I'm practicing windows disassembly on x64 notepad.exe
I've managed to find buffer allocation and string resources load.
But after that follows code, which I can't fully understand:
rbx = 0, rdx = 0 before this part
mov r9, cs:str_res_guid_18 ; dq 12h lea rcx, some_data ; some address mov edx, 28h sub r9, rcx mov r8, rdx loc_100003150: lea rax, [r8+7FFFFFD6h] ; what is this number? cmp rax, rbp jz short loc_100003173 movzx eax, word ptr [rcx+r9] ; str_res_guid_18 cmp ax, bp jz short loc_100003173 mov [rcx], ax add rcx, 2 sub r8, 1 jnz short loc_100003150 loc_100003173: cmp r8, rbp jz loc_1000058A0
What does 7FFFFFD6h stands for? And why is it compared against null?