In step 1, we launch EDB against the polymorphed binary and prepare for the dynamic analysis phase. Then, in step 2, we begin to execute each instruction, one at a time, stopping before the first system call:
As EDB executes the first six instructions, RAX, RSI, and RDI are initialized to 0. Starting with the instruction at 400092, as shown in the preceding screenshot, the RSI register is increased by 1, and this is followed by two inc dil instructions that increase the value in RDI by two in total. At 40009b, the 0x2a value is copied into AL and then decreased at 40009d so that AL contains the 0x29 value. The result of all ...
