Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 e8b004dd20344688…

MALICIOUS

Office (OLE)

427.0 KB Created: 2018-12-30 22:22:45 Authoring application: Microsoft Excel First seen: 2020-02-04
MD5: d5ba78f7a49f7ef9ca1796c424757fb3 SHA-1: dd45d3a14070f1a973244ee454cec99da7d74d68 SHA-256: e8b004dd20344688e12f66a031e0cf13fb37b4f3c697e8d0dcb33fd02f84863d
222 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1566.001 Spearphishing Attachment T1140 Deobfuscate/Decode Files or Information T1071.001 Web Protocols

This Excel document contains VBA macros that likely download and execute a second-stage payload. The presence of CreateObject, VirtualAlloc, and GetProcAddress API calls suggests dynamic code loading and execution. The heuristic 'Password-protected archive handoff' indicates a common tactic to evade gateway scanning, where the user is prompted to open an encrypted archive with a provided password.

Heuristics 8

  • x86 GetPC stub (CALL $+5; POP EBP) high SC_GETPC_CALL
    x86 GetPC stub (CALL $+5; POP EBP)
    Disassembly
    Attempted x86 opcode disassembly
    00042B4B  e800000000        call 0x42b50
00042B50  5d                pop ebp
00042B51  00f2              add dl, dh
00042B53  44                inc esp
00042B54  c8e80000          enter 0xe8, 0
00042B58  1800              sbb byte ptr [eax], al
00042B5A  0000              add byte ptr [eax], al
00042B5C  0000              add byte ptr [eax], al
00042B5E  0000              add byte ptr [eax], al
00042B60  5d                pop ebp
00042B61  00f2              add dl, dh
00042B63  44                inc esp
00042B64  00e9              add cl, ch
00042B66  0000              add byte ptr [eax], al
00042B68  1800              sbb byte ptr [eax], al
00042B6A  0000              add byte ptr [eax], al
00042B6C  0000              add byte ptr [eax], al
00042B6E  0000              add byte ptr [eax], al
00042B70  2000              and byte ptr [eax], al
00042B72  4c                dec esp
00042B73  03ac0000002000    add ebp, dword ptr [eax + eax + 0x200000]
00042B7A  4a                dec edx
00042B7B  07                pop es
00042B7C  2400              and al, 0
00042B7E  4c                dec esp
00042B7F  06                push es
00042B80  0100              add dword ptr [eax], eax
00042B82  2000              and byte ptr [eax], al
00042B84  4a                dec edx
00042B85  07                pop es
00042B86  1b00              sbb eax, dword ptr [eax]
00042B88  ac                lodsb al, byte ptr [esi]
00042B89  0000              add byte ptr [eax], al
00042B8B  00ac000000ac00    add byte ptr [eax + eax + 0xac0000], ch
00042B92  0000              add byte ptr [eax], al
00042B94  ac                lodsb al, byte ptr [esi]
00042B95  0000              add byte ptr [eax], al
00042B97  002400            add byte ptr [eax + eax], ah
00042B9A  ec                in al, dx
00042B9B  0308              add ecx, dword ptr [eax]
00042B9D  0027              add byte ptr [edi], ah
00042B9F  00c0              add al, al
00042BA1  06                push es
00042BA2  0000              add byte ptr [eax], al
00042BA4  0000              add byte ptr [eax], al
00042BA6  0000              add byte ptr [eax], al
00042BA8  2000              and byte ptr [eax], al
00042BAA  c0                .byte 0xc0
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • VBA macros detected medium 1 related finding OLE_VBA_MACROS
    Document contains VBA macro code
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
    Matched line in script
        Set regex = CreateObject("VBScript.RegExp")
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Reference to VirtualProtect API medium SC_STR_VIRTUALPROTECT
    Reference to VirtualProtect API
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 584828 bytes
SHA-256: f32a9f6489d4336266a6925c27366adc0c77d5e19cb03723b4fa4fd8661ec09b
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 eval/decoder/string-building token(s). Carved artifact contains 70 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "DieseArbeitsmappe"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "Tabelle1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Attribute VB_Name = "mTest"
Option Explicit

Private m_oZip As cZipArchive

'für Funktion "Exists" benötigt:
Private Declare Function PathFileExists Lib "shlwapi.dll" Alias "PathFileExistsA" ( _
  ByVal pszPath As String) As Long


' Anstelle von GetAttr in folgendem Beispiel könnte auch bspw. die Funktion FileLen
' oder eine passende andere Dateizugriffsfunktion benutzt werden. Auf die Verwendung
' der Funktion Dir$ zur Existenzprüfung sollte aber dringend verzichtet werden,
' da diese Funktion nicht eintrittsinvariant ist. Ihre Verwendung kann zur Folge haben,
' dass sich anderen Programmteile nach Aufruf der Funktion zur Existenzprüfung nicht
' mehr wie erwartet verhalten.
' So könnte beispielsweise in einer Prozedur EnumDirs Dir$ zur Aufzählung der Unterordner
' eines spezifizierten Verzeichnisses verwendet werden. Wird aber während der Aufzählung
' eine auf Dir$ basierende Funktion zur Existenzprüfung eingesetzt, führt dies zu
' unvollständigen Aufzählungsergebnissen.

Private Function FileExists(strPath As String) As Boolean
    On Local Error Resume Next
    FileExists = Not CBool(GetAttr(strPath) And (vbDirectory Or vbVolume))
End Function

Private Function FolderExists(strPath As String) As Boolean
    On Local Error Resume Next
    FolderExists = CBool(GetAttr(strPath) And vbDirectory)
End Function

Public Function Exists() As Boolean
    'API-Call um zu überprüfen, ob MyPath existiert
    Exists = CBool(PathFileExists(m_Path))
End Function


Private Sub Zip_All_Files_Add_Folder(apath As String, zpath As String, zfile As String, Optional ZPSW As String)
    With New cZipArchive
        'Start Zio
        Call .StartCompress
    
        'Datei hinzufügen: wenn ZPSW <> "" mit Passwort; wenn ZPSW = "" ohne Passwort
        Call .AddFromFolder(apath & "*", True, , True, Password:=ZPSW, EncrStrength:=AES_256)
    
        'Archiv erstellen bzw. erweitern
        If Not FileExists(zpath & zfile) Then
            Call .CreateArchive(zpath & zfile, "comment", 9)
        Else
            Call .AppendArchive(zpath & zfile, "comment", 9)
        End If
    End With
End Sub

Public Sub Zip_All_Files_Add_Folder_Test()
    Dim Path As String
    Path = ThisWorkbook.Path & "\"
    
    Call Zip_All_Files_Add_Folder(Path & "apps\", Path, "testFolder.zip", "password")
    'Call Zip_All_Files_Add_Folder("E:\temp\a\aaaa\", "e:\", "testFolder.zip", "password")
    
    Exit Sub
    
    Set m_oZip = New cZipArchive
     
    With m_oZip
        Call .StartDecompress("e:\testFolder.zip")  'configure for extraction. this also reads the zip contents
        Call .ExtractByFilter("e:\extract_folder", "*", Password:="password")   'extract all
    End With
End Sub

Attribute VB_Name = "cZipArchive"
Attribute VB_Base = "0{FCFB3D2A-A0FA-1068-A738-08002B3371B5}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = False
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False
'==================================================================================
'
' cZipArchive - A single-class pure VB6 library for zip archives management
'
'
' MIT License
'
' Copyright (c) 2017 - 2019 by Vladimir Vissoultchev
'
' Permission is hereby granted, free of charge, to any person obtaining a copy
' of this software and associated documentation files (the "Software"), to deal
' in the Software without restriction, including without limitation the rights
' to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
' copies of the Software, and to permit persons to whom the Software is
' furnished to do so, subject to the following conditions:
'
' The above copyright notice and this permission notice shall be included in all
' copies or substantial portions of the Software.
'
'
' Copyright (c) 2018 - 2019 for 64-bit extension, additional features and various
' bug fixes by Peter Seidel
'
' Permission is hereby granted for all licensee, to use this Software in their
' project (one project per license). It is not allowed to publish, distribute,
' sublicense, and/or sell copies of the parts of the Software, that were
' changed in comparison to the original (e.g. 64-bit extension).
'
'
' THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
' IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
' FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
' AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
' LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
' OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
' SOFTWARE.
'
'==================================================================================
Option Explicit
DefObj A-Z

 

'USE_ZLIB_INLINE: defines if this class should run with/without external dependencies. disable this line for using zlib dlls.
'  enable this line for using this class as standalone
'USE_TRAMPOLINE: perequisite for using USE_ZLIB_INLINE. can also be used to call an arbitrary stdcall fct by pointer


#Const USE_TRAMPOLINE = 1

#If USE_TRAMPOLINE Then
    #Const USE_ZLIB_INLINE = 1 'needs USE_TRAMPOLINE to be defined
#End If

#Const ZIP_CRYPTO = 1


Private Const MODULE_NAME As String = "cZipArchive"

#Const ImplCompress = ZIP_NOCOMPRESS = 0
#Const ImplDecompress = ZIP_NOEXTRACT = 0
#Const ImplCrypto = ZIP_CRYPTO
#Const ImplUseShared = ZIP_USESHARED
#Const ImplLogging = DEBUG_MODE

'=========================================================================
' Public events
'=========================================================================

Event Progress(ByVal FileIdx As Long, ByVal Current As Long, ByVal Total As Long, Cancel As Boolean)
Event Error(ByVal FileIdx As Long, Source As String, Description As String, Cancel As Boolean, DontRaiseError As Boolean)
#If ImplDecompress Then
    Event BeforeExtract(ByVal FileIdx As Long, File As Variant, SkipFile As Boolean, Cancel As Boolean)
    Event ExtractComplete(ByVal FileIdx As Long, File As Variant)
#End If ' ImplDecompress

'=========================================================================
' Public enums
'=========================================================================

Public Enum EncryptionStrengthEnum
      PK_Crypt = 0    'classic PK encryption, should be supported in every tool with zipping capabilities
      AES_128 = 1     'AES encryption. not supported in Windows' own zipping implementation. WinRAR and some other tools should be fine
      AES_192 = 2
      AES_256 = 3
      AES_320 = 4     'undocumented, can only be extracted with cZipArchive Class
End Enum


'=========================================================================
' static data tables used by zlib
'=========================================================================

#If VBA7 And Win64 Then
    Const zdat_mirrorbytes As String = "AIBAwCCgYOAQkFDQMLBw8AiISMgoqGjoGJhY2Di4ePgEhETEJKRk5BSUVNQ0tHT0DIxMzCysbOwcnFzcPLx8/AKCQsIiomLiEpJS0jKycvIKikrKKqpq6hqaWto6unr6BoZGxiamZuYWllbWNrZ29g6OTs4urm7uHp5e3j6+fv4BgUHBIaFh4RGRUdExsXHxCYlJySmpaekZmVnZObl5+QWFRcUlpWXlFZVV1TW1dfUNjU3NLa1t7R2dXd09vX39A4NDwyOjY+MTk1PTM7Nz8wuLS8srq2vrG5tb2zu7e/sHh0fHJ6dn5xeXV9c3t3f3D49Pzy+vb+8fn1/fP79//w=="
    Const zdat_lencodes As String = "AQEAAAMAAAADAAAAAgEAAAQAAAAEAAAAAwEAAAUAAAAFAAAABAEAAAYAAAAGAAAABQEAAAcAAAAHAAAABgEAAAgAAAAIAAAABwEAAAkAAAAJAAAACAEAAAoAAAAKAAAACQEBAAsAAAAMAAAACgEBAA0AAAAOAAAACwEBAA8AAAAQAAAADAEBABEAAAASAAAADQECABMAAAAWAAAADgECABcAAAAaAAAADwECABsAAAAeAAAAEAECAB8AAAAiAAAAEQEDACMAAAAqAAAAEgEDACsAAAAyAAAAEwEDADMAAAA6AAAAFAEDADsAAABCAAAAFQEEAEMAAABSAAAAFgEEAFMAAABiAAAAFwEEAGMAAAByAAAAGAEEAHMAAACCAAAAGQEFAIMAAACiAAAAGgEFAKMAAADCAAAAGwEFAMMAAADiAAAAHAEFAOMAAAABAQAAHQEAAAIBAAACAQAA"
    Const zdat_distcodes As String = "AAAAAAEAAAABAAAAAQAAAAIAAAACAAAAAgAAAAMAAAADAAAAAwAAAAQAAAAEAAAABAABAAUAAAAGAAAABQABAAcAAAAIAAAABgACAAkAAAAMAAAABwACAA0AAAAQAAAACAADABEAAAAYAAAACQADABkAAAAgAAAACgAEACEAAAAwAAAACwAEADEAAABAAAAADAAFAEEAAABgAAAADQAFAGEAAACAAAAADgAGAIEAAADAAAAADwAGAMEAAAAAAQAAEAAHAAEBAACAAQAAEQAHAIEBAAAAAgAAEgAIAAECAAAAAwAAEwAIAAEDAAAABAAAFAAJAAEEAAAABgAAFQAJAAEGAAAACAAAFgAKAAEIAAAADAAAFwAKAAEMAAAAEAAAGAALAAEQAAAAGAAAGQALAAEYAAAAIAAAGgAMAAEgAAAAMAAAGwAMAAEwAAAAQAAAHAANAAFAAAAAYAAAHQANAAFgAAAAgAAA"
    Const zdat_lenlenmap As String = "EBESAAgHCQYKBQsEDAMNAg4BDw=="
#Else
    Const zdat_mirrorbytes As String = "AIBAwCCgYOAQkFDQMLBw8AiISMgoqGjoGJhY2Di4ePgEhETEJKRk5BSUVNQ0tHT0DIxMzCysbOwcnFzcPLx8/AKCQsIiomLiEpJS0jKycvIKikrKKqpq6hqaWto6unr6BoZGxiamZuYWllbWNrZ29g6OTs4urm7uHp5e3j6+fv4BgUHBIaFh4RGRUdExsXHxCYlJySmpaekZmVnZObl5+QWFRcUlpWXlFZVV1TW1dfUNjU3NLa1t7R2dXd09vX39A4NDwyOjY+MTk1PTM7Nz8wuLS8srq2vrG5tb2zu7e/sHh0fHJ6dn5xeXV9c3t3f3D49Pzy+vb+8fn1/fP79//w=="
    Const zdat_lencodes As String = "AQEAAAMAAAADAAAAAgEAAAQAAAAEAAAAAwEAAAUAAAAFAAAABAEAAAYAAAAGAAAABQEAAAcAAAAHAAAABgEAAAgAAAAIAAAABwEAAAkAAAAJAAAACAEAAAoAAAAKAAAACQEBAAsAAAAMAAAACgEBAA0AAAAOAAAACwEBAA8AAAAQAAAADAEBABEAAAASAAAADQECABMAAAAWAAAADgECABcAAAAaAAAADwECABsAAAAeAAAAEAECAB8AAAAiAAAAEQEDACMAAAAqAAAAEgEDACsAAAAyAAAAEwEDADMAAAA6AAAAFAEDADsAAABCAAAAFQEEAEMAAABSAAAAFgEEAFMAAABiAAAAFwEEAGMAAAByAAAAGAEEAHMAAACCAAAAGQEFAIMAAACiAAAAGgEFAKMAAADCAAAAGwEFAMMAAADiAAAAHAEFAOMAAAABAQAAHQEAAAIBAAACAQAA"
    Const zdat_distcodes As String = "AAAAAAEAAAABAAAAAQAAAAIAAAACAAAAAgAAAAMAAAADAAAAAwAAAAQAAAAEAAAABAABAAUAAAAGAAAABQABAAcAAAAIAAAABgACAAkAAAAMAAAABwACAA0AAAAQAAAACAADABEAAAAYAAAACQADABkAAAAgAAAACgAEACEAAAAwAAAACwAEADEAAABAAAAADAAFAEEAAABgAAAADQAFAGEAAACAAAAADgAGAIEAAADAAAAADwAGAMEAAAAAAQAAEAAHAAEBAACAAQAAEQAHAIEBAAAAAgAAEgAIAAECAAAAAwAAEwAIAAEDAAAABAAAFAAJAAEEAAAABgAAFQAJAAEGAAAACAAAFgAKAAEIAAAADAAAFwAKAAEMAAAAEAAAGAALAAEQAAAAGAAAGQALAAEYAAAAIAAAGgAMAAEgAAAAMAAAGwAMAAEwAAAAQAAAHAANAAFAAAAAYAAAHQANAAFgAAAAgAAA"
    Const zdat_lenlenmap As String = "EBESAAgHCQYKBQsEDAMNAg4BDw=="
#End If

'=========================================================================
' imports for zlib x86/AMD64 dlls (if used)
'=========================================================================

#If VBA7 And Win64 Then
    Private Type ContextTable
    
        'functions that must be externally defined
        p_vbzlib_malloc As LongPtr 'void *(ZLIB_STDCALL *vbzlib_malloc)(size_t size);
        p_vbzlib_realloc As LongPtr 'void *(ZLIB_STDCALL *vbzlib_realloc)(void *ptr, size_t size);
        p_vbzlib_free As LongPtr 'void (ZLIB_STDCALL *vbzlib_free)(void *ptr);
        
        'pointer to lookup tables
        p_lencodes As LongPtr
        p_distcodes As LongPtr
        p_mirrorbytes As LongPtr
        p_lenlenmap As LongPtr
        p_crc32table As LongPtr
        
    End Type
    
#Else

    Private Type ContextTable
    
        'functions that must be externally defined
        p_vbzlib_malloc As Long 'void *(ZLIB_STDCALL *vbzlib_malloc)(size_t size);
        p_vbzlib_realloc As Long 'void *(ZLIB_STDCALL *vbzlib_realloc)(void *ptr, size_t size);
        p_vbzlib_free As Long 'void (ZLIB_STDCALL *vbzlib_free)(void *ptr);
        
        'pointer to lookup tables
        p_lencodes As Long
        p_distcodes As Long
        p_mirrorbytes As Long
        p_lenlenmap As Long
        p_crc32table As Long
        
    End Type

#End If

#If USE_ZLIB_INLINE Then
#Else
    #If VBA7 And Win64 Then
        Private Declare PtrSafe Sub vbzlib_crc32 Lib "ZlibDll.x64.dll" (ByVal p_crc32_table As LongPtr, ByVal p_block As LongPtr, ByVal Length As Long, ByVal p_pcrc As LongPtr)
        Private Declare PtrSafe Sub vbzlib_memnonce Lib "ZlibDll.x64.dll" (ByVal p_block As LongPtr, ByVal p_none As LongPtr, ByVal Length As Long)
        Private Declare PtrSafe Sub vbzlib_memxor Lib "ZlibDll.x64.dll" (ByVal p_block As LongPtr, ByVal p_dest As LongPtr, ByVal Length As Long)
        Private Declare PtrSafe Sub vbzlib_zipcrypt Lib "ZlibDll.x64.dll" (ByVal p_crc32_table As LongPtr, ByVal p_keys As LongPtr, ByVal p_block As LongPtr, ByVal Length As Long, ByVal Flags As Long)
        Private Declare PtrSafe Function vbzlib_compress_init Lib "ZlibDll.x64.dll" (ByRef rtbl As ContextTable) As LongPtr
        Private Declare PtrSafe Sub vbzlib_compress_cleanup Lib "ZlibDll.x64.dll" (ByVal Handle As LongPtr)
    'FIXME needs checking - 2nd param as raw ptr?
        Private Declare PtrSafe Function vbzlib_compress_block Lib "ZlibDll.x64.dll" (ByVal Handle As LongPtr, ByVal p_iobuffers As LongPtr, ByVal p_pcrc As LongPtr) As Long
        Private Declare PtrSafe Function vbzlib_decompress_init Lib "ZlibDll.x64.dll" (ByRef rtbl As ContextTable) As LongPtr
        Private Declare PtrSafe Sub vbzlib_decompress_cleanup Lib "ZlibDll.x64.dll" (ByVal Handle As LongPtr)
    'FIXME needs checking - 2nd param as raw ptr?
        Private Declare PtrSafe Function vbzlib_decompress_block Lib "ZlibDll.x64.dll" (ByVal Handle As LongPtr, ByVal p_buf As LongPtr, ByVal p_pcrc As LongPtr) As Long
    #Else
        Private Declare Sub vbzlib_crc32 Lib "ZlibDll.x86.dll" (ByVal p_crc32_table As Long, ByVal p_block As Long, ByVal Length As Long, ByVal p_pcrc As Long)
        Private Declare Sub vbzlib_memnonce Lib "ZlibDll.x86.dll" (ByVal p_block As Long, ByVal p_none As Long, ByVal Length As Long)
        Private Declare Sub vbzlib_memxor Lib "ZlibDll.x86.dll" (ByVal p_block As Long, ByVal p_dest As Long, ByVal Length As Long)
        Private Declare Sub vbzlib_zipcrypt Lib "ZlibDll.x86.dll" (ByVal p_crc32_table As Long, ByVal p_keys As Long, ByVal p_block As Long, ByVal Length As Long, ByVal Flags As Long)
        Private Declare Function vbzlib_compress_init Lib "ZlibDll.x86.dll" (ByRef rtbl As ContextTable) As Long
        Private Declare Sub vbzlib_compress_cleanup Lib "ZlibDll.x86.dll" (ByVal Handle As Long)
    'FIXME needs checking - 2nd param as raw ptr?
        Private Declare Function vbzlib_compress_block Lib "ZlibDll.x86.dll" (ByVal Handle As Long, ByVal p_iobuffers As Long, ByVal p_pcrc As Long) As Long
        Private Declare Function vbzlib_decompress_init Lib "ZlibDll.x86.dll" (ByRef rtbl As ContextTable) As Long
        Private Declare Sub vbzlib_decompress_cleanup Lib "ZlibDll.x86.dll" (ByVal Handle As Long)
    'FIXME needs checking - 2nd param as raw ptr?
        Private Declare Function vbzlib_decompress_block Lib "ZlibDll.x86.dll" (ByVal Handle As Long, ByVal p_buf As Long, ByVal p_pcrc As Long) As Long
    #End If
#End If

'=========================================================================
' stuff for using zlib inline (may also be usefull to call arbitrary stacall fcts)
'=========================================================================

#If USE_TRAMPOLINE Then
    #If VBA7 Then
        Private Declare PtrSafe Sub ZeroMemory Lib "kernel32.dll" Alias "RtlZeroMemory" (ByRef Destination As Any, ByVal Length As LongPtr)
        Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal lpAddress As LongPtr, ByVal dwSize As LongPtr, ByVal flAllocationType As Long, ByVal flProtect As Long) As LongPtr
        Private Declare PtrSafe Function VirtualProtect Lib "kernel32" (ByVal lpAddress As LongPtr, ByVal dwSize As LongPtr, ByVal flNewProtect As Long, ByRef lpflOldProtect As Long) As Long
        Private Declare PtrSafe Function VirtualFree Lib "kernel32" (ByVal lpAddress As LongPtr, ByVal dwSize As LongPtr, ByVal dwFreeType As Long) As Long
        Private Declare PtrSafe Function CallWindowProc Lib "user32.dll" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As LongPtr, ByVal hWnd As LongPtr, ByVal Msg As Long, ByVal wParam As LongPtr, ByVal lParam As LongPtr) As LongPtr
    #Else
        Private Declare Sub ZeroMemory Lib "kernel32.dll" Alias "RtlZeroMemory" (ByRef Destination As Any, ByVal Length As Long)
        Private Declare Function VirtualAlloc Lib "kernel32" (ByVal lpAddress As Long, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long
        Private Declare Function VirtualProtect Lib "kernel32" (ByVal lpAddress As Long, ByVal dwSize As Long, ByVal flNewProtect As Long, ByRef lpflOldProtect As Long) As Long
        Private Declare Function VirtualFree Lib "kernel32" (ByVal lpAddress As Long, ByVal dwSize As Long, ByVal dwFreeType As Long) As Long
        Private Declare Function CallWindowProc Lib "user32.dll" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hWnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
    #End If
    
    Private Const PAGE_EXECUTE              As Long = &H10
    Private Const PAGE_EXECUTE_READ         As Long = &H20
    Private Const PAGE_EXECUTE_READWRITE    As Long = &H40
    Private Const MEM_COMMIT                As Long = &H1000
    Private Const MEM_RELEASE As Long = &H800
    
    #If VBA7 Then
        Private Type Trampoline_Struct
            NumParams As LongPtr
            pParams As LongPtr
            pProc As LongPtr
            Ret As LongPtr
        End Type
    #Else
        Private Type Trampoline_Struct
            NumParams As Long
            pParams As Long
            pProc As Long
            Ret As Long
        End Type
    #End If
    
    Private Type CodeExport_Struct
        Name As String
        Offset As Long
    End Type
    
    #If VBA7 Then
        Private Type CodeDescriptor_Struct
            pCodeBlob As LongPtr
            Exports() As CodeExport_Struct
        End Type
    #Else
        Private Type CodeDescriptor_Struct
            pCodeBlob As Long
            Exports() As CodeExport_Struct
        End Type
    #End If
    
    #If Win64 Then
        'AMD64
        Const TrampolineText As String = "QFNIg+xAM8BJi9lNhckPhFIBAABNi1EQTYXSD4RFAQAASYsRSIXSdQhB/9LpLAEAAEmLSQhIhckPhCgBAABIg/oBdQtIiwlB/9LpDgEAAEiD+gJ1D0iLUQhIiwlB/9Lp+QAAAEiD+gN1E0yLQRBIi1EISIsJQf/S6eAAAABIg/oEdRdMi0kYTItBEEiLUQhIiwlB/9LpwwAAAEiD+gV1IEiLQSBMi0kYTItBEEiLUQhIiwlIiUQkIEH/0umdAAAASIP6BnUmSItBKEyLSRhMi0EQSItRCEiJRCQoSItBIEiLCUiJRCQgQf/S63FIg/oHdS9Ii0EwTItJGEyLQRBIi1EISIlEJDBIi0EoSIlEJChIi0EgSIsJSIlEJCBB/9LrPEiD+gh1P0iLQThMi0kYTItBEEiLUQhIiUQkOEiLQTBIiUQkMEiLQShIiUQkKEiLQSBIiwlIiUQkIEH/0kiJQxi4AQAAAEiDxEBbw8zMzMwzwMM="
        Const TrampolineExports As String = "Trampoline|0"
    #Else
        'x86
        Const TrampolineText As String = "VYvsVot1FDPShfYPhEQBAABXi34Ihf8PhDcBAACLDoXJdRL/14lGDLoBAAAAX4vCXl3CEACLRgSFwA+EFAEAAIP5AXUU/zD/14lGDLoBAAAAX4vCXl3CEACD+QJ1F/9wBP8w/9eJRgy6AQAAAF+Lwl5dwhAAg/kDdRr/cAj/cAT/MP/XiUYMugEAAABfi8JeXcIQAIP5BHUd/3AM/3AI/3AE/zD/14lGDLoBAAAAX4vCXl3CEACD+QV1IP9wEP9wDP9wCP9wBP8w/9eJRgy6AQAAAF+Lwl5dwhAAg/kGdSP/cBT/cBD/cAz/cAj/cAT/MP/XiUYMugEAAABfi8JeXcIQAIP5B3Um/3AY/3AU/3AQ/3AM/3AI/3AE/zD/14lGDLoBAAAAX4vCXl3CEACD+Qh1If9wHP9wGP9wFP9wEP9wDP9wCP9wBP8w/9eJRgy6AQAAAF+Lwl5dwhAAzMzMzDPAwgwAww=="
        Const TrampolineExports As String = "Trampoline|0"
    #End If
    
    
    #If USE_ZLIB_INLINE Then
        #If Win64 Then
            'AMD64
            Const ZlibText As String = "SGOBBIAEAEyLyUQPttKDyv9IjQzBD7dBAmY7wnQLSA+/wGZBiRTB6xJIY0EEg/j/dAlmQYmUQQiABABJY4EEgAQARYlEwQRJY4EEgAQAZkGJVMECSWOJBIAEAEljwEmNFEEPt4IIgAQAZkGJBMlJY4EEgAQASQ+/DMFBD7eBBIAEAGaJggiABACD+f90DkEPt4EEgAQAZkGJRMkCSWOBBIAEAEaIlAgAAAQAQYuBBIAEAP/AJf9/AABBiYEEgAQAw8zMzMzMzMzMzMzMzMzMzEiJTCQIU1VWV0FUQVZBV0iD7DBIi3kIM9tJY+lFi/hIi/JMi/E5nwyABgAPjhYBAABFM9sPH0AADx+EAAAAAABIY48MgAYAi8Erw0EDx4P4BA+MwQAAADvZfQtFD7aMOwiABgDrC0mLw0grwUQPtgwwRI1DAkSIjCSAAAAAQY1A/zvBfQtBD7aEOwmABgDrC0mLw0grwQ+2RDABiIQkgQAAAEQ7wX0LQQ+2hDsKgAYA6wtJi8NIK8EPtkQwAoiEJIIAAABBjUABO8F9C0EPtoQ7C4AGAOsLSYvDSCvBD7ZEMAOIhCSDAAAAQQ+20URphCSAAAAAvac1HkiLz0HB6BDoK/7////DSf/DO58MgAYAD4wq////6y+L0zufDIAGAH0lSGPDSI2PCIAGAEgDyEn32w+2Af/CQYgEC0iNSQE7lwyABgB86ymfDIAGAEyL3UiJbCQgRYX/D44mAgAATIlsJHhBg/8ED4ysAQAAi4cAAAQARTPAiYcAgAQAM9JpDr2nNR5Iwek" & _
                                        "QRA+/jE8IgAQAQYP5/w+EfgEAAA8fRAAAi48EgAQAQYvBK8FBugCAAAAl/38AAEQr0IsGQSvKgeH/fwAAOYQ5AAAEAHUTRImUlxCABgBB/8BI/8JJO9N9DkljwUQPvwzHQYP5/3WyRYXAD44iAQAAi4QkkAAAALsEAAAAQTvHRIvzQQ9Px0xj6ImEJJAAAABJO90PjX0AAABBD7YsNkUz0jPSTWPYRYXAfmtMjY8QgAYADx+AAAAAAESLhJcQgAYAi8NBK8B5HYvDQSvAi8gDjwSABACB4f9/AAAPtoQ5AAAEAOsHSGPID7YEMUA66HUKQf/CRYkBSYPBBEj/wkk703y2QYP6AX4N/8NJ/8ZFi8JNO/V8g0E7331bSGOvEIAGAEmNFDZMi8VNY99Ei81J99hB99lMi9ZJ99pBjQQZhcB5HIvDK8WLyAOPBIAEAIHh/38AAA+2hDkAAAQA6wVBD7YEEDgCdQ5I/8L/w0mNBBJJO8N8xUyLdCRwRIvDi5cQgAYASYvO6J0FAACF235a6xcPthZJi87onAQAALsBAAAADx+AAAAAAEGD/wR8GERpBr2nNR5Ii88PthZBwegQ6OT7///rF0hjjwyABgAPtgaIhDkIgAYA/4cMgAYASP/GQf/P/8uF23+/TItcJCBFhf8Pj+T9//9Mi2wkeEiDxDBBX0FeQVxfXl1bw8zMzMzMzMzMzMzMzMxIiUwkCFNVVldBVUFWQVdIg+wwSItZCDP/SWPpRYv4SIvyTIvxTI2rEIAGADm7DIAGAA+ODwEAAEUz2w8fRA" & _
                                        "AASGOLDIAGAIvBK8dBA8eD+AQPjMEAAAA7+X0LRQ+2jBsIgAYA6wtJi8NIK8FED7YMMESNRwJEiIwkgAAAAEGNQP87wX0LQQ+2hBsJgAYA6wtJi8NIK8EPtkQwAYiEJIEAAABEO8F9C0EPtoQbCoAGAOsLSYvDSCvBD7ZEMAKIhCSCAAAAQY1AATvBfQtBD7aEGwuABgDrC0mLw0grwQ+2RDADiIQkgwAAAEEPttFEaYQkgAAAAL2nNR5Ii8tBwegQ6Iv6////x0n/wzu7DIAGAA+MKv///+svi9c7uwyABgB9JUhjx0iNiwiABgBIA8hJ99sPtgH/wkGIBAtIjUkBO5MMgAYAfOspuwyABgAzwDP/iYQkgAAAAIl8JCBMi92JRCQkSIlsJChFhf8PjpYCAABMiWQkeEGD/wQPjPUBAACLgwAABABFM8CJgwCABAAz0mkOvac1HkjB6RBED7+MSwiABABBg/n/D4TAAQAAZpCLiwSABABBi8ErwUG6AIAAACX/fwAARCvQiwZBK8qB4f9/AAA5hBkAAAQAdRBFiVSVAEH/wEj/wkk7030OSWPBRA+/DMNBg/n/dbVFhcAPjmoBAACLhCSQAAAAvwQAAABBO8dEi/dBD0/HTGPgiYQkkAAAAEk7/A+NfQAAAA8fAEEPtiw2RTPSM9JNY9hFhcB+aE2LzWZmZg8fhAAAAAAARYtElQCLx0ErwHkdi8dBK8CLyAOLBIAEAIHh/38AAA+2hBkAAAQA6wdIY8gPtgQxQDrodQpB/8JFiQFJg8EESP/CSTvTf" & _
                                        "LlBg/oBfg3/x0n/xkWLwk079HyGQTv/fVxJY20ASY0UNkyLxU1j30SLzUn32EH32UyL1kn32g8fQABBjQQ5hcB5HIvHK8WLyAOLBIAEAIHh/38AAA+2hBkAAAQA6wVBD7YEEDgCdQ5I/8L/x0mNBBJJO8N8xYtsJCCF7X5DSItMJHCNRQE7+H4iD7ZUJCTo9wAAAEGLRQCJhCSAAAAAD7YGiUQkJIl8JCDrXouUJIAAAABEi8XowAEAAESNXf/rNA+2BkGLVQCJRCQkiZQkgAAAAIl8JCDrMYuEJIAAAABJi86F/34bRIvHi9DoigEAAESNX/8z/4l8JCBFhdt+U+sOD7YW6IEAAABBuwEAAABBg/8EfBhEaQa9pzUeSIvLD7YWQcHoEOjP9///6xdIY4sMgAYAD7YGiIQZCIAGAP+DDIAGAEj/xkH/z0H/y0WF23+9TItcJCiLhCSAAAAATIt0JHBFhf8Pj3T9//9Mi2QkeEiDxDBBX0FeQV1fXl1bw8zMzMzMzMzMzMxIiVwkCFdIg+wgSIs5D7bCSItZEA+2ykiLRyiA+o93ZA+2VAgwRItDFEGLyNPiCVMQQY1ACIlDFIP4CA+MmwAAAItDDDlDCHwRSIsLA8BIY9CJQwz/VwhIiQNIY1MID7ZDEEiLC4gECv9DCMFrEAiDQxT4g3sUCH3ISItcJDBIg8QgX8MPtgwIi1MUjQRNAQAAAIvK0+AJQxCNQgmJQxSD+Ah8OItDDDlDCHwRSIsLA8BIY9CJQwz/VwhIiQNIY1MID7ZDEEiLC4gECv9D" & _
                                        "CMFrEAiDQxT4g3sUCH3ISItcJDBIg8QgX8PMzMzMzMzMzMxFhcAPjvUCAABIiVwkIFVBVkFXSIPsIEiLKUWL8EiLWRBEi/pIiXQkQEiJfCRITIlkJFBBvBcBAAAPH4AAAAAAQYH+BAEAAH4HvwIBAADrEEGL/kGB/gIBAAB+BEGNfv1Mi1UYRCv3QYPI/0G5HQAAAEONBAGZK8LR+EhjyEiNFElBO3ySBH0FRIvI6+RBO3ySCH4FRIvA69hEi0MUSJhIjQxAQQ+3BIpJjTSKZkE7xJh/Z40ERQD+//9IY8hIi0UoD7YUAUGNQAdBi8iJQxTT4glTEIP4CA+MmwAAAA8fAItDDDlDCHwRSIsLA8BIY9CJQwz/VQhIiQNIY1MID7ZDEEiLC4gECv9DCMFrEAiDQxT4g3sUCH3I616D6FhIY8hIi0UoD7YUAUGNQAhBi8iJQxTT4glTEIP4CHw8Dx9AAItDDDlDCHwRSIsLA8BIY9CJQwz/VQhIiQNIY1MID7ZDEEiLC4gECv9DCMFrEAiDQxT4g3sUCH3ID7dGAmaFwHROK34Ei0sU0+cJexCYA8GJQxSD+Ah8OItDDDlDCHwRSIsLA8BIY9CJQwz/VQhIiQNIY1MID7ZDEEiLC4gECv9DCMFrEAiDQxT4g3sUCH3ITItVIEGDyP9BuR4AAAAPHwBDjQQBmSvC0fhIY8hIjRRJRTt8kgR9BUSLyOvkRTt8kgh+BUSLwOvYRItDFEiYSI0MQEEPvwSKweADSY08ikhjyEiLRSgPthQBQY1ABUGLyIlDFNP" & _
                                        "iCVMQg/gIfDsPHwCLQww5Qwh8EUiLCwPASGPQiUMM/1UISIkDSGNTCA+2QxBIiwuIBAr/QwjBaxAIg0MU+IN7FAh9yA+3RwJmhcB0V4tLFA+/0EGLxytHBNPgCUMQjQQRiUMUg/gIfDsPHwCLQww5Qwh8EUiLCwPASGPQiUMM/1UISIkDSGNTCA+2QxBIiwuIBAr/QwjBaxAIg0MU+IN7FAh9yEWF9g+PX/3//0yLZCRQSIt8JEhIi3QkQEiLXCRYSIPEIEFfQV5dw8xIiVwkEEiJbCQYVkiD7CBIi/G5GAAAAP8WubCPBgBIi9hIiTD/FjPtTIvASIXAdFpIiXwkMEiNUAJIiUMIvwCAAACDyP9mZmYPH4QAAAAAAIlCAmaJAmaJQv5IjVIISIPvAXXsSY24CIAEAEgPv8C5AAABAGbzq0iLfCQwQYmoBIAEAEGJqAyABgC5GAAAAP8WSIloEEiLbCRASIlDEEiLw0iLXCQ4SIPEIF7DzMzMzEiJXCQISIlsJBBIiXQkGFdBVEFWSIPsMEiLOUiL8UiLWRBNi+G5AIAAAEGL6EyL8v8Xi0sUSIkDM8A5RCR4iUMID5XAx0MMAIAAAIPAAtPgCUMQjUEDiUMUg/gIfDpmkItDDDlDCHwRSIsLA8BIY9CJQwz/VwhIiQNIY1MID7ZDEEiLC4gECv9DCMFrEAiDQxT4g3sUCH3Ig7wkgAAAAABEi8WLhCSQAAAASYvWRIuMJIgAAABIi86JRCQgdAfo3fL//+sF6Hb2//+DQxQHg3sUCHw4i0MMOUMIfB" & _
                                        "FIiwsDwEhj0IlDDP9XCEiJA0hjUwgPtkMQSIsLiAQK/0MIwWsQCINDFPiDexQIfciDfCR4AHRFg3sUAHQ/x0MUCAAAAItDDDlDCHwRSIsLA8BIY9CJQwz/VwhIiQNIY1MID7ZDEEiLC4gECv9DCMFrEAiDQxT4g3sUCH3ISIsDSItsJFhIi3QkYEmJBCRIi0QkcItLCEiLXCRQiQi4AQAAAEiDxDBBXkFcX8PMzMzMzMzMzMxEiUwkIEyJRCQYSIlUJBBIiUwkCFNVVldIg+xISIvpSYvwuRAAAAD/VQCLvCSYAAAAugEAAABIi9iLz7gBAAAA0+CLjCSgAAAA/8hI0+JIweIESIvKiYQkmAAAAP9VAESLjCSgAAAAM+1IiUMIQYvJuAEAAABBg8j/0+CL1f/IiQOFwHgxi81mDx+EAAAAAABIi0MISI1JEP/CZkSJRAjySItDCECIbAHwSItDCEiJbAj4OxN+2kSLlCSIAAAARIvdRYXSD46nAAAAi6wkiAAAAEyL1kiLdCR4Dx+AAAAAAEEPtgI7x35kiwaLyCOMJJgAAAA7jCSQAAAAdVCLz9P4IwM7A39GZmYPH4QAAAAAAEiLSwhIY9BIA9JmRIlc0QJMi0sIRQ+2AkQrx0EPtgzRQTvIfQRFiATRQQ+2CroBAAAAK8/T4gPCOwN+xEH/w0iDxgRJ/8JEO918hUSLjCSgAAAAM+1Ei5QkiAAAAEGDyP+DOwAPjJ0AAABIi/W6BwAAAEiLSwgPtgQxQTvBfmxmRIlEMQKLz0iLQwhED7YEBkUrw" & _
                                        "USIDAZBg/gHi8VED0/CQo0UD0SJRCQwRYvKTIuEJIAAAADT4AuEJJAAAABIi0wkcIlUJChIi1QkeIlEJCDoG/7//0iLSwi6BwAAAESLjCSgAAAASIlEDghEi5QkiAAAAP/FSIPGEEG4/////zsrD45r////SIvDSIPESF9eXVvDzMzMzMzMzMzMzMzMzEiJbCQQSIl0JBhIiXwkIEFWSIHsQAUAADPtQYv4SIlsJERIi/JIiWwkTEyL8UiJbCRURIvdSIlsJFxIiWwkZEiJbCRsSIlsJHSJbCR8TWPAhf9+JEiLymYPH4QAAAAAAA+2AUiNSQH/RIRARDvYRA9M2EmD6AF16IvVSIvNDx8AiZQMhAAAAANUDERIg8EEA9JIg/k8fOmF/35gSImcJFAFAABMjYwkwAAAAEiL30yL1kEPtgpBiSmLlIyAAAAAjUIBiYSMgAAAAIvFhcl0F0SLwYvKA8CD4QHR+gvBSYPoAXXvQYkBSf/CSYPBBEiD6wF1vkiLnCRQBQAASYsOSI2UJMAAAAC4CQAAAESLz0Q72EyLxkEPTMOJRCQwiWwkKIlsJCDop/z//0yNnCRABQAASYtrGEmLcyBJi3soSYvjQV7DzMzMzMzMzMzMzMzMzEiJVCQQVVZIg+woSIsxSIvpSIl0JEBIhdJ1CoPI/0iDxCheXcNIiXwkIEiLOkiF/3RfSIlcJFAz2zkffDQz9pBIi08ISIN8DggAdBZIjVEISGPDSMHgBEiLzUgD0Oie/////8NIg8YQOx9+1EiLdCRASItPCP9WEDPb" & _
                                        "SIvPSIlfCP9WEEiLRCRISIkYSItcJFAzwEiLfCQgSIPEKF5dw8xIiVwkCFdIgexAAQAASIv5udCBAAD/F0m4CAgICAgICAhIjUwkIEiL2LoCAAAASIk4TIkBTIlBCEyJQRBIjUlATIlB2EyJQeBMiUHoTIlB8EyJQfhIg+oBdddMiQFIjbwksAAAAEyJQQhIjVQkILgJAAAAuXAAAADzqki4BwcHBwcHBwdMiYQkOAEAAEG4IAEAAEiJhCQgAQAASIvLSImEJCgBAABIiYQkMAEAAOhe/f//SIlDCEiNVCQgSLgFBQUFBQUFBUG4IAAAAEiLy0iJRCQgSIlEJChIiUQkMEiJRCQ46Cn9//9IiUMQM8CJQzBIiUMoSIlDIEiJQxhIiYOwAQAAiYO4gQAASIvDSIucJFABAABIgcRAAQAAX8PMzMxIiVwkCFdIg+wgSItBGEiNURhIizlIi9lIhcB0C0g7QQh0BegY/v//SItDIEiNUyBIhcB0Dkg7QxB0CEiLy+j9/f//SIN7KABIjVModAhIi8vo6v3//0iNUwhIi8vo3v3//0iNUxBIi8vo0v3//0iLy0iLRxBIi1wkMEiDxCBfSP/gzMzMzMzMzMzMzMzMzMxIiVwkCEiJbCQQSIl0JBhXQVRBVUFWQVdIg+wgTIs5SIvZuQCAAABNi+FBi+hMi/JB/xdFM+3Hg8yBAAAAgAAARImryIEAAEiJg8CBAABBuwMAAABFjVP+vwsAAAAPHwCF7X8NRDmrtAEAAA+OlgIAAIO7tAEAABh9L2YPH0QAAIX" & _
                                        "tfiVBD7YG/82Li7QBAABJ/8bT4AmDsAEAAI1BCImDtAEAAIP4GHzXi0MwhcB1BkSJUzDrqoP4AQ+FgwAAAIuTtAEAAIP6Aw+MOQIAAIuDsAEAAIPC/dHoi8iJk7QBAADB6AKJg7ABAACD4QN1IYvKx0MwCgAAAIPhByvR0+iJg7ABAACJk7QBAADpUP///4P5AXUcSItDCEiJQxhIi0MQSIlDIMdDMAYAAADpL////4P5Ag+FJv///4lLMOke////g/gCdW2Lk7QBAACD+g4PjLEBAACLi7ABAACLwYPgH0SJa0QFAQEAAESJWzCJQzjB6QWLwcHpBYPgH//AiUM8i8GD4A+DwASJQ0CNQvKJg7QBAADB6QSJi7ABAABMiWtcTIlrZGZEiWtsRIhrbums/v//g/gDD4WMAAAAOYO0AQAAD4w+AQAAi0NAOUNEfTyDu7QBAAADfDNJi0cwSGNLRA+2k7ABAACA4gcPtgwIiFQZXP9DRIODtAEAAP3Bq7ABAAADi0NEO0NAfMSLQ0A5Q0QPhUf+//9IjVNcQbgTAAAASIvL6DX6//9BugEAAABIiUMox0MwBAAAAESJa0RFjVoC6Rf+//+D+AQPhX0BAACLSzxEi0M4QQPIOUtEfEdIjVNvSIvL6PP5//9Ei0M8SI1Tb0iJQxhIi8tIY0M4SAPQ6Nj5//9IjVMoSIlDIEiLy+gY+///TIlrKMdDMAYAAADppv3//0iLQyhEi4OwAQAARIuLtAEAAIsQSSPQSMHiBEgDUAgPtgJBO8F/OJAPtgpB0+hEK8" & _
                                        "lmg3oC/0GLwHVcSItKCEiFyQ+EKgYAAIvQiwFII9BIweIESANRCA+2AkE7wX7JSIuLwIEAAEGLwkmJDCRIi0wkcIuTyIEAAIkRSItcJFBIi2wkWEiLdCRgSIPEIEFfQV5BXUFcX8NEiYOwAQAARImLtAEAAA+/SgKD+f90sYP5/g+EuwUAAIP5EH0QSGNDRIhMGG//Q0Tp7Pz//3UHuAIAAADrDIP5EbgHAAAAQQ9Ew4lDSIP5EkGLww9Ex4lDTIP5EHUgi0NEhcB+Gf/ISGPID7ZEGW+JQ1THQzAFAAAA6aP8//9Bi8XHQzAFAAAAiUNU6ZH8//+D+AV1Z0SLg7QBAACLS0hEO8EPjCD///+Lg7ABAABEK8FBi9JEiYO0AQAA0+L/yiPQ0+gDU0yJg7ABAACF0n4gkItDPANDOEhjS0Q7yH0RD7ZDVP/KiEQZb/9DRIXSf+HHQzAEAAAA6SX8//+D+AYPhXUBAABIi0sYRIuDsAEAAESLi7QBAABBi9CLAUgj0EjB4gRIA1EID7YCQTvBD4+V/v//D7YKQdPoRCvJZoN6Av9Bi8B1KUiLSghIhckPhIgEAACL0IsBSCPQSMHiBEgDUQgPtgJBO8F+yelZ/v//RImDsAEAAESJi7QBAAAPv3oCg///D4Q+/v//g//+D4RIBAAAgf8AAQAAfXdIY4O4gQAATIsDQIi8GLgBAACLg7iBAAD/wCX/fwAAiYO4gQAAi4PIgQAAO4PMgQAAfCdIi4vAgQAAA8BIY9CJg8yBAABB/1AIQboBAAAASImDwIEAA" & _
                                        "EWNWgJIY4vIgQAASIuDwIEAAECIPAH/g8iBAADpB/v//3VLSItDCESJUzBIOUMYdBpIjVMYSIvL6EP4//9BugEAAABMiWsYRY1aAkiLQxBIOUMgD4TP+v//SI1TIEiLy+gb+P//TIlrIOmw+v//gf8eAQAAD42u+v//x0MwBwAAAIl7NOmf+v//g/gHdWmLQzREi4u0AQAALQEBAABImEiNDEBJi0cYTI0EiA+/TIgCRDvJD4we/f//i5OwAQAAQYvC0+D/yCPCQQNABIlDUEEPv0ACRCvIRImLtAEAAEEPtkgC0+qJk7ABAADHQzAIAAAA6Tn6//+D+AgPhagAAABIi0sgRIuDsAEAAESLi7QBAABBi9CLAUgj0EjB4gRIA1EID7YCQTvBD4+p/P//ZpAPtgpB0+hEK8lmg3oC/0GLwHUpSItKCEiFyQ+EmgIAAIvQiwFII9BIweIESANRCA+2AkE7wX7J6Wv8//9EiYOwAQAARImLtAEAAA+/QgKD+P8PhFD8//+D+P4PhFoCAACD+B4PjVECAADHQzAJAAAAiUM06Yj5//+D+AkPhfcAAABIY0M0i5O0AQAASI0MQEmLRyBMjQSID79MiAI70Q+MA/z//4uDsAEAACvRQYvy0+b/ziPwQQNwBImTtAEAAEEPtkgC0+iJg7ABAADHQzAGAAAARDlrUA+EkwAAAA8fAEhji7iBAAD/S1CLwUyLAyvGJf9/AAAPtrwYuAEAAECIvBm4AQAAi4O4gQAA/8Al/38AAImDuIEAAIuDyIEAADuDzIEAAHwd" & _
                                        "SIuLwIEAAAPASGPQiYPMgQAAQf9QCEiJg8CBAABIY4vIgQAASIuDwIEAAECIPAH/g8iBAABEOWtQD4V6////QboBAAAARY1aAv9LUOmA+P//g/gKdTWLk7QBAACD+hAPjBv7//+Li7ABAAAPt8GJQ1iNQvDB6RCJg7QBAACJi7ABAACJezDpTvj//4P4C3VOi4O0AQAAg/gQD4zh+v//i4uwAQAAg8DwD7fRwekQgfL//wAAiYuwAQAAi0tYiYO0AQAAO8oPhcgAAACFybgMAAAAQQ9EwolDMOn79///g/gMD4Xy9///g7u0AQAACA+MjPr//0hjg7iBAAAPtruwAQAATIsDQIi8GLgBAACLg7iBAAD/wCX/fwAAiYO4gQAAi4PIgQAAO4PMgQAAfCdIi4vAgQAAA8BIY9CJg8yBAABB/1AIQboBAAAASImDwIEAAEWNWgJIY4vIgQAASIuDwIEAAECIPAG/CwAAAP+DyIEAAIODtAEAAPjBq7ABAAAIg2tYAQ+FT/f//0SJUzDpRvf//0iLi8CBAABB/1cQSItEJHBMiavAgQAATYksJESJKDPA6eP5///MSIlcJAhIiWwkEEiJdCQYSIl8JCBBVkFXQYsBTYvxSWPwTIvaSAPySIv59sIDdCOQTDvedB1BD7YTSf/DD7bISDPRi8jB6QiLBJczwUH2wwN13jPbSIvWSSvTRIv7SIPi/EiNagNIwe0CSo0MGkw72UgPR+tIhe10fw8fgAAAAABFixNJ/8dBi8pJg8MEwekIRA+2wYvIwekID7bJTDP" & _
                                        "BQYvKwekQD7bRi8jB6RBGi4yHAAgAAA+2yUgz0UGLysHpGEQzjJcABAAAD7bRi8jB6RgPtslIM9EPtshBD7bCM8iBwQADAABEMwyXSGPJQYvBMwSPTDv9dYhMi8ZNK8NMO95MD0fDTYXAdCZmDx9EAABBD7YTTY1bAQ+2yEj/w0gz0YvIwekIiwSXM8FJO9h14EiLXCQYSItsJCBIi3QkKEiLfCQwQYkGQV9BXsPMzMzMRYXAfi1B/8hBwegEQf/ARTPJgwIBiwJ1A/9CBIkBi0IEiUEETIlJCEiDwRBJg+gBdeDDzMzMzMzMzMzMzMzMzEWFwHQbSCvKDx+EAAAAAAAPtgQRMAJIjVIBQYPoAXXww8zMzMzMzMzMzMzMzMzMzEBXTIvSSIv5RYXJD46SAAAARItcJDBIiVwkEEGL24PjAUGD4wJBD7YQhdt0F0GLQgiDyAKLyIPxAQ+vyMHpCDLKQYgIRYXbdARBD7YQQQ+2CkH/yQ+2wkn/wEgzyEGLAsHoCIsUjzPQD7bCQQNCBGnIBYQICEGJEkGLUgj/wUGJSgRBD7ZCBw+2ykgzyMHqCIsEjzPCQYlCCEWFyX+HSItcJBBfw8zMzMzMzMzMzMzM6Tvs///MzMzMzMzMzMzMzEiJXCQIV0iD7CBIixlIi/lIi0kQ/1MQSItPCP9TEEiLz0iLQxBIi1wkMEiDxCBfSP/gzMzMzMzMzMzMzMzMzMxIiVwkCFdIg+xQSIvaSIv5TYXAdBZIiwlNi8hEi0IISIsSSItJOOgV/f//i0MoTI1DGEiLE0" & _
                                        "yNSxCJRCRASIvPi0MkiUQkOItDIIlEJDCLQxyJRCQoTIlEJCBEi0MI6D3s//9Ii1wkYEiDxFBfw8zM6dvx///MzMzMzMzMzMzMzOnr8v//zMzMzMzMzMzMzMxIiVwkCEiJdCQQSIl8JBhMiXQkIEFXSIPsMEiNehBJi/BEi0IITI16GEiLEkyLz0yL8UyJfCQg6DTz//+L2EiF9nQghcB0HEiLF0iF0nQUSYsOTIvORYsHSItJOOhP/P//i8NIi1wkQEiLdCRISIt8JFBMi3QkWEiDxDBBX8PMzDPAg/oBD5TAww=="

            Const ZlibExports As String = "vbzlib_compress_block|8336*vbzlib_compress_cleanup|8272*vbzlib_compress_init|8256*vbzlib_crc32|7632*vbzlib_decompress_block|8480*vbzlib_decompress_cleanup|8464*vbzlib_decompress_init|8448*vbzlib_memnonce|7968*vbzlib_memxor|8032*vbzlib_zipcrypt|8080"
        #Else
            'x86
            Const ZlibText As String = "VleL+WiwjwYAiweLAP/Qi/CF9nUDX17DiXcEjU4CugCAAACDyP/rCI2kJAAAAACQx0EC/////41JCGaJQfhmiUH2g+oBdemNvgiABAC5AIAAAPOrX4mWBIAEAI1CAYmWDIAGAF7DzMzMzMzMzMzMzFWL7FNWi/GK2oPK/4uGBIAEAA+3TMYCjQTGZjvKdAkPv8FmiRTG6xCLQASD+P90CGaJlEYIgAQAi4YEgAQAi00IiUzGBIuGBIAEAGaJVMYCjRROi44EgAQAD7eCCIAEAGaJBM6LhgSABAAPvwzGD7fAZomCCIAEAIP5/3QMZouGBIAEAGaJRM4Ci4YEgAQAiJwGAAAEAIuGBIAEAEAl/38AAImGBIAEAF5bXcIEAMzMVYvsg+wUU4vBi9pWVzP2iV34i3gEiUXwiX3sObcMgAYAD47fAAAA6weNpCQAAAAAi48MgAYAi8ErxgNFCIP4BA+MjwAAADvxfQmKhD4IgAYA6weLxivBigQYjVYCiEX/iEX0jUL/O8F9CYqEPgmABgDrCIvGK8GKRBgBiEX1O9F9CYqEPgqABgDrCIvGK8GKRBgCiEX2jUIBO8F9CYqEPguABgDrCIvGK8GKRBgDilX/i8+IRfdpRfS9pzUewegQUOiK/v//Rju3DIAGAA+MXf///+sxi847twyABgB9J42XCIAGAOsJjaQkAAAAAIv/ioQPCIAGAI1SAYhC/0E7jwyABgB86im3DIAGAItFCIXAD45wAQAAg/gED4xwAQAAi4cAAAQAM9KJhwCABABpA72nNR7B6BA" & _
                                        "Pv7RHCIAEAIP+/w+ESAEAAOsGjZsAAAAAi48EgAQAi8YrwcdF9ACAAAAl/38AAClF9CtN9IHh/38AAIuEOQAABAA7A3UQi0X0iYSXEIAGAEI7VQx9CQ+/NPeD/v91uolV9IXSD47vAAAAi0UIi00QO8h+BYvIiU0QvgQAAAA7zn5xjaQkAAAAAIoEHjPJM9uIRf+F0n5Wi/+LlI8QgAYAi8YrwnkYi4cEgAQAK8IDxiX/fwAAioQ4AAAEAOsJi334igQ4i33sOEX/dQiJlJ8QgAYAQ0E7TfR8v4P7AX4Oi9NGi134iVX0O3UQfJyLXfiLRQg78H07i5cQgAYAi84ryoXJeRiLhwSABAArwgPGJf9/AACKhDgAAAQA6wOKBBmNPBo4BA+Lfex1B0ZBO3UIfM+LlxCABgCLTfBW6NgEAACF9n9Wi0UIhcAPj5D+//9fXluL5V3CDACLVfCKA4sKi1IIPI93Dw+28ItBFGoID7ZEMDDrGg+2yItF8GoJizCLRhQPtgQIi86NBEUBAAAAUOgjBAAAvgEAAACLRQiD+AR8FWkDvac1HovPihPB6BBQ6GP8///rFYuPDIAGAIoDiIQPCIAGAP+HDIAGAItFCE5IQ4lFCIX2f8SJXfjpZv///8zMzMzMzMxVi+yD7CCLwVNWV4tYBDP2i/qJRfCJffiJXeA5swyABgAPjt8AAADrB42kJAAAAACLiwyABgCLwSvGA0UIg/gED4yPAAAAO/F9CYqEHgiABgDrB4vGK8GKBDiNVgKIRf+IReiNQv87wX0JioQeCY" & _
                                        "AGAOsIi8YrwYpEOAGIRek70X0JioQeCoAGAOsIi8YrwYpEOAKIReqNQgE7wX0JioQeC4AGAOsIi8YrwYpEOAOKVf+Ly4hF62lF6L2nNR7B6BBQ6Gr7//9GO7MMgAYAD4xd////6zGLzjuzDIAGAH0njZMIgAYA6wmNpCQAAAAAi/+KhAsIgAYAjVIBiEL/QTuLDIAGAHzqKbMMgAYAM8AzyYlF5ItFCDP2iU3oiXX0hcAPjhACAACD+AQPjN0BAACLgwAABACJgwCABABpB72nNR7HRewAAAAAwegQD7+UQwiABACD+v8PhLABAACNZCQAi4sEgAQAi8Irwb4AgAAAJf9/AAAr8CvOgeH/fwAAi4QZAAAEADsHi0XsdRCJtIMQgAYAQIlF7DtFDH0JD78U04P6/3W7hcAPjlkBAACLVQiLTRA7yn4Fi8qJTRC/BAAAADvPfm+LTfgz9ooMD4hN/zPJhcB+W+sIjaQkAAAAAJCLlIsQgAYAi8crwnkYi4MEgAQAK8IDxyX/fwAAioQYAAAEAOsJi134igQYi13gOEX/dQiJlLMQgAYARkE7Tex8v4P+AX4LR4vGiUXsO30QfJSLVQg7+n1Bi7MQgAYAi8+LRfgrzoXJeRuLgwSABAArxgPHJf9/AACKlBgAAAQAi0X46wOKFAGNHAY4FAuLXeB1B0dBO30IfMyLdfSF9n5vjUYBO/h+V4t18ItN5IsGi1YIi0AUgPmPdxIPtvFqCA+2RDAwUItF8IsI6xMPtslqCQ+2BAiLDo0ERQEAAABQ6AwBAACLi" & _
                                        "xCABgCJffSLffiJTegPtgeJReTpngAAAItV6ItN8FboRgEAAIt9+Ossi5MQgAYAiX30i334iVXoD7YHiUXk63aLdfSLTeiF9n4vi9GLTfBW6BUBAABOM8CJRfSF9n9ci0UIi3X0i03ohcAPj/D9//9fXluL5V3CDACLVfCKB4sKi1IIPI93Dw+28ItBFGoID7ZEMDDrGg+2yItF8GoJizCLRhQPtgQIi86NBEUBAAAAUOhUAAAAvgEAAACLRQiD+AR8FWkHvac1HovLihfB6BBQ6JT4///rFYuLDIAGAIoHiIQLCIAGAP+DDIAGAItFCE5IR4lFCIX2f8SJffjpYP///8zMzMzMzMzMVYvsi0UIVovyV4v5i04Q0+AJRgyLRQwDwYlGEIP4CHwzi0YIOUYEfA8DwFD/NolGCItHBP/QiQaLVgSLDopGDIgECv9GBMFuDAiDRhD4g34QCH3NX15dwggAzMzMzMzMVYvsg+wUi0UIiVX0U4sZiV34VotxCIl1/IXAD45uAgAAVz0EAQAAfge/AgEAAOsMi/g9AgEAAH4DjXj9K8fHRfAdAAAAiUUIg87/i0MMi13wiUXsjQQzmSvCi1Xs0fiNDEA7fIoEfQSL2OvoO3yKCH4Ei/Dr3ot1/I0EQItd+I0EgolF7LkXAQAAD7cAi1YQZjvBD7/Ii0MUf1oPtoRIAP7//4vK0+AJRgyNQgeJRhCD+AgPjIoAAACNpCQAAAAAi0YIOUYEfA8DwFD/NolGCItDBP/QiQaLTgSLFopGDIgECv9GBMFuDAiDRhD4" & _
                                        "g34QCH3N604PtkQBqIvK0+AJRgyNQgiJRhCD+Ah8N41kJACLRgg5RgR8DwPAUP82iUYIi0ME/9CJBotOBIsWikYMiAQK/0YEwW4MCINGEPiDfhAIfc2LVewPt0ICZoXAdEkregSLThCY0+cDwQl+DIlGEIP4CHwzi0YIOUYEfA8DwFD/NolGCItDBP/QiQaLTgSLFopGDIgECv9GBMFuDAiDRhD4g34QCH3Ni0MQg8//vh4AAACL2I0EPpkrwotV9NH4jQxAO1SLBH0Ei/Dr6DtUiwh+BIv4696LdfyNBEAPvwyDjTyDi134i1YQi0MUD7YEyIvK0+AJRgyNQgWJRhCD+Ah8M4tGCDlGBHwPA8BQ/zaJRgiLQwT/0IkGi04EixaKRgyIBAr/RgTBbgwIg0YQ+IN+EAh9zQ+3RwJmhcB0VItOEA+/0ItF9CtHBNPgCUYMjQQRiUYQg/gIfDjrA41JAItGCDlGBHwPA8BQ/zaJRgiLQwT/0IkGi04EixaKRgyIBAr/RgTBbgwIg0YQ+IN+EAh9zYtFCIXAD4+U/f//X15bi+VdwgQAzMzMzMzMzMzMVYvsUVOL2YlV/FZXaACAAACLO4tzCIsH/9CJBovWM8DHRggAgAAAOUUUi89qAw+VwMdGBAAAAACDwAJQ6L/8//+DfRgAi8v/dSCLVfz/dRz/dQh0B+i29f//6wXoz/j//2oHagCL1ovP6JL8//+DfRQAdBqLVhCF0nQTuAgAAACLzyvCi9ZQagDocvz//4tFDIsOX4kIi0UQi04EXluJCLgBAAA" & _
                                        "Ai+VdwhwAzMzMzMxVi+yD7AxTi9mJVfxWV2oIiwOJXfT/0ItNFIv4uAEAAAC+AQAAANPgi00YSNPmiUX4jQT1AAAAAFCLA//QiUcEM8mNRv+Dyv+JB4XAeCGL/4tHBGaJVMgCi0cExgTIAItHBMdEyAQAAAAAQTsPfuEz2zldDH5ui3UUjaQkAAAAAItFCA+2BAM7xn5Ti0X8iwSYi8gjTfg7TRB1Q4vO0/gjBzsHfzmLTwRmiVzBAotNCA+2FAuLTwQr1o00wQ+2DjvKfQKIFotNCLoBAAAAi3UUD7YMCyvO0+IDwjsHfsdDO10MfJwz9jk3fGCLVRiLXRCLRwSNDPAPtgE7wn5Ig8j/ZolBAotHBI0M8A+2ASvCg/gHfgW4BwAAAIgRi00UUI0EEYtV/FCLxtPgi030C8NQ/3UM/3UI6MX+//+LTwSLVRiJRPEERjs3fqaLx19eW4vlXcIUAMzMzMzMzMzMzMzMVYvsgewMBQAAM8CJTfRTi10IVovyiUW4M9KJdfyJVfiJRbyJRcCJRcSJRciJRcyJRdCJRdSJRdiJRdyJReCJReSJReiJReyJRfCF234Yi/8Ptgww/0SNtDvRfQKL0UA7w3ztiVX4M9IzyY2bAAAAAImUDXj///8DVA24g8EEA9KD+Tx861cz/4XbfkiNnfT6//8PtjQ3xwMAAAAAi5S1dP///41CAYmEtXT///+F9nQUM8CLygPAg+EB0foLwYPuAXXwiQOLdfxHg8MEO30IfMGLXQiLRfhfg/gJfAW4CQAAAItN9I2V9Pr//1" & _
                                        "BqAGoAiwlTVuin/f//XluL5V3CBADMzMzMzMzMzMzMzMzMzMxVi+yD7AhTi9mLwolF+IsLiU38hcB1CIPI/1uL5V3DV4s4hf90SlYz9jk3fCGNSQCLVwSDwgSDPPIAjRTydAeLy+i6////Rjs3fuWLTfz/dwSLQQj/0ItF/MdHBAAAAABXi0AI/9CLRfhexwAAAAAAXzPAW4vlXcPMzMzMzMzMzFWL7IHsIAEAAFNWi/FXaLCBAACLBv/Qi9iNveD+//+4CAgICI2V4P7//7kkAAAAaCABAACJM/OruAkJCQmNvXD///+5HAAAAPOri8vHReAHBwcHx0XkBwcHB8dF6AcHBwfHRewHBwcHx0XwBwcHB8dF9AcHBwfHRfgICAgIx0X8CAgICOjn/f//iUMEjZXg/v//aiCLy8eF4P7//wUFBQXHheT+//8FBQUFx4Xo/v//BQUFBceF7P7//wUFBQXHhfD+//8FBQUFx4X0/v//BQUFBceF+P7//wUFBQXHhfz+//8FBQUF6IX9//9fiUMIi8Nex0MYAAAAAMdDFAAAAADHQxAAAAAAx0MMAAAAAMeDmAEAAAAAAADHg5wBAAAAAAAAx4OggQAAAAAAAFuL5V3DzMzMzMzMzMzMzMzMzMzMVYvsUYvBU1aJRfyL2leLOItFCIsTizCLQAQj9w+2DPCNBPA7yn8mD7YI0+8r0WaDeAL/dTKLQASFwHQdiwiLQAQjz40EyA+2CDvKftpfXoPI/1uL5V3CBABfXrj+////W4vlXcIEAItN/Ik5X4kTD79AA" & _
                                        "l5bi+VdwgQAzMzMzMxVi+yD7BBTVovxi9pXaACAAACJXfyLBolF+IsA/9CLVQiJhqSBAADHhqyBAAAAgAAAx4aogQAAAAAAAOsGi1UIi138hdJ/DYO+nAEAAAAPjukGAACDvpwBAAAYjb6cAQAAfSOF0n4ZD7YDSosPQ9PgCYaYAQAAjUEIiQeD+Bh844ld/IlVCItGGIXAdQnHRhgBAAAA662D+AF1fIsXg/oDD4yXBgAAi4aYAQAAg8L90eiLyIkXwegCiYaYAQAAg+EDdSCLysdGGAoAAACD4Qcr0dPoiReLVQiJhpgBAADpYP///4tVCIP5AXUYi0YEiUYMi0YIiUYQx0YYBgAAAOlA////g/kCD4U3////i1UIiU4Y6Sz///+D+AJ1cYsXg/oOD4wWBgAAi46YAQAAi8GD4B/B6QUFAQEAAMdGLAAAAACJRiCLwYPgH8HpBUDHRhgDAAAAiUYki8GD4A/B6QSDwASJjpgBAACJRiiNQvKLVQiJBzPAiUZEiUZIiUZMiUZQZolGVIhGVum2/v//g/gDdXs5Bw+MowUAAItGLDtGKH06i134gz8DfCyLSxiLRiyKlpgBAACA4gcPtgQBiFQwRP9GLItGLIMH/cGumAEAAAM7Rih8z4tVCItd/ItGLDtGKA+FW/7//2oTjVZEi87ovPr//4tVCIlGFMdGGAQAAADHRiwAAAAA6Tb+//+D+AQPhe0AAACLRiSLTiADwTlGLHxBUY1WV4vO6IL6////diSNVleJRgwDViCLzuhv+v//jVYUiUYQi87o" & _
                                        "cvv//4tVCMdGFAAAAADHRhgGAAAA6d/9////dhSNjpgBAACL1+gM/f//i8iD+f8PhL4EAACD+f4PhIAEAACD+RB9EotGLItVCIhMMFf/RizppP3//3UHuAIAAADrDzPAg/kRD5XAjQSFAwAAAIlGMDPAg/kSD5TAjQTFAwAAAIlGNIP5EHUei0YshcB+Fw+2RDBWi1UIiUY8x0YYBQAAAOlU/f//i1UIM8CJRjzHRhgFAAAA6UD9//+D+AV1YIsfi04wO9kPjCgEAACLhpgBAAC6AQAAANPiK9lKiR8j0NPoA1Y0iYaYAQAAhdJ+JOsGjZsAAAAAi0YkA0Ygi04sO8h9D4pGPEqIRDFX/0YshdJ/5MdGGAQAAADp1fz//4P4Bg+F9wAAAP92DI2OmAEAAIvX6P/7//+L2IP7/w+EsQMAAIP7/g+EcwMAAIH7AAEAAH1ji4aggQAAiw6InDCgAQAAi4aggQAAQCX/fwAAiYaggQAAi4aogQAAO4asgQAAfBoDwFD/tqSBAACJhqyBAACLQQT/0ImGpIEAAIuOqIEAAIuGpIEAAIgcAf+GqIEAAOk9/P//dUiLRgzHRhgBAAAAO0YEdBGNVgyLzuil+f//x0YMAAAAAItGEItVCItd/DtGCA+ED/z//41WEIvO6IL5///HRhAAAAAA6fP7//+LVQiB+x4BAAAPjef7///HRhgHAAAAiV4c6dX7//+D+Ad1U4tGHC0BAQAAjQxAi0X4i0AMjRyID79LAjkPD4ywAgAAi5aYAQAAuAEAAADT4EgjwgNDBIl" & _
                                        "GOA+/QwIpB4pLAtPqiZaYAQAAx0YYCAAAAOl9+///g/gIdT3/dhCNjpgBAACL1+ir+v//g/j/D4RfAgAAg/j+D4QhAgAAg/geD40YAgAAi1UIx0YYCQAAAIlGHOlB+///g/gJD4XcAAAAi0Ycix+NDECLRfiLQBCNBIgPv0gCiUX0iU3wO9kPjA8CAACLhpgBAAC6AQAAACtd8NPii030SiPQA1EEiR+KSQLT6IN+OACJVfSJhpgBAADHRhgGAAAAdHuLjqCBAACLwf9OOCvCixYl/38AAA+2nDCgAQAAiJwxoAEAAIuGoIEAAEAl/38AAImGoIEAAIuGqIEAADuGrIEAAHwaA8BQ/7akgQAAiYasgQAAi0IE/9CJhqSBAACLjqiBAACLhqSBAACLVfSIHAH/hqiBAACDfjgAdYX/TjjpVvr//4P4CnU0ixeD+hAPjEYBAACLjpgBAAAPt8GJRkCNQvCLVQjB6RCJB4mOmAEAAMdGGAsAAADpI/r//4P4C3VGiweD+BAPjA0BAACLjpgBAACDwPAPt9GJB4Hy//8AAItGQMHpEImOmAEAADvCD4WwAAAAi1UI99gbwIPgC0CJRhjp2Pn//4P4DA+Fz/n//4M/CA+MwAAAAIuGoIEAAA+2npgBAACLDoicMKABAACLhqCBAABAJf9/AACJhqCBAACLhqiBAAA7hqyBAAB8HQPAUP+2pIEAAImGrIEAAItBBP/Qi1UIiYakgQAAi46ogQAAi4akgQAAiBwB/4aogQAAgwf4wa6YAQAACINGQP+LXfwPhU" & _
                                        "f5///HRhgBAAAA6Tj5//+LRfj/tqSBAACLQAj/0ItFDMeGpIEAAAAAAABfXscAAAAAAItFEFvHAAAAAAAzwIvlXcIMAItNDLgBAAAAi5akgQAAX4kRi00Qi5aogQAAXluJEYvlXcIMAMzMzMzMzMzMzMzMzMzMzFWL7FGLRRSLTRBTi10MA8uLAIlN/FZXi30I9sMDdB+QO9l0Fw+2E0MPtsgz0cHoCItN/DMEl/bDA3XliV0Mi9HHRRAAAAAAK9OD4vyNDBqDwgPB6gI7yxvJ99EjyolNCHRpixuLy8HpCA+28YvIwekID7bJM/GLy8HpEA+20YvIwekQi7S3AAgAAA+2yTPRi8jB6RgztJcABAAAi9PB6hgz0Q+2yA+2w4tdDDPIg8MEMzSXiV0MM7SPAAwAAItNEIvGQYlNEDtNCHWXi038M/Yryzld/BvS99Ij0YlVDHQXD7YTjVsBD7bIRjPRwegIMwSXO3UMdemLTRRfXluJAYvlXcIQAMzMzMzMzMzMzMzMVYvsVot1EIX2fjOLVQxOi0UIwe4ERoMCAYsKdQP/QgSJCItKBIlIBMdACAAAAADHQAwAAAAAg8AQg+4BddheXcIMAMzMzMzMzMzMzMzMzMxVi+yLVRCF0nQYi0UMVot1CCvwigwGjUABMEj/g+oBdfJeXcIMAMzMzMzMzMzMzMxVi+yDfRQAD46JAAAAi0UQU1aLdQxXi30Yi8+D4QGD5wKJTRiKGIXJdBWLTgiDyQKL0YPyAQ+v0cHqCDLTiBCF/3QCihgPthZAD7bLi10IM" & _
                                        "9GLDsHpCIsUk4teCDPRD7bKA04EackFhAgIiRYPttPB6whBiU4ED7ZOBzPRi00IMxyRi00USYleCIlNFIXJi00Yf5FfXltdwhQAzMzMzMzMVYvsVot1CFdqDIsG/9CL+IvPiTfo1+X//4sOahT/0cdAEAAAAADHQAwAAAAAiUcIi8dfXl3CBADMzMzMzMzMzFWL7FaLdQhXiz7/dgiLRwj/0P92BItHCP/Qi0cIVv/QX15dwgQAzMzMzMzMzMzMzFWL7ItFEFaLdQxXi30IhcB0EFD/dgSLB/82/3Ac6D79////dhyLFo1GDP92GIvP/3YU/3YQUI1GCFD/dgToTvD//19eXcIMAMzMzMzMzMzMVYvsi00I6NXz//9dwgQAzFWL7FaLdQiLRgyNVgxXiz6FwHQMO0YEdAeLzugw8///i0YQjVYQhcB0DDtGCHQHi87oGvP//4N+FACNVhR0B4vO6Arz//+NVgSLzugA8///jVYIi87o9vL//4tHCFb/0F9eXcIEAMzMzMzMzMzMzMxVi+yLVQyLTQhTVleNWgyNeghTV/9yBIsS6AL1//+LTRCL8IXJdB2F9nQZiweFwHQRUf8zUItFCIsA/3Ac6E78//+Lxl9eW13CDADMzMzMzFWL7DPAg30MAQ+UwF3CDAA="

            Const ZlibExports As String = "vbzlib_compress_block|6784*vbzlib_compress_cleanup|6736*vbzlib_compress_init|6672*vbzlib_crc32|6112*vbzlib_decompress_block|6992*vbzlib_decompress_cleanup|6880*vbzlib_decompress_init|6864*vbzlib_memnonce|6384*vbzlib_memxor|6464*vbzlib_zipcrypt|6512"
            
        #End If
    #End If
    
#End If

'=========================================================================
' API
'=========================================================================

'--- for FindFirstFile
Private Const MAX_PATH                      As Long = 260

#If VBA7 Then
    Private Const INVALID_HANDLE_VALUE          As LongPtr = -1
#Else
    Private Const INVALID_HANDLE_VALUE          As Long = -1
#End If
'--- for CreateFile
Private Const CREATE_ALWAYS                 As Long = 2
Private Const OPEN_EXISTING                 As Long = &H3
Private Const GENERIC_WRITE                 As Long = &H40000000
Private Const GENERIC_READ                  As Long = &H80000000
Private Const FILE_SHARE_READ               As Long = &H1
Private Const FILE_SHARE_WRITE              As Long = &H2
'--- for VirtualAlloc
'Private Const PAGE_EXECUTE_READWRITE        As Long = &H40
'Private Const MEM_COMMIT                    As Long = &H1000
'--- for SetFilePointer
Private Const FILE_BEGIN                    As Long = 0
Private Const FILE_CURRENT                  As Long = 1
Private Const FILE_END                      As Long = 2
'--- for MultiByteToWideChar
Private Const CP_UTF8                       As Long = 65001
Private Const CP_OEMCP                      As Long = 1
'--- for FormatMessage
Private Const FORMAT_MESSAGE_FROM_SYSTEM    As Long = &H1000
Private Const FORMAT_MESSAGE_IGNORE_INSERTS As Long = &H200
'--- for SetFilePointer
Private Const INVALID_SET_FILE_POINTER      As Long = -1
'--- for CryptStringToBinary
Private Const CRYPT_STRING_BASE64           As Long = 1
'--- for CNG
Private Const MS_PRIMITIVE_PROVIDER         As String = "Microsoft Primitive Provider"
Private Const BCRYPT_SHA1_ALGORITHM         As String = "SHA1"
Private Const BCRYPT_AES_ALGORITHM          As String = "AES"
Private Const BCRYPT_HASH_LENGTH            As String = "HashDigestLength"
Private Const BCRYPT_OBJECT_LENGTH          As String = "ObjectLength"
Private Const BCRYPT_CHAINING_MODE          As String = "ChainingMode"
Private Const BCRYPT_CHAIN_MODE_ECB         As String = "ChainingModeECB"
Private Const BCRYPT_ALG_HANDLE_HMAC_FLAG   As Long = 8
Private Const BCRYPT_HASH_REUSABLE_FLAG     As Long = &H20
'--- for GetStdHandle
Private Const STD_INPUT_HANDLE              As Long = -10&
Private Const STD_OUTPUT_HANDLE             As Long = -11&
Private Const STD_ERROR_HANDLE              As Long = -12&

#If VBA7 Then
    Private Declare PtrSafe Function CryptStringToBinary Lib "crypt32" Alias "CryptStringToBinaryW" (ByVal pszString As LongPtr, ByVal cchString As Long, ByVal dwFlags As Long, ByVal pbBinary As LongPtr, ByRef pcbBinary As Long, ByRef pdwSkip As Long, ByRef pdwFlags As Long) As Long
    Private Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As LongPtr)
    Private Declare PtrSafe Function FindFirstFile Lib "kernel32" Alias "FindFirstFileA" (ByVal lpFileName As String, lpFindFileData As WIN32_FIND_DATA) As LongPtr
    Private Declare PtrSafe Function FindClose Lib "kernel32" (ByVal hFindFile As LongPtr) As Long
    Private Declare PtrSafe Function CreateFile Lib "kernel32" Alias "CreateFileA" (ByVal lpFileName As String, ByVal dwDesiredAccess As Long, ByVal dwShareMode As Long, ByVal lpSecurityAttributes As LongPtr, ByVal dwCreationDisposition As Long, ByVal dwFlagsAndAttributes As Long, ByVal hTemplateFile As LongPtr) As LongPtr
    Private Declare PtrSafe Function CloseHandle Lib "kernel32" (ByVal hObject As LongPtr) As Long
    Private Declare PtrSafe Function ReadFile Lib "kernel32" (ByVal hFile As LongPtr, lpBuffer As Any, ByVal nNumberOfBytesToRead As Long, lpNumberOfBytesRead As Long, ByVal lpOverlapped As LongPtr) As Long
    Private Declare PtrSafe Function WriteFile Lib "kernel32" (ByVal hFile As LongPtr, lpBuffer As Any, ByVal nNumberOfBytesToWrite As Long, lpNumberOfBytesWritten As Long, ByVal lpOverlapped As LongPtr) As Long
    Private Declare PtrSafe Function SetFilePointer Lib "kernel32" (ByVal hFile As LongPtr, ByVal lDistanceToMove As Long, ByVal lpDistanceToMoveHigh As Long, ByVal dwMoveMethod As Long) As Long
    Private Declare PtrSafe Function SetEndOfFile Lib "kernel32" (ByVal hFile As LongPtr) As Long
    Private Declare PtrSafe Function FileTimeToSystemTime Lib "kernel32" (lpFileTime As FILETIME, lpSystemTime As SYSTEMTIME) As Long
    Private Declare PtrSafe Function SystemTimeToFileTime Lib "kernel32" (lpSystemTime As SYSTEMTIME, lpFileTime As FILETIME) As Long
    Private Declare PtrSafe Function FileTimeToLocalFileTime Lib "kernel32" (lpFileTime As Any, lpLocalFileTime As FILETIME) As Long
    Private Declare PtrSafe Function LocalFileTimeToFileTime Lib "kernel32" (lpLocalFileTime As FILETIME, lpFileTime As FILETIME) As Long
    Private Declare PtrSafe Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As LongPtr
    Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtr
    Private Declare PtrSafe Sub CoTaskMemFree Lib "ole32" (ByVal pv As LongPtr)
    Private Declare PtrSafe Function MultiByteToWideChar Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, lpMultiByteStr As Any, ByVal cbMultiByte As Long, lpWideCharStr As Any, ByVal cchWideChar As Long) As Long
    Private Declare PtrSafe Function WideCharToMultiByte Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, ByVal lpWideCharStr As LongPtr, ByVal cchWideChar As Long, ByVal lpMultiByteStr As LongPtr, ByVal cchMultiByte As Long, ByVal lpDefaultChar As Long, ByVal lpUsedDefaultChar As Long) As Long
    Private Declare PtrSafe Function GetStdHandle Lib "kernel32" (ByVal nStdHandle As Long) As LongPtr
    #If ImplCompress Then
        Private Declare PtrSafe Function FileTimeToDosDateTime Lib "kernel32" (lpFileTime As FILETIME, ByVal lpFatDate As LongPtr, ByVal lpFatTime As LongPtr) As Long
        Private Declare PtrSafe Function ApiEmptyByteArray Lib "oleaut32" Alias "SafeArrayCreateVector" (Optional ByVal VarType As VbVarType = vbByte, Optional ByVal Low As Long = 0, Optional ByVal Count As Long = 0) As Byte()
        Private Declare PtrSafe Function FindNextFile Lib "kernel32" Alias "FindNextFileA" (ByVal hFindFile As LongPtr, lpFindFileData As WIN32_FIND_DATA) As Long
    #End If ' ImplCompress
    #If ImplDecompress Then
        Private Declare PtrSafe Function DosDateTimeToFileTime Lib "kernel32" (ByVal wFatDate As Long, ByVal wFatTime As Long, lpFileTime As FILETIME) As Long
    #End If ' ImplDecompress
    #If ImplCrypto Then
        Private Declare PtrSafe Function CoCreateGuid Lib "ole32" (pguid As Any) As Long
        Private Declare PtrSafe Function BCryptOpenAlgorithmProvider Lib "bcrypt" (phAlgorithm As LongPtr, ByVal pszAlgId As LongPtr, ByVal pszImplementation As LongPtr, ByVal dwFlags As Long) As Long
        Private Declare PtrSafe Function BCryptCloseAlgorithmProvider Lib "bcrypt" (ByVal hAlgorithm As LongPtr, ByVal dwFlags As Long) As Long
        Private Declare PtrSafe Function BCryptGetProperty Lib "bcrypt" (ByVal hObject As LongPtr, ByVal pszProperty As LongPtr, pbOutput As Any, ByVal cbOutput As Long, cbResult As Long, ByVal dwFlags As Long) As Long
        Private Declare PtrSafe Function BCryptSetProperty Lib "bcrypt" (ByVal hObject As LongPtr, ByVal pszProperty As LongPtr, ByVal pbInput As LongPtr, ByVal cbInput As Long, ByVal dwFlags As Long) As Long
        Private Declare PtrSafe Function BCryptGenerateSymmetricKey Lib "bcrypt" (ByVal hAlgorithm As LongPtr, phKey As LongPtr, pbKeyObject As Any, ByVal cbKeyObject As Long, pbSecret As Any, ByVal cbSecret As Long, ByVal dwFlags As Long) As Long
        Private Declare PtrSafe Function BCryptDestroyKey Lib "bcrypt" (ByVal hKey As LongPtr) As Long
        Private Declare PtrSafe Function BCryptEncrypt Lib "bcrypt" (ByVal hKey As LongPtr, pbInput As Any, ByVal cbInput As Long, ByVal pPaddingInfo As LongPtr, ByVal pbIV As LongPtr, ByVal cbIV As Long, pbOutput As Any, ByVal cbOutput As Long, pcbResult As Long, ByVal dwFlags As Long) As Long
        #If Win64 Then
            Private Declare PtrSafe Function BCryptDeriveKeyPBKDF2 Lib "bcrypt" (ByVal pPrf As LongPtr, pbPassword As Any, ByVal cbPassword As Long, pbSalt As Any, ByVal cbSalt As Long, ByVal cIterations As LongLong, pbDerivedKey As Any, ByVal cbDerivedKey As Long, ByVal dwFlags As Long) As Long
        #Else
            Private Declare PtrSafe Function BCryptDeriveKeyPBKDF2 Lib "bcrypt" (ByVal pPrf As LongPtr, pbPassword As Any, ByVal cbPassword As Long, pbSalt As Any, ByVal cbSalt As Long, ByVal cIterations As Long, ByVal dwDummy As Long, pbDerivedKey As Any, ByVal cbDerivedKey As Long, ByVal dwFlags As Long) As Long
        #End If
        Private Declare PtrSafe Function BCryptCreateHash Lib "bcrypt" (ByVal hAlgorithm As LongPtr, phHash As LongPtr, ByVal pbHashObject As LongPtr, ByVal cbHashObject As Long, pbSecret As Any, ByVal cbSecret As Long, ByVal dwFlags As Long) As Long
        Private Declare PtrSafe Function BCryptDestroyHash Lib "bcrypt" (ByVal hHash As LongPtr) As Long
        Private Declare PtrSafe Function BCryptHashData Lib "bcrypt" (ByVal hHash As LongPtr, pbInput As Any, ByVal cbInput As Long, ByVal dwFlags As Long) As Long
        Private Declare PtrSafe Function BCryptFinishHash Lib "bcrypt" (ByVal hHash As LongPtr, pbOutput As Any, ByVal cbOutput As Long, ByVal dwFlags As Long) As Long
    #End If ' ImplCrypto
    #If ImplUseShared = 0 Then
        Private Declare PtrSafe Function FormatMessage Lib "kernel32" Alias "FormatMessageA" (ByVal dwFlags As Long, ByVal lpSource As LongPtr, ByVal dwMessageId As Long, ByVal dwLanguageId As Long, ByVal lpBuffer As String, ByVal nSize As Long, Args As Any) As Long
        Private Declare PtrSafe Function GetFileAttributes Lib "kernel32" Alias "GetFileAttributesA" (ByVal lpFileName As String) As Long
        Private Declare PtrSafe Function CreateDirectory Lib "kernel32" Alias "CreateDirectoryA" (ByVal lpPathName As String, ByVal lpSecurityAttributes As LongPtr) As Long
    #End If ' Not ImplUseShared
#Else
    Private Declare Function CryptStringToBinary Lib "crypt32" Alias "CryptStringToBinaryW" (ByVal pszString As Long, ByVal cchString As Long, ByVal dwFlags As Long, ByVal pbBinary As Long, ByRef pcbBinary As Long, ByRef pdwSkip As Long, ByRef pdwFlags As Long) As Long
    Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
    Private Declare Function FindFirstFile Lib "kernel32" Alias "FindFirstFileA" (ByVal lpFileName As String, lpFindFileData As WIN32_FIND_DATA) As Long
    Private Declare Function FindClose Lib "kernel32" (ByVal hFindFile As Long) As Long
    Private Declare Function CreateFile Lib "kernel32" Alias "CreateFileA" (ByVal lpFileName As String, ByVal dwDesiredAccess As Long, ByVal dwShareMode As Long, ByVal NoSecurity As Long, ByVal dwCreationDisposition As Long, ByVal dwFlagsAndAttributes As Long, ByVal hTemplateFile As Long) As Long
    Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
    Private Declare Function ReadFile Lib "kernel32" (ByVal hFile As Long, lpBuffer As Any, ByVal nNumberOfBytesToRead As Long, lpNumberOfBytesRead As Long, ByVal lpOverlapped As Long) As Long
    Private Declare Function WriteFile Lib "kernel32" (ByVal hFile As Long, lpBuffer As Any, ByVal nNumberOfBytesToWrite As Long, lpNumberOfBytesWritten As Long, ByVal lpOverlapped As Long) As Long
    Private Declare Function SetFilePointer Lib "kernel32" (ByVal hFile As Long, ByVal lDistanceToMove As Long, ByVal lpDistanceToMoveHigh As Long, ByVal dwMoveMethod As Long) As Long
    Private Declare Function SetEndOfFile Lib "kernel32" (ByVal hFile As Long) As Long
    Private Declare Function FileTimeToSystemTime Lib "kernel32" (lpFileTime As FILETIME, lpSystemTime As SYSTEMTIME) As Long
    Private Declare Function SystemTimeToFileTime Lib "kernel32" (lpSystemTime As SYSTEMTIME, lpFileTime As FILETIME) As Long
    Private Declare Function FileTimeToLocalFileTime Lib "kernel32" (lpFileTime As Any, lpLocalFileTime As FILETIME) As Long
    Private Declare Function LocalFileTimeToFileTime Lib "kernel32" (lpLocalFileTime As FILETIME, lpFileTime As FILETIME) As Long
    Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
    Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
    Private Declare Sub CoTaskMemFree Lib "ole32" (ByVal pv As Long)
    Private Declare Function MultiByteToWideChar Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, lpMultiByteStr As Any, ByVal cbMultiByte As Long, lpWideCharStr As Any, ByVal cchWideChar As Long) As Long
    Private Declare Function WideCharToMultiByte Lib "kernel32" (ByVal CodePage As Long, ByVal dwFlags As Long, ByVal lpWideCharStr As Long, ByVal cchWideChar As Long, ByVal lpMultiByteStr As Long, ByVal cchMultiByte As Long, ByVal lpDefaultChar As Long, ByVal lpUsedDefaultChar As Long) As Long
    Private Declare Function GetStdHandle Lib "kernel32" (ByVal nStdHandle As Long) As Long
    #If ImplCompress Then
        Private Declare Function FileTimeToDosDateTime Lib "kernel32" (lpFileTime As FILETIME, ByVal lpFatDate As Long, ByVal lpFatTime As Long) As Long
        Private Declare Function ApiEmptyByteArray Lib "oleaut32" Alias "SafeArrayCreateVector" (Optional ByVal VarType As VbVarType = vbByte, Optional ByVal Low As Long = 0, Optional ByVal Count As Long = 0) As Byte()
        Private Declare Function FindNextFile Lib "kernel32" Alias "FindNextFileA" (ByVal hFindFile As Long, lpFindFileData As WIN32_FIND_DATA) As Long
    #End If ' ImplCompress
    #If ImplDecompress Then
        Private Declare Function DosDateTimeToFileTime Lib "kernel32" (ByVal wFatDate As Long, ByVal wFatTime As Long, lpFileTime As FILETIME) As Long
    #End If ' ImplDecompress
    #If ImplCrypto Then
        Private Declare Function CoCreateGuid Lib "ole32" (pguid As Any) As Long
        Private Declare Function BCryptOpenAlgorithmProvider Lib "bcrypt" (phAlgorithm As Long, ByVal pszAlgId As Long, ByVal pszImplementation As Long, ByVal dwFlags As Long) As Long
        Private Declare Function BCryptCloseAlgorithmProvider Lib "bcrypt" (ByVal hAlgorithm As Long, ByVal dwFlags As Long) As Long
        Private Declare Function BCryptGetProperty Lib "bcrypt" (ByVal hObject As Long, ByVal pszProperty As Long, pbOutput As Any, ByVal cbOutput As Long, cbResult As Long, ByVal dwFlags As Long) As Long
        Private Declare Function BCryptSetProperty Lib "bcrypt" (ByVal hObject As Long, ByVal pszProperty As Long, ByVal pbInput As Long, ByVal cbInput As Long, ByVal dwFlags As Long) As Long
        Private Declare Function BCryptGenerateSymmetricKey Lib "bcrypt" (ByVal hAlgorithm As Long, phKey As Long, pbKeyObject As Any, ByVal cbKeyObject As Long, pbSecret As Any, ByVal cbSecret As Long, ByVal dwFlags As Long) As Long
        Private Declare Function BCryptDestroyKey Lib "bcrypt" (ByVal hKey As Long) As Long
        Private Declare Function BCryptEncrypt Lib "bcrypt" (ByVal hKey As Long, pbInput As Any, ByVal cbInput As Long, ByVal pPaddingInfo As Long, ByVal pbIV As Long, ByVal cbIV As Long, pbOutput As Any, ByVal cbOutput As Long, pcbResult As Long, ByVal dwFlags As Long) As Long
        Private Declare Function BCryptDeriveKeyPBKDF2 Lib "bcrypt" (ByVal pPrf As Long, pbPassword As Any, ByVal cbPassword As Long, pbSalt As Any, ByVal cbSalt As Long, ByVal cIterations As Long, ByVal dwDummy As Long, pbDerivedKey As Any, ByVal cbDerivedKey As Long, ByVal dwFlags As Long) As Long
        Private Declare Function BCryptCreateHash Lib "bcrypt" (ByVal hAlgorithm As Long, phHash As Long, ByVal pbHashObject As Long, ByVal cbHashObject As Long, pbSecret As Any, ByVal cbSecret As Long, ByVal dwFlags As Long) As Long
        Private Declare Function BCryptDestroyHash Lib "bcrypt" (ByVal hHash As Long) As Long
        Private Declare Function BCryptHashData Lib "bcrypt" (ByVal hHash As Long, pbInput As Any, ByVal cbInput As Long, ByVal dwFlags As Long) As Long
        Private Declare Function BCryptFinishHash Lib "bcrypt" (ByVal hHash As Long, pbOutput As Any, ByVal cbOutput As Long, ByVal dwFlags As Long) As Long
    #End If ' ImplCrypto
    #If ImplUseShared = 0 Then
        Private Declare Function FormatMessage Lib "kernel32" Alias "FormatMessageA" (ByVal dwFlags As Long, lpSource As Long, ByVal dwMessageId As Long, ByVal dwLanguageId As Long, ByVal lpBuffer As String, ByVal nSize As Long, Args As Any) As Long
        Private Declare Function GetFileAttributes Lib "kernel32" Alias "GetFileAttributesA" (ByVal lpFileName As String) As Long
        Private Declare Function CreateDirectory Lib "kernel32" Alias "CreateDirectoryA" (ByVal lpPathName As String, ByVal lpSecurityAttributes As Long) As Long
    #End If ' Not ImplUseShared
#End If

Private Type FILETIME
    dwLowDateTime       As Long
    dwHighDateTime      As Long
End Type

Private Type SYSTEMTIME
    wYear               As Integer
    wMonth              As Integer
    wDayOfWeek          As Integer
    wDay                As Integer
    wHour               As Integer
    wMinute             As Integer
    wSecond             As Integer
    wMilliseconds       As Integer
End Type

Private Type WIN32_FIND_DATA
    dwFileAttributes    As Long
    ftCreationTime      As FILETIME
    ftLastAccessTime    As FILETIME
    ftLastWriteTime     As FILETIME
    nFileSizeHigh       As Long
    nFileSizeLow        As Long
    dwReserved0         As Long
    dwReserved1         As Long
    cFileName           As String * MAX_PATH
    cAlternate          As String * 14
End Type


'=========================================================================
' Constants and member variables
'=========================================================================

Private Const LNG_SIG_LOCAL         As Long = &H4034B50
Private Const LNG_SIG_CENTRAL       As Long = &H2014B50
Private Const LNG_SIG_END           As Long = &H6054B50
Private Const LNG_SIG_DATADESC      As Long = &H7064B50
Private Const LNG_LEN_LOCAL         As Long = 30
Private Const LNG_LEN_CENTRAL       As Long = 46
Private Const LNG_LEN_END           As Long = 22
Private Const LNG_VERMADE           As Long = 20
Private Const LNG_VEREXT            As Long = 20
Private Const LNG_METHOD_DEFLATE    As Long = 8
Private Const LNG_METHOD_STORE      As Long = 0
Private Const LNG_IOBUF_SIZE        As Long = 65536
Private Const LNG_METHOD_AES        As Long = 99
Private Const LNG_EXTRADATA_AES_HEADER As Integer = &H9901
Private Const LNG_EXTRADATA_AES_VENDOR As Integer = &H4541 '-- "AE"
Private Const LNG_EXTRADATA_AES_SIZE As Long = 11
Private Const LNG_EXTRADATA_AE_2_MAXSIZE As Long = 20
Private Const LNG_ENC_HEADER_SIZE   As Long = 12
Private Const LNG_AES_AUTHCODE_SIZE As Long = 10
Private Const LNG_AES_BLOCK_SIZE    As Long = 16
'Private Const LNG_DEF_ENCR_STRENGTH As Long = 0
Private Const LNG_PIPE_ENDED_ERROR  As Long = 109
Private Const ERR_USER_CANCEL       As String = "User cancelled"
Private Const ERR_INIT_COMPRESSOR   As String = "Cannot init deflate compressor"
Private Const ERR_COMPRESSING       As String = "Error compressing"
Private Const ERR_EMPTY_ARCHIVE     As String = "Empty archive"
Private Const ERR_INVALID_ARCHIVE   As String = "Invalid archive"
Private Const ERR_ARCHIVE_NOT_OPEN  As String = "Archive not opened"
Private Const ERR_INVALID_LOCALHDR  As String = "Invalid local header"
Private Const ERR_UNSUPPORTED_METHOD As String = "Unsupported compression method %1"
Private Const ERR_INIT_DECOMPRESSOR As String = "Cannot init inflate decompressor"
Private Const ERR_READING_ARCHIVE   As String = "Error reading archive"
Private Const ERR_DECOMPRESSING     As String = "Error decompressing"
Private Const ERR_CRC_CHECK         As String = "CRC check failed"
Private Const ERR_ENTRY_INVALID_SIG As String = "Entry %1 has invalid signature"
Private Const ERR_ENTRY_NO_FILENAME As String = "Entry %1 has no filename"
Private Const ERR_MISSING_ECD_RECORD As String = "Missing end-of-central-directory record"
Private Const ERR_UNSUPPORTED_ENCRYPTION As String = "Unsupported encryption"
Private Const ERR_PASSWORD_REQUIRED As String = "Password required"
Private Const ERR_INVALID_PASSWORD  As String = "Invalid password"
Private Const ERR_INVALID_AUTHCODE  As String = "Invalid authentication code"
Private Const STR_BUFFER            As String = "[buffer]"
Private Const STR_STREAM            As String = "[stream]"
Private Const STR_ENTRY             As String = "[entry %1]"

#If USE_TRAMPOLINE Then
    Private TrampolineCode As CodeDescriptor_Struct
    
    #If USE_ZLIB_INLINE Then
         Private ZlibCode As CodeDescriptor_Struct
    #End If
#End If

Private m_CtxTable                 As ContextTable
Private m_sLastError            As String
Private m_bCancel               As Boolean
Private m_lFileCount            As Long
Private m_uFiles()              As UcsFileInfo
Private m_lCurrentFile          As Long
#If ImplDecompress Then
    Private m_sComment          As String
    Private m_vArchiveFile      As Variant
#End If ' ImplDecompress
#If ImplCrypto Then
    Private m_uCrypto           As UcsZipCryptoType
#End If ' ImplCrypto

#If VBA7 Then
    Private Type UcsVfsFileType
        Handle              As LongPtr
        Stream              As Object
        BufferArray         As Variant
        BufferBase          As Long
        BufferSize          As Long
        BufferPtr           As Long
        Data                As WIN32_FIND_DATA
        FileName            As String
    End Type

    Private Type UcsZlibBuffersType
        InBlock             As LongPtr
        InLen               As Long
        OutBlock            As LongPtr
        OutLen              As Long
        Final               As Long
        Greedy              As Long
        MaxMatch            As Long
        NiceLen             As Long
    End Type
#Else
    Private Type UcsVfsFileType
        Handle              As Long
        Stream              As Object
        BufferArray         As Variant
        BufferBase          As Long
        BufferSize          As Long
        BufferPtr           As Long
        Data                As WIN32_FIND_DATA
        FileName            As String
    End Type
    
    Private Type UcsZlibBuffersType
        InBlock             As Long
  
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.