- Gather information
- IAT
- strings
- dynamic analysis
- Identify function of interest
- Identify CALLs
- Identify algorithms and data structures
- Pseudo-code it!
- if having trouble, draw the memory and CPU and map what happens at each instruction
- Rename function(s), argument(s), variable(s)
- Add comments
- GOTO 2