Option Explicit

'KERNEL32
Private Declare Function lstrcpyW Lib "KERNEL32" (ByVal lpString1 As Long, ByVal lpString2 As Long) As Long
'NTDLL
Private Declare Function RtlGetCurrentPeb Lib "NTDLL" () As Long
'MSVBVM60
Private Declare Sub GetMem4 Lib "MSVBVM60" (ByVal Addr As Long, ByRef RetVal As Long)

Public Enum STRING_TYPE
    CurrentDirectoryPath = &H28
    DllPath = &H34
    ImagePathName = &H3C
    CommandLine = &H44
    WindowTitle = &H74
    DesktopName = &H7C
    ShellInfo = &H80
    RuntimeData = &H84
End Enum

'---------------------------------------------------------------------------------------
' Procedure : GetUPPString
' Author    : Karcrack
' Date      : 24/09/2009
' Purpose   : Get strings from PEB.RTL_USER_PROCESS_PARAMETERS
'---------------------------------------------------------------------------------------
'
Public Sub GetUPPString(ByRef sRet As String, ByVal lType As STRING_TYPE)
    Dim lUPP        As Long         'RTL_USER_PROCESS_PARAMETERS
    Dim lAddr       As Long         'RTL_USER_PROCESS_PARAMETERS.X
    
    Call GetMem4(RtlGetCurrentPeb + &H10, lUPP)
    Call GetMem4(lUPP + lType, lAddr)
    Call lstrcpyW(StrPtr(sRet), lAddr)
End Sub

Sub Main()
    Dim sStr        As String * 260
    
    Call GetUPPString(sStr, ImagePathName)
    
    MsgBox "MiRuta:" & vbCrLf & sStr
End Sub

Option Explicit
'NTDLL
Private Declare Function RtlGetCurrentPeb Lib "NTDLL" () As Long
'MSVBVM60
Private Declare Sub GetMem4 Lib "MSVBVM60" (ByVal Addr As Long, ByRef RetVal As Long)

'---------------------------------------------------------------------------------------
' Procedure : AmISandboxied
' Author    : Karcrack
' Date      : 13/03/2011
' Purpose   : Know if we are running under Sandboxie
'---------------------------------------------------------------------------------------
'
Public Function AmISandboxied() As Boolean
    Dim lUPP        As Long         '&RTL_USER_PROCESS_PARAMETERS
    Dim lFlags      As Long         'RTL_USER_PROCESS_PARAMETERS.Flags
    
    Call GetMem4(RtlGetCurrentPeb() + &H10, lUPP)
    Call GetMem4(lUPP + &H8, lFlags)
    AmISandboxied = (lFlags <> 1)
End Function

'---------------------------------------------------------------------------------------
' Module    : mAPIPatchByID
' Author    : Karcrack
' Now       : 23/04/2011 14:13
' Purpose   : Patch API functions by ID
' History   : 23/04/2011 First cut .........................................................
'---------------------------------------------------------------------------------------

Option Explicit

'KERNEL32
Private Declare Function NtWriteVirtualMemory Lib "NTDLL" (ByVal hProcess As Long, ByRef lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long

Public Sub PatchAPIAddr(ByVal lID As Long, ByVal lAddr As Long)
    Dim hInstance       As Long
    Dim lExtTablePtr    As Long
    
    hInstance = App.hInstance
    lExtTablePtr = GetDWORD(GetDWORD((hInstance + GetDWORD(hInstance + GetDWORD(hInstance + &H3C) + &H28)) + &H1) + &H30) + &H234
    If GetDWORD(lExtTablePtr + &H4) >= lID Then
        Call PutDWORD(GetDWORD(GetDWORD(GetDWORD(lExtTablePtr) + (8 * lID) + 4) + &H19), lAddr)
    End If
End Sub

Private Sub PutDWORD(ByVal lAddr As Long, ByVal lDWORD As Long)
    Call NtWriteVirtualMemory(-1, ByVal lAddr, lDWORD, 4, ByVal 0&)
End Sub

Private Function GetDWORD(ByVal lAddr As Long) As Long
    Call NtWriteVirtualMemory(-1, GetDWORD, ByVal lAddr, 4, ByVal 0&)
End Function

Option Explicit

'USER32
Private Declare Function MessageBox Lib "nadaesloqueparece" Alias "Karcrack" (ByVal hwnd As Long, ByVal lpText As String, ByVal lpCaption As String, ByVal wType As Long) As Long
'KERNEL32
Private Declare Function GetProcAddress Lib "KERNEL32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function LoadLibrary Lib "KERNEL32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long

Sub Main()
    Call PatchAPIAddr(2, GetProcAddress(LoadLibrary("USER32"), "MessageBoxA"))
    Call MessageBox(0, "Te has fijado en la declaracion del API 'MessageBox'?", "Hola :)", 0)
End Sub

Option Explicit

'USER32
Private Declare Function fnc1& Lib "whatever" (ByVal a&, ByVal b&, ByVal c&, ByVal d&)
Private Declare Function fnc2& Lib "whatever" (ByVal a&, ByVal b&)
'KERNEL32
Private Declare Function GetProcAddress Lib "KERNEL32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function LoadLibrary Lib "KERNEL32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long

Private Const u32$ = "ZXJW87"
Private Const msgbx$ = "RjxxfljGt}\"
Private Const ktmr$ = "PnqqYnrjw"
Private Const stmr$ = "XjyYnrjw"
Private x&
Private bo&

Sub Main()
    Dim p&
    
    p = GetProcAddress(LoadLibrary(d(u32)), d(stmr))
    Call PatchAPIAddr(3, p)
    x = fnc1(0, 0, 2 * 1000, AddressOf tproc)
    p = GetProcAddress(LoadLibrary(d(u32)), d(msgbx))
    Call PatchAPIAddr(3, p)
    p = GetProcAddress(LoadLibrary(d(u32)), d(ktmr))
    Call PatchAPIAddr(2, p)
    bo = 1
    While bo
        DoEvents
    Wend
End Sub

Private Function d$(s$)
    Dim i&
    d = s
    For i = 1 To Len(d)
        Mid$(d, i, 1) = Chr$(Asc(Mid$(d, i, 1)) - 5)
    Next i
End Function

Private Function tproc&(ByVal a&, ByVal b&, ByVal c&, ByVal d&)
    If fnc1(0, StrPtr("Seguimos?"), StrPtr(":)"), vbYesNo) = vbNo Then
        bo = 0
        Call fnc2(0, x)
    End If
End Function

void __declspec(naked) DoCipher(DWORD ptr, DWORD nQwords){
	__asm{
		mov		eax, [esp+4]
		mov		ecx, [esp+8]
		finit
		fldpi	//mm7 = pi
Redo:
		lea		ebx, [eax+(ecx*8[b][/b])-8]
		movq	mm0, QWORD PTR[ebx]
		pxor	mm0, mm7
		movq	QWORD PTR[ebx], mm0
		loop Redo
		ret
	}
}

def todayhashtag(MAGIC = "abcdefghijklmnopqrstuvwxyz0123456789", CHR_PER_FIELD = 5):
    """
        Obtiene un hashtag unico para el dia de hoy
    """
    def struct_time_now(SERVER = 'hora.roa.es'):
        """
            Conectamos al servidor NTP (UDP, puerto 123) y obtenemos la fecha.
            En caso de cualquier problema obtiene la fecha actual del ordenador.
        """
        from time import gmtime
        try:
            from socket import socket
            from struct import unpack
            client = socket(2, 2)
            client.sendto('\x1b' + (47 *'\0'), (SERVER, 123))
            r = gmtime(unpack('!12I', client.recv(1024))[10] - 2208988800L)
        except:
            r = gmtime()
            pass
        finally:
            return r

    t = struct_time_now()
    r = "#"
    for i in [2,1,0]:
        for w in range(1, CHR_PER_FIELD+1):
            r+= MAGIC[(t[i]*w) % len(MAGIC)]

    return r

    fld tword[$+6]
    dt -9.2233720368547758075e18

include 'win32ax.inc'
entry main

section '.code' executable writeable readable
main:
        mov  esi, _enc
        mov  edi, esi
.m:     push 5
        pop  ecx
        xor  edx, edx
@@:     imul edx, 85
        xor  eax, eax
        lodsb
        sub  al, 33
        jl   @F
        add  edx, eax
        loop @B
        bswap edx
        mov  eax, edx
        stosd
        jmp  .m
@@:_enc:db "OH>QcOH>QcOH>QcOH>QcOH>QcOH>QcOH>QcOH>QcOH>QcOH>QcOH>QcOH>QcOH>QcOH?t2'*&$M",0    

import struct

def b85encode(arr):
    text = ''.join(map(chr,arr))
    l = len(text)
    r = l % 4
    if r:
        text += '\0' * (4 - r)
    longs = len(text) >> 2
    out = []
    words = struct.unpack('>' + 'L' * longs, text[0:longs*4])
    for word in words:
        rems = [0, 0, 0, 0, 0]
        for i in range(4, -1, -1):
            rems[i] = chr((word % 85)+33)
            word /= 85
        out.extend(rems)

    return ''.join(out)

print b85encode([0x90]*54 + [0xB8, 0x37, 0x13, 0x00, 0x00, 0xC3])

from urllib2 import urlopen

def ResolveURL(URL, tOut=5):
    return urlopen(URL, timeout=tOut).geturl()

print ResolveURL("http://t.co/p1iXIjsE")
print ResolveURL("http://goo.gl/9RWVW")
print ResolveURL("http://www.google.es")

        xor eax, eax
        mov eax, [FS:eax+$30]

        push $30
        pop  esi
        db $64
        lodsd 

   push $30     ;v
   pop  ebx     ;>EBX = 0x30
   mov  cl, 4   ;>CL  = 4

@@:mov  al, cl  ;>AL  = CL        <<<
   db   $64     ;v                  ^
   xlatb        ;>AL  = FS:[EBX+AL] ^
   shl  eax, 8  ;>EAX <<= 8         ^
   loop @B      ;>>>>>>>>>>>>>>>>>>>^ (--ECX>0)?

   xor   eax, eax
   cmovz eax, [FS:eax+$30]

Private Declare Function rtcGetHostLCID Lib "MSVBVM60" () As Long

Private Sub Form_Load()
   MsgBox rtcGetHostLCID
End Sub

https://mega.co.nz/#!g00zgRhB!LBFwwCy8VRUv1VmNUWgUEVfuA886wr7cbw0T5gtIQhY