Search the Community

Hey guys, i stumpled across the problem to get the SID of a user in a very simple way, without including additional UDFs and stuff. So i came up with my own approach. You can simply call the function by inserting the wanted Username as parameter. ;For Example get your Current User SID _getSID(@UserName) ; #FUNCTION# ==================================================================================================================== ; Name ..........: _getSID ; Description ...: Get the SID of the given User ; Syntax ........: _getSID($sUsername) ; Parameters ....: $sUsername - a string value. ; Return values .: Success - SID - a string value. ; Failure - @error ; Author ........: Blitzkid ; Modified ......: 22.08.2024 ; Remarks .......: ; Related .......: ; Link ..........: ; Example .......: No ; =============================================================================================================================== Func _getSID($sUsername) Local $sCommand = "wmic useraccount where name='" & $sUsername & "' get sid" Local $hProcess = Run('cmd /c ' & $sCommand, @SystemDir, @SW_HIDE, $STDOUT_CHILD + $STDERR_CHILD) Local $sResult = "" Local $sLine While 1 $sLine = StdoutRead($hProcess) If @error Then ExitLoop If StringLen($sLine) > 0 Then $sResult &= $sLine EndIf WEnd If StringInStr($sResult, "Keine Instanzen") Then Return @error If StringInStr($sResult, "No Instance") Then Return @error $sResult = StringStripWS(StringTrimLeft(StringStripWS($sResult, 4), 4),3) ConsoleWrite("User SID: " & $sResult & @CRLF) Return $sResult EndFunc ;==>_getSID If you use a OS Language which isnt german or english you need to update the following lines or add another one in your needed language: If StringInStr($sResult, "Keine Instanzen") Then Return @error If StringInStr($sResult, "No Instance") Then Return @error Hope this helps Cheers Blitzkid

Recently I was using csvde to execute some LDAP queries on a domain controller to create some reports. I noticed that when I queried the objectSID, it was returned (output) in binary format instead of the S-#-#-##-### (string) format I needed to compare with. I found there was a function I could use in the Security.au3 UDF to convert the SID Binary value to the SID String format; however, the example in the help file collected the SID binary value by using another function to lookup an AD object by name. Since I already had the SID, this "step" was erroneous to me, but I was still required to do some work to make the _Security__SidToStringSid function accept my binary values--namely creating and populating a DLLStruct before using as a parameter for the SidToSTringSid function. Below is a small illustration of what I did. It wasn't particularly complicated or difficult, but may provide some insight to folks who don't mess/work with DLLStructs much. Also, my "real" script utilized a lengthy CSV report and parsed it to replace the binary values with the SID strings. I just wanted to share this snippet. #include <security.au3> msgbox(0,"Builtin\Users",_SIDBinaryToStr("01020000000000052000000021020000")) msgbox(0,"Builtin\Guests",_SIDBinaryToStr("01020000000000052000000022020000")) msgbox(0,"Domain Users",_SIDBinaryToStr("010500000000000515000000e2ef6c5193efdefff2b6dd4401020000")) Func _SIDBinaryToStr($hSID) Local $tSID = DllStructCreate("byte SID[256]") DllStructSetData($tSID, "SID", Binary("0x" & $hSID)) Local $sStringSID = _Security__SidToStringSid($tSID) Return $sStringSID EndFunc

A little try with SDL 2 Library, SDL 2 GFX and Sid music. As usual, no externals files needed. Press "Esc" for quit. SDL2_Fireworks.au3 Happy New Year 2017

#NoTrayIcon #Region ;**** Directives created by AutoIt3Wrapper_GUI **** #AutoIt3Wrapper_Icon='' #AutoIt3Wrapper_Outfile=Fireworks.exe #AutoIt3Wrapper_Compression=4 #AutoIt3Wrapper_UseUpx=y #AutoIt3Wrapper_UPX_Parameters=--best --lzma #AutoIt3Wrapper_UseX64=n ; titchysid.dll id 32 bit #AutoIt3Wrapper_Res_Description=Fireworks + Music #AutoIt3Wrapper_Res_Fileversion=1.0.1 #AutoIt3Wrapper_Res_LegalCopyright=wakillon #AutoIt3Wrapper_Res_Field='Compiled with'|'AutoIt Version 3.3.14.2' #AutoIt3Wrapper_AU3Check_Stop_OnWarning=y #AutoIt3Wrapper_Run_After=move /y "%out%" "Fireworks.scr" #EndRegion ;**** Directives created by AutoIt3Wrapper_GUI **** #Region ;************ Includes ************ #Include <WindowsConstants.au3> #include <AutoitObject.au3> ; https://www.autoitscript.com/forum/topic/110379-autoitobject-udf/ #include <WINAPI.au3> #Include <Memory.au3> #EndRegion ;************ Includes ************ HotKeySet ( '{ESC}', '_Exit' ) ; SWF Constants from SWF.au3 by trancexx. https://www.autoitscript.com/forum/topic/126608-flash-matic/ Global $dtagIPersist = $dtagIUnknown & "GetClassID hresult(ptr*);" Global $dtagIPersistStream = $dtagIPersist & "IsDirty hresult(ptr);Load hresult(ptr);Save hresult(ptr;bool);GetSizeMax hresult(uint64*);" Global Const $sIID_IPersistStreamInit = "{7FD52380-4E07-101B-AE2D-08002B2EC713}" Global $dtagIPersistStreamInit = $dtagIPersistStream & "InitNew hresult();" Global $dtagISequentialStream = $dtagIUnknown & "Read hresult(ptr;dword;dword*);Write hresult(ptr;dword;dword*);" Global $dtagIStream = $dtagISequentialStream & "Seek hresult(int64;dword;int64);SetSize hresult(int64);CopyTo hresult(ptr;int64;int64*;int64*);Commit hresult(dword);" & _ "Revert none();LockRegion hresult(int64;int64;dword);UnlockRegion hresult(int64;int64;dword);Stat hresult(ptr;dword);Clone hresult(ptr*);" ; Memory constants from MemoryDll.au3 by Ward. https://www.autoitscript.com/forum/topic/77463-embed-dlls-in-script-and-call-functions-from-memory-memorydll-udf/ Global Const $tagIMAGE_DOS_HEADER = 'WORD e_magic;WORD e_cblp;WORD e_cp;WORD e_crlc;WORD e_cparhdr;WORD e_minalloc;WORD e_maxalloc;WORD e_ss;WORD e_sp;WORD e_csum;WORD e_ip;WORD e_cs;WORD e_lfarlc;WORD e_ovno;WORD e_res[4];' & _ 'WORD e_oemid;WORD e_oeminfo;WORD e_res2[10];LONG e_lfanew;' Global Const $tagIMAGE_FILE_HEADER = 'WORD Machine;WORD NumberOfSections;DWORD TimeDateStamp;DWORD PointerToSymbolTable;DWORD NumberOfSymbols;WORD SizeOfOptionalHeader;WORD Characteristics;' Global $tagIMAGE_OPTIONAL_HEADER = 'WORD Magic;BYTE MajorLinkerVersion;BYTE MinorLinkerVersion;DWORD SizeOfCode;DWORD SizeOfInitializedData;DWORD SizeOfUninitializedData;DWORD AddressOfEntryPoint;DWORD BaseOfCode;DWORD BaseOfData;' & _ 'PTR ImageBase;DWORD SectionAlignment;DWORD FileAlignment;WORD MajorOperatingSystemVersion;WORD MinorOperatingSystemVersion;WORD MajorImageVersion;WORD MinorImageVersion;WORD MajorSubsystemVersion;WORD MinorSubsystemVersion;' & _ 'DWORD Win32VersionValue;DWORD SizeOfImage;DWORD SizeOfHeaders;DWORD CheckSum;WORD Subsystem;WORD DllCharacteristics;PTR SizeOfStackReserve;PTR SizeOfStackCommit;PTR SizeOfHeapReserve;PTR SizeOfHeapCommit;DWORD LoaderFlags;DWORD NumberOfRvaAndSizes;' Global Const $tagIMAGE_NT_HEADER = 'DWORD Signature;' & $tagIMAGE_FILE_HEADER & $tagIMAGE_OPTIONAL_HEADER Global Const $tagIMAGE_SECTION_HEADER = 'CHAR Name[8];DWORD VirtualSize;DWORD VirtualAddress;DWORD SizeOfRawData;DWORD PointerToRawData;DWORD PointerToRelocations;DWORD PointerToLinenumbers;WORD NumberOfRelocations;WORD NumberOfLinenumbers;' & _ 'DWORD Characteristics;' Global Const $tagIMAGE_DATA_DIRECTORY = 'DWORD VirtualAddress;DWORD Size;' Global Const $tagIMAGE_BASE_RELOCATION = 'DWORD VirtualAddress;DWORD SizeOfBlock;' Global Const $tagIMAGE_IMPORT_DESCRIPTOR = 'DWORD OriginalFirstThunk;DWORD TimeDateStamp;DWORD ForwarderChain;DWORD Name;DWORD FirstThunk;' Global Const $tagIMAGE_IMPORT_BY_NAME = 'WORD Hint;char Name[1];' Global Const $tagIMAGE_EXPORT_DIRECTORY = 'DWORD Characteristics;DWORD TimeDateStamp;WORD MajorVersion;WORD MinorVersion;DWORD Name;DWORD Base;DWORD NumberOfFunctions;DWORD NumberOfNames;DWORD AddressOfFunctions;DWORD AddressOfNames;' & _ 'DWORD AddressOfNameOrdinals;' Global $_KERNEL32DLL = DllOpen ( 'kernel32.dll' ) Global $_MFHookPtr, $_MFHookBak, $_MFHookApi = 'LocalCompact' Global Const $tagModule = 'PTR ExportList;PTR CodeBase;PTR ImportList;PTR DllEntry;DWORD Initialized;' Global $_BinaryCall_Msvcrtdll = DllOpen ( 'msvcrt.dll' ) ; Sid Constants used in SIDOpen from TitchySID Player. https://www.autoitscript.com/forum/topic/169098-chiptunes-players/ Global Const $SID_RESOURCE = 0 ; Load SID file from resources Global Const $SID_MEMORY = 1 ; Load SID file from memory Global Const $SID_DEFAULT = 1 ; Play default sub song, as found in the PSID header Global Const $SID_NON_DEFAULT = 2 ; Play specified sub song ; Internal variables. Global $hTitchysidDll, $bin, $oShockwaveFlash, $iPos, $iSizeData, $vVar, $hGui, $TransColor = 0xABCDEF Global $oError = ObjEvent ( 'AutoIt.Error', '_ErrFunc' ) AutoItWinSetTitle ( 'Fireworks.Swf.Example' ) If _ScriptIsAlreadyRunning() Then Exit _AutoItObject_Startup() $oShockwaveFlash = ObjCreate( 'ShockwaveFlash.ShockwaveFlash' ) If Not IsObj ( $oShockwaveFlash ) Then Exit -1 $hGui = GUICreate( '', @DesktopWidth, @DesktopHeight, 0, 0, $WS_POPUP, BitOR ( $WS_EX_LAYERED, $WS_EX_TOPMOST ), WinGetHandle ( AutoItWinGetTitle() ) ) ;~ GUISetBkColor( $TransColor ) GUICtrlCreateObj( $oShockwaveFlash, 0, 0, @DesktopWidth, @DesktopHeight ) ; choice : ;~ $vVar = FireworksTransSwf() ; Transparent Background $vVar = FireworksBlackswf() ; Black Background _FlashLoadMemory( $oShockwaveFlash, $vVar, $iSizeData, $iPos ) _WinAPI_SetLayeredWindowAttributes( $hGui, $TransColor, 255 ) GUISetState() $hTitchysidDll = _SIDStartup() If Not @error Then $bin = Beat_Popsid() ; 16_Beat_Pop.sid _SIDOpen ( $bin, $SID_RESOURCE ) EndIf While 1 Sleep ( 1000 ) WEnd Func _ErrFunc() ConsoleWrite ( 'COM Error, ScriptLine(' & $oError.scriptline & ') : Number 0x' & Hex ( $oError.number, 8 ) & ' - ' & $oError.windescription & @CRLF ) EndFunc ;==> _ErrFunc() Func _Exit() _SIDStop() _SIDClose() _SIDShutdown() $oShockwaveFlash = 0 GUIDelete( $hGui ) Exit EndFunc ;==> _Exit() Func _FlashLoadMemory($oShockwaveFlash, ByRef $vData, ByRef $iSizeData, ByRef $iPos) If Not IsObj($oShockwaveFlash) Then Return SetError(1, 0, False) Local $oFlashInterface = _AutoItObject_WrapperCreate(_AutoItObject_IDispatchToPtr($oShockwaveFlash), $dtagIUnknown) If Not IsObj($oFlashInterface) Then Return SetError(2, 0, False) Local $oFlashMemoryStream = _AutoItObject_ObjectFromDtag("_FlashMemoryStream_", $dtagIStream) Local $tIID_IPersistStreamInit = _AutoItObject_CLSIDFromString($sIID_IPersistStreamInit) Local $aCall = $oFlashInterface.QueryInterface(Number(DllStructGetPtr($tIID_IPersistStreamInit)), 0) Local $pPersistStreamInit = $aCall[2] Local $oPersistStreamInit = _AutoItObject_WrapperCreate($pPersistStreamInit, $dtagIPersistStreamInit) $oPersistStreamInit.InitNew() $iPos = 0 $iSizeData = BinaryLen($vData) $oPersistStreamInit.Load(Number($oFlashMemoryStream.__ptr__)) _AutoItObject_IUnknownAddRef($oShockwaveFlash) Return True EndFunc ;==>_FlashLoadMemory Func _FlashMemoryStream_Read($pSelf, $pBuffer, $iCb, $pRead) #forceref $pSelf If $iPos = 0 And $iCb = 4 Then DllStructSetData(DllStructCreate("char[4]", $pBuffer), 1, "fUfU") $iPos += 4 ElseIf $iPos = 4 And $iCb = 4 Then DllStructSetData(DllStructCreate("dword", $pBuffer), 1, $iSizeData) $iSizeData += 8 $iPos += 4 Else If $iPos + $iCb > $iSizeData Then $iCb = $iSizeData - $iPos If $iCb = 0 Then Return 1 DllStructSetData(DllStructCreate("byte[" & $iCb & "]", $pBuffer), 1, BinaryMid($vVar, 1 + $iPos - 8, $iCb)) If $pRead Then DllStructSetData(DllStructCreate("dword", $pRead), 1, $iCb) $iPos += $iCb EndIf Return 0 EndFunc ;==>_FlashMemoryStream_Read Func _FlashMemoryStream_Release($pSelf) #forceref $pSelf Return 0x80004001 EndFunc ;==>_FlashMemoryStream_Release Func _ScriptIsAlreadyRunning() Local $aWinList = WinList ( AutoItWinGetTitle() ) If Not @error Then Return UBound ( $aWinList ) -1 > 1 EndFunc ;==> _ScriptIsAlreadyRunning() Func _SIDClose() Local $aRet = MemoryDllCall ( $hTitchysidDll, 'int', 'SIDClose' ) If @error Then Return SetError ( @error, 0, 0 ) Return $aRet[0] EndFunc ;==> _SIDClose() Func _SIDOpen ( $Sid, $iSubsong=1 ) Local $bSid If Not IsBinary ( $Sid ) Then If Not FileExists ( $Sid ) Then Return SetError ( 2, 0, 0 ) Local $hFileOpen = FileOpen ( $Sid, 0 ) If $hFileOpen = -1 Then Return SetError ( -1, 0, 0 ) $bSid = FileRead ( $hFileOpen ) FileClose ( $hFileOpen ) Else $bSid = $Sid EndIf Local $tSid = DllStructCreate ( 'byte[' & BinaryLen ( $bSid ) & ']') DllStructSetData ( $tSid, 1, $bSid ) Local $iSubsongCount = Int ( StringTrimLeft ( BinaryMid ( $bSid, 15, 2 ), 2 ) ) $iSubsong = $iSubsong -1 ; based 0 If $iSubsong < 0 Then $iSubsong = 0 If $iSubsong > $iSubsongCount Then $iSubsong = 0 Local $aRet = MemoryDllCall ( $hTitchysidDll, 'int', 'SIDOpen', 'ptr', DllStructGetPtr ( $tSid ), 'int', DllStructGetSize ( $tSid ), 'int', $SID_MEMORY, 'int', $SID_NON_DEFAULT, 'int', $iSubsong ) If @error Then Return SetError ( @error, 0, 0 ) $tSid = 0 $bSid = 0 Return $aRet[0] ; Returns non-zero on success. EndFunc ;==> _SIDOpen() Func _SIDShutdown() MemoryDllClose ( $hTitchysidDll ) $hTitchysidDll = 0 EndFunc ;==> _SIDShutdown() Func _SIDStartup() Local $hOpen = MemoryDllOpen ( Titchysiddll() ) If $hOpen = -1 Then Return SetError ( 1, 0, 0 ) Return SetError ( 0, 0, $hOpen ) EndFunc ;==> _SIDStartup() Func _SIDStop() Local $aRet = MemoryDllCall ( $hTitchysidDll, 'int', 'SIDStop' ) If @error Then Return SetError ( @error, 0, 0 ) Return $aRet[0] EndFunc ;==> _SIDStop() Func API_FreeLibrary ( $Module ) Local $Ret = DllCall ( $_KERNEL32DLL, 'bool', 'FreeLibrary', 'handle', $Module ) If @Error Then Return SetError ( @Error, @Extended, 0 ) Return $Ret[0] EndFunc ;==> API_FreeLibrary() Func API_GetProcAddress ( $Module, $Procname ) Local $Ret If IsNumber ( $Procname ) Then $Ret = DllCall ( $_KERNEL32DLL, 'ptr', 'GetProcAddress', 'handle', $Module, 'int', $Procname ) Else $Ret = DllCall ( $_KERNEL32DLL, 'ptr', 'GetProcAddress', 'handle', $Module, 'str', $Procname ) EndIf If @Error Then Return SetError ( @Error, @Extended, 0 ) Return $Ret[0] EndFunc ;==> API_GetProcAddress() Func API_IsBadReadPtr ( $Ptr, $Len ) Local $Ret = DllCall ( $_KERNEL32DLL, 'int', 'IsBadReadPtr', 'ptr', $Ptr, 'UINT_PTR', $Len ) If @Error Then Return SetError ( @Error, @Extended, 0 ) Return $Ret[0] EndFunc ;==> API_IsBadReadPtr() Func API_LoadLibrary ( $Filename ) Local $Ret = DllCall ( $_KERNEL32DLL, 'handle', 'LoadLibraryW', 'wstr', $Filename ) If @Error Then Return SetError ( @Error, @Extended, 0 ) Return $Ret[0] EndFunc ;==> API_LoadLibrary() Func API_lstrlenA ( $Address ) Local $Ret = DllCall ( $_KERNEL32DLL, 'int', 'lstrlenA', 'ptr', $Address ) If @Error Then Return SetError ( @Error, @Extended, 0 ) Return $Ret[0] EndFunc ;==> API_lstrlenA() Func API_lstrlenW ( $Address ) Local $Ret = DllCall ( $_KERNEL32DLL, 'int', 'lstrlenW', 'ptr', $Address ) If @Error Then Return SetError ( @Error, @Extended, 0 ) Return $Ret[0] EndFunc ;==> API_lstrlenW() Func API_VirtualProtect ( $Address, $Size, $Protection ) Local $Ret = DllCall ( $_KERNEL32DLL, 'bool', 'VirtualProtect', 'ptr', $Address, 'dword_ptr', $Size, 'dword', $Protection, 'dword*', 0 ) If @Error Then Return SetError ( @Error, @Extended, 0 ) Return $Ret[0] EndFunc ;==> API_VirtualProtect() Func API_ZeroMemory ( $Address, $Size ) Local $Ret = DllCall ( $_KERNEL32DLL, 'none', 'RtlZeroMemory', 'ptr', $Address, 'dword_ptr', $Size ) If @Error Then Return SetError ( @Error, @Extended, 0 ) Return $Ret[0] EndFunc ;==> API_ZeroMemory() Func Beat_Popsid() ; Code Generated by BinaryToAu3Kompressor. Local $sFileBin = 'UFNJRAACAHwAABAAEAMAAQABAAAAADE2IEJlYXQgUG9wAAAAAAAAAAAAAAAAAAAAAAAAAAAAUmFmYWwgU3Rh8WN6eWsgKFJhZmZpKQAAAAAAAAAAAAAxOTk2IFRvbmljAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAQTB0QTIUQTC8WTD4WAAAAAAAADDAwAQsLAQAAAABMBxgtEAwBGQUSIAIZIAISCQEOIA8GIAcSAQYGCRQZIDkxLc+tDd2NEdCtGdCNGNBOGNS5qxqNFhe5rBqNFxeNGNSiAIqdGBfo4IbQ+KIAqQGdDBCdOxfo4APQ9aIAip0A1OjgGND4YM4YFxAGrRYXjRgXogCOIBcgsBDoILAQ6CCwEK0cF40W1K0YEA0jF40X1GC9DBDwEK0WF80YF9AI3jsXvTsX8ANM+RG9BxeF+L0KF4X5vCYXsfgQKMn/0AipAJ0mF0zSEMn+0AapAJ0MEGA46aCwBEkfaQGdLBf+JhfIsfioubEchfi5uByF+UzAF7H4MBLJYJALKR+dFRD+KRdMDBFMohHJfvBLyX3wVsnAkGYpH0gpD51BF2gpENAgyLH4GH0sF51EF8ix+Bh9LBedRxf+KRf+KRe9RBdMphHIsfgYfSwXnUcXvRIQnUQX/ikXTHQRvT4XnTsX/ikXIOYRTCITvT4XnTsXvQ8QSQGdDxD+KRdMfRFM2hc+GNQpF0wMERh9LBedEhCouUcWnS8XuacWnTIXvT4XnTsX/ikXvbAX0LmpAJ01F504FxidaBedaxcgIxi8DRepCCD7F6n/nQ8QnUoXvCkXsfjJf/ABYKkAnSkXIC0YYL1KF9ADTCITGKkAnUoXnVAXnYkXnZIXnZUXvRUQCgoKfRUQfRUQfRUQnU0XqLnwGEi58Ri8DRcgSxhomQXUvE0XufoYKQTQKLnyGEgpD51TF2hKSkpKnVYXSQ+dWRe59hhKSkpKnV8XqQCdYhedZRe5+hgpIPBQrRgQHRAXjRgQufoYKQLQSakAjRkXjRoXufYYKQ8KCgoKjRsXqLksGkgp8I0jF2gpDwoKCgoNFxeNGNS5LRqNHBe5LhqNHRe5LxqNHhdMyRKtGBA9ExeNGBC8TRe59xhIKfBKnXEXaCkPnXQXufgYnXcXufkYnXoXufoYnX0XvBIQuYgYGJ2SF6kCnYYXIIUYvX0XKYDwEbwNF6n/mQDUmQHUqYGZBNRgTJEVrQ7cjQXUSr2GF/AG3oYXTE4TvX0XKRDwDr07F8kB0BOp/iDsF9AMvX0XKQjQBan+nQ8QvWIXShh9TReoufMYjR8XvWIXKQHwDK0fFykPCgoKCkx1E60fFynwGH1fF51cF71lF9AevVAXGH1cF51QF71TF2kAnVMX3VkX0C2pAZ1lF9AcvVAXOP1cF51QF71TF+kAnVMX3VYX0A+pAJ1lF71iF8kF8AP+Yhe9fRcpIPBQrSAX0EvojiAXyq0cF80eF/A+rRsXGG0ZF6i5MBqNIRe5NhqNIhetHBcYbSEXjRwX7hoXrRoXzSIX0BWpAI0aF+4ZF60ZF8kG0AatHReNGRe9QRfwfgoKCgqNHxe9RBfdRxewKrxHF701FxhtHxedNRe9OBdpAJ04F701Fxh9Lxe9OBd9MhfZpxbQRUyBFLxHF701FzjtHxedNRe9OBfpAJ04F701Fxh9Lxe9OBd9MhfZpxbQG5idEhC5RxadLxe5pxadMhepAJ1BF501F504F0yRFb1xF/AG3nEXTJEVvX0XKUDwb+4ZEK0ZECkBjRkQ0ANMkRW8DRe9LxcYfTUXjSQXvTIXaQCNJRetJBc4/ZgXmQDUrSUX/ZsXmQHUvXcXMBW9mBcYfXcXnZgXvZsXaQCdmxdMGRa9dxcpf40aEL2YFzjtGhCdmBe9mxfpAJ2bF0wZFr1oF9AhvTUXGH2SF501F704F32VF504F/5rF71rF910F/AkTJEVvTUXOP2SF501F704F/2VF504F/5rF71rF910F/ADTJEVqQCdaxe9aBdJAZ1oF71uF913F/AV/m4XvXQXGH10F510F72VF2kALJUXvX0XKQHQPbx6F7nMGcmQkBM46ZCNHxe9ehc47R8XnXoXTJgVnYAXufwZGH0SEJ2DF6i5RxadLxe5pxadMhf+ehdMAxa8ehe5zBnJkJATOOmQjR8XvXoXOO0fF516F0zVFZ2AF6kAnS8XufwZnTIX/noXvA0XvS8XGH01F5kA1L0yF304F5kB1L1QF5kC1L1TF5kD1L2AFz0PEJkE1GCiAIqdDBCdDxDo4APQ9WBImJ0VEGhMphEMHC0+R2Z7kanD3foYOFp9o8z2I1OGu/QwcLT7R5jtR6cMd+lh4Wj3jzDaj04Y79LDw9HvH2C1Hpwx36WHhqLfPsFrPDljvksPDEW/fYPWeXPHfJceGIt++gas8+aP+PwBAQEBAQEBAQEBAQECAgICAgICAwMDAwMEBAQEBQUFBgYHBwcICAkJCgsLDA0ODg8QERITFRYXGRocHR8hIyUnKiwvMjU4Oz9DR0tPVFleZGpwd36GjpafqLO9yNTh7v0AAABoaWoABw4BAgT+/fsBDwABUAAAAAABAf8A8AAAAAAAJxsbAAAAGMPDAhAQAAAAAAAABAQEBAQEAAAAAAA3AAAHAAAAC3l54AAA3A0NCAICBw0NMgAAAgAAAQEBAQEBAAAA4AICAAEBAAAAAAQEAAEBASkpqAAAQRERDDAwAAAAAAAAAAAAAAAAACgoAAAAAAAAAAAA/wAAAAAAAP+/HBQwBgcBvxwAAAAAAAAAAAAAAAAAAAAAAEw3GLH4yXzwA0wlEb2wF0kBnbAX/ikXTMAXyYCQCyk/nT4X/ikXTAwRTBMRnQ8QvA0XqQCZBdSZBtRgmQTUqQ+ZBdSZBtRgCgoKqKIAuasanQcXuawanQoXyMjo4APQ7UxwGJ1uF52YF52bF2D+JhedsBcssxdgvCkXsfjJ8JCFKQ+dsxf+KRdMNxiNQBC9sxfQB61AEJkG1GCtQBApD41AEL2zFwoKCgoNQBCZBtRgogCKnbAX6OAI0PhMUBAAABiddRlgvXQX0AOdkhdgAgIEBAQEBAQEBAQEBAQICAgICAgIDAwMDAwQEBAQFBQUGBgcHBwgICQkKCwsMDQ4ODxAREhMVFhcZGhwdHyEjJScqLC8yNTg7Pz///////////////////////////////8AAAAAAAAAAAAAAADMhiMzMyAAAACoAPYIAAAAAgAACQEA+AgAAAAAAAACAQIvCURERJkAACVlAOgGREREAQAAICgAaAZEREQBAAATCABoBkRERAEAACAIAM8CiIiIAgAAACAA3AgAAAAAAAAakAClCAAAAAAAABoIDc8mIAAAACIBKABIpCYgAAAAIgEoAADuKCMzM/MAAAAIAOsoIiAApAAAKiEAzDgyIyOgIgEtCAB6NjIiIqAAAC0IAEgoIiIiBQAAGggAiAhEREQFAAAToACICERERAUAACCgQZGBQUFBgYCRgREREREREREQkUFBQUFBQZYXkQAAAABBQUFBQUGWURGRgYCRQZGRAAD/Dw0IM/8A/w8NCggFBAIAAAAAAwMHBwAAAAAAAAAAAAQEBwcAAAAA//8AAAAA8ZAAAGD/AAAAAAIAAAAAAPaiABb+AAAAAAACAAAAAADxeAAAygIAAAAAAQIAAAAAIRAAAP4AAAAAAAIAAAAAAPYqAAACAAAAAAAAAAAAAADx8gAAKgAAAAAAAQAAAAAAAQEBAQEBAQEBAQH/AgICAgICAgICAgL/AgIFAwQG/4wamBqkGgEPc4g1fjU1fjV+cjJ+MjJ+Mn5zMH4wMH4wfnIyfjIyfjJ+f4RhHSljGGEpHSljGGEpFSFjGGEhFSFjGGEhGiZjGGEmGiZjGGEmDBhjGGEYDBhjGGEYf4RrNTk8NTk8NTw5PEA5PEA5QDI1OTI1OTI5MDQ3MDQ3MDd/bYQ5fn5+OTc8MH5+fjJ+' $sFileBin &= 'fjAyN35+NX5+fn40NTQwfn5+fnyBPEBDRXyEfn5FQzxIQ35Ffn5DRUHfPn5+fn5+fn7fPH1+fn4w3wB+0H5/aIQ5fn5+OTU0MH5+fn5+fn5+Mn5+fn5+fn4wfn5+fn5+fnyCMjAyNDI0NTQ1NzU3OTc5Ojk6PDo8Pjw+QD5BQEFDREWEfH5+fn5+fENBPHx+fn5+fn5+fn9thDAwMDAwMDAwMn5+MH5+KS1+fiYrfn4mJH5+fn5+fn5+KX5+figpLSQwfn5+MC0rLSl+fn4mfn4kfn5+fn5+fn6CKX4pKSl+KX4pfil+KX4pfi1+LS0tfi0tLX4tLS1+LX45fn5+fn5+fjAyNDA5OTUyMH5+fn5+fn5+fn5+fn5+fn9ohMk5PH5+yTk8fn7JNzl+yTs+fsk5PH5+fn7JNjl+fn7JNjl+fsk5PH7JNDd+fn5+fn6BNTc5foQ8fn48fn45fj5+PH5+fn45fn5+OX5+PH433wd+fn5+fn5/s9UIK3nSVhoaGxsbGxw=' $sFileBin = Binary ( __Au3Obj_Mem_Base64Decode ( $sFileBin ) ) Return SetError ( 0, 0, $sFileBin ) EndFunc ;==> Beat_Popsid() Func BinaryCall_Alloc ( $Code, $Padding = 0 ) Local $Length = BinaryLen ( $Code ) + $Padding Local $Ret = DllCall ( $_KERNEL32DLL, 'ptr', 'VirtualAlloc', 'ptr', 0, 'ulong_ptr', $Length, 'dword', 0x1000, 'dword', 0x40 ) If @Error Or Not $Ret[0] Then Return SetError ( 1, @Error, 0 ) If BinaryLen ( $Code ) Then Local $Buffer = DllStructCreate ( 'byte[' & $Length & ']', $Ret[0] ) DllStructSetData ( $Buffer, 1, $Code ) EndIf Return $Ret[0] EndFunc ;==> BinaryCall_Alloc() Func BinaryCall_Base64Decode ( $Src ) Static $CodeBase If Not $CodeBase Then $CodeBase = BinaryCall_Create ( '0x55B9FF00000089E531C05756E8F10000005381EC0C0100008B55088DBDF5FEFFFFF3A4E9C00000003B45140F8FC20000000FB65C0A028A9C1DF5FEFFFF889DF3FEFFFF0FB65C0A038A9C1DF5FEFFFF889DF2FEFFFF0FB65C0A018985E8FEFFFF0FB69C1DF5FEFFFF899DECFEFFFF0FB63C0A89DE83E630C1FE040FB6BC3DF5FEFFFFC1E70209FE8B7D1089F3881C074080BDF3FEFFFF63745C0FB6B5F3FEFFFF8BBDECFEFFFF8B9DE8FEFFFF89F083E03CC1E704C1F80209F88B7D1088441F0189D883C00280BDF2FEFFFF6374278A85F2FEFFFFC1E60683C10483E03F09F088441F0289D883C0033B4D0C0F8C37FFFFFFEB0231C081C40C0100005B5E5F5DC35EC3E8F9FFFFFF000000000000000000000000000000000000000000000000000000000000000000000000000000000000003E0000003F3435363738393A3B3C3D00000063000000000102030405060708090A0B0C0D0E0F101112131415161718190000000000001A1B1C1D1E1F202122232425262728292A2B2C2D2E2F30313233', '', 132, True, False ) If Not $CodeBase Then Return SetError ( 1, 0, Binary ( '' ) ) EndIf $Src = String ( $Src ) Local $SrcLen = StringLen ( $Src ) Local $SrcBuf = DllStructCreate ( 'char[' & $SrcLen & ']' ) DllStructSetData ( $SrcBuf, 1, $Src ) Local $DstLen = Int ( ( $SrcLen + 2 ) / 4 ) * 3 + 1 Local $DstBuf = DllStructCreate ( 'byte[' & $DstLen & ']' ) Local $Ret = DllCallAddress ( 'uint:cdecl', $CodeBase, 'ptr', DllStructGetPtr ( $SrcBuf ), 'uint', $SrcLen, 'ptr', DllStructGetPtr ( $DstBuf ), 'uint', $DstLen ) If $Ret[0] = 0 Then Return SetError ( 2, 0, Binary ( '' ) ) Return BinaryMid ( DllStructGetData ( $DstBuf, 1 ), 1, $Ret[0] ) EndFunc ;==> BinaryCall_Base64Decode() Func BinaryCall_CodePrepare ( $Code ) If Not $Code Then Return '' If IsBinary ( $Code ) Then Return $Code $Code = String ( $Code ) If StringLeft ( $Code, 2 ) = '0x' Then Return Binary ( $Code ) If StringIsXDigit ( $Code ) Then Return Binary ( '0x' & $Code ) Return BinaryCall_LzmaDecompress ( BinaryCall_Base64Decode ( $Code ) ) EndFunc ;==> BinaryCall_CodePrepare() Func BinaryCall_Create ( $Code, $Reloc = '', $Padding = 0, $ReleaseOnExit = True, $LibraryImport = True ) Local $BinaryCode = BinaryCall_CodePrepare ( $Code ) If Not $BinaryCode Then Return SetError ( 1, BinaryCall_LastError ( 'Invalid code' ), 0 ) Local $BinaryCodeLen = BinaryLen ( $BinaryCode ) Local $TotalCodeLen = $BinaryCodeLen + $Padding Local $CodeBase = BinaryCall_Alloc ( $BinaryCode, $Padding ) If Not $CodeBase Then Return SetError ( 2, BinaryCall_LastError ( 'Unable to allocate memory block' ), 0 ) If $Reloc Then $Reloc = BinaryCall_CodePrepare ( $Reloc ) If Not $Reloc Then Return SetError ( 3, BinaryCall_LastError ( 'Invalid relocation table' ), 0 ) BinaryCall_Relocation ( $CodeBase, $Reloc ) EndIf If $LibraryImport Then If Not BinaryCall_ImportLibrary ( $CodeBase, $BinaryCodeLen ) Then BinaryCall_Free ( $CodeBase ) Return SetError ( 4, 0, 0 ) EndIf EndIf If $ReleaseOnExit Then BinaryCall_ReleaseOnExit ( $CodeBase ) EndIf Return SetError ( 0, $TotalCodeLen, $CodeBase ) EndFunc ;==> BinaryCall_Create() Func BinaryCall_DoRelease() BinaryCall_ReleaseOnExit_Handle() EndFunc ;==> BinaryCall_DoRelease() Func BinaryCall_Free ( $Ptr ) Local $Ret = DllCall ( $_KERNEL32DLL, 'bool', 'VirtualFree', 'ptr', $Ptr, 'ulong_ptr', 0, 'dword', 0x8000 ) If @Error Or $Ret[0] = 0 Then $Ret = DllCall ( $_KERNEL32DLL, 'bool', 'GlobalFree', 'ptr', $Ptr ) If @Error Or $Ret[0] <> 0 Then Return SetError ( 1, @Error, False ) EndIf Return True EndFunc ;==> BinaryCall_Free() Func BinaryCall_GetProcAddress ( $Module, $Proc ) Local $Ret = DllCall ( $_KERNEL32DLL, 'ptr', 'GetProcAddress', 'ptr', $Module, 'str', $Proc ) If @Error Or Not $Ret[0] Then Return SetError ( 1, @Error, 0 ) Return $Ret[0] EndFunc ;==> BinaryCall_GetProcAddress() Func BinaryCall_ImportLibrary ( $Base, $Length ) ;~ Static $HasMemoryDll = IsFunc(Execute ( '__MemoryModule_RuntimeLoader' ) ) Local $JmpBin, $JmpOff, $JmpLen, $DllName, $ProcName $JmpBin = Binary ( '0xB8FFFFFFFFFFE0' ) $JmpOff = 1 $JmpLen = BinaryLen ( $JmpBin ) Local $Ptr, $StringPtr, $StringLen, $String, $Split, $Proc, $Diff, $Handle Do $Ptr = BinaryCall_MemorySearch ( $Base, $Length, $JmpBin ) If $Ptr = 0 Then ExitLoop $StringPtr = $Ptr + $JmpLen $StringLen = BinaryCall_lstrlenA ( $StringPtr ) If Not $StringLen Then Return SetError ( 3, BinaryCall_LastError ( 'Invalid import table' ), False ) $String = DllStructGetData ( DllStructCreate ( 'char[' & $StringLen & ']', $StringPtr ), 1 ) $Split = StringSplit ( $String, '|' ) If $Split[0] = 1 Then $ProcName = $Split[1] ElseIf $Split[0] = 2 Then If $Split[1] Then $DllName = $Split[1] $ProcName = $Split[2] EndIf If $DllName And $ProcName Then $Proc = 0 $Handle = BinaryCall_LoadLibrary ( $DllName ) If Not $Handle Then Return SetError ( 1, BinaryCall_LastError ( 'LoadLibrary fail on ' & $DllName ), False ) $Proc = BinaryCall_GetProcAddress ( $Handle, $ProcName ) If Not $Proc Then Return SetError ( 2, BinaryCall_LastError ( 'GetProcAddress failed on ' & $ProcName ), False ) DllStructSetData(DllStructCreate ( 'ptr', $Ptr + $JmpOff ), 1, $Proc ) EndIf $Diff = Int ( $Ptr - $Base + $JmpLen + $StringLen + 1 ) $Base += $Diff $Length -= $Diff Until $Length <= $JmpLen Return True EndFunc ;==> BinaryCall_ImportLibrary() Func BinaryCall_IsBadReadPtr ( $Ptr, $Length ) Local $Ret = DllCall ( $_KERNEL32DLL, 'int', 'IsBadReadPtr', 'ptr', $Ptr, 'uint_ptr', $Length ) If @Error Then Return SetError ( 1, @Error, 0 ) Return $Ret[0] EndFunc ;==> BinaryCall_IsBadReadPtr() Func BinaryCall_LastError ( $Error = Default ) Static $LastError If IsKeyword ( $Error ) Then Return $LastError $LastError = $Error EndFunc ;==> BinaryCall_LastError() Func BinaryCall_LoadLibrary ( $Filename ) Local $Ret = DllCall ( $_KERNEL32DLL, 'handle', 'LoadLibraryW', 'wstr', $Filename ) If @Error Then Return SetError ( 1, @Error, 0 ) Return $Ret[0] EndFunc ;==> BinaryCall_LoadLibrary() Func BinaryCall_lstrlenA ( $Ptr ) Local $Ret = DllCall ( $_KERNEL32DLL, 'int', 'lstrlenA', 'ptr', $Ptr ) If @Error Then Return SetError ( 1, @Error, 0 ) Return $Ret[0] EndFunc ;==> BinaryCall_lstrlenA() Func BinaryCall_LzmaDecompress ( $Src ) Static $CodeBase If Not $CodeBase Then $CodeBase = BinaryCall_Create ( BinaryCall_Base64Decode ( 'VYnlVzH/VlOD7EyLXQiKC4D54A+HxQAAADHA6wWD6S2I0ID5LI1QAXfziEXmMcDrBYPpCYjQgPkIjVABd/OIReWLRRSITeSLUwkPtsmLcwWJEA+2ReUBwbgAAwAA0+CNhABwDgAAiQQk6EcEAACJNCSJRdToPAQAAItV1InHi0Xkhf+JArgBAAAAdDaF9nQyi0UQg8MNiRQkiXQkFIl8JBCJRCQYjUXgiUQkDItFDIlcJASD6A2JRCQI6CkAAACLVdSJRdSJFCToAQQAAItF1IXAdAqJPCQx/+jwAwAAg8RMifhbXl9dw1dWU1WJ5YtFJAFFKFD8i3UYAXUcVot1FK2SUopO/oPI/9Pg99BQiPGDyP/T4PfQUADRifeD7AwpwEBQUFBQUFcp9laDy/+4AAMAANPgjYg2BwAAuAAEAATR6fOragVZ6MoCAADi+Yt9/ItF8Ct9JCH4iUXosADoywIAAA+FhQAAAIpN9CN97NPngOkI9tnT7lgB916NPH/B5wg8B1qNjH5sDgAAUVa+AAEAAFCwAXI0i338K33cD7Y/i23M0eeJ8SH+AfGNbE0A6JgCAACJwcHuCIPhATnOvgABAAB1DjnwctfrDIttzOh5AgAAOfBy9FqD+gSJ0XIJg/oKsQNyArEGKcpS60mwwOhJAgAAdRRYX1pZWln/NCRRUrpkBgAAsQDrb7DM6CwCAAB1LLDw6BMCAAB1U1g8B7AJcgKwC1CLdfwrddw7dSQPgs8BAACsi338qumOAQAAsNjo9wEAAIt12HQbsOTo6wEAAIt11HQJi3XQi03UiU3Qi03YiU3Ui03ciU3YiXXcWF9ZumgKAACxCAH6Ulc8B4jIcgIEA1CLbczovAEAAHUUi0Xoi33MweADKclqCF6NfEcE6zWLbcyDxQLomwEAAHUYi0Xoi33MweADaghZaghejbxHBAEAAOsQvwQCAAADfcxqEFm+AAEAAIlN5CnAQIn96GYBAACJwSnxcvMBTeSDfcQED4OwAAAAg0XEB4tN5IP5BHIDagNZi33IweEGKcBAakBejbxPYAMAAIn96CoBAACJwSnxcvOJTeiJTdyD+QRyc4nOg2XcAdHug03cAk6D+Q5zGbivAgAAKciJ8dJl3ANF3NHgA0XIiUXM6y2D7gToowAAANHr0WXcOV3gcgb/RdwpXeBOdei4RAYAAANFyIlFzMFl3ARqBF4p/0eJ+IttzOi0AAAAqAF0Awl93NHnTnXs6wD/RdyLTeSDwQKLffyJ+CtFJDlF3HdIif4rddyLVSisqjnXcwNJdfeJffwPtvA7fSgPgnH9///oKAAAACnAjWwkPItVIIt1+Ct1GIkyi1Usi338K30kiTrJW15fw15YKcBA69qB+wAAAAFyAcPB4whWi3X4O3Ucc+SLReDB4AisiUXgiXX4XsOLTcQPtsDB4QQDRegByOsGD7bAA0XEi23IjWxFACnAjWxFAIH7AAAAAXMci0wkOMFkJCAIO0wkXHOcihH/RCQ4weMIiFQkIInZD7dVAMHpCw+vyjlMJCBzF4nLuQAIAAAp0cHpBWYBTQABwI1sJEDDweoFKUwkICnLZilVAAHAg8ABjWwkQMO4///////gbXN2Y3J0LmRsbHxtYWxsb2MAuP//////4GZyZWUA' ) ) If Not $CodeBase Then Return SetError ( 1, 0, Binary ( '' ) ) EndIf $Src = Binary ( $Src ) Local $SrcLen = BinaryLen ( $Src ) Local $SrcBuf = DllStructCreate ( 'byte[' & $SrcLen & ']' ) DllStructSetData ( $SrcBuf, 1, $Src ) Local $Ret = DllCallAddress ( 'ptr:cdecl', $CodeBase, 'ptr', DllStructGetPtr ( $SrcBuf ), 'uint_ptr', $SrcLen, 'uint_ptr*', 0, 'uint*', 0 ) If $Ret[0] Then Local $DstBuf = DllStructCreate ( 'byte[' & $Ret[3] & ']', $Ret[0] ) Local $Output = DllStructGetData ( $DstBuf, 1 ) DllCall ( $_BinaryCall_Msvcrtdll, 'none:cdecl', 'free', 'ptr', $Ret[0] ) Return $Output EndIf Return SetError(2, 0, Binary ( '' ) ) EndFunc ;==> BinaryCall_LzmaDecompress() Func BinaryCall_MemorySearch ( $Ptr, $Length, $Binary ) Static $CodeBase If Not $CodeBase Then $CodeBase = BinaryCall_Create ( '0x5589E58B4D14578B4508568B550C538B7D1085C9742139CA721B29CA8D341031D2EB054239CA740F8A1C17381C1074F34039F076EA31C05B5E5F5DC3', '', 0, True, False ) If Not $CodeBase Then Return SetError ( 1, 0, 0 ) EndIf $Binary = Binary ( $Binary ) Local $Buffer = DllStructCreate ( 'byte[' & BinaryLen ( $Binary ) & ']' ) DllStructSetData ( $Buffer, 1, $Binary ) Return DllCallAddress ( 'ptr:cdecl', $CodeBase, 'ptr', $Ptr, 'uint', $Length, 'ptr', DllStructGetPtr ( $Buffer ), 'uint', DllStructGetSize ( $Buffer ) )[0] EndFunc ;==> BinaryCall_MemorySearch() Func BinaryCall_RegionSize ( $Ptr ) Local $Buffer = DllStructCreate ( 'ptr;ptr;dword;uint_ptr;dword;dword;dword' ) Local $Ret = DllCall ( $_KERNEL32DLL, 'int', 'VirtualQuery', 'ptr', $Ptr, 'ptr', DllStructGetPtr ( $Buffer ), 'uint_ptr', DllStructGetSize ( $Buffer ) ) If @Error Or $Ret[0] = 0 Then Return SetError ( 1, @Error, 0 ) Return DllStructGetData ( $Buffer, 4 ) EndFunc ;==> BinaryCall_RegionSize() Func BinaryCall_ReleaseOnExit ( $Ptr ) OnAutoItExitRegister ( 'BinaryCall_DoRelease' ) BinaryCall_ReleaseOnExit_Handle ( $Ptr ) EndFunc ;==> BinaryCall_ReleaseOnExit() Func BinaryCall_ReleaseOnExit_Handle ( $Ptr = Default ) Static $PtrList If @NumParams = 0 Then If IsArray ( $PtrList ) Then For $i = 1 To $PtrList[0] BinaryCall_Free ( $PtrList[$i] ) Next EndIf Else If Not IsArray($PtrList) Then Local $InitArray[1] = [0] $PtrList = $InitArray EndIf If IsPtr($Ptr) Then Local $Array = $PtrList Local $Size = UBound ( $Array ) ReDim $Array[$Size + 1] $Array[$Size] = $Ptr $Array[0] += 1 $PtrList = $Array EndIf EndIf EndFunc ;==> BinaryCall_ReleaseOnExit_Handle() Func BinaryCall_Relocation ( $Base, $Reloc ) Local $Size = Int ( BinaryMid ( $Reloc, 1, 2 ) ) Local $Offset, $Ptr For $i = 3 To BinaryLen ( $Reloc ) Step $Size $Offset = Int(BinaryMid ( $Reloc, $i, $Size ) ) $Ptr = $Base + $Offset DllStructSetData ( DllStructCreate ( 'ptr', $Ptr ), 1, DllStructGetData ( DllStructCreate ( 'ptr', $Ptr ), 1 ) + $Base ) Next EndFunc ;==> BinaryCall_Relocation() Func BinaryCall_SymbolFind ( $CodeBase, $Identify, $Length, $BeforeJump = False ) Local $Ptr $Identify = Binary ( $Identify ) If BinaryCall_IsBadReadPtr ( $CodeBase, $Length ) Then Return SetError ( 2, 0, 0 ) If $BeforeJump Then $Ptr = BinaryCall_MemorySearch ( $CodeBase, $Length, $Identify & Binary ( '0xE9' ) ) If $Ptr Then Return $Ptr + BinaryLen ( $Identify ) $Ptr = BinaryCall_MemorySearch ( $CodeBase, $Length, $Identify & Binary ( '0xEB' ) ) If $Ptr Then Return $Ptr + BinaryLen ( $Identify ) Else $Ptr = BinaryCall_MemorySearch ( $CodeBase, $Length, $Identify ) If $Ptr Then Return $Ptr + BinaryLen ( $Identify ) EndIf Return SetError ( 1, 0, 0 ) EndFunc ;==> BinaryCall_SymbolFind() Func BinaryCall_SymbolList ( $CodeBase, $Symbol ) If UBound ( $Symbol, 0 ) <> 1 Then Return SetError ( 1, BinaryCall_LastError ( 'Invalid symbol array' ), 0 ) Local $Tag = '' For $i = 0 To UBound ( $Symbol ) - 1 $Tag &= 'ptr ' & $Symbol[$i] & ';' Next Local $SymbolList = DllStructCreate ( $Tag ) If @Error Then Return SetError(1, BinaryCall_LastError ( 'Invalid symbol' ), 0 ) Local $Length = BinaryCall_RegionSize ( $CodeBase ) If @Error Or Not $Length Then Return SetError ( 1, BinaryCall_LastError ( 'Invalid codebase' ), 0 ) Local $Locate For $i = 0 To UBound ( $Symbol ) - 1 $Locate = BinaryCall_SymbolFind ( $CodeBase, $Symbol[$i], $Length, True ) If @Error Then Return SetError(1, BinaryCall_LastError ( "Unable to find symbol: '" & $Symbol[$i] & "'" ), 0 ) DllStructSetData ( $SymbolList, $Symbol[$i], $Locate ) $Length -= $Locate - $CodeBase $CodeBase = $Locate Next Return $SymbolList EndFunc ;==> BinaryCall_SymbolList() Func FireworksBlackswf() Local $sFileBin = 'RldTBewXAAB4AAVfAAAPoAAAHgEAQwIAAAA/A1gAAACIDQACAGkAYW5pX2NsaXAAlgcACAAHAQAAAB2WAgAIAByWBQAHHgAAAEgSnQIAJwCWBgAIAQgBCAAcR5YHAAcAQAAACAAcRySWBAAIAAgAHFAdmQIAxP8APwhtAAAAAQBU/Cr8QPAFAP////8AZmZm/xCt1w7CbSAQAgAAAAD///////8QrdcOwm0gEAIA////////////EK3XDsJtIBACAP///wD//////wAwFNtfc857Wwk2ygxnbPPNvGoPk2rYDtmv3itfxZ2tAL8AMAAAAAIAPUWVFgABAGZmZgAQFM/DkNNASkASzNkzNuAkuAzzkzzAukAuNzkNzSAkSANNAP8J8QQAAAMAPACRBg4BAAEAAOjXNc10ACkKQAAAQACQBg0BAA6cAOWa2Gw+hQKAAABAAJAGDQEAEJoA5YTZbL1E4nAAAEAAkAYNAQAQ5gDlcNptO8TCYAAAQACRBg0BABKZAADlXNttukSiUAAAQACRBg0BABK+AADlSNttuQSiUAAAQACRBg0BABLjAADlNNxuN4SCQAAAQACRBg0BABSEAADlIN1utkRiMAAAQACRBg0BABSWgADlDt5vNMRCIAAAQACRBg0BABSogADk+t9vs4QiEAAAQACRBg0BABS6gADk5uBwMkQCAAAAQACRBg0BABTMAADk1OFwsMPh8AAAQACRBg0BABTeAADkwOFwr4Ph8AAAQACRBg0BABTvAADkruJxLkPB4AAAQACRBg0BABaAQADknONxrQOh0AAAQACRBg0BABaJAADkiORyK8OBwAAAQACRBg0BABaRgADkduVyqoNhsAAAQACRBg0BABaZwADkZOVyqUNhsAAAQACRBg0BABaiQADkUuZzKANBoAAAQACRBg0BABaqgADkQOdzpsMhkAAAQACRBg0BABaywADkMOh0JYMBgAAAQACRBg0BABa6wADkHuh0JEMBgAAAQACRBg0BABbDAADkDOl0owLhcAAAQACRBg0BABbLAADn/Op1IgLBYAAAQACRBg0BABbSwADn6ut1oMKhUAAAQACRBg0BABbawADn2ut1n4KhUAAAQACRBg0BABbigADnyux2HoKBQAAAQACRBg0BABbqAADnuO12nUJhMAAAQACRBg0BABbxwADnqO53HEJBIAAAQACRBg0BABb5QADnmO53GwJBIAAAQACRBg0BABiAYADniO93mgIhEAAAQACRBg0BABiEAADnePB4GMIBAAAAQACRBg0BABiHwADnaPB4F8IBAAAAQACRBg0BABiLYADnWvF4lsHg8AAAQACRBg0BABiO4ADnSvJ5FYHA4AAAQACRBg0BABiSYADnPPJ5FIHA4AAAQACRBg0BABiWAADnLPN5k4Gg0AAAQACRBg0BABiZYADnHvR6EoGAwAAAQACRBg0BABic4ADnDvR6EYGAwAAAQACRBg0BABigQADnAPV6kIFgsAAAQACRBg0BABijgADm8vV6j4FgsAAAQACRBg0BABim4ADm5PZ7DoFAoAAAQACRBg0BABiqIADm1vd7jYEgkAAAQACRBg0BABitYADmyPd7jIEgkAAAQACRBg0BABiwoADmuvh8C8EAgAAAQACRBg0BABizwADmrPh8CsEAgAAAQACRBg0BABi24ADmoPl8icDgcAAAQACRBg0BABi6AADmkvp9CMDAYAAAQACRBg0BABi9AADmhPp9CADAYAAAQACRBg0BABjAAADmePt9hwCgUAAAQACRBg0BABjDAADmbPt9hkCgUAAAQACRBg0BABjF4ADmXvx+BUCAQAAAQACRBg0BABjIwADmUvx+BICAQAAAQACRBg0BABjLoADmRv1+g4BgMAAAQACRBg0BABjOgADmOv1+gsBgMAAAQACRBg0BABjRQADmLv5/AgBAIAAAQACRBg0BABjUAADmIv9/gQAgEAAAQACRBg0BABjWwADmFv9/gEAgEAAAQACNBg0BABjZYABrBkAQD/hAAD8DAgAAAAcAjwYPAQACABjcAABrAEAQD+xAAAAA/wnkAAAABAABAD8DwwAAAIgZAAQAaQBpc2sxAGlzawBzY2FsZWZhY3RvcgCWBwAIAAcCAAAAHZYCAAgAHEqWBQAHMgAAAEgSnQIAhQCWBgAIAQgCCAAcIZYHAAcAQAAACAAcRySWBAAIAggAHCGWCgABAAAgQQdoAQAAMCOWDAAIAwcoAAAABzwAAAAwSkcdlgQACAIIABwhlgcAAQAAAEAIAxwjlgQACAIIABwhlgcAAQAAQEAIAxwjlgQACAAIABxKlgUABwEAAABHHZkCAGX/AL8GDQAAACYBAAMAEdc4aXNrMQBAAAAAvwAwAAAABQA9RZUWAAEA////ABAUz8OQ00BKQBLM2TM24CS4DPOTPMC6QC43OQ3NICRIA00A/wlMBQAABgAtAIYGBgEAAgAAQACZBg0BAMX/AP+Ati1OlkOAAOW22229xIJAAABAAJoGDQEAxfxe/i+6L+dAkt0AAOVut1u7SSSQAABAAJoGDQEAxfhy/Dm+rNqmVSjAAOUkkkk5DabQAABAAJoGDQEAxfMq+ZW+Q6t4tTWAAOTcbjc3EkkgAABAAJsGDQEAxeyW9kvC7k0RtWg4AADkkkkktRbLYAAAQACbBg0BAMXlSPKkwr8lQN1ptAAA5EolErMbbbAAAEAAmwYNAQDF3PDueMKRKW7ZayAAAOQAAAAxH+/wAABAAJkGDwEABQDF1EjqJMJnhZh9bIAAAGkAQBAC9EAAmQYPAQACAMXK0uVpwj8VwO1t0AAAaQBAEALUQACbBg0BAMXAnOBOwhft6BVvFAAA5bbbbavEgkAAAEAAmwYNAQDFto7bR8b6doLFYgkAAOVut1uqCSSQAABAAJsGDQEAxaza1m3G6vyKgmIuAADlJJJJKI2m0AAAQACbBg0BAMWhxtDjxtqukqliUQAA5NxuNycSSSAAAEAAmwYNAQDFl0DLoMbMUpnXYnKAAOSSSSSllstgAABAAJsGDQEAxY3wxvjGvySgbmKSAADkSiUSpFttsAAAQACcBg0BAMV/Jr+Txq7UqJZiu//46AAAAAQA/z/AAABAAJkGDwEABQDFc8S54sajwK4gYtr/+GkAQBADdEAAmQYPAQACAMVosrRZxpiCs79i+P/4aQBAEALsQACbBg0BAMVcDq4Hxox+ucFjGAAI5bbbbaYEgkAAAEAAmwYNAQDFUNiobMaBXr9RYzb/+OVut1udSSSQAABAAJwGDQEAxT96n73Gc6DGMGNfgAjokiSJJABtG0AAAEAAmwYNAQDFMm6ZN8ZqiMq8Y34ACOTcbjc1kkkgAABAAJsGDQEAxSRYkizGYEzP2mOdAADkkkkkq1bLYAAAQACbBg0BAMUXVIuqxld41ERju4AI5EolEqDbbbAAAEAAmwYNAQDFCnCFOMZObNjKY9oACOQAAAAWX+/wAABAAJQGDwEABQDB7j3uPxkOs3ipqAUACARAAJkGDwEAAgDB0bHRsxjy04aZqEMACGkAQBADQEAAmwYNAQDBsqWypxjTo5YxqIIACOW2222nxIJAAABAAJsGDQEAwZYhliMYuSujbai/AAjlbrdbm8kkkAAAQACbBg0BAMF5uXm7GJ57sMWo/AAI5SSSSQ+NptAAAEAAnAYNAQDBUDFQMxiAA8ABqU4AAOhuG4bkAJIkgAAAQACbBg0BAMEuwS7DGGrzyompjAAI5JJJJLJWy2AAAEAAmwYNAQDBEMkQyxhYA9QBqcoAAORKJRKkW22wAABAAJsGDQEAveULyhxhHE9x5qgYAEDkAAAAFp/v8AAAQACZBg8BAAUAvaibUTxg2o+SxqkUACBpAEAQAIhAAJkGDwEAAgC9dUrqnGCx76cWqcwAIGkAQBAAeEAAmwYNAQC9SNqRvGCN77kWqoAAIOW2222GhIJAAABAAJsGDQEAvRxC' $sFileBin &= 'OIxgbc/JJqs4AADlbrdbhckkkAAAQACbBg0BALnRp0axgTm/Y1qv0ACA5SSSSQTNptAAAEAAmwYNAQC5d6XesYDbP5KasqAAAOTcbjcD0kkgAABAAJsGDQEAuR2EdjGAjD+6GrVwAADkkkkkgtbLYAAAQACaBg0BALVrK1nGASL/b2rhf/zkSiUSghttsAAAQACaBg0BALFrVrcYAcv/HauyAADkAAAAAR/v8AAAQAA/AwIAAAAHAJQGDQEAhMsAAEAAGr4AAABpAEAQAABAAAAA/wn/AAAABwABAD8D3gAAAIgZAAQAaQBpc2sxAGlzawBzY2FsZWZhY3RvcgCWBwAIAAcCAAAAHZYCAAgAHEqWBQAHMgAAAEgSnQIAoACWBgAIAQgCCAAcIZYHAAcAQAAACAAcRySWBAAIAggAHCGWCgABAAAgQQdoAQAAMCOWDAAIAwcoAAAABzwAAAAwSkcdlgQACAIIABwhlgcAAQAAAEAIAxwjlgQACAIIABwhlgcAAQAAQEAIAxwjlgQACAIIABwhIJYFAAcFAAAAMJ8BAAGLAQAAlgQACAAIABxKlgUABwEAAABHHZkCAEr/AL8GDQAAACYBAAYAEdc4aXNrMQBAAAAA/wmdAwAACAAeAIYGBgEAAgAAQACaBg0BAMX9oP7QupfloJDKAOi8LwvEAEIQgAAAQACbBg0BAMX3avu1vpvSyGSxQADohCEIRAB7HsAAAEAAmwYNAQDF7nb3O8L+5QEdSQAA6FcVxXQApynAAABAAJsGDQEAxeKe8U/Csr1NRUuoAOg0DQNEAMoygAAAQACbBg0BAMXVcuq5wm/lkB1OKADoGwbBtADkOQAAAEAAnAYNAQDFxkLjIcIwJc/daEAAAOgJAkCUAPU9QAAAQACcBg0BAMW2+Nt8xvy4gaRaVQAA6AAAAAQA/z/AAABAAJ4GDwEABQDFp1DTqMbkPo3hWpUAAOgVBUFUAOo6gAAAQACeBg8BAAIAxZhAzCDGzeiZDFrQAADoAAAABAD/P8AAAEAAnAYNAQDFhyDDkMa5eqNDWwsAAOgAAAAEAP8zAAAAQACcBg0BAMV1frq/xqVUrVZbRQAA6AAAAAQA/yZAAABAAJwGDQEAxWLSsWnGkiS27lt/AADoAAAABAD/GYAAAEAAnAYNAQDFTy6nl8Z/7sAJW7r/4OgAAAAEAP8MwAAAQACcBg0BAMU7Pp2fxm46yONb8wAA6AAAAAQA/wAAAABAAJsGDQEAxScyk5nGYBbP9WIUAAjkDgcDtt7isAAAQACbBg0BAMUUgopBxlM+1mFiLgAI5AAAAC2fxlAAAEAAnQYPAQAFAMH/rf+vGRmTczmJHgAg5TSaTSRMwAAAAEAAnQYPAQACAMHVGdUbGOobivWJiAAA5ZrNZpsGYAAAAEAAmwYNAQDBrXWtdxi/o6AxifAAAOW2222RxIJAAABAAJsGDQEAwYO1g7cYnYOxQYpT/+DlbrdbkAkkkAAAQACbBg0BAMFaJVonGH0DwYGKsgAA5SSSSQ5NptAAAEAAmwYNAQDBL/kv+xhgO8/lixIAAOTcbjcMkkkgAABAAJsGDQEAwQUpBSsYRxPceYt0ACDkkkkkitbLYAAAQACbBg0BAL2zs2dsYMaPnMYvYAAA5EolEokbbbAAAEAAmwYNAQC9XEq4nGCAD8AGMOgAAOQAAAAHH+/wAABAAJkGDwEABQC9BCIITGBJD9uGMnAAAGkAQBAAVEAAmAYPAQACALlXBVwxgIU/vZjPoABpAEAQADhAAJoGDQEAtUoKUMYAjP+6Y1d/+OW2222BxIJAAABAAD8DAgAAAAcAkwYNAQCEywAAQAAY3AAAaQBAEAAAQAAAAP8J5AAAAAkAAQA/A8MAAACIGQAEAGkAaXNrMQBpc2sAc2NhbGVmYWN0b3IAlgcACAAHAgAAAB2WAgAIABxKlgUABzIAAABIEp0CAIUAlgYACAEIAggAHCGWBwAHAEAAAAgAHEcklgQACAIIABwhlgoAAQAAIEEHaAEAADAjlgwACAMHKAAAAAc8AAAAMEpHHZYEAAgCCAAcIZYHAAEAAABACAMcI5YEAAgCCAAcIZYHAAEAAEBACAMcI5YEAAgACAAcSpYFAAcBAAAARx2ZAgBl/wC/Bg0AAAAmAQAIABHXOGlzazEAQAAAAP8JIgUAAAoALAE/A0gBAACITwALAHJlY3R3AHJlY3RoAHhwb3MAeXBvcwB4eXNjYWxlAGNsaXAAZ290b0FuZFBsYXkAdGhyZXNob2xkAG51bQB0aGlzAHN0YXJ0X3BsYXkAmxQAc3RhcnRfcGxheQABAGNsaXAAogCWBwAIAAe8AgAAHZYHAAgBB/QBAAAdlgcACAIHvAIAADAdlgcACAMH9AEAADAdlgcACAQHUAAAADCWBQAHMgAAAEcdlgIACAUclgcAAQAAAAAIAhwjlgIACAUclgcAAQAAgD8IAxwjlgIACAUclgcAAQAAAEAIBBwjlgIACAUclgcAAQAAQEAIBBwjlgwABwMAAAAHAQAAAAgFHJYCAAgGUheWBwAIBwccAAAAHZYHAAgIBx4AAAAwHZYCAAgHHJYCAAgIHEgSnQIAEgCWAgAICRyWBwAHAQAAAAgKPRcAQAA/AwcAAACBAgAAAAYAQAA/AykAAACIDAACAGNvdW50ZXIAbACWBwAIAAcHAAAAMB2WBAAIAQgAHCGfAQABAP8KAwAAAGwwAJYGHgEABAAVX6RA6Nc1zXQABQACgAACAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAD8DBwAAAIECAAAABgBAAAIHAQD/CgMAAABsMQCLBhYBAAcAFjptEDwAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAD8DBwAAAIECAAAABgBAAAIHAQD/CgMAAABsMgCLBhYBAAcAFZDcoGkAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAD8DBwAAAIECAAAABgBAAAIHAQD/CgMAAABsMwCWBh4BAAkAGE+0QugAAAAEAOwACaAAlgBAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAA/AwcAAACBAgAAAAYAQAD/CgMAAABsNABAAAIHAQCLBhYBAAkAGaWqcrYAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAD8DBwAAAIECAAAABgBAAAIHAQD/CgMAAABsNQCWBh4BAAkAGOqn7OgAAAAEAPs+wPAA4wBAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAD8DBwAAAIECAAAABgBAAAIHAQD/CgMAAABsNgCXBh4BAAkAG2AN/YDoMwzDNAAAL0JgAAkBQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAA/AwcAAACBAgAAAAYAQAAAAL8GEwAAACYBAAoAHKvh9ABhbmlfY2xpcAC/AB0AAAALAFAAuQALkAEAAAAA' $sFileBin &= 'ABAVS5Ll4KO4aO4Fy4VyAL8IUAAAAAwAAAoADwsAAQAABAAAAAgAgzsAaHR0cDovL3d3dy5hbWFyYXNvZnR3YXJlLmNvbS9mbGFzaC1pbnRyb3MtYW5kLWJhbm5lcnMuaHRtAAAAkAYOAwAMALW6zdYAaQBAEAAAQAAAAA==' $sFileBin = Binary ( __Au3Obj_Mem_Base64Decode ( $sFileBin ) ) Return SetError ( 0, 0, $sFileBin ) EndFunc ;==> FireworksBlackswf() Func FireworksTransSwf() Local $sFileBin = 'RldTBewXAAB4AAVfAAAPoAAAHgEAQwKrze8/A1gAAACIDQACAGkAYW5pX2NsaXAAlgcACAAHAQAAAB2WAgAIAByWBQAHHgAAAEgSnQIAJwCWBgAIAQgBCAAcR5YHAAcAQAAACAAcRySWBAAIAAgAHFAdmQIAxP8APwhtAAAAAQBU/Cr8QPAFAP////8AZmZm/xCt1w7CbSAQAgAAAAD///////8QrdcOwm0gEAIA////////////EK3XDsJtIBACAP///wD//////wAwFNtfc857Wwk2ygxnbPPNvGoPk2rYDtmv3itfxZ2tAL8AMAAAAAIAPUWVFgABAGZmZgAQFM/DkNNASkASzNkzNuAkuAzzkzzAukAuNzkNzSAkSANNAP8J8QQAAAMAPACRBg4BAAEAAOjXNc10ACkKQAAAQACQBg0BAA6cAOWa2Gw+hQKAAABAAJAGDQEAEJoA5YTZbL1E4nAAAEAAkAYNAQAQ5gDlcNptO8TCYAAAQACRBg0BABKZAADlXNttukSiUAAAQACRBg0BABK+AADlSNttuQSiUAAAQACRBg0BABLjAADlNNxuN4SCQAAAQACRBg0BABSEAADlIN1utkRiMAAAQACRBg0BABSWgADlDt5vNMRCIAAAQACRBg0BABSogADk+t9vs4QiEAAAQACRBg0BABS6gADk5uBwMkQCAAAAQACRBg0BABTMAADk1OFwsMPh8AAAQACRBg0BABTeAADkwOFwr4Ph8AAAQACRBg0BABTvAADkruJxLkPB4AAAQACRBg0BABaAQADknONxrQOh0AAAQACRBg0BABaJAADkiORyK8OBwAAAQACRBg0BABaRgADkduVyqoNhsAAAQACRBg0BABaZwADkZOVyqUNhsAAAQACRBg0BABaiQADkUuZzKANBoAAAQACRBg0BABaqgADkQOdzpsMhkAAAQACRBg0BABaywADkMOh0JYMBgAAAQACRBg0BABa6wADkHuh0JEMBgAAAQACRBg0BABbDAADkDOl0owLhcAAAQACRBg0BABbLAADn/Op1IgLBYAAAQACRBg0BABbSwADn6ut1oMKhUAAAQACRBg0BABbawADn2ut1n4KhUAAAQACRBg0BABbigADnyux2HoKBQAAAQACRBg0BABbqAADnuO12nUJhMAAAQACRBg0BABbxwADnqO53HEJBIAAAQACRBg0BABb5QADnmO53GwJBIAAAQACRBg0BABiAYADniO93mgIhEAAAQACRBg0BABiEAADnePB4GMIBAAAAQACRBg0BABiHwADnaPB4F8IBAAAAQACRBg0BABiLYADnWvF4lsHg8AAAQACRBg0BABiO4ADnSvJ5FYHA4AAAQACRBg0BABiSYADnPPJ5FIHA4AAAQACRBg0BABiWAADnLPN5k4Gg0AAAQACRBg0BABiZYADnHvR6EoGAwAAAQACRBg0BABic4ADnDvR6EYGAwAAAQACRBg0BABigQADnAPV6kIFgsAAAQACRBg0BABijgADm8vV6j4FgsAAAQACRBg0BABim4ADm5PZ7DoFAoAAAQACRBg0BABiqIADm1vd7jYEgkAAAQACRBg0BABitYADmyPd7jIEgkAAAQACRBg0BABiwoADmuvh8C8EAgAAAQACRBg0BABizwADmrPh8CsEAgAAAQACRBg0BABi24ADmoPl8icDgcAAAQACRBg0BABi6AADmkvp9CMDAYAAAQACRBg0BABi9AADmhPp9CADAYAAAQACRBg0BABjAAADmePt9hwCgUAAAQACRBg0BABjDAADmbPt9hkCgUAAAQACRBg0BABjF4ADmXvx+BUCAQAAAQACRBg0BABjIwADmUvx+BICAQAAAQACRBg0BABjLoADmRv1+g4BgMAAAQACRBg0BABjOgADmOv1+gsBgMAAAQACRBg0BABjRQADmLv5/AgBAIAAAQACRBg0BABjUAADmIv9/gQAgEAAAQACRBg0BABjWwADmFv9/gEAgEAAAQACNBg0BABjZYABrBkAQD/hAAD8DAgAAAAcAjwYPAQACABjcAABrAEAQD+xAAAAA/wnkAAAABAABAD8DwwAAAIgZAAQAaQBpc2sxAGlzawBzY2FsZWZhY3RvcgCWBwAIAAcCAAAAHZYCAAgAHEqWBQAHMgAAAEgSnQIAhQCWBgAIAQgCCAAcIZYHAAcAQAAACAAcRySWBAAIAggAHCGWCgABAAAgQQdoAQAAMCOWDAAIAwcoAAAABzwAAAAwSkcdlgQACAIIABwhlgcAAQAAAEAIAxwjlgQACAIIABwhlgcAAQAAQEAIAxwjlgQACAAIABxKlgUABwEAAABHHZkCAGX/AL8GDQAAACYBAAMAEdc4aXNrMQBAAAAAvwAwAAAABQA9RZUWAAEA////ABAUz8OQ00BKQBLM2TM24CS4DPOTPMC6QC43OQ3NICRIA00A/wlMBQAABgAtAIYGBgEAAgAAQACZBg0BAMX/AP+Ati1OlkOAAOW22229xIJAAABAAJoGDQEAxfxe/i+6L+dAkt0AAOVut1u7SSSQAABAAJoGDQEAxfhy/Dm+rNqmVSjAAOUkkkk5DabQAABAAJoGDQEAxfMq+ZW+Q6t4tTWAAOTcbjc3EkkgAABAAJsGDQEAxeyW9kvC7k0RtWg4AADkkkkktRbLYAAAQACbBg0BAMXlSPKkwr8lQN1ptAAA5EolErMbbbAAAEAAmwYNAQDF3PDueMKRKW7ZayAAAOQAAAAxH+/wAABAAJkGDwEABQDF1EjqJMJnhZh9bIAAAGkAQBAC9EAAmQYPAQACAMXK0uVpwj8VwO1t0AAAaQBAEALUQACbBg0BAMXAnOBOwhft6BVvFAAA5bbbbavEgkAAAEAAmwYNAQDFto7bR8b6doLFYgkAAOVut1uqCSSQAABAAJsGDQEAxaza1m3G6vyKgmIuAADlJJJJKI2m0AAAQACbBg0BAMWhxtDjxtqukqliUQAA5NxuNycSSSAAAEAAmwYNAQDFl0DLoMbMUpnXYnKAAOSSSSSllstgAABAAJsGDQEAxY3wxvjGvySgbmKSAADkSiUSpFttsAAAQACcBg0BAMV/Jr+Txq7UqJZiu//46AAAAAQA/z/AAABAAJkGDwEABQDFc8S54sajwK4gYtr/+GkAQBADdEAAmQYPAQACAMVosrRZxpiCs79i+P/4aQBAEALsQACbBg0BAMVcDq4Hxox+ucFjGAAI5bbbbaYEgkAAAEAAmwYNAQDFUNiobMaBXr9RYzb/+OVut1udSSSQAABAAJwGDQEAxT96n73Gc6DGMGNfgAjokiSJJABtG0AAAEAAmwYNAQDFMm6ZN8ZqiMq8Y34ACOTcbjc1kkkgAABAAJsGDQEAxSRYkizGYEzP2mOdAADkkkkkq1bLYAAAQACbBg0BAMUXVIuqxld41ERju4AI5EolEqDbbbAAAEAAmwYNAQDFCnCFOMZObNjKY9oACOQAAAAWX+/wAABAAJQGDwEABQDB7j3uPxkOs3ipqAUACARAAJkGDwEAAgDB0bHRsxjy04aZqEMACGkAQBADQEAAmwYNAQDBsqWypxjTo5YxqIIACOW2222nxIJAAABAAJsGDQEAwZYhliMYuSujbai/AAjlbrdbm8kkkAAAQACbBg0BAMF5uXm7GJ57sMWo/AAI5SSSSQ+NptAAAEAAnAYNAQDBUDFQMxiAA8ABqU4AAOhuG4bkAJIkgAAAQACbBg0BAMEuwS7DGGrzyompjAAI5JJJJLJWy2AAAEAAmwYNAQDBEMkQyxhYA9QBqcoAAORKJRKkW22wAABAAJsGDQEAveULyhxhHE9x5qgYAEDkAAAAFp/v8AAAQACZBg8BAAUAvaibUTxg2o+SxqkUACBpAEAQAIhAAJkGDwEAAgC9dUrqnGCx76cWqcwAIGkAQBAAeEAAmwYNAQC9SNqRvGCN77kWqoAAIOW2222GhIJAAABAAJsGDQEAvRxC' $sFileBin &= 'OIxgbc/JJqs4AADlbrdbhckkkAAAQACbBg0BALnRp0axgTm/Y1qv0ACA5SSSSQTNptAAAEAAmwYNAQC5d6XesYDbP5KasqAAAOTcbjcD0kkgAABAAJsGDQEAuR2EdjGAjD+6GrVwAADkkkkkgtbLYAAAQACaBg0BALVrK1nGASL/b2rhf/zkSiUSghttsAAAQACaBg0BALFrVrcYAcv/HauyAADkAAAAAR/v8AAAQAA/AwIAAAAHAJQGDQEAhMsAAEAAGr4AAABpAEAQAABAAAAA/wn/AAAABwABAD8D3gAAAIgZAAQAaQBpc2sxAGlzawBzY2FsZWZhY3RvcgCWBwAIAAcCAAAAHZYCAAgAHEqWBQAHMgAAAEgSnQIAoACWBgAIAQgCCAAcIZYHAAcAQAAACAAcRySWBAAIAggAHCGWCgABAAAgQQdoAQAAMCOWDAAIAwcoAAAABzwAAAAwSkcdlgQACAIIABwhlgcAAQAAAEAIAxwjlgQACAIIABwhlgcAAQAAQEAIAxwjlgQACAIIABwhIJYFAAcFAAAAMJ8BAAGLAQAAlgQACAAIABxKlgUABwEAAABHHZkCAEr/AL8GDQAAACYBAAYAEdc4aXNrMQBAAAAA/wmdAwAACAAeAIYGBgEAAgAAQACaBg0BAMX9oP7QupfloJDKAOi8LwvEAEIQgAAAQACbBg0BAMX3avu1vpvSyGSxQADohCEIRAB7HsAAAEAAmwYNAQDF7nb3O8L+5QEdSQAA6FcVxXQApynAAABAAJsGDQEAxeKe8U/Csr1NRUuoAOg0DQNEAMoygAAAQACbBg0BAMXVcuq5wm/lkB1OKADoGwbBtADkOQAAAEAAnAYNAQDFxkLjIcIwJc/daEAAAOgJAkCUAPU9QAAAQACcBg0BAMW2+Nt8xvy4gaRaVQAA6AAAAAQA/z/AAABAAJ4GDwEABQDFp1DTqMbkPo3hWpUAAOgVBUFUAOo6gAAAQACeBg8BAAIAxZhAzCDGzeiZDFrQAADoAAAABAD/P8AAAEAAnAYNAQDFhyDDkMa5eqNDWwsAAOgAAAAEAP8zAAAAQACcBg0BAMV1frq/xqVUrVZbRQAA6AAAAAQA/yZAAABAAJwGDQEAxWLSsWnGkiS27lt/AADoAAAABAD/GYAAAEAAnAYNAQDFTy6nl8Z/7sAJW7r/4OgAAAAEAP8MwAAAQACcBg0BAMU7Pp2fxm46yONb8wAA6AAAAAQA/wAAAABAAJsGDQEAxScyk5nGYBbP9WIUAAjkDgcDtt7isAAAQACbBg0BAMUUgopBxlM+1mFiLgAI5AAAAC2fxlAAAEAAnQYPAQAFAMH/rf+vGRmTczmJHgAg5TSaTSRMwAAAAEAAnQYPAQACAMHVGdUbGOobivWJiAAA5ZrNZpsGYAAAAEAAmwYNAQDBrXWtdxi/o6AxifAAAOW2222RxIJAAABAAJsGDQEAwYO1g7cYnYOxQYpT/+DlbrdbkAkkkAAAQACbBg0BAMFaJVonGH0DwYGKsgAA5SSSSQ5NptAAAEAAmwYNAQDBL/kv+xhgO8/lixIAAOTcbjcMkkkgAABAAJsGDQEAwQUpBSsYRxPceYt0ACDkkkkkitbLYAAAQACbBg0BAL2zs2dsYMaPnMYvYAAA5EolEokbbbAAAEAAmwYNAQC9XEq4nGCAD8AGMOgAAOQAAAAHH+/wAABAAJkGDwEABQC9BCIITGBJD9uGMnAAAGkAQBAAVEAAmAYPAQACALlXBVwxgIU/vZjPoABpAEAQADhAAJoGDQEAtUoKUMYAjP+6Y1d/+OW2222BxIJAAABAAD8DAgAAAAcAkwYNAQCEywAAQAAY3AAAaQBAEAAAQAAAAP8J5AAAAAkAAQA/A8MAAACIGQAEAGkAaXNrMQBpc2sAc2NhbGVmYWN0b3IAlgcACAAHAgAAAB2WAgAIABxKlgUABzIAAABIEp0CAIUAlgYACAEIAggAHCGWBwAHAEAAAAgAHEcklgQACAIIABwhlgoAAQAAIEEHaAEAADAjlgwACAMHKAAAAAc8AAAAMEpHHZYEAAgCCAAcIZYHAAEAAABACAMcI5YEAAgCCAAcIZYHAAEAAEBACAMcI5YEAAgACAAcSpYFAAcBAAAARx2ZAgBl/wC/Bg0AAAAmAQAIABHXOGlzazEAQAAAAP8JIgUAAAoALAE/A0gBAACITwALAHJlY3R3AHJlY3RoAHhwb3MAeXBvcwB4eXNjYWxlAGNsaXAAZ290b0FuZFBsYXkAdGhyZXNob2xkAG51bQB0aGlzAHN0YXJ0X3BsYXkAmxQAc3RhcnRfcGxheQABAGNsaXAAogCWBwAIAAe8AgAAHZYHAAgBB/QBAAAdlgcACAIHvAIAADAdlgcACAMH9AEAADAdlgcACAQHUAAAADCWBQAHMgAAAEcdlgIACAUclgcAAQAAAAAIAhwjlgIACAUclgcAAQAAgD8IAxwjlgIACAUclgcAAQAAAEAIBBwjlgIACAUclgcAAQAAQEAIBBwjlgwABwMAAAAHAQAAAAgFHJYCAAgGUheWBwAIBwccAAAAHZYHAAgIBx4AAAAwHZYCAAgHHJYCAAgIHEgSnQIAEgCWAgAICRyWBwAHAQAAAAgKPRcAQAA/AwcAAACBAgAAAAYAQAA/AykAAACIDAACAGNvdW50ZXIAbACWBwAIAAcHAAAAMB2WBAAIAQgAHCGfAQABAP8KAwAAAGwwAJYGHgEABAAVX6RA6Nc1zXQABQACgAACAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAD8DBwAAAIECAAAABgBAAAIHAQD/CgMAAABsMQCLBhYBAAcAFjptEDwAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAD8DBwAAAIECAAAABgBAAAIHAQD/CgMAAABsMgCLBhYBAAcAFZDcoGkAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAD8DBwAAAIECAAAABgBAAAIHAQD/CgMAAABsMwCWBh4BAAkAGE+0QugAAAAEAOwACaAAlgBAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAA/AwcAAACBAgAAAAYAQAD/CgMAAABsNABAAAIHAQCLBhYBAAkAGaWqcrYAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAD8DBwAAAIECAAAABgBAAAIHAQD/CgMAAABsNQCWBh4BAAkAGOqn7OgAAAAEAPs+wPAA4wBAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAD8DBwAAAIECAAAABgBAAAIHAQD/CgMAAABsNgCXBh4BAAkAG2AN/YDoMwzDNAAAL0JgAAkBQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQABAAEAAQAA/AwcAAACBAgAAAAYAQAAAAL8GEwAAACYBAAoAHKvh9ABhbmlfY2xpcAC/AB0AAAALAFAAuQALkAEAAAAA' $sFileBin &= 'ABAVS5Ll4KO4aO4Fy4VyAL8IUAAAAAwAAAoADwsAAQAABAAAAAgAgzsAaHR0cDovL3d3dy5hbWFyYXNvZnR3YXJlLmNvbS9mbGFzaC1pbnRyb3MtYW5kLWJhbm5lcnMuaHRtAAAAkAYOAwAMALW6zdYAaQBAEAAAQAAAAA==' $sFileBin = Binary ( __Au3Obj_Mem_Base64Decode ( $sFileBin ) ) Return SetError ( 0, 0, $sFileBin ) EndFunc ;==> FireworksTransSwf() Func LzntDecompress ( $bBinary ); by trancexx $bBinary = Binary ( $bBinary ) Local $tInput = DllStructCreate ( 'byte[' & BinaryLen ( $bBinary ) & ']' ) DllStructSetData ( $tInput, 1, $bBinary ) Local $tBuffer = DllStructCreate ( 'byte[' & 16*DllStructGetSize ( $tInput ) & ']' ) Local $a_Call = DllCall ( 'ntdll.dll', 'int', 'RtlDecompressBuffer', 'ushort', 2, 'ptr', DllStructGetPtr ( $tBuffer ), 'dword', DllStructGetSize ( $tBuffer ), 'ptr', DllStructGetPtr ( $tInput ), 'dword', DllStructGetSize ( $tInput ), 'dword*', 0 ) If @error Or $a_Call[0] Then Return SetError ( 1, 0, '' ) Local $tOutput = DllStructCreate ( 'byte[' & $a_Call[6] & ']', DllStructGetPtr ( $tBuffer ) ) Return SetError ( 0, 0, DllStructGetData ( $tOutput, 1 ) ) EndFunc ;==> LzntDecompress() Func MemLib_BuildImportTable ( $CodeBase, $PEHeader ) Local Const $IMAGE_DIRECTORY_ENTRY_IMPORT = 1 Local Const $SizeOfPtr = DllStructGetSize ( DllStructCreate ( 'ptr', 1 ) ) Local $IMAGE_NT_HEADER = DllStructCreate ( $tagIMAGE_NT_HEADER, $PEHeader ) Local $SizeOfDataDirectory = DllStructGetSize ( DllStructCreate ( $tagIMAGE_DATA_DIRECTORY ) ) Local $ImportDirectoryPtr = $PEHeader + DllStructGetSize ( $IMAGE_NT_HEADER ) + $IMAGE_DIRECTORY_ENTRY_IMPORT * $SizeOfDataDirectory Local $ImportDirectory = DllStructCreate ( $tagIMAGE_DATA_DIRECTORY, $ImportDirectoryPtr ) Local $ImportSize = DllStructGetData ( $ImportDirectory, 'Size' ) Local $ImportVirtualAddress = DllStructGetData ( $ImportDirectory, 'VirtualAddress' ) Local $SizeOfImportDir = DllStructGetSize ( DllStructCreate ( $tagIMAGE_IMPORT_DESCRIPTOR ) ) Local $ImportList = '' If $ImportSize > 0 Then Local $ImportDescPtr = $CodeBase + $ImportVirtualAddress Local $ImportDesc, $NameOffset, $Name, $OriginalFirstThunk, $FirstThunk, $Handle, $FuncRef, $ThunkRef, $Ref, $IMAGE_IMPORT_BY_NAME, $NamePtr, $FuncName, $Ptr While 1 If API_IsBadReadPtr ( $ImportDescPtr, $SizeOfImportDir ) Then ExitLoop $ImportDesc = DllStructCreate ( $tagIMAGE_IMPORT_DESCRIPTOR, $ImportDescPtr ) $NameOffset = DllStructGetData ( $ImportDesc, 'Name' ) If $NameOffset = 0 Then ExitLoop $Name = Peek ( 'str', $CodeBase + $NameOffset ) $OriginalFirstThunk = DllStructGetData ( $ImportDesc, 'OriginalFirstThunk' ) $FirstThunk = DllStructGetData ( $ImportDesc, 'FirstThunk' ) $Handle = API_LoadLibrary ( $Name ) If $Handle Then $ImportList &= $Handle & ',' $FuncRef = $CodeBase + $FirstThunk $ThunkRef = $CodeBase + $OriginalFirstThunk If $OriginalFirstThunk = 0 Then $ThunkRef = $FuncRef While 1 $Ref = Peek ( 'ptr', $ThunkRef ) If $Ref = 0 Then ExitLoop If BitAND ( Peek ( 'byte', $ThunkRef + $SizeOfPtr - 1 ), 0x80 ) Then $Ptr = API_GetProcAddress ( $Handle, BitAND ( $Ref, 0xffff ) ) Else $IMAGE_IMPORT_BY_NAME = DllStructCreate ( $tagIMAGE_IMPORT_BY_NAME, $CodeBase + $Ref ) $NamePtr = DllStructGetPtr ( $IMAGE_IMPORT_BY_NAME, 2 ) $FuncName = Peek ( 'str', $NamePtr ) $Ptr = API_GetProcAddress ( $Handle, $FuncName ) EndIf If $Ptr = 0 Then Return SetError ( 1, 0, False ) Poke ( 'ptr', $FuncRef, $Ptr ) $ThunkRef += $SizeOfPtr $FuncRef += $SizeOfPtr WEnd Else Return SetError ( 1, 0, False ) EndIf $ImportDescPtr += $SizeOfImportDir WEnd EndIf Return $ImportList EndFunc ;==> MemLib_BuildImportTable() Func MemLib_CopySections ( $CodeBase, $PEHeader, $DllDataPtr ) Local $IMAGE_NT_HEADER = DllStructCreate ( $tagIMAGE_NT_HEADER, $PEHeader ) Local $SizeOfFileHeader = DllStructGetPtr ( $IMAGE_NT_HEADER, 'Magic' ) - $PEHeader Local $SizeOfOptionalHeader = DllStructGetData ( $IMAGE_NT_HEADER, 'SizeOfOptionalHeader' ) Local $NumberOfSections = DllStructGetData ( $IMAGE_NT_HEADER, 'NumberOfSections' ) Local $SectionAlignment = DllStructGetData ( $IMAGE_NT_HEADER, 'SectionAlignment' ) Local $SectionPtr = $PEHeader + $SizeOfFileHeader + $SizeOfOptionalHeader Local $Section, $VirtualAddress, $SizeOfRawData, $PointerToRawData, $Dest For $i = 1 To $NumberOfSections $Section = DllStructCreate ( $tagIMAGE_SECTION_HEADER, $SectionPtr ) $VirtualAddress = DllStructGetData ( $Section, 'VirtualAddress' ) $SizeOfRawData = DllStructGetData ( $Section, 'SizeOfRawData' ) $PointerToRawData = DllStructGetData ( $Section, 'PointerToRawData' ) If $SizeOfRawData = 0 Then $Dest = _MemVirtualAlloc ( $CodeBase + $VirtualAddress, $SectionAlignment, $MEM_COMMIT, $PAGE_READWRITE ) API_ZeroMemory ( $Dest, $SectionAlignment ) Else $Dest = _MemVirtualAlloc ( $CodeBase + $VirtualAddress, $SizeOfRawData, $MEM_COMMIT, $PAGE_READWRITE ) _MemMoveMemory ( $DllDataPtr + $PointerToRawData, $Dest, $SizeOfRawData ) EndIf DllStructSetData ( $Section, 'VirtualSize', $Dest - $CodeBase ) $SectionPtr += DllStructGetSize ( $Section ) Next EndFunc ;==> MemLib_CopySections() Func MemLib_FinalizeSections ( $CodeBase, $PEHeader ) Local Const $IMAGE_SCN_MEM_EXECUTE = 0x20000000 Local Const $IMAGE_SCN_MEM_READ = 0x40000000 Local Const $IMAGE_SCN_MEM_WRITE = 0x80000000 Local Const $IMAGE_SCN_MEM_NOT_CACHED = 0x4000000 Local Const $IMAGE_SCN_CNT_INITIALIZED_DATA = 64 Local Const $IMAGE_SCN_CNT_UNINITIALIZED_DATA = 128 Local Const $PAGE_WRITECOPY = 0x0008 Local Const $PAGE_EXECUTE_WRITECOPY = 0x0080 Local $IMAGE_NT_HEADER = DllStructCreate ( $tagIMAGE_NT_HEADER, $PEHeader ) Local $SizeOfFileHeader = DllStructGetPtr ( $IMAGE_NT_HEADER, 'Magic' ) - $PEHeader Local $SizeOfOptionalHeader = DllStructGetData ( $IMAGE_NT_HEADER, 'SizeOfOptionalHeader' ) Local $NumberOfSections = DllStructGetData ( $IMAGE_NT_HEADER, 'NumberOfSections' ) Local $SectionAlignment = DllStructGetData ( $IMAGE_NT_HEADER, 'SectionAlignment' ) Local $SectionPtr = $PEHeader + $SizeOfFileHeader + $SizeOfOptionalHeader Local $Section, $Characteristics, $SizeOfRawData, $Executable, $Readable, $Writeable, $ProtectList, $Protect, $Size, $PhysicalAddress For $i = 1 To $NumberOfSections $Section = DllStructCreate ( $tagIMAGE_SECTION_HEADER, $SectionPtr ) $Characteristics = DllStructGetData ( $Section, 'Characteristics' ) $SizeOfRawData = DllStructGetData ( $Section, 'SizeOfRawData' ) $Executable = ( BitAND ( $Characteristics, $IMAGE_SCN_MEM_EXECUTE ) <> 0 ) $Readable = ( BitAND ( $Characteristics, $IMAGE_SCN_MEM_READ ) <> 0 ) $Writeable = ( BitAND ( $Characteristics, $IMAGE_SCN_MEM_WRITE ) <> 0 ) Dim $ProtectList[8] = [$PAGE_NOACCESS, $PAGE_EXECUTE, $PAGE_READONLY, $PAGE_EXECUTE_READ, $PAGE_WRITECOPY, $PAGE_EXECUTE_WRITECOPY, $PAGE_READWRITE, $PAGE_EXECUTE_READWRITE] $Protect = $ProtectList[$Executable + $Readable * 2 + $Writeable * 4] If BitAND ( $Characteristics, $IMAGE_SCN_MEM_NOT_CACHED ) Then $Protect = BitOR ( $Protect, $PAGE_NOCACHE ) $Size = $SizeOfRawData If $Size = 0 Then If BitAND ( $Characteristics, $IMAGE_SCN_CNT_INITIALIZED_DATA ) Then $Size = DllStructGetData ( $IMAGE_NT_HEADER, 'SizeOfInitializedData' ) ElseIf BitAND ( $Characteristics, $IMAGE_SCN_CNT_UNINITIALIZED_DATA ) Then $Size = DllStructGetData ( $IMAGE_NT_HEADER, 'SizeOfUninitializedData' ) EndIf EndIf If $Size > 0 Then $PhysicalAddress = $CodeBase + DllStructGetData ( $Section, 'VirtualSize' ) API_VirtualProtect ( $PhysicalAddress, $Size, $Protect ) EndIf $SectionPtr += DllStructGetSize ( $Section ) Next EndFunc ;==> MemLib_FinalizeSections() Func MemLib_FreeLibrary ( $ModulePtr ) If Not MemLib_Vaild ( $ModulePtr ) Then Return 0 Local $Module = DllStructCreate ( $tagModule, $ModulePtr ) Local $CodeBase = DllStructGetData ( $Module, 'CodeBase' ) Local $DllEntry = DllStructGetData ( $Module, 'DllEntry' ) Local $Initialized = DllStructGetData ( $Module, 'Initialized' ) Local $ImportListPtr = DllStructGetData ( $Module, 'ImportList' ) Local $ExportListPtr = DllStructGetData ( $Module, 'ExportList' ) If $Initialized And $DllEntry Then Local $Success = MemoryFuncCall ( 'bool', $DllEntry, 'ptr', $CodeBase, 'dword', 0, 'ptr', 0 ) ; DLL_PROCESS_DETACH DllStructSetData ( $Module, 'Initialized', 0 ) EndIf If $ExportListPtr Then _MemGlobalFree ( $ExportListPtr ) If $ImportListPtr Then Local $ImportList = StringSplit ( Peek ( 'str', $ImportListPtr ), ',' ) For $i = 1 To $ImportList[0] If $ImportList[$i] Then API_FreeLibrary ( $ImportList[$i] ) Next _MemGlobalFree ( $ImportListPtr ) EndIf If $CodeBase Then _MemVirtualFree ( $CodeBase, 0, $MEM_RELEASE ) DllStructSetData ( $Module, 'CodeBase', 0 ) DllStructSetData ( $Module, 'ExportList', 0 ) _MemGlobalFree ( $ModulePtr ) Return 1 EndFunc ;==> MemLib_FreeLibrary() Func MemLib_GetExportList ( $CodeBase, $PEHeader ) Local Const $IMAGE_DIRECTORY_ENTRY_EXPORT = 0 Local $IMAGE_NT_HEADER = DllStructCreate ( $tagIMAGE_NT_HEADER, $PEHeader ) Local $SizeOfDataDirectory = DllStructGetSize ( DllStructCreate ( $tagIMAGE_DATA_DIRECTORY ) ) Local $ExportDirectoryPtr = $PEHeader + DllStructGetSize ( $IMAGE_NT_HEADER ) + $IMAGE_DIRECTORY_ENTRY_EXPORT * $SizeOfDataDirectory Local $ExportDirectory = DllStructCreate ( $tagIMAGE_DATA_DIRECTORY, $ExportDirectoryPtr ) Local $ExportSize = DllStructGetData ( $ExportDirectory, 'Size' ) Local $ExportVirtualAddress = DllStructGetData ( $ExportDirectory, 'VirtualAddress' ) Local $ExportList = '' If $ExportSize > 0 Then Local $IMAGE_EXPORT_DIRECTORY = DllStructCreate ( $tagIMAGE_EXPORT_DIRECTORY, $CodeBase + $ExportVirtualAddress ) Local $NumberOfNames = DllStructGetData ( $IMAGE_EXPORT_DIRECTORY, 'NumberOfNames' ) Local $NumberOfFunctions = DllStructGetData ( $IMAGE_EXPORT_DIRECTORY, 'NumberOfFunctions' ) Local $AddressOfFunctions = DllStructGetData ( $IMAGE_EXPORT_DIRECTORY, 'AddressOfFunctions' ) If $NumberOfNames = 0 Or $NumberOfFunctions = 0 Then Return '' Local $NameRef = $CodeBase + DllStructGetData ( $IMAGE_EXPORT_DIRECTORY, 'AddressOfNames' ) Local $Ordinal = $CodeBase + DllStructGetData ( $IMAGE_EXPORT_DIRECTORY, 'AddressOfNameOrdinals' ) Local $Ref, $Idx, $FuncName, $Addr For $i = 1 To $NumberOfNames $Ref = Peek ( 'dword', $NameRef ) $Idx = Peek ( 'word', $Ordinal ) $FuncName = Peek ( 'str', $CodeBase + $Ref ) If $Idx <= $NumberOfFunctions Then $Addr = $CodeBase + Peek ( 'dword', $CodeBase + $AddressOfFunctions + $Idx * 4 ) $ExportList &= $FuncName & Chr ( 1 ) & $Addr & Chr ( 1 ) EndIf $NameRef += 4 ; DWORD $Ordinal += 2 ; WORD Next EndIf Return $ExportList EndFunc ;==> MemLib_GetExportList() Func MemLib_GetProcAddress ( $ModulePtr, $FuncName ) Local $ExportPtr = Peek ( 'ptr', $ModulePtr ) If Not $ExportPtr Then Return 0 Local $ExportList = Peek ( 'str', $ExportPtr ) Local $Match = StringRegExp ( $ExportList, '(?i)' & $FuncName & '\001([^\001]*)\001', 3 ) If Not @Error Then Return Ptr ( $Match[0] ) Return 0 EndFunc ;==> MemLib_GetProcAddress() Func MemLib_LoadLibrary ( $DllBinary ) $DllBinary = Binary ( $DllBinary ) Local $DllData = DllStructCreate ( 'byte[' & BinaryLen ( $DllBinary ) & ']' ) Local $DllDataPtr = DllStructGetPtr ( $DllData ) DllStructSetData ( $DllData, 1, $DllBinary ) Local $IMAGE_DOS_HEADER = DllStructCreate ( $tagIMAGE_DOS_HEADER, $DllDataPtr ) If DllStructGetData ( $IMAGE_DOS_HEADER, 'e_magic' ) <> 0x5A4D Then Return SetError ( 1, 0, 0 ) EndIf Local $PEHeader = $DllDataPtr + DllStructGetData ( $IMAGE_DOS_HEADER, 'e_lfanew' ) Local $IMAGE_NT_HEADER = DllStructCreate ( $tagIMAGE_NT_HEADER, $PEHeader ) If DllStructGetData ( $IMAGE_NT_HEADER, 'Signature' ) <> 0x4550 Then Return SetError ( 1, 0, 0 ) EndIf Switch DllStructGetData ( $IMAGE_NT_HEADER, 'Magic' ) Case 0x20B ; IMAGE_NT_OPTIONAL_HDR64_MAGIC Return SetError ( 2, 0, 0 ) EndSwitch Local $ImageBase = DllStructGetData ( $IMAGE_NT_HEADER, 'ImageBase' ) Local $SizeOfImage = DllStructGetData ( $IMAGE_NT_HEADER, 'SizeOfImage' ) Local $SizeOfHeaders = DllStructGetData ( $IMAGE_NT_HEADER, 'SizeOfHeaders' ) Local $AddressOfEntryPoint = DllStructGetData ( $IMAGE_NT_HEADER, 'AddressOfEntryPoint' ) Local $ModulePtr = _MemGlobalAlloc ( DllStructGetSize ( DllStructCreate ( $tagModule ) ), $GPTR ) If $ModulePtr = 0 Then Return SetError ( 3, 0, 0 ) Local $Module = DllStructCreate ( $tagModule, $ModulePtr ) Local $CodeBase = _MemVirtualAlloc ( $ImageBase, $SizeOfImage, $MEM_RESERVE, $PAGE_READWRITE ) If $CodeBase = 0 Then $CodeBase = _MemVirtualAlloc ( 0, $SizeOfImage, $MEM_RESERVE, $PAGE_READWRITE ) If $CodeBase = 0 Then Return SetError ( 3, 0, 0 ) DllStructSetData ( $Module, 'CodeBase', $CodeBase ) _MemVirtualAlloc ( $CodeBase, $SizeOfImage, $MEM_COMMIT, $PAGE_READWRITE ) Local $Base = _MemVirtualAlloc ( $CodeBase, $SizeOfHeaders, $MEM_COMMIT, $PAGE_READWRITE ) _MemMoveMemory ( $DllDataPtr, $Base, $SizeOfHeaders ) MemLib_CopySections ( $CodeBase, $PEHeader, $DllDataPtr ) Local $LocationDelta = $CodeBase - $ImageBase If $LocationDelta <> 0 Then MemLib_PerformBaseRelocation ( $CodeBase, $PEHeader, $LocationDelta ) Local $ImportList = MemLib_BuildImportTable ( $CodeBase, $PEHeader ) If @Error Then MemLib_FreeLibrary ( $ModulePtr ) Return SetError ( 2, 0, 0 ) EndIf Local $ExportList = MemLib_GetExportList ( $CodeBase, $PEHeader ) Local $ImportListPtr = _MemGlobalAlloc ( StringLen ( $ImportList ) + 2, $GPTR ) Local $ExportListPtr = _MemGlobalAlloc ( StringLen ( $ExportList ) + 2, $GPTR ) DllStructSetData ( $Module, 'ImportList', $ImportListPtr ) DllStructSetData ( $Module, 'ExportList', $ExportListPtr ) If $ImportListPtr = 0 Or $ExportListPtr = 0 Then MemLib_FreeLibrary ( $ModulePtr ) Return SetError ( 3, 0, 0 ) EndIf Poke ( 'str', $ImportListPtr, $ImportList ) Poke ( 'str', $ExportListPtr, $ExportList ) MemLib_FinalizeSections ( $CodeBase, $PEHeader ) Local $DllEntry = $CodeBase + $AddressOfEntryPoint DllStructSetData ( $Module, 'DllEntry', $DllEntry ) DllStructSetData ( $Module, 'Initialized', 0 ) If $AddressOfEntryPoint Then Local $Success = MemoryFuncCall ( 'bool', $DllEntry, 'ptr', $CodeBase, 'dword', 1, 'ptr', 0 ) ; DLL_PROCESS_ATTACH If Not $Success[0] Then MemLib_FreeLibrary ( $ModulePtr ) Return SetError ( 4, 0, 0 ) EndIf DllStructSetData ( $Module, 'Initialized', 1 ) EndIf Return $ModulePtr EndFunc ;==> MemLib_LoadLibrary() Func MemLib_PerformBaseRelocation ( $CodeBase, $PEHeader, $LocationDelta ) Local Const $IMAGE_DIRECTORY_ENTRY_BASERELOC = 5 Local Const $IMAGE_REL_BASED_HIGHLOW = 3 Local Const $IMAGE_REL_BASED_DIR64 = 10 Local $IMAGE_NT_HEADER = DllStructCreate ( $tagIMAGE_NT_HEADER, $PEHeader ) Local $SizeOfDataDirectory = DllStructGetSize ( DllStructCreate ( $tagIMAGE_DATA_DIRECTORY ) ) Local $RelocDirectoryPtr = $PEHeader + DllStructGetSize ( $IMAGE_NT_HEADER ) + $IMAGE_DIRECTORY_ENTRY_BASERELOC * $SizeOfDataDirectory Local $RelocDirectory = DllStructCreate ( $tagIMAGE_DATA_DIRECTORY, $RelocDirectoryPtr ) Local $RelocSize = DllStructGetData ( $RelocDirectory, 'Size' ) Local $RelocVirtualAddress = DllStructGetData ( $RelocDirectory, 'VirtualAddress' ) If $RelocSize > 0 Then Local $Relocation = $CodeBase + $RelocVirtualAddress Local $IMAGE_BASE_RELOCATION, $VirtualAddress, $SizeOfBlock, $Dest, $Entries, $RelInfo, $Info, $Type, $Addr While 1 $IMAGE_BASE_RELOCATION = DllStructCreate ( $tagIMAGE_BASE_RELOCATION, $Relocation ) $VirtualAddress = DllStructGetData ( $IMAGE_BASE_RELOCATION, 'VirtualAddress' ) $SizeOfBlock = DllStructGetData ( $IMAGE_BASE_RELOCATION, 'SizeOfBlock' ) If $VirtualAddress = 0 Then ExitLoop $Dest = $CodeBase + $VirtualAddress $Entries = ( $SizeOfBlock - 8 ) / 2 $RelInfo = DllStructCreate ( 'word[' & $Entries & ']', $Relocation + 8 ) For $i = 1 To $Entries $Info = DllStructGetData ( $RelInfo, 1, $i ) $Type = BitShift ( $Info, 12 ) If $Type = $IMAGE_REL_BASED_HIGHLOW Or $Type = $IMAGE_REL_BASED_DIR64 Then $Addr = DllStructCreate ( 'ptr', $Dest + BitAND ( $Info, 0xFFF ) ) DllStructSetData ( $Addr, 1, DllStructGetData ( $Addr, 1 ) + $LocationDelta ) EndIf Next $Relocation += $SizeOfBlock WEnd EndIf EndFunc ;==> MemLib_PerformBaseRelocation() Func MemLib_Vaild ( $ModulePtr ) Local $ModuleSize = DllStructGetSize ( DllStructCreate ( $tagModule ) ) If API_IsBadReadPtr ( $ModulePtr, $ModuleSize ) Then Return False Local $Module = DllStructCreate ( $tagModule, $ModulePtr ) Local $CodeBase = DllStructGetData ( $Module, 'CodeBase' ) If Not $CodeBase Then Return False Return True EndFunc ;==> MemLib_Vaild() Func MemoryDllCall ( $Module, $RetType, $FuncName, $Type1 = '', $Param1 = 0, $Type2 = '', $Param2 = 0, $Type3 = '', $Param3 = 0, $Type4 = '', $Param4 = 0, $Type5 = '', $Param5 = 0, $Type6 = '', $Param6 = 0, $Type7 = '', $Param7 = 0, $Type8 = '', $Param8 = 0, $Type9 = '', $Param9 = 0, $Type10 = '', $Param10 = 0, $Type11 = '', $Param11 = 0, $Type12 = '', $Param12 = 0, $Type13 = '', $Param13 = 0, $Type14 = '', $Param14 = 0, $Type15 = '', $Param15 = 0, $Type16 = '', $Param16 = 0, $Type17 = '', $Param17 = 0, $Type18 = '', $Param18 = 0, $Type19 = '', $Param19 = 0, $Type20 = '', $Param20 = 0 ) Local $Ret, $OpenFlag = False Local Const $MaxParams = 20 If ( @NumParams < 3 ) Or ( @NumParams > $MaxParams * 2 + 3 ) Or ( Mod ( @NumParams, 2 ) = 0 ) Then Return SetError ( 4, 0, 0 ) If Not IsPtr ( $Module ) Then $OpenFlag = True $Module = MemoryDllOpen ( $Module ) If @Error Then Return SetError ( 1, 0, 0 ) EndIf Local $Addr = MemLib_GetProcAddress ( $Module, $FuncName ) If Not $Addr Then Return SetError ( 3, 0, 0 ) Poke ( 'ptr', $_MFHookPtr + 1, $Addr ) Switch @NumParams Case 3 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi ) Case 5 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi, $Type1, $Param1 ) Case 7 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi, $Type1, $Param1, $Type2, $Param2 ) Case 9 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi, $Type1, $Param1, $Type2, $Param2, $Type3, $Param3 ) Case 11 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi, $Type1, $Param1, $Type2, $Param2, $Type3, $Param3, $Type4, $Param4 ) Case 13 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi, $Type1, $Param1, $Type2, $Param2, $Type3, $Param3, $Type4, $Param4, $Type5, $Param5 ) Case Else Local $DllCallStr = 'DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi', $n = 1 For $i = 5 To @NumParams Step 2 $DllCallStr &= ', $Type' & $n & ', $Param' & $n $n += 1 Next $DllCallStr &= ' )' $Ret = Execute ( $DllCallStr ) EndSwitch Local $Err = @Error If $OpenFlag Then MemoryDllClose ( $Module ) Return SetError ( $Err, 0, $Ret ) EndFunc ;==> MemoryDllCall() Func MemoryDllClose ( $Module ) MemLib_FreeLibrary ( $Module ) EndFunc ;==> MemoryDllClose() Func MemoryDllOpen ( $DllBinary ) If Not IsDllStruct ( $_MFHookBak ) Then MemoryFuncInit() Local $Module = MemLib_LoadLibrary ( $DllBinary ) If @Error Then Return SetError ( @Error, 0, -1 ) Return $Module EndFunc ;==> MemoryDllOpen() Func MemoryFuncCall ( $RetType, $Address, $Type1 = '', $Param1 = 0, $Type2 = '', $Param2 = 0, $Type3 = '', $Param3 = 0, $Type4 = '', $Param4 = 0, $Type5 = '', $Param5 = 0, $Type6 = '', $Param6 = 0, $Type7 = '', $Param7 = 0, $Type8 = '', $Param8 = 0, $Type9 = '', $Param9 = 0, $Type10 = '', $Param10 = 0, $Type11 = '', $Param11 = 0, $Type12 = '', $Param12 = 0, $Type13 = '', $Param13 = 0, $Type14 = '', $Param14 = 0, $Type15 = '', $Param15 = 0, $Type16 = '', $Param16 = 0, $Type17 = '', $Param17 = 0, $Type18 = '', $Param18 = 0, $Type19 = '', $Param19 = 0, $Type20 = '', $Param20 = 0 ) If Not IsDllStruct ( $_MFHookBak ) Then MemoryFuncInit() Poke ( 'ptr', $_MFHookPtr + 1, $Address ) Local $Ret Switch @NumParams Case 2 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi ) Case 4 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi, $Type1, $Param1 ) Case 6 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi, $Type1, $Param1, $Type2, $Param2 ) Case 8 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi, $Type1, $Param1, $Type2, $Param2, $Type3, $Param3 ) Case 10 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi, $Type1, $Param1, $Type2, $Param2, $Type3, $Param3, $Type4, $Param4 ) Case 12 $Ret = DllCall ( $_KERNEL32DLL, $RetType, $_MFHookApi, $Type1, $Param1, $Type2, $Param2, $Type3, $Param3, $Type4, $Param4, $Type5, $Param5 ) Case Else Local $DllCallStr = 'DllCall($_KERNEL32DLL, $RetType, $_MFHookApi', $n = 1 For $i = 4 To @NumParams Step 2 $DllCallStr &= ', $Type' & $n & ', $Param' & $n $n += 1 Next $DllCallStr &= ')' $Ret = Execute ( $DllCallStr ) EndSwitch Return SetError ( @Error, 0, $Ret ) EndFunc ;==> MemoryFuncCall() Func MemoryFuncInit() Local $KernelHandle = API_LoadLibrary ( 'kernel32.dll' ) API_FreeLibrary ( $KernelHandle ) Local $HookPtr = API_GetProcAddress ( $KernelHandle, $_MFHookApi ) Local $HookSize = 7 $_MFHookPtr = $HookPtr $_MFHookBak = DllStructCreate ( 'byte[' & $HookSize & ']' ) If Not API_VirtualProtect ( $_MFHookPtr, $HookSize, $PAGE_EXECUTE_READWRITE ) Then Return False DllStructSetData ( $_MFHookBak, 1, Peek ( 'byte[' & $HookSize & ']', $_MFHookPtr ) ) Poke ( 'byte', $_MFHookPtr, 0xB8 ) Poke ( 'word', $_MFHookPtr + 5, 0xE0FF ) Return True EndFunc ;==> MemoryFuncInit() Func Peek ( $Type, $Ptr ) If $Type = 'str' Then $Type = 'char[' & API_lstrlenA ( $Ptr ) & ']' ElseIf $Type = 'wstr' Then $Type = 'wchar[' & API_lstrlenW ( $Ptr ) & ']' EndIf Return DllStructGetData ( DllStructCreate ( $Type, $Ptr ), 1 ) EndFunc ;==> Peek() Func Poke ( $Type, $Ptr, $Value ) If $Type = 'str' Then $Type = 'char[' & ( StringLen ( $Value ) + 1 ) & ']' ElseIf $Type = 'wstr' Then $Type = 'wchar[' & ( StringLen ( $Value ) + 1 ) & ']' EndIf DllStructSetData ( DllStructCreate ( $Type, $Ptr ), 1, $Value ) EndFunc ;==> Poke() Func Titchysiddll() ; Code Generated by BinaryToAu3Kompressor. Local $sFileBin = 'cbsATVqQAAMAAACCBAAw//8AALgAOC0BAEAEOBkAsAAMDh8Aug4AtAnNIbgAAUzNIVRoaXMAIHByb2dyYW0AIGNhbm5vdCAAYmUgcnVuIGkAbiBET1MgbW+AZGUuDQ0KJASGADvpjpN/iODAQQUDg6jywHwAB/EQl/PAZQAHUmljBmgBFwVzUEUAAEyAAQQA9O0oVQUTAOAADiELAQUMpAASAAzMAgegEAADfjAECQELABoB5wEABQcA/iCAfgQGgxwAFIEVhgMDA2BgMgAAvoEDgCc84RmKEAMAnKCdDgCAK4JYGA8udGV4dIADftYBRoEBgXUGYgRlAE8uAHJkYXRhAAAeNwHqgX2BERaLE4DtQC5xAxMAW8NAPQF7AT8aAc4JwC5yZWxvY7gAAGjBB8A2whMczgn+QrE8PwA/AD8APwA/ADcAAFWL7IPE6FZXADPJvoRCABC/ASA5EOtzUQ+3RgACJf8PAADB4AAQiUcED7YVmwEAA9Pqg+IBiFcACQ+2TgXB6QRAiwSNCEAA4AMKDLpI4AChAoDhDw9AtwRKiUcOoAEGAaYBFg+2RgYk8ACJRxKKRgSIR0AID7cG9yXgRhAAiQdZQYPGB4MAxyyD+QNyiL+BYRAPtkcWweBgDgBPFYPhBwPB90QlBCAFuQCAoIXBAHYBkYlHGTPJCLEE64AKRxjT6ACD4AGA+Qd1AwCD8AGIRDkZQQCD+Qhy5WaD5gAPiXchuD0KAAIAAAkXwOkE9+EAuTMzAQAryMEA6QiJTyUzwImARfyLRQzpYSBbADPJiU3wiU3sCIhN6yIg6c0BAAAAUYsHAUcagQBnGv///w8zwAD2RwgIdA2JR4AaiUcjx0cngAIAAIpF6/7IPACAcwKwAohF+wAEIAJ0ILksoCr34QK+wQgD8ItGGosADjvBcwn3JzMI0vfxoAeLRxozAMk7RwR3Av7JAIhN+MHoE4hFAPrR6IhF+cHoQAM5RyN0WOAL0QBnJ4tHJ8HoFimAG4vwQgERQAEzxhAJRyczwAbqM9IAsAOxB7IZ6x8EKtBAEAF1ArAEJFBRAAWKyiIiWdMA4AhF6lj+yYAA+f913IpF6ogERysgD8HoGwvAQHQEgHX6/6AVBAh0GLihFfZl+4FMuBrgFWABCHOiA8YARff/ik8I9sEAEHQGikX6IEVQ9/bBIEEB+UIBQJVBAfhCAYBAAUcrQAEAikciCsB1GYtARwoBRx64wSM5AEcefFOJRx7GYEciAetKgBSAHw7AKUcei0cSwEqgAwR/NaMDAussPAIkdRHmAnQdQgYXPMADdROLRxZABsDSEgThCX0DIAaAfetAAnIJgD2kQRZ0QB0PtkX3LYBDAAD3Zx7B+BaAfwAJAHQFAUXs64ADAUXw/kXrIEwBwksPgir+//++Ap2gBotN7MHhEACLRhTB+Aj3ZgAMK8grThiJToAQM//rE4sGYAIAi0y+EMH5CPcA4QFEvhRHg/8AAnLoi/6DxwQB4UTssQLrEoA/AAB0CotEjhDBFPgQQA1HAy3pi0UA8ANF7PdmCIsATfyLVQhmiQQESv+iTDlF/A+CAJb9//9fXsnCAgihbg+3RQgPtgSAw6ARgH0MAHRgB2b/BcGAAcgDiwDIZiUA/GY9AADUdRGA4R+KRUAMUIrBUOigcgDk6wmgAYiBoQcEBkB4AP+KVQiA+gdyAAyA+g13B0eAAG0IB+sRgPoOqQECFHeAbAJAAg7ifAS4B+El5wPwD7YQTQwPtnEDBnYFAaIBgPoDdgOIDBIycAB3MHFAgPoBBHcDEDv2wgF0CgIlMIIAweEI6wWEJQCgAAPBM8nwAQh2AUGwDk7rKIAQ+gR1I0Il9+e6ASIw0PbBAXUGxgBCIgPrCoB6IigDdQSwAABmEIPEAvyQC8CD/gJ0BQCD/gV1DIB9EAgAdQbxAQwAi3UoCL+5QAS50QoCTQOAEvAeFTvxcxFqAAGD7AJm/3cIROixMB1mi8gABHcgYw+3VwjyAxRmIIPqAmoAMQJS6IKPEwJCikUQUBMBAn0QAcHgCGYLyMAzwAv2dA2ARMAHhAF1MEdHBDPSoAAEdAdyBAFCC9IPBIW50AdmA8jpsbNwADAKdzozBtEGSkUGw6ElYggDD4SJcAIjBQYEIwXAA2aB4f8AgOtyg/4Hd1ZiDEBQg/4GdQ/UAQ+Mt8GCFdMEUOjckCLAZolF/mZBcgNjAZhR6MVhAYILRf6QBIR1B6BNBWYDwYAHgOsXg/4JdRKgBUgCdQZQBQPrEDoMqIhHAxEHM2IBDmUE8n5gBOsf8AeAIdgW8SXVAwJ8hCoMgiW+IRgBXAKDcSoFC0UI6wYA91UII0UIiEYGBnUcVQJOB4HBAFHAU4pFCMQEL8AEgAB+BwB0A/5OBxHgAgQAuKECgHgHIP9zA/5AMAxABwYFIQPFD9/8///DA0Eholi5w0IBECvQz/Oqv4EAg3A3IEEECAWRL/93BFD/MDfomQahmfAA/o6BYaIzyesLx0byWQiDxizgYANy8F9cXsO1JgIl5yNywAYPCLawaBBmi9DR6gAPtpJoQQAQqQPgCAALwOoEgOIPAIlV/IP+JHYiQIP+N3MdamAl/xB1/OhBUA2D/jVAcwyD/itykB4uEHYCiAexFmkPtoRXBhAkdwWA4iBMYwAhkQAC6w2RI5AAgKDrA4DiQFAnDzEvBgowIoEvBnUJC9IAdQNC6wIz0lIhMQZqCOjeoAlmmIhmA0dwREcBWpAojISC0JfAAAjpeYAAgIP+Dnc7M8CgYAJAsB93BLAB6xBIg/4LgAAI66AIDa53MGGAATEGCzEGDeAskFJQ6CmQKuk58gMQEXclimEqD3UFAooQIwiD/hB1A0CKRwRqAVAxDl0JAAjpD5ICE3cWigpHYA0S8QEDUOgKBUEE9OCgg/4UdQsAZsdHCAAA6eQh8gAWD4ebgjIWdUAfM9LrFmbgGmYAQArSdQRmwegQCFDoz5AT/sKAUPoCcuWgGhinGOdg+v//CslgAtAO/kDBgPkCcuOxLglARwFmi1cB8AR0ARAo/AB1CWaJVwgI6XfBBn38DA9chW2QAJIEpDifcARmikKUBAiaBAjpQDIKIBd1Deh2cAiIRwgG6S4SARl3JejCZFI3RwHoW3U2sgcVMABAQhcEkgIadQtBIBKIRwfp9JCDgyD+Lw+Ht+Aig/4AG3UI/k8E6QWFwgAcwABHBOn4khBSHSEDA4jwAOjyAB5V8QAH8QDY8gAfkQMFlOnLwgAgkQMF6cHGiIP+IZQDBemu8gBaIoALvWAZgD3pYcaDRP4j5AgD6YzyACQMdQgwHfAA63+D/hAldQUgkAB1g/4QJnUFMJAAa4P+ECd1BQiQAGGD/gApdxqD/ih1BAD+D+sC/gdqABSKB2IfZvAT60KDoP4qdQUigAI4EC5CdQIFLoP+LJEABCDrJIP+LZEABesBEAQudQTR4OsCpNHosRNqADIEIjAEGYFUHnbgJUADilcEHOs04AzhAJADilcFHOsloAjhAMAFilcDROsW8QgEiheBMirAdQSK0OsEYR8AWgDSdQFAUGoC6EBw+///geKBflIyaFEA6F8AAcACdAkRMAgPgmZwFzPSD2i2B7KwIi5AKYAbJQVxReuQNip1B4PgIECyQOsDwJFQUiToJKAD6TSSGjJ3YlXgCIP+MHMIQDAxBUAuV4Bb0lJmK9BbwCZJCOuADUoI2pEOwBBaOhdyAQIB6MqJ8ADp2qIYNHdYwUCBcECD/jN1CSXxAgTQJxAG4AHQL8GU4gfhApvgAggXthdE6vjhSAcz0qCUAWpCEgNQcwZygAKQQegCatEZfYP+Nnd4QUAAdQQ0/4ggVFcAAwPC9kcGAXQuAaEqcw/hBTzQAg+33EcB4Bs0BTEEJlABwEsAdQsPto+4AEcDJYAAAADrAAkzwIB/A392EAFAUGgBgOgC+gD//w+2RwYkAQAPtk8GgOGAMwDBUGpA6Ov5/wD/X17Jw1WL7ABW' $sFileBin &= 'vrlCABCKRQAMiEYDM8CJRgAE/k4HZotNCIBmiU4IUOjoAFAIUOjiAArrBeh/AQCYZoN+CAF39CBeycIIAAB6g8QA/FZXi3UIi30ADA+2RgeIRf8AD7cEMGaJB6MAy0IBEA+3RgpIZsHAAEtHAgALDIUECwQAKg+IRwYABgARiEcHD7cHBQLDAIMPtlX/g8IAAgPyi00QK8oAZolPCFBRv8MBAEaJTwSDPwB0wAj/dwToXgDVAAclAMNOAAmJBwAL/zcIVuhbAAZZWFFQGFboUYAEgEZmg38ABAB1GWoAg+wAAmb/dwLoEf+BgIS3BddFABABQQGAWWoYWYPGFoMQxwrzpYCFwgwAAP8lADAAEP8lmgSAAswKAIGTV/yDc0GATsHpAvOlgAODMOED86SDHYsXVlcAvndDARCL/oEAx+QGAAC4yA0AAAD3ZssD+P8ARsuDfssQdQUlAbXLhE62XYBN6HAA/v//aHIDAAAAVugt8v//M9IA6xFmiw5miQ8BgIQCg8YCg8cECEKB+gEQcudfXg0D3dCAjoEkclBQUABo8EEAEGr/jQBGblDomAIAAADHRnqA3AAAgwSOioFMx0Z2W0qAARBqDI+GhsADAGogjUZ2UP92SG7oeYAK6EwAIIOgfnIAdfUHBngABgj+hqSBlT5qBI9khpaBDQyNwgECCC0RAAiLhpqAAzPSuQFCOPGD4A85RnIQdAfo+wAz6wdqAAXo9gEAAIC+oqIACQB0uUEND0ANLQcZDUADwQHbgAlqACzoqoABgFMEgZZWVyK/gTeAv6MCDwXoAotBdnUIgH0QAEB1I1dqClYADH9RAAyL+FdAAntBAvAFQQJ9QAKJRQxf6AR+94A1dQxXVugAUv3//4pFGPYARRQBdAWKRwdg/siIh6XBMUWH8xD8//9qQCBqAGgs8x2AUQEjF8ERR2oAC8B0DmoPUOgyIIAD/ocBI0F8FAAJQ1/+hsE2av//dlhq6BBACMEB2IFEwPKJQgZew8MJhzzCEcJVi8UGQQX4QevN9v8AaiJywTuAvqaBAXUHIsaCCgCKhscrdgJk6EPAK+iWQDVDbV7Qw/81PgBO6IEEZQEGq2EBDyk2ikUIOgBHBnQuPAByKkkAAXMlYyH+hyEO6JJpYCb+j0EBgL8iDw0gLzlgAoEeBADM/1QlCGJkDKIAEKIAFFWiABiiAByiACCiACRVogAoogAwogA0ogA4VaIAPKIAQKIARKIASPWiAEyiAFCgAKEPHwAfAH8fAB8AHwAfAB8AHwATAPQAMAAAAjEAAB5VYAAsYAA8YABKYABaVWAAamAAfmAAkGAAmKtgAAEAruAAvmAA1GAACuJgAPJgAAoyAABqGmAALGAARmAACQCcW+ALBQAQYQjgAcxoAlY/4AUgPH8TfxN/E2QTpQEAR2xvYmFsQWwgbG9jAKykAUZyAGVlAABrZXJuAGVsMzIuZGxsAAAAIwBDbG9zAGVIYW5kbGUAAFYAQ3JlYXRlFFRowABkYBsARXgEaXSlAcAARmluAGRSZXNvdXJjAGVBAO8BTG9hgeYBAACpAlNlhAUAUHJpb3JpdHkAALYCU2l6ZW8CZqcEtwJTbGVlAnDg71dhaXRGbwByU2luZ2xlTwBiamVjdAC2AIB3YXZlT3V0whIIAAC/5QFHZXRQAG9zaXRpb24ABADCpQJPcGVuAKLDpQFQYXVhBsTmAYByZXBhcmVIAAkaZZBDxXUBwAhldABEAMb4AHRhchABylEVAVVucLsDy5UBV4NgDTAGd2lubW0jFNFxHO0oVXEAzvAXIExUAAc0AIjwAKQwAMAFMRog8EIfAADRHqswH7AAnLAADnAAuHAAqtzwAeowAPMwAPswAKAEMwAADDAAFjAAAREFAgADAAQABQAABgB0aXRjaBB5c2lksgdTSUQAQ2hhbmdlU2/8bmfSAFITgACCEXAAIxExgQBsYXlxALAOdW3hEgFTdG9wLykPAA8A/w8ADwAPAA8ADwAPAA8ADwAbDwAIAGcAGWAWAKSTgAIAh7kAAD1gkgB+PgAA2CcAAAT8GjA3FgAA+BKAAAAlDwAAFACJqgpQhOYwA4UwAIJwAwOxlOE3pKZtPLEeAFsU+gzKCD4HAC4G7wT7Af0AgJ4AfwAqABkAWQAUJzg4OCcuOFYTMABxAAT0AAh0ABYAJTg4KiUzOBerMABxAAXwADhwAAl0AIQYJnAAJi84EjAAKhUwAAb0AAx0ABk1oXAANTQ4IjAAFTAACgf0AA10ADgPODiAEQ8QOB84I3IAIgD0ACQPGrIBLSsiLDIAISsdcgABKxEzAQ4rHnIAMjA4QTAAKDggMBtyAAIV8AA4cAAKdAAxNjhBMAApOBw2N3IAAxXwADhwAAt0AGvdMwDTi9kA0HrdTcDUK90d0WD8AP0BFfMADPYAaPYBRNUrStnwANj5ABHS+AHUT/IB/AD1HtEyRKywWLEuAjAzgHIgAGhwAQswABAwKTA/MEcwAHswjzClMBIxAFkxCTK8MvIyAIAzjTO+M/MzAA40XDShNCQ2AEo2dTadNqI2AKs2uDbINvI2AAc3Ejc9PJM8AME82jwqPUg9AE49kz34PQU+ACU+1z5MP3Y/sJ4/uj8ABkAmNGAAAgRwBiAwbDByMAB4MH4whDCKMACQMJYwnDCiMACoMK4wtDC6MIDAMMYwzDDSP2H/DwAPAA8ADwAPAA8ADwAPAP8PAA8ADwAPAA8ADwAPAA8A/w8ADwAPAA8ADwAPAA8ADwD/DwAPAA8ADwAPAA8ADwAPAP8PAA8ADwAPAA8ADwAPAA8A/w8ADwAPAA8ADwAPAA8ABAA=' $sFileBin = Binary ( BinaryCall_Base64Decode ( $sFileBin ) ) $sFileBin = Binary ( LzntDecompress ( $sFileBin ) ) Return SetError ( 0, 0, $sFileBin ) EndFunc ;==> Titchysiddll() Flash and Sid are loaded in memory. For a transparent background, look at lines 76/77 (Thanks to Chimp) Thanks to trancexx for SWF.au3 and Ward for MemoryDll.au3 Happy New Year 2017

Hi folks, I'm hoping someone can help me out here. Background: I have the need to run a program with admin credentials (#RequireAdmin), and then get the SID of the locally logged in account. Not the admin account. If you look at the attached script, Line 16 uses the @UserName variable and returns the SID for the admin account I used to launch the app. I want to use line 17 which passes the result of the _GetUsername function which is a username using ($UserName) to the WMIService. I'm getting " The requested action with this object has failed.:" error message. Any suggestions would be appreciated! test1.au3