IDA shows this following code in separate subroutine.


sub_180049410 proc near
jmp     rax
sub_180049410 endp


__int64 __usercall sub_180049410@<rax>(__int64 (*a1)(void)@<rax>)
  return a1();

The previous subroutine calls it as (off_180052510 and sub_180049410 are same)

mov     rcx, [rsp+0C8h+var_88]
mov     rax, [rcx]
mov     r8, rsi
mov     edx, 5
mov     rax, [rax+18h]
call    cs:off_180052510
mov     rcx, [rsp+0C8h]
test    eax, eax
js      loc_18000969B

So, why IDA shows it in separate subroutine? Can I join that in it's previous function?

  • off_180052510 and sub_180049410 appears to be two distinct addresses what do you mean when you write they are same
    – blabb
    Commented Mar 25, 2018 at 8:46
  • I mean to say that the offset points to that subroutine.
    – Biswapriyo
    Commented Mar 25, 2018 at 8:47

1 Answer 1


No. Ofc, you can modify assembly in IDA with API funcs by yourself, but there is no need in this. call instruction is not just jumping to code, it also modifies stack, pushing there return address, so called function can correctly return (read https://c9x.me/x86/html/file_module_x86_id_26.html ). Thats why this code is shown in another subroutine, and thats why just inlining jmp rax to code won't be correct in this case.

Also, rax value will be known only in runtime, so IDA's static analysis can't provide information, which function exactly will be called here. So sub_180049410 its just function to call some other function via pointer to it.

  • Is there any relation with this subroutine and COM vtable/function pointer?
    – Biswapriyo
    Commented May 19, 2018 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.