He can only replace bytes in a reversed executable. If he adds or removes bytes, the resultant .exe would be non-functional. Comment: Wrong. Are you referring to a hex editor instead of a disassembler? *** Actually, reverse engineers are allowed to do all of these things and typically do. Replacing bytes is simply patching. But removing bytes can also be usefull, for example, to cutt-off the wrapper for better perception. Adding bytes is rarely useful, but can be done in some cases. Basically, reverse engineers can ARE ALLOWED to edit the file in any way needed. The question should have been something like: "Which of these would a reverse engineer USUALLY/ TYPICALLY do with the disassembled malware executable?" -- Please rephrase this question and better the complete malware analysis section, because the authors of the question obviously lack competence.