In this case, the block of encrypted strings is not decrypted at once. Instead, each string is decrypted immediately before being used, so they are never decrypted all at the same time. In order to solve this problem, follow these steps:
- Find a function that's responsible for decrypting all strings.
- Replicate the decryptor behavior.
- Let the script find all the places in the code where this function is being called and then read an encrypted string that will be passed as its argument.
- Decrypt it and write it back on top of the encrypted one so that all the references will remain valid.
