I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify.
1. mov [rsp+78h+arg_0], rsi
2. mov rsi, cs:qword_1F39B60
3. mov [rsp+78h+arg_38], rsi
- If line 2 is loading
1F39B60
inrsi
or the contents of1F39B60
inrsi
? - Would
lea rsi, [qword_1F39B60]
be the same? - If non bracket using
mov
action on a memory even allowed or this is just a visual IDA thing? - Can you explain to me why it shows
cs:
even thoughqword_1F39B60
is in the.data segment
? Shouldn't it beds:
?
Last but not the least this isn't directly connected to my main question but is rsp+78h
a fancy way of saying rbp
by the disassembler?