Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro

Question

Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis.

cseg04:3044 loc_105D4:                              ; CODE XREF: cseg04:2F10↑j
    cseg04:3044                 push    0
    cseg04:3046                 push    34h ; '4'
    cseg04:3048                 les     bx, ppMalloc
    cseg04:304C                 push    es
    cseg04:304D                 push    bx
    cseg04:304E                 les     bx, es:[bx]
    cseg04:3051                 call    dword ptr es:[bx+0Ch]
    cseg04:3055                 add     sp, 8
    cseg04:3058                 mov     si, ax
    cseg04:305A                 mov     [bp-6], dx
    cseg04:305D                 or      dx, ax
    cseg04:305F                 jnz     short loc_105F8

ppMalloc section:

eg70:3612 ppMalloc        dd 0                    ; DATA XREF: cseg04:3048↑r
dseg70:3612                                         ; sub_145C0+24↑r ...
dseg70:3616 ; ATOM word_10CA26
dseg70:3616 word_10CA26     dw 0                    ; DATA XREF: sub_4637E:loc_463B1↑r
dseg70:3616                                         ; sub_4637E+3A↑r ...
dseg70:3618 word_10CA28     dw 0                    ; DATA XREF: sub_CE2A+1↑o
dseg70:3618                                         ; cseg03:2F9C↑o ...
dseg70:361A                 db    0
dseg70:361B                 db    0
dseg70:361C                 db    0
dseg70:361D                 db    0
dseg70:361E                 db    0
dseg70:361F                 db    0
dseg70:3620                 db    0
dseg70:3621                 db    0
dseg70:3622                 db    0
dseg70:3623                 db    0
dseg70:3624                 db    0
dseg70:3625                 db    0
dseg70:3626 unk_10CA36      db    0                 ; DATA XREF: sub_CE2A+A↑o
dseg70:3626                                         ; cseg03:2F93↑o ...
dseg70:3627                 db    0
dseg70:3628                 db    0
dseg70:3629                 db    0
dseg70:362A                 db    0
dseg70:362B                 db    0
dseg70:362C                 db    0
dseg70:362D                 db    0
dseg70:362E                 db    0
dseg70:362F                 db    0
dseg70:3630                 db    0
dseg70:3631                 db    0
dseg70:3632                 dw 0

Answer 1

My guess is that ppMalloc is a pointer to an instance of the IMalloc COM interface (e.g. it was initialized by a call to CoGetMalloc), which means the the first pointer in it (loaded by the les instruction) is the VTable which has the following methods.

First three are inherited from IUnknown, the parent of all COM objects:

---

+00 QueryInterface

+04 AddRef

+08 Release

---

Followed by the methods of IMalloc proper:

---

+0C Alloc

+10 DidAlloc

+14 Free

+18 GetSize

+1C HeapMinimize

+20 Realloc

---

So the code is probably calling IMalloc::Malloc to allocate 0x34 bytes, pointer to which is returned in the ax:dx register pair.

Answer 2

We cannot deduce it from the fragment of code you have provided (unless we are @Igor Skochinsky of course). However, we can notice a few things:

• ppMalloc contains the address of dynamically allocated array of function pointers
• the function called by call [bx+0Ch] takes three arguments passed by stack: 0, 34h (offset?) and a pointer to the address of that dynamically allocated array (that is the address of ppMalloc pointer)
• at line 3051 es:bx points to the first element of that array and es:[bx+0Ch] is fourth element in it
• depending on the value returned (in dx:ax) the jump at the last line will or won't be performed (or dx, ax checks whether dx:ax is 0 or not)

If you have any doubts the comments to the disassembly given below should clarify them.

cseg04:3044                 push    0 ; push first argument
cseg04:3046                 push    34h ; '4' ; push the second one
cseg04:3048                 les     bx, ppMalloc ; es:bx = ppMalloc
cseg04:304C                 push    es
cseg04:304D                 push    bx ; push es:bx (ppMalloc)
cseg04:304E                 les     bx, es:[bx] ; es:bx = *ppMalloc (that is the value stored at dseg70:3612, i.e. pointer to array of function pointers, i.e. pointer to the first element of that array)
cseg04:3051                 call    dword ptr es:[bx+0Ch] ; call arrayOfFunctionPointers[3] - fourth entry as each entry is probably of dword size
cseg04:3055                 add     sp, 8 ; restore previous sp value
cseg04:3058                 mov     si, ax ; si = (returned result) % 2^16
cseg04:305A                 mov     [bp-6], dx ; [bp-6] = (returned result) / 2^16
cseg04:305D                 or      dx, ax ; will be 0 <=> (dx = 0 and ax = 0)
cseg04:305F                 jnz     short loc_105F8