I have recently came across the following sequence of assembly instructions.
call ds:WSAStartup push ecx push edi mov ecx, 69E65AC4h mov edi, 2776452Ah pop edi pop ecx jmp short loc_ABCD
Please help me make sense of these particular 4 instructions below:
mov ecx, 69E65AC4h mov edi, 2776452Ah pop edi pop ecx
Why would you move direct values into registers, just to over write them with next 2 instructions?
ADDED: In regards to Rolf Rolles and peter ferrie comments bellow. First off, thank you, guys, for your input. I really appreciate it. What puzzles me the most and seems to be relatively interesting is the fact the the executable in question seems to be clean and clear of code obfuscation of any sort. How relevant is such a small amount of obfuscation for AV defeating purposes? I would assume, not too relevant.
I have also came across the post here on RE What is the purpose of 'mov edi, edi'? . RE user QAZ on the accepted answer mentioned something about support of run time hot patching. Could it be something along those lines?