GREM Windows Assembly Code Reversing 2

Question 1

In x86 assembly, what does the instruction 'MOVZX EAX, BYTE PTR [ESI]' accomplish?

Accepted Answer

Zero-extends the byte at address ESI into the full 32-bit EAX register

Answer

Moves a byte from memory at ESI into AL only

Answer

Sign-extends the byte at address ESI into EAX

Answer

Moves the address stored in ESI into EAX

Question 2

Which Windows API function is commonly called by malware to locate the base address of a loaded DLL without importing it explicitly?

Accepted Answer

GetModuleHandleA

Answer

LoadLibraryA

Answer

GetProcAddress

Answer

VirtualAlloc

Question 3

When reversing a Windows binary, you see 'PUSH EBP; MOV EBP, ESP' at the start of a function. What is the primary purpose of this prologue?

Accepted Answer

Establishes a new stack frame by saving the caller's base pointer

Answer

Allocates heap memory for local variables

Answer

Saves all general-purpose registers before the call

Answer

Switches the processor from user mode to kernel mode

Question 4

In IDA Pro, what does the 'xref' (cross-reference) feature primarily help a reverse engineer determine?

Accepted Answer

All locations in code that call or reference a given address

Answer

The number of CPU cycles a function consumes

Answer

The original source file name of a function

Answer

Compiler optimization level applied to a code block

Question 5

A malware sample executes 'SUB ESP, 0x20' inside a function body after the standard prologue. What does this instruction accomplish?

Accepted Answer

Decrements the stack pointer to allocate 32 bytes of local stack space

Answer

Adds 32 bytes to the stack pointer, freeing space

Answer

Stores the value 0x20 into ESP directly

Answer

Aligns the stack to a 32-byte boundary by rounding down

Question 6

Which calling convention requires the CALLER to clean up the stack after the called function returns, and is the default for C on Windows x86?

Accepted Answer

__cdecl

Answer

__stdcall

Answer

__fastcall

Answer

__thiscall

Question 7

During static analysis of a PE binary, you find the instruction 'JNZ SHORT 0x401050'. Under what condition does execution jump to 0x401050?

Accepted Answer

When the Zero Flag (ZF) is cleared (0)

Answer

When the Zero Flag (ZF) is set to 1

Answer

When the Carry Flag (CF) is set

Answer

When the Sign Flag (SF) differs from the Overflow Flag (OF)