The malware calls Windows functions in a unique way to aid obfuscation, i.e. When the function ends, Windows makes a “ret” opcode then gets the last memory address that the malware pushed inside the stack, returning to this address and continuing the flow