A university researcher disassembles a malware sample to learn how one function decrypts the sample configuration. Which term names that work?

Reverse engineering that studies how the decrypt function is written inside the sample is the work. Disassembly lets the researcher read the instructions of the function that decrypts the configuration, which is how reverse engineering explains the sample's logic rather than only its outward behavior. The goal in the stem is understanding that function, not merely running the file. A sandbox detonation that runs the file without reading that function's instructions executes the sample and, as described, never consults the function's instructions. A detonation can show behavior and still leave the decrypt routine unread, so it is not this task. A hash lookup that matches the file digest to a name already held in a reference catalog identifies a file by its digest. A catalog match can name a known sample and still say nothing about how the decrypt function works. A user-awareness email warning students not to open attachments they were not expecting is training for students. A warning about attachments does not examine the function inside the sample. Exam caveat: reading the function shows how the configuration is decrypted. It does not by itself prove that a particular university host already executed the sample. Operational check: on an isolated analysis system, record the decrypt function and the configuration fields it produces, and keep that work off the general campus network.