Locating function parameters in x32dbg

Question

I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows:

0627BF49 | 8B0B                     | mov ecx,dword ptr ds:[ebx]                           |
0627BF4B | 8B85 CCF5FFFF            | mov eax,dword ptr ss:[ebp-A34]                       |
0627BF51 | 05 EC040000              | add eax,4EC                                          |
0627BF56 | 50                       | push eax                                             |
0627BF57 | 8BB1 E4050000            | mov esi,dword ptr ds:[ecx+5E4]                       |
0627BF5D | 8BCE                     | mov ecx,esi                                          |
0627BF5F | FF15 A08C5406            | call dword ptr ds:[6548CA0]                          |
0627BF65 | 8BCB                     | mov ecx,ebx                                          |
0627BF67 | FFD6                     | call esi                                             |
0627BF69 | 8BB5 ACF5FFFF            | mov esi,dword ptr ss:[ebp-A54]                       |
0627BF6F | 8BCE                     | mov ecx,esi                                          **|
0627BF71 | FF15 20735406            | call dword ptr ds:[<&?IsEmpty@?$CStringT@XXXXXXXXX   |**
0627BF77 | 85C0                     | test eax,eax                                         |
0627BF79 | 75 56                    | jne foo     .627BFD1   

             

dissassembled there a lot of statements like this, point to IsEmpty in BAR.DLL (this is FOO.DLL)

iVar4 = Bar::CStringT<wchar_t>::IsEmpty(local_84);

Given my understanding, values should be pushed to EAX,ECX,and EDX prior to the call to test if a value is empty. However, if I look in any of these registers, and try to follow in the stack, I don't see anything there. The registers values not ASCII, and it looks like a reference to a CStringT. But I can't find the CStringT, the stack just points to a different DLL. How do I find the values of the CStringT parameter that is passed?

Thx

Answer 1

The correct answer is:

This is using thiscall: https://docs.microsoft.com/en-us/cpp/cpp/thiscall?view=msvc-170 and a parameter like CStringT<wchar_t> *param_1 so unlike in other calls, ECX is not what we want. Instead this gives the value:

utf16([esi+4]+2)