8.2 Calling Function

The call instruction in the assembly language can be used to call a function. The general form of the call looks as follows:

call <some_function>

From a code analysis perspective, think of some_function as an address containing a block of code. When the call instruction is executed, the control is transferred to some_function (a block of code), but before that, it stores the address of the next instruction (the instruction following call <some_function>) by pushing it onto the stack. The address following the call which is pushed onto the stack is called the return address. Once some_function finishes executing, the return address that was stored on the stack is popped from the stack, and the execution continues from ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.