9.3.4 Storing Value From Register to Memory (stosx)

The stosb instruction is used to move a byte from the CPU's al register to the memory address specified by edi (the destination index register). Similarly, the stosw and stosd instructions move data from ax (2 bytes) and eax (4 bytes) to the address specified by edi. Normally, the stosb instruction is used along with the rep instruction to initialize all of the bytes of the buffer to some value. The following assembly code fills the destination buffer with 5 double words (dword), all of them equal to 0 (in other words, it initializes 5*4 = 20 bytes of memory to 0). The rep instruction, when used with stosb, is equivalent to the memset() function in C programming:

mov eax, 0lea edi,[dest] ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.