
0x20f: 42 -> xor WORD(Reg7) WORD(Reg14)
OP: 0xe5
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0x7c)
0x211: 43 -> xor DWORD(Reg12) DWORD(Reg13)
OP: 0xd7
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0xb)
0x213: 65 -> mov BYTE(Data[DP]) BYTE(Reg11)
OP: 0xb7
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xdd)
0x215: 30 -> mov WORD(Reg4) WORD(0xa5dd)
OP: 0xdd
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xea)
0x219: 29 -> mov BYTE(Reg6) BYTE(0xea)
OP: 0xee
OP (decrypted): 0x37
INST: mw_add_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0x4)
0x21c: 55 -> add DWORD(Data[DP]) DWORD(Reg4)
OP: 0xaf
OP (decrypted): 0x16
INST: h_rc4
size: 127
operand count: 4
self.key ^= code[3](0xc)
0x21e: 22 -> rc4 BYTE(0x7c) BYTE(0xc) Buffer[6702d699d4b7c32a55ebfefe2651e18e51474e2e3c4fdacedbcc829663994d359c2f18bfe9b6a678e6db034557067661dbd17f6490436e7bc06e2e8389a47ced889fbe4bebc88d1d66c6f317952edf8268164c1179aa3df2afa40a4278903cd5d631dccc9022a4ceb5471c156a0010cd9cc18be07d01b85fb38bade4] VALUE(12)(Data[DP])
OP: 0x90
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xe)
0x29d: 62 -> mov BYTE(Reg14) BYTE(Data[DP])
OP: 0xaf
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x71)
0x29f: 29 -> mov BYTE(Reg3) BYTE(0x71)
OP: 0xe4
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x33)
0x2a2: 38 -> sub BYTE(Reg3) BYTE(Reg14)
OP: 0xec
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x33)
0x2a4: 42 -> xor WORD(Reg3) WORD(Reg14)
OP: 0xe2
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xe3)
0x2a6: 40 -> sub DWORD(Reg3) DWORD(Reg10)
OP: 0xa3
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x3c)
0x2a8: 29 -> mov BYTE(Reg15) BYTE(0x3c)
OP: 0xa9
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xef)
0x2ab: 38 -> sub BYTE(Reg15) BYTE(Reg8)
OP: 0x85
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x38)
0x2ad: 31 -> mov DWORD(Reg7) DWORD(0x54c3c238)
OP: 0xbc
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xef)
0x2b3: 43 -> xor DWORD(Reg15) DWORD(Reg10)
OP: 0xae
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xff)
0x2b5: 43 -> xor DWORD(Reg15) DWORD(Reg11)
OP: 0xb2
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xe7)
0x2b7: 39 -> sub WORD(Reg7) WORD(Reg13)
OP: 0xde
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x4d)
0x2b9: 50 -> xor BYTE(Reg7) BYTE(0x4d)
OP: 0x91
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x94)
0x2bc: 50 -> xor BYTE(Reg14) BYTE(0x94)
OP: 0xd2
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xf3)
0x2bf: 40 -> sub DWORD(Reg3) DWORD(Reg9)
OP: 0x9f
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x53)
0x2c1: 49 -> sub DWORD(Reg14) DWORD(0x33570553)
OP: 0xde
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x7c)
0x2c7: 46 -> add DWORD(Reg15) DWORD(0x77a4b67c)
OP: 0xc6
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x37)
0x2cd: 38 -> sub BYTE(Reg7) BYTE(Reg15)
OP: 0xf0
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x95)
0x2cf: 50 -> xor BYTE(Reg14) BYTE(0x95)
OP: 0xd8
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xf7)
0x2d2: 35 -> add BYTE(Reg7) BYTE(Reg12)
OP: 0xc3
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0x3f)
0x2d4: 43 -> xor DWORD(Reg15) DWORD(Reg14)
OP: 0xe7
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xae)
0x2d6: 50 -> xor BYTE(Reg3) BYTE(0xae)
OP: 0xef
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xce)
0x2d9: 47 -> sub BYTE(Reg14) BYTE(0xce)
OP: 0xb9
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x73)
0x2dc: 35 -> add BYTE(Reg3) BYTE(Reg10)
OP: 0xad
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0xe)
0x2de: 65 -> mov BYTE(Data[DP]) BYTE(Reg14)
OP: 0xb2
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xe2)
0x2e0: 30 -> mov WORD(Reg12) WORD(0x3de2)
OP: 0xe2
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xbf)
0x2e4: 29 -> mov BYTE(Reg11) BYTE(0xbf)
OP: 0xa3
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x7a)
0x2e7: 47 -> sub BYTE(Reg11) BYTE(0x7a)
OP: 0x9e
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x81)
0x2ea: 48 -> sub WORD(Reg11) WORD(0x4881)
OP: 0xf6
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xbc)
0x2ee: 36 -> add WORD(Reg12) WORD(Reg13)
OP: 0xd9
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x15)
0x2f0: 44 -> add BYTE(Reg11) BYTE(0x15)
OP: 0xf1
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x16)
0x2f3: 45 -> add WORD(Reg12) WORD(0xce16)
OP: 0xd2
OP (decrypted): 0x37
INST: mw_add_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0xb)
0x2f7: 55 -> add DWORD(Data[DP]) DWORD(Reg11)
OP: 0x88
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xd)
0x2f9: 62 -> mov BYTE(Reg13) BYTE(Data[DP])
OP: 0xae
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xe3)
0x2fb: 31 -> mov DWORD(Reg3) DWORD(0x669736e3)
OP: 0xeb
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x33)
0x301: 39 -> sub WORD(Reg3) WORD(Reg8)
OP: 0x88
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x7)
0x303: 48 -> sub WORD(Reg13) WORD(0xc007)
OP: 0xf3
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x33)
0x307: 39 -> sub WORD(Reg3) WORD(Reg9)
OP: 0x96
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x23)
0x309: 46 -> add DWORD(Reg13) DWORD(0xe1a61823)
OP: 0x8d
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x75)
0x30f: 50 -> xor BYTE(Reg13) BYTE(0x75)
OP: 0xb2
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0xd3)
0x312: 41 -> xor BYTE(Reg3) BYTE(Reg8)
OP: 0x8c
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xd3)
0x314: 40 -> sub DWORD(Reg3) DWORD(Reg12)
OP: 0xcf
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0xd)
0x316: 65 -> mov BYTE(Data[DP]) BYTE(Reg13)
OP: 0xb1
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x7b)
0x318: 30 -> mov WORD(Reg7) WORD(0xd77b)
OP: 0xf8
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x51)
0x31c: 30 -> mov WORD(Reg1) WORD(0x6851)
OP: 0xff
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xc0)
0x320: 51 -> xor WORD(Reg7) WORD(0x20c0)
OP: 0xf4
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x14)
0x324: 46 -> add DWORD(Reg7) DWORD(0xfcd3f514)
OP: 0xad
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x71)
0x32a: 37 -> add DWORD(Reg1) DWORD(Reg11)
OP: 0xbe
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xbb)
0x32c: 47 -> sub BYTE(Reg1) BYTE(0xbb)
OP: 0xc2
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x49)
0x32f: 45 -> add WORD(Reg7) WORD(0xd049)
OP: 0x90
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x77)
0x333: 42 -> xor WORD(Reg7) WORD(Reg10)
OP: 0xa2
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x4b)
0x335: 44 -> add BYTE(Reg1) BYTE(0x4b)
OP: 0xb3
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x16)
0x338: 49 -> sub DWORD(Reg7) DWORD(0xa6066a16)
OP: 0x81
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x48)
0x33e: 52 -> xor DWORD(Reg1) DWORD(0xc51ca148)
OP: 0xac
OP (decrypted): 0x35
INST: mw_add_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x7)
0x344: 53 -> add BYTE(Data[DP]) BYTE(Reg7)
OP: 0xc8
OP (decrypted): 0x9
INST: h_sub_data_imm_b
size: 2
operand count: 2
self.key ^= code[1](0xca)
0x346: 9 -> sub BYTE(Data[DP]) BYTE(0xca)
OP: 0xbd
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x6)
0x348: 62 -> mov BYTE(Reg6) BYTE(Data[DP])
OP: 0xa7
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x89)
0x34a: 29 -> mov BYTE(Reg7) BYTE(0x89)
OP: 0x99
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x67)
0x34d: 35 -> add BYTE(Reg7) BYTE(Reg13)
OP: 0xd6
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x72)
0x34f: 46 -> add DWORD(Reg6) DWORD(0x15ddd072)
OP: 0xc6
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x67)
0x355: 40 -> sub DWORD(Reg7) DWORD(Reg15)
OP: 0xfb
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x6)
0x357: 65 -> mov BYTE(Data[DP]) BYTE(Reg6)
OP: 0xb0
OP (decrypted): 0x14
INST: h_not_dw_data
size: 1
operand count: 1
self.key ^= code[0](0x14)
0x359: 20 -> not DWORD(Data[DP])
OP: 0x8c
OP (decrypted): 0x1c
INST: h_loop_w
size: 3
operand count: 2
self.key ^= code[1](0x88)
0x35a: 28 -> loop DWORD(PC) WORD(0x188)
OP: 0xb9
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xa1)
0x35d: 29 -> mov BYTE(Reg1) BYTE(0xa1)
OP: 0x8d
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xb9)
0x360: 31 -> mov DWORD(Reg9) DWORD(0x729495b9)
OP: 0xbc
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x19)
0x366: 42 -> xor WORD(Reg9) WORD(Reg13)
OP: 0xd2
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xd1)
0x368: 50 -> xor BYTE(Reg9) BYTE(0xd1)
OP: 0x8f
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x20)
0x36b: 48 -> sub WORD(Reg9) WORD(0xdb20)
OP: 0xc6
OP (decrypted): 0x35
INST: mw_add_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x9)
0x36f: 53 -> add BYTE(Data[DP]) BYTE(Reg9)
OP: 0xd9
OP (decrypted): 0x16
INST: h_rc4
size: 14
operand count: 4
self.key ^= code[3](0xa)
0x371: 22 -> rc4 BYTE(0xb) BYTE(0xa) Buffer[01046d00c6ba5a8c5d937c] VALUE(10)(Data[DP])
OP: 0xc4
OP (decrypted): 0xc
INST: h_rol_b_data_b
size: 2
operand count: 2
self.key ^= code[1](0x6f)
0x37f: 12 -> rol BYTE(Data[DP]) BYTE(0x6f)
OP: 0xdd
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x7)
0x381: 62 -> mov BYTE(Reg7) BYTE(Data[DP])
OP: 0xa6
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x54)
0x383: 29 -> mov BYTE(Reg2) BYTE(0x54)
OP: 0xce
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0x22)
0x386: 41 -> xor BYTE(Reg2) BYTE(Reg15)
OP: 0xfd
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x22)
0x388: 40 -> sub DWORD(Reg2) DWORD(Reg13)
OP: 0xd3
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x9)
0x38a: 44 -> add BYTE(Reg2) BYTE(0x9)
OP: 0xee
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x2)
0x38d: 46 -> add DWORD(Reg7) DWORD(0x9d427d02)
OP: 0xae
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x3f)
0x393: 48 -> sub WORD(Reg7) WORD(0x713f)
OP: 0xdc
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x90)
0x397: 48 -> sub WORD(Reg7) WORD(0xde90)
OP: 0xe0
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x22)
0x39b: 35 -> add BYTE(Reg2) BYTE(Reg9)
OP: 0x9e
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x72)
0x39d: 35 -> add BYTE(Reg2) BYTE(Reg10)
OP: 0xac
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x7)
0x39f: 65 -> mov BYTE(Data[DP]) BYTE(Reg7)
OP: 0xbf
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0xc1)
0x3a1: 26 -> add DWORD(DP) WORD(0xfec1)
OP: 0xf0
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xb)
0x3a4: 62 -> mov BYTE(Reg11) BYTE(Data[DP])
OP: 0xaa
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x33)
0x3a6: 29 -> mov BYTE(Reg2) BYTE(0x33)
OP: 0xb0
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x84)
0x3a9: 48 -> sub WORD(Reg11) WORD(0x3e84)
OP: 0xf8
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x83)
0x3ad: 47 -> sub BYTE(Reg2) BYTE(0x83)
OP: 0xff
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xb2)
0x3b0: 40 -> sub DWORD(Reg2) DWORD(Reg12)
OP: 0xc6
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0x22)
0x3b2: 41 -> xor BYTE(Reg2) BYTE(Reg9)
OP: 0x94
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0xb)
0x3b4: 65 -> mov BYTE(Data[DP]) BYTE(Reg11)
OP: 0xb6
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xf)
0x3b6: 31 -> mov DWORD(Reg12) DWORD(0x9603da0f)
OP: 0x83
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xcc)
0x3bc: 35 -> add BYTE(Reg12) BYTE(Reg12)
OP: 0xcd
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x5e)
0x3be: 30 -> mov WORD(Reg8) WORD(0xcd5e)
OP: 0xf0
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x2e)
0x3c2: 51 -> xor WORD(Reg8) WORD(0x982e)
OP: 0x80
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x66)
0x3c6: 52 -> xor DWORD(Reg8) DWORD(0x32b58766)
OP: 0x96
OP (decrypted): 0x21
INST: h_mov_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xc5)
0x3cc: 33 -> mov WORD(Reg5) WORD(Reg14)
OP: 0xea
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x6f)
0x3ce: 50 -> xor BYTE(Reg12) BYTE(0x6f)
OP: 0xa9
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xcc)
0x3d1: 40 -> sub DWORD(Reg12) DWORD(Reg11)
OP: 0xbf
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xe)
0x3d3: 46 -> add DWORD(Reg8) DWORD(0x1e49590e)
OP: 0xa0
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x62)
0x3d9: 50 -> xor BYTE(Reg5) BYTE(0x62)
OP: 0xa7
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xc8)
0x3dc: 43 -> xor DWORD(Reg8) DWORD(Reg9)
OP: 0x91
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xdc)
0x3de: 51 -> xor WORD(Reg5) WORD(0xeedc)
OP: 0xe8
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x87)
0x3e2: 46 -> add DWORD(Reg5) DWORD(0xccab1887)
OP: 0xbc
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x8c)
0x3e8: 39 -> sub WORD(Reg12) WORD(Reg11)
OP: 0xbb
OP (decrypted): 0x3c
INST: mw_xor_data_with_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x8)
0x3ea: 60 -> xor WORD(Data[DP]) WORD(Reg8)
OP: 0xe6
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xd6)
0x3ec: 31 -> mov DWORD(Reg0) DWORD(0x958d08d6)
OP: 0xd4
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x27)
0x3f2: 45 -> add WORD(Reg0) WORD(0x5e27)
OP: 0xf8
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xe2)
0x3f6: 44 -> add BYTE(Reg0) BYTE(0xe2)
OP: 0xb4
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x9e)
0x3f9: 31 -> mov DWORD(Reg13) DWORD(0xa5715d9e)
OP: 0x91
OP (decrypted): 0x20
INST: h_mov_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xdb)
0x3ff: 32 -> mov BYTE(Reg11) BYTE(Reg11)
OP: 0xba
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x78)
0x401: 52 -> xor DWORD(Reg11) DWORD(0x6cd50e78)
OP: 0x86
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xe4)
0x407: 47 -> sub BYTE(Reg0) BYTE(0xe4)
OP: 0x9d
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xb7)
0x40a: 45 -> add WORD(Reg0) WORD(0x4bb7)
OP: 0xe0
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xbb)
0x40e: 36 -> add WORD(Reg11) WORD(Reg12)
OP: 0xc6
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x32)
0x410: 52 -> xor DWORD(Reg13) DWORD(0xda51e732)
OP: 0xca
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0x0)
0x416: 41 -> xor BYTE(Reg0) BYTE(Reg13)
OP: 0xd1
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xbb)
0x418: 38 -> sub BYTE(Reg11) BYTE(Reg14)
OP: 0xed
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xdb)
0x41a: 35 -> add BYTE(Reg11) BYTE(Reg15)
OP: 0xf3
OP (decrypted): 0x37
INST: mw_add_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0x0)
0x41c: 55 -> add DWORD(Data[DP]) DWORD(Reg0)
OP: 0xa5
OP (decrypted): 0x18
INST: h_set_loop_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x0)
0x41e: 24 -> set loop LoopCounter WORD(0x0)
OP: 0x82
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x7)
0x421: 31 -> mov DWORD(Reg12) DWORD(0x19948707)
OP: 0xb6
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x10)
0x427: 30 -> mov WORD(Reg11) WORD(0x3010)
OP: 0xa7
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0xbc)
0x42b: 42 -> xor WORD(Reg12) WORD(Reg13)
OP: 0xda
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xb6)
0x42d: 31 -> mov DWORD(Reg14) DWORD(0xda1d69b6)
OP: 0xa8
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xb0)
0x433: 49 -> sub DWORD(Reg11) DWORD(0x6c15c9b0)
OP: 0xa3
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x9d)
0x439: 48 -> sub WORD(Reg11) WORD(0xe69d)
OP: 0xfb
OP (decrypted): 0x35
INST: mw_add_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0xb)
0x43d: 53 -> add BYTE(Data[DP]) BYTE(Reg11)
OP: 0xc1
OP (decrypted): 0xc
INST: h_rol_b_data_b
size: 2
operand count: 2
self.key ^= code[1](0xd4)
0x43f: 12 -> rol BYTE(Data[DP]) BYTE(0xd4)
OP: 0xc5
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x6d)
0x441: 29 -> mov BYTE(Reg13) BYTE(0x6d)
OP: 0xc3
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x5b)
0x444: 29 -> mov BYTE(Reg0) BYTE(0x5b)
OP: 0xdb
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x5d)
0x447: 51 -> xor WORD(Reg0) WORD(0xd45d)
OP: 0xe0
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xd)
0x44b: 39 -> sub WORD(Reg13) WORD(Reg11)
OP: 0xbf
OP (decrypted): 0x39
INST: mw_subs_reg_from_data_w
size: 2
operand count: 2
self.key ^= code[1](0x0)
0x44d: 57 -> sub WORD(Data[DP]) WORD(Reg0)
OP: 0xd1
OP (decrypted): 0xa
INST: h_sub_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0xb3)
0x44f: 10 -> sub WORD(Data[DP]) WORD(0xc8b3)
OP: 0xd2
OP (decrypted): 0x16
INST: h_rc4
size: 153
operand count: 4
self.key ^= code[3](0xdb)
0x452: 22 -> rc4 BYTE(0x96) BYTE(0xdb) Buffer[bd4a8fb28c2763d854e7e9b119b2eaafe99d4d370cbc815a35ddd902d9ca8c4115173bb64258ab8e246782e4383dc6883045a27e9ae6035930c0d528bc112115863db19d903f000e325ac03f8fea1eaafc9040f538722d236e12d40adb4b42d81b56a06d291b430475edb9c58d4801f17e3093c070ee2ccb108a287986321680b230f3375c9804172a78f97e87736441f0669c698c54] VALUE(219)(Data[DP])
OP: 0xef
OP (decrypted): 0x1b
INST: h_loop_b
size: 2
operand count: 2
self.key ^= code[1](0xcc)
0x4eb: 27 -> loop DWORD(PC) BYTE(0xcc)
OP: 0xab
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x42)
0x4ed: 31 -> mov DWORD(Reg7) DWORD(0x83506d42)
OP: 0xd9
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x2b)
0x4f3: 52 -> xor DWORD(Reg7) DWORD(0x4f17852b)
OP: 0xc7
OP (decrypted): 0x3d
INST: mw_xor_data_with_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x7)
0x4f9: 61 -> xor DWORD(Data[DP]) DWORD(Reg7)
OP: 0xc3
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x2)
0x4fb: 62 -> mov BYTE(Reg2) BYTE(Data[DP])
OP: 0xa3
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x3)
0x4fd: 29 -> mov BYTE(Reg15) BYTE(0x3)
OP: 0x99
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0x2f)
0x500: 41 -> xor BYTE(Reg15) BYTE(Reg15)
OP: 0xf0
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x2f)
0x502: 40 -> sub DWORD(Reg15) DWORD(Reg13)
OP: 0xdc
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x17)
0x504: 46 -> add DWORD(Reg2) DWORD(0x5bccb417)
OP: 0xa3
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x2f)
0x50a: 40 -> sub DWORD(Reg15) DWORD(Reg13)
OP: 0xd6
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x2f)
0x50c: 36 -> add WORD(Reg15) WORD(Reg12)
OP: 0xc0
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xff)
0x50e: 38 -> sub BYTE(Reg15) BYTE(Reg12)
OP: 0xcb
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x2)
0x510: 65 -> mov BYTE(Data[DP]) BYTE(Reg2)
OP: 0xbf
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xbc)
0x512: 31 -> mov DWORD(Reg8) DWORD(0xe468c1bc)
OP: 0x8e
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x94)
0x518: 29 -> mov BYTE(Reg0) BYTE(0x94)
OP: 0x88
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xc4)
0x51b: 47 -> sub BYTE(Reg0) BYTE(0xc4)
OP: 0xa8
OP (decrypted): 0x38
INST: mw_subs_reg_from_data_b
size: 2
operand count: 2
self.key ^= code[1](0x0)
0x51e: 56 -> sub BYTE(Data[DP]) BYTE(Reg0)
OP: 0x8c
OP (decrypted): 0x8
INST: h_add_data_imm_dw
size: 5
operand count: 2
self.key ^= code[1](0xf3)
0x520: 8 -> add DWORD(Data[DP]) DWORD(0xb7e9a3f3)
OP: 0xef
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x76)
0x525: 30 -> mov WORD(Reg2) WORD(0x8876)
OP: 0xcd
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x22)
0x529: 38 -> sub BYTE(Reg2) BYTE(Reg15)
OP: 0xf6
OP (decrypted): 0x21
INST: h_mov_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x28)
0x52b: 33 -> mov WORD(Reg8) WORD(Reg8)
OP: 0x84
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x9a)
0x52d: 49 -> sub DWORD(Reg2) DWORD(0x2290ec9a)
OP: 0x8e
OP (decrypted): 0x37
INST: mw_add_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0x2)
0x533: 55 -> add DWORD(Data[DP]) DWORD(Reg2)
OP: 0xae
OP (decrypted): 0x11
INST: h_ror_dw_data_b
size: 2
operand count: 2
self.key ^= code[1](0x96)
0x535: 17 -> ror DWORD(Data[DP]) BYTE(0x96)
OP: 0xf7
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0xd3)
0x537: 26 -> add DWORD(DP) WORD(0xfdd3)
OP: 0xe2
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xa)
0x53a: 62 -> mov BYTE(Reg10) BYTE(Data[DP])
OP: 0xa8
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x9b)
0x53c: 30 -> mov WORD(Reg13) WORD(0xf49b)
OP: 0x9b
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xc5)
0x540: 29 -> mov BYTE(Reg12) BYTE(0xc5)
OP: 0xd5
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xdc)
0x543: 35 -> add BYTE(Reg12) BYTE(Reg14)
OP: 0xed
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xaf)
0x545: 46 -> add DWORD(Reg10) DWORD(0xf85617af)
OP: 0x9c
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x7d)
0x54b: 47 -> sub BYTE(Reg10) BYTE(0x7d)
OP: 0x8e
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xad)
0x54e: 39 -> sub WORD(Reg13) WORD(Reg8)
OP: 0x8e
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xac)
0x550: 40 -> sub DWORD(Reg12) DWORD(Reg13)
OP: 0xd6
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xdd)
0x552: 39 -> sub WORD(Reg13) WORD(Reg15)
OP: 0xf2
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xad)
0x554: 36 -> add WORD(Reg13) WORD(Reg13)
OP: 0xd7
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xed)
0x556: 51 -> xor WORD(Reg10) WORD(0x15ed)
OP: 0xc6
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x68)
0x55a: 49 -> sub DWORD(Reg13) DWORD(0xbb8e7668)
OP: 0xf9
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x66)
0x560: 50 -> xor BYTE(Reg12) BYTE(0x66)
OP: 0xad
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xcd)
0x563: 37 -> add DWORD(Reg13) DWORD(Reg14)
OP: 0xec
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0xa)
0x565: 65 -> mov BYTE(Data[DP]) BYTE(Reg10)
OP: 0xa4
OP (decrypted): 0xc
INST: h_rol_b_data_b
size: 2
operand count: 2
self.key ^= code[1](0x7c)
0x567: 12 -> rol BYTE(Data[DP]) BYTE(0x7c)
OP: 0xff
OP (decrypted): 0xf
INST: h_ror_b_data_b
size: 2
operand count: 2
self.key ^= code[1](0x2d)
0x569: 15 -> ror BYTE(Data[DP]) BYTE(0x2d)
OP: 0x8a
OP (decrypted): 0x3f
INST: h_mov_data_to_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x4)
0x56b: 63 -> mov WORD(Reg4) WORD(Data[DP])
OP: 0xa6
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x91)
0x56d: 31 -> mov DWORD(Reg11) DWORD(0xbaaebb91)
OP: 0x8c
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x25)
0x573: 50 -> xor BYTE(Reg4) BYTE(0x25)
OP: 0xf9
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x23)
0x576: 50 -> xor BYTE(Reg4) BYTE(0x23)
OP: 0xe3
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x66)
0x579: 46 -> add DWORD(Reg11) DWORD(0x88440e66)
OP: 0xdc
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xbb)
0x57f: 38 -> sub BYTE(Reg11) BYTE(Reg14)
OP: 0xed
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x4b)
0x581: 35 -> add BYTE(Reg11) BYTE(Reg14)
OP: 0xe0
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xf4)
0x583: 52 -> xor DWORD(Reg4) DWORD(0x8d25b4f4)
OP: 0x91
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x8c)
0x589: 52 -> xor DWORD(Reg4) DWORD(0xf77a3b8c)
OP: 0xec
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x90)
0x58f: 49 -> sub DWORD(Reg4) DWORD(0x615fa190)
OP: 0x9c
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xeb)
0x595: 47 -> sub BYTE(Reg4) BYTE(0xeb)
OP: 0x90
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xe)
0x598: 47 -> sub BYTE(Reg4) BYTE(0xe)
OP: 0xc5
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xc)
0x59b: 31 -> mov DWORD(Reg9) DWORD(0xed27ed0c)
OP: 0xe1
OP (decrypted): 0x42
INST: mw_push_reg_to_data_w
size: 2
operand count: 2
self.key ^= code[1](0x4)
0x5a1: 66 -> mov WORD(Data[DP]) WORD(Reg4)
OP: 0xe4
OP (decrypted): 0x18
INST: h_set_loop_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x2)
0x5a3: 24 -> set loop LoopCounter WORD(0x2)
OP: 0x80
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x72)
0x5a6: 31 -> mov DWORD(Reg5) DWORD(0x2a71ac72)
OP: 0xc2
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x73)
0x5ac: 31 -> mov DWORD(Reg8) DWORD(0x5491f173)
OP: 0xc1
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xdf)
0x5b2: 29 -> mov BYTE(Reg1) BYTE(0xdf)
OP: 0xc5
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0x85)
0x5b5: 41 -> xor BYTE(Reg5) BYTE(Reg12)
OP: 0xc6
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xe3)
0x5b7: 52 -> xor DWORD(Reg5) DWORD(0x56e06de3)
OP: 0x9d
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xf7)
0x5bd: 47 -> sub BYTE(Reg1) BYTE(0xf7)
OP: 0x93
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xc7)
0x5c0: 48 -> sub WORD(Reg5) WORD(0x28c7)
OP: 0xb8
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x1)
0x5c4: 44 -> add BYTE(Reg8) BYTE(0x1)
OP: 0xeb
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x85)
0x5c7: 35 -> add BYTE(Reg5) BYTE(Reg8)
OP: 0x85
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xcd)
0x5c9: 31 -> mov DWORD(Reg12) DWORD(0xcb4600cd)
OP: 0xce
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x90)
0x5cf: 44 -> add BYTE(Reg1) BYTE(0x90)
OP: 0xf6
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xb2)
0x5d2: 47 -> sub BYTE(Reg1) BYTE(0xb2)
OP: 0xc3
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x18)
0x5d5: 37 -> add DWORD(Reg8) DWORD(Reg13)
OP: 0xd3
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0x58)
0x5d7: 43 -> xor DWORD(Reg8) DWORD(Reg9)
OP: 0x9b
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0xcc)
0x5d9: 41 -> xor BYTE(Reg12) BYTE(Reg9)
OP: 0x92
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0x81)
0x5db: 41 -> xor BYTE(Reg1) BYTE(Reg13)
OP: 0xd8
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xbb)
0x5dd: 46 -> add DWORD(Reg12) DWORD(0x6ba7dabb)
OP: 0x8b
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x67)
0x5e3: 44 -> add BYTE(Reg8) BYTE(0x67)
OP: 0x9f
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xc8)
0x5e6: 49 -> sub DWORD(Reg1) DWORD(0x9276bc8)
OP: 0xd6
OP (decrypted): 0x3d
INST: mw_xor_data_with_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x1)
0x5ec: 61 -> xor DWORD(Data[DP]) DWORD(Reg1)
OP: 0xf7
OP (decrypted): 0xc
INST: h_rol_b_data_b
size: 2
operand count: 2
self.key ^= code[1](0x3f)
0x5ee: 12 -> rol BYTE(Data[DP]) BYTE(0x3f)
OP: 0xad
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x79)
0x5f0: 30 -> mov WORD(Reg1) WORD(0xeb79)
OP: 0xfa
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x8e)
0x5f4: 30 -> mov WORD(Reg6) WORD(0x588e)
OP: 0xa3
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x61)
0x5f8: 48 -> sub WORD(Reg6) WORD(0x3c61)
OP: 0x96
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x16)
0x5fc: 36 -> add WORD(Reg6) WORD(Reg12)
OP: 0xc2
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x8e)
0x5fe: 29 -> mov BYTE(Reg10) BYTE(0x8e)
OP: 0x8f
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xc0)
0x601: 50 -> xor BYTE(Reg6) BYTE(0xc0)
OP: 0x81
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x1e)
0x604: 47 -> sub BYTE(Reg6) BYTE(0x1e)
OP: 0xf9
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xd3)
0x607: 51 -> xor WORD(Reg6) WORD(0xaad3)
OP: 0xe4
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xa6)
0x60b: 45 -> add WORD(Reg6) WORD(0x14a6)
OP: 0xe4
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xc6)
0x60f: 49 -> sub DWORD(Reg6) DWORD(0x721c08c6)
OP: 0xcb
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x1)
0x615: 46 -> add DWORD(Reg6) DWORD(0x1bdf6801)
OP: 0xac
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x51)
0x61b: 49 -> sub DWORD(Reg10) DWORD(0x34853e51)
OP: 0xda
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xa1)
0x621: 40 -> sub DWORD(Reg1) DWORD(Reg12)
OP: 0xcf
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x5b)
0x623: 51 -> xor WORD(Reg6) WORD(0x9c5b)
OP: 0xed
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xb1)
0x627: 44 -> add BYTE(Reg1) BYTE(0xb1)
OP: 0xcc
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xb1)
0x62a: 52 -> xor DWORD(Reg10) DWORD(0x76e877b1)
OP: 0xd5
OP (decrypted): 0x35
INST: mw_add_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x6)
0x630: 53 -> add BYTE(Data[DP]) BYTE(Reg6)
OP: 0x80
OP (decrypted): 0x40
INST: h_mov_data_to_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xa)
0x632: 64 -> mov DWORD(Reg10) DWORD(Data[DP])
OP: 0x88
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x92)
0x634: 29 -> mov BYTE(Reg3) BYTE(0x92)
OP: 0x88
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0xa3)
0x637: 41 -> xor BYTE(Reg3) BYTE(Reg15)
OP: 0xf7
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xa3)
0x639: 35 -> add BYTE(Reg3) BYTE(Reg15)
OP: 0xff
OP (decrypted): 0x43
INST: mw_push_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0xa)
0x63b: 67 -> mov DWORD(Data[DP]) DWORD(Reg10)
OP: 0x9c
OP (decrypted): 0x40
INST: h_mov_data_to_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x6)
0x63d: 64 -> mov DWORD(Reg6) DWORD(Data[DP])
OP: 0x84
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x89)
0x63f: 29 -> mov BYTE(Reg1) BYTE(0x89)
OP: 0x99
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x61)
0x642: 35 -> add BYTE(Reg1) BYTE(Reg13)
OP: 0xde
OP (decrypted): 0x20
INST: h_mov_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x19)
0x644: 32 -> mov BYTE(Reg9) BYTE(Reg14)
OP: 0xeb
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x69)
0x646: 39 -> sub WORD(Reg9) WORD(Reg13)
OP: 0xd2
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x48)
0x648: 48 -> sub WORD(Reg6) WORD(0xbc48)
OP: 0xb5
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xbc)
0x64c: 46 -> add DWORD(Reg6) DWORD(0x36dfb4bc)
OP: 0x8c
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x2c)
0x652: 44 -> add BYTE(Reg6) BYTE(0x2c)
OP: 0xc0
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x69)
0x655: 37 -> add DWORD(Reg9) DWORD(Reg10)
OP: 0xaf
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x19)
0x657: 38 -> sub BYTE(Reg9) BYTE(Reg12)
OP: 0xcf
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x19)
0x659: 35 -> add BYTE(Reg9) BYTE(Reg10)
OP: 0xac
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x19)
0x65b: 42 -> xor WORD(Reg9) WORD(Reg12)
OP: 0xc7
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x99)
0x65d: 39 -> sub WORD(Reg9) WORD(Reg11)
OP: 0xbb
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0x11)
0x65f: 41 -> xor BYTE(Reg1) BYTE(Reg12)
OP: 0xc3
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x99)
0x661: 37 -> add DWORD(Reg9) DWORD(Reg13)
OP: 0xda
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x99)
0x663: 35 -> add BYTE(Reg9) BYTE(Reg11)
OP: 0xb2
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xda)
0x665: 52 -> xor DWORD(Reg6) DWORD(0xf10194da)
OP: 0xb8
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xf5)
0x66b: 51 -> xor WORD(Reg6) WORD(0x4ff5)
OP: 0xac
OP (decrypted): 0x43
INST: mw_push_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0x6)
0x66f: 67 -> mov DWORD(Data[DP]) DWORD(Reg6)
OP: 0xc6
OP (decrypted): 0x16
INST: h_rc4
size: 30
operand count: 4
self.key ^= code[3](0xa6)
0x671: 22 -> rc4 BYTE(0x1b) BYTE(0xa6) Buffer[2da3dd3b3ba7139e66c7e6142096fc1589faae43e6371fa572a82f] VALUE(166)(Data[DP])
OP: 0xff
OP (decrypted): 0x1b
INST: h_loop_b
size: 2
operand count: 2
self.key ^= code[1](0xeb)
0x68f: 27 -> loop DWORD(PC) BYTE(0xeb)
OP: 0x8c
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xe6)
0x691: 31 -> mov DWORD(Reg1) DWORD(0xc4886ae6)
OP: 0xd7
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x83)
0x697: 30 -> mov WORD(Reg14) WORD(0xb383)
OP: 0xaa
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xec)
0x69b: 52 -> xor DWORD(Reg1) DWORD(0xd2a86aec)
OP: 0x87
OP (decrypted): 0x3a
INST: mw_subs_reg_from_data_dw
size: 2
operand count: 2
self.key ^= code[1](0x1)
0x6a1: 58 -> sub DWORD(Data[DP]) DWORD(Reg1)
OP: 0xd1
OP (decrypted): 0x16
INST: h_rc4
size: 72
operand count: 4
self.key ^= code[3](0x35)
0x6a3: 22 -> rc4 BYTE(0x45) BYTE(0x35) Buffer[c6323b7610aafc976af3b7da0f1da68b257048d6e1bcdcd970f0a5e87b7ace6892e8c415a02c1b1c49a777de00c28b0554e22c2434961a30d08e0f7cb4cb9839ce73a72ddd] VALUE(53)(Data[DP])
OP: 0x95
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x2f)
0x6eb: 26 -> add DWORD(DP) WORD(0xfe2f)
OP: 0xb6
OP (decrypted): 0x16
INST: h_rc4
size: 254
operand count: 4
self.key ^= code[3](0x5a)
0x6ee: 22 -> rc4 BYTE(0xfb) BYTE(0x5a) Buffer[32a5fe0f419672e210ef5bee15d56995e3a30eb8c0e6582814c15126c7a974469fd70f82f8f685b4959dcc3cd5a73db435f4a609b2f0800db1a85583427a0250c285a8298bcb96d5210d3f30faef32b2641ec00c71ce3b2b4241afd6e23e33dab2c87fe40f43550bcea83b15b768537699a439cbe476d8ddab4fdf0780218cfa9919bbf085be70e89e14f716fcbc4e06098e263596d1650dd9f78c7a4d97e6256ffbf77e2ab617e5f1741db48e2464ad6df1c52f5b783d2eef52283514f08339faaab8230920b5918d939d010923647c0bb44b37e10e4cae80c0b3555966f1134e85791ec3e22b5736e1f11a2f52a56d038b0f00ea65f59ff657e0] VALUE(90)(Data[DP])
OP: 0xe4
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x97)
0x7ec: 31 -> mov DWORD(Reg15) DWORD(0x12b3a697)
OP: 0xa7
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x60)
0x7f2: 31 -> mov DWORD(Reg10) DWORD(0x1e804160)
OP: 0xd1
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xfe)
0x7f8: 30 -> mov WORD(Reg8) WORD(0xf6fe)
OP: 0xc9
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x8a)
0x7fc: 42 -> xor WORD(Reg10) WORD(Reg13)
OP: 0xd7
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x8f)
0x7fe: 36 -> add WORD(Reg15) WORD(Reg15)
OP: 0xf4
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x79)
0x800: 50 -> xor BYTE(Reg15) BYTE(0x79)
OP: 0x89
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xec)
0x803: 30 -> mov WORD(Reg3) WORD(0xadec)
OP: 0xdf
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x4f)
0x807: 46 -> add DWORD(Reg8) DWORD(0x4310844f)
OP: 0xe3
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xd0)
0x80d: 48 -> sub WORD(Reg8) WORD(0x42d0)
OP: 0xab
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xf3)
0x811: 40 -> sub DWORD(Reg3) DWORD(Reg9)
OP: 0x9c
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xff)
0x813: 50 -> xor BYTE(Reg8) BYTE(0xff)
OP: 0xa5
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x9b)
0x816: 52 -> xor DWORD(Reg15) DWORD(0xe1ace59b)
OP: 0xf9
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x61)
0x81c: 51 -> xor WORD(Reg8) WORD(0xcc61)
OP: 0xcb
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x87)
0x820: 48 -> sub WORD(Reg15) WORD(0x4b87)
OP: 0xe2
OP (decrypted): 0x36
INST: mw_add_reg_to_data_w
size: 2
operand count: 2
self.key ^= code[1](0x8)
0x824: 54 -> add WORD(Data[DP]) WORD(Reg8)
OP: 0xbe
OP (decrypted): 0x4
INST: h_xor_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0xb8)
0x826: 4 -> xor WORD(Data[DP]) WORD(0xe5b8)
OP: 0xb4
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xf)
0x829: 62 -> mov BYTE(Reg15) BYTE(Data[DP])
OP: 0xac
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xee)
0x82b: 31 -> mov DWORD(Reg9) DWORD(0xbacd64ee)
OP: 0xed
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x33)
0x831: 44 -> add BYTE(Reg15) BYTE(0x33)
OP: 0xd3
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0x99)
0x834: 41 -> xor BYTE(Reg9) BYTE(Reg12)
OP: 0xc4
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x99)
0x836: 42 -> xor WORD(Reg9) WORD(Reg12)
OP: 0xca
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0xf9)
0x838: 42 -> xor WORD(Reg9) WORD(Reg10)
OP: 0xa8
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x99)
0x83a: 40 -> sub DWORD(Reg9) DWORD(Reg15)
OP: 0xf5
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xb2)
0x83c: 49 -> sub DWORD(Reg15) DWORD(0x515175b2)
OP: 0xb2
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x99)
0x842: 35 -> add BYTE(Reg9) BYTE(Reg10)
OP: 0xad
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xf9)
0x844: 43 -> xor DWORD(Reg9) DWORD(Reg11)
OP: 0xba
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0xf9)
0x846: 41 -> xor BYTE(Reg9) BYTE(Reg11)
OP: 0xbc
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xc1)
0x848: 50 -> xor BYTE(Reg15) BYTE(0xc1)
OP: 0x80
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xf6)
0x84b: 47 -> sub BYTE(Reg9) BYTE(0xf6)
OP: 0x84
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xf9)
0x84e: 38 -> sub BYTE(Reg9) BYTE(Reg10)
OP: 0xa2
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xd0)
0x850: 46 -> add DWORD(Reg15) DWORD(0x3228dbd0)
OP: 0xff
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x5)
0x856: 51 -> xor WORD(Reg15) WORD(0xb105)
OP: 0xaf
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x49)
0x85a: 48 -> sub WORD(Reg15) WORD(0x1e49)
OP: 0xdb
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0xf)
0x85e: 65 -> mov BYTE(Data[DP]) BYTE(Reg15)
OP: 0xb0
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x1e)
0x860: 29 -> mov BYTE(Reg9) BYTE(0x1e)
OP: 0xb0
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xd1)
0x863: 29 -> mov BYTE(Reg13) BYTE(0xd1)
OP: 0xd2
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x33)
0x866: 48 -> sub WORD(Reg9) WORD(0xf933)
OP: 0xd0
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x15)
0x86a: 48 -> sub WORD(Reg13) WORD(0x5e15)
OP: 0xeb
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x3e)
0x86e: 45 -> add WORD(Reg13) WORD(0x313e)
OP: 0xe1
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x1f)
0x872: 44 -> add BYTE(Reg13) BYTE(0x1f)
OP: 0xe2
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xf4)
0x875: 52 -> xor DWORD(Reg13) DWORD(0xe1c440f4)
OP: 0x98
OP (decrypted): 0x3d
INST: mw_xor_data_with_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xd)
0x87b: 61 -> xor DWORD(Data[DP]) DWORD(Reg13)
OP: 0xe1
OP (decrypted): 0x16
INST: h_rc4
size: 227
operand count: 4
self.key ^= code[3](0x7c)
0x87d: 22 -> rc4 BYTE(0xe0) BYTE(0x7c) Buffer[7b463a18ca0ca13b1144a5c54784538679876d87398ad38be0eef2e748dc1546905c8c920e81a796bb02817efcc9eb62c89b25399bbe0c401f8e59cef9e2e246028a2324a6c9b2d9876d6f0f7fe9cfe0c889c1cc0cf36e893b478ad4a67452b1c328c6366d82cf23893a2d60014ac8aacfd3907877f82584ce3ff97930d075778f484c954b0053ba63126865acde0206e13993b9e5074847edf9c329fe7e540b01f1473b06ab05df350f20256417f190009bdf2e5fc456fa0c59b8ac888338c525469c1c75f296fd61c3400882e0cd776c0e39cff65951c98559b46f92267fe9] VALUE(124)(Data[DP])
OP: 0xa7
OP (decrypted): 0x15
INST: h_dw_data_shuffle
size: 2
operand count: 2
self.key ^= code[1](0xc9)
0x960: 21 -> shuffle DWORD(Data[DP]) BYTE(0xc9)
OP: 0xf5
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x9)
0x962: 62 -> mov BYTE(Reg9) BYTE(Data[DP])
OP: 0xaa
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x76)
0x964: 31 -> mov DWORD(Reg11) DWORD(0xa8912a76)
OP: 0xf3
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x9b)
0x96a: 42 -> xor WORD(Reg11) WORD(Reg15)
OP: 0xfd
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x2)
0x96c: 31 -> mov DWORD(Reg10) DWORD(0xc524af02)
OP: 0x8b
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x9a)
0x972: 38 -> sub BYTE(Reg10) BYTE(Reg12)
OP: 0xc1
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x6a)
0x974: 46 -> add DWORD(Reg11) DWORD(0x39613e6a)
OP: 0xd2
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x9b)
0x97a: 36 -> add WORD(Reg11) WORD(Reg14)
OP: 0xe3
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x56)
0x97c: 49 -> sub DWORD(Reg9) DWORD(0x8f0e4256)
OP: 0xd8
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xd4)
0x982: 45 -> add WORD(Reg9) WORD(0x16d4)
OP: 0xe6
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x9)
0x986: 65 -> mov BYTE(Data[DP]) BYTE(Reg9)
OP: 0xb4
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x99)
0x988: 31 -> mov DWORD(Reg10) DWORD(0x4eb10899)
OP: 0xa9
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x35)
0x98e: 31 -> mov DWORD(Reg5) DWORD(0xf7d53c35)
OP: 0xb8
OP (decrypted): 0x22
INST: h_mov_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xa9)
0x994: 34 -> mov DWORD(Reg9) DWORD(Reg15)
OP: 0xfb
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x82)
0x996: 30 -> mov WORD(Reg6) WORD(0xa982)
OP: 0xba
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x96)
0x99a: 37 -> add DWORD(Reg6) DWORD(Reg13)
OP: 0xda
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xb4)
0x99c: 44 -> add BYTE(Reg10) BYTE(0xb4)
OP: 0xd1
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xa8)
0x99f: 44 -> add BYTE(Reg9) BYTE(0xa8)
OP: 0xce
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x23)
0x9a2: 47 -> sub BYTE(Reg5) BYTE(0x23)
OP: 0xdd
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x96)
0x9a5: 42 -> xor WORD(Reg6) WORD(Reg12)
OP: 0xcb
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x66)
0x9a7: 36 -> add WORD(Reg6) WORD(Reg8)
OP: 0x8a
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x65)
0x9a9: 37 -> add DWORD(Reg5) DWORD(Reg11)
OP: 0xb7
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xdf)
0x9ab: 50 -> xor BYTE(Reg10) BYTE(0xdf)
OP: 0x81
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xce)
0x9ae: 48 -> sub WORD(Reg5) WORD(0xf2ce)
OP: 0xb8
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x56)
0x9b2: 37 -> add DWORD(Reg6) DWORD(Reg9)
OP: 0x9a
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x68)
0x9b4: 44 -> add BYTE(Reg9) BYTE(0x68)
OP: 0x92
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xec)
0x9b7: 51 -> xor WORD(Reg10) WORD(0xe5ec)
OP: 0xc7
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x21)
0x9bb: 49 -> sub DWORD(Reg10) DWORD(0x2872b521)
OP: 0xaf
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x3)
0x9c1: 45 -> add WORD(Reg6) WORD(0x9e03)
OP: 0xcc
OP (decrypted): 0x3c
INST: mw_xor_data_with_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x6)
0x9c5: 60 -> xor WORD(Data[DP]) WORD(Reg6)
OP: 0xf1
OP (decrypted): 0x6
INST: h_add_data_imm_b
size: 2
operand count: 2
self.key ^= code[1](0x8f)
0x9c7: 6 -> add BYTE(Data[DP]) BYTE(0x8f)
OP: 0xbc
OP (decrypted): 0x7
INST: h_add_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x54)
0x9c9: 7 -> add WORD(Data[DP]) WORD(0xd554)
OP: 0xd8
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x7c)
0x9cc: 26 -> add DWORD(DP) WORD(0xfe7c)
OP: 0xcc
OP (decrypted): 0x3f
INST: h_mov_data_to_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xb)
0x9cf: 63 -> mov WORD(Reg11) WORD(Data[DP])
OP: 0xa8
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x94)
0x9d1: 30 -> mov WORD(Reg7) WORD(0x794)
OP: 0xaa
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x77)
0x9d5: 35 -> add BYTE(Reg7) BYTE(Reg12)
OP: 0xcc
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x77)
0x9d7: 36 -> add WORD(Reg7) WORD(Reg15)
OP: 0xfc
OP (decrypted): 0x42
INST: mw_push_reg_to_data_w
size: 2
operand count: 2
self.key ^= code[1](0xb)
0x9d9: 66 -> mov WORD(Data[DP]) WORD(Reg11)
OP: 0xcc
OP (decrypted): 0x3f
INST: h_mov_data_to_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x6)
0x9db: 63 -> mov WORD(Reg6) WORD(Data[DP])
OP: 0xa6
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xc5)
0x9dd: 29 -> mov BYTE(Reg15) BYTE(0xc5)
OP: 0xc4
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xf5)
0x9e0: 50 -> xor BYTE(Reg6) BYTE(0xf5)
OP: 0xbc
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xff)
0x9e3: 39 -> sub WORD(Reg15) WORD(Reg13)
OP: 0xd6
OP (decrypted): 0x22
INST: h_mov_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x64)
0x9e5: 34 -> mov DWORD(Reg4) DWORD(Reg14)
OP: 0xea
OP (decrypted): 0x42
INST: mw_push_reg_to_data_w
size: 2
operand count: 2
self.key ^= code[1](0x6)
0x9e7: 66 -> mov WORD(Data[DP]) WORD(Reg6)
OP: 0xc1
OP (decrypted): 0x3f
INST: h_mov_data_to_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x0)
0x9e9: 63 -> mov WORD(Reg0) WORD(Data[DP])
OP: 0xa0
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x39)
0x9eb: 29 -> mov BYTE(Reg13) BYTE(0x39)
OP: 0xa0
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0xd)
0x9ee: 42 -> xor WORD(Reg13) WORD(Reg14)
OP: 0xe9
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xf4)
0x9f0: 29 -> mov BYTE(Reg1) BYTE(0xf4)
OP: 0xd9
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xef)
0x9f3: 30 -> mov WORD(Reg8) WORD(0x6def)
OP: 0xd4
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x11)
0x9f7: 38 -> sub BYTE(Reg1) BYTE(Reg12)
OP: 0xc0
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xd8)
0x9f9: 36 -> add WORD(Reg8) WORD(Reg11)
OP: 0xb6
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x8)
0x9fb: 39 -> sub WORD(Reg8) WORD(Reg11)
OP: 0xb7
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x41)
0x9fd: 52 -> xor DWORD(Reg0) DWORD(0x3022db41)
OP: 0xa1
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xd1)
0xa03: 49 -> sub DWORD(Reg0) DWORD(0x124decd1)
OP: 0xd4
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x18)
0xa09: 38 -> sub BYTE(Reg8) BYTE(Reg12)
OP: 0xcb
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x8d)
0xa0b: 38 -> sub BYTE(Reg13) BYTE(Reg13)
OP: 0xd7
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xb6)
0xa0d: 47 -> sub BYTE(Reg13) BYTE(0xb6)
OP: 0xc7
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x8)
0xa10: 37 -> add DWORD(Reg8) DWORD(Reg13)
OP: 0xda
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xbb)
0xa12: 50 -> xor BYTE(Reg0) BYTE(0xbb)
OP: 0xfa
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x14)
0xa15: 47 -> sub BYTE(Reg1) BYTE(0x14)
OP: 0xea
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x18)
0xa18: 42 -> xor WORD(Reg8) WORD(Reg12)
OP: 0xcd
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xbd)
0xa1a: 44 -> add BYTE(Reg1) BYTE(0xbd)
OP: 0xdc
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x11)
0xa1d: 40 -> sub DWORD(Reg1) DWORD(Reg8)
OP: 0x8e
OP (decrypted): 0x42
INST: mw_push_reg_to_data_w
size: 2
operand count: 2
self.key ^= code[1](0x0)
0xa1f: 66 -> mov WORD(Data[DP]) WORD(Reg0)
OP: 0xe7
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xed)
0xa21: 31 -> mov DWORD(Reg14) DWORD(0x94e9e1ed)
OP: 0xe8
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0xee)
0xa27: 42 -> xor WORD(Reg14) WORD(Reg8)
OP: 0x8a
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xe2)
0xa29: 29 -> mov BYTE(Reg6) BYTE(0xe2)
OP: 0xf3
OP (decrypted): 0x22
INST: h_mov_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x64)
0xa2c: 34 -> mov DWORD(Reg4) DWORD(Reg9)
OP: 0x98
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x13)
0xa2e: 48 -> sub WORD(Reg6) WORD(0x8313)
OP: 0xec
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x31)
0xa32: 44 -> add BYTE(Reg6) BYTE(0x31)
OP: 0xc9
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x82)
0xa35: 49 -> sub DWORD(Reg6) DWORD(0x125d1282)
OP: 0x92
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xdf)
0xa3b: 51 -> xor WORD(Reg14) WORD(0x8bdf)
OP: 0xf6
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x4)
0xa3f: 51 -> xor WORD(Reg14) WORD(0xd704)
OP: 0xac
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x61)
0xa43: 50 -> xor BYTE(Reg14) BYTE(0x61)
OP: 0xb5
OP (decrypted): 0x3a
INST: mw_subs_reg_from_data_dw
size: 2
operand count: 2
self.key ^= code[1](0xe)
0xa46: 58 -> sub DWORD(Data[DP]) DWORD(Reg14)
OP: 0xd0
OP (decrypted): 0x18
INST: h_set_loop_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x9)
0xa48: 24 -> set loop LoopCounter WORD(0x9)
OP: 0x8a
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x78)
0xa4b: 30 -> mov WORD(Reg1) WORD(0x7d78)
OP: 0xfa
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xef)
0xa4f: 31 -> mov DWORD(Reg7) DWORD(0xeda6caef)
OP: 0xec
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xb1)
0xa55: 44 -> add BYTE(Reg1) BYTE(0xb1)
OP: 0xe7
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x53)
0xa58: 31 -> mov DWORD(Reg4) DWORD(0x5c703853)
OP: 0xd1
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x57)
0xa5e: 45 -> add WORD(Reg4) WORD(0x1d57)
OP: 0xb9
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xe7)
0xa62: 29 -> mov BYTE(Reg14) BYTE(0xe7)
OP: 0xe4
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x72)
0xa65: 48 -> sub WORD(Reg7) WORD(0x3572)
OP: 0x8a
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0x74)
0xa69: 43 -> xor DWORD(Reg4) DWORD(Reg10)
OP: 0xaf
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x8c)
0xa6b: 49 -> sub DWORD(Reg4) DWORD(0x16098c)
OP: 0x9e
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xb2)
0xa71: 49 -> sub DWORD(Reg4) DWORD(0x7b920eb2)
OP: 0xba
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xe7)
0xa77: 43 -> xor DWORD(Reg7) DWORD(Reg10)
OP: 0xa3
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xf7)
0xa79: 46 -> add DWORD(Reg14) DWORD(0x607169f7)
OP: 0xc5
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xb7)
0xa7f: 46 -> add DWORD(Reg7) DWORD(0x1f4890b7)
OP: 0x84
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xb)
0xa85: 47 -> sub BYTE(Reg14) BYTE(0xb)
OP: 0xe6
OP (decrypted): 0x39
INST: mw_subs_reg_from_data_w
size: 2
operand count: 2
self.key ^= code[1](0x4)
0xa88: 57 -> sub WORD(Data[DP]) WORD(Reg4)
OP: 0xd7
OP (decrypted): 0x8
INST: h_add_data_imm_dw
size: 5
operand count: 2
self.key ^= code[1](0x8a)
0xa8a: 8 -> add DWORD(Data[DP]) DWORD(0x17738a8a)
OP: 0xb6
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x8)
0xa8f: 62 -> mov BYTE(Reg8) BYTE(Data[DP])
OP: 0xaa
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xbe)
0xa91: 30 -> mov WORD(Reg13) WORD(0xd9be)
OP: 0xbc
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xe8)
0xa95: 31 -> mov DWORD(Reg7) DWORD(0xe57a80e8)
OP: 0xf3
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x63)
0xa9b: 52 -> xor DWORD(Reg13) DWORD(0xa9bcf963)
OP: 0x94
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x8d)
0xaa1: 38 -> sub BYTE(Reg13) BYTE(Reg13)
OP: 0xdd
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xd7)
0xaa3: 37 -> add DWORD(Reg7) DWORD(Reg9)
OP: 0x9d
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x77)
0xaa5: 42 -> xor WORD(Reg7) WORD(Reg11)
OP: 0xbd
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xf6)
0xaa7: 51 -> xor WORD(Reg13) WORD(0x82f6)
OP: 0xf3
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xb5)
0xaab: 31 -> mov DWORD(Reg9) DWORD(0x327fc7b5)
OP: 0xb4
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x6a)
0xab1: 46 -> add DWORD(Reg8) DWORD(0xa748016a)
OP: 0xd1
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xd7)
0xab7: 39 -> sub WORD(Reg7) WORD(Reg15)
OP: 0xf1
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x6b)
0xab9: 45 -> add WORD(Reg8) WORD(0xf66b)
OP: 0xab
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xc1)
0xabd: 51 -> xor WORD(Reg7) WORD(0xac1)
OP: 0xf4
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x7a)
0xac1: 47 -> sub BYTE(Reg8) BYTE(0x7a)
OP: 0x9a
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x4f)
0xac4: 52 -> xor DWORD(Reg9) DWORD(0x4c84bb4f)
OP: 0xbb
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xdd)
0xaca: 37 -> add DWORD(Reg13) DWORD(Reg9)
OP: 0x96
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0x8d)
0xacc: 43 -> xor DWORD(Reg13) DWORD(Reg12)
OP: 0xc2
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x77)
0xace: 37 -> add DWORD(Reg7) DWORD(Reg13)
OP: 0xd6
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x8)
0xad0: 65 -> mov BYTE(Data[DP]) BYTE(Reg8)
OP: 0xbc
OP (decrypted): 0x16
INST: h_rc4
size: 141
operand count: 4
self.key ^= code[3](0x2b)
0xad2: 22 -> rc4 BYTE(0x8a) BYTE(0x2b) Buffer[0610b9fd4e21a3e6a1f8bc76f8bee8820feaf1b90a2e763ecc39308dbdbeba137da1da45cc7b475152a8011f3a0b9262ee506084c7933225ee0e3a74cf9bcbfa6ceff1f127c0bb42c861dd068cf720fecf22c7508165e9a20f93e70f1bedd7e45040c79a606b7c62a96318637f0d28be26de6999ff54fd0e740b0f6e56fdb8837176ad63367b4a302cc0] VALUE(43)(Data[DP])
OP: 0xd1
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xf1)
0xb5f: 30 -> mov WORD(Reg1) WORD(0x4ef1)
OP: 0xc9
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x11)
0xb63: 37 -> add DWORD(Reg1) DWORD(Reg13)
OP: 0xd9
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x11)
0xb65: 40 -> sub DWORD(Reg1) DWORD(Reg14)
OP: 0xe9
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x11)
0xb67: 37 -> add DWORD(Reg1) DWORD(Reg14)
OP: 0xee
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x1a)
0xb69: 31 -> mov DWORD(Reg7) DWORD(0xff28061a)
OP: 0x91
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x17)
0xb6f: 36 -> add WORD(Reg7) WORD(Reg15)
OP: 0xf3
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x80)
0xb71: 45 -> add WORD(Reg1) WORD(0x6980)
OP: 0xc2
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xa8)
0xb75: 49 -> sub DWORD(Reg1) DWORD(0xef6984a8)
OP: 0xb0
OP (decrypted): 0x3b
INST: mw_xor_data_with_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x1)
0xb7b: 59 -> xor BYTE(Data[DP]) BYTE(Reg1)
OP: 0xc3
OP (decrypted): 0x3f
INST: h_mov_data_to_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x0)
0xb7d: 63 -> mov WORD(Reg0) WORD(Data[DP])
OP: 0xa0
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x75)
0xb7f: 29 -> mov BYTE(Reg10) BYTE(0x75)
OP: 0xee
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xa)
0xb82: 40 -> sub DWORD(Reg10) DWORD(Reg14)
OP: 0xe5
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xad)
0xb84: 50 -> xor BYTE(Reg0) BYTE(0xad)
OP: 0xdd
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xe3)
0xb87: 30 -> mov WORD(Reg7) WORD(0xd5e3)
OP: 0xd1
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xd9)
0xb8b: 47 -> sub BYTE(Reg0) BYTE(0xd9)
OP: 0xa2
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xf4)
0xb8e: 47 -> sub BYTE(Reg0) BYTE(0xf4)
OP: 0x83
OP (decrypted): 0x23
INST: h_add_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x7a)
0xb91: 35 -> add BYTE(Reg10) BYTE(Reg10)
OP: 0xa7
OP (decrypted): 0x42
INST: mw_push_reg_to_data_w
size: 2
operand count: 2
self.key ^= code[1](0x0)
0xb93: 66 -> mov WORD(Data[DP]) WORD(Reg0)
OP: 0xfd
OP (decrypted): 0x5
INST: h_xor_data_imm_dw
size: 5
operand count: 2
self.key ^= code[1](0x4a)
0xb95: 5 -> nop DWORD(Data[DP]) DWORD(0xd06db74a)
OP: 0x89
OP (decrypted): 0x3f
INST: h_mov_data_to_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x6)
0xb9a: 63 -> mov WORD(Reg6) WORD(Data[DP])
OP: 0xa5
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x93)
0xb9c: 30 -> mov WORD(Reg5) WORD(0xdc93)
OP: 0xab
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x55)
0xba0: 37 -> add DWORD(Reg5) DWORD(Reg9)
OP: 0x9a
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x29)
0xba2: 47 -> sub BYTE(Reg6) BYTE(0x29)
OP: 0xd7
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x55)
0xba5: 42 -> xor WORD(Reg5) WORD(Reg8)
OP: 0x88
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x65)
0xba7: 36 -> add WORD(Reg5) WORD(Reg8)
OP: 0x86
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x65)
0xba9: 42 -> xor WORD(Reg5) WORD(Reg13)
OP: 0xde
OP (decrypted): 0x42
INST: mw_push_reg_to_data_w
size: 2
operand count: 2
self.key ^= code[1](0x6)
0xbab: 66 -> mov WORD(Data[DP]) WORD(Reg6)
OP: 0xe2
OP (decrypted): 0x1c
INST: h_loop_w
size: 3
operand count: 2
self.key ^= code[1](0x65)
0xbad: 28 -> loop DWORD(PC) WORD(0x165)
OP: 0xdf
OP (decrypted): 0x16
INST: h_rc4
size: 47
operand count: 4
self.key ^= code[3](0x27)
0xbb0: 22 -> rc4 BYTE(0x2c) BYTE(0x27) Buffer[4a8fccc2cdc9ad7c9852e6da0d3b80263c1fcba0fe6ce667d728a5d75ad1fe0e2e74790451fcf73e02476fb8] VALUE(39)(Data[DP])
OP: 0x99
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x79)
0xbdf: 26 -> add DWORD(DP) WORD(0xfd79)
OP: 0xc8
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x9)
0xbe2: 62 -> mov BYTE(Reg9) BYTE(Data[DP])
OP: 0xab
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xb5)
0xbe4: 30 -> mov WORD(Reg15) WORD(0xebb5)
OP: 0x9b
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xbe)
0xbe8: 51 -> xor WORD(Reg9) WORD(0xeabe)
OP: 0xbb
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xe)
0xbec: 31 -> mov DWORD(Reg4) DWORD(0x8ca06c0e)
OP: 0x8d
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x9a)
0xbf2: 44 -> add BYTE(Reg15) BYTE(0x9a)
OP: 0xe3
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x18)
0xbf5: 48 -> sub WORD(Reg9) WORD(0x4418)
OP: 0xfa
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xcc)
0xbf9: 49 -> sub DWORD(Reg4) DWORD(0x33b30bcc)
OP: 0xca
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xff)
0xbff: 37 -> add DWORD(Reg15) DWORD(Reg11)
OP: 0xb8
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x94)
0xc01: 39 -> sub WORD(Reg4) WORD(Reg11)
OP: 0xb8
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x4f)
0xc03: 39 -> sub WORD(Reg15) WORD(Reg14)
OP: 0xee
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x44)
0xc05: 42 -> xor WORD(Reg4) WORD(Reg8)
OP: 0x8d
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xa8)
0xc07: 48 -> sub WORD(Reg4) WORD(0x9ea8)
OP: 0xd0
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0x44)
0xc0b: 43 -> xor DWORD(Reg4) DWORD(Reg8)
OP: 0x8b
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x94)
0xc0d: 37 -> add DWORD(Reg4) DWORD(Reg11)
OP: 0xb5
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x9)
0xc0f: 65 -> mov BYTE(Data[DP]) BYTE(Reg9)
OP: 0xb3
OP (decrypted): 0x18
INST: h_set_loop_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x3)
0xc11: 24 -> set loop LoopCounter WORD(0x3)
OP: 0x80
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xb9)
0xc14: 30 -> mov WORD(Reg11) WORD(0xf7b9)
OP: 0x90
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x68)
0xc18: 52 -> xor DWORD(Reg11) DWORD(0xbac34e68)
OP: 0x84
OP (decrypted): 0x3d
INST: mw_xor_data_with_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xb)
0xc1e: 61 -> xor DWORD(Data[DP]) DWORD(Reg11)
OP: 0xe7
OP (decrypted): 0x16
INST: h_rc4
size: 171
operand count: 4
self.key ^= code[3](0x9b)
0xc20: 22 -> rc4 BYTE(0xa8) BYTE(0x9b) Buffer[6b4c569816733225425ff5c8a17a3d0acb499171560e261dc0395be11d1ef0c3a56bc9eea6902aef22be68c818d41ab8c691311c8f9489ee17e88b5d54dac4ccf42b498de4b031123e8248a8da2cdef9d5230232eb6057820a8b14174bf23275a2c4ed2dc5c3c6fac15010135d6528ebca8df1d46cf610cc495f88332d1c3f9a70e114646a3f9accdcfb8bfc543315249f29e10eaa68dfd5b5150ac72c25335f6f56f0529b0ff748] VALUE(155)(Data[DP])
OP: 0xb9
OP (decrypted): 0x1b
INST: h_loop_b
size: 2
operand count: 2
self.key ^= code[1](0xb9)
0xccb: 27 -> loop DWORD(PC) BYTE(0xb9)
OP: 0x81
OP (decrypted): 0x40
INST: h_mov_data_to_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xf)
0xccd: 64 -> mov DWORD(Reg15) DWORD(Data[DP])
OP: 0x8d
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x12)
0xccf: 29 -> mov BYTE(Reg12) BYTE(0x12)
OP: 0xbe
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x38)
0xcd2: 31 -> mov DWORD(Reg0) DWORD(0x90e54538)
OP: 0xb0
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xc)
0xcd8: 39 -> sub WORD(Reg12) WORD(Reg10)
OP: 0xa0
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xf0)
0xcda: 39 -> sub WORD(Reg0) WORD(Reg14)
OP: 0xe4
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x82)
0xcdc: 31 -> mov DWORD(Reg3) DWORD(0x2c032d82)
OP: 0x99
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x91)
0xce2: 52 -> xor DWORD(Reg15) DWORD(0xafe9391)
OP: 0xe8
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xc0)
0xce8: 40 -> sub DWORD(Reg0) DWORD(Reg11)
OP: 0xb2
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xe8)
0xcea: 47 -> sub BYTE(Reg3) BYTE(0xe8)
OP: 0x8c
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xd0)
0xced: 48 -> sub WORD(Reg15) WORD(0x5dd0)
OP: 0xb0
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x32)
0xcf1: 51 -> xor WORD(Reg3) WORD(0x4d32)
OP: 0x9c
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x33)
0xcf5: 52 -> xor DWORD(Reg3) DWORD(0x99ceda33)
OP: 0xcd
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xe9)
0xcfb: 47 -> sub BYTE(Reg15) BYTE(0xe9)
OP: 0x8d
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xec)
0xcfe: 48 -> sub WORD(Reg15) WORD(0x4fec)
OP: 0x99
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x0)
0xd02: 38 -> sub BYTE(Reg0) BYTE(Reg12)
OP: 0xc5
OP (decrypted): 0x30
INST: h_reg_sub_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xb3)
0xd04: 48 -> sub WORD(Reg15) WORD(0xa4b3)
OP: 0xd4
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xa7)
0xd08: 52 -> xor DWORD(Reg15) DWORD(0x8d0f8ca7)
OP: 0xde
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x3c)
0xd0e: 40 -> sub DWORD(Reg12) DWORD(Reg13)
OP: 0xd3
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x42)
0xd10: 50 -> xor BYTE(Reg15) BYTE(0x42)
OP: 0x88
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x3c)
0xd13: 36 -> add WORD(Reg12) WORD(Reg13)
OP: 0xd9
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xed)
0xd15: 44 -> add BYTE(Reg15) BYTE(0xed)
OP: 0xe7
OP (decrypted): 0x43
INST: mw_push_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0xf)
0xd18: 67 -> mov DWORD(Data[DP]) DWORD(Reg15)
OP: 0xc3
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x95)
0xd1a: 26 -> add DWORD(DP) WORD(0xfd95)
OP: 0xda
OP (decrypted): 0x40
INST: h_mov_data_to_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x7)
0xd1d: 64 -> mov DWORD(Reg7) DWORD(Data[DP])
OP: 0x85
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x20)
0xd1f: 29 -> mov BYTE(Reg4) BYTE(0x20)
OP: 0xa2
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x82)
0xd22: 49 -> sub DWORD(Reg7) DWORD(0x33349382)
OP: 0x8e
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x1c)
0xd28: 47 -> sub BYTE(Reg4) BYTE(0x1c)
OP: 0xe5
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xa8)
0xd2b: 45 -> add WORD(Reg7) WORD(0x81a8)
OP: 0x98
OP (decrypted): 0x43
INST: mw_push_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0x7)
0xd2f: 67 -> mov DWORD(Data[DP]) DWORD(Reg7)
OP: 0xc9
OP (decrypted): 0x18
INST: h_set_loop_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x9)
0xd31: 24 -> set loop LoopCounter WORD(0x9)
OP: 0x82
OP (decrypted): 0x16
INST: h_rc4
size: 123
operand count: 4
self.key ^= code[3](0x3a)
0xd34: 22 -> rc4 BYTE(0x78) BYTE(0x3a) Buffer[6aed9aa1f8ccae3405401e6535007d10d490c185cd1d7b22fda4477944d39b2f03cad9ba1f8d768a2dce5f682dbc09a3e08055cba491ecc6ab6e19aab9ddabf2052d55c1c2da86687821586c8ed241cda64016f0d7fc73163f57d593342ade542961464d9e7c3aa128ff1c041e40557f273679ea425bbc48] VALUE(58)(Data[DP])
OP: 0xb8
OP (decrypted): 0x1b
INST: h_loop_b
size: 2
operand count: 2
self.key ^= code[1](0x7d)
0xdaf: 27 -> loop DWORD(PC) BYTE(0x7d)
OP: 0x9f
OP (decrypted): 0x1a
INST: h_shift_data_imm_w
size: 3
operand count: 2
self.key ^= code[1](0xc4)
0xdb1: 26 -> add DWORD(DP) WORD(0xfcc4)
OP: 0xd3
OP (decrypted): 0x18
INST: h_set_loop_imm_w
size: 3
operand count: 2
self.key ^= code[1](0x2)
0xdb4: 24 -> set loop LoopCounter WORD(0x2)
OP: 0x9d
OP (decrypted): 0x2
INST: nop_dw
size: 4
operand count: 0
self.key ^= code[1](0x64)
0xdb7: 2 -> nop
OP: 0xd3
OP (decrypted): 0x12
INST: h_not_b_data
size: 1
operand count: 1
self.key ^= code[0](0x12)
0xdbb: 18 -> not BYTE(Data[DP])
OP: 0xfe
OP (decrypted): 0x16
INST: h_rc4
size: 99
operand count: 4
self.key ^= code[3](0x28)
0xdbc: 22 -> rc4 BYTE(0x60) BYTE(0x28) Buffer[59a6e784df7fcd93b3b8820eb9a118cb49e3f2931562943b801975f2997450822cc595db2312b746b3084543a56142a791a5e47812564ce8ae9b4ee9f7afdb268aa187184e8de45971313d49f4bc11f64663abd317172c544c63d21d5afd3c95] VALUE(40)(Data[DP])
OP: 0x9c
OP (decrypted): 0xc
INST: h_rol_b_data_b
size: 2
operand count: 2
self.key ^= code[1](0x9)
0xe1f: 12 -> rol BYTE(Data[DP]) BYTE(0x9)
OP: 0x9b
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xc1)
0xe21: 30 -> mov WORD(Reg0) WORD(0x46c1)
OP: 0xf2
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xdf)
0xe25: 46 -> add DWORD(Reg0) DWORD(0xa19159df)
OP: 0xe3
OP (decrypted): 0x20
INST: h_mov_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x8)
0xe2b: 32 -> mov BYTE(Reg8) BYTE(Reg12)
OP: 0xc2
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xf8)
0xe2d: 31 -> mov DWORD(Reg9) DWORD(0xe9ff1cf8)
OP: 0xfa
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x24)
0xe33: 45 -> add WORD(Reg9) WORD(0x1124)
OP: 0xf8
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x6)
0xe37: 47 -> sub BYTE(Reg8) BYTE(0x6)
OP: 0xcf
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xde)
0xe3a: 29 -> mov BYTE(Reg11) BYTE(0xde)
OP: 0xc0
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xc7)
0xe3d: 45 -> add WORD(Reg0) WORD(0x5cc7)
OP: 0x9a
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x1e)
0xe41: 46 -> add DWORD(Reg0) DWORD(0x5ce2361e)
OP: 0xaa
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x98)
0xe47: 40 -> sub DWORD(Reg8) DWORD(Reg15)
OP: 0xf6
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xd1)
0xe49: 51 -> xor WORD(Reg9) WORD(0x51d1)
OP: 0xed
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x8b)
0xe4d: 38 -> sub BYTE(Reg11) BYTE(Reg13)
OP: 0xd0
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xa7)
0xe4f: 46 -> add DWORD(Reg8) DWORD(0x69194ba7)
OP: 0x96
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x73)
0xe55: 45 -> add WORD(Reg11) WORD(0x173)
OP: 0xad
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x3b)
0xe59: 45 -> add WORD(Reg8) WORD(0x443b)
OP: 0xec
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x99)
0xe5d: 36 -> add WORD(Reg9) WORD(Reg15)
OP: 0xfb
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xb)
0xe5f: 43 -> xor DWORD(Reg11) DWORD(Reg13)
OP: 0xda
OP (decrypted): 0x3b
INST: mw_xor_data_with_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x8)
0xe61: 59 -> xor BYTE(Data[DP]) BYTE(Reg8)
OP: 0xe3
OP (decrypted): 0x16
INST: h_rc4
size: 18
operand count: 4
self.key ^= code[3](0xcd)
0xe63: 22 -> rc4 BYTE(0xf) BYTE(0xcd) Buffer[5f418731950173ef12e77508c99ff0] VALUE(205)(Data[DP])
OP: 0x8d
OP (decrypted): 0x1b
INST: h_loop_b
size: 2
operand count: 2
self.key ^= code[1](0xc0)
0xe75: 27 -> loop DWORD(PC) BYTE(0xc0)
OP: 0xb0
OP (decrypted): 0x8
INST: h_add_data_imm_dw
size: 5
operand count: 2
self.key ^= code[1](0xb2)
0xe77: 8 -> add DWORD(Data[DP]) DWORD(0x8b8ac0b2)
OP: 0xf0
OP (decrypted): 0x40
INST: h_mov_data_to_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xc)
0xe7c: 64 -> mov DWORD(Reg12) DWORD(Data[DP])
OP: 0x8d
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xf6)
0xe7e: 30 -> mov WORD(Reg1) WORD(0x4df6)
OP: 0xc0
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0x11)
0xe82: 43 -> xor DWORD(Reg1) DWORD(Reg11)
OP: 0xb8
OP (decrypted): 0x43
INST: mw_push_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0xc)
0xe84: 67 -> mov DWORD(Data[DP]) DWORD(Reg12)
OP: 0xcc
OP (decrypted): 0x16
INST: h_rc4
size: 30
operand count: 4
self.key ^= code[3](0x27)
0xe86: 22 -> rc4 BYTE(0x1b) BYTE(0x27) Buffer[100a4fac18772770ed0591879605948fc8f1ef8099912500f93c19] VALUE(39)(Data[DP])
OP: 0xe6
OP (decrypted): 0x3f
INST: h_mov_data_to_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xf)
0xea4: 63 -> mov WORD(Reg15) WORD(Data[DP])
OP: 0xac
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xf1)
0xea6: 30 -> mov WORD(Reg11) WORD(0x69f1)
OP: 0xd8
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x68)
0xeaa: 52 -> xor DWORD(Reg15) DWORD(0x85c25568)
OP: 0x8a
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x2e)
0xeb0: 51 -> xor WORD(Reg15) WORD(0x772e)
OP: 0x9a
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x25)
0xeb4: 46 -> add DWORD(Reg15) DWORD(0x2bca6e25)
OP: 0x9f
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0xfb)
0xeba: 38 -> sub BYTE(Reg11) BYTE(Reg9)
OP: 0x93
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x33)
0xebc: 29 -> mov BYTE(Reg7) BYTE(0x33)
OP: 0xa7
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xfb)
0xebf: 39 -> sub WORD(Reg11) WORD(Reg13)
OP: 0xdd
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xe8)
0xec1: 45 -> add WORD(Reg15) WORD(0x13e8)
OP: 0xa8
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x3c)
0xec5: 51 -> xor WORD(Reg15) WORD(0xde3c)
OP: 0x8e
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x7b)
0xec9: 40 -> sub DWORD(Reg11) DWORD(Reg8)
OP: 0x8b
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xe7)
0xecb: 45 -> add WORD(Reg7) WORD(0xd8e7)
OP: 0xa6
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x12)
0xecf: 50 -> xor BYTE(Reg15) BYTE(0x12)
OP: 0xd7
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0xb7)
0xed2: 43 -> xor DWORD(Reg7) DWORD(Reg14)
OP: 0xee
OP (decrypted): 0x33
INST: h_reg_xor_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x1)
0xed4: 51 -> xor WORD(Reg15) WORD(0x2401)
OP: 0xd9
OP (decrypted): 0x42
INST: mw_push_reg_to_data_w
size: 2
operand count: 2
self.key ^= code[1](0xf)
0xed8: 66 -> mov WORD(Data[DP]) WORD(Reg15)
OP: 0xe1
OP (decrypted): 0x16
INST: h_rc4
size: 124
operand count: 4
self.key ^= code[3](0x2)
0xeda: 22 -> rc4 BYTE(0x79) BYTE(0x2) Buffer[d780c998cd76bc7d1d6dc7a2897a24ed4bb67a83e8a61950bafffae8bc0878f3d4967adb4d6421bad86104bfa731b1316b382650a7ddb2f17185ad6459ab524e1ba8a9ddd5c8adeb84ea5a586b82be5e39444a53acdb446aa642182f86b57e581981454f858589f7f1ab58f66a73e8f29c94f636db2c8bda99] WORD(Data[DP])
OP: 0xa0
OP (decrypted): 0x3e
INST: h_mov_data_to_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x3)
0xf56: 62 -> mov BYTE(Reg3) BYTE(Data[DP])
OP: 0xa2
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x77)
0xf58: 29 -> mov BYTE(Reg0) BYTE(0x77)
OP: 0xea
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xe9)
0xf5b: 46 -> add DWORD(Reg3) DWORD(0xb47393e9)
OP: 0xdf
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x0)
0xf61: 42 -> xor WORD(Reg0) WORD(Reg13)
OP: 0xd2
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0x0)
0xf63: 43 -> xor DWORD(Reg0) DWORD(Reg15)
OP: 0xf7
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x1e)
0xf65: 29 -> mov BYTE(Reg9) BYTE(0x1e)
OP: 0x9f
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xfc)
0xf68: 50 -> xor BYTE(Reg3) BYTE(0xfc)
OP: 0xb4
OP (decrypted): 0x26
INST: h_sub_reg_reg_b
size: 2
operand count: 2
self.key ^= code[1](0x30)
0xf6b: 38 -> sub BYTE(Reg0) BYTE(Reg14)
OP: 0xe0
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x30)
0xf6d: 37 -> add DWORD(Reg0) DWORD(Reg12)
OP: 0xcd
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xdd)
0xf6f: 29 -> mov BYTE(Reg1) BYTE(0xdd)
OP: 0xc9
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x9)
0xf72: 39 -> sub WORD(Reg9) WORD(Reg12)
OP: 0xc3
OP (decrypted): 0x41
INST: mw_push_reg_to_data_b
size: 2
operand count: 2
self.key ^= code[1](0x3)
0xf74: 65 -> mov BYTE(Data[DP]) BYTE(Reg3)
OP: 0xa8
OP (decrypted): 0x9
INST: h_sub_data_imm_b
size: 2
operand count: 2
self.key ^= code[1](0xd1)
0xf76: 9 -> sub BYTE(Data[DP]) BYTE(0xd1)
OP: 0xd8
OP (decrypted): 0x40
INST: h_mov_data_to_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x7)
0xf78: 64 -> mov DWORD(Reg7) DWORD(Data[DP])
OP: 0x87
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xdb)
0xf7a: 31 -> mov DWORD(Reg1) DWORD(0xf51788db)
OP: 0xde
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x11)
0xf80: 42 -> xor WORD(Reg1) WORD(Reg12)
OP: 0xc5
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x40)
0xf82: 45 -> add WORD(Reg7) WORD(0xf340)
OP: 0x9e
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xc2)
0xf86: 45 -> add WORD(Reg7) WORD(0xd5c2)
OP: 0xae
OP (decrypted): 0x1f
INST: h_mov_reg_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xad)
0xf8a: 31 -> mov DWORD(Reg4) DWORD(0xf3c417ad)
OP: 0xa8
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x41)
0xf90: 42 -> xor WORD(Reg1) WORD(Reg8)
OP: 0x8a
OP (decrypted): 0x32
INST: h_reg_xor_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x9)
0xf92: 50 -> xor BYTE(Reg7) BYTE(0x9)
OP: 0xc3
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x44)
0xf95: 36 -> add WORD(Reg4) WORD(Reg10)
OP: 0xa0
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x9f)
0xf97: 45 -> add WORD(Reg1) WORD(0x279f)
OP: 0xc4
OP (decrypted): 0x28
INST: h_sub_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x71)
0xf9b: 40 -> sub DWORD(Reg1) DWORD(Reg8)
OP: 0x85
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0x41)
0xf9d: 41 -> xor BYTE(Reg1) BYTE(Reg8)
OP: 0x87
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x67)
0xf9f: 49 -> sub DWORD(Reg7) DWORD(0x2a53e067)
OP: 0xf5
OP (decrypted): 0x31
INST: h_reg_sub_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x8a)
0xfa5: 49 -> sub DWORD(Reg7) DWORD(0x367f6f8a)
OP: 0x83
OP (decrypted): 0x2a
INST: h_xor_reg2_to_reg1_w
size: 2
operand count: 2
self.key ^= code[1](0x11)
0xfab: 42 -> xor WORD(Reg1) WORD(Reg10)
OP: 0xab
OP (decrypted): 0x43
INST: mw_push_reg_to_data_dw
size: 2
operand count: 2
self.key ^= code[1](0x7)
0xfad: 67 -> mov DWORD(Data[DP]) DWORD(Reg7)
OP: 0xda
OP (decrypted): 0xb
INST: h_sub_data_imm_dw
size: 5
operand count: 2
self.key ^= code[1](0xae)
0xfaf: 11 -> sub DWORD(Data[DP]) DWORD(0xd8c0deae)
OP: 0xc1
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x7a)
0xfb4: 30 -> mov WORD(Reg2) WORD(0x577a)
OP: 0xc3
OP (decrypted): 0x24
INST: h_add_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0x22)
0xfb8: 36 -> add WORD(Reg2) WORD(Reg15)
OP: 0xf6
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x68)
0xfba: 29 -> mov BYTE(Reg8) BYTE(0x68)
OP: 0xe1
OP (decrypted): 0x3a
INST: mw_subs_reg_from_data_dw
size: 2
operand count: 2
self.key ^= code[1](0x2)
0xfbd: 58 -> sub DWORD(Data[DP]) DWORD(Reg2)
OP: 0xd9
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x2f)
0xfbf: 29 -> mov BYTE(Reg13) BYTE(0x2f)
OP: 0x82
OP (decrypted): 0x1e
INST: h_mov_reg_imm_w
size: 4
operand count: 2
self.key ^= code[2](0x11)
0xfc2: 30 -> mov WORD(Reg14) WORD(0xbc11)
OP: 0x91
OP (decrypted): 0x1d
INST: h_mov_reg_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x5d)
0xfc6: 29 -> mov BYTE(Reg4) BYTE(0x5d)
OP: 0xc5
OP (decrypted): 0x2b
INST: h_xor_reg2_to_reg1_dw
size: 2
operand count: 2
self.key ^= code[1](0x4d)
0xfc9: 43 -> xor DWORD(Reg13) DWORD(Reg8)
OP: 0x89
OP (decrypted): 0x2e
INST: h_reg_add_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x29)
0xfcb: 46 -> add DWORD(Reg14) DWORD(0x5733d929)
OP: 0x90
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0x4e)
0xfd1: 37 -> add DWORD(Reg14) DWORD(Reg9)
OP: 0x9a
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xf3)
0xfd3: 52 -> xor DWORD(Reg14) DWORD(0xf04fd9f3)
OP: 0x8f
OP (decrypted): 0x2d
INST: h_reg_add_imm_w
size: 4
operand count: 2
self.key ^= code[2](0xd2)
0xfd9: 45 -> add WORD(Reg13) WORD(0x71d2)
OP: 0x95
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0xc4)
0xfdd: 52 -> xor DWORD(Reg13) DWORD(0xb24df6c4)
OP: 0xb0
OP (decrypted): 0x25
INST: h_add_reg_reg_dw
size: 2
operand count: 2
self.key ^= code[1](0xe4)
0xfe3: 37 -> add DWORD(Reg4) DWORD(Reg10)
OP: 0xad
OP (decrypted): 0x29
INST: h_xor_reg2_to_reg1_b
size: 2
operand count: 2
self.key ^= code[1](0xd4)
0xfe5: 41 -> xor BYTE(Reg4) BYTE(Reg8)
OP: 0x84
OP (decrypted): 0x27
INST: h_sub_reg_reg_w
size: 2
operand count: 2
self.key ^= code[1](0xd4)
0xfe7: 39 -> sub WORD(Reg4) WORD(Reg14)
OP: 0xeb
OP (decrypted): 0x34
INST: h_reg_xor_imm_dw
size: 6
operand count: 2
self.key ^= code[2](0x58)
0xfe9: 52 -> xor DWORD(Reg4) DWORD(0x204da058)
OP: 0xa5
OP (decrypted): 0x2c
INST: h_reg_add_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x41)
0xfef: 44 -> add BYTE(Reg14) BYTE(0x41)
OP: 0xa7
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0x95)
0xff2: 47 -> sub BYTE(Reg14) BYTE(0x95)
OP: 0xee
OP (decrypted): 0x2f
INST: h_reg_sub_imm_b
size: 3
operand count: 2
self.key ^= code[2](0xbf)
0xff5: 47 -> sub BYTE(Reg4) BYTE(0xbf)
OP: 0xd3
OP (decrypted): 0x38
INST: mw_subs_reg_from_data_b
size: 2
operand count: 2
self.key ^= code[1](0x4)
0xff8: 56 -> sub BYTE(Data[DP]) BYTE(Reg4)
OP: 0xc4
OP (decrypted): 0x44
INST: h_vm_exit
size: 1
operand count: 0
self.key ^= code[0](0x44)
0xffa: 68 -> exit

for i in disassembly:
    print(i.text)

add DWORD(DP) WORD(0x209)
add DWORD(DP) WORD(0xff96)
set loop LoopCounter WORD(0x2)
rc4 BYTE(0x24) BYTE(0x9a) Buffer[881f8cc1ecfff903bc02414b249015aa648ad582c81d3615e6a6ee5c6bf9ab6fec5d09e3] VALUE(154)(Data[DP])
loop DWORD(PC) BYTE(0x29)
rc4 BYTE(0x1a) BYTE(0x1) Buffer[78ea5d76bc302819ba41474563b987c556f06aad9809c9b86c44] BYTE(Data[DP])
rol WORD(Data[DP]) BYTE(0x4f)
add DWORD(DP) WORD(0xfec9)
set loop LoopCounter WORD(0x1)
rc4 BYTE(0x51) BYTE(0x8f) Buffer[e191d47d3881bf24a74bf05b6bd82e95bec48930e73714e72b8cf81be623ffaecdf2d694b9dd1d7ad773fd1cde891dd1bf31f3d676ab0528a0d45a05dd4cd75d6ece255154538218a7b761beebb01ac9e5] VALUE(143)(Data[DP])
loop DWORD(PC) BYTE(0x56)
mov WORD(Reg5) WORD(Data[DP])
mov BYTE(Reg6) BYTE(0x55)
sub WORD(Reg6) WORD(Reg15)
sub BYTE(Reg5) BYTE(0x8e)
mov WORD(Reg3) WORD(0x5257)
add DWORD(Reg5) DWORD(0x67a37ce2)
sub DWORD(Reg5) DWORD(0x24e2b767)
xor BYTE(Reg5) BYTE(0xa)
mov WORD(Data[DP]) WORD(Reg5)
ror DWORD(Data[DP]) BYTE(0x38)
add DWORD(DP) WORD(0xff7b)
add DWORD(DP) WORD(0xfeb0)
mov BYTE(Reg4) BYTE(Data[DP])
mov DWORD(Reg14) DWORD(0x2f70d8a6)
sub BYTE(Reg4) BYTE(0xde)
sub DWORD(Reg14) DWORD(0x79c0318a)
sub WORD(Reg4) WORD(0x70d1)
xor BYTE(Reg4) BYTE(0x7e)
sub BYTE(Reg4) BYTE(0x7d)
xor DWORD(Reg4) DWORD(0x3e4156b2)
add WORD(Reg4) WORD(0x96f9)
xor BYTE(Reg14) BYTE(Reg10)
sub WORD(Reg4) WORD(0x758d)
mov BYTE(Data[DP]) BYTE(Reg4)
mov BYTE(Reg14) BYTE(0x26)
mov DWORD(Reg11) DWORD(0x94b23d2)
xor BYTE(Reg11) BYTE(0xf1)
add WORD(Reg11) WORD(0x1d80)
sub WORD(Reg14) WORD(0x2c96)
sub WORD(Reg11) WORD(0xa443)
add BYTE(Reg14) BYTE(0xb5)
add BYTE(Reg14) BYTE(0x7e)
add WORD(Reg14) WORD(0x1d3b)
xor DWORD(Reg14) DWORD(Reg14)
xor WORD(Reg14) WORD(0xfa91)
add DWORD(Data[DP]) DWORD(Reg14)
mov WORD(Reg13) WORD(0xc20)
mov DWORD(Reg15) DWORD(0xb58d3719)
xor DWORD(Reg13) DWORD(0x72be53e0)
sub BYTE(Reg15) BYTE(0x8b)
xor BYTE(Reg15) BYTE(0x28)
add WORD(Reg15) WORD(Reg8)
xor DWORD(Reg13) DWORD(0x7dd0797c)
add DWORD(Reg15) DWORD(Reg11)
xor BYTE(Reg13) BYTE(Reg8)
add DWORD(Reg15) DWORD(Reg10)
sub DWORD(Data[DP]) DWORD(Reg15)
mov DWORD(Reg7) DWORD(0x65647815)
mov BYTE(Reg3) BYTE(0xb3)
add DWORD(Reg7) DWORD(0x7dfd39c9)
xor WORD(Reg7) WORD(0x1335)
xor DWORD(Reg7) DWORD(0xc2ec02cb)
mov WORD(Reg11) WORD(Reg9)
sub DWORD(Reg11) DWORD(0xbe9c184a)
mov BYTE(Reg9) BYTE(0x69)
xor DWORD(Reg7) DWORD(0x741c6d4)
add BYTE(Reg9) BYTE(0xfa)
add BYTE(Reg11) BYTE(Reg12)
add DWORD(Reg11) DWORD(Reg13)
add WORD(Reg11) WORD(0x15d2)
xor WORD(Reg7) WORD(Reg15)
sub DWORD(Reg3) DWORD(0x2314fbb4)
sub WORD(Data[DP]) WORD(Reg7)
mov BYTE(Reg9) BYTE(0xd2)
mov WORD(Reg1) WORD(0xc567)
mov DWORD(Reg2) DWORD(0xbd8d6cc3)
add BYTE(Reg9) BYTE(Reg11)
xor BYTE(Reg9) BYTE(0x9f)
sub BYTE(Reg9) BYTE(Reg12)
sub BYTE(Reg9) BYTE(0xe0)
xor WORD(Reg9) WORD(Reg13)
xor DWORD(Reg2) DWORD(0xb53df76b)
add BYTE(Data[DP]) BYTE(Reg9)
mov DWORD(Reg5) DWORD(0x44ee157)
sub DWORD(Reg5) DWORD(0x7588fec0)
add WORD(Reg5) WORD(0x1ad6)
sub BYTE(Reg5) BYTE(0x72)
add BYTE(Reg5) BYTE(Reg15)
xor DWORD(Reg5) DWORD(0xdbc71562)
mov WORD(Reg11) WORD(0xcc78)
xor BYTE(Data[DP]) BYTE(Reg5)
set loop LoopCounter WORD(0xb)
mov WORD(Reg10) WORD(0xc4f7)
sub BYTE(Reg10) BYTE(Reg15)
xor DWORD(Reg10) DWORD(Reg14)
add DWORD(Reg10) DWORD(0x389ae27b)
xor DWORD(Reg10) DWORD(Reg14)
mov BYTE(Reg4) BYTE(Reg12)
add DWORD(Data[DP]) DWORD(Reg10)
shuffle DWORD(Data[DP]) BYTE(0x1e)
mov BYTE(Reg11) BYTE(Data[DP])
mov WORD(Reg12) WORD(0xc7e4)
xor DWORD(Reg12) DWORD(Reg15)
add DWORD(Reg11) DWORD(0x5e1d373)
mov WORD(Reg7) WORD(0x4a5a)
add BYTE(Reg7) BYTE(Reg12)
add DWORD(Reg7) DWORD(Reg11)
add BYTE(Reg11) BYTE(0x28)
xor BYTE(Reg11) BYTE(0xb9)
add BYTE(Reg12) BYTE(Reg15)
add WORD(Reg7) WORD(0xd332)
xor DWORD(Reg12) DWORD(Reg8)
xor WORD(Reg7) WORD(Reg14)
xor DWORD(Reg12) DWORD(Reg13)
mov BYTE(Data[DP]) BYTE(Reg11)
mov WORD(Reg4) WORD(0xa5dd)
mov BYTE(Reg6) BYTE(0xea)
add DWORD(Data[DP]) DWORD(Reg4)
rc4 BYTE(0x7c) BYTE(0xc) Buffer[6702d699d4b7c32a55ebfefe2651e18e51474e2e3c4fdacedbcc829663994d359c2f18bfe9b6a678e6db034557067661dbd17f6490436e7bc06e2e8389a47ced889fbe4bebc88d1d66c6f317952edf8268164c1179aa3df2afa40a4278903cd5d631dccc9022a4ceb5471c156a0010cd9cc18be07d01b85fb38bade4] VALUE(12)(Data[DP])
mov BYTE(Reg14) BYTE(Data[DP])
mov BYTE(Reg3) BYTE(0x71)
sub BYTE(Reg3) BYTE(Reg14)
xor WORD(Reg3) WORD(Reg14)
sub DWORD(Reg3) DWORD(Reg10)
mov BYTE(Reg15) BYTE(0x3c)
sub BYTE(Reg15) BYTE(Reg8)
mov DWORD(Reg7) DWORD(0x54c3c238)
xor DWORD(Reg15) DWORD(Reg10)
xor DWORD(Reg15) DWORD(Reg11)
sub WORD(Reg7) WORD(Reg13)
xor BYTE(Reg7) BYTE(0x4d)
xor BYTE(Reg14) BYTE(0x94)
sub DWORD(Reg3) DWORD(Reg9)
sub DWORD(Reg14) DWORD(0x33570553)
add DWORD(Reg15) DWORD(0x77a4b67c)
sub BYTE(Reg7) BYTE(Reg15)
xor BYTE(Reg14) BYTE(0x95)
add BYTE(Reg7) BYTE(Reg12)
xor DWORD(Reg15) DWORD(Reg14)
xor BYTE(Reg3) BYTE(0xae)
sub BYTE(Reg14) BYTE(0xce)
add BYTE(Reg3) BYTE(Reg10)
mov BYTE(Data[DP]) BYTE(Reg14)
mov WORD(Reg12) WORD(0x3de2)
mov BYTE(Reg11) BYTE(0xbf)
sub BYTE(Reg11) BYTE(0x7a)
sub WORD(Reg11) WORD(0x4881)
add WORD(Reg12) WORD(Reg13)
add BYTE(Reg11) BYTE(0x15)
add WORD(Reg12) WORD(0xce16)
add DWORD(Data[DP]) DWORD(Reg11)
mov BYTE(Reg13) BYTE(Data[DP])
mov DWORD(Reg3) DWORD(0x669736e3)
sub WORD(Reg3) WORD(Reg8)
sub WORD(Reg13) WORD(0xc007)
sub WORD(Reg3) WORD(Reg9)
add DWORD(Reg13) DWORD(0xe1a61823)
xor BYTE(Reg13) BYTE(0x75)
xor BYTE(Reg3) BYTE(Reg8)
sub DWORD(Reg3) DWORD(Reg12)
mov BYTE(Data[DP]) BYTE(Reg13)
mov WORD(Reg7) WORD(0xd77b)
mov WORD(Reg1) WORD(0x6851)
xor WORD(Reg7) WORD(0x20c0)
add DWORD(Reg7) DWORD(0xfcd3f514)
add DWORD(Reg1) DWORD(Reg11)
sub BYTE(Reg1) BYTE(0xbb)
add WORD(Reg7) WORD(0xd049)
xor WORD(Reg7) WORD(Reg10)
add BYTE(Reg1) BYTE(0x4b)
sub DWORD(Reg7) DWORD(0xa6066a16)
xor DWORD(Reg1) DWORD(0xc51ca148)
add BYTE(Data[DP]) BYTE(Reg7)
sub BYTE(Data[DP]) BYTE(0xca)
mov BYTE(Reg6) BYTE(Data[DP])
mov BYTE(Reg7) BYTE(0x89)
add BYTE(Reg7) BYTE(Reg13)
add DWORD(Reg6) DWORD(0x15ddd072)
sub DWORD(Reg7) DWORD(Reg15)
mov BYTE(Data[DP]) BYTE(Reg6)
not DWORD(Data[DP])
loop DWORD(PC) WORD(0x188)
mov BYTE(Reg1) BYTE(0xa1)
mov DWORD(Reg9) DWORD(0x729495b9)
xor WORD(Reg9) WORD(Reg13)
xor BYTE(Reg9) BYTE(0xd1)
sub WORD(Reg9) WORD(0xdb20)
add BYTE(Data[DP]) BYTE(Reg9)
rc4 BYTE(0xb) BYTE(0xa) Buffer[01046d00c6ba5a8c5d937c] VALUE(10)(Data[DP])
rol BYTE(Data[DP]) BYTE(0x6f)
mov BYTE(Reg7) BYTE(Data[DP])
mov BYTE(Reg2) BYTE(0x54)
xor BYTE(Reg2) BYTE(Reg15)
sub DWORD(Reg2) DWORD(Reg13)
add BYTE(Reg2) BYTE(0x9)
add DWORD(Reg7) DWORD(0x9d427d02)
sub WORD(Reg7) WORD(0x713f)
sub WORD(Reg7) WORD(0xde90)
add BYTE(Reg2) BYTE(Reg9)
add BYTE(Reg2) BYTE(Reg10)
mov BYTE(Data[DP]) BYTE(Reg7)
add DWORD(DP) WORD(0xfec1)
mov BYTE(Reg11) BYTE(Data[DP])
mov BYTE(Reg2) BYTE(0x33)
sub WORD(Reg11) WORD(0x3e84)
sub BYTE(Reg2) BYTE(0x83)
sub DWORD(Reg2) DWORD(Reg12)
xor BYTE(Reg2) BYTE(Reg9)
mov BYTE(Data[DP]) BYTE(Reg11)
mov DWORD(Reg12) DWORD(0x9603da0f)
add BYTE(Reg12) BYTE(Reg12)
mov WORD(Reg8) WORD(0xcd5e)
xor WORD(Reg8) WORD(0x982e)
xor DWORD(Reg8) DWORD(0x32b58766)
mov WORD(Reg5) WORD(Reg14)
xor BYTE(Reg12) BYTE(0x6f)
sub DWORD(Reg12) DWORD(Reg11)
add DWORD(Reg8) DWORD(0x1e49590e)
xor BYTE(Reg5) BYTE(0x62)
xor DWORD(Reg8) DWORD(Reg9)
xor WORD(Reg5) WORD(0xeedc)
add DWORD(Reg5) DWORD(0xccab1887)
sub WORD(Reg12) WORD(Reg11)
xor WORD(Data[DP]) WORD(Reg8)
mov DWORD(Reg0) DWORD(0x958d08d6)
add WORD(Reg0) WORD(0x5e27)
add BYTE(Reg0) BYTE(0xe2)
mov DWORD(Reg13) DWORD(0xa5715d9e)
mov BYTE(Reg11) BYTE(Reg11)
xor DWORD(Reg11) DWORD(0x6cd50e78)
sub BYTE(Reg0) BYTE(0xe4)
add WORD(Reg0) WORD(0x4bb7)
add WORD(Reg11) WORD(Reg12)
xor DWORD(Reg13) DWORD(0xda51e732)
xor BYTE(Reg0) BYTE(Reg13)
sub BYTE(Reg11) BYTE(Reg14)
add BYTE(Reg11) BYTE(Reg15)
add DWORD(Data[DP]) DWORD(Reg0)
set loop LoopCounter WORD(0x0)
mov DWORD(Reg12) DWORD(0x19948707)
mov WORD(Reg11) WORD(0x3010)
xor WORD(Reg12) WORD(Reg13)
mov DWORD(Reg14) DWORD(0xda1d69b6)
sub DWORD(Reg11) DWORD(0x6c15c9b0)
sub WORD(Reg11) WORD(0xe69d)
add BYTE(Data[DP]) BYTE(Reg11)
rol BYTE(Data[DP]) BYTE(0xd4)
mov BYTE(Reg13) BYTE(0x6d)
mov BYTE(Reg0) BYTE(0x5b)
xor WORD(Reg0) WORD(0xd45d)
sub WORD(Reg13) WORD(Reg11)
sub WORD(Data[DP]) WORD(Reg0)
sub WORD(Data[DP]) WORD(0xc8b3)
rc4 BYTE(0x96) BYTE(0xdb) Buffer[bd4a8fb28c2763d854e7e9b119b2eaafe99d4d370cbc815a35ddd902d9ca8c4115173bb64258ab8e246782e4383dc6883045a27e9ae6035930c0d528bc112115863db19d903f000e325ac03f8fea1eaafc9040f538722d236e12d40adb4b42d81b56a06d291b430475edb9c58d4801f17e3093c070ee2ccb108a287986321680b230f3375c9804172a78f97e87736441f0669c698c54] VALUE(219)(Data[DP])
loop DWORD(PC) BYTE(0xcc)
mov DWORD(Reg7) DWORD(0x83506d42)
xor DWORD(Reg7) DWORD(0x4f17852b)
xor DWORD(Data[DP]) DWORD(Reg7)
mov BYTE(Reg2) BYTE(Data[DP])
mov BYTE(Reg15) BYTE(0x3)
xor BYTE(Reg15) BYTE(Reg15)
sub DWORD(Reg15) DWORD(Reg13)
add DWORD(Reg2) DWORD(0x5bccb417)
sub DWORD(Reg15) DWORD(Reg13)
add WORD(Reg15) WORD(Reg12)
sub BYTE(Reg15) BYTE(Reg12)
mov BYTE(Data[DP]) BYTE(Reg2)
mov DWORD(Reg8) DWORD(0xe468c1bc)
mov BYTE(Reg0) BYTE(0x94)
sub BYTE(Reg0) BYTE(0xc4)
sub BYTE(Data[DP]) BYTE(Reg0)
add DWORD(Data[DP]) DWORD(0xb7e9a3f3)
mov WORD(Reg2) WORD(0x8876)
sub BYTE(Reg2) BYTE(Reg15)
mov WORD(Reg8) WORD(Reg8)
sub DWORD(Reg2) DWORD(0x2290ec9a)
add DWORD(Data[DP]) DWORD(Reg2)
ror DWORD(Data[DP]) BYTE(0x96)
add DWORD(DP) WORD(0xfdd3)
mov BYTE(Reg10) BYTE(Data[DP])
mov WORD(Reg13) WORD(0xf49b)
mov BYTE(Reg12) BYTE(0xc5)
add BYTE(Reg12) BYTE(Reg14)
add DWORD(Reg10) DWORD(0xf85617af)
sub BYTE(Reg10) BYTE(0x7d)
sub WORD(Reg13) WORD(Reg8)
sub DWORD(Reg12) DWORD(Reg13)
sub WORD(Reg13) WORD(Reg15)
add WORD(Reg13) WORD(Reg13)
xor WORD(Reg10) WORD(0x15ed)
sub DWORD(Reg13) DWORD(0xbb8e7668)
xor BYTE(Reg12) BYTE(0x66)
add DWORD(Reg13) DWORD(Reg14)
mov BYTE(Data[DP]) BYTE(Reg10)
rol BYTE(Data[DP]) BYTE(0x7c)
ror BYTE(Data[DP]) BYTE(0x2d)
mov WORD(Reg4) WORD(Data[DP])
mov DWORD(Reg11) DWORD(0xbaaebb91)
xor BYTE(Reg4) BYTE(0x25)
xor BYTE(Reg4) BYTE(0x23)
add DWORD(Reg11) DWORD(0x88440e66)
sub BYTE(Reg11) BYTE(Reg14)
add BYTE(Reg11) BYTE(Reg14)
xor DWORD(Reg4) DWORD(0x8d25b4f4)
xor DWORD(Reg4) DWORD(0xf77a3b8c)
sub DWORD(Reg4) DWORD(0x615fa190)
sub BYTE(Reg4) BYTE(0xeb)
sub BYTE(Reg4) BYTE(0xe)
mov DWORD(Reg9) DWORD(0xed27ed0c)
mov WORD(Data[DP]) WORD(Reg4)
set loop LoopCounter WORD(0x2)
mov DWORD(Reg5) DWORD(0x2a71ac72)
mov DWORD(Reg8) DWORD(0x5491f173)
mov BYTE(Reg1) BYTE(0xdf)
xor BYTE(Reg5) BYTE(Reg12)
xor DWORD(Reg5) DWORD(0x56e06de3)
sub BYTE(Reg1) BYTE(0xf7)
sub WORD(Reg5) WORD(0x28c7)
add BYTE(Reg8) BYTE(0x1)
add BYTE(Reg5) BYTE(Reg8)
mov DWORD(Reg12) DWORD(0xcb4600cd)
add BYTE(Reg1) BYTE(0x90)
sub BYTE(Reg1) BYTE(0xb2)
add DWORD(Reg8) DWORD(Reg13)
xor DWORD(Reg8) DWORD(Reg9)
xor BYTE(Reg12) BYTE(Reg9)
xor BYTE(Reg1) BYTE(Reg13)
add DWORD(Reg12) DWORD(0x6ba7dabb)
add BYTE(Reg8) BYTE(0x67)
sub DWORD(Reg1) DWORD(0x9276bc8)
xor DWORD(Data[DP]) DWORD(Reg1)
rol BYTE(Data[DP]) BYTE(0x3f)
mov WORD(Reg1) WORD(0xeb79)
mov WORD(Reg6) WORD(0x588e)
sub WORD(Reg6) WORD(0x3c61)
add WORD(Reg6) WORD(Reg12)
mov BYTE(Reg10) BYTE(0x8e)
xor BYTE(Reg6) BYTE(0xc0)
sub BYTE(Reg6) BYTE(0x1e)
xor WORD(Reg6) WORD(0xaad3)
add WORD(Reg6) WORD(0x14a6)
sub DWORD(Reg6) DWORD(0x721c08c6)
add DWORD(Reg6) DWORD(0x1bdf6801)
sub DWORD(Reg10) DWORD(0x34853e51)
sub DWORD(Reg1) DWORD(Reg12)
xor WORD(Reg6) WORD(0x9c5b)
add BYTE(Reg1) BYTE(0xb1)
xor DWORD(Reg10) DWORD(0x76e877b1)
add BYTE(Data[DP]) BYTE(Reg6)
mov DWORD(Reg10) DWORD(Data[DP])
mov BYTE(Reg3) BYTE(0x92)
xor BYTE(Reg3) BYTE(Reg15)
add BYTE(Reg3) BYTE(Reg15)
mov DWORD(Data[DP]) DWORD(Reg10)
mov DWORD(Reg6) DWORD(Data[DP])
mov BYTE(Reg1) BYTE(0x89)
add BYTE(Reg1) BYTE(Reg13)
mov BYTE(Reg9) BYTE(Reg14)
sub WORD(Reg9) WORD(Reg13)
sub WORD(Reg6) WORD(0xbc48)
add DWORD(Reg6) DWORD(0x36dfb4bc)
add BYTE(Reg6) BYTE(0x2c)
add DWORD(Reg9) DWORD(Reg10)
sub BYTE(Reg9) BYTE(Reg12)
add BYTE(Reg9) BYTE(Reg10)
xor WORD(Reg9) WORD(Reg12)
sub WORD(Reg9) WORD(Reg11)
xor BYTE(Reg1) BYTE(Reg12)
add DWORD(Reg9) DWORD(Reg13)
add BYTE(Reg9) BYTE(Reg11)
xor DWORD(Reg6) DWORD(0xf10194da)
xor WORD(Reg6) WORD(0x4ff5)
mov DWORD(Data[DP]) DWORD(Reg6)
rc4 BYTE(0x1b) BYTE(0xa6) Buffer[2da3dd3b3ba7139e66c7e6142096fc1589faae43e6371fa572a82f] VALUE(166)(Data[DP])
loop DWORD(PC) BYTE(0xeb)
mov DWORD(Reg1) DWORD(0xc4886ae6)
mov WORD(Reg14) WORD(0xb383)
xor DWORD(Reg1) DWORD(0xd2a86aec)
sub DWORD(Data[DP]) DWORD(Reg1)
rc4 BYTE(0x45) BYTE(0x35) Buffer[c6323b7610aafc976af3b7da0f1da68b257048d6e1bcdcd970f0a5e87b7ace6892e8c415a02c1b1c49a777de00c28b0554e22c2434961a30d08e0f7cb4cb9839ce73a72ddd] VALUE(53)(Data[DP])
add DWORD(DP) WORD(0xfe2f)
rc4 BYTE(0xfb) BYTE(0x5a) Buffer[32a5fe0f419672e210ef5bee15d56995e3a30eb8c0e6582814c15126c7a974469fd70f82f8f685b4959dcc3cd5a73db435f4a609b2f0800db1a85583427a0250c285a8298bcb96d5210d3f30faef32b2641ec00c71ce3b2b4241afd6e23e33dab2c87fe40f43550bcea83b15b768537699a439cbe476d8ddab4fdf0780218cfa9919bbf085be70e89e14f716fcbc4e06098e263596d1650dd9f78c7a4d97e6256ffbf77e2ab617e5f1741db48e2464ad6df1c52f5b783d2eef52283514f08339faaab8230920b5918d939d010923647c0bb44b37e10e4cae80c0b3555966f1134e85791ec3e22b5736e1f11a2f52a56d038b0f00ea65f59ff657e0] VALUE(90)(Data[DP])
mov DWORD(Reg15) DWORD(0x12b3a697)
mov DWORD(Reg10) DWORD(0x1e804160)
mov WORD(Reg8) WORD(0xf6fe)
xor WORD(Reg10) WORD(Reg13)
add WORD(Reg15) WORD(Reg15)
xor BYTE(Reg15) BYTE(0x79)
mov WORD(Reg3) WORD(0xadec)
add DWORD(Reg8) DWORD(0x4310844f)
sub WORD(Reg8) WORD(0x42d0)
sub DWORD(Reg3) DWORD(Reg9)
xor BYTE(Reg8) BYTE(0xff)
xor DWORD(Reg15) DWORD(0xe1ace59b)
xor WORD(Reg8) WORD(0xcc61)
sub WORD(Reg15) WORD(0x4b87)
add WORD(Data[DP]) WORD(Reg8)
xor WORD(Data[DP]) WORD(0xe5b8)
mov BYTE(Reg15) BYTE(Data[DP])
mov DWORD(Reg9) DWORD(0xbacd64ee)
add BYTE(Reg15) BYTE(0x33)
xor BYTE(Reg9) BYTE(Reg12)
xor WORD(Reg9) WORD(Reg12)
xor WORD(Reg9) WORD(Reg10)
sub DWORD(Reg9) DWORD(Reg15)
sub DWORD(Reg15) DWORD(0x515175b2)
add BYTE(Reg9) BYTE(Reg10)
xor DWORD(Reg9) DWORD(Reg11)
xor BYTE(Reg9) BYTE(Reg11)
xor BYTE(Reg15) BYTE(0xc1)
sub BYTE(Reg9) BYTE(0xf6)
sub BYTE(Reg9) BYTE(Reg10)
add DWORD(Reg15) DWORD(0x3228dbd0)
xor WORD(Reg15) WORD(0xb105)
sub WORD(Reg15) WORD(0x1e49)
mov BYTE(Data[DP]) BYTE(Reg15)
mov BYTE(Reg9) BYTE(0x1e)
mov BYTE(Reg13) BYTE(0xd1)
sub WORD(Reg9) WORD(0xf933)
sub WORD(Reg13) WORD(0x5e15)
add WORD(Reg13) WORD(0x313e)
add BYTE(Reg13) BYTE(0x1f)
xor DWORD(Reg13) DWORD(0xe1c440f4)
xor DWORD(Data[DP]) DWORD(Reg13)
rc4 BYTE(0xe0) BYTE(0x7c) Buffer[7b463a18ca0ca13b1144a5c54784538679876d87398ad38be0eef2e748dc1546905c8c920e81a796bb02817efcc9eb62c89b25399bbe0c401f8e59cef9e2e246028a2324a6c9b2d9876d6f0f7fe9cfe0c889c1cc0cf36e893b478ad4a67452b1c328c6366d82cf23893a2d60014ac8aacfd3907877f82584ce3ff97930d075778f484c954b0053ba63126865acde0206e13993b9e5074847edf9c329fe7e540b01f1473b06ab05df350f20256417f190009bdf2e5fc456fa0c59b8ac888338c525469c1c75f296fd61c3400882e0cd776c0e39cff65951c98559b46f92267fe9] VALUE(124)(Data[DP])
shuffle DWORD(Data[DP]) BYTE(0xc9)
mov BYTE(Reg9) BYTE(Data[DP])
mov DWORD(Reg11) DWORD(0xa8912a76)
xor WORD(Reg11) WORD(Reg15)
mov DWORD(Reg10) DWORD(0xc524af02)
sub BYTE(Reg10) BYTE(Reg12)
add DWORD(Reg11) DWORD(0x39613e6a)
add WORD(Reg11) WORD(Reg14)
sub DWORD(Reg9) DWORD(0x8f0e4256)
add WORD(Reg9) WORD(0x16d4)
mov BYTE(Data[DP]) BYTE(Reg9)
mov DWORD(Reg10) DWORD(0x4eb10899)
mov DWORD(Reg5) DWORD(0xf7d53c35)
mov DWORD(Reg9) DWORD(Reg15)
mov WORD(Reg6) WORD(0xa982)
add DWORD(Reg6) DWORD(Reg13)
add BYTE(Reg10) BYTE(0xb4)
add BYTE(Reg9) BYTE(0xa8)
sub BYTE(Reg5) BYTE(0x23)
xor WORD(Reg6) WORD(Reg12)
add WORD(Reg6) WORD(Reg8)
add DWORD(Reg5) DWORD(Reg11)
xor BYTE(Reg10) BYTE(0xdf)
sub WORD(Reg5) WORD(0xf2ce)
add DWORD(Reg6) DWORD(Reg9)
add BYTE(Reg9) BYTE(0x68)
xor WORD(Reg10) WORD(0xe5ec)
sub DWORD(Reg10) DWORD(0x2872b521)
add WORD(Reg6) WORD(0x9e03)
xor WORD(Data[DP]) WORD(Reg6)
add BYTE(Data[DP]) BYTE(0x8f)
add WORD(Data[DP]) WORD(0xd554)
add DWORD(DP) WORD(0xfe7c)
mov WORD(Reg11) WORD(Data[DP])
mov WORD(Reg7) WORD(0x794)
add BYTE(Reg7) BYTE(Reg12)
add WORD(Reg7) WORD(Reg15)
mov WORD(Data[DP]) WORD(Reg11)
mov WORD(Reg6) WORD(Data[DP])
mov BYTE(Reg15) BYTE(0xc5)
xor BYTE(Reg6) BYTE(0xf5)
sub WORD(Reg15) WORD(Reg13)
mov DWORD(Reg4) DWORD(Reg14)
mov WORD(Data[DP]) WORD(Reg6)
mov WORD(Reg0) WORD(Data[DP])
mov BYTE(Reg13) BYTE(0x39)
xor WORD(Reg13) WORD(Reg14)
mov BYTE(Reg1) BYTE(0xf4)
mov WORD(Reg8) WORD(0x6def)
sub BYTE(Reg1) BYTE(Reg12)
add WORD(Reg8) WORD(Reg11)
sub WORD(Reg8) WORD(Reg11)
xor DWORD(Reg0) DWORD(0x3022db41)
sub DWORD(Reg0) DWORD(0x124decd1)
sub BYTE(Reg8) BYTE(Reg12)
sub BYTE(Reg13) BYTE(Reg13)
sub BYTE(Reg13) BYTE(0xb6)
add DWORD(Reg8) DWORD(Reg13)
xor BYTE(Reg0) BYTE(0xbb)
sub BYTE(Reg1) BYTE(0x14)
xor WORD(Reg8) WORD(Reg12)
add BYTE(Reg1) BYTE(0xbd)
sub DWORD(Reg1) DWORD(Reg8)
mov WORD(Data[DP]) WORD(Reg0)
mov DWORD(Reg14) DWORD(0x94e9e1ed)
xor WORD(Reg14) WORD(Reg8)
mov BYTE(Reg6) BYTE(0xe2)
mov DWORD(Reg4) DWORD(Reg9)
sub WORD(Reg6) WORD(0x8313)
add BYTE(Reg6) BYTE(0x31)
sub DWORD(Reg6) DWORD(0x125d1282)
xor WORD(Reg14) WORD(0x8bdf)
xor WORD(Reg14) WORD(0xd704)
xor BYTE(Reg14) BYTE(0x61)
sub DWORD(Data[DP]) DWORD(Reg14)
set loop LoopCounter WORD(0x9)
mov WORD(Reg1) WORD(0x7d78)
mov DWORD(Reg7) DWORD(0xeda6caef)
add BYTE(Reg1) BYTE(0xb1)
mov DWORD(Reg4) DWORD(0x5c703853)
add WORD(Reg4) WORD(0x1d57)
mov BYTE(Reg14) BYTE(0xe7)
sub WORD(Reg7) WORD(0x3572)
xor DWORD(Reg4) DWORD(Reg10)
sub DWORD(Reg4) DWORD(0x16098c)
sub DWORD(Reg4) DWORD(0x7b920eb2)
xor DWORD(Reg7) DWORD(Reg10)
add DWORD(Reg14) DWORD(0x607169f7)
add DWORD(Reg7) DWORD(0x1f4890b7)
sub BYTE(Reg14) BYTE(0xb)
sub WORD(Data[DP]) WORD(Reg4)
add DWORD(Data[DP]) DWORD(0x17738a8a)
mov BYTE(Reg8) BYTE(Data[DP])
mov WORD(Reg13) WORD(0xd9be)
mov DWORD(Reg7) DWORD(0xe57a80e8)
xor DWORD(Reg13) DWORD(0xa9bcf963)
sub BYTE(Reg13) BYTE(Reg13)
add DWORD(Reg7) DWORD(Reg9)
xor WORD(Reg7) WORD(Reg11)
xor WORD(Reg13) WORD(0x82f6)
mov DWORD(Reg9) DWORD(0x327fc7b5)
add DWORD(Reg8) DWORD(0xa748016a)
sub WORD(Reg7) WORD(Reg15)
add WORD(Reg8) WORD(0xf66b)
xor WORD(Reg7) WORD(0xac1)
sub BYTE(Reg8) BYTE(0x7a)
xor DWORD(Reg9) DWORD(0x4c84bb4f)
add DWORD(Reg13) DWORD(Reg9)
xor DWORD(Reg13) DWORD(Reg12)
add DWORD(Reg7) DWORD(Reg13)
mov BYTE(Data[DP]) BYTE(Reg8)
rc4 BYTE(0x8a) BYTE(0x2b) Buffer[0610b9fd4e21a3e6a1f8bc76f8bee8820feaf1b90a2e763ecc39308dbdbeba137da1da45cc7b475152a8011f3a0b9262ee506084c7933225ee0e3a74cf9bcbfa6ceff1f127c0bb42c861dd068cf720fecf22c7508165e9a20f93e70f1bedd7e45040c79a606b7c62a96318637f0d28be26de6999ff54fd0e740b0f6e56fdb8837176ad63367b4a302cc0] VALUE(43)(Data[DP])
mov WORD(Reg1) WORD(0x4ef1)
add DWORD(Reg1) DWORD(Reg13)
sub DWORD(Reg1) DWORD(Reg14)
add DWORD(Reg1) DWORD(Reg14)
mov DWORD(Reg7) DWORD(0xff28061a)
add WORD(Reg7) WORD(Reg15)
add WORD(Reg1) WORD(0x6980)
sub DWORD(Reg1) DWORD(0xef6984a8)
xor BYTE(Data[DP]) BYTE(Reg1)
mov WORD(Reg0) WORD(Data[DP])
mov BYTE(Reg10) BYTE(0x75)
sub DWORD(Reg10) DWORD(Reg14)
xor BYTE(Reg0) BYTE(0xad)
mov WORD(Reg7) WORD(0xd5e3)
sub BYTE(Reg0) BYTE(0xd9)
sub BYTE(Reg0) BYTE(0xf4)
add BYTE(Reg10) BYTE(Reg10)
mov WORD(Data[DP]) WORD(Reg0)
nop DWORD(Data[DP]) DWORD(0xd06db74a)
mov WORD(Reg6) WORD(Data[DP])
mov WORD(Reg5) WORD(0xdc93)
add DWORD(Reg5) DWORD(Reg9)
sub BYTE(Reg6) BYTE(0x29)
xor WORD(Reg5) WORD(Reg8)
add WORD(Reg5) WORD(Reg8)
xor WORD(Reg5) WORD(Reg13)
mov WORD(Data[DP]) WORD(Reg6)
loop DWORD(PC) WORD(0x165)
rc4 BYTE(0x2c) BYTE(0x27) Buffer[4a8fccc2cdc9ad7c9852e6da0d3b80263c1fcba0fe6ce667d728a5d75ad1fe0e2e74790451fcf73e02476fb8] VALUE(39)(Data[DP])
add DWORD(DP) WORD(0xfd79)
mov BYTE(Reg9) BYTE(Data[DP])
mov WORD(Reg15) WORD(0xebb5)
xor WORD(Reg9) WORD(0xeabe)
mov DWORD(Reg4) DWORD(0x8ca06c0e)
add BYTE(Reg15) BYTE(0x9a)
sub WORD(Reg9) WORD(0x4418)
sub DWORD(Reg4) DWORD(0x33b30bcc)
add DWORD(Reg15) DWORD(Reg11)
sub WORD(Reg4) WORD(Reg11)
sub WORD(Reg15) WORD(Reg14)
xor WORD(Reg4) WORD(Reg8)
sub WORD(Reg4) WORD(0x9ea8)
xor DWORD(Reg4) DWORD(Reg8)
add DWORD(Reg4) DWORD(Reg11)
mov BYTE(Data[DP]) BYTE(Reg9)
set loop LoopCounter WORD(0x3)
mov WORD(Reg11) WORD(0xf7b9)
xor DWORD(Reg11) DWORD(0xbac34e68)
xor DWORD(Data[DP]) DWORD(Reg11)
rc4 BYTE(0xa8) BYTE(0x9b) Buffer[6b4c569816733225425ff5c8a17a3d0acb499171560e261dc0395be11d1ef0c3a56bc9eea6902aef22be68c818d41ab8c691311c8f9489ee17e88b5d54dac4ccf42b498de4b031123e8248a8da2cdef9d5230232eb6057820a8b14174bf23275a2c4ed2dc5c3c6fac15010135d6528ebca8df1d46cf610cc495f88332d1c3f9a70e114646a3f9accdcfb8bfc543315249f29e10eaa68dfd5b5150ac72c25335f6f56f0529b0ff748] VALUE(155)(Data[DP])
loop DWORD(PC) BYTE(0xb9)
mov DWORD(Reg15) DWORD(Data[DP])
mov BYTE(Reg12) BYTE(0x12)
mov DWORD(Reg0) DWORD(0x90e54538)
sub WORD(Reg12) WORD(Reg10)
sub WORD(Reg0) WORD(Reg14)
mov DWORD(Reg3) DWORD(0x2c032d82)
xor DWORD(Reg15) DWORD(0xafe9391)
sub DWORD(Reg0) DWORD(Reg11)
sub BYTE(Reg3) BYTE(0xe8)
sub WORD(Reg15) WORD(0x5dd0)
xor WORD(Reg3) WORD(0x4d32)
xor DWORD(Reg3) DWORD(0x99ceda33)
sub BYTE(Reg15) BYTE(0xe9)
sub WORD(Reg15) WORD(0x4fec)
sub BYTE(Reg0) BYTE(Reg12)
sub WORD(Reg15) WORD(0xa4b3)
xor DWORD(Reg15) DWORD(0x8d0f8ca7)
sub DWORD(Reg12) DWORD(Reg13)
xor BYTE(Reg15) BYTE(0x42)
add WORD(Reg12) WORD(Reg13)
add BYTE(Reg15) BYTE(0xed)
mov DWORD(Data[DP]) DWORD(Reg15)
add DWORD(DP) WORD(0xfd95)
mov DWORD(Reg7) DWORD(Data[DP])
mov BYTE(Reg4) BYTE(0x20)
sub DWORD(Reg7) DWORD(0x33349382)
sub BYTE(Reg4) BYTE(0x1c)
add WORD(Reg7) WORD(0x81a8)
mov DWORD(Data[DP]) DWORD(Reg7)
set loop LoopCounter WORD(0x9)
rc4 BYTE(0x78) BYTE(0x3a) Buffer[6aed9aa1f8ccae3405401e6535007d10d490c185cd1d7b22fda4477944d39b2f03cad9ba1f8d768a2dce5f682dbc09a3e08055cba491ecc6ab6e19aab9ddabf2052d55c1c2da86687821586c8ed241cda64016f0d7fc73163f57d593342ade542961464d9e7c3aa128ff1c041e40557f273679ea425bbc48] VALUE(58)(Data[DP])
loop DWORD(PC) BYTE(0x7d)
add DWORD(DP) WORD(0xfcc4)
set loop LoopCounter WORD(0x2)
nop
not BYTE(Data[DP])
rc4 BYTE(0x60) BYTE(0x28) Buffer[59a6e784df7fcd93b3b8820eb9a118cb49e3f2931562943b801975f2997450822cc595db2312b746b3084543a56142a791a5e47812564ce8ae9b4ee9f7afdb268aa187184e8de45971313d49f4bc11f64663abd317172c544c63d21d5afd3c95] VALUE(40)(Data[DP])
rol BYTE(Data[DP]) BYTE(0x9)
mov WORD(Reg0) WORD(0x46c1)
add DWORD(Reg0) DWORD(0xa19159df)
mov BYTE(Reg8) BYTE(Reg12)
mov DWORD(Reg9) DWORD(0xe9ff1cf8)
add WORD(Reg9) WORD(0x1124)
sub BYTE(Reg8) BYTE(0x6)
mov BYTE(Reg11) BYTE(0xde)
add WORD(Reg0) WORD(0x5cc7)
add DWORD(Reg0) DWORD(0x5ce2361e)
sub DWORD(Reg8) DWORD(Reg15)
xor WORD(Reg9) WORD(0x51d1)
sub BYTE(Reg11) BYTE(Reg13)
add DWORD(Reg8) DWORD(0x69194ba7)
add WORD(Reg11) WORD(0x173)
add WORD(Reg8) WORD(0x443b)
add WORD(Reg9) WORD(Reg15)
xor DWORD(Reg11) DWORD(Reg13)
xor BYTE(Data[DP]) BYTE(Reg8)
rc4 BYTE(0xf) BYTE(0xcd) Buffer[5f418731950173ef12e77508c99ff0] VALUE(205)(Data[DP])
loop DWORD(PC) BYTE(0xc0)
add DWORD(Data[DP]) DWORD(0x8b8ac0b2)
mov DWORD(Reg12) DWORD(Data[DP])
mov WORD(Reg1) WORD(0x4df6)
xor DWORD(Reg1) DWORD(Reg11)
mov DWORD(Data[DP]) DWORD(Reg12)
rc4 BYTE(0x1b) BYTE(0x27) Buffer[100a4fac18772770ed0591879605948fc8f1ef8099912500f93c19] VALUE(39)(Data[DP])
mov WORD(Reg15) WORD(Data[DP])
mov WORD(Reg11) WORD(0x69f1)
xor DWORD(Reg15) DWORD(0x85c25568)
xor WORD(Reg15) WORD(0x772e)
add DWORD(Reg15) DWORD(0x2bca6e25)
sub BYTE(Reg11) BYTE(Reg9)
mov BYTE(Reg7) BYTE(0x33)
sub WORD(Reg11) WORD(Reg13)
add WORD(Reg15) WORD(0x13e8)
xor WORD(Reg15) WORD(0xde3c)
sub DWORD(Reg11) DWORD(Reg8)
add WORD(Reg7) WORD(0xd8e7)
xor BYTE(Reg15) BYTE(0x12)
xor DWORD(Reg7) DWORD(Reg14)
xor WORD(Reg15) WORD(0x2401)
mov WORD(Data[DP]) WORD(Reg15)
rc4 BYTE(0x79) BYTE(0x2) Buffer[d780c998cd76bc7d1d6dc7a2897a24ed4bb67a83e8a61950bafffae8bc0878f3d4967adb4d6421bad86104bfa731b1316b382650a7ddb2f17185ad6459ab524e1ba8a9ddd5c8adeb84ea5a586b82be5e39444a53acdb446aa642182f86b57e581981454f858589f7f1ab58f66a73e8f29c94f636db2c8bda99] WORD(Data[DP])
mov BYTE(Reg3) BYTE(Data[DP])
mov BYTE(Reg0) BYTE(0x77)
add DWORD(Reg3) DWORD(0xb47393e9)
xor WORD(Reg0) WORD(Reg13)
xor DWORD(Reg0) DWORD(Reg15)
mov BYTE(Reg9) BYTE(0x1e)
xor BYTE(Reg3) BYTE(0xfc)
sub BYTE(Reg0) BYTE(Reg14)
add DWORD(Reg0) DWORD(Reg12)
mov BYTE(Reg1) BYTE(0xdd)
sub WORD(Reg9) WORD(Reg12)
mov BYTE(Data[DP]) BYTE(Reg3)
sub BYTE(Data[DP]) BYTE(0xd1)
mov DWORD(Reg7) DWORD(Data[DP])
mov DWORD(Reg1) DWORD(0xf51788db)
xor WORD(Reg1) WORD(Reg12)
add WORD(Reg7) WORD(0xf340)
add WORD(Reg7) WORD(0xd5c2)
mov DWORD(Reg4) DWORD(0xf3c417ad)
xor WORD(Reg1) WORD(Reg8)
xor BYTE(Reg7) BYTE(0x9)
add WORD(Reg4) WORD(Reg10)
add WORD(Reg1) WORD(0x279f)
sub DWORD(Reg1) DWORD(Reg8)
xor BYTE(Reg1) BYTE(Reg8)
sub DWORD(Reg7) DWORD(0x2a53e067)
sub DWORD(Reg7) DWORD(0x367f6f8a)
xor WORD(Reg1) WORD(Reg10)
mov DWORD(Data[DP]) DWORD(Reg7)
sub DWORD(Data[DP]) DWORD(0xd8c0deae)
mov WORD(Reg2) WORD(0x577a)
add WORD(Reg2) WORD(Reg15)
mov BYTE(Reg8) BYTE(0x68)
sub DWORD(Data[DP]) DWORD(Reg2)
mov BYTE(Reg13) BYTE(0x2f)
mov WORD(Reg14) WORD(0xbc11)
mov BYTE(Reg4) BYTE(0x5d)
xor DWORD(Reg13) DWORD(Reg8)
add DWORD(Reg14) DWORD(0x5733d929)
add DWORD(Reg14) DWORD(Reg9)
xor DWORD(Reg14) DWORD(0xf04fd9f3)
add WORD(Reg13) WORD(0x71d2)
xor DWORD(Reg13) DWORD(0xb24df6c4)
add DWORD(Reg4) DWORD(Reg10)
xor BYTE(Reg4) BYTE(Reg8)
sub WORD(Reg4) WORD(Reg14)
xor DWORD(Reg4) DWORD(0x204da058)
add BYTE(Reg14) BYTE(0x41)
sub BYTE(Reg14) BYTE(0x95)
sub BYTE(Reg4) BYTE(0xbf)
sub BYTE(Data[DP]) BYTE(Reg4)
exit