Learning Malware Analysis

6.7 Disassembly Solution

Let's start by assigning the symbolic names to the address (ebp-4). After assigning the symbolic names to the memory address references, we get the following code:

mov dword ptr [x], 1cmp dword ptr [x], 0  ➊jnz loc_40101C  ➋mov eax, [x]  ➍xor eax, 2mov [x], eaxjmp loc_401025  ➌loc_40101C:  mov ecx, [x]  ➎xor ecx, 3  mov [x], ecx   ➏  loc_401025:

In the preceding code, notice the cmp and jnz instructions at ➊ and ➋ (this is a conditional statement) and note that jnz is the same as jne (jump if not equal to). Now that we have identified the conditional statement, let's try to determine what type of conditional statement this is (if, or if/else, or if/else if/else, and so on); to do that, focus on the jumps. The conditional jump ...