4.2 Disassembly Solution

You can read the code line by line and try to determine the program's logic, but it would be easier if you translate it back to some high-level language. To understand the preceding program, let's use the same logic that was covered previously. The preceding code contains four memory references. First, let's label these addresses - ebp-4=a, ebp-8=b , ebp-0Ch=c, and ebp-10H=d. After labeling the addresses, it translates to the following:

mov dword ptr [a], 16hmov dword ptr [b], 5mov eax, [a]add eax, [b]mov [c], eaxmov ecx, [a]sub ecx, [b]mov [d], ecx

Now, let's translate the preceding code into a pseudocode (high-level language equivalent). The code will as follows:

a = 16h    ; h represents hexadecmial, so 16h (0x16) ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.