Search code examples
assemblyx86reverse-engineeringida

What does this code imply: ss:dword_410CC5[ebp]?

Using IDA Pro for analysing a file, I have run across some code that I don't quite understand:

mov eax, ss:dword_410CC5[ebp] ;
call eax; Indirect Call Near Proc

Going to this address - 410CC5 - I see this:

 ile.........Clos
 eHandle.........

I assumed that in the first code snippet in EAX the name of library function is stored, which is then called by 

call eax; Indirect Call Near Proc

But the problem is the address 410CC5 does not fully correspond to this name (see attachment). At this address are actually just zeroes.

Does that anyway means that at 

call eax; Indirect Call Near Proc

we call CloseHandle? If so, then why isn't the right address passed to EAX?

Code snippet

Solution

  • When a call instruction appears in the disassembly, it means that another routine/function is called at that point.

    If the routine has an absolute address, the instruction will appear like call 0xaabbccdd.

    If the address of the function being called is a dynamic address (this kind of addresses are resolved when the OS loads the executable), it's called via an enregistered value.

    However, this instruction is used for calling a routine—that's all.