The call stack is a relatively hard topic to understand, but it is very useful for speeding up your malware analysis process. It's also useful in the unpacking process.
Take a look at the following code and imagine what the stack will look like:
func 01:
1: push ebp
2: mov esp, ebp ;now ebp = esp
...
3: call func 02
...
func 02:
4: push ebp ;which was the previous esp before the call
5: mov ebp, esp ;now ebp = new esp
...
5: call func 03
...
func 03:
6: push ebp ;which is equal to previous esp
7: mov ebp, esp ; ebp = another new esp
...
You will notice that, just after the return address from call func03 in the stack, the address of the previous esp is stored. The previous esp value is stored in the stack. This stored esp value points to the top of the stack, just after instruction 5. On top of the stack from this previous esp value, the first esp value is stored (this is because of instruction 4...
