How do you recognize that a function call is being set up (arguments loaded into registers)?

Look for the argument registers %rdi, %rsi, %rdx, %rcx, %r8, %r9 being written just before a call — those writes are the arguments, in order.

# Setting up: strings_not_equal(input, expected)
mov  $0x402490, %esi
mov  %rbx, %rdi
call <strings_not_equal>

Here:

• %rdi = 1st argument (our input string)
• %esi = 2nd argument (expected string address)

Another example — write syscall:

mov  $1, %edi
lea  msg(%rip), %rsi
mov  $13, %edx
call <write@PLT>

• %edi = fd (1 = stdout)
• %rsi = buffer address
• %edx = byte count (13)

How to read it:

1. Find the call instruction
2. Scan upward for the nearest writes to %rdi, %rsi, %rdx, %rcx, %r8, %r9
3. Those are the arguments, in that order

Gotcha: Only look at writes between the previous call (or function entry) and this call. Registers may have been set earlier but clobbered by an intervening call.

Go deeper:

• System V AMD64 calling convention — first six integer/pointer args go in rdi, rsi, rdx, rcx, r8, r9