format PE64 console
include 'win64wx.inc' ;

entry main 

section '.text' code readable executable

main:
mov rbp, rsp
and rsp, -16
sub rsp, 32

call  a
call [ExitProcess]

ret

a:
push rbp
mov rbp, rsp

sub rsp, 32

push rcx
push rdx
pop rcx
pop rdx
add rsp, 32

pop rbp
ret
;endp


section '.idata' data readable import
library kernel32, 'kernel32.dll', msvcrt,   'msvcrt.dll',shell,'SHELL32.DLL'
import kernel32, GetCommandLine,'GetCommandLineA', \
ExitProcess,'ExitProcess'
    

 
call a

    

call [ExitProcess]


    

format PE64 console
include 'win64wx.inc' ;

entry main 

section '.text' code readable executable

main:
mov rbp, rsp
and rsp, -16


;this works fine
;call a

;------------------------------------------
;why?? this error
;lea rax, [a]
;call qword [rax]
;------------------------------------------



;this works fine:
;call [ExitProcess]

; this works fine
;lea rax, [ExitProcess]
;call qword [rax]

;this works fine.
;mov rax, ExitProcess
;call qword [rax]

;this call error: because ExitProcess is a pointer variable?
;mov rax, [ExitProcess]
;call qword [rax]

; this error. as inner a is the code, not the address.
;mov rax, [a]
;call qword [rax]

;this error. as inner a is the code, not the addres.
;mov rax, a
;call qword [rax]



ret

a:

ret

section '.data' data readable writeable
eee db 'abc',0


section '.idata' data readable import
library kernel32, 'kernel32.dll', msvcrt,   'msvcrt.dll',shell,'SHELL32.DLL'
import kernel32, GetCommandLine,'GetCommandLineA', \
ExitProcess,'ExitProcess'





    

call a    

call [ExitProcess]    

lea rax, [a]
mov [MyIndirectVar], rax
...
call [MyIndirectVar]
...


MyIndirectVar dq 0    

Code:

call a    

encodes a relative offset to the label a, so it works because it's always loaded at a fixed offset in your output binary (it's your function in your code).

Code:

call [ExitProcess]    

first obtains the 64-bit qword at where ExitProcess is (which is in the import address table), then calls that value, which has the 64-bit address of the code in the system library. So it's an indirect call.

You might ask why is the indirection needed? Because you don't know where the system library will be loaded. It's not fixed relative to your code.

So the OS has an "import address table" that is a list of addresses for such functions that gets filled in when the library gets loaded. What the executable stores is info about the function, such as its name (ExitProcess). It then looks it up and fills the value at [ExitProcess] with its actual address, so you can call it in code.

So "ExitProcess" itself does not point to the system code, it points to the import address in your binary. It's the qword value obtained from where it points to that points to the system code.

If you wanted something similar with "a" you'd do e.g.:

Code:

lea rax, [a]
mov [MyIndirectVar], rax
...
call [MyIndirectVar]
...


MyIndirectVar dq 0    

@Furs
thanks, be figured out:


;this works fine
;call a

;this works too
;lea rax, [a]
;mov [MyIndi​​rectVar], rax
;lea rax, [MyIndi​​rectVar]
;call qword [MyIndi​​rectVar]

; this works three
;lea rax, [a]
;mov [MyIndi​​rectVar], rax
;lea rax, [MyIndi​​rectVar]
;call qword [rax]


;this do not work:
;lea rax, [a]
;call qword [rax]

ExitProcess dq actual_address_to_the_function_after_runtime_load