Borland Delphi 6.0-7.0
00509cb0 > $-PUSH EBP
00509CB1.8BEC MOV Ebp,esp
00509cb3.83c4 EC ADD esp,-14
00509cb6. EBX PUSH
00509cb7.
00509cb8. $ PUSH EDI
00509cb9.33c0 XOR eax,eax
00509CBB. 8945 EC MOV DWORD PTR ss:[ebp-14],eax
00509CBE. B8 20975000 MOV eax,unpack.00509720
00509CC3. E8 84CCEFFF Call unpack.0040694c
Microsoft Visual C + + 6.0
00496eb8 >/$-PUSH EBP; (initial CPU selection)
00496eb9 |. 8BEC MOV EBP,ESP
00496EBB |. 6A FF PUSH-1
00496EBD |. 40375600 PUSH screensh.00563740
00496ec2 |. 8cc74900 PUSH screensh.0049c78c; SE Handler Installation
00496ec7 |. 64:a1 0000000>mov eax,dword PTR fs:[0]
00496ECD |. PUSH EAX
00496ECE |. 64:8925 00000>mov DWORD PTR fs:[0],esp
00496ed5 |. 83EC esp,58 SUB
Microsoft Visual C + + 6.0 [Overlay] e language
00403831 >/$
00403832 |. 8BEC MOV EBP,ESP
00403834 |. 6A FF PUSH-1
00403836 |. F0624000 PUSH NISY521.004062F0
0040383B |. a44c4000 PUSH NISY521.00404CA4; SE Handler Installation
00403840 |. 64:a1 0000000>mov eax,dword PTR fs:[0]
00403846 |. PUSH EAX
00403847 |. 64:8925 00000>mov DWORD PTR fs:[0],esp
Microsoft Visual Basic 5.0/6.0
00401166-ff25 6c104000 JMP DWORD PTR ds:[<&msvbvm60. #100;]; MSVBVM60. Thunrtmain
0040116C > 147c4000 PUSH packme.00407c14
00401171 E8 f0ffffff call <jmp.&msvbvm60. #100 >
00401176 0000 ADD BYTE PTR ds:[eax],al
00401178 0000 ADD BYTE PTR ds:[eax],al
0040117A 0000 ADD BYTE PTR ds:[eax],al
0040117C XOR BYTE PTR ds:[eax],al
or omit the first line of JMP
00401FBC > d0d44000 push dumped_.0040d4d0
00401fc1 E8 eeffffff call <jmp.&msvbvm60. Thunrtmain>
00401fc6 0000 Add byte ptr ds:[eax],al
00401fc8 0000 Add byte ptr ds:[eax],al
00401FCA 0000 Add byte ptr ds:[eax],al
00401FCC xor byte ptr ds:[eax],al
00401FCE 0000 Add byte ptr ds:[eax],al
bc++
0040163C > $/eb JMP short bclock.0040164e
0040163E |66 DB 66; CHAR ' F '
0040163F |62 DB 62; CHAR ' B '
00401640 |3a DB 3 A; CHAR ': '
00401641 |43 DB 43; CHAR ' C '
00401642 |2b DB 2B; CHAR ' + '
00401643 |2b DB 2B; CHAR ' + '
00401644 |48 DB 48; CHAR ' H '
00401645 |4f DB 4F; CHAR ' O '
00401646 |4f DB 4F; CHAR ' O '
00401647 |4b DB 4 B; CHAR ' K '
00401648 |90 NOP
00401649 | E9 DB E9
0040164A. |98e04e00 DD OFFSET Bclock.___cppdebughook
0040164E > \a1 8be04e00 MOV eax,dword PTR ds:[4ee08b]
00401653. C1E0 eax,2 SHL
00401656. A3 8fe04e00 MOV DWORD PTR ds:[4ee08f],eax
0040165B. PUSH EDX
0040165C. 6A 0,/pmodule = NULL
0040165E. E8 dfbc0e00 call <jmp.&kernel32. getmodulehandlea>; \getmodulehandlea
00401663.8bd0 MOV edx,eax
Dasm:
00401000 >/$ 6A 0;/pmodule = NULL
00401002 |. E8 c50a0000 call <jmp.&kernel32. getmodulehandlea>; \getmodulehandlea
00401007 |. A3 0c354000 MOV DWORD PTR ds:[40350c],eax
0040100C |. E8 b50a0000 call <jmp.&kernel32. getcommandlinea>; [Getcommandlinea
00401011 |. A3 10354000 MOV DWORD PTR ds:[403510],eax
00401016 |. 6A 0A PUSH 0A;/arg4 = 0000000A
00401018 |. FF35 10354000 PUSH DWORD PTR ds:[403510]; | ARG3 = 00000000
0040101E |. 6A to PUSH 0; | ARG2 = 00000000
00401020 |. FF35 0c354000 PUSH DWORD PTR ds:[40350c]; | ARG1 = 00000000
2.OD Judgment Writing language
