Learning Malware Analysis

9.1 Disassembly Challenge

Translate the following code to its high-level equivalent. Use the techniques and the concepts that you have learned so far to solve this challenge:

push ebpmov ebp, espsub esp, 14hmov dword ptr [ebp-14h], 1mov dword ptr [ebp-10h], 2mov dword ptr [ebp-0Ch], 3mov dword ptr [ebp-4], 0loc_401022: cmp dword ptr [ebp-4], 3 jge loc_40103D mov eax, [ebp-4] mov ecx, [ebp+eax*4-14h] mov [ebp-8], ecx mov edx, [ebp-4] add edx, 1 mov [ebp-4], edx jmp loc_401022loc_40103D: xor eax, eax mov esp, ebp pop ebp ret