title: x86 assembly "push OFFSET ..." and mnemonics?
body: <p>I'm trying to teach myself a bit of assembly by creating small C programs in <strong>Visual Studio 2012 Express</strong>, and then disassembling them in <strong>Immunity Debugger</strong>. But I've obviously run into something I do not understand:</p>
  
  <pre><code>012A13F0   68 58582A01      PUSH OFFSET Hello_Wo.??_C@_0M@KPLPPDAC@H&gt;; ASCII "Hello World"
  012A13F5   FF15 BC922A01    CALL DWORD PTR DS:[&lt;&amp;MSVCR110D.printf&gt;]  ; MSVCR110.printf
  </code></pre>
  
  <p>I'm confused by both of these instructions. In fact, the opcodes make more sense to me than the actual instructions depicted by the debugger.</p>
  
  <p>Obviously, the first instruction pushes an address onto the stack. When I follow the address in the dump, it shows me an area which contains some hexadecimals that comprise the string <code>Hello World</code>. I believe this is the <code>.data segment</code>. Am I correct?</p>
  
  <p>And also; I guess <code>Hello_Wo.??_C@_0M@...</code>  is just a visual aid provided to me by the debugger, so I could better understand that this is... Something...</p>
  
  <p>But what does the <strong>OFFSET</strong> mean in this push instruction? I haven't been able to find anything on Google on it.</p>
  
  <p>I would also like to ask about the other instruction...</p>
  
  <p>As far as I understand, it is trying to call a routine by using the 4-byte value located at the address <code>DS:[102A92BC] (&amp;MSVCR110D...)</code>, <em>as the address of the call</em>?</p>
  
  <p>The debugger tells me that <code>DS:[102A92BC] = 5C0A93A0</code>. And that memory range is reserved for MSVCR110's <code>.text segment</code>.</p>
  
  <p>I'm very sorry, but I had a hard time making this question, as I wasn't even really sure how I should ask it. I hope you understand. And thank you.</p>
  
  <p><strong>Off-topic:</strong> I have one last question that is a bit stupid, and off-topic, but I hope you don't mind: You aren't suppose to read data segments as disassembled code, ever, are you? the imports data segment made me confused in my search for <code>5C0A93A0</code>.</p>