Hmm, I'm tempted to suggest quite a lot of reading now. Ok, let's see what should be relevant "starter" material.
Reading:
Intel's IA32 - Vol1 (which is a basic architectural overview of x86 assembly)
Intel's IA32 - Vol2 (used as an instruction set reference)
OOP and Inheritance (Object oriented programming, base classes, derived classes)
Virtual Functions (make sure you understand OOP and Inheritance first, as virtual functions are only relevant in that context, and try to learn some assembly first, as you'll probably need to know how this is implemented at the assembly level to truely understand what is needed. I suppose you can get by without really understanding it in this much depth, but it will certainly help).
Stack Frames (and C++ calling convenctions)
Tools/files:
OllyDbg (a disassembler/debugger, free download, google it)
Outpost2.udd (a comment file for OllyDbg, check the programming forum)
C++ compiler (use the microsoft one of course, version 6, or 5 if you need to)
I would like to first point out that the Intel docs are very large. Here's how big the (older) versions I have are. The first one, Vol 1, is 432 pages, and the second one, Vol 2, is 954 pages. Only use Vol 2 as a reference. If you need to know what an instruction does, look it up in Vol 2, otherwise don't waste your time. Only a very small subset of the total opcodes are likely used in any given program, and you don't need to know all 300 or so.
It may help to read through some of Vol 1 like a text book if you're not familiar with assembly. There are other ways to learn though, this is just a possible suggestion. One thing about using the Intel docs is they're very thorough, and you won't need to know about every aspect they talk about. Most assembly tutorials tend to focus only on the core set of instructions which is what you need. You basically just need to know about the 8
general purpose registers, and the basic integer artihmetic, logic, and flow control instructions.
You don't need to know anything about processor hardware layout, or certain operating modes, like real mode, virtual 8086 mode, system management mode (SMM), or specifics of how protected mode works (although your code will be running at user priveldge in a protected mode environment) and you don't need to know certain instruction families such as floating point (x87 FPU), MMX, SSE (uses XMM registers), or about any of the data types larger than a double word (DWORD, which is 32 bits) since the larger data types only apply to those extra instruction families. You also don't need to know about interrupts or exceptions (but you do need to know about procedure calls and the stack, which is talked about in the first part of the same chapter). You also don't need to worry about the deimal arithmetic instructions (which work on the general purpose registers). If it says BCD anywhere, then it's decimal arithmetic and it's not relevant. Also ignore I/O instrutions and Segment Register instructions, as you won't see these, nor will you be priviledged enough in user code to actually make use of them.
Basically, if you read Vol 1, you want to read parts of chapters 3-7. Skipping the above sections. Everything beyong chapter 7 deals with those extra instruction sets and is quite irrelevant.
It would be helpful to play around with the C++ compiler and OllyDbg to familiarize yourself with them. Write a few simple C++ programs, compile them, and the open the exe with OllyDbg. Take a look at the assembly code, and try to find where your main function is. (This is much easier when you have a small example with very little code, as the entry point in the assembly file will be in the C runtime (CRT), and not at the entry point of your main function). Try to understand how the assembly works, and that it does correspond to what your C++ program is doing. Also try to match up the first few instructions of the function and the last few instructions of the function with how the stack frame is layed out. Having a good understand of stack frames and calling conventions will help you understand function calls, and recognize the few oddities that occasionally occur.
Well, now that I've taken the time to write that up, you'd better start reading.
