Protected_Asm_Gen.py

with open('Protected.exe', 'rb') as f:
    data = f.read()
data = [ord(x) for x in data]
data = data[0x7B8:]
regs = {1 : 'eax', 2: 'ebx', 3: 'ecx', 4: 'edx', 5: 'esi', 6: 'edi', 7:'esp', 8:'eip', 9:'ebp'}
baseAddr = 0
f = open('asm', 'w')
while baseAddr < len(data):
    buffer = data[baseAddr:baseAddr+5]
    if buffer[0] == 0:
        f.write('mov ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
        baseAddr += 3
    elif buffer[0] == 1:
        f.write('mov ' + regs[buffer[1]] + ', ' + hex(buffer[2]) + '\n')
        baseAddr += 3
    elif buffer[0] == 2:
        f.write('xor ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
        baseAddr += 3
    elif buffer[0] == 3:
        f.write('sub ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
        baseAddr += 3
    elif buffer[0] == 4:
        f.write('add ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
        baseAddr += 3
    elif buffer[0] == 5:
        f.write('push ' + regs[buffer[1]] + '\n')
        baseAddr += 2
    elif buffer[0] == 6:
        f.write('pop ' + regs[buffer[1]] + '\n')
        baseAddr += 2
    elif buffer[0] == 7:
        f.write('add ' + regs[buffer[2]] + ', ' + regs[buffer[3]] + '\n')
        f.write('mov ' + regs[buffer[1]] + ', BYTE [' + regs[buffer[2]] + ']\n')
        baseAddr += 4
    elif buffer[0] == 8:
        baseAddr += 2
    elif buffer[0] == 9:
        baseAddr += 2
    elif buffer[0] == 10:
        f.write('cmp ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
        baseAddr += 3
    elif buffer[0] == 11:
        f.write('and ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
        baseAddr += 3
    elif buffer[0] == 12:
        f.write('shl ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
        baseAddr += 3
    elif buffer[0] == 13:
        f.write('shr ' + regs[buffer[1]] + ', ' + regs[buffer[2]] + '\n')
        baseAddr += 3
    elif buffer[0] == 14:
        f.write('add eip, 1\n')
        f.write('push eip\n')
        baseAddr += 2
    elif buffer[0] == 15:
        f.write('mov eip, ' + regs[buffer[1]] + '\n')
    elif buffer[0] == 16:
        f.write('add ' + regs[buffer[2]] + ', ' + regs[buffer[3]] + '\n')
        f.write('mov ' + regs[buffer[1]] + ', DWORD [' + regs[buffer[2]] +']\n')
        baseAddr += 4
    elif buffer[0] == 17:
        f.write('jnz failed \n')
        baseAddr += 2