Learning Malware Analysis

8.2 Calling Function

The call instruction in the assembly language can be used to call a function. The general form of the call looks as follows:

call <some_function>

From a code analysis perspective, think of some_function as an address containing a block of code. When the call instruction is executed, the control is transferred to some_function (a block of code), but before that, it stores the address of the next instruction (the instruction following call <some_function>) by pushing it onto the stack. The address following the call which is pushed onto the stack is called the return address. Once some_function finishes executing, the return address that was stored on the stack is popped from the stack, and the execution continues from ...