I am reading through the 'Practical Malware Analysis' book and got to page 74 which says:

lea ebx, [eax*4+4] is the functional equivalent of ebx = (eax+1)* 5 where eax is a number.

As of my understanding, lea ebx, [eax*4 + 4] should multiply eax value by 4, add 4 to it and then store it back in ebx, which is different than (eax+1) * 5.

Is that a typo? Or I got things wrong?

I think it should be: ebx = (eax+1) * 4


This is a typo. The instruction lea ebx,[eax*4+4] will set ebx to 4*eax+4 or 4*(eax+1).

I believe I found a revision online of that book which has:

For example, it is common to see an instruction such as lea ebx, [eax*5+5], where eax is a number, rather than a memory address. This instruction is the functional equivalent of ebx = (eax+1)*5, ...

so it seems as though it was corrected at some point. Note that, technically, lea ebx, [eax*5+5] is really implemented as lea ebx, [eax*4+eax+5].

  • The question is: lea ebx, [eax*4+4] is the same as ebx = (eax+1)*5 – Ahmad Kouraiem Jun 13 '17 at 4:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.