Base Simples.

37161A01  |. 6A 01          PUSH 1
37161A03  |. 896E 2C        MOV DWORD PTR DS:[ESI+2C],EBP
37161A06  |. 68 08016F37    PUSH Cshell.376F0108                     ;  ASCII "BestKill"
37161A0B  |. E9 E9000000    JMP Cshell.37161AF9

\x68\x00\x00\x00\x00\xE9\x00\x00\x00\x00\x0F\xB6\x45\x7C\x38\x46\x50\x0F\x84\x00\x00\x00\x00\x8B\x4E\x04 x????x????xxxxxxxxx????xxx

371636AE  |. 68 C8D16E37    PUSH Cshell.376ED1C8                     ;  ASCII "Infection"
371636B3  |. E8 480C4100    CALL Cshell.37574300
371636B8  |. 50             PUSH EAX
371636B9  |. 8BCB           MOV ECX,EBX
371636BB  |. E8 B074FFFF    CALL Cshell.3715AB70
371636C0  |. E9 B5000000    JMP Cshell.3716377A

\x68\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x50\x8B\xCB\xE8\x00\x00\x00\x00\xE9\x00\x00\x00\x00\x8B\x8F\x00\x00\x00\x00\x51\x8B\x0E\x6A\x00 x????x????xxxx????x????xx????xxxxx

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

INT FPS;

void Funçoes()
{

	if (GetAsyncKeyState(VK_NUMPAD1)&1) FPS =! FPS;

if ( FPS )
{
	__asm
	{
		mov eax,[3791EED4h]
		mov word ptr ds:[eax], 1
	}
	} else {
		__asm 
		{
			mov eax,[3791EED4h]
		    mov word ptr ds:[eax], 0
		}
	}
}

void dwHook (void)
{
	for(;;)
	{
		DWORD CShell = (DWORD)GetModuleHandleA("CShell.dll");
		
		if(CShell)
		{
			__asm 
			{
			  CALL Funçoes;
		    }
	    }
	}
}

INT WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
{
	DisableThreadLibraryCalls(hModule);

	if(dwReason == DLL_PROCESS_ATTACH)
	{
      CreateThread(NULL,NULL,(LPTHREAD_START_ROUTINE)dwHook,NULL,NULL,NULL);
	}
	return TRUE;
}