Binary diffing: Why moving ebx to eax, instead of pushing ebx?

Question

I was doing binary diffing, I want to know why mov eax,ebx is used instead of push ebx.

This is the binary diffing image:

Before patch :

After patch :

Answer 1

The function prototype for ?EnsureCollectionCache@CFormElement@@QAEJXZ is the same before and after the patch. It demangles to:

public: long int __thiscall CFormElement::EnsureCollectionCache(void)

And the calling convention for the parent function, ?DoReset@CFromElement@@QAEJH@Z, is the same before and after as well:

public: long int __thiscall CFormElement::DoReset(int)

Before and after the patch, the CFormElement::DoReset function saves the value of its int argument in register ebx. Before the patch, this value is pushed onto the stack at EIP 639C2C58 because other code in the function will likely make use of it later. After the patch, the mov eax, ebx instruction is effectively a no-op since the call to CFormElement::EnsureCollectionCache will overwrite eax.

As for why the compiler made this change, it's difficult to say without seeing the rest of the function. Perhaps after the patch, the code in the rest of the function gets the value of the int argument from the stack relative to ebp as opposed to grabbing it from the top of the stack.

Answer 2

It may be because the calling convention changed from __cdecl (using the stack to receive the arguments) to __fastcall or even to a calling convention invented by the compiler (using EAX as the register holding the same information that was pushed on to the stack in the previous version).