Function Prologue, add esp directive

Question

I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code:

push    ebp                          ; DllMain entry point
mov     ebp, esp
add     esp, FFFFFFBC
xor     eax, eax
mov     dword ptr ss:[ebp-44], eax
mov     eax, module.8BC3980
call    module.8BB8D54
xor     eax, eax

Wikipedia says the following about function prologues:

A function prologue typically does the following actions if the architecture has a base pointer (also known as frame pointer) and a stack pointer:

Pushes current base pointer onto the stack, so it can be restored later.

Assigns the value of stack pointer (which is pointed to the saved base pointer) to base pointer so that a new stack frame will be created on top of the old stack frame.

Moves the stack pointer further by decreasing or increasing its value, depending on whether the stack grows down or up. On x86, the stack pointer is decreased to make room for the function's local variables.

[...]

As an example, here′s a typical x86 assembly language function prologue as produced by the GCC

push   ebp
mov    ebp, esp
sub    esp, N

But I have encountered an add esp, N directive which adds a huge number to esp register. It seems something is wrong here, what should I understand from the code exactly?

And the second question is about mov dword ptr ss:[ebp-44], eax directive. Why it is 44 that is subtracted from ebp address (11 ints!) and what does the ss item here?

PS I suspect that the DLL is written in Delphi, but not 100% sure.

Answer 1

The large integer that is added to ESP is negative and is used to move the stack pointer to a an address that allows 0x44 bytes on the stack for the current function.

At this point, ESP=EBP-0x44. So, EBP-0x44 is essentially, [ESP]. It is equivalent to PUSH EAX, as a parameter for the CALL that comes next.

The ss: is a selector which indicates that the "base" of the mentioned address is on the stack. In a linear memory system it has no practical meaning.

Answer 2

you should normally take a pencil and paper and try solving it

ill use python here

>>> ebp = 0x1000
>>> esp = ebp
>>> esp = ( esp + 0xffffffbc )& 0xffffffff
>>> print(hex(esp),hex(ebp-0x44))
0xfbc 0xfbc
>>>

It will write 0 to the Address 0xfbc if ebp were 0x1000 to start with