* These functions can read from the stream safely! * Swap endianity of input to little endian. */

TODO: keep list of 'temporary' selected items if you select an item with the mouse and it gets out of the selection rectangle it stays selected. it

000000014000F9E1 4C 8D 1D AE FF FF FF lea r11, off_14000F996 ;dll base 000000014000F9E8 4C 8B D0 mov r10, rax

* Resolve PESpin Api String to VA */

* Api name hash function at VA 14000FBEC * * Start: 000000014000FBEC 52 push rdx * End: 000000014000FC10 C3

* 3DNow! instruction handling: * This is used when we encounter a 3DNow! instruction. * We can't really locate a 3DNow! instruction before we see two

* SIB decoding is the most confusing part when decoding IA-32 instructions. * This explanation should clear up some stuff. * * ! When base == 5, us

* Read as many prefixes as possible, up to 15 bytes, and halt when we encounter non-prefix byte. * This algorithm tries to imitate a real processor,

Ignore all prefix. */

Calculates which prefixes weren't used and accordingly sets the bits in the unusedPrefixesMask. */

only needed in windows xp