PUSHAD , 286 386 486 Interesting Instruction

The old PUSH Assembly Instruction is old culture for malware programmers .... is easy see the Assembly Instruction PUSHAD just beginning section .TEXT , .CODE , as SALLITY malware.

The PUSHAD (Code 60h ) (Push ALl Register), put at Stack all Register Values (EAX, EBX,ECX, and so on).

To get values is easy, and very intuitive ! The Instruction POPAD can be used !

Then ... the code below can run


PUSHAD

MOV EAX, 5
MOV ECX, EAX
MOV EBX, 2
MOV EDX, EBX

POPAD 


Why to use PUSHAD ? caue the malware need be the smaller possible ! and all way is used to do it.


The Sallity Malware Code:


00401010  60                          PUSHAD
00401011   E8 00000000       CALL min2.00401016
00401016   5B                        POP EBX
00401017   0FAFC8               IMUL ECX,EAX
0040101A   46                        INC ESI
0040101B   69CF E7FF0351 IMUL ECX,EDI,5103FFE7
00401021   FFC6                    INC ESI
00401023   0FAFFE               IMUL EDI,ESI
00401026   68 7C060000       PUSH 67C
0040102B   0FBEF8              MOVSX EDI,AL

.

.

.