format PE GUI 4.0
include 'win32ax.inc'
entry main_p

section '.text' code executable readable

strlen: push eax
        xor ecx,ecx
        cmp byte [eax],0
        je strlen.end
    strlen.counter:
                inc eax
                inc ecx
                cmp byte [eax],0x00
                jne strlen.counter
    strlen.end:
                pop eax
                ret

exitProgram: invoke ExitProcess,1

main_p: call [GetCommandLineA]
        mov [pidstr],eax
        call strlen
   main_p.loop1:
             cmp byte [eax],0x20
             je main_p.found
             inc eax
             loop main_p.loop1
   main_p.notf:
             invoke MessageBoxA,0,errormsg,0,0
             jmp exitProgram
   main_p.found:
             inc eax
             xor ecx,ecx
             cinvoke atoi,eax
             invoke OpenProcess,PROCESS_ALL_ACCESS,0,eax
             cmp eax,0
             je main_p.notf
             mov [phandle],eax
             mov eax,[GetModuleHandleA]
             mov [injcode.modh],eax
             mov eax,[GetProcAddress]
             mov [injcode.proca],eax
             mov eax,[endsize]
             mov ecx,[phandle]
             invoke VirtualAllocEx,ecx,0,eax,MEM_COMMIT,PAGE_READWRITE
             cmp eax,0
             je main_p.notf
             mov [pbaddr],eax
             mov eax,[endsize]
             mov ecx,[phandle]
             mov ebx,[pbaddr]
             invoke WriteProcessMemory,ecx,ebx,injcode,eax,tmpint
             invoke GetModuleHandleA,injcode.dlls
             invoke GetProcAddress,eax,injcode.procz
             mov [injcode.msgb],eax
             mov eax,[endsize]
             mov ecx,[phandle]
             mov ebx,[pbaddr]
             invoke CreateRemoteThread,ecx,0,0,ebx,0,0,tmpint
             invoke wsprintfA,pidstr,formats,eax
             invoke MessageBoxA,0,pidstr,0,0
             invoke MessageBoxA,0,sucmsg,0,0
             jmp exitProgram



section '.data' data readable writeable
        injcode:
                mov eax,[injcode.modh]
                push injcode.dlls
                call eax
                push injcode.procz eax
                mov eax,injcode.proca
                call eax
                ;mov eax,[injcode.msgb]
                push 0 injcode.datas injcode.datas 0
                call eax
                ret
            injcode.modh: dd 0
            injcode.msgb: dd 0
            injcode.proca: dd 0
            injcode.dlls: db "user32.dll",0
            injcode.procz: db "MessageBoxA",0
            injcode.datas: db "Process hook success.",0
        endsize: dd endsize-injcode
        tmpint: dd 0
        formats: db "size: %d",0
        pidstr: times 30 db 0
        sucmsg: db "process opened",0
        errormsg: db "Sorry cannot open process.",0
        phandle: dd 0
        pbaddr: dd 0

section '.import' import data readable writeable
        library  kernel32,'kernel32.dll',user32,'user32.dll',msvcrt,'msvcrt.dll'
        include 'API\USER32.INC'
        include 'API\KERNEL32.INC'
        import msvcrt,atoi,'atoi'    

;...
        call    .reference
    .reference:
        pop     ebx
        mov     eax,[ebx - .reference + .variable1]  ;<--- PIC memory read
;...
    .variable1:
        dd      0x12345678
;...