In addition, there is the book that Tomasz participated as a technical consultant on.

Mastering Assembly Programming

@DimonSoft: Yes, i only do programming in VMs. I have a windows 10 host running a win10 developer vm. And also win7 testing enviroments. I never develop on host machines. I have set up qemu and freedos and already played around with fasmd. I really like dos i have to admit. To bad it is pretty outdated by now and nobody is using it anymore. But luckily i still have several WinXP copies lying around somewhere.

What debugger do you use? In general, I prefer debuggers over print debugging. What is confusing though is, that unlike in high level languages you don't exactly step through the lines of code you have written. So you end up stepping through the code that the assembler has written out of your code. That's pretty confusing. I mean, that makes sense since you can't step through your macros and stuff line by line as they get converted into assembly as well, but that's confusing: what line in the debugger corresponds to the the line in my code. And also plain assembly code you have written is changed by the assembler due to optimization I guess.
Stepping through the debugger is a bit like: "hum, that's not what I have written, where am I right now.. and what is it doing.. "
That might sound pretty silly, but I guess that comes from working with visual studio 10 years, where you can step exactly through every line you have written and how you have written them.

WinXP is the last Windows version which has full-featured NTVDM (environment to run old apps) without severe limitations.

It you are familiar with VS, C++ and can do basic stuff (arrays, pointers etc), I would recommend you try to compile some simple C code, debug it with asm listing enabled, then recompile with optimization and examine step-by-step again. Hope a few iterations will help to get a clue.

Quote:

WinXP is the last Windows version which has full-featured NTVDM (environment to run old apps) without severe limitations.

Oh, didn't know that. Thought the last version was Window ME.

Windows Me was last in the 9x line, which was running on top of an actual DOS. NTVDM is something different - it is a subsystem on NT kernel that allows to run DOS programs in V86 mode. Also, it has a great DPMI implementation (an exemplary one), so you can run tools like FASMD with no problems.

format PE GUI 4.0
entry start

include 'win32w.inc'

virtual at 0
        PEB:
        db $A4 dup (?)
        .OSMajorVersion db ?
        db 3 dup (?)
        .OSMinorVersion db ?
        db 3 dup (?)
end virtual


section '.text' code readable executable

proc start
        mov     al,[ebx+PEB.OSMajorVersion]
        add     byte[_Version],al
        mov     al,[ebx+PEB.OSMinorVersion]
        add     byte[_Version+2*sizeof.TCHAR],al
        invoke  MessageBox,NULL,_Version,_winVerTitle,MB_OK
        ;xor     eax,eax ;mov    eax,ExitCode ; there is no needance in xor     eax,eax - MessageBox already done that for us
        ret
endp

section '.data' data readable writeable

  _Version TCHAR '0.0',0
  _winVerTitle TCHAR 'Windows version',0

section '.idata' import data readable writeable

  library user32,'USER32.DLL' ; even without kernel32 import

  include 'os specific/windows/api/x86/user32.inc'      

format PE GUI 4.0
entry start

include 'win32w.inc'

virtual at 0
        PEB:
        dd ?,?
        .ImageBaseAddress dd ?
end virtual

section '.text' code readable executable

proc start

        mov     eax,[ebx+PEB.ImageBaseAddress] ;invoke  GetModuleHandle,0 - cut it off - it is require kernel32
        mov     [wc.hInstance],eax
        invoke  LoadIcon,0,IDI_APPLICATION
        mov     [wc.hIcon],eax
        invoke  LoadCursor,0,IDC_ARROW
        mov     [wc.hCursor],eax
        invoke  RegisterClass,wc
        test    eax,eax
        jz      error

        invoke  CreateWindowEx,0,_class,_title,WS_VISIBLE+WS_DLGFRAME+WS_SYSMENU,128,128,256,192,NULL,NULL,[wc.hInstance],NULL
        test    eax,eax
        jz      error

  msg_loop:
        invoke  GetMessage,msg,NULL,0,0
        cmp     eax,1
        jb      end_loop
        jne     msg_loop
        invoke  TranslateMessage,msg
        invoke  DispatchMessage,msg
        jmp     msg_loop

  error:
        invoke  MessageBox,NULL,_error,NULL,MB_ICONERROR+MB_OK

  end_loop:
        mov     eax,[msg.wParam] ; invoke  ExitProcess,[msg.wParam] - cut it off - it is require kernel32
        ret                      ;
endp

proc WindowProc uses ebx esi edi, hwnd,wmsg,wparam,lparam
        cmp     [wmsg],WM_DESTROY
        je      .wmdestroy
  .defwndproc:
        invoke  DefWindowProc,[hwnd],[wmsg],[wparam],[lparam]
        jmp     .finish
  .wmdestroy:
        invoke  PostQuitMessage,0
        xor     eax,eax
  .finish:
        ret
endp

section '.data' data readable writeable

  _class TCHAR 'FASMWIN32',0
  _title TCHAR 'Win32 program template',0
  _error TCHAR 'Startup failed.',0

  wc WNDCLASS 0,WindowProc,0,0,NULL,NULL,NULL,COLOR_BTNFACE+1,NULL,_class

  msg MSG

section '.idata' import data readable writeable

  library \;kernel32,'KERNEL32.DLL',\
          user32,'USER32.DLL'

  ;include 'os specific/windows/api/x86/kernel32.inc'
  include 'os specific/windows/api/x86/user32.inc'    

ImageBase = $ - rva $    

thou could force relocation to exe adding errorneus imagebase & adding reloc section - so calculated in design time "ImageBase = $ - rva $" would have same errorneus value

... just wondering, is the EBX value for the real entry point guaranteed (documented somewhere) to hold the pointer or is it a version-specific stuff?