Abstract: Identification of information about functions forms the base of static binary analysis and malicious code detection.A heuristic approach to detect metamorphic virus is to examine the calls a binary makes to the operating system.To avoid this，malicious code programmers hide the information about functions using a variety of obfuscations，including substitution of call with another equivalent instruction sequences，changing the normal form of parameters passing and returning process.These obfuscation methods introduce much difficulty for reverse code analysis.To deal with the problem，this article presents a static method which can detect obfuscated function calls in a binary efficiently.