0

I have a dataset of .ASM files generated by IDA (dont have the corresponding file)

now there are a lot of calls like this :

.text:00637114 5F                                  pop     edi
.text:00637115 33 C0                                   xor     eax, eax
.text:00637117 FF 14 45 04 87 63 00                        call    ds:GetModuleHandleA[eax*2]
.text:0063711E 57                                  push    edi
.text:0063711F                                     db      3Eh
.text:0063711F 3E C2 00 00                             retn    0

Now i have never seen something like call ds:apicall[registry*constant] in IDA disassembly itself, what does this even mean? why is eax getting multiplied by two within a call instruction and its in brackets after the api name? it can't be the input to the api since its not getting pushed to stack(its x86). i thought near call instructions (FF) only have the offset in their operand, this is really confusing me, what does IDA mean when it says call ApiCall[registry * constant] ?

EDIT1:

this is a "normal" type of api call in .asm files :

.text:00402ACD 8B CB                                   mov     ecx, ebx
.text:00402ACF 68 B8 9B 64 00                              push    offset WndClass ; lpWndClass
.text:00402AD4 FF 15 44 41 63 00                           call    ds:RegisterClassA
.text:00402ADA 8D 4D 70                                lea     ecx, [ebp+68h+hInstance]
  • Your instruction disassembles to call dword ptr [eax * 2 + 0x638704]. So, in pseudoassembly, you could write 0x638704[2*eax] treating 0x638704 as an array. In your case probably this address has label GetModuleHandleA and hence this strange convention. – bart1e Sep 18 '20 at 15:17
  • @bart1e what's interesting is both call instructions i provided start with FF, which is call near absolute, but somehow one of them is 6 byte and the other is 7 byte and has a eax multiplication, and i assume the eax*2 trick is some sort of obfuscation since eax is getting xor ed before that, doubt any compiler will produce something like this – OneAndOnly Sep 18 '20 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.