MalwareSourceCode/MSIL/Trojan/Win32/P/Trojan.Win32.Patched.mf-e8127d5ac262f8a18c98990240938f5b10bb0eb14e19d9b9912199b94bd711a1/as.cs

// Decompiled with JetBrains decompiler
// Type: as
// Assembly: SpeechGridService, Version=1.0.0.81, Culture=neutral, PublicKeyToken=0b1522110151bc44
// MVID: EC73F2A1-74C8-4B65-87F0-244E72253AC2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Patched.mf-e8127d5ac262f8a18c98990240938f5b10bb0eb14e19d9b9912199b94bd711a1.exe

using Microsoft.Win32;
using System;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Security.Cryptography.Xml;
using System.Text;
using System.Threading;
using System.Xml;

internal static class @as
{
  private static readonly string a = "http://updates.speechgrid.net/updateCheck?build={0}&clientGuid={1}&requestIsFromService={2}";
  private static System.Threading.Timer b;
  private static readonly string c = "-----BEGIN CERTIFICATE-----\r\nMIIDVDCCAjwCCQCIWhwhFtjLfzANBgkqhkiG9w0BAQUFADBsMQswCQYDVQQGEwJV\r\nUzEWMBQGA1UECAwNU2FuIEZyYW5jaXNjbzEWMBQGA1UEBwwNU2FuIEZyYW5jaXNj\r\nbzETMBEGA1UECgwKU3BlZWNoR3JpZDEYMBYGA1UEAwwPU3BlZWNoR3JpZCBQUk9E\r\nMB4XDTExMDIxODAzNDMzMFoXDTM4MDIxMTAzNDMzMFowbDELMAkGA1UEBhMCVVMx\r\nFjAUBgNVBAgMDVNhbiBGcmFuY2lzY28xFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28x\r\nEzARBgNVBAoMClNwZWVjaEdyaWQxGDAWBgNVBAMMD1NwZWVjaEdyaWQgUFJPRDCC\r\nASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKlAgt4kRc0bxDso24IMhij9\r\nXmVIizXM5mMUtlub0Mimmp0whvpsWNGKNQgkxHCZhIU+DV/5z2C2698ZMrfCkZpz\r\nj4aKCcprWNAsh7jFQoi1rbMaR5Df5nZMVJyjiRhaiwI0grS5WUsQ4iM/kKR1TL8q\r\npWukfU6UilCJk+jhb/J+5VEmg7WNzwDRrfkT/w8BIIhB6kSKQVTTKKPGi7p1s0dY\r\n8iH9ED4jg08A4gnmRuAFIZdo2rWX1N730WfcZ1O3UmjI5FXWlhRHcjgZCUEtGnHu\r\n6bMZMqAIK3kkxjOZJGBUSdiaSZU1p8GHcGFPJzXLchNfoWZms9vpaXIxh9+dMd0C\r\nAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAWMlHPCE1cGAM0lAIWycHqp6xfY13ILos\r\nTJgZAg/UfzKoS16pvWQmSDD4VTAxHkws358fA5yMDnBpMFZaNzKb2YFCsRI9Xj79\r\ntijWvxp/X0p6i9UBmQreYmBy30Ur76FMYWDb3W/UVEUcgud0bKKwRax03hQDGwtE\r\ncauzAXHKIYZidi4wnMObWCrosWCYjNcojQkyyV2TIBnHseaXipzsPV5S8Ra/8vJx\r\naycIMFN5k9yeTe4XGWhWFt1C4qEM7vOop1H/uhVz5Z453gIuUPrw91kibhjUToPV\r\nsSiqMJt07S7QuBQlaTo4C/zrGAc7S4AuUuce02kjdrFg+MWLv6TPPw==\r\n-----END CERTIFICATE-----";
  private static readonly string d = "-----BEGIN CERTIFICATE-----\r\nMIIDTjCCAjYCCQD6l9oqYF8G3zANBgkqhkiG9w0BAQUFADBpMQswCQYDVQQGEwJV\r\nUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzET\r\nMBEGA1UECgwKU3BlZWNoR3JpZDEYMBYGA1UEAwwPU3BlZWNoR3JpZCBURVNUMB4X\r\nDTExMDIxODAzMDYzNloXDTM4MDIxMTAzMDYzNlowaTELMAkGA1UEBhMCVVMxEzAR\r\nBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNV\r\nBAoMClNwZWVjaEdyaWQxGDAWBgNVBAMMD1NwZWVjaEdyaWQgVEVTVDCCASIwDQYJ\r\nKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM0AbE9tOTC7PgfwTsriFqQHYHhu7+Nv\r\nDafCGe7XqbhIPZ09W5krF8U5a/TnznManP+tIRVyyMMSReyuS1BF0n1NjBvvvxGx\r\ntDDrZHjdRItihfLgMXUrDvX5gud02LgLK2faK1M8W8jX0J6GCplYrUarQES2qCSU\r\n1c5gJlxsqFxqnCGS/ZYXCRBFRJEaGZO73RzL9k8ggY5K9ksxUfPiCzCcXPwUXAWR\r\nfKlFlTyncXhaIHcW0I+Qeulrr3Nkp+4nBhH7HFKpMoIWDDHu3p3uvkB9wtdoSGG+\r\niEAqu80WbeFP9OVxIDPnDwGDhJ1L8Vq5QB1PU/7AQ7+zHTP0xjt7rRsCAwEAATAN\r\nBgkqhkiG9w0BAQUFAAOCAQEAIgsabxtJdIo8kXkmh67Ah++m1kFDgYOzhkrd5ogd\r\n+NMUgHjuFM7EUB4DEV1gsagM3R5ulqTi2kq7buzUkWn+U9VhUDRyDFLXABB4/n9G\r\nlh/Q5SuSH5Rz/5xio1a6M2SLJtIVZyCLIl4/xE+c9iftT2xedKKgtIsi4dZ91qcm\r\njTXMET/3U/SKru3K+9vpARI6RWRae3TXlUNxsxFI61fXjie2WfzSMMcl3i6t9dJQ\r\nLTH2Q/FNnb693WalmbmzizaSJ3fZ5tlt5lnMyOH0908Lz28kTCT/BKh8ivjEQZm8\r\nM25AHGxGeav/vDIWgqk++SNNj6EkWKJuvo+O1FlRzFOZaw==\r\n-----END CERTIFICATE-----";

  internal static void b(e A_0)
  {
    TimeSpan dueTime = new TimeSpan((long) ((double) TimeSpan.FromHours(24.0).Ticks * new Random().NextDouble()));
    if (@as.b())
    {
      dueTime = TimeSpan.FromSeconds(10.0);
      @as.a((object) A_0, "ImmediateUpdateCheck flag is set, but will be subjugated to user preference for automatic updates.");
    }
    @as.b = new System.Threading.Timer(new TimerCallback(@as.b), (object) A_0, dueTime, TimeSpan.FromHours(24.0));
    @as.a((object) A_0, @as.a() ? "Automatic updates are enabled" : "Automatic updates are disabled (by user)");
    @as.a((object) A_0, string.Format("First update check (if enabled) scheduled for t-minus {0} hours", (object) dueTime.TotalHours));
  }

  internal static void a(e A_0, bool A_1)
  {
    if (A_1)
      @as.b.Change(TimeSpan.Zero, TimeSpan.FromHours(24.0));
    else
      @as.a((object) A_0);
  }

  private static void b(object A_0)
  {
    if (!@as.a())
      @as.a(A_0, "Skipping scheduled check for updates due to user setting.");
    else
      @as.a(A_0);
  }

  private static void a(object A_0)
  {
    e A_0_1 = (e) null;
    try
    {
      if (!(A_0 is e e))
        e = new e();
      A_0_1 = e;
      string A_0_2 = @as.a(A_0_1);
      if (string.IsNullOrEmpty(A_0_2))
        return;
      @as.a a = @as.a.a(A_0_2, A_0_1 != null && A_0_1.c());
      string str = Path.Combine(au.a(ax.a, ax.b, ax.c) ?? throw new Exception("Cannot find writable directory for update download."), "SpeechGridUpdater.exe");
      if (System.IO.File.Exists(str))
      {
        try
        {
          System.IO.File.Delete(str);
        }
        catch (IOException ex)
        {
          @as.a((object) A_0_1, "An updater seems to be running already.  Trying to kill it...");
          int num = 0;
          foreach (Process process in Process.GetProcessesByName("SpeechGridUpdater"))
          {
            process.Kill();
            ++num;
          }
          @as.a((object) A_0_1, string.Format("Killed {0} already-running updaters", (object) num));
        }
      }
      using (WebClient webClient = new WebClient())
        webClient.DownloadFile(a.b(), str);
      string base64String;
      using (FileStream inputStream = new FileStream(str, FileMode.Open, FileAccess.Read))
        base64String = Convert.ToBase64String(new SHA1CryptoServiceProvider().ComputeHash((Stream) inputStream));
      if (base64String != a.a())
        throw new Exception("Updater executable hash is mismatched.");
      try
      {
        if (A_0_1.f() != null)
          A_0_1.f()();
      }
      catch (Exception ex)
      {
        if (A_0_1 != null)
        {
          if (A_0_1.g() != null)
            @as.a((Delegate) A_0_1.g(), (object) "Exception calling BeforeExecutingUpdateFile delegate", (object) ex);
        }
      }
      @as.a((object) A_0_1, string.Format("Launching update executable {0}", (object) str));
      Process.Start(str);
    }
    catch (Exception ex)
    {
      if (A_0_1 == null || A_0_1.d() == null)
        return;
      @as.a((Delegate) A_0_1.d(), (object) "Exception while checking for and running updates", (object) ex);
    }
  }

  private static string a(e A_0)
  {
    int revision = Assembly.GetExecutingAssembly().GetName().Version.Revision;
    string str = string.Empty;
    if (A_0 != null && A_0.a() != null)
      str = A_0.a();
    bool flag = false;
    if (A_0 != null)
      flag = A_0.e();
    HttpWebRequest httpWebRequest = (HttpWebRequest) WebRequest.Create(string.Format(@as.a, (object) revision, (object) str, (object) flag));
    httpWebRequest.KeepAlive = false;
    try
    {
      using (WebResponse response = httpWebRequest.GetResponse())
      {
        using (StreamReader streamReader = new StreamReader(response.GetResponseStream()))
          return streamReader.ReadToEnd();
      }
    }
    catch (Exception ex)
    {
      @as.a((Delegate) A_0.g(), (object) "Exception while trying to check for update info.", (object) ex);
      return (string) null;
    }
  }

  private static bool b()
  {
    try
    {
      using (RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("Software\\SpeechGrid", false))
      {
        if (registryKey == null)
          return false;
        if (!(registryKey.GetValue("ImmediateUpdateCheck") is string empty))
          empty = string.Empty;
        return empty.ToLowerInvariant() == "true";
      }
    }
    catch
    {
      return false;
    }
  }

  private static bool a() => @as.a(Registry.LocalMachine) && @as.a(Registry.CurrentUser);

  private static bool a(RegistryKey A_0)
  {
    try
    {
      using (RegistryKey registryKey = A_0.OpenSubKey("Software\\SpeechGrid\\AppData", false))
        return registryKey == null || (registryKey.GetValue("AutomaticUpdatesEnabled") as long?).GetValueOrDefault(1L) != 0L;
    }
    catch
    {
      return true;
    }
  }

  private static void a(Delegate A_0, params object[] A_1)
  {
    try
    {
      A_0.DynamicInvoke(A_1);
    }
    catch
    {
    }
  }

  private static void a(object A_0, string A_1)
  {
    if (!(A_0 is e e) || e.b() == null)
      return;
    @as.a((Delegate) e.b(), (object) A_1);
  }

  private class a
  {
    [CompilerGenerated]
    [SpecialName]
    internal string b() => this.a;

    [CompilerGenerated]
    [SpecialName]
    internal void a(string A_0) => this.a = A_0;

    [CompilerGenerated]
    [SpecialName]
    internal string a() => this.b;

    [CompilerGenerated]
    [SpecialName]
    internal void b(string A_0) => this.b = A_0;

    internal static @as.a a(string A_0, bool A_1)
    {
      if (!A_1)
        return @as.a.a(A_0, @as.c);
      try
      {
        return @as.a.a(A_0, @as.c);
      }
      catch
      {
        return @as.a.a(A_0, @as.d);
      }
    }

    private static @as.a a(string A_0, string A_1)
    {
      X509Certificate2 certificate = new X509Certificate2(Encoding.UTF8.GetBytes(A_1.Replace("\r", "").Replace("\n", "").Replace("-----BEGIN CERTIFICATE-----", "").Replace("-----END CERTIFICATE-----", "")));
      XmlDocument document = new XmlDocument();
      document.PreserveWhitespace = true;
      document.LoadXml(A_0);
      SignedXml signedXml = new SignedXml(document);
      XmlNodeList elementsByTagName = document.GetElementsByTagName("Signature");
      signedXml.LoadXml((XmlElement) elementsByTagName[0]);
      if (!signedXml.CheckSignature(certificate, true))
        throw new Exception("Signature verification failed.");
      @as.a a = new @as.a();
      a.a(document["UpdateInfo"]["DownloadUrl"].InnerText);
      a.b(document["UpdateInfo"]["DownloadHash"].InnerText);
      return a;
    }
  }
}