Learning Malware Analysis

9.3.2 Moving From Memory To Memory (movsx)

The movsx instructions are used to move a sequence of bytes from one memory location to another. The movsb instruction is used to move 1 byte from the address specified by the esi register to the address specified by the edi register. The movsw, movsd instructions move 2 and 4 bytes from the address specified by the esi to the address specified by edi. After the value is moved, the esi and edi registers are incremented/decremented by 1, 2, or 4 bytes, based on the size of the data item. In the following assembly code, let's assume that the address labeled as src contained the string "Good", followed by a null terminator (0x0). After executing the first instruction at ➊, esi will contain the start ...