Skip to main content
added ida tag
Link
Joel
  • 125
  • 5
added code examples
Source Link
Joel
  • 125
  • 5
.text:000000000041063A
.text:000000000041063A clearEAX        proc near               ; CODE XREF: sub_40E4B4+37p
.text:000000000041063A                                         ; sub_40E528+DFp ...
.text:000000000041063A                 xor     eax, eax        ; Logical Exclusive OR
.text:000000000041063C                 retn                    ; Return Near from Procedure
.text:000000000041063C clearEAX        endp
.text:000000000041063C
.text:000000000041063D

Its address being referenced (0x4113B2) It being called directly in context: (0x4113CB)

.text:00000000004113AC                 push    rbp
.text:00000000004113AD                 mov     edx, offset unk_514200
.text:00000000004113B2                 mov     esi, offset clearEAX
.text:00000000004113B7                 push    rbx
.text:00000000004113B8                 mov     ebx, edi
.text:00000000004113BA                 sub     rsp, 28h        ; Integer Subtraction
.text:00000000004113BE                 mov     rdi, rsp
.text:00000000004113C1                 call    nullsub_3       ; Call Procedure
.text:00000000004113C6                 mov     edi, offset unk_514200
.text:00000000004113CB                 call    clearEAX        ; Call Procedure
.text:00000000004113D0                 mov     rax, cs:qword_514398
.text:00000000004113D7                 test    rax, rax        ; Logical Compare
.text:00000000004113DA                 jz      short loc_4113E0 ; Jump if Zero (ZF=1)
.text:00000000004113DC                 mov     edi, ebx
.text:00000000004113DE                 call    rax ; qword_514398 ; Indirect Call Near Procedure
.text:00000000004113E0

However, I don't think, that the context does matter here because the context is nowhere near similar. Meaning that it's not the combination of moving the address first then calling it or something like that.

.text:000000000041063A
.text:000000000041063A clearEAX        proc near               ; CODE XREF: sub_40E4B4+37p
.text:000000000041063A                                         ; sub_40E528+DFp ...
.text:000000000041063A                 xor     eax, eax        ; Logical Exclusive OR
.text:000000000041063C                 retn                    ; Return Near from Procedure
.text:000000000041063C clearEAX        endp
.text:000000000041063C
.text:000000000041063D

Its address being referenced (0x4113B2) It being called directly in context: (0x4113CB)

.text:00000000004113AC                 push    rbp
.text:00000000004113AD                 mov     edx, offset unk_514200
.text:00000000004113B2                 mov     esi, offset clearEAX
.text:00000000004113B7                 push    rbx
.text:00000000004113B8                 mov     ebx, edi
.text:00000000004113BA                 sub     rsp, 28h        ; Integer Subtraction
.text:00000000004113BE                 mov     rdi, rsp
.text:00000000004113C1                 call    nullsub_3       ; Call Procedure
.text:00000000004113C6                 mov     edi, offset unk_514200
.text:00000000004113CB                 call    clearEAX        ; Call Procedure
.text:00000000004113D0                 mov     rax, cs:qword_514398
.text:00000000004113D7                 test    rax, rax        ; Logical Compare
.text:00000000004113DA                 jz      short loc_4113E0 ; Jump if Zero (ZF=1)
.text:00000000004113DC                 mov     edi, ebx
.text:00000000004113DE                 call    rax ; qword_514398 ; Indirect Call Near Procedure
.text:00000000004113E0

However, I don't think, that the context does matter here because the context is nowhere near similar. Meaning that it's not the combination of moving the address first then calling it or something like that.

added 86 characters in body
Source Link
Joel
  • 125
  • 5

I decompiled a program where there is a function, which has only a single useful instruction which is

xor eax, eax
retn

What it the purpose of having this in an extra function, instead of using xor eax, eax or mov eax, 0 at the place where the call happens to be?

  • Notes:
  1. Most of the time, it is called directly call sub_41063A (address of the function), sometimes its address is loaded with mov esi, offset sub_41063A
  2. It is an x68_64-architecture
  3. I don't know, which compiler was used

Edit:

Code examples: (I named the function 'clearEAX')

The function Itself:

I decompiled a program where there is a function, which has only a single useful instruction which is

xor eax, eax
retn

What it the purpose of having this in an extra function, instead of using xor eax, eax or mov eax, 0 at the place where the call happens to be?

  • Notes:
  1. Most of the time, it is called directly call sub_41063A (address of the function), sometimes its address is loaded with mov esi, offset sub_41063A
  2. It is an x68_64-architecture
  3. I don't know, which compiler was used

I decompiled a program where there is a function, which has only a single useful instruction which is

xor eax, eax
retn

What it the purpose of having this in an extra function, instead of using xor eax, eax or mov eax, 0 at the place where the call happens to be?

  • Notes:
  1. Most of the time, it is called directly call sub_41063A (address of the function), sometimes its address is loaded with mov esi, offset sub_41063A
  2. It is an x68_64-architecture
  3. I don't know, which compiler was used

Edit:

Code examples: (I named the function 'clearEAX')

The function Itself:

added alternative
Source Link
Joel
  • 125
  • 5
Loading
Source Link
Joel
  • 125
  • 5
Loading