What is the purpose of the function epilogue in assembly code?

To set up the arguments for the next function call

To save the registers that the function will use

To restore the stack frame and return control to the caller

To allocate local variables on the stack

In a control flow flattened function, what is the role of the state variable?

It holds the function's parameters

It tracks the number of times the function has been called

It stores the return value of the function

It determines which basic block executes next in the dispatch loop

You are analyzing a malware function that validates a command code. The disassembly shows: `cmp eax, 3; je loc_case3; cmp eax, 7; je loc_case7; jmp loc_default`. What is the control flow structure, and what happens if EAX contains 5?

A series of conditional branches; if EAX is 5, execution jumps to the default case.

A switch-case jump table; if EAX is 5, execution jumps to case 5.

A do-while loop that executes at least once; if EAX is 5, it exits to the default.

A loop that iterates until EAX equals 3 or 7; if EAX is 5, the loop continues.

What is the primary characteristic of control flow flattening in obfuscated code?

The code is split into many small functions that call each other

The code is encrypted and decrypted at runtime

The original control flow is transformed into a state machine with a central dispatch loop

All conditional branches are replaced with unconditional jumps

GIAC Reverse Engineering Malware

Domain 2Objective 3

Malware Flow Control and Structures GREM Practice Questions (Page 1)

Part of the Core Reverse Engineering Concepts domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

10concepts

Questions 1–5

1foundation · easy
What is the purpose of the function epilogue in assembly code?
Select an answer first
2foundation · easy
In a control flow flattened function, what is the role of the state variable?
Select an answer first
3application · medium
You are analyzing a malware function that validates a command code. The disassembly shows: `cmp eax, 3; je loc_case3; cmp eax, 7; je loc_case7; jmp loc_default`. What is the control flow structure, and what happens if EAX contains 5?
Select an answer first
4foundation · easy
What is the primary characteristic of control flow flattening in obfuscated code?
Select an answer first
5application · medium
You are reversing a 32-bit Windows malware function. The disassembly shows the function begins with `push ebp; mov ebp, esp` and ends with `pop ebp; ret 8`. The caller passes two arguments on the stack. Which calling convention is this function using?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.