Disassembly is the reverse of assembling: a disassembler walks the raw machine-code bytes of a binary and decodes each one back into its x86-64 mnemonic using the CPU's own instruction encoding — e.g. the three bytes 48 89 E5 always mean mov rbp, rsp. Tools like IDA Pro, Ghidra or objdump do exactly this before a human ever reads a line of "assembly".
Once every instruction is known, the analyst groups them into basic blocks — straight-line runs of code with one entry and one exit — and draws an edge for every jump, call and fall-through between them. The result is a control-flow graph (CFG): the same shape IDA Pro's graph view or Ghidra's function graph draws automatically for every function.
With the CFG in front of them, an analyst looks for known attack patterns. Two are simulated here: a tight loop that xors a buffer byte-by-byte against a constant key is the textbook signature of a payload decrypting/deobfuscating itself at runtime; and the API sequence VirtualAllocEx → WriteProcessMemory → CreateRemoteThread is the classic process-injection pattern — allocate memory in a remote process, write shellcode into it, then start a thread that runs it. Neither call is suspicious alone; it's the sequence that gives it away.
- Malicious sample — off: a benign array-sum loop. On: a payload that XOR-decodes itself, then injects into another process.
- Start disassembly — replays the byte stream, decoding one instruction at a time, then assembles the CFG and highlights anything suspicious.