Pattern Recognition: Loops, Switches, Strings

• Loops: a backward jump (target address < current) closing a block; a counter register incremented each pass (inc/add).
• Switch tables: an indirect jmp [table + index*8] — a jump through a computed address is a compiled switch.
• Strings: byte comparisons, rep string ops, or calls to strcmp/strlen; cross-reference (xref) data to code.
• Function boundaries: prologue push rbp; mov rbp, rsp and epilogue leave; ret.
• API calls: call into imported functions reveal intent (network, crypto, file, registry).