Question

So, while using IDA to disassemble a dll, I came across this class function:

mov eax, [ecx+4]
mov eax, [eax]
retn

I know ecx means this and eax is the return value, but I fail to understand what it returns. Any help?

Answer 1

class C
{
    int a;
    int *b; // ecx+4

    int get_b()
    {
        return *b;
    }
}

Of course, the actual type of a and *b is unknown, but they’re both 32-bit types. a could also be the pointer to the VMT, if the class has any virtual methods or destructors.