I found this in my collection of assembler source's. Dont know if you want it
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; 1Run (1 IMPORT in compiled exe)
;Assembled with MASM32.
;
.386
.model flat,stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\macros\macros.asm
INCX user32 , kernel32
include genmacro.inc
sSEH STRUCT
OrgEsp DD ?
OrgEbp DD ?
SaveEip DD ?
sSEH ENDS
MIN_KERNEL_SEARCH_BASE EQU 070000000h
MAX_API_STRING_LENGTH EQU 150
MUTEX_ALL_ACCESS EQU 1F0001h
CREATE_DEFAULT_ERROR_MODE EQU 04000000h
.CONST
;szGetCommandLineA DB "GetCommandLineA",0
szCreateProcessA DB "CreateProcessA",0
szOpenMutexA DB "OpenMutexA",0
szCreateMutexA DB "CreateMutexA",0
szGetStartupInfoA DB "GetStartupInfoA",0
szLoadLibrary DB "LoadLibraryA",0
szGetProcAddress DB "GetProcAddress",0
szExitProcess DB "ExitProcess",0
szUser32 DB "user32",0
szMessageBox DB "MessageBoxA",0
.data
DATAFOR General Use
;_GetCommandLineA DD NULL
_CreateProcessA DD NULL
_OpenMutexA DD NULL
_CreateMutexA DD NULL
_GetStartupInfoA DD NULL
_LoadLibrary DD NULL
_GetProcAddress DD NULL
_ExitProcess DD NULL
_MessageBox DD NULL
SEH sSEH <NULL>
dwKernelBase DD NULL
dwUserBase DD NULL
paramCount DD NULL
paramPtr DD NULL
usageString DB "1RUN <applicationame> [application command line parameters]",10,0
.data?
RUNTIMEDATA for General Use
hInstance DD ?
commandLinePtr LPSTR ?
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
DATAFOR multiple instance blocking ;;;;;;;;;;;;;;;;;;
mutexAttributes SECURITY_ATTRIBUTES <sizeof SECURITY_ATTRIBUTES,NULL,TRUE>
; CODE START ;
.code
; -- PEID SAYS: Ding Boy's PE-lock Phantasm v1.0 / v1.1 --
@@:
db 055h,057h,056h,052h,051h,053h,066h,081h,0C3h,0EBh,002h,\ ; FAKE 'OEP'
0EBh,0FCh,066h,081h,0C3h,0EBh,002h,0EBh,0FCh,\
088h,088h,088h,088h,088h,088h ; {POP EAX}*6
ret 4
nops 5
main:
ASSUME FS : NOTHING
PUSH [ESP]
CALL GetKernelBase
OR EAX, EAX
JZ @B
MOV dwKernelBase, EAX
START_SEH RETURN_HOME ; ---- START SEH FRAME ---
;---- Why not make it look like a normal prog? ----
@@: wcall GetCommandLineA
mov commandLinePtr,EAX
SHUT_SEH ; ---- STOP SEH FRAME ---
call splitCommandLine
mov paramCount, eax
push eax
CHKAPPDBG: ; --- (LAJM #1) ---
mov eax,fs:[30h] ; pointer to PEB
movzx eax,byte ptr [eax+2h]
or al,al
jz @f
RET
mov eax,dword ptr fs:[20h] ; #2
or eax,eax
jNz @f
@@: ;---- GET SOME KERNEL API ADDRESSES -----
LOAD_UP_API szLoadLibrary, _LoadLibrary, dwKernelBase
LOAD_UP_API szGetProcAddress, _GetProcAddress, dwKernelBase
;LOAD_UP_API szGetCommandLineA, _GetCommandLineA, dwKernelBase
LOAD_UP_API szCreateProcessA, _CreateProcessA, dwKernelBase
LOAD_UP_API szOpenMutexA, _OpenMutexA, dwKernelBase
LOAD_UP_API szCreateMutexA, _CreateMutexA, dwKernelBase
LOAD_UP_API szGetStartupInfoA, _GetStartupInfoA, dwKernelBase
LOAD_UP_API szExitProcess, _ExitProcess, dwKernelBase
;---- LOAD USER32.DLL ----
mycall _LoadLibrary,OFFSET szUser32
OR EAX,EAX
JZ QUIT
MOV dwUserBase, EAX
;---- GET SOME MORE API ADDRESSES ----
LOAD_UP_API szMessageBox, _MessageBox, dwUserBase
;____
;
; Check for previous instance.
;
mycall _OpenMutexA, MUTEX_ALL_ACCESS,FALSE, commandLinePtr
.if eax != NULL ;another instance is already running
jmp endme
.endif
;
; Create Mutex to let other One Run instances know you're already here.
;
mycall _CreateMutexA, offset mutexAttributes, TRUE, commandLinePtr
pop eax
.if eax !=0
mycall WinMain, hInstance,NULL,commandLinePtr, SW_SHOWDEFAULT
.else
szText LmTitle2,"1RUN USAGE!"
mycall _MessageBox ,NULL,offset usageString, OFFSET LmTitle2, MB_OK
.endif
endme:
xor eax,eax
QUIT: SHUT_SEH
RETURN_HOME: mycall _ExitProcess,NULL ; LEAVE IT!
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
WinMain proc hInst:HINSTANCE,hPrevInst:HINSTANCE,CmdLine:LPSTR,CmdShow:dword ;;;;;;;;
RUNTIMEDATA for start up info ;;
startUp STARTUPINFO <>
RESUMECODE
mycall _GetStartupInfoA, offset startUp
RUNTIMEDATA for proc info ;;;;;;
unusedProcInfo PROCESS_INFORMATION <>
RESUMECODE
mycall _CreateProcessA, NULL, paramPtr, NULL, NULL, TRUE, \
CREATE_DEFAULT_ERROR_MODE, NULL, NULL, offset startUp,\
offset unusedProcInfo
.if eax==FALSE
mycall _MessageBox ,NULL, OFFSET usageString, NULL, MB_OK \
or MB_APPLMODAL or MB_ICONWARNING
.endif
returnzero
WinMain endp
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
splitCommandLine: ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
DATAFOR splitCommandLine
paramListPtr dd NULL
RESUMECODE
push ebx
push esi
xor edx,edx ;clear parameter counter
mov esi,commandLinePtr
call skipSpacesAndTabs
mov bl, ' '
.if byte ptr [esi] == '"'
mov bl,'"'
inc esi
.endif
mov commandLinePtr, esi
call findChar
.if byte ptr [esi] == 0
jmp commandLineSplit
.endif
mov byte ptr [esi], 0
inc esi
call skipSpacesAndTabs
.if byte ptr [esi] == 0
jmp commandLineSplit
.endif
mov edx, 1
mov paramPtr, esi
commandLineSplit:
pop esi
pop ebx
mov eax, edx
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
skipSpacesAndTabs: ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
lodsb
cmp al,' '
je skipSpacesAndTabs
cmp al, 9
je skipSpacesAndTabs
dec esi
ret
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
findChar: ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
lodsb
cmp al, 0
je findCharDone
cmp al, bl
jne findChar
findCharDone:
dec esi
ret
INCLUDE KERN_SHIT.ASM
end main