start end bytes hex classification evidence 1020:0666 1020:0666 1 ba overlapping-entry-opcode BA 33 D2 is mov dx,0xd233 at 0666; entry 0667 intentionally decodes 33 D2 as xor dx,dx 1020:0dea 1020:0dea 1 90 alignment single NOP between the 0d97 and 0e93 Borland runtime routines