Learning Malware Analysis

7.2 Disassembly Solution

The preceding code consists of two memory addresses (ebp-4 and ebp-8); let's rename ebp-4 to x and ebp-8 to y. The modified code is shown here:

 mov dword ptr [y], 1 mov dword ptr [x], 0loc_401014: cmp dword ptr [x], 4  ➋ jge loc_40102E  ➌  mov eax, [y] add eax, [x] mov [y], eax mov ecx, [x]  ➎ add ecx, 1 mov [x], ecx  ➏ jmp loc_401014 ➊ loc_40102E:  ➍

In the preceding code, at ➊, there is a backward jump to loc_401014, indicating a loop; so, let's rename loc_401014 to loop. At ➋ and ➌, there is a condition check for the variable x (using cmp and jge); the code is checking whether x is greater than or equal to 4. If the condition is met, it will jump outside of the loop to loc_40102E (at ➍). The value of x is incremented ...