I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows:

0627BF49 | 8B0B                     | mov ecx,dword ptr ds:[ebx]                           |
0627BF4B | 8B85 CCF5FFFF            | mov eax,dword ptr ss:[ebp-A34]                       |
0627BF51 | 05 EC040000              | add eax,4EC                                          |
0627BF56 | 50                       | push eax                                             |
0627BF57 | 8BB1 E4050000            | mov esi,dword ptr ds:[ecx+5E4]                       |
0627BF5D | 8BCE                     | mov ecx,esi                                          |
0627BF5F | FF15 A08C5406            | call dword ptr ds:[6548CA0]                          |
0627BF65 | 8BCB                     | mov ecx,ebx                                          |
0627BF67 | FFD6                     | call esi                                             |
0627BF69 | 8BB5 ACF5FFFF            | mov esi,dword ptr ss:[ebp-A54]                       |
0627BF6F | 8BCE                     | mov ecx,esi                                          **|
0627BF71 | FF15 20735406            | call dword ptr ds:[<&?IsEmpty@?$CStringT@XXXXXXXXX   |**
0627BF77 | 85C0                     | test eax,eax                                         |
0627BF79 | 75 56                    | jne foo     .627BFD1   


dissassembled there a lot of statements like this, point to IsEmpty in BAR.DLL (this is FOO.DLL)

iVar4 = Bar::CStringT<wchar_t>::IsEmpty(local_84);

Given my understanding, values should be pushed to EAX,ECX,and EDX prior to the call to test if a value is empty. However, if I look in any of these registers, and try to follow in the stack, I don't see anything there. The registers values not ASCII, and it looks like a reference to a CStringT. But I can't find the CStringT, the stack just points to a different DLL. How do I find the values of the CStringT parameter that is passed?


  • Can you show us the instructions surrounding the call? That would help in understanding how the call is being made. Aug 30, 2022 at 14:59
  • 1
    @dingo_kinznerhook done, similar call with more context. Aug 30, 2022 at 15:11

1 Answer 1


The correct answer is:

This is using thiscall: https://docs.microsoft.com/en-us/cpp/cpp/thiscall?view=msvc-170 and a parameter like CStringT<wchar_t> *param_1 so unlike in other calls, ECX is not what we want. Instead this gives the value:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.