I decompiled a program where there is a function, which has only a single useful instruction which is
xor eax, eax
retn
What it the purpose of having this in an extra function, instead of using xor eax, eax
or mov eax, 0
at the place where the call happens to be?
- Notes:
- Most of the time, it is called directly
call sub_41063A
(address of the function), sometimes its address is loaded withmov esi, offset sub_41063A
- It is an x68_64-architecture
- I don't know, which compiler was used
- Most of the time, it is called directly
Edit:
Code examples: (I named the function 'clearEAX')
The function Itself:
.text:000000000041063A
.text:000000000041063A clearEAX proc near ; CODE XREF: sub_40E4B4+37p
.text:000000000041063A ; sub_40E528+DFp ...
.text:000000000041063A xor eax, eax ; Logical Exclusive OR
.text:000000000041063C retn ; Return Near from Procedure
.text:000000000041063C clearEAX endp
.text:000000000041063C
.text:000000000041063D
Its address being referenced (0x4113B2) It being called directly in context: (0x4113CB)
.text:00000000004113AC push rbp
.text:00000000004113AD mov edx, offset unk_514200
.text:00000000004113B2 mov esi, offset clearEAX
.text:00000000004113B7 push rbx
.text:00000000004113B8 mov ebx, edi
.text:00000000004113BA sub rsp, 28h ; Integer Subtraction
.text:00000000004113BE mov rdi, rsp
.text:00000000004113C1 call nullsub_3 ; Call Procedure
.text:00000000004113C6 mov edi, offset unk_514200
.text:00000000004113CB call clearEAX ; Call Procedure
.text:00000000004113D0 mov rax, cs:qword_514398
.text:00000000004113D7 test rax, rax ; Logical Compare
.text:00000000004113DA jz short loc_4113E0 ; Jump if Zero (ZF=1)
.text:00000000004113DC mov edi, ebx
.text:00000000004113DE call rax ; qword_514398 ; Indirect Call Near Procedure
.text:00000000004113E0
However, I don't think, that the context does matter here because the context is nowhere near similar. Meaning that it's not the combination of moving the address first then calling it or something like that.
void CallBack() { return FALSE; }
. Provide the full assembly or pseudo code. Not picture ;)