Question

I have the following assembly code on Windows and I want to make sure that I understand correctly.
edi contains some address i.e. 0x6090F454

In this case, what should eax have after the first mov instruction?

775672f3  mov eax,dword ptr [edi]

775672f5  mov dword ptr [ebp-50h],0 
775672fc  mov dword ptr [ebp-48h],0 

77567303  cmp eax,0FFFFFFFFh 

It seems to me that eax must have the value but I am not so sure about that.
For your information, C++ code for the above assembly is

if (sem->num != INVALID_FLAG) {
    ....
}

Also, here is what’s store in edi.

0:024> dd edi
6090f454  0c0e8fe0 ffffffff 00000000 00000000

Thank you in advance.

Answer 1

The line:

mov eax,dword ptr [edi]

will simply load whatever is stored at the address edi. So it’s a simple data load.

Since you don’t show what is at address edi (0x6090F434), we can’t tell you exactly what eax will be.

Based on the C++ code that is given, it looks like edi is the address of the num field. So it’s reading num into a register, then comparing it against 0xFFFFFFFF which is the INVALID_FLAG constant.