.until edx >= [esi].NumberOfNames

sub ebx, [esi].AddressOfNames
sub ebx, _dwKernelBase
shr ebx, 1
add ebx, [esi].AddressOfNameOrdinals
add ebx, _dwKernelBase
movzx eax, word ptr [ebx]
shl eax, 2
add eax, [esi].AddressOfFunctions
add eax, _dwKernelBase

mov eax, [eax]
add eax, _dwKernelBase
mov @dwRet, eax

popad

mov eax, @dwRet

ret
_GetAPIByName endp
REMOTE_CODE_START equ this byte

_lpLoadLibrary dd ?
_lpGetProcAddress dd ?
_lpGetModuleHandle dd ?

_lpMessageBox dd ?
_hInstance dd ?
_hUserModule dd ?
_szMessageBox db 'MessageBoxA',0
_szUserDLL db 'User32.dll',0
_szMsgCaption db '远程成功',0
_szMsgText db '请打开Windows任务管理器,看看!',0

_hRemoteKernel32 dd ?
_hRemoteUser32 dd ? 
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_RemoteThread proc uses ebx edi esi lParam

call @F
@@:
pop ebx
sub ebx,offset @B

; push NULL
;call [ebx + _lpGetModuleHandle]
; mov  [ebx + _hInstance],eax

invoke _GetKernelBase, [esp]
mov [ebx + _hRemoteKernel32], eax

lea eax, [ebx + szGetProcAddress]
invoke _GetAPIByName, [ebx + _hRemoteKernel32], eax
mov _lpGetProcAddress, eax

lea eax, [ebx + szLoadLibrary]
invoke _GetAPIByName, [ebx + _hRemoteKernel32], eax
mov [ebx + _lpLoadLibrary], eax

lea eax, [ebx + _szUser32]
push eax
call [ebx + _lpLoadLibrary]
mov [ebx + _hRemoteUser32], eax

lea eax, [ebx + szMessageBox]
invoke _GetAPIByName, [ebx + _hRemoteUser32], eax
mov [ebx + _lpMessageBox], eax

push NULL
push NULL
push NULL
push NULL
call [ebx + _lpMessageBox]
ret

_RemoteThread endp

REMOTE_CODE_END equ this byte
REMOTE_CODE_LENGTH equ offset REMOTE_CODE_END - offset REMOTE_CODE_START



start:

invoke GetModuleHandle, offset szKernel
mov hModule, eax

invoke GetProcAddress, hModule, offset szLoadLibrary
mov lpLoadLibrary, eax

invoke GetProcAddress, hModule, offset szGetProcAddress
mov lpGetProcAddress, eax

invoke GetProcAddress, hModule, offset szGetModuleHandle
mov lpGetModuleHandle, eax


invoke FindWindow, NULL, offset szProcessWndName ;获取窗口句柄
invoke GetWindowThreadProcessId, eax, offset dwProcessID  ;获取程序 ID

invoke OpenProcess, PROCESS_CREATE_THREAD or PROCESS_VM_OPERATION or PROCESS_VM_WRITE,\
   FALSE, dwProcessID
.if eax
mov hProcess, eax
 invoke VirtualAllocEx, hProcess, NULL, REMOTE_CODE_LENGTH, MEM_COMMIT, PAGE_EXECUTE_READWRITE

.if eax
mov lpRemoteCode, eax

invoke WriteProcessMemory, hProcess, lpRemoteCode, offset REMOTE_CODE_START,\
REMOTE_CODE_LENGTH , NULL

  invoke WriteProcessMemory, hProcess,lpRemoteCode, offset lpLoadLibrary,\
     sizeof dword * 3, NULL
 
  mov eax, lpRemoteCode
  add eax, _RemoteThread - offset REMOTE_CODE_START
  invoke CreateRemoteThread, hProcess, NULL, 0, eax, 0, NULL, 0 
  invoke CloseHandle, eax
 
  invoke MessageBox, NULL, NULL, NULL, MB_OK
.endif
 
.endif

invoke CloseHandle, hProcess
invoke ExitProcess, 0
end start

kernel32.lib
这个库好像没有啊