#Requires -Version 5.1
<#
    Schooi's Multitool (SMT) Installer/Bootstrapper
    Downloads and runs the SMT setup executable, handling self-elevation,
    AV exclusions (with Tamper Protection detection), retries, and cleanup.
    Installer will still attempt to run even if the AV exclusion fails.
#>

Set-StrictMode -Version Latest

# ---------------------------------------------------------------------------
# Configuration
# ---------------------------------------------------------------------------
$SMTTempPath = Join-Path $env:TEMP 'SMT'
$SetupPath   = Join-Path $SMTTempPath 'SMTSetup.exe'
$SetupUrl    = 'https://github.com/SchooiCodes/smt/raw/main/Schooi%27s%20Multitool%20Setup.exe'
$ScriptUrl   = 'https://smt.gleeze.com'
$MaxAttempts = 3
$ESC = [char]27
$Bright_Green  = "$ESC[92m"
$Bright_Red    = "$ESC[91m"
$Bright_Yellow = "$ESC[93m"
$Reset         = "$ESC[0m"

Write-Host ''
Write-Host '░██████╗░█████╗░██╗░░██╗░█████╗░░█████╗░██╗██╗░██████╗
██╔════╝██╔══██╗██║░░██║██╔══██╗██╔══██╗██║╚█║██╔════╝
╚█████╗░██║░░╚═╝███████║██║░░██║██║░░██║██║░╚╝╚█████╗░
░╚═══██╗██║░░██╗██╔══██║██║░░██║██║░░██║██║░░░░╚═══██╗
██████╔╝╚█████╔╝██║░░██║╚█████╔╝╚█████╔╝██║░░░██████╔╝
╚═════╝░░╚════╝░╚═╝░░╚═╝░╚════╝░░╚════╝░╚═╝░░░╚═════╝░

███╗░░░███╗██╗░░░██╗██╗░░░░░████████╗██╗████████╗░█████╗░░█████╗░██╗░░░░░
████╗░████║██║░░░██║██║░░░░░╚══██╔══╝██║╚══██╔══╝██╔══██╗██╔══██╗██║░░░░░
██╔████╔██║██║░░░██║██║░░░░░░░░██║░░░██║░░░██║░░░██║░░██║██║░░██║██║░░░░░
██║╚██╔╝██║██║░░░██║██║░░░░░░░░██║░░░██║░░░██║░░░██║░░██║██║░░██║██║░░░░░
██║░╚═╝░██║╚██████╔╝███████╗░░░██║░░░██║░░░██║░░░╚█████╔╝╚█████╔╝███████╗
╚═╝░░░░░╚═╝░╚═════╝░╚══════╝░░░╚═╝░░░╚═╝░░░╚═╝░░░░╚════╝░░╚════╝░╚══════╝'
Write-Host ''

# ---------------------------------------------------------------------------
# OS / architecture gate
# ---------------------------------------------------------------------------
if (-not [Environment]::Is64BitOperatingSystem) {
    Write-Host [$Bright_Red-$Reset] SMT requires a 64-bit version of Windows 10/11. This PC is not supported.
    exit 1
}

# ---------------------------------------------------------------------------
# Admin check + self-elevation
# ---------------------------------------------------------------------------
$currentPrincipal = New-Object Security.Principal.WindowsPrincipal(
    [Security.Principal.WindowsIdentity]::GetCurrent()
)
$isAdmin = $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if (-not $isAdmin) {
    Write-Host [$Bright_Red-$Reset] Elevation required! Restarting as administrator..

    if ($PSCommandPath) {
        # Running from a real .ps1 file on disk
        $argList = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', "`"$PSCommandPath`"")
    } else {
        # Running via irm | iex - no file exists on disk, so re-fetch and re-run remotely
        $argList = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-Command', "irm '$ScriptUrl' | iex")
    }

    try {
        Start-Process -FilePath PowerShell.exe -Verb RunAs -ArgumentList $argList -ErrorAction Stop
    } catch {
        Write-Host [$Bright_Red-$Reset] Elevation was cancelled or failed.
        Write-Host [$Bright_Yellow!$Reset] "Please start PowerShell or Terminal as an Administrator and run the command again."
        Write-Host [$Bright_Yellow!$Reset] "(Right click Start -> Terminal/PowerShell (Admin), or WIN + R -> powershell -> CTRL+SHIFT+ENTER)"
        exit 1
    }
    exit
}

# ---------------------------------------------------------------------------
# Prep working directory
# ---------------------------------------------------------------------------
New-Item -Path $SMTTempPath -ItemType Directory -Force | Out-Null

# ---------------------------------------------------------------------------
# Tamper Protection check
# ---------------------------------------------------------------------------
function Test-TamperProtectionEnabled {
    try {
        $status = Get-MpComputerStatus -ErrorAction Stop
        return [bool]$status.IsTamperProtected
    } catch {
        return $null   # Get-MpComputerStatus missing/failing - likely third-party AV active
    }
}

# ---------------------------------------------------------------------------
# Download + install (with guaranteed cleanup)
# Note: the AV exclusion step never blocks the install - if it fails or can't
# be verified, the script prints why and proceeds to download/install anyway.
# ---------------------------------------------------------------------------
$exclusionAdded = $false

try {
    $tamperStatus = Test-TamperProtectionEnabled

    if ($tamperStatus -eq $true) {
        Write-Host [$Bright_Red-$Reset] Tamper Protection is enabled - exclusions cannot be set automatically.
        Write-Host [$Bright_Red-$Reset] Skipping Defender exclusion.
        Write-Host [$Bright_Yellow!$Reset] If files get falsely flagged, you can add the exclusion manually "(Virus & threat protection > Manage settings > Exclusions)".
    } elseif ($tamperStatus -eq $false) {
        Write-Host [$Bright_Yellow~$Reset] Adding antivirus exclusion for setup executable..
        try {
            Add-MpPreference -ExclusionPath $SetupPath -ErrorAction Stop
            Start-Sleep -Milliseconds 500   # allow the preference store to update

            $currentExclusions = (Get-MpPreference -ErrorAction Stop).ExclusionPath
            if ($currentExclusions -contains $SetupPath) {
                $exclusionAdded = $true
                Write-Host [$Bright_Green+$Reset] Exclusion confirmed.
            } else {
                Write-Host [$Bright_Red-$Reset] Exclusion did not apply for an unknown reason. Continuing anyway.
            }
        } catch {
            Write-Host [$Bright_Red-$Reset] Could not set AV exclusion, continuing without it: $_
        }
    } else {
        Write-Host [$Bright_Red-$Reset] Could not determine Defender status (a third-party AV may be active). Continuing without an exclusion.
    }

    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $ProgressPreference = 'SilentlyContinue'   # speeds up Invoke-WebRequest substantially

    Write-Host [$Bright_Yellow~$Reset] Downloading setup executable..
    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
        try {
            Invoke-WebRequest -Uri $SetupUrl -OutFile $SetupPath -UseBasicParsing -TimeoutSec 30 -ErrorAction Stop
            break
        } catch {
            if ($attempt -eq $MaxAttempts) { throw }
            Write-Host [$Bright_Red-$Reset] Download attempt $attempt failed, retrying..
            Start-Sleep -Seconds (2 * $attempt)
        }
    }

    if ((Get-Item $SetupPath).Length -lt 100KB) {
        throw 'Downloaded file looks incomplete or invalid (size check failed).'
    }
    Write-Host [$Bright_Green+$Reset] Download completed successfully.

    Write-Host [$Bright_Yellow~$Reset] Installing SMT..
    $proc = Start-Process -FilePath $SetupPath -ArgumentList @('/S', '/NOLAUNCH') -Wait -PassThru
    if ($proc.ExitCode -ne 0) {
        throw "Installer exited with code $($proc.ExitCode)."
    }
    Write-Host [$Bright_Green+$Reset] Installation completed successfully.
}
catch {
    Write-Host [$Bright_Red-$Reset] "Error: $_"
    exit 1
}
finally {
    Write-Host [$Bright_Yellow~$Reset] Cleaning up temporary files and antivirus exclusion..
    if ($exclusionAdded) {
        Remove-MpPreference -ExclusionPath $SetupPath -ErrorAction SilentlyContinue
    }
    if (Test-Path $SMTTempPath) {
        Remove-Item -Path $SMTTempPath -Recurse -Force -ErrorAction SilentlyContinue
    }
}

Write-Host [$Bright_Green+$Reset] Script execution completed.
Write-Host