[HaBo]

#include <windows.h>
#include <string>

void function(void* src,unsigned length);
char buf[256];
const char* message = "success";
int main()
{
    FARPROC retAddr;
            
    char* writePtr = buf+4; //local var
    
    retAddr = GetProcAddress(LoadLibraryA("User32.dll"),"MessageBoxA");
    
    memcpy(writePtr,&retAddr,4);//funcAddr    //that lands at the retAddr
    writePtr+=4;
    //clean return
    retAddr = GetProcAddress(GetModuleHandleA("Kernel32.dll"),"ExitProcess");//clean exit
    memcpy(writePtr,&retAddr,4);//retaddr 2
    writePtr+=4;
    
    memset(writePtr,0,4);//hwnd
    writePtr+=4;    
    memcpy(writePtr,&message,4);//text
    writePtr += 4;
    memset(writePtr,0,8);//dmy params
    writePtr+=8;
    

    memset(writePtr,0,8);//4bytes allign + exit code
    writePtr+=8;
        
    function(buf,writePtr-buf);
    
    MessageBoxA(0,"usual behavior",0,0);
    return 0;
}

_declspec(noinline) void function(void* src,unsigned length)//4 bytes local vars
{
    void* buf;
    _asm mov buf,esp
    memcpy(buf,src,length);
}

00401090 51               push        ecx  
00401091 89 24 24         mov         dword ptr [esp],esp 
00401094 8B 14 24         mov         edx,dword ptr [esp] 
00401097 50               push        eax  
00401098 51               push        ecx  
00401099 52               push        edx  
0040109A E8 05 08 00 00   call        memcpy (4018A4h) 
0040109F 83 C4 10         add         esp,10h 
004010A2 C3               ret