Learning Malware Analysis

4.2 Disassembly Solution

You can read the code line by line and try to determine the program's logic, but it would be easier if you translate it back to some high-level language. To understand the preceding program, let's use the same logic that was covered previously. The preceding code contains four memory references. First, let's label these addresses - ebp-4=a, ebp-8=b , ebp-0Ch=c, and ebp-10H=d. After labeling the addresses, it translates to the following:

mov dword ptr [a], 16hmov dword ptr [b], 5mov eax, [a]add eax, [b]mov [c], eaxmov ecx, [a]sub ecx, [b]mov [d], ecx

Now, let's translate the preceding code into a pseudocode (high-level language equivalent). The code will as follows:

a = 16h    ; h represents hexadecmial, so 16h (0x16) ...