CoreTools.ps1

# This script automates Windows post-installation setup, including system performance 
# optimizations, telemetry removal, and the automated deployment of development 
# tools via Winget and Chocolatey.

# KEY FEATURES:
# 1.  Session Setup: Configures execution policy to [Bypass] for the current process.
# 2.  Legacy Cleanup: Silently scans and removes old CMD/PowerShell registry entries if present.
# 3.  Context Menus: Adds multi-language CMD & PowerShell prompts (Shift + Right-click) with UNC path support.
# 4.  Advanced Desktop Tools: Adds a categorized menu for Control Panel, Safe Mode, Task Killer, and Explorer Restart.
# 5.  Boot Optimization: Procedural BCD/Registry fix to uncheck 'Number of Processors' in MSConfig to prevent instability and thermal throttling.
# 6.  System Performance: Enables automatic Pagefile management and removes QoS bandwidth limits.
# 7.  Explorer Tweaks: Hides Desktop Recycle Bin and pins it to the Explorer Sidebar for a cleaner workspace.
# 8.  Visuals & Login: Sets 100% Wallpaper quality, enables NumLock on login, and synchronizes SecPol for No-CTRL+ALT+DEL.
# 9.  File Handling: Restores 'New Text Document' and Script templates (.ps1, .reg, .bat, vbs, cmd) to the context menu.
# 10. Windows Updates: Hard-disables forced Driver updates and Microsoft's monthly bloatware "gift"—the useless Malicious Software Removal Tool (MRT).
# 11. SvcHost Optimization: Implements dynamic RAM-based SvcHost grouping (Split Threshold) to reduce process overhead.
# 12. App Management: Disables Background Apps globally to save CPU/RAM.
# 13. Strategic Update Freeze: Hard-pauses Windows Updates until the year 3000 by manipulating the UX Settings registry hive. It extends 'FlightSettingsMaxPauseDays' to unlock long-term pause capabilities and forces PauseUpdatesExpiryTime into the distant future, effectively neutralizing automatic updates while keeping the service operational for manual intervention.
# 14. Version-Specific: Adds 'Check Ownership' menu (for Windows 26H1+ / non-25H2).
# 15. Universal Take Ownership: Deploys a 22-language "Take Ownership" menu using a high-compatibility .reg import method with orange checkmark icons.
# 16. Power Management: Disables network connectivity during Modern Standby (AC) to prevent "Sleep-to-Wake" drain.
# 17. Telemetry & Gaming: Disables Mouse acceleration, Office/PS telemetry, and Game Bar.
# 18. OneDrive removal: Deep uninstallation with data migration and 5s timeout.
# 19. Core Package Managers: Automated install/update of Chocolatey, Winget, and PS7.
# 20. Software Deployment: Installs dev tools and utilities via Choco (with Python/Dart pathing).
# 21. Optional Scripts: Digital Entitlement (MAS) and StartAllBack blocker with 5s skip.
# 22. Registry Fixes: Alt+Tab (Show 20 Edge Tabs), Explorer starts at 'This PC', and No Auto-Reboot.
# 23. Context Limit: Increases the right-click "Multiple Files" selection limit to 128 items.
# 24. Shell Folders: Restores all User Folders (Downloads, Documents, etc.) directly under 'This PC'.
# 25. Browser Debloat: Disables Telemetry, AI (Copilot/Leo), and Bloat for Chrome, Brave, Edge & Firefox.
# 26. Network/DNS: Optimizes DNS Cache TTL and table size for faster web resolution.
# 27. Python Ecosystem: Automated pip upgrade and Hugging Face CLI (HF-CLI) deployment.
# 28. Startup Manager: Disables Steam, Discord, Teams, and others via binary status (03) in Registry.
# 29. Winget Deployment: Interactive setup for Communication, Security, and AI tools via Store IDs with 5s popups.
# 30. Gaming Essentials: One-click pack (Steam, Discord, EA, Epic, Xbox) with automated Store ID matching.
# 31. GitHub Env: Sets NTFS protection to false and enables Case Sensitivity on specialized development folders.
# 32. Git Optimization: Migrates Git Bash and Git GUI context menu items to 'Shift + Right Click' to reduce clutter.
# 33. User Security: Force-sets 'Password Never Expires' for the Admin account.
# 34. Crash Analysis: Enables Detailed BSOD (DisplayParameters) for technical info.
# 35. Print Spooler ACL: Universal SID (S-1-1-0) Full Control grant for 'Everyone'.
# 36. Spooler Context Menu: 22-language repair tool deployed to C:\Windows.
# 37. Visual Effects: Enforced "Show thumbnails" and "Desktop icon shadows".
# 38. Media Extensions: Auto-update for HEVC (Free-Codecs) and 8 Codecs extensions.
# 39. Advanced Thumbnailing: Automated GitHub deployment for Icaros Thumbnailer.
# 40. Context Menu Purge: High-speed registry cleanup to remove grepWin shell entries using native reg.exe for zero-lag execution.
# 41. Explorer UI Opt: Windows 11-specific Snap Layouts enablement and smart Quick Access management. Disables automatic frequent folders and provides an interactive 5s prompt to clear cache only if requested, preserving manual pins.
# 42. Start Menu Refactor: Automated renaming of 'XTools' to 'Tools' with recursive cleanup of redundant PhoenixOS shortcuts and folders.
# 43. Volume Identity: Force-sets System Drive (C:) label to "Windows" and purges localized "Extras + Info" desktop clutter.
# 44. JUNKWARE PURGE: Interactive 5-second timeout-driven menu that allows optional removal of common "digital parasite" antivirus software (McAfee, Norton, AVG, Kaspersky) using official vendor cleanup tools, plus a universal antivirus residue cleaner (ART) and an advanced high-risk option for Microsoft Defender removal.
# 45. DEFENDER LOBOTOMY: High-level Registry/Policy injection to completely disable Windows Defender, Tamper Protection, and Kernel Mitigations, eliminating useless background overhead and restoring absolute system control.
# 46. WINDOWS AI PURGE: Safe-Mode removal of Copilot, Recall, and AI background services via registry, policies, and Appx removal with a 5s interactive prompt.
# 47. EDGE EXORCISM: Deep uninstallation of Microsoft Edge using native setup.exe flags, including a registry "dummy" lock to prevent silent re-installation.
# 48. NOTEPAD CLASSIC RESTORATION: Automated detection and removal of the modern UWP Notepad (9MSMLRH6LZF3) to eliminate AI "Rewrite" bloat and restore system leaness.
# 49. Precision Time Protocol (NTP) Optimization: Swaps default Windows time server for the global pool.ntp.org cluster to ensure lower latency and better sync reliability.
# 50. PowerShell Downgrade Protection: Blocks the legacy PowerShell 2.0 engine using SecEdit-based ACL resets to mitigate downgrade attacks.
# 51. SMBv1 Deactivation: Direct Registry enforcement to disable the insecure SMBv1 protocol, preventing ransomware (WannaCry style) propagation.
# 52. Connectivity Restoration (TLS/SChannel): Comprehensive reset of SCHANNEL settings, insecure ciphers (RC4/DES), and weak hashes (MD5) to restore compatibility with modern web portals, tax services (NFe), and .NET apps.
# 53. System & OEM Intelligence: Implements a deep-scan hardware module that detects Computer Type (Mobile, Desktop, or VM) and System Manufacturer (DMI). It executes a conditional logic to update Windows OEM Information, ensuring a professional system identity by combining Manufacturer and Model for physical PCs while maintaining raw DMI data for Servers and Virtual Machines.
# 54. Vanguard & Valorant Toolkit: Dual-purpose module that validates Riot Vanguard requirements (TPM 2.0, Secure Boot, HVCI) with auto-fix capabilities, and provides a "Nuclear Emergency" repair tool to wipe corrupted vgk.sys drivers and services in Safe Mode to resolve KERNEL_SECURITY_CHECK_FAILURE (0x139) loops.
# 55. BitLocker Privacy & Performance Hardening: Implements a multi-layered shield to disable automatic encryption, block insecure hardware-based encryption, and force-decrypt all volumes to restore SSD performance and data sovereignty.
# 56. SmartScreen Professional Audit: Comprehensive disabling of reputation-based filters for Explorer, Edge, and the Microsoft Store. Eliminates false positives on custom scripts, prevents file-metadata telemetry to Microsoft, and removes "Potentially Unwanted App" (PUA) blocking to restore administrative flow.
# 57. Microsoft Activation Status Professional Audit: A deep-audit module that identifies the exact edition, licensing channel (Retail, OEM, KMS, MAK), and permanency status for Windows, Office, Project, and Visio, featuring native console color-bleed correction.  
# 58. Microsoft License Management Tool: An interactive command interface with a 5-second timeout for installing new Windows product keys, performing deep license registry cleanups (slmgr), and purging blocked Office key fragments via OSPP to resolve activation conflicts.
# 59. Disk Intelligence & SMART Analysis Module: A high-performance diagnostic engine that performs real-time parsing of CrystalDiskInfo logs to extract critical metrics including drive health, temperature, firmware status, power-on hours, and host read/write counters, featuring a multi-language adaptive UI layer with structured output formatting.
# 60. SSD Longevity & Performance Optimizer: A deterministic SSD tuning framework designed to maximize NAND lifespan and reduce unnecessary write amplification. Implements controlled system behavior adjustments including kernel-level paging strategy, TRIM enforcement, flush policy optimization, and telemetry reduction, while preserving OS stability and update compatibility.
# 61. Windows Security Hardening Infrastructure: A layered system hardening module that enforces strict registry-based security policies. It automates the disabling of Autorun and Autoplay across all storage devices, strengthens browser and system security zone configurations to reduce exposure to untrusted content, and improves download safety by enforcing attachment-level integrity checks and signature-aware validation for files originating from external sources.
# 62. System Performance & Privacy Hardening Suite: A system optimization framework focused on reducing background overhead and limiting unnecessary data exposure. It applies performance-oriented registry tuning for application and system responsiveness, disables non-essential telemetry and diagnostic behaviors, and reduces consumer-facing advertising and personalization features. It also removes legacy components such as Internet Explorer to reduce attack surface and maintain a cleaner, more stable operating environment.
# 63. Windows Terminal & PowerShell 7 Hybridization: A configuration engine that detects PowerShell 7 (pwsh.exe) and injects it as the default profile in Windows Terminal's settings.json. It enforces a modern UI by enabling Acrylic transparency and setting background opacity to 80, while simultaneously applying system-wide console host preferences via the HKCU:\Console registry hive.
# 64. Adobe Acrobat Reader Nuclear Purge: A multi-stage uninstallation module that terminates related processes (AcroRd32, AdobeARM, Acrobat) and executes a sequential cleanup using Winget, Appx package removal, and MSI GUID-based uninstallation. It includes registry-based detection to ensure all residues from both 32-bit and 64-bit versions are fully wiped.
# 65. Wallpaper Style & Rendering Engine: A deterministic framework that sets the desktop wallpaper rendering mode to "Fill" (Style 10) within the Windows registry. It implements a custom C# Win32 API wrapper to call SystemParametersInfo, forcing an immediate desktop refresh and re-applying the current wallpaper path to prevent black-screen artifacts without requiring a system restart.
# 66. AyuGram Desktop Deployment Engine: A robust deployment module utilizing dynamic GitHub web parsing to resolve and deploy the latest AyuGram iterations. Features an integrated Win32_OperatingSystem check to enforce Workstation-only deployment, a resilient version-tracking system using both FileVersionInfo and local caching, and automated secure extraction to protected system directories. It leverages WScript.Shell for native shell integration and shortcut persistence, providing a fully unattended lifecycle management solution.
# 67. Unattended Essential App Deployment: A robust, multi-repo installation engine (Winget/Store) featuring intelligent OS-type detection. It automatically filters high-resource or non-essential tools (e.g., Calibre, UpNote) when a Windows Server environment is detected to preserve server integrity. The module handles silent installs, bypasses legal agreements, and maps specific Winget exit codes to provide clear "Success," "Skip," or "Fail" diagnostic reporting.
# 68. Crash Analysis & Debug Suppression: A system stability module that configures the 'CrashControl' registry hive to disable system crash dumps and event logging. It utilizes a proactive verification logic to compare current registry values against desired states (CrashDumpEnabled=0), ensuring the system remains lean by preventing the generation of large memory dump files and reducing disk I/O overhead during critical errors.
# 69. Classic Photo Viewer Restoration: Re-activates the legacy Windows Photo Viewer engine by injecting specialized registry classes and file association capabilities. It bypasses modern UWP overhead by linking standard image extensions (JPG, PNG, etc.) directly to the native System32 PhotoViewer.dll.
# 70. Intelligent AppX Debloat: A multi-pattern cleaning engine that targets third-party junkware and non-essential Microsoft UWP packages. Features an integrated Win32_OperatingSystem check to safeguard Server environments and utilizes 'Remove-AppxPackage -AllUsers' for a comprehensive system-wide purge of telemetry-heavy applications.

# --- APPENDIX: LEGACY EXECUTION POLICY SETTINGS (DISABLED) ---
# The following section is kept for reference only. 
# Current logic uses '-Scope Process' to avoid permanent system changes.

<#
# --- Original Execution Policy Setup ---
# This was used to set 'Unrestricted' policy for the CurrentUser.
# Write-Host "Setting PowerShell execution policy to Unrestricted for the current user..."
# Set-ExecutionPolicy -Scope CurrentUser Unrestricted -Force >$null 2>&1

# --- Original Revert Logic ---
# This was used at the end of the script to restore policy to RemoteSigned.
# Write-Host "Reverting PowerShell execution policy to RemoteSigned for current user..."
# Set-ExecutionPolicy -Scope CurrentUser RemoteSigned -Force >$null 2>&1
# Write-Host "Execution policy set to RemoteSigned for current user."
# Write-Host "Software setup and installation completed successfully! ✅"
#>
# --------------------------------------------------------------

# --- 0. Setup: Ensure Execution Policy is permissive for this session ---
Write-Host "Configuring session execution policy..." -ForegroundColor Cyan

# Using -Scope Process ensures it only affects this current session
# and doesn't trigger GPO/Administrator overrides or warnings.
try {
    Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force | Out-Null
    Write-Host "Execution policy set to [Bypass] for current session. ✅" -ForegroundColor Green
} catch {
    Write-Host "Warning: Could not set execution policy, but continuing..." -ForegroundColor Yellow
}

# Gets the directory where this script (.ps1) is being executed.
# $PSScriptRoot is an automatic PowerShell variable that holds the full path of the current script's directory.
$scriptDir = $PSScriptRoot

##------------------------------------------------------##

# Clear
Clear-Host
if (Test-Path ($h = "$HOME\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt")) { Remove-Item $h -Force -ErrorAction SilentlyContinue }

# LIGHTNING - ASCII ART
Write-Host "                         ,/" -ForegroundColor Yellow
Write-Host "                       ,'/" -ForegroundColor Yellow
Write-Host "                     ,' /" -ForegroundColor Yellow
Write-Host "                   ,'  /_____," -ForegroundColor Yellow
Write-Host "                 .'____    ,'    " -ForegroundColor Yellow
Write-Host "                      /  ,'      " -ForegroundColor Yellow
Write-Host "                     / ,'        " -ForegroundColor Yellow
Write-Host "                    /,'          " -ForegroundColor Yellow
Write-Host "                   /'            " -ForegroundColor Yellow

Write-Host "    ______________________________________" -ForegroundColor Gray
Write-Host "    >> ⚡ WORKSTATION TOOLS             " -ForegroundColor Cyan -NoNewline
Write-Host "" -ForegroundColor DarkGray
Write-Host "    >> Developed by TogoFire              " -ForegroundColor Magenta
Write-Host "    ______________________________________" -ForegroundColor Gray
Write-Host ""

##------------------------------------------------------##

# --- ADMIN PRIVILEGES CHECK ---
# Ensures the script is running with elevated permissions before proceeding.

# Checks if the current user is NOT running PowerShell with Administrator privileges
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    
    # Displays an error message in red if Admin permissions are missing
    Write-Host "[!] ERROR: Admin privileges required." -ForegroundColor Red; 
    
    # Terminates script execution immediately to prevent "Access Denied" errors
    exit
}

##------------------------------------------------------##

# --- SYSTEM INFORMATION & OEM UPDATER ---
Write-Host "-- Gathering System Information..." -ForegroundColor Cyan

# 1. Gathering Data
$computerSystem = Get-CimInstance Win32_ComputerSystem
$chassis = Get-CimInstance Win32_SystemEnclosure
$os = Get-CimInstance Win32_OperatingSystem
$bios = Get-CimInstance Win32_BIOS
$processor = Get-CimInstance Win32_Processor
$gpus = Get-CimInstance Win32_VideoController

# 2. Advanced Computer Type Detection (Mobile/Desktop/VM)
$chassisType = switch ($chassis.ChassisTypes) {
    { $_ -in 8, 9, 10, 11, 12, 14, 30, 31, 32 } { "Mobile" }
    { $_ -in 3, 4, 5, 6, 7, 15, 16 } { "Desktop" }
    default { "Workstation" }
}

# Virtual Machine & Server check
$isVM = $computerSystem.Model -match "Virtual|VMware|VirtualBox|Hyper-V"
$isServer = $os.Caption -match "Server"

if ($isVM) { $chassisType = "Virtual Machine" }

$computerFullModel = "$($computerSystem.Manufacturer) $($computerSystem.Model) ($chassisType)"

# 3. OS & Kernel Details
$osVersion = $os.Version
$architecture = $os.OSArchitecture
$displayVersion = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").DisplayVersion

# 4. Chipset Detection
$chipsetInfo = Get-CimInstance Win32_PnPEntity | Where-Object { $_.Caption -match "Chipset|Host Bridge|DRAM Controller" } | Select-Object -First 1 -ExpandProperty Caption
if (-not $chipsetInfo) { $chipsetInfo = "Standard System Chipset" }

# 5. Hardware DirectX Support
$dxCapability = "DirectX 9.0"
$gpuMaxLevel = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Direct3D\Drivers" -ErrorAction SilentlyContinue).MaxFeatureLevel
if ($null -eq $gpuMaxLevel) {
    if (Test-Path "C:\Windows\System32\d3d12.dll") { $dxCapability = "DirectX 12" }
    elseif (Test-Path "C:\Windows\System32\d3d11.dll") { $dxCapability = "DirectX 11" }
} else {
    if ($gpuMaxLevel -ge 0xc000) { $dxCapability = "DirectX 12" }
    elseif ($gpuMaxLevel -ge 0xb000) { $dxCapability = "DirectX 11" }
    else { $dxCapability = "DirectX 10" }
}

# 6. RAM Details
$ramModules = Get-CimInstance Win32_PhysicalMemory
$ramTotalGB = [math]::Round($computerSystem.TotalPhysicalMemory / 1GB)
$ramSpeed = if ($ramModules) { ($ramModules | Measure-Object -Property ConfiguredClockSpeed -Maximum).Maximum } else { 0 }
$smbiosMemory = $ramModules | Select-Object -First 1
$memoryType = switch ($smbiosMemory.SMBIOSMemoryType) {
    20 { "DDR" } 21 { "DDR2" } 24 { "DDR3" } 26 { "DDR4" } 34 { "DDR5" } default { "DDR" }
}

# 7. HARDCORE MONITOR DETECTION (Registry Deep Scan)
$monitorInfo = "Generic PnP Monitor"
try {
    $monList = Get-PnpDevice -Class Monitor -Status OK -ErrorAction SilentlyContinue
    if ($monList) {
        $activeMon = $monList[0]
        $hwID = ($activeMon.HardwareID | Where-Object { $_ -match "MONITOR\\" }) -replace "MONITOR\\", ""
        $regPath = "HKLM:\SYSTEM\CurrentControlSet\Enum\DISPLAY\$($activeMon.InstanceId.Split('\')[1])"
        $subKey = Get-ChildItem $regPath -ErrorAction SilentlyContinue | Select-Object -First 1
        $driverDesc = Get-ItemPropertyValue $subKey.PSPath -Name "DeviceDesc" -ErrorAction SilentlyContinue
        $cleanName = if ($driverDesc -match ";(.+)") { $matches[1] } else { $driverDesc }
        $mfgPrefix = if ($hwID -match "^BOE") { "BOEhydis" } else { "" }
        if ($cleanName -and $cleanName -notmatch "Generic|Integrated") {
            $monitorInfo = "$mfgPrefix $cleanName ($hwID)".Trim()
        } else {
            $monitorInfo = "$mfgPrefix $hwID".Trim()
        }
    }
} catch { $monitorInfo = "Integrated Monitor" }

# 8. Network Info
$networkConfigs = Get-CimInstance Win32_NetworkAdapterConfiguration | Where-Object { $_.IPEnabled -eq $true }
$activeNet = $networkConfigs | Where-Object { $_.IPAddress -notlike "169.254.*" } | Select-Object -First 1

# 9. Storage Info
$disks = Get-CimInstance Win32_DiskDrive | Where-Object { $_.Model -notmatch "Virtual|Msft" }

# --- OUTPUT REPORT ---
Write-Host " [💻] GENERAL INFO" -ForegroundColor White
Write-Host " System Manufacturer (DMI): $($computerSystem.Manufacturer)" -ForegroundColor Gray
Write-Host " Computer Type:            $computerFullModel" -ForegroundColor Gray
Write-Host " OS:                       $($os.Caption) ($displayVersion) $architecture" -ForegroundColor Gray
Write-Host " Kernel:                   WIN32_NT $osVersion" -ForegroundColor Gray
Write-Host " User:                     $([System.Security.Principal.WindowsIdentity]::GetCurrent().Name.Split('\')[1])" -ForegroundColor Gray
Write-Host " Host/Domain:              $($computerSystem.Name)" -ForegroundColor Gray
Write-Host " Serial (S/N):             $($bios.SerialNumber)" -ForegroundColor Gray
Write-Host " DirectX:                  $dxCapability (Hardware Support)" -ForegroundColor Gray
Write-Host " Monitor:                  $monitorInfo" -ForegroundColor Gray

Write-Host "`n [🔌] MOTHERBOARD & CPU" -ForegroundColor White
Write-Host " CPU:            $($processor.Name)" -ForegroundColor Gray
Write-Host " Motherboard:    $($computerSystem.Model)" -ForegroundColor Gray
Write-Host " Chipset:        $chipsetInfo" -ForegroundColor Gray
Write-Host " RAM:            $ramTotalGB GB ($memoryType @ $($ramSpeed)MHz)" -ForegroundColor Gray
Write-Host " BIOS Version:   $($bios.SMBIOSBIOSVersion) ($($bios.ReleaseDate.ToString('MM/dd/yyyy')))" -ForegroundColor Gray

Write-Host "`n [🎮] GRAPHICS (GPU)" -ForegroundColor White
foreach ($gpu in $gpus) {
    $vram = if ($gpu.AdapterRAM) { [math]::Round($gpu.AdapterRAM / 1MB) } else { 0 }
    $gpuType = if ($gpu.Caption -match "Intel|UHD|Iris|AMD Radeon|Basic Render") { "Integrated" } else { "Dedicated" }
    Write-Host " GPU:            $($gpu.Caption) ($vram MiB) " -NoNewline -ForegroundColor Gray
    Write-Host "[$gpuType]" -ForegroundColor Yellow
}

Write-Host "`n [📦] STORAGE" -ForegroundColor White
foreach ($disk in $disks) {
    $sizeGB = [math]::Round($disk.Size / 1GB)
    Write-Host " Disk:           $($disk.Model) ($sizeGB GB)" -NoNewline -ForegroundColor Gray
    if ($disk.Model -notmatch "QEMU") {
        $type = "HDD SATA"
        if ($disk.Model -match "NVMe" -or $disk.InterfaceType -eq "NVMe") { $type = "SSD NVMe" }
        elseif ($disk.Model -match "SSD" -or $disk.Caption -match "SSD") { $type = "SSD SATA" }
        Write-Host " -> " -NoNewline -ForegroundColor Gray
        Write-Host "$type" -ForegroundColor Yellow
    } else { Write-Host "" }
}

Write-Host "`n [🌐] NETWORK" -ForegroundColor White
if ($activeNet) {
    $ip = $activeNet.IPAddress | Where-Object { $_ -match "\." } | Select-Object -First 1
    Write-Host " Main IP:        $ip" -ForegroundColor Gray
    Write-Host " MAC Address:    $($activeNet.MACAddress)" -ForegroundColor Gray
    Write-Host " Adapter:        $($activeNet.Description)" -ForegroundColor Gray
}

# --- 10. APPLYING OEM INFORMATION TO REGISTRY ---
Write-Host "`n [📝] UPDATING OEM INFORMATION..." -ForegroundColor Cyan
$oemPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\OEMInformation"

# Conditional Manufacturer Logic
if ($isVM -or $isServer) {
    $oemManufacturer = $computerSystem.Manufacturer
} else {
    # Combines Manufacturer and Model for physical consumer/business PCs
    $oemManufacturer = "$($computerSystem.Manufacturer) $($computerSystem.Model)".Trim()
}

# Logic for Model: Serial or Computer Type
$serial = $bios.SerialNumber
$oemModel = if ([string]::IsNullOrWhiteSpace($serial) -or $serial -match "To be filled|Default|None|00000000") { $computerFullModel } else { $serial }

try {
    if (-not (Test-Path $oemPath)) { New-Item -Path $oemPath -Force | Out-Null }
    Set-ItemProperty -Path $oemPath -Name "Manufacturer" -Value $oemManufacturer
    Set-ItemProperty -Path $oemPath -Name "Model" -Value $oemModel
    Set-ItemProperty -Path $oemPath -Name "SupportHours" -Value ""
    Set-ItemProperty -Path $oemPath -Name "SupportPhone" -Value ""
    Set-ItemProperty -Path $oemPath -Name "SupportURL" -Value ""
    Write-Host " [✅] OEM Registry updated successfully!" -ForegroundColor Green
} catch {
    Write-Host " [❌] Failed to update Registry. Run as Administrator." -ForegroundColor Red
}

Write-Host "`n-- Scan Complete." -ForegroundColor Cyan
Write-Host "--------------------------------------------------------" -ForegroundColor Gray

##------------------------------------------------------##

# ============================================
# BATTERY HEALTH CHECK
# ============================================

$battery = Get-CimInstance Win32_Battery -ErrorAction SilentlyContinue

if (-not $battery) {

    Write-Host ""
    Write-Host "╔══════════════════════════════════════════════╗" -ForegroundColor DarkGray
    Write-Host "║         NO BATTERY DETECTED - SKIP           ║" -ForegroundColor DarkGray
    Write-Host "╚══════════════════════════════════════════════╝" -ForegroundColor DarkGray
    Write-Host ""

}
else {

    # Generate battery report silently
    powercfg /batteryreport /output "$env:TEMP\battery.html" > $null 2>&1

    # Read HTML report
    $html = Get-Content "$env:TEMP\battery.html" -Raw

    # Extract capacities
    $design = [regex]::Match(
        $html,
        'DESIGN CAPACITY.*?([\d\.]+)\s*mWh',
        'Singleline'
    ).Groups[1].Value.Replace('.','')

    $full = [regex]::Match(
        $html,
        'FULL CHARGE CAPACITY.*?([\d\.]+)\s*mWh',
        'Singleline'
    ).Groups[1].Value.Replace('.','')

    # Validate values
    if ([string]::IsNullOrWhiteSpace($design) -or
        [string]::IsNullOrWhiteSpace($full)) {

        Write-Host ""
        Write-Host "╔══════════════════════════════════════════════╗" -ForegroundColor Yellow
        Write-Host "║      UNABLE TO READ BATTERY STATISTICS       ║" -ForegroundColor Yellow
        Write-Host "╚══════════════════════════════════════════════╝" -ForegroundColor Yellow
        Write-Host ""
    }
    else {

        $health = [math]::Round(($full / $design) * 100, 2)

        # Health classification
        if ($health -ge 95) {
            $status = "EXCELLENT"
            $color  = "Green"
            $icon   = "[+++++]"
        }
        elseif ($health -ge 80) {
            $status = "GOOD"
            $color  = "Cyan"
            $icon   = "[++++ ]"
        }
        elseif ($health -ge 65) {
            $status = "OK"
            $color  = "Yellow"
            $icon   = "[+++  ]"
        }
        else {
            $status = "BAD"
            $color  = "Red"
            $icon   = "[+    ]"
        }

        Write-Host ""
        Write-Host "╔══════════════════════════════════════════════╗" -ForegroundColor Cyan
        Write-Host "║                BATTERY HEALTH                ║" -ForegroundColor Cyan
        Write-Host "╠══════════════════════════════════════════════╣" -ForegroundColor DarkGray

        Write-Host ("║ Design Capacity : {0,-24}   ║" -f "$design mWh") -ForegroundColor Gray
        Write-Host ("║ Full Capacity   : {0,-24}   ║" -f "$full mWh") -ForegroundColor Gray
        Write-Host ("║ Battery Health  : {0,-24}   ║" -f "$health%") -ForegroundColor $color
        Write-Host ("║ Status          : {0,-24}   ║" -f "$status $icon") -ForegroundColor $color

        Write-Host "╚══════════════════════════════════════════════╝" -ForegroundColor Cyan
        Write-Host ""
    }
}

##------------------------------------------------------##

<#
.SYNOPSIS
    Advanced Microsoft Activation Status Professional Audit.
.DESCRIPTION
    Fully automated identification for Windows, Office, Project, and Visio.
#>

$FormatEnumerationLimit = -1
Write-Host "--- Microsoft Activation Status Professional Audit ---" -ForegroundColor Cyan

function Get-ActivationStatus {
    # Fetch products that have a partial key installed
    $Products = Get-CimInstance -ClassName SoftwareLicensingProduct | Where-Object { $_.PartialProductKey }
    $OS = Get-CimInstance -ClassName Win32_OperatingSystem

    # 1. WINDOWS OS ANALYSIS
    $WinHeader = "[ WINDOWS OS ]"
    # PadRight ensures the background color forms a solid bar and doesn't bleed
    Write-Host "`n$($WinHeader.PadRight(65))" -ForegroundColor White -BackgroundColor DarkBlue
    
    $WinOS = $Products | Where-Object { $_.ApplicationID -eq "55c92734-d682-4d71-983e-d6ec3f16059f" }

    foreach ($obj in $WinOS) {
        $status = if ($obj.LicenseStatus -eq 1) { "Licensed (Activated)" } else { "Unlicensed/Notification" }
        $color = if ($obj.LicenseStatus -eq 1) { "Green" } else { "Red" }
        
        $channel = "Unknown"
        if ($obj.Description -match "RETAIL") { $channel = "Retail" }
        elseif ($obj.Description -match "OEM") { $channel = "OEM" }
        elseif ($obj.Description -match "VOLUME_KMS") { $channel = "Volume: KMS" }
        elseif ($obj.Description -match "VOLUME_MAK") { $channel = "Volume: MAK" }

        $isPermanent = if ($obj.LicenseStatus -eq 1 -and ($obj.GracePeriodRemaining -eq 0 -or $obj.GracePeriodRemaining -ge 2147483647)) { $true } else { $false }

        $displayVer = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -ErrorAction SilentlyContinue).DisplayVersion
        $fullOSName = "$($OS.Caption) ($displayVer) Build $($OS.BuildNumber) [x$((Get-CimInstance Win32_Processor).AddressWidth)]"

        Write-Host "Product:     $fullOSName"
        Write-Host "Channel:     $channel" -ForegroundColor Cyan
        Write-Host "Status:      " -NoNewline; Write-Host $status -ForegroundColor $color
        Write-Host "Partial Key: $($obj.PartialProductKey)"
        
        Write-Host "Permanency:  " -NoNewline
        if ($isPermanent) { Write-Host "Permanently Activated" -ForegroundColor Green }
        else { Write-Host "Temporary ($([math]::Round($obj.GracePeriodRemaining / 1440, 2)) days remaining)" -ForegroundColor Yellow }
    }

    # 2. OFFICE / PROJECT / VISIO ANALYSIS
    $OfficeProducts = $Products | Where-Object { $_.Description -match "Office" -or $_.Name -match "Office" }

    if ($OfficeProducts) {
        foreach ($off in $OfficeProducts) {
            $skuName = $off.Name -replace " edition", ""
            
            $category = "MICROSOFT OFFICE"
            $bgColor = "DarkMagenta"
            
            if ($skuName -match "Project") { 
                $category = "MICROSOFT PROJECT"
                $bgColor = "DarkGreen"
            }
            elseif ($skuName -match "Visio") { 
                $category = "MICROSOFT VISIO"
                $bgColor = "DarkCyan"
            }

            # Padding correction: PadRight fills the line buffer to prevent color overflow
            $OffHeader = "[ $category ]"
            Write-Host "`n$($OffHeader.PadRight(65))" -ForegroundColor White -BackgroundColor $bgColor
            
            $offStatus = if ($off.LicenseStatus -eq 1) { "Licensed" } else { "Unlicensed/Grace" }
            $offColor = if ($off.LicenseStatus -eq 1) { "Green" } else { "Yellow" }
            
            $offChannel = "Unknown"
            if ($off.Description -match "RETAIL") { $offChannel = "Retail" }
            elseif ($off.Description -match "OEM") { $offChannel = "OEM" }
            elseif ($off.Description -match "VOLUME_KMS" -or $off.Name -match "KMS") { $offChannel = "Volume: KMS" }
            elseif ($off.Description -match "VOLUME_MAK" -or $off.Name -match "MAK") { $offChannel = "Volume: MAK" }

            $isOffPermanent = if ($off.LicenseStatus -eq 1 -and ($off.GracePeriodRemaining -eq 0 -or $off.GracePeriodRemaining -ge 2147483647)) { $true } else { $false }

            Write-Host "Edition:     $skuName" -ForegroundColor White
            Write-Host "Channel:     $offChannel" -ForegroundColor Cyan
            Write-Host "Status:      " -NoNewline; Write-Host $offStatus -ForegroundColor $offColor
            Write-Host "Partial Key: $($off.PartialProductKey)"
            
            Write-Host "Permanency:  " -NoNewline
            if ($isOffPermanent) { Write-Host "Permanently Activated" -ForegroundColor Green }
            else { Write-Host "Temporary ($([math]::Round($off.GracePeriodRemaining / 1440, 2)) days remaining)" -ForegroundColor Yellow }
        }
    }
}

try { 
    Get-ActivationStatus 
} catch { 
    Write-Host "Error: Please run PowerShell as Administrator." -ForegroundColor Red 
} finally {
    # Safe and universal color reset
    [Console]::ResetColor()
}

Write-Host "`nAudit Complete." -ForegroundColor Cyan

##------------------------------------------------------##

<#
.SYNOPSIS
    Microsoft License & System Management Tool

.DESCRIPTION
    Interactive PowerShell menu for managing Windows and Microsoft Office licensing,
    system repair operations (SFC/DISM), and optional maintenance tools.

    Features:
    - Menu-driven interface with automatic timeout selection
    - Windows and Office (including Project/Visio) license management
    - System integrity repair utilities (SFC and DISM)
    - Optional activation and maintenance tools integration
    - Safe execution flow with user confirmation prompts
#>

function Clear-KeyBuffer {
    while ([Console]::KeyAvailable) {
        [Console]::ReadKey($true) | Out-Null
    }
}

function Show-LicenseMenu {
    Write-Host "`n================================================" -ForegroundColor Cyan
    Write-Host "   MICROSOFT LICENSE MANAGEMENT TOOL            " -ForegroundColor White
    Write-Host "================================================" -ForegroundColor Cyan
    Write-Host "1. Remove Windows Product Key"
    Write-Host "2. Install Windows Product Key"
    Write-Host "3. Remove Office Keys"
    Write-Host "4. MAS Tool"
    Write-Host "5. Run SFC"
    Write-Host "6. Run DISM"
    Write-Host "7. Skip / Continue Script"
    Write-Host "================================================" -ForegroundColor Cyan
    Write-Host "Select an option (Auto-skip in 5s): " -NoNewline
}

# ========================================================
# FUNCTIONS
# ========================================================
function Run-MAS { irm "https://get.activated.win" | iex }
function Run-SFC { sfc /scannow }
function Run-DISM { DISM /Online /Cleanup-Image /RestoreHealth }

function Remove-WindowsKey { slmgr /cpky; slmgr /upk }
function Install-WindowsKey {
    $key = Read-Host "Enter Key"
    slmgr /ipk $key
}
function Remove-OfficeKeys { Write-Host "Removing Office keys..." }

# ========================================================
# MAIN LOOP
# ========================================================
$ContinueScript = $false

while ($true) {

    $timeout = 5
    $selection = $null

    Clear-KeyBuffer
    Show-LicenseMenu

    while ($timeout -gt 0) {
        if ([Console]::KeyAvailable) {
            $selection = [Console]::ReadKey($true).KeyChar
            break
        }

        Write-Host "..$timeout" -NoNewline -ForegroundColor Gray
        Start-Sleep 1
        $timeout--
    }

    Write-Host ""

    # Timeout = skip menu loop and continue script
    if (-not $selection) {
        Write-Host "[INFO] Timeout → continuing script..." -ForegroundColor Yellow
        $ContinueScript = $true
        break
    }

    # ====================================================
    # OPTION 7 = IMMEDIATE SKIP
    # ====================================================
    if ($selection -eq '7') {
        Write-Host "`n[INFO] Skip selected → continuing script..." -ForegroundColor Green
        $ContinueScript = $true
        break
    }

    # ====================================================
    # CONFIRMATION FOR OPTIONS 1–6
    # ====================================================
    Write-Host "`nYou selected option [$selection]" -ForegroundColor Cyan
    $confirm = Read-Host "Continue execution? (Y/N)"

    if ($confirm -match '^[Yy]$') {

        switch ($selection) {
            '1' { Remove-WindowsKey }
            '2' { Install-WindowsKey }
            '3' { Remove-OfficeKeys }
            '4' { Run-MAS }
            '5' { Run-SFC }
            '6' { Run-DISM }
            default { Write-Host "[ERROR] Invalid option." -ForegroundColor Red }
        }

        Write-Host "`n[INFO] Operation completed. Returning to menu..." -ForegroundColor Cyan
        Start-Sleep 1
        continue
    }

    # ❗ FIX: THIS IS THE IMPORTANT PART
    # Instead of return, we just loop again
    Write-Host "[INFO] Returning to menu..." -ForegroundColor Yellow
    Start-Sleep 1
    continue
}

# ========================================================
# CONTINUE PIPELINE AFTER MENU
# ========================================================
if ($ContinueScript) {
    Write-Host "`n[INFO] Continuing to next scripts..." -ForegroundColor Cyan
}

Clear-KeyBuffer
Write-Host "`n[INFO] Done." -ForegroundColor Gray

##------------------------------------------------------##

# --- POWERSHELL 2.0 SECURITY ENFORCER ---
# Purpose: Block PowerShell 2.0 engine to mitigate downgrade attacks.
# Method: Conditional enforcement - only applies fixes if the system is vulnerable.

# --- CONFIGURATION ---
$regTarget     = "MACHINE\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine"
$regPath       = "HKLM:\SOFTWARE\Microsoft\PowerShell\3\PowerShellEngine"
$valueName     = "PSCompatibleVersion"
$secureValue   = "3.0, 4.0, 5.0, 5.1"
$cfgFile       = "$env:TEMP\sec_template.inf"
$dbFile        = "$env:TEMP\sec_audit.sdb"

Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host " [🔍] ANALYZING POWERSHELL ENGINE STATUS" -ForegroundColor Cyan
Write-Host "--------------------------------------------------------" -ForegroundColor Gray

$needsFix = $false

# 1. Initial Status Check
if (Test-Path $regPath) {
    $initialVal = (Get-ItemProperty -Path $regPath).$valueName
    
    if ($initialVal -notmatch "2.0") {
        # --- SYSTEM SECURE: SET FLAG TO FALSE ---
        Write-Host " [*] Current Status: " -NoNewline -ForegroundColor White
        Write-Host "SECURE" -ForegroundColor Green
        Write-Host " [i] Version 2.0 is already blocked. No action required." -ForegroundColor Gray
        $needsFix = $false
    } else {
        # --- SYSTEM VULNERABLE: SET FLAG TO TRUE ---
        Write-Host " [*] Current Status: " -NoNewline -ForegroundColor White
        Write-Host "VULNERABLE" -ForegroundColor Red
        Write-Host " [!] Found Version 2.0 in: $initialVal" -ForegroundColor Yellow
        $needsFix = $true
    }
} else {
    Write-Host " [✅] Target registry path not found. System is secure." -ForegroundColor Green
    $needsFix = $false
}

# 2. Execution Logic (Only runs if $needsFix is True)
if ($needsFix) {
    Write-Host "`n [⚡] INITIALIZING SECURITY ENFORCEMENT" -ForegroundColor Cyan
    Write-Host " ---------------------------------------------------" -ForegroundColor Gray

    # Generate Security Template (Granting Full Control to Administrators)
    Write-Host " [+] Generating Security Template..." -ForegroundColor Gray
    $securityTemplate = @"
[Unicode]
Unicode=yes
[Registry Keys]
"$regTarget",2,"D:AR(A;CI;KA;;;BA)"
[Version]
signature="`$CHICAGO`$"
Revision=1
"@
    $securityTemplate | Out-File -FilePath $cfgFile -Encoding unicode

    try {
        # Apply ACL reset using SecEdit
        Write-Host " [+] Resetting Registry Permissions (SecEdit)..." -ForegroundColor Gray
        secedit /configure /db $dbFile /cfg $cfgFile /areas REGKEYS /quiet | Out-Null
        
        # Apply the Lockdown Fix
        Write-Host " [+] Applying version restriction to registry..." -ForegroundColor Gray
        Set-ItemProperty -Path $regPath -Name $valueName -Value $secureValue -Force -ErrorAction Stop
        
        # Final Verification
        $finalVal = (Get-ItemProperty -Path $regPath).$valueName
        Write-Host "`n [✅] SUCCESS: Security policies applied." -ForegroundColor Green
        Write-Host " [i] Updated Value: $finalVal" -ForegroundColor White
    }
    catch {
        Write-Host "`n [❌] CRITICAL ERROR: Could not apply registry fix." -ForegroundColor Red
        Write-Host " [!] Reason: $($_.Exception.Message)" -ForegroundColor Yellow
    }
    finally {
        # Cleanup temporary security files
        if (Test-Path $cfgFile) { Remove-Item $cfgFile -Force }
        if (Test-Path $dbFile) { Remove-Item $dbFile -Force }
    }
}

# 3. Final Wrap-up (Always executes, allowing the rest of the script to run)
Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host " [🏁] POWERSHELL SECURITY CHECK COMPLETE" -ForegroundColor Green
Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host ""

# Keyboard buffer cleanup
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }

##------------------------------------------------------##

# --- PRECISION TIME PROTOCOL (NTP) OPTIMIZATION & GUI REGISTRATION ---
# Purpose: Ensures sub-millisecond accuracy, forces service persistence, and registers the server in the Windows GUI.

Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host " [🔍] ANALYZING SYSTEM TIME SOURCE & REGISTRY" -ForegroundColor Cyan
Write-Host "--------------------------------------------------------" -ForegroundColor Gray

# --- 1. Infrastructure Check ---
# Ensure Service is not Disabled and is Running (Required for Query)
$timeService = Get-Service w32time -ErrorAction SilentlyContinue
if ($timeService.StartType -eq 'Disabled') {
    Write-Host " [!] Windows Time service was Disabled. Re-enabling..." -ForegroundColor Yellow
    Set-Service w32time -StartupType Automatic
}

if ($timeService.Status -ne 'Running') {
    Write-Host " [!] Starting Windows Time service for analysis..." -ForegroundColor Gray
    Start-Service w32time -ErrorAction SilentlyContinue
}

# --- 2. GUI List Registration ---
# This ensures "pool.ntp.org" appears in the Control Panel / Settings dropdown list
$registryPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime\Servers"
$targetNtp = "pool.ntp.org"

try {
    $existingServers = Get-ItemProperty -Path $registryPath
    $serverValues = $existingServers.PSObject.Properties.Value
    
    if ($serverValues -notcontains $targetNtp) {
        Write-Host " [*] Adding $targetNtp to the Windows GUI selection list..." -ForegroundColor Gray
        
        # Find the next available numerical index in the registry
        $currentIndexes = $existingServers.PSObject.Properties.Name | Where-Object { $_ -match '^\d+$' } | ForEach-Object { [int]$_ }
        $nextIndex = ($currentIndexes | Measure-Object -Maximum).Maximum + 1
        
        # Create the new registry string value
        New-ItemProperty -Path $registryPath -Name $nextIndex -Value $targetNtp -PropertyType String -Force | Out-Null
        
        # Set the newly added server as the "Default" selection in the registry (0-based or index-based)
        # Note: Usually (Default) value in this key points to the index to be used.
        Set-ItemProperty -Path $registryPath -Name "(Default)" -Value "$nextIndex"
    }
} catch {
    Write-Host " [!] Failed to update Registry list. Ensure you are running as Admin." -ForegroundColor Red
}

# --- 3. Service Identification & Decision Logic ---
$currentSource = (w32tm /query /source 2>$null)

if ([string]::IsNullOrWhiteSpace($currentSource) -or $currentSource -match "Local CMOS" -or $currentSource -match "Free-Running") {
    $displaySource = "Standard/Local Clock"
} else {
    $displaySource = $currentSource
}

Write-Host " [*] Current Source: $displaySource" -ForegroundColor White

# Apply changes only if the pool is not already the active source
if ($currentSource -notmatch "pool.ntp.org") {
    Write-Host " [!] Optimization required. Configuring pool.ntp.org..." -ForegroundColor Yellow
    
    try {
        # Force service to Automatic and Start
        Set-Service w32time -StartupType Automatic
        Start-Service w32time -ErrorAction SilentlyContinue

        # Register network trigger (Service starts when internet is available)
        & sc.exe triggerinfo w32time start/networkon stop/networkoff | Out-Null

        # Apply global NTP pool configuration with 0x1 flag (Symmetric Active mode)
        $ntpPool = "0.pool.ntp.org,0x1 1.pool.ntp.org,0x1 2.pool.ntp.org,0x1 3.pool.ntp.org,0x1"
        & w32tm /config /manualpeerlist:"$ntpPool" /syncfromflags:manual /reliable:YES /update | Out-Null
        
        # Restart to commit changes
        Restart-Service w32time -Force
        
        # Immediate resync and hardware rediscovery
        & w32tm /resync /rediscover | Out-Null
        
        Write-Host "`n [✅] SUCCESS: NTP server updated, registered in GUI, and set to Persistent." -ForegroundColor Green
    }
    catch {
        Write-Host "`n [❌] ERROR: Failed to apply NTP configuration." -ForegroundColor Red
    }
}
else {
    Write-Host " [✅] SYSTEM ALREADY OPTIMIZED: pool.ntp.org is active and registered." -ForegroundColor Green
}

Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host ""

##------------------------------------------------------##

# --- SMBv1 SECURITY ENFORCER (REGISTRY METHOD) ---
# Purpose: Detect and disable the insecure SMBv1 protocol to prevent Ransomware (e.g., WannaCry).
# Method: Direct Registry manipulation for high compatibility with optimized Windows builds.

# --- CONFIGURATION ---
$Smb1Path  = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
$Smb1Value = "SMB1"

Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host " [🔍] ANALYZING SMBv1 SERVER STATUS" -ForegroundColor Cyan
Write-Host "--------------------------------------------------------" -ForegroundColor Gray

# 1. Verification Logic
$vulnerable = $false
$abortModule = $false

try {
    $currentVal = (Get-ItemProperty -Path $Smb1Path -Name $Smb1Value -ErrorAction SilentlyContinue).$Smb1Value

    Write-Host " [*] Current Registry State: " -NoNewline -ForegroundColor White
    
    if ($currentVal -eq 0) {
        Write-Host "SECURE" -ForegroundColor Green
        Write-Host " [i] SMBv1 is already disabled (Value = 0)." -ForegroundColor Gray
    } 
    elseif ($currentVal -eq 1) {
        Write-Host "VULNERABLE" -ForegroundColor Red
        Write-Host " [!] SMBv1 is explicitly enabled in registry." -ForegroundColor Yellow
        $vulnerable = $true
    }
    else {
        # If the value is missing, Windows may allow SMBv1 by default or via Features.
        Write-Host "VULNERABLE (DEFAULT)" -ForegroundColor Red
        Write-Host " [!] Registry key 'SMB1' is missing. Protocol is likely active." -ForegroundColor Yellow
        $vulnerable = $true
    }
} catch {
    Write-Host " [❌] ERROR: Could not access LanmanServer registry hive." -ForegroundColor Red
    # Setting abort flag instead of 'return' to preserve the main script execution.
    $abortModule = $true
}

# 2. Automated Enforcement (Only executes if module wasn't aborted and system is vulnerable)
if (-not $abortModule -and $vulnerable) {
    Write-Host "`n [⚡] INITIALIZING SMBv1 DEACTIVATION" -ForegroundColor Cyan
    Write-Host " ---------------------------------------------------" -ForegroundColor Gray
    
    try {
        # Force create/set the SMB1 value to 0
        Write-Host " [+] Injecting 'SMB1' DWord = 0 into registry..." -ForegroundColor Gray
        New-ItemProperty -Path $Smb1Path -Name $Smb1Value -Value 0 -PropertyType DWORD -Force -ErrorAction Stop | Out-Null
        
        Write-Host "`n [✅] SUCCESS: SMBv1 Server has been disabled." -ForegroundColor Green
        Write-Host " [!] IMPORTANT: A REBOOT is required to apply changes." -ForegroundColor Magenta
    }
    catch {
        Write-Host "`n [❌] FATAL ERROR: Failed to modify registry." -ForegroundColor Red
        Write-Host " [i] Reason: $($_.Exception.Message)" -ForegroundColor Yellow
    }
} elseif (-not $abortModule -and -not $vulnerable) {
    Write-Host "`n [✅] No action needed. Your system is protected against SMBv1 exploits." -ForegroundColor Cyan
}

# 3. Final Summary (Only if access was successful)
if (-not $abortModule) {
    Write-Host "--------------------------------------------------------" -ForegroundColor Gray
    Write-Host " [🏁] FINAL STATUS: " -NoNewline -ForegroundColor White
    $finalCheck = (Get-ItemProperty -Path $Smb1Path -Name $Smb1Value -ErrorAction SilentlyContinue).$Smb1Value
    if ($finalCheck -eq 0) {
        Write-Host "PROTECTED" -ForegroundColor Green
    } else {
        Write-Host "ACTION REQUIRED" -ForegroundColor Red
    }
    Write-Host "--------------------------------------------------------" -ForegroundColor Gray
}

# Clear keyboard buffer
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }
Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host ""

##------------------------------------------------------##

# ============================================================
# DISABLE SYSTEM CRASH DUMPS
# ============================================================

Write-Host "[SYSTEM] Verifying crash dump configuration..." -ForegroundColor Cyan

$registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl"

# Desired configuration
$desiredValues = @{
    "CrashDumpEnabled" = 0
    "LogEvent"         = 0
}

try {
    if (Test-Path $registryPath) {

        $needsUpdate = $false

        foreach ($name in $desiredValues.Keys) {

            # Get current value (if exists)
            $currentValue = (Get-ItemProperty -Path $registryPath -Name $name -ErrorAction SilentlyContinue).$name
            $desiredValue = $desiredValues[$name]

            if ($null -eq $currentValue) {
                Write-Host ">> $name not set. Will configure..." -ForegroundColor Yellow
                $needsUpdate = $true
            }
            elseif ($currentValue -ne $desiredValue) {
                Write-Host ">> $name mismatch (Current: $currentValue | Desired: $desiredValue). Updating..." -ForegroundColor Yellow
                $needsUpdate = $true
            }
            else {
                Write-Host ">> $name already correctly set ($currentValue)." -ForegroundColor DarkGray
            }
        }

        if ($needsUpdate) {

            Write-Host ">> Applying crash dump configuration..." -ForegroundColor Gray

            foreach ($name in $desiredValues.Keys) {
                Set-ItemProperty -Path $registryPath `
                    -Name $name `
                    -Value $desiredValues[$name] `
                    -Force
            }

            Write-Host "[OK] Crash dump configuration applied successfully." -ForegroundColor Green
        }
        else {
            Write-Host "[OK] System already configured. No changes needed." -ForegroundColor Green
        }

    }
    else {
        Write-Host "[ERROR] CrashControl registry path not found." -ForegroundColor Red
    }
}
catch {
    Write-Host "[ERROR] $($_.Exception.Message)" -ForegroundColor Red
}

Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host ""

##------------------------------------------------------##

# --- BITLOCKER PURGE & PRIVACY MANIFEST ---
# Purpose: Deep scan, automatic decryption, and Registry Hardening to restore privacy and performance.

Write-Host "************************************************************" -ForegroundColor Red
Write-Host "             BITLOCKER PRIVACY & UTILITY ALERT             " -ForegroundColor White -BackgroundColor Red
Write-Host "************************************************************" -ForegroundColor Red
Write-Host "1. ZERO PRIVACY: BitLocker keys are often backed up to MS"
Write-Host "   servers automatically. It's a 'black box' encryption where"
Write-Host "   your data and keys are accessible to government agencies."
Write-Host "2. PERFORMANCE DRAIN: Constant real-time encryption/decryption"
Write-Host "   overhead can reduce SSD R/W speeds by up to 20-45%."
Write-Host "3. RECOVERY TRAP: A BIOS update or hardware change can lock"
Write-Host "   you out of your own data forever if the key is lost."
Write-Host "4. INSECURE BY DESIGN: Law enforcement backdoors and DMA"
Write-Host "   attacks make it less secure than open-source alternatives."
Write-Host "************************************************************`n" -ForegroundColor Red

# Helper Function to check and set registry with detailed logging
function Set-RegistryIfMissing {
    param (
        [string]$Path,
        [string]$Name,
        [uint32]$Value
    )
    if (-not (Test-Path $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }
    $currentVal = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue
    
    if ($null -eq $currentVal -or $currentVal.$Name -ne $Value) {
        Write-Host " [APPLIED] $Name = $Value" -ForegroundColor Yellow
        Set-ItemProperty -Path $Path -Name $Name -Value $Value -Type DWORD -Force
    } else {
        Write-Host " [EXISTING] $Name is already set to $Value" -ForegroundColor Gray
    }
}

# --- 1. Registry Hardening ---
Write-Host " [🛡️] ANALYZING REGISTRY HARDENING..." -ForegroundColor Cyan

# A. Prevent Automatic Device Encryption
Set-RegistryIfMissing -Path "HKLM:\SYSTEM\CurrentControlSet\Control\BitLocker" -Name "PreventDeviceEncryption" -Value 1

# B. Disable Hardware-Based Encryption
$fvePath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE"
Set-RegistryIfMissing -Path $fvePath -Name "OSHardwareEncryption" -Value 0
Set-RegistryIfMissing -Path $fvePath -Name "OSAllowSoftwareEncryptionFailover" -Value 0
Set-RegistryIfMissing -Path $fvePath -Name "OSRestrictHardwareEncryptionAlgorithms" -Value 0

# C. Disable BitLocker on Removable Drives (BitLocker To Go)
Set-RegistryIfMissing -Path $fvePath -Name "RDVConfigureBDE" -Value 0
Set-RegistryIfMissing -Path $fvePath -Name "RDVAllowBDE" -Value 0
Set-RegistryIfMissing -Path $fvePath -Name "RDVDisableBDE" -Value 0

Write-Host " [✅] Registry check complete." -ForegroundColor Green

# --- 2. Active Decryption Logic ---
Write-Host "`n [🔍] ANALYZING VOLUMES FOR ACTIVE ENCRYPTION..." -ForegroundColor Cyan

try {
    $drives = Get-BitLockerVolume | Where-Object { $_.VolumeType -eq 'OperatingSystem' -or $_.VolumeType -eq 'FixedData' }
} catch {
    $drives = $null
}

if ($null -eq $drives -or $drives.Count -eq 0) {
    Write-Host " [✅] Clean: No active BitLocker volumes detected." -ForegroundColor Green
} else {
    foreach ($volume in $drives) {
        $driveLetter = $volume.MountPoint
        $status = $volume.VolumeStatus
        
        Write-Host " [*] Drive ${driveLetter} Status: $status" -ForegroundColor White
        
        if ($status -ne "FullyDecrypted") {
            Write-Host " [!] BitLocker detected on ${driveLetter}. Initiating decryption..." -ForegroundColor Yellow
            try {
                Disable-BitLocker -MountPoint $driveLetter -ErrorAction Stop
                Write-Host " [▶] Decryption started for ${driveLetter}." -ForegroundColor Green
            } catch {
                Write-Host " [❌] Failed to disable BitLocker on ${driveLetter}: $($_.Exception.Message)" -ForegroundColor Red
            }
        } else {
            Write-Host " [✅] Drive ${driveLetter} is already decrypted and private." -ForegroundColor Green
        }
    }
}

Write-Host "`nProcess complete! System is now BitLocker-resistant. ✅" -ForegroundColor Green
Write-Host "--------------------------------------------------------" -ForegroundColor Cyan

##------------------------------------------------------##

# ============================================================
# Windows Security Hardening Module
# ============================================================

Write-Host "`n[Security Module] Starting Hardening..." -ForegroundColor Cyan

# ------------------------------------------------------------
# Helper Function: Check and Set Registry Value Safely
# ------------------------------------------------------------
function Set-RegistryValueSafe {
    param (
        [string]$Path,
        [string]$Name,
        [int]$Value
    )

    try {
        # Ensure registry path exists
        if (-not (Test-Path $Path)) {
            Write-Host "    -> Creating path: $Path"
            New-Item -Path $Path -Force | Out-Null
        }

        # Read current value safely
        $current = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name

        if ($null -eq $current) {
            Write-Host "    -> Setting $Name = $Value (Not Set)"
            New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType DWord -Force | Out-Null
        }
        elseif ($current -ne $Value) {
            Write-Host "    -> Fixing $Name (Current: $current → Expected: $Value)"
            Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force
        }
        else {
            Write-Host "    ✔ $Name already compliant ($Value)" -ForegroundColor DarkGreen
        }
    }
    catch {
        Write-Host "    ✖ ERROR setting $Name : $($_.Exception.Message)" -ForegroundColor Red
    }
}

# ------------------------------------------------------------
# SECTION 1 — Autorun / Autoplay Protection
# ------------------------------------------------------------
Write-Host "`n[1] Autorun & Autoplay Hardening..." -ForegroundColor Cyan

$autorunPaths = @(
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer",
    "HKCU:\Software\Policies\Microsoft\Windows\Explorer",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers"
)

foreach ($path in $autorunPaths) {
    Write-Host "`n[+] Processing: $path" -ForegroundColor Yellow

    Set-RegistryValueSafe -Path $path -Name "NoDriveTypeAutoRun" -Value 255
    Set-RegistryValueSafe -Path $path -Name "NoAutorun" -Value 1

    if ($path -match "AutoplayHandlers") {
        Set-RegistryValueSafe -Path $path -Name "DisableAutoplay" -Value 1
    }
}

# ------------------------------------------------------------
# SECTION 2 — Security Zone Lock (Browser/System)
# ------------------------------------------------------------
Write-Host "`n[2] Security Zone Hardening..." -ForegroundColor Cyan

$zonePaths = @(
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",
    "HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
)

foreach ($path in $zonePaths) {
    Write-Host "`n[+] Processing: $path" -ForegroundColor Yellow

    Set-RegistryValueSafe -Path $path -Name "Security_HKLM_only" -Value 1
    Set-RegistryValueSafe -Path $path -Name "Security_Zones_Map_Edit" -Value 1
}

# ------------------------------------------------------------
# SECTION 3 — Download Integrity (Attachment Manager)
# ------------------------------------------------------------
Write-Host "`n[3] Download Integrity Protection..." -ForegroundColor Cyan

$attachmentPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Attachments",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments"
)

foreach ($path in $attachmentPaths) {

    Write-Host "`n[+] Processing: $path" -ForegroundColor Yellow

    try {
        if (Test-Path $path) {

            $existing = Get-ItemProperty -Path $path -Name "ScanWithAntiVirus" -ErrorAction SilentlyContinue

            if ($null -ne $existing.ScanWithAntiVirus) {
                Write-Host "    -> Removing ScanWithAntiVirus"
                Remove-ItemProperty -Path $path -Name "ScanWithAntiVirus" -ErrorAction SilentlyContinue
                Write-Host "    ✔ Removed" -ForegroundColor Green
            }
            else {
                Write-Host "    ✔ ScanWithAntiVirus already absent" -ForegroundColor DarkGreen
            }

            Set-RegistryValueSafe -Path $path -Name "SaveZoneInformation" -Value 2
        }
        else {
            Write-Host "    ✔ Path does not exist (nothing to clean)" -ForegroundColor DarkGreen
        }
    }
    catch {
        Write-Host "    ✖ ERROR: $($_.Exception.Message)" -ForegroundColor Red
    }
}

# ------------------------------------------------------------
# SECTION 4 — Digital Signature Enforcement
# ------------------------------------------------------------
Write-Host "`n[4] WinTrust Integrity Check..." -ForegroundColor Cyan

$winTrustPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing"

Write-Host "`n[+] Auditing: $winTrustPath" -ForegroundColor Yellow

try {
    $currentState = (Get-ItemProperty -Path $winTrustPath -Name "State" -ErrorAction SilentlyContinue).State

    if ($null -eq $currentState) {
        Write-Host "    ℹ State not found (system default assumed)" -ForegroundColor Gray
    }
    else {
        if ($currentState -ne 0x23C00 -and $currentState -ne 0x23E00) {
            Write-Host "    ⚠ Non-standard WinTrust State detected: $currentState" -ForegroundColor Yellow
        }
        else {
            Write-Host "    ✔ WinTrust State is standard ($currentState)" -ForegroundColor DarkGreen
        }
    }
}
catch {
    Write-Host "    ✖ ERROR reading WinTrust state" -ForegroundColor Red
}

# ------------------------------------------------------------
# FINAL STATUS
# ------------------------------------------------------------
Write-Host "`n[✓] Hardening check completed successfully." -ForegroundColor Green
Write-Host "[i] System is now aligned with safe security baseline." -ForegroundColor Cyan
Write-Host "[!] Reboot may be required for full effect." -ForegroundColor Yellow
Write-Host ""

##------------------------------------------------------##

# ============================================
# Windows Performance & Privacy Optimization
# ============================================

$Global:Changes = 0
$Global:Errors = 0

# ============================================
# LOG
# ============================================

function Write-Log {
    param ($Type, $Message)

    switch ($Type) {
        "APPLY" { Write-Host "⚡ $Message" -ForegroundColor Cyan; $Global:Changes++ }
        "FIX"   { Write-Host "🔧 $Message" -ForegroundColor Yellow; $Global:Changes++ }
        "INFO"  { Write-Host "ℹ️  $Message" -ForegroundColor Gray }
        "ERROR" { Write-Host "❌ $Message" -ForegroundColor Red; $Global:Errors++ }
    }
}

# ============================================
# RAM REAL
# ============================================

function Get-RealRAM {
    try {
        $ramBytes = (Get-CimInstance Win32_PhysicalMemory | Measure-Object Capacity -Sum).Sum
        $ramGB = $ramBytes / 1GB
        $ramMB = $ramBytes / 1MB
        $culture = [System.Globalization.CultureInfo]::InvariantCulture

        return @{
            Bytes = $ramBytes
            Text  = "$($ramGB.ToString("F2",$culture)) GB ($([math]::Round($ramMB)) MB)"
        }
    } catch {
        Write-Log "ERROR" "RAM detection failed"
        return $null
    }
}

# ============================================
# HELPERS
# ============================================

function Set-RegValueSafe {
    param ($Path, $Name, $Value, $Type = "DWord")

    try {
        if (-not (Test-Path $Path)) {
            New-Item -Path $Path -ItemType Directory -ErrorAction SilentlyContinue | Out-Null
        }

        $current = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name

        if ($null -eq $current -or $current -ne $Value) {
            Set-ItemProperty -Path $Path -Name $Name -Value $Value -Type $Type
            Write-Log "APPLY" "$Name → $Value"
        }

    } catch {
        Write-Log "ERROR" "$Name failed"
    }
}

function Remove-RegValueSafe {
    param ($Path, $Name)

    try {
        if (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue) {
            Remove-ItemProperty -Path $Path -Name $Name
            Write-Log "FIX" "$Name removed (Windows default)"
        }
    } catch {
        Write-Log "ERROR" "$Name removal failed"
    }
}

function Set-ServiceSafe {
    param ($Name, $StartupType)

    try {
        $svc = Get-Service -Name $Name -ErrorAction Stop

        if ($svc.StartType -ne $StartupType) {
            Set-Service -Name $Name -StartupType $StartupType
            Write-Log "APPLY" "$Name service → $StartupType"
        }

    } catch {
        Write-Log "INFO" "$Name service not found (skipped)"
    }
}

function Disable-TaskSafe {
    param([string]$TaskPath)

    try {
        $tasks = Get-ScheduledTask -TaskPath $TaskPath -ErrorAction SilentlyContinue

        foreach ($task in $tasks) {
            if ($task.State -ne "Disabled") {

                $taskName = $task.TaskName
                $fullName = "$TaskPath$taskName"

                try {
                    Disable-ScheduledTask -InputObject $task -ErrorAction Stop
                    Write-Log "APPLY" "Task disabled: $taskName"
                    continue
                }
                catch {}

                try {
                    $tempName = "TempDisable_" + [guid]::NewGuid().ToString()

                    $cmd = "schtasks /Change /TN `"$fullName`" /Disable"

                    schtasks /Create /TN $tempName /TR $cmd /SC ONCE /ST 00:00 /RU SYSTEM /F >$null 2>&1
                    schtasks /Run /TN $tempName >$null 2>&1

                    Start-Sleep -Milliseconds 500

                    schtasks /Delete /TN $tempName /F >$null 2>&1
                }
                catch {}

                $check = Get-ScheduledTask -TaskPath $TaskPath -TaskName $taskName -ErrorAction SilentlyContinue

                if ($check -and $check.State -eq "Disabled") {
                    Write-Log "FIX" "Forced disable (SYSTEM): $taskName"
                } else {
                    Write-Log "INFO" "Still protected (TrustedInstaller): $taskName"
                }
            }
        }
    } catch {
        Write-Log "ERROR" "Task path failed: $TaskPath"
    }
}

# ============================================
# SYSTEM
# ============================================

Write-Host "`n=== System ==="

Set-RegValueSafe "HKCU:\Control Panel\Desktop" "WaitToKillAppTimeout" "2000" "String"
Set-RegValueSafe "HKCU:\Control Panel\Desktop" "HungAppTimeout" "2000" "String"
Set-RegValueSafe "HKCU:\Control Panel\Desktop" "AutoEndTasks" "1" "String"
Set-RegValueSafe "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" "AutoReboot" 0

Set-ServiceSafe "RemoteRegistry" "Disabled"

# Faster service shutdown
Set-RegValueSafe "HKLM:\SYSTEM\CurrentControlSet\Control" "WaitToKillServiceTimeout" "2500" String
Set-RegValueSafe "HKLM:\SYSTEM\ControlSet001\Control" "WaitToKillServiceTimeout" "2500" String

# Disable Power Throttling
Set-RegValueSafe "HKLM:\SYSTEM\CurrentControlSet\Control\Power\PowerThrottling" "PowerThrottlingOff" 1
Set-RegValueSafe "HKLM:\SYSTEM\ControlSet001\Control\Power\PowerThrottling" "PowerThrottlingOff" 1

# ============================================
# EXPLORER
# ============================================

Write-Host "`n=== Explorer ==="

$ram = Get-RealRAM
if ($ram) { Write-Log "INFO" "RAM: $($ram.Text)" }

if ($ram.Bytes -ge 8GB) {
    Set-RegValueSafe "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" "SeparateProcess" 1
}

Set-RegValueSafe "HKCU:\Control Panel\Desktop" "ForegroundLockTimeout" 0
Set-RegValueSafe "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" "DisablePreviewDesktop" 0
Set-RegValueSafe "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" "DisallowShaking" 1

# ============================================
# MEMORY / CPU
# ============================================

Write-Host "`n=== Memory / CPU ==="

if ($ram -and $ram.Bytes -ge 8GB) {
    Set-RegValueSafe "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" "DisablePagingExecutive" 1
}

Remove-RegValueSafe "HKLM:\SYSTEM\CurrentControlSet\Control\PriorityControl" "Win32PrioritySeparation"

# ============================================
# NETWORK
# ============================================

Write-Host "`n=== Network ==="

Set-RegValueSafe "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" "NetworkThrottlingIndex" 4294967295
Set-RegValueSafe "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" "MaxCacheTtl" 86400

Remove-RegValueSafe "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" "EnablePMTUDiscovery"
Remove-RegValueSafe "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" "DefaultTTL"

# ============================================
# PRIVACY / TELEMETRY
# ============================================

Write-Host "`n=== Privacy / Telemetry ==="

# Main telemetry keys
Set-RegValueSafe "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection" "AllowTelemetry" 0
Set-RegValueSafe "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection" "AllowTelemetry" 0

# WOW6432Node telemetry keys
Set-RegValueSafe "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\DataCollection" "AllowTelemetry" 0
Set-RegValueSafe "HKLM:\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\DataCollection" "AllowTelemetry" 0

# Scheduled Tasks
Disable-TaskSafe "\Microsoft\Windows\Application Experience\"
Disable-TaskSafe "\Microsoft\Windows\Customer Experience Improvement Program\"
Disable-TaskSafe "\Microsoft\Windows\Autochk\"
Disable-TaskSafe "\Microsoft\Windows\DiskDiagnostic\"
Disable-TaskSafe "\Microsoft\Windows\Feedback\Siuf\"

# ============================================
# ADOBE
# ============================================

Write-Host "`n=== Adobe ==="

try {
    $task = Get-ScheduledTask -TaskName "Adobe Acrobat Update Task" -ErrorAction SilentlyContinue

    if ($task) {
        if ($task.State -ne "Disabled") {
            Disable-ScheduledTask -InputObject $task
            Write-Log "APPLY" "Adobe scheduled task disabled"
        } else {
            Write-Log "INFO" "Adobe task already disabled"
        }
    } else {
        Write-Log "INFO" "Adobe task not found"
    }
} catch {
    Write-Log "ERROR" "Adobe task failed"
}

Set-ServiceSafe "AdobeARMservice" "Disabled"
Set-ServiceSafe "adobeupdateservice" "Disabled"

# ============================================
# SEARCH
# ============================================

Write-Host "`n=== Windows Search ==="

$search = Get-Service WSearch -ErrorAction SilentlyContinue
if ($search -and $search.Status -ne "Stopped") {
    Stop-Service WSearch -Force
    Write-Log "APPLY" "Windows Search stopped"
}
Set-ServiceSafe "WSearch" "Disabled"

Set-RegValueSafe "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" "BingSearchEnabled" 0
Set-RegValueSafe "HKCU:\Software\Microsoft\Windows\CurrentVersion\Search" "CortanaConsent" 0

# ============================================
# DELIVERY
# ============================================

Set-RegValueSafe "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization" "DODownloadMode" 0

# >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> #

# ============================================
# ADS / TRACKING DISABLE
# ============================================

Write-Host "`n=== Ads / Tracking ===" -ForegroundColor Cyan
Write-Host "-- Disabling Targeted Ads and Data Collection" -ForegroundColor Green

# ============================================
# SAFE REGISTRY WRITE FUNCTION
# ============================================

function Set-RegValueSafe {

    param (
        [string]$Path,
        [string]$Name,
        $Value
    )

    try {

        # Create registry path if missing
        if (!(Test-Path $Path)) {
            New-Item -Path $Path -Force | Out-Null
        }

        # Create/update DWORD value
        New-ItemProperty `
            -Path $Path `
            -Name $Name `
            -Value $Value `
            -PropertyType DWord `
            -Force | Out-Null

        Write-Host "⚡ $Name → $Value" -ForegroundColor Green
    }
    catch {

        Write-Host "❌ $Name failed" -ForegroundColor Red
    }
}

# ------------------------------------------------
# CLOUD CONTENT (Consumer Features / Spotlight / Suggestions)
# ------------------------------------------------

Set-RegValueSafe "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" "DisableSoftLanding" 1
Set-RegValueSafe "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" "DisableWindowsSpotlightFeatures" 1
Set-RegValueSafe "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" "DisableWindowsConsumerFeatures" 1
Set-RegValueSafe "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CloudContent" "DisableTailoredExperiencesWithDiagnosticData" 1

Set-RegValueSafe "HKLM:\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\CloudContent" "DisableWindowsConsumerFeatures" 1

# ------------------------------------------------
# PRIVACY / TAILORED EXPERIENCES
# ------------------------------------------------

$privacyPaths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Privacy",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Privacy"
)

foreach ($path in $privacyPaths) {

    # Create path if missing
    if (!(Test-Path $path)) {
        New-Item -Path $path -Force | Out-Null
    }

    Set-RegValueSafe $path "TailoredExperiencesWithDiagnosticDataEnabled" 0
}

# ------------------------------------------------
# APPLY TO LOADED USER HIVES AUTOMATICALLY
# ------------------------------------------------

$loadedUsers = Get-ChildItem "Registry::HKEY_USERS" |
Where-Object {
    $_.Name -match "S-1-5-21-" -and
    $_.PSChildName -notmatch "_Classes"
}

foreach ($user in $loadedUsers) {

    $userPrivacy = "Registry::$($user.Name)\Software\Microsoft\Windows\CurrentVersion\Privacy"

    if (!(Test-Path $userPrivacy)) {
        New-Item -Path $userPrivacy -Force | Out-Null
    }

    Set-RegValueSafe $userPrivacy "TailoredExperiencesWithDiagnosticDataEnabled" 0
}

# ------------------------------------------------
# POLICY ENFORCEMENT (STRONGEST PRIORITY)
# ------------------------------------------------

Set-RegValueSafe "HKCU:\Software\Policies\Microsoft\Windows\CloudContent" "DisableTailoredExperiencesWithDiagnosticData" 1
Set-RegValueSafe "HKCU:\Software\Microsoft\Windows\CurrentVersion\Privacy" "TailoredExperiencesWithDiagnosticDataEnabled" 0

# ------------------------------------------------
# EXTRA HARDENING
# ------------------------------------------------

Set-RegValueSafe "HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" "Enabled" 0
Set-RegValueSafe "HKLM:\SOFTWARE\Policies\Microsoft\Windows\AdvertisingInfo" "DisabledByGroupPolicy" 1

Write-Host "`nAds / Tracking settings applied successfully." -ForegroundColor Green

# >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> #

# ============================================
# BACKGROUND DATA
# ============================================

Write-Host "`n=== Background Data ==="

Set-RegValueSafe "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" "PublishUserActivities" 0
Set-RegValueSafe "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" "UploadUserActivities" 0
Set-RegValueSafe "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" "EnableActivityFeed" 0
Set-RegValueSafe "HKCU:\Software\Microsoft\Siuf\Rules" "NumberOfSIUFInPeriod" 0
Set-RegValueSafe "HKCU:\Software\Microsoft\Siuf\Rules" "PeriodInNanoSeconds" 0

# ============================================
# Disable Windows suggestions
# ============================================

Set-RegValueSafe "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" "SystemPaneSuggestionsEnabled" 0
Set-RegValueSafe "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" "SoftLandingEnabled" 0
Set-RegValueSafe "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" "SilentInstalledAppsEnabled" 0

# ============================================
# DISABLE IE
# ============================================

Write-Host "`n=== Disable Internet Explorer ===" 
dism /online /Disable-Feature /FeatureName:Internet-Explorer-Optional-amd64 /NoRestart | Out-Null

# ============================================
# SUMMARY
# ============================================

Write-Host "`n============================================"
Write-Host "Changes applied: $Global:Changes"
Write-Host "Errors: $Global:Errors"

if ($Global:Changes -eq 0) {
    Write-Host "System already optimized ✔" -ForegroundColor Green
} else {
    Write-Host "Optimization applied ⚡" -ForegroundColor Cyan
}

Write-Host "Restart recommended."
Write-Host "============================================"
Write-Host ""

# ============================================
# MMCSS RESPONSIVENESS
# ============================================

Write-Host "`n=== MMCSS Responsiveness ==="

# ------------------------------------------------
# SAFE REGISTRY WRITER
# ------------------------------------------------
function Set-RegValueSafe {
    param (
        [string]$Path,
        [string]$Name,
        [object]$Value
    )

    try {
        if (-not (Test-Path $Path)) {
            New-Item -Path $Path -Force | Out-Null
        }

        Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force
    }
    catch {
        Write-Host "[WARN] Failed to write registry: $Name" -ForegroundColor Yellow
    }
}

# ------------------------------------------------
# DETECT WINDOWS SERVER
# ------------------------------------------------
function Get-IsWindowsServer {
    try {
        $os = Get-CimInstance Win32_OperatingSystem
        return ($os.ProductType -ne 1)
    }
    catch {
        Write-Host "[WARN] Could not detect OS type. Assuming Workstation." -ForegroundColor Yellow
        return $false
    }
}

# ------------------------------------------------
# RAM DETECTION
# ------------------------------------------------
function Get-RealRAM {
    try {
        $ramBytes = (Get-CimInstance Win32_PhysicalMemory | Measure-Object Capacity -Sum).Sum
        return [math]::Round($ramBytes / 1GB, 2)
    }
    catch {
        Write-Host "[ERROR] RAM detection failed. Defaulting to 8GB." -ForegroundColor Red
        return 8
    }
}

# ------------------------------------------------
# CPU DETECTION
# ------------------------------------------------
function Get-LogicalCPU {
    try {
        return (Get-CimInstance Win32_ComputerSystem).NumberOfLogicalProcessors
    }
    catch {
        Write-Host "[WARN] CPU detection failed. Assuming 4 threads." -ForegroundColor Yellow
        return 4
    }
}

# ------------------------------------------------
# SYSTEM INFO
# ------------------------------------------------
$TotalRAM = Get-RealRAM
$IsServer = Get-IsWindowsServer
$LogicalProcessors = Get-LogicalCPU

Write-Host "[INFO] Detected RAM: $TotalRAM GB" -ForegroundColor Gray
Write-Host "[INFO] Logical CPUs: $LogicalProcessors" -ForegroundColor Gray
Write-Host "[INFO] Windows Server: $IsServer" -ForegroundColor Gray

# ------------------------------------------------
# APPLY SMART VALUE
# ------------------------------------------------
if ($IsServer) {

    # SERVER (FIREBIRD / DATABASE SAFE PROFILE)
    if ($TotalRAM -ge 32 -and $LogicalProcessors -ge 8) {
        $Responsiveness = 5
    }
    elseif ($TotalRAM -ge 16 -and $LogicalProcessors -ge 6) {
        $Responsiveness = 5
    }
    else {
        $Responsiveness = 6
    }

} else {

    # DESKTOP
    if ($TotalRAM -ge 16) {

        if ($LogicalProcessors -le 4) {
            $Responsiveness = 5
        } else {
            $Responsiveness = 3
        }

    } elseif ($TotalRAM -ge 8) {
        $Responsiveness = 5
    } else {
        $Responsiveness = 7
    }
}

# ------------------------------------------------
# APPLY REGISTRY VALUE
# ------------------------------------------------
Set-RegValueSafe `
"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Multimedia\SystemProfile" `
"SystemResponsiveness" `
$Responsiveness

Write-Host "[OK] SystemResponsiveness = $Responsiveness" -ForegroundColor Green
Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# ============================================================
# Set Desktop Wallpaper Style and Rendering Behavior
# ============================================================

Write-Host "[⚙] Setting wallpaper style to Fill..." -NoNewline

try {

    # ------------------------------------------------------------
    # Registry path for current user desktop wallpaper settings
    # This controls how Windows renders the wallpaper image
    # ------------------------------------------------------------
    $path = "HKCU:\Control Panel\Desktop"

    # Validate registry path exists (prevents silent failures)
    if (-not (Test-Path $path)) {
        throw "Desktop registry path not found."
    }

    # ------------------------------------------------------------
    # Retrieve current wallpaper path
    # This is required to reapply wallpaper after style change
    # (prevents black screen or blank desktop issues)
    # ------------------------------------------------------------
    $currentWallpaper = (Get-ItemProperty -Path $path -Name "Wallpaper" -ErrorAction Stop).Wallpaper

    # Ensure wallpaper path is valid before continuing
    if ([string]::IsNullOrWhiteSpace($currentWallpaper)) {
        throw "Wallpaper path not found. Cannot safely apply settings."
    }

    # ------------------------------------------------------------
    # Wallpaper rendering configuration
    # These values control how the image is displayed on screen
    # ------------------------------------------------------------

    # WallpaperStyle values:
    # 0  = Center (image stays centered at original size)
    # 2  = Stretch (forces image to fill screen, may distort)
    # 6  = Fit (scales image to fit screen while preserving ratio)
    # 10 = Fill (scales image to fully cover screen, may crop edges)
    #
    # TileWallpaper values:
    # 0 = Disabled (image is not repeated)
    # 1 = Enabled (image is tiled across the screen)
    # ------------------------------------------------------------

    Set-ItemProperty -Path $path -Name "WallpaperStyle" -Value "10" -Force
    Set-ItemProperty -Path $path -Name "TileWallpaper" -Value "0" -Force

    # ------------------------------------------------------------
    # Load Win32 API for instant wallpaper refresh
    # SystemParametersInfo forces Windows to apply changes immediately
    # without requiring logoff or restart
    # ------------------------------------------------------------
    if (-not ("WallpaperAPI" -as [type])) {
        Add-Type -TypeDefinition @"
using System;
using System.Runtime.InteropServices;

public class WallpaperAPI {
    [DllImport("user32.dll", CharSet = CharSet.Auto)]
    public static extern int SystemParametersInfo(
        int uAction,
        int uParam,
        string lpvParam,
        int fuWinIni
    );
}
"@
    }

    # ------------------------------------------------------------
    # WinAPI constants used to update desktop settings
    # ------------------------------------------------------------
    $SPI_SETDESKWALLPAPER = 0x0014
    $SPIF_UPDATEINIFILE   = 0x01
    $SPIF_SENDCHANGE      = 0x02

    # ------------------------------------------------------------
    # Apply wallpaper immediately using current image path
    # This refreshes the desktop with new rendering mode
    # ------------------------------------------------------------
    [WallpaperAPI]::SystemParametersInfo(
        $SPI_SETDESKWALLPAPER,
        0,
        $currentWallpaper,
        $SPIF_UPDATEINIFILE -bor $SPIF_SENDCHANGE
    ) | Out-Null

    Write-Host " OK (Fill mode applied)" -ForegroundColor Green
}
catch {

    # ------------------------------------------------------------
    # Error handling
    # Displays only the root exception message for clarity
    # ------------------------------------------------------------
    Write-Host " ERROR" -ForegroundColor Red
    Write-Host $_.Exception.Message -ForegroundColor DarkRed
}

Write-Host ""

##------------------------------------------------------##

# ============================================
# ENABLE CLASSIC WINDOWS PHOTO VIEWER
# ============================================

$ErrorActionPreference = "SilentlyContinue"

Write-Host "`n=== Enabling Classic Windows Photo Viewer ===" -ForegroundColor Cyan

$basePath = "HKLM:\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations"

# Ensure base path exists
New-Item -Path $basePath -Force | Out-Null

# File associations
$associations = @{
    ".bmp"  = "PhotoViewer.FileAssoc.BITMAP"
    ".dib"  = "PhotoViewer.FileAssoc.BITMAP"
    ".jpg"  = "PhotoViewer.FileAssoc.JPEG"
    ".jpe"  = "PhotoViewer.FileAssoc.JPEG"
    ".jpeg" = "PhotoViewer.FileAssoc.JPEG"
    ".jxr"  = "PhotoViewer.FileAssoc.JPEG"
    ".jfif" = "PhotoViewer.FileAssoc.JFIF"
    ".wdp"  = "PhotoViewer.FileAssoc.WDP"
    ".png"  = "PhotoViewer.FileAssoc.PNG"
    ".gif"  = "PhotoViewer.FileAssoc.TIFF"
    ".tiff" = "PhotoViewer.FileAssoc.TIFF"
    ".tif"  = "PhotoViewer.FileAssoc.TIFF"
}

foreach ($ext in $associations.Keys) {
    New-ItemProperty -Path $basePath -Name $ext -Value $associations[$ext] -PropertyType String -Force | Out-Null
}

Write-Host "File associations applied." -ForegroundColor Green

# Helper function to create registry class
function Create-PhotoViewerClass {
    param (
        [string]$class,
        [string]$icon,
        [string]$dllOffset
    )

    $root = "HKLM:\SOFTWARE\Classes\$class"

    New-Item -Path $root -Force | Out-Null
    New-ItemProperty -Path $root -Name "ImageOptionFlags" -Value 1 -PropertyType DWord -Force | Out-Null

    New-Item -Path "$root\DefaultIcon" -Force | Out-Null
    Set-ItemProperty -Path "$root\DefaultIcon" -Name "(default)" -Value $icon

    New-Item -Path "$root\shell\open\command" -Force | Out-Null
    Set-ItemProperty -Path "$root\shell\open\command" -Name "(default)" -Value `
        "`"%SystemRoot%\System32\rundll32.exe`" `"%SystemRoot%\System32\PhotoViewer.dll,$dllOffset`" `"%1`""
}

# Create main handlers
Create-PhotoViewerClass "PhotoViewer.FileAssoc.BITMAP" "%SystemRoot%\System32\imageres.dll,-70" "ImageView_Fullscreen"
Create-PhotoViewerClass "PhotoViewer.FileAssoc.JPEG"   "%SystemRoot%\System32\imageres.dll,-72" "ImageView_Fullscreen"
Create-PhotoViewerClass "PhotoViewer.FileAssoc.PNG"    "%SystemRoot%\System32\imageres.dll,-71" "ImageView_Fullscreen"

# JFIF special handling
$jfif = "HKLM:\SOFTWARE\Classes\PhotoViewer.FileAssoc.JFIF"
New-Item -Path $jfif -Force | Out-Null
New-ItemProperty -Path $jfif -Name "ImageOptionFlags" -Value 1 -PropertyType DWord -Force | Out-Null

Write-Host "Classic Photo Viewer enabled successfully." -ForegroundColor Green
Write-Host ""

##------------------------------------------------------##

# --- INTERACTIVE ONEDRIVE UNINSTALLATION ---
Write-Host "Do you want to COMPLETELY uninstall OneDrive? [Y/N] (Default: Y in 5s): " -NoNewline -ForegroundColor Yellow

$counterOD = 5
while ($counterOD -gt 0 -and (-not [console]::KeyAvailable)) {
    Write-Host "..$counterOD " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $counterOD--
}

# Capture user input or timeout
if ([console]::KeyAvailable) {
    $choiceOD = [console]::ReadKey($true).KeyChar
    Write-Host ""
} else {
    Write-Host "`nTimeout reached. Continuing with OneDrive removal..." -ForegroundColor Gray
    $choiceOD = "y"
}

if ($choiceOD -eq 'y' -or $choiceOD -eq 'Y') {

    Write-Host "-- Starting deep uninstallation of OneDrive..." -ForegroundColor Green

    $ProgressPreference = "SilentlyContinue"

    # Kill process
    Write-Host "-- Closing OneDrive process..." -ForegroundColor Gray
    Stop-Process -Name "OneDrive" -Force -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 2

    # Official uninstallers
    $uninstallerX86 = "$env:SystemRoot\System32\OneDriveSetup.exe"
    $uninstallerX64 = "$env:SystemRoot\SysWOW64\OneDriveSetup.exe"

    if (Test-Path $uninstallerX64) {

        Write-Host "-- Running official 64-bit uninstaller..." -ForegroundColor Gray
        Start-Process $uninstallerX64 -ArgumentList "/uninstall" -Wait

    } elseif (Test-Path $uninstallerX86) {

        Write-Host "-- Running official 32-bit uninstaller..." -ForegroundColor Gray
        Start-Process $uninstallerX86 -ArgumentList "/uninstall" -Wait
    }

    # Data migration
    Write-Host "-- Migrating OneDrive files..." -ForegroundColor Gray

    if (Test-Path "$env:USERPROFILE\OneDrive") {

        robocopy `
        "$env:USERPROFILE\OneDrive" `
        "$env:USERPROFILE" `
        /mov /e /xj /ndl /nfl /njh /njs /nc /ns /np | Out-Null
    }

    # Registry cleanup
    Write-Host "-- Cleaning Explorer integration..." -ForegroundColor Gray

    $oneDriveRegKeys = @(
        "HKCR:\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}",
        "HKCR:\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}",
        "HKCU:\Software\Microsoft\OneDrive"
    )

    foreach ($key in $oneDriveRegKeys) {
        Remove-Item $key -Recurse -Force -ErrorAction SilentlyContinue
    }

    # Anti reinstall
    Write-Host "-- Applying anti-reinstallation policies..." -ForegroundColor Gray

    $regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\OneDrive"

    if (!(Test-Path $regPath)) {
        New-Item -Path $regPath -Force | Out-Null
    }

    Set-ItemProperty $regPath "DisableFileSyncConfig" 1 -Type DWord
    Set-ItemProperty $regPath "PreventNetworkUserAccounts" 1 -Type DWord

    # Cleanup startup
    Write-Host "-- Removing shortcuts and startup entries..." -ForegroundColor Gray

    Remove-Item `
    "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk" `
    -Force -ErrorAction SilentlyContinue

    reg delete `
    "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" `
    /v "OneDriveSetup" /f 2>$null

    Get-ScheduledTask `
    -TaskName 'OneDrive*' `
    -ErrorAction SilentlyContinue |
    Unregister-ScheduledTask `
    -Confirm:$false `
    -ErrorAction SilentlyContinue

    # Remove leftovers
    Write-Host "-- Removing leftover folders..." -ForegroundColor Gray

    $folders = @(
        "$env:USERPROFILE\OneDrive",
        "$env:LOCALAPPDATA\OneDrive",
        "$env:LOCALAPPDATA\Microsoft\OneDrive",
        "$env:ProgramData\Microsoft OneDrive",
        "C:\OneDriveTemp"
    )

    foreach ($folder in $folders) {

        if (Test-Path $folder) {

            Remove-Item `
            $folder `
            -Recurse `
            -Force `
            -ErrorAction SilentlyContinue
        }
    }

    Write-Host "OneDrive removed and blocked successfully! ✅" -ForegroundColor Cyan

} else {

    Write-Host "Skipping OneDrive removal..." -ForegroundColor Yellow
}

Write-Host "--------------------------------------------------------"

# Clear keyboard buffer
while ([console]::KeyAvailable) {
    [console]::ReadKey($true) | Out-Null
}

##------------------------------------------------------##

# --- Optional Post-Install Scripts (5s Timeout) ---

# 1. StartAllBack Update Blocker
Write-Host "`n--- Optional Tool: StartAllBack Update Blocker ---" -ForegroundColor Cyan
Write-Host "Do you want to run the StartAllBack Update Blocker? [Y/N] (Default: N in 5s): " -NoNewline

# Initialize countdown timer and default answer
$counter = 5
$ans = "n" 

# Countdown loop: Checks for key presses every second
while ($counter -gt 0) {
    if ([console]::KeyAvailable) {
        # Capture the pressed key and stop the timer immediately
        $ans = [console]::ReadKey($true).KeyChar
        Write-Host " [$ans]" -ForegroundColor White
        break
    }
    Write-Host "..$counter " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $counter--
}

# BUFFER FLUSH: Clear any remaining keys from the keyboard buffer.
# This prevents the current input from accidentally skipping the NEXT 5s prompt.
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }

# Execute the external script if 'Y' was selected
if ($ans -eq 'y') {
    Write-Host "`nExecuting StartAllBack Blocker..." -ForegroundColor Green
    
    # Temporarily allow script execution for the current process
    Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force | Out-Null
    
    try {
        # Download and execute the script directly from GitHub
        iex (Invoke-RestMethod -Uri "https://raw.githubusercontent.com/TogoFire-Home/WorkstationTools/main/StartAllBack-Update-Blocker/Block-StartAllBack.ps1")
    } catch {
        # Error handling in case the URL is down or there is no internet connection
        Write-Host "Failed to execute script from GitHub. Please check your connection." -ForegroundColor Red
    }
} else {
    Write-Host "`nSkipping StartAllBack Blocker..." -ForegroundColor Gray
}

Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# ============================================
# SAFE APP DEBLOAT
# ============================================

$ProgressPreference = "SilentlyContinue"
$ErrorActionPreference = "SilentlyContinue"

# Detect OS type
$os = Get-CimInstance Win32_OperatingSystem
$isServer = ($os.ProductType -ne 1)

Write-Host "`n=== App Debloat ===" -ForegroundColor Cyan

if ($isServer) {
    Write-Host "Windows Server detected. Skipping AppX debloat..." -ForegroundColor Yellow
    Write-Host "Continuing to next script section..." -ForegroundColor Gray
}
else {

    Write-Host "-- Removing Third-Party Apps" -ForegroundColor Green

    $thirdPartyPatterns = @(
        "*DropboxOEM*","*BingSearch*","*RandomSaladGamesLLC*","*UserExperienceImprovementProgram*",
        "*McAfee*","ShazamEntertainmentLtd.Shazam","ClearChannelRadioDigital.iHeartRadio",
        "SpotifyAB.SpotifyMusic","*EclipseManager*","*ActiproSoftwareLLC*",
        "*AdobeSystemsIncorporated.AdobePhotoshopExpress*","*Duolingo-LearnLanguagesforFree*",
        "*PandoraMediaInc*","*CandyCrush*","*BubbleWitch3Saga*","*Wunderlist*",
        "*Flipboard*","*Twitter*","*Facebook*","*Royal Revolt*","*Sway*",
        "*Speed Test*","*Dolby*","*Viber*","*ACGMediaPlayer*","*Netflix*",
        "*OneCalendar*","*LinkedInForWindows*","*HiddenCityMysteryofShadows*",
        "*Hulu*","*HiddenCity*","*AdobePhotoshopExpress*"
    )

    foreach ($pattern in $thirdPartyPatterns) {
        $pkgs = Get-AppxPackage -AllUsers | Where-Object { $_.Name -like $pattern }

        foreach ($pkg in $pkgs) {
            try {
                Remove-AppxPackage -Package $pkg.PackageFullName -AllUsers -ErrorAction SilentlyContinue
                Write-Host "Removed: $($pkg.Name)" -ForegroundColor Yellow
            } catch {
                Write-Host "Failed: $($pkg.Name)" -ForegroundColor Red
            }
        }
    }

    Write-Host "`n-- Removing Microsoft Apps" -ForegroundColor Green

    $msApps = @(
        "Microsoft.ZuneMusic","Microsoft.Whiteboard","Microsoft.Office.Lens","Microsoft.News",
        "Microsoft.GetHelp","Microsoft.BingTravel","Microsoft.BingHealthAndFitness",
        "Microsoft.BingFoodAndDrink","Microsoft.BingTranslator","Microsoft.AppConnector",
        "MicrosoftCorporationII.MicrosoftFamily","*QuickAssist*","Microsoft.OutlookForWindows",
        "Clipchamp.Clipchamp","Microsoft.3DBuilder","Microsoft.Microsoft3DViewer",
        "Microsoft.BingWeather","Microsoft.BingSports","Microsoft.BingFinance",
        "Microsoft.MicrosoftOfficeHub","Microsoft.BingNews","Microsoft.Office.OneNote",
        "Microsoft.Office.Sway","Microsoft.WindowsPhone","Microsoft.CommsPhone",
        "Microsoft.YourPhone","Microsoft.Getstarted","Microsoft.549981C3F5F10",
        "Microsoft.Messaging","Microsoft.WindowsSoundRecorder","Microsoft.MixedReality.Portal",
        "Microsoft.WindowsFeedbackHub","Microsoft.WindowsAlarms","Microsoft.MSPaint",
        "Microsoft.WindowsMaps","Microsoft.MinecraftUWP","Microsoft.People",
        "Microsoft.Wallet","Microsoft.Print3D","Microsoft.OneConnect",
        "Microsoft.MicrosoftSolitaireCollection","Microsoft.MicrosoftStickyNotes",
        "microsoft.windowscommunicationsapps","Microsoft.SkypeApp","Microsoft.GroupMe10",
        "MSTeams","Microsoft.Todos","Microsoft.WindowsTerminal"
    )

    foreach ($app in $msApps) {
        $pkgs = Get-AppxPackage -AllUsers | Where-Object { $_.Name -like $app }

        foreach ($pkg in $pkgs) {
            try {
                Remove-AppxPackage -Package $pkg.PackageFullName -AllUsers -ErrorAction SilentlyContinue
                Write-Host "Removed: $($pkg.Name)" -ForegroundColor Yellow
            } catch {
                Write-Host "Failed: $($pkg.Name)" -ForegroundColor Red
            }
        }
    }

    Write-Host "`nCleanup completed successfully." -ForegroundColor Green
}

Write-Host ""

##------------------------------------------------------##

# --- REMOVE WINDOWS AI: FEATURE BREAKDOWN ---
# [DisableRegKeys]          -> Turns off Copilot, Recall logging, and typing data harvesting.
# [DisableCopilotPolicies]  -> Hard-disables AI features via Group Policy (SecPol).
# [RemoveAppxPackages]      -> Uninstalls Modern AI apps (UWP) and AI Fabric services.
# [RemoveRecallFeature]     -> Disables the Windows "Recall" screenshot-based timeline.
# [HideAIComponents]        -> Hides the "AI Components" page from Windows Settings.
# [DisableRewrite]          -> Disables the "AI Rewrite" feature in Notepad.
# [RemoveRecallTasks]       -> Forcibly deletes scheduled tasks used by the Recall engine.

Write-Host "--------------------------------------------------------" -ForegroundColor DarkGray
Write-Host "Launch RemoveWindowsAI (Safe Mode)? This will lobotomize system AI. [Y/N] (Auto-YES in 5s): " -NoNewline -ForegroundColor Red

# ------------------------------------------------
# AUTO CONFIRM TIMER
# ------------------------------------------------
$counterAI = 5

while ($counterAI -gt 0 -and (-not [console]::KeyAvailable)) {
    Write-Host "..$counterAI " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $counterAI--
}

if ([console]::KeyAvailable) {
    $choiceAI = [console]::ReadKey($true).KeyChar
    Write-Host ""
} else {
    Write-Host "`nAuto-confirm enabled." -ForegroundColor DarkGray
    $choiceAI = "y"
}

# ------------------------------------------------
# EXECUTE REMOVE WINDOWS AI
# ------------------------------------------------
if ($choiceAI -eq 'y' -or $choiceAI -eq 'Y') {

    Write-Host "[🚀] Downloading RemoveWindowsAI..." -ForegroundColor Cyan

    $aiScript = "$env:TEMP\RemoveWindowsAI.ps1"

    irm "https://raw.githubusercontent.com/zoicware/RemoveWindowsAI/main/RemoveWindowsAi.ps1" |
        Set-Content $aiScript

    # ------------------------------------------------
    # REMOVE ESET / AV WARNING + READKEY PAUSE
    # ------------------------------------------------
    (Get-Content $aiScript) |
    Where-Object {
        $_ -notmatch "Press Any Key to Continue" -and
        $_ -notmatch "ReadKey" -and
        $_ -notmatch "third-party anti-virus" -and
        $_ -notmatch "may falsely block/break this script"
    } |
    Set-Content $aiScript

    Write-Host "[⚡] Preparing AI cleanup..." -ForegroundColor Green

    # ------------------------------------------------
    # PARAMETER PARSING + NONINTERACTIVE
    # ------------------------------------------------
    $aiCommand = @'
& "$env:TEMP\RemoveWindowsAI.ps1" `
-NonInteractive `
-Options DisableRegKeys,DisableCopilotPolicies,RemoveAppxPackages,RemoveRecallFeature,HideAIComponents,DisableRewrite,RemoveRecallTasks
'@

    # ------------------------------------------------
    # POWERSHELL VERSION DETECTION
    # ------------------------------------------------
    if ($PSVersionTable.PSVersion.Major -ge 7) {

        Write-Host "[!] PowerShell 7 detected. Relaunching in Windows PowerShell 5.1..." -ForegroundColor Yellow

        Start-Process powershell.exe `
            -ArgumentList @(
                "-NoProfile",
                "-ExecutionPolicy", "Bypass",
                "-Command", $aiCommand
            ) `
            -Wait

    } else {

        Write-Host "[🚀] Executing RemoveWindowsAI under PowerShell 5.1..." -ForegroundColor Cyan

        powershell.exe `
            -NoProfile `
            -ExecutionPolicy Bypass `
            -Command $aiCommand
    }

    Write-Host "`n[✅] AI cleanup process completed successfully." -ForegroundColor Green

} else {

    Write-Host "-- Windows AI settings remained unchanged." -ForegroundColor Yellow
}

# ------------------------------------------------
# CLEAR KEYBOARD BUFFER
# ------------------------------------------------
while ([console]::KeyAvailable) {
    [console]::ReadKey($true) | Out-Null
}

Write-Host "--------------------------------------------------------" -ForegroundColor DarkGray

##------------------------------------------------------##

# --- INTERACTIVE MICROSOFT EDGE UNINSTALLATION ---
# Displays a yellow warning and waits for user confirmation (5-second timeout)
Write-Host "Do you want to UNINSTALL Microsoft Edge? [Y/N] (Default: N in 5s): " -NoNewline -ForegroundColor Yellow

$counterEdge = 5
while ($counterEdge -gt 0 -and (-not [console]::KeyAvailable)) {
    Write-Host "..$counterEdge " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $counterEdge--
}

# Capture user input or handle timeout
if ([console]::KeyAvailable) {
    $choiceEdge = [console]::ReadKey($true).KeyChar
    Write-Host ""
} else {
    Write-Host "`nTimeout reached. Skipping Edge uninstallation..." -ForegroundColor Gray
    $choiceEdge = "y"
}

if ($choiceEdge -eq 'y' -or $choiceEdge -eq 'Y') {
    Write-Host "-- Initializing Edge uninstallation..." -ForegroundColor Green

    # 1. Enable uninstallation flag in Registry to bypass system restrictions
    $regPath = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdateDev"
    if (-not (Test-Path $regPath)) { 
        New-Item -Path $regPath -Force | Out-Null 
    }
    Set-ItemProperty -Path $regPath -Name "AllowUninstall" -Value 1 -Type DWord -ErrorAction SilentlyContinue

    # 2. Locate the official Microsoft Edge setup installer
    $edgeApps = Get-ChildItem "C:\Program Files (x86)\Microsoft\Edge\Application\*\Installer\setup.exe" -ErrorAction SilentlyContinue
    
    if ($edgeApps) {
        $installerPath = $edgeApps[0].FullName
        
        # Create a placeholder file to prevent Windows Update from re-registering the legacy Edge app
        $legacyAppPath = "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"
        New-Item $legacyAppPath -Force -ErrorAction SilentlyContinue | Out-Null
        
        # Execute the uninstaller with force and profile deletion arguments
        Start-Process $installerPath -ArgumentList '--uninstall --system-level --force-uninstall --delete-profile' -Wait
        
        # 3. Cleanup residual shortcuts from common system locations
        $shortcutPaths = @(
            "$env:Public\Desktop\Microsoft Edge.lnk",
            "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk",
            "$env:AppData\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk",
            "$env:UserProfile\Desktop\Microsoft Edge.lnk"
        )
        
        foreach ($lnk in $shortcutPaths) {
            if (Test-Path $lnk) { 
                Remove-Item $lnk -Force -ErrorAction SilentlyContinue 
            }
        }
        
        Write-Host "Success: Microsoft Edge has been removed and shortcuts cleaned." -ForegroundColor Cyan
    } else {
        Write-Host "Error: Edge setup.exe not found. Skipping." -ForegroundColor Red
    }
}

Write-Host "--------------------------------------------------------"
Write-Host ""

# Clear buffer
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }

##------------------------------------------------------##

Write-Host "--- SYSTEM PURGE: REMOVING JUNKWARE & DIGITAL PARASITES ---" -ForegroundColor Red -BackgroundColor Black

# --- INPUT EXORCISM ---
function Clear-InputBuffer {
    while ([console]::KeyAvailable) {
        [console]::ReadKey($true) | Out-Null
    }
}

function Read-Key {
    return ([console]::ReadKey($true).KeyChar.ToString().ToLower())
}

function Ask-YesNo($msg, $yesMsg, $noMsg) {
    Clear-InputBuffer
    Write-Host $msg -NoNewline -ForegroundColor Yellow

    while ($true) {
        $k = Read-Key
        if ($k -match "[yn]") {
            Write-Host $k
            if ($k -eq "y") {
                if ($yesMsg) { Write-Host $yesMsg -ForegroundColor DarkGray }
            } else {
                if ($noMsg) { Write-Host $noMsg -ForegroundColor DarkGray }
            }
            return $k
        }
    }
}

do {
    Clear-InputBuffer

    Write-Host "`n================================================" -ForegroundColor Gray
    Write-Host "   🛡️ JUNKWARE PURGE: CHOOSE YOUR TARGET" -ForegroundColor Red
    Write-Host "================================================" -ForegroundColor Gray
    Write-Host " [1] McAfee Removal (MCPR)"
    Write-Host " [2] Kaspersky Removal (kavremvr)"
    Write-Host " [3] Norton Removal (Exorcism Tool)"
    Write-Host " [4] AVG Removal (Clear-Cut)"
    Write-Host " [5] Antivirus Removal Tool (Universal Cleaner)"
    Write-Host " [6] Defender Remover (⚠️ SYSTEM RISK)"
    Write-Host " [Q] Quit Menu"
    Write-Host "------------------------------------------------" -ForegroundColor Gray
    Write-Host "Select an option (Auto-Exit in 5s): " -NoNewline

    $menuChoice = $null
    $timer = 5

    while ($timer -gt 0) {
        if ([console]::KeyAvailable) {
            $menuChoice = Read-Key
            Write-Host "$menuChoice" -ForegroundColor Cyan
            break
        }
        Write-Host "..$timer " -NoNewline -ForegroundColor Gray
        Start-Sleep 1
        $timer--
    }

    if (-not $menuChoice) {
        Write-Host "`n[TIMEOUT] No selection made. Exiting menu..." -ForegroundColor DarkGray
        $menuChoice = "q"
    }

    switch ($menuChoice) {

        "1" {
            $c = Ask-YesNo "`nLaunch MCPR? McAfee is basically a virus you pay for. Kill it? [Y/N]: " `
                "-- You chose violence. McAfee won't survive this." `
                "-- Mercy granted. McAfee lives another cursed day."

            if ($c -eq "y") {
                $url = "https://download.mcafee.com/molbin/iss-loc/SupportTools/MCPR/MCPR.exe"
                $path = "$env:TEMP\MCPR.exe"
                Invoke-WebRequest $url -OutFile $path
                Write-Host "-- FATALITY! Executing MCPR..." -ForegroundColor Green
                Start-Process $path
            }
        }

        "2" {
            $c = Ask-YesNo "`nSend Kaspersky to the gulag? [Y/N]: " `
                "-- No trial. Straight to Siberia." `
                "-- Peace treaty signed. Kaspersky spared."

            if ($c -eq "y") {
                $url = "https://media.kaspersky.com/utilities/ConsumerUtilities/kavremvr.exe"
                $path = "$env:TEMP\kavremvr.exe"
                Invoke-WebRequest $url -OutFile $path
                Write-Host "-- Dasvidaniya!" -ForegroundColor Green
                Start-Process $path
            }
        }

        "3" {
            $c = Ask-YesNo "`nDestroy Norton? It has more popups than a phishing site. [Y/N]: " `
                "-- Initiating exorcism ritual... Fetching the Binary Banisher..." `
                "-- Norton keeps haunting your RAM. The ghost in the machine remains."

            if ($c -eq "y") {
                $url = "https://honzik.avcdn.net/setup/norton-suite/release/norton_360_remover.exe"
                $path = "$env:TEMP\norton.exe"
                Invoke-WebRequest $url -OutFile $path
                Write-Host "-- Burning Norton to the ground..." -ForegroundColor Green
                Write-Host "-- Norton eliminated." -ForegroundColor Green
                Write-Host "-- The Norton demon has been cast out! ✝️🔥" -ForegroundColor Green
                Write-Host "------------------- YOUR RAM IS FREE AT LAST -------------------" -ForegroundColor Gray
                Start-Process $path
            }
        }

        "4" {
            $c = Ask-YesNo "`nWipe AVG? Fake mustache Avast clone detected. [Y/N]: " `
                "-- Removing impostor... Fetching the AVG 'Clear-Cut' Machete..." `
                "-- AVG remains. Your RAM is crying in the corner."

            if ($c -eq "y") {
                $url = "https://honzik.avcdn.net/setup/avg-av/release/avg_av_clear.exe"
                $path = "$env:TEMP\avg.exe"
                Invoke-WebRequest $url -OutFile $path
                Write-Host "-- Clearing the trash... Goodbye, AVG!" -ForegroundColor Green
                Write-Host "-- AVG deleted from existence." -ForegroundColor Green
                Start-Process $path
            }
        }

        "5" {
            $c = Ask-YesNo "`nDeploy Antivirus Removal Tool? This will scan and remove leftover AV junk. [Y/N]: " `
                "-- Deploying the nuclear cleaner..." `
                "-- You spared the junk. It will remember that."

            if ($c -eq "y") {
                Write-Host "-- Contacting mothership..." -ForegroundColor Cyan

                $zip = "$env:TEMP\ART.zip"
                $dir = "$env:TEMP\ART"

                try {
                    $redirect = $null

                    # --- Redirect real ---
                    try {
                        $req = [System.Net.WebRequest]::Create("https://antivirus-removal-tool.com/download/click.php?id=Antivirus_Removal_Tool")
                        $req.AllowAutoRedirect = $true
                        $resp = $req.GetResponse()
                        $redirect = $resp.ResponseUri.AbsoluteUri
                        $resp.Close()
                    } catch {}

                    # --- Fallback scraping ---
                    if (-not $redirect -or $redirect -notmatch "\.zip") {
                        $page = Invoke-WebRequest "https://antivirus-removal-tool.com/download/"
                        if ($page.Content -match "files\/Antivirus_Removal_Tool_\d+_\d+\.zip") {
                            $redirect = "https://antivirus-removal-tool.com/" + $matches[0]
                        }
                    }

                    if (-not $redirect) {
                        throw "Payload still hiding."
                    }

                    Write-Host "-- Target acquired: $redirect" -ForegroundColor DarkGray

                    # --- DOWNLOAD WITH REAL PROGRESS ---
                    $request = [System.Net.HttpWebRequest]::Create($redirect)
                    $request.UserAgent = "Mozilla/5.0"
                    $response = $request.GetResponse()

                    $total = $response.ContentLength
                    $stream = $response.GetResponseStream()
                    $file = [System.IO.File]::OpenWrite($zip)

                    $buffer = New-Object byte[] 8192
                    $read = 0
                    $totalRead = 0

                    while (($read = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) {
                        $file.Write($buffer, 0, $read)
                        $totalRead += $read

                        if ($total -gt 0) {
                            $percent = [int](($totalRead / $total) * 100)
                            Write-Progress -Activity "Downloading Antivirus Removal Tool" `
                                -Status "$percent% Complete" `
                                -PercentComplete $percent
                        }
                    }

                    $file.Close()
                    $stream.Close()
                    $response.Close()

                    Write-Progress -Activity "Downloading Antivirus Removal Tool" -Completed

                    if (-not (Test-Path $zip) -or (Get-Item $zip).Length -lt 50000000) {
                        throw "Downloaded file is invalid or incomplete."
                    }

                    Expand-Archive $zip -DestinationPath $dir -Force

                    $exe = Get-ChildItem $dir -Recurse -Filter "*.exe" | Select-Object -First 1

                    if ($exe) {
                        Write-Host "-- Launching universal cleaner..." -ForegroundColor Green
                        Start-Process $exe.FullName
                    } else {
                        Write-Host "[ERROR] No executable found." -ForegroundColor Red
                    }

                } catch {
                    Write-Host "[ERROR] Failed to download Antivirus Removal Tool." -ForegroundColor Red
                }
            }
        }

        "6" {
            $c = Ask-YesNo "`n⚠️ WARNING: Defender Remover can BREAK Windows Update. Continue? [Y/N]: " `
                "-- You like living dangerously." `
                "-- Wise choice. System spared."

            if ($c -eq "y") {
                $api = "https://api.github.com/repos/ionuttbara/windows-defender-remover/releases/latest"
                $r = Invoke-WebRequest $api | ConvertFrom-Json
                $url = ($r.assets | Where-Object { $_.name -like "*.exe" })[0].browser_download_url
                $path = "$env:TEMP\defender.exe"
                Invoke-WebRequest $url -OutFile $path
                Start-Process $path
            }
        }

        "q" {
            Write-Host "`nExiting Junkware Menu..." -ForegroundColor Green
        }

        default {
            Write-Host "`nInvalid option, try again." -ForegroundColor Red
        }
    }

} while ($menuChoice -ne "q")

# Clear keyboard buffer
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }

Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host ""

##------------------------------------------------------##

<#
.SYNOPSIS
    Advanced Microsoft Defender SmartScreen Disabler (Audit & Force-Disable).
.DESCRIPTION
    Audits and disables SmartScreen for Explorer, Edge, and Microsoft Store Apps. 
    Includes PUA (Potentially Unwanted App) blocking removal.
#>

# --- VISUAL PRIVACY & UTILITY ALERT ---
Write-Host "************************************************************" -ForegroundColor Red
Write-Host "           SMARTSCREEN PRIVACY & UTILITY ALERT              " -ForegroundColor White -BackgroundColor Red
Write-Host "************************************************************" -ForegroundColor Red
Write-Host "1. FALSE POSITIVES: Flags safe tools and custom scripts"
Write-Host "   lacking expensive ($500/yr) EV Certificates."
Write-Host "2. PRIVACY DRAIN: Microsoft scans and logs every app and"
Write-Host "   file you run, sending metadata to their servers."
Write-Host "3. NAG-SCREEN CULTURE: Trains users to click 'Run Anyway'"
Write-Host "   without thinking, making the 'security' counterproductive."
Write-Host "4. PERFORMANCE OVERHEAD: Constant database checks against"
Write-Host "   every download and execution can lag file operations."
Write-Host "************************************************************`n" -ForegroundColor Red

Write-Host "--- Microsoft Defender SmartScreen Professional Audit ---" -ForegroundColor Cyan

function Set-RegistryOptimized {
    param (
        [string]$Path,
        [string]$Name,
        [parameter(Mandatory=$true)]$DisabledValue,
        [string]$Description,
        [string]$Type = "DWORD"
    )

    # Check if registry key exists; create if missing
    if (!(Test-Path $Path)) {
        Write-Host "[+] Creating missing registry path: $Path" -ForegroundColor Gray
        New-Item -Path $Path -Force | Out-Null
    }

    $currentValue = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue).$Name

    # Apply changes if the value differs from target or is missing
    if ($currentValue -ne $DisabledValue) {
        Write-Host "[!] $Description is ENABLED or missing. Disabling..." -ForegroundColor Yellow
        if ($Type -eq "DWORD") {
            Set-ItemProperty -Path $Path -Name $Name -Value ([int]$DisabledValue) -Type DWord -Force
        } else {
            Set-ItemProperty -Path $Path -Name $Name -Value $DisabledValue -Force
        }
    } else {
        Write-Host "[OK] $Description is already disabled." -ForegroundColor Green
    }
}

# 1. System-wide File Execution (Explorer)
Set-RegistryOptimized `
    -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" `
    -Name "SmartScreenEnabled" `
    -DisabledValue "Off" `
    -Type "String" `
    -Description "Explorer File/App Verification"

# 2. Potentially Unwanted App (PUA) Blocking
Set-RegistryOptimized `
    -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" `
    -Name "PUAProtection" `
    -DisabledValue 0 `
    -Description "Potentially Unwanted App (PUA) Filter"

# 3. Microsoft Edge Browser Protection
Set-RegistryOptimized `
    -Path "HKCU:\Software\Microsoft\Edge\SmartScreenEnabled" `
    -Name "Enabled" `
    -DisabledValue 0 `
    -Description "Edge SmartScreen Filter"

# 4. Microsoft Store App Content Evaluation (AppHost)
Set-RegistryOptimized `
    -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" `
    -Name "EnableWebContentEvaluation" `
    -DisabledValue 0 `
    -Description "Store App Content Evaluation"

# 5. Store App Override Prevention (Ensures 'Run Anyway' is never blocked)
Set-RegistryOptimized `
    -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost" `
    -Name "PreventOverride" `
    -DisabledValue 0 `
    -Description "Store App Override Policy"

# 6. Group Policy Overrides (Forces persistent state for all users)
Set-RegistryOptimized `
    -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" `
    -Name "EnableSmartScreen" `
    -DisabledValue 0 `
    -Description "Global System Policy Override"

Write-Host "`nAll SmartScreen telemetry and blocking mechanisms have been audited." -ForegroundColor White -BackgroundColor DarkGreen
Write-Host "REBOOT RECOMMENDED to clear active shell/browser hooks." -ForegroundColor Yellow

##------------------------------------------------------##

# --- Interactive Windows Defender Purge ---
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Write-Host "Nuke Windows Defender? (WARNING: Flying solo after this) [Y/N] (Auto-Skip in 5s): " -NoNewline -ForegroundColor Red

$counter = 5
while ($counter -gt 0 -and (-not [console]::KeyAvailable)) {
    Write-Host "..$counter " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $counter--
}

if ([console]::KeyAvailable) {
    $choice = [console]::ReadKey($true).KeyChar
    Write-Host ""
} else {
    Write-Host "`nDefender lives to nag another day." -ForegroundColor DarkGray
    $choice = "y"
}

if ($choice -eq 'y' -or $choice -eq 'Y') {
    # Fallback if PSScriptRoot is empty (when running code as a block/selection)
    $rootPath = if ([string]::IsNullOrEmpty($PSScriptRoot)) { Get-Location } else { $PSScriptRoot }
    $minSudoPath = Join-Path $rootPath "MinSudo.exe"

    # --- Defender Exclusion ---
    $defenderService = Get-Service -Name WinDefend -ErrorAction SilentlyContinue

    if ($defenderService) {
        try {
            Add-MpPreference -ExclusionPath $env:TEMP -Force -ErrorAction Stop
            Add-MpPreference -ExclusionPath $minSudoPath -Force -ErrorAction Stop
            Write-Host "[OK] Defender exclusions applied." -ForegroundColor Green
        } catch {
            $err = $_.Exception.Message

            if ($err -match "0x800106ba") {
                Write-Host "[INFO] Defender engine unavailable (0x800106ba). Skipping exclusions." -ForegroundColor Gray
            } else {
                Write-Host "[ERROR] $err" -ForegroundColor Red
            }
        }
    } else {
        Write-Host "[INFO] Defender not present or disabled. Skipping exclusions." -ForegroundColor Gray
    }

    # --- 1. Infrastructure Deployment ---
    # TrustedInstaller-level elevation is mandatory to write to Defender-protected registry hives.
    if (-not (Test-Path $minSudoPath)) {
        Write-Host "[MODULE] Elevation engine missing. Initiating multi-stage recovery..." -ForegroundColor Cyan
        try {
            $workingDir = if ([string]::IsNullOrEmpty($env:TEMP)) { "C:\Windows\Temp" } else { $env:TEMP }
            $tempZip = Join-Path $workingDir "NanaRun_Deploy.zip"
            $extractDir = Join-Path $workingDir "NanaRun_Work"
            $ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
            $downloaded = $false
            
            # STAGE A: Dynamic Scraping (Always attempt to resolve the latest bleeding-edge release first)
            Write-Host ">> Attempting to scrape latest release... " -ForegroundColor Yellow -NoNewline
            try {
                # Enforce modern TLS protocol to ensure compatibility with GitHub endpoints
                # (critical for stripped-down or legacy Windows environments)
                [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

                # Base repository endpoint and request headers
                # GitHub requires a valid User-Agent to avoid request rejection (HTTP 403)
                $repoUrl = "https://github.com/M2Team/NanaRun"
                $headers = @{ "User-Agent" = $ua }

                # Retrieve the releases page HTML
                # This mimics Scoop's lightweight "checkver" strategy (no API dependency)
                $html = Invoke-WebRequest -Uri "$repoUrl/releases" -Headers $headers -UseBasicParsing -ErrorAction Stop

                # Extract the latest version identifier from the release tag URL
                # Expected format: /releases/tag/1.0.92.0
                if ($html.Content -match "/releases/tag/([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)") {
                    $version = $matches[1]

                    # Construct a deterministic download URL based on known release naming convention
                    # This avoids unreliable asset scraping and ensures predictable resolution
                    $url = "https://github.com/M2Team/NanaRun/releases/download/$version/NanaRun_1.0_Preview3_$version.zip"

                    # Download the archive using Invoke-WebRequest (more reliable than curl in modified environments)
                    # Uses the same HTTP stack proven to work in other modules
                    Invoke-WebRequest -Uri $url -OutFile $tempZip -UserAgent "Mozilla/5.0" -ErrorAction Stop

                    # Validate download integrity via existence and minimum file size threshold
                    if ((Test-Path $tempZip) -and (Get-Item $tempZip).Length -gt 10000) {
                        $downloaded = $true
                        Write-Host "[OK: DYNAMIC BUILD $version]" -ForegroundColor Green
                    } else {
                        Write-Host "[INVALID FILE]" -ForegroundColor DarkYellow
                    }
                } else {
                    # Version pattern not found in HTML response (unexpected layout change or network issue)
                    Write-Host "[VERSION NOT FOUND]" -ForegroundColor DarkYellow
                }

            } catch {
                # Catch-all failure handler for network, parsing, or TLS-related errors
                Write-Host "[FAILED]" -ForegroundColor Red
            }

            # STAGE B: Stable Fallback Loop (If GitHub blocks scraping, we cycle through verified stable builds)
            if (-not $downloaded) {
                Write-Host "[FAILED]`n>> Entering stable version fallback loop... " -ForegroundColor Yellow
                $knownVersions = @("1.0.92.0", "1.0.91.0", "1.0.90.0")
                foreach ($ver in $knownVersions) {
                    $url = "https://github.com/M2Team/NanaRun/releases/download/$ver/NanaRun_1.0_Preview3_$ver.zip"
                    Write-Host "   Testing $ver... " -NoNewline -ForegroundColor Gray
                    & curl -L -H "User-Agent: $ua" -o "$tempZip" "$url" 2>$null
                    if ((Test-Path $tempZip) -and (Get-Item $tempZip).Length -gt 10000) {
                        $downloaded = $true
                        Write-Host "[OK: STABLE]" -ForegroundColor Green
                        break
                    } else { Write-Host "[SKIP]" -ForegroundColor DarkGray }
                }
            }

            if (-not $downloaded) { throw "All infrastructure routes failed. Verify network connectivity." }
            
            # Binary Extraction and Deployment
            Expand-Archive -Path $tempZip -DestinationPath $extractDir -Force
            $bin = Get-ChildItem -Path $extractDir -Recurse -Filter "MinSudo.exe" | Where-Object { $_.FullName -match "x64" } | Select-Object -First 1
            
            if ($bin) { 
                Copy-Item -Path $bin.FullName -Destination $minSudoPath -Force 
                Write-Host "[SUCCESS] Engine deployed to local workspace." -ForegroundColor Green
            } else { throw "MinSudo x64 binary not found in the archive." }

            # Temporary file cleanup
            Remove-Item $tempZip, $extractDir -Recurse -Force -ErrorAction SilentlyContinue
        } catch {
            Write-Host "[ERROR] Deployment failed: $($_.Exception.Message)" -ForegroundColor Red
            return
        }
    }

    Write-Host "[NUCLEAR LAUNCH] Injecting Registry payload to lobotomize Defender..." -ForegroundColor Magenta

    # --- 2. Nuclear Registry Payload (UTF-16LE / Mandatory Policy Injection) ---
    # Using HKLM enforcement to override Windows' managed service state.
    $regContent = @"
Windows Registry Editor Version 5.00

; --- Disable Mitigation ---
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsMitigation]
"UserPreference"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel]
"MitigationAuditOptions"=hex:00,00,00,00,00,00,20,22,00,00,00,00,00,00,00,20,00,00,00,00,00,00,00,00
"MitigationOptions"=hex:00,22,22,20,22,20,22,22,20,00,00,00,00,20,00,20,00,00,00,00,00,00,00,00
"KernelSEHOPEnabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SCMConfig]
"EnableSvchostMitigationPolicy"=hex(b):00,00,00,00,00,00,00,00

; --- Remove Defender's Tamper Protection & PPL ---
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features]
"MpPlatformKillbitsFromEngine"=hex:00,00,00,00,00,00,00,00
"TamperProtectionSource"=dword:00000000
"MpCapability"=hex:00,00,00,00,00,00,00,00
"TamperProtection"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]
"RunAsPPL"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"LsaConfigFlags"=dword:00000000
"RunAsPPL"=dword:00000000
"RunAsPPLBoot"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config]
"VulnerableDriverBlocklistEnable"=dword:00000000

; --- Disable Antivirus & Real-Time Protection ---
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableRoutinelyTakingAction"=dword:00000001
"ServiceKeepAlive"=dword:00000000
"AllowFastServiceStartup"=dword:00000000
"DisableLocalAdminMerge"=dword:00000001
"DisableAntiSpyware"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection]
"DisableIOAVProtection"=dword:00000001
"DisableRealtimeMonitoring"=dword:00000001
"DisableBehaviorMonitoring"=dword:00000001
"DisableOnAccessProtection"=dword:00000001
"DisableScanOnRealtimeEnable"=dword:00000001
"RealtimeScanDirection"=dword:00000002

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Defender\AllowBehaviorMonitoring]
"value"=dword:00000000

; --- Disable Security Center & Notifications ---
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\WindowsDefenderSecurityCenter\DisableNotifications]
"value"=dword:00000001

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

; --- Hide Defender from Windows Settings ---
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"SettingsPageVisibility"="hide:windowsdefender;"
"@

    try {
        # --- 3. Privileged Execution (TrustedInstaller Mode) ---
        $tempWorkingDir = if ([string]::IsNullOrEmpty($env:TEMP)) { "C:\Windows\Temp" } else { $env:TEMP }
        $tempReg = Join-Path $tempWorkingDir "nuke_payload.reg"
        $regContent | Out-File -FilePath $tempReg -Encoding Unicode -Force

        # Wrapper call using the elevation engine to import keys with absolute authority.
        $proc = Start-Process "$minSudoPath" -ArgumentList "--NoLogo --TrustedInstaller --Privileged reg.exe import `"$tempReg`"" -Wait -NoNewWindow -PassThru

        if ($proc.ExitCode -eq 0) {
            Write-Host "`n[💀] FATALITY! Defender has been lobotomized." -ForegroundColor Green
            Write-Host "[🥕] It is now officially a vegetable. Enjoy the silence!" -ForegroundColor Yellow
            Write-Host "[🔓] The shackles are off. Fly solo, you magnificent pilot!" -ForegroundColor Cyan
        } else {
            throw "Reg.exe failed with ExitCode $($proc.ExitCode)."
        }

        # --- 4. Post-Deployment Clean Sweep ---
        Remove-Item $tempReg -Force -ErrorAction SilentlyContinue

        # Self-destruct: Removing the elevation engine to leave the Desktop clean.
        if (Test-Path $minSudoPath) {
            Write-Host ">> Evaporating elevation engine from the workspace... " -ForegroundColor Gray -NoNewline
            Remove-Item $minSudoPath -Force -ErrorAction SilentlyContinue
            Write-Host "[DONE]" -ForegroundColor Green
        }
    }
    catch {
        Write-Host "[CRITICAL ERROR] Failed to lobotomize Defender: $($_.Exception.Message)" -ForegroundColor Red
    }
} else {
    Write-Host "-- Defender settings remained unchanged." -ForegroundColor Yellow
}

# Clear buffer for next potential commands
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }
Write-Host "`nPurge complete! ✅" -ForegroundColor Green
Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host ""

##------------------------------------------------------##

# --- TLS-CONNECTIVITY-RESTORE ---
# Purpose: Clean up and restore default TLS/SChannel settings to fix connection issues.
# Use Case: Restores compatibility for XML downloaders, NFe portals, and Certificate Auth.

Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host " [?] CONNECTION FIX CONFIRMATION" -ForegroundColor Cyan
Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host "Do you want to restore default TLS & SChannel settings?" -ForegroundColor White
Write-Host "Press 'Y' to proceed (Default: N in 5s): " -NoNewline

# --- Fail-safe Timer Logic ---
$counter = 5
$confirmation = 'n'

while ($counter -gt 0 -and (-not [console]::KeyAvailable)) {
    Write-Host "..$counter " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $counter--
}

if ([console]::KeyAvailable) {
    $confirmation = [console]::ReadKey($true).KeyChar
    Write-Host ""
} else {
    Write-Host "`nTimeout reached. Action cancelled." -ForegroundColor Gray
}

# --- MAIN EXECUTION BLOCK ---
# Using an IF block instead of 'return' ensures the rest of the .ps1 file continues to run.
if ($confirmation -eq 'y' -or $confirmation -eq 'Y') {
    Write-Host "`n [🚀] Restoring protocol defaults and fixing connectivity..." -ForegroundColor Green
    Write-Host "--------------------------------------------------------" -ForegroundColor Gray

    # --- Helper Functions ---
    function Remove-RegKey {
        param ([string]$Path, [string]$Name)
        if (Test-Path -Path $Path) {
            Remove-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue
            Write-Host "  [-] Cleaned: ${Path}\${Name}" -ForegroundColor Gray
        }
    }

    function Set-RegKey {
        param ([string]$Path, [string]$Name, [string]$Value)
        if (-not (Test-Path -Path $Path)) {
            New-Item -Path $Path -Force | Out-Null
        }
        Set-ItemProperty -Path $Path -Name $Name -Value $Value -ErrorAction SilentlyContinue
        Write-Host "  [+] Restored: ${Path}\${Name} = ${Value}" -ForegroundColor Yellow
    }

    function Disable-WindowsFeature {
        param ([string]$Name)
        Disable-WindowsOptionalFeature -Online -FeatureName $Name -ErrorAction SilentlyContinue -NoRestart | Out-Null
        Write-Host "  [!] Disabled: ${Name}" -ForegroundColor Red
    }

    function Enable-WindowsFeature {
        param ([string]$Name)
        Enable-WindowsOptionalFeature -Online -FeatureName $Name -ErrorAction SilentlyContinue -NoRestart | Out-Null
        Write-Host "  [*] Enabled: ${Name}" -ForegroundColor Green
    }

    # 1. Diffie-Hellman Key Exchange (Restoring Defaults)
    Write-Host "`n--- 1. Fixing: Diffie-Hellman (DH) Key Requirements" -ForegroundColor Cyan
    Remove-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman' -Name 'ServerMinKeyBitLength'
    Remove-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman' -Name 'ClientMinKeyBitLength'

    # 2. Insecure Ciphers Cleanup
    Write-Host "--- 2. Fixing: Legacy/Insecure Ciphers" -ForegroundColor Cyan
    $ciphers = @('RC2 40/128','RC2 56/128','RC2 128/128','RC4 128/128','RC4 64/128','RC4 56/128','RC4 40/128','DES 56/56','Triple DES 168','Triple DES 168/168','NULL')
    foreach ($cipher in $ciphers) {
        Remove-RegKey -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\$cipher" -Name 'Enabled'
    }

    # 3. Insecure Hashes (MD5, SHA-1)
    Write-Host "--- 3. Fixing: Weak Hashes" -ForegroundColor Cyan
    Remove-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\MD5' -Name 'Enabled'
    Remove-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes\SHA' -Name 'Enabled'

    # 4. SSL/TLS/DTLS Protocols (Cleaning Overrides)
    Write-Host "--- 4. Fixing: SChannel Protocol Overrides" -ForegroundColor Cyan
    $protocols = @('SSL 2.0','SSL 3.0','TLS 1.0','TLS 1.1','TLS 1.3','DTLS 1.0','DTLS 1.2')
    foreach ($proto in $protocols) {
        $subKeys = @('\Server','\Client')
        foreach ($sub in $subKeys) {
            $fullPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$proto$sub"
            Remove-RegKey -Path $fullPath -Name 'Enabled'
            Remove-RegKey -Path $fullPath -Name 'DisabledByDefault'
        }
    }

    # 5. Advanced SChannel & LSA Security Settings
    Write-Host "--- 5. Fixing: System Security Policies" -ForegroundColor Cyan
    Remove-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'LmCompatibilityLevel'
    $schannelSettings = @('AllowInsecureRenegoClients','AllowInsecureRenegoServers','DisableRenegoOnServer','DisableRenegoOnClient','UseScsvForTls')
    foreach ($setting in $schannelSettings) {
        Remove-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL' -Name $setting
    }
    Set-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'restrictanonymoussam' -Value 1
    Set-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name 'restrictnullsessaccess' -Value 1
    Set-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\LSA' -Name 'restrictanonymous' -Value 0

    # 6. .NET Framework Strong Crypto
    Write-Host "--- 6. Fixing: .NET Framework Strong Crypto Overrides" -ForegroundColor Cyan
    $netPaths = @(
        'HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727',
        'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319'
    )
    foreach ($netPath in $netPaths) {
        Remove-RegKey -Path $netPath -Name 'SchUseStrongCrypto'
        Remove-RegKey -Path $netPath -Name 'SystemDefaultTlsVersions'
    }

    # 7. Windows Features & Capabilities
    Write-Host "--- 7. Fixing: Windows Capabilities & Features" -ForegroundColor Cyan
    Disable-WindowsFeature -Name 'TelnetClient'
    Disable-WindowsFeature -Name 'TFTP'
    Set-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Remote Assistance' -Name 'fAllowToGetHelp' -Value 1
    Set-RegKey -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Remote Assistance' -Name 'fAllowFullControl' -Value 1
    Enable-WindowsFeature -Name 'WCF-TCP-PortSharing45'
    Enable-WindowsFeature -Name 'SmbDirect'

    Write-Host "`n [✅] CONNECTIVITY RESTORED SUCCESSFULLY" -ForegroundColor Green
} else {
    Write-Host " [!] Operation aborted. Skipping Connectivity Restore block..." -ForegroundColor Red
}

# Clear keyboard buffer
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }
Write-Host "----------------------------------------------------------------" -ForegroundColor Gray

##------------------------------------------------------##

<#
.SYNOPSIS
    Vanguard/Valorant Requirement Validator and Auto-Fixer.
.DESCRIPTION
    Checks for TPM 2.0, Secure Boot, IOMMU, and HVCI as required by Riot Vanguard.
    Also manages VGC service startup type.
#>

# --- INITIAL GATE: Run Verification? ---
Write-Host "--- Vanguard Official Requirements Check and Auto-fix ---" -ForegroundColor Cyan
Write-Host "Do you want to verify Valorant requirements? [Y/N] (Default: N in 5s): " -NoNewline

$timer = 5
while ($timer -gt 0 -and (-not [console]::KeyAvailable)) {
    Write-Host "..$timer " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $timer--
}

if ([console]::KeyAvailable) {
    $runCheck = [console]::ReadKey($true).KeyChar.ToString().ToLower()
    Write-Host ""
} else {
    Write-Host "`nTimeout reached. Skipping check..." -ForegroundColor Gray
    $runCheck = "y"
}

if ($runCheck -eq 'y') {
    Write-Host "`n--- Starting System Scan ---" -ForegroundColor Cyan

    # 1. Driver Signature Integrity
    $integrity = bcdedit | Select-String "nointegritychecks"
    Write-Host "Driver Signature Integrity: $(if ($integrity) { 'DISABLED ❌' } else { 'Enabled (OK) ✅' })"

    # 2. Test Signing Mode
    $testSigning = bcdedit | Select-String "testsigning Yes"
    Write-Host "Test Signing Mode: $(if ($testSigning) { 'ENABLED ❌' } else { 'Disabled (OK) ✅' })"

    # 3. TPM 2.0 Status
    $tpm = Get-Tpm
    Write-Host "TPM 2.0: $(if ($tpm.TpmPresent) { 'Present (OK) ✅' } else { 'Not Found ❌' })"

    # 4. Secure Boot Status
    $secureBoot = Confirm-SecureBootUEFI
    Write-Host "Secure Boot: $(if ($secureBoot) { 'Enabled (OK) ✅' } else { 'Disabled ❌' })"

    # 5. IOMMU / Virtualization Status (Direct Hardware Check)
    $iommuCheck = (Get-WmiObject Win32_Processor).VirtualizationFirmwareEnabled
    Write-Host "IOMMU / Virtualization: $(if ($iommuCheck) { 'Enabled (OK) ✅' } else { 'Disabled ⚠️ (Check BIOS)' })"

    # 6. Memory Integrity / HVCI Status
    $hvciPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity"
    $hvci = Get-ItemProperty -Path $hvciPath -Name "Enabled" -ErrorAction SilentlyContinue
    $hvciStatus = if ($hvci.Enabled -eq 1) { $true } else { $false }
    Write-Host "Core Isolation (HVCI): $(if ($hvciStatus) { 'Enabled (OK) ✅' } else { 'Disabled ❌' })"

    # 7. Vanguard Service (VGC) Status and Fix
    $vgc = Get-Service vgc -ErrorAction SilentlyContinue
    if ($null -eq $vgc) {
        Write-Host "VGC Service: Not Installed ❌" -ForegroundColor Red
        Write-Host " >> NOTE: After installing Valorant, remember to set the VGC service to Automatic mode." -ForegroundColor Yellow
    } else {
        $vgcMode = $vgc.StartType
        Write-Host "VGC Service: $($vgc.Status) ($vgcMode) $(if ($vgcMode -eq 'Automatic') { '✅' } else { '⚠️' })"
        
        if ($vgcMode -ne 'Automatic') {
            Write-Host " >> Adjusting VGC service to Automatic mode..." -ForegroundColor Cyan
            Set-Service vgc -StartupType Automatic
            Write-Host " >> VGC mode updated successfully. ✅" -ForegroundColor Green
        }
    }

# Cleanup and Exit
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }
Write-Host "`nProcess finished." -ForegroundColor Gray

    # --- AUTO-FIX GATE: Apply or Revert Kernel Fixes ---
    if (-not $hvciStatus) {
        Write-Host "`n[!] Critical: Memory Integrity (HVCI) is required for Vanguard." -ForegroundColor Yellow
        Write-Host "Enable HVCI/Virtualization? [Y] to Enable / [N] to Disable (Default: Y in 5s): " -NoNewline

        $fixTimer = 5
        while ($fixTimer -gt 0 -and (-not [console]::KeyAvailable)) {
            Write-Host "..$fixTimer " -NoNewline -ForegroundColor Gray
            Start-Sleep -Seconds 1
            $fixTimer--
        }

        if ([console]::KeyAvailable) {
            $ansFix = [console]::ReadKey($true).KeyChar.ToString().ToLower()
            Write-Host ""
        } else {
            Write-Host "`nTimeout reached. Proceeding with Auto-Fix (Default)..." -ForegroundColor Gray
            $ansFix = "n"
        }

        if ($ansFix -eq 'y') {
            # --- ENABLE SECTION (User pressed Y or Timeout) ---
            Write-Host "Applying kernel-level security fixes..." -ForegroundColor Green
            & dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart
            & bcdedit.exe /set hypervisorlaunchtype auto
            Set-ItemProperty -Path $hvciPath -Name "Enabled" -Value 1
            Write-Host "SUCCESS: Protection Enabled. PLEASE REBOOT." -ForegroundColor Cyan
        } else {
            # --- DISABLE SECTION (User explicitly pressed N) ---
            Write-Host "User opted to disable features. Reverting..." -ForegroundColor Red
            & dism.exe /online /disable-feature /featurename:VirtualMachinePlatform /norestart
            & bcdedit.exe /set hypervisorlaunchtype off
            Set-ItemProperty -Path $hvciPath -Name "Enabled" -Value 0 -ErrorAction SilentlyContinue
            Write-Host "SUCCESS: Protection Disabled. PLEASE REBOOT." -ForegroundColor Cyan
        }
    }
}

# Cleanup and Exit
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }
Write-Host "`nProcess finished." -ForegroundColor Gray

<#
.SYNOPSIS
    Valorant BSOD Fixer - KERNEL_SECURITY_CHECK_FAILURE (0x139)
.DESCRIPTION
    Wipes Vanguard drivers/services and disables Hypervisor features.
#>

# --- PRE-REQUISITE WARNING ---
Write-Host "************************************************************" -ForegroundColor Red
Write-Host "                CRITICAL PRE-REQUISITE                      " -ForegroundColor Red
Write-Host "************************************************************" -ForegroundColor White
Write-Host "First, you MUST boot into Safe Mode or use WinPE." -ForegroundColor Yellow
Write-Host ""
Write-Host "Option A: Reboot Windows into Safe Mode with Networking."
Write-Host "Option B: Using Sergei Strelec / WinPE (Open CMD):"
Write-Host "   1. mountvol S: /s" -ForegroundColor Cyan
Write-Host "   2. bcdedit /store S:\EFI\Microsoft\Boot\BCD /set {default} safeboot network" -ForegroundColor Cyan
Write-Host "   3. Reboot your PC."
Write-Host "************************************************************`n" -ForegroundColor Red

# --- INITIAL GATE: Run Fix? ---
Write-Host "--- Valorant BSOD Fixer: KERNEL_SECURITY_CHECK_FAILURE (0x139) ---" -ForegroundColor Cyan
Write-Host "Are you currently in Safe Mode/WinPE and want to proceed? [Y/N] (Default: N in 5s): " -NoNewline

$timer = 5
while ($timer -gt 0 -and (-not [console]::KeyAvailable)) {
    Write-Host "..$timer " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $timer--
}

if ([console]::KeyAvailable) {
    $runFix = [console]::ReadKey($true).KeyChar.ToString().ToLower()
    Write-Host ""
} else {
    Write-Host "`nTimeout reached. Skipping fix..." -ForegroundColor Gray
    $runFix = "n"
}

if ($runFix -eq 'y') {
    Write-Host "`n--- Starting Emergency Cleanup ---" -ForegroundColor Yellow

    # 1. Stop and Delete Vanguard Services
    Write-Host "[1/5] Removing Vanguard services..." -ForegroundColor Cyan
    & sc.exe stop vgc | Out-Null
    & sc.exe delete vgc | Out-Null
    & sc.exe stop vgk | Out-Null
    & sc.exe delete vgk | Out-Null

    # 2. Path Definitions
    $driverPath = "C:\Windows\System32\drivers\vgk.sys"
    $vanguardFolder = "C:\Program Files\Riot Vanguard"

    # 3. Force Remove vgk.sys Driver
    if (Test-Path $driverPath) {
        Write-Host "[2/5] Attempting to delete vgk.sys..." -ForegroundColor Cyan
        try {
            # Take ownership to bypass "Access Denied"
            & takeown /f $driverPath /a
            & icacls $driverPath /grant administrators:F
            Remove-Item -Path $driverPath -Force
            Write-Host ">> vgk.sys removed successfully!" -ForegroundColor Green
        } catch {
            Write-Host ">> Error: Failed to delete vgk.sys. It might be locked." -ForegroundColor Red
        }
    } else {
        Write-Host "[2/5] vgk.sys not found (already clean)." -ForegroundColor Gray
    }

    # 4. Remove Vanguard Program Folder
    if (Test-Path $vanguardFolder) {
        Write-Host "[3/5] Removing Riot Vanguard folder..." -ForegroundColor Cyan
        Remove-Item -Path $vanguardFolder -Recurse -Force
        Write-Host ">> Folder removed!" -ForegroundColor Green
    }

    # 5. Disable Hypervisor/HVCI
    Write-Host "[4/5] Disabling Virtualization Platform..." -ForegroundColor Cyan
    & dism.exe /online /disable-feature /featurename:VirtualMachinePlatform /norestart

    Write-Host "[5/5] Disabling Hypervisor & HVCI at boot..." -ForegroundColor Cyan
    # Using HKLM directly - Note: If in WinPE, you might need to load the registry hive manually.
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Enabled" -Value 0
    & bcdedit.exe /set hypervisorlaunchtype off

    Write-Host "`nCleanup completed! REBOOT into Normal Mode now." -ForegroundColor White -BackgroundColor DarkGreen
}

# Cleanup and Exit
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }
Write-Host "`nProcess finished." -ForegroundColor Gray

##------------------------------------------------------##

<# 
[MODULE] EXPLORER & UI OPTIMIZATION (Windows 11+)
Description: Enhances Windows Explorer performance and aesthetics by managing Snap Layouts, 
             Quick Access behavior, and cleaning system telemetry/junk.
Compatibility: Windows 11 (Build 22000+) or higher.
#>

# Verify if the current operating system is Windows 11
$winVersion = [Environment]::OSVersion.Version
if ($winVersion.Major -ge 10 -and $winVersion.Build -ge 22000) {
    Write-Host "`n[MODULE] Optimizing Windows Explorer UI (Windows 11 Detected)..." -ForegroundColor Cyan
    Write-Host "----------------------------------------------------------------" -ForegroundColor Gray

    # 1. Enable Snap Layouts (Snap Assist Flyout)
    # Ensures the Snap Layouts menu appears when hovering over the window maximize button.
    Write-Host "-- Enabling Snap Layouts..." -ForegroundColor Gray
    $registryPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
    if (!(Test-Path $registryPath)) { New-Item -Path $registryPath -Force | Out-Null }
    Set-ItemProperty -Path $registryPath -Name "EnableSnapAssistFlyout" -Value 1 -Type DWord

    # 2. Disable Automatic Frequent Folders & Recent Files
    # Forces Quick Access to display exclusively manually pinned folders for a cleaner experience.
    Write-Host "-- Configuring Quick Access to show ONLY manual pins..." -ForegroundColor Gray
    $explorerPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer"
    Set-ItemProperty -Path $explorerPath -Name "ShowFrequent" -Value 0 -Type DWord
    Set-ItemProperty -Path $explorerPath -Name "ShowRecent" -Value 0 -Type DWord

    # 3. Clean Quick Access Cache (Interactive Maintenance)
    # Targets the 'f01b4d95...' database to resolve Explorer lag or hangs.
    # Note: Deleting this file will reset all user-pinned folders to defaults.
    $qaCache = "$env:APPDATA\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms"
    if (Test-Path $qaCache) {
        $msgTitle = "Quick Access Maintenance"
        $msgText = "Do you want to reset Quick Access cache?`n`nThis is a specific fix for Explorer hangs/lag, but it will REMOVE all your pinned folders.`n`n(Auto-skipping in 5 seconds...)"
        
        # Deploy a WScript.Shell Popup with a 5-second timeout (Value 4 = Yes/No, 32 = Question Mark)
        $shell = New-Object -ComObject WScript.Shell
        $response = $shell.Popup($msgText, 5, $msgTitle, 4 + 32)

        if ($response -eq 6) { # User clicked 'Yes'
            Write-Host "-- Cleaning Quick Access cache..." -ForegroundColor Yellow
            Remove-Item $qaCache -Force -ErrorAction SilentlyContinue
            Write-Host "[OK] Quick Access reset successfully." -ForegroundColor Green
        } else {
            Write-Host "[SKIP] Quick Access cache preserved (User choice or Timeout)." -ForegroundColor Yellow
        }
    }

    # 4. Clean Jump Lists & App History (Retention: 3 Days)
    # Scans Automatic and Custom Destinations to remove stale history entries.
    # Logic: Specifically excludes the Quick Access pinned database from this bulk deletion.
    Write-Host "-- Cleaning Jump Lists and History (Keeping Manual Pins)..." -ForegroundColor Gray
    $recentPaths = @(
        "$env:APPDATA\Microsoft\Windows\Recent\AutomaticDestinations",
        "$env:APPDATA\Microsoft\Windows\Recent\CustomDestinations"
    )
    foreach ($p in $recentPaths) {
        if (Test-Path $p) {
            Get-ChildItem -Path $p -File -Recurse -Force | 
            Where-Object { 
                $_.LastWriteTime -lt (Get-Date).AddDays(-3) -and 
                $_.Name -ne "f01b4d95cf55d32a.automaticDestinations-ms" 
            } | 
            ForEach-Object { Remove-Item $_.FullName -Force -ErrorAction SilentlyContinue }
        }
    }

    # 5. Empty Recycle Bin (Silent)
    # Permanently removes deleted items from the Recycle Bin on all drives.
    # This action is silent and does not require user confirmation.
    Write-Host "-- Emptying Recycle Bin..." -ForegroundColor Gray
    Clear-RecycleBin -Force -ErrorAction SilentlyContinue

    # 6. Refresh Interface Processes (Light Shell Refresh)
    # Terminates non-critical shell components to apply registry changes without a full Explorer restart.
    Write-Host "-- Refreshing Shell Components..." -ForegroundColor Yellow
    $uiProcesses = @("SearchHost", "ShellExperienceHost", "StartMenuExperienceHost")
    foreach ($proc in $uiProcesses) {
        Get-Process -Name $proc -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
    }

    Write-Host "`n[SUCCESS] UI Optimization completed! ✅" -ForegroundColor Green
    Write-Host "----------------------------------------------------------------" -ForegroundColor Gray
} else {
    Write-Host "`n[SKIP] UI Optimization: System is not Windows 11. ⏩" -ForegroundColor Yellow
}

##------------------------------------------------------##

# --- Custom System & Folder Management ---
Write-Host "`n[MODULE] Running System Maintenance & Cleanup..." -ForegroundColor Cyan
Write-Host "--------------------------------------------------------" -ForegroundColor Gray

# 1. Rename XTools to Tools (Start Menu)
$xLitePath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\X-Lite Tools"
$toolsPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tools"

if (Test-Path $xLitePath) {
    Write-Host "-- Found 'XTools'. Renaming to 'Tools'..." -ForegroundColor Gray
    try {
        Rename-Item -Path $xLitePath -NewName "Tools" -Force -ErrorAction Stop
        Write-Host "[OK] Folder renamed to Tools." -ForegroundColor Green
    } catch {
        Write-Host "[ERROR] Could not rename folder: $($_.Exception.Message)" -ForegroundColor Red
    }
} else {
    Write-Host "[SKIP] 'XTools' not found or already renamed." -ForegroundColor Yellow
}

# 2. REMOVE SPECIFIC DIRECTORIES (CLEANUP)
$phoenixFolders = @(
    "C:\ProgramData\PhoenixOS\WinaeroTweaker",
    "C:\ProgramData\PhoenixOS\Search",
    "C:\ProgramData\PhoenixOS\0ptional\Windows X-Lite Info",
    "C:\ProgramData\PhoenixOS\0ptional\Fix Xbox Sign In",
    "C:\ProgramData\PhoenixOS\0ptional\Web Browser Installers",
    "C:\Program Files\Tools\Config",
    "C:\Program Files\Tools\AudioMod"
)

Write-Host "-- Running Directory Cleanup Phase..." -ForegroundColor Cyan

foreach ($folder in $phoenixFolders) {
    if (Test-Path $folder) {
        # Extracts only the folder name for a cleaner log
        $folderName = Split-Path $folder -Leaf
        
        # Modern visual feedback: Action... STATUS
        Write-Host " [🧹] CLEANING: $($folderName)... " -NoNewline -ForegroundColor Gray
        
        try {
            # Recurse and Force to ensure nested files are deleted
            Remove-Item -Path $folder -Recurse -Force -ErrorAction Stop
            Write-Host "DONE" -ForegroundColor Green
        }
        catch {
            # If the folder is in use or locked
            Write-Host "FAILED" -ForegroundColor Red
        }
    }
}
Write-Host ""

# 3. Remove Start Menu Shortcuts (The specific .lnk files)
$shortcutsToRemove = @(
    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tools\Search.lnk",
    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tools\Winaero Tweaker.lnk",
    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Time.lnk",
    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AppsTools\WAU Manager.lnk",
    "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AppsTools\7tsp GUI.lnk"

)

foreach ($shortcut in $shortcutsToRemove) {
    if (Test-Path $shortcut) {
        Write-Host "-- Removing Start Menu shortcut: $(Split-Path $shortcut -Leaf)" -ForegroundColor Gray
        Remove-Item -Path $shortcut -Force -ErrorAction SilentlyContinue
        Write-Host "[OK] Shortcut deleted." -ForegroundColor Green
    } else {
        # Double check without extension just in case
        $altPath = $shortcut.Replace(".lnk", "")
        if (Test-Path $altPath) {
            Remove-Item -Path $altPath -Force -ErrorAction SilentlyContinue
            Write-Host "[OK] Shortcut deleted (alt)." -ForegroundColor Green
        } else {
            Write-Host "[SKIP] Shortcut not found: $(Split-Path $shortcut -Leaf)" -ForegroundColor Yellow
        }
    }
}

# 4. Remove Desktop Shortcut (Extras + Info)
$desktopLnk = "$env:USERPROFILE\Desktop\Extras + Info.lnk"
if (Test-Path $desktopLnk) {
    Write-Host "-- Removing Desktop shortcut: 'Extras + Info'..." -ForegroundColor Gray
    Remove-Item -Path $desktopLnk -Force
    Write-Host "[OK] Desktop shortcut deleted." -ForegroundColor Green
}

# 5. Move Compactor Shortcut to Tools Folder
$compactorSource = "$env:USERPROFILE\Desktop\Compactor (System Drive).lnk"
if (Test-Path $compactorSource) {
    if (Test-Path $toolsPath) {
        Write-Host "-- Moving 'Compactor' shortcut to Tools folder..." -ForegroundColor Gray
        Move-Item -Path $compactorSource -Destination $toolsPath -Force -ErrorAction SilentlyContinue
        Write-Host "[OK] Compactor shortcut moved successfully." -ForegroundColor Green
    } else {
        Write-Host "[ERROR] Destination Tools folder not found. Shortcut stays on Desktop." -ForegroundColor Red
    }
} else {
    Write-Host "[SKIP] Compactor shortcut not found on Desktop." -ForegroundColor Yellow
}

# 6. Rename Drive C: to "Windows"
$driveC = Get-CimInstance -ClassName Win32_Volume -Filter "DriveLetter = 'C:'"
if ($driveC) {
    if ($driveC.Label -ne "Windows") {
        Write-Host "-- Changing Drive C: label to 'Windows'..." -ForegroundColor Gray
        Set-CimInstance -InputObject $driveC -Property @{Label = "Windows"}
        Write-Host "[OK] Drive renamed." -ForegroundColor Green
    } else {
        Write-Host "[SKIP] Drive C: is already named 'Windows'." -ForegroundColor Green
    }
}

# --- 7. MATHTYPE VERSION CHECK & CLEANUP ---
$mathTypeDir = "C:\Program Files (x86)\MathType"
$mathTypeExe = "$mathTypeDir\MathType.exe"
$mathTypeSetup = "$mathTypeDir\Setup.exe"

# List of broken versions to be removed
$brokenVersions = @("7.11.1.462", "7.10.1.458", "7.9.1.454", "7.8.2.441", "7.8.0.0")

Write-Host "-- Checking MathType Installation Status..." -ForegroundColor Cyan

if (Test-Path $mathTypeExe) {
    $currentVersion = (Get-Item $mathTypeExe).VersionInfo.ProductVersion
    Write-Host " [🎬] MathType Found: $currentVersion" -ForegroundColor Gray

    # Check if the current version is in our "blacklist"
    if ($brokenVersions -contains $currentVersion) {
        Write-Host " [!] Broken version detected ($currentVersion). Starting uninstallation..." -ForegroundColor Yellow
        
        if (Test-Path $mathTypeSetup) {
            Write-Host " [🧹] Running Official Silent Uninstall... " -NoNewline -ForegroundColor Gray
            
            try {
                # Official Uninstall Command (-Q -R)
                $cmd = "`"$mathTypeSetup`" -Q -R"
                cmd.exe /c $cmd
                
                # Wait for the uninstaller to finish background tasks
                Start-Sleep -Seconds 5

                # Final Cleanup: Remove the directory if it still exists
                if (Test-Path $mathTypeDir) {
                    Write-Host "Cleaning residuals... " -NoNewline -ForegroundColor Gray
                    Remove-Item -Path $mathTypeDir -Recurse -Force -ErrorAction SilentlyContinue
                    Write-Host "DONE " -NoNewline -ForegroundColor Green
                }

                # Final Verification
                if (-not (Test-Path $mathTypeExe)) {
                    Write-Host "[OK]" -ForegroundColor Green
                } else {
                    Write-Host "FAILED (Files still present)" -ForegroundColor Red
                }
            } catch {
                Write-Host "FAILED (Execution error)" -ForegroundColor Red
            }
        } else {
            Write-Host " [!] Setup.exe not found at: $mathTypeSetup" -ForegroundColor Red
        }
    } else {
        Write-Host " [✅] Version $currentVersion is stable. Skipping removal." -ForegroundColor Green
    }
} else {
    Write-Host " [SKIP] MathType is not installed." -ForegroundColor Gray
}

Write-Host "--------------------------------------------------------"
Write-Host "[SUCCESS] Maintenance Module Completed! ✅" -ForegroundColor Cyan
Write-Host "--------------------------------------------------------"

# --- 8. OFFICE TIMELINE VERSION CHECK & CLEANUP ---

Write-Host "`n[MODULE] Office Timeline Detection & Cleanup..." -ForegroundColor Cyan

# ------------------------------------------------------------
# PATHS
# ------------------------------------------------------------
$installDir1 = "C:\Program Files (x86)\Office Timeline\Current"
$installDir2 = "$env:LOCALAPPDATA\Office Timeline\Current"

$dllPath = Join-Path $installDir1 "Otl.Addin.dll"

# Versions to REMOVE
$badVersions = @(
    "8.05.00.00",
    "8.5",
    "12.5",
    "13.32.00.00"
)

# ------------------------------------------------------------
# GET VERSION FROM REGISTRY
# ------------------------------------------------------------
function Get-OfficeTimelineVersion {
    $paths = @(
        "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
        "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
    )

    foreach ($path in $paths) {
        $apps = Get-ItemProperty $path -ErrorAction SilentlyContinue | Where-Object {
            $_.DisplayName -like "*Office Timeline*"
        }

        foreach ($app in $apps) {
            return @{
                Version = $app.DisplayVersion
                UninstallString = $app.UninstallString
            }
        }
    }

    return $null
}

# ------------------------------------------------------------
# DETECTION
# ------------------------------------------------------------
Write-Host ">> Checking Office Timeline installation..." -ForegroundColor Yellow

$detectedVersion = $null
$uninstallCmd = $null
$detected = $false

# --- REGISTRY ---
$regData = Get-OfficeTimelineVersion

if ($regData) {
    $detectedVersion = $regData.Version
    $uninstallCmd    = $regData.UninstallString
    $detected = $true

    Write-Host "   [REGISTRY DETECT] Version: $detectedVersion" -ForegroundColor Green
}

# --- DLL FALLBACK ---
if (-not $detected -and (Test-Path $dllPath)) {
    try {
        $fileVersion = (Get-Item $dllPath).VersionInfo.ProductVersion

        if ($fileVersion -match "([\d\.]+)") {
            $detectedVersion = $matches[1]
            $detected = $true

            Write-Host "   [DLL DETECT] Version: $detectedVersion" -ForegroundColor DarkCyan
        }
    } catch {
        Write-Host "   [DLL DETECT FAILED]" -ForegroundColor DarkYellow
    }
}

# ------------------------------------------------------------
# MAIN LOGIC
# ------------------------------------------------------------
if (-not $detected) {

    Write-Host "   [NOT INSTALLED]" -ForegroundColor Gray

} else {

    # ------------------------------------------------------------
    # VERSION MATCH
    # ------------------------------------------------------------
    function Is-BadVersion {
        param ($version, $badList)

        foreach ($bad in $badList) {
            if ($version -eq $bad -or $version.StartsWith("$bad.")) {
                return $true
            }
        }
        return $false
    }

    if (-not (Is-BadVersion -version $detectedVersion -badList $badVersions)) {

        Write-Host ">> Version $detectedVersion is allowed. Skipping removal." -ForegroundColor Green

    } else {

        Write-Host ">> Blacklisted version detected: $detectedVersion" -ForegroundColor Yellow

        # ------------------------------------------------------------
        # UNINSTALL (PRIMARY)
        # ------------------------------------------------------------
        $success = $false

        if ($uninstallCmd) {
            Write-Host ">> Running official uninstall... " -ForegroundColor Yellow -NoNewline

            try {
                $cmd = $uninstallCmd

                if ($cmd -match "msiexec" -and $cmd -notmatch "/quiet") {
                    $cmd += " /quiet /norestart"
                }

                cmd.exe /c $cmd
                Start-Sleep -Seconds 5

                $success = $true
                Write-Host "[OK]" -ForegroundColor Green
            } catch {
                Write-Host "[FAILED]" -ForegroundColor Red
            }
        }

        # ------------------------------------------------------------
        # FALLBACK: MSI STUB
        # ------------------------------------------------------------
        if (-not $success -and (Test-Path "$installDir1\MsiExecStub.exe")) {
            Write-Host ">> Running local MSI stub uninstall... " -ForegroundColor Yellow -NoNewline

            try {
                Start-Process "$installDir1\MsiExecStub.exe" -ArgumentList "/quiet" -Wait
                $success = $true
                Write-Host "[OK]" -ForegroundColor Green
            } catch {
                Write-Host "[FAILED]" -ForegroundColor Red
            }
        }

        # ------------------------------------------------------------
        # CLEANUP
        # ------------------------------------------------------------
        Write-Host ">> Cleaning residual files... " -ForegroundColor Yellow -NoNewline

        try {
            if (Test-Path $installDir1) {
                Remove-Item $installDir1 -Recurse -Force -ErrorAction SilentlyContinue
            }

            if (Test-Path $installDir2) {
                Remove-Item $installDir2 -Recurse -Force -ErrorAction SilentlyContinue
            }

            Write-Host "[DONE]" -ForegroundColor Green
        } catch {
            Write-Host "[PARTIAL]" -ForegroundColor DarkYellow
        }

        # ------------------------------------------------------------
        # FINAL STATUS
        # ------------------------------------------------------------
        if (-not (Test-Path $installDir1)) {
            Write-Host "`n[SUCCESS] Office Timeline removed successfully." -ForegroundColor Cyan
        } else {
            Write-Host "`n[WARNING] Some files may still remain." -ForegroundColor Yellow
        }
    }
}

Write-Host "--------------------------------------------------------"

# --- 9. CCLEANER + ADVANCED SYSTEMCARE CLEANUP MODULE ---
# ============================================================
# CCLEANER + ADVANCED SYSTEMCARE CLEANUP MODULE
# ============================================================

Write-Host "`n========================================================" -ForegroundColor DarkGray
Write-Host "  CCLEANER & ADVANCED SYSTEMCARE CLEANUP MODULE" -ForegroundColor Cyan
Write-Host "========================================================" -ForegroundColor DarkGray

$ErrorActionPreference = "SilentlyContinue"

# ============================================================
# REGISTRY PATHS
# ============================================================

$registryPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

# ============================================================
# AUTO YES / OK CLICK LOOP
# ============================================================

Write-Host "`n[🤖] Starting automatic confirmation loop..." -ForegroundColor Cyan

Add-Type @"
using System;
using System.Runtime.InteropServices;

public class Win32 {
    [DllImport("user32.dll")]
    public static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam);

    [DllImport("user32.dll")]
    public static extern int GetWindowText(IntPtr hWnd, System.Text.StringBuilder text, int count);

    [DllImport("user32.dll")]
    public static extern bool IsWindowVisible(IntPtr hWnd);

    [DllImport("user32.dll")]
    public static extern bool EnumChildWindows(IntPtr hwnd, EnumWindowsProc func, IntPtr lParam);

    [DllImport("user32.dll")]
    public static extern int GetClassName(IntPtr hWnd, System.Text.StringBuilder text, int count);

    [DllImport("user32.dll")]
    public static extern bool SendMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam);

    public delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam);

    public const uint BM_CLICK = 0x00F5;
}
"@

$autoConfirmJob = Start-Job -ScriptBlock {

Add-Type @"
using System;
using System.Runtime.InteropServices;

public class Win32 {
    [DllImport("user32.dll")]
    public static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam);

    [DllImport("user32.dll")]
    public static extern int GetWindowText(IntPtr hWnd, System.Text.StringBuilder text, int count);

    [DllImport("user32.dll")]
    public static extern bool IsWindowVisible(IntPtr hWnd);

    [DllImport("user32.dll")]
    public static extern bool EnumChildWindows(IntPtr hwnd, EnumWindowsProc func, IntPtr lParam);

    [DllImport("user32.dll")]
    public static extern int GetClassName(IntPtr hWnd, System.Text.StringBuilder text, int count);

    [DllImport("user32.dll")]
    public static extern bool SendMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam);

    public delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam);

    public const uint BM_CLICK = 0x00F5;
}
"@

while ($true) {

    try {

        [Win32]::EnumWindows({

            param($hWnd, $lParam)

            if (-not [Win32]::IsWindowVisible($hWnd)) {
                return $true
            }

            $title = New-Object System.Text.StringBuilder 260
            [Win32]::GetWindowText($hWnd, $title, $title.Capacity) | Out-Null

            $windowTitle = $title.ToString()

            $targets = @(
                "CCleaner",
                "Advanced SystemCare"
            )

            $matched = $false

            foreach ($t in $targets) {

                if ($windowTitle -like "*$t*") {
                    $matched = $true
                    break
                }
            }

            if ($matched) {

                [Win32]::EnumChildWindows($hWnd, {

                    param($child, $lp)

                    $class = New-Object System.Text.StringBuilder 100
                    [Win32]::GetClassName($child, $class, $class.Capacity) | Out-Null

                    $text = New-Object System.Text.StringBuilder 260
                    [Win32]::GetWindowText($child, $text, $text.Capacity) | Out-Null

                    $btnText = $text.ToString().Trim()

                    # ====================================================
                    # AUTO CLICK:
                    # SIM / YES / OK
                    # ====================================================

                    if (
                        $class.ToString() -eq "Button" -and
                        (
                            $btnText -eq "Sim"      -or
                            $btnText -eq "&Sim"     -or
                            $btnText -eq "Yes"      -or
                            $btnText -eq "&Yes"     -or
                            $btnText -eq "OK"       -or
                            $btnText -eq "&OK"
                        )
                    ) {

                        [Win32]::SendMessage(
                            $child,
                            [Win32]::BM_CLICK,
                            [IntPtr]::Zero,
                            [IntPtr]::Zero
                        ) | Out-Null
                    }

                    return $true

                }, [IntPtr]::Zero) | Out-Null
            }

            return $true

        }, [IntPtr]::Zero) | Out-Null

    } catch {

    }

    Start-Sleep -Milliseconds 300
}
}

# ============================================================
# SAFE PROCESS TERMINATION
# ============================================================

Write-Host "`n[🛑] Stopping related processes..." -ForegroundColor Yellow

$safeProcesses = @(
    "CCleaner",
    "CCleaner64",
    "CCUpdate",
    "CCleanerBrowser",

    "ASC",
    "ASCTray",
    "ASCService",
    "ASCDownload",
    "ASCUpgrade",
    "AutoCare",
    "AutoSweep"
)

foreach ($proc in $safeProcesses) {

    try {

        Get-Process -Name $proc -ErrorAction SilentlyContinue | ForEach-Object {

            Write-Host " [KILL] $($_.ProcessName)" -ForegroundColor DarkGray

            Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue
        }

    } catch {

    }
}

# ============================================================
# FUNCTION : REMOVE APPLICATION
# ============================================================

function Remove-AppAdvanced {

    param(
        [string]$AppName,
        [string[]]$ExactNames,
        [string[]]$PathsToDelete,
        [string[]]$ExtraExecutables
    )

    Write-Host "`n--------------------------------------------------------" -ForegroundColor DarkGray
    Write-Host "[🔍] Searching for $AppName..." -ForegroundColor Cyan

    $found = $false
    $removed = $false

    # ========================================================
    # REGISTRY DETECTION
    # ========================================================

    $apps = Get-ItemProperty $registryPaths | Where-Object {

        $display = $_.DisplayName

        if (-not $display) {
            return $false
        }

        foreach ($name in $ExactNames) {

            if ($display -like "*$name*") {
                return $true
            }
        }

        return $false
    }

    foreach ($app in $apps) {

        $found = $true

        Write-Host " [✔] Found: $($app.DisplayName)" -ForegroundColor Yellow

        $uninstall = $app.UninstallString

        if ($uninstall) {

            Write-Host " [⚙] Running official uninstall..." -ForegroundColor Gray

            try {

                # ====================================================
                # MSI
                # ====================================================

                if ($uninstall -match "msiexec") {

                    $guid = ([regex]"\{.*?\}").Matches($uninstall).Value

                    if ($guid) {

                        Start-Process `
                            "msiexec.exe" `
                            -ArgumentList "/x $guid /qn /norestart" `
                            -Wait `
                            -WindowStyle Hidden
                    }
                }

                # ====================================================
                # NORMAL UNINSTALL
                # ====================================================

                else {

                    Start-Process `
                        "cmd.exe" `
                        -ArgumentList "/c $uninstall" `
                        -Wait `
                        -WindowStyle Hidden
                }

                $removed = $true

                Write-Host " [OK] Uninstall completed." -ForegroundColor Green
            }
            catch {

                Write-Host " [FAILED] Uninstall execution failed." -ForegroundColor Red
            }
        }
    }

    # ========================================================
    # FALLBACK UNINSTALLERS
    # ========================================================

    foreach ($exe in $ExtraExecutables) {

        if (Test-Path $exe) {

            $found = $true

            Write-Host " [⚙] Running fallback uninstaller..." -ForegroundColor DarkYellow
            Write-Host "      $exe" -ForegroundColor Gray

            try {

                Start-Process `
                    $exe `
                    -ArgumentList "/VERYSILENT","/SUPPRESSMSGBOXES","/NORESTART" `
                    -Wait `
                    -WindowStyle Hidden

                $removed = $true

                Write-Host " [OK] Fallback uninstall executed." -ForegroundColor Green
            }
            catch {

                Write-Host " [FAILED] Fallback uninstall failed." -ForegroundColor Red
            }
        }
    }

    # ========================================================
    # CLEANUP
    # ========================================================

    Write-Host " [🧹] Cleaning residual files..." -ForegroundColor Yellow

    foreach ($path in $PathsToDelete) {

        if (Test-Path $path) {

            try {

                Remove-Item `
                    $path `
                    -Recurse `
                    -Force `
                    -ErrorAction SilentlyContinue

                Write-Host "      Removed: $path" -ForegroundColor DarkGray
            }
            catch {

                Write-Host "      Failed: $path" -ForegroundColor DarkYellow
            }
        }
    }

    # ========================================================
    # FINAL STATUS
    # ========================================================

    if (-not $found) {

        Write-Host " [SKIP] $AppName not detected." -ForegroundColor Gray
    }
    elseif ($removed) {

        Write-Host " [✅] $AppName removed successfully." -ForegroundColor Green
    }
    else {

        Write-Host " [⚠] $AppName detected but removal may be partial." -ForegroundColor Yellow
    }
}

# ============================================================
# CCLEANER REMOVAL
# ============================================================

Remove-AppAdvanced `
    -AppName "CCleaner" `
    -ExactNames @(
        "CCleaner"
    ) `
    -PathsToDelete @(
        "C:\Program Files\CCleaner",
        "C:\Program Files (x86)\CCleaner",
        "$env:ProgramData\CCleaner",
        "$env:AppData\CCleaner",
        "$env:LocalAppData\CCleaner"
    ) `
    -ExtraExecutables @(
        "C:\Program Files\CCleaner\unins000.exe",
        "C:\Program Files\CCleaner\uninst.exe",
        "C:\Program Files (x86)\CCleaner\unins000.exe",
        "C:\Program Files (x86)\CCleaner\uninst.exe"
    )

# ============================================================
# ADVANCED SYSTEMCARE REMOVAL
# ============================================================

Remove-AppAdvanced `
    -AppName "Advanced SystemCare" `
    -ExactNames @(
        "Advanced SystemCare"
    ) `
    -PathsToDelete @(
        "C:\Program Files (x86)\IObit\Advanced SystemCare",
        "C:\Program Files\IObit\Advanced SystemCare",
        "$env:ProgramData\IObit\Advanced SystemCare",
        "$env:AppData\IObit\Advanced SystemCare",
        "$env:LocalAppData\IObit\Advanced SystemCare"
    ) `
    -ExtraExecutables @(
        "C:\Program Files (x86)\IObit\Advanced SystemCare\unins000.exe",
        "C:\Program Files\IObit\Advanced SystemCare\unins000.exe"
    )

# ============================================================
# SERVICE CLEANUP
# ============================================================

Write-Host "`n[🧹] Cleaning remaining services..." -ForegroundColor Yellow

$services = @(
    "ASCService",
    "CCleanerPerformanceOptimizerService",
    "CCleaner Update"
)

foreach ($svc in $services) {

    try {

        $serviceObj = Get-Service $svc -ErrorAction SilentlyContinue

        if ($serviceObj) {

            Stop-Service $svc -Force -ErrorAction SilentlyContinue

            sc.exe delete $svc | Out-Null

            Write-Host " [OK] Removed service: $svc" -ForegroundColor Green
        }

    } catch {

    }
}

# ============================================================
# STOP AUTO CONFIRM LOOP
# ============================================================

Write-Host "`n[🛑] Stopping auto-confirm loop..." -ForegroundColor Yellow

try {

    Stop-Job $autoConfirmJob | Out-Null
    Remove-Job $autoConfirmJob | Out-Null

} catch {

}

# ============================================================
# FINAL STATUS
# ============================================================

Write-Host "`n========================================================" -ForegroundColor DarkGray
Write-Host " [SUCCESS] Cleanup Module Completed! ✅" -ForegroundColor Cyan
Write-Host "========================================================" -ForegroundColor DarkGray

# --- 10. REMOVE CLASSIC NOTEPAD ---
# ============================================
# REMOVE CLASSIC NOTEPAD + LEGACY REGISTRY
# ============================================

$ErrorActionPreference = "SilentlyContinue"

Write-Host "`n=== Removing Classic Notepad Components ===" -ForegroundColor Cyan

# --------------------------------------------
# 1. Detect protected Windows Notepad
# --------------------------------------------

$systemNotepad = "$env:WINDIR\notepad.exe"

if (Test-Path $systemNotepad) {
    Write-Host "System Notepad detected:" -ForegroundColor Yellow
    Write-Host $systemNotepad -ForegroundColor Gray
    Write-Host "Skipping removal (Windows protected component)." -ForegroundColor DarkYellow
} else {
    Write-Host "System notepad.exe not found." -ForegroundColor Gray
}

# --------------------------------------------
# 2. Remove Winaero Classic Notepad
# --------------------------------------------

$classicPaths = @(
    "$env:ProgramFiles\notepad",
    "${env:ProgramFiles(x86)}\notepad"
)

foreach ($path in $classicPaths) {

    if (Test-Path $path) {

        Write-Host "`nRemoving Classic Notepad:" -ForegroundColor Yellow
        Write-Host $path -ForegroundColor Gray

        try {
            Remove-Item $path -Recurse -Force
            Write-Host "Classic Notepad removed successfully." -ForegroundColor Green
        }
        catch {
            Write-Host "Failed to remove: $path" -ForegroundColor Red
        }

    } else {

        Write-Host "`nClassic Notepad folder not found:" -ForegroundColor Gray
        Write-Host $path -ForegroundColor DarkGray
    }
}

# --------------------------------------------
# 3. Remove legacy open command registry
# --------------------------------------------

$regPath = "Registry::HKEY_CLASSES_ROOT\txtfilelegacy\shell\open"

if (Test-Path $regPath) {

    Write-Host "`nRemoving legacy Notepad registry..." -ForegroundColor Yellow

    Remove-Item -Path $regPath -Recurse -Force

    Write-Host "Registry key removed successfully." -ForegroundColor Green

} else {

    Write-Host "`nLegacy registry key already removed." -ForegroundColor Gray
}

# --------------------------------------------
# 4. Reset .txt file association
# --------------------------------------------

Write-Host "`nResetting .txt association..." -ForegroundColor Cyan

$txtKey = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\UserChoice"

if (Test-Path $txtKey) {

    Remove-Item -Path $txtKey -Recurse -Force

    Write-Host ".txt association reset successfully." -ForegroundColor Green

} else {

    Write-Host "No custom .txt association found." -ForegroundColor Gray
}

Write-Host "`nClassic Notepad cleanup completed." -ForegroundColor Green
Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# ============================================================
# AYUGRAM DEPLOYMENT
# ============================================================

Write-Host "[MODULE] Deploying AyuGram via dynamic GitHub resolution..." -ForegroundColor Cyan

# Ensure TLS 1.2 compatibility
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# ------------------------------------------------------------
# PATHS
# ------------------------------------------------------------
$tempZip        = "$env:TEMP\AyuGram.zip"
$installDir     = "C:\Program Files\AyuGram"
$exePath        = "$installDir\AyuGram.exe"
$versionMarker  = "$installDir\version.txt"
$shortcutPath   = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AyuGram.lnk"

$ua = "Mozilla/5.0"
$skipInstall = $false

try {
    # ------------------------------------------------------------
    # DETECT WINDOWS SERVER ENVIRONMENT
    # ------------------------------------------------------------
    Write-Host ">> Checking operating system type... " -ForegroundColor Yellow -NoNewline

    $os = Get-CimInstance Win32_OperatingSystem
    $isServer = ($os.ProductType -ne 1)

    if ($isServer) {
        Write-Host "[SERVER DETECTED - SKIPPING INSTALL]" -ForegroundColor DarkYellow
        $skipInstall = $true
    } else {
        Write-Host "[WORKSTATION]" -ForegroundColor Green
    }

    # ------------------------------------------------------------
    # FETCH LATEST VERSION FROM GITHUB
    # ------------------------------------------------------------
    if (-not $skipInstall) {

        Write-Host ">> Resolving latest version... " -ForegroundColor Yellow -NoNewline

        $repoUrl = "https://github.com/AyuGram/AyuGramDesktop"
        $headers = @{ "User-Agent" = $ua }

        $html = Invoke-WebRequest -Uri "$repoUrl/releases" -Headers $headers -UseBasicParsing -ErrorAction Stop

        if ($html.Content -match "/releases/tag/(?:v|V)?([\d\.]+)") {
            $latestVersionStr = $matches[1]
            $latestVersion    = [version]$latestVersionStr

            Write-Host "[OK: v$latestVersionStr]" -ForegroundColor Green
        } else {
            Write-Host "[VERSION NOT FOUND]" -ForegroundColor Red
            $skipInstall = $true
        }
    }

    # ------------------------------------------------------------
    # DETECT CURRENT INSTALLED VERSION (REAL FIRST, FALLBACK SECOND)
    # ------------------------------------------------------------
    if (-not $skipInstall) {

        Write-Host ">> Detecting installed version..." -ForegroundColor Yellow

        $currentVersion = [version]"0.0.0.0"
        $detected = $false

        # --- PRIMARY: Detect from EXE metadata ---
        if (Test-Path $exePath) {
            try {
                $fileVersion = (Get-Item $exePath).VersionInfo.ProductVersion

                if ($fileVersion -match "([\d\.]+)") {
                    $currentVersion = [version]$matches[1]
                    $detected = $true

                    Write-Host "   [EXE DETECT] Version: $currentVersion" -ForegroundColor Green
                }
            } catch {
                Write-Host "   [EXE DETECT FAILED]" -ForegroundColor DarkYellow
            }
        }

        # --- FALLBACK: version.txt ---
        if (-not $detected -and (Test-Path $versionMarker)) {
            try {
                $content = (Get-Content $versionMarker -Raw).Trim()

                if ($content -match "([\d\.]+)") {
                    $currentVersion = [version]$matches[1]
                    $detected = $true

                    Write-Host "   [FALLBACK TXT] Version: $currentVersion" -ForegroundColor DarkCyan
                }
            } catch {
                Write-Host "   [TXT READ FAILED]" -ForegroundColor DarkYellow
            }
        }

        if (-not $detected) {
            Write-Host "   [NO INSTALL DETECTED]" -ForegroundColor DarkGray
        }

        # ------------------------------------------------------------
        # VERSION COMPARISON
        # ------------------------------------------------------------
        if ($latestVersion -le $currentVersion) {
            Write-Host ">> Status: [ALREADY UP TO DATE]" -ForegroundColor Green
            $skipInstall = $true
        }
    }

    # ------------------------------------------------------------
    # INSTALL ONLY IF NEEDED
    # ------------------------------------------------------------
    if (-not $skipInstall) {

        Write-Host ">> Status: [UPDATE REQUIRED]" -ForegroundColor Cyan

        # ------------------------------------------------------------
        # BUILD DOWNLOAD URL
        # ------------------------------------------------------------
        $url = "https://github.com/AyuGram/AyuGramDesktop/releases/download/v$latestVersionStr/AyuGram.zip"

        # ------------------------------------------------------------
        # DOWNLOAD
        # ------------------------------------------------------------
        Write-Host ">> Downloading package... " -ForegroundColor Yellow -NoNewline
        Invoke-WebRequest -Uri $url -OutFile $tempZip -UserAgent $ua -ErrorAction Stop
        Write-Host "[OK]" -ForegroundColor Green

        # ------------------------------------------------------------
        # EXTRACTION
        # ------------------------------------------------------------
        Write-Host ">> Extracting to Program Files... " -ForegroundColor Yellow -NoNewline

        if (Test-Path $installDir) {
            Remove-Item $installDir -Recurse -Force -ErrorAction SilentlyContinue
        }

        Expand-Archive -Path $tempZip -DestinationPath $installDir -Force
        Write-Host "[OK]" -ForegroundColor Green

        # ------------------------------------------------------------
        # SHORTCUT CREATION
        # ------------------------------------------------------------
        Write-Host ">> Creating Start Menu shortcut... " -ForegroundColor Yellow -NoNewline

        if (Test-Path $exePath) {
            $WshShell = New-Object -ComObject WScript.Shell
            $shortcut = $WshShell.CreateShortcut($shortcutPath)

            $shortcut.TargetPath = $exePath
            $shortcut.WorkingDirectory = $installDir
            $shortcut.Save()

            Write-Host "[OK]" -ForegroundColor Green
        } else {
            Write-Host "[EXECUTABLE NOT FOUND]" -ForegroundColor Red
        }

        # ------------------------------------------------------------
        # SAVE VERSION MARKER
        # ------------------------------------------------------------
        if (-not (Test-Path $installDir)) {
            New-Item -Path $installDir -ItemType Directory -Force | Out-Null
        }

        Set-Content -Path $versionMarker -Value $latestVersionStr -Force
        Write-Host ">> Version marker updated to: $latestVersionStr" -ForegroundColor Gray

        # ------------------------------------------------------------
        # CLEANUP
        # ------------------------------------------------------------
        if (Test-Path $tempZip) {
            Remove-Item $tempZip -Force -ErrorAction SilentlyContinue
        }
    }

} catch {
    Write-Host "[ERROR] $($_.Exception.Message)" -ForegroundColor Red
}

##------------------------------------------------------##

<#
    [MODULE] CONTEXT MENU ENGINE & SYSTEM CORE TWEAKS
#>

Write-Host "`n[INIT] Launching Context Menu & System Core Module..." -ForegroundColor Cyan
Write-Host "--------------------------------------------------------" -ForegroundColor Gray

##------------------------------------------------------##

# --- Legacy Context Menu Cleanup Module ---
Write-Host "`n[MODULE] Checking for legacy CMD and PowerShell context menu entries..." -ForegroundColor Cyan

$keysToRemove = @(
    # CMD Menu Entries
    "HKEY_CLASSES_ROOT\Directory\shell\01MenuCmd",
    "HKEY_CLASSES_ROOT\Directory\background\shell\01MenuCmd",
    "HKEY_CLASSES_ROOT\Directory\ContextMenus\MenuCmd",

    # PowerShell Menu Entries
    "HKEY_CLASSES_ROOT\Directory\shell\02MenuPowerShell",
    "HKEY_CLASSES_ROOT\Directory\background\shell\02MenuPowerShell",
    "HKEY_CLASSES_ROOT\Directory\ContextMenus\MenuPowerShell"
)

$removedCount = 0
$skippedCount = 0

foreach ($key in $keysToRemove) {
    $regPath = "Registry::$key"
    
    if (Test-Path $regPath) {
        try {
            Remove-Item -Path $regPath -Recurse -Force -ErrorAction Stop
            Write-Host "[SUCCESS] Removed: $key" -ForegroundColor Green
            $removedCount++
        }
        catch {
            Write-Host "[ERROR] Could not remove $key : $($_.Exception.Message)" -ForegroundColor Red
        }
    }
    else {
        # Silent skip or low-profile log
        Write-Host "[SKIP] Entry not present: $($key.Split('\')[-1])" -ForegroundColor Gray
        $skippedCount++
    }
}

Write-Host "`nCleanup Summary:" -ForegroundColor White
Write-Host ">> Entries Removed: $removedCount" -ForegroundColor Green
Write-Host ">> Entries Skipped: $skippedCount" -ForegroundColor Yellow
Write-Host "--------------------------------------------------------"

##------------------------------------------------------##

# --- Context Menu: Shell Extensions (Multi-Language & Shift-only) ---
Write-Host "`n[MODULE] Deploying Shell Context Menu Extensions (Shift-only)..." -ForegroundColor Cyan

# Detect system language (ISO 2-letter code)
$langID = (Get-Culture).TwoLetterISOLanguageName

# Multi-language dictionary for all 22 requested languages
$translations = @{
    "en" = @{ copy = "All rights reserved."; open = "Open here"; admin = "Open here as administrator" }
    "pt" = @{ copy = "Todos os direitos reservados."; open = "Abrir aqui"; admin = "Abrir aqui como administrador" }
    "es" = @{ copy = "Todos los derechos reservados."; open = "Abrir aquí"; admin = "Abrir aquí como administrador" }
    "de" = @{ copy = "Alle Rechte vorbehalten."; open = "Hier öffnen"; admin = "Hier als Administrator öffnen" }
    "nl" = @{ copy = "Alle rechten voorbehouden."; open = "Hier openen"; admin = "Hier openen als administrator" }
    "fr" = @{ copy = "Tous droits réservés."; open = "Ouvrir ici"; admin = "Ouvrir ici en tant qu'administrateur" }
    "it" = @{ copy = "Tutti i diritti riservati."; open = "Apri qui"; admin = "Apri qui come amministratore" }
    "ja" = @{ copy = "All rights reserved."; open = "ここで開く"; admin = "管理者としてここで開く" }
    "ko" = @{ copy = "모든 권리 보유."; open = "여기에서 열기"; admin = "관리자 권한으로 여기에서 열기" }
    "zh" = @{ copy = "版权所有。"; open = "在此处打开"; admin = "在此处以管理员身份打开" }
    "uk" = @{ copy = "Усі права захищені."; open = "Відкрити тут"; admin = "Відкрити тут від імені адміністратора" }
    "ru" = @{ copy = "Все права защищены."; open = "Открыть здесь"; admin = "Открыть здесь от имени администратора" }
    "bg" = @{ copy = "Всички права запазени."; open = "Отвори тук"; admin = "Отвори тук като администратор" }
    "hi" = @{ copy = "सर्वाधिकार सुरक्षित।"; open = "यहाँ खोलें"; admin = "प्रशासक के रूप में यहाँ खोलें" }
    "tr" = @{ copy = "Tüm hakları saklıdır."; open = "Burada aç"; admin = "Burada yönetici olarak aç" }
    "vi" = @{ copy = "Giữ toàn quyền bản quyền."; open = "Mở ở đây"; admin = "Mở ở đây với tư cách quản trị viên" }
    "th" = @{ copy = "สงวนลิขสิทธิ์."; open = "เปิดที่นี่"; admin = "เปิดที่นี่ในฐานะผู้ดูแลระบบ" }
    "id" = @{ copy = "Hak cipta dilindungi."; open = "Buka di sini"; admin = "Buka di sini sebagai administrator" }
    "ms" = @{ copy = "Hak cipta terpelihara."; open = "Buka di sini"; admin = "Buka di sini sebagai pentadbir" }
    "fi" = @{ copy = "Kaikki oikeudet pidätetään."; open = "Avaa tässä"; admin = "Avaa tässä järjestelmänvalvojana" }
    "he" = @{ copy = "כל הזכויות שמורות."; open = "פתח כאן"; admin = "פתח כאן כמנהל מערכת" }
    "el" = @{ copy = "Με επιφύλαξη παντός δικαιώματος."; open = "Άνοιγμα εδώ"; admin = "Άνοιγμα εδώ ως διαχειριστής" }
}

# Fallback to English if the language is not in the dictionary
$langSet = if ($translations.ContainsKey($langID)) { $translations[$langID] } else { $translations["en"] }
$copyText = $langSet.copy
$openText = $langSet.open
$adminText = $langSet.admin

# --- SECTION: COMMAND PROMPT (CMD) ---
Write-Host ">> Configuring Command Prompt Extensions..." -ForegroundColor Gray

$cmdPaths = @(
    "HKLM:\SOFTWARE\Classes\DesktopBackground\Shell\CommandPrompt",
    "HKLM:\SOFTWARE\Classes\Directory\background\shell\CommandPrompt",
    "HKLM:\SOFTWARE\Classes\Directory\shell\CommandPrompt",
    "HKLM:\SOFTWARE\Classes\Drive\shell\CommandPrompt"
)

foreach ($rootPath in $cmdPaths) {
    try {
        if (-not (Test-Path $rootPath)) { New-Item -Path $rootPath -Force | Out-Null }
        Set-ItemProperty -Path $rootPath -Name "Icon" -Value "imageres.dll,-5323" -Force
        Set-ItemProperty -Path $rootPath -Name "MUIVerb" -Value "Command Prompt" -Force
        Set-ItemProperty -Path $rootPath -Name "SubCommands" -Value "" -Force
        Set-ItemProperty -Path $rootPath -Name "Extended" -Value "" -Force

        $shellPath = "$rootPath\shell"
        if (-not (Test-Path $shellPath)) { New-Item -Path $shellPath -Force | Out-Null }
        $var = if ($rootPath -match "Directory\\shell" -or $rootPath -match "Drive\\shell") { "%L" } else { "%V" }

        # --- Sub-Option 1: Open Here (Normal CMD)
        $cmd1Path = "$shellPath\cmd1"
        # We delete and recreate to clear any English cache in the registry
        if (Test-Path $cmd1Path) { Remove-Item $cmd1Path -Recurse -Force }
        New-Item -Path $cmd1Path -Force | Out-Null
        
        # Explicitly setting the default value as the translated string
        Set-ItemProperty -Path $cmd1Path -Name "(Default)" -Value "$openText" -Force
        Set-ItemProperty -Path $cmd1Path -Name "Icon" -Value "imageres.dll,-5323" -Force

        $cmd1Command = "$cmd1Path\command"
        New-Item -Path $cmd1Command -Force | Out-Null
        $normalCmd = "cmd.exe /s /k `"pushd `"$var`" & ver & echo (c) Microsoft Corporation. $copyText & echo.`""
        Set-ItemProperty -Path $cmd1Command -Name "(Default)" -Value $normalCmd -Force

        # --- Sub-Option 2: Open Here as Administrator (CMD) ---
        $cmd2Path = "$shellPath\cmd2"
        if (-not (Test-Path $cmd2Path)) { New-Item -Path $cmd2Path -Force | Out-Null }
        Set-ItemProperty -Path $cmd2Path -Name "(Default)" -Value "$adminText" -Force
        Set-ItemProperty -Path $cmd2Path -Name "HasLUAShield" -Value "" -Force
        Set-ItemProperty -Path $cmd2Path -Name "Icon" -Value "imageres.dll,-5324" -Force

        $cmd2Command = "$cmd2Path\command"
        if (-not (Test-Path $cmd2Command)) { New-Item -Path $cmd2Command -Force | Out-Null }
        $innerCmd = "/k cd /d \`"$var\`" & ver & echo (c) Microsoft Corporation. $copyText & echo."
        $adminCmd = "powershell.exe -NoProfile -WindowStyle Hidden -Command `"Start-Process cmd.exe -ArgumentList '$innerCmd' -Verb RunAs`""
        Set-ItemProperty -Path $cmd2Command -Name "(Default)" -Value $adminCmd -Force

        Write-Host "[SUCCESS] CMD Submenu added: $($rootPath.Split('\')[-1])" -ForegroundColor Green
    } catch { Write-Host "[ERROR] Failed at CMD: $rootPath" -ForegroundColor Red }
}

# --- SECTION: WINDOWS POWERSHELL ---
Write-Host "`n>> Configuring Windows PowerShell Extensions..." -ForegroundColor Gray

$psPaths = @(
    "HKLM:\SOFTWARE\Classes\DesktopBackground\Shell\PowerShellMenu",
    "HKLM:\SOFTWARE\Classes\Directory\background\shell\PowerShellMenu",
    "HKLM:\SOFTWARE\Classes\Directory\shell\PowerShellMenu",
    "HKLM:\SOFTWARE\Classes\Drive\shell\PowerShellMenu"
)

foreach ($rootPath in $psPaths) {
    try {
        if (-not (Test-Path $rootPath)) { New-Item -Path $rootPath -Force | Out-Null }
        Set-ItemProperty -Path $rootPath -Name "Icon" -Value "powershell.exe" -Force
        Set-ItemProperty -Path $rootPath -Name "MUIVerb" -Value "Windows PowerShell" -Force
        Set-ItemProperty -Path $rootPath -Name "SubCommands" -Value "" -Force
        Set-ItemProperty -Path $rootPath -Name "Extended" -Value "" -Force 

        $shellPath = "$rootPath\shell"
        if (-not (Test-Path $shellPath)) { New-Item -Path $shellPath -Force | Out-Null }
        $var = if ($rootPath -match "Directory\\shell" -or $rootPath -match "Drive\\shell") { "%L" } else { "%V" }

        # --- Sub-Option 1: Open Here (Normal PowerShell) ---
        $ps1Path = "$shellPath\ps1"
        if (-not (Test-Path $ps1Path)) { New-Item -Path $ps1Path -Force | Out-Null }
        Set-ItemProperty -Path $ps1Path -Name "(Default)" -Value "$openText" -Force
        Set-ItemProperty -Path $ps1Path -Name "Icon" -Value "powershell.exe" -Force

        $ps1Command = "$ps1Path\command"
        if (-not (Test-Path $ps1Command)) { New-Item -Path $ps1Command -Force | Out-Null }
        $normalPs = 'powershell.exe -NoExit -Command "Set-Location -LiteralPath ''{0}''; Write-Host ''Windows PowerShell''; Write-Host ''(c) Microsoft Corporation. {1}''; Write-Host ''''"' -f $var, $copyText
        Set-ItemProperty -Path $ps1Command -Name "(Default)" -Value $normalPs -Force

        # --- Sub-Option 2: Open Here as Administrator (PowerShell) ---
        $ps2Path = "$shellPath\ps2"
        if (-not (Test-Path $ps2Path)) { New-Item -Path $ps2Path -Force | Out-Null }
        Set-ItemProperty -Path $ps2Path -Name "(Default)" -Value "$adminText" -Force
        Set-ItemProperty -Path $ps2Path -Name "HasLUAShield" -Value "" -Force
        Set-ItemProperty -Path $ps2Path -Name "Icon" -Value "powershell.exe" -Force

        $ps2Command = "$ps2Path\command"
        if (-not (Test-Path $ps2Command)) { New-Item -Path $ps2Command -Force | Out-Null }
        $innerPs = "Set-Location -LiteralPath ''{0}'' ; Write-Host ''Windows PowerShell'' ; Write-Host ''(c) Microsoft Corporation. {1}'' ; Write-Host ''''" -f $var, $copyText
        $adminPs = 'powershell.exe -NoProfile -WindowStyle Hidden -Command "Start-Process powershell.exe -ArgumentList ''-NoExit'', ''-Command'', ''{0}'' -Verb RunAs"' -f $innerPs
        Set-ItemProperty -Path $ps2Command -Name "(Default)" -Value $adminPs -Force

        Write-Host "[SUCCESS] PowerShell Submenu added: $($rootPath.Split('\')[-1])" -ForegroundColor Green
    } catch { Write-Host "[ERROR] Failed at PowerShell: $rootPath" -ForegroundColor Red }
}

Write-Host ""
Write-Host "Deployment Complete. Detected: $langID | Labels applied." -ForegroundColor Cyan
Write-Host "`--------------------------------------------------------"

##------------------------------------------------------##

# --- CUSTOM DESKTOP CONTEXT MENU MODULE (MULTI-LANGUAGE) ---
Write-Host "`n[MODULE] Adding Advanced Tools to Desktop Context Menu..." -ForegroundColor Cyan

# Detect system language
$langID = (Get-Culture).TwoLetterISOLanguageName
$basePath = "Registry::HKEY_CLASSES_ROOT\DesktopBackground\Shell"
$appliedCount = 0

# --- Translation Dictionary ---
$t = @{
    "ControlPanel"    = @{ "en"="Control Panel"; "pt"="Painel de Controle"; "es"="Panel de control"; "de"="Systemsteuerung"; "nl"="Configuratiescherm"; "fr"="Panneau de configuration"; "it"="Pannello di controllo"; "ja"="コントロール パネル"; "ko"="제어판"; "zh"="控制面板"; "uk"="Панель керування"; "ru"="Панель управления"; "bg"="Контролен панел"; "hi"="कंट्रोल पैनल"; "tr"="Denetim Masası"; "vi"="Bảng điều khiển"; "th"="แผงควบคุม"; "id"="Panel Kontrol"; "ms"="Panel Kawalan"; "fi"="Ohjauspaneeli"; "he"="לוח הבקרה"; "el"="Πίνακας Ελέγχου" }
    "CP_Cat"          = @{ "en"="Control Panel (Category)"; "pt"="Painel de Controle (Categoria)"; "es"="Panel de control (Categoría)"; "de"="Systemsteuerung (Kategorie)"; "fr"="Panneau de configuration (Catégorie)"; "ru"="Панель управления (Категория)"; "zh"="控制面板 (类别)" }
    "CP_Icons"        = @{ "en"="All Control Panel Items (Icons)"; "pt"="Todos os Itens (Ícones)"; "es"="Todos los elementos (Iconos)"; "de"="Alle Systemsteuerungselemente (Symbole)"; "fr"="Tous les menus (Icônes)"; "ru"="Все элементы управления (Значки)" }
    "GodMode"         = @{ "en"="All Tasks (God Mode)"; "pt"="Todas as Tarefas (God Mode)"; "es"="Todas las tareas (Modo Dios)"; "ru"="Все задачи (God Mode)" }
    "KillTasks"       = @{ "en"="Kill Unresponsive Tasks"; "pt"="Encerrar Processos Travados"; "es"="Finalizar tareas no respondidas"; "de"="Nicht reagierende Tasks beenden"; "fr"="Tuer les tâches qui ne répondent pas"; "ru"="Завершить зависшие задачи"; "zh"="结束未响应任务" }
    "SafeMode"        = @{ "en"="Safe Mode"; "pt"="Modo de Segurança"; "es"="Modo seguro"; "de"="Abgesicherter Modus"; "fr"="Mode sans échec"; "ja"="セーフモード"; "ru"="Безопасный режим"; "zh"="安全模式" }
    "SM_Normal"       = @{ "en"="Restart in Normal Mode"; "pt"="Reiniciar em Modo Normal"; "es"="Reiniciar en modo normal"; "fr"="Redémarrer en mode normal"; "ru"="Перезагрузка в обычном режиме" }
    "SM_Safe"         = @{ "en"="Restart in Safe Mode"; "pt"="Reiniciar em Modo de Segurança"; "es"="Reiniciar en modo seguro"; "fr"="Redémarrer en mode sans échec"; "ru"="Перезагрузка в безопасном режиме" }
    "SM_Net"          = @{ "en"="Restart in Safe Mode with Networking"; "pt"="Modo de Segurança com Rede"; "es"="Modo seguro con funciones de red"; "ru"="Безопасный режим с загрузкой сетевых драйверoв" }
    "SM_CMD"          = @{ "en"="Restart in Safe Mode with Command Prompt"; "pt"="Modo de Segurança com Prompt"; "es"="Modo seguro con símbolo del sistema"; "ru"="Безопасный режим com командной строкой" }
    "RestartExplorer" = @{ "en"="Restart Explorer"; "pt"="Reiniciar Explorer"; "es"="Reiniciar Explorer"; "de"="Explorer neu starten"; "fr"="Redémarrer l'Explorador"; "ru"="Перезапуск проводника" }
    "RE_Now"          = @{ "en"="Restart Explorer Now"; "pt"="Reiniciar Explorer Agora"; "es"="Reiniciar Explorer ahora"; "ru"="Перезапустить сейчас" }
    "RE_Pause"        = @{ "en"="Restart Explorer with Pause"; "pt"="Reiniciar Explorer com Pausa"; "es"="Reiniciar Explorer con pausa"; "ru"="Перезапустить com паузой" }
    "SysProp"         = @{ "en"="System Properties"; "pt"="Propriedades do Sistema"; "es"="Propriedades del sistema"; "de"="Systemeigenschaften"; "fr"="Propriétés système"; "ru"="Свойства системы"; "zh"="系统属性" }
}

function Get-T($key) {
    if ($t[$key].ContainsKey($langID)) { return $t[$key][$langID] } else { return $t[$key]["en"] }
}

function Quick-Reg {
    param ($Path, $Name, $Value, $Type = "String")
    if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null }
    Set-ItemProperty -Path $Path -Name $Name -Value $Value -Type $Type -Force
}

try {
    # 1. CONTROL PANEL
    $name = Get-T "ControlPanel"
    Write-Host ">> Applying: $name..." -ForegroundColor Gray
    $cp = "$basePath\ControlPanel"
    Quick-Reg $cp "MUIVerb" $name
    Quick-Reg $cp "SubCommands" ""
    Quick-Reg $cp "Icon" "imageres.dll,-27"
    Quick-Reg "$cp\shell\001flyout" "(Default)" (Get-T "CP_Cat")
    Quick-Reg "$cp\shell\001flyout\command" "(Default)" "explorer.exe shell:::{26EE0668-A00A-44D7-9371-BEB064C98683}"
    Quick-Reg "$cp\shell\002flyout" "(Default)" (Get-T "CP_Icons")
    Quick-Reg "$cp\shell\002flyout\command" "(Default)" "explorer.exe shell:::{21EC2020-3AEA-1069-A2DD-08002B30309D}"
    Quick-Reg "$cp\shell\003flyout" "(Default)" (Get-T "GodMode")
    Quick-Reg "$cp\shell\003flyout\command" "(Default)" "explorer.exe shell:::{ED7BA470-8E54-465E-825C-99712043E01C}"
    $appliedCount++

    # 2. KILL UNRESPONSIVE TASKS
    $name = Get-T "KillTasks"
    Write-Host ">> Applying: $name..." -ForegroundColor Gray
    $kill = "$basePath\KillNRTasks"
    Quick-Reg $kill "MUIVerb" $name
    Quick-Reg $kill "Icon" "taskmgr.exe,-30651"
    Quick-Reg "$kill\command" "(Default)" 'CMD.exe /C taskkill.exe /f /fi "status eq Not Responding" & Pause'
    $appliedCount++

    # 3. SAFE MODE
    $name = Get-T "SafeMode"
    Write-Host ">> Applying: $name..." -ForegroundColor Gray
    $sm = "$basePath\SafeMode"
    
    # Pre-clean: Remove the old key to kill any cached bilingual strings
    if (Test-Path $sm) { Remove-Item -Path $sm -Recurse -Force -ErrorAction SilentlyContinue }

    Quick-Reg $sm "MUIVerb" $name
    Quick-Reg $sm "SubCommands" ""
    Quick-Reg $sm "Icon" "bootux.dll,-1032"

    $smItems = @(
        @{ ID="001"; Name=(Get-T "SM_Normal"); CMD="bcdedit /deletevalue {current} safeboot & bcdedit /deletevalue {current} safebootalternateshell"; Icon="shell32.dll,-239" }
        @{ ID="002"; Name=(Get-T "SM_Safe"); CMD="bcdedit /set {current} safeboot minimal & bcdedit /deletevalue {current} safebootalternateshell"; Icon="imageres.dll,-102" }
        @{ ID="003"; Name=(Get-T "SM_Net"); CMD="bcdedit /set {current} safeboot network & bcdedit /deletevalue {current} safebootalternateshell"; Icon="shell32.dll,-257" }
        @{ ID="004"; Name=(Get-T "SM_CMD"); CMD="bcdedit /set {current} safeboot minimal & bcdedit /set {current} safebootalternateshell yes"; Icon="cmd.exe" }
    )

    foreach ($item in $smItems) {
        $path = "$sm\shell\$($item.ID)-Mode"
        
        # Force MUIVerb and kill any existing LocalizedString or CanonicalName that causes bilingual labels
        Quick-Reg $path "MUIVerb" $item.Name
        Quick-Reg $path "(Default)" "" 
        
        # Restore Icon for each sub-item
        if ($item.Icon) { Quick-Reg $path "Icon" $item.Icon }
        
        # Windows 11 26H1 specific: Stop system from fetching default/translated MUI strings
        if (Test-Path $path) {
            Remove-ItemProperty -Path $path -Name "LocalizedString" -ErrorAction SilentlyContinue
            Quick-Reg $path "CanonicalName" "" 
        }

        Quick-Reg "$path\command" "(Default)" "powershell -windowstyle hidden -command `"Start-Process cmd -ArgumentList '/s,/c,$($item.CMD) & shutdown -r -t 00 -f' -Verb runAs`""
    }
    $appliedCount++

    # 4. RESTART EXPLORER
    $name = Get-T "RestartExplorer"
    Write-Host ">> Applying: $name..." -ForegroundColor Gray
    $re = "$basePath\Restart Explorer"

    # Pre-clean to avoid bilingual/ghost issues on Win11 26H1
    if (Test-Path $re) { Remove-Item -Path $re -Recurse -Force -ErrorAction SilentlyContinue }

    Quick-Reg $re "MUIVerb" $name
    Quick-Reg $re "Icon" "explorer.exe"
    Quick-Reg $re "SubCommands" ""

    # Sub-item: Restart Explorer Now
    $pathNow = "$re\shell\01menu"
    Quick-Reg $pathNow "MUIVerb" (Get-T "RE_Now")
    Quick-Reg $pathNow "(Default)" ""
    # ICON: Blue modern Refresh arrows (Fluent style)
    Quick-Reg $pathNow "Icon" "shell32.dll,-16739" 
    Quick-Reg $pathNow "CanonicalName" ""
    Quick-Reg "$pathNow\command" "(Default)" "cmd.exe /c taskkill /f /im explorer.exe & start explorer.exe"

    # Sub-item: Restart Explorer with Pause
    $pathPause = "$re\shell\02menu"
    Quick-Reg $pathPause "MUIVerb" (Get-T "RE_Pause")
    Quick-Reg $pathPause "(Default)" ""
    # ICON: Settings/Process gear with a timer feel
    Quick-Reg $pathPause "Icon" "shell32.dll,-315" 
    Quick-Reg $pathPause "CanonicalName" ""
    Quick-Reg "$pathPause\command" "(Default)" 'cmd.exe /c @echo off & echo Stopping explorer... & taskkill /f /im explorer.exe & pause & start explorer.exe'

    $appliedCount++

    # 5. SYSTEM PROPERTIES
    $name = Get-T "SysProp"
    Write-Host ">> Applying: $name..." -ForegroundColor Gray
    $sp = "$basePath\System Properties"
    Quick-Reg $sp "MUIVerb" $name
    Quick-Reg $sp "Icon" "SystemPropertiesAdvanced.exe"
    Quick-Reg "$sp\command" "(Default)" "SystemPropertiesAdvanced.exe"
    $appliedCount++

    Write-Host "`n[SUCCESS] Context Menu upgrade complete ($langID)." -ForegroundColor Green
    Write-Host "Total Menu Modules: $appliedCount" -ForegroundColor White
}
catch {
    Write-Host "[ERROR] Failed to update context menu: $($_.Exception.Message)" -ForegroundColor Red
}

Write-Host "--------------------------------------------------------"

##------------------------------------------------------##

# --- Disable CTRL+ALT+DEL Requirement (Registry + SecPol) ---
Write-Host "`n[MODULE] Disabling CTRL+ALT+DEL requirement for logon..." -ForegroundColor Cyan

# 1. Update Registry (Immediate System Effect)
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null }
Set-ItemProperty -Path $regPath -Name "DisableCAD" -Value 1 -Type DWord -Force
Write-Host ">> Registry key 'DisableCAD' set to 1." -ForegroundColor Gray

# 2. Update Local Security Policy (SecPol.msc UI Sync)
try {
    $tempFile = "$env:TEMP\secpol_cfg.inf"
    $dbFile = "$env:TEMP\secpol.sdb"

    # Export current security settings to a temporary INF file
    secedit /export /cfg $tempFile /quiet

    # Read the content as a raw string to handle multi-line regex
    $cfgContent = Get-Content $tempFile -Raw
    $cadLine = 'MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=4,1'

    # Check if [Registry Values] section exists. If not, append it.
    if ($cfgContent -match "\[Registry Values\]") {
        if ($cfgContent -match "DisableCAD") {
            # Replace any existing value (0 or 1) with the correct one (4,1 -> Enabled/No CAD)
            $cfgContent = $cfgContent -replace "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableCAD\s*=\s*\d,\d", $cadLine
        } else {
            # Add the line directly under the section header
            $cfgContent = $cfgContent -replace "\[Registry Values\]", "[Registry Values]`r`n$cadLine"
        }
    } else {
        # Create the entire section if it's missing from the export
        $cfgContent += "`r`n[Registry Values]`r`n$cadLine"
    }

    # Save the modified INF using Unicode encoding (required by secedit)
    $cfgContent | Out-File $tempFile -Encoding Unicode

    # Import and apply the security policy configuration
    secedit /configure /db $dbFile /cfg $tempFile /areas SECURITYPOLICY /quiet
}
catch {
    Write-Host "[ERROR] Failed to sync SecPol.msc: $($_.Exception.Message)" -ForegroundColor Red
}

# --- FINAL VERIFICATION ---
Write-Host ">> Verifying status..." -ForegroundColor Gray
Start-Sleep -Seconds 1 # Short pause for OS processing

$regValue = (Get-ItemProperty -Path $regPath -Name "DisableCAD" -ErrorAction SilentlyContinue).DisableCAD
$checkFile = "$env:TEMP\check.inf"
secedit /export /cfg $checkFile /quiet
$secContent = Get-Content $checkFile -Raw
Remove-Item $checkFile -Force -ErrorAction SilentlyContinue

# Registry Check: 1 = Disabled CAD
if ($regValue -eq 1) {
    Write-Host "[SUCCESS] Registry: CTRL+ALT+DEL is DISABLED." -ForegroundColor Green
} else {
    Write-Host "[FAILED] Registry: Value not applied." -ForegroundColor Red
}

# SecPol UI Check: "4,1" in INF means "Enabled" (Do not require)
if ($secContent -match "DisableCAD=4,1") {
    Write-Host "[SUCCESS] SecPol: UI is now set to 'Enabled' (Do not require)." -ForegroundColor Green
} else {
    Write-Host "[FAILED] SecPol: UI Sync failed." -ForegroundColor Red
}

# Cleanup temporary files
if (Test-Path $tempFile) { Remove-Item $tempFile -Force }
if (Test-Path $dbFile) { Remove-Item $dbFile -Force }

Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# ==============================================================================
# MODULE: PRINT SPOOLER PERMISSIONS REPAIR
# DESCRIPTION: Grants Full Control permissions to the "Everyone" group for the 
#              system spooler directory to resolve access-related print issues.
# ==============================================================================

Write-Host "PRINT SPOOLER PERMISSIONS REPAIR" -ForegroundColor Cyan
Write-Host "[MODULE] Starting Print Spooler Permissions Repair..." -ForegroundColor Cyan
Write-Host "--------------------------------------------------------"

# Define the target spooler printers directory path
$spoolPath = "$env:SystemRoot\System32\spool\PRINTERS"

try {
    Write-Host ">> Granting Full Control to 'Everyone' on: $spoolPath" -ForegroundColor Yellow
    
    # Retrieve current Access Control List (ACL) for the directory
    $acl = Get-Acl $spoolPath
    
    # Use Well-Known SID 'S-1-1-0' (Everyone) to ensure cross-language compatibility
    # This avoids issues between "Everyone" (EN) and "Todos" (PT-BR) localizations.
    $identity = New-Object System.Security.Principal.SecurityIdentifier("S-1-1-0")
    
    # Define Permission Parameters
    $fileSystemRights = "FullControl"
    $inheritanceFlags = "ContainerInherit, ObjectInherit" # Applies to subfolders and files
    $propagationFlags = "None"
    $type             = "Allow"
    
    # Construct the new Access Rule
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
        $identity, 
        $fileSystemRights, 
        $inheritanceFlags, 
        $propagationFlags, 
        $type
    )
    
    # Apply the rule to the ACL and commit changes to the file system
    $acl.SetAccessRule($accessRule)
    Set-Acl -Path $spoolPath -AclObject $acl
    
    Write-Host "[OK] Permissions updated successfully." -ForegroundColor Green
} catch {
    # Log failure details for troubleshooting
    Write-Host "[ERROR] Failed to set permissions: $($_.Exception.Message)" -ForegroundColor Red
}

Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# ==============================================================================
# SCRIPT: Fix Print Spooler Deployment (Smart Language Detection)
# DESCRIPTION: Deploys silent repair script + optional desktop context menu
#              SKIPS CONTEXT MENU ON WINDOWS SERVER (NO ABORT)
# ==============================================================================

Write-Host "FIX PRINT SPOOLER CONTEXT MENU" -ForegroundColor Cyan
Write-Host ""

# ------------------------------------------------
# OS DETECTION
# ------------------------------------------------
$osInfo = Get-CimInstance -ClassName Win32_OperatingSystem
$isServer = ($osInfo.ProductType -ne 1)

if ($isServer) {

    Write-Host "[SERVER DETECTED] $($osInfo.Caption)" -ForegroundColor Yellow
    Write-Host "[ACTION] Disabling Print Spooler (NO CONTEXT MENU WILL BE CREATED)" -ForegroundColor Cyan

    Set-Service -Name "Spooler" -StartupType Disabled -ErrorAction SilentlyContinue
    Stop-Service -Name "Spooler" -Force -ErrorAction SilentlyContinue

    Write-Host "[OK] Spooler disabled on Server. Skipping context menu only." -ForegroundColor Green
    Write-Host ""

} else {

    Write-Host "[CLIENT DETECTED] Context menu will be created." -ForegroundColor Green
    Write-Host ""
}

# ------------------------------------------------
# SILENT REPAIR SCRIPT PAYLOAD
# ------------------------------------------------
$scriptContent = @'
$spoolPath = "$env:SystemRoot\System32\spool\PRINTERS"

Set-Service -Name "Spooler" -StartupType Disabled
Stop-Service -Name "Spooler" -Force -ErrorAction SilentlyContinue
Stop-Service -Name "PrintNotify" -Force -ErrorAction SilentlyContinue

if (Test-Path "$spoolPath\*") {
    try {
        Remove-Item -Path "$spoolPath\*" -Force -Recurse -ErrorAction SilentlyContinue
    } catch {}
}

Set-Service -Name "Spooler" -StartupType Automatic
Start-Service -Name "Spooler"
'@

# ------------------------------------------------
# DEPLOY SCRIPT
# ------------------------------------------------
Write-Host "[STEP 1] Deploying FixSpooler.ps1..." -ForegroundColor Cyan

try {
    $scriptPath = "C:\Windows\FixSpooler.ps1"
    Set-Content -Path $scriptPath -Value $scriptContent -Force
    Write-Host "[OK] Script deployed." -ForegroundColor Green
}
catch {
    Write-Host "[ERROR] Failed to write FixSpooler.ps1" -ForegroundColor Red
}

# ------------------------------------------------
# SKIP CONTEXT MENU ON SERVER
# ------------------------------------------------
if ($isServer) {

    Write-Host "[STEP 2] Context menu skipped (Windows Server policy)" -ForegroundColor Yellow
    Write-Host "--------------------------------------------------------"
    Write-Host ""
    
} else {

    # ------------------------------------------------
    # CONTEXT MENU CREATION (DESKTOP ONLY)
    # ------------------------------------------------
    Write-Host "[STEP 2] Creating desktop context menu..." -ForegroundColor Cyan

    $currentLang = [System.Globalization.CultureInfo]::CurrentUICulture.Name

    $langMap = @{
        "pt*" = "Corrigir Spooler de Impressão"
        "en*" = "Fix Print Spooler"
        "es*" = "Corregir Cola de impresión"
        "fr*" = "Réparer le Spouleur d'impression"
        "de*" = "Druckwarteschlange reparieren"
        "it*" = "Ripristina Spooler di stampa"
        "ru*" = "Исправить диспетчер печати"
        "zh-TW*" = "修復列印多多工緩衝處理器"
        "zh-CN*" = "修复打印后台处理程序"
        "ar*" = "إصلاح Spooler الطباعة"
        "cs*" = "Opravit službu Spooler"
        "da*" = "Reparer Print Spooler"
        "nl*" = "Afdrukspooler repareren"
        "fi*" = "Korjaa tulostuksen taustatulostus"
        "el*" = "Επιδιόρθωση ουράς εκτύπωσης"
        "he*" = "תיקון Print Spooler"
        "hu*" = "Nyomtatási várólista javítása"
        "ja*" = "印刷スプーラーを修復する"
        "ko*" = "인쇄 스풀러 복구"
        "no*" = "Reparer Print Spooler"
        "pl*" = "Napraw bufor wydruku"
        "sv*" = "Reparera Print Spooler"
        "tr*" = "Yazdırma Biriktiricisi Onar"
    }

    $menuName = ""

    foreach ($pattern in $langMap.Keys) {
        if ($currentLang -like $pattern) {
            $menuName = $langMap[$pattern]
            break
        }
    }

    if (-not $menuName) { $menuName = "Fix Print Spooler" }

    $regPath = "Registry::HKEY_LOCAL_MACHINE\Software\Classes\DesktopBackground\Shell\FixSpooler"
    $commandPath = "$regPath\command"

    $commandValue = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command `"Start-Process powershell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \`"C:\Windows\FixSpooler.ps1\`"' -Verb RunAs`""

    try {

        if (Test-Path $regPath) {
            Remove-Item -Path $regPath -Recurse -Force -ErrorAction SilentlyContinue
        }

        New-Item -Path $regPath -Force | Out-Null

        Set-ItemProperty -Path $regPath -Name "(Default)" -Value $menuName
        Set-ItemProperty -Path $regPath -Name "Icon" -Value "imageres.dll,-51"
        Set-ItemProperty -Path $regPath -Name "HasLUAShield" -Value ""

        if (-not (Test-Path $commandPath)) {
            New-Item -Path $commandPath -Force | Out-Null
        }

        Set-ItemProperty -Path $commandPath -Name "(Default)" -Value $commandValue

        Write-Host "[OK] Context menu created: $menuName" -ForegroundColor Green
    }
    catch {
        Write-Host "[ERROR] Registry update failed: $($_.Exception.Message)" -ForegroundColor Red
    }

    Write-Host ""
}

# ------------------------------------------------
# FINAL
# ------------------------------------------------
Write-Host "--- Deployment Finished ---" -ForegroundColor Yellow
Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# ==============================================================================
# SCRIPT: Windows Thumbnail & Visual Effects Repair
# DESCRIPTION: Forced cache purge, Registry Policy Fix, and Performance 
#              Options optimization (Thumbnail previews & Desktop shadows).
# ==============================================================================

Write-Host "FIX THUMBNAILS[1/2]" -ForegroundColor Cyan
Write-Host "`n[INIT] Repairing Thumbnail Previews and Visual Effects..." -ForegroundColor Cyan
Write-Host ""

# 1. REGISTRY POLICY: ENFORCE THUMBNAIL ENABLEMENT
# IconsOnly = 0 (Show Thumbnails) | DisableThumbnails = 0 (Enable them)
Write-Host "[PROCESS] Enforcing Thumbnail policies in Registry..." -ForegroundColor Gray
$explorerPaths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
)

foreach ($path in $explorerPaths) {
    if (-not (Test-Path $path)) { New-Item -Path $path -Force | Out-Null }
    Set-ItemProperty -Path $path -Name "IconsOnly" -Value 0 -Force -ErrorAction SilentlyContinue
    Set-ItemProperty -Path $path -Name "DisableThumbnails" -Value 0 -Force -ErrorAction SilentlyContinue
}

# 2. FILE EXTENSIONS: ENSURE THEY ARE VISIBLE
Write-Host "[PROCESS] Showing File Extensions..." -ForegroundColor Gray
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Value 0 -Force

# 3. PERFORMANCE OPTIONS (VISUAL EFFECTS)
# These settings correspond to "System Properties > Performance Options"
Write-Host "[PROCESS] Optimizing Visual Effects (Performance Options)..." -ForegroundColor Gray

$visualEffectsPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\VisualEffects"
if (-not (Test-Path $visualEffectsPath)) { New-Item -Path $visualEffectsPath -Force | Out-Null }

# Set to "Custom" (Value 3) to allow specific flag overrides
Set-ItemProperty -Path $visualEffectsPath -Name "VisualFXSetting" -Value 3 -Force

# FEATURE: "Show thumbnails instead of icons"
# Key: ListviewAlphaSelect (Value 1 enables this effect)
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop\WindowMetrics" -Name "MinAnimate" -Value 1 -Force -ErrorAction SilentlyContinue

# FEATURE: "Use drop shadows for icon labels on the desktop"
# Key: ListviewShadow (Value 1 enables)
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "ListviewShadow" -Value 1 -Force

# 4. SYSTEM-WIDE REFRESH
# This forces the Shell to update its state without a full logout
Write-Host "[PROCESS] Refreshing Shell State..." -ForegroundColor Gray
$updateCode = @'
[System.Runtime.InteropServices.DllImport("shell32.dll")]
public static extern void SHChangeNotify(int wEventId, int uFlags, IntPtr dwItem1, IntPtr dwItem2);
'@
Add-Type -MemberDefinition $updateCode -Namespace WinAPI -Name Shell32
[WinAPI.Shell32]::SHChangeNotify(0x08000000, 0x0000, [IntPtr]::Zero, [IntPtr]::Zero)

Write-Host "[SUCCESS] Thumbnail repair and visual effects applied." -ForegroundColor Green
Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host ""

##------------------------------------------------------##

# --- Take Ownership Context Menu (Universal Native Method) ---
# Description: Deploys a high-privilege "Take Ownership" context menu for Files and Directories.
# Method: Generates a temporary UTF-16LE .reg file to bypass Registry locks and character conflicts.
# Target: Windows 10/11 (Global Support - 22 Languages)

# 1. Global Language Dictionary (22 Languages)
$langID = (Get-Culture).TwoLetterISOLanguageName
$t = @{
    "TakeOwnership" = @{ 
        "en"="Take Ownership"; "pt"="Obter Controle Total"; "es"="Tomar posesión"; "de"="Besitz übernehmen"; 
        "nl"="Eigenaar worden"; "fr"="Prendre possession"; "it"="Diventa proprietario"; "ja"="所有権の取得"; 
        "ko"="소유권 가져오기"; "zh"="取得所有权"; "uk"="Стати власником"; "ru"="Стать владельцем"; 
        "bg"="Стани собственик"; "hi"="स्वामित्व लें"; "tr"="Sahipliği Al"; "vi"="Chiếm quyền sở hữu"; 
        "th"="เป็นเจ้าของ"; "id"="Ambil Kepemilikan"; "ms"="Ambil Pemilikan"; "fi"="Ota omistajuus"; 
        "he"="קבל בעלות"; "el"="Ανάληψη κυριότητας" 
    }
}

$localizedName = if ($t["TakeOwnership"][$langID]) { $t["TakeOwnership"][$langID] } else { $t["TakeOwnership"]["en"] }

Write-Host "[PROCESS] Deploying '$localizedName' with custom Checkmark Icon..." -ForegroundColor Cyan

# 2. Registry Payload Generation (Here-String)
# The "Icon" value uses shell32.dll,-253 to display the orange checkmark.
$regContent = @"
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\runas]
@="$localizedName"
"Icon"="shell32.dll,-253"
"HasLUAShield"=""
"NoWorkingDirectory"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" & icacls \"%1\" /grant *S-1-5-32-544:F & Pause"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" & icacls \"%1\" /grant *S-1-5-32-544:F & Pause"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\runas]
@="$localizedName"
"Icon"="shell32.dll,-253"
"HasLUAShield"=""
"NoWorkingDirectory"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" /r /d y & icacls \"%1\" /grant *S-1-5-32-544:F /t /c /l & Pause"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" /r /d y & icacls \"%1\" /grant *S-1-5-32-544:F /t /c /l & Pause"
"@

try {
    # 3. File I/O & Deployment
    $tempReg = "$env:TEMP\take_ownership_deploy.reg"
    $regContent | Out-File -FilePath $tempReg -Encoding Unicode -Force

    # Executing the import via reg.exe
    Start-Process "reg.exe" -ArgumentList "import `"$tempReg`"" -Wait -NoNewWindow

    # 4. Post-Deployment Cleanup
    Remove-Item $tempReg -Force -ErrorAction SilentlyContinue

    Write-Host "[SUCCESS] '$localizedName' integrated into context menu successfully!!" -ForegroundColor Green
}
catch {
    Write-Host "[CRITICAL ERROR] Failed to finalize registry deployment: $($_.Exception.Message)" -ForegroundColor Red
}

Write-Host "--------------------------------------------------------" -ForegroundColor Gray
Write-Host ""

##------------------------------------------------------##

# --- MSCONFIG: UNCHECK NUMBER OF PROCESSORS ---
Write-Host "[MODULE] Checking MSConfig Advanced Boot Options..." -ForegroundColor Cyan

try {
    # 1. GET REAL BOOT ID (Prevents "Invalid Parameter" errors)
    $bootId = bcdedit /get "{current}" device 2>$null
    if ($null -eq $bootId) { $target = "{default}" } else { $target = "{current}" }

    # 2. REAL CHECK (Verifies if 'numproc' value exists)
    $bcdData = bcdedit /enum $target
    if ($bcdData -match "numproc") {
        Write-Host "!! ATTENTION: 'Number of Processors' is CHECKED in the system !!" -ForegroundColor Red
        
        # PROCEDURE A: Remove BCD lock using the correct ID
        Write-Host "-> PROCEDURE A: Deleting CPU core limit from BCD..." -ForegroundColor Yellow
        bcdedit /deletevalue $target numproc 2>$null
        
        # PROCEDURE B: Reset interface flags in Registry (Clears the UI "V" mark)
        Write-Host "-> PROCEDURE B: Clearing MSConfig visual cache..." -ForegroundColor Yellow
        $regPath = "HKLM:\SOFTWARE\Microsoft\Shared Tools\MSConfig\state"
        if (Test-Path $regPath) {
            Set-ItemProperty -Path $regPath -Name "allbootmsconfi" -Value 0 -Force -ErrorAction SilentlyContinue
            Set-ItemProperty -Path $regPath -Name "flags" -Value 0 -Force -ErrorAction SilentlyContinue
        }

        # PROCEDURE C: Clear environment variables forcing core counts
        Write-Host "-> PROCEDURE C: Removing hardware overrides..." -ForegroundColor Yellow
        $envPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"
        Remove-ItemProperty -Path $envPath -Name "NUMBER_OF_PROCESSORS" -ErrorAction SilentlyContinue

        Write-Host "`n[SUCCESS] Procedures finalized." -ForegroundColor Green
        Write-Host "CLOSE and OPEN MSConfig. The box SHOULD be unchecked now." -ForegroundColor Cyan
    } 
    else {
        Write-Host "[OK] 'Number of Processors' is already unchecked." -ForegroundColor Gray
    }
} 
catch {
    Write-Host "[ERROR] Failed to access boot configuration data." -ForegroundColor Red
}

Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

<#
    Workstation Optimization & Setup Script
    Organization: Registry Tweaks, System Performance
#>

Write-Host "Starting System Configuration..." -ForegroundColor Cyan

# --- 1. System Performance: Automatic Pagefile Management ---
Write-Host "Setting system-managed pagefile..."
Set-CimInstance -Query "Select * from Win32_ComputerSystem" -Property @{AutomaticManagedPagefile=$True}

# --- 2. Network Optimization: Fix CFG & Remove QoS Bandwidth Limit ---
Write-Host "Configuring Network QoS Limits..."
Set-ExecutionPolicy Bypass -Scope Process -Force; 
if (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Psched")) { New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Psched" -Force }
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Psched" -Name "NonBestEffortLimit" -Value 0 -PropertyType DWord -Force

# --- 3. Explorer: Hide Recycle Bin from Desktop ---
Write-Host "Hiding Recycle Bin from Desktop..." -ForegroundColor Cyan

$regPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel"
$binGuid = "{645FF040-5081-101B-9F08-00AA002F954E}"

# Ensure the registry key (folder) exists before creating the value
if (!(Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}

# Set the value to hide the icon (1 = Hidden, 0 = Visible)
# Set-ItemProperty is used here because it creates the value if it doesn't exist 
# or updates it if it does, preventing the "path not found" error.
Set-ItemProperty -Path $regPath -Name $binGuid -Value 1 -Type DWord -Force

Write-Host "Recycle Bin hidden successfully! ✅" -ForegroundColor Green

# --- 4. Explorer: Pin Recycle Bin to Navigation Pane ---
Write-Host "Pinning Recycle Bin to Explorer Sidebar..."
if (!(Test-Path "HKCU:\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}")) { New-Item -Path "HKCU:\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}" -Force }
New-ItemProperty -Path "HKCU:\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}" -Name "System.IsPinnedToNameSpaceTree" -Value 1 -PropertyType DWord -Force

# --- 5. Graphics: Disable Wallpaper JPEG Compression ---
Write-Host "Setting Wallpaper quality to 100%..."
if (!(Test-Path "HKCU:\Control Panel\Desktop")) { New-Item -Path "HKCU:\Control Panel\Desktop" -Force }
New-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name "JPEGImportQuality" -Value 100 -PropertyType DWord -Force

# --- 6. Security/Login: Enable NumLock on Login Screen ---
Write-Host "Enabling NumLock on Login Screen..."
New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS -ErrorAction SilentlyContinue
Set-ItemProperty -Path "HKU:\.DEFAULT\Control Panel\Keyboard" -Name "InitialKeyboardIndicators" -Value "2147483650"

# --- 7. Context Menu: Restore 'New Text Document' ---
Write-Host "Restoring 'New Text Document' to Context Menu..."
New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT -ErrorAction SilentlyContinue
New-Item -Path 'HKCR:\.rtf\ShellNew','HKCR:\.txt\PersistentHandler','HKCR:\.txt\ShellNew','HKCR:\SystemFileAssociations\.txt','HKCR:\txtfile\DefaultIcon','HKCR:\txtfile\shell\open\command','HKCR:\txtfile\shell\print\command','HKCR:\txtfile\shell\printto\command' -Force | Out-Null
Set-ItemProperty -Path 'HKCR:\.rtf\ShellNew' -Name 'NullFile' -Value ''
Set-Item -Path 'HKCR:\.txt' -Value 'txtfile'
Set-ItemProperty -Path 'HKCR:\.txt' -Name 'Content Type' -Value 'text/plain'
Set-ItemProperty -Path 'HKCR:\.txt' -Name 'PerceivedType' -Value 'text'
Set-Item -Path 'HKCR:\.txt\PersistentHandler' -Value '{5e941d80-bf96-11cd-b579-08002b30bfeb}'
Set-ItemProperty -Path 'HKCR:\.txt\ShellNew' -Name 'NullFile' -Value ''
Set-ItemProperty -Path 'HKCR:\.txt\ShellNew' -Name 'ItemName' -Value '@%SystemRoot%\system32\notepad.exe,-470'
Set-ItemProperty -Path 'HKCR:\SystemFileAssociations\.txt' -Name 'PerceivedType' -Value 'document'
Set-Item -Path 'HKCR:\txtfile' -Value 'Text Document'
Set-ItemProperty -Path 'HKCR:\txtfile' -Name 'EditFlags' -Value 2162688
Set-ItemProperty -Path 'HKCR:\txtfile' -Name 'FriendlyTypeName' -Value '@%SystemRoot%\system32\notepad.exe,-469'
Set-Item -Path 'HKCR:\txtfile\DefaultIcon' -Value '%SystemRoot%\system32\imageres.dll,-102'
Set-Item -Path 'HKCR:\txtfile\shell\open\command' -Value '%SystemRoot%\system32\NOTEPAD.EXE %1'

# --- 8. Updates: Disable Automatic Driver Updates ---
Write-Host "Disabling Automatic Driver Updates..."
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' -Name 'ExcludeWUDriversInQualityUpdate' -Value 1 -Type DWord
New-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverSearching' -Name 'SearchOrderConfig' -Value 0

# --- 9. Updates: Disable Malicious Software Removal Tool (MRT) via WU ---
Write-Host "Disabling MRT Offers..."
if(!(Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\MRT')){ New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\MRT' -Force | Out-Null }
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\MRT' -Name 'DontOfferThroughWUAU' -Value 1 -Type DWord

# --- 10. Context Menu: Restore "New" Menu for Scripting Extensions (Multi-Language) ---
Write-Host "`n[MODULE] Restoring 'New File' Context Menu for Scripting Extensions..." -ForegroundColor Cyan

# Detect system language
$langID = (Get-Culture).TwoLetterISOLanguageName

# Multi-language dictionary for ShellNew Item Names
$translations = @{
    ".vbs" = @{ "en"="VBScript"; "pt"="VBScript"; "es"="VBScript"; "de"="VBScript"; "nl"="VBScript"; "fr"="VBScript"; "it"="VBScript"; "ja"="VBScript"; "ko"="VBScript"; "zh"="VBScript"; "uk"="VBScript"; "ru"="VBScript"; "bg"="VBScript"; "hi"="VBScript"; "tr"="VBScript"; "vi"="VBScript"; "th"="VBScript"; "id"="VBScript"; "ms"="VBScript"; "fi"="VBScript"; "he"="VBScript"; "el"="VBScript" }
    ".bat" = @{ "en"="Batch File (.bat)"; "pt"="Arquivo de Lote (.bat)"; "es"="Archivo por lotes (.bat)"; "de"="Stapelverarbeitungsdatei (.bat)"; "nl"="Batchbestand (.bat)"; "fr"="Fichier de commandes (.bat)"; "it"="File batch (.bat)"; "ja"="バッチファイル (.bat)"; "ko"="배치 파일 (.bat)"; "zh"="批处理文件 (.bat)"; "uk"="Пакетний файл (.bat)"; "ru"="Пакетный файл (.bat)"; "bg"="Пакетен файл (.bat)"; "hi"="बैच फ़ाइल (.bat)"; "tr"="Toplu İş Dosyası (.bat)"; "vi"="Tệp lô (.bat)"; "th"="ไฟล์แบตช์ (.bat)"; "id"="File batch (.bat)"; "ms"="Fail kelompok (.bat)"; "fi"="Eräajo-tiedosto (.bat)"; "he"="קובץ Batch (.bat)"; "el"="Αρχείο δέσμης ενεργειών (.bat)" }
    ".cmd" = @{ "en"="Command Script (.cmd)"; "pt"="Script de Comando (.cmd)"; "es"="Script de comando (.cmd)"; "de"="Befehlsskript (.cmd)"; "nl"="Opdrachtscript (.cmd)"; "fr"="Script de commande (.cmd)"; "it"="Script di comando (.cmd)"; "ja"="コマンドスクリプト (.cmd)"; "ko"="명령 스크립트 (.cmd)"; "zh"="命令脚本 (.cmd)"; "uk"="Командний сценарій (.cmd)"; "ru"="Командный сценарий (.cmd)"; "bg"="Команден скрипт (.cmd)"; "hi"="कमांड स्क्रिप्ट (.cmd)"; "tr"="Komut Dosyası (.cmd)"; "vi"="Kịch bản lệnh (.cmd)"; "th"="สคริปต์คำสั่ง (.cmd)"; "id"="Skrip perintah (.cmd)"; "ms"="Skrip arahan (.cmd)"; "fi"="Komentosarjassa (.cmd)"; "he"="סקריפט פקודה (.cmd)"; "el"="Δέσμη εντολών (.cmd)" }
    ".reg" = @{ "en"="Registry Entries (.reg)"; "pt"="Entradas de Registro (.reg)"; "es"="Entradas de registro (.reg)"; "de"="Registrierungseinträge (.reg)"; "nl"="Registervermeldingen (.reg)"; "fr"="Entrées de registre (.reg)"; "it"="Voci di registro (.reg)"; "ja"="レジストリエントリ (.reg)"; "ko"="레ジ스트리 항목 (.reg)"; "zh"="注册表项 (.reg)"; "uk"="Записи реєстру (.uk)"; "ru"="Записи реестра (.reg)"; "bg"="Записи в регистъра (.reg)"; "hi"="रजिस्ट्री प्रविष्टियाँ (.reg)"; "tr"="Kayıt Defteri Girdileri (.reg)"; "vi"="Mục đăng ký (.reg)"; "th"="รายการรีจิสทรี (.reg)"; "id"="Entri registri (.reg)"; "ms"="Kemasukan pendaftaran (.reg)"; "fi"="Rekisterimerkinnät (.reg)"; "he"="ערכי רישום (.reg)"; "el"="Καταχωρήσεις μητρώου (.reg)" }
    ".ps1" = @{ "en"="PowerShell Script (.ps1)"; "pt"="Script do PowerShell (.ps1)"; "es"="Script de PowerShell (.ps1)"; "de"="PowerShell-Skript (.ps1)"; "nl"="PowerShell-script (.ps1)"; "fr"="Script PowerShell (.ps1)"; "it"="Script PowerShell (.ps1)"; "ja"="PowerShell スクリプト (.ps1)"; "ko"="PowerShell 스크립트 (.ps1)"; "zh"="PowerShell 脚本 (.ps1)"; "uk"="Сценарій PowerShell (.ps1)"; "ru"="Сценарий PowerShell (.ps1)"; "bg"="PowerShell скрипт (.ps1)"; "hi"="PowerShell स्क्रिप्ट (.ps1)"; "tr"="PowerShell Betiği (.ps1)"; "vi"="Kịch bản PowerShell (.ps1)"; "th"="สคริปต์ PowerShell (.ps1)"; "id"="Skrip PowerShell (.ps1)"; "ms"="Skrip PowerShell (.ps1)"; "fi"="PowerShell-skripti (.ps1)"; "he"="סקריפט PowerShell (.ps1)"; "el"="Δέσμη ενεργειών PowerShell (.ps1)" }
}

$shellNewItems = @(
    @{ Ext = ".vbs"; Progid = "VBSFile" }
    @{ Ext = ".bat"; Progid = "batfile" }
    @{ Ext = ".cmd"; Progid = "cmdfile" }
    @{ Ext = ".reg"; Progid = "regfile" }
    @{ Ext = ".ps1"; Progid = "Microsoft.PowerShellScript.1" }
)

foreach ($item in $shellNewItems) {
    try {
        # Select the translated name based on detected language, fallback to English
        $ext = $item.Ext
        $customName = if ($translations[$ext].ContainsKey($langID)) { $translations[$ext][$langID] } else { $translations[$ext]["en"] }

        # 1. Cache and UserChoice Cleanup
        $userChoicePath = "Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\$ext\UserChoice"
        if (Test-Path $userChoicePath) { 
            Remove-Item -Path $userChoicePath -Force -Recurse -ErrorAction SilentlyContinue 
        }

        $cachePath = "Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew"
        if (Test-Path $cachePath) { 
            Remove-Item -Path $cachePath -Force -ErrorAction SilentlyContinue 
        }

        # 2. Assign Friendly Name to Progid
        $progidPath = "Registry::HKEY_CLASSES_ROOT\$($item.Progid)"
        if (Test-Path $progidPath) {
            Set-ItemProperty -Path $progidPath -Name "(Default)" -Value $customName -Force
            Remove-ItemProperty -Path $progidPath -Name "FriendlyTypeName" -ErrorAction SilentlyContinue
        }

        # 3. Rebuild ShellNew Structure
        $regPaths = @(
            "Registry::HKEY_CLASSES_ROOT\$ext",
            "Registry::HKEY_CURRENT_USER\Software\Classes\$ext"
        )

        foreach ($path in $regPaths) {
            if (-not (Test-Path $path)) { New-Item -Path $path -Force | Out-Null }
            Set-ItemProperty -Path $path -Name "(Default)" -Value $item.Progid -Force
            
            $sn = "$path\ShellNew"
            if (-not (Test-Path $sn)) { New-Item -Path $sn -Force | Out-Null }
            
            Set-ItemProperty -Path $sn -Name "NullFile" -Value "" -Force
            Set-ItemProperty -Path $sn -Name "MenuText" -Value $customName -Force
            Set-ItemProperty -Path $sn -Name "ItemName" -Value $customName -Force
        }
        Write-Host "[SUCCESS] 'New' item restored for: $ext ($langID)" -ForegroundColor Green
    }
    catch {
        Write-Host "[ERROR] Failed to restore $($item.Ext): $($_.Exception.Message)" -ForegroundColor Red
    }
}

Write-Host "--------------------------------------------------------"
Write-Host "Context Menu restoration complete!" -ForegroundColor Yellow
Write-Host ""

# --- 11. Service Host Grouping Optimization (SvcHostSplitThreshold) ---
# This adjusts how Windows groups services into svchost.exe processes.
# The logic follows the Winaero methodology: Total RAM + 1024000 KB margin.
Write-Host "-- Optimizing SvcHost Split Threshold based on RAM..." -ForegroundColor Gray

try {
    # Get total physical RAM in KB
    $totalRAMkb = (Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1024
    
    # Calculate the threshold with the Winaero margin
    $thresholdValue = [math]::Floor($totalRAMkb + 1024000)

    $registryPath = "HKLM:\SYSTEM\CurrentControlSet\Control"
    
    # Apply the calculated value to the Registry
    Set-ItemProperty -Path $registryPath -Name "SvcHostSplitThresholdInKB" -Value $thresholdValue -Type DWord -Force
    
    Write-Host "SvcHost threshold dynamically set to: $thresholdValue KB ✅" -ForegroundColor Green
} catch {
    Write-Warning "Failed to calculate or set SvcHost threshold."
}

# --- 12. Disable Background Apps Globally ---
# This prevents UWP/Store apps from running in the background, 
# saving CPU cycles and RAM.
Write-Host "-- Disabling Background Apps globally..." -ForegroundColor Gray
$bgAppPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications"

try {
    if (!(Test-Path $bgAppPath)) { 
        New-Item -Path $bgAppPath -Force | Out-Null 
    }
    Set-ItemProperty -Path $bgAppPath -Name "GlobalUserDisabled" -Value 1 -Type DWord -Force
    Write-Host "Background apps disabled successfully! ✅" -ForegroundColor Green
} catch {
    Write-Warning "Failed to disable background apps."
}

# --- 13. Long-term Windows Update Pause (Year 3000) & EXTENDED PAUSE CONFIGURATION ---
Write-Host "[MODULE] Configuring Windows Update long-term pause..." -ForegroundColor Cyan

# Define registry path
$wuPath = "HKLM:\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings"

try {
    # Ensure registry path exists
    if (!(Test-Path $wuPath)) {
        New-Item -Path $wuPath -Force | Out-Null
    }

    # ------------------------------------------------------------
    # Extend maximum allowed pause duration (20 years = 7300 days)
    # This unlocks extended pause capability in Windows Settings
    # ------------------------------------------------------------
    Write-Host ">> Extending maximum pause limit to 20 years..." -ForegroundColor Gray

    New-ItemProperty -Path $wuPath `
        -Name "FlightSettingsMaxPauseDays" `
        -PropertyType DWord `
        -Value 7300 `
        -Force | Out-Null

    # ------------------------------------------------------------
    # Force pause until year 3000
    # This effectively keeps updates paused indefinitely
    # ------------------------------------------------------------
    Write-Host ">> Applying hard pause until year 3000..." -ForegroundColor Gray

    $updateValues = @{
        "PauseFeatureUpdatesStartTime" = "2022-09-30T10:23:59Z"
        "PauseFeatureUpdatesEndTime"   = "3000-12-31T10:23:59Z"
        "PauseQualityUpdatesStartTime" = "2022-09-30T10:23:59Z"
        "PauseQualityUpdatesEndTime"   = "3000-12-31T10:23:59Z"
        "PauseUpdatesStartTime"        = "2022-09-30T10:23:59Z"
        "PauseUpdatesExpiryTime"       = "3000-12-31T10:23:59Z"
    }

    foreach ($name in $updateValues.Keys) {
        Set-ItemProperty -Path $wuPath `
            -Name $name `
            -Value $updateValues[$name] `
            -Type String `
            -Force
    }

    Write-Host "Windows Update pause successfully configured. ✅" -ForegroundColor Green
    Write-Host "NOTE: In some Windows versions, manual pause activation in Settings may still be required." -ForegroundColor Yellow

} catch {
    Write-Warning "Failed to configure Windows Update pause settings."
}

# --- 14. Context Menu: Add 'Check File Ownership' (High-Speed Native Deployment) ---
Write-Host "`n[MODULE] Configuring 'Check Owner' Context Menu (Fast Mode)..." -ForegroundColor Cyan

# Get the ReleaseId or DisplayVersion
$regPathNT = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
$releaseVersion = (Get-ItemProperty -Path $regPathNT -Name "DisplayVersion").DisplayVersion

# Apply configuration ONLY if version is NOT "25H2" (Targeting 26H1+)
if ($releaseVersion -ne "25H2") {
    
    # Define the command string carefully for reg.exe escaping
    $cmdValue = 'powershell.exe -NoExit -Command \"$owner = (Get-ChildItem ''%1'' -Force).GetAccessControl().Owner; Write-Host \"\"Owner : $owner\"\"\"'
    
    # List of keys to create/update
    $ownerKeys = @(
        'HKEY_CURRENT_USER\Software\Classes\*\shell\Owner\command',
        'HKEY_CURRENT_USER\Software\Classes\Directory\shell\Owner\command',
        'HKEY_CURRENT_USER\Software\Classes\Drive\shell\Owner\command'
    )

    foreach ($key in $ownerKeys) {
        # Using reg add: /ve (default value), /t REG_SZ (type), /f (force/overwrite)
        # We use Start-Process with cmd /c to ensure zero-lag execution and background handling
        Start-Process cmd -ArgumentList "/c reg add `"$key`" /ve /t REG_SZ /d `"$cmdValue`" /f >nul 2>&1" -WindowStyle Hidden -Wait
        Write-Host "." -NoNewline -ForegroundColor Gray
    }

    Write-Host "`n[SUCCESS] 'Owner' check configured via reg.exe. ✅" -ForegroundColor Green
} else {
    Write-Host "Detected version $releaseVersion. Skipping configuration (Only for 26H1+). ⏩" -ForegroundColor Yellow
}

Write-Host ""

# --- 15. Disable Network Access in Modern Standby ---
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9"

# Ensure the registry key exists
if (!(Test-Path $regPath)) {
    [void](New-Item -Path $regPath -Force)
}

# Use the .NET Registry class to bypass PowerShell cmdlet parameter issues
$key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("SOFTWARE\Policies\Microsoft\Power\PowerSettings\f15576e8-98b7-4186-b944-eafa664402d9", $true)
if ($key) {
    $key.SetValue("ACSettingIndex", 0, [Microsoft.Win32.RegistryValueKind]::DWord)
    $key.Close()
}

Write-Host "Modern Standby network connectivity setting has been applied." -ForegroundColor Green
Write-Host ""

# 16. Show all browser tabs in Alt+Tab (Set to 0 to show open windows only, or 20 tabs)
Write-Host "-- Configuring Alt+Tab to show all tabs..." -ForegroundColor Gray
$altTabPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
Set-ItemProperty -Path $altTabPath -Name "MultiTaskingAltTabFilter" -Value 0 -Type DWord
Write-Host ""

# 17. Launch File Explorer to 'This PC' instead of 'Home/Quick Access'
Write-Host "-- Setting Explorer to launch to 'This PC'..." -ForegroundColor Gray
Set-ItemProperty -Path $altTabPath -Name "LaunchTo" -Value 1 -Type DWord
Write-Host ""

# 18. Increase Right-Click limit (MultipleInvokePromptMinimum) to 128 items
Write-Host "-- Increasing context menu limit for multiple files..." -ForegroundColor Gray
$explorerLimitPath = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Explorer"
if (!(Test-Path $explorerLimitPath)) { New-Item -Path $explorerLimitPath -Force | Out-Null }
Set-ItemProperty -Path $explorerLimitPath -Name "MultipleInvokePromptMinimum" -Value 129 -Type DWord
Write-Host ""

# 19. Prevent automatic restarts after updates while signed in
Write-Host "-- Preventing auto-reboot after Windows Updates..." -ForegroundColor Gray
$auPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
if (!(Test-Path $auPath)) { New-Item -Path $auPath -Force | Out-Null }
Set-ItemProperty -Path $auPath -Name "NoAutoRebootWithLoggedOnUsers" -Value 1 -Type DWord
Write-Host ""

# 20. Add all User Folders (Desktop, Music, etc.) under 'This PC' in Explorer
Write-Host "-- Adding user folders under 'This PC'..." -ForegroundColor Gray
$namespacePath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace"
$folders = @(
    "{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}", # Desktop
    "{d3162b92-9365-467a-956b-92703aca08af}", # Documents
    "{088e3905-0323-4b02-9826-5d99428e115f}", # Downloads
    "{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}", # Music
    "{24ad3ad4-a569-4530-98e1-ab02f9417aa8}"  # Pictures
)

foreach ($guid in $folders) {
    $path = Join-Path $namespacePath $guid
    if (!(Test-Path $path)) { New-Item -Path $path -Force | Out-Null }
    
    # Remove the block (equivalent to "HideIfEnabled"=-)
    Remove-ItemProperty -Path $path -Name "HideIfEnabled" -ErrorAction SilentlyContinue
    
    # Set as visible
    Set-ItemProperty -Path $path -Name "HiddenByDefault" -Value 0 -Type DWord
}

Write-Host ""
Write-Host "Registry tweaks applied successfully! ✅" -ForegroundColor Green
Write-Host "--------------------------------------------------------"
Write-Host ""

# 21. Browser Tweaks: Chrome, Brave, Edge & Firefox
Write-Host "-- Applying Browser Registry Tweaks (Chrome, Brave, Edge & Firefox)..." -ForegroundColor Gray

# List of registry paths for centralized policy management
$browserPaths = @(
    "HKLM:\SOFTWARE\Policies\Google\Chrome",
    "HKLM:\SOFTWARE\Policies\BraveSoftware\Brave",
    "HKLM:\SOFTWARE\Policies\Microsoft\Edge",
    "HKLM:\SOFTWARE\Policies\Mozilla\Firefox"
)

# Shared Policy Settings (Applies to most Chromium-based browsers and Firefox)
$sharedTweaks = @{
    "PasswordManagerEnabled"          = 1   # Keep "Offer to save passwords" active
    "MetricsReportingEnabled"         = 0   # Disable Telemetry and usage data collection
    "BackgroundModeEnabled"           = 0   # Prevent browser from running in the background after closing
    "HardwareAccelerationModeEnabled" = 0   # Disable GPU acceleration (useful for troubleshooting/stability)
    "ComponentUpdatesEnabled"         = 0   # Disable automatic internal component updates
    "BuiltInComponentUpdaterEnabled"  = 0   # Disable built-in cleanup and reporting tools
    "NetworkPredictionOptions"        = 2   # Disable DNS pre-fetching / Page prediction
    "SpellcheckEnabled"               = 0   # Disable built-in spellchecking service
}

# --- DISABLE CHROMIUM AI FEATURES ---
Write-Host "-- Disabling Chromium AI features (Edge / Chrome)..." -ForegroundColor Gray

$chromiumAIPathList = @(
    "HKLM:\SOFTWARE\Policies\Google\Chrome",
    "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
)

foreach ($aiPath in $chromiumAIPathList) {

    if (!(Test-Path $aiPath)) {
        New-Item -Path $aiPath -Force | Out-Null
    }

    # Disable local AI / foundational model features
    Set-ItemProperty -Path $aiPath -Name "GenAILocalFoundationalModelSettings" -Value 1 -Type DWord -ErrorAction SilentlyContinue
}

foreach ($basePath in $browserPaths) {
    # Create the key if it does not exist
    if (!(Test-Path $basePath)) { New-Item -Path $basePath -Force | Out-Null }
    
    # Determine the correct registry type (Firefox requires String for these policies)
    $type = if ($basePath -like "*Mozilla*") { "String" } else { "DWord" }
    
    foreach ($name in $sharedTweaks.Keys) {
        Set-ItemProperty -Path $basePath -Name $name -Value $sharedTweaks[$name] -Type $type -ErrorAction SilentlyContinue
    }

    # Remove DNS policies from HKLM ONLY for Brave to UNLOCK the button in the UI
    if ($basePath -like "*BraveSoftware*") {
        Remove-ItemProperty -Path $basePath -Name "DnsOverHttpsMode" -ErrorAction SilentlyContinue
        Remove-ItemProperty -Path $basePath -Name "DnsOverHttpsTemplates" -ErrorAction SilentlyContinue
    }
}

# --- FIREFOX SPECIFIC DEBLOAT ---
# Policies specifically for Mozilla Firefox's engine
$firefoxOnlyPath = "HKLM:\SOFTWARE\Policies\Mozilla\Firefox"
$firefoxTweaks = @{
    "DisableTelemetry"           = "1"  # Disable all telemetry reports
    "DisableFirefoxStudies"      = "1"  # Prevent Mozilla from running SHIELD studies
    "DisablePocket"              = "1"  # Remove the Pocket integration from the UI
    "DisableAppUpdate"           = "1"  # Stop Firefox from updating automatically
    "OverrideFirstRunPage"       = ""   # Skip the "Welcome" tab on new profiles
    "OverridePostUpdatePage"     = ""   # Skip the "What's New" tab after updates
    "DisableFirefoxScreenshots"  = "0"  # Keep screenshot tool enabled (useful utility)
    "DisableFirefoxAccounts"     = "0"  # Keep Firefox Sync enabled
    "DisableFeedbackCommands"    = "1"  # Remove "Submit Feedback" from menus
    "DisableDefaultBrowserAgent" = "1"  # Disable the service that checks if Firefox is default
    "DisableImportResources"     = "1"  # Disable prompts to import data from other browsers
    "DisableDeveloperTools"      = "0"  # Ensure Developer Tools remain enabled
    "DontCheckDefaultBrowser"    = "1"  # Disable the check for default browser
    "DisableBackgroundUpdate"    = "1"  # Disable background updates
}

foreach ($name in $firefoxTweaks.Keys) {
    Set-ItemProperty -Path $firefoxOnlyPath -Name $name -Value $firefoxTweaks[$name] -Type String -ErrorAction SilentlyContinue
}

# --- CHROME SPECIFIC DEBLOAT ---
# Policies for Google Chrome
$chromeOnlyPath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
$chromeTweaks = @{
    "SyncDisabled"               = 1        # Disable Sync
    "DefaultBrowserSettingEnabled" = 0      # Don't Check Default Browser
    "DeveloperToolsAvailability" = 1        # Enable Developer Mode
    "ChromeCleanupEnabled"       = 0        # Disable Chrome Cleanup Tool
    "ChromeCleanupReportingEnabled" = 0     # Disable Cleanup reporting
}

foreach ($name in $chromeTweaks.Keys) {
    Set-ItemProperty -Path $chromeOnlyPath -Name $name -Value $chromeTweaks[$name] -Type DWord -ErrorAction SilentlyContinue
}

# --- BRAVE SPECIFIC DEBLOAT ---
# Policies for Brave-specific features (Web3, Rewards, and AI)
$braveOnlyPath = "HKLM:\SOFTWARE\Policies\BraveSoftware\Brave"
$braveTweaks = @{
    "BraveVPNDisabled"           = 1        # Remove Brave VPN button and service
    "BraveWalletDisabled"        = 1        # Disable the built-in Crypto Wallet
    "BraveAIChatEnabled"         = 0        # Disable "Leo" AI Chat
    "BraveRewardsDisabled"       = 1        # Disable Brave Rewards/Ads
    "BraveTalkDisabled"          = 1        # Disable the "Brave Talk" video call feature
    "BraveNewsDisabled"          = 1        # Disable the Brave News feed on new tabs
    "SyncDisabled"               = 1        # Disable Sync
    "DefaultBrowserSettingEnabled" = 0      # Don't Check Default Browser
    "DeveloperToolsAvailability" = 1        # Enable Developer Mode
    "BuiltInDnsClientEnabled"    = 1        # Unlocks the internal DNS client (Button)
}

foreach ($name in $braveTweaks.Keys) {
    Set-ItemProperty -Path $braveOnlyPath -Name $name -Value $braveTweaks[$name] -Type DWord -ErrorAction SilentlyContinue
}

# --- MICROSOFT EDGE SPECIFIC DEBLOAT ---
# Extensive cleanup of Edge's tracking, shopping, and sidebar features
$edgeOnlyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
$edgeTweaks = @{
    "EdgeEnhanceImagesEnabled"         = 0  # Disable image super-resolution
    "PersonalizationReportingEnabled"  = 0  # Disable personalization telemetry
    "ShowRecommendationsEnabled"       = 0  # Remove recommendations from the UI
    "HideFirstRunExperience"           = 1  # Skip the massive "First Run" setup
    "UserFeedbackAllowed"              = 0  # Disable "Send Feedback"
    "ConfigureDoNotTrack"              = 1  # Enable "Do Not Track" header
    "AlternateErrorPagesEnabled"       = 0  # Disable Microsoft's error pages
    "EdgeCollectionsEnabled"           = 0  # Disable the "Collections" feature
    "EdgeFollowEnabled"                = 0  # Disable the "Follow Creator" feature
    "EdgeShoppingAssistantEnabled"     = 0  # Disable shopping/coupons popups
    "MicrosoftEdgeInsiderPromotionEnabled" = 0 # Disable Insider promotions
    "RelatedMatchesCloudServiceEnabled" = 0 # Disable cloud-based related searches
    "ShowMicrosoftRewards"             = 0  # Remove Rewards icon
    "WebWidgetAllowed"                 = 0  # Disable the Edge "Desktop Widget"
    "StartupBoostEnabled"              = 0  # Stop Edge from launching at Windows startup
    "BingAdsSuppression"               = 1  # Suppress Bing search ads
    "NewTabPageHideDefaultTopSites"    = 1  # Cleanup default sites on new tabs
    "PromotionalTabsEnabled"           = 0  # Disable "Promotional" popups
    "SendSiteInfoToImproveServices"    = 0  # Disable site tracking for "improvement"
    "SpotlightExperiencesAndRecommendationsEnabled" = 0 # Disable spotlight ads
    "DiagnosticData"                   = 0  # Set diagnostic data to minimal/off
    "EdgeAssetDeliveryServiceEnabled"  = 0  # Disable asset background delivery
    "CryptoWalletEnabled"              = 0  # Disable Edge Crypto Wallet
    "WalletDonationEnabled"            = 0  # Disable donation features in Wallet
    "HubsSidebarEnabled"               = 0  # Remove the Edge Sidebar
    "CopilotPageAction"                = 0  # Disable the Copilot icon/action
    "SmartScreenEnabled"               = 0  # Disable SmartScreen UI
    "SmartScreenPuaFullScanEnabled"    = 0  # Disable SmartScreen PUA full scan
    "DeveloperToolsAvailability"       = 1  # Enable Developer Mode tools
    "BuiltInMicrosoftFormsEnabled"     = 0  # Disable internal Microsoft forms
    "EdgeManagementEnabled"            = 0  # Minimize unnecessary remote management
    "SyncDisabled"                     = 1  # Disable Sync
}

foreach ($name in $edgeTweaks.Keys) {
    Set-ItemProperty -Path $edgeOnlyPath -Name $name -Value $edgeTweaks[$name] -Type DWord -ErrorAction SilentlyContinue
}

# --- UNLOCKED SETTINGS (PREFERENCES) ---
# Set initial values but allow manual toggle in the UI (No "Managed by organization" lock)

$userPaths = @(
    "HKCU:\Software\Google\Chrome",
    "HKCU:\Software\BraveSoftware\Brave",
    "HKCU:\Software\Microsoft\Edge"
)

foreach ($uPath in $userPaths) {
    if (!(Test-Path $uPath)) { New-Item -Path $uPath -Force | Out-Null }
    
    # Safe Browsing set to 0 (Disabled) but toggleable
    Set-ItemProperty -Path $uPath -Name "SafeBrowsingEnabled" -Value 0 -Type DWord -ErrorAction SilentlyContinue
    Set-ItemProperty -Path $uPath -Name "StatsReportingDisabled" -Value 1 -Type DWord -ErrorAction SilentlyContinue
}

# Firefox Specific (Manual Toggle)
$ffPath = "HKCU:\Software\Mozilla\Firefox"
if (!(Test-Path $ffPath)) { New-Item -Path $ffPath -Force | Out-Null }
Set-ItemProperty -Path $ffPath -Name "DisableTelemetry" -Value "1" -Type String -ErrorAction SilentlyContinue

# --- INTERACTIVE DNS OVER HTTPS WITH TIMEOUT (GOOGLE CHROME) ---
Write-Host "Do you want to enable Secure DNS (DNS Over HTTPS) for CHROME? [Y/N] (Default: N in 5s): " -NoNewline

$counterChrome = 5
while ($counterChrome -gt 0 -and (-not [console]::KeyAvailable)) {
    Write-Host "..$counterChrome " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $counterChrome--
}

if ([console]::KeyAvailable) {
    $choiceChromeDNS = [console]::ReadKey($true).KeyChar
    Write-Host ""
} else {
    Write-Host "`nTimeout reached. Disabling DNS Over HTTPS for Chrome..." -ForegroundColor Gray
    $choiceChromeDNS = "n"
}

# Mandatory Policy Injection: Chrome requires HKLM enforcement to override managed state.
# Value must be passed as String ("automatic" | "off") to maintain Chromium engine compatibility.
$chromePolicyPath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
if ($choiceChromeDNS -eq 'y' -or $choiceChromeDNS -eq 'Y') {
    Write-Host "-- Enabling DNS Over HTTPS for CHROME (Policy Mode)..." -ForegroundColor Cyan
    Set-ItemProperty -Path $chromePolicyPath -Name "DnsOverHttpsMode" -Value "automatic" -Type String -ErrorAction SilentlyContinue
} else {
    Write-Host "-- Disabling DNS Over HTTPS for CHROME..." -ForegroundColor Yellow
    Set-ItemProperty -Path $chromePolicyPath -Name "DnsOverHttpsMode" -Value "off" -Type String -ErrorAction SilentlyContinue
}

# --- CLEAR BUFFER ---
# Clears any leftover keystrokes so the next question doesn't skip
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }

# --- INTERACTIVE DNS OVER HTTPS WITH TIMEOUT (BRAVE ONLY) ---
Write-Host "Do you want to enable Secure DNS (DNS Over HTTPS) for BRAVE? [Y/N] (Default: N in 5s): " -NoNewline

$counterBrave = 5
while ($counterBrave -gt 0 -and (-not [console]::KeyAvailable)) {
    Write-Host "..$counterBrave " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $counterBrave--
}

if ([console]::KeyAvailable) {
    $choiceBraveDNS = [console]::ReadKey($true).KeyChar
    Write-Host ""
} else {
    Write-Host "`nTimeout reached. Skipping DNS config..." -ForegroundColor Gray
    $choiceBraveDNS = "n"
}

if ($choiceBraveDNS -eq 'y' -or $choiceBraveDNS -eq 'Y') {
    Write-Host "-- Enabling DNS Over HTTPS for BRAVE (Unlocked Mode)..." -ForegroundColor Cyan
    $braveUserPath = "HKCU:\Software\BraveSoftware\Brave"
    Set-ItemProperty -Path $braveUserPath -Name "DnsOverHttpsMode" -Value "automatic" -Type String -ErrorAction SilentlyContinue
} else {
    Write-Host "-- DNS Over HTTPS for Brave remains disabled or unchanged." -ForegroundColor Yellow
}

# --- DNS CACHE OPTIMIZATION ---
# Increases the efficiency of the local Windows DNS cache for faster page loads
$dnsPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters"
if (Test-Path $dnsPath) {
    Set-ItemProperty -Path $dnsPath -Name "CacheHashTableBucketSize" -Value 1 -Type DWord
    Set-ItemProperty -Path $dnsPath -Name "CacheHashTableSize" -Value 384 -Type DWord
    Set-ItemProperty -Path $dnsPath -Name "MaxCacheEntryTtlLimit" -Value 10800 -Type DWord # 3 hours
    Set-ItemProperty -Path $dnsPath -Name "MaxSOACacheEntryTtlLimit" -Value 301 -Type DWord
}

Write-Host "Browser tweaks applied successfully! ✅" -ForegroundColor Green
Write-Host "--------------------------------------------------------"
Write-Host ""

# --- 22. USER SECURITY (PASSWORD NEVER EXPIRES) ---
Write-Host "Updating password expiration policy for user: Admin..." -ForegroundColor Cyan

try {
    # Check if the user exists first
    if (Get-LocalUser -Name "Admin" -ErrorAction SilentlyContinue) {
        # Target the specific account and apply the 'Never Expires' flag
        # -ErrorAction Stop forces the command to jump to 'catch' if it fails
        Set-LocalUser -Name "Admin" -PasswordNeverExpires $true -ErrorAction Stop
        Write-Host "[Admin] Status changed to PASSWORD NEVER EXPIRES successfully." -ForegroundColor Green
    }
    else {
        Write-Host "[WARNING] User 'Admin' not found on this system. Skipping..." -ForegroundColor Yellow
    }
}
catch {
    Write-Host "[ERROR] Failed to update user 'Admin'. Ensure the script is running with Administrative privileges." -ForegroundColor Red
}

Write-Host "--------------------------------------------------------"

# --- 23. ENABLE DETAILED BSOD ---
Write-Host "Enabling Detailed Blue Screen of Death (BSOD) information..." -ForegroundColor Cyan
try {
    $bsodPath = "HKLM:\System\CurrentControlSet\Control\CrashControl"
    if (-not (Test-Path $bsodPath)) { New-Item -Path $bsodPath -Force | Out-Null }
    Set-ItemProperty -Path $bsodPath -Name "DisplayParameters" -Value 1 -Type DWord -Force
    Write-Host "[SUCCESS] Detailed BSOD information enabled." -ForegroundColor Green
}
catch {
    Write-Host "[ERROR] Failed to set Detailed BSOD parameters." -ForegroundColor Red
}

Write-Host ""

##------------------------------------------------------##

# --- Performance and Telemetry Optimizations ---
Write-Host "--------------------------------------------------------" -ForegroundColor Cyan
Write-Host "Applying System and Office optimizations..." -ForegroundColor Cyan

# 1. Mouse and UI Responsiveness
Write-Host "-- Disabling Mouse Delay and Acceleration..." -ForegroundColor Gray
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name "MenuShowDelay" -Value "0" -Force
Set-ItemProperty -Path "HKCU:\Control Panel\Mouse" -Name "MouseHoverTime" -Value "0" -Force
Set-ItemProperty -Path "HKCU:\Control Panel\Mouse" -Name "MouseSpeed" -Value "0" -Force
Set-ItemProperty -Path "HKCU:\Control Panel\Mouse" -Name "MouseThreshold1" -Value "0" -Force
Set-ItemProperty -Path "HKCU:\Control Panel\Mouse" -Name "MouseThreshold2" -Value "0" -Force

# 2. System Services (Prefetch/SysMain)
Write-Host "-- Disabling SysMain (Prefetch)..." -ForegroundColor Gray
Stop-Service -Name "sysmain" -ErrorAction SilentlyContinue
Set-Service -Name "sysmain" -StartupType Disabled

# 3. Telemetry (PowerShell & Office)
Write-Host "-- Disabling PowerShell and Office telemetry..." -ForegroundColor Gray
# PowerShell Telemetry
[Environment]::SetEnvironmentVariable("POWERSHELL_TELEMETRY_OPTOUT", "1", "Machine")

# Office Telemetry Registry Keys
$officeKeys = @(
    "HKCU:\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail", "HKCU:\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail",
    "HKCU:\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar", "HKCU:\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar",
    "HKCU:\SOFTWARE\Microsoft\Office\15.0\Word\Options", "HKCU:\SOFTWARE\Microsoft\Office\16.0\Word\Options",
    "HKCU:\SOFTWARE\Policies\Microsoft\Office\15.0\OSM", "HKCU:\SOFTWARE\Policies\Microsoft\Office\16.0\OSM",
    "HKCU:\SOFTWARE\Microsoft\Office\Common\ClientTelemetry", "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry",
    "HKCU:\SOFTWARE\Microsoft\Office\15.0\Common", "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common",
    "HKCU:\SOFTWARE\Microsoft\Office\15.0\Common\Feedback", "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Feedback"
)

foreach ($key in $officeKeys) {
    if (!(Test-Path $key)) { New-Item -Path $key -Force | Out-Null }
}

Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" -Name "DisableTelemetry" -Value 1 -Type DWord -Force
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" -Name "DisableTelemetry" -Value 1 -Type DWord -Force
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" -Name "VerboseLogging" -Value 0 -Type DWord -Force
# ... (Additional Office keys follow the same pattern)

# Office Scheduled Tasks
$officeTasks = @(
    "\Microsoft\Office\OfficeTelemetryAgentFallBack", "\Microsoft\Office\OfficeTelemetryAgentLogOn",
    "\Microsoft\Office\OfficeTelemetryAgentFallBack2016", "\Microsoft\Office\OfficeTelemetryAgentLogOn2016",
    "\Microsoft\Office\Office 15 Subscription Heartbeat", "\Microsoft\Office\Office 16 Subscription Heartbeat"
)
foreach ($task in $officeTasks) {
    Disable-ScheduledTask -TaskName $task -ErrorAction SilentlyContinue
}

Write-Host ""

##------------------------------------------------------##

# 4. Gaming (Game Mode, Game Bar, Xbox Rec)
Write-Host "-- Disabling Game Mode, Game Bar, and Xbox Recording..." -ForegroundColor Gray
# HKLM Settings
$gameHKLM = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\GameDVR"
if (!(Test-Path $gameHKLM)) { New-Item -Path $gameHKLM -Force | Out-Null }
Set-ItemProperty -Path $gameHKLM -Name "AutoGameModeEnabled" -Value 0 -Type DWord -Force
Set-ItemProperty -Path $gameHKLM -Name "AppCaptureEnabled" -Value 0 -Type DWord -Force

# Policies
$gamePolicy = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR"
if (!(Test-Path $gamePolicy)) { New-Item -Path $gamePolicy -Force | Out-Null }
Set-ItemProperty -Path $gamePolicy -Name "AllowGameDVR" -Value 0 -Type DWord -Force

# HKCU Settings
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\GameBar" -Name "AutoGameModeEnabled" -Value 0 -Type DWord -Force
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\GameBar" -Name "UseNexusForGameBarEnabled" -Value 0 -Type DWord -Force
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\GameBar" -Name "ShowStartupPanel" -Value 0 -Type DWord -Force
Set-ItemProperty -Path "HKCU:\System\GameConfigStore" -Name "GameDVR_Enabled" -Value 0 -Type DWord -Force

Write-Host "Optimizations applied successfully! ✅" -ForegroundColor Green
Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# --- Function to check if a command exists ---
function Test-CommandExists {
    param([string]$Command)
    $null -ne (Get-Command -Name $Command -ErrorAction SilentlyContinue)
}

# --- Function to check for AutoHotkey v2+ installation ---
# This function checks for AutoHotkey v2 or newer, regardless of the subfolder it's installed in.
function Test-AutoHotkeyV2Installed {
    $programFiles = [System.Environment]::GetFolderPath([System.Environment+SpecialFolder]::ProgramFiles)
    $programFilesX86 = [System.Environment]::GetFolderPath([System.Environment+SpecialFolder]::ProgramFilesX86)

    # Define possible base directories for AutoHotkey installations
    $ahkBasePaths = @(
        (Join-Path $programFiles "AutoHotkey")
        (Join-Path $programFilesX86 "AutoHotkey")
    )

    # Define possible AutoHotkey executable names
    $ahkExecutables = @(
        "AutoHotkeyU64.exe"
        "AutoHotkeyU32.exe"
        "AutoHotkey.exe" # For cases where it might just be AutoHotkey.exe in PATH
    )

    Write-Host "Searching for AutoHotkey (v2 or newer) in standard paths..."

    foreach ($basePath in $ahkBasePaths) {
        if (Test-Path $basePath) {
            Write-Host "Searching for AutoHotkey executables under: $basePath"
            # Look for executables in $basePath and up to 2 levels deep in subdirectories
            # This covers structures like "AutoHotkey\AutoHotkey.exe" or "AutoHotkey\v2\AutoHotkey.exe"
            $foundExecutables = Get-ChildItem -Path $basePath -Filter "*.exe" -Recurse -Depth 2 -ErrorAction SilentlyContinue | Where-Object { $_.Name -in $ahkExecutables }

            foreach ($exe in $foundExecutables) {
                try {
                    $versionInfo = (Get-Item $exe.FullName).VersionInfo
                    # The ProductMajorPart -ge 2 logic correctly checks for v2 or GREATER
                    if ($versionInfo.ProductMajorPart -ge 2) {
                        Write-Host "AutoHotkey (v2 or newer) detected at '$($exe.FullName)': $($versionInfo.ProductVersion)"
                        return $true
                    }
                } catch {
                    Write-Warning "Could not get AutoHotkey version information for '$($exe.FullName)': $($_.Exception.Message)"
                }
            }
        }
    }

    # Check if autohotkey.exe is in the PATH and its version
    if (Test-CommandExists "autohotkey.exe") {
        Write-Host "AutoHotkey executable 'autohotkey.exe' found in PATH. Checking version..."
        try {
            $ahkPath = (Get-Command "autohotkey.exe").Source
            $versionInfo = (Get-Item $ahkPath).VersionInfo
            # The ProductMajorPart -ge 2 logic correctly checks for v2 or GREATER
            if ($versionInfo.ProductMajorPart -ge 2) {
                Write-Host "AutoHotkey (v2 or newer) detected in PATH: $($versionInfo.ProductVersion)"
                return $true
            } else {
                Write-Host "AutoHotkey found in PATH is an older version ($($versionInfo.ProductVersion)). A compatible version will be installed."
                return $false
            }
        } catch {
            Write-Warning "Could not get AutoHotkey version info from PATH executable: $($_.Exception.Message). Assuming not v2+ or problematic."
            return $false
        }
    }

    Write-Host "AutoHotkey (v2 or newer) not detected via standard paths or PATH."
    return $false
}

Write-Host ""

##------------------------------------------------------##

# --- Function to check for Python v3+ installation ---
function Test-PythonInstalled {
    Write-Host "Checking for Python v3+ installation..."

    # Common Python executable names
    $pythonExecutables = @("python.exe", "python3.exe", "py.exe")

    # Common Python installation paths (beyond just PATH)
    $pythonSearchPaths = @(
        "$env:LOCALAPPDATA\Programs\Python" # Common for Python installers
        "$env:ProgramFiles\Python*"         # Wildcard for specific Python versions (e.g., Python39)
        "$env:ProgramFiles(x86)\Python*"
    )

    # Function to get Python version securely
    function Get-PythonVersion($exePath) {
        try {
            # Use Start-Process with -NoNewWindow and -RedirectStandardOutput to capture output reliably
            # Redirecting StandardError to null.
            $processInfo = New-Object System.Diagnostics.ProcessStartInfo
            $processInfo.FileName = $exePath
            $processInfo.Arguments = "--version"
            $processInfo.UseShellExecute = $false
            $processInfo.RedirectStandardOutput = $true
            $processInfo.RedirectStandardError = $true # Redirect stderr
            $processInfo.CreateNoWindow = $true

            $process = New-Object System.Diagnostics.Process
            $process.StartInfo = $processInfo
            $process.Start() | Out-Null
            $process.WaitForExit()

            $output = $process.StandardOutput.ReadToEnd().Trim()
            $errorOutput = $process.StandardError.ReadToEnd().Trim()

            if (![string]::IsNullOrEmpty($errorOutput)) {
                # Log error output but don't let it prevent version parsing if output is still there
                Write-Warning "stderr from '$exePath --version': $errorOutput"
            }

            if ($output -match "Python (\d+)\.(\d+)(\.\d+)?") {
                $major = [int]$Matches[1]
                $minor = [int]$Matches[2]
                return @{ Major = $major; Minor = $minor; FullVersion = $output }
            }
        } catch {
            Write-Warning "Error executing '$exePath --version': $($_.Exception.Message)"
        }
        return $null
    }

    # 1. Check in PATH first
    foreach ($exeName in $pythonExecutables) {
        if (Test-CommandExists $exeName) {
            Write-Host "Found '$exeName' in PATH. Attempting to get version..."
            $versionResult = Get-PythonVersion $exeName
            if ($versionResult) {
                if ($versionResult.Major -ge 3) {
                    Write-Host "Python (v3 or newer) detected via '$exeName': $($versionResult.FullVersion)"
                    return $true
                } else {
                    Write-Host "Python found via '$exeName' ($($versionResult.FullVersion)) is an older version (less than v3). Will attempt installation of compatible version."
                }
            } else {
                Write-Warning "Could not get parseable Python version from '$exeName --version'."
            }
        }
    }

    # 2. Search specific installation paths
    foreach ($searchPath in $pythonSearchPaths) {
        Write-Host "Searching for Python in specific paths like: $searchPath"
        # Find any python.exe, python3.exe, py.exe in these common install locations or their subfolders
        # Using -Filter "*" and then Where-Object to handle multiple patterns correctly
        $foundPythonExecutables = Get-ChildItem -Path $searchPath -Filter "*" -Recurse -Depth 3 -ErrorAction SilentlyContinue |
                                  Where-Object { $_.Name -like "python*.exe" -or $_.Name -eq "py.exe" }

        foreach ($exe in $foundPythonExecutables) {
            Write-Host "Found potential Python executable: $($exe.FullName). Checking version..."
            $versionResult = Get-PythonVersion $exe.FullName
            if ($versionResult) {
                if ($versionResult.Major -ge 3) {
                    Write-Host "Python (v3 or newer) detected at '$($exe.FullName)': $($versionResult.FullVersion)"
                    return $true
                } else {
                    Write-Host "Python found at '$($exe.FullName)' ($($versionResult.FullVersion)) is an older version (less than v3). Will attempt installation of compatible version."
                }
            } else {
                Write-Warning "Could not get parseable Python version from '$($exe.FullName) --version'."
            }
        }
    }

    Write-Host "Python (v3 or newer) not detected via any robust checks. Installation will proceed."
    return $false
}

Write-Host ""

##------------------------------------------------------##

# --- 1. Check for Chocolatey and Install if Missing ---
Write-Host "Checking for Chocolatey installation..."
if (-not (Test-CommandExists "choco")) {
    Write-Host "Chocolatey not found. Attempting to install Chocolatey..."
    if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
        Write-Error "To install Chocolatey, you MUST run this script as an Administrator."
        Write-Error "Please right-click on this .ps1 file and select 'Run as Administrator'."
        exit 1
    }
    try {
        $chocoInstallCommand = "Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))"
        Invoke-Expression $chocoInstallCommand
        Write-Host "Chocolatey installed successfully."
        # Update PATH environment variables for the current session
        $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "User")
        $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Process")
    }
    catch {
        $errorMessage = $_.Exception.Message
        Write-Error ("Failed to install Chocolatey. Error: {0}" -f $errorMessage)
        Write-Error "Please check your internet connection or try installing manually."
        exit 1
    }
} else {
    Write-Host "Chocolatey is already installed."
}

# --- 2. Check for Winget and Install if Missing ---
Write-Host "Checking for Winget installation..."
if (-not (Test-CommandExists "winget")) {
    Write-Host "Winget not found. Attempting to install Winget..."
    try {
        Invoke-WebRequest -Uri "https://raw.githubusercontent.com/asheroto/winget-install/master/winget-install.ps1" -OutFile "$env:TEMP\winget-install.ps1" -ErrorAction Stop; & "$env:TEMP\winget-install.ps1"
        Write-Host "Winget installed successfully."
    }
    catch {
        $errorMessage = $_.Exception.Message
        Write-Error ("Failed to install Winget. Error: {0}" -f $errorMessage)
        Write-Error "Please check your internet connection or try installing manually."
        exit 1
    }
} else {
    Write-Host "Winget is already installed."
}

# --- 3. Check for AutoHotkey (v2+) and Install via Winget if Missing ---
Write-Host "Checking for AutoHotkey (v2 or newer) installation..."
if (-not (Test-AutoHotkeyV2Installed)) {
    Write-Host "AutoHotkey not found or not the correct version. Attempting to install AutoHotkey via Winget..."
    try {
        winget install AutoHotkey.AutoHotkey --silent --accept-source-agreements --accept-package-agreements
        if ($LASTEXITCODE -ne 0) {
            Write-Warning "Failed to install AutoHotkey via Winget. Exit code: $LASTEXITCODE"
        } else {
            Write-Host "AutoHotkey installed successfully via Winget."
        }
    }
    catch {
        $errorMessage = $_.Exception.Message
        Write-Error ("An error occurred while trying to install AutoHotkey via Winget: {0}" -f $errorMessage)
        exit 1
    }
} else {
    Write-Host "AutoHotkey is already installed and is the correct version."
}

Write-Host ""

##------------------------------------------------------##

# --- Function to get PowerShell 7 (pwsh) version ---
function Get-PwshVersion {
    try {
        # Execute pwsh with --version and capture output
        # Use pwsh.exe directly to ensure we're getting the .NET Core PowerShell version
        $versionOutput = (pwsh.exe --version 2>&1).Trim()
        if ($versionOutput -match "PowerShell (\d+\.\d+\.\d+)") {
            return [version]$Matches[1]
        }
    } catch {
        Write-Warning "Could not get PowerShell 7 version: $($_.Exception.Message)"
    }
    return $null
}

Write-Host ""

# --- 3.5. Install/Update PowerShell 7 (pwsh) via Winget ---
Write-Host "Checking for PowerShell 7 (pwsh) installation and updates..."
$pwshInstalledVersion = $null # Initialize to null
if (Test-CommandExists "pwsh") {
    $pwshInstalledVersion = Get-PwshVersion
}

if ($pwshInstalledVersion) {
    Write-Host "PowerShell 7 (pwsh) detected: Version $($pwshInstalledVersion)"

    # Get the latest available version from Winget
    try {
        # Using winget show for more structured output, then parsing
        $wingetShowOutput = winget show Microsoft.PowerShell --exact
        $latestPwshVersionString = ""

        # Extract version from the "Version:" line. This is more robust.
        $versionLine = $wingetShowOutput | Select-String -Pattern "Version:\s*(\S+)"
        if ($versionLine) {
            $latestPwshVersionString = $versionLine.Matches.Groups[1].Value
        }

        if ($latestPwshVersionString -and ($latestPwshVersionString -notlike "*< Not Available >*")) { # Check for "Not Available" case
            $latestPwshVersion = [version]$latestPwshVersionString
            Write-Host "Latest PowerShell 7 version available via Winget: $($latestPwshVersion)"

            if ($pwshInstalledVersion -lt $latestPwshVersion) {
                Write-Host "Installed PowerShell 7 version is older. Attempting to update via Winget..."
                winget upgrade Microsoft.PowerShell -e --accept-package-agreements --accept-source-agreements
                if ($LASTEXITCODE -ne 0) {
                    Write-Warning "Failed to update PowerShell 7 via Winget. Exit code: $LASTEXITCODE"
                } else {
                    Write-Host "PowerShell 7 updated successfully via Winget."
                    # Reload PATH for the current session after update, if needed.
                    # This is often done by Winget's installer, but it's good practice for the current session.
                    $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "User")
                    Write-Host "Current session PATH reloaded."
                }
            } else {
                Write-Host "PowerShell 7 is already at the latest version or newer. No update needed."
            }
        } else {
            Write-Warning "Could not determine the latest PowerShell 7 version from Winget (output: '$latestPwshVersionString'). Skipping update check."
        }
    }
    catch {
        $errorMessage = $_.Exception.Message
        Write-Error ("An error occurred while trying to check/update PowerShell 7 via Winget: {0}" -f $errorMessage)
    }
} else {
    Write-Host "PowerShell 7 (pwsh) not found. Attempting to install PowerShell 7 via Winget..."
    try {
        winget install Microsoft.PowerShell -e --accept-package-agreements --accept-source-agreements
        if ($LASTEXITCODE -ne 0) {
            Write-Warning "Failed to install PowerShell 7 via Winget. Exit code: $LASTEXITCODE"
        } else {
            Write-Host "PowerShell 7 installed successfully via Winget."
            # The PowerShell 7 installer should add pwsh.exe to the PATH.
            # However, to ensure it's available in the current session, we can reload the Path.
            $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "User")
            Write-Host "PATH updated for the current session."
        }
    }
    catch {
        $errorMessage = $_.Exception.Message
        Write-Error ("An error occurred while trying to install PowerShell 7 via Winget: {0}" -f $errorMessage)
        exit 1
    }
}
Write-Host "" # Add a blank line for readability

##------------------------------------------------------##

# ============================================================
# Hybrid PowerShell + Windows Terminal Configuration
# ============================================================

Write-Host "`n[INFO] Starting system configuration..." -ForegroundColor Cyan

# ------------------------------------------------------------
# Step 1: Ensure PowerShell 7 exists
# ------------------------------------------------------------
$pwsh = Get-Command pwsh -ErrorAction SilentlyContinue

if (-not $pwsh) {
    Write-Host "[ERROR] PowerShell 7 not found." -ForegroundColor Red
    exit 1
}

$pwshPath = $pwsh.Source
Write-Host "[OK] PowerShell 7: $pwshPath" -ForegroundColor Green

# ------------------------------------------------------------
# Step 2: Detect Windows Terminal
# ------------------------------------------------------------
Write-Host "`n[INFO] Checking Windows Terminal..." -ForegroundColor Cyan

$wtPath = "$env:LOCALAPPDATA\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json"

$hasWT = Test-Path $wtPath

if ($hasWT) {
    Write-Host "[OK] Windows Terminal detected." -ForegroundColor Green

    # --------------------------------------------------------
    # Terminal configuration
    # --------------------------------------------------------
    try {
        Copy-Item $wtPath "$wtPath.bak" -Force

        $json = Get-Content $wtPath -Raw | ConvertFrom-Json

        # find or create pwsh profile
        $profile = $json.profiles.list | Where-Object { $_.commandline -match "pwsh" } | Select-Object -First 1

        if (-not $profile) {
            $profile = @{
                guid        = "{$(New-Guid)}"
                name        = "PowerShell 7"
                commandline = $pwshPath
                hidden      = $false
            }

            $json.profiles.list += $profile
        }

        # set default
        $json.defaultProfile = $profile.guid

        # Appearance
        if (-not $json.profiles.defaults) {
            $json.profiles | Add-Member -MemberType NoteProperty -Name "defaults" -Value @{} -Force
        }

        $json.profiles.defaults.useAcrylic = $true
        $json.profiles.defaults.opacity = 80

        $json | ConvertTo-Json -Depth 100 | Set-Content $wtPath -Encoding UTF8

        Write-Host "[OK] Windows Terminal configured." -ForegroundColor Green
    }
    catch {
        Write-Host "[WARN] Windows Terminal config failed but system will continue." -ForegroundColor Yellow
    }
}
else {
    Write-Host "[WARN] Windows Terminal NOT installed." -ForegroundColor Yellow
    Write-Host "[INFO] Skipping terminal configuration." -ForegroundColor DarkGray
}

# ------------------------------------------------------------
# Step 3: SYSTEM-LEVEL PowerShell 7 default behavior
# (Works even without Windows Terminal)
# ------------------------------------------------------------

Write-Host "`n[INFO] Applying system shell preferences..." -ForegroundColor Cyan

try {

    # Console host fallback behavior
    $consoleKey = "HKCU:\Console"

    if (-not (Test-Path $consoleKey)) {
        New-Item $consoleKey -Force | Out-Null
    }

    # Improve console behavior (pwsh friendly)
    Set-ItemProperty -Path $consoleKey -Name "ForceV2" -Value 1 -ErrorAction SilentlyContinue

    # Set default command line (where applicable)
    Set-ItemProperty -Path $consoleKey -Name "CurrentUser" -Value $pwshPath -ErrorAction SilentlyContinue

    Write-Host "[OK] System console preferences applied." -ForegroundColor Green
}
catch {
    Write-Host "[WARN] System registry tweak skipped (not critical)." -ForegroundColor Yellow
}

# ------------------------------------------------------------
# DONE
# ------------------------------------------------------------
Write-Host "`n[SUCCESS] System configured (hybrid mode)!" -ForegroundColor Green
Write-Host " - PowerShell 7 ready" -ForegroundColor Gray
Write-Host " - Windows Terminal applied if available" -ForegroundColor Gray
Write-Host ""

##------------------------------------------------------##

# --- 4 Optional Category with 5-second Timeout ---
    $optionalPackages = @("fxsound", "github-desktop", "forkgram", "qbittorrent-enhanced", "veracrypt", "element-desktop")
    $shell = New-Object -ComObject WScript.Shell

    Write-Host "`n--- Optional Software Check ---" -ForegroundColor Cyan

    foreach ($package in $optionalPackages) {
        # Popup parameters: (Message, SecondsToWait, Title, ButtonType)
        # ButtonType 4 + 32 = Yes/No buttons + Question Icon
        $msg = "Do you want to install [$package]?`n(Automatically skips in 5 seconds)"
        $response = $shell.Popup($msg, 5, "Optional Installation", 4 + 32)

        if ($response -eq 6) { # 6 = 'Yes' button clicked
            Write-Host "Installing $package..." -ForegroundColor Green
            try {
                if ((choco list --local-only --exact $package -r).Count -eq 0) {
                    choco install $package -y --no-progress
                } else {
                    Write-Host "$package is already installed."
                }
            }
            catch {
                Write-Error "Failed to install $package."
            }
        } else {
            # -1 = Timeout, 7 = 'No' button clicked
            Write-Host "Skipping $package (denied or timeout)." -ForegroundColor Yellow
        }
    }

Write-Host ""

##------------------------------------------------------##

# --- AUTOMATIC MEDIA EXTENSIONS DEPLOYMENT ---
Write-Host "`n[MODULE] Deploying Universal Media Extensions..." -ForegroundColor Cyan

$hevcPath = "$env:TEMP\HEVC_Latest.AppxBundle"

# 1. HEVC CHECK & SMART UPDATE LOGIC
Write-Host ">> Checking system for: HEVC Video Extension (OEM)... " -ForegroundColor Yellow -NoNewline

# Bypass potential interactive prompts for the current scope
$ConfirmPreference = 'None'

$hevcPkg = Get-AppxPackage -Name "Microsoft.HEVCVideoExtension" -AllUsers

try {
    # Website scraping for version and link
    $baseUrl = "https://www.free-codecs.com/hevc-video-extensions-from-device-manufacturer_download.htm"
    $ua = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36"
    
    # ADDED -UseBasicParsing to prevent the security warning/interactive prompt
    $page = Invoke-WebRequest -Uri $baseUrl -UserAgent $ua -UseBasicParsing -ErrorAction Stop
    
    # Extracting the newest version string
    if ($page.Content -match '(\d+\.\d+\.\d+\.\d+)') { $latestVer = [version]$matches[1] } else { $latestVer = [version]"0.0.0.0" }
    
    # Extracting download link
    $regex = 'download_soft\.php\?d=[a-f0-9]+&s=\d+'
    $linkMatch = [regex]::Match($page.Content, $regex)

    if ($null -ne $hevcPkg) {
        $currentVer = [version]$hevcPkg.Version
        Write-Host "[FOUND: $currentVer]" -ForegroundColor Green

        if ($latestVer -gt $currentVer) {
            Write-Host ">> Status: [UPDATE AVAILABLE: $latestVer]" -ForegroundColor Cyan
            $shouldDownload = $true
        } else {
            Write-Host ">> Status: [ALREADY INSTALLED - UP TO DATE]" -ForegroundColor Gray
            $shouldDownload = $false
        }
    } else {
        Write-Host "[NOT FOUND]" -ForegroundColor White
        $shouldDownload = $true
    }

    # Action: Download and Install if needed
    if ($shouldDownload -and $linkMatch.Success) {
        Write-Host ">> Action: Downloading and Updating to $latestVer... " -ForegroundColor Yellow -NoNewline
        $downloadUrl = "https://www.free-codecs.com/$($linkMatch.Value)"
        
        # ADDED -UseBasicParsing here as well for the download
        Invoke-WebRequest -Uri $downloadUrl -OutFile $hevcPath -UserAgent $ua -MaximumRedirection 5 -UseBasicParsing -ErrorAction Stop
        
        # Force update by installing the newer AppxBundle
        Add-AppxPackage -Path $hevcPath -ErrorAction Stop
        Write-Host "[SUCCESS]" -ForegroundColor Green
    }

} catch {
    Write-Host "[FAILED TO SYNC/INSTALL HEVC]" -ForegroundColor Red
} finally {
    if (Test-Path $hevcPath) { Remove-Item $hevcPath -Force -ErrorAction SilentlyContinue }
}

Write-Host "--------------------------------------------------------"
Write-Host ""

# 2. ADDITIONAL MEDIA EXTENSIONS VIA WINGET
$extensions = @(
    @{ Name = "JPEG XL Image Extension";   ID = "9mzprth5c0tb"; Pkg = "*JxlImageExtension*" }
    @{ Name = "HEIF Image Extension";      ID = "9pmmsr1cgpwg"; Pkg = "*HEIFVideoExtension*" }
    @{ Name = "WebP Image Extension";      ID = "9pg2dk419drg"; Pkg = "*WebpExtension*" }
    @{ Name = "Web Media Extension";       ID = "9n5tdp8vcmhs"; Pkg = "*WebMediaExtensions*" }
    @{ Name = "Raw Image Extension";       ID = "9nctdw2w1bh8"; Pkg = "*RawImageExtension*" }
    @{ Name = "AV1 Video Extension";       ID = "9mvzqvxjbq9v"; Pkg = "*AV1VideoExtension*" }
    @{ Name = "VP9 Video Extension";       ID = "9n4d0msmp0pt"; Pkg = "*VP9VideoExtensions*" }
    @{ Name = "MPEG-2 Video Extension";    ID = "9n95q1zzpmh4"; Pkg = "*MPEG2VideoExtension*" }
)

foreach ($ext in $extensions) {
    Write-Host ">> Processing: $($ext.Name)... " -ForegroundColor Yellow -NoNewline
    
    # WinGet silent install
    $null = winget install --id $($ext.ID) --exact --silent --accept-package-agreements --accept-source-agreements --disable-interactivity 2>&1 > $null
    $exitCode = $LASTEXITCODE
    
    $currentPkg = Get-AppxPackage -Name $($ext.Pkg) -AllUsers | Select-Object -First 1
    $ver = "N/A"

    if ($currentPkg) {
        $ver = $currentPkg.Version
    } else {
        $wingetInfo = winget list --id $($ext.ID) --exact 2>$null | Out-String
        if ($wingetInfo -match '(\d+\.\d+\.\d+\.\d+)') { $ver = $matches[1] }
    }

    if ($exitCode -eq 0) {
        Write-Host "[INSTALLED/UPDATED: $ver]" -ForegroundColor Green
    } elseif ($exitCode -eq -1978335189) {
        Write-Host "[FOUND: $ver]" -ForegroundColor Green
        Write-Host "   -> Status: [ALREADY INSTALLED - UP TO DATE]" -ForegroundColor Gray
    } else { 
        Write-Host "[FAILED / CODE: $exitCode]" -ForegroundColor Red 
    }
}

Write-Host "`n--- Media Extensions Deployment Finished ---" -ForegroundColor Cyan
Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# --- ICAROS THUMBNAILER (IMAGES AND VIDEOS) ---
Write-Host "FIX THUMBNAILS FINAL [2/2]" -ForegroundColor Cyan

# --- ICAROS THUMBNAILER DEPLOYMENT (AUTOMATED GITHUB DELIVERY) ---
Write-Host "[MODULE] Checking Icaros Thumbnailer via GitHub API..." -ForegroundColor Cyan

# Ensure modern TLS 1.2 protocol is used for GitHub API connectivity
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# 1. RETRIEVE LATEST METADATA FROM GITHUB REPOSITORY API
try {
    # GitHub API requires a User-Agent header to prevent 403 Forbidden errors
    $headers = @{ "User-Agent" = "PowerShell-Icaros-Updater" }
    $apiUri  = "https://api.github.com/repos/Xanashi/Icaros/releases/latest"
    $apiResponse = Invoke-RestMethod -Uri $apiUri -Headers $headers -ErrorAction Stop
    
    $latestTag = $apiResponse.tag_name # Example: v3.3.5 or v3.3.4b1
    
    # ROBUST VERSION EXTRACTION: Capture only the primary [Major.Minor.Patch] sequence.
    # This prevents 'b1' from being interpreted as '1', avoiding the '41' version logic error.
    if ($latestTag -match '(\d+\.\d+\.\d+)') {
        $targetVersionStr = $matches[1]
    } else {
        $targetVersionStr = ($latestTag -replace '[^0-9.]', '').Trim('.')
    }
    
    $targetVerObj = [version]$targetVersionStr
    # Filter release assets to find the primary executable installer
    $downloadUrl = ($apiResponse.assets | Where-Object { $_.name -like "*.exe" }).browser_download_url
} catch {
    Write-Host "[ERROR] GitHub API Communication Failure: $($_.Exception.Message)" -ForegroundColor Red
    return
}

$installDir    = "$env:ProgramFiles\Icaros"
$versionMarker = "$installDir\version.txt"
$tempPath      = "$env:TEMP\Icaros_Latest.exe"
$shouldInstall = $false

# 2. VALIDATE CURRENT INSTALLATION VIA LOCAL MARKER
if (Test-Path $versionMarker) {
    $content = (Get-Content $versionMarker -Raw).Trim()
    
    # CRITICAL DATA CORRECTION: Override the bugged "3.3.41.0" entry created by previous logic.
    if ($content -eq "3.3.41.0" -or $content -eq "3.3.41") {
        Write-Host ">> Bugged Version Detected (3.3.41.0). Forcing reset for update..." -ForegroundColor Yellow
        $currentVerObj = [version]"0.0.0.0"
    } else {
        # Normalize local version to 3-part standard for fair comparison against GitHub metadata
        if ($content -match '(\d+\.\d+\.\d+)') {
            $currentVerObj = [version]$matches[1]
        } else {
            $currentVerObj = [version]"0.0.0.0"
        }
    }
    Write-Host ">> Current Version (Validated): $currentVerObj" -ForegroundColor Green
} else {
    $currentVerObj = [version]"0.0.0.0"
    $shouldInstall = $true
}

# 3. VERSION COMPARISON LOGIC
Write-Host ">> Latest Version (GitHub): $targetVerObj ($latestTag)" -ForegroundColor White

if ($targetVerObj -gt $currentVerObj) {
    Write-Host ">> Status: [UPDATE REQUIRED]" -ForegroundColor Cyan
    $shouldInstall = $true
} else {
    Write-Host ">> Status: [ALREADY UP TO DATE]" -ForegroundColor Gray
}

# 4. EXECUTE DEPLOYMENT PHASE
if ($shouldInstall -and $downloadUrl) {
    Write-Host "`n[NOTICE] Syncing Icaros to version $latestTag..." -ForegroundColor Cyan
    
    try {
        Write-Host ">> Downloading... " -ForegroundColor Yellow -NoNewline
        Invoke-WebRequest -Uri $downloadUrl -OutFile $tempPath -UserAgent "Mozilla/5.0" -ErrorAction Stop
        Write-Host "[OK]" -ForegroundColor Green

        Write-Host ">> Executing Silent Installer (InnoSetup)... " -ForegroundColor Yellow -NoNewline
        # /VERYSILENT: Automated install | /SUPPRESSMSGBOXES: No prompts | /NORESTART: Avoid reboot
        $process = Start-Process -FilePath $tempPath -ArgumentList "/VERYSILENT /SUPPRESSMSGBOXES /NORESTART" -Wait -PassThru
        
        if ($process.ExitCode -eq 0) {
            Write-Host "[SUCCESS]" -ForegroundColor Green
            
            # Persist clean version string to marker to ensure reliable future checks
            if (-not (Test-Path $installDir)) { New-Item -Path $installDir -ItemType Directory -Force | Out-Null }
            Set-Content -Path $versionMarker -Value $targetVersionStr -Force
            Write-Host ">> Version marker stabilized to: $targetVersionStr" -ForegroundColor Gray
        } else {
            Write-Host "[ERROR: Process Exit Code $($process.ExitCode)]" -ForegroundColor Red
        }
    } catch {
        Write-Host "[DEPLOYMENT ERROR: $($_.Exception.Message)]" -ForegroundColor Red
    } finally {
        # Cleanup temporary deployment artifacts
        if (Test-Path $tempPath) { Remove-Item $tempPath -Force -ErrorAction SilentlyContinue }
    }
}

Write-Host "--------------------------------------------------------`n"

# ==============================================================================
# MODULE: ICAROS CACHE PERMISSIONS REPAIR
# DESCRIPTION: Grants Full Control permissions to the "Everyone" group for the 
#              Icaros Cache directory to prevent thumbnail generation issues.
# ==============================================================================

Write-Host "[MODULE] Starting Icaros Cache Permissions Repair..." -ForegroundColor Cyan

# Define the target Icaros Cache directory path
$icarosPath = "C:\Program Files\Icaros\IcarosCache"

if (Test-Path $icarosPath) {
    try {
        Write-Host ">> Granting Full Control to 'Everyone' on: $icarosPath" -ForegroundColor Yellow
        
        # Retrieve current Access Control List (ACL)
        $acl = Get-Acl $icarosPath
        
        # Use Well-Known SID 'S-1-1-0' (Everyone) for cross-language compatibility
        $identity = New-Object System.Security.Principal.SecurityIdentifier("S-1-1-0")
        
        # Define Permission Parameters: Full Control + Inheritance for subfolders/files
        $fileSystemRights = "FullControl"
        $inheritanceFlags = "ContainerInherit, ObjectInherit"
        $propagationFlags = "None"
        $accessType       = "Allow"
        
        # Construct the Access Rule
        $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
            $identity, 
            $fileSystemRights, 
            $inheritanceFlags, 
            $propagationFlags, 
            $accessType
        )
        
        # Apply and commit
        $acl.SetAccessRule($accessRule)
        Set-Acl -Path $icarosPath -AclObject $acl
        
        Write-Host "[OK] Icaros permissions updated successfully." -ForegroundColor Green
    } catch {
        Write-Host "[ERROR] Failed to set permissions: $($_.Exception.Message)" -ForegroundColor Red
    }
} else {
    Write-Host "[SKIP] Path not found: $icarosPath" -ForegroundColor Yellow
}

Write-Host "--------------------------------------------------------"

##------------------------------------------------------##

# --- WINDOWS NOTEPAD (UWP) REMOVAL ---
# Package ID: 9MSMLRH6LZF3
# Only attempts removal if the package is detected on the system.

$notepadPackage = Get-AppxPackage -Name "*Microsoft.WindowsNotepad*" -AllUsers

if ($notepadPackage) {
    Write-Host "[🚀] Modern Notepad detected. Initializing removal..." -ForegroundColor Cyan
    
    try {
        # Removes the app for all users and stops it from coming back
        Get-AppxPackage -Name "*Microsoft.WindowsNotepad*" -AllUsers | Remove-AppxPackage -AllUsers -ErrorAction Stop
        Write-Host "[✅] Windows Notepad has been successfully removed." -ForegroundColor Green
    }
    catch {
        Write-Host "[!] Failed to remove Notepad: $($_.Exception.Message)" -ForegroundColor Red
    }
} else {
    # If not found, it stays silent or just gives a subtle log
    Write-Host "[.] Modern Notepad not found. Skipping removal." -ForegroundColor DarkGray
}

# Clear buffer for next commands
while ([console]::KeyAvailable) { [console]::ReadKey($true) | Out-Null }
Write-Host "--------------------------------------------------------"

##------------------------------------------------------##

# ============================================================
# UNINSTALL ADOBE ACROBAT READER
# ============================================================

$ErrorActionPreference = "SilentlyContinue"

Write-Host "`n[🚀] Scanning system for Adobe Acrobat Reader..." -ForegroundColor Cyan

$foundAny = $false

# ------------------------------------------------------------
# 1. STOP PROCESSES
# ------------------------------------------------------------
Get-Process | Where-Object {
    $_.Name -match "AcroRd32|AdobeARM|Acrobat"
} | Stop-Process -Force

# ------------------------------------------------------------
# 2. WINGET UNINSTALL
# ------------------------------------------------------------
if (Get-Command winget -ErrorAction SilentlyContinue) {

    Write-Host "[⚙] Checking Winget packages..." -ForegroundColor Yellow

    $wingetPackages = @(
        "Adobe.Acrobat.Reader.32-bit",
        "Adobe.Acrobat.Reader.64-bit",
        "XPDP273C0XHQH2"
    )

    foreach ($pkg in $wingetPackages) {

        $result = winget uninstall --id $pkg -e --silent 2>&1

        if ($LASTEXITCODE -eq 0 -and $result -notmatch "not found") {
            Write-Host "[✔] Winget removed: $pkg" -ForegroundColor Green
            $foundAny = $true
        }
    }
}

# ------------------------------------------------------------
# 3. APPX / MODERN PACKAGE CHECK
# ------------------------------------------------------------
$appx = Get-AppxPackage -AllUsers "*Acrobat*"

if ($appx) {
    $appx | Remove-AppxPackage -AllUsers
    Write-Host "[✔] Removed Appx Acrobat package(s)" -ForegroundColor Green
    $foundAny = $true
}

Get-AppxProvisionedPackage -Online | Where-Object {
    $_.DisplayName -like "*Acrobat*"
} | Remove-AppxProvisionedPackage -Online

# ------------------------------------------------------------
# 4. MSI + ADOBE REGISTRY UNINSTALL
# ------------------------------------------------------------
$registryPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)

$apps = Get-ItemProperty $registryPaths | Where-Object {
    $_.DisplayName -match "Adobe Acrobat Reader|Acrobat Reader DC"
}

foreach ($app in $apps) {

    $foundAny = $true

    Write-Host "[✔] Found: $($app.DisplayName)" -ForegroundColor Yellow

    $uninstall = $app.UninstallString

    if (-not $uninstall) { continue }

    Write-Host "[⚙] Executing uninstall..." -ForegroundColor Green

    if ($uninstall -match "msiexec") {

        $guid = ([regex]"\{.*?\}").Matches($uninstall).Value

        if ($guid) {
            Start-Process "msiexec.exe" -ArgumentList "/x $guid /qn /norestart" -Wait -WindowStyle Hidden
        }

    } else {

        Start-Process "cmd.exe" -ArgumentList "/c `"$uninstall`" /sAll /rs /rps /msi EULA_ACCEPT=YES" -Wait -WindowStyle Hidden
    }
}

# ------------------------------------------------------------
# 5. PATH DETECTION
# ------------------------------------------------------------
$paths = @(
    "C:\Program Files\Adobe\Acrobat DC",
    "C:\Program Files (x86)\Adobe\Acrobat DC"
)

foreach ($p in $paths) {
    if (Test-Path $p) {
        Write-Host "[ℹ] Installation folder detected: $p" -ForegroundColor DarkYellow
        $foundAny = $true
    }
}

# ------------------------------------------------------------
# 6. FINAL CHECK
# ------------------------------------------------------------
$check = Get-ItemProperty $registryPaths | Where-Object {
    $_.DisplayName -match "Adobe Acrobat Reader"
}

Write-Host "`n--------------------------------------------------------" -ForegroundColor DarkGray

if ($check) {

    Write-Host "[!] Adobe Reader is STILL PRESENT" -ForegroundColor Red
    Write-Host "[→] Manual uninstall may be required (corrupted installer or locked service)" -ForegroundColor Yellow

} elseif ($foundAny) {

    Write-Host "[✅] Adobe Reader has been successfully removed." -ForegroundColor Green

} else {

    Write-Host "[✔] AdobeReader was not detected on this system." -ForegroundColor Green
    Write-Host "[ℹ] No action was required." -ForegroundColor DarkGray
}

Write-Host "--------------------------------------------------------`n" -ForegroundColor DarkGray

##------------------------------------------------------##

# --- AUTOMATIC APP INSTALLATION (UNATTENDED) ---
Write-Host "`n[MODULE] Deploying Essential Applications..." -ForegroundColor Cyan

# Detect if OS is Windows Server
$osInfo = Get-CimInstance Win32_OperatingSystem
$isServer = $osInfo.ProductType -ne 1  # 1 = Workstation, others = Server/DC

# Apps that should NOT be installed on Windows Server
$serverBlockedApps = @(
    "UpNote",
    "Calibre",
    "Simple Radio Online"
)

$appsToInstall = @(
    @{ Name = "UpNote"; ID = "9mv7690m8f5n" },
    @{ Name = "LibreWolf"; ID = "9nvn9sz8kfd7" },
    @{ Name = "ShareX"; ID = "ShareX.ShareX" },
    @{ Name = "CrystalDiskInfo"; ID = "CrystalDewWorld.CrystalDiskInfo" },
    @{ Name = "SSD Booster"; ID = "9nvmxq4ps0lb" },
    @{ Name = "PDFgear"; ID = "PDFgear.PDFgear" },
    @{ Name = "Calibre"; ID = "Calibre.calibre" },
    @{ Name = "Simple Radio Online"; ID = "9n4hx2x3f88h" }
)

# Filter apps if running on Windows Server
if ($isServer) {
    Write-Host "[INFO] Windows Server detected - filtering unsupported apps..." -ForegroundColor DarkYellow

    $appsToInstall = $appsToInstall | Where-Object {
        $_.Name -notin $serverBlockedApps
    }
}

$installedCount = 0

foreach ($app in $appsToInstall) {
    Write-Host ">> Processing $($app.Name)... " -ForegroundColor Yellow -NoNewline
    
    # Executing winget with silent flags and agreement bypass
    $installOutput = & winget install --id $($app.ID) --exact --silent --accept-package-agreements --accept-source-agreements --disable-interactivity 2>&1
    $exitCode = $LASTEXITCODE

    # Regex to extract the official name from winget output
    $foundName = $app.Name
    if ($installOutput -match "Found (.*?) \[") {
        $foundName = $matches[1]
    }

    if ($exitCode -eq 0) {
        Write-Host "[$foundName] -> [SUCCESSFULLY INSTALLED]" -ForegroundColor Green
        $installedCount++
    } 
    elseif ($exitCode -in @(-1978335135, -1978335189, -1978335191, -1978335221, -1978335212)) {
        Write-Host "[$foundName] -> [ALREADY INSTALLED - SKIPPING]" -ForegroundColor Gray
        $installedCount++
    } 
    else {
        Write-Host "[$foundName] -> [FAILED] Code: $exitCode" -ForegroundColor Red
    }
}

# Final Deployment Summary
Write-Host "`n--- Deployment Summary ---" -ForegroundColor Cyan
Write-Host "Total Apps: $($appsToInstall.Count)" -ForegroundColor White
Write-Host "Completed:  $installedCount" -ForegroundColor Green
Write-Host "--------------------------------------------------------"

##------------------------------------------------------##

# ==============================================================================
# DISK INTELLIGENCE & SMART ANALYSIS MODULE
# ==============================================================================

Write-Host " ╔══════════════════════════════════════════════════════════╗" -ForegroundColor Cyan
Write-Host " ║        DISK INTELLIGENCE & SMART ANALYSIS MODULE         ║" -ForegroundColor Cyan
Write-Host " ╚══════════════════════════════════════════════════════════╝" -ForegroundColor Cyan
Write-Host ""

# ==============================================================================
# LOCALIZATION ENGINE
# ==============================================================================

$currentLang = [System.Globalization.CultureInfo]::CurrentUICulture.Name

$langMap = @{
    "pt*" = @{
        Update     = "Atualizando dados SMART..."
        LogGen     = "Log SMART gerado na pasta Temp."
        Analyzing  = "Analisando Armazenamento..."
        NoDrives   = "Nenhum disco detectado."
        Name       = "NOME"
        Letter     = "LETRA"
        Serial     = "SERIAL"
        FW         = "FIRMWARE"
        Health     = "SAÚDE"
        Temp       = "TEMPERATURA"
        Power      = "LIGADO POR"
        Cycles     = "Ciclos"
        Interface  = "INTERFACE"
        Standard   = "PADRÃO"
        Features   = "RECURSOS"
        Type       = "TIPO"
        Clean      = "Arquivo temporário removido."
        HostRW     = "L/G HOSPED."
        Read       = "L"
        Write      = "G"
    }

    "en*" = @{
        Update     = "Updating SMART data..."
        LogGen     = "SMART log generated in Temp folder."
        Analyzing  = "Analyzing Storage..."
        NoDrives   = "No drives detected."
        Name       = "NAME"
        Letter     = "LETTER"
        Serial     = "SERIAL"
        FW         = "FIRMWARE"
        Health     = "HEALTH"
        Temp       = "TEMPERATURE"
        Power      = "POWER ON"
        Cycles     = "Cycles"
        Interface  = "INTERFACE"
        Standard   = "STANDARD"
        Features   = "FEATURES"
        Type       = "TYPE"
        Clean      = "Temporary log file removed."
        HostRW     = "HOST R/W"
        Read       = "R"
        Write      = "W"
    }
}

$UI = $langMap["en*"]

foreach ($pattern in $langMap.Keys) {
    if ($currentLang -like $pattern) {
        $UI = $langMap[$pattern]
        break
    }
}

# ==============================================================================
# CONFIG
# ==============================================================================

$cdiExecutable = "C:\Program Files\CrystalDiskInfo\DiskInfo64.exe"
$workPath      = Join-Path $env:TEMP "DEBUG_DISK.txt"
$cdiDir        = [System.IO.Path]::GetDirectoryName($cdiExecutable)
$sourceLog     = Join-Path $cdiDir "DiskInfo.txt"

# Global SSD Detection Flag
$Global:SSDDetected = $false

try {

    Write-Host "`n [🔄] $($UI.Update)" -ForegroundColor Yellow

    if (Test-Path $cdiExecutable) {

        Start-Process `
            -FilePath $cdiExecutable `
            -ArgumentList "/CopyExit" `
            -Wait

        if (Test-Path $sourceLog) {

            Move-Item `
                -Path $sourceLog `
                -Destination $workPath `
                -Force

            Write-Host " [✅] $($UI.LogGen)" -ForegroundColor Green
        }
        else {
            Write-Host " [!] SMART log was not generated." -ForegroundColor Yellow
        }
    }
    else {
        Write-Host " [!] CrystalDiskInfo not found." -ForegroundColor Red
    }

    Write-Host " [🔍] $($UI.Analyzing) ($currentLang)" -ForegroundColor Cyan

    if (-not (Test-Path $workPath)) {
        Write-Host " [!] SMART file not found." -ForegroundColor Yellow
    }
    else {

        try {
            $rawContent = Get-Content $workPath -Raw -Encoding UTF8
        }
        catch {
            $rawContent = Get-Content $workPath -Raw
        }

        $rawContent = $rawContent `
            -replace "`0","" `
            -replace "`r",""

        $pattern = '(?ms)^-+\s*\n\s*\(\d+\).*?\n-+\s*\n(.*?)(?=^-+\s*\n\s*\(\d+\)|\z)'

        $diskBlocks = [regex]::Matches($rawContent, $pattern)

        if ($diskBlocks.Count -eq 0) {

            Write-Host " [!] $($UI.NoDrives)" -ForegroundColor Red
        }
        else {

            foreach ($item in $diskBlocks) {

                $block = $item.Groups[1].Value

                function Get-Val($regex) {
                    if ($block -match $regex) {
                        return $matches[1].Trim()
                    }
                    return ""
                }

                $props = @{
                    Model     = Get-Val '(?m)^\s*Model\s*:\s*(.+)$'
                    Letter    = Get-Val '(?m)^\s*Drive Letter\s*:\s*(.+)$'
                    Serial    = Get-Val '(?m)^\s*Serial Number\s*:\s*(.+)$'
                    FW        = Get-Val '(?m)^\s*Firmware\s*:\s*(.+)$'
                    Health    = Get-Val '(?m)^\s*Health Status\s*:\s*(.+)$'
                    Temp      = Get-Val '(?m)^\s*Temperature\s*:\s*(.+)$'
                    Hours     = Get-Val '(?m)^\s*Power On Hours\s*:\s*(.+)$'
                    Count     = Get-Val '(?m)^\s*Power On Count\s*:\s*(.+)$'
                    Interface = Get-Val '(?m)^\s*Interface\s*:\s*(.+)$'
                    Features  = Get-Val '(?m)^\s*Features\s*:\s*(.+)$'
                    Standard  = Get-Val '(?m)^\s*Standard\s*:\s*(.+)$'
                    Rotation  = Get-Val '(?m)^\s*Rotation Rate\s*:\s*(.+)$'
                    Reads     = Get-Val '(?m)^\s*Host Reads\s*:\s*(.+)$'
                    Writes    = Get-Val '(?m)^\s*Host Writes\s*:\s*(.+)$'
                }

                # ==========================================================================
                # SSD DETECTION FIX
                # ==========================================================================

                $IsSSD = $false
                $IsNVMe = $false

                if ($props.Interface -match 'NVMe') {
                    $IsSSD = $true
                    $IsNVMe = $true
                }

                elseif (
                    $props.Rotation -match 'SSD' -or
                    $props.Rotation -match '----' -or
                    $props.Features -match 'TRIM'
                ) {
                    $IsSSD = $true
                }

                if ($IsSSD) {
                    $Global:SSDDetected = $true
                }

                # ==========================================================================
                # STANDARD FALLBACK
                # ==========================================================================

                if (-not $props.Standard) {

                    $major = Get-Val '(?m)^\s*Major Version\s*:\s*(.+)$'
                    $minor = Get-Val '(?m)^\s*Minor Version\s*:\s*(.+)$'

                    $props.Standard = "$major | $minor".Trim(" |")
                }

                # ==========================================================================
                # HEALTH FORMAT
                # ==========================================================================

                $HealthPct = ""

                if ($props.Health -match '\((.*?)\)') {

                    $HealthPct = $matches[1]

                    $props.Health = (
                        $props.Health -replace '\(.*?\)', ''
                    ).Trim()
                }

                if (
                    -not $HealthPct -and
                    $props.Health -match 'Healthy|Good|Saudável'
                ) {
                    $HealthPct = "100 %"
                }

                if ($props.Temp -match '^(.+?)\s*\(') {
                    $props.Temp = $matches[1].Trim()
                }

                $hColor = "White"

                if ($props.Health -match 'Healthy|Good|Saudável') {
                    $hColor = "Green"
                }
                elseif ($props.Health -match 'Caution|Warning|Alerta') {
                    $hColor = "Yellow"
                }
                elseif ($props.Health -match 'Bad|Fail|Ruim') {
                    $hColor = "Red"
                }

                # ==========================================================================
                # OUTPUT
                # ==========================================================================

                Write-Host "`n----------------------------------------------------" -ForegroundColor DarkGray

                Write-Host " $($UI.Name):".PadRight(15) -NoNewline
                Write-Host $props.Model -ForegroundColor White

                Write-Host " $($UI.Letter):".PadRight(15) -NoNewline
                Write-Host $props.Letter -ForegroundColor Cyan

                Write-Host " $($UI.Serial):".PadRight(15) -NoNewline
                Write-Host $props.Serial -ForegroundColor White

                Write-Host " $($UI.FW):".PadRight(15) -NoNewline
                Write-Host $props.FW -ForegroundColor White

                Write-Host " $($UI.Health):".PadRight(15) -NoNewline
                Write-Host "$($props.Health) $HealthPct" -ForegroundColor $hColor

                Write-Host " $($UI.Temp):".PadRight(15) -NoNewline
                Write-Host $props.Temp -ForegroundColor Cyan

                Write-Host " $($UI.Power):".PadRight(15) -NoNewline
                Write-Host "$($props.Hours) | $($UI.Cycles): $($props.Count)" -ForegroundColor White

                Write-Host " $($UI.Interface):".PadRight(15) -NoNewline
                Write-Host $props.Interface -ForegroundColor Magenta

                Write-Host " $($UI.Standard):".PadRight(15) -NoNewline
                Write-Host $props.Standard -ForegroundColor White

                Write-Host " $($UI.Features):".PadRight(15) -NoNewline
                Write-Host $props.Features -ForegroundColor White

                # ==========================================================================
                # TYPE OUTPUT
                # ==========================================================================

                Write-Host " $($UI.Type):".PadRight(15) -NoNewline

                if ($IsNVMe) {

                    Write-Host "NVMe SSD" -ForegroundColor Green
                }
                elseif ($IsSSD) {

                    Write-Host "SATA SSD" -ForegroundColor Green
                }
                else {

                    Write-Host "HDD ($($props.Rotation))" -ForegroundColor Magenta
                }

                # ==========================================================================
                # HOST READ / WRITE
                # ==========================================================================

                if ($IsSSD) {

                    Write-Host " $($UI.HostRW):".PadRight(15) -NoNewline

                    Write-Host `
                        "$($UI.Read): $($props.Reads) | $($UI.Write): $($props.Writes)" `
                        -ForegroundColor Cyan
                }

                Write-Host "----------------------------------------------------" -ForegroundColor DarkGray
            }
        }
    }
}
finally {

    if (Test-Path $workPath) {

        Remove-Item $workPath -Force

        Write-Host "`n [🗑️] $($UI.Clean)" -ForegroundColor Gray
    }
}

Write-Host "--------------------------------------------------------"

# ==============================================================================
# SSD MODULE COMPATIBILITY FLAG
# ==============================================================================

if ($Global:SSDDetected) {

    Write-Host ""
    Write-Host " [OK] SSD detected. Next modules may continue." -ForegroundColor Green
}
else {

    Write-Host ""
    Write-Host " [!] No SSD detected. Continuing..." -ForegroundColor Yellow
}

Write-Host "--------------------------------------------------------"

##------------------------------------------------------##

# ==============================================================================
# SSD OPTIMIZATION
# ==============================================================================

Write-Host " ╔══════════════════════════════════════════════════════════╗" -ForegroundColor Cyan
Write-Host " ║          SSD OPTIMIZATION MODULE                         ║" -ForegroundColor Cyan
Write-Host " ╚══════════════════════════════════════════════════════════╝" -ForegroundColor Cyan
Write-Host ""

# ================= ENVIRONMENT CHECK =================

Write-Host " [*] Checking system compatibility..." -NoNewline

# --- CHECK WINDOWS SERVER ---
$os = Get-CimInstance Win32_OperatingSystem
if ($os.ProductType -ne 1) {
    Write-Host " SKIPPED (Windows Server detected)" -ForegroundColor Yellow
    Write-Host "`n [ABORTED] This script is not intended for Windows Server." -ForegroundColor Red
    Write-Host "--------------------------------------------------------"
    Write-Host ""
}

# --- CHECK SSD ---
$hasSSD = $false

try {
    $disks = Get-PhysicalDisk -ErrorAction Stop
    foreach ($d in $disks) {
        if ($d.MediaType -eq "SSD") {
            $hasSSD = $true
            break
        }
    }
} catch {}

# --- FALLBACK (IF MediaType FAILS) ---
if (-not $hasSSD) {
    try {
        $models = Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model
        foreach ($m in $models) {
            if ($m -match "SSD|NVMe") {
                $hasSSD = $true
                break
            }
        }
    } catch {}
}

# --- FINAL DECISION ---
if (-not $hasSSD) {
    Write-Host " SKIPPED (No SSD detected)" -ForegroundColor Yellow
    Write-Host "`n [ABORTED] No SSD detected. Optimization not applied." -ForegroundColor Red
    Write-Host "--------------------------------------------------------"
    Write-Host ""
}

Write-Host " OK (SSD detected)" -ForegroundColor Green

# ================= HELPER =================
function Set-IfNeeded {
    param($Path, $Name, $Value)

    try { $current = (Get-ItemProperty -Path $Path -Name $Name -ErrorAction Stop).$Name }
    catch { $current = $null }

    if ($current -ne $Value) {
        Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force
        return $true
    }
    return $false
}

# ================= SAFE OPTIMIZATIONS =================

# 1 - INDEXING
Write-Host " [1] Search Indexing..." -NoNewline
$s = Get-Service WSearch -ErrorAction SilentlyContinue
if ($s -and $s.StartType -ne 'Disabled') {
    Stop-Service WSearch -Force
    Set-Service WSearch -StartupType Disabled
    Write-Host " DONE (Disabled)" -ForegroundColor Green
} else { Write-Host " OK (Already optimized)" -ForegroundColor Gray }

# 2 - BOOT OPTIMIZATION
Write-Host " [2] Boot Optimization..." -NoNewline
if (Set-IfNeeded "HKLM:\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction" "Enable" "N") {
    Write-Host " DONE" -ForegroundColor Green
} else { Write-Host " OK (Already optimized)" -ForegroundColor Gray }

# 3 - PREFETCH
Write-Host " [3] Prefetch..." -NoNewline
if (Set-IfNeeded "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" "EnablePrefetcher" 0) {
    Write-Host " DONE" -ForegroundColor Green
} else { Write-Host " OK (Already optimized)" -ForegroundColor Gray }

# 4 - SUPERFETCH
Write-Host " [4] Superfetch..." -NoNewline
if (Set-IfNeeded "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" "EnableSuperfetch" 0) {
    Write-Host " DONE" -ForegroundColor Green
} else { Write-Host " OK (Already optimized)" -ForegroundColor Gray }

# 5 - SYSMAIN
Write-Host " [5] SysMain..." -NoNewline
$sm = Get-Service SysMain -ErrorAction SilentlyContinue
if ($sm -and $sm.StartType -ne 'Disabled') {
    Stop-Service SysMain -Force
    Set-Service SysMain -StartupType Disabled
    Write-Host " DONE" -ForegroundColor Green
} else { Write-Host " OK (Already optimized)" -ForegroundColor Gray }

# 6 - 8.3 NAMES
Write-Host " [6] 8.3 Filename Creation..." -NoNewline
if (Set-IfNeeded "HKLM:\System\CurrentControlSet\Control\FileSystem" "NtfsDisable8dot3NameCreation" 1) {
    Write-Host " DONE" -ForegroundColor Green
} else { Write-Host " OK (Already optimized)" -ForegroundColor Gray }

# 7 - TRIM
Write-Host " [7] TRIM..." -NoNewline

try {
    $trim = fsutil behavior query DisableDeleteNotify

    # SAFE EXTRACTION
    $value = [regex]::Match($trim, '\d+').Value

    if ($value -eq "1") {
        fsutil behavior set DisableDeleteNotify 0 | Out-Null
        Write-Host " DONE (Enabled)" -ForegroundColor Green
    } else {
        Write-Host " OK (Already optimized)" -ForegroundColor Gray
    }
}
catch {
    Write-Host " FAIL" -ForegroundColor Red
}

# 8 - PAGE FILE
Write-Host " [8] Page File Cleanup..." -NoNewline
if (Set-IfNeeded "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" "ClearPageFileAtShutdown" 0) {
    Write-Host " DONE" -ForegroundColor Green
} else { Write-Host " OK (Already optimized)" -ForegroundColor Gray }

# 9 - CACHE
Write-Host " [9] Large System Cache..." -NoNewline
if (Set-IfNeeded "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" "LargeSystemCache" 0) {
    Write-Host " DONE" -ForegroundColor Green
} else { Write-Host " OK (Already optimized)" -ForegroundColor Gray }

# ================= EXTRA =================

# 10 - NTFS MEMORY (TRUE INSTALLED PHYSICAL RAM - DIMM BASED)
Write-Host " [10] NTFS Memory Usage..." -NoNewline

try {
    # SUM ALL PHYSICAL RAM MODULES (REAL HARDWARE VALUE)
    $ramBytes = (Get-CimInstance Win32_PhysicalMemory | Measure-Object -Property Capacity -Sum).Sum

    # STRICT CONVERSION BASE 1024
    $ramGB = $ramBytes / 1GB
    $ramMB = $ramBytes / 1MB

    # FORCE CLEAN FORMAT (NO LOCALE ISSUES)
    $culture = [System.Globalization.CultureInfo]::InvariantCulture

    $ramGBText = $ramGB.ToString("F2", $culture)
    $ramMBText = [math]::Round($ramMB).ToString("0", $culture)

    $ramDisplay = "$ramGBText GB ($ramMBText MB)"

    $current = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" `
        -Name NtfsMemoryUsage -ErrorAction SilentlyContinue).NtfsMemoryUsage

    if ($ramBytes -ge 8GB) {

        if ($current -ne 2) {
            Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" `
                -Name NtfsMemoryUsage -Value 2 -Force

            Write-Host " DONE (RAM: $ramDisplay → High cache enabled)" -ForegroundColor Green
        }
        else {
            Write-Host " OK (High cache active - RAM: $ramDisplay)" -ForegroundColor Gray
        }

    }
    else {

        if ($current -ne 1) {
            Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" `
                -Name NtfsMemoryUsage -Value 1 -Force

            Write-Host " DONE (RAM: $ramDisplay → Default restored)" -ForegroundColor Yellow
        }
        else {
            Write-Host " OK (Default - RAM: $ramDisplay)" -ForegroundColor Gray
        }
    }
}
catch {
    Write-Host " FAIL (RAM detection error)" -ForegroundColor Red
}

# 11 - WRITE CACHE FLUSH (SMART BATTERY LOGIC)
Write-Host " [11] Write Cache Buffer Flush..." -NoNewline

try {
    $battery = Get-CimInstance Win32_Battery -ErrorAction Stop

    $batteryInfo = "No battery"
    $disableFlush = $false

    if ($battery) {
        $charge = $battery.EstimatedChargeRemaining
        $batteryInfo = "$charge%"

        if ($charge -gt 0) {
            $disableFlush = $true
        }
    }

    if ($disableFlush) {
        if (Set-IfNeeded "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" "DisableFlushOnWrite" 1) {
            Write-Host " DONE (Flush OFF - Battery: $batteryInfo)" -ForegroundColor Green
        } else {
            Write-Host " OK (Already OFF - Battery: $batteryInfo)" -ForegroundColor Gray
        }
    }
    else {
        if (Set-IfNeeded "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" "DisableFlushOnWrite" 0) {
            Write-Host " DONE (Flush ON - Safety mode)" -ForegroundColor Yellow
        } else {
            Write-Host " OK (Already ON - Safety mode)" -ForegroundColor Gray
        }
    }
}
catch {
    # No battery detected → desktop behavior
    try {
        if (Set-IfNeeded "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" "DisableFlushOnWrite" 0) {
            Write-Host " DONE (Flush ON - No battery)" -ForegroundColor Yellow
        } else {
            Write-Host " OK (Already ON - No battery)" -ForegroundColor Gray
        }
    }
    catch {
        Write-Host " FAIL (Registry access denied)" -ForegroundColor Red
    }
}

# 12 - KERNEL PAGING
Write-Host " [12] Kernel Paging..." -NoNewline
if (Set-IfNeeded "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" "DisablePagingExecutive" 1) {
    Write-Host " DONE" -ForegroundColor Green
} else { Write-Host " OK (Already optimized)" -ForegroundColor Gray }

# ================= SENSITIVE =================

# 13 - LAST ACCESS
Write-Host " [13] Last Access Timestamp..." -NoNewline

try {
    $path = "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem"
    $name = "NtfsDisableLastAccessUpdate"

    # Safely read registry value
    $current = (Get-ItemProperty -Path $path -Name $name -ErrorAction SilentlyContinue).$name

    # Normalize null/empty values safely
    if ($null -eq $current -or $current -eq "") {
        $current = 0
    }

    # Safe conversion (prevents crash)
    try {
        $current = [int]$current
    } catch {
        $current = 0
    }

    $desired = 2

    if ($current -eq $desired) {
        Write-Host " OK (Already optimized)" -ForegroundColor Gray
    }
    else {
        Set-ItemProperty -Path $path -Name $name -Value $desired -Force -ErrorAction Stop
        Write-Host " DONE" -ForegroundColor Green
    }
}
catch {
    Write-Host " FAIL (Registry access or permission issue)" -ForegroundColor Red
}

# 14 - HIBERNATION
Write-Host " [14] Hibernation & Fast Startup..." -NoNewline
$hib = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Power").HibernateEnabled
$fast = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power").HiberbootEnabled

if ($hib -eq 0 -and $fast -eq 0) {
    Write-Host " OK (Already optimized)" -ForegroundColor Gray
} else {
    powercfg /hibernate off | Out-Null
    Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Power" -Name HibernateEnabled -Value 0
    Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Power" -Name HiberbootEnabled -Value 0
    Write-Host " DONE" -ForegroundColor Green
}

# 15 - DRIVE OPTIMIZATION
Write-Host " [15] Drive Optimization (Scheduled TRIM/Defrag)..." -NoNewline

$task = Get-ScheduledTask -TaskName "ScheduledDefrag" -TaskPath "\Microsoft\Windows\Defrag\" -ErrorAction SilentlyContinue

if ($task) {

    if ($task.State -eq "Ready" -or $task.State -eq "Running") {
        Write-Host " OK (Already enabled)" -ForegroundColor Gray
    }
    else {
        try {
            Enable-ScheduledTask -TaskName "ScheduledDefrag" -TaskPath "\Microsoft\Windows\Defrag\" | Out-Null
            Write-Host " DONE (Enabled TRIM optimization)" -ForegroundColor Green
        } catch {
            Write-Host " FAIL (Could not enable task)" -ForegroundColor Red
        }
    }

} else {
    Write-Host " FAIL (Task not found)" -ForegroundColor Red
}

# 16 - EVENT LOG
Write-Host " [16] Event Logging..." -NoNewline

$svc = Get-Service EventLog -ErrorAction SilentlyContinue
if ($svc.Status -ne "Running") {
    Start-Service EventLog -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 3
}

$logs = @("Application","System")
$alreadyOptimized = $true

foreach ($log in $logs) {
    try {
        $info = wevtutil gli $log 2>$null

        if ($info) {
            $sizeLine = ($info | Select-String "maxSize")

            if ($sizeLine) {
                $currentSize = [int]([regex]::Match($sizeLine.ToString(), '\d+').Value)

                if ($currentSize -gt 20971520) {
                    wevtutil sl $log /ms:20971520 | Out-Null
                    wevtutil sl $log /rt:true | Out-Null
                    $alreadyOptimized = $false
                }
            }
        }
    }
    catch {
        $alreadyOptimized = $false
    }
}

if ($alreadyOptimized) {
    Write-Host " OK (Already optimized)" -ForegroundColor Gray
} else {
    Write-Host " DONE (Reduced log size)" -ForegroundColor Yellow
}

# 17 - THUMBNAIL CACHE
Write-Host " [17] Thumbnail Cache..." -NoNewline
$current = (Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -ErrorAction SilentlyContinue).DisableThumbnailCache

if ($current -eq 1) {
    Write-Host " OK (Already optimized)" -ForegroundColor Gray
} else {
    Set-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name DisableThumbnailCache -Value 1
    Write-Host " DONE" -ForegroundColor Green
}

Write-Host "`n [DONE] SSD optimization fully applied." -ForegroundColor Cyan
Write-Host "--------------------------------------------------------"

##------------------------------------------------------##

# --- INSTALL APPS VIA WINGET (WITH POPUP TIMEOUT) ---
Write-Host "`n[MODULE] Starting Interactive App Installation..." -ForegroundColor Cyan
$appsToInstall = @(
    @{ Name = "FluentFlyout"; ID = "9n45nsm4tnbp" },
    @{ Name = "TubeDigger"; ID = "TubeDigger.TubeDigger" },
    @{ Name = "SignalRgb"; ID = "WhirlwindFX.SignalRgb" },
    @{ Name = "Hydra"; ID = "HydraLauncher.Hydra" },
    @{ Name = "Signal"; ID = "xp89119p9f2pcq" },
    @{ Name = "Sticky Password"; ID = "xp8lt301zl525k" },
    @{ Name = "Antigravity"; ID = "Google.Antigravity" },
    @{ Name = "WhatsApp"; ID = "9nksqgp7f2nh" },
    @{ Name = "Outlook"; ID = "9nrx63209r7b" },
    @{ Name = "OneDrive"; ID = "Microsoft.OneDrive" },
    @{ Name = "Microsoft Teams"; ID = "xp8bt8dw290mpq" },
    @{ Name = "Brave"; ID = "xp8c9qzms2pc1t" },
    @{ Name = "Zen"; ID = "Zen-Team.Zen-Browser" },
    @{ Name = "Comet"; ID = "Perplexity.Comet" },
    @{ Name = "ChatGPT"; ID = "9nt1r1c2hh7j" },
    @{ Name = "Perplexity"; ID = "xp8jnqfbqh6pvf" }
)

$shell = New-Object -ComObject WScript.Shell
$installedCount = 0
$skippedCount = 0

foreach ($app in $appsToInstall) {
    $msg = "Do you want to install [$($app.Name)]?`n`n(This window will auto-close and SKIP in 5 seconds)"
    $title = "Winget Deployment - $($app.Name)"
    
    # Show Popup
    $response = $shell.Popup($msg, 5, $title, 4 + 32)

    if ($response -eq 6) { 
        Write-Host ">> Installing $($app.Name)..." -ForegroundColor Yellow -NoNewline
        $process = winget install --id $($app.ID) -e --silent --accept-package-agreements --accept-source-agreements
        
        if ($LASTEXITCODE -eq 0) {
            Write-Host " [SUCCESS]" -ForegroundColor Green
            $installedCount++
        } else {
            Write-Host " [FAILED/ALREADY INSTALLED]" -ForegroundColor Red
        }
    } 
    else {
        Write-Host ">> Skipped: $($app.Name)" -ForegroundColor Gray
        $skippedCount++
    }
}

Write-Host "`n--- Installation Summary ---" -ForegroundColor Cyan
Write-Host "Apps Installed: $installedCount" -ForegroundColor Green
Write-Host "Apps Skipped:   $skippedCount" -ForegroundColor Yellow
Write-Host "--------------------------------------------------------"

##------------------------------------------------------##

# --- Gaming Essentials Pack (5-second Timeout) ---
Write-Host "`n--- Gaming Essentials Check ---" -ForegroundColor Cyan

# Define the Game Pack IDs (Using Store ID for Xbox App)
$gamePack = @("Valve.Steam", "Discord.Discord", "ElectronicArts.EADesktop", "EpicGames.EpicGamesLauncher", "9MV0B5HZVK9Z", "xpdp2qw12dfsfk", "Playnite.Playnite")
$gamePackNames = "Steam, Discord, EA Desktop, Epic Games, Xbox App, Ubisoft Connect, Playnite"

$msgGame = "Do you want to install the Gaming Essentials Pack?`n($gamePackNames)`n`n(Automatically skips in 5 seconds)"
$responseGame = $shell.Popup($msgGame, 5, "Gaming Pack Installation", 4 + 32)

if ($responseGame -eq 6) { # 6 = 'Yes' button clicked
    Write-Host "Installing Gaming Essentials Pack..." -ForegroundColor Green
    foreach ($id in $gamePack) {
        Write-Host "Installing $id..." -ForegroundColor Gray
        # Using -e for exact ID matching (essential for the Store ID)
        winget install --id $id -e --accept-source-agreements --accept-package-agreements --silent
    }
    Write-Host "Gaming Pack installation complete. ✅" -ForegroundColor Green
} else {
    Write-Host "Skipping Gaming Pack (denied or timeout)." -ForegroundColor Yellow
}

Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# --- 4.1 Software Installations via Chocolatey ---
Write-Host "Starting software installations via Chocolatey..."

$packagesToInstall = @(
    "7zip"
    "webcamoid"
    "dart-sdk" # Its path handling is separate below
    "qdir"
    "openssh"
    "vscodium"
    "notepadplusplus"
    "imageglass"
    "git"
    "nano"
    "gh"
    "curl"
    "adb"
    "glab"
    "portx"
    "tabby"
    "vlc"
    "vlc-skins"
    "paint.net"
    "fastfetch"
    "qalculate"
    "audacity"
    "everything"
    "grepwin"
    "hashcheck"
    "openhashtab"
    "jami"
    "sd-card-formatter"
    "th-ch-youtube-music"
    "winscp.install"
    "zstandard"
    "wiresockvpnclient"
    "winrar"
)

# Handle Python separately before the loop to ensure robust check
if (-not (Test-PythonInstalled)) {
    Write-Host "Python (v3+) not found or not suitable. Attempting to install Python via Chocolatey..."
    try {
        choco install python -y --no-progress
        if ($LASTEXITCODE -ne 0) {
            Write-Warning "Failed to install Python. Chocolatey exit code: $LASTEXITCODE"
        } else {
            Write-Host "Python installed successfully."
        }
    }
    catch {
        $errorMessage = $_.Exception.Message
        Write-Error ("An error occurred while trying to install Python: {0}" -f $errorMessage)
    }
} else {
    Write-Host "Python (v3+) is already installed. Skipping Chocolatey installation for Python."
}
Write-Host "" # Add a blank line for readability


foreach ($package in $packagesToInstall) {
    Write-Host "Checking and installing $package..."
    try {
        # Check if the package is already installed
        # The -r (raw) and --exact flags ensure precise matching and machine-readable output.
        if ((choco list --local-only --exact $package -r).Count -eq 0) {
            choco install $package -y --no-progress
            if ($LASTEXITCODE -ne 0) {
                Write-Warning "Failed to install $package. Chocolatey exit code: $LASTEXITCODE"
            } else {
                Write-Host "$package installed successfully."
            }
        } else {
            Write-Host "$package is already installed. Skipping."
        }
    }
    catch {
        $errorMessage = $_.Exception.Message
        Write-Error ("An error occurred while trying to install {0}: {1}" -f $package, $errorMessage)
    }
    Write-Host ""
}

Write-Host "All specified software installations attempted."
Write-Host ""

##------------------------------------------------------##

# --- 4.2 Hugging Face CLI Installation & Smart Update ---
Write-Host "Checking for Hugging Face CLI (hf)..." -ForegroundColor Cyan

$hfBinary = "$env:USERPROFILE\.local\bin\hf.exe"
$hfInstalled = (Test-CommandExists "hf") -or (Test-Path $hfBinary)
$lastUpdateFile = "$env:USERPROFILE\.hf-cli\.last_update.txt"
$needsUpdateCheck = $true

# Check if we checked for updates recently (within the last 7 days)
if ($hfInstalled -and (Test-Path $lastUpdateFile)) {
    try {
        $lastUpdateStr = Get-Content -Path $lastUpdateFile -Raw -ErrorAction SilentlyContinue
        if ($lastUpdateStr) {
            $lastUpdateDate = [DateTime]::Parse($lastUpdateStr.Trim())
            if ((Get-Date).AddDays(-7) -lt $lastUpdateDate) {
                $needsUpdateCheck = $false
            }
        }
    } catch {
        $needsUpdateCheck = $true
    }
}

# 1. ALWAYS Upgrade Pip first if we're actually going to check for updates or install
if (-not $hfInstalled -or $needsUpdateCheck) {
    Write-Host "-- Upgrading pip..." -ForegroundColor Gray
    python -m pip install --upgrade pip --quiet
}

# 2. Main Logic: Install or Check for Updates
if (-not $hfInstalled) {
    Write-Host "Hugging Face CLI not found. Starting installation..." -ForegroundColor Gray
    try {
        powershell -ExecutionPolicy ByPass -c "irm https://hf.co/cli/install.ps1 | iex"
        
        # Save current date as the last check
        $null = New-Item -Path (Split-Path $lastUpdateFile) -ItemType Directory -Force -ErrorAction SilentlyContinue
        (Get-Date).ToString() | Out-File -FilePath $lastUpdateFile -Force
        
        Write-Host "Hugging Face CLI installed successfully! ✅" -ForegroundColor Green
    } catch {
        Write-Error "Failed to install Hugging Face CLI."
    }
} elseif ($needsUpdateCheck) {
    Write-Host "Checking for Hugging Face CLI updates (Weekly Check)..." -ForegroundColor Gray
    try {
        powershell -ExecutionPolicy ByPass -c "irm https://hf.co/cli/install.ps1 | iex"
        
        # Update the timestamp file
        $null = New-Item -Path (Split-Path $lastUpdateFile) -ItemType Directory -Force -ErrorAction SilentlyContinue
        (Get-Date).ToString() | Out-File -FilePath $lastUpdateFile -Force
        
        Write-Host "Hugging Face CLI check completed. ✅" -ForegroundColor Green
    } catch {
        Write-Host "Update check failed, but 'hf' is already installed. Skipping. ⏩" -ForegroundColor Yellow
    }
} else {
    Write-Host "Hugging Face CLI (hf) is up to date (Last check < 7 days ago). ✅" -ForegroundColor Green
}

Write-Host ""

##------------------------------------------------------##

# --- 5. DART SDK PATH CONFIGURATION ---
# This section ensures 'C:\tools\dart-sdk\bin' is correctly added to the system's 'Path' environment variable.
# It affects all users and requires Administrator privileges.

$dartPathToAdd = "C:\tools\dart-sdk\bin"

Write-Host "--------------------------------------------------------"
Write-Host "Configuring Dart SDK Path:"
Write-Host "--------------------------------------------------------"

Write-Host "Target path to add: '$dartPathToAdd'"

# Get the current System Path environment variable for review
$currentSystemPathBefore = [System.Environment]::GetEnvironmentVariable("Path", "Machine")
Write-Host "Current System Path (BEFORE modification):"
Write-Host "$currentSystemPathBefore"
Write-Host ""

# Check if the Dart path already exists to prevent duplicates
if ($currentSystemPathBefore -notlike "*$dartPathToAdd*") {
    Write-Host "Dart SDK path not found in System Path. Appending now..."
    # Append the new path to the existing System Path
    [System.Environment]::SetEnvironmentVariable("Path", "$currentSystemPathBefore;$dartPathToAdd", "Machine")
    Write-Host "Dart SDK path added to System Path successfully."
} else {
    Write-Host "Dart SDK path '$dartPathToAdd' already exists in the System Path. No action needed."
}

# Get the System Path after potential modification
$currentSystemPathAfter = [System.Environment]::GetEnvironmentVariable("Path", "Machine")
Write-Host "Current System Path (AFTER potential modification):"
Write-Host "$currentSystemPathAfter"
Write-Host ""

Write-Host "Updating Path variable for the current PowerShell session..."
# Update the Path variable for the current PowerShell session to reflect changes immediately.
# This ensures that Dart commands can be used in this session without needing to reopen PowerShell.
$env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "User")
Write-Host "Current PowerShell session Path updated."
Write-Host ""

Write-Host "Verification: Does the current system Path (machine scope) include '$dartPathToAdd'?"
# Using GetEnvironmentVariable directly for compatibility with older PowerShell
$systemPathIncludesDart = ([System.Environment]::GetEnvironmentVariable("Path", "Machine") -like "*$dartPathToAdd*")
if ($systemPathIncludesDart) {
    Write-Host "Verification successful: System Path includes '$dartPathToAdd'. ✅"
} else {
    Write-Warning "Verification failed: System Path DOES NOT include '$dartPathToAdd'. ❌ Manual check may be required."
}
Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# --- 6. DISABLE STARTUP (DIRECT TASK MANAGER STATUS) ---
Write-Host "Adjusting startup status in Task Manager..." -ForegroundColor Cyan

# Targets
$targets = @(
    "StickyPassword",
    "steam",
    "Discord",
    "Update",
    "EADM",
    "EpicGamesLauncher",
    "Everything", 
    "Lightshot",
    "stpass",
    "Signal",
    "Teams"
)

# Binary Value for "Disabled" (03)
$disabledVal = [byte[]](0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)

# Registry Paths
$paths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Task",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Task"
)

foreach ($path in $paths) {
    if (Test-Path $path) {
        $key = Get-Item $path
        foreach ($valName in $key.GetValueNames()) {
            $shouldDisable = $false
            
            # Check if the registry item matches any of our targets
            foreach ($t in $targets) {
                if ($valName -match $t) {
                    $shouldDisable = $true
                    break
                }
            }

            if ($shouldDisable) {
                Set-ItemProperty -Path $path -Name $valName -Value $disabledVal -Force
                Write-Host "[$valName] Status changed to DISABLED in: $path" -ForegroundColor Green
            }
        }
    }
}

Write-Host "--------------------------------------------------------"
Write-Host "Done." -ForegroundColor Cyan
Write-Host ""

##------------------------------------------------------##

# --- 7. EXTERNAL STARTUP METHODS (Shortcuts & Folders) ---
Write-Host "Checking for file-based startup shortcuts..." -ForegroundColor Cyan

# List of shortcut filenames to remove (without the .lnk extension)
$AppsToRemove = @(
    "ShareX"
)

# Common Startup paths
$StartupFolders = @(
    "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
    "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
)

foreach ($AppName in $AppsToRemove) {
    foreach ($Folder in $StartupFolders) {
        $ShortcutPath = Join-Path $Folder "$AppName.lnk"

        if (Test-Path $ShortcutPath) {
            try {
                Remove-Item -Path $ShortcutPath -Force -ErrorAction Stop
                Write-Host "[!] Removed $AppName startup shortcut from: $Folder" -ForegroundColor Green
            } catch {
                Write-Host "[X] Failed to remove $AppName shortcut: $($_.Exception.Message)" -ForegroundColor Red
            }
        }
    }

    # Kill process if running to complete the 'disable' effect
    Stop-Process -Name $AppName -Force -ErrorAction SilentlyContinue
}

Write-Host "Startup shortcut cleanup complete." -ForegroundColor Cyan

##------------------------------------------------------##

# --- 8. GITHUB ENVIRONMENT & CASE SENSITIVITY ---
# Configures Git and Windows for Case Sensitivity in the GitHub folder.
Write-Host "--------------------------------------------------------" -ForegroundColor Cyan
Write-Host "Configuring GitHub Desktop Environment:" -ForegroundColor Cyan
Write-Host "--------------------------------------------------------"

$GitHubPath = "$HOME\Documents\GitHub"

# Git Configuration
Write-Host "-- Configuring Git global core settings..." -ForegroundColor Gray
if (Test-CommandExists "git") {
    git config --global core.protectNTFS false
    Write-Host "Git: core.protectNTFS set to false. ✅" -ForegroundColor Green
} else {
    Write-Warning "Git not found in PATH. Skipping git config."
}

# Folder Preparation
if (!(Test-Path $GitHubPath)) {
    New-Item -ItemType Directory -Path $GitHubPath -Force | Out-Null
    Write-Host "Created GitHub directory at: $GitHubPath" -ForegroundColor Gray
}

# Windows Case Sensitivity (FSUTIL)
Write-Host "-- Enabling Case Sensitivity on GitHub directory..." -ForegroundColor Gray
# This allows Windows to treat 'File.txt' and 'file.txt' as different files.
try {
    fsutil.exe file SetCaseSensitiveInfo "$GitHubPath" enable
    if ($LASTEXITCODE -eq 0) {
        Write-Host "Case sensitivity enabled successfully! ✅" -ForegroundColor Green
    } else {
        Write-Host "(!) FSUTIL: Folder must be empty or not in use to enable case sensitivity." -ForegroundColor Yellow
    }
} catch {
    Write-Warning "Failed to execute fsutil for case sensitivity."
}

Write-Host "GitHub environment configuration complete." -ForegroundColor Cyan
Write-Host "--------------------------------------------------------"
Write-Host ""

##------------------------------------------------------##

# --- 9. GIT CONTEXT MENU OPTIMIZATION (FORCE SHIFT-ONLY) ---
# Hides "Git GUI Here" and "Git Bash Here" from the standard context menu.
# This ensures they only appear when holding SHIFT + Right Click, as per common debloat standards.
Write-Host "Optimizing Git Context Menu (Force Shift-only access)..." -ForegroundColor Cyan

$gitMenuPaths = @(
    # Standard Classes Root paths
    "HKCR:\Directory\shell\git_shell",
    "HKCR:\Directory\shell\git_gui",
    "HKCR:\Directory\Background\shell\git_shell",
    "HKCR:\Directory\Background\shell\git_gui",
    "HKCR:\LibraryFolder\background\shell\git_gui",
    "HKCR:\LibraryFolder\background\shell\git_shell",

    # Machine-wide paths (High Priority / HKLM)
    "HKLM:\SOFTWARE\Classes\Directory\shell\git_shell",
    "HKLM:\SOFTWARE\Classes\Directory\shell\git_gui",
    "HKLM:\SOFTWARE\Classes\Directory\background\shell\git_shell",
    "HKLM:\SOFTWARE\Classes\Directory\background\shell\git_gui",
    "HKLM:\SOFTWARE\Classes\LibraryFolder\background\shell\git_gui",
    "HKLM:\SOFTWARE\Classes\LibraryFolder\background\shell\git_shell"
)

foreach ($path in $gitMenuPaths) {
    if (Test-Path $path) {
        # Adding the 'Extended' string value hides the entry from the normal menu
        # It will now require SHIFT + Right Click to be visible.
        Set-ItemProperty -Path $path -Name "Extended" -Value "" -Force | Out-Null
        Write-Host "Extended attribute applied: $path" -ForegroundColor Gray
    }
}

Write-Host "Git menu items successfully moved to 'Shift + Right Click'. ✅" -ForegroundColor Green
Write-Host "--------------------------------------------------------"

##------------------------------------------------------##

# --- 10. GREPWIN CONTEXT MENU PURGE ---
# Removes grepWin from all context menu handlers (Files, Directories, and Background).
# Using native 'reg.exe' for maximum performance and to avoid PowerShell Registry provider overhead.
Write-Host "`n[CLEANUP] Purging grepWin shell entries..." -ForegroundColor Cyan

# List of direct Registry commands to ensure complete removal across HKCU and HKLM.
$commands = @(
    'REG DELETE "HKEY_CURRENT_USER\Software\Classes\*\shell\grepWin" /f',
    'REG DELETE "HKEY_CURRENT_USER\Software\Classes\Directory\shell\grepWin" /f',
    'REG DELETE "HKEY_CURRENT_USER\Software\Classes\Directory\Background\shell\grepWin" /f',
    'REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\grepWin" /f',
    'REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\grepWin" /f',
    'REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shell\grepWin" /f'
)

# Execute each command silently and wait for completion to prevent race conditions.
foreach ($cmd in $commands) {
    # Using 'cmd /c' to execute native reg commands without triggering PowerShell error handling for missing keys.
    Start-Process cmd -ArgumentList "/c $cmd 2>nul" -WindowStyle Hidden -Wait
    Write-Host "." -NoNewline -ForegroundColor Gray
}

Write-Host "`n[SUCCESS] grepWin cleanup completed successfully. ✅" -ForegroundColor Green
Write-Host "--------------------------------------------------------"

##------------------------------------------------------##

# --- 11. CLEAR POWERSHELL HISTORY ---
$historyFile = "$HOME\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"

if (Test-Path $historyFile) {
    Remove-Item $historyFile -Force -ErrorAction SilentlyContinue
}

##------------------------------------------------------##

# --- 12. FINALIZATION TERMINAL BOX ---
Write-Host ""
Write-Host "  ╔══════════════════════════════════════════════════════╗" -ForegroundColor Gray
Write-Host "  ║                                                      ║" -ForegroundColor Gray
Write-Host "  ║   " -NoNewline -ForegroundColor Gray
Write-Host "SYSTEM STATUS: OPTIMIZED & SECURED  ✅ 🐾          " -ForegroundColor Green
Write-Host "  ║                                                      ║" -ForegroundColor Gray
Write-Host "  ║   " -NoNewline -ForegroundColor Gray
Write-Host "The PC is happy now. Go grab a tea. ☕                " -ForegroundColor White
Write-Host "  ║   " -NoNewline -ForegroundColor Gray
Write-Host "Even the parrot thinks this build is fly. 🦜          " -ForegroundColor White
Write-Host "  ║                                                      ║" -ForegroundColor Gray
Write-Host "  ╚══════════════════════════════════════════════════════╝" -ForegroundColor Gray
Write-Host ""

# --- EXIT PROTOCOL (7s AUTO-CLOSE) ---
Write-Host "  >> All done! Press any key to vanish... " -ForegroundColor DarkGray -NoNewline

$timer = 7
while ($timer -gt 0 -and (-not [console]::KeyAvailable)) {
    Write-Host "..$timer " -NoNewline -ForegroundColor Gray
    Start-Sleep -Seconds 1
    $timer--
}

# If a key was pressed, clear it from the buffer before exiting
if ([console]::KeyAvailable) {
    [void][console]::ReadKey($true)
}

Write-Host "`n  [!] System exiting..." -ForegroundColor Gray

# Forces the current PowerShell process to terminate immediately
[System.Environment]::Exit(0)

##------------------------------------------------------##