Practical Malware Analysis

Disassembling Arithmetic Operations

Many different types of math operations can be performed in C programming, and we’ll present the disassembly of those operations in this section.

Example 6-6 shows the C code for two variables and a variety of arithmetic operations. Two of these are the -- and ++ operations, which are used to decrement by 1 and increment by 1, respectively. The % operation performs the modulo between the two variables, which is the remainder after performing a division operation.

Example 6-6. C code with two variables and a variety of arithmetic

int a = 0;
int b = 1;
a = a + 11;
a = a - b;
a--;
b++;
b = a % 3;

Example 6-7 shows the assembly for the C code shown in Example 6-6, which can be broken down to translate back to C.

Example 6-7. Assembly ...