Quick introduction to reverse engineering for beginners

mov eax, ecx
mov ecx, DWORD PTR _a$[esp-4]
mov DWORD PTR [eax], ecx
mov DWORD PTR [eax+4], edx
ret 8
??0c@@QAE@HH@Z ENDP ; c::c
?dump@c@@QAEXXZ PROC ; c::dump, COMDAT
; _this$ = ecx
mov eax, DWORD PTR [ecx+4]
mov ecx, DWORD PTR [ecx]
push eax
push ecx
push OFFSET ??_C@_07NJBDCIEC@?$CFd?$DL?5?$CFd?6?$AA@
call _printf
add esp, 12 ; 0000000cH
ret 0
?dump@c@@QAEXXZ ENDP ; c::dump
That’s all. One more thing to say is that stack pointer after second constructor calling wasn’t corrected
with add esp, X. Please also note that, constructor has ret 8 instead of RET at the end.
That’s all because here used thiscall 2.5.4 calling convention, the method of passing values through the
stack, which is, together with stdcall 2.5.2 method, offers to correct stack to callee rather then to caller. ret
x instruction adding X to ESP, then passes control to caller function.
See also section about calling conventions 2.5.
It’s also should be noted that compiler deciding when to call constructor and destructor — but that’s
we already know from C++ language basics.
1.16.1 GCC
It’s almost the same situation in GCC 4.4.1, with few exceptions.
public main
main proc near ; DATA XREF: _start+17
var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_10 = dword ptr -10h
var_8 = dword ptr -8
push ebp
mov ebp, esp
and esp, 0FFFFFFF0h
sub esp, 20h
lea eax, [esp+20h+var_8]
mov [esp+20h+var_20], eax
call _ZN1cC1Ev
mov [esp+20h+var_18], 6
mov [esp+20h+var_1C], 5
lea eax, [esp+20h+var_10]
mov [esp+20h+var_20], eax
call _ZN1cC1Eii
lea eax, [esp+20h+var_8]
mov [esp+20h+var_20], eax
82