This is the second time I see this kind of function today :

.text:00000000000010B0 sub_10B0        proc near               ; CODE XREF: sub_1120:loc_1143↓p
.text:00000000000010B0                 lea     rdi, byte_4418
.text:00000000000010B7                 lea     rax, byte_4418
.text:00000000000010BE                 cmp     rax, rdi
.text:00000000000010C1                 jz      short locret_10D8
.text:00000000000010C3                 mov     rax, cs:_ITM_deregisterTMCloneTable_ptr
.text:00000000000010CA                 test    rax, rax
.text:00000000000010CD                 jz      short locret_10D8
.text:00000000000010CF                 jmp     rax
.text:00000000000010CF ; ------------------------------------------------------------------
.text:00000000000010D1                 align 8
.text:00000000000010D8 locret_10D8:                            ; CODE XREF: sub_10B0+11↑j
.text:00000000000010D8                                         ; sub_10B0+1D↑j
.text:00000000000010D8                 retn
.text:00000000000010D8 sub_10B0        endp

As I understand, both jz are going to jump anyway, so the first jz is always going to jump to the ret.

Why isn't this function written more simply, just like a single return &byte_4418 ?

lea     rax, byte_4418

I hope my English is good enough to be understood.

Thank you,


PS : I'm sorry, I don't know which compiler is used.

1 Answer 1


I expect that the compiler emitted two different symbol references in the two LEA instructions, and uses the compare instruction to detect at run time whether the two symbols were resolved to the same address at link time. Many modern compilers/linkers offer "link time code generation" aka "whole program optimization", where the compiler's optimizer runs at link time. In such a system, there would be no need for a runtime check, but the compiler is (re-)called at link time and can optimize (in this case: eliminate/not generate the dead path) in response to seeing all modules getting linked together.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.