Malware Flow Control and Structures GREM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In disassembled code, which construct is used to implement a conditional branch that transfers execution to a different address based on the state of the CPU flags?

   • AA move instruction such as MOV or LEA
   • BA call instruction such as CALL or RET
   • CA stack operation such as PUSH or POP
   • DA jump instruction such as JZ or JNZ
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In disassembly, what data structure is often used to implement a switch-case statement efficiently?

   • AA hash table
   • BA jump table
   • CA binary tree
   • DA linked list
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   In a disassembled function, you see the following sequence: `xor ecx, ecx; loc_401000: ...; inc ecx; cmp ecx, 10; jl loc_401000`. What is the loop structure and its exit condition?

   • AA for loop that runs 10 times, exiting when ECX reaches 10
   • BA do-while loop that runs 11 times
   • CAn infinite loop with a break on ECX == 10
   • DA while loop that runs 9 times, exiting when ECX reaches 9
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   In a disassembled malware function, you see a `jmp dword ptr [eax*4 + table_401000]` instruction. The value in EAX is derived from a user-controlled input byte that is masked with 0x0F. The table at 0x401000 contains 16 pointers. What does this construct represent, and what is the maximum number of distinct destinations?

   • AA function pointer array used for indirect calls, with 16 possible functions.
   • BA loop that iterates 16 times, using EAX as a counter.
   • CA switch-case jump table with up to 16 possible destinations.
   • DA conditional branch that checks if EAX is less than 16.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You are analyzing a decryption routine in a malware sample. The disassembly shows a block that starts with `loc_401000:` followed by the decryption code, then `inc ecx; cmp ecx, 0x100; jne loc_401000`. What type of loop is this, and what is the exit condition?

   • AA do-while loop that executes at least once and exits when ECX equals 0x100.
   • BA for loop that executes exactly 0x100 times, but the exit condition is when ECX is greater than 0x100.
   • CA while loop that checks the condition before executing the body.
   • DAn infinite loop because the condition never becomes false.
   Reveal Solution Discussion Select an answer first