format PE GUI 4.0 on 'null'
include 'include\win32ax.inc'
entry start
section 'ZLOY' code readable writable executable

start:
;Step(1) : Get Kernel Base(read it from PEB,NT ONLY).
mov eax,[fs:30h]
mov eax,[eax+0Ch]
mov esi,[eax+1Ch]
lodsd
mov ebx,[eax+08h]
;Step(2) : Find 'GetProcAddress' address.
push 0x1FC0EAEE; hashed 'GetProcAddress'
push ebx ;kernel32 base
call .getproc
mov ecx,eax
;Step(3) : Find 'LoadLibraryA' address.
push 0xC8AC8026 ; hashed 'LoadLibraryA'
push ebx ;kernel32 base
call .getproc
;Step(4) : Load the 'user32.dll'
pushd 'user32'
call eax
;Step(5) Find 'MessageBoxA' address.
push 0xABBC680D ;hashed 'MessageBoxA'
push eax ;user32 base
call .getproc
;Step(6) Testing,now in eax pointer to 'MessageBoxA' func.
;i dont use here(push 0) if it 4 times pasted = 8 bytes,i use:
;(xor ecx,ecx) and 4 times (push ecx) = 6 bytes
xor ecx,ecx
push ecx
push ecx
push ecx
push ecx
call eax
ret

.getproc:
pushad
mov eax,[esp+0x24] ;module handle
mov ebx,eax ;save module handle
add eax,[eax+3Ch];pe header
mov edx,[eax+78h];export table rva
add edx,ebx ;module handle
mov ecx,[edx+0x18];Num of Name Pointers
mov edi,[edx+0x20];Name Pointers RVA
add edi,ebx ;module handle
.getproc_scan:
mov esi,ebx ;module handle
add esi,[edi+(ecx-1)*4] ;poiner to apiname
xor eax,eax
.getproc_hash:
rol eax,7
xor al,[esi]
inc esi
cmp byte[esi],0
jnz .getproc_hash
xor eax,[esp+0x28] ;~cmp ... if eax=[esp+0x28] then eax =0 and jump
jz .getproc_found
loop .getproc_scan
xor eax, eax
jmp .getproc_quit
.getproc_found:
mov eax,[edx+28h+(ecx-1)*4]
add eax,ebx
.getproc_quit:
mov dword[esp+01Ch],eax ; return result on eax
popad
retn 8