sub_123434 proc near 
mov esi, [ebp-1Ch] 
sub_123434 endp

What means proc near? Can someone possibly explain also the whole function?


Insofar as proc and endp, start here. A good explanation for nearcan be found from this document, which states as follows:

Attribute is NEAR if the Procedure is in the same code segment as the calling program; or FAR if in a different code segment.

The meat of the code is this:

mov esi,[ebp-1Ch]

This bit of code is moving a value from the stack into the esi register. Depending on the compiler used and context, you might stand to glean additional information from register conventions where a value being moved into the esi register is concerned. More specifically, consider the accepted answer from this post.

Also, ebp- (as opposed to ebp+) is a typical sign of arguments that have been passed to a function--of which those values reside on the stack within memory addresses that can be referenced as long as that particular stack frame exists.

Regarding [ebp-1Ch], that's a pointer. In this case, the ebp register contains a memory address (or, more specifically, the value in ebp is treated as a reference to a memory address instead of a literal value), and -1Ch is an offset from that memory address. The lowercase 'h' is just a pneumonic meaning "hex," and to that end, you might also sometimes see offsets and/or hex-based values referenced with a preceding 0x, like this: [ebp-0x1C]. Bearing that in mind, you can really think of that as [ebp-1C].

Do note that ebp and [ebp] are different things. [ebp] means the value inside of ebp is treated as a reference to a memory address. Let's assume ebp has 0xD34DC0DE in it. Now consider the following:

mov esi,ebp
mov esi,[ebp]
mov esi,[ebp-1C]

The results of each of these would be the following:

mov esi,ebp // esi now contains the literal value 0xD34DC0DE

mov esi,[ebp] // esi now contains whatever is inside the memory address 0xD34DC0DE

mov esi,[ebp-1C] // esi now contains whatever is inside the memory address 0xD34DC0C2 (which is 0xD34DC0DE - 1C)

Overall, it looks like that subroutine isn't doing anything but moving data from the stack into a register. As a completely blind assumption, if we assume that each argument passed to its respective function is 4-bytes wide, then [ebp-1C] references the 8th argument passed to perhaps a parent routine of this subroutine. In this case, other values of interest could potentially reside in [ebp], [ebp-04], [ebp-08], [ebp-0C], [ebp-10], [ebp-14], and/or [ebp-18].

Ultimately, we're lacking context here to gather what the purpose of this function you've provided is--though, again, a combination of the aforementioned conventions can possibly tell you a lot about what that mov instruction is potentially a part of. Look into calling conventions for additional clarity. You should be able to infer and research the rest based on the information herein.

| improve this answer | |
  • @Yoonisj: please post a new question about that and provide relevant code snippets – Igor Skochinsky Jul 26 '17 at 9:00
  • call ds: RegOpenKyEx call ds: RegEnumKey mov edi,ds:RegCloseKey what this malware do in this function, if these three function are below each other – Yoonisj Jul 26 '17 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.