关于unicorn去搞VMP的iat那点事

.vmp00:004FBE6B 90                                      nop                     ; No Operation.vmp00:004FBE6C 9F                                      lahf                    ; Load Flags into AH Register.vmp00:004FBE6D 98                                      cwde                    ; AX -> EAX (with sign).vmp00:004FBE6E 58                                      pop     eax.vmp00:004FBE6F E9 62 5A EC FF                          jmp     loc_3C18D6.vmp00:003C18D6 87 04 24                                xchg    eax, [esp-4+arg_0] ; Exchange Register/Memory with Register.vmp00:003C18D9 E9 F5 D8 F2 FF                          jmp     loc_2EF1D3      ; Jump.vmp00:002EF1D3 50                                      push    eax.vmp00:002EF1D4 B8 3F 15 28 00                          mov     eax, 28153Fh.vmp00:002EF1D9 E9 2F 45 16 00                          jmp     loc_45370D      ; Jump.vmp00:0045370D 8B 80 51 E1 00 00                       mov     eax, [eax+0E151h].vmp00:00453713 8D 80 CD 4A 08 4C                       lea     eax, [eax+4C084ACDh] ; Load Effective Address.vmp00:00453719 87 04 24                                xchg    eax, [esp+0]    ; Exchange Register/Memory with Register.vmp00:0045371C E9 8C 35 E4 FF                          jmp     nullsub_32      ; Jump.vmp00:00296CAD C3                                      retn                    ; Return Near from Procedure

mov     eax, 28153Fhmov     eax, [eax+0E151h]lea     eax, [eax+4C084ACDh]xchg    eax, [esp+0]