I'm trying to understand exactly what is happening in the below loop. I've commented in what I believe is happening. I came to these conclusions by googling every op code and trying to understand what it means in addition to running the code in ImmunityDebugger and observing behavior.
I'm not sure if that is the most efficient means of research. Please let me know if there are other best practices for discovering functionality of relatively small selections of code.
What happens at memory address
00401053? What does XOR do in this case?
0040104B |. 31C9 XOR ECX,ECX 0040104D |> 8A81 58214000 /MOV AL,BYTE PTR DS:[ECX+402158] ;Move first byte of [ECX+402158] into AL 00401053 |. 34 7D |XOR AL,7D ;Not sure what this means 00401055 |. 3A81 40214000 |CMP AL,BYTE PTR DS:[ECX+402140] ;Compare AL with the first byte of [ECX+402140] 0040105B 75 1E |JNZ SHORT i_am_hap.0040107B ;Jump out of loop if not zero << What does that mean? 0040105D |. 41 |INC ECX ;increment ECX value 0040105E |. 83F9 18 |CMP ECX,18 ;loop runs 18 times 00401061 ^7C EA \JL SHORT i_am_hap.0040104D ;If above CMP fails restart the loop