Get my intructions table... and work's very well for me...
Code: Select all
instructions op[] = {
{ "8D85%08X", "lea eax,[ebp+]" },
{ "50", "push eax" },
{ "51", "push ecx" },
{ "55", "push ebp" },
{ "58", "pop eax" },
{ "59", "pop ecx" },
{ "03C1", "add eax,ecx" },
{ "05%08X", "add eax" },
{ "0101", "add [ecx],eax" },
{ "660101", "add [ecx],ax" },
{ "0001", "add [ecx],al" },
{ "83C4%02X", "add1 esp" }, // byte operand
{ "81C4%08X", "add4 esp" }, // int operand
{ "8300%02X", "add1 dwordptr[eax]" },
{ "8100%08X", "add4 dwordptr[eax]" },
{ "8301%02X", "add1 dwordptr[ecx]" },
{ "8101%08X", "add4 dwordptr[ecx]" },
{ "8000%02X", "add byteptr[eax]" },
{ "8001%02X", "add byteptr[ecx]" },
{ "48", "dec eax" },
{ "2BC1", "sub eax,ecx" },
{ "2901", "sub [ecx],eax" },
{ "662901", "sub [ecx],ax" },
{ "2801", "sub [ecx],al" },
{ "83EC%02X", "sub1 esp" },
{ "81EC%08X", "sub4 esp" },
{ "8328%02X", "sub1 dwordptr[eax]" },
{ "8128%08X", "sub4 dwordptr[eax]" },
{ "8329%02X", "sub1 dwordptr[ecx]" },
{ "8129%08X", "sub4 dwordptr[ecx]" },
{ "8028%02X", "sub byteptr[eax]" },
{ "8029%02X", "sub byteptr[ecx]" },
{ "0FAFC1", "imul eax,ecx" },
{ "69C0%08X", "imul eax,eax" },
{ "99", "cdq" }, // Convert Double to Quad.
{ "F7F9", "idiv ecx" },
{ "3BC8", "cmp ecx,eax" },
{ "83F8%02X", "cmp1 eax" },
{ "81F8%08X", "cmp4 eax" },
{ "80FC%02X", "cmp ah" },
{ "F6C4%02X", "test ah" },
{ "23C1", "and eax,ecx" },
{ "80E4%02X", "and ah" },
{ "09C0", "or eax,eax" },
{ "0BC1", "or eax,ecx" },
{ "0901", "or [ecx],eax" },
{ "660901", "or [ecx],ax" },
{ "0801", "or [ecx],al" },
{ "31C0", "xor eax,eax" },
{ "33C1", "xor eax,ecx" },
{ "80F4%02X", "xor ah" },
{ "D3E0", "shl eax,cl" },
{ "D3E8", "shr eax,cl" },
{ "F7D8", "neg eax" },
{ "89D0", "mov eax,edx" },
{ "8BC8", "mov ecx,eax" },
{ "B8%08X", "mov eax" },
{ "B8V%06X_", "mov eax_v" },
{ "B8X%06X_", "mov eax_x" },
{ "B8fn_%04X_", "mov eax_fn" },
{ "B8FN_%04X_", "mov eax_FN" },
{ "B9%08X", "mov ecx" },
{ "B9V%06X_", "mov ecx_v" },
{ "BA%08X", "mov edx" },
{ "C700%08X", "mov dwordptr[eax]" },
{ "C700V%06X_", "mov dwordptr[eax]_v"},
{ "66C700%04X", "mov wordptr[eax]" },
{ "C600%02X", "mov byteptr[eax]" },
{ "8B00", "mov eax,[eax]" },
{ "8B01", "mov eax,[ecx]" },
{ "89E5", "mov ebp,esp" },
{ "8901", "mov [ecx],eax" },
{ "668901", "mov [ecx],ax" },
{ "8801", "mov [ecx],al" },
{ "0FBF00", "movsx eax,wordptr[eax]"},
{ "0FBE00", "movsx eax,byteptr[eax]"},
{ "91", "xchg eax,ecx" },
{ "74%02X", "jz " },
{ "75%02X", "jnz " },
{ "E9ln_%04X_", "jmp " },
{ "0F85ln_%04X_", "jne " },
{ "0F82%08X", "jb " },
{ "7C%02X", "jl " },
{ "7D%02X", "jge " },
{ "7E%02X", "jle " },
{ "7F%02X", "jg " },
{ "E8fn_%04X_", "call " },
{ "FF10", "call dwordptr[eax]" },
{ "FF15X%06X_", "call dwordptr[]" },
{ "C9", "leave" },
{ "C3", "ret" },
{ "0F94C0", "sete al" },
{ "0F95C0", "setne al" },
{ "D9E0", "fchs" },
{ "D9C9", "fxch st(1)" },
{ "DD00", "fld qwordptr[eax]" },
{ "DD01", "fld qwordptr[ecx]" },
{ "DD5C2400", "fst qwordptr[esp]" },
{ "DFE0", "fstsw" },
{ "DD18", "fstp qwordptr[eax]" },
{ "DD19", "fstp qwordptr[ecx]" },
{ "DEC1", "faddp st(1),st" }, // +=
{ "DEE9", "fsubrp st(1),st" }, // -=
{ "DEC9", "fmulp st(1),st" },
{ "DEF9", "fdivrp st(1),st" },
{ "DAE9", "fucompp" },
{ "DB1C24", "fistp dwordptr[esp]" },
{ "DC25V%06X_", "fsub qwordptr[]_v" },
};