1/ I want to point out this thread has a good example of what happens during "reverse engineering": we frequently encounter inexplicably weird things that turn out to have perfectly straightforward explanations.
2/ It's where we are trying to figure things out that while we are "familiar" with the thing, we aren't "comfortable" with it -- meaning we know the facts but not the nuance.
3/ We then go up blind allies, where confirmation bias makes us keep going in that direction even when we've hit a dead end. We eventually back out and go a different direction, but this self-reinforced reasoning makes this take longer.
4/ In this case, Microsoft has an API "FindResource()" that can accept an argument that can be a string OR an integer. In this case, the number 101 was passed to the function, not "101" but 101, though the API is defined to take only (char*).
5/ It's such a bad thing for Microsoft to do that you just keep bumping over preconceptions about what's going on, grasping at any explanation but the right one.
6/ It comes from the days of Windows 3.1 in the 1980s when the difference between a string "#101" and number 101 meant saving space, back when 64k was large for the size of a program.
7/ By chance, I've used the function before in writing Windows apps, so I can more quickly cross this particular bump, but OMG I've been up so many blind allies exactly like this, over and over again, in my career.
8/ I remember the first time I encountered LEA the first time in code. It stands for "load effective address", what it means is doing a complex calculation consisting of two additions and a shift by a small amount.
9/ That's typical math for "address calculations", such as indexing into an array of structures. But it can be used to fold into a single instruction any calculation that fits that same pattern.
10/ And that's exactly what had happened: the code I was looking at wasn't an address calculation, but a series of calculations that happened to be optimized using this instruction. Even knowing this it took me a while to "grok" it.
