Learning Malware Analysis

9.3.4 Storing Value From Register to Memory (stosx)

The stosb instruction is used to move a byte from the CPU's al register to the memory address specified by edi (the destination index register). Similarly, the stosw and stosd instructions move data from ax (2 bytes) and eax (4 bytes) to the address specified by edi. Normally, the stosb instruction is used along with the rep instruction to initialize all of the bytes of the buffer to some value. The following assembly code fills the destination buffer with 5 double words (dword), all of them equal to 0 (in other words, it initializes 5*4 = 20 bytes of memory to 0). The rep instruction, when used with stosb, is equivalent to the memset() function in C programming:

mov eax, 0lea edi,[dest] ...