Learning Malware Analysis

9.3.3 Repeat Instructions (rep)

The movsx instruction can only copy 1, 2, or 4 bytes, but to copy the multi-byte content, the rep instruction is used, along with the string instruction. The rep instruction depends on the ecx register, and it repeats the string instruction the number of times specified by the ecx register. After the rep instruction is executed, the value of ecx is decremented. The following assembly code copies the string "Good" (along with a null terminator) from src to dst:

lea esi,[src] ; "Good",0x0lea edi,[dst]mov ecx,5rep movsb

The rep instruction, when used with the movsx instruction, is equivalent to the memcpy() function in C programming. The rep instruction has multiple forms, which allows early termination, based ...