@echo off
:: Stage 1: Ensure Admin Rights
net session >nul 2>&1
if %errorLevel% neq 0 (
    echo [!] ERROR: You MUST run this as Administrator.
    pause
    exit /b
)

echo [*] STEP 1: Stopping DWAgent Service...
net stop dwagent >nul 2>&1

echo [*] STEP 2: Navigating and Renaming Binary...
cd /d "C:\Program Files\DWAgent"
if exist dwagent.exe (
    rename dwagent.exe WinSvchost_Update.exe
)

echo [*] STEP 3: Masking Service Configuration...
sc config dwagent binPath= "\"C:\Program Files\DWAgent\WinSvchost_Update.exe\" -service" >nul
sc config dwagent DisplayName= "Windows Font Cache Update Service" >nul
sc config dwagent start= auto >nul

echo [*] STEP 4: Applying ACL Lockdown (Hiding Service from Scanners)...
:: This denies 'Everyone' the ability to even see the service exists.
sc sdset dwagent D:(D;;RP;;;WD)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)

echo [*] STEP 5: Signing Binary via PowerShell (Microsoft Spoof)...
powershell -Command "$cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject 'CN=Microsoft Windows Hardware Compatibility Publisher' -CertStoreLocation cert:\CurrentUser\My -NotAfter (Get-Date).AddYears(1); Set-AuthenticodeSignature -FilePath 'C:\Program Files\DWAgent\WinSvchost_Update.exe' -Certificate $cert" >nul 2>&1

echo [*] STEP 6: Cleaning Registries and Spoofing Status...
:: Remove standard startup icons
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "dwagent" /f >nul 2>&1
reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "dwagent" /f >nul 2>&1

:: Spoof Remote Assistance as 'Disabled' for PSI/Pearson
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowToGetHelp" /t REG_DWORD /d 0 /f >nul
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v "fAllowFullControl" /t REG_DWORD /d 0 /f >nul
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 1 /f >nul

:: Disable Telemetry (Anti-Snitch)
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v "AllowTelemetry" /t REG_DWORD /d 0 /f >nul 2>&1
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting" /v "Disabled" /t REG_DWORD /d 1 /f >nul 2>&1

echo [*] STEP 7: Restarting Stealth Service...
net start dwagent >nul

echo.
echo [+] ======================================================
echo [+] ULTRA-STEALTH SETUP COMPLETE
echo [+] Service Name: Windows Font Cache Update Service
echo [+] Binary Name: WinSvchost_Update.exe
echo [+] Status: Hidden from Services.msc and Task Manager
echo [+] ======================================================
pause