sub_123434 proc near mov esi, [ebp-1Ch] sub_123434 endp
What means proc near? Can someone possibly explain also the whole function?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Attribute is NEAR if the Procedure is in the same code segment as the calling program; or FAR if in a different code segment.
The meat of the code is this:
This bit of code is moving a value from the stack into the
esi register. Depending on the compiler used and context, you might stand to glean additional information from register conventions where a value being moved into the
esi register is concerned. More specifically, consider the accepted answer from this post.
ebp- (as opposed to
ebp+) is a typical sign of arguments that have been passed to a function--of which those values reside on the stack within memory addresses that can be referenced as long as that particular stack frame exists.
[ebp-1Ch], that's a pointer. In this case, the
ebp register contains a memory address (or, more specifically, the value in
ebp is treated as a reference to a memory address instead of a literal value), and
-1Ch is an offset from that memory address. The lowercase 'h' is just a pneumonic meaning "hex," and to that end, you might also sometimes see offsets and/or hex-based values referenced with a preceding 0x, like this:
[ebp-0x1C]. Bearing that in mind, you can really think of that as
Do note that
[ebp] are different things.
[ebp] means the value inside of
ebp is treated as a reference to a memory address. Let's assume
0xD34DC0DE in it. Now consider the following:
mov esi,ebp mov esi,[ebp] mov esi,[ebp-1C]
The results of each of these would be the following:
mov esi,ebp // esi now contains the literal value 0xD34DC0DE
mov esi,[ebp] // esi now contains whatever is inside the memory address 0xD34DC0DE
mov esi,[ebp-1C] // esi now contains whatever is inside the memory address 0xD34DC0C2 (which is 0xD34DC0DE - 1C)
Overall, it looks like that subroutine isn't doing anything but moving data from the stack into a register. As a completely blind assumption, if we assume that each argument passed to its respective function is 4-bytes wide, then
[ebp-1C] references the 8th argument passed to perhaps a parent routine of this subroutine. In this case, other values of interest could potentially reside in
Ultimately, we're lacking context here to gather what the purpose of this function you've provided is--though, again, a combination of the aforementioned conventions can possibly tell you a lot about what that mov instruction is potentially a part of. Look into calling conventions for additional clarity. You should be able to infer and research the rest based on the information herein.