I try to analyze an .exe file and I have always something like that:
MOV EAX, DWORD PTR DS:[ESI]
I search a lot for that and I know that the expression with [...] means that we store the context of ESI in EAX. For example, when I have in ESI the value 00000101 (5 in decimal), then I would represent it in C like this:
int x = 5; int y = x;
Ok, thats fine, but what if I have an address in ESI ? Something like 001B5355 from which i know that it is an address. How would I represent it then? Maybe use something like a pointer which would point to 001B5355 ?
UnknownType *immediatePointer = &001B5355; UnknownType *pointerEAX = *immediatePointer;
I need help because the whole assembly code of the .exe consists of that kind of lines and I do not know how to represent it to imagine how it could implement it.