الفريق العربي للهندسة العكسية

function ZwTerminateProcess(hProcess: DWORD; uCode: DWORD): NTSTATUS; stdcall; assembler;
{
  Coded By Agmcz
  Support for all operating systems [XP, 7, 8, 8.1, 10; 32bit]
  Tested on Windows XP/7/8.1/10.
}
asm
{$IFDEF WIN32}
  MOV EAX, FS:[$C0]
  CMP EAX, $0
  JNZ @Exit
  MOV EAX, FS:[$30]
  MOV EAX, [EAX+$A4]
  SUB EAX, $5
  JE @WinXP
  DEC EAX
  JE @Win8_81
  SUB EAX, $4
  JNE @Sys
  MOV EAX, $0024
  JMP @Sys
  @Win8_81:
  MOV EAX, EBX
  MOV EAX, [EAX+$A8]
  DEC EAX
  JE @Win7
  DEC EAX
  SUB EAX, $2
  JAE @Sys
  MOV EAX, $0023
  JMP @Sys
  @Win7:
  MOV EAX, $0172
  JMP @Sys
  @WinXP:
  MOV EAX, $0101
  @Sys:
  LEA EDX,[EBP+$8]
  INT $2E
  @Exit:
{$ENDIF}
end; 

const
  arrZwTerminateProcess: array[0..92] of byte = (
    $55, $8B, $EC, $64, $8B, $05, $C0, $00, $00, $00, $83, $F8, $00, $75, $4A,
    $64, $8B, $05, $30, $00, $00, $00, $8B, $80, $A4, $00, $00, $00, $83, $E8,
    $05, $74, $2E, $48, $74, $0C, $83, $E8, $04, $75, $2B, $B8, $24, $00, $00,
    $00, $EB, $24, $89, $D8, $8B, $80, $A8, $00, $00, $00, $48, $74, $0D, $48,
    $83, $E8, $02, $73, $13, $B8, $23, $00, $00, $00, $EB, $0C, $B8, $72, $01,
    $00, $00, $EB, $05, $B8, $01, $01, $00, $00, $8D, $55, $08, $CD, $2E, $5D,
    $C2, $08, $00);

var
  ZwTerminateProcess: function(hProcess: DWORD; uCode: DWORD): NTSTATUS; stdcall;
begin
  ZwTerminateProcess := @arrZwTerminateProcess;
  {code}
end.