format PE GUI 4.0
entry start

macro FindKernelBase saveadd
{ 
local blah1 
mov eax, [esp] 
and eax, 0FFFF0000h 
blah1: 
cmp dword [eax], 00905A4Dh 
je saveadd 
sub eax, 1000h 
jmp blah1 
}


start:

FindKernelBase aLabel

db "some code"

aLabel:    

+++++++++++++++++++ ASSEMBLY CODE LISTING ++++++++++++++++++
//********************** Start of Code in Object .flat **************
Program Entry Point = 00401000 (test.exe File Offset:00001400)



//******************** Program Entry Point ********
:00401000 8B0424                  mov eax, dword ptr [esp]
:00401003 250000FFFF              and eax, FFFF0000

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401015(U)
|
:00401008 81384D5A9000            cmp dword ptr [eax], 00905A4D
:0040100E 7410                    je 00401020
:00401010 2D00100000              sub eax, 00001000
:00401015 EBF1                    jmp 00401008
:00401017 736F                    jnb 00401088
:00401019 6D                      insd
:0040101A 6520636F                and byte ptr gs:[ebx+6F], ah
:0040101E 64                      BYTE 064h


:0040101F 65                      BYTE 065h



* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040100E(C)
|
:00401020 00000000000000000000    BYTE 10 DUP(0)