Which condition has to be met to execute this if branch

Question

Right now I am playing around with a little training application I found on OpenSecurityTraining.

So, I analyzed this code and I think I understand this pretty well. The only thing I don't get is the cmp and je at lines 0x004010e3 and 0x004010e7 which seem to be some if conditions. But, I cannot figure out which condition should be met to take the jump instruction.

My workaround was to manipulate eip when the cmp line was executed. But, my question is what condition has to be set to take the je instruction ?

004010e0 55              push    ebp
004010e1 8bec            mov     ebp,esp
004010e3 837d0803        cmp     dword ptr [ebp+8],3
004010e7 7412            je      mystery!main+0x1b (004010fb)
004010e9 6834404200      push    offset mystery!__rtc_tzz <PERF> (mystery+0x24034) (00424034)
004010ee e81c040000      call    mystery!printf (0040150f)
004010f3 83c404          add     esp,4
004010f6 83c8ff          or      eax,0FFFFFFFFh
004010f9 eb0b            jmp     mystery!main+0x26 (00401106)
004010fb e80affffff      call    mystery!mystery_function+0xffffffff`ffffffea (0040100a)
00401100 eb02            jmp     mystery!main+0x24 (00401104)
00401102 eb02            jmp     mystery!main+0x26 (00401106)
00401104 33c0            xor     eax,eax
00401106 5d              pop     ebp
00401107 c3              ret

Answer 1

Extended Base Pointer, as the name suggests, is usually used as a frame pointer. That, among other things, means that it's used to access function parameters and local variables. If you think about how stack works, you can conclude the following:

• local variables will be on the negative offset from the base pointer
• address in the frame pointer will be the location of the previous function's frame pointer
• address at the +4 offset from EBP will be the return address
• offsets greater than 4 are function parameters

That being said, ebp+8 is usually the first function argument. The compare instruction in this case compares the value of the first function parameter to 3. If those are equal (je instruction is jump if equal) the conditional jump will be executed.

Answer 2

dword ptr [val] is exactly, what it says: A 32bit pointer to value. As to how cmp, je and all the other instructions work, I recommend the reading of the Intel Manual.