> 80485b3: e8 00 00 00 00 call 80485b8 <X::f()+0xc> > 80485b8: 5b pop %ebx > 80485b9: 81 c3 5c 12 00 00 add $0x125c,%ebx With pop ebx, it pops the eip at that instruction to ebx. I'm guessing it'll use ebx as a base pointer to data (or code?) from this point on. You can verify this guess by accessing some global variables from within X::f() and see whether it uses ebx-relative access.
