#define SYSENTER __asm _emit 0x0F __asm _emit 0x34
    DWORD NtOpenProcessCall,;
    typedef struct _CLIENT_ID{
        HANDLE UniqueProcess;
        HANDLE UniqueThread;
    } CLIENT_ID, *PCLIENT_ID;

    DWORD GetCallNUM(LPCSTR FuncName)
    {
        HMODULE ntdll = GetModuleHandle("ntdll.dll");
        if (!ntdll)
            LoadLibrary("ntdll.dll");    
        DWORD sysenter = *(DWORD*)((DWORD)GetProcAddress(ntdll, FuncName) + 1);
        return sysenter;
    }
    void InitFunction()
    {
        NtOpenProcessCall = GetCallNUM("NtOpenProcess");
    }

    _declspec(naked) void __stdcall SystemCall(void)
    {
        __asm
        {
            MOV EDX,ESP
            SYSENTER
            RET
        }
    }
    __declspec(naked) NTSTATUS __stdcall 
NtOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK AccessMask, PVOID ObjectAttributes, PCLIENT_ID ClientID)
    {
        __asm
        {
            mov eax, NtOpenProcessCall
            call SystemCall
            retn 10h
        }
    }

    void main()
    {    
        InitFunction();
        CLIENT_ID cid;
        cid.UniqueThread = 0;
        cid.UniqueProcess = (HANDLE)21060;
        BYTE bBuffer[] = {0x90, 0x90, 0x90, 0x90};
        DWORD nWritten;
        HANDLE VictimHandle = 0;
        OBJECT_ATTRIBUTES ObjectAttributes;
        InitializeObjectAttributes(&ObjectAttributes, NULL, 0, 0, NULL);
        NTSTATUS stt = NtOpenProcess(&VictimHandle, PROCESS_QUERY_INFORMATION |
 PROCESS_VM_OPERATION | PROCESS_VM_WRITE, &ObjectAttributes, &cid);
        WriteProcessMemory(VictimHandle, (void*)0x000A8BE0, &bBuffer, sizeof(bBuffer), &nWritten);
        printf("0x%X \n",stt);
        system("pause");
    }