Introduction to Windows API

thiscall

The thiscall convention is Microsoft-specific for C++, so it appears often in C++ samples. The this argument is passed via ECX, while the rest are pushed in the stack. this is a pointer to an instance of a struct, and inside the function the struct arguments are generally used or initialized. In the example below, the first argument of the struct (x) is used by dereferencing it [ecx]. If a second argument was needed it would be taken via [ecx + 4] or any other number based on the size of the previous arguments.

1
FUN PROC
2
    push    ebp
3
    mov     ebp, esp
4
    ; ECX = this
5
    mov     eax, [ecx]       ; eax = this->x
6
    add     eax, [ebp+8]     ; + b  (first stack arg)
7
    pop     ebp
8
    ret     4               ; callee cleans 1 stack arg (b)
9
FUN ENDP

The caller simply populates ECX and pushes any extra arguments on the stack:

1
mov ecx, thisPtr
2
push b
3
call FUN_thiscall
4
 ; EAX = result