AutoIt Obfuscator — AutoIt Script Source Code Obfuscation
AutoIt Obfuscator lets you protect your AutoIt script source code against analysis, reverse engineering & decompilation by using multiple advanced obfuscation techniques and polymorphic encryption.
What is AutoIt?
AutoIt is a scripting language for the Windows platform. It has evolved greatly from its first releases and now it's a mature product capable of creating whole applications, both console and windows based. Over time it has become a powerful language that supports complex expressions, user functions, loops and everything else that veteran scripters would expect.
It is widely used for fast and simple GUI automation tasks. It uses a combination of simulated keystrokes, mouse movement and window/control manipulation in order to automate tasks in a way not possible or reliable with other languages.
AutoIt script source code obfuscation
Obfuscation is the process of transforming AutoIt source code into a protected version of itself. The script functionality stays the same, everything works the same, but the source code is protected from analysis, all of the variables are encrypted, and all strings are encrypted.
AutoIt Obfuscator uses multiple obfuscation strategies to protect the real meaning of your AutoIt source code.
Look at this example and click the "After obfuscation" tab to understand how AutoIt Obfuscator works:
- Before obfuscation
- After obfuscation
#include <MsgBoxConstants.au3>
Example()
Func Example()
MsgBox($MB_SYSTEMMODAL, "AutoIt Obfuscator", "Hello World!")
EndFunc ;==>Example;////////////////////////////////////////////////////////////////////////////////
;//
;// AutoIt Obfuscator v1.2 - Bartosz Wójcik
;//
;// Website : https://www.pelock.com/products/autoit-obfuscator
;// Version : v1.2
;// Date : 09.11.2016
;//
;////////////////////////////////////////////////////////////////////////////////
#include <Array.au3>
#AutoIt3Wrapper_Tidy_Stop_OnError=n
#AutoIt3Wrapper_Run_AU3Check=n
Global Const $TzWSoUK_o_K_Ff5Sj = Asc("2")
#OnAutoItStartRegister "Dvwnkojx"
Global Const $g_fCyqhei[2][12] = [[2063123760, 29310, 32, 190, 73055682, 165, 154], [627776834, 66, 64891, 187, 219, 824633971, 198062827, 1612, 64556, 27806, 12, 64276]]
Global $var_91 = Asc("W")
#OnAutoItStartRegister "IbpsyvnkFwcps"
Global Const $_0_hhp_oz_miTjdtrWVNHnV[2][12] = [[29945, 57833, 3693, 67, 24005, 34803, 209, 64282, 48, 27878, 10, 2], [91, 1, 523435560, 248]]
Global Const $eFbjpamWtmcrdgYtmzkr = 35086
Global Const $MFGOTTLY = Asc("9")
Global $x8s8NkwhS_lr__057h = 197
Global Const $P_Pmm__tsM_i86l9k1Wy0 = 204
Global $bQpxvjddpRxljbut[2][12] = [[415403296, 111], [11926, 1407128997, 31135, 185594694, 47717, 14769, 121, 12808, 52, 20331, 74, 519475019]]
Global Const $bPsrcrDmcanfm = 63036
Global Const $var_2286[2][16] = [[54150, 34400, 319180750, 114], [249, 358803285, 173, 2086763066, 45957, 21107, 977032919, 80, 14433, 137, 217, 23429, _
43767, 219, 63036, 923804633]]
#OnAutoItStartRegister "Wawmvisy"
Global $var_2364 = Asc("j")
#OnAutoItStartRegister "func_4046"
Global $var_3055[12] = [232, 155, 33396, 991869286, 54242, 568794891, 51866, 145, 841723459, 1296486683, _
4539, 1052749213]
Global $g_dZdupnn = 23434
Global $x_B_wh07ri_FHvyjL[2][14] = [[128, 48969, 2138057828, 1296299644, 131, 44615491, 143, 122, 435757233, 40, 44, 32892, _
1244895380], _
[37021, 252, 1592146808, 27, 52323, 29507, 17237, 285115765, 160, 1291940763, 40, _
5716, 57427, 28541]]
Global Const $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[10] = [45894, 28141, 58636, 55, 9363, 142, 166521229, 1000217573, 34412, 100]
#OnAutoItStartRegister "EgkgpjulbLseqqzjvwFunc"
Global Const $_DnaZCOXz0I_liK_O09_5l[13] = [123109389, 14223, 5007, 221241792, 213, 43322, 18846, 759001477, 126, 1948733066, _
1722969202, 35379, 35834]
Global Const $DBYMMNXI_IJLDFF = Asc("5")
Global Const $var_418 = 79
Global $NXYVQOPHZ[7] = [93, 35933, 26541, 44, 16024, 35248, 299188747]
#OnAutoItStartRegister "BwywrFunc"
Global Const $aPgpmq = 179
Global Const $sPttobChemaz = 118
Global $kAF7_F_C08e_fV_1wJklw = 106
Global $g_dOfkjobnohQrqryrovmv = 1360675040
Global $cqXViwt_QU_qfPBvA_Y = 535302144
Global $HGELA = 799969345
Global $var_702 = 5
Global $u5y_vWFUXmT54LcnM__ = 197
Global $yg_f_kQ3r6Ncs_o9_e6ymFtnU = 410833152
Global $rJKeHnSWZSmMencIf_p_ = 2
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 683101943
Do
If (1086691258 - func_2042()) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 2145539946
Global $var_2141 = BitXOR
ElseIf 136764320 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 981565012
Global $NMIXUNXKK = _ArrayToString
ElseIf 2145539946 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1939713100
Global $eKcgqryncFedmkzjras = PtqkllvgepFunc
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 312336526 Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1340993918
Global $var_911 = func_2042
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1783462431 Then
Global $VAFHSO_NFQCDMSET_FBEQGW = ($var_2364 < $NXYVQOPHZ[4] ? 33 : $var_911())
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 377975485
ElseIf -(-254826652) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
Global $SRBLEVZF = ($WmnT_OkvejrH_J_qsP3_6() < $x_B_wh07ri_FHvyjL[0][12] ? 20 : $DBYMMNXI_IJLDFF)
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1791774600
ElseIf -(-1426171412) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 837828767
Global $WmnT_OkvejrH_J_qsP3_6 = func_421
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 515578572 Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1300097581
Global $VTURHNG = Chr
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 377975485 Then
Global $GWJPERIO_KROBTG_NOHHVMWCTD = 4
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 254826652
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = -(-114113507) Then
Global $var_3521 = Int
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 515578572
ElseIf 1737043033 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 312336526
Global $UVSKRLX_RWIKYKE_PIPSLO = NpbogqwkfdFunc
ElseIf BitNOT(-1184752091) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
Global $FEBKAKCULY_CETPP = BitAND
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 136764320
ElseIf 1504979127 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 114113507
Global $var_3166 = H__fJGJtRUk_IsHcHU
ElseIf (842770224 + $var_418) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
Global $var_638 = BgwcitOvvmqsLkslomdemu
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1667864091
ElseIf BitOR(76, $yg_f_kQ3r6Ncs_o9_e6ymFtnU) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
Global $EDMDTOOX_XZIRYXALKC_UIPZSYM = Iv_Ylu_np__TiJSTnVRCxr
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 842770303
ElseIf BitOR(6, $g_dOfkjobnohQrqryrovmv) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
Global $var_2825 = Sqrt
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1184752090
ElseIf 1631038363 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
Global $var_228 = PfisdqEhfnuyOigqzq
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 188052903
ElseIf 1667864091 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1783462431
Global $g_nHhfjxjxFtklg = func_3870
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = -(-1939713100) Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 410833228
Global $zzvq_sK6R_Tp7_N = BitNOT
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 683101943 Then
Global $var_896 = Xdcuitb
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1360675046
ElseIf 188052903 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
Global $var_2010 = StringReverse
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1737043033
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 288720335 Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1504979127
Global $zYg_BfE4yjW__POR_cdKVzC = ChrW
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1479232499 Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1426171412
Global $3_Bj_h9TkT3xrvWW_CN7_ = UqsexjrxvwCjjrgweiFunc
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = BitOR(4616, 143819860) Then
Global $TZTPKFQRJT_AXSEX_DJSOKLIL = func_2133
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 288720335
ElseIf BitNOT(-1103488573) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
While $idZvmnghsKgebqrdxylMfpxf <> 2107674666
$var_571 = 905717111
Do
Switch $var_571
Case 1059758732
ExitLoop 6
Case 905717111
If $idZvmnghsKgebqrdxylMfpxf = -(-(2107674560 + $var_2364)) Then
$var_1452 = 1105868731
Do
Switch $var_1452
Case 1105868731
$var_1452 = 801048409
$idZvmnghsKgebqrdxylMfpxf = $idZjfokWuywqhTjzdext(($TzWSoUK_o_K_Ff5Sj >= $var_91 ? $x_B_wh07ri_FHvyjL[0][12] : 2426767168), $SRBLEVZF, _
$TZTPKFQRJT_AXSEX_DJSOKLIL(($g_fCyqhei[1][2] < $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[7] ? 150 : $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[3]), _
$aPgpmq, $XEOIHR_HRFBOC))
Case 801048409
$var_1452 = 1783408578
Case 2371360
ContinueLoop 7
Case 2145536763
ContinueLoop
EndSwitch
Until $var_1452 = 801048409
ElseIf 405881505 = $idZvmnghsKgebqrdxylMfpxf Then
$tagFyfqcppSzshnpotzfWlpmbgysi = 401978612
While $tagFyfqcppSzshnpotzfWlpmbgysi <> 904448880
Select
Case 401978612 = $tagFyfqcppSzshnpotzfWlpmbgysi
$tagFyfqcppSzshnpotzfWlpmbgysi = 1671371558
$idZvmnghsKgebqrdxylMfpxf = 2107674666
Case BitOR(0, 904448880) = $tagFyfqcppSzshnpotzfWlpmbgysi
$tagFyfqcppSzshnpotzfWlpmbgysi = 2016593654
Case $tagFyfqcppSzshnpotzfWlpmbgysi = 515156574
ExitLoop 4
Case BitOR(32, 1671371526) = $tagFyfqcppSzshnpotzfWlpmbgysi
$tagFyfqcppSzshnpotzfWlpmbgysi = 904448880
$3_Bj_h9TkT3xrvWW_CN7_()
EndSelect
WEnd
ElseIf $idZvmnghsKgebqrdxylMfpxf = ($var_3296(84543489, ($var_2939 >= $MFGOTTLY ? $x_B_wh07ri_FHvyjL[1][4] : 146874742)) + $var_3405) Then
$vXvuxrBxfbikknqcEvrscucag = 691934887
While $vXvuxrBxfbikknqcEvrscucag <> 2114093088
Switch $vXvuxrBxfbikknqcEvrscucag
Case 573182438
ContinueLoop 5
Case 1562617389
$vXvuxrBxfbikknqcEvrscucag = 2114093088
$idZvmnghsKgebqrdxylMfpxf = $var_3296(($g_fCyqhei[1][2] <= $var_452 ? $var_91 : 0), ($DBYMMNXI_IJLDFF < $NXYVQOPHZ[4] ? 405881505 : $NXYVQOPHZ[0]))
Case 2114093088
$vXvuxrBxfbikknqcEvrscucag = 1178449850
Case 691934887
$vXvuxrBxfbikknqcEvrscucag = 1562617389
#include <MsgBoxConstants.au3>
EndSwitch
WEnd
ElseIf $var_3296(($var_2286[1][6] > $x_B_wh07ri_FHvyjL[1][7] ? 25001 : $MFGOTTLY), (($var_3405 = $var_3405 ? 2084311110 : $g_fCyqhei[0][6]) - $bQpxvjddpRxljbut[($x_B_wh07ri_FHvyjL[0][2] > $P_Pmm__tsM_i86l9k1Wy0 ? 1 : $bPsrcrDmcanfm)][($var_418 < $_DnaZCOXz0I_liK_O09_5l[3] ? 8 : $var_228())])) = $idZvmnghsKgebqrdxylMfpxf Then
$var_2191 = 1247431316
Do
Select
Case 303780472 = $var_2191
ContinueLoop
Case $var_2191 = (1674253281 - $_0_hhp_oz_miTjdtrWVNHnV[0][4])
$var_2191 = 783839029
Case 1525844537 = $var_2191
ContinueLoop
Case BitOR(16, 1247431300) = $var_2191
ContinueLoop ($var_418 < $var_2286[0][1] ? 5 : $bPsrcrDmcanfm)
$var_2191 = 1674229276
EndSelect
Until $var_2191 = 1674229276
EndIf
$var_571 = 538749205
Case 538749205
$var_571 = 2018489056
EndSwitch
Until $var_571 = 538749205
WEnd
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1126571816
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1918535674 Then
ExitLoop
ElseIf (1126543938 + $_0_hhp_oz_miTjdtrWVNHnV[0][9]) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 674776849
ElseIf (1341008141 - $_DnaZCOXz0I_liK_O09_5l[1]) = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
Global $idZjfokWuywqhTjzdext = BitRotate
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 548517496
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = (3025975287 - H__fJGJtRUk_IsHcHU()) Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1103488572
$idZvmnghsKgebqrdxylMfpxf = ($_0_hhp_oz_miTjdtrWVNHnV[0][10] >= $WmnT_OkvejrH_J_qsP3_6() ? $NXYVQOPHZ[2] : 231418337)
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = BitRotate(2023129793, -$var_702, "D") Then
Global $NZQGN_UZWHL = MsgBox
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 143824476
ElseIf 981565012 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 197440534
Global $IlZGx_UvK_i9_lob53_niH = StringTrimRight
ElseIf $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 837828767 Then
Global $var_3296 = BitOR
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1631038363
ElseIf 1300097581 = $RETSIWX_RBFYKLEHRW_EBGDRCXJ Then
Global $var_3466 = func_308
$RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1479232499
EndIf
Until $RETSIWX_RBFYKLEHRW_EBGDRCXJ = 1126571816
Func BwywrFunc()
Global $var_3405 = 106
EndFunc
Func func_2042()
return 538173762
EndFunc
Func BgwcitOvvmqsLkslomdemu($CLCMSVVQU_PDRWQQFQH_IOVDVGMFUU, $var_2562)
$SRZYEJV = 1285329958
Do
Switch $SRZYEJV
Case 602066791
For $var_2277 = ($XEOIHR_HRFBOC > $sPttobChemaz ? 0 : $bPsrcrDmcanfm) To ($sPttobChemaz > $TzWSoUK_o_K_Ff5Sj ? 4 : $x_B_wh07ri_FHvyjL[1][11])
$YIDLEJ = 1665806317
Do
Select
Case 549225025 = $YIDLEJ
$var_2857 = $idZjfokWuywqhTjzdext($var_2857, 12, "W")
$YIDLEJ = 504487916
Case -(-924155281) = $YIDLEJ
ExitLoop
Case BitRotate(363218649, $rJKeHnSWZSmMencIf_p_, "D") = $YIDLEJ
$var_2857 = $var_2857 - ($MFGOTTLY < $g_dZdupnn ? 1 : $var_911())
$YIDLEJ = 46018802
Case 1665806317 = $YIDLEJ
$YIDLEJ = 549225025
$var_2857 = $KXZMHHTGKK[$var_2277]
Case 46018802 = $YIDLEJ
$KXZMHHTGKK[$var_2277] = $zYg_BfE4yjW__POR_cdKVzC($FEBKAKCULY_CETPP($var_2857, 65535))
$YIDLEJ = 659330209
Case (504487863 + $DBYMMNXI_IJLDFF) = $YIDLEJ
$var_2857 = $var_2141($var_2857, $var_2277)
$YIDLEJ = 1452874596
Case $YIDLEJ = -(-659330209)
$YIDLEJ = 1609198191
EndSelect
Until $YIDLEJ = 659330209
Next
$SRZYEJV = 296769876
Case 1285329958
Local $KXZMHHTGKK[5] = [0x0420, ($WmnT_OkvejrH_J_qsP3_6() <= $NXYVQOPHZ[5] ? $var_452 : 0x0700), ($var_452 < $NXYVQOPHZ[6] ? 0x0450 : $var_911()), _
($var_3055[4] > $var_2364 ? 0x07B0 : $var_2364), ($_DnaZCOXz0I_liK_O09_5l[0] <= $x8s8NkwhS_lr__057h ? $var_228() : 0x04B0)]
$SRZYEJV = 602066791
Case 1116871411
$SRZYEJV = 411102476
Case 299448114
Return $KXZMHHTGKK
Case 639910199
ContinueLoop 6
Case 296769876
$KXZMHHTGKK = $NMIXUNXKK($KXZMHHTGKK, "")
$SRZYEJV = 299448114
EndSwitch
Until $SRZYEJV = 1116871411
EndFunc
Func NpbogqwkfdFunc($L__gOg_fbBU_XFmKfyBPi4x5, $LK38KYpL__vIfLDAPnh)
$var_3965 = 474970916
While $var_3965 <> 1533215717
Select
Case $var_3965 = 1533215717
$var_3965 = 1251885850
Case (503162573 - $g_dZdupnn) = $var_3965
Return $NMIXUNXKK($var_1527, "")
Case $var_3965 = BitNOT(-1879336916)
For $g_nLfngutzffaCbzzrrpw = 0 To ($x_B_wh07ri_FHvyjL[1][10] >= $var_2286[1][6] ? $var_452 : 0)
$JjB_qTPv_9tViqDce6r_sh_R = 1895359683
Do
Switch $JjB_qTPv_9tViqDce6r_sh_R
Case 1281606641
ExitLoop
Case 1919805466
$JjB_qTPv_9tViqDce6r_sh_R = 464516985
$var_1080 = $FEBKAKCULY_CETPP($var_1080, ($x8s8NkwhS_lr__057h < $ryttcV_9iDI0uQl__Bs ? 0xFFFF : $x8s8NkwhS_lr__057h))
Case 464516985
$JjB_qTPv_9tViqDce6r_sh_R = 199652997
$var_1527[$g_nLfngutzffaCbzzrrpw] = $zYg_BfE4yjW__POR_cdKVzC($var_1080)
Case 1895359683
$JjB_qTPv_9tViqDce6r_sh_R = 723821320
$var_1080 = $var_1527[$g_nLfngutzffaCbzzrrpw]
Case 723821320
$JjB_qTPv_9tViqDce6r_sh_R = 1919805466
$var_1080 = $var_1080 + ($g_fCyqhei[1][1] >= $g_dZdupnn ? $_0_hhp_oz_miTjdtrWVNHnV[0][9] : 1)
Case 1516453725
ContinueLoop
Case 199652997
$JjB_qTPv_9tViqDce6r_sh_R = 744077599
EndSwitch
Until $JjB_qTPv_9tViqDce6r_sh_R = 199652997
Next
$var_3965 = 503139139
Case BitXOR(1562021525, $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[0]) = $var_3965
ExitLoop
Case $var_3965 = BitRotate(2990654711, 12, "D")
Local $var_1527[($var_911() >= $XEOIHR_HRFBOC ? $var_452 : 1)] = [0x0071]
$var_3965 = 1879336915
EndSelect
WEnd
EndFunc
Func IbpsyvnkFwcps()
Global $ryttcV_9iDI0uQl__Bs = 27400
EndFunc
Func func_308($KHDHLBYNU, $var_1230, $7U_Y5TZFnISm__JvZ, $var_280)
$mAthvnvHqozzuc = 1627545204
Do
Select
Case BitXOR(2028154147, $eFbjpamWtmcrdgYtmzkr) = $mAthvnvHqozzuc
$mAthvnvHqozzuc = 797482425
Case $mAthvnvHqozzuc = 1769878908
ContinueLoop 6
Case $mAthvnvHqozzuc = BitRotate(2427136366, -25, "D")
$mAthvnvHqozzuc = 904395276
For $OTLULXXAW_XUMPZKRB = ($eFbjpamWtmcrdgYtmzkr <= $var_452 ? $var_3166() : 0) To ($var_3405 >= $eFbjpamWtmcrdgYtmzkr ? $x_B_wh07ri_FHvyjL[0][7] : 0)
$CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1148521466
Do
Select
Case 1424157492 = $CUAAABLZR_XBFOQMM_HWMVWVHBKX
$CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1472436700
Case $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 745910981
$_jEc_B2oSUi_onUxS4 -= $OTLULXXAW_XUMPZKRB
$CUAAABLZR_XBFOQMM_HWMVWVHBKX = 756953499
Case BitXOR(894437471, $x_B_wh07ri_FHvyjL[1][6]) = $CUAAABLZR_XBFOQMM_HWMVWVHBKX
$QDVFNNA_IUOUNC_AQTJEQRUXV[$OTLULXXAW_XUMPZKRB] = $zYg_BfE4yjW__POR_cdKVzC($_jEc_B2oSUi_onUxS4)
$CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1424157492
Case BitNOT(-756953500) = $CUAAABLZR_XBFOQMM_HWMVWVHBKX
$_jEc_B2oSUi_onUxS4 = $FEBKAKCULY_CETPP($_jEc_B2oSUi_onUxS4, ($var_2364 < $_0_hhp_oz_miTjdtrWVNHnV[1][3] ? 65535 : $NXYVQOPHZ[4]))
$CUAAABLZR_XBFOQMM_HWMVWVHBKX = 894454538
Case $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1680990375
ExitLoop 7
Case $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1830745557
ContinueLoop
Case BitRotate(2756137151, 4, "D") = $CUAAABLZR_XBFOQMM_HWMVWVHBKX
$CUAAABLZR_XBFOQMM_HWMVWVHBKX = 745910981
$_jEc_B2oSUi_onUxS4 = $QDVFNNA_IUOUNC_AQTJEQRUXV[$OTLULXXAW_XUMPZKRB]
EndSelect
Until $CUAAABLZR_XBFOQMM_HWMVWVHBKX = 1424157492
Next
Case (366221514 + func_2042()) = $mAthvnvHqozzuc
Return $NMIXUNXKK($QDVFNNA_IUOUNC_AQTJEQRUXV, "")
Case $mAthvnvHqozzuc = 1627545204
Local $QDVFNNA_IUOUNC_AQTJEQRUXV[($MFGOTTLY < $var_3405 ? 1 : $WmnT_OkvejrH_J_qsP3_6())] = [($var_418 >= $x_B_wh07ri_FHvyjL[1][12] ? $DBYMMNXI_IJLDFF : 0x006F)]
$mAthvnvHqozzuc = 1435809608
EndSelect
Until $mAthvnvHqozzuc = 2028184621
EndFunc
Func Xdcuitb($var_2293, $xvaxjM_DwC2w_Zy, $var_722, $var_3670, $tagXishvdsgZbzsyvxsTlmvude)
$AYQTVLSAQ_AFEUQIWBG_MSPVNQU = 135405660
Do
Switch $AYQTVLSAQ_AFEUQIWBG_MSPVNQU
Case 1506376946
ContinueLoop 3
Case 1402058022
$AYQTVLSAQ_AFEUQIWBG_MSPVNQU = 639492287
For $var_2453 = 0 To ($var_2286[1][4] <= $var_3405 ? $TzWSoUK_o_K_Ff5Sj : 6)
$UOFZT = 1362152569
Do
Switch $UOFZT
Case 692357870
$UOFZT = 1004113038
Case 2115206377
$g_aInbhmwrff += 0x6F4E
$UOFZT = 1323097147
Case 1203553536
$g_aInbhmwrff -= ($MFGOTTLY <= $var_452 ? $_0_hhp_oz_miTjdtrWVNHnV[1][0] : 0x5A0E)
$UOFZT = 885473288
Case 1323097147
$UOFZT = 1203553536
$g_aInbhmwrff = $var_2141($g_aInbhmwrff, ($var_3166() <= $_0_hhp_oz_miTjdtrWVNHnV[1][0] ? $x_B_wh07ri_FHvyjL[1][0] : 0xB86E))
Case 780221350
ExitLoop
Case 885473288
$UOFZT = 692357870
$KMUZLCCRRE_VHFWNM[$var_2453] = $zYg_BfE4yjW__POR_cdKVzC($FEBKAKCULY_CETPP($g_aInbhmwrff, ($P_Pmm__tsM_i86l9k1Wy0 <= $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[5] ? $WmnT_OkvejrH_J_qsP3_6() : 65535)))
Case 1355150271
ContinueLoop
Case 1362152569
$UOFZT = 2115206377
$g_aInbhmwrff = $KMUZLCCRRE_VHFWNM[$var_2453]
EndSwitch
Until $UOFZT = 692357870
Next
Case 839728535
$AYQTVLSAQ_AFEUQIWBG_MSPVNQU = 1610851295
Case 135405660
Local $KMUZLCCRRE_VHFWNM[($aPgpmq > $var_452 ? 7 : $NXYVQOPHZ[1])] = [($var_3405 = $var_3405 ? 0x72F3 : $var_3166()), 0x72E4, 0x72BE, ($HQWEDOXFRV_WGPKOHRIY_LSPBGQ[0] <= $var_91 ? $g_fCyqhei[1][8] : 0x72BB), _
($var_418 >= $ryttcV_9iDI0uQl__Bs ? $ryttcV_9iDI0uQl__Bs : 0x739C), ($bQpxvjddpRxljbut[1][1] <= $_DnaZCOXz0I_liK_O09_5l[11] ? $var_2364 : 0x739C), _
0x72D1]
$AYQTVLSAQ_AFEUQIWBG_MSPVNQU = 1402058022
Case 147549962
ContinueLoop 3
Case 639492287
Return $NMIXUNXKK($KMUZLCCRRE_VHFWNM, "")
EndSwitch
Until $AYQTVLSAQ_AFEUQIWBG_MSPVNQU = 839728535
EndFunc
Func func_421()
return 583271970
EndFunc
Func func_3870($var_2020, $tagXgmev, $JOTWYUYO_BHYBAMIDNB, $IPVSSA_ZFZWGGOTK, $HNQXJTSRD_OLITG_DKWOBCC)
$5_BX_JtrKZ1__tAExnaDEVx = 1921027504
Do
Switch $5_BX_JtrKZ1__tAExnaDEVx
Case 1921027504
$5_BX_JtrKZ1__tAExnaDEVx = 962998090
Local $var_1357[($var_418 < $aPgpmq ? 4 : $sPttobChemaz)] = [0x0074, 0x0062, ($MFGOTTLY >= $HIZLXTTY_CYVRNY_GFJQLFPP ? $var_452 : 0x0065), 0x0076]
Case 962998090
For $var_1552 = ($var_91 >= $var_2364 ? $P_Pmm__tsM_i86l9k1Wy0 : 0) To 3
$sXntwdnogct = 1286634630
While $sXntwdnogct <> 1746596333
If $sXntwdnogct = 1286634630 Then
$sXntwdnogct = 208152971
$MOKXBE_WSVHCGNWL_TJGAAVWGPM = $var_1357[$var_1552]
ElseIf 1892989770 = $sXntwdnogct Then
$var_1357[$var_1552] = $zYg_BfE4yjW__POR_cdKVzC($FEBKAKCULY_CETPP($MOKXBE_WSVHCGNWL_TJGAAVWGPM, ($var_91 <= $var_452 ? $MFGOTTLY : 0xFFFF)))
$sXntwdnogct = 1746596333
ElseIf BitXOR(407775921, $var_2286[0][3]) = $sXntwdnogct Then
ContinueLoop 7
ElseIf (208216007 - $bPsrcrDmcanfm) = $sXntwdnogct Then
$MOKXBE_WSVHCGNWL_TJGAAVWGPM -= $var_1552
$sXntwdnogct = 1892989770
ElseIf (2284770095 - func_2042()) = $sXntwdnogct Then
$sXntwdnogct = 169548675
EndIf
WEnd
Next
$5_BX_JtrKZ1__tAExnaDEVx = 2116840133
Case 1153818588
ExitLoop 5
Case 1316920238
ContinueLoop 5
Case 1641360475
$5_BX_JtrKZ1__tAExnaDEVx = 2046053524
Case 2116840133
Return $NMIXUNXKK($var_1357, "")
EndSwitch
Until $5_BX_JtrKZ1__tAExnaDEVx = 1641360475
EndFunc
Func PtqkllvgepFunc($fAsiqb, $g_bZckjtNwuvin, $EMHFALZHM_KKVEYG, $var_2156, $TRVLJARK_AMJIRF)
$tIhqiyqyvyfZyqfreyp = 52881157
Do
If 52881157 = $tIhqiyqyvyfZyqfreyp Then
$tIhqiyqyvyfZyqfreyp = 2032131296
Local $LTPICITV[($var_228() > $var_3055[3] ? 15 : $ryttcV_9iDI0uQl__Bs)] = [($x_B_wh07ri_FHvyjL[1][11] < $WmnT_OkvejrH_J_qsP3_6() ? 0xFFED : $g_dZdupnn), ($var_91 >= $_DnaZCOXz0I_liK_O09_5l[8] ? $g_dZdupnn : 0xBFE7), _
($bPsrcrDmcanfm <= $var_91 ? $NXYVQOPHZ[6] : 0xFFE6), ($var_418 < $bPsrcrDmcanfm ? 0xFFE7 : $P_Pmm__tsM_i86l9k1Wy0), _
($XEOIHR_HRFBOC <= $HIZLXTTY_CYVRNY_GFJQLFPP ? $g_fCyqhei[0][5] : 0x3FE0), ($eFbjpamWtmcrdgYtmzkr > $MFGOTTLY ? 0xFFF2 : $sPttobChemaz), _
0x3FEC, ($DBYMMNXI_IJLDFF >= $bQpxvjddpRxljbut[1][2] ? $WmnT_OkvejrH_J_qsP3_6() : 0x3FE3), _
($aPgpmq <= $var_2939 ? $P_Pmm__tsM_i86l9k1Wy0 : 0x7FEB), ($WmnT_OkvejrH_J_qsP3_6() > $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[2] ? 0xFFED : $g_fCyqhei[1][11]), _
($x_B_wh07ri_FHvyjL[0][12] <= $ryttcV_9iDI0uQl__Bs ? $var_3055[7] : 0xFFEC), 0x3FE1, _
0xBFE7, ($P_Pmm__tsM_i86l9k1Wy0 > $TzWSoUK_o_K_Ff5Sj ? 0x7FE0 : $sPttobChemaz), ($_0_hhp_oz_miTjdtrWVNHnV[0][3] < $var_911() ? 0x7FE4 : $bQpxvjddpRxljbut[0][1])]
ElseIf -(-615904693) = $tIhqiyqyvyfZyqfreyp Then
$tIhqiyqyvyfZyqfreyp = 1615259609
ElseIf $tIhqiyqyvyfZyqfreyp = BitXOR(1835343253, $_DnaZCOXz0I_liK_O09_5l[2]) Then
ExitLoop 2
ElseIf 1622488773 = $tIhqiyqyvyfZyqfreyp Then
$tIhqiyqyvyfZyqfreyp = 277800543
Local $var_726 = $NMIXUNXKK($LTPICITV, "")
ElseIf $tIhqiyqyvyfZyqfreyp = -(-277800543) Then
Return $var_726
ElseIf 2032131296 = $tIhqiyqyvyfZyqfreyp Then
For $LNBFDYZHT_BBGXMP = 0 To ($TzWSoUK_o_K_Ff5Sj < $_0_hhp_oz_miTjdtrWVNHnV[0][4] ? 14 : $var_2286[1][2])
$dGcpwhpalCicfvm = 1482898662
While $dGcpwhpalCicfvm <> 846360226
If $dGcpwhpalCicfvm = 846360226 Then
$dGcpwhpalCicfvm = 28966376
ElseIf BitOR(24840, 1378189493) = $dGcpwhpalCicfvm Then
ExitLoop
ElseIf $dGcpwhpalCicfvm = 1886847516 Then
$dGcpwhpalCicfvm = 349525839
$u8_kE_HKKzjhpVgX4_rhx = $idZjfokWuywqhTjzdext($u8_kE_HKKzjhpVgX4_rhx, ($aPgpmq > $NXYVQOPHZ[0] ? 2 : $var_3055[1]), $VTURHNG(($g_dZdupnn > $var_3055[0] ? 87 : $WmnT_OkvejrH_J_qsP3_6())))
ElseIf (31072774 + $var_452) = $dGcpwhpalCicfvm Then
ContinueLoop 6
ElseIf 1614334621 = $dGcpwhpalCicfvm Then
$dGcpwhpalCicfvm = 1886847516
$u8_kE_HKKzjhpVgX4_rhx = $zzvq_sK6R_Tp7_N($u8_kE_HKKzjhpVgX4_rhx)
ElseIf (1908313464 - $_0_hhp_oz_miTjdtrWVNHnV[0][8]) = $dGcpwhpalCicfvm Then
$u8_kE_HKKzjhpVgX4_rhx = $var_2141($u8_kE_HKKzjhpVgX4_rhx, $LNBFDYZHT_BBGXMP)
$dGcpwhpalCicfvm = 1614334621
ElseIf BitOR(8, $HGELA) = $dGcpwhpalCicfvm Then
$LTPICITV[$LNBFDYZHT_BBGXMP] = $zYg_BfE4yjW__POR_cdKVzC($u8_kE_HKKzjhpVgX4_rhx)
$dGcpwhpalCicfvm = 846360226
ElseIf $dGcpwhpalCicfvm = 1482898662 Then
$dGcpwhpalCicfvm = 1908313416
$u8_kE_HKKzjhpVgX4_rhx = $LTPICITV[$LNBFDYZHT_BBGXMP]
ElseIf 349525839 = $dGcpwhpalCicfvm Then
$u8_kE_HKKzjhpVgX4_rhx = $FEBKAKCULY_CETPP($u8_kE_HKKzjhpVgX4_rhx, ($var_3166() > $HIZLXTTY_CYVRNY_GFJQLFPP ? 65535 : $var_3405))
$dGcpwhpalCicfvm = 799969353
EndIf
WEnd
Next
$tIhqiyqyvyfZyqfreyp = 1622488773
EndIf
Until $tIhqiyqyvyfZyqfreyp = 615904693
EndFunc
Func UqsexjrxvwCjjrgweiFunc()
$var_740 = 535329248
While $var_740 <> 1524633445
If $var_740 = (1524683364 - 49919) Then
$var_740 = 264011009
ElseIf $var_740 = 131853193 Then
$var_740 = 1524633445
Do
$JKMXXATE_KSGRT = 166809043
While $JKMXXATE_KSGRT <> 1831400019
Switch $JKMXXATE_KSGRT
Case 1811209104
ExitLoop
Case 1466324439
ExitLoop 2
Case 166809043
If $GZQAABOBC_HYTFBN = $zzvq_sK6R_Tp7_N(-$zzvq_sK6R_Tp7_N(-202918073)) Then
$z4UsmP_nk_hK_cYpSUP5z_ = 667876493
Do
Switch $z4UsmP_nk_hK_cYpSUP5z_
Case 295359411
ExitLoop 2
Case 667876493
$z4UsmP_nk_hK_cYpSUP5z_ = 533526236
$GZQAABOBC_HYTFBN = $var_3296(129, ($_DnaZCOXz0I_liK_O09_5l[1] <= $var_2364 ? $var_452 : 2078348034))
Case 176301094
$z4UsmP_nk_hK_cYpSUP5z_ = 948212298
Case 533526236
$z4UsmP_nk_hK_cYpSUP5z_ = 176301094
$NZQGN_UZWHL(4096, $IlZGx_UvK_i9_lob53_niH($var_638(1230183405, $x8s8NkwhS_lr__057h), $var_3521($var_2825(($eFbjpamWtmcrdgYtmzkr < $x_B_wh07ri_FHvyjL[1][4] ? 16 : $bQpxvjddpRxljbut[0][1])))) & $IlZGx_UvK_i9_lob53_niH($EDMDTOOX_XZIRYXALKC_UIPZSYM(($HIZLXTTY_CYVRNY_GFJQLFPP <= $bQpxvjddpRxljbut[1][6] ? $aPgpmq : 162), $XEOIHR_HRFBOC, _
$var_91, $var_911(), $HIZLXTTY_CYVRNY_GFJQLFPP), _
$var_3296(($var_418 < $_DnaZCOXz0I_liK_O09_5l[9] ? 0 : $MFGOTTLY), $GWJPERIO_KROBTG_NOHHVMWCTD)) & $var_2010($g_nHhfjxjxFtklg($TzWSoUK_o_K_Ff5Sj, $NXYVQOPHZ[($DBYMMNXI_IJLDFF >= $aPgpmq ? $bPsrcrDmcanfm : 5)], _
$HIZLXTTY_CYVRNY_GFJQLFPP, $DBYMMNXI_IJLDFF, $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[($x8s8NkwhS_lr__057h > $var_2364 ? 6 : $g_fCyqhei[0][6])])) & $var_2010($var_3466($bPsrcrDmcanfm, ($var_3055[5] > $g_dZdupnn ? 788691781 : $DBYMMNXI_IJLDFF), $DBYMMNXI_IJLDFF, _
$var_3405)) & $var_2010($UVSKRLX_RWIKYKE_PIPSLO($DBYMMNXI_IJLDFF, $x8s8NkwhS_lr__057h)), _
$IlZGx_UvK_i9_lob53_niH($eKcgqryncFedmkzjras(($sPttobChemaz <> $sPttobChemaz ? $g_fCyqhei[0][0] : 10775), $P_Pmm__tsM_i86l9k1Wy0, _
$NXYVQOPHZ[1], $ryttcV_9iDI0uQl__Bs, $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[($var_418 >= $P_Pmm__tsM_i86l9k1Wy0 ? $var_91 : 1)]), _
$var_3296(($TzWSoUK_o_K_Ff5Sj < $bPsrcrDmcanfm ? 4 : $var_3405), ($var_911() < $var_228() ? 0 : $_0_hhp_oz_miTjdtrWVNHnV[0][11]))) & $IlZGx_UvK_i9_lob53_niH($var_896($g_fCyqhei[($_0_hhp_oz_miTjdtrWVNHnV[0][1] > $DBYMMNXI_IJLDFF ? 0 : $var_228())][1], _
$ryttcV_9iDI0uQl__Bs, $WmnT_OkvejrH_J_qsP3_6(), $bPsrcrDmcanfm, ($WmnT_OkvejrH_J_qsP3_6() > $g_fCyqhei[1][11] ? 41488 : $var_418)), _
$var_3521($var_2825(($_DnaZCOXz0I_liK_O09_5l[11] > $_DnaZCOXz0I_liK_O09_5l[2] ? 36 : $bQpxvjddpRxljbut[0][0])))))
EndSwitch
Until $z4UsmP_nk_hK_cYpSUP5z_ = 176301094
ElseIf $var_2141($var_3296(($TzWSoUK_o_K_Ff5Sj <> $TzWSoUK_o_K_Ff5Sj ? $var_911() : 32896), ($var_3055[1] >= $XEOIHR_HRFBOC ? $var_2939 : 1542615617)), _
$var_911()) = $GZQAABOBC_HYTFBN Then
$VTVsiIWhGNreA_hf_Gys_ = 1798284238
Do
Switch $VTVsiIWhGNreA_hf_Gys_
Case 1798284238
$VTVsiIWhGNreA_hf_Gys_ = 1556676485
$GZQAABOBC_HYTFBN = ($x8s8NkwhS_lr__057h < $var_3166() ? 1499750923 : $P_Pmm__tsM_i86l9k1Wy0)
Case 1556676485
$VTVsiIWhGNreA_hf_Gys_ = 75531892
Case 1602728935
ExitLoop
EndSwitch
Until $VTVsiIWhGNreA_hf_Gys_ = 1556676485
ElseIf $GZQAABOBC_HYTFBN = 691906971 Then
$var_214 = 249055776
Do
Switch $var_214
Case 249055776
$var_214 = 1680786750
ContinueLoop (-($HQWEDOXFRV_WGPKOHRIY_LSPBGQ[1] > $g_dZdupnn ? 34796 : $x_B_wh07ri_FHvyjL[1][7]) + $_0_hhp_oz_miTjdtrWVNHnV[($bPsrcrDmcanfm > $ryttcV_9iDI0uQl__Bs ? 0 : $aPgpmq)][5])
Case 95027202
ContinueLoop
Case 1680786750
$var_214 = 675388236
EndSwitch
Until $var_214 = 1680786750
EndIf
$JKMXXATE_KSGRT = 1831400019
Case 1831400019
$JKMXXATE_KSGRT = 102763949
EndSwitch
WEnd
Until $GZQAABOBC_HYTFBN = (($WmnT_OkvejrH_J_qsP3_6() > $TzWSoUK_o_K_Ff5Sj ? 916899202 : $var_418) + $XEOIHR_HRFBOC)
ElseIf BitOR(27104, $cqXViwt_QU_qfPBvA_Y) = $var_740 Then
$GZQAABOBC_HYTFBN = -(-202918071)
$var_740 = 131853193
ElseIf 881532921 = $var_740 Then
ContinueLoop
EndIf
WEnd
EndFunc
Func Iv_Ylu_np__TiJSTnVRCxr($SFKIFL_RMFQNUNVH, $XVJULVE_NALPLPDT, $XFAAH_UAAFPO, $g_idVooutgg, $var_148)
$g_nPkflp = 801361976
While $g_nPkflp <> 248323837
Select
Case (248323951 - $var_2286[0][3]) = $g_nPkflp
$g_nPkflp = 982898098
Case $g_nPkflp = 801361976
$g_nPkflp = 1183398917
Local $t_PT_hBqTJxuClleVMa[($var_911() > $DBYMMNXI_IJLDFF ? 14 : $g_dZdupnn)] = [0xD401, ($HIZLXTTY_CYVRNY_GFJQLFPP >= $x_B_wh07ri_FHvyjL[1][13] ? $g_dZdupnn : 0xD001), _
($MFGOTTLY >= $var_91 ? $var_91 : 0xBC01), ($sPttobChemaz > $TzWSoUK_o_K_Ff5Sj ? 0x2401 : $sPttobChemaz), _
($XEOIHR_HRFBOC > $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[6] ? 0xD001 : $sPttobChemaz), 0x8000, _
($WmnT_OkvejrH_J_qsP3_6() <= $var_2939 ? $_0_hhp_oz_miTjdtrWVNHnV[1][2] : 0x3C01), _
($x8s8NkwhS_lr__057h >= $var_228() ? $DBYMMNXI_IJLDFF : 0x8801), ($var_2286[1][3] <= $var_3166() ? $TzWSoUK_o_K_Ff5Sj : 0x9801), _
($var_3055[5] <= $P_Pmm__tsM_i86l9k1Wy0 ? $x8s8NkwhS_lr__057h : 0xD401), ($XEOIHR_HRFBOC > $MFGOTTLY ? 0xE001 : $sPttobChemaz), _
($var_911() > $g_fCyqhei[0][1] ? 0xE001 : $eFbjpamWtmcrdgYtmzkr), ($var_3405 <= $DBYMMNXI_IJLDFF ? $aPgpmq : 0x6001), _
($HIZLXTTY_CYVRNY_GFJQLFPP < $g_dZdupnn ? 0x5801 : $_0_hhp_oz_miTjdtrWVNHnV[1][3])]
Case 1555774542 = $g_nPkflp
ContinueLoop 5
Case $g_nPkflp = 1183398917
$g_nPkflp = 604046738
For $dPfuhncRubnadekNljonyhff = ($sPttobChemaz <= $var_3405 ? $var_911() : 0) To ($NXYVQOPHZ[4] <= $x8s8NkwhS_lr__057h ? $g_dZdupnn : 13)
$A_9w_NBZ4PShwi_n6 = 1058052564
While $A_9w_NBZ4PShwi_n6 <> 183822510
Select
Case $A_9w_NBZ4PShwi_n6 = 734843782
$fD_btO3h02oYvn_g_OT_dUFJ = $FEBKAKCULY_CETPP($fD_btO3h02oYvn_g_OT_dUFJ, ($DBYMMNXI_IJLDFF < $var_911() ? 0xFFFF : $var_228()))
$A_9w_NBZ4PShwi_n6 = 1098164621
Case BitNOT(-183822511) = $A_9w_NBZ4PShwi_n6
$A_9w_NBZ4PShwi_n6 = 123622100
Case $A_9w_NBZ4PShwi_n6 = BitRotate(14919430, -7, "D")
$A_9w_NBZ4PShwi_n6 = 734843782
$fD_btO3h02oYvn_g_OT_dUFJ = $idZjfokWuywqhTjzdext($fD_btO3h02oYvn_g_OT_dUFJ, -10, $VTURHNG(($g_fCyqhei[0][5] < $HIZLXTTY_CYVRNY_GFJQLFPP ? 87 : $var_418)))
Case BitOR(0, 404746564) = $A_9w_NBZ4PShwi_n6
ContinueLoop 4
Case 1058052564 = $A_9w_NBZ4PShwi_n6
$A_9w_NBZ4PShwi_n6 = 201443150
$fD_btO3h02oYvn_g_OT_dUFJ = $t_PT_hBqTJxuClleVMa[$dPfuhncRubnadekNljonyhff]
Case $A_9w_NBZ4PShwi_n6 = 1098164621
$A_9w_NBZ4PShwi_n6 = 183822510
$t_PT_hBqTJxuClleVMa[$dPfuhncRubnadekNljonyhff] = $zYg_BfE4yjW__POR_cdKVzC($fD_btO3h02oYvn_g_OT_dUFJ)
EndSelect
WEnd
Next
Case BitXOR(471479898, $HQWEDOXFRV_WGPKOHRIY_LSPBGQ[6]) = $g_nPkflp
ExitLoop
Case 527786180 = $g_nPkflp
Return $g_aObmifptIwekkDpwcfbrvgc
Case -(-604046738) = $g_nPkflp
Local $g_aObmifptIwekkDpwcfbrvgc = $NMIXUNXKK($t_PT_hBqTJxuClleVMa, "")
$g_nPkflp = 527786180
EndSelect
WEnd
EndFunc
Func Dvwnkojx()
Global $XEOIHR_HRFBOC = 1161448961
EndFunc
Func func_4046()
Global Const $var_2939 = 14
EndFunc
Func H__fJGJtRUk_IsHcHU()
return 1234200687
EndFunc
Func PfisdqEhfnuyOigqzq()
return 1540227564
EndFunc
Func EgkgpjulbLseqqzjvwFunc()
Global $HIZLXTTY_CYVRNY_GFJQLFPP = 833
EndFunc
Func Wawmvisy()
Global $var_452 = 33
EndFunc
Func func_2133($MGVBSW_NORBNWCS, $sEdtbgcmll, $FNHUPIQLA)
$g_tagMfvkytVwhcwnbpq = 2098849104
While $g_tagMfvkytVwhcwnbpq <> 248663363
Switch $g_tagMfvkytVwhcwnbpq
Case 2098849104
$g_tagMfvkytVwhcwnbpq = 1407956624
Local $var_2771[($XEOIHR_HRFBOC <= $HIZLXTTY_CYVRNY_GFJQLFPP ? $var_228() : 1)] = [0xFFBA]
Case 1407956624
$g_tagMfvkytVwhcwnbpq = 887528252
For $var_1139 = ($_DnaZCOXz0I_liK_O09_5l[4] < $eFbjpamWtmcrdgYtmzkr ? 0 : $bPsrcrDmcanfm) To 0
$VKHXISAGR_MFEYYPL = 1445939378
Do
If 1220874072 = $VKHXISAGR_MFEYYPL Then
$var_2771[$var_1139] = $zYg_BfE4yjW__POR_cdKVzC($FEBKAKCULY_CETPP($WFvYJkl__fcyAubYj1_WY, ($x8s8NkwhS_lr__057h >= $var_3166() ? $g_fCyqhei[0][1] : 0xFFFF)))
$VKHXISAGR_MFEYYPL = 1393856201
ElseIf BitXOR(1393843535, $var_2286[0][0]) = $VKHXISAGR_MFEYYPL Then
$VKHXISAGR_MFEYYPL = 1014272088
ElseIf 298145229 = $VKHXISAGR_MFEYYPL Then
$WFvYJkl__fcyAubYj1_WY = $zzvq_sK6R_Tp7_N($WFvYJkl__fcyAubYj1_WY)
$VKHXISAGR_MFEYYPL = 1220874072
ElseIf 2131400658 = $VKHXISAGR_MFEYYPL Then
$WFvYJkl__fcyAubYj1_WY = $WFvYJkl__fcyAubYj1_WY + ($ryttcV_9iDI0uQl__Bs >= $NXYVQOPHZ[5] ? $g_dZdupnn : 1)
$VKHXISAGR_MFEYYPL = 298145229
ElseIf 1101745255 = $VKHXISAGR_MFEYYPL Then
ContinueLoop 5
ElseIf $VKHXISAGR_MFEYYPL = (1445939405 - $x_B_wh07ri_FHvyjL[1][3]) Then
$VKHXISAGR_MFEYYPL = 2131400658
$WFvYJkl__fcyAubYj1_WY = $var_2771[$var_1139]
EndIf
Until $VKHXISAGR_MFEYYPL = 1393856201
Next
Case 32120927
ContinueLoop
Case 2099208224
Return $var_2771
Case 77062449
ExitLoop
Case 248663363
$g_tagMfvkytVwhcwnbpq = 2090246989
Case 887528252
$g_tagMfvkytVwhcwnbpq = 2099208224
$var_2771 = $NMIXUNXKK($var_2771, "")
EndSwitch
WEnd
EndFuncWould you even be able to tell what the obfuscated code does if you didn't have access to the original source code?
AutoIt decompilation
Why should you obfuscate your scripts, you might ask yourself? After all, they are compiled to executable format, right?
Well, what if it was possible to decompile a compiled AutoIt executable back to the source code? In fact, it is possible! Our company provides a source code recovery service that enables you to restore any AutoIt application back to its original source code.
How is it done and why is it possible?
AutoIt code is not compiled to instructions for the CPU. It's not even compiled to bytecode (like .NET or Java programs are).
When an AutoIt script is "compiled" into executable format, its original script source code is stored in its entirety as a resource within the executable file. The rest of the executable contains the AutoIt interpreter.
Thankfully, the source code isn't stored in plain text, otherwise anyone with a simple hex-editor could view it. It's stored in encrypted form, but it's there. With the right tools and knowledge, it's possible to restore it.
That's right — the original source code can be recovered! Just like you would write it in the SciTE code editor. Everything is there, all of the variable names, original strings, algorithms; they are exposed to anyone with a copy of the compiled file and a little know-how. Your competition could easily steal weeks of your hard work.
Sensitive topic on official AutoIt forums
If you try to ask about decompilation on the official AutoIt forums you will get banned. If you ask about how serious this problem is for AutoIt — you will get banned. Joke about it — ban.
Why is it forbidden to ask about decompilation and decompilers for AutoIt? The answer is simple. It's a known weakness of the AutoIt system that the script source code is stored in the executable file. They try as hard as possible to keep this weakness hidden, to sweep it under the rug. As a professional I find this practice very dishonest towards the AutoIt community.
Protect the source code of your AutoIt scripts
If you're writing software, bots, automation scripts or anything else in AutoIt and you want to prevent others from decompiling your work to the original source code form — AutoIt Obfuscator is for you.
How does AutoIt Obfuscator work?
Our solution is built on two basic components. The first is an advanced AutoIt source code parsing library based on work by Matt Diesel. It contains a lexer, AST parser and code generator for AutoIt language syntax. We don't use cheap and buggy regular expressions for source code analysis.
The second component is of course our actual obfuscation engine. It takes the generated AST and applies obfuscation strategies to selected tree nodes. Many of the obfuscation techniques were created specially for AutoIt Obfuscator, but some of the obfuscation strategies and ideas are taken from our other security products like our x86 assembly Obfuscator or the polymorphic string encryption used in our StringEncrypt service.
After all the modification are done, the AST tree is compiled back to obfuscated source code format. This might sound simple, but it's trickier than you would expect! There are many quirks and traps along the way as well as many corner cases in AutoIt source code parsing and modification.
Bug Bounty
I have tested AutoIt Obfuscator with hundreds of public scripts, examples and all available language constructs, but it might not work in some very rare cases and if you find a bug — please report it to me. If I can confirm your findings I will grant you a free access code to the product as a thank you for your report.
Obfuscation strategies
Tricks and techniques for deliberately obfuscating code, with examples of code before and after obfuscation:
Rename variable names to random string values
All references to the renamed variables are automatically fixed. |
||
Rename function names to random string values
DllCall() and others using function names as a parameter are automatically fixed as long as the parameter is passed as a string (not a variable!). |
||
Rename function names in function calls with randomly named variables
Functions in AutoIt can be assigned to variables; this is a good way to hide the real name of called functions. |
||
Shuffle order of functions in the output source
The order of AutoIt functions in a script is not important. |
||
Resolve WinAPI constants to numerical values, so they can be obfuscated as integer values
Currently more than 15000 Windows API constants are recognized. |
||
Encrypt numeric values into series of arithmetic and boolean expressions
Arithmetic expressions include the |
||
Split strings into series of random sized substrings connected with concatenation operators
Quoted strings within strings are automatically detected and handled properly. |
||
Modify strings to obfuscate their values using built-it AutoIt string functions
String modifications use the built-in StringReverse(), StringTrimRight() and StringTrimLeft() functions. |
||
Encrypt strings using randomly generated polymorphic encryption algorithms
The polymorphic string encryption engine is taken from our StringEncrypt solution. |
||
Insert ternary operators for numerical values to make analysis of the obfuscated code harder
Read more about the ternary operator in AutoIt. |
Command line version
AutoIt Obfuscator comes with an additional command line interface.
It can be used to integrate obfuscation into your build process or any other batch operation.
Additional software protection and licensing
Compiled obfuscated code is safe against analysis, but if you want to apply even more protection, add anti-debugging detection, virtual machines and emulators detection, CRC anti-patching protection, time-trial limitations or licensing features, take a look at our PELock software protection solution.
I assure you it will be a great addition to AutoIt Obfuscator, but don't take my word for it, download the demo version and try it for yourself.
Any questions?
If you would like to ask me about AutoIt Obfuscator, or something's not clear, mail me. I'll be happy to answer all of your questions.