@echo off
setlocal EnableExtensions
title Ganti img0.jpg sebagai SYSTEM

net session >nul 2>&1
if errorlevel 1 (
  echo Meminta hak Administrator...
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
  exit /b
)

set "SVC=RDPKOIWallpaperSvc"
set "B64=C:\Windows\Temp\RDPKOI_Wallpaper.b64"
set "PS1=C:\Windows\Temp\RDPKOI_Wallpaper.ps1"
set "RUNNER=C:\Windows\Temp\RDPKOI_Wallpaper_Run.cmd"
set "RESULT=C:\Windows\Temp\RDPKOI_Wallpaper.result"
set "LOG=C:\Windows\Temp\RDPKOI_Wallpaper.log"

sc.exe stop "%SVC%" >nul 2>&1
sc.exe delete "%SVC%" >nul 2>&1
del /q "%B64%" "%PS1%" "%RUNNER%" "%RESULT%" "%LOG%" >nul 2>&1

echo.
echo ============================================================
echo   Mengganti img0.jpg menggunakan akun SYSTEM
echo ============================================================
echo.
echo Menyiapkan proses...
>>"%B64%" echo JEVycm9yQWN0aW9uUHJlZmVyZW5jZSA9ICdTdG9wJwokUHJvZ3Jlc3NQcmVmZXJlbmNlID0gJ1NpbGVudGx5Q29udGludWUnCgokVXJsID0gJ2h0dHBzOi8vdXBsb2FkLmJ1eXJkcC5iaXouaWQvd2Via29pL2JhY2tyb3VuZC9iYWNyb3VuZCcKJFdhbGxwYXBlckRpciA9IEpvaW4tUGF0aCAkZW52OldJTkRJUiAnV2ViXFdhbGxwYXBlclxXaW5kb3dzJwokVGFyZ2V0ID0gSm9pbi1QYXRoICRXYWxscGFwZXJEaXIgJ2ltZzAuanBnJwokUG5nVGVtcCA9ICdDOlxXaW5kb3dzXFRlbXBcUkRQS09JX05FVy5wbmcnCiRKcGdUZW1wID0gJ0M6XFdpbmRvd3NcVGVtcFxSRFBLT0lfTkVXLmpwZycKJFJlc3VsdCA9ICdDOlxXaW5kb3dzXFRlbXBcUkRQS09JX1dhbGxwYXBlci5yZXN1bHQnCiRCYWNrdXAgPSBKb2luLVBhdGggJFdhbGxwYXBlckRpciAoJ2ltZzBfYmFja3VwXycgKyAoR2V0LURhdGUgLUZvcm1hdCAneXl5eU1NZGRfSEhtbXNzJykgKyAnLmpwZycpCgp0cn
>>"%B64%" echo kgewogICAgIlJ1bm5pbmcgYXM6ICQoW1NlY3VyaXR5LlByaW5jaXBhbC5XaW5kb3dzSWRlbnRpdHldOjpHZXRDdXJyZW50KCkuTmFtZSkiCgogICAgaWYgKC1ub3QgKFRlc3QtUGF0aCAtTGl0ZXJhbFBhdGggJFdhbGxwYXBlckRpcikpIHsKICAgICAgICB0aHJvdyAiRm9sZGVyIHRpZGFrIGRpdGVtdWthbjogJFdhbGxwYXBlckRpciIKICAgIH0KCiAgICAnWzEvNl0gTWVuZ3VuZHVoIE5FVy5wbmcuLi4nCiAgICBbTmV0LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpTZWN1cml0eVByb3RvY29sID0gW05ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyCiAgICBJbnZva2UtV2ViUmVxdWVzdCAtVXJpICRVcmwgLU91dEZpbGUgJFBuZ1RlbXAgLVVzZUJhc2ljUGFyc2luZwoKICAgIGlmICgtbm90IChUZXN0LVBhdGggLUxpdGVyYWxQYXRoICRQbmdUZW1wKSAtb3IKICAgICAgICAoR2V0LUl0ZW0gLUxpdGVyYWxQYXRoICRQbmdUZW1wKS5MZW5ndGggLWx0IDEw
>>"%B64%" echo MjQpIHsKICAgICAgICB0aHJvdyAnRG93bmxvYWQgZ2FnYWwgYXRhdSBmaWxlIHRlcmxhbHUga2VjaWwuJwogICAgfQoKICAgICdbMi82XSBNZW5ndWJhaCBQTkcgbWVuamFkaSBKUEcuLi4nCiAgICBBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5EcmF3aW5nCgogICAgJHNvdXJjZSA9IFtTeXN0ZW0uRHJhd2luZy5JbWFnZV06OkZyb21GaWxlKCRQbmdUZW1wKQogICAgdHJ5IHsKICAgICAgICAkYml0bWFwID0gTmV3LU9iamVjdCBTeXN0ZW0uRHJhd2luZy5CaXRtYXAgJHNvdXJjZS5XaWR0aCwgJHNvdXJjZS5IZWlnaHQKICAgICAgICB0cnkgewogICAgICAgICAgICAkZ3JhcGhpY3MgPSBbU3lzdGVtLkRyYXdpbmcuR3JhcGhpY3NdOjpGcm9tSW1hZ2UoJGJpdG1hcCkKICAgICAgICAgICAgdHJ5IHsKICAgICAgICAgICAgICAgICRncmFwaGljcy5DbGVhcihbU3lzdGVtLkRyYXdpbmcuQ29sb3JdOjpCbGFjaykKICAgICAgICAgICAgICAgICRncmFwaG
>>"%B64%" echo ljcy5EcmF3SW1hZ2UoJHNvdXJjZSwgMCwgMCwgJHNvdXJjZS5XaWR0aCwgJHNvdXJjZS5IZWlnaHQpCiAgICAgICAgICAgIH0KICAgICAgICAgICAgZmluYWxseSB7ICRncmFwaGljcy5EaXNwb3NlKCkgfQoKICAgICAgICAgICAgaWYgKFRlc3QtUGF0aCAtTGl0ZXJhbFBhdGggJEpwZ1RlbXApIHsKICAgICAgICAgICAgICAgIFJlbW92ZS1JdGVtIC1MaXRlcmFsUGF0aCAkSnBnVGVtcCAtRm9yY2UKICAgICAgICAgICAgfQogICAgICAgICAgICAkYml0bWFwLlNhdmUoJEpwZ1RlbXAsIFtTeXN0ZW0uRHJhd2luZy5JbWFnaW5nLkltYWdlRm9ybWF0XTo6SnBlZykKICAgICAgICB9CiAgICAgICAgZmluYWxseSB7ICRiaXRtYXAuRGlzcG9zZSgpIH0KICAgIH0KICAgIGZpbmFsbHkgeyAkc291cmNlLkRpc3Bvc2UoKSB9CgogICAgJ1szLzZdIE1lbWJhY2t1cCBpbWcwLmpwZyBsYW1hLi4uJwogICAgaWYgKFRlc3QtUGF0aCAtTGl0ZXJhbFBhdGggJFRhcmdldCkg
>>"%B64%" echo ewogICAgICAgIENvcHktSXRlbSAtTGl0ZXJhbFBhdGggJFRhcmdldCAtRGVzdGluYXRpb24gJEJhY2t1cCAtRm9yY2UKICAgICAgICAiQmFja3VwOiAkQmFja3VwIgogICAgfQoKICAgICdbNC82XSBNZW5nYW1iaWwgaXppbiBmaWxlLi4uJwogICAgJiB0YWtlb3duLmV4ZSAvRiAkVGFyZ2V0IC9BIHwgT3V0LU51bGwKICAgICYgaWNhY2xzLmV4ZSAkVGFyZ2V0IC9ncmFudCAnKlMtMS01LTE4OkYnIC9DIHwgT3V0LU51bGwKICAgICYgaWNhY2xzLmV4ZSAkVGFyZ2V0IC9ncmFudCAnKlMtMS01LTMyLTU0NDpGJyAvQyB8IE91dC1OdWxsCiAgICAmIGF0dHJpYi5leGUgLVIgLVMgLUggJFRhcmdldCAyPiRudWxsCgogICAgJ1s1LzZdIE1lbmltcGEgZmlsZSBpbWcwLmpwZy4uLicKICAgIGlmIChUZXN0LVBhdGggLUxpdGVyYWxQYXRoICRUYXJnZXQpIHsKICAgICAgICBbU3lzdGVtLklPLkZpbGVdOjpEZWxldGUoJFRhcmdldCkKICAgIH0KICAgIFtTeXN0ZW0uSU
>>"%B64%" echo 8uRmlsZV06OkNvcHkoJEpwZ1RlbXAsICRUYXJnZXQsICR0cnVlKQoKICAgICRhID0gKEdldC1GaWxlSGFzaCAtTGl0ZXJhbFBhdGggJEpwZ1RlbXAgLUFsZ29yaXRobSBTSEEyNTYpLkhhc2gKICAgICRiID0gKEdldC1GaWxlSGFzaCAtTGl0ZXJhbFBhdGggJFRhcmdldCAtQWxnb3JpdGhtIFNIQTI1NikuSGFzaAogICAgaWYgKCRhIC1uZSAkYikgewogICAgICAgIHRocm93ICdWZXJpZmlrYXNpIGZpbGUgZ2FnYWwuJwogICAgfQoKICAgICdbNi82XSBNZW5nYXR1ciBwcm9maWwgRGVmYXVsdCB1bnR1ayBha3VuIGJhcnUuLi4nCiAgICAkRGVmYXVsdEhpdmUgPSAnQzpcVXNlcnNcRGVmYXVsdFxOVFVTRVIuREFUJwogICAgJEhpdmVOYW1lID0gJ1JEUEtPSV9ERUZBVUxUJwogICAgJGxvYWRlZCA9ICRmYWxzZQoKICAgIGlmIChUZXN0LVBhdGggLUxpdGVyYWxQYXRoICREZWZhdWx0SGl2ZSkgewogICAgICAgIHRyeSB7CiAgICAgICAgICAgICYgcmVnLmV4ZSBs
>>"%B64%" echo b2FkICJIS1VcJEhpdmVOYW1lIiAkRGVmYXVsdEhpdmUgfCBPdXQtTnVsbAogICAgICAgICAgICBpZiAoJExBU1RFWElUQ09ERSAtZXEgMCkgewogICAgICAgICAgICAgICAgJGxvYWRlZCA9ICR0cnVlCiAgICAgICAgICAgICAgICAka2V5ID0gIlJlZ2lzdHJ5OjpIS0VZX1VTRVJTXCRIaXZlTmFtZVxDb250cm9sIFBhbmVsXERlc2t0b3AiCiAgICAgICAgICAgICAgICBpZiAoLW5vdCAoVGVzdC1QYXRoICRrZXkpKSB7CiAgICAgICAgICAgICAgICAgICAgTmV3LUl0ZW0gLVBhdGggJGtleSAtRm9yY2UgfCBPdXQtTnVsbAogICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgTmV3LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAka2V5IC1OYW1lIFdhbGxwYXBlciAtVmFsdWUgJFRhcmdldCAtUHJvcGVydHlUeXBlIFN0cmluZyAtRm9yY2UgfCBPdXQtTnVsbAogICAgICAgICAgICAgICAgTmV3LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAka2V5IC1OYW1lIFdhbGxwYXBlcl
>>"%B64%" echo N0eWxlIC1WYWx1ZSAnMTAnIC1Qcm9wZXJ0eVR5cGUgU3RyaW5nIC1Gb3JjZSB8IE91dC1OdWxsCiAgICAgICAgICAgICAgICBOZXctSXRlbVByb3BlcnR5IC1QYXRoICRrZXkgLU5hbWUgVGlsZVdhbGxwYXBlciAtVmFsdWUgJzAnIC1Qcm9wZXJ0eVR5cGUgU3RyaW5nIC1Gb3JjZSB8IE91dC1OdWxsCiAgICAgICAgICAgIH0KICAgICAgICB9CiAgICAgICAgZmluYWxseSB7CiAgICAgICAgICAgIGlmICgkbG9hZGVkKSB7CiAgICAgICAgICAgICAgICBbZ2NdOjpDb2xsZWN0KCkKICAgICAgICAgICAgICAgIFtnY106OldhaXRGb3JQZW5kaW5nRmluYWxpemVycygpCiAgICAgICAgICAgICAgICAmIHJlZy5leGUgdW5sb2FkICJIS1VcJEhpdmVOYW1lIiB8IE91dC1OdWxsCiAgICAgICAgICAgIH0KICAgICAgICB9CiAgICB9CgogICAgUmVtb3ZlLUl0ZW0gLUxpdGVyYWxQYXRoICRQbmdUZW1wLCAkSnBnVGVtcCAtRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5
>>"%B64%" echo Q29udGludWUKICAgICdTVUNDRVNTOiBpbWcwLmpwZyBzdWRhaCBkaWdhbnRpLiBBa3VuIGJhcnUgYWthbiBtZW1ha2FpIHdhbGxwYXBlciBiYXJ1LicgfAogICAgICAgIFNldC1Db250ZW50IC1MaXRlcmFsUGF0aCAkUmVzdWx0IC1FbmNvZGluZyBBU0NJSQp9CmNhdGNoIHsKICAgICgnRkFJTEVEOiAnICsgJF8uRXhjZXB0aW9uLk1lc3NhZ2UpIHwKICAgICAgICBTZXQtQ29udGVudCAtTGl0ZXJhbFBhdGggJFJlc3VsdCAtRW5jb2RpbmcgQVNDSUkKICAgIGV4aXQgMQp9DQo=

certutil -f -decode "%B64%" "%PS1%" >nul 2>&1
if errorlevel 1 (
  echo GAGAL membuat file PowerShell.
  pause
  exit /b 1
)

> "%RUNNER%" echo @echo off
>>"%RUNNER%" echo powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File "%PS1%" ^> "%LOG%" 2^>^&1

sc.exe create "%SVC%" binPath= "C:\Windows\System32\cmd.exe /c C:\Windows\Temp\RDPKOI_Wallpaper_Run.cmd" start= demand obj= LocalSystem >nul
if errorlevel 1 (
  echo GAGAL membuat service SYSTEM.
  pause
  exit /b 1
)

sc.exe start "%SVC%" >nul 2>&1
echo Proses SYSTEM sedang berjalan...

set /a WAIT=0
:WAIT_LOOP
if exist "%RESULT%" goto DONE
timeout /t 2 /nobreak >nul
set /a WAIT+=2
if %WAIT% GEQ 120 goto TIMEOUT
goto WAIT_LOOP

:DONE
echo.
type "%RESULT%"
echo.
echo Log lengkap: %LOG%
sc.exe stop "%SVC%" >nul 2>&1
sc.exe delete "%SVC%" >nul 2>&1
del /q "%B64%" "%PS1%" "%RUNNER%" >nul 2>&1
pause
exit /b 0

:TIMEOUT
echo GAGAL: Proses melebihi 120 detik.
echo Periksa log: %LOG%
sc.exe stop "%SVC%" >nul 2>&1
sc.exe delete "%SVC%" >nul 2>&1
pause
exit /b 1