1

Little knowledge of assembly can be a problem sometimes.

 push       ebp
 lea        eax,[ebp-3C0]
 call       005A0E30
 pop        ecx
 mov        edx,dword ptr [ebp-3C0]
 lea        eax,[ebp-20]
 call       @UStrLAsg
 push       ebp
 lea        eax,[ebp-3C4]
 call       005A1568
 pop        ecx

Just as the above code, I am trying to understand what is happening but I cannot understand the instructions lea followed by a call.

Maybe if I had an idea of what @UstrLAsg means I would start to get what is going on there or maybe someone out there can give me a hint.

  • 1
    as answered by perror ustlasg is just a name a symbol most of the debuggers and disassembler will offer you an option to turn it off and display the actual address like your call 5a0e30 just a few lines above your tool recognized the address as ustrxxx so it displays ustrxx for the call few lines above thsi call it didnt recogize the symbol so it says call 0x50xxxxx that is all – blabb Dec 26 '15 at 11:22
2
mov        edx,dword ptr [ebp-3C0]

This instruction sets register edx to the value of the DWORD at memory address (ebp-3C0).

lea        eax,[ebp-20]

This instruction sets register eax to the value (ebp-20); despite the square brackets in the instruction, there is no memory dereferencing involved.

call       @UStrLAsg

This instruction calls the Delphi library function UStrLAsg(), which receives its input arguments via eax and edx. A little Googling shows that that function is used to assign a local Unicode string to a global variable, where edx points to the source string and eax points to the global variable.

  • Great,thats why call @UstrLAsg starts with test Edx,Edx huh! – Alexio puk2sefu Dec 26 '15 at 19:58
0

lea stands for Load Effective Address. It is an instruction designed to fetch a piece of memory and load it into a register in an optimized manner. It may also be used to perform an addition when you see:

lea eax, [eax+4]

Which is equivalent to:

add eax, 4

Then, the call @UstrLAsg refer to a symbol (@UstrLAsg), which give a static address in the executable memory. The best way to find out where it does jump in memory would be to execute the program and to look at the symbol while running. It should unveil the static address.

Hope this helped you a bit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.