GREM Windows Assembly Code Reversing 3

Question 1

What does the x86 instruction 'LEA EAX, [EBP-8]' store in EAX?

Accepted Answer

The effective address EBP-8, without performing a memory read

Answer

The value stored at the memory address EBP minus 8

Answer

The value 8 subtracted from the current value in EAX

Answer

The result of EBP XOR 8

Question 2

In Windows x64 calling convention (Microsoft ABI), which four registers are used to pass the first four integer/pointer arguments?

Accepted Answer

RCX, RDX, R8, R9

Answer

EAX, EBX, ECX, EDX

Answer

RDI, RSI, RDX, RCX

Answer

RAX, RBX, RCX, RDX

Question 3

A malware analyst observes repeated use of 'ROL' and 'ROR' instructions on a buffer. What technique does this most likely indicate?

Accepted Answer

A custom or lightweight encryption/obfuscation routine

Answer

Stack unwinding for exception handling

Answer

SIMD parallel processing of image data

Answer

Standard CRC32 checksum calculation

Question 4

When analyzing a Windows PE file in assembly, what does the instruction 'CALL DWORD PTR [EAX+0x3C]' indicate architecturally?

Accepted Answer

An indirect call through a function pointer stored in a structure or vtable at offset 0x3C from EAX

Answer

A direct call to a fixed address at 0x3C

Answer

A call to a system interrupt with index 0x3C

Answer

A tail call optimization generated by the compiler

Question 5

What is the purpose of the 'REPE SCASB' instruction sequence when used with AL=0 in malware shellcode?

Accepted Answer

Scans EDI forward to find the first zero byte (null terminator), effectively measuring string length

Answer

Copies a string from ESI to EDI one byte at a time

Answer

Fills a buffer at EDI with zero bytes

Answer

Searches backwards from EDI for a byte matching AL

Question 6

During dynamic analysis of malware, you observe the sequence 'PUSHAD' followed much later by 'POPAD'. What technique does this pattern suggest?

Accepted Answer

Packer or unpacker stub preserving register state across a decompression routine

Answer

Exception handler registration via SEH chains

Answer

A system call gateway switching from user to kernel mode

Answer

Position-independent code locating its own base address

Question 7

In a Windows PE, the Import Address Table (IAT) entries are patched by the OS loader at load time. After loading, what does a CALL to an IAT entry actually do?

Accepted Answer

Jumps to the actual address of the imported function in its host DLL

Answer

Executes a software interrupt that traps into the NT kernel

Answer

Triggers a structured exception to resolve the import lazily

Answer

Looks up the function name in the EAT of NTDLL