Some help with disassembled code understanding

Question

I've got some windows dll file. This dll-file exports a couple of functions to read HDD with some unknown (to me) filesystem. So, I've launched IDA disassembler and started an investigation on how those disk operations are going.

In short, there are two part: Initialize and Act. Currently I'm on Initialize part of the code. And I'm stuck with this piece of code:

; at this point: 
;   edi = 0, 
;   ebp = some 32-bit value, lets call it an Argument, 
;   esi holds address of some buffer with size of 07b0h bytes
.text:100014C9                 xor     ecx, ecx        
.text:100014CB                 mov     eax, ebp
.text:100014CD                 mov     edx, 14h
.text:100014D2                 mul     edx             ; eax:edx = Argument * 14h
.text:100014D4                 seto    cl              ; ecx = (eax != 0)
.text:100014D7                 mov     [esi+14h], edi
.text:100014DA                 neg     ecx             ; ecx = -1 = 0ffffffffh (eax != 0), ecx = 0 (eax == 0)
.text:100014DC                 or      ecx, eax        ; eax = 0ffffffffh (OF set), eax = eax (OF not set)
.text:100014DE                 push    ecx             ; size_t
; jmp_to_operator_new holds just a command to 
; c++ (i assume) 'new' operator
.text:100014DF                 call    jmp_to_operator_new
.text:100014E4                 lea     ecx, [ebp+ebp*4+0]
.text:100014E8                 add     ecx, ecx
.text:100014EA                 add     ecx, ecx
.text:100014EC                 push    ecx             ; size_t
.text:100014ED                 push    edi             ; int
.text:100014EE                 push    eax             ; void *
.text:100014EF                 mov     [esi+14h], eax
.text:100014F2                 call    _memset

So, as you may have noticed, I assume that that at text:100014DE point ecx can only hold either -1 (0ffffffffh) or zero as a value to pass to operator new (which doesn't do much than just call to _malloc). The result of memory allocation is then passed as destination buffer to _memset.

Hence my question is here. Am I wrong about the value of ecx at text:100014DE point? Where am I wrong? What is correct value?

Answer 1

You are wrong with your interpretation. As you see correctly, after 100014da ecx is either zero (no overflow in the mul statement) or 0xffffffff (overflow in mul, neg works with twos complement). After 100014dc however, ecx is either 0xffffffff (unchanged on overflow) or equals eax (no overflow), as in the intel notation the destination register is the left one. eax remains unchanged.