How to identify encryption functions

The following screenshot demonstrates sections, which are numbered from 1 to 4. These sections are key to understanding and identifying the encryption algorithms that are used in malware:

Figure 24: Things to pay attention to when identifying the encryption algorithm

To identify an encryption function, there are four things you should be searching for, as shown in the following table:

1	Sequential data read	The encryption function has to read data from memory—not a fixed value, but an array of bytes, one by one.
2	Encrypting the value	There's no encryption loop without encryption! It may sound obvious, but a loop with sequential read and sequential write can be easily misunderstood as an encryption loop, and they are just data or memory copiers.
3	Sequential data write	A sequential data write is also easy to miss. If the function is writing by a fixed address, it's possible that it is just generating a checksum...