Introduction to Windows API
- Author
- Moise Medici
- Updated
- 23 Jan 2026 · Completed
Assembly Calling Conventions
When reading the decompiled assembly call from Ghidra, it is common to see functions preceded by a string like __thiscall, for example:
undefined __thiscall FUN_10001910 (void * this , wchar_t)The undefined is the return type that the decompiler was not able to understand, while the second string __thiscall is the calling convention.
There are 4 main conventions that are commonly encountered. These conventions determine:
- How to pass arguments to the function and which registers or stack to use
- Where the return value is stored
- Who cleans the stack used by the function
The conventions are summarized below:
| Convention | Arguments Location | Return Location | Stack Cleanup |
|---|---|---|---|
cdecl | Stack (pushed right → left) | EAX | Caller |
stdcall | Stack (pushed right → left) | EAX | Callee |
fastcall | First args in registers (commonly ECX, EDX), rest on stack | EAX | Callee |
thiscall | this in ECX, other args on stack | EAX | Callee (usually) |
Below is a comparison of the same function (FUN) which sums two numbers, with one example for each convention, and a more in-depth explanation of the convention.