zzz.asm

BITS 32

%define MAX_PATH		0x1
%define SZWCHAR			0x2 ; sizeof(wchar_t)
%define u(x)			__utf16__(x) 

SECTION .data
storage:
	hNtDll		dd 0x0
	hKernel32	dd 0x0
	wsDllPath	db u('procrewriter.dll'), 0x0, 0x0
	;wsDllPath: times ((MAX_PATH+1) * SZWCHAR) db 0x0
	int3
	int3
	int3

SECTION .text
global _start
_start:
	xor ecx, ecx					; ECX = 0
; Find base address of kernel32.dll. This code should work on Windows 5.0-7.0
	mov esi, [ fs:ecx + 0x30 ]		; ESI = &(PEB) ([FS:0x30])
	mov esi, [ esi + 0x0C ]			; ESI = PEB->Ldr
	mov esi, [ esi + 0x1C ]			; ESI = PEB->Ldr.InInitOrder (first module)
next_module:
	mov ebp, [ esi + 0x08 ]			; EBP = InInitOrder[X].base_address
	mov edi, [ esi + 0x20 ]			; EDI = InInitOrder[X].module_name (unicode string)
	mov esi, [ esi]					; ESI = InInitOrder[X].flink (next module)
	cmp [ edi + 9*SZWCHAR ], cl		; modulename[9] == 0 ? strlen("ntdll.dll") == 9
	je set_ntdll
	cmp [ edi + 12*SZWCHAR ], cl	; modulename[12] == 0 ? strlen("kernel32.dll") == 12
	jne next_module					; No: try next module.
set_kernel32:
	mov [ hKernel32 ], dword ebp				; EBP = kernel32.base_address
	jmp begin_calls
set_ntdll:
	mov [ hNtDll ], dword ebp					; EBP = ntdll.base_address
	jmp next_module
begin_calls:
	mov edi, [ hKernel32 ]			; EDI = kernel32.base_address
	add edi, dword 0x14913
	push wsDllPath
	call dword edi
	mov edi, eax
	add edi, dword 0x110EB
	push dword hNtDll
	call edi
	pop edx
	retn 0