7. Quick Disassembly Examination of Executable Image

• The C++ compiler automatically adds the underscore and the @8 suffix to the end of the public procedure name: _COPYSTR@8

• To verify this, one could run the command

      dumpbin /disasm Release\M13.exe > Release\M13.txt
  

  and examine the resulting Disassembly file M13.txt.

• Please note that when using PROC directive when defining procedures such as COPYSTR, the explicit setting and releasing of the stack frame using the EBP register isn't necessary. The assembler automatically controls the stack. Here is the excerpt from the M13.txt dump:

      Dump of file Release\M13.exe
  
      File Type: EXECUTABLE IMAGE
  
      _COPYSTR@8:
        00401000: 55                 push        ebp
        00401001: 8B EC              mov         ebp,esp
        00401003: 8B 75 0C           mov         esi,dword ptr [ebp+0Ch]
        00401006: 8B 7D 08           mov         edi,dword ptr [ebp+8]
        00401009: 8A 06              mov         al,byte ptr [esi]
        0040100B: 88 07              mov         byte ptr [edi],al
        0040100D: 3C 00              cmp         al,0
        0040100F: 74 04              je          00401015
        00401011: 46                 inc         esi
        00401012: 47                 inc         edi
        00401013: EB F4              jmp         00401009
        00401015: 8B 45 08           mov         eax,dword ptr [ebp+8]
        00401018: C9                 leave
        00401019: C2 08 00           ret         8
  

• The LEAVE command is an equivalent of

                                     mov esp, ebp
                                     pop ebp