ps66uk

PS deobfuscator

Aug 16th, 2018
2,663
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. $str = Read-Host
  2.  
  3. switch -Regex ($str.Replace('^','')) {
  4.     ("(set.+)&") {$cmds = $matches[1].split('&')}
  5. }
  6.  
  7. $pstr = $cmds[0]
  8.  
  9. for ($i = 1;$i -lt $cmds.Length;$i++) {
  10.     if ($cmds[$i].length -ne 0) {
  11.         switch -Regex ($cmds[$i]) {
  12.                 ":(.)=(.)!" {$vars = $matches}
  13.         }
  14.         $pstr = $pstr -creplace [regex]::escape($vars[1]), [regex]::escape($vars[2])
  15.     }
  16. }
  17.  
  18. $decode = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($pstr.split(' ')[-1]))
  19.  
  20. switch -Regex ($decode) {
  21.     "\('(.)'\)" {$split = $matches[1]}
  22.     "'(.*)'" {($matches[1].split("'"))[0].split($split)}
  23. }
Advertisement
Add Comment
Please, Sign In to add comment