Which of the following are common flow control instructions used in malware? (Choose two)

Question

Options

• AJMP
• BXOR
• CCALL
• DPOP

• A
  76% (35)
• B
  7% (3)
• D
  17% (8)

Explanation

JMP and CALL are both flow control instructions because they redirect the CPU's execution path. JMP causes an unconditional branch to another memory address - malware uses this to loop, evade analysis, or jump to shellcode. CALL transfers execution to a subroutine while pushing a return address onto the stack, making it essential for malware invoking Windows API functions or modular payloads.

XOR is a distractor: it's a bitwise logical operation used heavily in malware for encryption and obfuscation, but it operates on data values - it doesn't redirect execution flow.

POP is also a distractor: it removes a value from the top of the stack into a register, which is a data movement operation, not flow control (even though the stack is involved in calls/returns).

Memory tip: Think "flow = where does execution GO next." Only JMP and CALL answer that question - JMP goes there directly, CALL goes there and comes back. XOR and POP just transform or move data without changing where the CPU fetches its next instruction.

No community discussion yet for this question.