Learning Malware Analysis

4. Arithmetic Operations

You can perform addition, subtraction, multiplication, and division in assembly language. A addition and subtraction are performed using the add and sub instructions, respectively. These instructions take two operands: destination and source. The add instruction adds the source and destination and stores the result in the destination. The sub instruction subtracts the source from the destination operand, and the result is stored in the destination. These instructions set or clear flags in the eflags register, based on the operation. These flags can be used in the conditional statements. The sub instruction sets the zero flag, (zf), if the result is zero, and the carry flag, (cf), if the destination value is less than ...