Mochi is a reference to the mochigames site and mochiads network - all it usually means is that they're using mochiads in the game.
There is a mochi module that obfuscates integer values, but I've only seen this in use on one game.
As you can tell from the first post to this thread, there's no real protection and you can beat it very quickly by using CE to search for XP, Gold and castle health * 1 and setting them to large values (or freezing them).
The game can only be played from maxgames.com is just a site lock, which is set under the net.louissi.Alpha1.EngineStart class:
public function EngineStart()
{
ALLOWED_DOMAINS = ["maxgames.com", "farm.maxgames.com"];
trace("start engine");
super(MAIN_CLASS, Preloader, STAGE_WIDTH, STAGE_HEIGHT, IS_LOADING_EMBEDDED, ALLOWED_DOMAINS, MOCHIBOT);
stop();
return;
}// end function
This just calls the Engine method in the net.louissi.Moon.Engines.Engine class, which has the code (where param6, as can be seen above is ALLOWED_DOMAINS:
if (param6.length == 0 || param6.indexOf(_loc_10.domain) != -1)
{
stop();
addEventListener(Event.ADDED_TO_STAGE, addedToStagehandler);
this.mainClassName = param1;
this.preloaderClass = param2;
RessourceManager.getInstance().isLoadingEmbedded = param5;
GlobalVars.stage = stage;
GlobalVars.stageWidth = param3;
GlobalVars.stageHeight = param4;
}
else
{
_loc_11 = new TextField();
_loc_11.text = "This game can only be played from maxgames.com! Your domain: " + _loc_10.domain + " !";
_loc_11.width = _loc_11.textWidth + 5;
_loc_11.selectable = false;
addChild(_loc_11);
}