O'Reilly logo

Learning Malware Analysis by Monnappa K A

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

9.2 Disassembly Solution

In the preceding code, the first two instructions (push ebp and mov ebp, esp) represent function prologue. Similarly, the two lines before the last instruction, ret, represent the function epilogue (mov esp,ebp and pop ebp). We know that the function prologue and epilogue are not part of the code, but they are used to set up the environment for the function, and hence they can be removed to simplify the code. The third instruction, sub,14h, suggests that 20 (14h) bytes are allocated for local variables; we know that this instruction is also not part of the code (it's just used for allocating space for local variables), and can also be ignored. After removing the instructions that are not part of the actual code, we ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required