When debugging I sometimes see things as the following:

MOV EDI,DWORD PTR DS:[<&USER32.SendMessageA>]
CALL EDI

and other times the more common

CALL DWORD PTR DS:[<&KERNEL32.SendMessageA>]

I was wondering why compilers generate these two different set of instructions to do the same thing.

yaa
Posted on 2004-01-03 05:40:45 by yaa
in case of
MOV EDI,DWORD PTR DS:[<&USER32.SendMessageA>]
CALL EDI
you'll probably see some more calls to this api after that,
should be some kind of optimisation ;)
Posted on 2004-01-03 05:59:25 by Tola
Size of instruction, my friend

call memory is 6 bytes.

mov reg, memory is 6bytes. call reg is 2 bytes.

Therefore if the same function is called more than once, it is more favourable to use the second method. Registers used is usually ebx, esi, edi or ebp as they are not changed when calling other functions (other functions usually preserve ebx, edi, esi and ebp if they modify the value in it).
Posted on 2004-01-03 07:03:58 by roticv
What are ebx, esi, edi or ebp?
Posted on 2004-01-03 22:25:00 by bRaNcO
There are 8 general purpose registers. ebx, esi,edi and ebp are just 4 of the 8 registers. ebx is the base pointer. esi is the string source. edi is the string destination. ebp is the stack frame base.
Posted on 2004-01-03 22:32:59 by roticv
thx guys. everything is clear now.

yaa
Posted on 2004-01-04 05:45:19 by yaa