├── .gitattributes ├── .gitignore ├── README.md ├── composer.json ├── examples ├── AutoItObfuscatorExample.php ├── AutoItObfuscatorExampleIsDemo.php └── AutoItObfuscatorExampleSimple.php └── src └── AutoItObfuscator.php /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | 4 | # Custom for Visual Studio 5 | *.cs diff=csharp 6 | 7 | # Standard to msysgit 8 | *.doc diff=astextplain 9 | *.DOC diff=astextplain 10 | *.docx diff=astextplain 11 | *.DOCX diff=astextplain 12 | *.dot diff=astextplain 13 | *.DOT diff=astextplain 14 | *.pdf diff=astextplain 15 | *.PDF diff=astextplain 16 | *.rtf diff=astextplain 17 | *.RTF diff=astextplain 18 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Byte-compiled / optimized / DLL files 2 | __pycache__/ 3 | *.py[cod] 4 | *$py.class 5 | 6 | # C extensions 7 | *.so 8 | 9 | # Distribution / packaging 10 | .Python 11 | env/ 12 | build/ 13 | develop-eggs/ 14 | dist/ 15 | downloads/ 16 | eggs/ 17 | .eggs/ 18 | lib/ 19 | lib64/ 20 | parts/ 21 | sdist/ 22 | var/ 23 | *.egg-info/ 24 | .installed.cfg 25 | *.egg 26 | 27 | # PyInstaller 28 | # Usually these files are written by a python script from a template 29 | # before PyInstaller builds the exe, so as to inject date/other infos into it. 30 | *.manifest 31 | *.spec 32 | 33 | # Installer logs 34 | pip-log.txt 35 | pip-delete-this-directory.txt 36 | 37 | # Unit test / coverage reports 38 | htmlcov/ 39 | .tox/ 40 | .coverage 41 | .coverage.* 42 | .cache 43 | nosetests.xml 44 | coverage.xml 45 | *,cover 46 | .hypothesis/ 47 | 48 | # Translations 49 | *.mo 50 | *.pot 51 | 52 | # Django stuff: 53 | *.log 54 | local_settings.py 55 | 56 | # Flask instance folder 57 | instance/ 58 | 59 | # Scrapy stuff: 60 | .scrapy 61 | 62 | # Sphinx documentation 63 | docs/_build/ 64 | 65 | # PyBuilder 66 | target/ 67 | 68 | # IPython Notebook 69 | .ipynb_checkpoints 70 | 71 | # pyenv 72 | .python-version 73 | 74 | # celery beat schedule file 75 | celerybeat-schedule 76 | 77 | # dotenv 78 | .env 79 | 80 | # virtualenv 81 | venv/ 82 | ENV/ 83 | 84 | # Spyder project settings 85 | .spyderproject 86 | 87 | # Rope project settings 88 | .ropeproject 89 | 90 | # ========================= 91 | # Operating System Files 92 | # ========================= 93 | 94 | # OSX 95 | # ========================= 96 | 97 | .DS_Store 98 | .AppleDouble 99 | .LSOverride 100 | 101 | # Thumbnails 102 | ._* 103 | 104 | # Files that might appear in the root of a volume 105 | .DocumentRevisions-V100 106 | .fseventsd 107 | .Spotlight-V100 108 | .TemporaryItems 109 | .Trashes 110 | .VolumeIcon.icns 111 | 112 | # Directories potentially created on remote AFP share 113 | .AppleDB 114 | .AppleDesktop 115 | Network Trash Folder 116 | Temporary Items 117 | .apdisk 118 | 119 | # Windows 120 | # ========================= 121 | 122 | # Windows image file caches 123 | Thumbs.db 124 | ehthumbs.db 125 | 126 | # Folder config file 127 | Desktop.ini 128 | 129 | # Recycle Bin used on file shares 130 | $RECYCLE.BIN/ 131 | 132 | # Windows Installer files 133 | *.cab 134 | *.msi 135 | *.msm 136 | *.msp 137 | 138 | # Windows shortcuts 139 | *.lnk 140 | 141 | # Builds 142 | build 143 | dist 144 | *.egg-info 145 | .idea 146 | *.bat -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # AutoIt Obfuscator — Obfuscation for AutoIt Script Source Code 2 | 3 | AutoIt Obfuscator is a tool to modify AutoIt script source code in this way to 4 | make an analysis of obfuscated code very difficult. 5 | 6 | More technical details, downloads, documentation available at: 7 | 8 | https://www.pelock.com/products/autoit-obfuscator 9 | 10 | Online interface: 11 | 12 | https://www.pelock.com/autoit-obfuscator/ 13 | 14 | ## What is source code obfuscation? 15 | 16 | Obfuscation is a process of transforming AutoIt source code into protected 17 | version of itself. The script functionality stays the same, everything works 18 | the same, but the source code is protected from analysis, all of the variables 19 | are encrypted, strings are encrypted, our AutoIt Obfuscator uses multiple 20 | obfuscation strategies to protect the real meaning of your AutoIt source code. 21 | 22 | ### AutoIt script example before obfuscation 23 | 24 | ```autoit 25 | #include 26 | 27 | Example() 28 | 29 | Func Example() 30 | MsgBox($MB_SYSTEMMODAL, "AutoIt Obfuscator", "Hello World!") 31 | EndFunc ;==>Example 32 | ``` 33 | 34 | ### After obfuscation 35 | 36 | ```autoit 37 | ;//////////////////////////////////////////////////////////////////////////////// 38 | ;// 39 | ;// AutoIt Obfuscator v2.1 - Bartosz Wójcik 40 | ;// 41 | ;// Website : https://www.pelock.com/products/autoit-obfuscator 42 | ;// Version : v2.1 43 | ;// Date : 08.02.2024 44 | ;// 45 | ;//////////////////////////////////////////////////////////////////////////////// 46 | 47 | #include 48 | #include 49 | #AutoIt3Wrapper_Tidy_Stop_OnError=n 50 | #AutoIt3Wrapper_Run_AU3Check=n 51 | Global Const $daSQ_n1JN_mBs1I_ = Asc(StringMid("Random(1, 270905415 + SRandom(1566730703), 1)", 19, 1)) 52 | Global $RYRWVDVJ = Asc("J") 53 | Global $RYXLYH_RTGANHXUI = Asc("3") 54 | Global $tagRrdruaavjk[3] = [150, 1017374602, 10411] 55 | Global $DoaFoGAWMNbBmkAe__d = 4045 56 | Global $AXCGXJWX_OLRCOQFSXX = Asc("t") 57 | Global Const $iQzojqte = 26933 58 | Global Const $var_15[2][8] = [[1595107513, 1104537718, 868900013, 105640690, 47653, 116, 693837332, 16233], [1211827987, 1657997570, 37032, 227, 57, 6273, 762969513]] 59 | #OnAutoItStartRegister "VwdmsFnzdotDyuxttspg" 60 | Global Const $var_487[2][8] = [[1083217155, 30638, 84, 144, 43877, 189, 1295519879, 1915220323], [247, 163, 143, 18102, 51, 17202]] 61 | Global $QVCEHSV[2][9] = [[866325531, 131], [18637, 203, 995096871, 202, 287364341, 29839, 367413199, 52009, 242297425]] 62 | Global $var_3525 = Asc(StringMid("Until 1", 2, 1)) 63 | Global Const $WMMQB_NIFPPM[2][15] = [[81, 876847059, 170, 47439, 863656242, 33, 245, 119, 27673, 136, 28, 758746073, 199, _ 64 | 92], _ 65 | [129, 1658572839, 42061, 94, 70, 61382, 183, 12027, 91, 221, 43126, 1736920964, 201, _ 66 | 199, 993478498]] 67 | Global Const $var_1984[15] = [2081761766, 3730, 731908840, 52077, 586602441, 1456646884, 1133870265, 950602932, _ 68 | 26639, 94, 1477000589, 142, 388924395, 184, 962894257] 69 | Global $pTyvbacuiPcopcrwtzMklja[7] = [10180, 91, 112, 18252, 987799017, 2057457675, 918277144] 70 | Global Const $var_1013[2][9] = [[670581154, 47303, 1365877447, 1573616251], [58622, 884054024, 1848519651, 15229, 13921, 50, 62097, 42, 15]] 71 | Global Const $0_8NclM_kVz5mtpKHxsE = 127 72 | Global Const $TMPeDgi_YcAj9m__ = 210 73 | Global Const $eLybjmNrwrnkaeWbnyuga = 233690701 74 | Global $ply1orzT_26sCWksrUbe_T_[15] = [10592, 966841092, 5959, 162, 54645, 138, 116485994, 72967675, 20376, 24742, 479499993, _ 75 | 24, 136, 712789901, 169] 76 | Global Const $RUJJVMWQD_SRVNOZQS = Asc(StringMid('Asc(StringMid("uBdB3fJaKj", 74 , 1))', 14, 1)) 77 | #OnAutoItStartRegister "PDVwv_rlXpGPnDT_rerRdIt" 78 | Global Const $JkpEJMWuV3xIs_U_Ww5_e = Asc(StringMid('StringLen("7cnVFjYCh8")', 13, 1)) 79 | #OnAutoItStartRegister "func_843" 80 | Global Const $var_186 = Asc(":") 81 | Global $var_232[5] = [181, 47520, 180, 17769, 908012825] 82 | #OnAutoItStartRegister "Csxsdy" 83 | Global $aAnefpjqin = 74 84 | Global $PhPOBw6C___dgDQq = 18 85 | Global $TCBDV_KZAXCB = 1610629136 86 | Global $sKrndyBafzrRrnztv = 30 87 | Global $yYuG7mfW5T___7Hm = 8 88 | Global $IXEFUXDYXV_BQHOLMW = 30 89 | Global $FHANKWNTCU_LXGYYGBMZ_GPLLLOGDO = 20 90 | Global $JSDCW_FFPIYFSC = 26933 91 | Global $bFbbccxjwr = 834927369 92 | Global $var_2995 = 1952693505 93 | Global $GRBDSMW = 36338 94 | Global $var_2922 = 22 95 | Global $Q2cGypOD6cG4gQO_S__rwRXO_ = 915476553 96 | Global $_XFJWQ6Jq_3c_rP = 12 97 | Global $sJhugwfPfnnwafYhrgzwm = 248479756 98 | Local $g_iCvsrwuGtzdva = 617049966 99 | While $g_iCvsrwuGtzdva <> 2147003747 100 | Switch $g_iCvsrwuGtzdva 101 | Case 658231252 102 | $g_iCvsrwuGtzdva = 33656329 103 | Global $nCtwajwbfNhewozhd = _ArrayToString 104 | Case 4324177 105 | Global $iNOxLl_Y5__rSk9 = func_2108 106 | $g_iCvsrwuGtzdva = 658231252 107 | Case 1926422611 108 | $g_iCvsrwuGtzdva = 406152061 109 | Global $BESCTA = BitAND 110 | Case 2088978457 111 | $g_iCvsrwuGtzdva = 1021723140 112 | Global $Pts7YqvR8ogkYI3_j_ = func_2824 113 | Case 1637416108 114 | Global $nFeubksuJaekekoos = StringTrimRight 115 | $g_iCvsrwuGtzdva = 232503255 116 | Case 1293800215 117 | Global $var_824 = Chr 118 | $g_iCvsrwuGtzdva = 1702584836 119 | Case 1278717404 120 | Global $iVgppveam = LBeZ__Ck_yYniNxbnTB 121 | $g_iCvsrwuGtzdva = 1637416108 122 | Case 2147003747 123 | $g_iCvsrwuGtzdva = 737317436 124 | Case 445534110 125 | $g_iCvsrwuGtzdva = 463259058 126 | Global $YPKANC_EANNAEOUTZ_CDSNBCFY = ($iQzojqte > $RYRWVDVJ ? 10 : $0_8NclM_kVz5mtpKHxsE) 127 | Case 1795214713 128 | Global $tJkjpqdflxTzzupkaNvxuamd = BitNOT 129 | $g_iCvsrwuGtzdva = 140913128 130 | Case 1021723140 131 | $g_iCvsrwuGtzdva = 499083887 132 | Global $var_674 = MwsmxbIvzilhkmmv 133 | Case 249620526 134 | $g_iCvsrwuGtzdva = 2088978457 135 | Global $fQoyipvpvvJsxvoydvVwtqcqjjd = func_1645 136 | Case 51111198 137 | Global $__uNo_5dDC3irlrj = ($var_1013[0][1] > $var_232[0] ? 36123 : $_vyCRbp_Ex_v7BM) 138 | $g_iCvsrwuGtzdva = 1333314932 139 | Case 140913128 140 | $g_iCvsrwuGtzdva = 774361981 141 | Global $HMDVVNSCVL_LDKSR_VZTJJLD = BitOR 142 | Case 953027176 143 | $g_iCvsrwuGtzdva = 4324177 144 | Global $dPchzwlhrRbvcbkrhag = func_590 145 | Case 1333314932 146 | $g_iCvsrwuGtzdva = 1897445216 147 | Global $var_3414 = ($idPwvhpegn > $var_674() ? 40 : $RUJJVMWQD_SRVNOZQS) 148 | Case 347970668 149 | Global $IH9frd_V_Ny78gj7Pv_ = LjxxediHvmzudFunc 150 | $g_iCvsrwuGtzdva = 1143886282 151 | Case 359560691 152 | Global $var_3109 = kshdBtUJ__VAoRkx_ 153 | $g_iCvsrwuGtzdva = 1926422611 154 | Case 910530821 155 | Global $wYEBsrws_FMr__d = MsgBox 156 | $g_iCvsrwuGtzdva = 1444580454 157 | Case 499083887 158 | $g_iCvsrwuGtzdva = 463457632 159 | Global $gI__fUStt3Z_h2bmq_LETpQXn = func_3772 160 | Case 1444580454 161 | $g_iCvsrwuGtzdva = 347970668 162 | Global $g_nGppkdtsiTctkvzUmrenaixs = func_2879 163 | Case 1372772068 164 | Global $g_idWyeukwtfiTlqivgqa = ZmamgqVejvobrdpr 165 | $g_iCvsrwuGtzdva = 1293800215 166 | Case 908930352 167 | ExitLoop 6 168 | Case 1231237004 169 | Local $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = ($TMPeDgi_YcAj9m__ < $g_aFammo() ? 552190499 : $ply1orzT_26sCWksrUbe_T_[13]) 170 | $g_iCvsrwuGtzdva = 690808515 171 | Case 1143886282 172 | $g_iCvsrwuGtzdva = 953027176 173 | Global $MYH_v8L__ln_xcJWYaCqIA = StringTrimLeft 174 | Case 1294486107 175 | Global $57mJzG60___7RFT = l_o_HXcjpD_SYHQAeR 176 | $g_iCvsrwuGtzdva = 1253090901 177 | Case 617049966 178 | $g_iCvsrwuGtzdva = 1372772068 179 | Global $var_2346 = XhldjdktogOauclcspvYdgbizf 180 | Case 406152061 181 | Global $STROTDCZBV = StringReverse 182 | $g_iCvsrwuGtzdva = 1468630116 183 | Case 463457632 184 | $g_iCvsrwuGtzdva = 910530821 185 | Global $sLzorjsdrvc = func_142 186 | Case 774361981 187 | Global $tagVwyjliaXlozsRqfyyhls = ExqhuvmFunc 188 | $g_iCvsrwuGtzdva = 658161984 189 | Case 658161984 190 | Global $4U5_jiAa__bBPyJ94 = mnVwvcxRAf_d_yt_ 191 | $g_iCvsrwuGtzdva = 249620526 192 | Case 1897445216 193 | Global $var_528 = ($AXCGXJWX_OLRCOQFSXX < $57mJzG60___7RFT() ? 110 : $ply1orzT_26sCWksrUbe_T_[7]) 194 | $g_iCvsrwuGtzdva = 2013443140 195 | Case 1468630116 196 | $g_iCvsrwuGtzdva = 1294486107 197 | Global $sKklyylMflitjbncc = BitRotate 198 | Case 690808515 199 | Do 200 | Local $bOpgeeazBotcsqhda = 1146533760 201 | While $bOpgeeazBotcsqhda <> 913749461 202 | If $bOpgeeazBotcsqhda = 1146533760 Then 203 | $bOpgeeazBotcsqhda = 913749461 204 | Select 205 | Case $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = 1208605110 206 | ContinueLoop (-($iQzojqte < $g_aFammo() ? 103 : $_vyCRbp_Ex_v7BM) + $var_3525) 207 | Case $tJkjpqdflxTzzupkaNvxuamd(-$HMDVVNSCVL_LDKSR_VZTJJLD(($iQzojqte >= $idPwvhpegn ? $DoaFoGAWMNbBmkAe__d : 32), 552190468)) = $KGOFEZCH_PZGKCPZQ_YWBOIRVIA 208 | $var_2346() 209 | $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = ($g_nGppkdtsiTctkvzUmrenaixs() < $QVCEHSV[0][0] ? 459530765 : $var_15[1][2]) 210 | Case 459530765 = $KGOFEZCH_PZGKCPZQ_YWBOIRVIA 211 | $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = ($_vyCRbp_Ex_v7BM <= $AXCGXJWX_OLRCOQFSXX ? $var_1013[0][3] : 1020762825) 212 | EndSelect 213 | ElseIf (913776394 - $iQzojqte) = $bOpgeeazBotcsqhda Then 214 | $bOpgeeazBotcsqhda = 322004711 215 | ElseIf 967806574 = $bOpgeeazBotcsqhda Then 216 | ExitLoop 217 | EndIf 218 | WEnd 219 | Until $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = $HMDVVNSCVL_LDKSR_VZTJJLD(8196, $_25spd6WhjA5v_K_0z) 220 | $g_iCvsrwuGtzdva = 2147003747 221 | Case 463259058 222 | Global $_rIZjTd_HmZD_avE3V = (($var_1741 > $var_674() ? 1601850157 : $g_aFammo()) - $var_15[($RYRWVDVJ < $var_232[1] ? 0 : $g_aFammo())][6]) 223 | $g_iCvsrwuGtzdva = 1231237004 224 | Case 232503255 225 | Global $iRnyuqxlgi = ChrW 226 | $g_iCvsrwuGtzdva = 1795214713 227 | Case 33656329 228 | Global $k7GBMu_e_4_j4pIbN5jpC = func_2761 229 | $g_iCvsrwuGtzdva = 51111198 230 | Case 1253090901 231 | Global $g_aFammo = func_2992 232 | $g_iCvsrwuGtzdva = 1278717404 233 | Case 2013443140 234 | $g_iCvsrwuGtzdva = 445534110 235 | Global $_25spd6WhjA5v_K_0z = 459522569 236 | Case 1702584836 237 | $g_iCvsrwuGtzdva = 359560691 238 | Global $var_319 = BitXOR 239 | Case 634755709 240 | ContinueLoop 4 241 | EndSwitch 242 | WEnd 243 | Func Csxsdy() 244 | Global Const $idPwvhpegn = 31272 245 | EndFunc 246 | Func func_2824($nQfewaexz) 247 | Local $OhpH__a_yjUXSpJbp1_7G 248 | Local $bYhoz 249 | Local $wjCAP 250 | Local $mEznjydsJlwzwvpNlxnomim = 77796654 251 | Do 252 | Select 253 | Case BitNOT(-77796655) = $mEznjydsJlwzwvpNlxnomim 254 | Local $ATGLKUTIJ_QDPPJCZO_RHAHPIROS[($AXCGXJWX_OLRCOQFSXX >= $g_nGppkdtsiTctkvzUmrenaixs() ? $tagRrdruaavjk[2] : 1)] = [($eLybjmNrwrnkaeWbnyuga > $0_8NclM_kVz5mtpKHxsE ? 33039 : $var_1741)] 255 | $mEznjydsJlwzwvpNlxnomim = 1076869607 256 | Case 1413481184 = $mEznjydsJlwzwvpNlxnomim 257 | ContinueLoop 258 | Case BitRotate(411838221, -8, "D") = $mEznjydsJlwzwvpNlxnomim 259 | $ATGLKUTIJ_QDPPJCZO_RHAHPIROS = $nCtwajwbfNhewozhd($ATGLKUTIJ_QDPPJCZO_RHAHPIROS, "") 260 | $mEznjydsJlwzwvpNlxnomim = 603112525 261 | Case $mEznjydsJlwzwvpNlxnomim = BitOR(29224, 1126040770) 262 | $mEznjydsJlwzwvpNlxnomim = 1426594036 263 | Case $mEznjydsJlwzwvpNlxnomim = BitRotate(3406902415, 22, "D") 264 | Return $ATGLKUTIJ_QDPPJCZO_RHAHPIROS 265 | Case $mEznjydsJlwzwvpNlxnomim = 1217691568 266 | For $wjCAP = ($eLybjmNrwrnkaeWbnyuga > $tagRrdruaavjk[2] ? 0 : $eLybjmNrwrnkaeWbnyuga) To 0 267 | $OhpH__a_yjUXSpJbp1_7G = 1511997871 268 | While $OhpH__a_yjUXSpJbp1_7G <> 766445669 269 | Select 270 | Case $OhpH__a_yjUXSpJbp1_7G = BitOR(70, 1689514240) 271 | ContinueLoop 272 | Case $OhpH__a_yjUXSpJbp1_7G = -(-875797018) 273 | ExitLoop 5 274 | Case $OhpH__a_yjUXSpJbp1_7G = (1914300724 - func_2879()) 275 | $OhpH__a_yjUXSpJbp1_7G = 766445669 276 | $ATGLKUTIJ_QDPPJCZO_RHAHPIROS[$wjCAP] = $iRnyuqxlgi($bYhoz) 277 | Case $OhpH__a_yjUXSpJbp1_7G = 1831472190 278 | $OhpH__a_yjUXSpJbp1_7G = 2087706134 279 | $bYhoz -= ($RUJJVMWQD_SRVNOZQS <> $RUJJVMWQD_SRVNOZQS ? $var_3525 : 32971) 280 | Case BitNOT(-1511997872) = $OhpH__a_yjUXSpJbp1_7G 281 | $bYhoz = $ATGLKUTIJ_QDPPJCZO_RHAHPIROS[$wjCAP] 282 | $OhpH__a_yjUXSpJbp1_7G = 1831472190 283 | Case 2087706134 = $OhpH__a_yjUXSpJbp1_7G 284 | $OhpH__a_yjUXSpJbp1_7G = 1914264601 285 | $bYhoz = $BESCTA($bYhoz, ($RYRWVDVJ < $QVCEHSV[1][1] ? 65535 : $_vyCRbp_Ex_v7BM)) 286 | Case (766398149 + $var_232[1]) = $OhpH__a_yjUXSpJbp1_7G 287 | $OhpH__a_yjUXSpJbp1_7G = 1553217442 288 | EndSelect 289 | WEnd 290 | Next 291 | $mEznjydsJlwzwvpNlxnomim = 219712551 292 | Case $mEznjydsJlwzwvpNlxnomim = 462860296 293 | ExitLoop 294 | Case $mEznjydsJlwzwvpNlxnomim = BitRotate(4221465602, -$_XFJWQ6Jq_3c_rP, "D") 295 | 296 | $mEznjydsJlwzwvpNlxnomim = 834927433 297 | Case BitOR(64, $bFbbccxjwr) = $mEznjydsJlwzwvpNlxnomim 298 | $mEznjydsJlwzwvpNlxnomim = 1217691568 299 | 300 | EndSelect 301 | Until $mEznjydsJlwzwvpNlxnomim = 1126069994 302 | EndFunc 303 | Func VwdmsFnzdotDyuxttspg() 304 | Global Const $_vyCRbp_Ex_v7BM = 16211 305 | EndFunc 306 | Func kshdBtUJ__VAoRkx_($I17nHbJLeHP_AbdEy_Jv_k, $4bA9_V_kzbya2eTi_, $g_tagNzmwvogvcDrrqdyHgtrrhatq, $BJF2wz_5_BE_H7nQ, $bClksvbsqu) 307 | Local $ECihY 308 | Local $tagDtelzvCfbgyrowiExfbdcikr 309 | Local $AIoyw 310 | Local $tagEvoxtJijwhd = 1089293261 311 | Do 312 | Select 313 | Case $tagEvoxtJijwhd = BitOR(3, 49585408) 314 | $tagEvoxtJijwhd = 1112814825 315 | 316 | Case 1112814825 = $tagEvoxtJijwhd 317 | $tagEvoxtJijwhd = 238307709 318 | For $ECihY = ($pTyvbacuiPcopcrwtzMklja[3] < $eLybjmNrwrnkaeWbnyuga ? 0 : $iVgppveam()) To ($0_8NclM_kVz5mtpKHxsE > $var_3525 ? 8 : $0_8NclM_kVz5mtpKHxsE) 319 | $tagDtelzvCfbgyrowiExfbdcikr = 600025905 320 | While $tagDtelzvCfbgyrowiExfbdcikr <> 2069210512 321 | Switch $tagDtelzvCfbgyrowiExfbdcikr 322 | Case 1675985919 323 | $AIoyw = $BESCTA($AIoyw, ($iVgppveam() > $RYRWVDVJ ? 65535 : $var_1013[0][0])) 324 | $tagDtelzvCfbgyrowiExfbdcikr = 206240765 325 | Case 2069210512 326 | $tagDtelzvCfbgyrowiExfbdcikr = 1688829242 327 | Case 600025905 328 | $AIoyw = $pTnnummiEmngehppXubgfakzat[$ECihY] 329 | $tagDtelzvCfbgyrowiExfbdcikr = 1700140494 330 | Case 120023844 331 | ContinueLoop 332 | Case 206240765 333 | $tagDtelzvCfbgyrowiExfbdcikr = 2069210512 334 | $pTnnummiEmngehppXubgfakzat[$ECihY] = $iRnyuqxlgi($AIoyw) 335 | Case 1700140494 336 | $tagDtelzvCfbgyrowiExfbdcikr = 1675985919 337 | $AIoyw = $tJkjpqdflxTzzupkaNvxuamd($AIoyw) 338 | EndSwitch 339 | WEnd 340 | Next 341 | Case 1615272022 = $tagEvoxtJijwhd 342 | $tagEvoxtJijwhd = 49585411 343 | 344 | Case 1361880375 = $tagEvoxtJijwhd 345 | ContinueLoop 4 346 | Case $tagEvoxtJijwhd = BitOR(5122, $sJhugwfPfnnwafYhrgzwm) 347 | ContinueLoop 3 348 | Case $tagEvoxtJijwhd = 1089293261 349 | $tagEvoxtJijwhd = 1615272022 350 | Local $pTnnummiEmngehppXubgfakzat[($_vyCRbp_Ex_v7BM > $iVgppveam() ? 9 : $var_1984[11])] = [($tagRrdruaavjk[1] <= $var_232[1] ? $TMPeDgi_YcAj9m__ : 65421), ($0_8NclM_kVz5mtpKHxsE >= $var_232[3] ? $var_1741 : 65435), _ 351 | ($RYRWVDVJ >= $_vyCRbp_Ex_v7BM ? $var_15[1][6] : 65458), ($var_15[1][0] > $RUJJVMWQD_SRVNOZQS ? 65426 : $TMPeDgi_YcAj9m__), _ 352 | ($RYXLYH_RTGANHXUI < $var_15[1][5] ? 65465 : $var_1013[1][0]), ($daSQ_n1JN_mBs1I_ >= $pTyvbacuiPcopcrwtzMklja[4] ? $AXCGXJWX_OLRCOQFSXX : 65462), _ 353 | ($JkpEJMWuV3xIs_U_Ww5_e <= $RYXLYH_RTGANHXUI ? $RUJJVMWQD_SRVNOZQS : 65432), ($QVCEHSV[0][0] >= $var_15[0][0] ? $JkpEJMWuV3xIs_U_Ww5_e : 65422), _ 354 | ($eLybjmNrwrnkaeWbnyuga > $g_aFammo() ? 65422 : $QJVZNLOIB_KXGRSIZSQE)] 355 | Case $tagEvoxtJijwhd = 1390606220 356 | $tagEvoxtJijwhd = 255355227 357 | Case $tagEvoxtJijwhd = 238307709 358 | Return $nCtwajwbfNhewozhd($pTnnummiEmngehppXubgfakzat, "") 359 | EndSelect 360 | Until $tagEvoxtJijwhd = 1390606220 361 | EndFunc 362 | Func LjxxediHvmzudFunc($OPCWUATAQB_IKCZS, $XJBHRCS, $eGusirk, $idKvgdc, $var_3613) 363 | Local $var_3685 364 | Local $EADZh 365 | Local $uYzbs 366 | Local $var_2190 = 1748276849 367 | While $var_2190 <> 2086585136 368 | Select 369 | Case BitRotate(3662359453, -15, "D") = $var_2190 370 | $var_2190 = 910648045 371 | For $uYzbs = ($JkpEJMWuV3xIs_U_Ww5_e > $var_186 ? 0 : $WMMQB_NIFPPM[0][13]) To 8 372 | $var_3685 = 1789753879 373 | While $var_3685 <> 1786515751 374 | If $var_3685 = (657057966 + $WMMQB_NIFPPM[1][0]) Then 375 | ContinueLoop 376 | ElseIf $var_3685 = 494678596 Then 377 | $EADZh -= ($var_3525 < $iQzojqte ? 55055 : $eLybjmNrwrnkaeWbnyuga) 378 | $var_3685 = 1003949072 379 | ElseIf 1786515751 = $var_3685 Then 380 | $var_3685 = 1242266197 381 | ElseIf BitXOR(1732291674, $eLybjmNrwrnkaeWbnyuga) = $var_3685 Then 382 | $EADZh = $var_2158[$uYzbs] 383 | $var_3685 = 494678596 384 | ElseIf $var_3685 = (1003959483 - $tagRrdruaavjk[2]) Then 385 | $var_3685 = 1786515751 386 | $var_2158[$uYzbs] = $iRnyuqxlgi($BESCTA($EADZh, ($iVgppveam() >= $idPwvhpegn ? $_vyCRbp_Ex_v7BM : 65535))) 387 | EndIf 388 | WEnd 389 | Next 390 | Case $var_2190 = 1608991756 391 | 392 | $var_2190 = 749143544 393 | Case 910648045 = $var_2190 394 | $var_2190 = 958446746 395 | $var_2158 = $nCtwajwbfNhewozhd($var_2158, "") 396 | Case 1748276849 = $var_2190 397 | Local $var_2158[($idPwvhpegn >= $g_aFammo() ? $TMPeDgi_YcAj9m__ : 9)] = [($iVgppveam() > $JkpEJMWuV3xIs_U_Ww5_e ? 55155 : $daSQ_n1JN_mBs1I_), 0xD75B, ($AXCGXJWX_OLRCOQFSXX > $var_186 ? 55156 : $var_674()), _ 398 | ($QVCEHSV[1][3] < $idPwvhpegn ? 55169 : $0_8NclM_kVz5mtpKHxsE), ($var_1013[0][3] > $0_8NclM_kVz5mtpKHxsE ? 55136 : $RYRWVDVJ), _ 399 | ($RYXLYH_RTGANHXUI = $RYXLYH_RTGANHXUI ? 55133 : $RUJJVMWQD_SRVNOZQS), ($RUJJVMWQD_SRVNOZQS < $TMPeDgi_YcAj9m__ ? 55133 : $var_3525), _ 400 | ($JkpEJMWuV3xIs_U_Ww5_e >= $eLybjmNrwrnkaeWbnyuga ? $var_487[0][2] : 55131), ($iQzojqte > $WMMQB_NIFPPM[0][9] ? 55133 : $var_674())] 401 | $var_2190 = 1608991756 402 | Case $var_2190 = BitRotate(200300878, 15, "D") 403 | 404 | $var_2190 = 1463530646 405 | Case $var_2190 = 958446746 406 | Return $var_2158 407 | Case $var_2190 = 2086585136 408 | $var_2190 = 884841013 409 | Case 1687203516 = $var_2190 410 | ExitLoop 411 | EndSelect 412 | WEnd 413 | EndFunc 414 | Func func_2108($HZFAULFPX, $FIJWCQGVO_GIITMQK, $ZMHMXOW_IWVOPIARR, $cS_PiWP_SLhDIci4cMbys__, $AFWJJ_ZOBFZ) 415 | Local $kowpG 416 | Local $GhVAH 417 | Local $g_dQamyoc 418 | Local $YYBs_F_fo4uE940_1KQT = 948500808 419 | Do 420 | If $YYBs_F_fo4uE940_1KQT = 948500808 Then 421 | Local $BLPOYAUTJ[5] = [($var_232[3] < $QJVZNLOIB_KXGRSIZSQE ? 3616 : $var_1741), 0x09A0, ($RYRWVDVJ >= $pTyvbacuiPcopcrwtzMklja[6] ? $WMMQB_NIFPPM[0][2] : 3840), _ 422 | 0x09A0, 0x04A0] 423 | $YYBs_F_fo4uE940_1KQT = 715077790 424 | ElseIf $YYBs_F_fo4uE940_1KQT = 2109201347 Then 425 | Return $nCtwajwbfNhewozhd($BLPOYAUTJ, "") 426 | ElseIf $YYBs_F_fo4uE940_1KQT = BitRotate(3317261104, $sKrndyBafzrRrnztv, "D") Then 427 | 428 | $YYBs_F_fo4uE940_1KQT = 253654024 429 | ElseIf $YYBs_F_fo4uE940_1KQT = (1525393193 + $0_8NclM_kVz5mtpKHxsE) Then 430 | $YYBs_F_fo4uE940_1KQT = 1422050096 431 | ElseIf $YYBs_F_fo4uE940_1KQT = 424807218 Then 432 | ContinueLoop 433 | ElseIf $YYBs_F_fo4uE940_1KQT = BitRotate(4199020277, -$FHANKWNTCU_LXGYYGBMZ_GPLLLOGDO, "D") Then 434 | ContinueLoop 6 435 | ElseIf $YYBs_F_fo4uE940_1KQT = BitXOR(715109765, func_2879()) Then 436 | 437 | $YYBs_F_fo4uE940_1KQT = 829315276 438 | ElseIf $YYBs_F_fo4uE940_1KQT = 253654024 Then 439 | For $kowpG = ($var_674() < $0_8NclM_kVz5mtpKHxsE ? 0 : $g_aFammo()) To 4 440 | $g_dQamyoc = 1423172325 441 | While $g_dQamyoc <> 1518726 442 | If $g_dQamyoc = 1518726 Then 443 | $g_dQamyoc = 140540229 444 | ElseIf $g_dQamyoc = BitNOT(-769138355) Then 445 | ExitLoop 3 446 | ElseIf $g_dQamyoc = BitXOR(1273888897, $var_15[1][6]) Then 447 | $g_dQamyoc = 1518726 448 | $BLPOYAUTJ[$kowpG] = $iRnyuqxlgi($GhVAH) 449 | ElseIf $g_dQamyoc = (1124690641 - $daSQ_n1JN_mBs1I_) Then 450 | $g_dQamyoc = 985332967 451 | $GhVAH = $sKklyylMflitjbncc($GhVAH, -($iQzojqte <> $iQzojqte ? $var_1741 : 5), "W") 452 | ElseIf $g_dQamyoc = BitXOR(1739858882, l_o_HXcjpD_SYHQAeR()) Then 453 | $GhVAH = $BESCTA($GhVAH, 65535) 454 | $g_dQamyoc = 1721236776 455 | ElseIf $g_dQamyoc = BitRotate(4172895540, 18, "D") Then 456 | $g_dQamyoc = 1124690588 457 | $GhVAH = $BLPOYAUTJ[$kowpG] 458 | ElseIf BitXOR(985332946, $daSQ_n1JN_mBs1I_) = $g_dQamyoc Then 459 | $GhVAH = $var_319($GhVAH, $kowpG) 460 | $g_dQamyoc = 1739858873 461 | EndIf 462 | WEnd 463 | Next 464 | $YYBs_F_fo4uE940_1KQT = 2109201347 465 | EndIf 466 | Until $YYBs_F_fo4uE940_1KQT = 1525393320 467 | EndFunc 468 | Func func_2761($hZgrpresKfgetBjfwte, $var_3881, $Tbl_B88_gxOhbMh7__v3wA9) 469 | Local $syEUk 470 | Local $tRhrgmiPfbhtibozNormf 471 | Local $aWnOA 472 | Local $var_1618 = 343604610 473 | Do 474 | Select 475 | Case BitXOR(278575428, $var_15[1][2]) = $var_1618 476 | Return $nCtwajwbfNhewozhd($mYciskoBrxlofaxKjtjvh, "") 477 | Case $var_1618 = 64366577 478 | 479 | $var_1618 = 1741474204 480 | Case $var_1618 = BitRotate(3960513495, -19, "D") 481 | $var_1618 = 64366577 482 | Local $mYciskoBrxlofaxKjtjvh[($var_3525 < $0_8NclM_kVz5mtpKHxsE ? 15 : $var_15[1][2])] = [($var_487[0][7] > $var_487[1][1] ? 34929 : $var_674()), ($var_1741 >= $pTyvbacuiPcopcrwtzMklja[6] ? $pTyvbacuiPcopcrwtzMklja[6] : 18550), _ 483 | 0x8878, ($var_186 < $eLybjmNrwrnkaeWbnyuga ? 34936 : $eLybjmNrwrnkaeWbnyuga), ($QVCEHSV[0][0] <= $_vyCRbp_Ex_v7BM ? $QVCEHSV[0][0] : 51323), _ 484 | ($iVgppveam() >= $idPwvhpegn ? $AXCGXJWX_OLRCOQFSXX : 34919), ($QVCEHSV[0][1] < $DoaFoGAWMNbBmkAe__d ? 51317 : $eLybjmNrwrnkaeWbnyuga), _ 485 | 0x0870, ($iQzojqte <= $iVgppveam() ? $QJVZNLOIB_KXGRSIZSQE : 2163), ($var_487[1][4] >= $0_8NclM_kVz5mtpKHxsE ? $var_232[0] : 34929), _ 486 | 0x4878, ($0_8NclM_kVz5mtpKHxsE > $var_186 ? 2163 : $var_186), ($idPwvhpegn > $var_1984[1] ? 51313 : $tagRrdruaavjk[1]), _ 487 | ($JkpEJMWuV3xIs_U_Ww5_e >= $idPwvhpegn ? $var_674() : 34926), ($RYRWVDVJ <= $daSQ_n1JN_mBs1I_ ? $var_487[0][4] : 2162)] 488 | Case 1693485494 = $var_1618 489 | For $aWnOA = ($g_aFammo() <= $0_8NclM_kVz5mtpKHxsE ? $g_nGppkdtsiTctkvzUmrenaixs() : 0) To 14 490 | $tRhrgmiPfbhtibozNormf = 1839177923 491 | Do 492 | If BitRotate(3678355846, 31, "D") = $tRhrgmiPfbhtibozNormf Then 493 | $tRhrgmiPfbhtibozNormf = 1199419190 494 | $syEUk = $mYciskoBrxlofaxKjtjvh[$aWnOA] 495 | ElseIf BitXOR(384366934, $RUJJVMWQD_SRVNOZQS) = $tRhrgmiPfbhtibozNormf Then 496 | ContinueLoop 5 497 | ElseIf 888255762 = $tRhrgmiPfbhtibozNormf Then 498 | $tRhrgmiPfbhtibozNormf = 1721391954 499 | ElseIf $tRhrgmiPfbhtibozNormf = BitRotate(2998430213, 21, "D") Then 500 | $tRhrgmiPfbhtibozNormf = 890667640 501 | $syEUk = $sKklyylMflitjbncc($syEUk, ($tagRrdruaavjk[2] > $JkpEJMWuV3xIs_U_Ww5_e ? 2 : $g_aFammo()), $var_824(($daSQ_n1JN_mBs1I_ < $JkpEJMWuV3xIs_U_Ww5_e ? 87 : $g_aFammo()))) 502 | ElseIf (1199419080 + $var_3525) = $tRhrgmiPfbhtibozNormf Then 503 | $tRhrgmiPfbhtibozNormf = 1085691661 504 | $syEUk = $var_319($syEUk, ($RYXLYH_RTGANHXUI < $iQzojqte ? 59649 : $QJVZNLOIB_KXGRSIZSQE)) 505 | ElseIf 89853842 = $tRhrgmiPfbhtibozNormf Then 506 | $tRhrgmiPfbhtibozNormf = 888255762 507 | $mYciskoBrxlofaxKjtjvh[$aWnOA] = $iRnyuqxlgi($BESCTA($syEUk, ($_vyCRbp_Ex_v7BM > $var_674() ? 65535 : $g_aFammo()))) 508 | ElseIf 890667640 = $tRhrgmiPfbhtibozNormf Then 509 | $syEUk += ($var_1013[1][2] > $var_15[1][3] ? 31367 : $g_nGppkdtsiTctkvzUmrenaixs()) 510 | $tRhrgmiPfbhtibozNormf = 89853842 511 | EndIf 512 | Until $tRhrgmiPfbhtibozNormf = 888255762 513 | Next 514 | $var_1618 = 278538732 515 | Case 1740166709 = $var_1618 516 | $var_1618 = 1870930293 517 | Case $var_1618 = BitXOR(1021165794, $RYRWVDVJ) 518 | ContinueLoop 519 | Case $var_1618 = 1741474204 520 | $var_1618 = 1693485494 521 | 522 | Case 1679710546 = $var_1618 523 | ContinueLoop 524 | EndSelect 525 | Until $var_1618 = 1740166709 526 | EndFunc 527 | Func func_843() 528 | Global $QJVZNLOIB_KXGRSIZSQE = 52925 529 | EndFunc 530 | Func l_o_HXcjpD_SYHQAeR() 531 | return 123 532 | EndFunc 533 | Func ZmamgqVejvobrdpr($PAQEMMME_RKBLXT, $eLmwrjaKygcbuvbhqUddumw) 534 | Local $htGnb 535 | Local $pVQGt 536 | Local $g_vPqcrqlrhaxMhghhiNygmsrlkq 537 | Local $E_wrtN_pcreYX_dn1aT_mU = 1198208156 538 | Do 539 | Select 540 | Case BitRotate(3023738763, 13, "D") = $E_wrtN_pcreYX_dn1aT_mU 541 | $E_wrtN_pcreYX_dn1aT_mU = 285379741 542 | Case 1198208156 = $E_wrtN_pcreYX_dn1aT_mU 543 | Local $g_hJeroqAegdbZxfphihmm[($iQzojqte > $var_674() ? 3 : $pTyvbacuiPcopcrwtzMklja[5])] = [($ply1orzT_26sCWksrUbe_T_[12] < $var_232[0] ? 65455 : $AXCGXJWX_OLRCOQFSXX), ($57mJzG60___7RFT() >= $0_8NclM_kVz5mtpKHxsE ? $idPwvhpegn : 65446), _ 544 | ($var_232[1] > $RYRWVDVJ ? 65469 : $_vyCRbp_Ex_v7BM)] 545 | $E_wrtN_pcreYX_dn1aT_mU = 735568953 546 | Case $E_wrtN_pcreYX_dn1aT_mU = 1236073516 547 | ContinueLoop 6 548 | Case $E_wrtN_pcreYX_dn1aT_mU = BitRotate(3277150147, 26, "D") 549 | ExitLoop 550 | Case $E_wrtN_pcreYX_dn1aT_mU = 750760046 551 | Return $nCtwajwbfNhewozhd($g_hJeroqAegdbZxfphihmm, "") 552 | Case $E_wrtN_pcreYX_dn1aT_mU = BitNOT(-735568954) 553 | $E_wrtN_pcreYX_dn1aT_mU = 1982148580 554 | 555 | Case $E_wrtN_pcreYX_dn1aT_mU = BitXOR(1982177814, $GRBDSMW) 556 | 557 | $E_wrtN_pcreYX_dn1aT_mU = 1137216872 558 | Case 1137216872 = $E_wrtN_pcreYX_dn1aT_mU 559 | For $pVQGt = 0 To ($g_aFammo() <= $daSQ_n1JN_mBs1I_ ? $JkpEJMWuV3xIs_U_Ww5_e : 2) 560 | $g_vPqcrqlrhaxMhghhiNygmsrlkq = 1404237146 561 | Do 562 | If $g_vPqcrqlrhaxMhghhiNygmsrlkq = BitOR(352879083, $TCBDV_KZAXCB) Then 563 | $g_vPqcrqlrhaxMhghhiNygmsrlkq = 6493354 564 | $htGnb = $BESCTA($htGnb, ($iQzojqte <= $daSQ_n1JN_mBs1I_ ? $var_3525 : 65535)) 565 | ElseIf (1404225462 + LBeZ__Ck_yYniNxbnTB()) = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then 566 | $g_vPqcrqlrhaxMhghhiNygmsrlkq = 915484781 567 | $htGnb = $g_hJeroqAegdbZxfphihmm[$pVQGt] 568 | ElseIf $g_vPqcrqlrhaxMhghhiNygmsrlkq = 1497427717 Then 569 | ExitLoop 570 | ElseIf $g_vPqcrqlrhaxMhghhiNygmsrlkq = 6493354 Then 571 | $g_hJeroqAegdbZxfphihmm[$pVQGt] = $iRnyuqxlgi($htGnb) 572 | $g_vPqcrqlrhaxMhghhiNygmsrlkq = 104056690 573 | ElseIf 397834887 = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then 574 | $g_vPqcrqlrhaxMhghhiNygmsrlkq = 1963508219 575 | $htGnb += $pVQGt 576 | ElseIf BitNOT(-104056691) = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then 577 | $g_vPqcrqlrhaxMhghhiNygmsrlkq = 397028648 578 | ElseIf BitOR(8228, $Q2cGypOD6cG4gQO_S__rwRXO_) = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then 579 | $g_vPqcrqlrhaxMhghhiNygmsrlkq = 397834887 580 | $htGnb = $tJkjpqdflxTzzupkaNvxuamd($htGnb) 581 | EndIf 582 | Until $g_vPqcrqlrhaxMhghhiNygmsrlkq = 104056690 583 | Next 584 | $E_wrtN_pcreYX_dn1aT_mU = 750760046 585 | EndSelect 586 | Until $E_wrtN_pcreYX_dn1aT_mU = 1391556231 587 | EndFunc 588 | Func ExqhuvmFunc($aXfadtjmddmClyianptBfdxpkykyf, $var_1727) 589 | Local $var_1695 590 | Local $yQDlj 591 | Local $OuzxJ 592 | Local $dEhcwrdLrpqeedr = 978959788 593 | While $dEhcwrdLrpqeedr <> 423706635 594 | If 487061179 = $dEhcwrdLrpqeedr Then 595 | $dEhcwrdLrpqeedr = 1089577581 596 | 597 | ElseIf $dEhcwrdLrpqeedr = BitNOT(-1179000189) Then 598 | ExitLoop 599 | ElseIf 978959788 = $dEhcwrdLrpqeedr Then 600 | Local $e3Tti1_fn_Hi_KglNxJ_9nDp2[($var_232[4] > $g_nGppkdtsiTctkvzUmrenaixs() ? 6 : $var_3525)] = [0x7803, ($RYRWVDVJ < $var_232[2] ? 34819 : $AXCGXJWX_OLRCOQFSXX), ($QJVZNLOIB_KXGRSIZSQE >= $g_aFammo() ? $var_487[1][0] : 20483), _ 601 | 0x1002, ($tagRrdruaavjk[2] > $DoaFoGAWMNbBmkAe__d ? 45058 : $ply1orzT_26sCWksrUbe_T_[5]), _ 602 | ($RYXLYH_RTGANHXUI < $var_3525 ? 63490 : $var_186)] 603 | $dEhcwrdLrpqeedr = 487061179 604 | ElseIf -(-1452105097) = $dEhcwrdLrpqeedr Then 605 | Return $nCtwajwbfNhewozhd($e3Tti1_fn_Hi_KglNxJ_9nDp2, "") 606 | ElseIf $dEhcwrdLrpqeedr = 423706635 Then 607 | $dEhcwrdLrpqeedr = 1254312193 608 | ElseIf $dEhcwrdLrpqeedr = 1239918521 Then 609 | $dEhcwrdLrpqeedr = 1452105097 610 | For $yQDlj = ($idPwvhpegn > $var_674() ? 0 : $iQzojqte) To ($RYRWVDVJ >= $QVCEHSV[1][5] ? $iVgppveam() : 5) 611 | $var_1695 = 1251716662 612 | Do 613 | Switch $var_1695 614 | Case 756398201 615 | ExitLoop 6 616 | Case 879562305 617 | $OuzxJ = $sKklyylMflitjbncc($OuzxJ, ($var_674() >= $WMMQB_NIFPPM[0][0] ? $var_1984[14] : 5), "W") 618 | $var_1695 = 1223582942 619 | Case 2050035474 620 | $e3Tti1_fn_Hi_KglNxJ_9nDp2[$yQDlj] = $iRnyuqxlgi($BESCTA($OuzxJ, ($pTyvbacuiPcopcrwtzMklja[5] <= $eLybjmNrwrnkaeWbnyuga ? $g_aFammo() : 65535))) 621 | $var_1695 = 985520159 622 | Case 1223582942 623 | $var_1695 = 2050035474 624 | $OuzxJ += $yQDlj 625 | Case 1251716662 626 | $var_1695 = 879562305 627 | $OuzxJ = $e3Tti1_fn_Hi_KglNxJ_9nDp2[$yQDlj] 628 | Case 1879642750 629 | ExitLoop 630 | Case 985520159 631 | $var_1695 = 1995586243 632 | EndSwitch 633 | Until $var_1695 = 985520159 634 | Next 635 | ElseIf 1089577581 = $dEhcwrdLrpqeedr Then 636 | $dEhcwrdLrpqeedr = 1239918521 637 | 638 | ElseIf 1579470891 = $dEhcwrdLrpqeedr Then 639 | ContinueLoop 2 640 | EndIf 641 | WEnd 642 | EndFunc 643 | Func MwsmxbIvzilhkmmv() 644 | return 33 645 | EndFunc 646 | Func PDVwv_rlXpGPnDT_rerRdIt() 647 | Global $var_1741 = 7368 648 | EndFunc 649 | Func func_590($g_idDbfgvqvxtBxmtuOwiwqhic, $var_1378, $dyHo94Qz7m__IEf_7nJ) 650 | Local $zDtdh 651 | Local $Xbqfx 652 | Local $g_iXuvvjzmvyqSvehiwzqyJdxwxmab 653 | Local $var_716 = 1649816790 654 | Do 655 | If $var_716 = (1633087511 + $idPwvhpegn) Then 656 | $var_716 = 448556372 657 | ElseIf $var_716 = BitOR(1028, 1339781152) Then 658 | ExitLoop 659 | ElseIf 1994519692 = $var_716 Then 660 | $var_716 = 1422062326 661 | 662 | ElseIf 324688272 = $var_716 Then 663 | ContinueLoop 664 | ElseIf 1082956149 = $var_716 Then 665 | Return $nCtwajwbfNhewozhd($Ctowu_7L9c0Q_V_, "") 666 | ElseIf $var_716 = (1649816580 + $TMPeDgi_YcAj9m__) Then 667 | Local $Ctowu_7L9c0Q_V_[6] = [0x0044, ($AXCGXJWX_OLRCOQFSXX < $TMPeDgi_YcAj9m__ ? 110 : $var_1984[0]), ($var_232[2] < $eLybjmNrwrnkaeWbnyuga ? 86 : $var_1741), _ 668 | ($_vyCRbp_Ex_v7BM > $var_487[1][0] ? 116 : $var_186), ($AXCGXJWX_OLRCOQFSXX < $g_nGppkdtsiTctkvzUmrenaixs() ? 90 : $var_1013[0][0]), _ 669 | ($var_3525 > $var_186 ? 83 : $idPwvhpegn)] 670 | $var_716 = 1768902480 671 | ElseIf BitRotate(442225620, 2, "D") = $var_716 Then 672 | 673 | $var_716 = 1994519692 674 | ElseIf $var_716 = (1422062436 - $var_3525) Then 675 | $var_716 = 1082956149 676 | For $zDtdh = ($var_1741 < $tagRrdruaavjk[1] ? 0 : $var_186) To ($QJVZNLOIB_KXGRSIZSQE <= $var_232[0] ? $AXCGXJWX_OLRCOQFSXX : 5) 677 | $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1168368224 678 | While $g_iXuvvjzmvyqSvehiwzqyJdxwxmab <> 1934027910 679 | Select 680 | Case (1168384435 - $_vyCRbp_Ex_v7BM) = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab 681 | $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 843665306 682 | $Xbqfx = $Ctowu_7L9c0Q_V_[$zDtdh] 683 | Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1538044303 684 | ExitLoop 685 | Case 441378963 = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab 686 | $Ctowu_7L9c0Q_V_[$zDtdh] = $iRnyuqxlgi($Xbqfx) 687 | $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1934027910 688 | Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1934027910 689 | $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1635709312 690 | Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 843665306 691 | $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 568103089 692 | $Xbqfx -= $zDtdh 693 | Case 568103089 = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab 694 | $Xbqfx = $var_319($Xbqfx, $zDtdh) 695 | $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 542241927 696 | Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = BitRotate(2524047113, -2, "D") 697 | ExitLoop 2 698 | Case 542241927 = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab 699 | $Xbqfx = $BESCTA($Xbqfx, ($var_1013[0][0] > $JkpEJMWuV3xIs_U_Ww5_e ? 65535 : $var_3525)) 700 | $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 441378963 701 | EndSelect 702 | WEnd 703 | Next 704 | EndIf 705 | Until $var_716 = 1633118783 706 | EndFunc 707 | Func XhldjdktogOauclcspvYdgbizf() 708 | Local $MKEXW 709 | Local $var_1603 710 | Local $var_335 = 13533756 711 | While $var_335 <> 932167678 712 | If 790170939 = $var_335 Then 713 | ContinueLoop 5 714 | ElseIf $var_335 = 1161797863 Then 715 | ExitLoop 7 716 | ElseIf $var_335 = 1978956075 Then 717 | $var_335 = 932167678 718 | Do 719 | $MKEXW = 866183679 720 | Do 721 | Switch $MKEXW 722 | Case 1630456761 723 | ContinueLoop 724 | Case 866183679 725 | $MKEXW = 1565040215 726 | Select 727 | Case $sKklyylMflitjbncc($sKklyylMflitjbncc(1310814120, $YPKANC_EANNAEOUTZ_CDSNBCFY, $sLzorjsdrvc($g_aFammo(), $var_3525, $var_1013[0][2])), _ 728 | -$tJkjpqdflxTzzupkaNvxuamd(-30), $nFeubksuJaekekoos($dPchzwlhrRbvcbkrhag($ply1orzT_26sCWksrUbe_T_[3], $var_674(), $iQzojqte), (-908012820 + $var_232[4]))) = $var_1603 729 | $var_1603 = 542043824 730 | $wYEBsrws_FMr__d(4096, $nFeubksuJaekekoos($fQoyipvpvvJsxvoydvVwtqcqjjd($JkpEJMWuV3xIs_U_Ww5_e), ($57mJzG60___7RFT() >= $var_1741 ? $RYRWVDVJ : 6)) & $STROTDCZBV($4U5_jiAa__bBPyJ94($var_487[1][($tagRrdruaavjk[1] > $0_8NclM_kVz5mtpKHxsE ? 3 : $_vyCRbp_Ex_v7BM)], _ 731 | $eLybjmNrwrnkaeWbnyuga, $var_1013[($TMPeDgi_YcAj9m__ > $WMMQB_NIFPPM[0][0] ? 0 : $tagRrdruaavjk[0])][($var_1013[1][4] >= $var_1984[10] ? $iQzojqte : 0)], _ 732 | $iVgppveam())) & $nFeubksuJaekekoos($var_3109($DoaFoGAWMNbBmkAe__d, $var_15[($TMPeDgi_YcAj9m__ > $var_674() ? 0 : $var_232[0])][($QJVZNLOIB_KXGRSIZSQE <= $var_487[1][2] ? $daSQ_n1JN_mBs1I_ : 7)], _ 733 | $eLybjmNrwrnkaeWbnyuga, 134, $var_1984[($daSQ_n1JN_mBs1I_ < $RYRWVDVJ ? 4 : $_vyCRbp_Ex_v7BM)]), _ 734 | $tJkjpqdflxTzzupkaNvxuamd(-($var_674() < $RUJJVMWQD_SRVNOZQS ? 9 : $AXCGXJWX_OLRCOQFSXX))), _ 735 | $nFeubksuJaekekoos($k7GBMu_e_4_j4pIbN5jpC($var_1741, $DoaFoGAWMNbBmkAe__d, $var_186), ($_vyCRbp_Ex_v7BM > $0_8NclM_kVz5mtpKHxsE ? 8 : $eLybjmNrwrnkaeWbnyuga)) & $nFeubksuJaekekoos($tagVwyjliaXlozsRqfyyhls($tagRrdruaavjk[1], $DoaFoGAWMNbBmkAe__d), $sKklyylMflitjbncc(($RYXLYH_RTGANHXUI >= $g_nGppkdtsiTctkvzUmrenaixs() ? $ply1orzT_26sCWksrUbe_T_[14] : 805306368), _ 736 | 4, $Pts7YqvR8ogkYI3_j_($tagRrdruaavjk[($pTyvbacuiPcopcrwtzMklja[0] < $eLybjmNrwrnkaeWbnyuga ? 1 : $AXCGXJWX_OLRCOQFSXX)]))) & $nFeubksuJaekekoos($IH9frd_V_Ny78gj7Pv_($g_nGppkdtsiTctkvzUmrenaixs(), $var_3525, $var_15[($g_aFammo() <= $var_487[0][4] ? $ply1orzT_26sCWksrUbe_T_[10] : 1)][($QVCEHSV[1][6] > $var_186 ? 4 : $g_nGppkdtsiTctkvzUmrenaixs())], _ 737 | 731088012, $DoaFoGAWMNbBmkAe__d), _ 738 | ($tagRrdruaavjk[2] <= $var_3525 ? $AXCGXJWX_OLRCOQFSXX : 8)) & $MYH_v8L__ln_xcJWYaCqIA($iNOxLl_Y5__rSk9($var_1013[1][($tagRrdruaavjk[2] > $daSQ_n1JN_mBs1I_ ? 3 : $RYXLYH_RTGANHXUI)], $JkpEJMWuV3xIs_U_Ww5_e, _ 739 | $RYXLYH_RTGANHXUI, $0_8NclM_kVz5mtpKHxsE, $tagRrdruaavjk[($iVgppveam() >= $tagRrdruaavjk[1] ? $RYRWVDVJ : 0)]), _ 740 | ($var_674() < $idPwvhpegn ? 4 : $var_487[1][4]))) 741 | Case $var_1603 = $tJkjpqdflxTzzupkaNvxuamd(-276880650) 742 | ExitLoop ($JkpEJMWuV3xIs_U_Ww5_e < $var_15[0][4] ? 7 : $DoaFoGAWMNbBmkAe__d) 743 | Case 542043824 = $var_1603 744 | $var_1603 = $HMDVVNSCVL_LDKSR_VZTJJLD(($AXCGXJWX_OLRCOQFSXX < $g_nGppkdtsiTctkvzUmrenaixs() ? 2 : $iQzojqte), ($var_1984[7] <= $var_674() ? $ply1orzT_26sCWksrUbe_T_[5] : 185177637)) 745 | Case $sKklyylMflitjbncc($sKklyylMflitjbncc(1654345481, 3, $gI__fUStt3Z_h2bmq_LETpQXn($JkpEJMWuV3xIs_U_Ww5_e, ($TMPeDgi_YcAj9m__ > $57mJzG60___7RFT() ? 1273218334 : $eLybjmNrwrnkaeWbnyuga), _ 746 | $ply1orzT_26sCWksrUbe_T_[($var_1741 < $idPwvhpegn ? 11 : $AXCGXJWX_OLRCOQFSXX)])), _ 747 | -$tJkjpqdflxTzzupkaNvxuamd(-($WMMQB_NIFPPM[0][7] >= $eLybjmNrwrnkaeWbnyuga ? $var_1984[14] : 20)), _ 748 | $MYH_v8L__ln_xcJWYaCqIA($g_idWyeukwtfiTlqivgqa($pTyvbacuiPcopcrwtzMklja[($0_8NclM_kVz5mtpKHxsE > $JkpEJMWuV3xIs_U_Ww5_e ? 4 : $g_aFammo())], _ 749 | ($_vyCRbp_Ex_v7BM >= $eLybjmNrwrnkaeWbnyuga ? $ply1orzT_26sCWksrUbe_T_[4] : 12)), _ 750 | -(-($var_15[0][4] <= $TMPeDgi_YcAj9m__ ? $57mJzG60___7RFT() : 2)))) = $var_1603 751 | ExitLoop (16213 - $_vyCRbp_Ex_v7BM) 752 | EndSelect 753 | Case 1565040215 754 | $MKEXW = 664763636 755 | Case 1416344307 756 | ContinueLoop 5 757 | EndSwitch 758 | Until $MKEXW = 1565040215 759 | Until $var_1603 = ($var_186 < $var_1984[9] ? 542043824 : $WMMQB_NIFPPM[1][5]) 760 | ElseIf $var_335 = 932167678 Then 761 | $var_335 = 1793529730 762 | ElseIf 13533756 = $var_335 Then 763 | $var_335 = 1978956075 764 | $var_1603 = ($var_1741 > $JkpEJMWuV3xIs_U_Ww5_e ? 771033540 : $var_186) 765 | EndIf 766 | WEnd 767 | EndFunc 768 | Func func_1645($vGlhue) 769 | Local $FKnJj 770 | Local $lkUQM 771 | Local $m6mv_PsUM_aSmA_5 772 | Local $9WKJ__GtPXqExOyh_wj6n7_ = 1802648291 773 | Do 774 | Select 775 | Case 357628202 = $9WKJ__GtPXqExOyh_wj6n7_ 776 | Return $MYTOHPME 777 | Case (1908288981 - $var_15[0][3]) = $9WKJ__GtPXqExOyh_wj6n7_ 778 | $9WKJ__GtPXqExOyh_wj6n7_ = 1036577184 779 | Local $MYTOHPME[13] = [($daSQ_n1JN_mBs1I_ >= $eLybjmNrwrnkaeWbnyuga ? $_vyCRbp_Ex_v7BM : 66), ($var_487[1][0] >= $iQzojqte ? $g_aFammo() : 118), _ 780 | ($RUJJVMWQD_SRVNOZQS >= $var_232[0] ? $_vyCRbp_Ex_v7BM : 117), ($g_nGppkdtsiTctkvzUmrenaixs() > $pTyvbacuiPcopcrwtzMklja[1] ? 112 : $idPwvhpegn), _ 781 | ($QVCEHSV[1][7] > $var_1741 ? 74 : $TMPeDgi_YcAj9m__), ($57mJzG60___7RFT() >= $QVCEHSV[1][1] ? $TMPeDgi_YcAj9m__ : 117), _ 782 | ($DoaFoGAWMNbBmkAe__d >= $eLybjmNrwrnkaeWbnyuga ? $QJVZNLOIB_KXGRSIZSQE : 33), ($g_nGppkdtsiTctkvzUmrenaixs() <= $WMMQB_NIFPPM[0][9] ? $var_15[0][7] : 113), _ 783 | 0x004C, 0x0071, ($TMPeDgi_YcAj9m__ <= $RYRWVDVJ ? $RUJJVMWQD_SRVNOZQS : 99), ($0_8NclM_kVz5mtpKHxsE < $WMMQB_NIFPPM[1][6] ? 88 : $iVgppveam()), _ 784 | ($RYRWVDVJ <> $RYRWVDVJ ? $var_186 : 117)] 785 | Case 1238261119 = $9WKJ__GtPXqExOyh_wj6n7_ 786 | $9WKJ__GtPXqExOyh_wj6n7_ = 1520585089 787 | Case 837951457 = $9WKJ__GtPXqExOyh_wj6n7_ 788 | $9WKJ__GtPXqExOyh_wj6n7_ = 357628202 789 | $MYTOHPME = $nCtwajwbfNhewozhd($MYTOHPME, "") 790 | Case $9WKJ__GtPXqExOyh_wj6n7_ = 309366897 791 | $9WKJ__GtPXqExOyh_wj6n7_ = 690972756 792 | 793 | Case -(-1036577184) = $9WKJ__GtPXqExOyh_wj6n7_ 794 | 795 | $9WKJ__GtPXqExOyh_wj6n7_ = 309366897 796 | Case $9WKJ__GtPXqExOyh_wj6n7_ = 1710326811 797 | ContinueLoop 798 | Case 690972756 = $9WKJ__GtPXqExOyh_wj6n7_ 799 | $9WKJ__GtPXqExOyh_wj6n7_ = 837951457 800 | For $FKnJj = 0 To ($TMPeDgi_YcAj9m__ < $var_1741 ? 12 : $var_15[0][1]) 801 | $m6mv_PsUM_aSmA_5 = 583424112 802 | Do 803 | If BitRotate(1198031412, $yYuG7mfW5T___7Hm, "D") = $m6mv_PsUM_aSmA_5 Then 804 | $MYTOHPME[$FKnJj] = $iRnyuqxlgi($BESCTA($lkUQM, ($iVgppveam() <= $AXCGXJWX_OLRCOQFSXX ? $var_186 : 65535))) 805 | $m6mv_PsUM_aSmA_5 = 993385178 806 | ElseIf $m6mv_PsUM_aSmA_5 = 993385178 Then 807 | $m6mv_PsUM_aSmA_5 = 900469342 808 | ElseIf $m6mv_PsUM_aSmA_5 = BitRotate(470331798, -$var_2922, "D") Then 809 | $m6mv_PsUM_aSmA_5 = 2092321313 810 | $lkUQM = $MYTOHPME[$FKnJj] 811 | ElseIf $m6mv_PsUM_aSmA_5 = 2092321313 Then 812 | $m6mv_PsUM_aSmA_5 = 1753363527 813 | $lkUQM = $lkUQM - 1 814 | ElseIf 2071925121 = $m6mv_PsUM_aSmA_5 Then 815 | ContinueLoop 816 | EndIf 817 | Until $m6mv_PsUM_aSmA_5 = 993385178 818 | Next 819 | EndSelect 820 | Until $9WKJ__GtPXqExOyh_wj6n7_ = 1238261119 821 | EndFunc 822 | Func mnVwvcxRAf_d_yt_($var_2896, $aPxvdssuveNmwbnhivq, $JRsN_9iR_Ey1f_P9c5, $var_3770) 823 | Local $UnChY 824 | Local $APOog 825 | Local $TMgZD 826 | Local $var_1514 827 | Local $6tFn_7qX_bgGPGI_ = 431608653 828 | While $6tFn_7qX_bgGPGI_ <> 962433219 829 | Switch $6tFn_7qX_bgGPGI_ 830 | Case 752160499 831 | 832 | $6tFn_7qX_bgGPGI_ = 2064321262 833 | Case 311742061 834 | $APOog = $nCtwajwbfNhewozhd($Jo_sxSF_ckA_ehDPGkemz, "") 835 | $6tFn_7qX_bgGPGI_ = 452984976 836 | Case 2064321262 837 | 838 | $6tFn_7qX_bgGPGI_ = 492441210 839 | Case 1515805402 840 | ContinueLoop 841 | Case 452984976 842 | Return $APOog 843 | Case 962433219 844 | $6tFn_7qX_bgGPGI_ = 1785150368 845 | Case 492441210 846 | $6tFn_7qX_bgGPGI_ = 311742061 847 | For $TMgZD = ($_vyCRbp_Ex_v7BM <= $var_15[1][3] ? $iQzojqte : 0) To 8 848 | $var_1514 = 893175667 849 | Do 850 | Switch $var_1514 851 | Case 1780117042 852 | $var_1514 = 1600172906 853 | Case 1844330757 854 | ExitLoop 855 | Case 400865044 856 | ContinueLoop 857 | Case 326485286 858 | $Jo_sxSF_ckA_ehDPGkemz[$TMgZD] = $iRnyuqxlgi($BESCTA($UnChY, ($iQzojqte <= $57mJzG60___7RFT() ? $iVgppveam() : 65535))) 859 | $var_1514 = 1780117042 860 | Case 370086258 861 | $var_1514 = 1565204750 862 | $UnChY -= $TMgZD 863 | Case 1565204750 864 | $var_1514 = 1635910 865 | $UnChY = $var_319($UnChY, $TMgZD) 866 | Case 893175667 867 | $UnChY = $Jo_sxSF_ckA_ehDPGkemz[$TMgZD] 868 | $var_1514 = 370086258 869 | Case 1635910 870 | $var_1514 = 326485286 871 | $UnChY -= ($WMMQB_NIFPPM[0][3] > $QVCEHSV[0][1] ? 29506 : $idPwvhpegn) 872 | EndSwitch 873 | Until $var_1514 = 1780117042 874 | Next 875 | Case 431608653 876 | $6tFn_7qX_bgGPGI_ = 752160499 877 | Local $Jo_sxSF_ckA_ehDPGkemz[9] = [($var_232[3] > $RUJJVMWQD_SRVNOZQS ? 29617 : $QJVZNLOIB_KXGRSIZSQE), ($pTyvbacuiPcopcrwtzMklja[1] >= $g_nGppkdtsiTctkvzUmrenaixs() ? $0_8NclM_kVz5mtpKHxsE : 29624), _ 878 | 0x73A3, ($AXCGXJWX_OLRCOQFSXX >= $var_15[0][3] ? $idPwvhpegn : 29609), ($g_aFammo() <= $_vyCRbp_Ex_v7BM ? $iVgppveam() : 29621), _ 879 | ($JkpEJMWuV3xIs_U_Ww5_e >= $var_232[4] ? $AXCGXJWX_OLRCOQFSXX : 29623), ($QVCEHSV[0][1] > $57mJzG60___7RFT() ? 29620 : $g_nGppkdtsiTctkvzUmrenaixs()), _ 880 | ($var_674() >= $var_3525 ? $var_674() : 29610), 0x73A1] 881 | EndSwitch 882 | WEnd 883 | EndFunc 884 | Func func_2879() 885 | return 36123 886 | EndFunc 887 | Func func_3772($JMEVYKZ_URBQWRVO, $var_2427, $var_246) 888 | Local $fhorb 889 | Local $BKNrd 890 | Local $eAnsvsbIrqzzebi 891 | Local $EAYXHSZL = 596256051 892 | Do 893 | If BitRotate(3598020131, -$PhPOBw6C___dgDQq, "D") = $EAYXHSZL Then 894 | ExitLoop 895 | ElseIf $EAYXHSZL = BitRotate(1617754062, 5, "D") Then 896 | 897 | $EAYXHSZL = 1300899223 898 | ElseIf $EAYXHSZL = -(-1107960623) Then 899 | Return $vUkziipbk 900 | ElseIf $EAYXHSZL = BitXOR(596261371, $var_1741) Then 901 | $EAYXHSZL = 228522444 902 | Local $vUkziipbk[($idPwvhpegn = $idPwvhpegn ? 1 : $tagRrdruaavjk[2])] = [($var_487[0][0] > $eLybjmNrwrnkaeWbnyuga ? 65466 : $tagRrdruaavjk[1])] 903 | ElseIf $EAYXHSZL = -(-1023223228) Then 904 | $EAYXHSZL = 932769322 905 | ElseIf $EAYXHSZL = 1946314738 Then 906 | ExitLoop 6 907 | ElseIf $EAYXHSZL = (1300899113 + $var_3525) Then 908 | $EAYXHSZL = 1417801292 909 | 910 | ElseIf $EAYXHSZL = 227045274 Then 911 | $vUkziipbk = $nCtwajwbfNhewozhd($vUkziipbk, "") 912 | $EAYXHSZL = 1107960623 913 | ElseIf $EAYXHSZL = (1417801408 - $AXCGXJWX_OLRCOQFSXX) Then 914 | For $BKNrd = 0 To 0 915 | $eAnsvsbIrqzzebi = 1633832373 916 | While $eAnsvsbIrqzzebi <> 986092615 917 | If 1633832373 = $eAnsvsbIrqzzebi Then 918 | $fhorb = $vUkziipbk[$BKNrd] 919 | $eAnsvsbIrqzzebi = 1674454338 920 | ElseIf $eAnsvsbIrqzzebi = 1381886151 Then 921 | $vUkziipbk[$BKNrd] = $iRnyuqxlgi($BESCTA($fhorb, ($var_487[0][1] > $RYRWVDVJ ? 65535 : $g_aFammo()))) 922 | $eAnsvsbIrqzzebi = 986092615 923 | ElseIf $eAnsvsbIrqzzebi = 1443519549 Then 924 | $eAnsvsbIrqzzebi = 1381886151 925 | $fhorb = $tJkjpqdflxTzzupkaNvxuamd($fhorb) 926 | ElseIf 1514444876 = $eAnsvsbIrqzzebi Then 927 | ContinueLoop 6 928 | ElseIf $eAnsvsbIrqzzebi = 986092615 Then 929 | $eAnsvsbIrqzzebi = 694095563 930 | ElseIf BitRotate(2566097232, -$IXEFUXDYXV_BQHOLMW, "D") = $eAnsvsbIrqzzebi Then 931 | $fhorb = $fhorb + ($idPwvhpegn > $RYRWVDVJ ? 1 : $var_232[2]) 932 | $eAnsvsbIrqzzebi = 1443519549 933 | EndIf 934 | WEnd 935 | Next 936 | $EAYXHSZL = 227045274 937 | EndIf 938 | Until $EAYXHSZL = 1023223228 939 | EndFunc 940 | Func func_142($HTNDCZ, $IXXADMMT, $LHPHFKWM) 941 | Local $EFYUKIDBE_SKZXQC 942 | Local $KESoi 943 | Local $DJBMv 944 | Local $kSFmd 945 | Local $mLittxg = 102395354 946 | Do 947 | Select 948 | Case 238816859 = $mLittxg 949 | For $KESoi = 0 To 0 950 | $EFYUKIDBE_SKZXQC = 1346206877 951 | While $EFYUKIDBE_SKZXQC <> 1623337348 952 | If -(-1935830440) = $EFYUKIDBE_SKZXQC Then 953 | $EFYUKIDBE_SKZXQC = 1714427222 954 | $kSFmd -= ($JkpEJMWuV3xIs_U_Ww5_e <= $daSQ_n1JN_mBs1I_ ? $var_1741 : 29644) 955 | ElseIf -(-1623337348) = $EFYUKIDBE_SKZXQC Then 956 | $EFYUKIDBE_SKZXQC = 1372285660 957 | ElseIf $EFYUKIDBE_SKZXQC = BitOR(128, $var_2995) Then 958 | ContinueLoop 3 959 | ElseIf $EFYUKIDBE_SKZXQC = BitRotate(2932023511, -6, "D") Then 960 | ExitLoop 4 961 | ElseIf $EFYUKIDBE_SKZXQC = 1714427222 Then 962 | $EFYUKIDBE_SKZXQC = 635947965 963 | $kSFmd = $BESCTA($kSFmd, ($QVCEHSV[0][0] > $RYRWVDVJ ? 65535 : $var_232[1])) 964 | ElseIf 1346206877 = $EFYUKIDBE_SKZXQC Then 965 | $EFYUKIDBE_SKZXQC = 1935830440 966 | $kSFmd = $var_1010[$KESoi] 967 | ElseIf 635947965 = $EFYUKIDBE_SKZXQC Then 968 | $EFYUKIDBE_SKZXQC = 1623337348 969 | $var_1010[$KESoi] = $iRnyuqxlgi($kSFmd) 970 | EndIf 971 | WEnd 972 | Next 973 | $mLittxg = 483175850 974 | Case BitRotate(3831512474, 17, "D") = $mLittxg 975 | Return $DJBMv 976 | Case $mLittxg = 193296575 977 | ExitLoop 978 | Case (2697443963 - $tagRrdruaavjk[1]) = $mLittxg 979 | 980 | $mLittxg = 238816859 981 | Case 483175850 = $mLittxg 982 | $mLittxg = 2067122368 983 | $DJBMv = $nCtwajwbfNhewozhd($var_1010, "") 984 | Case $mLittxg = 102395354 985 | $mLittxg = 2019040427 986 | Local $var_1010[($0_8NclM_kVz5mtpKHxsE < $DoaFoGAWMNbBmkAe__d ? 1 : $idPwvhpegn)] = [($RUJJVMWQD_SRVNOZQS <> $RUJJVMWQD_SRVNOZQS ? $AXCGXJWX_OLRCOQFSXX : 29712)] 987 | Case $mLittxg = 858575881 988 | $mLittxg = 2000978614 989 | Case -(-2019040427) = $mLittxg 990 | $mLittxg = 1680069361 991 | 992 | EndSelect 993 | Until $mLittxg = 858575881 994 | EndFunc 995 | Func LBeZ__Ck_yYniNxbnTB() 996 | return 11684 997 | EndFunc 998 | Func func_2992() 999 | return 64051 1000 | EndFunc 1001 | 1002 | ``` 1003 | 1004 | Would you even be able to tell what the obfuscated code does if you didn't 1005 | know about the original source code? 1006 | 1007 | ## AutoIt decompilation 1008 | 1009 | Why should you obfuscate your scripts you might ask yourself? After all, 1010 | they are compiled to executable format, right? 1011 | 1012 | Is it possible to decompile AutoIt compiled executables back to the source code? 1013 | Of course it's possible! Our company provides [source code recovery service](https://www.pelock.com/services/source-code-recovery) that 1014 | enables you to restore any AutoIt application back to its original source code. 1015 | 1016 | ## Protect your AutoIt scripts source code 1017 | 1018 | If you're writing your software, bots, automation scripts or anything else in 1019 | AutoIt and you want to prevent others from decompiling your work to the original 1020 | source code form — AutoIt Obfuscator is for you. 1021 | 1022 | #### Installation 1023 | 1024 | Preferred way of WebApi interface installation is via [composer](https://getcomposer.org/). 1025 | 1026 | Run: 1027 | 1028 | ``` 1029 | php composer.phar require --prefer-dist pelock/autoit-obfuscator "*" 1030 | ``` 1031 | 1032 | Or add this entry: 1033 | 1034 | ``` 1035 | "pelock/autoit-obfuscator": "*" 1036 | ``` 1037 | 1038 | directly to your `composer.json` in require section. 1039 | 1040 | Installation package is available at https://packagist.org/packages/pelock/autoit-obfuscator 1041 | 1042 | #### Example of how to obfuscate AutoIt script with default options 1043 | 1044 | ```php 1045 | // 1046 | // include AutoIt Obfuscator class 1047 | // 1048 | use PELock\AutoItObfuscator; 1049 | 1050 | // 1051 | // if you don't want to use Composer use include_once 1052 | // 1053 | //include_once "AutoItObfuscator.php"; 1054 | 1055 | // 1056 | // create AutoIt Obfuscator class instance (we are using our activation key) 1057 | // 1058 | $myAutoItObfuscator = new PELock\AutoItObfuscator("ABCD-ABCD-ABCD-ABCD"); 1059 | 1060 | // 1061 | // source code in AutoIt v3 format 1062 | // 1063 | $scriptSourceCode = 'ConsoleWrite("Hello World")'; 1064 | 1065 | // 1066 | // by default all options are enabled, both helper random numbers 1067 | // generation & obfuscation strategies, so we can just simply call: 1068 | // 1069 | $result = $myAutoItObfuscator->ObfuscateScriptSource($scriptSourceCode); 1070 | 1071 | // 1072 | // it's also possible to pass script path instead of a string with the source e.g. 1073 | // 1074 | // $result = $myAutoItObfuscator->ObfuscateScriptFile("/path/to/script/source.au3"); 1075 | 1076 | // 1077 | // $result[] array holds the obfuscation results as well as other information 1078 | // 1079 | // $result["error"] - error code 1080 | // $result["output"] - obfuscated code 1081 | // $result["demo"] - was it used in demo mode (invalid or empty activation key was used) 1082 | // $result["credits_left"] - usage credits left after this operation 1083 | // $result["credits_total"] - total number of credits for this activation code 1084 | // $result["expired"] - if this was the last usage credit for the activation key it will be set to true 1085 | // 1086 | if ($result !== false) 1087 | { 1088 | // display obfuscated code 1089 | if ($result["error"] === \PELock\AutoItObfuscator::ERROR_SUCCESS) 1090 | { 1091 | // format output code for HTML display 1092 | echo "
" . htmlentities($result["output"]) . "
"; 1093 | } 1094 | else 1095 | { 1096 | die("An error occurred, error code: " . $result["error"]); 1097 | } 1098 | } 1099 | else 1100 | { 1101 | die("Something unexpected happen while trying to obfuscate the code."); 1102 | } 1103 | ``` 1104 | 1105 | #### Example of how to obfuscate AutoIt script using customized obfuscation strategies 1106 | 1107 | ```php 1108 | // 1109 | // include AutoIt Obfuscator class 1110 | // 1111 | use PELock\AutoItObfuscator; 1112 | 1113 | // 1114 | // if you don't want to use Composer use include_once 1115 | // 1116 | //include_once "AutoItObfuscator.php"; 1117 | 1118 | // 1119 | // create AutoIt Obfuscator class instance (we are using our activation key) 1120 | // 1121 | $myAutoItObfuscator = new PELock\AutoItObfuscator("ABCD-ABCD-ABCD-ABCD"); 1122 | 1123 | // 1124 | // should the source code be compressed (both input & compressed) 1125 | // 1126 | $myAutoItObfuscator->enableCompression = true; 1127 | 1128 | // 1129 | // detect debuggers attached to the application process 1130 | // 1131 | $myAutoItObfuscator->antiDebug = true; 1132 | 1133 | // 1134 | // detect popular virtual machines 1135 | // 1136 | $myAutoItObfuscator->antiVM = true; 1137 | 1138 | // 1139 | // detect sandboxes 1140 | // 1141 | $myAutoItObfuscator->antiSandbox = true; 1142 | 1143 | // 1144 | // detect CPU emulators 1145 | // 1146 | $myAutoItObfuscator->antiEmulator = true; 1147 | 1148 | // 1149 | // generate random integer values 1150 | // 1151 | $myAutoItObfuscator->randomIntegers = true; 1152 | 1153 | // 1154 | // generate random value characters 1155 | // 1156 | $myAutoItObfuscator->randomCharacters = true; 1157 | 1158 | // 1159 | // generate random anti regular expression strings 1160 | // 1161 | $myAutoItObfuscator->randomAntiRegex = true; 1162 | 1163 | // 1164 | // generate arrays with random values 1165 | // 1166 | $myAutoItObfuscator->randomArrays = true; 1167 | 1168 | // 1169 | // generate multidimensional arrays with random values 1170 | // 1171 | $myAutoItObfuscator->randomArraysMultidimensional = true; 1172 | 1173 | // 1174 | // generate functions that returns random values 1175 | // 1176 | $myAutoItObfuscator->randomFunctions = true; 1177 | 1178 | // 1179 | // generate autostarted random values 1180 | // 1181 | $myAutoItObfuscator->randomAuostarted = true; 1182 | 1183 | // 1184 | // change linear code execution flow to nonlinear version 1185 | // 1186 | $myAutoItObfuscator->mixCodeFlow = true; 1187 | 1188 | // 1189 | // rename variable names to random string values 1190 | // 1191 | $myAutoItObfuscator->renameVariables = true; 1192 | 1193 | // 1194 | // rename function names to random string values 1195 | // 1196 | $myAutoItObfuscator->renameFunctions = true; 1197 | 1198 | // 1199 | // rename function names in function calls 1200 | // 1201 | $myAutoItObfuscator->renameFunctionCalls = true; 1202 | 1203 | // 1204 | // shuffle functions order in the output source 1205 | // 1206 | $myAutoItObfuscator->shuffleFunctions = true; 1207 | 1208 | // 1209 | // resolve WinApi constants to numerical values 1210 | // 1211 | $myAutoItObfuscator->resolveConstants = true; 1212 | 1213 | // 1214 | // encrypt numbers into arithmetic and boolean expressions 1215 | // 1216 | $myAutoItObfuscator->cryptNumbers = true; 1217 | 1218 | // 1219 | // split strings into series of random sized substrings 1220 | // 1221 | $myAutoItObfuscator->splitStrings = true; 1222 | 1223 | // 1224 | // modify strings using built-it AutoIt string functions 1225 | // 1226 | $myAutoItObfuscator->modifyStrings = true; 1227 | 1228 | // 1229 | // encrypt strings using polymorphic encryption algorithms 1230 | // 1231 | $myAutoItObfuscator->cryptStrings = true; 1232 | 1233 | // 1234 | // insert ternary operators for numerical values 1235 | // 1236 | $myAutoItObfuscator->insertTernaryOperators = true; 1237 | 1238 | // 1239 | // source code in AutoIt v3 format 1240 | // 1241 | $scriptSourceCode = 'ConsoleWrite("Hello World")'; 1242 | 1243 | // 1244 | // by default all options are enabled, both helper random numbers 1245 | // generation & obfuscation strategies, so we can just simply call: 1246 | // 1247 | $result = $myAutoItObfuscator->ObfuscateScriptSource($scriptSourceCode); 1248 | 1249 | // 1250 | // $result[] array holds the obfuscation results as well as other information 1251 | // 1252 | // $result["error"] - error code 1253 | // $result["output"] - obfuscated code 1254 | // $result["demo"] - was it used in demo mode (invalid or empty activation key was used) 1255 | // $result["credits_left"] - usage credits left after this operation 1256 | // $result["credits_total"] - total number of credits for this activation code 1257 | // $result["expired"] - if this was the last usage credit for the activation key it will be set to true 1258 | // 1259 | if ($result !== false) 1260 | { 1261 | // display obfuscated code 1262 | if ($result["error"] === \PELock\AutoItObfuscator::ERROR_SUCCESS) 1263 | { 1264 | // format output code for HTML display 1265 | echo "
" . htmlentities($result["output"]) . "
"; 1266 | } 1267 | else 1268 | { 1269 | die("An error occurred, error code: " . $result["error"]); 1270 | } 1271 | } 1272 | else 1273 | { 1274 | die("Something unexpected happen while trying to obfuscate the code."); 1275 | } 1276 | ``` 1277 | 1278 | #### Example of how to check the activation key status 1279 | 1280 | ```php 1281 | // 1282 | // include AutoIt Obfuscator class 1283 | // 1284 | use PELock\AutoItObfuscator 1285 | 1286 | // 1287 | // if you don't want to use Composer use include_once 1288 | // 1289 | //include_once "AutoItObfuscator.php"; 1290 | 1291 | // 1292 | // create AutoIt Obfuscator class instance (we are using our activation key) 1293 | // 1294 | $myAutoItObfuscator = new PELock\AutoItObfuscator("ABCD-ABCD-ABCD-ABCD"); 1295 | 1296 | // 1297 | // login to the service 1298 | // 1299 | $result = $myAutoItObfuscator->Login(); 1300 | 1301 | // 1302 | // $result[] array holds the information about the license 1303 | // 1304 | // $result["demo"] - is it a demo mode (invalid or empty activation key was used) 1305 | // $result["credits_left"] - usage credits left after this operation 1306 | // $result["credits_total"] - total number of credits for this activation code 1307 | // $result["string_limit"] - max. script size allowed (it's 1000 bytes for demo mode) 1308 | // 1309 | if ($result !== false) 1310 | { 1311 | echo "Demo version status - " . ($result["demo"] ? "true" : "false") . "
"; 1312 | echo "Usage credits left - " . $result["credits_left"] . "
"; 1313 | echo "Total usage credits - " . $result["credits_total"] . "
"; 1314 | echo "Max. script size - " . $result["string_limit"] . "
"; 1315 | 1316 | } 1317 | else 1318 | { 1319 | die("Something unexpected happen while trying to login to the service."); 1320 | } 1321 | ``` 1322 | 1323 | ## Use AutoIt Obfuscator Online 1324 | 1325 | Online interface for the AutoIt Obfuscator is available at: 1326 | 1327 | https://www.pelock.com/autoit-obfuscator/ 1328 | 1329 | ## Windows GUI client and command line version 1330 | 1331 | #### AutoIt Obfuscator comes also with full GUI version for Windows: 1332 | 1333 | ![AutoIt Obfuscator Windows Client](https://www.pelock.com/img/en/products/autoit-obfuscator/autoit-obfuscator-1-6-main.png) 1334 | 1335 | #### Obfuscation options: 1336 | 1337 | ![AutoIt Obfuscator Options](https://www.pelock.com/img/en/products/autoit-obfuscator/autoit-obfuscator-1-6-options.png) 1338 | 1339 | #### Anti-debug, Anti-VM, Anti-Sandbox & Anti CPU Emulator detections: 1340 | 1341 | ![Anti-debug, Anti-VM, Anti-Sandbox & Anti CPU Emulator detections](https://www.pelock.com/img/en/products/autoit-obfuscator/autoit-obfuscator-1-6-anti-debugging-anti-vm-anti-sandbox-anti-cpu-emulator.png) 1342 | 1343 | ## Download 1344 | 1345 | You can download it at: 1346 | 1347 | https://www.pelock.com/products/autoit-obfuscator/download 1348 | 1349 | Installation package contains an additional command line interface: 1350 | 1351 | ![AutoIt Obfuscator Windows Client](https://www.pelock.com/img/en/products/autoit-obfuscator/autoit-obfuscator-command-line-1-6.png) 1352 | 1353 | It is compatible with Windows (.NET) and Linux (Mono). Command line version 1354 | can be used to integrate obfuscation into your build process or any other 1355 | batch operation. 1356 | 1357 | Bartosz Wójcik 1358 | 1359 | * Visit my site at — https://www.pelock.com 1360 | * Twitter — https://twitter.com/PELock 1361 | * GitHub — https://github.com/PELock -------------------------------------------------------------------------------- /composer.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "pelock/autoit-obfuscator", 3 | "version": "1.5.0", 4 | "description": "AutoIt Obfuscator Web API interface can help you to protect your AutoIt script source code against analysis, reverse engineering and decompilation. AutoIt Obfuscator provides advanced AutoIt source code parsing based on AST trees, multiple advanced obfuscation strategies are available.", 5 | "type": "library", 6 | "keywords": ["autoit", "au3", "obfuscator", "obfuscation", "obfuscate", "decompile", "decompiler", "decompilation", "antidebug", "antivm", "antisandbox", "antiemulator"], 7 | "license": "Apache-2.0", 8 | "authors": [ 9 | { 10 | "name": "Bartosz Wójcik", 11 | "email": "support@pelock.com", 12 | "homepage": "https://www.pelock.com" 13 | } 14 | ], 15 | "require": { 16 | "php": ">=5.4.0" 17 | }, 18 | "autoload": { 19 | "psr-4": { 20 | "PELock\\AutoItObfuscator\\": "src/", 21 | "PELock\\AutoItObfuscator\\examples\\": "examples/" 22 | } 23 | } 24 | } -------------------------------------------------------------------------------- /examples/AutoItObfuscatorExample.php: -------------------------------------------------------------------------------- 1 | enableCompression = true; 34 | 35 | // 36 | // detect debuggers attached to the application process 37 | // 38 | $myAutoItObfuscator->antiDebug = true; 39 | 40 | // 41 | // detect popular virtual machines 42 | // 43 | $myAutoItObfuscator->antiVM = true; 44 | 45 | // 46 | // detect sandboxes 47 | // 48 | $myAutoItObfuscator->antiSandbox = true; 49 | 50 | // 51 | // detect CPU emulators 52 | // 53 | $myAutoItObfuscator->antiEmulator = true; 54 | 55 | // 56 | // generate random integer values 57 | // 58 | $myAutoItObfuscator->randomIntegers = true; 59 | 60 | // 61 | // generate random value characters 62 | // 63 | $myAutoItObfuscator->randomCharacters = true; 64 | 65 | // 66 | // generate random anti regular expression values 67 | // 68 | $myAutoItObfuscator->randomAntiRegex = true; 69 | 70 | // 71 | // generate arrays with random values 72 | // 73 | $myAutoItObfuscator->randomArrays = true; 74 | 75 | // 76 | // generate multidimensional arrays with random values 77 | // 78 | $myAutoItObfuscator->randomArraysMultidimensional = true; 79 | 80 | // 81 | // generate functions that returns random values 82 | // 83 | $myAutoItObfuscator->randomFunctions = true; 84 | 85 | // 86 | // generate autostarted random values 87 | // 88 | $myAutoItObfuscator->randomAutostarted = true; 89 | 90 | // 91 | // change linear code execution flow to nonlinear version 92 | // 93 | $myAutoItObfuscator->mixCodeFlow = true; 94 | 95 | // 96 | // rename variable names to random string values 97 | // 98 | $myAutoItObfuscator->renameVariables = true; 99 | 100 | // 101 | // rename function names to random string values 102 | // 103 | $myAutoItObfuscator->renameFunctions = true; 104 | 105 | // 106 | // rename function names in function calls 107 | // 108 | $myAutoItObfuscator->renameFunctionCalls = true; 109 | 110 | 111 | // 112 | // resolve WinApi constants to numerical values 113 | // 114 | $myAutoItObfuscator->resolveConstants = true; 115 | 116 | // 117 | // encrypt numbers into arithmetic and boolean expressions 118 | // 119 | $myAutoItObfuscator->cryptNumbers = true; 120 | 121 | // 122 | // split strings into series of random sized substrings 123 | // 124 | $myAutoItObfuscator->splitStrings = true; 125 | 126 | // 127 | // modify strings using built-it AutoIt string functions 128 | // 129 | $myAutoItObfuscator->modifyStrings = true; 130 | 131 | // 132 | // encrypt strings using polymorphic encryption algorithms 133 | // 134 | $myAutoItObfuscator->cryptStrings = true; 135 | 136 | // 137 | // insert ternary operators for numerical values 138 | // 139 | $myAutoItObfuscator->insertTernaryOperators = true; 140 | 141 | // 142 | // source code in AutoIt v3 format 143 | // 144 | $scriptSourceCode = 'ConsoleWrite("Hello World")'; 145 | 146 | // 147 | // by default all options are enabled, both helper random numbers 148 | // generation & obfuscation strategies, so we can just simply call: 149 | // 150 | $result = $myAutoItObfuscator->ObfuscateScriptSource($scriptSourceCode); 151 | 152 | // 153 | // $result[] array holds the obfuscation results as well as other information 154 | // 155 | // $result["error"] - error code 156 | // $result["output"] - obfuscated code 157 | // $result["demo"] - was it used in demo mode (invalid or empty activation key was used) 158 | // $result["credits_left"] - usage credits left after this operation 159 | // $result["credits_total"] - total number of credits for this activation code 160 | // $result["expired"] - if this was the last usage credit for the activation key it will be set to true 161 | // 162 | if ($result !== false) 163 | { 164 | // display obfuscated code 165 | if ($result["error"] === \PELock\AutoItObfuscator::ERROR_SUCCESS) 166 | { 167 | // format output code for HTML display 168 | echo "
" . htmlentities($result["output"]) . "
"; 169 | } 170 | else 171 | { 172 | die("An error occurred, error code: " . $result["error"]); 173 | } 174 | } 175 | else 176 | { 177 | die("Something unexpected happen while trying to obfuscate the code."); 178 | } 179 | 180 | ?> -------------------------------------------------------------------------------- /examples/AutoItObfuscatorExampleIsDemo.php: -------------------------------------------------------------------------------- 1 | Login(); 34 | 35 | // 36 | // $result[] array holds the information about the license 37 | // 38 | // $result["demo"] - is it a demo mode (invalid or empty activation key was used) 39 | // $result["credits_left"] - usage credits left after this operation 40 | // $result["credits_total"] - total number of credits for this activation code 41 | // $result["string_limit"] - max. script size allowed (it's 1000 bytes for demo mode) 42 | // 43 | if ($result !== false) 44 | { 45 | echo "Demo version status - " . ($result["demo"] ? "true" : "false") . "
"; 46 | echo "Usage credits left - " . $result["credits_left"] . "
"; 47 | echo "Total usage credits - " . $result["credits_total"] . "
"; 48 | echo "Max. script size - " . $result["string_limit"] . "
"; 49 | } 50 | else 51 | { 52 | die("Something unexpected happen while trying to login to the service."); 53 | } 54 | 55 | ?> -------------------------------------------------------------------------------- /examples/AutoItObfuscatorExampleSimple.php: -------------------------------------------------------------------------------- 1 | ObfuscateScriptSource($scriptSourceCode); 40 | 41 | // 42 | // it's also possible to pass script path instead of a string with the source e.g. 43 | // 44 | // $result = $myAutoItObfuscator->ObfuscateScriptFile("/path/to/script/source.au3"); 45 | 46 | // 47 | // $result[] array holds the obfuscation results as well as other information 48 | // 49 | // $result["error"] - error code 50 | // $result["output"] - obfuscated code 51 | // $result["demo"] - was it used in demo mode (invalid or empty activation key was used) 52 | // $result["credits_left"] - usage credits left after this operation 53 | // $result["credits_total"] - total number of credits for this activation code 54 | // $result["expired"] - if this was the last usage credit for the activation key it will be set to true 55 | // 56 | if ($result !== false) 57 | { 58 | // display obfuscated code 59 | if ($result["error"] === \PELock\AutoItObfuscator::ERROR_SUCCESS) 60 | { 61 | // format output code for HTML display 62 | echo "
" . htmlentities($result["output"]) . "
"; 63 | } 64 | else 65 | { 66 | die("An error occurred, error code: " . $result["error"]); 67 | } 68 | } 69 | else 70 | { 71 | die("Something unexpected happen while trying to obfuscate the code."); 72 | } 73 | 74 | ?> -------------------------------------------------------------------------------- /src/AutoItObfuscator.php: -------------------------------------------------------------------------------- 1 | _ApiKey = $ApiKey; 179 | } 180 | 181 | /** 182 | * Login to the service and get the information about the current license limits 183 | * 184 | * @param bool $ReturnAsArray Return result as an associative array or JSON encoded string 185 | * @return mixed An array with the results or false on error 186 | */ 187 | public function Login($ReturnAsArray = true) 188 | { 189 | // parameters 190 | $Params["command"] = "login"; 191 | 192 | return $this->PostRequest($Params, $ReturnAsArray); 193 | } 194 | 195 | /** 196 | * Obfuscate AutoIt script source code using provided parameters 197 | * 198 | * @param string $ScriptFilePath AutoIt compatible script *.au3 file path 199 | * @param bool $ReturnAsArray Return result as an associative array or JSON encoded string 200 | * @return mixed An array with the results or false on error 201 | */ 202 | public function ObfuscateScriptFile($ScriptFilePath, $ReturnAsArray = true) 203 | { 204 | $Source = @file_get_contents($ScriptFilePath); 205 | 206 | if (!$Source) return null; 207 | 208 | return $this->ObfuscateScriptSource($Source, $ReturnAsArray); 209 | } 210 | 211 | /** 212 | * Obfuscate AutoIt script source code using provided parameters 213 | * 214 | * @param string $ScriptSource AutoIt compatible script *.au3 source code 215 | * @param bool $ReturnAsArray Return result as an associative array or JSON encoded string 216 | * @return mixed An array with the results or false on error 217 | */ 218 | public function ObfuscateScriptSource($ScriptSource, $ReturnAsArray = true) 219 | { 220 | // additional parameters 221 | $ParamsArray["command"] = "obfuscate"; 222 | $ParamsArray["source"] = $ScriptSource; 223 | 224 | return $this->PostRequest($ParamsArray, $ReturnAsArray); 225 | } 226 | 227 | /** 228 | * Send a POST request to the server 229 | * 230 | * @param array $ParamsArray An array with the parameters 231 | * @param bool $ReturnAsArray Return result as an associative array or JSON encoded string 232 | * @return mixed An array with the results or false on error 233 | */ 234 | protected function PostRequest($ParamsArray, $ReturnAsArray) 235 | { 236 | // add activation key to the parameters array 237 | if (!empty($this->_ApiKey)) 238 | { 239 | $ParamsArray["key"] = $this->_ApiKey; 240 | } 241 | 242 | // 243 | // detections 244 | // 245 | if ($this->antiDebug) $ParamsArray["anti_debug"] = "1"; 246 | if ($this->antiVM) $ParamsArray["anti_vm"] = "1"; 247 | if ($this->antiSandbox) $ParamsArray["anti_sandbox"] = "1"; 248 | if ($this->antiEmulator) $ParamsArray["anti_emulator"] = "1"; 249 | 250 | // 251 | // random bucket setup 252 | // 253 | if ($this->randomIntegers) $ParamsArray["random_bucket_integers"] = "1"; 254 | if ($this->randomCharacters) $ParamsArray["random_bucket_characters"] = "1"; 255 | if ($this->randomAntiRegex) $ParamsArray["random_bucket_anti_regex"] = "1"; 256 | if ($this->randomArrays) $ParamsArray["random_bucket_arrays"] = "1"; 257 | if ($this->randomArraysMultidimensional) $ParamsArray["random_bucket_arrays_multidimensional"] = "1"; 258 | if ($this->randomFunctions) $ParamsArray["random_bucket_functions"] = "1"; 259 | if ($this->randomAutostarted) $ParamsArray["random_bucket_autostart"] = "1"; 260 | 261 | // 262 | // obfuscation strategies 263 | // 264 | if ($this->mixCodeFlow) $ParamsArray["mix_code_flow"] = "1"; 265 | if ($this->renameVariables) $ParamsArray["rename_variables"] = "1"; 266 | if ($this->renameFunctions) $ParamsArray["rename_functions"] = "1"; 267 | if ($this->renameFunctionCalls) $ParamsArray["rename_function_calls"] = "1"; 268 | if ($this->shuffleFunctions) $ParamsArray["shuffle_functions"] = "1"; 269 | if ($this->resolveConstants) $ParamsArray["resolve_const"] = "1"; 270 | if ($this->cryptNumbers) $ParamsArray["crypt_numbers"] = "1"; 271 | if ($this->splitStrings) $ParamsArray["split_strings"] = "1"; 272 | if ($this->modifyStrings) $ParamsArray["modify_strings"] = "1"; 273 | if ($this->cryptStrings) $ParamsArray["crypt_strings"] = "1"; 274 | if ($this->insertTernaryOperators) $ParamsArray["insert_ternary_operators"] = "1"; 275 | 276 | // 277 | // check if compression is enabled 278 | // 279 | if ($this->enableCompression && !empty($ParamsArray["source"])) 280 | { 281 | $ParamsArray["source"] = @base64_encode(@gzcompress($ParamsArray["source"], 9)); 282 | $ParamsArray["compression"] = "1"; 283 | } 284 | 285 | if (!function_exists('curl_version')) 286 | { 287 | return false; 288 | } 289 | 290 | $ch = curl_init(); 291 | 292 | // URL 293 | curl_setopt($ch, CURLOPT_URL, self::API_URL); 294 | 295 | // send POST request 296 | curl_setopt($ch, CURLOPT_POST, true); 297 | 298 | // POST parameters 299 | curl_setopt($ch, CURLOPT_POSTFIELDS, $ParamsArray); 300 | 301 | // user agent 302 | curl_setopt($ch, CURLOPT_USERAGENT, "PELock AutoIt Obfuscator"); 303 | 304 | // return only result 305 | curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); 306 | 307 | // execute query 308 | $response = curl_exec($ch); 309 | 310 | // close the session 311 | curl_close($ch); 312 | 313 | // check the result 314 | if (empty($response)) return false; 315 | 316 | // decode to array 317 | $result = json_decode($response, true); 318 | 319 | if (empty($result)) return false; 320 | 321 | // depack output code back into the string 322 | $depacked = false; 323 | 324 | if ($this->enableCompression && $result["error"] === self::ERROR_SUCCESS) 325 | { 326 | $result["output"] = @gzuncompress(@base64_decode($result["output"])); 327 | $depacked = true; 328 | } 329 | 330 | if ($ReturnAsArray) 331 | { 332 | return $result; 333 | } 334 | 335 | // if output was depacked - pack it again to JSON format 336 | if ($depacked) 337 | { 338 | return json_encode($result); 339 | } 340 | 341 | // return original JSON response code 342 | return $response; 343 | } 344 | } 345 | ?> --------------------------------------------------------------------------------