changed deobfuscation to keep register jumps

2 years ago · f35a70749f
parent e62c872fbe
commit f35a70749f
1 changed files with 1 additions and 1 deletions
--- a/src/vminstrs.cpp
+++ b/src/vminstrs.cpp
@ -69,7 +69,7 @@ void deobfuscate(hndlr_trace_t& trace) {
        break;
      }

-      if (vm::utils::is_jmp(itr->m_instr)) {
+      if (vm::utils::is_jmp(itr->m_instr) && itr->m_instr.operands[0].type != ZYDIS_OPERAND_TYPE_REGISTER) {
        uct_context_free(itr->m_cpu);
        trace.m_instrs.erase(itr);
        break;