I've got some windows dll file. This dll-file exports a couple of functions to read HDD with some unknown (to me) filesystem. So, I've launched IDA disassembler and started an investigation on how those disk operations are going.
In short, there are two part: Initialize and Act. Currently I'm on Initialize part of the code. And I'm stuck with this piece of code:
; at this point: ; edi = 0, ; ebp = some 32-bit value, lets call it an Argument, ; esi holds address of some buffer with size of 07b0h bytes .text:100014C9 xor ecx, ecx .text:100014CB mov eax, ebp .text:100014CD mov edx, 14h .text:100014D2 mul edx ; eax:edx = Argument * 14h .text:100014D4 seto cl ; ecx = (eax != 0) .text:100014D7 mov [esi+14h], edi .text:100014DA neg ecx ; ecx = -1 = 0ffffffffh (eax != 0), ecx = 0 (eax == 0) .text:100014DC or ecx, eax ; eax = 0ffffffffh (OF set), eax = eax (OF not set) .text:100014DE push ecx ; size_t ; jmp_to_operator_new holds just a command to ; c++ (i assume) 'new' operator .text:100014DF call jmp_to_operator_new .text:100014E4 lea ecx, [ebp+ebp*4+0] .text:100014E8 add ecx, ecx .text:100014EA add ecx, ecx .text:100014EC push ecx ; size_t .text:100014ED push edi ; int .text:100014EE push eax ; void * .text:100014EF mov [esi+14h], eax .text:100014F2 call _memset
So, as you may have noticed, I assume that that at text:100014DE point ecx can only hold either -1 (0ffffffffh) or zero as a value to pass to operator new (which doesn't do much than just call to _malloc). The result of memory allocation is then passed as destination buffer to _memset.
Hence my question is here. Am I wrong about the value of ecx at text:100014DE point? Where am I wrong? What is correct value?