pelock / autoit-obfuscator
AutoIt Obfuscator Web API 接口可以帮助您保护 AutoIt 脚本源代码,防止分析、逆向工程和反编译。AutoIt Obfuscator 提供基于 AST 树的高级 AutoIt 源代码解析,并提供了多种高级混淆策略。
Requires
- php: >=5.4.0
This package is auto-updated.
Last update: 2024-09-10 17:57:53 UTC
README
AutoIt Obfuscator 是一个工具,可以修改 AutoIt 脚本源代码,使其分析非常困难。
更多技术细节、下载、文档可在以下地址找到
https://www.pelock.com/products/autoit-obfuscator
在线界面
https://www.pelock.com/autoit-obfuscator/
什么是源代码混淆?
混淆是将 AutoIt 源代码转换为其受保护版本的过程。脚本功能保持不变,一切正常工作,但源代码被保护,所有变量都被加密,字符串也被加密,我们的 AutoIt Obfuscator 使用多种混淆策略来保护您的 AutoIt 源代码的真实含义。
混淆前的 AutoIt 脚本示例
#include <MsgBoxConstants.au3> Example() Func Example() MsgBox($MB_SYSTEMMODAL, "AutoIt Obfuscator", "Hello World!") EndFunc ;==>Example
混淆后的
;//////////////////////////////////////////////////////////////////////////////// ;// ;// AutoIt Obfuscator v2.1 - Bartosz Wójcik ;// ;// Website : https://www.pelock.com/products/autoit-obfuscator ;// Version : v2.1 ;// Date : 08.02.2024 ;// ;//////////////////////////////////////////////////////////////////////////////// #include <Array.au3> #include <MsgBoxConstants.au3> #AutoIt3Wrapper_Tidy_Stop_OnError=n #AutoIt3Wrapper_Run_AU3Check=n Global Const $daSQ_n1JN_mBs1I_ = Asc(StringMid("Random(1, 270905415 + SRandom(1566730703), 1)", 19, 1)) Global $RYRWVDVJ = Asc("J") Global $RYXLYH_RTGANHXUI = Asc("3") Global $tagRrdruaavjk[3] = [150, 1017374602, 10411] Global $DoaFoGAWMNbBmkAe__d = 4045 Global $AXCGXJWX_OLRCOQFSXX = Asc("t") Global Const $iQzojqte = 26933 Global Const $var_15[2][8] = [[1595107513, 1104537718, 868900013, 105640690, 47653, 116, 693837332, 16233], [1211827987, 1657997570, 37032, 227, 57, 6273, 762969513]] #OnAutoItStartRegister "VwdmsFnzdotDyuxttspg" Global Const $var_487[2][8] = [[1083217155, 30638, 84, 144, 43877, 189, 1295519879, 1915220323], [247, 163, 143, 18102, 51, 17202]] Global $QVCEHSV[2][9] = [[866325531, 131], [18637, 203, 995096871, 202, 287364341, 29839, 367413199, 52009, 242297425]] Global $var_3525 = Asc(StringMid("Until 1", 2, 1)) Global Const $WMMQB_NIFPPM[2][15] = [[81, 876847059, 170, 47439, 863656242, 33, 245, 119, 27673, 136, 28, 758746073, 199, _ 92], _ [129, 1658572839, 42061, 94, 70, 61382, 183, 12027, 91, 221, 43126, 1736920964, 201, _ 199, 993478498]] Global Const $var_1984[15] = [2081761766, 3730, 731908840, 52077, 586602441, 1456646884, 1133870265, 950602932, _ 26639, 94, 1477000589, 142, 388924395, 184, 962894257] Global $pTyvbacuiPcopcrwtzMklja[7] = [10180, 91, 112, 18252, 987799017, 2057457675, 918277144] Global Const $var_1013[2][9] = [[670581154, 47303, 1365877447, 1573616251], [58622, 884054024, 1848519651, 15229, 13921, 50, 62097, 42, 15]] Global Const $0_8NclM_kVz5mtpKHxsE = 127 Global Const $TMPeDgi_YcAj9m__ = 210 Global Const $eLybjmNrwrnkaeWbnyuga = 233690701 Global $ply1orzT_26sCWksrUbe_T_[15] = [10592, 966841092, 5959, 162, 54645, 138, 116485994, 72967675, 20376, 24742, 479499993, _ 24, 136, 712789901, 169] Global Const $RUJJVMWQD_SRVNOZQS = Asc(StringMid('Asc(StringMid("uBdB3fJaKj", 74 , 1))', 14, 1)) #OnAutoItStartRegister "PDVwv_rlXpGPnDT_rerRdIt" Global Const $JkpEJMWuV3xIs_U_Ww5_e = Asc(StringMid('StringLen("7cnVFjYCh8")', 13, 1)) #OnAutoItStartRegister "func_843" Global Const $var_186 = Asc(":") Global $var_232[5] = [181, 47520, 180, 17769, 908012825] #OnAutoItStartRegister "Csxsdy" Global $aAnefpjqin = 74 Global $PhPOBw6C___dgDQq = 18 Global $TCBDV_KZAXCB = 1610629136 Global $sKrndyBafzrRrnztv = 30 Global $yYuG7mfW5T___7Hm = 8 Global $IXEFUXDYXV_BQHOLMW = 30 Global $FHANKWNTCU_LXGYYGBMZ_GPLLLOGDO = 20 Global $JSDCW_FFPIYFSC = 26933 Global $bFbbccxjwr = 834927369 Global $var_2995 = 1952693505 Global $GRBDSMW = 36338 Global $var_2922 = 22 Global $Q2cGypOD6cG4gQO_S__rwRXO_ = 915476553 Global $_XFJWQ6Jq_3c_rP = 12 Global $sJhugwfPfnnwafYhrgzwm = 248479756 Local $g_iCvsrwuGtzdva = 617049966 While $g_iCvsrwuGtzdva <> 2147003747 Switch $g_iCvsrwuGtzdva Case 658231252 $g_iCvsrwuGtzdva = 33656329 Global $nCtwajwbfNhewozhd = _ArrayToString Case 4324177 Global $iNOxLl_Y5__rSk9 = func_2108 $g_iCvsrwuGtzdva = 658231252 Case 1926422611 $g_iCvsrwuGtzdva = 406152061 Global $BESCTA = BitAND Case 2088978457 $g_iCvsrwuGtzdva = 1021723140 Global $Pts7YqvR8ogkYI3_j_ = func_2824 Case 1637416108 Global $nFeubksuJaekekoos = StringTrimRight $g_iCvsrwuGtzdva = 232503255 Case 1293800215 Global $var_824 = Chr $g_iCvsrwuGtzdva = 1702584836 Case 1278717404 Global $iVgppveam = LBeZ__Ck_yYniNxbnTB $g_iCvsrwuGtzdva = 1637416108 Case 2147003747 $g_iCvsrwuGtzdva = 737317436 Case 445534110 $g_iCvsrwuGtzdva = 463259058 Global $YPKANC_EANNAEOUTZ_CDSNBCFY = ($iQzojqte > $RYRWVDVJ ? 10 : $0_8NclM_kVz5mtpKHxsE) Case 1795214713 Global $tJkjpqdflxTzzupkaNvxuamd = BitNOT $g_iCvsrwuGtzdva = 140913128 Case 1021723140 $g_iCvsrwuGtzdva = 499083887 Global $var_674 = MwsmxbIvzilhkmmv Case 249620526 $g_iCvsrwuGtzdva = 2088978457 Global $fQoyipvpvvJsxvoydvVwtqcqjjd = func_1645 Case 51111198 Global $__uNo_5dDC3irlrj = ($var_1013[0][1] > $var_232[0] ? 36123 : $_vyCRbp_Ex_v7BM) $g_iCvsrwuGtzdva = 1333314932 Case 140913128 $g_iCvsrwuGtzdva = 774361981 Global $HMDVVNSCVL_LDKSR_VZTJJLD = BitOR Case 953027176 $g_iCvsrwuGtzdva = 4324177 Global $dPchzwlhrRbvcbkrhag = func_590 Case 1333314932 $g_iCvsrwuGtzdva = 1897445216 Global $var_3414 = ($idPwvhpegn > $var_674() ? 40 : $RUJJVMWQD_SRVNOZQS) Case 347970668 Global $IH9frd_V_Ny78gj7Pv_ = LjxxediHvmzudFunc $g_iCvsrwuGtzdva = 1143886282 Case 359560691 Global $var_3109 = kshdBtUJ__VAoRkx_ $g_iCvsrwuGtzdva = 1926422611 Case 910530821 Global $wYEBsrws_FMr__d = MsgBox $g_iCvsrwuGtzdva = 1444580454 Case 499083887 $g_iCvsrwuGtzdva = 463457632 Global $gI__fUStt3Z_h2bmq_LETpQXn = func_3772 Case 1444580454 $g_iCvsrwuGtzdva = 347970668 Global $g_nGppkdtsiTctkvzUmrenaixs = func_2879 Case 1372772068 Global $g_idWyeukwtfiTlqivgqa = ZmamgqVejvobrdpr $g_iCvsrwuGtzdva = 1293800215 Case 908930352 ExitLoop 6 Case 1231237004 Local $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = ($TMPeDgi_YcAj9m__ < $g_aFammo() ? 552190499 : $ply1orzT_26sCWksrUbe_T_[13]) $g_iCvsrwuGtzdva = 690808515 Case 1143886282 $g_iCvsrwuGtzdva = 953027176 Global $MYH_v8L__ln_xcJWYaCqIA = StringTrimLeft Case 1294486107 Global $57mJzG60___7RFT = l_o_HXcjpD_SYHQAeR $g_iCvsrwuGtzdva = 1253090901 Case 617049966 $g_iCvsrwuGtzdva = 1372772068 Global $var_2346 = XhldjdktogOauclcspvYdgbizf Case 406152061 Global $STROTDCZBV = StringReverse $g_iCvsrwuGtzdva = 1468630116 Case 463457632 $g_iCvsrwuGtzdva = 910530821 Global $sLzorjsdrvc = func_142 Case 774361981 Global $tagVwyjliaXlozsRqfyyhls = ExqhuvmFunc $g_iCvsrwuGtzdva = 658161984 Case 658161984 Global $4U5_jiAa__bBPyJ94 = mnVwvcxRAf_d_yt_ $g_iCvsrwuGtzdva = 249620526 Case 1897445216 Global $var_528 = ($AXCGXJWX_OLRCOQFSXX < $57mJzG60___7RFT() ? 110 : $ply1orzT_26sCWksrUbe_T_[7]) $g_iCvsrwuGtzdva = 2013443140 Case 1468630116 $g_iCvsrwuGtzdva = 1294486107 Global $sKklyylMflitjbncc = BitRotate Case 690808515 Do Local $bOpgeeazBotcsqhda = 1146533760 While $bOpgeeazBotcsqhda <> 913749461 If $bOpgeeazBotcsqhda = 1146533760 Then $bOpgeeazBotcsqhda = 913749461 Select Case $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = 1208605110 ContinueLoop (-($iQzojqte < $g_aFammo() ? 103 : $_vyCRbp_Ex_v7BM) + $var_3525) Case $tJkjpqdflxTzzupkaNvxuamd(-$HMDVVNSCVL_LDKSR_VZTJJLD(($iQzojqte >= $idPwvhpegn ? $DoaFoGAWMNbBmkAe__d : 32), 552190468)) = $KGOFEZCH_PZGKCPZQ_YWBOIRVIA $var_2346() $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = ($g_nGppkdtsiTctkvzUmrenaixs() < $QVCEHSV[0][0] ? 459530765 : $var_15[1][2]) Case 459530765 = $KGOFEZCH_PZGKCPZQ_YWBOIRVIA $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = ($_vyCRbp_Ex_v7BM <= $AXCGXJWX_OLRCOQFSXX ? $var_1013[0][3] : 1020762825) EndSelect ElseIf (913776394 - $iQzojqte) = $bOpgeeazBotcsqhda Then $bOpgeeazBotcsqhda = 322004711 ElseIf 967806574 = $bOpgeeazBotcsqhda Then ExitLoop EndIf WEnd Until $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = $HMDVVNSCVL_LDKSR_VZTJJLD(8196, $_25spd6WhjA5v_K_0z) $g_iCvsrwuGtzdva = 2147003747 Case 463259058 Global $_rIZjTd_HmZD_avE3V = (($var_1741 > $var_674() ? 1601850157 : $g_aFammo()) - $var_15[($RYRWVDVJ < $var_232[1] ? 0 : $g_aFammo())][6]) $g_iCvsrwuGtzdva = 1231237004 Case 232503255 Global $iRnyuqxlgi = ChrW $g_iCvsrwuGtzdva = 1795214713 Case 33656329 Global $k7GBMu_e_4_j4pIbN5jpC = func_2761 $g_iCvsrwuGtzdva = 51111198 Case 1253090901 Global $g_aFammo = func_2992 $g_iCvsrwuGtzdva = 1278717404 Case 2013443140 $g_iCvsrwuGtzdva = 445534110 Global $_25spd6WhjA5v_K_0z = 459522569 Case 1702584836 $g_iCvsrwuGtzdva = 359560691 Global $var_319 = BitXOR Case 634755709 ContinueLoop 4 EndSwitch WEnd Func Csxsdy() Global Const $idPwvhpegn = 31272 EndFunc Func func_2824($nQfewaexz) Local $OhpH__a_yjUXSpJbp1_7G Local $bYhoz Local $wjCAP Local $mEznjydsJlwzwvpNlxnomim = 77796654 Do Select Case BitNOT(-77796655) = $mEznjydsJlwzwvpNlxnomim Local $ATGLKUTIJ_QDPPJCZO_RHAHPIROS[($AXCGXJWX_OLRCOQFSXX >= $g_nGppkdtsiTctkvzUmrenaixs() ? $tagRrdruaavjk[2] : 1)] = [($eLybjmNrwrnkaeWbnyuga > $0_8NclM_kVz5mtpKHxsE ? 33039 : $var_1741)] $mEznjydsJlwzwvpNlxnomim = 1076869607 Case 1413481184 = $mEznjydsJlwzwvpNlxnomim ContinueLoop Case BitRotate(411838221, -8, "D") = $mEznjydsJlwzwvpNlxnomim $ATGLKUTIJ_QDPPJCZO_RHAHPIROS = $nCtwajwbfNhewozhd($ATGLKUTIJ_QDPPJCZO_RHAHPIROS, "") $mEznjydsJlwzwvpNlxnomim = 603112525 Case $mEznjydsJlwzwvpNlxnomim = BitOR(29224, 1126040770) $mEznjydsJlwzwvpNlxnomim = 1426594036 Case $mEznjydsJlwzwvpNlxnomim = BitRotate(3406902415, 22, "D") Return $ATGLKUTIJ_QDPPJCZO_RHAHPIROS Case $mEznjydsJlwzwvpNlxnomim = 1217691568 For $wjCAP = ($eLybjmNrwrnkaeWbnyuga > $tagRrdruaavjk[2] ? 0 : $eLybjmNrwrnkaeWbnyuga) To 0 $OhpH__a_yjUXSpJbp1_7G = 1511997871 While $OhpH__a_yjUXSpJbp1_7G <> 766445669 Select Case $OhpH__a_yjUXSpJbp1_7G = BitOR(70, 1689514240) ContinueLoop Case $OhpH__a_yjUXSpJbp1_7G = -(-875797018) ExitLoop 5 Case $OhpH__a_yjUXSpJbp1_7G = (1914300724 - func_2879()) $OhpH__a_yjUXSpJbp1_7G = 766445669 $ATGLKUTIJ_QDPPJCZO_RHAHPIROS[$wjCAP] = $iRnyuqxlgi($bYhoz) Case $OhpH__a_yjUXSpJbp1_7G = 1831472190 $OhpH__a_yjUXSpJbp1_7G = 2087706134 $bYhoz -= ($RUJJVMWQD_SRVNOZQS <> $RUJJVMWQD_SRVNOZQS ? $var_3525 : 32971) Case BitNOT(-1511997872) = $OhpH__a_yjUXSpJbp1_7G $bYhoz = $ATGLKUTIJ_QDPPJCZO_RHAHPIROS[$wjCAP] $OhpH__a_yjUXSpJbp1_7G = 1831472190 Case 2087706134 = $OhpH__a_yjUXSpJbp1_7G $OhpH__a_yjUXSpJbp1_7G = 1914264601 $bYhoz = $BESCTA($bYhoz, ($RYRWVDVJ < $QVCEHSV[1][1] ? 65535 : $_vyCRbp_Ex_v7BM)) Case (766398149 + $var_232[1]) = $OhpH__a_yjUXSpJbp1_7G $OhpH__a_yjUXSpJbp1_7G = 1553217442 EndSelect WEnd Next $mEznjydsJlwzwvpNlxnomim = 219712551 Case $mEznjydsJlwzwvpNlxnomim = 462860296 ExitLoop Case $mEznjydsJlwzwvpNlxnomim = BitRotate(4221465602, -$_XFJWQ6Jq_3c_rP, "D") $mEznjydsJlwzwvpNlxnomim = 834927433 Case BitOR(64, $bFbbccxjwr) = $mEznjydsJlwzwvpNlxnomim $mEznjydsJlwzwvpNlxnomim = 1217691568 EndSelect Until $mEznjydsJlwzwvpNlxnomim = 1126069994 EndFunc Func VwdmsFnzdotDyuxttspg() Global Const $_vyCRbp_Ex_v7BM = 16211 EndFunc Func kshdBtUJ__VAoRkx_($I17nHbJLeHP_AbdEy_Jv_k, $4bA9_V_kzbya2eTi_, $g_tagNzmwvogvcDrrqdyHgtrrhatq, $BJF2wz_5_BE_H7nQ, $bClksvbsqu) Local $ECihY Local $tagDtelzvCfbgyrowiExfbdcikr Local $AIoyw Local $tagEvoxtJijwhd = 1089293261 Do Select Case $tagEvoxtJijwhd = BitOR(3, 49585408) $tagEvoxtJijwhd = 1112814825 Case 1112814825 = $tagEvoxtJijwhd $tagEvoxtJijwhd = 238307709 For $ECihY = ($pTyvbacuiPcopcrwtzMklja[3] < $eLybjmNrwrnkaeWbnyuga ? 0 : $iVgppveam()) To ($0_8NclM_kVz5mtpKHxsE > $var_3525 ? 8 : $0_8NclM_kVz5mtpKHxsE) $tagDtelzvCfbgyrowiExfbdcikr = 600025905 While $tagDtelzvCfbgyrowiExfbdcikr <> 2069210512 Switch $tagDtelzvCfbgyrowiExfbdcikr Case 1675985919 $AIoyw = $BESCTA($AIoyw, ($iVgppveam() > $RYRWVDVJ ? 65535 : $var_1013[0][0])) $tagDtelzvCfbgyrowiExfbdcikr = 206240765 Case 2069210512 $tagDtelzvCfbgyrowiExfbdcikr = 1688829242 Case 600025905 $AIoyw = $pTnnummiEmngehppXubgfakzat[$ECihY] $tagDtelzvCfbgyrowiExfbdcikr = 1700140494 Case 120023844 ContinueLoop Case 206240765 $tagDtelzvCfbgyrowiExfbdcikr = 2069210512 $pTnnummiEmngehppXubgfakzat[$ECihY] = $iRnyuqxlgi($AIoyw) Case 1700140494 $tagDtelzvCfbgyrowiExfbdcikr = 1675985919 $AIoyw = $tJkjpqdflxTzzupkaNvxuamd($AIoyw) EndSwitch WEnd Next Case 1615272022 = $tagEvoxtJijwhd $tagEvoxtJijwhd = 49585411 Case 1361880375 = $tagEvoxtJijwhd ContinueLoop 4 Case $tagEvoxtJijwhd = BitOR(5122, $sJhugwfPfnnwafYhrgzwm) ContinueLoop 3 Case $tagEvoxtJijwhd = 1089293261 $tagEvoxtJijwhd = 1615272022 Local $pTnnummiEmngehppXubgfakzat[($_vyCRbp_Ex_v7BM > $iVgppveam() ? 9 : $var_1984[11])] = [($tagRrdruaavjk[1] <= $var_232[1] ? $TMPeDgi_YcAj9m__ : 65421), ($0_8NclM_kVz5mtpKHxsE >= $var_232[3] ? $var_1741 : 65435), _ ($RYRWVDVJ >= $_vyCRbp_Ex_v7BM ? $var_15[1][6] : 65458), ($var_15[1][0] > $RUJJVMWQD_SRVNOZQS ? 65426 : $TMPeDgi_YcAj9m__), _ ($RYXLYH_RTGANHXUI < $var_15[1][5] ? 65465 : $var_1013[1][0]), ($daSQ_n1JN_mBs1I_ >= $pTyvbacuiPcopcrwtzMklja[4] ? $AXCGXJWX_OLRCOQFSXX : 65462), _ ($JkpEJMWuV3xIs_U_Ww5_e <= $RYXLYH_RTGANHXUI ? $RUJJVMWQD_SRVNOZQS : 65432), ($QVCEHSV[0][0] >= $var_15[0][0] ? $JkpEJMWuV3xIs_U_Ww5_e : 65422), _ ($eLybjmNrwrnkaeWbnyuga > $g_aFammo() ? 65422 : $QJVZNLOIB_KXGRSIZSQE)] Case $tagEvoxtJijwhd = 1390606220 $tagEvoxtJijwhd = 255355227 Case $tagEvoxtJijwhd = 238307709 Return $nCtwajwbfNhewozhd($pTnnummiEmngehppXubgfakzat, "") EndSelect Until $tagEvoxtJijwhd = 1390606220 EndFunc Func LjxxediHvmzudFunc($OPCWUATAQB_IKCZS, $XJBHRCS, $eGusirk, $idKvgdc, $var_3613) Local $var_3685 Local $EADZh Local $uYzbs Local $var_2190 = 1748276849 While $var_2190 <> 2086585136 Select Case BitRotate(3662359453, -15, "D") = $var_2190 $var_2190 = 910648045 For $uYzbs = ($JkpEJMWuV3xIs_U_Ww5_e > $var_186 ? 0 : $WMMQB_NIFPPM[0][13]) To 8 $var_3685 = 1789753879 While $var_3685 <> 1786515751 If $var_3685 = (657057966 + $WMMQB_NIFPPM[1][0]) Then ContinueLoop ElseIf $var_3685 = 494678596 Then $EADZh -= ($var_3525 < $iQzojqte ? 55055 : $eLybjmNrwrnkaeWbnyuga) $var_3685 = 1003949072 ElseIf 1786515751 = $var_3685 Then $var_3685 = 1242266197 ElseIf BitXOR(1732291674, $eLybjmNrwrnkaeWbnyuga) = $var_3685 Then $EADZh = $var_2158[$uYzbs] $var_3685 = 494678596 ElseIf $var_3685 = (1003959483 - $tagRrdruaavjk[2]) Then $var_3685 = 1786515751 $var_2158[$uYzbs] = $iRnyuqxlgi($BESCTA($EADZh, ($iVgppveam() >= $idPwvhpegn ? $_vyCRbp_Ex_v7BM : 65535))) EndIf WEnd Next Case $var_2190 = 1608991756 $var_2190 = 749143544 Case 910648045 = $var_2190 $var_2190 = 958446746 $var_2158 = $nCtwajwbfNhewozhd($var_2158, "") Case 1748276849 = $var_2190 Local $var_2158[($idPwvhpegn >= $g_aFammo() ? $TMPeDgi_YcAj9m__ : 9)] = [($iVgppveam() > $JkpEJMWuV3xIs_U_Ww5_e ? 55155 : $daSQ_n1JN_mBs1I_), 0xD75B, ($AXCGXJWX_OLRCOQFSXX > $var_186 ? 55156 : $var_674()), _ ($QVCEHSV[1][3] < $idPwvhpegn ? 55169 : $0_8NclM_kVz5mtpKHxsE), ($var_1013[0][3] > $0_8NclM_kVz5mtpKHxsE ? 55136 : $RYRWVDVJ), _ ($RYXLYH_RTGANHXUI = $RYXLYH_RTGANHXUI ? 55133 : $RUJJVMWQD_SRVNOZQS), ($RUJJVMWQD_SRVNOZQS < $TMPeDgi_YcAj9m__ ? 55133 : $var_3525), _ ($JkpEJMWuV3xIs_U_Ww5_e >= $eLybjmNrwrnkaeWbnyuga ? $var_487[0][2] : 55131), ($iQzojqte > $WMMQB_NIFPPM[0][9] ? 55133 : $var_674())] $var_2190 = 1608991756 Case $var_2190 = BitRotate(200300878, 15, "D") $var_2190 = 1463530646 Case $var_2190 = 958446746 Return $var_2158 Case $var_2190 = 2086585136 $var_2190 = 884841013 Case 1687203516 = $var_2190 ExitLoop EndSelect WEnd EndFunc Func func_2108($HZFAULFPX, $FIJWCQGVO_GIITMQK, $ZMHMXOW_IWVOPIARR, $cS_PiWP_SLhDIci4cMbys__, $AFWJJ_ZOBFZ) Local $kowpG Local $GhVAH Local $g_dQamyoc Local $YYBs_F_fo4uE940_1KQT = 948500808 Do If $YYBs_F_fo4uE940_1KQT = 948500808 Then Local $BLPOYAUTJ[5] = [($var_232[3] < $QJVZNLOIB_KXGRSIZSQE ? 3616 : $var_1741), 0x09A0, ($RYRWVDVJ >= $pTyvbacuiPcopcrwtzMklja[6] ? $WMMQB_NIFPPM[0][2] : 3840), _ 0x09A0, 0x04A0] $YYBs_F_fo4uE940_1KQT = 715077790 ElseIf $YYBs_F_fo4uE940_1KQT = 2109201347 Then Return $nCtwajwbfNhewozhd($BLPOYAUTJ, "") ElseIf $YYBs_F_fo4uE940_1KQT = BitRotate(3317261104, $sKrndyBafzrRrnztv, "D") Then $YYBs_F_fo4uE940_1KQT = 253654024 ElseIf $YYBs_F_fo4uE940_1KQT = (1525393193 + $0_8NclM_kVz5mtpKHxsE) Then $YYBs_F_fo4uE940_1KQT = 1422050096 ElseIf $YYBs_F_fo4uE940_1KQT = 424807218 Then ContinueLoop ElseIf $YYBs_F_fo4uE940_1KQT = BitRotate(4199020277, -$FHANKWNTCU_LXGYYGBMZ_GPLLLOGDO, "D") Then ContinueLoop 6 ElseIf $YYBs_F_fo4uE940_1KQT = BitXOR(715109765, func_2879()) Then $YYBs_F_fo4uE940_1KQT = 829315276 ElseIf $YYBs_F_fo4uE940_1KQT = 253654024 Then For $kowpG = ($var_674() < $0_8NclM_kVz5mtpKHxsE ? 0 : $g_aFammo()) To 4 $g_dQamyoc = 1423172325 While $g_dQamyoc <> 1518726 If $g_dQamyoc = 1518726 Then $g_dQamyoc = 140540229 ElseIf $g_dQamyoc = BitNOT(-769138355) Then ExitLoop 3 ElseIf $g_dQamyoc = BitXOR(1273888897, $var_15[1][6]) Then $g_dQamyoc = 1518726 $BLPOYAUTJ[$kowpG] = $iRnyuqxlgi($GhVAH) ElseIf $g_dQamyoc = (1124690641 - $daSQ_n1JN_mBs1I_) Then $g_dQamyoc = 985332967 $GhVAH = $sKklyylMflitjbncc($GhVAH, -($iQzojqte <> $iQzojqte ? $var_1741 : 5), "W") ElseIf $g_dQamyoc = BitXOR(1739858882, l_o_HXcjpD_SYHQAeR()) Then $GhVAH = $BESCTA($GhVAH, 65535) $g_dQamyoc = 1721236776 ElseIf $g_dQamyoc = BitRotate(4172895540, 18, "D") Then $g_dQamyoc = 1124690588 $GhVAH = $BLPOYAUTJ[$kowpG] ElseIf BitXOR(985332946, $daSQ_n1JN_mBs1I_) = $g_dQamyoc Then $GhVAH = $var_319($GhVAH, $kowpG) $g_dQamyoc = 1739858873 EndIf WEnd Next $YYBs_F_fo4uE940_1KQT = 2109201347 EndIf Until $YYBs_F_fo4uE940_1KQT = 1525393320 EndFunc Func func_2761($hZgrpresKfgetBjfwte, $var_3881, $Tbl_B88_gxOhbMh7__v3wA9) Local $syEUk Local $tRhrgmiPfbhtibozNormf Local $aWnOA Local $var_1618 = 343604610 Do Select Case BitXOR(278575428, $var_15[1][2]) = $var_1618 Return $nCtwajwbfNhewozhd($mYciskoBrxlofaxKjtjvh, "") Case $var_1618 = 64366577 $var_1618 = 1741474204 Case $var_1618 = BitRotate(3960513495, -19, "D") $var_1618 = 64366577 Local $mYciskoBrxlofaxKjtjvh[($var_3525 < $0_8NclM_kVz5mtpKHxsE ? 15 : $var_15[1][2])] = [($var_487[0][7] > $var_487[1][1] ? 34929 : $var_674()), ($var_1741 >= $pTyvbacuiPcopcrwtzMklja[6] ? $pTyvbacuiPcopcrwtzMklja[6] : 18550), _ 0x8878, ($var_186 < $eLybjmNrwrnkaeWbnyuga ? 34936 : $eLybjmNrwrnkaeWbnyuga), ($QVCEHSV[0][0] <= $_vyCRbp_Ex_v7BM ? $QVCEHSV[0][0] : 51323), _ ($iVgppveam() >= $idPwvhpegn ? $AXCGXJWX_OLRCOQFSXX : 34919), ($QVCEHSV[0][1] < $DoaFoGAWMNbBmkAe__d ? 51317 : $eLybjmNrwrnkaeWbnyuga), _ 0x0870, ($iQzojqte <= $iVgppveam() ? $QJVZNLOIB_KXGRSIZSQE : 2163), ($var_487[1][4] >= $0_8NclM_kVz5mtpKHxsE ? $var_232[0] : 34929), _ 0x4878, ($0_8NclM_kVz5mtpKHxsE > $var_186 ? 2163 : $var_186), ($idPwvhpegn > $var_1984[1] ? 51313 : $tagRrdruaavjk[1]), _ ($JkpEJMWuV3xIs_U_Ww5_e >= $idPwvhpegn ? $var_674() : 34926), ($RYRWVDVJ <= $daSQ_n1JN_mBs1I_ ? $var_487[0][4] : 2162)] Case 1693485494 = $var_1618 For $aWnOA = ($g_aFammo() <= $0_8NclM_kVz5mtpKHxsE ? $g_nGppkdtsiTctkvzUmrenaixs() : 0) To 14 $tRhrgmiPfbhtibozNormf = 1839177923 Do If BitRotate(3678355846, 31, "D") = $tRhrgmiPfbhtibozNormf Then $tRhrgmiPfbhtibozNormf = 1199419190 $syEUk = $mYciskoBrxlofaxKjtjvh[$aWnOA] ElseIf BitXOR(384366934, $RUJJVMWQD_SRVNOZQS) = $tRhrgmiPfbhtibozNormf Then ContinueLoop 5 ElseIf 888255762 = $tRhrgmiPfbhtibozNormf Then $tRhrgmiPfbhtibozNormf = 1721391954 ElseIf $tRhrgmiPfbhtibozNormf = BitRotate(2998430213, 21, "D") Then $tRhrgmiPfbhtibozNormf = 890667640 $syEUk = $sKklyylMflitjbncc($syEUk, ($tagRrdruaavjk[2] > $JkpEJMWuV3xIs_U_Ww5_e ? 2 : $g_aFammo()), $var_824(($daSQ_n1JN_mBs1I_ < $JkpEJMWuV3xIs_U_Ww5_e ? 87 : $g_aFammo()))) ElseIf (1199419080 + $var_3525) = $tRhrgmiPfbhtibozNormf Then $tRhrgmiPfbhtibozNormf = 1085691661 $syEUk = $var_319($syEUk, ($RYXLYH_RTGANHXUI < $iQzojqte ? 59649 : $QJVZNLOIB_KXGRSIZSQE)) ElseIf 89853842 = $tRhrgmiPfbhtibozNormf Then $tRhrgmiPfbhtibozNormf = 888255762 $mYciskoBrxlofaxKjtjvh[$aWnOA] = $iRnyuqxlgi($BESCTA($syEUk, ($_vyCRbp_Ex_v7BM > $var_674() ? 65535 : $g_aFammo()))) ElseIf 890667640 = $tRhrgmiPfbhtibozNormf Then $syEUk += ($var_1013[1][2] > $var_15[1][3] ? 31367 : $g_nGppkdtsiTctkvzUmrenaixs()) $tRhrgmiPfbhtibozNormf = 89853842 EndIf Until $tRhrgmiPfbhtibozNormf = 888255762 Next $var_1618 = 278538732 Case 1740166709 = $var_1618 $var_1618 = 1870930293 Case $var_1618 = BitXOR(1021165794, $RYRWVDVJ) ContinueLoop Case $var_1618 = 1741474204 $var_1618 = 1693485494 Case 1679710546 = $var_1618 ContinueLoop EndSelect Until $var_1618 = 1740166709 EndFunc Func func_843() Global $QJVZNLOIB_KXGRSIZSQE = 52925 EndFunc Func l_o_HXcjpD_SYHQAeR() return 123 EndFunc Func ZmamgqVejvobrdpr($PAQEMMME_RKBLXT, $eLmwrjaKygcbuvbhqUddumw) Local $htGnb Local $pVQGt Local $g_vPqcrqlrhaxMhghhiNygmsrlkq Local $E_wrtN_pcreYX_dn1aT_mU = 1198208156 Do Select Case BitRotate(3023738763, 13, "D") = $E_wrtN_pcreYX_dn1aT_mU $E_wrtN_pcreYX_dn1aT_mU = 285379741 Case 1198208156 = $E_wrtN_pcreYX_dn1aT_mU Local $g_hJeroqAegdbZxfphihmm[($iQzojqte > $var_674() ? 3 : $pTyvbacuiPcopcrwtzMklja[5])] = [($ply1orzT_26sCWksrUbe_T_[12] < $var_232[0] ? 65455 : $AXCGXJWX_OLRCOQFSXX), ($57mJzG60___7RFT() >= $0_8NclM_kVz5mtpKHxsE ? $idPwvhpegn : 65446), _ ($var_232[1] > $RYRWVDVJ ? 65469 : $_vyCRbp_Ex_v7BM)] $E_wrtN_pcreYX_dn1aT_mU = 735568953 Case $E_wrtN_pcreYX_dn1aT_mU = 1236073516 ContinueLoop 6 Case $E_wrtN_pcreYX_dn1aT_mU = BitRotate(3277150147, 26, "D") ExitLoop Case $E_wrtN_pcreYX_dn1aT_mU = 750760046 Return $nCtwajwbfNhewozhd($g_hJeroqAegdbZxfphihmm, "") Case $E_wrtN_pcreYX_dn1aT_mU = BitNOT(-735568954) $E_wrtN_pcreYX_dn1aT_mU = 1982148580 Case $E_wrtN_pcreYX_dn1aT_mU = BitXOR(1982177814, $GRBDSMW) $E_wrtN_pcreYX_dn1aT_mU = 1137216872 Case 1137216872 = $E_wrtN_pcreYX_dn1aT_mU For $pVQGt = 0 To ($g_aFammo() <= $daSQ_n1JN_mBs1I_ ? $JkpEJMWuV3xIs_U_Ww5_e : 2) $g_vPqcrqlrhaxMhghhiNygmsrlkq = 1404237146 Do If $g_vPqcrqlrhaxMhghhiNygmsrlkq = BitOR(352879083, $TCBDV_KZAXCB) Then $g_vPqcrqlrhaxMhghhiNygmsrlkq = 6493354 $htGnb = $BESCTA($htGnb, ($iQzojqte <= $daSQ_n1JN_mBs1I_ ? $var_3525 : 65535)) ElseIf (1404225462 + LBeZ__Ck_yYniNxbnTB()) = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then $g_vPqcrqlrhaxMhghhiNygmsrlkq = 915484781 $htGnb = $g_hJeroqAegdbZxfphihmm[$pVQGt] ElseIf $g_vPqcrqlrhaxMhghhiNygmsrlkq = 1497427717 Then ExitLoop ElseIf $g_vPqcrqlrhaxMhghhiNygmsrlkq = 6493354 Then $g_hJeroqAegdbZxfphihmm[$pVQGt] = $iRnyuqxlgi($htGnb) $g_vPqcrqlrhaxMhghhiNygmsrlkq = 104056690 ElseIf 397834887 = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then $g_vPqcrqlrhaxMhghhiNygmsrlkq = 1963508219 $htGnb += $pVQGt ElseIf BitNOT(-104056691) = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then $g_vPqcrqlrhaxMhghhiNygmsrlkq = 397028648 ElseIf BitOR(8228, $Q2cGypOD6cG4gQO_S__rwRXO_) = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then $g_vPqcrqlrhaxMhghhiNygmsrlkq = 397834887 $htGnb = $tJkjpqdflxTzzupkaNvxuamd($htGnb) EndIf Until $g_vPqcrqlrhaxMhghhiNygmsrlkq = 104056690 Next $E_wrtN_pcreYX_dn1aT_mU = 750760046 EndSelect Until $E_wrtN_pcreYX_dn1aT_mU = 1391556231 EndFunc Func ExqhuvmFunc($aXfadtjmddmClyianptBfdxpkykyf, $var_1727) Local $var_1695 Local $yQDlj Local $OuzxJ Local $dEhcwrdLrpqeedr = 978959788 While $dEhcwrdLrpqeedr <> 423706635 If 487061179 = $dEhcwrdLrpqeedr Then $dEhcwrdLrpqeedr = 1089577581 ElseIf $dEhcwrdLrpqeedr = BitNOT(-1179000189) Then ExitLoop ElseIf 978959788 = $dEhcwrdLrpqeedr Then Local $e3Tti1_fn_Hi_KglNxJ_9nDp2[($var_232[4] > $g_nGppkdtsiTctkvzUmrenaixs() ? 6 : $var_3525)] = [0x7803, ($RYRWVDVJ < $var_232[2] ? 34819 : $AXCGXJWX_OLRCOQFSXX), ($QJVZNLOIB_KXGRSIZSQE >= $g_aFammo() ? $var_487[1][0] : 20483), _ 0x1002, ($tagRrdruaavjk[2] > $DoaFoGAWMNbBmkAe__d ? 45058 : $ply1orzT_26sCWksrUbe_T_[5]), _ ($RYXLYH_RTGANHXUI < $var_3525 ? 63490 : $var_186)] $dEhcwrdLrpqeedr = 487061179 ElseIf -(-1452105097) = $dEhcwrdLrpqeedr Then Return $nCtwajwbfNhewozhd($e3Tti1_fn_Hi_KglNxJ_9nDp2, "") ElseIf $dEhcwrdLrpqeedr = 423706635 Then $dEhcwrdLrpqeedr = 1254312193 ElseIf $dEhcwrdLrpqeedr = 1239918521 Then $dEhcwrdLrpqeedr = 1452105097 For $yQDlj = ($idPwvhpegn > $var_674() ? 0 : $iQzojqte) To ($RYRWVDVJ >= $QVCEHSV[1][5] ? $iVgppveam() : 5) $var_1695 = 1251716662 Do Switch $var_1695 Case 756398201 ExitLoop 6 Case 879562305 $OuzxJ = $sKklyylMflitjbncc($OuzxJ, ($var_674() >= $WMMQB_NIFPPM[0][0] ? $var_1984[14] : 5), "W") $var_1695 = 1223582942 Case 2050035474 $e3Tti1_fn_Hi_KglNxJ_9nDp2[$yQDlj] = $iRnyuqxlgi($BESCTA($OuzxJ, ($pTyvbacuiPcopcrwtzMklja[5] <= $eLybjmNrwrnkaeWbnyuga ? $g_aFammo() : 65535))) $var_1695 = 985520159 Case 1223582942 $var_1695 = 2050035474 $OuzxJ += $yQDlj Case 1251716662 $var_1695 = 879562305 $OuzxJ = $e3Tti1_fn_Hi_KglNxJ_9nDp2[$yQDlj] Case 1879642750 ExitLoop Case 985520159 $var_1695 = 1995586243 EndSwitch Until $var_1695 = 985520159 Next ElseIf 1089577581 = $dEhcwrdLrpqeedr Then $dEhcwrdLrpqeedr = 1239918521 ElseIf 1579470891 = $dEhcwrdLrpqeedr Then ContinueLoop 2 EndIf WEnd EndFunc Func MwsmxbIvzilhkmmv() return 33 EndFunc Func PDVwv_rlXpGPnDT_rerRdIt() Global $var_1741 = 7368 EndFunc Func func_590($g_idDbfgvqvxtBxmtuOwiwqhic, $var_1378, $dyHo94Qz7m__IEf_7nJ) Local $zDtdh Local $Xbqfx Local $g_iXuvvjzmvyqSvehiwzqyJdxwxmab Local $var_716 = 1649816790 Do If $var_716 = (1633087511 + $idPwvhpegn) Then $var_716 = 448556372 ElseIf $var_716 = BitOR(1028, 1339781152) Then ExitLoop ElseIf 1994519692 = $var_716 Then $var_716 = 1422062326 ElseIf 324688272 = $var_716 Then ContinueLoop ElseIf 1082956149 = $var_716 Then Return $nCtwajwbfNhewozhd($Ctowu_7L9c0Q_V_, "") ElseIf $var_716 = (1649816580 + $TMPeDgi_YcAj9m__) Then Local $Ctowu_7L9c0Q_V_[6] = [0x0044, ($AXCGXJWX_OLRCOQFSXX < $TMPeDgi_YcAj9m__ ? 110 : $var_1984[0]), ($var_232[2] < $eLybjmNrwrnkaeWbnyuga ? 86 : $var_1741), _ ($_vyCRbp_Ex_v7BM > $var_487[1][0] ? 116 : $var_186), ($AXCGXJWX_OLRCOQFSXX < $g_nGppkdtsiTctkvzUmrenaixs() ? 90 : $var_1013[0][0]), _ ($var_3525 > $var_186 ? 83 : $idPwvhpegn)] $var_716 = 1768902480 ElseIf BitRotate(442225620, 2, "D") = $var_716 Then $var_716 = 1994519692 ElseIf $var_716 = (1422062436 - $var_3525) Then $var_716 = 1082956149 For $zDtdh = ($var_1741 < $tagRrdruaavjk[1] ? 0 : $var_186) To ($QJVZNLOIB_KXGRSIZSQE <= $var_232[0] ? $AXCGXJWX_OLRCOQFSXX : 5) $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1168368224 While $g_iXuvvjzmvyqSvehiwzqyJdxwxmab <> 1934027910 Select Case (1168384435 - $_vyCRbp_Ex_v7BM) = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 843665306 $Xbqfx = $Ctowu_7L9c0Q_V_[$zDtdh] Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1538044303 ExitLoop Case 441378963 = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab $Ctowu_7L9c0Q_V_[$zDtdh] = $iRnyuqxlgi($Xbqfx) $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1934027910 Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1934027910 $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1635709312 Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 843665306 $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 568103089 $Xbqfx -= $zDtdh Case 568103089 = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab $Xbqfx = $var_319($Xbqfx, $zDtdh) $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 542241927 Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = BitRotate(2524047113, -2, "D") ExitLoop 2 Case 542241927 = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab $Xbqfx = $BESCTA($Xbqfx, ($var_1013[0][0] > $JkpEJMWuV3xIs_U_Ww5_e ? 65535 : $var_3525)) $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 441378963 EndSelect WEnd Next EndIf Until $var_716 = 1633118783 EndFunc Func XhldjdktogOauclcspvYdgbizf() Local $MKEXW Local $var_1603 Local $var_335 = 13533756 While $var_335 <> 932167678 If 790170939 = $var_335 Then ContinueLoop 5 ElseIf $var_335 = 1161797863 Then ExitLoop 7 ElseIf $var_335 = 1978956075 Then $var_335 = 932167678 Do $MKEXW = 866183679 Do Switch $MKEXW Case 1630456761 ContinueLoop Case 866183679 $MKEXW = 1565040215 Select Case $sKklyylMflitjbncc($sKklyylMflitjbncc(1310814120, $YPKANC_EANNAEOUTZ_CDSNBCFY, $sLzorjsdrvc($g_aFammo(), $var_3525, $var_1013[0][2])), _ -$tJkjpqdflxTzzupkaNvxuamd(-30), $nFeubksuJaekekoos($dPchzwlhrRbvcbkrhag($ply1orzT_26sCWksrUbe_T_[3], $var_674(), $iQzojqte), (-908012820 + $var_232[4]))) = $var_1603 $var_1603 = 542043824 $wYEBsrws_FMr__d(4096, $nFeubksuJaekekoos($fQoyipvpvvJsxvoydvVwtqcqjjd($JkpEJMWuV3xIs_U_Ww5_e), ($57mJzG60___7RFT() >= $var_1741 ? $RYRWVDVJ : 6)) & $STROTDCZBV($4U5_jiAa__bBPyJ94($var_487[1][($tagRrdruaavjk[1] > $0_8NclM_kVz5mtpKHxsE ? 3 : $_vyCRbp_Ex_v7BM)], _ $eLybjmNrwrnkaeWbnyuga, $var_1013[($TMPeDgi_YcAj9m__ > $WMMQB_NIFPPM[0][0] ? 0 : $tagRrdruaavjk[0])][($var_1013[1][4] >= $var_1984[10] ? $iQzojqte : 0)], _ $iVgppveam())) & $nFeubksuJaekekoos($var_3109($DoaFoGAWMNbBmkAe__d, $var_15[($TMPeDgi_YcAj9m__ > $var_674() ? 0 : $var_232[0])][($QJVZNLOIB_KXGRSIZSQE <= $var_487[1][2] ? $daSQ_n1JN_mBs1I_ : 7)], _ $eLybjmNrwrnkaeWbnyuga, 134, $var_1984[($daSQ_n1JN_mBs1I_ < $RYRWVDVJ ? 4 : $_vyCRbp_Ex_v7BM)]), _ $tJkjpqdflxTzzupkaNvxuamd(-($var_674() < $RUJJVMWQD_SRVNOZQS ? 9 : $AXCGXJWX_OLRCOQFSXX))), _ $nFeubksuJaekekoos($k7GBMu_e_4_j4pIbN5jpC($var_1741, $DoaFoGAWMNbBmkAe__d, $var_186), ($_vyCRbp_Ex_v7BM > $0_8NclM_kVz5mtpKHxsE ? 8 : $eLybjmNrwrnkaeWbnyuga)) & $nFeubksuJaekekoos($tagVwyjliaXlozsRqfyyhls($tagRrdruaavjk[1], $DoaFoGAWMNbBmkAe__d), $sKklyylMflitjbncc(($RYXLYH_RTGANHXUI >= $g_nGppkdtsiTctkvzUmrenaixs() ? $ply1orzT_26sCWksrUbe_T_[14] : 805306368), _ 4, $Pts7YqvR8ogkYI3_j_($tagRrdruaavjk[($pTyvbacuiPcopcrwtzMklja[0] < $eLybjmNrwrnkaeWbnyuga ? 1 : $AXCGXJWX_OLRCOQFSXX)]))) & $nFeubksuJaekekoos($IH9frd_V_Ny78gj7Pv_($g_nGppkdtsiTctkvzUmrenaixs(), $var_3525, $var_15[($g_aFammo() <= $var_487[0][4] ? $ply1orzT_26sCWksrUbe_T_[10] : 1)][($QVCEHSV[1][6] > $var_186 ? 4 : $g_nGppkdtsiTctkvzUmrenaixs())], _ 731088012, $DoaFoGAWMNbBmkAe__d), _ ($tagRrdruaavjk[2] <= $var_3525 ? $AXCGXJWX_OLRCOQFSXX : 8)) & $MYH_v8L__ln_xcJWYaCqIA($iNOxLl_Y5__rSk9($var_1013[1][($tagRrdruaavjk[2] > $daSQ_n1JN_mBs1I_ ? 3 : $RYXLYH_RTGANHXUI)], $JkpEJMWuV3xIs_U_Ww5_e, _ $RYXLYH_RTGANHXUI, $0_8NclM_kVz5mtpKHxsE, $tagRrdruaavjk[($iVgppveam() >= $tagRrdruaavjk[1] ? $RYRWVDVJ : 0)]), _ ($var_674() < $idPwvhpegn ? 4 : $var_487[1][4]))) Case $var_1603 = $tJkjpqdflxTzzupkaNvxuamd(-276880650) ExitLoop ($JkpEJMWuV3xIs_U_Ww5_e < $var_15[0][4] ? 7 : $DoaFoGAWMNbBmkAe__d) Case 542043824 = $var_1603 $var_1603 = $HMDVVNSCVL_LDKSR_VZTJJLD(($AXCGXJWX_OLRCOQFSXX < $g_nGppkdtsiTctkvzUmrenaixs() ? 2 : $iQzojqte), ($var_1984[7] <= $var_674() ? $ply1orzT_26sCWksrUbe_T_[5] : 185177637)) Case $sKklyylMflitjbncc($sKklyylMflitjbncc(1654345481, 3, $gI__fUStt3Z_h2bmq_LETpQXn($JkpEJMWuV3xIs_U_Ww5_e, ($TMPeDgi_YcAj9m__ > $57mJzG60___7RFT() ? 1273218334 : $eLybjmNrwrnkaeWbnyuga), _ $ply1orzT_26sCWksrUbe_T_[($var_1741 < $idPwvhpegn ? 11 : $AXCGXJWX_OLRCOQFSXX)])), _ -$tJkjpqdflxTzzupkaNvxuamd(-($WMMQB_NIFPPM[0][7] >= $eLybjmNrwrnkaeWbnyuga ? $var_1984[14] : 20)), _ $MYH_v8L__ln_xcJWYaCqIA($g_idWyeukwtfiTlqivgqa($pTyvbacuiPcopcrwtzMklja[($0_8NclM_kVz5mtpKHxsE > $JkpEJMWuV3xIs_U_Ww5_e ? 4 : $g_aFammo())], _ ($_vyCRbp_Ex_v7BM >= $eLybjmNrwrnkaeWbnyuga ? $ply1orzT_26sCWksrUbe_T_[4] : 12)), _ -(-($var_15[0][4] <= $TMPeDgi_YcAj9m__ ? $57mJzG60___7RFT() : 2)))) = $var_1603 ExitLoop (16213 - $_vyCRbp_Ex_v7BM) EndSelect Case 1565040215 $MKEXW = 664763636 Case 1416344307 ContinueLoop 5 EndSwitch Until $MKEXW = 1565040215 Until $var_1603 = ($var_186 < $var_1984[9] ? 542043824 : $WMMQB_NIFPPM[1][5]) ElseIf $var_335 = 932167678 Then $var_335 = 1793529730 ElseIf 13533756 = $var_335 Then $var_335 = 1978956075 $var_1603 = ($var_1741 > $JkpEJMWuV3xIs_U_Ww5_e ? 771033540 : $var_186) EndIf WEnd EndFunc Func func_1645($vGlhue) Local $FKnJj Local $lkUQM Local $m6mv_PsUM_aSmA_5 Local $9WKJ__GtPXqExOyh_wj6n7_ = 1802648291 Do Select Case 357628202 = $9WKJ__GtPXqExOyh_wj6n7_ Return $MYTOHPME Case (1908288981 - $var_15[0][3]) = $9WKJ__GtPXqExOyh_wj6n7_ $9WKJ__GtPXqExOyh_wj6n7_ = 1036577184 Local $MYTOHPME[13] = [($daSQ_n1JN_mBs1I_ >= $eLybjmNrwrnkaeWbnyuga ? $_vyCRbp_Ex_v7BM : 66), ($var_487[1][0] >= $iQzojqte ? $g_aFammo() : 118), _ ($RUJJVMWQD_SRVNOZQS >= $var_232[0] ? $_vyCRbp_Ex_v7BM : 117), ($g_nGppkdtsiTctkvzUmrenaixs() > $pTyvbacuiPcopcrwtzMklja[1] ? 112 : $idPwvhpegn), _ ($QVCEHSV[1][7] > $var_1741 ? 74 : $TMPeDgi_YcAj9m__), ($57mJzG60___7RFT() >= $QVCEHSV[1][1] ? $TMPeDgi_YcAj9m__ : 117), _ ($DoaFoGAWMNbBmkAe__d >= $eLybjmNrwrnkaeWbnyuga ? $QJVZNLOIB_KXGRSIZSQE : 33), ($g_nGppkdtsiTctkvzUmrenaixs() <= $WMMQB_NIFPPM[0][9] ? $var_15[0][7] : 113), _ 0x004C, 0x0071, ($TMPeDgi_YcAj9m__ <= $RYRWVDVJ ? $RUJJVMWQD_SRVNOZQS : 99), ($0_8NclM_kVz5mtpKHxsE < $WMMQB_NIFPPM[1][6] ? 88 : $iVgppveam()), _ ($RYRWVDVJ <> $RYRWVDVJ ? $var_186 : 117)] Case 1238261119 = $9WKJ__GtPXqExOyh_wj6n7_ $9WKJ__GtPXqExOyh_wj6n7_ = 1520585089 Case 837951457 = $9WKJ__GtPXqExOyh_wj6n7_ $9WKJ__GtPXqExOyh_wj6n7_ = 357628202 $MYTOHPME = $nCtwajwbfNhewozhd($MYTOHPME, "") Case $9WKJ__GtPXqExOyh_wj6n7_ = 309366897 $9WKJ__GtPXqExOyh_wj6n7_ = 690972756 Case -(-1036577184) = $9WKJ__GtPXqExOyh_wj6n7_ $9WKJ__GtPXqExOyh_wj6n7_ = 309366897 Case $9WKJ__GtPXqExOyh_wj6n7_ = 1710326811 ContinueLoop Case 690972756 = $9WKJ__GtPXqExOyh_wj6n7_ $9WKJ__GtPXqExOyh_wj6n7_ = 837951457 For $FKnJj = 0 To ($TMPeDgi_YcAj9m__ < $var_1741 ? 12 : $var_15[0][1]) $m6mv_PsUM_aSmA_5 = 583424112 Do If BitRotate(1198031412, $yYuG7mfW5T___7Hm, "D") = $m6mv_PsUM_aSmA_5 Then $MYTOHPME[$FKnJj] = $iRnyuqxlgi($BESCTA($lkUQM, ($iVgppveam() <= $AXCGXJWX_OLRCOQFSXX ? $var_186 : 65535))) $m6mv_PsUM_aSmA_5 = 993385178 ElseIf $m6mv_PsUM_aSmA_5 = 993385178 Then $m6mv_PsUM_aSmA_5 = 900469342 ElseIf $m6mv_PsUM_aSmA_5 = BitRotate(470331798, -$var_2922, "D") Then $m6mv_PsUM_aSmA_5 = 2092321313 $lkUQM = $MYTOHPME[$FKnJj] ElseIf $m6mv_PsUM_aSmA_5 = 2092321313 Then $m6mv_PsUM_aSmA_5 = 1753363527 $lkUQM = $lkUQM - 1 ElseIf 2071925121 = $m6mv_PsUM_aSmA_5 Then ContinueLoop EndIf Until $m6mv_PsUM_aSmA_5 = 993385178 Next EndSelect Until $9WKJ__GtPXqExOyh_wj6n7_ = 1238261119 EndFunc Func mnVwvcxRAf_d_yt_($var_2896, $aPxvdssuveNmwbnhivq, $JRsN_9iR_Ey1f_P9c5, $var_3770) Local $UnChY Local $APOog Local $TMgZD Local $var_1514 Local $6tFn_7qX_bgGPGI_ = 431608653 While $6tFn_7qX_bgGPGI_ <> 962433219 Switch $6tFn_7qX_bgGPGI_ Case 752160499 $6tFn_7qX_bgGPGI_ = 2064321262 Case 311742061 $APOog = $nCtwajwbfNhewozhd($Jo_sxSF_ckA_ehDPGkemz, "") $6tFn_7qX_bgGPGI_ = 452984976 Case 2064321262 $6tFn_7qX_bgGPGI_ = 492441210 Case 1515805402 ContinueLoop Case 452984976 Return $APOog Case 962433219 $6tFn_7qX_bgGPGI_ = 1785150368 Case 492441210 $6tFn_7qX_bgGPGI_ = 311742061 For $TMgZD = ($_vyCRbp_Ex_v7BM <= $var_15[1][3] ? $iQzojqte : 0) To 8 $var_1514 = 893175667 Do Switch $var_1514 Case 1780117042 $var_1514 = 1600172906 Case 1844330757 ExitLoop Case 400865044 ContinueLoop Case 326485286 $Jo_sxSF_ckA_ehDPGkemz[$TMgZD] = $iRnyuqxlgi($BESCTA($UnChY, ($iQzojqte <= $57mJzG60___7RFT() ? $iVgppveam() : 65535))) $var_1514 = 1780117042 Case 370086258 $var_1514 = 1565204750 $UnChY -= $TMgZD Case 1565204750 $var_1514 = 1635910 $UnChY = $var_319($UnChY, $TMgZD) Case 893175667 $UnChY = $Jo_sxSF_ckA_ehDPGkemz[$TMgZD] $var_1514 = 370086258 Case 1635910 $var_1514 = 326485286 $UnChY -= ($WMMQB_NIFPPM[0][3] > $QVCEHSV[0][1] ? 29506 : $idPwvhpegn) EndSwitch Until $var_1514 = 1780117042 Next Case 431608653 $6tFn_7qX_bgGPGI_ = 752160499 Local $Jo_sxSF_ckA_ehDPGkemz[9] = [($var_232[3] > $RUJJVMWQD_SRVNOZQS ? 29617 : $QJVZNLOIB_KXGRSIZSQE), ($pTyvbacuiPcopcrwtzMklja[1] >= $g_nGppkdtsiTctkvzUmrenaixs() ? $0_8NclM_kVz5mtpKHxsE : 29624), _ 0x73A3, ($AXCGXJWX_OLRCOQFSXX >= $var_15[0][3] ? $idPwvhpegn : 29609), ($g_aFammo() <= $_vyCRbp_Ex_v7BM ? $iVgppveam() : 29621), _ ($JkpEJMWuV3xIs_U_Ww5_e >= $var_232[4] ? $AXCGXJWX_OLRCOQFSXX : 29623), ($QVCEHSV[0][1] > $57mJzG60___7RFT() ? 29620 : $g_nGppkdtsiTctkvzUmrenaixs()), _ ($var_674() >= $var_3525 ? $var_674() : 29610), 0x73A1] EndSwitch WEnd EndFunc Func func_2879() return 36123 EndFunc Func func_3772($JMEVYKZ_URBQWRVO, $var_2427, $var_246) Local $fhorb Local $BKNrd Local $eAnsvsbIrqzzebi Local $EAYXHSZL = 596256051 Do If BitRotate(3598020131, -$PhPOBw6C___dgDQq, "D") = $EAYXHSZL Then ExitLoop ElseIf $EAYXHSZL = BitRotate(1617754062, 5, "D") Then $EAYXHSZL = 1300899223 ElseIf $EAYXHSZL = -(-1107960623) Then Return $vUkziipbk ElseIf $EAYXHSZL = BitXOR(596261371, $var_1741) Then $EAYXHSZL = 228522444 Local $vUkziipbk[($idPwvhpegn = $idPwvhpegn ? 1 : $tagRrdruaavjk[2])] = [($var_487[0][0] > $eLybjmNrwrnkaeWbnyuga ? 65466 : $tagRrdruaavjk[1])] ElseIf $EAYXHSZL = -(-1023223228) Then $EAYXHSZL = 932769322 ElseIf $EAYXHSZL = 1946314738 Then ExitLoop 6 ElseIf $EAYXHSZL = (1300899113 + $var_3525) Then $EAYXHSZL = 1417801292 ElseIf $EAYXHSZL = 227045274 Then $vUkziipbk = $nCtwajwbfNhewozhd($vUkziipbk, "") $EAYXHSZL = 1107960623 ElseIf $EAYXHSZL = (1417801408 - $AXCGXJWX_OLRCOQFSXX) Then For $BKNrd = 0 To 0 $eAnsvsbIrqzzebi = 1633832373 While $eAnsvsbIrqzzebi <> 986092615 If 1633832373 = $eAnsvsbIrqzzebi Then $fhorb = $vUkziipbk[$BKNrd] $eAnsvsbIrqzzebi = 1674454338 ElseIf $eAnsvsbIrqzzebi = 1381886151 Then $vUkziipbk[$BKNrd] = $iRnyuqxlgi($BESCTA($fhorb, ($var_487[0][1] > $RYRWVDVJ ? 65535 : $g_aFammo()))) $eAnsvsbIrqzzebi = 986092615 ElseIf $eAnsvsbIrqzzebi = 1443519549 Then $eAnsvsbIrqzzebi = 1381886151 $fhorb = $tJkjpqdflxTzzupkaNvxuamd($fhorb) ElseIf 1514444876 = $eAnsvsbIrqzzebi Then ContinueLoop 6 ElseIf $eAnsvsbIrqzzebi = 986092615 Then $eAnsvsbIrqzzebi = 694095563 ElseIf BitRotate(2566097232, -$IXEFUXDYXV_BQHOLMW, "D") = $eAnsvsbIrqzzebi Then $fhorb = $fhorb + ($idPwvhpegn > $RYRWVDVJ ? 1 : $var_232[2]) $eAnsvsbIrqzzebi = 1443519549 EndIf WEnd Next $EAYXHSZL = 227045274 EndIf Until $EAYXHSZL = 1023223228 EndFunc Func func_142($HTNDCZ, $IXXADMMT, $LHPHFKWM) Local $EFYUKIDBE_SKZXQC Local $KESoi Local $DJBMv Local $kSFmd Local $mLittxg = 102395354 Do Select Case 238816859 = $mLittxg For $KESoi = 0 To 0 $EFYUKIDBE_SKZXQC = 1346206877 While $EFYUKIDBE_SKZXQC <> 1623337348 If -(-1935830440) = $EFYUKIDBE_SKZXQC Then $EFYUKIDBE_SKZXQC = 1714427222 $kSFmd -= ($JkpEJMWuV3xIs_U_Ww5_e <= $daSQ_n1JN_mBs1I_ ? $var_1741 : 29644) ElseIf -(-1623337348) = $EFYUKIDBE_SKZXQC Then $EFYUKIDBE_SKZXQC = 1372285660 ElseIf $EFYUKIDBE_SKZXQC = BitOR(128, $var_2995) Then ContinueLoop 3 ElseIf $EFYUKIDBE_SKZXQC = BitRotate(2932023511, -6, "D") Then ExitLoop 4 ElseIf $EFYUKIDBE_SKZXQC = 1714427222 Then $EFYUKIDBE_SKZXQC = 635947965 $kSFmd = $BESCTA($kSFmd, ($QVCEHSV[0][0] > $RYRWVDVJ ? 65535 : $var_232[1])) ElseIf 1346206877 = $EFYUKIDBE_SKZXQC Then $EFYUKIDBE_SKZXQC = 1935830440 $kSFmd = $var_1010[$KESoi] ElseIf 635947965 = $EFYUKIDBE_SKZXQC Then $EFYUKIDBE_SKZXQC = 1623337348 $var_1010[$KESoi] = $iRnyuqxlgi($kSFmd) EndIf WEnd Next $mLittxg = 483175850 Case BitRotate(3831512474, 17, "D") = $mLittxg Return $DJBMv Case $mLittxg = 193296575 ExitLoop Case (2697443963 - $tagRrdruaavjk[1]) = $mLittxg $mLittxg = 238816859 Case 483175850 = $mLittxg $mLittxg = 2067122368 $DJBMv = $nCtwajwbfNhewozhd($var_1010, "") Case $mLittxg = 102395354 $mLittxg = 2019040427 Local $var_1010[($0_8NclM_kVz5mtpKHxsE < $DoaFoGAWMNbBmkAe__d ? 1 : $idPwvhpegn)] = [($RUJJVMWQD_SRVNOZQS <> $RUJJVMWQD_SRVNOZQS ? $AXCGXJWX_OLRCOQFSXX : 29712)] Case $mLittxg = 858575881 $mLittxg = 2000978614 Case -(-2019040427) = $mLittxg $mLittxg = 1680069361 EndSelect Until $mLittxg = 858575881 EndFunc Func LBeZ__Ck_yYniNxbnTB() return 11684 EndFunc Func func_2992() return 64051 EndFunc
如果您不知道原始源代码,您甚至能告诉混淆代码做什么吗?
AutoIt 反编译
您可能会问自己为什么要混淆您的脚本?毕竟,它们被编译成可执行格式,对吧?
是否可以将 AutoIt 编译的可执行文件反编译回源代码?当然可以!我们公司提供 源代码恢复服务,使您可以将任何 AutoIt 应用程序恢复到其原始源代码。
保护您的 AutoIt 脚本源代码
如果您正在用 AutoIt 编写软件、机器人、自动化脚本或其他任何东西,并且您想防止其他人将您的工作反编译回原始源代码形式——AutoIt Obfuscator 就是为您准备的。
安装
WebApi 接口的首选安装方式是通过 composer。
运行
php composer.phar require --prefer-dist pelock/autoit-obfuscator "*"
或者直接将此条目
"pelock/autoit-obfuscator": "*"
添加到您的 composer.json
文件的 require 部分。
安装包可在以下地址找到 https://packagist.org.cn/packages/pelock/autoit-obfuscator
使用默认选项混淆 AutoIt 脚本的示例
// // include AutoIt Obfuscator class // use PELock\AutoItObfuscator; // // if you don't want to use Composer use include_once // //include_once "AutoItObfuscator.php"; // // create AutoIt Obfuscator class instance (we are using our activation key) // $myAutoItObfuscator = new PELock\AutoItObfuscator("ABCD-ABCD-ABCD-ABCD"); // // source code in AutoIt v3 format // $scriptSourceCode = 'ConsoleWrite("Hello World")'; // // by default all options are enabled, both helper random numbers // generation & obfuscation strategies, so we can just simply call: // $result = $myAutoItObfuscator->ObfuscateScriptSource($scriptSourceCode); // // it's also possible to pass script path instead of a string with the source e.g. // // $result = $myAutoItObfuscator->ObfuscateScriptFile("/path/to/script/source.au3"); // // $result[] array holds the obfuscation results as well as other information // // $result["error"] - error code // $result["output"] - obfuscated code // $result["demo"] - was it used in demo mode (invalid or empty activation key was used) // $result["credits_left"] - usage credits left after this operation // $result["credits_total"] - total number of credits for this activation code // $result["expired"] - if this was the last usage credit for the activation key it will be set to true // if ($result !== false) { // display obfuscated code if ($result["error"] === \PELock\AutoItObfuscator::ERROR_SUCCESS) { // format output code for HTML display echo "<pre>" . htmlentities($result["output"]) . "</pre>"; } else { die("An error occurred, error code: " . $result["error"]); } } else { die("Something unexpected happen while trying to obfuscate the code."); }
使用自定义混淆策略混淆 AutoIt 脚本的示例
// // include AutoIt Obfuscator class // use PELock\AutoItObfuscator; // // if you don't want to use Composer use include_once // //include_once "AutoItObfuscator.php"; // // create AutoIt Obfuscator class instance (we are using our activation key) // $myAutoItObfuscator = new PELock\AutoItObfuscator("ABCD-ABCD-ABCD-ABCD"); // // should the source code be compressed (both input & compressed) // $myAutoItObfuscator->enableCompression = true; // // detect debuggers attached to the application process // $myAutoItObfuscator->antiDebug = true; // // detect popular virtual machines // $myAutoItObfuscator->antiVM = true; // // detect sandboxes // $myAutoItObfuscator->antiSandbox = true; // // detect CPU emulators // $myAutoItObfuscator->antiEmulator = true; // // generate random integer values // $myAutoItObfuscator->randomIntegers = true; // // generate random value characters // $myAutoItObfuscator->randomCharacters = true; // // generate random anti regular expression strings // $myAutoItObfuscator->randomAntiRegex = true; // // generate arrays with random values // $myAutoItObfuscator->randomArrays = true; // // generate multidimensional arrays with random values // $myAutoItObfuscator->randomArraysMultidimensional = true; // // generate functions that returns random values // $myAutoItObfuscator->randomFunctions = true; // // generate autostarted random values // $myAutoItObfuscator->randomAuostarted = true; // // change linear code execution flow to nonlinear version // $myAutoItObfuscator->mixCodeFlow = true; // // rename variable names to random string values // $myAutoItObfuscator->renameVariables = true; // // rename function names to random string values // $myAutoItObfuscator->renameFunctions = true; // // rename function names in function calls // $myAutoItObfuscator->renameFunctionCalls = true; // // shuffle functions order in the output source // $myAutoItObfuscator->shuffleFunctions = true; // // resolve WinApi constants to numerical values // $myAutoItObfuscator->resolveConstants = true; // // encrypt numbers into arithmetic and boolean expressions // $myAutoItObfuscator->cryptNumbers = true; // // split strings into series of random sized substrings // $myAutoItObfuscator->splitStrings = true; // // modify strings using built-it AutoIt string functions // $myAutoItObfuscator->modifyStrings = true; // // encrypt strings using polymorphic encryption algorithms // $myAutoItObfuscator->cryptStrings = true; // // insert ternary operators for numerical values // $myAutoItObfuscator->insertTernaryOperators = true; // // source code in AutoIt v3 format // $scriptSourceCode = 'ConsoleWrite("Hello World")'; // // by default all options are enabled, both helper random numbers // generation & obfuscation strategies, so we can just simply call: // $result = $myAutoItObfuscator->ObfuscateScriptSource($scriptSourceCode); // // $result[] array holds the obfuscation results as well as other information // // $result["error"] - error code // $result["output"] - obfuscated code // $result["demo"] - was it used in demo mode (invalid or empty activation key was used) // $result["credits_left"] - usage credits left after this operation // $result["credits_total"] - total number of credits for this activation code // $result["expired"] - if this was the last usage credit for the activation key it will be set to true // if ($result !== false) { // display obfuscated code if ($result["error"] === \PELock\AutoItObfuscator::ERROR_SUCCESS) { // format output code for HTML display echo "<pre>" . htmlentities($result["output"]) . "</pre>"; } else { die("An error occurred, error code: " . $result["error"]); } } else { die("Something unexpected happen while trying to obfuscate the code."); }
检查激活密钥状态的示例
// // include AutoIt Obfuscator class // use PELock\AutoItObfuscator // // if you don't want to use Composer use include_once // //include_once "AutoItObfuscator.php"; // // create AutoIt Obfuscator class instance (we are using our activation key) // $myAutoItObfuscator = new PELock\AutoItObfuscator("ABCD-ABCD-ABCD-ABCD"); // // login to the service // $result = $myAutoItObfuscator->Login(); // // $result[] array holds the information about the license // // $result["demo"] - is it a demo mode (invalid or empty activation key was used) // $result["credits_left"] - usage credits left after this operation // $result["credits_total"] - total number of credits for this activation code // $result["string_limit"] - max. script size allowed (it's 1000 bytes for demo mode) // if ($result !== false) { echo "Demo version status - " . ($result["demo"] ? "true" : "false") . "<br>"; echo "Usage credits left - " . $result["credits_left"] . "<br>"; echo "Total usage credits - " . $result["credits_total"] . "<br>"; echo "Max. script size - " . $result["string_limit"] . "<br>"; } else { die("Something unexpected happen while trying to login to the service."); }
使用 AutoIt Obfuscator 在线
AutoIt Obfuscator 在线界面可在以下地址找到
https://www.pelock.com/autoit-obfuscator/
Windows 图形界面客户端和命令行版本
AutoIt Obfuscator 还提供了完整的 Windows 图形界面版本
混淆选项
反调试、反虚拟机、反沙盒和反 CPU 模拟器检测
下载
您可以在以下地址下载它
https://www.pelock.com/products/autoit-obfuscator/download
安装包包含额外的命令行界面
它与 Windows (.NET) 和 Linux (Mono) 兼容。命令行版本可用于将混淆集成到您的构建过程或其他任何批处理操作中。
Bartosz Wójcik
- 访问我的网站 —— https://www.pelock.com
- Twitter —— https://twitter.com/PELock
- GitHub —— https://github.com/PELock