segnolin / vobfus Goto Github PK

 construct:
       mov rbp, rsp
       sub rsp, 0200h                       ;set rsp to lower place
       lea rax, [rbp - 0a0h]
       mov qword ptr [rbp - 070h], rax      ;set v_rbp
       mov qword ptr [rbp - 068h], rax      ;set v_rsp
       lea rax, [rcx]
       mov qword ptr [rbp - 060h], rax      ;set v_rip
       mov qword ptr [rbp - 078h], rdi      ;set v_rdi
       mov qword ptr [rbp - 080h], rsi      ;set v_rsi
     fetch:
       xor rax, rax
       mov rbx, qword ptr [rbp - 060h]
       mov al, byte ptr [rbx]
       test al, al                          ;test if next opcode is \x00
       je destruct
     execute:
       lea rdi, [rbp - 0a0h]
       sub rax, 080h
       shl rax, 3
       lea rbx, [rdx]
       add rbx, rax                         ;use rax as v_table offset
       call qword ptr [rbx]                 ;call function accordingly
       jmp fetch
     destruct:
       mov rax, qword ptr [rbp - 0a0h]      ;return value
       mov rsp, rbp                         ;restore rsp