Learning Malware Analysis

3.6 Disassembly Solution

The preceding program copies a value from one memory location to another. At ➊, the program copies a dword value 1 into a memory address (specified by ebp-4). At ➋, the same value is copied into the eax register, which is then copied into a different memory address, ebp-8, at ➌.

The disassembled code might be difficult to understand initially, so let me break it down to make it simple. We know that in a high-level language like C, a variable that you define (for example, int val;) is just a symbolic name for a memory address (as mentioned previously). Going by that logic, let's identify the memory address references and give them a symbolic name. In the disassembled program, we have two addresses (within square brackets):  ...