during an analysis, I have found the following :
... call program.00401535 ... (a few lines later) ... ... call program.00401535 ... ...
So, it call the same function. When I step over that first call, nothing happens. But later, when I step over the second call, suddenly I get the message "000004C0 terminated, exit code 0" and ollydbg is running, running...and running. So, I have decided to look into that function and I see the following:
PUSH EBP MOV EBP, ESP 00401538 PUSH 1000 | CALL DWORD PTR DS:[40241C] ; which is kernel32.Sleep -------------- JMP SHORT program.00401538 LEAVE RETN
So, it is simple what it is doing here. Since we have unconditional jump, it always lets the program sleep for a while. In other words, that function should never return.
But my question would be: Why it was possible for me to step over the first call, and not over the second ? I googled for Sleep() as anti-debugging trick but I did not find anything about that. Can somebody tell me what can I do in such a case?