Learning Malware Analysis

8.4 Function Parameters And Return Values

In the x86 architecture, the parameters that a function accepts are pushed onto the stack, and the return value is placed in the eax register.

In order to understand the function, let's take an example of a simple C program. When the following program is executed, the main() function calls the test function and passes two integer arguments: 2 and 3. Inside the test function, the value of arguments is copied to the local variables x and y, and the test returns a value of 0 (return value):

int test(int a, int b){     int x, y;     x = a;     y = b;            return 0;}int main(){    test(2, 3);    return 0; }

First, let's see how the statements inside the main() function are translated into assembly instructions:

push 3 ...