Is this really a function IDA could not decode?

Question

I have the following IDA output:

BEGTEXT:00415A2C read_dpc_sub_415928 endp
BEGTEXT:00415A2C
BEGTEXT:00415A2C ; ---------------------------------------------------------------------------
BEGTEXT:00415A2D                 align 10h
BEGTEXT:00415A30                 push    ebx
BEGTEXT:00415A31                 push    edx
BEGTEXT:00415A32                 mov     edx, eax
BEGTEXT:00415A34                 call    sub_41576C
BEGTEXT:00415A39                 mov     ebx, eax
BEGTEXT:00415A3B                 call    sub_415758
BEGTEXT:00415A40                 mov     eax, ebx
BEGTEXT:00415A42                 call    sub_4158C8
BEGTEXT:00415A47                 mov     eax, ebx
BEGTEXT:00415A49                 pop     edx
BEGTEXT:00415A4A                 pop     ebx
BEGTEXT:00415A4B                 retn
BEGTEXT:00415A4B ; ---------------------------------------------------------------------------

As you can see, IDA has considered that this is a code block but it hasn't been made a function.

Can you explain how one should try handle this situation ?

i.e. is this really code in the end and what to consider when making a function.

(if that matters, the executable is a 32-bit Windows one)

Answer 1

You can make it a function by placing a cursor to address 00415A2C in disassembly view and pressing P. If this doesn't work you can select the whole function and, again, press P. The documentation on this action is located here. If all this doesn't work, undefine align 10h by pressing U, make resulting bytes code by pressing C and try again.

There are a lot of reasons why this function has not been created automatically, including, but not limited by:

• This function is not called directly
• This function is not called at all
• IDA autoanalysis was unable to find a reference to this function as function