I have come across the following instructions:

mov ecx, [ebp + var_4]
imul ecx, 4
call dword_1423d4[ecx]

Can someone explain to me what it possibly means or point me in the right direction? Why is the call made to a variable?

  • 2
    Calls function by reference out of an array of pointers?
    – PSS
    Commented Jun 25, 2013 at 16:01
  • @PSS what it means? Commented Jun 25, 2013 at 16:39

2 Answers 2


dword_1423d4 is a pointer to a global array of 32-bit function pointers.

var_4 is an index into this array.

The call instruction calls the function at index var_4 in the dword_1423d4 function array.

  • 3
    it's a common representation of a "switch()" statement when the values are linear. The var_4 is the parameter to the switch(), the dword_1423d4 is the table of case handlers. Commented Jun 25, 2013 at 17:50
  • 2
    @peterferrie - From my experience, switch statements are typically compiled to use jmp, not call, but I suppose a compiler might choose the latter in some circumstances. Commented Jun 25, 2013 at 21:53
  • 1
    I agree with Jason, it is unlikely (although not guaranteed) to be a switch statement due to the call and no jmp. Possibly a custom function dispatcher or something.
    – QAZ
    Commented Jun 26, 2013 at 9:39
  • 1
    Also agree with @JasonGeffner. I've never seen a switch statement (or anything aside from a real function call, for that matter) on x86 implemented with a call instruction. Commented Jun 28, 2013 at 5:41
  • By the way @JasonGeffner, I thought your name sounded familiar from BlackHat a couple years back. Commented Jun 28, 2013 at 6:00

What immediately comes to mind is some type of virtualization layer accessing an IAT or IVT. I absolutely agree with the previous answer that this is a call to a function vector in an array of function pointers. I also agree that it does not look like a switch statement. That's what takes me down the interrupt vector table/address table.

  • Would you please add more details into your answer? How is it different from the answer above? At the moment, it reads like a kudos to Jason's answer. If that is what you intended, you can show your agreement with another answer by clicking on the upvote button next to it. Posting a separate answer is not needed.
    – asheeshr
    Commented Jul 14, 2013 at 2:30
  • I must have missed a reference to an interrupt vector or address table in his answer. Commented Jul 14, 2013 at 2:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.