This has been used for decades by malware and shellcode that needs to be compact and position-independent (loaded at any virtual address). It is clever and as a

This has been used for decades by malware and shellcode that needs to be compact and position-independent (loaded at any virtual address). It is clever and as a side effect is that the string is already loaded on the stack, so if your next step is to call a function with that string as an argument, you can just call that function directly. It used to confuse a lot of disassemblers, where you'd have to re-synchronize the disassembly after the string and disambiguate between 'code' and 'data' by hand.