I have found the following lines in a sample which I try to analyze. Here, are the lines:

   push  afg.00401189       "ntdll.dll" 
   call  GetmoduleHandleW
   neg   eax
   sbb   eax, eax
   neg   eax

So, I do not understand the lines after the call instruction. We have sbb instruction between two neg-operations, but what can be the purpose of that. Can somebody explain that ?

PS: Intuitively, I would say that at the end I have the handle to ntdll.dll in EAX...but the operations between the call and retn are very strange. I am confused.

1 Answer 1


The neg / sbb / neg code in your question is the equivalent of the following C code:

eax = (eax != 0)

In other words, the function returns GetModuleHandleW("ntdll.dll") != NULL.

The neg / sbb / neg construct is explained in detail here:

Reversing: Secrets of Reverse Engineering, section A.2.8.1. Pure Arithmetic Implementations


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.