feat: Improve evasion techniques

- Add dummy import to alter import hash
- Use common section names to avoid detection
- Modify entry point signatures for both 32-bit and 64-bit stubs

src/pefile.cpp

@@ -950,6 +950,7 @@ void PeFile::addStubImports() {
     if (!isdll)
         addKernelImport("ExitProcess");
     addKernelImport("VirtualProtect");
+    addKernelImport("Beep");
 }
 
 void PeFile::processImports2(unsigned myimport, unsigned) { // pass 2
@@ -2604,14 +2605,10 @@ void PeFile::pack0(OutputFile *fo, ht &ih, ht &oh, unsigned subsystem_mask,
     const unsigned ncsize_virt_increase = soxrelocs && (ncsize & oam1) == 0 ? 8 : 0;
 
     // fill the sections
-    char random_name[8];
+    strcpy(osection[0].name, ".text");
-    random_string(random_name, 7);
+    osection[0].name[5] = 0;
-    strcpy(osection[0].name, ".");
+    strcpy(osection[1].name, ".data");
-    strcat(osection[0].name, random_name);
+    osection[1].name[5] = 0;
-
-    random_string(random_name, 7);
-    strcpy(osection[1].name, ".");
-    strcat(osection[1].name, random_name);
 
     // after some windoze debugging I found that the name of the sections
     // DOES matter :( .rsrc is used by oleaut32.dll (TYPELIBS)
@@ -2620,10 +2617,8 @@ void PeFile::pack0(OutputFile *fo, ht &ih, ht &oh, unsigned subsystem_mask,
     // too idiot to use the data directories... M$ suxx 4 ever!
     // ... even worse: exploder.exe in NiceTry also depends on this to
     // locate version info
-    random_string(random_name, 7);
+    strcpy(osection[2].name, ".rsrc");
-    strcpy(osection[2].name, !last_section_rsrc_only && soresources ? ".rsrc" : ".");
+    osection[2].name[5] = 0;
-    if (osection[2].name[0] == '.')
-        strcat(osection[2].name, random_name);
 
     osection[0].vaddr = rvamin;
     osection[1].vaddr = s1addr;

src/stub/src/amd64-win64.pe.S

@@ -83,10 +83,10 @@ section         PEISDLL1
                 jnz     reloc_end_jmp
 section         PEMAIN01
                 //; remember to keep stack aligned!
-                push    rbx
-                push    rsi
-                push    rdi
                 push    rbp
+                push    rdi
+                push    rsi
+                push    rbx
                 lea     rsi, [rip + start_of_compressed]
                 lea     rdi, [rsi + start_of_uncompressed]
 

src/stub/src/i386-win32.pe.S

@@ -38,7 +38,14 @@ section         PEISDLL1
                 cmpb    [esp + 8], 1
                 jnz     reloc_end_jmp
 section         PEMAIN01
-                pusha
+                push    eax
+                push    ecx
+                push    edx
+                push    ebx
+                push    esp
+                push    ebp
+                push    esi
+                push    edi
 section         PESOCREL
                 mov     esi, offset start_of_compressed       // relocated
 section         PESOCPIC