NAME=asm.bb.middle disasm FILE=bins/pe/cmd_adf_sample0.exe CMDS=< 0x00560e7d pop esi | 0x00560e7e push eax | 0x00560e7f push edx | ,=< 0x00560e80 jmp 0x560e96 | 0x00560e85 mov ebx, 0x4fd160dd | 0x00560e8a in al, dx | 0x00560e8b mov esp, 0x60bdf441 | 0x00560e90 lodsd eax, dword [esi] ,==< 0x00560e91 ja 0x560ed9 || 0x00560e93 aaa || 0x00560e94 sahf || 0x00560e95 ~ mov edx, 0x14e9310f | |`-> 0x00560e96 rdtsc | | 0x00560e98 jmp 0x560eb1 | 0x00560e9d test al, 0x36 | 0x00560e9f fcom qword [edx + 0x64] | 0x00560ea2 xlatb | 0x00560ea3 push 0x27 | 0x00560ea5 sub esp, edx | 0x00560ea7 mov eax, dword [0xe8c1cf5d] |,=< 0x00560eac jle 0x560f29 || 0x00560eae inc ecx || 0x00560eaf ~ mov byte [eax + 0x5a], dl | || 0x00560eb1 pop edx | || 0x00560eb2 pop eax / fcn.00560e67 (int32_t arg_4h); | 0x00560e67 push esi | ,=< 0x00560e68 jmp 0x560e7d | 0x00560e6d push ecx | 0x00560e6e in eax, 0xd6 | 0x00560e70 sbb eax, 0x5ceea31 | 0x00560e75 push es | 0x00560e76 cmp edx, esp | 0x00560e78 aam 0x1b | 0x00560e7a add byte [ebp + 0x52505e96], al | ,=< 0x00560e80 jmp 0x560e96 | 0x00560e85 mov ebx, 0x4fd160dd | 0x00560e8a in al, dx | 0x00560e8b mov esp, 0x60bdf441 | 0x00560e90 lodsd eax, dword [esi] ,==< 0x00560e91 ja 0x560ed9 || 0x00560e93 aaa || 0x00560e94 sahf || 0x00560e95 mov edx, 0x14e9310f | | 0x00560e9a add byte [eax], al | | 0x00560e9c add byte [eax + 0x6452dc36], ch | 0x00560ea2 xlatb | 0x00560ea3 push 0x27 | 0x00560ea5 sub esp, edx | 0x00560ea7 mov eax, dword [0xe8c1cf5d] |,=< 0x00560eac jle 0x560f29 || 0x00560eae inc ecx || 0x00560eaf mov byte [eax + 0x5a], dl | || 0x00560eb2 pop eax EOF RUN NAME=asm.bb.middle json FILE== CMDS=<>,ebx,=,$z,zf,:=,$p,pf,:=,31,$s,sf,:=", "refptr": false, "fcn_addr": 0, "fcn_last": 16, "size": 3, "opcode": "shr ebx, 0xfd", "disasm": "shr ebx, 0xfd", "bytes": "c1ebfd", "family": "cpu", "type": "shr", "reloc": false, "type_num": 22, "type2_num": 0, "xrefs_to": [ { "addr": 10, "type": "CODE" } ] }, { "offset": 12, "ptr": 44, "val": 44, "esil": "44,rbx,=", "refptr": false, "fcn_addr": 0, "fcn_last": 14, "size": 5, "opcode": "mov ebx, 0x2c", "disasm": "mov ebx, 0x2c", "bytes": "bb2c000000", "family": "cpu", "type": "mov", "reloc": false, "type_num": 9, "type2_num": 0, "xrefs_from": [ { "addr": 44, "type": "DATA" } ] }, { "offset": 17, "esil": "0x3,rip,=", "refptr": false, "fcn_addr": 0, "fcn_last": 17, "size": 2, "opcode": "jmp 3", "disasm": "jmp 3", "bytes": "ebf0", "family": "cpu", "type": "jmp", "reloc": false, "type_num": 1, "type2_num": 0, "jump": 3, "xrefs_from": [ { "addr": 3, "type": "CODE" } ] } ] ----2---- [ { "offset": 0, "esil": ",", "refptr": false, "fcn_addr": 0, "fcn_last": 14, "size": 5, "opcode": "nop dword [rax + rax]", "disasm": "nop dword [rax + rax]", "bytes": "0f1f440000", "family": "cpu", "type": "nop", "reloc": false, "type_num": 8, "type2_num": 0, "flags": [ "fcn.00000000" ] }, { "offset": 5, "ptr": 3238002721, "val": 3238002721, "esil": "3238002721,rax,=", "refptr": false, "fcn_addr": 0, "fcn_last": 14, "size": 5, "opcode": "mov eax, 0xc1000021", "disasm": "mov eax, 0xc1000021", "bytes": "b8210000c1", "family": "cpu", "type": "mov", "reloc": false, "type_num": 9, "type2_num": 0 }, { "offset": 10, "esil": "0x9,rip,=", "refptr": false, "fcn_addr": 0, "fcn_last": 17, "size": 2, "opcode": "jmp 9", "disasm": "jmp 9", "bytes": "ebfd", "family": "cpu", "type": "jmp", "reloc": false, "type_num": 1, "type2_num": 0, "jump": 9, "xrefs_from": [ { "addr": 9, "type": "CODE" } ] }, { "offset": 12, "ptr": 44, "val": 44, "esil": "44,rbx,=", "refptr": false, "fcn_addr": 0, "fcn_last": 14, "size": 5, "opcode": "mov ebx, 0x2c", "disasm": "mov ebx, 0x2c", "bytes": "bb2c000000", "family": "cpu", "type": "mov", "reloc": false, "type_num": 9, "type2_num": 0, "xrefs_from": [ { "addr": 44, "type": "DATA" } ] }, { "offset": 17, "esil": "0x3,rip,=", "refptr": false, "fcn_addr": 0, "fcn_last": 17, "size": 2, "opcode": "jmp 3", "disasm": "jmp 3", "bytes": "ebf0", "family": "cpu", "type": "jmp", "reloc": false, "type_num": 1, "type2_num": 0, "jump": 3, "xrefs_from": [ { "addr": 3, "type": "CODE" } ] } ] ----3---- { "name": "fcn.00000000", "size": 24, "addr": 0, "ops": [ { "offset": 0, "esil": ",", "refptr": false, "fcn_addr": 0, "fcn_last": 14, "size": 5, "opcode": "nop dword [rax + rax]", "disasm": "nop dword [rax + rax]", "bytes": "0f1f440000", "family": "cpu", "type": "nop", "reloc": false, "type_num": 8, "type2_num": 0, "flags": [ "fcn.00000000" ] }, { "offset": 3, "esil": "al,rax,+=[1],7,$o,of,:=,7,$s,sf,:=,$z,zf,:=,7,$c,cf,:=,$p,pf,:=,3,$c,af,:=", "refptr": true, "fcn_addr": 0, "fcn_last": 17, "size": 2, "opcode": "add byte [rax], al", "disasm": "add byte [rax], al", "bytes": "0000", "family": "cpu", "type": "add", "reloc": false, "type_num": 17, "type2_num": 0, "xrefs_to": [ { "addr": 17, "type": "CODE" } ] }, { "offset": 5, "ptr": 3238002721, "val": 3238002721, "esil": "3238002721,rax,=", "refptr": false, "fcn_addr": 0, "fcn_last": 14, "size": 5, "opcode": "mov eax, 0xc1000021", "disasm": "mov eax, 0xc1000021", "bytes": "b8210000c1", "family": "cpu", "type": "mov", "reloc": false, "type_num": 9, "type2_num": 0 }, { "offset": 10, "esil": "0x9,rip,=", "refptr": false, "fcn_addr": 0, "fcn_last": 17, "size": 2, "opcode": "jmp 9", "disasm": "jmp 9", "bytes": "ebfd", "family": "cpu", "type": "jmp", "reloc": false, "type_num": 1, "type2_num": 0, "jump": 9, "xrefs_from": [ { "addr": 9, "type": "CODE" } ] }, { "offset": 9, "val": 253, "esil": "0,cf,:=,1,253,-,1,<<,ebx,&,?{,1,cf,:=,},253,ebx,>>,ebx,=,$z,zf,:=,$p,pf,:=,31,$s,sf,:=", "refptr": false, "fcn_addr": 0, "fcn_last": 16, "size": 3, "opcode": "shr ebx, 0xfd", "disasm": "shr ebx, 0xfd", "bytes": "c1ebfd", "family": "cpu", "type": "shr", "reloc": false, "type_num": 22, "type2_num": 0, "xrefs_to": [ { "addr": 10, "type": "CODE" } ] }, { "offset": 12, "ptr": 44, "val": 44, "esil": "44,rbx,=", "refptr": false, "fcn_addr": 0, "fcn_last": 14, "size": 5, "opcode": "mov ebx, 0x2c", "disasm": "mov ebx, 0x2c", "bytes": "bb2c000000", "family": "cpu", "type": "mov", "reloc": false, "type_num": 9, "type2_num": 0, "xrefs_from": [ { "addr": 44, "type": "DATA" } ] }, { "offset": 17, "esil": "0x3,rip,=", "refptr": false, "fcn_addr": 0, "fcn_last": 17, "size": 2, "opcode": "jmp 3", "disasm": "jmp 3", "bytes": "ebf0", "family": "cpu", "type": "jmp", "reloc": false, "type_num": 1, "type2_num": 0, "jump": 3, "xrefs_from": [ { "addr": 3, "type": "CODE" } ] } ] } EOF RUN NAME=asm.bb.middle and pdq FILE== CMDS=<