To apply this approach, you need to set the breakpoints on the APIs that the program will execute at some point. You can rely on the common APIs that are getting used, your behavioral analysis, or a sandbox report that will give you the APIs that were used during the execution of the sample.
Some examples of some known APIs are GetModuleFileNameA, GetCommandLine, CreateFileA, VirtualAlloc, HeapAlloc, memset, and so on.
First, you set a breakpoint on these APIs (use all of your known ones, except the ones that could be used by the unpacking stub) and execute the program until the execution breaks:
Figure 12: The return address in the stack window in OllyDbg
Now, you need to check the stack, since most of your next steps will be on the stack side. By doing this, you can start following the call stack.
