i am reversing a malware sample .but getting stucked in a loop below.the line written in the bold letter generated random letter like "/2","/lm32" etc to EDX.The thing is that ECX does not contains any contents memory ,so only register address will be added

004011F7              >  8BD4              MOV EDX,ESP
004011F9              .  03E1              ADD ESP,ECX
004011FB              .  4C                DEC ESP
004011FC              .  66:8B3C24         MOV DI,WORD PTR [ESP]
00401200              .  8BE2              MOV ESP,EDX
00401202              .  8BD6              MOV EDX,ESI
**00401204              .  03D1              ADD EDX,ECX**
00401206              .  50                PUSH EAX
00401207              .  03C2              ADD EAX,EDX
00401209              .  2D 01000000       SUB EAX,1
0040120E              .  81E7 FFFF0000     AND EDI,0FFFF
00401214              .  52                PUSH EDX
00401215              .  8BD7              MOV EDX,EDI
00401217              .  8810              MOV BYTE PTR [EAX],DL
00401219              .  5A                POP EDX
0040121A              .  58                POP EAX
0040121B              .  49                DEC ECX
0040121C              .  83F9 00           CMP ECX,0
0040121F              .  0F84 02000000     JE test.00401227
00401225              .^ EB D0             JMP SHORT test.004011F7

i am adding the below screenshots before stepin and after stepout. before stepin After stepin please let me know what is happening there. Any help will be great. Thanks

  • this is a string copy routine, though written horribly and hard to read. ecx is the index into the string to copy. Jun 26 '16 at 15:57

My guess that ECX is a counter holds the index in C:\WINDOWS\system32\ so the "m32\" you are talking about is part of the string that EDX+ECX points to, a wild guess is it might be some kind of sprintf with the system directory and catsrv.dll.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.