Learning Malware Analysis

6.2 Conditional Jumps

In conditional jumps, the control is transferred to a memory address based on some condition. To use a conditional jump, you need instructions that can alter the flags (set or clear). These instructions can be performing an arithmetic operation or a bitwise operation. The x86 instruction provides the cmp instruction, which subtracts the second operand (source operand) from the first operand (destination operation) and alters the flags without storing the difference in the destination. In the following instruction, if the eax contained the value 5, then cmp eax,5 would set the zero flag (zf=1), because the result of this operation is zero:

cmp eax,5  ; subtracts eax from 5, sets the flags but result is not stored

Another ...