I recently asked to question: How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? After posting the question, I found that another function passed the first argument in
EAX and then pushed its remaining argument. The caller then cleans up the stack.
The calling code:
.text:00402465 lea eax, [ebp+var_4] ... .text:00402469 push eax .text:0040246A mov eax, [ebp+hWnd] .text:0040246D call openFileDialog .text:00402472 add esp, 4
And the function itself:
.text:00411730 openFileDialog proc near .text:00411730 ... .text:00411730 arg_0 = dword ptr 8 .text:00411730 .text:00411730 push ebp .text:00411731 mov ebp, esp .text:00411733 sub esp, 18h .text:00411736 cmp byte_42AE1D, FALSE .text:0041173D push ebx .text:0041173E push esi .text:0041173F push edi .text:00411740 mov esi, eax ... .text:00411789 mov eax, [ebp+arg_0] .text:0041178C push eax .text:0041178D push esi .text:0041178E call openFileDialog_Compat .text:00411793 add esp, 8
As you can see, in the function, the value of
EAX is saved before anything can affect it, so it is definitely being used as a parameter. Later, the pushed argument is passed to a normal __cdecl function.
The program is linked to use msvcr100.dll and uses MSVC style throughout (Such as __security_cookie, MSVC name mangling, etc.), so it would appear to have been compiled with Visual C++, but this unusual calling convention makes me question that.