What would this register contain after...

Question

I can't seem to figure out what eax contains after this peice of assembly:

mov     edi, [edi+4]
lea     eax, [edi+88h]

With edi pointing to a class

Answer 1

A long shot, since I know nothing about your class, but here goes anyway.

Do you have multiple inheritance? Perhaps edi+4 is the second virtual table, and [edi+4]+88h is a function pointer you wish to call? Or depending on your compiler, it might be that the virtual table is located at +4, in either case eax contains the address of the virtual function to call.

Answer 2

Load Effective Address gets the actual address of the reference. For some arcane reason, the symbolic assembly is written as if it references the content of edi+88h, but what the instruction actually does is loading the value of the edi register plus the constant 088h (equivalent to mov eax, edi; add eax, 088h). I doubt edi+4 is a function pointer: more likely, it's a vtbl pointer or an array.

Answer 3

Based on the use of edi, it probably ends up pointing to a memory location, but lea isn't always used like this: http://en.wikipedia.org/wiki/Addressing_mode#Useful_side_effect.

Answer 4

mov     edi, [edi+4]
lea     eax, [edi+88h]

    edi points here after 'mov'
    .
    xxxx....................
    |                      ^
xxxx....                   eax points here after 'lea'
^
edi pointed here before 'mov'

char* edi;
void* eax;

edi = *(char**)(edi+4);
eax = edi+0x88;

It looks like some record is just getting accessed there.