#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Configure a Windows malware analysis VM with FLARE VM tools.

.DESCRIPTION
    Installs malware analysis tools via Chocolatey and direct downloads.
    Includes debuggers, disassemblers, network tools, and utilities.

.PARAMETER Minimal
    Install only core tools (x64dbg, Ghidra, PE-bear, YARA, capa).

.PARAMETER SkipChocolatey
    Skip Chocolatey installation (assume it is already present).

.PARAMETER SkipPython
    Skip Python and Python library installation.

.EXAMPLE
    .\setup_flarevm.ps1
    .\setup_flarevm.ps1 -Minimal
    .\setup_flarevm.ps1 -SkipPython
#>

param(
    [switch]$Minimal,
    [switch]$SkipChocolatey,
    [switch]$SkipPython
)

$ErrorActionPreference = "Stop"
$ProgressPreference = "SilentlyContinue"

$LogFile = "$env:USERPROFILE\Desktop\flarevm_setup.log"

# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------
function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $entry = "[$ts] [$Level] $Message"
    Write-Host $entry
    Add-Content -Path $LogFile -Value $entry
}

function Test-Command {
    param([string]$Name)
    return [bool](Get-Command $Name -ErrorAction SilentlyContinue)
}

function Install-ChocoPackage {
    param([string]$PackageName, [string]$ExtraArgs = "")
    Write-Log "Installing Chocolatey package: $PackageName"
    try {
        if ($ExtraArgs) {
            choco install $PackageName -y --no-progress --package-parameters $ExtraArgs 2>&1 | Out-Null
        } else {
            choco install $PackageName -y --no-progress 2>&1 | Out-Null
        }
        Write-Log "  Installed: $PackageName"
    } catch {
        Write-Log "  Failed to install $PackageName : $_" "WARN"
    }
}

# ---------------------------------------------------------------------------
# Disable Windows Defender (for analysis VM only)
# ---------------------------------------------------------------------------
function Disable-Defender {
    Write-Log "Disabling Windows Defender real-time protection..."
    try {
        Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue
        Set-MpPreference -DisableBehaviorMonitoring $true -ErrorAction SilentlyContinue
        Set-MpPreference -DisableIOAVProtection $true -ErrorAction SilentlyContinue
        Set-MpPreference -DisableScriptScanning $true -ErrorAction SilentlyContinue
        Add-MpPreference -ExclusionPath "C:\" -ErrorAction SilentlyContinue
        Write-Log "  Defender real-time protection disabled"
    } catch {
        Write-Log "  Could not disable Defender (may require Tamper Protection off): $_" "WARN"
    }
}

# ---------------------------------------------------------------------------
# Install Chocolatey
# ---------------------------------------------------------------------------
function Install-Chocolatey {
    if ($SkipChocolatey) {
        Write-Log "Skipping Chocolatey installation (flag set)"
        return
    }
    if (Test-Command "choco") {
        Write-Log "Chocolatey already installed: $(choco --version)"
        return
    }
    Write-Log "Installing Chocolatey..."
    Set-ExecutionPolicy Bypass -Scope Process -Force
    [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
    Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
    $env:Path = "$env:ProgramData\chocolatey\bin;$env:Path"
    Write-Log "Chocolatey installed: $(choco --version)"
}

# ---------------------------------------------------------------------------
# Core tools
# ---------------------------------------------------------------------------
function Install-CoreTools {
    Write-Log "Installing core analysis tools..."

    # Debuggers
    Install-ChocoPackage "x64dbg.portable"
    Install-ChocoPackage "windbg"

    # Disassemblers / Decompilers
    Install-ChocoPackage "ghidra"
    Install-ChocoPackage "ida-free"

    # PE Analysis
    Install-ChocoPackage "pestudio"
    Install-ChocoPackage "pe-bear"
    Install-ChocoPackage "cff-explorer"
    Install-ChocoPackage "die"

    # YARA
    Install-ChocoPackage "yara"

    # Hex editors
    Install-ChocoPackage "hxd"
    Install-ChocoPackage "010editor"

    # Utilities
    Install-ChocoPackage "7zip"
    Install-ChocoPackage "notepadplusplus"
    Install-ChocoPackage "git"
    Install-ChocoPackage "jq"

    # capa
    Install-Capa
}

function Install-Capa {
    Write-Log "Installing Mandiant capa..."
    $capaVersion = "7.1.0"
    $capaUrl = "https://github.com/mandiant/capa/releases/download/v$capaVersion/capa-v$capaVersion-windows.zip"
    $capaDir = "$env:ProgramFiles\capa"
    try {
        New-Item -ItemType Directory -Force -Path $capaDir | Out-Null
        $tmpZip = "$env:TEMP\capa.zip"
        Invoke-WebRequest -Uri $capaUrl -OutFile $tmpZip -UseBasicParsing
        Expand-Archive -Path $tmpZip -DestinationPath $capaDir -Force
        $env:Path += ";$capaDir"
        [Environment]::SetEnvironmentVariable("Path", $env:Path, [EnvironmentVariableTarget]::Machine)
        Remove-Item $tmpZip -Force
        Write-Log "  capa installed to $capaDir"
    } catch {
        Write-Log "  Failed to install capa: $_" "WARN"
    }
}

# ---------------------------------------------------------------------------
# Additional tools (full install)
# ---------------------------------------------------------------------------
function Install-AdditionalTools {
    Write-Log "Installing additional analysis tools..."

    # Network tools
    Install-ChocoPackage "wireshark"
    Install-ChocoPackage "fiddler"
    Install-ChocoPackage "nmap"

    # .NET analysis
    Install-ChocoPackage "dnspy"
    Install-ChocoPackage "ilspy"
    Install-ChocoPackage "de4dot"

    # Document analysis
    Install-ChocoPackage "oledump"

    # Process analysis
    Install-ChocoPackage "sysinternals"
    Install-ChocoPackage "processhacker"
    Install-ChocoPackage "apimonitor"

    # Crypto / encoding
    Install-ChocoPackage "cyberchef"
}

# ---------------------------------------------------------------------------
# Python environment
# ---------------------------------------------------------------------------
function Install-PythonEnvironment {
    if ($SkipPython) {
        Write-Log "Skipping Python installation (flag set)"
        return
    }

    Write-Log "Installing Python..."
    Install-ChocoPackage "python3" "--install-arguments='/quiet InstallAllUsers=1 PrependPath=1'"

    # Refresh PATH
    $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "User")

    Write-Log "Installing Python analysis libraries..."
    $pipPackages = @(
        "pefile",
        "lief",
        "capstone",
        "unicorn",
        "keystone-engine",
        "yara-python",
        "oletools",
        "pycryptodome",
        "dnfile",
        "angr",
        "floss",
        "malduck",
        "stix2",
        "requests",
        "rich"
    )
    foreach ($pkg in $pipPackages) {
        try {
            python -m pip install --quiet $pkg 2>&1 | Out-Null
            Write-Log "  pip: $pkg installed"
        } catch {
            Write-Log "  pip: $pkg failed - $_" "WARN"
        }
    }
}

# ---------------------------------------------------------------------------
# Environment configuration
# ---------------------------------------------------------------------------
function Set-AnalysisEnvironment {
    Write-Log "Configuring analysis environment..."

    # Show file extensions
    Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" `
        -Name "HideFileExt" -Value 0 -Type DWord

    # Show hidden files
    Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" `
        -Name "Hidden" -Value 1 -Type DWord

    # Disable UAC (analysis VM only)
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" `
        -Name "EnableLUA" -Value 0 -Type DWord -ErrorAction SilentlyContinue

    # Create analysis directories
    $dirs = @("$env:USERPROFILE\Desktop\Malware", "$env:USERPROFILE\Desktop\Tools", "$env:USERPROFILE\Desktop\Output")
    foreach ($d in $dirs) {
        New-Item -ItemType Directory -Force -Path $d | Out-Null
    }

    Write-Log "  Environment configured"
}

# ---------------------------------------------------------------------------
# Summary
# ---------------------------------------------------------------------------
function Show-Summary {
    Write-Log "============================================"
    Write-Log "  FLARE VM Setup Complete"
    Write-Log "============================================"
    Write-Log ""
    Write-Log "Log file: $LogFile"
    Write-Log ""
    Write-Log "Next steps:"
    Write-Log "  1. Reboot the VM to apply all changes"
    Write-Log "  2. Take a VM snapshot labeled 'analysis-ready'"
    Write-Log "  3. Verify: capa --version; yara --version"
    Write-Log ""

    $tools = @("capa", "yara64", "x64dbg", "python", "tshark", "git")
    foreach ($t in $tools) {
        if (Test-Command $t) {
            Write-Log "  [OK] $t" "INFO"
        } else {
            Write-Log "  [MISSING] $t" "WARN"
        }
    }
}

# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------
function Main {
    "" | Out-File -FilePath $LogFile
    Write-Log "Starting FLARE VM setup ($(Get-Date))"

    Disable-Defender
    Install-Chocolatey
    Install-CoreTools

    if (-not $Minimal) {
        Install-AdditionalTools
        Install-PythonEnvironment
    }

    Set-AnalysisEnvironment
    Show-Summary
}

Main