I have disassembled the file WinLoad.exe as a 32-bit PE for i386 ISA, and I'll show some of the instructions I do not get are for:
call 0x00408b6d <--- test al,al je 0x0040109f lea eax,[esp+0x20] <---
First of all, what is at the memory address the call instruction is at? Second, what is the leave instruction do?
cmp BYTE PTR [esp+0x12],0x0 <--- mov eax,DWORD PTR [esp+0x20] mov DWORD PTR [esp+0x1c],eax
Third, how does the compare instruction make sense?
Last, what does this do?
rep movs DWORD PTR es:[edi],DWORD PTR ds:[esi]
Also, how I can tell if this file is statically or dynamically linked? I mean, when executed, if it's statically linked it must've been compiled that way. If dynamic there must be other program running. Basically, this is suppose to be the first executable on boot of a PE.