Two instructions look similar in disassembly but do opposite things with memory.
| Instruction | What it does | C analogy |
|---|---|---|
mov ecx, [ebp+Pswrd_2] |
Reads the value stored at address ebp+Pswrd_2 into ecx |
ecx = Pswrd_2; (where Pswrd_2 is a pointer variable) |
lea esi, [edi+0B68h] |
Computes the address edi + 0xB68 and stores it in esi; does not read memory |
esi = &some_data[0xB68]; or esi = edi + 0xB68; |
Key points:
- lea is the "address-of" instruction. The brackets [...] in its operand define addressing mode, but the result is just a number put into the destination register.
- mov with a memory operand dereferences. The value at the computed address is copied into the register.
- Compilers also use lea for simple arithmetic because lea esi, [edi+0B68h] is often faster than add esi, edi, 0B68h.
- If you see cmp reg1, reg2 after loading two "string" values, it is comparing pointers, not string contents.
To see contents at an address in WinDbg, use db address, da address, or du address — not lea, which does not touch memory.
Related: WinDbg Stack Inspection Commands, Pointer Comparison vs Content Comparison in Assembly