[Console]::OutputEncoding = [Text.Encoding]::UTF8
$ErrorActionPreference = 'Continue'

$ns       = 'C:\Program Files\NirSoft'
$stamp    = Get-Date -Format 'yyyyMMdd-HHmmss'
$hostname = $env:COMPUTERNAME
$outDir   = Join-Path $env:TEMP "nirsoft-dump-$hostname-$stamp"
New-Item -ItemType Directory -Force -Path $outDir | Out-Null

function Run-Tool {
    param(
        [string]$Name,
        [string]$Exe,
        [string[]]$ArgList,
        [int]$TimeoutSec = 60
    )
    $path = Join-Path $ns "$Name\$Exe"
    if (-not (Test-Path $path)) {
        Write-Host "[skip] $Name not installed"
        return
    }
    Write-Host "[*] $Name"
    try {
        $p = Start-Process -FilePath $path -ArgumentList $ArgList -Wait -PassThru -WindowStyle Hidden
        if ($p.ExitCode -ne 0) { Write-Host "    (exit $($p.ExitCode))" }
    } catch {
        Write-Host "    [!] $($_.Exception.Message)"
    }
}

# === NirSoft CSV dumps ===
Run-Tool 'BlueScreenView'      'BlueScreenView.exe'      @('/scomma', (Join-Path $outDir 'bluescreen.csv'))
Run-Tool 'LastActivityView'    'LastActivityView.exe'    @('/scomma', (Join-Path $outDir 'lastactivity.csv'))
Run-Tool 'WhatInStartup'       'WhatInStartup.exe'       @('/scomma', (Join-Path $outDir 'startup.csv'))
Run-Tool 'OpenedFilesView'     'OpenedFilesView.exe'     @('/scomma', (Join-Path $outDir 'opened-files.csv'))
Run-Tool 'InstalledAppView'    'InstalledAppView.exe'    @('/scomma', (Join-Path $outDir 'installed-apps.csv'))
Run-Tool 'DevManView'          'DevManView.exe'          @('/scomma', (Join-Path $outDir 'devices.csv'))
Run-Tool 'USBDeview'           'USBDeview.exe'           @('/scomma', (Join-Path $outDir 'usb-history.csv'))
Run-Tool 'TurnedOnTimesView'   'TurnedOnTimesView.exe'   @('/scomma', (Join-Path $outDir 'uptime.csv'))
Run-Tool 'CurrPorts'           'cports.exe'              @('/scomma', (Join-Path $outDir 'ports.csv'))
Run-Tool 'WifiInfoView'        'WifiInfoView.exe'        @('/scomma', (Join-Path $outDir 'wifi-nearby.csv'))
Run-Tool 'WirelessNetView'     'WirelessNetView.exe'     @('/scomma', (Join-Path $outDir 'wifi-tracking.csv'))
Run-Tool 'DNSDataView'         'DNSDataView.exe'         @('/scomma', (Join-Path $outDir 'dns-cache.csv'))

# === Native Windows snapshots ===
Write-Host ""
Write-Host "[*] Native Windows snapshots"

& systeminfo.exe | Out-File (Join-Path $outDir 'systeminfo.txt') -Encoding UTF8
& ipconfig.exe /all | Out-File (Join-Path $outDir 'ipconfig.txt') -Encoding UTF8
& netstat.exe -ano | Out-File (Join-Path $outDir 'netstat.txt') -Encoding UTF8

Get-Process | Select-Object Id,ProcessName,CPU,WS,@{n='WS_MB';e={[math]::Round($_.WS/1MB,1)}},Path,StartTime |
    Export-Csv -Path (Join-Path $outDir 'processes.csv') -NoTypeInformation -Encoding UTF8

Get-Service | Select-Object Name,DisplayName,Status,StartType |
    Export-Csv -Path (Join-Path $outDir 'services.csv') -NoTypeInformation -Encoding UTF8

Get-ScheduledTask | Select-Object TaskPath,TaskName,State,Author |
    Export-Csv -Path (Join-Path $outDir 'scheduled-tasks.csv') -NoTypeInformation -Encoding UTF8

# Recent error/warning events (System + Application, last 24h)
Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2,3; StartTime=(Get-Date).AddHours(-24)} -MaxEvents 500 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated,Id,LevelDisplayName,ProviderName,Message |
    Export-Csv -Path (Join-Path $outDir 'events-system-24h.csv') -NoTypeInformation -Encoding UTF8
Get-WinEvent -FilterHashtable @{LogName='Application'; Level=1,2,3; StartTime=(Get-Date).AddHours(-24)} -MaxEvents 500 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated,Id,LevelDisplayName,ProviderName,Message |
    Export-Csv -Path (Join-Path $outDir 'events-application-24h.csv') -NoTypeInformation -Encoding UTF8

# === Summary file ===
@"
=== Nirsoft + System Dump ===
Host:        $hostname
Timestamp:   $stamp
User running: $env:USERDOMAIN\$env:USERNAME
OS:          $((Get-CimInstance Win32_OperatingSystem).Caption) $((Get-CimInstance Win32_OperatingSystem).Version)
Boot time:   $((Get-CimInstance Win32_OperatingSystem).LastBootUpTime)
Uptime:      $((Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime)

Files in this archive:
$((Get-ChildItem $outDir | Sort-Object Name | ForEach-Object { "  - $($_.Name) ($(if ($_.Length) { '{0:N0}' -f $_.Length } else { '-' }) bytes)" }) -join "`r`n")
"@ | Out-File (Join-Path $outDir '_summary.txt') -Encoding UTF8

# === Zip and announce ===
$zipPath = "$outDir.zip"
Compress-Archive -Path (Join-Path $outDir '*') -DestinationPath $zipPath -Force
$zipSize = (Get-Item $zipPath).Length

Write-Host ""
Write-Host "====================================="
Write-Host "DUMP_ZIP: $zipPath"
Write-Host "DUMP_SIZE: $zipSize"
Write-Host "====================================="

# Optional cleanup of the uncompressed dir
Remove-Item $outDir -Recurse -Force -ErrorAction SilentlyContinue