It was fairly straightforward to see in this case honestly. I made a habit of looking at both the disassembly and decompiled code – my previous project was in I

It was fairly straightforward to see in this case honestly. I made a habit of looking at both the disassembly and decompiled code – my previous project was in IDA Free which had no decompilation, so I was used to referring to the disassembly. The address to use for breakpoints also come from the disassembly, so one naturally spends a lot of time looking at it. In the first case, the decompiled code reports a function call, but in the disassembly it is preceded by pushing some suspicious-looking magic numbers onto the stack which are not reported in the decompiled code – clearly, something was going on there. In the second case, the "ret" instruction at the supposed end of the function was immediately preceded by pushing an address to the stack – so again fairly simple to determine that the return must necessarily jump to that address, rather than return from the function.