Learning Malware Analysis

9.3.1 String Instructions

The x86 family of processors provides string instructions, which operate on strings. These instructions step through the string (character array) and are suffixed with b, w, and d, which indicating the size of data to operate on (1, 2, or 4 bytes). The string instructions make use of the registers eax, esi, and edi. The register eax, or its sub-registers ax and al, are used to hold values. The register esi acts as the source address register (it holds the address of the source string), and edi is the destination address register (it holds the address of the destination string).

After performing a string operation, the esi and edi registers are either automatically incremented or decremented (you can think of esi ...