Learning Malware Analysis

3.3 Moving Values From Memory To Registers

Before looking at the assembly instruction to move a value from the memory to a register, let's try to understand how values reside in the memory. Let's say you have defined a variable in your C program:

int val = 100;

The following list outlines what happens during the runtime of the program:

1. An integer is 4 bytes in length, so the integer 100 is stored as a sequence of 4 bytes (00 00 00 64) in the memory.
2. The sequence of four bytes is stored in the little-endian format mentioned previously.
3. The integer 100 is stored at some memory address. Let's assume that 100 was stored at the memory address starting at 0x403000; you can think of this memory address labeled as val:

To move a value from the ...