I think its pretty cool.
I mean obviously as stated you wouldnt use for a legitimate malware.
But its nice for a simple small design.
I dont like however you attempt to add to startup thru HKLM first, then if it fails (most likely cus of no admin rights) write to HKCU.
I think you should just come out writing to it.
Your fork_core & fork_coredue are the same, and I assume you meant for fork_core to be SW_HIDE.
Since you have:
PHP Code
<?php
if(metodo){
CreateThread(0, 0, (LPTHREAD_START_ROUTINE)fork_coredue, 0, 0, 0); // 1 = True, so if metodo is 1 (visible)
}else{
CreateThread(0, 0, (LPTHREAD_START_ROUTINE)fork_core, 0, 0, 0); // else
}
So for the fork_core you need to change SW_SHOW to -> SW_HIDE to ensure if it is set to 0, it will hide the windows.
ramrabbit is a bool, but returns void/nothing.
But other than those, it is neat just to use and great for beginners to learn from!
Nvm, I see you fixed the SW_HIDE and stuff in your newer version.
