Looking at disassembly

[K]

Code Select Expand


                ; ...
                push    offset sub_11802190
                push    7
                push    6
                ; ...
                call    SomeFunction
                test    eax, eax


Is this code passing a function pointer to SomeFunction?

Code Select Expand


typedef BOOL(_stdcall *pfSomeFunction)(int, int, pfAnotherFunction);

[Kp]

Looks like it, yes.

[K]

Thanks for the help with these basic questions.  I've got a couple more:

Code Select Expand


mov     ecx, [ebp+arg_C]
mov     ecx, [ecx]


does this indicate that arg_C is a pointer of some type?

IDA generated this:

Code Select Expand


AdminEventCallback proc near

arg_0           = dword ptr  8
event_id        = dword ptr  0Ch
arg_C           = dword ptr  14h

; .....

retn 10h


there are three arguments at 4 bytes each (12bytes), yet 16 are returned to the stack at the end -- is there an argument between event_id and arg_C that just isn't used and therefore isn't generated by IDA?

[Adron]

1. Yes, arg_C seems to be a pointer.

2. Perhaps so. It's also possible that it is used in some way IDA doesn't notice - perhaps the address of event_id is taken and then indexed from?

[K]

1. Yes, arg_C seems to be a pointer.

2. Perhaps so. It's also possible that it is used in some way IDA doesn't notice - perhaps the address of event_id is taken and then indexed from?

So the mystery argument would be offset 10h;

Code Select Expand


arg_0          = dword ptr  8
event_id       = dword ptr  0Ch
arg_?          = dword ptr 10h
arg_C          = dword ptr  14h

; is this code referencing arg_?
; I get confused with the +/- offsets for local variables
; and arguments.
mov     eax, [ebp+arg_0]       ; ebp - 8 + 18h = ebp + 10h
and     dword ptr [eax+18h], 0 ; ebp + 8 + 18h = ebp + 20h


[Adron]

Code Select Expand


; is this code referencing arg_?
; I get confused with the +/- offsets for local variables
; and arguments.
mov     eax, [ebp+arg_0]       ; ebp - 8 + 18h = ebp + 10h
and     dword ptr [eax+18h], 0 ; ebp + 8 + 18h = ebp + 20h


No, it's moving the value passed as arg_0 into eax. Then it's zeroing out a value at offset 0x18 from that. This means that arg_0 probably is a pointer to a struct.

[K]

No, it's moving the value passed as arg_0 into eax. Then it's zeroing out a value at offset 0x18 from that. This means that arg_0 probably is a pointer to a struct.

I see now.  Thanks for the help, I'm trying to get a handle on this  .