mov rax, [rcx+0x10]
mov eax, [rax+0x4]

Here the value +0x10 is also used as a Pointer and after the destination Object Offset +0x4 is read

So +0x10 is probably a Pointer to another structure or Object

So for now we can have a basic model:

Object
|
+0x00 unknown
+0x04 integer / flag
+0x08 pointer-like
+0x10 pointer-like

But this is not the final Struct yet

This is just a Hypothesis

We need to check it with more instructions, Cross-References and other functions

Now let's move on to
Ghidra

When we find the different Offsets, we can create a Struct in Ghidra and add Fields to it

For example, at first we may only have this information:

User

0x00 unknown
0x04 field_4
0x08 field_8
0x10 field_10

After further investigation, we will find out:

User

0x00 unknown
0x04 id
0x08 name
0x10 address

That is, what was initially just:

field_8

slowly becomes:

name

And this is exactly one of the interesting parts of Reverse Engineering

Because The goal is not just to understand:

mov rax, [rcx+0x8]

what it does

The goal is to rebuild a logical model of the program from these instructions

That is, from:

[rcx+0x8]

to get to something like:

user->name

To reconstruct an unknown struct, keep this path in mind:

Find the Base Pointer

Collect the access offsets

Distinguish Read and Write

Check the size of the Memory Access

Check how the value is used

Find duplicate offsets in different functions

Separate Pointers from Integers

Check Nested Structures

Consider Padding and Alignment

10. Check Arrays and Strides

11. Make a Hypothesis

12. Confirm or modify it with Cross-Reference and further analysis

In the Source Code, we may very easily have:

user->name

But In Binary we may only see this:

mov rax, [rcx+0x8]

The job of the Reverse Engineer is to understand from this information:

RCX
↓
User Object
↓
+0x8
↓
name

That is, we reassemble the logical structure of the program from a few scattered Offsets and Instructions

@reverseengine