       Themid'
         ,     ,  
  ,          xprotector'
   


1. SIDT block

push reg
push reg
...
sidt [esp-2]
...
pop reg
...
pop reg

2.RDTSC block

push eax
push edx
...
rdtsc
...
pop edx
...
pop eax

3. PUSHA/POPA block

pusha
... ;,    
popa


4. Idle mov instruction

mov reg, reg -  

5. Idle jcc instruction

jcc @@l1
nop
nop
nop
... ;  nop
nop
 @@l1:
...


6. Jmp-1 block

jmp @@l1
... ;,     

7. Call-1 block

call @@l1
... ; jmp-1

 @@l1:
pop reg ;   
...

8. Antitrace-1 construction

push    0
push    reg
call    @@l1
; ---------------------------------------------------------------------------
             db  20h
; ---------------------------------------------------------------------------
pop     reg
retn

 @@l1:
pop     reg
mov     [esp-4+arg_4], reg
add     [esp-4+arg_4], 15h
inc     reg
push    reg
retn



9. Antitrace-2 construction

  ,  
    oreans.sys

10. Self-modifying xor block

call    _synchro_proc1
; ---------------------------------------------------------------------------
db    0
push    edx
push    eax
push    eax
sidt    qword ptr [esp-2]
mov     edx, 481BF691h
xor     edx, 481BF69Dh
pop     eax
add     eax, edx
mov     word ptr [eax+2], 1274h
mov     eax, [eax]
shr     eax, 10h
call    $+5
pop     edx
add     edx, 11h
mov     [ebp+4BF25F5h], edx
xor     [edx], eax
jmp     short $+2
; ---------------------------------------------------------------------------
dd 1B9Dh
db    0
db  52h ; R
db  4Fh ; O
db  86h ; ?
db 0F3h ; ?
db 0B2h ; -
db  3Eh ; >
db  2Ch ; ,
db  9Bh ; U
db 0F2h ; ?
; ---------------------------------------------------------------------------
xor     [edx], eax
push    0FFFFFFFFh
call    _set_current_int3

 _synchro_proc1  _set_current_int3       ,
   :

WinLicen:00AAE765 _synchro_proc1  proc near
WinLicen:00AAE765                 push    eax
WinLicen:00AAE766                 mov     ax, cs
WinLicen:00AAE769                 and     al, 3
WinLicen:00AAE76B                 or      al, al
WinLicen:00AAE76D                 jz      loc_AAE78C
WinLicen:00AAE773                 push    eax
WinLicen:00AAE774                 push    ebx
WinLicen:00AAE775                 mov     ebx, 2
WinLicen:00AAE77A                 mov     eax, [ebp+4BF03E9h]
WinLicen:00AAE780
WinLicen:00AAE780 loc_AAE780:                             ; CODE XREF: _synchro_proc1+1F
WinLicen:00AAE780                 xchg    bl, [eax]
WinLicen:00AAE782                 or      bl, bl
WinLicen:00AAE784                 jnz     loc_AAE780
WinLicen:00AAE78A                 pop     ebx
WinLicen:00AAE78B                 pop     eax
WinLicen:00AAE78C
WinLicen:00AAE78C loc_AAE78C:                             ; CODE XREF: _synchro_proc1+8
WinLicen:00AAE78C                 pop     eax
WinLicen:00AAE78D                 inc     dword ptr [esp+0]
WinLicen:00AAE790                 retn
WinLicen:00AAE790 _synchro_proc1  endp

WinLicen:00AAE796 _set_current_int3 proc near
WinLicen:00AAE796
WinLicen:00AAE796 var_A           = qword ptr -0Ah
WinLicen:00AAE796 arg_0           = dword ptr  4
WinLicen:00AAE796
WinLicen:00AAE796                 push    eax
WinLicen:00AAE797                 push    [esp+4+arg_0]
WinLicen:00AAE79B                 call    dword ptr [ebp+4BF2A11h]
WinLicen:00AAE7A1                 push    eax
WinLicen:00AAE7A2                 sidt    qword ptr [esp-2]
WinLicen:00AAE7A7                 pop     eax
WinLicen:00AAE7A8                 add     eax, 1Ch
WinLicen:00AAE7AB                 push    ebx
WinLicen:00AAE7AC                 mov     ebx, [esp+0Ch]
WinLicen:00AAE7B0                 mov     [eax-4], bx
WinLicen:00AAE7B4                 mov     [eax+2], bx
WinLicen:00AAE7B8                 pop     ebx
WinLicen:00AAE7B9                 mov     ax, cs
WinLicen:00AAE7BC                 and     al, 3
WinLicen:00AAE7BE                 or      al, al
WinLicen:00AAE7C0                 jz      loc_AAE7CF
WinLicen:00AAE7C6                 mov     eax, [ebp+4BF03E9h]
WinLicen:00AAE7CC                 mov     byte ptr [eax], 0
WinLicen:00AAE7CF
WinLicen:00AAE7CF loc_AAE7CF:                             ; CODE XREF: _set_current_int3+2A
WinLicen:00AAE7CF                 pop     eax
WinLicen:00AAE7D0                 inc     dword ptr [esp+4+var_A+6]
WinLicen:00AAE7D3                 retn    4
WinLicen:00AAE7D3 _set_current_int3 endp


11. Ring0 decryptor type-1

call    _load_from_pagefile1 ;< EBP>
; ---------------------------------------------------------------------------
db    0
; ---------------------------------------------------------------------------
mov     dx, bx
push    reg
push    reg
sidt    qword ptr [esp-2]
mov     reg, 7B448236h
xor     reg, 7B44823Ah
add     reg, [esp]
add     esp, 4
mov     word ptr [reg+2], 0C02Bh
sub     esp, 4
call    $+5
pop     dword ptr [esp]
add     dword ptr [esp], 51h ; 'Q'
push    dword ptr [esp]
call    dword ptr [ebp+4BF2A11h]
push    dword ptr [esp]
pop     word ptr [reg-4]
pop     word ptr [reg+2]

 _load_from_pagefile1   ,    
    EBP,       
  ,       EP

12. Labeled instruction

     delinstr.
