I'm no Walter, but I think he had it right. >> jmp dword ptr FLAT:_DATA[00h][EBX*4] It's not jumping to "ebx" but to "[ebx*4], which means the value (dword) at (ebx*4) is read first. The *4 also shows that the table contains dwords: the offsets of the code jumped to for each case. >> dd offset FLAT:?test@@YAHH at Z[014h] L.