.386
.model flat,stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
includelib kernel32.lib
includelib user32.lib
 
.data
	szProcess					db 'explorer.exe',0
	szKernel					db 'KERNEL32',0
	szGetProcAddress			db 'GetProcAddress',0
 
.data?
	hProcess					dd ?
	lpInjected					dd ?
	lenInjected					dd ?
	pInfo						PROCESS_INFORMATION <>
	sInfo						STARTUPINFO <>
 
   Injected PROTO:DWORD
.code
    start:
 
	;Creamos el Proceso
	invoke CreateProcess,0,addr szProcess,0,0,0,CREATE_SUSPENDED,0,0,addr sInfo,addr pInfo
	push pInfo.hProcess
	pop hProcess
 
	;Obtenemos el tamaño de Injected
	mov ebx,EndInjected
	sub ebx,Injected
	mov lenInjected,ebx
 
	;Reservamos espacio en memoria para la función a Injected
	invoke VirtualAllocEx,hProcess,0,lenInjected,MEM_COMMIT+MEM_RESERVE,PAGE_EXECUTE_READWRITE
	mov lpInjected,eax
 
	;Escribimos en memoria los datos
	invoke WriteProcessMemory,hProcess,lpInjected,Injected,lenInjected,0
 
	invoke GetModuleHandle,addr szKernel
	invoke GetProcAddress,eax,addr szGetProcAddress
 
	;Creamos el hilo en el proceso
	invoke CreateRemoteThread,hProcess,0,0,lpInjected,eax,0,0
 
    invoke ExitProcess,0
 
    include injected.asm
end start
 

Injected PROC lpGetProcAddress:DWORD
	LOCAL Stack[20h]:dword
	ASSUME fs:NOTHING
 
	push ebp
	xor eax,eax
	mov esi,fs:[eax+30h]
	mov esi,[esi+0Ch]
	mov esi,[esi+1Ch]
next_module:
	mov ebp,[esi+08h]
	mov edi,[esi+20h]
	mov esi,[esi]
	cmp [edi+12*2],al
	jne next_module
	cmp byte ptr[edi],6Bh
	je find_kernel32_finished
	cmp byte ptr[edi],4Bh
	je find_kernel32_finished
	jmp next_module
find_kernel32_finished:
	mov ecx,ebp
	pop ebp
	mov eax,lpGetProcAddress
	mov Stack,eax
	mov Stack+4,ecx
 
	call loc_1
		_szLoadLibraryA db "LoadLibraryA",0
	loc_1:
	pop ecx
	invoke (type GetProcAddress)ptr Stack,Stack+4,ecx
	mov Stack+8,eax
 
	call loc_2
		_szUser32 db "USER32.DLL",0
	loc_2:
	pop ecx
	invoke (type LoadLibrary)ptr Stack+8,ecx
	mov Stack+12,eax
 
	call loc_3
		_szMessageBox db "MessageBoxA",0
	loc_3:
	pop ecx
	invoke (type GetProcAddress)ptr Stack,Stack+12,ecx
	mov Stack+16,eax
 
	call loc_4
		_szTitle db "xD",0
	loc_4:
	pop ecx
 
	call loc_5
		_szMSg db "Injected",0
	loc_5:
	pop ebx
 
	invoke (type MessageBox)ptr Stack+16,0,ebx,ecx,0
	ret
Injected endp
EndInjected: