Some opcode matching helpers

Skips to next instruction (when no self-reference point is given) [Serial instructions] Last decrypted parameter should be passed

Gets the value of a register.

Deletes first N instructions

Unrolls the entire instruction stream as far as possiblibly predictable statically

Dumps the given instruction sequence

Extracts the next rolling key decryption block within the given instruction stream - On failure returns -1 as the iterator index

Extracts all of the rolling key decryption blocks within the given instruction stream

Finds the self-reference point from the given instruction stream if relevant

Invokes routine at the pointer given with the current context and updates the context. - Template argument is a small trick to make it work with ICC,

Reduces the given virtualized instruction handler to the base (AKA Deobfuscation + I/O based Register tracing)

Dumps all of the instructions in the stream to a byte array

Deduces the virtual instruction stream direction from the given instruction stream

Virtualizes the usage of the register throughout the routine given the stack frame.

Allocates <size> bytes of read/write/execute memory.

Reads encrypted value from the instruction stream

Frees the read/write/execute memory at <pointer>.

Parses VMENTER subroutine and extracts the vm information, entry point of the virtualized routine, rolling key 0 value, and describes the push order o

Parses the VMEXIT subroutine and extracts the order registers are pop'd from the stack.

Parses swapping vm of context/registers, returns newly extracted rkey blocks

Unrolls all instructions for the current handler

Deduces the virtual register key from the given instruction stream

Some helpers to extend from original size.

Finds the next/prev matching instruction

Merges two instruction streams together

Peeks at the virtual instruction stream without forwarding it

References the N bytes from the virtual instruction stream and skips them

Resolves the offset<0> where the value is saved at for the given register and the number of bytes<1> it takes.