While analyzing a 32-bit malware binary, you find a function that receives its arguments in ECX and EDX, with any additional arguments on the stack. The function ends with `ret 4`. How many arguments does this function take, and what is the calling convention?

3 arguments; thiscall with 1 in ECX and 2 on the stack

1 argument; stdcall with the argument in ECX

2 arguments; fastcall with both in registers and none on the stack

3 arguments; fastcall with 2 in registers and 1 on the stack

You are analyzing a 32-bit Windows API function that uses the stdcall convention. The function takes two arguments. Which of the following is the most reliable way to confirm that the function uses stdcall rather than cdecl?

The function begins with `push ebp; mov ebp, esp`.

The arguments are passed in ECX and EDX.

The function ends with `ret 8` to clean up the two arguments.

The caller executes `add esp, 8` after the call.

What does the CALL instruction do before transferring control to the target function?

Pushes the return address onto the stack

Pops the return address from the stack

A 32-bit function's prologue is `push ebp; mov ebp, esp; sub esp, 8`. The function stores two 4-byte values at [ebp-4] and [ebp-8]. Later, it executes `leave; ret`. What is the purpose of the `leave` instruction in this context?

It restores ESP to the value it had before the `sub esp, 8` and pops the saved EBP

It pops the return address from the stack and jumps to it

It clears the local variables at [ebp-4] and [ebp-8] before returning

It sets EBP to the current ESP value to prepare for the return

GIAC Reverse Engineering Malware

Domain 2Objective 2

Reversing Functions in Assembly GREM Practice Questions (Page 3)

Part of the Core Reverse Engineering Concepts domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 11–15

11foundation · easy
Which conditional jump instruction in x86 is taken when the zero flag (ZF) is set?
Select an answer first
12application · medium
While analyzing a 32-bit malware binary, you find a function that receives its arguments in ECX and EDX, with any additional arguments on the stack. The function ends with `ret 4`. How many arguments does this function take, and what is the calling convention?
Select an answer first
13application · medium
You are analyzing a 32-bit Windows API function that uses the stdcall convention. The function takes two arguments. Which of the following is the most reliable way to confirm that the function uses stdcall rather than cdecl?
Select an answer first
14foundation · easy
What does the CALL instruction do before transferring control to the target function?
Select an answer first
15application · medium
A 32-bit function's prologue is `push ebp; mov ebp, esp; sub esp, 8`. The function stores two 4-byte values at [ebp-4] and [ebp-8]. Later, it executes `leave; ret`. What is the purpose of the `leave` instruction in this context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.