NO_IAT_PROGRAM

#include<Windows.h>
#include<winternl.h>

/*
bool __stdcall checkwstr(wchar_t *s1, wchar_t *s2) {
    for (int i = 0; s1[i] && s2[i]; i++) {
        if (s1[i] != s2[i]) {
            return false;
        }
    }
    return true;
}
*/
wchar_t target[128] = { 0 };
wchar_t search_name[128] = { 0 };
bool __stdcall check_module_wstr(wchar_t *s1, wchar_t *s2) {
    wchar_t *s1_name = s1;


    for (int i = 0; s2[i] && i < 127; i++) {
        search_name[i] = (L'a' <= s2[i] && s2[i] <= L'z') ? ((WORD)s2[i] - 0x20) : s2[i];
    }

    for (int i = 0; s1[i] && i < 256; i++) {
        if (s1[i] == L'\\') {
            s1_name = &s1[i + 1];
        }
    }

    for (int i = 0; s1_name[i] && i < 127; i++) {
        target[i] = (L'a' <= s1_name[i] && s1_name[i] <= L'z') ? ((WORD)s1_name[i] - 0x20) : s1_name[i];
    }

    for (int i = 0; target[i] && search_name[i]; i++) {
        if (target[i] != search_name[i]) {
            return false;
        }
    }


    return true;
}

bool __stdcall checkstr(char *s1, char *s2) {
    for (int i = 0; s1[i] && s2[i]; i++) {
        if (s1[i] != s2[i]) {
            return false;
        }
    }
    return true;
}

ULONG_PTR FindModule(WCHAR *wName) {
    PEB *peb = (PEB *)__readfsdword(0x30);
    PEB_LDR_DATA *ldr = peb->Ldr;
    LIST_ENTRY *entry = &ldr->InMemoryOrderModuleList;
    LDR_DATA_TABLE_ENTRY *table_entry = 0;
    for (entry = entry->Flink->Flink; ; entry = entry->Flink) {
        LDR_DATA_TABLE_ENTRY  *table_entry = (LDR_DATA_TABLE_ENTRY *)((ULONG_PTR)entry - 0x08);
        if (!table_entry->DllBase) {
            break;
        }
        if (check_module_wstr(table_entry->FullDllName.Buffer, wName)) {
            return (ULONG_PTR)table_entry->DllBase;
        }
    }
    return 0;
}

/*
ULONG_PTR FindAPI(ULONG_PTR uDll, ULONG_PTR number) {
    IMAGE_DOS_HEADER *image_dos_header = (decltype(image_dos_header))uDll;
    IMAGE_NT_HEADERS *image_nt_headers = (decltype(image_nt_headers))((ULONG_PTR)image_dos_header + image_dos_header->e_lfanew);
    IMAGE_OPTIONAL_HEADER *image_optional_header = &image_nt_headers->OptionalHeader;
    IMAGE_EXPORT_DIRECTORY *image_export_directory = (decltype(image_export_directory))(uDll + (ULONG_PTR)image_optional_header->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
    ULONG_PTR *function_rva = (ULONG_PTR *)(uDll + image_export_directory->AddressOfFunctions);
    return uDll + function_rva[number - image_export_directory->Base];
}
*/

ULONG_PTR FindAPI_byName(ULONG_PTR uDll, char *cAPI) {
    IMAGE_DOS_HEADER *image_dos_header = (decltype(image_dos_header))uDll;
    IMAGE_NT_HEADERS *image_nt_headers = (decltype(image_nt_headers))((ULONG_PTR)image_dos_header + image_dos_header->e_lfanew);
    IMAGE_OPTIONAL_HEADER *image_optional_header = &image_nt_headers->OptionalHeader;
    IMAGE_EXPORT_DIRECTORY *image_export_directory = (decltype(image_export_directory))(uDll + (ULONG_PTR)image_optional_header->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
    ULONG_PTR *name_rva = (ULONG_PTR *)(uDll + image_export_directory->AddressOfNames);
    ULONG_PTR *function_rva = (ULONG_PTR *)(uDll + image_export_directory->AddressOfFunctions);
    WORD *name_ordinal = (WORD *)(uDll + image_export_directory->AddressOfNameOrdinals);
    for (DWORD i = 0; i < image_export_directory->NumberOfNames; i++) {
        if (checkstr((char *)(uDll + name_rva[i]), cAPI)) {
            return uDll + function_rva[name_ordinal[i]];
        }
    }
    return 0;
}

// kernel32.dll LoadLibraryW 0x3CA, LoadLibraryA 0x3C7
// user32.dll MessageBoxW 0x86C, MessageBoxA 0x865
// change visual studio project option's entry point to start function, please
int WINAPI start() {
    /*
    ULONG_PTR uDll = FindModule((WCHAR *)L"C:\\WINDOWS\\System32\\KERNEL32.DLL");
    if (!uDll) {
        uDll = FindModule((WCHAR *)L"C:\\Windows\\syswow64\\kernel32.dll");
        if (!uDll) {
            return 1;
        }
    }
    */
    ULONG_PTR uDll = FindModule((WCHAR *)L"kernel32.dll");
    if (!uDll) {
        return 1;
    }
    HMODULE(WINAPI *_LoadLibraryW)(LPCWSTR) = 0;
    //_LoadLibraryW = (decltype(_LoadLibraryW))FindAPI(uDll, 0x3CA);
    _LoadLibraryW = (decltype(_LoadLibraryW))FindAPI_byName(uDll, (char *)"LoadLibraryW");

    if (!_LoadLibraryW) {
        return 2;
    }

    HMODULE hUser32 = _LoadLibraryW(L"user32.dll");

    if (!hUser32) {
        return 3;
    }

    int (WINAPI *_MessageBoxW)(HWND, LPCWSTR, LPCWSTR, UINT) = 0;
    //_MessageBoxW = (decltype(_MessageBoxW))FindAPI((ULONG_PTR)hUser32, 0x86C);
    _MessageBoxW = (decltype(_MessageBoxW))FindAPI_byName((ULONG_PTR)hUser32, (char *)"MessageBoxW");

    if (!_MessageBoxW) {
        return 3;
    }

    _MessageBoxW(NULL, L"HELLO WORLD!", L"TEST", MB_OK);

    void (WINAPI *_ExitProcess)(UINT) = 0;
    _ExitProcess = (decltype(_ExitProcess))FindAPI_byName(uDll, (char *)"ExitProcess");

    if (_ExitProcess) {
        _ExitProcess(0); // OK
    }

    // some OS won't kill the process after executing return 0;
    __asm {
        int 3
    }

    return 0;
}