AutoIt Obfuscator — AutoIt Script Source Code Obfuscation

AutoIt Obfuscator lets you protect your AutoIt script source code against analysis, reverse engineering & decompilation by using multiple advanced obfuscation techniques and polymorphic encryption.

What is AutoIt?

AutoIt is a scripting language for the Windows platform. It has evolved greatly from its first releases and now it's a mature product capable of creating whole applications, both console and windows based. Over time it has become a powerful language that supports complex expressions, user functions, loops and everything else that veteran scripters would expect.

It is widely used for fast and simple GUI automation tasks. It uses a combination of simulated keystrokes, mouse movement and window/control manipulation in order to automate tasks in a way not possible or reliable with other languages.

AutoIt Logo

AutoIt script source code obfuscation

Obfuscation is the process of transforming AutoIt source code into a protected version of itself. The script functionality stays the same, everything works the same, but the source code is protected from analysis, all of the variables are encrypted, and all strings are encrypted.

AutoIt Obfuscator uses multiple obfuscation strategies to protect the real meaning of your AutoIt source code.

Look at this example and click the "After obfuscation" tab to understand how AutoIt Obfuscator works:

#include <MsgBoxConstants.au3>

Example()

Func Example()
    MsgBox($MB_SYSTEMMODAL, "AutoIt Obfuscator", "Hello World!")
EndFunc   ;==>Example
;////////////////////////////////////////////////////////////////////////////////
;//
;// AutoIt Obfuscator v1.2 - Bartosz Wójcik
;//
;// Website : https://www.pelock.com/products/autoit-obfuscator
;// Version : v1.2
;// Date    : 09.11.2016
;//
;////////////////////////////////////////////////////////////////////////////////

#include <Array.au3>
#AutoIt3Wrapper_Tidy_Stop_OnError=n
#AutoIt3Wrapper_Run_AU3Check=n
Global Const $TzWSoUK_o_K_Ff5Sj = Asc("2")
#OnAutoItStartRegister "Dvwnkojx"
Global Const $g_fCyqhei[2][12] = [[2063123760, 29310, 32, 190, 73055682, 165, 154], [627776834, 66, 64891, 187, 219, 824633971, 198062827, 1612, 64556, 27806, 12, 64276]]
Global $var_91 = Asc("W")
#OnAutoItStartRegister "IbpsyvnkFwcps"
Global Const $_0_hhp_oz_miTjdtrWVNHnV[2][12] = [[29945, 57833, 3693, 67, 24005, 34803, 209, 64282, 48, 27878, 10, 2], [91, 1, 523435560, 248]]
Global Const $eFbjpamWtmcrdgYtmzkr = 35086
Global Const $MFGOTTLY = Asc("9")
Global $x8s8NkwhS_lr__057h = 197
Global Const $P_Pmm__tsM_i86l9k1Wy0 = 204
Global $bQpxvjddpRxljbut[2][12] = [[415403296, 111], [11926, 1407128997, 31135, 185594694, 47717, 14769, 121, 12808, 52, 20331, 74, 519475019]]
Global Const $bPsrcrDmcanfm = 63036
Global Const $var_2286[2][16] = [[54150, 34400, 319180750, 114], [249, 358803285, 173, 2086763066, 45957, 21107, 977032919, 80, 14433, 137, 217, 23429,  _
43767, 219, 63036, 923804633]]
#OnAutoItStartRegister "Wawmvisy"
Global $var_2364 = Asc("j")
#OnAutoItStartRegister "func_4046"
Global $var_3055[12] = [232, 155, 33396, 991869286, 54242, 568794891, 51866, 145, 841723459, 1296486683,  _
4539, 1052749213]
Global $g_dZdupnn = 23434
Global $x_B_wh07ri_FHvyjL[2][14] = [[128, 48969, 2138057828, 1296299644, 131, 44615491, 143, 122, 435757233, 40, 44, 32892,  _
1244895380],  _
[37021, 252, 1592146808, 27, 52323, 29507, 17237, 285115765, 160, 1291940763, 40,  _
5716, 57427, 28541]]
Global Const $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[10] = [45894, 28141, 58636, 55, 9363, 142, 166521229, 1000217573, 34412, 100]
#OnAutoItStartRegister "EgkgpjulbLseqqzjvwFunc"
Global Const $_DnaZCOXz0I_liK_O09_5l[13] = [123109389, 14223, 5007, 221241792, 213, 43322, 18846, 759001477, 126, 1948733066,  _
1722969202, 35379, 35834]
Global Const $DBYMMNXI_IJLDFF = Asc("5")
Global Const $var_418 = 79
Global $NXYVQOPHZ[7] = [93, 35933, 26541, 44, 16024, 35248, 299188747]
#OnAutoItStartRegister "BwywrFunc"
Global Const $aPgpmq = 179
Global Const $sPttobChemaz = 118
Global $kAF7_F_C08e_fV_1wJklw = 106
Global $g_dOfkjobnohQrqryrovmv = 1360675040
Global $cqXViwt_QU_qfPBvA_Y = 535302144
Global $HGELA = 799969345
Global $var_702 = 5
Global $u5y_vWFUXmT54LcnM__ = 197
Global $yg_f_kQ3r6Ncs_o9_e6ymFtnU = 410833152
Global $rJKeHnSWZSmMencIf_p_ = 2
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 683101943
Do
    If (1086691258 - func_2042()) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 2145539946
        Global $var_2141 = BitXOR
    ElseIf 136764320 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 981565012
        Global $NMIXUNXKK = _ArrayToString
    ElseIf 2145539946 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1939713100
        Global $eKcgqryncFedmkzjras = PtqkllvgepFunc
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 312336526 Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1340993918
        Global $var_911 = func_2042
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1783462431 Then
        Global $VAFHSO_NFQCDMSET_FBEQGW = ($var_2364 < $NXYVQOPHZ[4] ? 33 : $var_911())
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 377975485
    ElseIf -(-254826652) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        Global $SRBLEVZF = ($WmnT_OkvejrH_J_qsP3_6() < $x_B_wh07ri_FHvyjL[0][12] ? 20 : $DBYMMNXI_IJLDFF)
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1791774600
    ElseIf -(-1426171412) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 837828767
        Global $WmnT_OkvejrH_J_qsP3_6 = func_421
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 515578572 Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1300097581
        Global $VTURHNG = Chr
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 377975485 Then
        Global $GWJPERIO_KROBTG_NOHHVMWCTD = 4
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 254826652
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = -(-114113507) Then
        Global $var_3521 = Int
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 515578572
    ElseIf 1737043033 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 312336526
        Global $UVSKRLX_RWIKYKE_PIPSLO = NpbogqwkfdFunc
    ElseIf BitNOT(-1184752091) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        Global $FEBKAKCULY_CETPP = BitAND
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 136764320
    ElseIf 1504979127 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 114113507
        Global $var_3166 = H__fJGJtRUk_IsHcHU
    ElseIf (842770224 + $var_418) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        Global $var_638 = BgwcitOvvmqsLkslomdemu
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1667864091
    ElseIf BitOR(76, $yg_f_kQ3r6Ncs_o9_e6ymFtnU) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        Global $EDMDTOOX_XZIRYXALKC_UIPZSYM = Iv_Ylu_np__TiJSTnVRCxr
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 842770303
    ElseIf BitOR(6, $g_dOfkjobnohQrqryrovmv) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        Global $var_2825 = Sqrt
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1184752090
    ElseIf 1631038363 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        Global $var_228 = PfisdqEhfnuyOigqzq
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 188052903
    ElseIf 1667864091 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1783462431
        Global $g_nHhfjxjxFtklg = func_3870
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = -(-1939713100) Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 410833228
        Global $zzvq_sK6R_Tp7_N = BitNOT
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 683101943 Then
        Global $var_896 = Xdcuitb
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1360675046
    ElseIf 188052903 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        Global $var_2010 = StringReverse
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1737043033
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 288720335 Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1504979127
        Global $zYg_BfE4yjW__POR_cdKVzC = ChrW
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1479232499 Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1426171412
        Global $3_Bj_h9TkT3xrvWW_CN7_ = UqsexjrxvwCjjrgweiFunc
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = BitOR(4616, 143819860) Then
        Global $TZTPKFQRJT_AXSEX_DJSOKLIL = func_2133
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 288720335
    ElseIf BitNOT(-1103488573) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        While $idZvmnghsKgebqrdxylMfpxf <> 2107674666
            $var_571 = 905717111
            Do
                Switch $var_571
                    Case 1059758732
                        ExitLoop 6
                    Case 905717111
                        If $idZvmnghsKgebqrdxylMfpxf = -(-(2107674560 + $var_2364)) Then
                            $var_1452 = 1105868731
                            Do
                                Switch $var_1452
                                    Case 1105868731
                                        $var_1452 = 801048409
                                        $idZvmnghsKgebqrdxylMfpxf = $idZjfokWuywqhTjzdext(($TzWSoUK_o_K_Ff5Sj >= $var_91 ? $x_B_wh07ri_FHvyjL[0][12] : 2426767168), $SRBLEVZF,  _
$TZTPKFQRJT_AXSEX_DJSOKLIL(($g_fCyqhei[1][2] < $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[7] ? 150 : $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[3]),  _
$aPgpmq, $XEOIHR_HRFBOC))
                                    Case 801048409
                                        $var_1452 = 1783408578
                                    Case 2371360
                                        ContinueLoop 7
                                    Case 2145536763
                                        ContinueLoop
                                EndSwitch
                            Until $var_1452 = 801048409
                        ElseIf 405881505 = $idZvmnghsKgebqrdxylMfpxf Then
                            $tagFyfqcppSzshnpotzfWlpmbgysi = 401978612
                            While $tagFyfqcppSzshnpotzfWlpmbgysi <> 904448880
                                Select
                                    Case 401978612 = $tagFyfqcppSzshnpotzfWlpmbgysi
                                        $tagFyfqcppSzshnpotzfWlpmbgysi = 1671371558
                                        $idZvmnghsKgebqrdxylMfpxf = 2107674666
                                    Case BitOR(0, 904448880) = $tagFyfqcppSzshnpotzfWlpmbgysi
                                        $tagFyfqcppSzshnpotzfWlpmbgysi = 2016593654
                                    Case $tagFyfqcppSzshnpotzfWlpmbgysi = 515156574
                                        ExitLoop 4
                                    Case BitOR(32, 1671371526) = $tagFyfqcppSzshnpotzfWlpmbgysi
                                        $tagFyfqcppSzshnpotzfWlpmbgysi = 904448880
                                        $3_Bj_h9TkT3xrvWW_CN7_()
                                EndSelect
                            WEnd
                        ElseIf $idZvmnghsKgebqrdxylMfpxf = ($var_3296(84543489, ($var_2939 >= $MFGOTTLY ? $x_B_wh07ri_FHvyjL[1][4] : 146874742)) + $var_3405) Then
                            $vXvuxrBxfbikknqcEvrscucag = 691934887
                            While $vXvuxrBxfbikknqcEvrscucag <> 2114093088
                                Switch $vXvuxrBxfbikknqcEvrscucag
                                    Case 573182438
                                        ContinueLoop 5
                                    Case 1562617389
                                        $vXvuxrBxfbikknqcEvrscucag = 2114093088
                                        $idZvmnghsKgebqrdxylMfpxf = $var_3296(($g_fCyqhei[1][2] <= $var_452 ? $var_91 : 0), ($DBYMMNXI_IJLDFF < $NXYVQOPHZ[4] ? 405881505 : $NXYVQOPHZ[0]))
                                    Case 2114093088
                                        $vXvuxrBxfbikknqcEvrscucag = 1178449850
                                    Case 691934887
                                        $vXvuxrBxfbikknqcEvrscucag = 1562617389
                                        #include <MsgBoxConstants.au3>
                                EndSwitch
                            WEnd
                        ElseIf $var_3296(($var_2286[1][6] > $x_B_wh07ri_FHvyjL[1][7] ? 25001 : $MFGOTTLY), (($var_3405 = $var_3405 ? 2084311110 : $g_fCyqhei[0][6]) - $bQpxvjddpRxljbut[($x_B_wh07ri_FHvyjL[0][2] > $P_Pmm__tsM_i86l9k1Wy0 ? 1 : $bPsrcrDmcanfm)][($var_418 < $_DnaZCOXz0I_liK_O09_5l[3] ? 8 : $var_228())])) = $idZvmnghsKgebqrdxylMfpxf Then
                            $var_2191 = 1247431316
                            Do
                                Select
                                    Case 303780472 = $var_2191
                                        ContinueLoop
                                    Case $var_2191 = (1674253281 - $_0_hhp_oz_miTjdtrWVNHnV[0][4])
                                        $var_2191 = 783839029
                                    Case 1525844537 = $var_2191
                                        ContinueLoop
                                    Case BitOR(16, 1247431300) = $var_2191
                                        ContinueLoop ($var_418 < $var_2286[0][1] ? 5 : $bPsrcrDmcanfm)
                                        $var_2191 = 1674229276
                                EndSelect
                            Until $var_2191 = 1674229276
                        EndIf
                        $var_571 = 538749205
                    Case 538749205
                        $var_571 = 2018489056
                EndSwitch
            Until $var_571 = 538749205
        WEnd
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1126571816
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1918535674 Then
        ExitLoop
    ElseIf (1126543938 + $_0_hhp_oz_miTjdtrWVNHnV[0][9]) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 674776849
    ElseIf (1341008141 - $_DnaZCOXz0I_liK_O09_5l[1]) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        Global $idZjfokWuywqhTjzdext = BitRotate
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 548517496
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = (3025975287 - H__fJGJtRUk_IsHcHU()) Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1103488572
        $idZvmnghsKgebqrdxylMfpxf = ($_0_hhp_oz_miTjdtrWVNHnV[0][10] >= $WmnT_OkvejrH_J_qsP3_6() ? $NXYVQOPHZ[2] : 231418337)
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = BitRotate(2023129793, -$var_702, "D") Then
        Global $NZQGN_UZWHL = MsgBox
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 143824476
    ElseIf 981565012 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 197440534
        Global $IlZGx_UvK_i9_lob53_niH = StringTrimRight
    ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 837828767 Then
        Global $var_3296 = BitOR
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1631038363
    ElseIf 1300097581 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
        Global $var_3466 = func_308
        $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1479232499
    EndIf
Until $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1126571816
Func BwywrFunc()
    Global $var_3405 = 106
EndFunc
Func func_2042()
    return 538173762
EndFunc
Func BgwcitOvvmqsLkslomdemu($CLCMSVVQU_PDRWQQFQH_IOVDVGMFUU, $var_2562)
    $SRZYEJV = 1285329958
    Do
        Switch $SRZYEJV
            Case 602066791
                For $var_2277 = ($XEOIHR_HRFBOC > $sPttobChemaz ? 0 : $bPsrcrDmcanfm) To ($sPttobChemaz > $TzWSoUK_o_K_Ff5Sj ? 4 : $x_B_wh07ri_FHvyjL[1][11])
                    $YIDLEJ = 1665806317
                    Do
                        Select
                            Case 549225025 = $YIDLEJ
                                $var_2857 = $idZjfokWuywqhTjzdext($var_2857, 12, "W")
                                $YIDLEJ = 504487916
                            Case -(-924155281) = $YIDLEJ
                                ExitLoop
                            Case BitRotate(363218649, $rJKeHnSWZSmMencIf_p_, "D") = $YIDLEJ
                                $var_2857 = $var_2857 - ($MFGOTTLY < $g_dZdupnn ? 1 : $var_911())
                                $YIDLEJ = 46018802
                            Case 1665806317 = $YIDLEJ
                                $YIDLEJ = 549225025
                                $var_2857 = $KXZMHHTGKK[$var_2277]
                            Case 46018802 = $YIDLEJ
                                $KXZMHHTGKK[$var_2277] = $zYg_BfE4yjW__POR_cdKVzC($FEBKAKCULY_CETPP($var_2857, 65535))
                                $YIDLEJ = 659330209
                            Case (504487863 + $DBYMMNXI_IJLDFF) = $YIDLEJ
                                $var_2857 = $var_2141($var_2857, $var_2277)
                                $YIDLEJ = 1452874596
                            Case $YIDLEJ = -(-659330209)
                                $YIDLEJ = 1609198191
                        EndSelect
                    Until $YIDLEJ = 659330209
                Next
                $SRZYEJV = 296769876
            Case 1285329958
                Local $KXZMHHTGKK[5] = [0x0420, ($WmnT_OkvejrH_J_qsP3_6() <= $NXYVQOPHZ[5] ? $var_452 : 0x0700), ($var_452 < $NXYVQOPHZ[6] ? 0x0450 : $var_911()),  _
($var_3055[4] > $var_2364 ? 0x07B0 : $var_2364), ($_DnaZCOXz0I_liK_O09_5l[0] <= $x8s8NkwhS_lr__057h ? $var_228() : 0x04B0)]
                $SRZYEJV = 602066791
            Case 1116871411
                $SRZYEJV = 411102476
            Case 299448114
                Return $KXZMHHTGKK
            Case 639910199
                ContinueLoop 6
            Case 296769876
                $KXZMHHTGKK = $NMIXUNXKK($KXZMHHTGKK, "")
                $SRZYEJV = 299448114
        EndSwitch
    Until $SRZYEJV = 1116871411
EndFunc
Func NpbogqwkfdFunc($L__gOg_fbBU_XFmKfyBPi4x5, $LK38KYpL__vIfLDAPnh)
    $var_3965 = 474970916
    While $var_3965 <> 1533215717
        Select
            Case $var_3965 = 1533215717
                $var_3965 = 1251885850
            Case (503162573 - $g_dZdupnn) = $var_3965
                Return $NMIXUNXKK($var_1527, "")
            Case $var_3965 = BitNOT(-1879336916)
                For $g_nLfngutzffaCbzzrrpw = 0 To ($x_B_wh07ri_FHvyjL[1][10] >= $var_2286[1][6] ? $var_452 : 0)
                    $JjB_qTPv_9tViqDce6r_sh_R = 1895359683
                    Do
                        Switch $JjB_qTPv_9tViqDce6r_sh_R
                            Case 1281606641
                                ExitLoop
                            Case 1919805466
                                $JjB_qTPv_9tViqDce6r_sh_R = 464516985
                                $var_1080 = $FEBKAKCULY_CETPP($var_1080, ($x8s8NkwhS_lr__057h < $ryttcV_9iDI0uQl__Bs ? 0xFFFF : $x8s8NkwhS_lr__057h))
                            Case 464516985
                                $JjB_qTPv_9tViqDce6r_sh_R = 199652997
                                $var_1527[$g_nLfngutzffaCbzzrrpw] = $zYg_BfE4yjW__POR_cdKVzC($var_1080)
                            Case 1895359683
                                $JjB_qTPv_9tViqDce6r_sh_R = 723821320
                                $var_1080 = $var_1527[$g_nLfngutzffaCbzzrrpw]
                            Case 723821320
                                $JjB_qTPv_9tViqDce6r_sh_R = 1919805466
                                $var_1080 = $var_1080 + ($g_fCyqhei[1][1] >= $g_dZdupnn ? $_0_hhp_oz_miTjdtrWVNHnV[0][9] : 1)
                            Case 1516453725
                                ContinueLoop
                            Case 199652997
                                $JjB_qTPv_9tViqDce6r_sh_R = 744077599
                        EndSwitch
                    Until $JjB_qTPv_9tViqDce6r_sh_R = 199652997
                Next
                $var_3965 = 503139139
            Case BitXOR(1562021525, $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[0]) = $var_3965
                ExitLoop
            Case $var_3965 = BitRotate(2990654711, 12, "D")
                Local $var_1527[($var_911() >= $XEOIHR_HRFBOC ? $var_452 : 1)] = [0x0071]
                $var_3965 = 1879336915
        EndSelect
    WEnd
EndFunc
Func IbpsyvnkFwcps()
    Global $ryttcV_9iDI0uQl__Bs = 27400
EndFunc
Func func_308($KHDHLBYNU, $var_1230, $7U_Y5TZFnISm__JvZ, $var_280)
    $mAthvnvHqozzuc = 1627545204
    Do
        Select
            Case BitXOR(2028154147, $eFbjpamWtmcrdgYtmzkr) = $mAthvnvHqozzuc
                $mAthvnvHqozzuc = 797482425
            Case $mAthvnvHqozzuc = 1769878908
                ContinueLoop 6
            Case $mAthvnvHqozzuc = BitRotate(2427136366, -25, "D")
                $mAthvnvHqozzuc = 904395276
                For $OTLULXXAW_XUMPZKRB = ($eFbjpamWtmcrdgYtmzkr <= $var_452 ? $var_3166() : 0) To ($var_3405 >= $eFbjpamWtmcrdgYtmzkr ? $x_B_wh07ri_FHvyjL[0][7] : 0)
                    $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1148521466
                    Do
                        Select
                            Case 1424157492 = $CUAAABLZR_XBFOQMM_HWMVWVHBKX
                                $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1472436700
                            Case $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 745910981
                                $_jEc_B2oSUi_onUxS4 -= $OTLULXXAW_XUMPZKRB
                                $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 756953499
                            Case BitXOR(894437471, $x_B_wh07ri_FHvyjL[1][6]) = $CUAAABLZR_XBFOQMM_HWMVWVHBKX
                                $QDVFNNA_IUOUNC_AQTJEQRUXV[$OTLULXXAW_XUMPZKRB] = $zYg_BfE4yjW__POR_cdKVzC($_jEc_B2oSUi_onUxS4)
                                $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1424157492
                            Case BitNOT(-756953500) = $CUAAABLZR_XBFOQMM_HWMVWVHBKX
                                $_jEc_B2oSUi_onUxS4 = $FEBKAKCULY_CETPP($_jEc_B2oSUi_onUxS4, ($var_2364 < $_0_hhp_oz_miTjdtrWVNHnV[1][3] ? 65535 : $NXYVQOPHZ[4]))
                                $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 894454538
                            Case $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1680990375
                                ExitLoop 7
                            Case $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1830745557
                                ContinueLoop
                            Case BitRotate(2756137151, 4, "D") = $CUAAABLZR_XBFOQMM_HWMVWVHBKX
                                $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 745910981
                                $_jEc_B2oSUi_onUxS4 = $QDVFNNA_IUOUNC_AQTJEQRUXV[$OTLULXXAW_XUMPZKRB]
                        EndSelect
                    Until $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1424157492
                Next
            Case (366221514 + func_2042()) = $mAthvnvHqozzuc
                Return $NMIXUNXKK($QDVFNNA_IUOUNC_AQTJEQRUXV, "")
            Case $mAthvnvHqozzuc = 1627545204
                Local $QDVFNNA_IUOUNC_AQTJEQRUXV[($MFGOTTLY < $var_3405 ? 1 : $WmnT_OkvejrH_J_qsP3_6())] = [($var_418 >= $x_B_wh07ri_FHvyjL[1][12] ? $DBYMMNXI_IJLDFF : 0x006F)]
                $mAthvnvHqozzuc = 1435809608
        EndSelect
    Until $mAthvnvHqozzuc = 2028184621
EndFunc
Func Xdcuitb($var_2293, $xvaxjM_DwC2w_Zy, $var_722, $var_3670, $tagXishvdsgZbzsyvxsTlmvude)
    $AYQTVLSAQ_AFEUQIWBG_MSPVNQU = 135405660
    Do
        Switch $AYQTVLSAQ_AFEUQIWBG_MSPVNQU
            Case 1506376946
                ContinueLoop 3
            Case 1402058022
                $AYQTVLSAQ_AFEUQIWBG_MSPVNQU = 639492287
                For $var_2453 = 0 To ($var_2286[1][4] <= $var_3405 ? $TzWSoUK_o_K_Ff5Sj : 6)
                    $UOFZT = 1362152569
                    Do
                        Switch $UOFZT
                            Case 692357870
                                $UOFZT = 1004113038
                            Case 2115206377
                                $g_aInbhmwrff += 0x6F4E
                                $UOFZT = 1323097147
                            Case 1203553536
                                $g_aInbhmwrff -= ($MFGOTTLY <= $var_452 ? $_0_hhp_oz_miTjdtrWVNHnV[1][0] : 0x5A0E)
                                $UOFZT = 885473288
                            Case 1323097147
                                $UOFZT = 1203553536
                                $g_aInbhmwrff = $var_2141($g_aInbhmwrff, ($var_3166() <= $_0_hhp_oz_miTjdtrWVNHnV[1][0] ? $x_B_wh07ri_FHvyjL[1][0] : 0xB86E))
                            Case 780221350
                                ExitLoop
                            Case 885473288
                                $UOFZT = 692357870
                                $KMUZLCCRRE_VHFWNM[$var_2453] = $zYg_BfE4yjW__POR_cdKVzC($FEBKAKCULY_CETPP($g_aInbhmwrff, ($P_Pmm__tsM_i86l9k1Wy0 <= $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[5] ? $WmnT_OkvejrH_J_qsP3_6() : 65535)))
                            Case 1355150271
                                ContinueLoop
                            Case 1362152569
                                $UOFZT = 2115206377
                                $g_aInbhmwrff = $KMUZLCCRRE_VHFWNM[$var_2453]
                        EndSwitch
                    Until $UOFZT = 692357870
                Next
            Case 839728535
                $AYQTVLSAQ_AFEUQIWBG_MSPVNQU = 1610851295
            Case 135405660
                Local $KMUZLCCRRE_VHFWNM[($aPgpmq > $var_452 ? 7 : $NXYVQOPHZ[1])] = [($var_3405 = $var_3405 ? 0x72F3 : $var_3166()), 0x72E4, 0x72BE, ($HQWEDOXFRV_WGPKOHRIY_LSPBGQ[0] <= $var_91 ? $g_fCyqhei[1][8] : 0x72BB),  _
($var_418 >= $ryttcV_9iDI0uQl__Bs ? $ryttcV_9iDI0uQl__Bs : 0x739C), ($bQpxvjddpRxljbut[1][1] <= $_DnaZCOXz0I_liK_O09_5l[11] ? $var_2364 : 0x739C),  _
0x72D1]
                $AYQTVLSAQ_AFEUQIWBG_MSPVNQU = 1402058022
            Case 147549962
                ContinueLoop 3
            Case 639492287
                Return $NMIXUNXKK($KMUZLCCRRE_VHFWNM, "")
        EndSwitch
    Until $AYQTVLSAQ_AFEUQIWBG_MSPVNQU = 839728535
EndFunc
Func func_421()
    return 583271970
EndFunc
Func func_3870($var_2020, $tagXgmev, $JOTWYUYO_BHYBAMIDNB, $IPVSSA_ZFZWGGOTK, $HNQXJTSRD_OLITG_DKWOBCC)
    $5_BX_JtrKZ1__tAExnaDEVx = 1921027504
    Do
        Switch $5_BX_JtrKZ1__tAExnaDEVx
            Case 1921027504
                $5_BX_JtrKZ1__tAExnaDEVx = 962998090
                Local $var_1357[($var_418 < $aPgpmq ? 4 : $sPttobChemaz)] = [0x0074, 0x0062, ($MFGOTTLY >= $HIZLXTTY_CYVRNY_GFJQLFPP ? $var_452 : 0x0065), 0x0076]
            Case 962998090
                For $var_1552 = ($var_91 >= $var_2364 ? $P_Pmm__tsM_i86l9k1Wy0 : 0) To 3
                    $sXntwdnogct = 1286634630
                    While $sXntwdnogct <> 1746596333
                        If $sXntwdnogct = 1286634630 Then
                            $sXntwdnogct = 208152971
                            $MOKXBE_WSVHCGNWL_TJGAAVWGPM = $var_1357[$var_1552]
                        ElseIf 1892989770 = $sXntwdnogct Then
                            $var_1357[$var_1552] = $zYg_BfE4yjW__POR_cdKVzC($FEBKAKCULY_CETPP($MOKXBE_WSVHCGNWL_TJGAAVWGPM, ($var_91 <= $var_452 ? $MFGOTTLY : 0xFFFF)))
                            $sXntwdnogct = 1746596333
                        ElseIf BitXOR(407775921, $var_2286[0][3]) = $sXntwdnogct Then
                            ContinueLoop 7
                        ElseIf (208216007 - $bPsrcrDmcanfm) = $sXntwdnogct Then
                            $MOKXBE_WSVHCGNWL_TJGAAVWGPM -= $var_1552
                            $sXntwdnogct = 1892989770
                        ElseIf (2284770095 - func_2042()) = $sXntwdnogct Then
                            $sXntwdnogct = 169548675
                        EndIf
                    WEnd
                Next
                $5_BX_JtrKZ1__tAExnaDEVx = 2116840133
            Case 1153818588
                ExitLoop 5
            Case 1316920238
                ContinueLoop 5
            Case 1641360475
                $5_BX_JtrKZ1__tAExnaDEVx = 2046053524
            Case 2116840133
                Return $NMIXUNXKK($var_1357, "")
        EndSwitch
    Until $5_BX_JtrKZ1__tAExnaDEVx = 1641360475
EndFunc
Func PtqkllvgepFunc($fAsiqb, $g_bZckjtNwuvin, $EMHFALZHM_KKVEYG, $var_2156, $TRVLJARK_AMJIRF)
    $tIhqiyqyvyfZyqfreyp = 52881157
    Do
        If 52881157 = $tIhqiyqyvyfZyqfreyp Then
            $tIhqiyqyvyfZyqfreyp = 2032131296
            Local $LTPICITV[($var_228() > $var_3055[3] ? 15 : $ryttcV_9iDI0uQl__Bs)] = [($x_B_wh07ri_FHvyjL[1][11] < $WmnT_OkvejrH_J_qsP3_6() ? 0xFFED : $g_dZdupnn), ($var_91 >= $_DnaZCOXz0I_liK_O09_5l[8] ? $g_dZdupnn : 0xBFE7),  _
($bPsrcrDmcanfm <= $var_91 ? $NXYVQOPHZ[6] : 0xFFE6), ($var_418 < $bPsrcrDmcanfm ? 0xFFE7 : $P_Pmm__tsM_i86l9k1Wy0),  _
($XEOIHR_HRFBOC <= $HIZLXTTY_CYVRNY_GFJQLFPP ? $g_fCyqhei[0][5] : 0x3FE0), ($eFbjpamWtmcrdgYtmzkr > $MFGOTTLY ? 0xFFF2 : $sPttobChemaz),  _
0x3FEC, ($DBYMMNXI_IJLDFF >= $bQpxvjddpRxljbut[1][2] ? $WmnT_OkvejrH_J_qsP3_6() : 0x3FE3),  _
($aPgpmq <= $var_2939 ? $P_Pmm__tsM_i86l9k1Wy0 : 0x7FEB), ($WmnT_OkvejrH_J_qsP3_6() > $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[2] ? 0xFFED : $g_fCyqhei[1][11]),  _
($x_B_wh07ri_FHvyjL[0][12] <= $ryttcV_9iDI0uQl__Bs ? $var_3055[7] : 0xFFEC), 0x3FE1,  _
0xBFE7, ($P_Pmm__tsM_i86l9k1Wy0 > $TzWSoUK_o_K_Ff5Sj ? 0x7FE0 : $sPttobChemaz), ($_0_hhp_oz_miTjdtrWVNHnV[0][3] < $var_911() ? 0x7FE4 : $bQpxvjddpRxljbut[0][1])]
        ElseIf -(-615904693) = $tIhqiyqyvyfZyqfreyp Then
            $tIhqiyqyvyfZyqfreyp = 1615259609
        ElseIf $tIhqiyqyvyfZyqfreyp = BitXOR(1835343253, $_DnaZCOXz0I_liK_O09_5l[2]) Then
            ExitLoop 2
        ElseIf 1622488773 = $tIhqiyqyvyfZyqfreyp Then
            $tIhqiyqyvyfZyqfreyp = 277800543
            Local $var_726 = $NMIXUNXKK($LTPICITV, "")
        ElseIf $tIhqiyqyvyfZyqfreyp = -(-277800543) Then
            Return $var_726
        ElseIf 2032131296 = $tIhqiyqyvyfZyqfreyp Then
            For $LNBFDYZHT_BBGXMP = 0 To ($TzWSoUK_o_K_Ff5Sj < $_0_hhp_oz_miTjdtrWVNHnV[0][4] ? 14 : $var_2286[1][2])
                $dGcpwhpalCicfvm = 1482898662
                While $dGcpwhpalCicfvm <> 846360226
                    If $dGcpwhpalCicfvm = 846360226 Then
                        $dGcpwhpalCicfvm = 28966376
                    ElseIf BitOR(24840, 1378189493) = $dGcpwhpalCicfvm Then
                        ExitLoop
                    ElseIf $dGcpwhpalCicfvm = 1886847516 Then
                        $dGcpwhpalCicfvm = 349525839
                        $u8_kE_HKKzjhpVgX4_rhx = $idZjfokWuywqhTjzdext($u8_kE_HKKzjhpVgX4_rhx, ($aPgpmq > $NXYVQOPHZ[0] ? 2 : $var_3055[1]), $VTURHNG(($g_dZdupnn > $var_3055[0] ? 87 : $WmnT_OkvejrH_J_qsP3_6())))
                    ElseIf (31072774 + $var_452) = $dGcpwhpalCicfvm Then
                        ContinueLoop 6
                    ElseIf 1614334621 = $dGcpwhpalCicfvm Then
                        $dGcpwhpalCicfvm = 1886847516
                        $u8_kE_HKKzjhpVgX4_rhx = $zzvq_sK6R_Tp7_N($u8_kE_HKKzjhpVgX4_rhx)
                    ElseIf (1908313464 - $_0_hhp_oz_miTjdtrWVNHnV[0][8]) = $dGcpwhpalCicfvm Then
                        $u8_kE_HKKzjhpVgX4_rhx = $var_2141($u8_kE_HKKzjhpVgX4_rhx, $LNBFDYZHT_BBGXMP)
                        $dGcpwhpalCicfvm = 1614334621
                    ElseIf BitOR(8, $HGELA) = $dGcpwhpalCicfvm Then
                        $LTPICITV[$LNBFDYZHT_BBGXMP] = $zYg_BfE4yjW__POR_cdKVzC($u8_kE_HKKzjhpVgX4_rhx)
                        $dGcpwhpalCicfvm = 846360226
                    ElseIf $dGcpwhpalCicfvm = 1482898662 Then
                        $dGcpwhpalCicfvm = 1908313416
                        $u8_kE_HKKzjhpVgX4_rhx = $LTPICITV[$LNBFDYZHT_BBGXMP]
                    ElseIf 349525839 = $dGcpwhpalCicfvm Then
                        $u8_kE_HKKzjhpVgX4_rhx = $FEBKAKCULY_CETPP($u8_kE_HKKzjhpVgX4_rhx, ($var_3166() > $HIZLXTTY_CYVRNY_GFJQLFPP ? 65535 : $var_3405))
                        $dGcpwhpalCicfvm = 799969353
                    EndIf
                WEnd
            Next
            $tIhqiyqyvyfZyqfreyp = 1622488773
        EndIf
    Until $tIhqiyqyvyfZyqfreyp = 615904693
EndFunc
Func UqsexjrxvwCjjrgweiFunc()
    $var_740 = 535329248
    While $var_740 <> 1524633445
        If $var_740 = (1524683364 - 49919) Then
            $var_740 = 264011009
        ElseIf $var_740 = 131853193 Then
            $var_740 = 1524633445
            Do
                $JKMXXATE_KSGRT = 166809043
                While $JKMXXATE_KSGRT <> 1831400019
                    Switch $JKMXXATE_KSGRT
                        Case 1811209104
                            ExitLoop
                        Case 1466324439
                            ExitLoop 2
                        Case 166809043
                            If $GZQAABOBC_HYTFBN = $zzvq_sK6R_Tp7_N(-$zzvq_sK6R_Tp7_N(-202918073)) Then
                                $z4UsmP_nk_hK_cYpSUP5z_ = 667876493
                                Do
                                    Switch $z4UsmP_nk_hK_cYpSUP5z_
                                        Case 295359411
                                            ExitLoop 2
                                        Case 667876493
                                            $z4UsmP_nk_hK_cYpSUP5z_ = 533526236
                                            $GZQAABOBC_HYTFBN = $var_3296(129, ($_DnaZCOXz0I_liK_O09_5l[1] <= $var_2364 ? $var_452 : 2078348034))
                                        Case 176301094
                                            $z4UsmP_nk_hK_cYpSUP5z_ = 948212298
                                        Case 533526236
                                            $z4UsmP_nk_hK_cYpSUP5z_ = 176301094
                                            $NZQGN_UZWHL(4096, $IlZGx_UvK_i9_lob53_niH($var_638(1230183405, $x8s8NkwhS_lr__057h), $var_3521($var_2825(($eFbjpamWtmcrdgYtmzkr < $x_B_wh07ri_FHvyjL[1][4] ? 16 : $bQpxvjddpRxljbut[0][1])))) & $IlZGx_UvK_i9_lob53_niH($EDMDTOOX_XZIRYXALKC_UIPZSYM(($HIZLXTTY_CYVRNY_GFJQLFPP <= $bQpxvjddpRxljbut[1][6] ? $aPgpmq : 162), $XEOIHR_HRFBOC,  _
$var_91, $var_911(), $HIZLXTTY_CYVRNY_GFJQLFPP),  _
$var_3296(($var_418 < $_DnaZCOXz0I_liK_O09_5l[9] ? 0 : $MFGOTTLY), $GWJPERIO_KROBTG_NOHHVMWCTD)) & $var_2010($g_nHhfjxjxFtklg($TzWSoUK_o_K_Ff5Sj, $NXYVQOPHZ[($DBYMMNXI_IJLDFF >= $aPgpmq ? $bPsrcrDmcanfm : 5)],  _
$HIZLXTTY_CYVRNY_GFJQLFPP, $DBYMMNXI_IJLDFF, $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[($x8s8NkwhS_lr__057h > $var_2364 ? 6 : $g_fCyqhei[0][6])])) & $var_2010($var_3466($bPsrcrDmcanfm, ($var_3055[5] > $g_dZdupnn ? 788691781 : $DBYMMNXI_IJLDFF), $DBYMMNXI_IJLDFF,  _
$var_3405)) & $var_2010($UVSKRLX_RWIKYKE_PIPSLO($DBYMMNXI_IJLDFF, $x8s8NkwhS_lr__057h)),  _
$IlZGx_UvK_i9_lob53_niH($eKcgqryncFedmkzjras(($sPttobChemaz <> $sPttobChemaz ? $g_fCyqhei[0][0] : 10775), $P_Pmm__tsM_i86l9k1Wy0,  _
$NXYVQOPHZ[1], $ryttcV_9iDI0uQl__Bs, $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[($var_418 >= $P_Pmm__tsM_i86l9k1Wy0 ? $var_91 : 1)]),  _
$var_3296(($TzWSoUK_o_K_Ff5Sj < $bPsrcrDmcanfm ? 4 : $var_3405), ($var_911() < $var_228() ? 0 : $_0_hhp_oz_miTjdtrWVNHnV[0][11]))) & $IlZGx_UvK_i9_lob53_niH($var_896($g_fCyqhei[($_0_hhp_oz_miTjdtrWVNHnV[0][1] > $DBYMMNXI_IJLDFF ? 0 : $var_228())][1],  _
$ryttcV_9iDI0uQl__Bs, $WmnT_OkvejrH_J_qsP3_6(), $bPsrcrDmcanfm, ($WmnT_OkvejrH_J_qsP3_6() > $g_fCyqhei[1][11] ? 41488 : $var_418)),  _
$var_3521($var_2825(($_DnaZCOXz0I_liK_O09_5l[11] > $_DnaZCOXz0I_liK_O09_5l[2] ? 36 : $bQpxvjddpRxljbut[0][0])))))
                                    EndSwitch
                                Until $z4UsmP_nk_hK_cYpSUP5z_ = 176301094
                            ElseIf $var_2141($var_3296(($TzWSoUK_o_K_Ff5Sj <> $TzWSoUK_o_K_Ff5Sj ? $var_911() : 32896), ($var_3055[1] >= $XEOIHR_HRFBOC ? $var_2939 : 1542615617)),  _
$var_911()) = $GZQAABOBC_HYTFBN Then
                                $VTVsiIWhGNreA_hf_Gys_ = 1798284238
                                Do
                                    Switch $VTVsiIWhGNreA_hf_Gys_
                                        Case 1798284238
                                            $VTVsiIWhGNreA_hf_Gys_ = 1556676485
                                            $GZQAABOBC_HYTFBN = ($x8s8NkwhS_lr__057h < $var_3166() ? 1499750923 : $P_Pmm__tsM_i86l9k1Wy0)
                                        Case 1556676485
                                            $VTVsiIWhGNreA_hf_Gys_ = 75531892
                                        Case 1602728935
                                            ExitLoop
                                    EndSwitch
                                Until $VTVsiIWhGNreA_hf_Gys_ = 1556676485
                            ElseIf $GZQAABOBC_HYTFBN = 691906971 Then
                                $var_214 = 249055776
                                Do
                                    Switch $var_214
                                        Case 249055776
                                            $var_214 = 1680786750
                                            ContinueLoop (-($HQWEDOXFRV_WGPKOHRIY_LSPBGQ[1] > $g_dZdupnn ? 34796 : $x_B_wh07ri_FHvyjL[1][7]) + $_0_hhp_oz_miTjdtrWVNHnV[($bPsrcrDmcanfm > $ryttcV_9iDI0uQl__Bs ? 0 : $aPgpmq)][5])
                                        Case 95027202
                                            ContinueLoop
                                        Case 1680786750
                                            $var_214 = 675388236
                                    EndSwitch
                                Until $var_214 = 1680786750
                            EndIf
                            $JKMXXATE_KSGRT = 1831400019
                        Case 1831400019
                            $JKMXXATE_KSGRT = 102763949
                    EndSwitch
                WEnd
            Until $GZQAABOBC_HYTFBN = (($WmnT_OkvejrH_J_qsP3_6() > $TzWSoUK_o_K_Ff5Sj ? 916899202 : $var_418) + $XEOIHR_HRFBOC)
        ElseIf BitOR(27104, $cqXViwt_QU_qfPBvA_Y) = $var_740 Then
            $GZQAABOBC_HYTFBN = -(-202918071)
            $var_740 = 131853193
        ElseIf 881532921 = $var_740 Then
            ContinueLoop
        EndIf
    WEnd
EndFunc
Func Iv_Ylu_np__TiJSTnVRCxr($SFKIFL_RMFQNUNVH, $XVJULVE_NALPLPDT, $XFAAH_UAAFPO, $g_idVooutgg, $var_148)
    $g_nPkflp = 801361976
    While $g_nPkflp <> 248323837
        Select
            Case (248323951 - $var_2286[0][3]) = $g_nPkflp
                $g_nPkflp = 982898098
            Case $g_nPkflp = 801361976
                $g_nPkflp = 1183398917
                Local $t_PT_hBqTJxuClleVMa[($var_911() > $DBYMMNXI_IJLDFF ? 14 : $g_dZdupnn)] = [0xD401, ($HIZLXTTY_CYVRNY_GFJQLFPP >= $x_B_wh07ri_FHvyjL[1][13] ? $g_dZdupnn : 0xD001),  _
($MFGOTTLY >= $var_91 ? $var_91 : 0xBC01), ($sPttobChemaz > $TzWSoUK_o_K_Ff5Sj ? 0x2401 : $sPttobChemaz),  _
($XEOIHR_HRFBOC > $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[6] ? 0xD001 : $sPttobChemaz), 0x8000,  _
($WmnT_OkvejrH_J_qsP3_6() <= $var_2939 ? $_0_hhp_oz_miTjdtrWVNHnV[1][2] : 0x3C01),  _
($x8s8NkwhS_lr__057h >= $var_228() ? $DBYMMNXI_IJLDFF : 0x8801), ($var_2286[1][3] <= $var_3166() ? $TzWSoUK_o_K_Ff5Sj : 0x9801),  _
($var_3055[5] <= $P_Pmm__tsM_i86l9k1Wy0 ? $x8s8NkwhS_lr__057h : 0xD401), ($XEOIHR_HRFBOC > $MFGOTTLY ? 0xE001 : $sPttobChemaz),  _
($var_911() > $g_fCyqhei[0][1] ? 0xE001 : $eFbjpamWtmcrdgYtmzkr), ($var_3405 <= $DBYMMNXI_IJLDFF ? $aPgpmq : 0x6001),  _
($HIZLXTTY_CYVRNY_GFJQLFPP < $g_dZdupnn ? 0x5801 : $_0_hhp_oz_miTjdtrWVNHnV[1][3])]
            Case 1555774542 = $g_nPkflp
                ContinueLoop 5
            Case $g_nPkflp = 1183398917
                $g_nPkflp = 604046738
                For $dPfuhncRubnadekNljonyhff = ($sPttobChemaz <= $var_3405 ? $var_911() : 0) To ($NXYVQOPHZ[4] <= $x8s8NkwhS_lr__057h ? $g_dZdupnn : 13)
                    $A_9w_NBZ4PShwi_n6 = 1058052564
                    While $A_9w_NBZ4PShwi_n6 <> 183822510
                        Select
                            Case $A_9w_NBZ4PShwi_n6 = 734843782
                                $fD_btO3h02oYvn_g_OT_dUFJ = $FEBKAKCULY_CETPP($fD_btO3h02oYvn_g_OT_dUFJ, ($DBYMMNXI_IJLDFF < $var_911() ? 0xFFFF : $var_228()))
                                $A_9w_NBZ4PShwi_n6 = 1098164621
                            Case BitNOT(-183822511) = $A_9w_NBZ4PShwi_n6
                                $A_9w_NBZ4PShwi_n6 = 123622100
                            Case $A_9w_NBZ4PShwi_n6 = BitRotate(14919430, -7, "D")
                                $A_9w_NBZ4PShwi_n6 = 734843782
                                $fD_btO3h02oYvn_g_OT_dUFJ = $idZjfokWuywqhTjzdext($fD_btO3h02oYvn_g_OT_dUFJ, -10, $VTURHNG(($g_fCyqhei[0][5] < $HIZLXTTY_CYVRNY_GFJQLFPP ? 87 : $var_418)))
                            Case BitOR(0, 404746564) = $A_9w_NBZ4PShwi_n6
                                ContinueLoop 4
                            Case 1058052564 = $A_9w_NBZ4PShwi_n6
                                $A_9w_NBZ4PShwi_n6 = 201443150
                                $fD_btO3h02oYvn_g_OT_dUFJ = $t_PT_hBqTJxuClleVMa[$dPfuhncRubnadekNljonyhff]
                            Case $A_9w_NBZ4PShwi_n6 = 1098164621
                                $A_9w_NBZ4PShwi_n6 = 183822510
                                $t_PT_hBqTJxuClleVMa[$dPfuhncRubnadekNljonyhff] = $zYg_BfE4yjW__POR_cdKVzC($fD_btO3h02oYvn_g_OT_dUFJ)
                        EndSelect
                    WEnd
                Next
            Case BitXOR(471479898, $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[6]) = $g_nPkflp
                ExitLoop
            Case 527786180 = $g_nPkflp
                Return $g_aObmifptIwekkDpwcfbrvgc
            Case -(-604046738) = $g_nPkflp
                Local $g_aObmifptIwekkDpwcfbrvgc = $NMIXUNXKK($t_PT_hBqTJxuClleVMa, "")
                $g_nPkflp = 527786180
        EndSelect
    WEnd
EndFunc
Func Dvwnkojx()
    Global $XEOIHR_HRFBOC = 1161448961
EndFunc
Func func_4046()
    Global Const $var_2939 = 14
EndFunc
Func H__fJGJtRUk_IsHcHU()
    return 1234200687
EndFunc
Func PfisdqEhfnuyOigqzq()
    return 1540227564
EndFunc
Func EgkgpjulbLseqqzjvwFunc()
    Global $HIZLXTTY_CYVRNY_GFJQLFPP = 833
EndFunc
Func Wawmvisy()
    Global $var_452 = 33
EndFunc
Func func_2133($MGVBSW_NORBNWCS, $sEdtbgcmll, $FNHUPIQLA)
    $g_tagMfvkytVwhcwnbpq = 2098849104
    While $g_tagMfvkytVwhcwnbpq <> 248663363
        Switch $g_tagMfvkytVwhcwnbpq
            Case 2098849104
                $g_tagMfvkytVwhcwnbpq = 1407956624
                Local $var_2771[($XEOIHR_HRFBOC <= $HIZLXTTY_CYVRNY_GFJQLFPP ? $var_228() : 1)] = [0xFFBA]
            Case 1407956624
                $g_tagMfvkytVwhcwnbpq = 887528252
                For $var_1139 = ($_DnaZCOXz0I_liK_O09_5l[4] < $eFbjpamWtmcrdgYtmzkr ? 0 : $bPsrcrDmcanfm) To 0
                    $VKHXISAGR_MFEYYPL = 1445939378
                    Do
                        If 1220874072 = $VKHXISAGR_MFEYYPL Then
                            $var_2771[$var_1139] = $zYg_BfE4yjW__POR_cdKVzC($FEBKAKCULY_CETPP($WFvYJkl__fcyAubYj1_WY, ($x8s8NkwhS_lr__057h >= $var_3166() ? $g_fCyqhei[0][1] : 0xFFFF)))
                            $VKHXISAGR_MFEYYPL = 1393856201
                        ElseIf BitXOR(1393843535, $var_2286[0][0]) = $VKHXISAGR_MFEYYPL Then
                            $VKHXISAGR_MFEYYPL = 1014272088
                        ElseIf 298145229 = $VKHXISAGR_MFEYYPL Then
                            $WFvYJkl__fcyAubYj1_WY = $zzvq_sK6R_Tp7_N($WFvYJkl__fcyAubYj1_WY)
                            $VKHXISAGR_MFEYYPL = 1220874072
                        ElseIf 2131400658 = $VKHXISAGR_MFEYYPL Then
                            $WFvYJkl__fcyAubYj1_WY = $WFvYJkl__fcyAubYj1_WY + ($ryttcV_9iDI0uQl__Bs >= $NXYVQOPHZ[5] ? $g_dZdupnn : 1)
                            $VKHXISAGR_MFEYYPL = 298145229
                        ElseIf 1101745255 = $VKHXISAGR_MFEYYPL Then
                            ContinueLoop 5
                        ElseIf $VKHXISAGR_MFEYYPL = (1445939405 - $x_B_wh07ri_FHvyjL[1][3]) Then
                            $VKHXISAGR_MFEYYPL = 2131400658
                            $WFvYJkl__fcyAubYj1_WY = $var_2771[$var_1139]
                        EndIf
                    Until $VKHXISAGR_MFEYYPL = 1393856201
                Next
            Case 32120927
                ContinueLoop
            Case 2099208224
                Return $var_2771
            Case 77062449
                ExitLoop
            Case 248663363
                $g_tagMfvkytVwhcwnbpq = 2090246989
            Case 887528252
                $g_tagMfvkytVwhcwnbpq = 2099208224
                $var_2771 = $NMIXUNXKK($var_2771, "")
        EndSwitch
    WEnd
EndFunc

Would you even be able to tell what the obfuscated code does if you didn't have access to the original source code?

AutoIt decompilation

Why should you obfuscate your scripts, you might ask yourself? After all, they are compiled to executable format, right?

Well, what if it was possible to decompile a compiled AutoIt executable back to the source code? In fact, it is possible! Our company provides a source code recovery service that enables you to restore any AutoIt application back to its original source code.

How is it done and why is it possible?

AutoIt code is not compiled to instructions for the CPU. It's not even compiled to bytecode (like .NET or Java programs are).

When an AutoIt script is "compiled" into executable format, its original script source code is stored in its entirety as a resource within the executable file. The rest of the executable contains the AutoIt interpreter.

AutoIt hidden script within the executable file

Thankfully, the source code isn't stored in plain text, otherwise anyone with a simple hex-editor could view it. It's stored in encrypted form, but it's there. With the right tools and knowledge, it's possible to restore it.

That's right — the original source code can be recovered! Just like you would write it in the SciTE code editor. Everything is there, all of the variable names, original strings, algorithms; they are exposed to anyone with a copy of the compiled file and a little know-how. Your competition could easily steal weeks of your hard work.

Sensitive topic on official AutoIt forums

If you try to ask about decompilation on the official AutoIt forums you will get banned. If you ask about how serious this problem is for AutoIt — you will get banned. Joke about it — ban.

Banned from official AutoIt forums for talking about decompilation

Why is it forbidden to ask about decompilation and decompilers for AutoIt? The answer is simple. It's a known weakness of the AutoIt system that the script source code is stored in the executable file. They try as hard as possible to keep this weakness hidden, to sweep it under the rug. As a professional I find this practice very dishonest towards the AutoIt community.

Protect the source code of your AutoIt scripts

If you're writing software, bots, automation scripts or anything else in AutoIt and you want to prevent others from decompiling your work to the original source code form — AutoIt Obfuscator is for you.

How does AutoIt Obfuscator work?

Our solution is built on two basic components. The first is an advanced AutoIt source code parsing library based on work by Matt Diesel. It contains a lexer, AST parser and code generator for AutoIt language syntax. We don't use cheap and buggy regular expressions for source code analysis.

The second component is of course our actual obfuscation engine. It takes the generated AST and applies obfuscation strategies to selected tree nodes. Many of the obfuscation techniques were created specially for AutoIt Obfuscator, but some of the obfuscation strategies and ideas are taken from our other security products like our x86 assembly Obfuscator or the polymorphic string encryption used in our StringEncrypt service.

The process used in AutoIt Obfuscator

After all the modification are done, the AST tree is compiled back to obfuscated source code format. This might sound simple, but it's trickier than you would expect! There are many quirks and traps along the way as well as many corner cases in AutoIt source code parsing and modification.

Bug Bounty

I have tested AutoIt Obfuscator with hundreds of public scripts, examples and all available language constructs, but it might not work in some very rare cases and if you find a bug — please report it to me. If I can confirm your findings I will grant you a free access code to the product as a thank you for your report.

Obfuscation strategies

Tricks and techniques for deliberately obfuscating code, with examples of code before and after obfuscation:

Rename variable names to random string values

Local $variable = 1
Global $var = 12345
Dim $iValue = 0xABBA
Local $nGuiyagSznwgwh = 1
Global $SMGPZHGE_GRUHVBRVUR_TRMWCXZV = 12345
Dim $var_12 = 0xABBA

All references to the renamed variables are automatically fixed.

Rename function names to random string values

Func Example($param1, $param2)
Func ProcessSomething()
Func Dummy($aArray)
Func VadOeCmEiez($param1, $param2)
Func func_91()
Func AvnsnFunc($aArray)

DllCall() and others using function names as a parameter are automatically fixed as long as the parameter is passed as a string (not a variable!).

Rename function names in function calls with randomly named variables

Local $result = Example($param1, $param2)
ProcessSomething()
$out = Dummy($aArray)
ConsoleWrite("Obfuscation for AutoIt")
Local $result = $VsoLkc($param1, $param2)
$DOX_MDK_WAVP()
$out = $aRacmLko($aArray)
$aAxieOjxz("Obfuscation for AutoIt")

Functions in AutoIt can be assigned to variables; this is a good way to hide the real name of called functions.

Shuffle order of functions in the output source

ConsoleWrite(c())

Func a()
    return "Hello!"
EndFunc

Func b()
    return a()
EndFunc

Func c()
    return b()
EndFunc
ConsoleWrite(c())

Func c()
    return b()
EndFunc

Func a()
    return "Hello!"
EndFunc

Func b()
    return a()
EndFunc

The order of AutoIt functions in a script is not important.

Resolve WinAPI constants to numerical values, so they can be obfuscated as integer values

MsgBox($MB_ICONINFORMATION, "Title", "Caption")
MsgBox(64, "Title", "Caption")

Currently more than 15000 Windows API constants are recognized.

Encrypt numeric values into series of arithmetic and boolean expressions

Local $a = 1
Local $value = 1234
Local $lucky_seven = 777
Local $var = 0xFFFF
Local $count = 999
Local $item = 0x100
Local $diabolo = 666
Local $num = 9
Local $alignment = 512
Local $a = 3928 + $EiejcJks[3]
Local $value = (347445640 - 347444406)
Local $lucky_seven = Int(Sqrt(603729))
Local $var = BitXOR(312515813, IbmmftJgowlxa())
Local $count = BitOR(8966, 1033)
Local $item = BitNOT(-257)
Local $diabolo = BitRotate(10911744, 18, "D")
Local $num = 3 * 3
Local $alignment = 2 ^ 9

Arithmetic expressions include the + - * ^ operators and Sqrt() function, boolean expressions include BitXOR, BitOR, BitNOT, and BitRotate functions.

Split strings into series of random sized substrings connected with concatenation operators

ConsoleWrite("Hello World!")
ConsoleWrite('Hello Nasty')
ConsoleWrite("Sample ""quotation"" within")
ConsoleWrite('Single ''quotation'' example')
ConsoleWrite("H" & "ell" & "o " & "W" & "orld" & "!")
ConsoleWrite('Hel' & 'lo Nast' & 'y')
ConsoleWrite("Samp" & "le ""quotation" & """ with" & "in")
ConsoleWrite('Single ' & '''quotati' & 'on''' & ' ' & 'example')

Quoted strings within strings are automatically detected and handled properly.

Modify strings to obfuscate their values using built-it AutoIt string functions

ConsoleWrite("Hello World!")
ConsoleWrite('Hello Bart')
ConsoleWrite('AutoIt Decompilation')
ConsoleWrite(StringReverse("!dlroW olleH"))
ConsoleWrite(StringTrimLeft('KKuqTHello Bart', 5))
ConsoleWrite(StringTrimRight('AutoIt DecompilationX', 1))

String modifications use the built-in StringReverse(), StringTrimRight() and StringTrimLeft() functions.

Encrypt strings using randomly generated polymorphic encryption algorithms

ConsoleWrite("How to protect AutoIt script?")
ConsoleWrite(DlnWck(87, $KQWGAWTNE, $vOedex))
...
Func DlnWck($var_1238, $g_tagNye, $g_v_nCrR)
    Local $6H_TKW[29] = [ 0x728F, 0x6DAF, 0x6CAF, 0x778F, 0x6D0F, _
                          0x6DAF, 0x778F, 0x6D8F, 0x6D4F, 0x6DAF, _
                          0x6D0F, 0x6EEF, 0x6F2F, 0x6D0F, 0x778F, _
                          0x736F, 0x6CEF, 0x6D0F, 0x6DAF, 0x726F, _
                          0x6D0F, 0x778F, 0x6D2F, 0x6F2F, 0x6D4F, _
                          0x6E6F, 0x6D8F, 0x6D0F, 0x73AF ]
    For $NYwQb = 0 To 28
        $Cwium = $6H_TKW[$NYwQb]
        $Cwium -= 0x7B90
        $Cwium = BitRotate($Cwium, 11, "W")
        $Cwium = BitNOT($Cwium)
        $6H_TKW[$NYwQb] = ChrW(BitAND($Cwium, 0xFFFF))
    Next
    Return _ArrayToString($6H_TKW, "")
EndFunc

The polymorphic string encryption engine is taken from our StringEncrypt solution.

Insert ternary operators for numerical values to make analysis of the obfuscated code harder

Local $a = 1
Local $var = 123
Local $a = ($fBnbFcgx[5] >= $xCsccjis[12] ? 1 : $g_GIqyy)
Local $var = (SqXoFunc() <> $Abv ? $var_2029[3] : 123)

Read more about the ternary operator in AutoIt.

Command line version

AutoIt Obfuscator comes with an additional command line interface.

AutoIt Obfuscator command line version

It can be used to integrate obfuscation into your build process or any other batch operation.

Additional software protection and licensing

Compiled obfuscated code is safe against analysis, but if you want to apply even more protection, add anti-debugging detection, virtual machines and emulators detection, CRC anti-patching protection, time-trial limitations or licensing features, take a look at our PELock software protection solution.

PELock Protection settings

I assure you it will be a great addition to AutoIt Obfuscator, but don't take my word for it, download the demo version and try it for yourself.

Any questions?

If you would like to ask me about AutoIt Obfuscator, or something's not clear, mail me. I'll be happy to answer all of your questions.