Mastering Assembly Programming

The call

There are several ways to replace the call instruction with a sequence of instructions that would perform exactly the same action but would be treated by decompilers in a different manner. For example, the following code would do exactly what the call instruction does:

   ; Preceding code   push  .return_address   ; Push the return address on stack   push  .callee           ; Redirect the execution flow to   ret                     ; callee.return_address:   ; the rest of the code

We may, as well, replace the following sequence:

push  calleeret

with, for example:

lea  eax, [callee]jmp eax

This would still yield the same result. However, we want our obfuscation to be a bit stronger; therefore, we proceed and create a macro.