[ENABLE]

alloc(newmem1,2048)

label(returnhere1)

label(originalcode1)

newmem1:

push ffffffff

call sleep

originalcode1:

pushfd

push edi

push esp

pop edi

add edi,00000004

jmp returnhere1

"BlackCipher.aes"+26885DE:

jmp newmem1

nop 5

returnhere1:

alloc(newmem2,2048)

label(returnhere2)

label(originalcode2)

newmem2:

push ffffffff

call sleep

originalcode2:

pushfd

sub esp,00000004

jmp returnhere2

"BlackCipher.aes"+201769C:

jmp newmem2

nop 2

returnhere2:

alloc(newmem3,2048)

label(returnhere3)

label(originalcode3)

newmem3:

push ffffffff

call sleep

originalcode3:

pushfd

sub esp,04

mov [esp],edi

jmp returnhere3

02AC1CCA:

jmp newmem3

nop 2

returnhere3:

[DISABLE]