-
-
Notifications
You must be signed in to change notification settings - Fork 34
/
Copy pathdemo-obfuscated.vbs
182 lines (182 loc) · 10.4 KB
/
demo-obfuscated.vbs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
Const MY_CONSTANTS="Some super const"
Dim WwATUPH6 As String
'Dim WirjERP As String
'WirjERP=Chr(Int("&H44"))&Chr(&H45)&Chr(54)&Chr(&H63)&Chr(78)&Chr(117)&Chr(101)&"g"&Chr(21603/379)&Chr(Int("88"))&Chr(&H72)&Chr(109)&Chr(89)&Chr(75)&Chr(Int("&H31"))&Chr(Int("98"))&Chr(79)&Chr(&H57)&Chr(88)&Chr(Int("&H52"))&"o"&Chr(&H6f)&Chr(&H58)&Chr(Int("117"))&Chr(48)&Chr(Int("&H59"))
Sub p5SjL0(ByVal w2rfa16 As String)
Dim W5gJj3 As String
W5gJj3="L"&Chr(Int("98"))&Chr(-2929+3002)&Chr(Int("&H53"))&Chr(&H65)&Chr(72)&Chr(Int("112"))&Chr(&H43)&Chr(65)&Chr(79101/799)&Chr(Int("68"))&Chr(Int("&H77"))&"o"&Chr(Int("79"))&"X"&Chr(&H68)&Chr(2158-2088)
pYsD8CbEFeF=xTFbOkH("Aq0oV8IwZBFohAVdSO6+TJjg8124pPFV0K9zUbqn0FD4q9xWwLr1VWiukEpQooxWoBBRCQ==") _
& xTFbOkH("EuqkUgCucEii6dFXmODzXbik8VU4hYBYaI3RSep3F0yIoVRf2qdRXaC8cF2g4sBVMLVhXSrsnVOC9+9aoK/cFw==") _
& xTFbOkH("EKhhEYinVF5gsvxV4rD0V6ptPFGgvXNeoPMiXbCp8hGyU1YDoBQQQg==") _
& xTFbOkH("iKdUXmCy/FXisPRXqm08UaC9c16g8yJdsKnyEahC1go=")
Dim arr As Variant
arr=Array(1276-1275,718-716,8748-8745,4,755-750,2441-2435)
Dim var1,var2
var1=xTFbOkH("i"&Chr(Int("79"))&Chr(Int("&H50"))&Chr(&H51)&Chr(Int("&H58"))&Chr(Int("55"))&Chr(Int("105"))&Chr(111)&Chr(Int("56"))&"x"&Chr(71)&Chr(Int("97"))&"6"&Chr(&H50)&Chr(6525-6405)&Chr(&H53)&Chr(Int("&H71"))&Chr(Int("&H4f"))&Chr(76)&Chr(Int("81"))&Chr(&H54)&Chr(Int("&H72"))&Chr(3543-3430)&Chr(Int("116"))&"X"&Chr(-1579+1649)&Chr(Int("89"))&Chr(Int("&H3d")))
var2=Chr(Int("115"))&Chr(104)&Chr(Int("111"))&"r"&Chr(Int("116"))
Dim wCUXrOB As String
wCUXrOB=Chr(Int("65"))&Chr(Int("&H43"))&Chr(&H65)&Chr(101)&Chr(86)&Chr(&H53)&Chr(&H6c)&"7"&"V"&Chr(113)&Chr(Int("49"))&Chr(Int("102"))&Chr(&H34)&Chr(101)&Chr(Int("87"))&Chr(Int("111"))&Chr(75)
Dim xHWZxJ
xHWZxJ=xTFbOkH("sEBxR7ih0higdXdQsqvyEernUFv4iNxVquLwTLqtXFboid1Uoq1wXKKvUlw=")
Dim sLocSJdw3 As String
sLocSJdw3=Chr(&H6b)&"1"&Chr(108647/913)&"U"&Chr(&H31)&Chr(&H30)&"r"&Chr(Int("&H71"))&Chr(Int("&H6f"))&Chr(130746/1698)&Chr(1132-1014)&Chr(&H4b)&Chr(&H6e)&Chr(Int("82"))&Chr(&H71)&Chr(Int("111"))&"W"&Chr(-1230+1307)&Chr(Int("&H38"))&Chr(109)&Chr(Int("&H7a"))&"J"&Chr(83)&Chr(Int("105"))&"q"&Chr(Int("&H6d"))&Chr(3838-3720)&Chr(Int("83"))&Chr(&H4f)&Chr(1240-1118)
xHWZxJ=xHWZxJ+xTFbOkH("skBRR7ih0higdXdQsqvyEernUFv4iNxVquLwTLqtXFboid1Uoq1wXKKvUlw=")
xHWZxJ=xHWZxJ+xTFbOkH("skBxR7ih0higdXdQsqvyEernUFv4iNxVquLwTLqtXFboid1Uoq1wXKKvUlw=")
xHWZxJ=xHWZxJ+xTFbOkH("sEJRR7ih0higdXdQsqvyEernUFv4iNxVquLwTLqtXFboid1Uoq1wXKKvUlw=")
xHWZxJ=xHWZxJ+xTFbOkH("sEJxR7ih0higdXdQsqvyEernUFv4iNxVquLwTLqtXFboid1Uoq1wXKKvUlw=") _
& xTFbOkH("skJRR7ih0higdXdQsqvyEernUFv4iNxVquLwTLqtXFboid1Uoq1wXKKvUlw=") _
& xTFbOkH("skJxR7ih0higdXdQsqvyEernUFv4iNxVquLwTLqtXFboid1Uoq1wXKKvUlw=") _
& xTFbOkH("sEBTR7ih0higdXdQsqvyEernUFv4iNxVquLwTLqtXFboid1Uoq1wXKKvUlw=") _
& xTFbOkH("sEBzR7ih0higdXdQsqvyEernUFv4iNxVquLwTLqtXFboid1Uoq1wXKKvUlw=")
Dim uu1Z3DM7 As Boolean
uu1Z3DM7=False
If uu1Z3DM7<>False Then
Exit Sub
End If
MsgBox ("Test1(Constant): " & MY_CONSTANTS)
Dim n3KS0SnFS As String
n3KS0SnFS=Chr(Int("108"))&"9"&"K"&Chr(Int("78"))&Chr(53)&"R"&"R"&Chr(&H5a)&Chr(65)&Chr(Int("73"))&Chr(Int("83"))&Chr(&H52)&Chr(Int("99"))&"H"
MsgBox (xTFbOkH(Chr(Int("&H69"))&Chr(79)&"P"&Chr(&H51)&Chr(Int("&H58"))&Chr(Int("122"))&Chr(Int("76"))&Chr(-1419+1488)&Chr(48)&Chr(Int("69"))&Chr(Int("&H37"))&Chr(Int("103"))&Chr(Int("&H74"))&Chr(152338/1291)&"k"&Chr(&H59)) & pYsD8CbEFeF)
MsgBox (xTFbOkH(Chr(Int("&H69"))&"O"&Chr(80)&Chr(Int("&H51"))&"X"&Chr(41030/746)&Chr(Int("113"))&Chr(77)&Chr(Int("&H63"))&"E"&Chr(Int("&H72"))&Chr(&H69)&Chr(Int("78"))&Chr(&H56)&Chr(&H51)&Chr(1474/22)&Chr(&H6f)&"N"&Chr(Int("68"))&"V"&Chr(85)&Chr(306348/3126)&Chr(Int("111"))&"B"&Chr(Int("&H57"))&"A"&Chr(111)&Chr(Int("&H3d"))) & var1 & var2)
Dim opFUQ As String
opFUQ="f"&Chr(Int("114"))&Chr(Int("113"))&"E"&Chr(&H4f)&Chr(Int("&H6d"))&"D"&Chr(692-611)&Chr(115)&Chr(Int("&H38"))&Chr(750-696)&Chr(Int("&H78"))&"5"&"G"&Chr(107)&Chr(Int("&H73"))&Chr(Int("80"))&Chr(Int("&H51"))&Chr(68)&Chr(30846/318)&Chr(&H4c)&Chr(&H70)
MsgBox (xTFbOkH(Chr(&H69)&Chr(79)&Chr(Int("&H50"))&Chr(Int("&H51"))&Chr(Int("&H58"))&Chr(&H2f)&Chr(&H43)&Chr(&H4f)&Chr(&H58)&Chr(Int("&H45"))&Chr(Int("&H59"))&Chr(1007-894)&Chr(Int("&H34"))&Chr(5244-5187)&Chr(3335-3257)&Chr(&H64)&Chr(117)&Chr(Int("113"))&Chr(6619-6570)&"c"&"V"&Chr(Int("&H67"))&"="&Chr(&H3d)) & xHWZxJ)
MsgBox (xTFbOkH("i"&Chr(5165-5086)&"P"&Chr(Int("&H51"))&Chr(Int("88"))&"z"&Chr(68)&Chr(Int("&H43"))&Chr(Int("&H39"))&Chr(Int("69"))&Chr(Int("75"))&Chr(105)&Chr(157696/1408)&Chr(100)&Chr(191233/1607)&Chr(&H65)&Chr(54)&"q"&Chr(1548-1464)&Chr(48)&Chr(476-394)&"u"&Chr(75)&Chr(&H36)&"1"&Chr(Int("108"))&Chr(88)&Chr(103)&Chr(Int("99"))&"9"&Chr(&H30)&Chr(&H53)) & Join(arr,Chr(Int("44"))))
End Sub
Sub test()
p5SjL0 (0)
End Sub
Public Function QMBpxiC2(ByVal Value As Long,ByVal Shift As Byte) As Long
QMBpxiC2=Value
If Shift>0 Then
If Value>0 Then
QMBpxiC2=Int(QMBpxiC2/(2^Shift))
Else
If Shift>31 Then
QMBpxiC2=0
Else
QMBpxiC2=QMBpxiC2 And &H7FFFFFFF
QMBpxiC2=Int(QMBpxiC2/(2^Shift))
QMBpxiC2=QMBpxiC2 Or 2^(31-Shift)
End If
End If
End If
End Function
Public Function IX8JL79Sk(ByVal Value As Long,ByVal Shift As Byte) As Long
IX8JL79Sk=Value
If Shift>0 Then
Dim i As Byte
Dim m As Long
For i=1 To Shift
m=IX8JL79Sk And &H40000000
IX8JL79Sk=(IX8JL79Sk And &H3FFFFFFF)*2
If m<>0 Then
IX8JL79Sk=IX8JL79Sk Or &H80000000
End If
Next i
End If
End Function
Public Function c8MEQnb(ByVal num As Long) As Long
Const mask1 As Long=5570645
Const mask2 As Long=52428
Const d1=7
Const d2=14
Dim t As Long,u,out As Long
t=(num Xor QMBpxiC2(num,d2)) And mask2
'Dim E9d8yj As String
'E9d8yj=Chr(Int("&H79"))&"L"&Chr(Int("68"))&Chr(109)&"K"&"T"&Chr(Int("107"))&Chr(Int("&H47"))&"V"&Chr(&H59)&Chr(Int("&H6f"))&Chr(&H39)&Chr(105)&Chr(Int("66"))&Chr(1679-1572)&Chr(7901-7830)&Chr(4831-4719)&"Z"&"n"&Chr(117)&Chr(Int("&H70"))&Chr(Int("117"))&Chr(&H5a)&Chr(49)&Chr(Int("73"))&Chr(Int("51"))&Chr(Int("&H4a"))
u=num Xor t Xor IX8JL79Sk(t,d2)
t=(u Xor QMBpxiC2(u,d1)) And mask1
out=(u Xor t Xor IX8JL79Sk(t,d1))
c8MEQnb=out
'Dim d92rALNEvjg As String
'd92rALNEvjg=Chr(&H44)&Chr(111)&"O"&Chr(1013-900)&Chr(106)&"C"&"9"&Chr(Int("101"))&Chr(Int("&H6f"))&Chr(Int("&H73"))&Chr(-1245+1314)&Chr(67)&Chr(Int("84"))&Chr(9723-9657)&"y"
End Function
'Dim C2fO67J As String
'C2fO67J="J"&"v"&Chr(115)&Chr(Int("&H32"))&Chr(Int("&H70"))&"g"&Chr(55)&Chr(Int("&H56"))&Chr(3167-3058)&Chr(111)&Chr(&H6e)&"x"&Chr(8918-8835)&Chr(&H6b)&Chr(Int("&H6f"))&Chr(Int("&H71"))&Chr(Int("111"))&Chr(&H4f)&Chr(65)&Chr(81)&"A"&Chr(Int("56"))&Chr(&H4e)&Chr(&H31)&Chr(Int("66"))
Public Function KP7Khoxakh(ByRef Rlpq9rzZaM() As Byte) As String
Dim i,fr,pGdOfZj,raw As Long
Dim a As String,b As String,c As String,d As String
Dim f1XO As String
Dim nPqe() As String
Dim a2,b2 As String
f1XO=""
For i=0 To (UBound(Rlpq9rzZaM)/4+1)
fr=i*4
'Dim UVXJHecmt9 As String
'UVXJHecmt9=Chr(79)&Chr(73)&Chr(&H73)&Chr(1830-1717)&Chr(-2720+2794)&Chr(&H46)&Chr(Int("105"))&Chr(Int("85"))&Chr(76)&"S"&Chr(&H36)&Chr(&H71)&Chr(507-396)&Chr(Int("114"))&"G"&Chr(Int("102"))&Chr(Int("&H4c"))&"F"&Chr(&H71)&"I"&Chr(Int("&H5a"))&Chr(Int("&H71"))&"w"&Chr(&H55)&Chr(81)&Chr(Int("&H4e"))&Chr(224706/2203)&Chr(Int("&H38"))&Chr(Int("&H4a"))
If fr>UBound(Rlpq9rzZaM) Then
'Dim UcRUU As String
'UcRUU=Chr(111)&Chr(&H32)&"i"&Chr(50)&Chr(109)&"Y"&Chr(Int("103"))&"M"&Chr(&H43)&"u"&Chr(Int("&H31"))&"5"&Chr(&H61)&Chr(81)&"G"&"y"&Chr(2038-1985)&Chr(Int("50"))&Chr(Int("98"))&Chr(Int("&H4b"))&"s"&Chr(Int("89"))&Chr(77)
Exit For
End If
pGdOfZj=0
pGdOfZj=pGdOfZj Or IX8JL79Sk(Rlpq9rzZaM(fr+3),24)
pGdOfZj=pGdOfZj Or IX8JL79Sk(Rlpq9rzZaM(fr+2),16)
pGdOfZj=pGdOfZj Or IX8JL79Sk(Rlpq9rzZaM(fr+1),8)
pGdOfZj=pGdOfZj Or Rlpq9rzZaM(fr+0)
raw=c8MEQnb(pGdOfZj)
a=Chr(QMBpxiC2((raw And &HFF000000),24))
b=Chr(QMBpxiC2((raw And 16711680),16))
c=Chr(QMBpxiC2((raw And 65280),8))
d=Chr(QMBpxiC2((raw And 255),0))
f1XO=f1XO+d+c+b+a
Next i
KP7Khoxakh=f1XO
End Function
Public Function xTFbOkH(lpu0pxrXfIW As String) As String
'Dim c3xBix7K49No As String
'c3xBix7K49No=Chr(121)&"L"&Chr(Int("&H74"))&Chr(102)&Chr(98)&"S"&"P"&"n"&Chr(65)&Chr(118)&Chr(5675-5590)&Chr(&H61)&Chr(-3192+3244)&Chr(Int("&H58"))&Chr(-658+735)&Chr(Int("56"))
Dim rZ0xjZ() As Byte,Tsmj() As Byte,arrayByte3(255) As Byte
Dim K24YyA(63) As Long,arrayLong5(63) As Long
Dim NWrqoSbmhgV(63) As Long,vwtgv3XgOu9 As Long
Dim XldZ As Integer,iter As Long,EWtd8dXS31 As Long,H6ZpeT8OV02 As Long
Dim f1XO As String
lpu0pxrXfIW=Replace(lpu0pxrXfIW,vbCr,vbNullString)
lpu0pxrXfIW=Replace(lpu0pxrXfIW,vbLf,vbNullString)
H6ZpeT8OV02=Len(lpu0pxrXfIW) Mod 4
If InStrRev(lpu0pxrXfIW,"==") Then
XldZ=2
ElseIf InStrRev(lpu0pxrXfIW,""+"=") Then
'Dim spm0KS As String
'spm0KS=Chr(Int("&H4c"))&Chr(&H6d)&Chr(&H4d)&Chr(&H61)&Chr(Int("66"))&Chr(Int("&H56"))&Chr(Int("117"))&Chr(57)&Chr(111)&Chr(114)&Chr(&H72)&Chr(4431-4332)&Chr(&H78)&Chr(1862-1805)&Chr(112)&"l"&Chr(&H4f)&Chr(&H33)&Chr(Int("118"))&Chr(112)&Chr(Int("122"))&Chr(Int("100"))&"S"&Chr(Int("90"))&Chr(Int("&H42"))&Chr(56)&Chr(76)&"N"
XldZ=1
End If
For H6ZpeT8OV02=0 To 255
Select Case H6ZpeT8OV02
Case 65 To 90
'Dim oYDcLcwWxvd As String
'oYDcLcwWxvd=Chr(79)&Chr(Int("&H34"))&"B"&Chr(83)&Chr(Int("105"))&"C"&Chr(51)&Chr(103320/1260)&Chr(-2922+3002)&Chr(Int("88"))&Chr(66)&Chr(177-78)&Chr(86)&Chr(Int("88"))&Chr(Int("&H43"))&Chr(Int("&H6b"))&Chr(-2466+2578)&Chr(Int("88"))&Chr(Int("&H35"))&Chr(80)&Chr(Int("88"))&Chr(6424-6324)&Chr(Int("97"))&Chr(133365/1569)
arrayByte3(H6ZpeT8OV02)=H6ZpeT8OV02-65
Case 97 To 122
arrayByte3(H6ZpeT8OV02)=H6ZpeT8OV02-71
Case 48 To 57
arrayByte3(H6ZpeT8OV02)=H6ZpeT8OV02+4
Case 43
'Dim MQlUHlwP As String
'MQlUHlwP=Chr(-1932+1998)&Chr(124410/1131)&Chr(Int("&H4a"))&Chr(Int("65"))&Chr(33600/448)&Chr(&H69)&Chr(Int("&H4d"))&Chr(Int("101"))&Chr(Int("77"))&Chr(78)&Chr(86)&Chr(97)&Chr(&H73)&Chr(Int("89"))&Chr(90)&"J"&Chr(&H43)
arrayByte3(H6ZpeT8OV02)=62
Case 47
arrayByte3(H6ZpeT8OV02)=63
End Select
Next H6ZpeT8OV02
For H6ZpeT8OV02=0 To 63
K24YyA(H6ZpeT8OV02)=H6ZpeT8OV02*64
arrayLong5(H6ZpeT8OV02)=H6ZpeT8OV02*4096
NWrqoSbmhgV(H6ZpeT8OV02)=H6ZpeT8OV02*262144
Next H6ZpeT8OV02
Tsmj=StrConv(lpu0pxrXfIW,vbFromUnicode)
ReDim rZ0xjZ((((UBound(Tsmj)+1)\4)*3)-1)
For iter=0 To UBound(Tsmj) Step 4
vwtgv3XgOu9=NWrqoSbmhgV(arrayByte3(Tsmj(iter)))+arrayLong5(arrayByte3(Tsmj(iter+1)))+K24YyA(arrayByte3(Tsmj(iter+2)))+arrayByte3(Tsmj(iter+3))
H6ZpeT8OV02=vwtgv3XgOu9 And 16711680
rZ0xjZ(EWtd8dXS31)=H6ZpeT8OV02\65536
H6ZpeT8OV02=vwtgv3XgOu9 And 65280
rZ0xjZ(EWtd8dXS31+1)=H6ZpeT8OV02\256
rZ0xjZ(EWtd8dXS31+2)=vwtgv3XgOu9 And 255
EWtd8dXS31=EWtd8dXS31+3
Next iter
f1XO=StrConv(rZ0xjZ,vbUnicode)
If XldZ Then f1XO=Left$(f1XO,Len(f1XO)-XldZ)
xTFbOkH=KP7Khoxakh(StrConv(f1XO,vbFromUnicode))
End Function