Learning Malware Analysis

2.2.2 Functions Window

The functions window displays all the functions recognized by IDA, and it also shows the virtual address where each function can be found, the size of each function, and various other properties of the function. You can double-click on any of these functions to jump to a selected function. Each function is associated with various flags (such as R, F, L, and so on). You can get more information about these flags in the help file (by pressing F1). One of the useful flags is the L flag, which indicates that the function is a library function. Library functions are compiler-generated and are not written by a malware author; from a code analysis perspective, we would be interested in analyzing the malware code, not the library ...