Learning Malware Analysis

3.4 Moving Values From Registers To Memory

You can move a value from a register to memory by swapping operands so that the memory address is on the left-hand side (destination) and the register is on the right-hand side (source):

mov [0x403000],eax ; moves 4 byte value in eax to memory location starting at 0x403000mov [ebx],eax   ; moves 4 byte value in eax to the memory address specified by ebx

Sometimes, you will come across instructions like those that follow. These instructions move constant values into a memory location; dword ptr just specifies that a dword value (4 bytes) is moved into the memory location. Similarly, word ptr specifies that a word (2 bytes) is moved into the memory location:

mov dword ptr [402000],13498h ; moves dword ...