Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

function Test-IsAdministrator {
    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
    $principal = New-Object Security.Principal.WindowsPrincipal($identity)
    return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

if (-not (Test-IsAdministrator)) {
    throw "This script must be run from an elevated PowerShell session."
}

$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$manifestPath = Join-Path $scriptDir "armoury_update_disable_manifest_$timestamp.json"

$services = @(
    'ArmouryCrateService',
    'ROG Live Service',
    'ASUSSoftwareManager',
    'asus',
    'asusm'
)

$files = @(
    'C:\Windows\System32\DriverStore\FileRepository\rogms.inf_amd64_7bcd8839c8e4f2a7\ArmouryLiveUpdate.exe',
    'C:\Windows\System32\DriverStore\FileRepository\rogms.inf_amd64_7bcd8839c8e4f2a7\ArmouryUpdate.exe',
    'C:\Program Files (x86)\ASUS\ArmouryDevice\dll\FilterDriver\x64\Win11\ROGMS\ArmouryUpdate.exe',
    'C:\Program Files (x86)\ASUS\ArmouryDevice\dll\FilterDriver\x64\Win10\ROGMS\ArmouryUpdate.exe'
)

$report = [ordered]@{
    executedAt = (Get-Date).ToString('s')
    services = @()
    files = @()
    notes = @(
        'ASUS scheduled tasks were reviewed separately. No task with an explicit update executable was found, so this script does not disable ASUS tasks by default.'
    )
}

function Disable-ServiceForUpdate {
    param(
        [Parameter(Mandatory = $true)]
        [string]$Name
    )

    $svc = Get-CimInstance Win32_Service -Filter "Name='$Name'" -ErrorAction SilentlyContinue
    if (-not $svc) {
        return [ordered]@{
            name = $Name
            found = $false
            state = $null
            startModeBefore = $null
            changed = $false
            note = 'Service not found'
        }
    }

    $notes = @()
    $changed = $false

    if ($svc.State -eq 'Running') {
        try {
            Stop-Service -Name $Name -Force -ErrorAction Stop
            $notes += 'Stopped via Stop-Service'
            $changed = $true
        } catch {
            $notes += "Stop-Service failed: $($_.Exception.Message)"
            & sc.exe stop $Name | Out-Null
            Start-Sleep -Seconds 3
            $afterStop = Get-CimInstance Win32_Service -Filter "Name='$Name'"
            if ($afterStop.State -eq 'Running' -and $afterStop.ProcessId -gt 0) {
                & taskkill.exe /PID $afterStop.ProcessId /F | Out-Null
                $notes += "Killed service process PID $($afterStop.ProcessId)"
                $changed = $true
            }
        }
    }

    & sc.exe config $Name start= disabled | Out-Null
    $updated = Get-CimInstance Win32_Service -Filter "Name='$Name'"
    if ($updated.StartMode -eq 'Disabled') {
        $changed = $true
    }

    return [ordered]@{
        name = $Name
        found = $true
        state = $updated.State
        startModeBefore = $svc.StartMode
        startModeAfter = $updated.StartMode
        changed = $changed
        pathName = $svc.PathName
        note = ($notes -join '; ')
    }
}

function Rename-UpdateBinary {
    param(
        [Parameter(Mandatory = $true)]
        [string]$Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return [ordered]@{
            originalPath = $Path
            found = $false
            changed = $false
            note = 'File not found'
        }
    }

    $disabledPath = "$Path.disabled"
    if (Test-Path -LiteralPath $disabledPath) {
        return [ordered]@{
            originalPath = $Path
            disabledPath = $disabledPath
            found = $true
            changed = $false
            note = 'Disabled copy already exists'
        }
    }

    $parentDir = Split-Path -Parent $Path

    & takeown.exe /F $parentDir /A | Out-Null
    & icacls.exe $parentDir /grant Administrators:F | Out-Null
    & takeown.exe /F $Path /A | Out-Null
    & icacls.exe $Path /grant Administrators:F | Out-Null
    Rename-Item -LiteralPath $Path -NewName ([IO.Path]::GetFileName($disabledPath)) -ErrorAction Stop

    return [ordered]@{
        originalPath = $Path
        disabledPath = $disabledPath
        found = $true
        changed = $true
        note = 'File renamed to .disabled'
    }
}

foreach ($serviceName in $services) {
    $report.services += Disable-ServiceForUpdate -Name $serviceName
}

foreach ($filePath in $files) {
    $report.files += Rename-UpdateBinary -Path $filePath
}

$report | ConvertTo-Json -Depth 5 | Set-Content -LiteralPath $manifestPath -Encoding UTF8
$report | ConvertTo-Json -Depth 5