New answers tagged


ok it is _fastCall so this function takes 5 arguments 2 in registers ecx,edx 3 in stack 8,12,16 and As I Commented edx is used as an argument to the First Indirect call [esi+4] copy pasted the disassembly to notepad++ used the column editor to rip out the bytes from the paste pasted the bytes in hxd to make a bin Offset(h) 00 01 02 03 04 05 06 07 08 09 0A ...


To determine if a function is using some registers as parameters: You could find the call references of the function, then see prior to the function call if those registers' values are copied from other operands and then later in the function, those values are used.


Typically, a register's value being used in a function prior to being initializing it is a hint that it may be a parameter. Here we see ecx being used for the first time in this function: 00893c1e 8bf1 mov esi,ecx There are a few different standard calling conventions that pass parameters in the ecx register such as fastcall. C++ compilers ...

Top 50 recent answers are included