def get_vmp_import_func_list():
    segm = ida_segment.get_segm_by_name('.vmp0')
    if (segm is None) or (segm.sclass != SEG_CODE):
        return None
    func_list = []
    ea = segm.start_ea
    while True:
        func = ida_funcs.get_next_func(ea)
        if (func is None):
            break
        ea = func.start_ea
        if (ea >= segm.end_ea):
            break
        xref = ida_xref.get_first_fcref_to(ea)
        if (xref == ida_idaapi.BADADDR):
            continue
        while (xref != ida_idaapi.BADADDR):
            if (xref >= segm.start_ea) and (xref < segm.end_ea):
                break
            xref = ida_xref.get_next_fcref_to(ea, xref)
        else:
            func_list.append(ea)
    return func_list

def get_original_import_addr(vmp_import_addr):
    start_addr = GetRIP()
    save_rsp = GetRSP()
    # call $+vmp_import_addr
    WriteByte(start_addr, 0xE8)
    WriteDword(start_addr + 1, vmp_import_addr - 5)
    orig_import_addr = None
    for _ in range(MAX_STEPS):
        StepIn()
        rip = GetRIP()
        inst = ReadByte(rip)
        # retn ?
        if (inst == 0xC3) or (inst == 0xC2):
            rsp = GetRSP()
            orig_import_addr = ReadQword(rsp)
            break
    SetRIP(start_addr)
    SetRSP(save_rsp)
    return orig_import_addr

# callback for tracing instructions
def hook_code(uc, address, size, orig_addr_wrapper):
    inst = uc.mem_read(address, 1)
    # retn ?
    if (inst[0] != 0xC3) and (inst[0] != 0xC2):
        return
    esp = uc.reg_read(UC_X86_REG_ESP)
    addr_size = 0
    if (UC_MODE == UC_MODE_64):
        addr_size = 8
        fmt = '<Q'
    elif (UC_MODE == UC_MODE_32):
        addr_size = 4
        fmt = '<L'
    if (addr_size != 0):
        addr = uc.mem_read(esp, addr_size)
        orig_addr_wrapper[0], = struct.unpack(fmt, addr)
    uc.emu_stop()
def get_orig_import_func_list(dump_data, vmp_func_list):
    orig_addr_wrapper = [0]
    image_size = (len(dump_data) + 0xFFFF) & ~0xFFFF
    try:
        # Initialize emulator
        mu = Uc(UC_ARCH_X86, UC_MODE)
        # tracing all instructions with customized callback
        mu.hook_add(UC_HOOK_CODE, hook_code, orig_addr_wrapper)
        # map memory for this emulation
        mu.mem_map(BASE_ADDR, image_size + STACK_SIZE)
        # write machine code to be emulated to memory
        mu.mem_write(BASE_ADDR, dump_data)
    except UcError as e:
        print('Unicorn Engine Error: %s' % e)
        return None
    orig_func_list = []
    for vmp_func_rva in vmp_func_list:
        try:
            # write vmp function call code
            call_code = b'\xE8' + struct.pack('<L', vmp_func_rva - 5)
            mu.mem_write(BASE_ADDR, call_code)
            # initialize stack
            mu.reg_write(UC_X86_REG_ESP,
                         BASE_ADDR + image_size + STACK_SIZE // 2)
            orig_addr_wrapper[0] = 0
            # emulate machine code in infinite time
            mu.emu_start(BASE_ADDR, BASE_ADDR + len(dump_data))
            if (orig_addr_wrapper[0] != 0):
                orig_func_list.append((vmp_func_rva,
                                       orig_addr_wrapper[0]))
        except UcError as e:
            print('Unicorn Engine Error: %s' % e)
    return orig_func_list