Practical Malware Analysis

Recognizing if Statements

Programmers use if statements to alter program execution based on certain conditions. if statements are common in C code and disassembly. We’ll examine basic and nested if statements in this section. Your goal should be to learn how to recognize different types of if statements.

Example 6-8 displays a simple if statement in C with the assembly for this code shown in Example 6-9. Notice the conditional jump jnz at ❷. There must be a conditional jump for an if statement, but not all conditional jumps correspond to if statements.

Example 6-8. C code if statement example

int x = 1;
int y = 2;

if(x == y){
      printf("x equals y.\n");
}else{
      printf("x is not equal to y.\n");
}

Example 6-9. Assembly code for the if statement example ...