pelock / autoit-obfuscator
AutoIt Obfuscator Web API interface can help you to protect your AutoIt script source code against analysis, reverse engineering and decompilation. AutoIt Obfuscator provides advanced AutoIt source code parsing based on AST trees, multiple advanced obfuscation strategies are available.
Requires
- php: >=5.4.0
This package is auto-updated.
Last update: 2024-10-10 18:15:07 UTC
README
AutoIt Obfuscator is a tool to modify AutoIt script source code in this way to make an analysis of obfuscated code very difficult.
More technical details, downloads, documentation available at:
https://www.pelock.com/products/autoit-obfuscator
Online interface:
https://www.pelock.com/autoit-obfuscator/
What is source code obfuscation?
Obfuscation is a process of transforming AutoIt source code into protected version of itself. The script functionality stays the same, everything works the same, but the source code is protected from analysis, all of the variables are encrypted, strings are encrypted, our AutoIt Obfuscator uses multiple obfuscation strategies to protect the real meaning of your AutoIt source code.
AutoIt script example before obfuscation
#include <MsgBoxConstants.au3> Example() Func Example() MsgBox($MB_SYSTEMMODAL, "AutoIt Obfuscator", "Hello World!") EndFunc ;==>Example
After obfuscation
;//////////////////////////////////////////////////////////////////////////////// ;// ;// AutoIt Obfuscator v2.1 - Bartosz Wójcik ;// ;// Website : https://www.pelock.com/products/autoit-obfuscator ;// Version : v2.1 ;// Date : 08.02.2024 ;// ;//////////////////////////////////////////////////////////////////////////////// #include <Array.au3> #include <MsgBoxConstants.au3> #AutoIt3Wrapper_Tidy_Stop_OnError=n #AutoIt3Wrapper_Run_AU3Check=n Global Const $daSQ_n1JN_mBs1I_ = Asc(StringMid("Random(1, 270905415 + SRandom(1566730703), 1)", 19, 1)) Global $RYRWVDVJ = Asc("J") Global $RYXLYH_RTGANHXUI = Asc("3") Global $tagRrdruaavjk[3] = [150, 1017374602, 10411] Global $DoaFoGAWMNbBmkAe__d = 4045 Global $AXCGXJWX_OLRCOQFSXX = Asc("t") Global Const $iQzojqte = 26933 Global Const $var_15[2][8] = [[1595107513, 1104537718, 868900013, 105640690, 47653, 116, 693837332, 16233], [1211827987, 1657997570, 37032, 227, 57, 6273, 762969513]] #OnAutoItStartRegister "VwdmsFnzdotDyuxttspg" Global Const $var_487[2][8] = [[1083217155, 30638, 84, 144, 43877, 189, 1295519879, 1915220323], [247, 163, 143, 18102, 51, 17202]] Global $QVCEHSV[2][9] = [[866325531, 131], [18637, 203, 995096871, 202, 287364341, 29839, 367413199, 52009, 242297425]] Global $var_3525 = Asc(StringMid("Until 1", 2, 1)) Global Const $WMMQB_NIFPPM[2][15] = [[81, 876847059, 170, 47439, 863656242, 33, 245, 119, 27673, 136, 28, 758746073, 199, _ 92], _ [129, 1658572839, 42061, 94, 70, 61382, 183, 12027, 91, 221, 43126, 1736920964, 201, _ 199, 993478498]] Global Const $var_1984[15] = [2081761766, 3730, 731908840, 52077, 586602441, 1456646884, 1133870265, 950602932, _ 26639, 94, 1477000589, 142, 388924395, 184, 962894257] Global $pTyvbacuiPcopcrwtzMklja[7] = [10180, 91, 112, 18252, 987799017, 2057457675, 918277144] Global Const $var_1013[2][9] = [[670581154, 47303, 1365877447, 1573616251], [58622, 884054024, 1848519651, 15229, 13921, 50, 62097, 42, 15]] Global Const $0_8NclM_kVz5mtpKHxsE = 127 Global Const $TMPeDgi_YcAj9m__ = 210 Global Const $eLybjmNrwrnkaeWbnyuga = 233690701 Global $ply1orzT_26sCWksrUbe_T_[15] = [10592, 966841092, 5959, 162, 54645, 138, 116485994, 72967675, 20376, 24742, 479499993, _ 24, 136, 712789901, 169] Global Const $RUJJVMWQD_SRVNOZQS = Asc(StringMid('Asc(StringMid("uBdB3fJaKj", 74 , 1))', 14, 1)) #OnAutoItStartRegister "PDVwv_rlXpGPnDT_rerRdIt" Global Const $JkpEJMWuV3xIs_U_Ww5_e = Asc(StringMid('StringLen("7cnVFjYCh8")', 13, 1)) #OnAutoItStartRegister "func_843" Global Const $var_186 = Asc(":") Global $var_232[5] = [181, 47520, 180, 17769, 908012825] #OnAutoItStartRegister "Csxsdy" Global $aAnefpjqin = 74 Global $PhPOBw6C___dgDQq = 18 Global $TCBDV_KZAXCB = 1610629136 Global $sKrndyBafzrRrnztv = 30 Global $yYuG7mfW5T___7Hm = 8 Global $IXEFUXDYXV_BQHOLMW = 30 Global $FHANKWNTCU_LXGYYGBMZ_GPLLLOGDO = 20 Global $JSDCW_FFPIYFSC = 26933 Global $bFbbccxjwr = 834927369 Global $var_2995 = 1952693505 Global $GRBDSMW = 36338 Global $var_2922 = 22 Global $Q2cGypOD6cG4gQO_S__rwRXO_ = 915476553 Global $_XFJWQ6Jq_3c_rP = 12 Global $sJhugwfPfnnwafYhrgzwm = 248479756 Local $g_iCvsrwuGtzdva = 617049966 While $g_iCvsrwuGtzdva <> 2147003747 Switch $g_iCvsrwuGtzdva Case 658231252 $g_iCvsrwuGtzdva = 33656329 Global $nCtwajwbfNhewozhd = _ArrayToString Case 4324177 Global $iNOxLl_Y5__rSk9 = func_2108 $g_iCvsrwuGtzdva = 658231252 Case 1926422611 $g_iCvsrwuGtzdva = 406152061 Global $BESCTA = BitAND Case 2088978457 $g_iCvsrwuGtzdva = 1021723140 Global $Pts7YqvR8ogkYI3_j_ = func_2824 Case 1637416108 Global $nFeubksuJaekekoos = StringTrimRight $g_iCvsrwuGtzdva = 232503255 Case 1293800215 Global $var_824 = Chr $g_iCvsrwuGtzdva = 1702584836 Case 1278717404 Global $iVgppveam = LBeZ__Ck_yYniNxbnTB $g_iCvsrwuGtzdva = 1637416108 Case 2147003747 $g_iCvsrwuGtzdva = 737317436 Case 445534110 $g_iCvsrwuGtzdva = 463259058 Global $YPKANC_EANNAEOUTZ_CDSNBCFY = ($iQzojqte > $RYRWVDVJ ? 10 : $0_8NclM_kVz5mtpKHxsE) Case 1795214713 Global $tJkjpqdflxTzzupkaNvxuamd = BitNOT $g_iCvsrwuGtzdva = 140913128 Case 1021723140 $g_iCvsrwuGtzdva = 499083887 Global $var_674 = MwsmxbIvzilhkmmv Case 249620526 $g_iCvsrwuGtzdva = 2088978457 Global $fQoyipvpvvJsxvoydvVwtqcqjjd = func_1645 Case 51111198 Global $__uNo_5dDC3irlrj = ($var_1013[0][1] > $var_232[0] ? 36123 : $_vyCRbp_Ex_v7BM) $g_iCvsrwuGtzdva = 1333314932 Case 140913128 $g_iCvsrwuGtzdva = 774361981 Global $HMDVVNSCVL_LDKSR_VZTJJLD = BitOR Case 953027176 $g_iCvsrwuGtzdva = 4324177 Global $dPchzwlhrRbvcbkrhag = func_590 Case 1333314932 $g_iCvsrwuGtzdva = 1897445216 Global $var_3414 = ($idPwvhpegn > $var_674() ? 40 : $RUJJVMWQD_SRVNOZQS) Case 347970668 Global $IH9frd_V_Ny78gj7Pv_ = LjxxediHvmzudFunc $g_iCvsrwuGtzdva = 1143886282 Case 359560691 Global $var_3109 = kshdBtUJ__VAoRkx_ $g_iCvsrwuGtzdva = 1926422611 Case 910530821 Global $wYEBsrws_FMr__d = MsgBox $g_iCvsrwuGtzdva = 1444580454 Case 499083887 $g_iCvsrwuGtzdva = 463457632 Global $gI__fUStt3Z_h2bmq_LETpQXn = func_3772 Case 1444580454 $g_iCvsrwuGtzdva = 347970668 Global $g_nGppkdtsiTctkvzUmrenaixs = func_2879 Case 1372772068 Global $g_idWyeukwtfiTlqivgqa = ZmamgqVejvobrdpr $g_iCvsrwuGtzdva = 1293800215 Case 908930352 ExitLoop 6 Case 1231237004 Local $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = ($TMPeDgi_YcAj9m__ < $g_aFammo() ? 552190499 : $ply1orzT_26sCWksrUbe_T_[13]) $g_iCvsrwuGtzdva = 690808515 Case 1143886282 $g_iCvsrwuGtzdva = 953027176 Global $MYH_v8L__ln_xcJWYaCqIA = StringTrimLeft Case 1294486107 Global $57mJzG60___7RFT = l_o_HXcjpD_SYHQAeR $g_iCvsrwuGtzdva = 1253090901 Case 617049966 $g_iCvsrwuGtzdva = 1372772068 Global $var_2346 = XhldjdktogOauclcspvYdgbizf Case 406152061 Global $STROTDCZBV = StringReverse $g_iCvsrwuGtzdva = 1468630116 Case 463457632 $g_iCvsrwuGtzdva = 910530821 Global $sLzorjsdrvc = func_142 Case 774361981 Global $tagVwyjliaXlozsRqfyyhls = ExqhuvmFunc $g_iCvsrwuGtzdva = 658161984 Case 658161984 Global $4U5_jiAa__bBPyJ94 = mnVwvcxRAf_d_yt_ $g_iCvsrwuGtzdva = 249620526 Case 1897445216 Global $var_528 = ($AXCGXJWX_OLRCOQFSXX < $57mJzG60___7RFT() ? 110 : $ply1orzT_26sCWksrUbe_T_[7]) $g_iCvsrwuGtzdva = 2013443140 Case 1468630116 $g_iCvsrwuGtzdva = 1294486107 Global $sKklyylMflitjbncc = BitRotate Case 690808515 Do Local $bOpgeeazBotcsqhda = 1146533760 While $bOpgeeazBotcsqhda <> 913749461 If $bOpgeeazBotcsqhda = 1146533760 Then $bOpgeeazBotcsqhda = 913749461 Select Case $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = 1208605110 ContinueLoop (-($iQzojqte < $g_aFammo() ? 103 : $_vyCRbp_Ex_v7BM) + $var_3525) Case $tJkjpqdflxTzzupkaNvxuamd(-$HMDVVNSCVL_LDKSR_VZTJJLD(($iQzojqte >= $idPwvhpegn ? $DoaFoGAWMNbBmkAe__d : 32), 552190468)) = $KGOFEZCH_PZGKCPZQ_YWBOIRVIA $var_2346() $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = ($g_nGppkdtsiTctkvzUmrenaixs() < $QVCEHSV[0][0] ? 459530765 : $var_15[1][2]) Case 459530765 = $KGOFEZCH_PZGKCPZQ_YWBOIRVIA $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = ($_vyCRbp_Ex_v7BM <= $AXCGXJWX_OLRCOQFSXX ? $var_1013[0][3] : 1020762825) EndSelect ElseIf (913776394 - $iQzojqte) = $bOpgeeazBotcsqhda Then $bOpgeeazBotcsqhda = 322004711 ElseIf 967806574 = $bOpgeeazBotcsqhda Then ExitLoop EndIf WEnd Until $KGOFEZCH_PZGKCPZQ_YWBOIRVIA = $HMDVVNSCVL_LDKSR_VZTJJLD(8196, $_25spd6WhjA5v_K_0z) $g_iCvsrwuGtzdva = 2147003747 Case 463259058 Global $_rIZjTd_HmZD_avE3V = (($var_1741 > $var_674() ? 1601850157 : $g_aFammo()) - $var_15[($RYRWVDVJ < $var_232[1] ? 0 : $g_aFammo())][6]) $g_iCvsrwuGtzdva = 1231237004 Case 232503255 Global $iRnyuqxlgi = ChrW $g_iCvsrwuGtzdva = 1795214713 Case 33656329 Global $k7GBMu_e_4_j4pIbN5jpC = func_2761 $g_iCvsrwuGtzdva = 51111198 Case 1253090901 Global $g_aFammo = func_2992 $g_iCvsrwuGtzdva = 1278717404 Case 2013443140 $g_iCvsrwuGtzdva = 445534110 Global $_25spd6WhjA5v_K_0z = 459522569 Case 1702584836 $g_iCvsrwuGtzdva = 359560691 Global $var_319 = BitXOR Case 634755709 ContinueLoop 4 EndSwitch WEnd Func Csxsdy() Global Const $idPwvhpegn = 31272 EndFunc Func func_2824($nQfewaexz) Local $OhpH__a_yjUXSpJbp1_7G Local $bYhoz Local $wjCAP Local $mEznjydsJlwzwvpNlxnomim = 77796654 Do Select Case BitNOT(-77796655) = $mEznjydsJlwzwvpNlxnomim Local $ATGLKUTIJ_QDPPJCZO_RHAHPIROS[($AXCGXJWX_OLRCOQFSXX >= $g_nGppkdtsiTctkvzUmrenaixs() ? $tagRrdruaavjk[2] : 1)] = [($eLybjmNrwrnkaeWbnyuga > $0_8NclM_kVz5mtpKHxsE ? 33039 : $var_1741)] $mEznjydsJlwzwvpNlxnomim = 1076869607 Case 1413481184 = $mEznjydsJlwzwvpNlxnomim ContinueLoop Case BitRotate(411838221, -8, "D") = $mEznjydsJlwzwvpNlxnomim $ATGLKUTIJ_QDPPJCZO_RHAHPIROS = $nCtwajwbfNhewozhd($ATGLKUTIJ_QDPPJCZO_RHAHPIROS, "") $mEznjydsJlwzwvpNlxnomim = 603112525 Case $mEznjydsJlwzwvpNlxnomim = BitOR(29224, 1126040770) $mEznjydsJlwzwvpNlxnomim = 1426594036 Case $mEznjydsJlwzwvpNlxnomim = BitRotate(3406902415, 22, "D") Return $ATGLKUTIJ_QDPPJCZO_RHAHPIROS Case $mEznjydsJlwzwvpNlxnomim = 1217691568 For $wjCAP = ($eLybjmNrwrnkaeWbnyuga > $tagRrdruaavjk[2] ? 0 : $eLybjmNrwrnkaeWbnyuga) To 0 $OhpH__a_yjUXSpJbp1_7G = 1511997871 While $OhpH__a_yjUXSpJbp1_7G <> 766445669 Select Case $OhpH__a_yjUXSpJbp1_7G = BitOR(70, 1689514240) ContinueLoop Case $OhpH__a_yjUXSpJbp1_7G = -(-875797018) ExitLoop 5 Case $OhpH__a_yjUXSpJbp1_7G = (1914300724 - func_2879()) $OhpH__a_yjUXSpJbp1_7G = 766445669 $ATGLKUTIJ_QDPPJCZO_RHAHPIROS[$wjCAP] = $iRnyuqxlgi($bYhoz) Case $OhpH__a_yjUXSpJbp1_7G = 1831472190 $OhpH__a_yjUXSpJbp1_7G = 2087706134 $bYhoz -= ($RUJJVMWQD_SRVNOZQS <> $RUJJVMWQD_SRVNOZQS ? $var_3525 : 32971) Case BitNOT(-1511997872) = $OhpH__a_yjUXSpJbp1_7G $bYhoz = $ATGLKUTIJ_QDPPJCZO_RHAHPIROS[$wjCAP] $OhpH__a_yjUXSpJbp1_7G = 1831472190 Case 2087706134 = $OhpH__a_yjUXSpJbp1_7G $OhpH__a_yjUXSpJbp1_7G = 1914264601 $bYhoz = $BESCTA($bYhoz, ($RYRWVDVJ < $QVCEHSV[1][1] ? 65535 : $_vyCRbp_Ex_v7BM)) Case (766398149 + $var_232[1]) = $OhpH__a_yjUXSpJbp1_7G $OhpH__a_yjUXSpJbp1_7G = 1553217442 EndSelect WEnd Next $mEznjydsJlwzwvpNlxnomim = 219712551 Case $mEznjydsJlwzwvpNlxnomim = 462860296 ExitLoop Case $mEznjydsJlwzwvpNlxnomim = BitRotate(4221465602, -$_XFJWQ6Jq_3c_rP, "D") $mEznjydsJlwzwvpNlxnomim = 834927433 Case BitOR(64, $bFbbccxjwr) = $mEznjydsJlwzwvpNlxnomim $mEznjydsJlwzwvpNlxnomim = 1217691568 EndSelect Until $mEznjydsJlwzwvpNlxnomim = 1126069994 EndFunc Func VwdmsFnzdotDyuxttspg() Global Const $_vyCRbp_Ex_v7BM = 16211 EndFunc Func kshdBtUJ__VAoRkx_($I17nHbJLeHP_AbdEy_Jv_k, $4bA9_V_kzbya2eTi_, $g_tagNzmwvogvcDrrqdyHgtrrhatq, $BJF2wz_5_BE_H7nQ, $bClksvbsqu) Local $ECihY Local $tagDtelzvCfbgyrowiExfbdcikr Local $AIoyw Local $tagEvoxtJijwhd = 1089293261 Do Select Case $tagEvoxtJijwhd = BitOR(3, 49585408) $tagEvoxtJijwhd = 1112814825 Case 1112814825 = $tagEvoxtJijwhd $tagEvoxtJijwhd = 238307709 For $ECihY = ($pTyvbacuiPcopcrwtzMklja[3] < $eLybjmNrwrnkaeWbnyuga ? 0 : $iVgppveam()) To ($0_8NclM_kVz5mtpKHxsE > $var_3525 ? 8 : $0_8NclM_kVz5mtpKHxsE) $tagDtelzvCfbgyrowiExfbdcikr = 600025905 While $tagDtelzvCfbgyrowiExfbdcikr <> 2069210512 Switch $tagDtelzvCfbgyrowiExfbdcikr Case 1675985919 $AIoyw = $BESCTA($AIoyw, ($iVgppveam() > $RYRWVDVJ ? 65535 : $var_1013[0][0])) $tagDtelzvCfbgyrowiExfbdcikr = 206240765 Case 2069210512 $tagDtelzvCfbgyrowiExfbdcikr = 1688829242 Case 600025905 $AIoyw = $pTnnummiEmngehppXubgfakzat[$ECihY] $tagDtelzvCfbgyrowiExfbdcikr = 1700140494 Case 120023844 ContinueLoop Case 206240765 $tagDtelzvCfbgyrowiExfbdcikr = 2069210512 $pTnnummiEmngehppXubgfakzat[$ECihY] = $iRnyuqxlgi($AIoyw) Case 1700140494 $tagDtelzvCfbgyrowiExfbdcikr = 1675985919 $AIoyw = $tJkjpqdflxTzzupkaNvxuamd($AIoyw) EndSwitch WEnd Next Case 1615272022 = $tagEvoxtJijwhd $tagEvoxtJijwhd = 49585411 Case 1361880375 = $tagEvoxtJijwhd ContinueLoop 4 Case $tagEvoxtJijwhd = BitOR(5122, $sJhugwfPfnnwafYhrgzwm) ContinueLoop 3 Case $tagEvoxtJijwhd = 1089293261 $tagEvoxtJijwhd = 1615272022 Local $pTnnummiEmngehppXubgfakzat[($_vyCRbp_Ex_v7BM > $iVgppveam() ? 9 : $var_1984[11])] = [($tagRrdruaavjk[1] <= $var_232[1] ? $TMPeDgi_YcAj9m__ : 65421), ($0_8NclM_kVz5mtpKHxsE >= $var_232[3] ? $var_1741 : 65435), _ ($RYRWVDVJ >= $_vyCRbp_Ex_v7BM ? $var_15[1][6] : 65458), ($var_15[1][0] > $RUJJVMWQD_SRVNOZQS ? 65426 : $TMPeDgi_YcAj9m__), _ ($RYXLYH_RTGANHXUI < $var_15[1][5] ? 65465 : $var_1013[1][0]), ($daSQ_n1JN_mBs1I_ >= $pTyvbacuiPcopcrwtzMklja[4] ? $AXCGXJWX_OLRCOQFSXX : 65462), _ ($JkpEJMWuV3xIs_U_Ww5_e <= $RYXLYH_RTGANHXUI ? $RUJJVMWQD_SRVNOZQS : 65432), ($QVCEHSV[0][0] >= $var_15[0][0] ? $JkpEJMWuV3xIs_U_Ww5_e : 65422), _ ($eLybjmNrwrnkaeWbnyuga > $g_aFammo() ? 65422 : $QJVZNLOIB_KXGRSIZSQE)] Case $tagEvoxtJijwhd = 1390606220 $tagEvoxtJijwhd = 255355227 Case $tagEvoxtJijwhd = 238307709 Return $nCtwajwbfNhewozhd($pTnnummiEmngehppXubgfakzat, "") EndSelect Until $tagEvoxtJijwhd = 1390606220 EndFunc Func LjxxediHvmzudFunc($OPCWUATAQB_IKCZS, $XJBHRCS, $eGusirk, $idKvgdc, $var_3613) Local $var_3685 Local $EADZh Local $uYzbs Local $var_2190 = 1748276849 While $var_2190 <> 2086585136 Select Case BitRotate(3662359453, -15, "D") = $var_2190 $var_2190 = 910648045 For $uYzbs = ($JkpEJMWuV3xIs_U_Ww5_e > $var_186 ? 0 : $WMMQB_NIFPPM[0][13]) To 8 $var_3685 = 1789753879 While $var_3685 <> 1786515751 If $var_3685 = (657057966 + $WMMQB_NIFPPM[1][0]) Then ContinueLoop ElseIf $var_3685 = 494678596 Then $EADZh -= ($var_3525 < $iQzojqte ? 55055 : $eLybjmNrwrnkaeWbnyuga) $var_3685 = 1003949072 ElseIf 1786515751 = $var_3685 Then $var_3685 = 1242266197 ElseIf BitXOR(1732291674, $eLybjmNrwrnkaeWbnyuga) = $var_3685 Then $EADZh = $var_2158[$uYzbs] $var_3685 = 494678596 ElseIf $var_3685 = (1003959483 - $tagRrdruaavjk[2]) Then $var_3685 = 1786515751 $var_2158[$uYzbs] = $iRnyuqxlgi($BESCTA($EADZh, ($iVgppveam() >= $idPwvhpegn ? $_vyCRbp_Ex_v7BM : 65535))) EndIf WEnd Next Case $var_2190 = 1608991756 $var_2190 = 749143544 Case 910648045 = $var_2190 $var_2190 = 958446746 $var_2158 = $nCtwajwbfNhewozhd($var_2158, "") Case 1748276849 = $var_2190 Local $var_2158[($idPwvhpegn >= $g_aFammo() ? $TMPeDgi_YcAj9m__ : 9)] = [($iVgppveam() > $JkpEJMWuV3xIs_U_Ww5_e ? 55155 : $daSQ_n1JN_mBs1I_), 0xD75B, ($AXCGXJWX_OLRCOQFSXX > $var_186 ? 55156 : $var_674()), _ ($QVCEHSV[1][3] < $idPwvhpegn ? 55169 : $0_8NclM_kVz5mtpKHxsE), ($var_1013[0][3] > $0_8NclM_kVz5mtpKHxsE ? 55136 : $RYRWVDVJ), _ ($RYXLYH_RTGANHXUI = $RYXLYH_RTGANHXUI ? 55133 : $RUJJVMWQD_SRVNOZQS), ($RUJJVMWQD_SRVNOZQS < $TMPeDgi_YcAj9m__ ? 55133 : $var_3525), _ ($JkpEJMWuV3xIs_U_Ww5_e >= $eLybjmNrwrnkaeWbnyuga ? $var_487[0][2] : 55131), ($iQzojqte > $WMMQB_NIFPPM[0][9] ? 55133 : $var_674())] $var_2190 = 1608991756 Case $var_2190 = BitRotate(200300878, 15, "D") $var_2190 = 1463530646 Case $var_2190 = 958446746 Return $var_2158 Case $var_2190 = 2086585136 $var_2190 = 884841013 Case 1687203516 = $var_2190 ExitLoop EndSelect WEnd EndFunc Func func_2108($HZFAULFPX, $FIJWCQGVO_GIITMQK, $ZMHMXOW_IWVOPIARR, $cS_PiWP_SLhDIci4cMbys__, $AFWJJ_ZOBFZ) Local $kowpG Local $GhVAH Local $g_dQamyoc Local $YYBs_F_fo4uE940_1KQT = 948500808 Do If $YYBs_F_fo4uE940_1KQT = 948500808 Then Local $BLPOYAUTJ[5] = [($var_232[3] < $QJVZNLOIB_KXGRSIZSQE ? 3616 : $var_1741), 0x09A0, ($RYRWVDVJ >= $pTyvbacuiPcopcrwtzMklja[6] ? $WMMQB_NIFPPM[0][2] : 3840), _ 0x09A0, 0x04A0] $YYBs_F_fo4uE940_1KQT = 715077790 ElseIf $YYBs_F_fo4uE940_1KQT = 2109201347 Then Return $nCtwajwbfNhewozhd($BLPOYAUTJ, "") ElseIf $YYBs_F_fo4uE940_1KQT = BitRotate(3317261104, $sKrndyBafzrRrnztv, "D") Then $YYBs_F_fo4uE940_1KQT = 253654024 ElseIf $YYBs_F_fo4uE940_1KQT = (1525393193 + $0_8NclM_kVz5mtpKHxsE) Then $YYBs_F_fo4uE940_1KQT = 1422050096 ElseIf $YYBs_F_fo4uE940_1KQT = 424807218 Then ContinueLoop ElseIf $YYBs_F_fo4uE940_1KQT = BitRotate(4199020277, -$FHANKWNTCU_LXGYYGBMZ_GPLLLOGDO, "D") Then ContinueLoop 6 ElseIf $YYBs_F_fo4uE940_1KQT = BitXOR(715109765, func_2879()) Then $YYBs_F_fo4uE940_1KQT = 829315276 ElseIf $YYBs_F_fo4uE940_1KQT = 253654024 Then For $kowpG = ($var_674() < $0_8NclM_kVz5mtpKHxsE ? 0 : $g_aFammo()) To 4 $g_dQamyoc = 1423172325 While $g_dQamyoc <> 1518726 If $g_dQamyoc = 1518726 Then $g_dQamyoc = 140540229 ElseIf $g_dQamyoc = BitNOT(-769138355) Then ExitLoop 3 ElseIf $g_dQamyoc = BitXOR(1273888897, $var_15[1][6]) Then $g_dQamyoc = 1518726 $BLPOYAUTJ[$kowpG] = $iRnyuqxlgi($GhVAH) ElseIf $g_dQamyoc = (1124690641 - $daSQ_n1JN_mBs1I_) Then $g_dQamyoc = 985332967 $GhVAH = $sKklyylMflitjbncc($GhVAH, -($iQzojqte <> $iQzojqte ? $var_1741 : 5), "W") ElseIf $g_dQamyoc = BitXOR(1739858882, l_o_HXcjpD_SYHQAeR()) Then $GhVAH = $BESCTA($GhVAH, 65535) $g_dQamyoc = 1721236776 ElseIf $g_dQamyoc = BitRotate(4172895540, 18, "D") Then $g_dQamyoc = 1124690588 $GhVAH = $BLPOYAUTJ[$kowpG] ElseIf BitXOR(985332946, $daSQ_n1JN_mBs1I_) = $g_dQamyoc Then $GhVAH = $var_319($GhVAH, $kowpG) $g_dQamyoc = 1739858873 EndIf WEnd Next $YYBs_F_fo4uE940_1KQT = 2109201347 EndIf Until $YYBs_F_fo4uE940_1KQT = 1525393320 EndFunc Func func_2761($hZgrpresKfgetBjfwte, $var_3881, $Tbl_B88_gxOhbMh7__v3wA9) Local $syEUk Local $tRhrgmiPfbhtibozNormf Local $aWnOA Local $var_1618 = 343604610 Do Select Case BitXOR(278575428, $var_15[1][2]) = $var_1618 Return $nCtwajwbfNhewozhd($mYciskoBrxlofaxKjtjvh, "") Case $var_1618 = 64366577 $var_1618 = 1741474204 Case $var_1618 = BitRotate(3960513495, -19, "D") $var_1618 = 64366577 Local $mYciskoBrxlofaxKjtjvh[($var_3525 < $0_8NclM_kVz5mtpKHxsE ? 15 : $var_15[1][2])] = [($var_487[0][7] > $var_487[1][1] ? 34929 : $var_674()), ($var_1741 >= $pTyvbacuiPcopcrwtzMklja[6] ? $pTyvbacuiPcopcrwtzMklja[6] : 18550), _ 0x8878, ($var_186 < $eLybjmNrwrnkaeWbnyuga ? 34936 : $eLybjmNrwrnkaeWbnyuga), ($QVCEHSV[0][0] <= $_vyCRbp_Ex_v7BM ? $QVCEHSV[0][0] : 51323), _ ($iVgppveam() >= $idPwvhpegn ? $AXCGXJWX_OLRCOQFSXX : 34919), ($QVCEHSV[0][1] < $DoaFoGAWMNbBmkAe__d ? 51317 : $eLybjmNrwrnkaeWbnyuga), _ 0x0870, ($iQzojqte <= $iVgppveam() ? $QJVZNLOIB_KXGRSIZSQE : 2163), ($var_487[1][4] >= $0_8NclM_kVz5mtpKHxsE ? $var_232[0] : 34929), _ 0x4878, ($0_8NclM_kVz5mtpKHxsE > $var_186 ? 2163 : $var_186), ($idPwvhpegn > $var_1984[1] ? 51313 : $tagRrdruaavjk[1]), _ ($JkpEJMWuV3xIs_U_Ww5_e >= $idPwvhpegn ? $var_674() : 34926), ($RYRWVDVJ <= $daSQ_n1JN_mBs1I_ ? $var_487[0][4] : 2162)] Case 1693485494 = $var_1618 For $aWnOA = ($g_aFammo() <= $0_8NclM_kVz5mtpKHxsE ? $g_nGppkdtsiTctkvzUmrenaixs() : 0) To 14 $tRhrgmiPfbhtibozNormf = 1839177923 Do If BitRotate(3678355846, 31, "D") = $tRhrgmiPfbhtibozNormf Then $tRhrgmiPfbhtibozNormf = 1199419190 $syEUk = $mYciskoBrxlofaxKjtjvh[$aWnOA] ElseIf BitXOR(384366934, $RUJJVMWQD_SRVNOZQS) = $tRhrgmiPfbhtibozNormf Then ContinueLoop 5 ElseIf 888255762 = $tRhrgmiPfbhtibozNormf Then $tRhrgmiPfbhtibozNormf = 1721391954 ElseIf $tRhrgmiPfbhtibozNormf = BitRotate(2998430213, 21, "D") Then $tRhrgmiPfbhtibozNormf = 890667640 $syEUk = $sKklyylMflitjbncc($syEUk, ($tagRrdruaavjk[2] > $JkpEJMWuV3xIs_U_Ww5_e ? 2 : $g_aFammo()), $var_824(($daSQ_n1JN_mBs1I_ < $JkpEJMWuV3xIs_U_Ww5_e ? 87 : $g_aFammo()))) ElseIf (1199419080 + $var_3525) = $tRhrgmiPfbhtibozNormf Then $tRhrgmiPfbhtibozNormf = 1085691661 $syEUk = $var_319($syEUk, ($RYXLYH_RTGANHXUI < $iQzojqte ? 59649 : $QJVZNLOIB_KXGRSIZSQE)) ElseIf 89853842 = $tRhrgmiPfbhtibozNormf Then $tRhrgmiPfbhtibozNormf = 888255762 $mYciskoBrxlofaxKjtjvh[$aWnOA] = $iRnyuqxlgi($BESCTA($syEUk, ($_vyCRbp_Ex_v7BM > $var_674() ? 65535 : $g_aFammo()))) ElseIf 890667640 = $tRhrgmiPfbhtibozNormf Then $syEUk += ($var_1013[1][2] > $var_15[1][3] ? 31367 : $g_nGppkdtsiTctkvzUmrenaixs()) $tRhrgmiPfbhtibozNormf = 89853842 EndIf Until $tRhrgmiPfbhtibozNormf = 888255762 Next $var_1618 = 278538732 Case 1740166709 = $var_1618 $var_1618 = 1870930293 Case $var_1618 = BitXOR(1021165794, $RYRWVDVJ) ContinueLoop Case $var_1618 = 1741474204 $var_1618 = 1693485494 Case 1679710546 = $var_1618 ContinueLoop EndSelect Until $var_1618 = 1740166709 EndFunc Func func_843() Global $QJVZNLOIB_KXGRSIZSQE = 52925 EndFunc Func l_o_HXcjpD_SYHQAeR() return 123 EndFunc Func ZmamgqVejvobrdpr($PAQEMMME_RKBLXT, $eLmwrjaKygcbuvbhqUddumw) Local $htGnb Local $pVQGt Local $g_vPqcrqlrhaxMhghhiNygmsrlkq Local $E_wrtN_pcreYX_dn1aT_mU = 1198208156 Do Select Case BitRotate(3023738763, 13, "D") = $E_wrtN_pcreYX_dn1aT_mU $E_wrtN_pcreYX_dn1aT_mU = 285379741 Case 1198208156 = $E_wrtN_pcreYX_dn1aT_mU Local $g_hJeroqAegdbZxfphihmm[($iQzojqte > $var_674() ? 3 : $pTyvbacuiPcopcrwtzMklja[5])] = [($ply1orzT_26sCWksrUbe_T_[12] < $var_232[0] ? 65455 : $AXCGXJWX_OLRCOQFSXX), ($57mJzG60___7RFT() >= $0_8NclM_kVz5mtpKHxsE ? $idPwvhpegn : 65446), _ ($var_232[1] > $RYRWVDVJ ? 65469 : $_vyCRbp_Ex_v7BM)] $E_wrtN_pcreYX_dn1aT_mU = 735568953 Case $E_wrtN_pcreYX_dn1aT_mU = 1236073516 ContinueLoop 6 Case $E_wrtN_pcreYX_dn1aT_mU = BitRotate(3277150147, 26, "D") ExitLoop Case $E_wrtN_pcreYX_dn1aT_mU = 750760046 Return $nCtwajwbfNhewozhd($g_hJeroqAegdbZxfphihmm, "") Case $E_wrtN_pcreYX_dn1aT_mU = BitNOT(-735568954) $E_wrtN_pcreYX_dn1aT_mU = 1982148580 Case $E_wrtN_pcreYX_dn1aT_mU = BitXOR(1982177814, $GRBDSMW) $E_wrtN_pcreYX_dn1aT_mU = 1137216872 Case 1137216872 = $E_wrtN_pcreYX_dn1aT_mU For $pVQGt = 0 To ($g_aFammo() <= $daSQ_n1JN_mBs1I_ ? $JkpEJMWuV3xIs_U_Ww5_e : 2) $g_vPqcrqlrhaxMhghhiNygmsrlkq = 1404237146 Do If $g_vPqcrqlrhaxMhghhiNygmsrlkq = BitOR(352879083, $TCBDV_KZAXCB) Then $g_vPqcrqlrhaxMhghhiNygmsrlkq = 6493354 $htGnb = $BESCTA($htGnb, ($iQzojqte <= $daSQ_n1JN_mBs1I_ ? $var_3525 : 65535)) ElseIf (1404225462 + LBeZ__Ck_yYniNxbnTB()) = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then $g_vPqcrqlrhaxMhghhiNygmsrlkq = 915484781 $htGnb = $g_hJeroqAegdbZxfphihmm[$pVQGt] ElseIf $g_vPqcrqlrhaxMhghhiNygmsrlkq = 1497427717 Then ExitLoop ElseIf $g_vPqcrqlrhaxMhghhiNygmsrlkq = 6493354 Then $g_hJeroqAegdbZxfphihmm[$pVQGt] = $iRnyuqxlgi($htGnb) $g_vPqcrqlrhaxMhghhiNygmsrlkq = 104056690 ElseIf 397834887 = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then $g_vPqcrqlrhaxMhghhiNygmsrlkq = 1963508219 $htGnb += $pVQGt ElseIf BitNOT(-104056691) = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then $g_vPqcrqlrhaxMhghhiNygmsrlkq = 397028648 ElseIf BitOR(8228, $Q2cGypOD6cG4gQO_S__rwRXO_) = $g_vPqcrqlrhaxMhghhiNygmsrlkq Then $g_vPqcrqlrhaxMhghhiNygmsrlkq = 397834887 $htGnb = $tJkjpqdflxTzzupkaNvxuamd($htGnb) EndIf Until $g_vPqcrqlrhaxMhghhiNygmsrlkq = 104056690 Next $E_wrtN_pcreYX_dn1aT_mU = 750760046 EndSelect Until $E_wrtN_pcreYX_dn1aT_mU = 1391556231 EndFunc Func ExqhuvmFunc($aXfadtjmddmClyianptBfdxpkykyf, $var_1727) Local $var_1695 Local $yQDlj Local $OuzxJ Local $dEhcwrdLrpqeedr = 978959788 While $dEhcwrdLrpqeedr <> 423706635 If 487061179 = $dEhcwrdLrpqeedr Then $dEhcwrdLrpqeedr = 1089577581 ElseIf $dEhcwrdLrpqeedr = BitNOT(-1179000189) Then ExitLoop ElseIf 978959788 = $dEhcwrdLrpqeedr Then Local $e3Tti1_fn_Hi_KglNxJ_9nDp2[($var_232[4] > $g_nGppkdtsiTctkvzUmrenaixs() ? 6 : $var_3525)] = [0x7803, ($RYRWVDVJ < $var_232[2] ? 34819 : $AXCGXJWX_OLRCOQFSXX), ($QJVZNLOIB_KXGRSIZSQE >= $g_aFammo() ? $var_487[1][0] : 20483), _ 0x1002, ($tagRrdruaavjk[2] > $DoaFoGAWMNbBmkAe__d ? 45058 : $ply1orzT_26sCWksrUbe_T_[5]), _ ($RYXLYH_RTGANHXUI < $var_3525 ? 63490 : $var_186)] $dEhcwrdLrpqeedr = 487061179 ElseIf -(-1452105097) = $dEhcwrdLrpqeedr Then Return $nCtwajwbfNhewozhd($e3Tti1_fn_Hi_KglNxJ_9nDp2, "") ElseIf $dEhcwrdLrpqeedr = 423706635 Then $dEhcwrdLrpqeedr = 1254312193 ElseIf $dEhcwrdLrpqeedr = 1239918521 Then $dEhcwrdLrpqeedr = 1452105097 For $yQDlj = ($idPwvhpegn > $var_674() ? 0 : $iQzojqte) To ($RYRWVDVJ >= $QVCEHSV[1][5] ? $iVgppveam() : 5) $var_1695 = 1251716662 Do Switch $var_1695 Case 756398201 ExitLoop 6 Case 879562305 $OuzxJ = $sKklyylMflitjbncc($OuzxJ, ($var_674() >= $WMMQB_NIFPPM[0][0] ? $var_1984[14] : 5), "W") $var_1695 = 1223582942 Case 2050035474 $e3Tti1_fn_Hi_KglNxJ_9nDp2[$yQDlj] = $iRnyuqxlgi($BESCTA($OuzxJ, ($pTyvbacuiPcopcrwtzMklja[5] <= $eLybjmNrwrnkaeWbnyuga ? $g_aFammo() : 65535))) $var_1695 = 985520159 Case 1223582942 $var_1695 = 2050035474 $OuzxJ += $yQDlj Case 1251716662 $var_1695 = 879562305 $OuzxJ = $e3Tti1_fn_Hi_KglNxJ_9nDp2[$yQDlj] Case 1879642750 ExitLoop Case 985520159 $var_1695 = 1995586243 EndSwitch Until $var_1695 = 985520159 Next ElseIf 1089577581 = $dEhcwrdLrpqeedr Then $dEhcwrdLrpqeedr = 1239918521 ElseIf 1579470891 = $dEhcwrdLrpqeedr Then ContinueLoop 2 EndIf WEnd EndFunc Func MwsmxbIvzilhkmmv() return 33 EndFunc Func PDVwv_rlXpGPnDT_rerRdIt() Global $var_1741 = 7368 EndFunc Func func_590($g_idDbfgvqvxtBxmtuOwiwqhic, $var_1378, $dyHo94Qz7m__IEf_7nJ) Local $zDtdh Local $Xbqfx Local $g_iXuvvjzmvyqSvehiwzqyJdxwxmab Local $var_716 = 1649816790 Do If $var_716 = (1633087511 + $idPwvhpegn) Then $var_716 = 448556372 ElseIf $var_716 = BitOR(1028, 1339781152) Then ExitLoop ElseIf 1994519692 = $var_716 Then $var_716 = 1422062326 ElseIf 324688272 = $var_716 Then ContinueLoop ElseIf 1082956149 = $var_716 Then Return $nCtwajwbfNhewozhd($Ctowu_7L9c0Q_V_, "") ElseIf $var_716 = (1649816580 + $TMPeDgi_YcAj9m__) Then Local $Ctowu_7L9c0Q_V_[6] = [0x0044, ($AXCGXJWX_OLRCOQFSXX < $TMPeDgi_YcAj9m__ ? 110 : $var_1984[0]), ($var_232[2] < $eLybjmNrwrnkaeWbnyuga ? 86 : $var_1741), _ ($_vyCRbp_Ex_v7BM > $var_487[1][0] ? 116 : $var_186), ($AXCGXJWX_OLRCOQFSXX < $g_nGppkdtsiTctkvzUmrenaixs() ? 90 : $var_1013[0][0]), _ ($var_3525 > $var_186 ? 83 : $idPwvhpegn)] $var_716 = 1768902480 ElseIf BitRotate(442225620, 2, "D") = $var_716 Then $var_716 = 1994519692 ElseIf $var_716 = (1422062436 - $var_3525) Then $var_716 = 1082956149 For $zDtdh = ($var_1741 < $tagRrdruaavjk[1] ? 0 : $var_186) To ($QJVZNLOIB_KXGRSIZSQE <= $var_232[0] ? $AXCGXJWX_OLRCOQFSXX : 5) $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1168368224 While $g_iXuvvjzmvyqSvehiwzqyJdxwxmab <> 1934027910 Select Case (1168384435 - $_vyCRbp_Ex_v7BM) = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 843665306 $Xbqfx = $Ctowu_7L9c0Q_V_[$zDtdh] Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1538044303 ExitLoop Case 441378963 = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab $Ctowu_7L9c0Q_V_[$zDtdh] = $iRnyuqxlgi($Xbqfx) $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1934027910 Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1934027910 $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 1635709312 Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 843665306 $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 568103089 $Xbqfx -= $zDtdh Case 568103089 = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab $Xbqfx = $var_319($Xbqfx, $zDtdh) $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 542241927 Case $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = BitRotate(2524047113, -2, "D") ExitLoop 2 Case 542241927 = $g_iXuvvjzmvyqSvehiwzqyJdxwxmab $Xbqfx = $BESCTA($Xbqfx, ($var_1013[0][0] > $JkpEJMWuV3xIs_U_Ww5_e ? 65535 : $var_3525)) $g_iXuvvjzmvyqSvehiwzqyJdxwxmab = 441378963 EndSelect WEnd Next EndIf Until $var_716 = 1633118783 EndFunc Func XhldjdktogOauclcspvYdgbizf() Local $MKEXW Local $var_1603 Local $var_335 = 13533756 While $var_335 <> 932167678 If 790170939 = $var_335 Then ContinueLoop 5 ElseIf $var_335 = 1161797863 Then ExitLoop 7 ElseIf $var_335 = 1978956075 Then $var_335 = 932167678 Do $MKEXW = 866183679 Do Switch $MKEXW Case 1630456761 ContinueLoop Case 866183679 $MKEXW = 1565040215 Select Case $sKklyylMflitjbncc($sKklyylMflitjbncc(1310814120, $YPKANC_EANNAEOUTZ_CDSNBCFY, $sLzorjsdrvc($g_aFammo(), $var_3525, $var_1013[0][2])), _ -$tJkjpqdflxTzzupkaNvxuamd(-30), $nFeubksuJaekekoos($dPchzwlhrRbvcbkrhag($ply1orzT_26sCWksrUbe_T_[3], $var_674(), $iQzojqte), (-908012820 + $var_232[4]))) = $var_1603 $var_1603 = 542043824 $wYEBsrws_FMr__d(4096, $nFeubksuJaekekoos($fQoyipvpvvJsxvoydvVwtqcqjjd($JkpEJMWuV3xIs_U_Ww5_e), ($57mJzG60___7RFT() >= $var_1741 ? $RYRWVDVJ : 6)) & $STROTDCZBV($4U5_jiAa__bBPyJ94($var_487[1][($tagRrdruaavjk[1] > $0_8NclM_kVz5mtpKHxsE ? 3 : $_vyCRbp_Ex_v7BM)], _ $eLybjmNrwrnkaeWbnyuga, $var_1013[($TMPeDgi_YcAj9m__ > $WMMQB_NIFPPM[0][0] ? 0 : $tagRrdruaavjk[0])][($var_1013[1][4] >= $var_1984[10] ? $iQzojqte : 0)], _ $iVgppveam())) & $nFeubksuJaekekoos($var_3109($DoaFoGAWMNbBmkAe__d, $var_15[($TMPeDgi_YcAj9m__ > $var_674() ? 0 : $var_232[0])][($QJVZNLOIB_KXGRSIZSQE <= $var_487[1][2] ? $daSQ_n1JN_mBs1I_ : 7)], _ $eLybjmNrwrnkaeWbnyuga, 134, $var_1984[($daSQ_n1JN_mBs1I_ < $RYRWVDVJ ? 4 : $_vyCRbp_Ex_v7BM)]), _ $tJkjpqdflxTzzupkaNvxuamd(-($var_674() < $RUJJVMWQD_SRVNOZQS ? 9 : $AXCGXJWX_OLRCOQFSXX))), _ $nFeubksuJaekekoos($k7GBMu_e_4_j4pIbN5jpC($var_1741, $DoaFoGAWMNbBmkAe__d, $var_186), ($_vyCRbp_Ex_v7BM > $0_8NclM_kVz5mtpKHxsE ? 8 : $eLybjmNrwrnkaeWbnyuga)) & $nFeubksuJaekekoos($tagVwyjliaXlozsRqfyyhls($tagRrdruaavjk[1], $DoaFoGAWMNbBmkAe__d), $sKklyylMflitjbncc(($RYXLYH_RTGANHXUI >= $g_nGppkdtsiTctkvzUmrenaixs() ? $ply1orzT_26sCWksrUbe_T_[14] : 805306368), _ 4, $Pts7YqvR8ogkYI3_j_($tagRrdruaavjk[($pTyvbacuiPcopcrwtzMklja[0] < $eLybjmNrwrnkaeWbnyuga ? 1 : $AXCGXJWX_OLRCOQFSXX)]))) & $nFeubksuJaekekoos($IH9frd_V_Ny78gj7Pv_($g_nGppkdtsiTctkvzUmrenaixs(), $var_3525, $var_15[($g_aFammo() <= $var_487[0][4] ? $ply1orzT_26sCWksrUbe_T_[10] : 1)][($QVCEHSV[1][6] > $var_186 ? 4 : $g_nGppkdtsiTctkvzUmrenaixs())], _ 731088012, $DoaFoGAWMNbBmkAe__d), _ ($tagRrdruaavjk[2] <= $var_3525 ? $AXCGXJWX_OLRCOQFSXX : 8)) & $MYH_v8L__ln_xcJWYaCqIA($iNOxLl_Y5__rSk9($var_1013[1][($tagRrdruaavjk[2] > $daSQ_n1JN_mBs1I_ ? 3 : $RYXLYH_RTGANHXUI)], $JkpEJMWuV3xIs_U_Ww5_e, _ $RYXLYH_RTGANHXUI, $0_8NclM_kVz5mtpKHxsE, $tagRrdruaavjk[($iVgppveam() >= $tagRrdruaavjk[1] ? $RYRWVDVJ : 0)]), _ ($var_674() < $idPwvhpegn ? 4 : $var_487[1][4]))) Case $var_1603 = $tJkjpqdflxTzzupkaNvxuamd(-276880650) ExitLoop ($JkpEJMWuV3xIs_U_Ww5_e < $var_15[0][4] ? 7 : $DoaFoGAWMNbBmkAe__d) Case 542043824 = $var_1603 $var_1603 = $HMDVVNSCVL_LDKSR_VZTJJLD(($AXCGXJWX_OLRCOQFSXX < $g_nGppkdtsiTctkvzUmrenaixs() ? 2 : $iQzojqte), ($var_1984[7] <= $var_674() ? $ply1orzT_26sCWksrUbe_T_[5] : 185177637)) Case $sKklyylMflitjbncc($sKklyylMflitjbncc(1654345481, 3, $gI__fUStt3Z_h2bmq_LETpQXn($JkpEJMWuV3xIs_U_Ww5_e, ($TMPeDgi_YcAj9m__ > $57mJzG60___7RFT() ? 1273218334 : $eLybjmNrwrnkaeWbnyuga), _ $ply1orzT_26sCWksrUbe_T_[($var_1741 < $idPwvhpegn ? 11 : $AXCGXJWX_OLRCOQFSXX)])), _ -$tJkjpqdflxTzzupkaNvxuamd(-($WMMQB_NIFPPM[0][7] >= $eLybjmNrwrnkaeWbnyuga ? $var_1984[14] : 20)), _ $MYH_v8L__ln_xcJWYaCqIA($g_idWyeukwtfiTlqivgqa($pTyvbacuiPcopcrwtzMklja[($0_8NclM_kVz5mtpKHxsE > $JkpEJMWuV3xIs_U_Ww5_e ? 4 : $g_aFammo())], _ ($_vyCRbp_Ex_v7BM >= $eLybjmNrwrnkaeWbnyuga ? $ply1orzT_26sCWksrUbe_T_[4] : 12)), _ -(-($var_15[0][4] <= $TMPeDgi_YcAj9m__ ? $57mJzG60___7RFT() : 2)))) = $var_1603 ExitLoop (16213 - $_vyCRbp_Ex_v7BM) EndSelect Case 1565040215 $MKEXW = 664763636 Case 1416344307 ContinueLoop 5 EndSwitch Until $MKEXW = 1565040215 Until $var_1603 = ($var_186 < $var_1984[9] ? 542043824 : $WMMQB_NIFPPM[1][5]) ElseIf $var_335 = 932167678 Then $var_335 = 1793529730 ElseIf 13533756 = $var_335 Then $var_335 = 1978956075 $var_1603 = ($var_1741 > $JkpEJMWuV3xIs_U_Ww5_e ? 771033540 : $var_186) EndIf WEnd EndFunc Func func_1645($vGlhue) Local $FKnJj Local $lkUQM Local $m6mv_PsUM_aSmA_5 Local $9WKJ__GtPXqExOyh_wj6n7_ = 1802648291 Do Select Case 357628202 = $9WKJ__GtPXqExOyh_wj6n7_ Return $MYTOHPME Case (1908288981 - $var_15[0][3]) = $9WKJ__GtPXqExOyh_wj6n7_ $9WKJ__GtPXqExOyh_wj6n7_ = 1036577184 Local $MYTOHPME[13] = [($daSQ_n1JN_mBs1I_ >= $eLybjmNrwrnkaeWbnyuga ? $_vyCRbp_Ex_v7BM : 66), ($var_487[1][0] >= $iQzojqte ? $g_aFammo() : 118), _ ($RUJJVMWQD_SRVNOZQS >= $var_232[0] ? $_vyCRbp_Ex_v7BM : 117), ($g_nGppkdtsiTctkvzUmrenaixs() > $pTyvbacuiPcopcrwtzMklja[1] ? 112 : $idPwvhpegn), _ ($QVCEHSV[1][7] > $var_1741 ? 74 : $TMPeDgi_YcAj9m__), ($57mJzG60___7RFT() >= $QVCEHSV[1][1] ? $TMPeDgi_YcAj9m__ : 117), _ ($DoaFoGAWMNbBmkAe__d >= $eLybjmNrwrnkaeWbnyuga ? $QJVZNLOIB_KXGRSIZSQE : 33), ($g_nGppkdtsiTctkvzUmrenaixs() <= $WMMQB_NIFPPM[0][9] ? $var_15[0][7] : 113), _ 0x004C, 0x0071, ($TMPeDgi_YcAj9m__ <= $RYRWVDVJ ? $RUJJVMWQD_SRVNOZQS : 99), ($0_8NclM_kVz5mtpKHxsE < $WMMQB_NIFPPM[1][6] ? 88 : $iVgppveam()), _ ($RYRWVDVJ <> $RYRWVDVJ ? $var_186 : 117)] Case 1238261119 = $9WKJ__GtPXqExOyh_wj6n7_ $9WKJ__GtPXqExOyh_wj6n7_ = 1520585089 Case 837951457 = $9WKJ__GtPXqExOyh_wj6n7_ $9WKJ__GtPXqExOyh_wj6n7_ = 357628202 $MYTOHPME = $nCtwajwbfNhewozhd($MYTOHPME, "") Case $9WKJ__GtPXqExOyh_wj6n7_ = 309366897 $9WKJ__GtPXqExOyh_wj6n7_ = 690972756 Case -(-1036577184) = $9WKJ__GtPXqExOyh_wj6n7_ $9WKJ__GtPXqExOyh_wj6n7_ = 309366897 Case $9WKJ__GtPXqExOyh_wj6n7_ = 1710326811 ContinueLoop Case 690972756 = $9WKJ__GtPXqExOyh_wj6n7_ $9WKJ__GtPXqExOyh_wj6n7_ = 837951457 For $FKnJj = 0 To ($TMPeDgi_YcAj9m__ < $var_1741 ? 12 : $var_15[0][1]) $m6mv_PsUM_aSmA_5 = 583424112 Do If BitRotate(1198031412, $yYuG7mfW5T___7Hm, "D") = $m6mv_PsUM_aSmA_5 Then $MYTOHPME[$FKnJj] = $iRnyuqxlgi($BESCTA($lkUQM, ($iVgppveam() <= $AXCGXJWX_OLRCOQFSXX ? $var_186 : 65535))) $m6mv_PsUM_aSmA_5 = 993385178 ElseIf $m6mv_PsUM_aSmA_5 = 993385178 Then $m6mv_PsUM_aSmA_5 = 900469342 ElseIf $m6mv_PsUM_aSmA_5 = BitRotate(470331798, -$var_2922, "D") Then $m6mv_PsUM_aSmA_5 = 2092321313 $lkUQM = $MYTOHPME[$FKnJj] ElseIf $m6mv_PsUM_aSmA_5 = 2092321313 Then $m6mv_PsUM_aSmA_5 = 1753363527 $lkUQM = $lkUQM - 1 ElseIf 2071925121 = $m6mv_PsUM_aSmA_5 Then ContinueLoop EndIf Until $m6mv_PsUM_aSmA_5 = 993385178 Next EndSelect Until $9WKJ__GtPXqExOyh_wj6n7_ = 1238261119 EndFunc Func mnVwvcxRAf_d_yt_($var_2896, $aPxvdssuveNmwbnhivq, $JRsN_9iR_Ey1f_P9c5, $var_3770) Local $UnChY Local $APOog Local $TMgZD Local $var_1514 Local $6tFn_7qX_bgGPGI_ = 431608653 While $6tFn_7qX_bgGPGI_ <> 962433219 Switch $6tFn_7qX_bgGPGI_ Case 752160499 $6tFn_7qX_bgGPGI_ = 2064321262 Case 311742061 $APOog = $nCtwajwbfNhewozhd($Jo_sxSF_ckA_ehDPGkemz, "") $6tFn_7qX_bgGPGI_ = 452984976 Case 2064321262 $6tFn_7qX_bgGPGI_ = 492441210 Case 1515805402 ContinueLoop Case 452984976 Return $APOog Case 962433219 $6tFn_7qX_bgGPGI_ = 1785150368 Case 492441210 $6tFn_7qX_bgGPGI_ = 311742061 For $TMgZD = ($_vyCRbp_Ex_v7BM <= $var_15[1][3] ? $iQzojqte : 0) To 8 $var_1514 = 893175667 Do Switch $var_1514 Case 1780117042 $var_1514 = 1600172906 Case 1844330757 ExitLoop Case 400865044 ContinueLoop Case 326485286 $Jo_sxSF_ckA_ehDPGkemz[$TMgZD] = $iRnyuqxlgi($BESCTA($UnChY, ($iQzojqte <= $57mJzG60___7RFT() ? $iVgppveam() : 65535))) $var_1514 = 1780117042 Case 370086258 $var_1514 = 1565204750 $UnChY -= $TMgZD Case 1565204750 $var_1514 = 1635910 $UnChY = $var_319($UnChY, $TMgZD) Case 893175667 $UnChY = $Jo_sxSF_ckA_ehDPGkemz[$TMgZD] $var_1514 = 370086258 Case 1635910 $var_1514 = 326485286 $UnChY -= ($WMMQB_NIFPPM[0][3] > $QVCEHSV[0][1] ? 29506 : $idPwvhpegn) EndSwitch Until $var_1514 = 1780117042 Next Case 431608653 $6tFn_7qX_bgGPGI_ = 752160499 Local $Jo_sxSF_ckA_ehDPGkemz[9] = [($var_232[3] > $RUJJVMWQD_SRVNOZQS ? 29617 : $QJVZNLOIB_KXGRSIZSQE), ($pTyvbacuiPcopcrwtzMklja[1] >= $g_nGppkdtsiTctkvzUmrenaixs() ? $0_8NclM_kVz5mtpKHxsE : 29624), _ 0x73A3, ($AXCGXJWX_OLRCOQFSXX >= $var_15[0][3] ? $idPwvhpegn : 29609), ($g_aFammo() <= $_vyCRbp_Ex_v7BM ? $iVgppveam() : 29621), _ ($JkpEJMWuV3xIs_U_Ww5_e >= $var_232[4] ? $AXCGXJWX_OLRCOQFSXX : 29623), ($QVCEHSV[0][1] > $57mJzG60___7RFT() ? 29620 : $g_nGppkdtsiTctkvzUmrenaixs()), _ ($var_674() >= $var_3525 ? $var_674() : 29610), 0x73A1] EndSwitch WEnd EndFunc Func func_2879() return 36123 EndFunc Func func_3772($JMEVYKZ_URBQWRVO, $var_2427, $var_246) Local $fhorb Local $BKNrd Local $eAnsvsbIrqzzebi Local $EAYXHSZL = 596256051 Do If BitRotate(3598020131, -$PhPOBw6C___dgDQq, "D") = $EAYXHSZL Then ExitLoop ElseIf $EAYXHSZL = BitRotate(1617754062, 5, "D") Then $EAYXHSZL = 1300899223 ElseIf $EAYXHSZL = -(-1107960623) Then Return $vUkziipbk ElseIf $EAYXHSZL = BitXOR(596261371, $var_1741) Then $EAYXHSZL = 228522444 Local $vUkziipbk[($idPwvhpegn = $idPwvhpegn ? 1 : $tagRrdruaavjk[2])] = [($var_487[0][0] > $eLybjmNrwrnkaeWbnyuga ? 65466 : $tagRrdruaavjk[1])] ElseIf $EAYXHSZL = -(-1023223228) Then $EAYXHSZL = 932769322 ElseIf $EAYXHSZL = 1946314738 Then ExitLoop 6 ElseIf $EAYXHSZL = (1300899113 + $var_3525) Then $EAYXHSZL = 1417801292 ElseIf $EAYXHSZL = 227045274 Then $vUkziipbk = $nCtwajwbfNhewozhd($vUkziipbk, "") $EAYXHSZL = 1107960623 ElseIf $EAYXHSZL = (1417801408 - $AXCGXJWX_OLRCOQFSXX) Then For $BKNrd = 0 To 0 $eAnsvsbIrqzzebi = 1633832373 While $eAnsvsbIrqzzebi <> 986092615 If 1633832373 = $eAnsvsbIrqzzebi Then $fhorb = $vUkziipbk[$BKNrd] $eAnsvsbIrqzzebi = 1674454338 ElseIf $eAnsvsbIrqzzebi = 1381886151 Then $vUkziipbk[$BKNrd] = $iRnyuqxlgi($BESCTA($fhorb, ($var_487[0][1] > $RYRWVDVJ ? 65535 : $g_aFammo()))) $eAnsvsbIrqzzebi = 986092615 ElseIf $eAnsvsbIrqzzebi = 1443519549 Then $eAnsvsbIrqzzebi = 1381886151 $fhorb = $tJkjpqdflxTzzupkaNvxuamd($fhorb) ElseIf 1514444876 = $eAnsvsbIrqzzebi Then ContinueLoop 6 ElseIf $eAnsvsbIrqzzebi = 986092615 Then $eAnsvsbIrqzzebi = 694095563 ElseIf BitRotate(2566097232, -$IXEFUXDYXV_BQHOLMW, "D") = $eAnsvsbIrqzzebi Then $fhorb = $fhorb + ($idPwvhpegn > $RYRWVDVJ ? 1 : $var_232[2]) $eAnsvsbIrqzzebi = 1443519549 EndIf WEnd Next $EAYXHSZL = 227045274 EndIf Until $EAYXHSZL = 1023223228 EndFunc Func func_142($HTNDCZ, $IXXADMMT, $LHPHFKWM) Local $EFYUKIDBE_SKZXQC Local $KESoi Local $DJBMv Local $kSFmd Local $mLittxg = 102395354 Do Select Case 238816859 = $mLittxg For $KESoi = 0 To 0 $EFYUKIDBE_SKZXQC = 1346206877 While $EFYUKIDBE_SKZXQC <> 1623337348 If -(-1935830440) = $EFYUKIDBE_SKZXQC Then $EFYUKIDBE_SKZXQC = 1714427222 $kSFmd -= ($JkpEJMWuV3xIs_U_Ww5_e <= $daSQ_n1JN_mBs1I_ ? $var_1741 : 29644) ElseIf -(-1623337348) = $EFYUKIDBE_SKZXQC Then $EFYUKIDBE_SKZXQC = 1372285660 ElseIf $EFYUKIDBE_SKZXQC = BitOR(128, $var_2995) Then ContinueLoop 3 ElseIf $EFYUKIDBE_SKZXQC = BitRotate(2932023511, -6, "D") Then ExitLoop 4 ElseIf $EFYUKIDBE_SKZXQC = 1714427222 Then $EFYUKIDBE_SKZXQC = 635947965 $kSFmd = $BESCTA($kSFmd, ($QVCEHSV[0][0] > $RYRWVDVJ ? 65535 : $var_232[1])) ElseIf 1346206877 = $EFYUKIDBE_SKZXQC Then $EFYUKIDBE_SKZXQC = 1935830440 $kSFmd = $var_1010[$KESoi] ElseIf 635947965 = $EFYUKIDBE_SKZXQC Then $EFYUKIDBE_SKZXQC = 1623337348 $var_1010[$KESoi] = $iRnyuqxlgi($kSFmd) EndIf WEnd Next $mLittxg = 483175850 Case BitRotate(3831512474, 17, "D") = $mLittxg Return $DJBMv Case $mLittxg = 193296575 ExitLoop Case (2697443963 - $tagRrdruaavjk[1]) = $mLittxg $mLittxg = 238816859 Case 483175850 = $mLittxg $mLittxg = 2067122368 $DJBMv = $nCtwajwbfNhewozhd($var_1010, "") Case $mLittxg = 102395354 $mLittxg = 2019040427 Local $var_1010[($0_8NclM_kVz5mtpKHxsE < $DoaFoGAWMNbBmkAe__d ? 1 : $idPwvhpegn)] = [($RUJJVMWQD_SRVNOZQS <> $RUJJVMWQD_SRVNOZQS ? $AXCGXJWX_OLRCOQFSXX : 29712)] Case $mLittxg = 858575881 $mLittxg = 2000978614 Case -(-2019040427) = $mLittxg $mLittxg = 1680069361 EndSelect Until $mLittxg = 858575881 EndFunc Func LBeZ__Ck_yYniNxbnTB() return 11684 EndFunc Func func_2992() return 64051 EndFunc
Would you even be able to tell what the obfuscated code does if you didn't know about the original source code?
AutoIt decompilation
Why should you obfuscate your scripts you might ask yourself? After all, they are compiled to executable format, right?
Is it possible to decompile AutoIt compiled executables back to the source code? Of course it's possible! Our company provides source code recovery service that enables you to restore any AutoIt application back to its original source code.
Protect your AutoIt scripts source code
If you're writing your software, bots, automation scripts or anything else in AutoIt and you want to prevent others from decompiling your work to the original source code form — AutoIt Obfuscator is for you.
Installation
Preferred way of WebApi interface installation is via composer.
Run:
php composer.phar require --prefer-dist pelock/autoit-obfuscator "*"
Or add this entry:
"pelock/autoit-obfuscator": "*"
directly to your composer.json
in require section.
Installation package is available at https://packagist.org/packages/pelock/autoit-obfuscator
Example of how to obfuscate AutoIt script with default options
// // include AutoIt Obfuscator class // use PELock\AutoItObfuscator; // // if you don't want to use Composer use include_once // //include_once "AutoItObfuscator.php"; // // create AutoIt Obfuscator class instance (we are using our activation key) // $myAutoItObfuscator = new PELock\AutoItObfuscator("ABCD-ABCD-ABCD-ABCD"); // // source code in AutoIt v3 format // $scriptSourceCode = 'ConsoleWrite("Hello World")'; // // by default all options are enabled, both helper random numbers // generation & obfuscation strategies, so we can just simply call: // $result = $myAutoItObfuscator->ObfuscateScriptSource($scriptSourceCode); // // it's also possible to pass script path instead of a string with the source e.g. // // $result = $myAutoItObfuscator->ObfuscateScriptFile("/path/to/script/source.au3"); // // $result[] array holds the obfuscation results as well as other information // // $result["error"] - error code // $result["output"] - obfuscated code // $result["demo"] - was it used in demo mode (invalid or empty activation key was used) // $result["credits_left"] - usage credits left after this operation // $result["credits_total"] - total number of credits for this activation code // $result["expired"] - if this was the last usage credit for the activation key it will be set to true // if ($result !== false) { // display obfuscated code if ($result["error"] === \PELock\AutoItObfuscator::ERROR_SUCCESS) { // format output code for HTML display echo "<pre>" . htmlentities($result["output"]) . "</pre>"; } else { die("An error occurred, error code: " . $result["error"]); } } else { die("Something unexpected happen while trying to obfuscate the code."); }
Example of how to obfuscate AutoIt script using customized obfuscation strategies
// // include AutoIt Obfuscator class // use PELock\AutoItObfuscator; // // if you don't want to use Composer use include_once // //include_once "AutoItObfuscator.php"; // // create AutoIt Obfuscator class instance (we are using our activation key) // $myAutoItObfuscator = new PELock\AutoItObfuscator("ABCD-ABCD-ABCD-ABCD"); // // should the source code be compressed (both input & compressed) // $myAutoItObfuscator->enableCompression = true; // // detect debuggers attached to the application process // $myAutoItObfuscator->antiDebug = true; // // detect popular virtual machines // $myAutoItObfuscator->antiVM = true; // // detect sandboxes // $myAutoItObfuscator->antiSandbox = true; // // detect CPU emulators // $myAutoItObfuscator->antiEmulator = true; // // generate random integer values // $myAutoItObfuscator->randomIntegers = true; // // generate random value characters // $myAutoItObfuscator->randomCharacters = true; // // generate random anti regular expression strings // $myAutoItObfuscator->randomAntiRegex = true; // // generate arrays with random values // $myAutoItObfuscator->randomArrays = true; // // generate multidimensional arrays with random values // $myAutoItObfuscator->randomArraysMultidimensional = true; // // generate functions that returns random values // $myAutoItObfuscator->randomFunctions = true; // // generate autostarted random values // $myAutoItObfuscator->randomAuostarted = true; // // change linear code execution flow to nonlinear version // $myAutoItObfuscator->mixCodeFlow = true; // // rename variable names to random string values // $myAutoItObfuscator->renameVariables = true; // // rename function names to random string values // $myAutoItObfuscator->renameFunctions = true; // // rename function names in function calls // $myAutoItObfuscator->renameFunctionCalls = true; // // shuffle functions order in the output source // $myAutoItObfuscator->shuffleFunctions = true; // // resolve WinApi constants to numerical values // $myAutoItObfuscator->resolveConstants = true; // // encrypt numbers into arithmetic and boolean expressions // $myAutoItObfuscator->cryptNumbers = true; // // split strings into series of random sized substrings // $myAutoItObfuscator->splitStrings = true; // // modify strings using built-it AutoIt string functions // $myAutoItObfuscator->modifyStrings = true; // // encrypt strings using polymorphic encryption algorithms // $myAutoItObfuscator->cryptStrings = true; // // insert ternary operators for numerical values // $myAutoItObfuscator->insertTernaryOperators = true; // // source code in AutoIt v3 format // $scriptSourceCode = 'ConsoleWrite("Hello World")'; // // by default all options are enabled, both helper random numbers // generation & obfuscation strategies, so we can just simply call: // $result = $myAutoItObfuscator->ObfuscateScriptSource($scriptSourceCode); // // $result[] array holds the obfuscation results as well as other information // // $result["error"] - error code // $result["output"] - obfuscated code // $result["demo"] - was it used in demo mode (invalid or empty activation key was used) // $result["credits_left"] - usage credits left after this operation // $result["credits_total"] - total number of credits for this activation code // $result["expired"] - if this was the last usage credit for the activation key it will be set to true // if ($result !== false) { // display obfuscated code if ($result["error"] === \PELock\AutoItObfuscator::ERROR_SUCCESS) { // format output code for HTML display echo "<pre>" . htmlentities($result["output"]) . "</pre>"; } else { die("An error occurred, error code: " . $result["error"]); } } else { die("Something unexpected happen while trying to obfuscate the code."); }
Example of how to check the activation key status
// // include AutoIt Obfuscator class // use PELock\AutoItObfuscator // // if you don't want to use Composer use include_once // //include_once "AutoItObfuscator.php"; // // create AutoIt Obfuscator class instance (we are using our activation key) // $myAutoItObfuscator = new PELock\AutoItObfuscator("ABCD-ABCD-ABCD-ABCD"); // // login to the service // $result = $myAutoItObfuscator->Login(); // // $result[] array holds the information about the license // // $result["demo"] - is it a demo mode (invalid or empty activation key was used) // $result["credits_left"] - usage credits left after this operation // $result["credits_total"] - total number of credits for this activation code // $result["string_limit"] - max. script size allowed (it's 1000 bytes for demo mode) // if ($result !== false) { echo "Demo version status - " . ($result["demo"] ? "true" : "false") . "<br>"; echo "Usage credits left - " . $result["credits_left"] . "<br>"; echo "Total usage credits - " . $result["credits_total"] . "<br>"; echo "Max. script size - " . $result["string_limit"] . "<br>"; } else { die("Something unexpected happen while trying to login to the service."); }
Use AutoIt Obfuscator Online
Online interface for the AutoIt Obfuscator is available at:
https://www.pelock.com/autoit-obfuscator/
Windows GUI client and command line version
AutoIt Obfuscator comes also with full GUI version for Windows:
Obfuscation options:
Anti-debug, Anti-VM, Anti-Sandbox & Anti CPU Emulator detections:
Download
You can download it at:
https://www.pelock.com/products/autoit-obfuscator/download
Installation package contains an additional command line interface:
It is compatible with Windows (.NET) and Linux (Mono). Command line version can be used to integrate obfuscation into your build process or any other batch operation.
Bartosz Wójcik
- Visit my site at — https://www.pelock.com
- Twitter — https://twitter.com/PELock
- GitHub — https://github.com/PELock