Re: [spam][crazy] bomb malware

param_2 is edx which is 0 that's the first three pushed values then the function pointers, two of them ecx here is 0xffffc944. I type `p *$ecx` into gdb and see it's a valid dereferencable pointer. wonder where this came from. glancing up at the entrypoint assembly 08048167 89 e1 MOV ECX,ESP 08048169 83 e4 f0 AND ESP,0xfffffff0 $ecx is $esp before being aligned to 16 bytes.