Step 2 – following the call stack

Follow the stored esp value in the stack and then the next stored esp value until you land on the first return address, as shown in the following screenshot:

Figure 13: The last return address in the stack window in OllyDbg

Now, follow the return address on the disassembled section in the CPU window, as follows:

Figure 14: Following the last return address in OllyDbg

Now, you have reached the first call in the unpacked section, and the only step left is reaching the OEP.