Книга: Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
Назад: Lab 19-3 Solutions
Дальше: Lab 20-2 Solutions

as the URL.

  • This program downloads a file from a remote server and stores it as c:\tempdownload.exe on the local system.

  • .

    begins with a call to the new operator at , which tells us that this code is creating an object. A reference to the object is returned in EAX, and is eventually stored in var_8 at and var_4 at . var_4 is moved into ECX at , indicating that it will be passed as the this pointer in a function call. A pointer to the URL is then stored at the beginning of the object, followed by a call to the function sub_401040, which is shown in .

    , we see the this pointer in ECX accessed and stored in var_4 at . The remainder of the code is arguments being placed on the stack for the call to URLDownloadToFileA. To obtain the URL that will be used for the function call, the this pointer is accessed at , then the first data element stored in the object is accessed at , and then it’s pushed onto the stack at .

    Recall from the main method that the first element stored in the object was the URL string . The main method returns, and the program is finished executing.

    Назад: Lab 19-3 Solutions
    Дальше: Lab 20-2 Solutions

    sss
    sss

    © RuTLib.com 2015-2018