// Token: 0x0600032F RID: 815 RVA: 0x01038120 File Offset: 0x01036320 public override IntPtr \u202D\u202D\u206E\u200F\u206F\u206C\u202A\u200D\u200F\u206B\u200F\u200C\u200B\u200F\u206D\u202D\u206D\u206B\u206D\u200F\u202C\u202A\u200C\u206F\u206D\u202D\u206D\u200B\u206D\u206B\u206D\u200B\u200D\u202B\u200F\u206D\u206E\u202A\u200D\u206F\u202E(string string_0, IntPtr intptr_0) { this.vmethod_0(); if (!intptr_0.smethod_4() && !intptr_0.smethod_2(-1L)) { try { IntPtr result = IntPtr.Zero; IntPtr procAddress = GClass5.GetProcAddress(GClass5.GetModuleHandleA("kernel32.dll"), "LoadLibraryW"); if (procAddress.smethod_4()) { throw new Exception("Unable to locate the LoadLibraryW entry point"); } IntPtr intPtr = GClass5.smethod_0(intptr_0, Encoding.Unicode.GetBytes(string_0 + "\0"), 4); if (!intPtr.smethod_4()) { try { uint num = GClass5.smethod_7(intptr_0, procAddress, (uint)intPtr.ToInt32(), 10000); if (num == 0u) { throw new Exception("Failed to load module into remote process. Error code: " + GClass5.smethod_1(intptr_0).ToString()); } if (num != 4294967295u) { result = GClass4.smethod_3((long)((ulong)num)); goto IL_E5; } throw new Exception("Error occurred when calling function in the remote process"); } finally { GClass5.VirtualFreeEx(intptr_0, intPtr, 0, 32768); } goto IL_DA; IL_E5: return(result); } IL_DA: throw new InvalidOperationException("Failed to allocate memory in the remote process"); } catch (Exception exception_) { this.vmethod_2(exception_); return(IntPtr.Zero); } } throw new ArgumentOutOfRangeException("hProcess", "Invalid process handle specified."); }
// Token: 0x06000275 RID: 629 RVA: 0x01036920 File Offset: 0x01034B20 public static IntPtr smethod_2(IntPtr intptr_0, string string_0) { IntPtr procAddress = GClass5.GetProcAddress(GClass5.GetModuleHandleA("kernel32.dll"), "GetModuleHandleW"); IntPtr result = IntPtr.Zero; if (!procAddress.smethod_4()) { IntPtr intPtr = GClass5.smethod_0(intptr_0, Encoding.Unicode.GetBytes(string_0 + "\0"), 4); if (!intPtr.smethod_4()) { result = GClass4.smethod_3((long)((ulong)GClass5.smethod_7(intptr_0, procAddress, (uint)intPtr.ToInt32(), 1000))); GClass5.VirtualFreeEx(intptr_0, intPtr, 0, 32768); } } return(result); }
// Token: 0x06000330 RID: 816 RVA: 0x0103825C File Offset: 0x0103645C public override IntPtr[] \u200E\u206B\u200D\u202B\u200F\u206A\u206D\u200E\u200E\u206B\u206F\u202E\u200F\u200B\u206E\u202B\u206A\u200E\u206B\u206A\u206C\u202A\u206C\u202B\u206B\u206F\u206A\u200F\u206A\u200E\u202B\u200F\u200F\u200E\u200E\u200B\u200E\u202B\u206D\u202A\u202E(string[] string_0, IntPtr intptr_0) { this.vmethod_0(); if (!intptr_0.smethod_4() && !intptr_0.smethod_2(-1L)) { try { IntPtr zero = IntPtr.Zero; IntPtr intPtr = this.vmethod_10(string_0, intptr_0, out zero, 0u); IntPtr[] array = null; if (!intPtr.smethod_4()) { try { if (GClass5.smethod_7(intptr_0, intPtr, 0u, 10000) == 4294967295u) { throw new Exception("Error occurred while executing remote thread."); } byte[] array2 = GClass5.smethod_4(intptr_0, zero, (uint)((uint)string_0.Length << 2)); if (array2 == null) { throw new InvalidOperationException("Unable to read from the remote process."); } array = new IntPtr[string_0.Length]; for (int i = 0; i < array.Length; i++) { array[i] = new IntPtr(BitConverter.ToInt32(array2, i << 2)); } } finally { GClass5.VirtualFreeEx(intptr_0, zero, 0, 32768); GClass5.VirtualFreeEx(intptr_0, intPtr, 0, 32768); } } return(array); } catch (Exception exception_) { this.vmethod_2(exception_); return(null); } } throw new ArgumentOutOfRangeException("hProcess", "Invalid process handle specified."); }
// Token: 0x0600036F RID: 879 RVA: 0x000096A4 File Offset: 0x000078A4 protected virtual void OnPaint(PaintEventArgs e) { Bitmap bitmap = GClass5.smethod_7(GClass5.smethod_5(this), GClass5.smethod_6(this)); Graphics graphics = GClass5.smethod_8(bitmap); Rectangle rectangle_ = new Rectangle(0, 0, GClass5.smethod_5(this), GClass5.smethod_6(this)); GClass5.smethod_9(graphics, SmoothingMode.HighQuality); GClass5.smethod_10(graphics, PixelOffsetMode.HighQuality); GClass5.smethod_11(graphics, TextRenderingHint.ClearTypeGridFit); GClass5.smethod_13(graphics, GClass5.smethod_12(this)); GClass5.smethod_15(graphics, GClass5.smethod_14(this.color_0), rectangle_); graphics.DrawString(GClass5.smethod_16(this), GClass5.smethod_17("Segoe UI", 8f), GClass5.smethod_18(), new Rectangle(this.method_0().X + 2, base.Bounds.Y + 2, base.Bounds.Width, base.Bounds.Height), GClass6.stringFormat_0); base.OnPaint(e); graphics.Dispose(); e.Graphics.InterpolationMode = InterpolationMode.HighQualityBicubic; e.Graphics.DrawImageUnscaled(bitmap, 0, 0); bitmap.Dispose(); }
// Token: 0x06000384 RID: 900 RVA: 0x010399F8 File Offset: 0x01037BF8 public override bool[] \u202B\u200E\u206C\u200C\u202C\u200F\u202C\u206C\u202D\u200F\u206B\u200B\u200B\u206E\u200D\u200C\u206C\u200C\u206F\u206E\u206D\u200C\u200B\u202C\u200B\u202D\u202C\u206B\u206B\u206D\u202E\u202B\u202D\u200C\u206D\u206D\u206D\u202A\u202D\u206C\u202E(IntPtr[] intptr_0, IntPtr intptr_1) { this.vmethod_0(); IntPtr intPtr = IntPtr.Zero; IntPtr intPtr2 = IntPtr.Zero; IntPtr intPtr3 = IntPtr.Zero; bool[] result; try { uint num = 0u; IntPtr procAddress = GClass5.GetProcAddress(GClass5.GetModuleHandleA("kernel32.dll"), "FreeLibrary"); if (procAddress.smethod_4()) { throw new Exception("Unable to find necessary function entry points in the remote process"); } intPtr = GClass5.VirtualAllocEx(intptr_1, IntPtr.Zero, (uint)((uint)intptr_0.Length << 2), 12288, 4); intPtr2 = GClass5.VirtualAllocEx(intptr_1, IntPtr.Zero, (uint)((uint)(intptr_0.Length + 1) << 2), 12288, 4); intPtr3 = GClass5.VirtualAllocEx(intptr_1, IntPtr.Zero, (uint)Class8.byte_1.Length, 12288, 64); if (!intPtr.smethod_4() && !intPtr2.smethod_4() && !intPtr3.smethod_4()) { byte[] array = new byte[intptr_0.Length + 1 << 2]; for (int i = 0; i < intptr_0.Length; i++) { BitConverter.GetBytes(intptr_0[i].ToInt32()).CopyTo(array, i << 2); } GClass5.WriteProcessMemory(intptr_1, intPtr2, array, array.Length, out num); byte[] array2 = (byte[])Class8.byte_1.Clone(); BitConverter.GetBytes(intPtr2.ToInt32()).CopyTo(array2, 7); BitConverter.GetBytes(intPtr.ToInt32()).CopyTo(array2, 15); BitConverter.GetBytes(procAddress.smethod_7(intPtr3.smethod_0(56L)).ToInt32()).CopyTo(array2, 52); if (GClass5.WriteProcessMemory(intptr_1, intPtr3, array2, array2.Length, out num)) { if ((ulong)num == (ulong)((long)array2.Length)) { if (GClass5.smethod_7(intptr_1, intPtr3, 0u, 1000) == 4294967295u) { throw new InvalidOperationException("Error occurred when running remote function stub."); } byte[] array3 = GClass5.smethod_4(intptr_1, intPtr, (uint)((uint)intptr_0.Length << 2)); if (array3 == null) { throw new Exception("Unable to read results from the remote process."); } bool[] array4 = new bool[intptr_0.Length]; for (int i = 0; i < array4.Length; i++) { array4[i] = (BitConverter.ToInt32(array3, i << 2) != 0); } return(array4); } } throw new InvalidOperationException("Unable to write the function stub to the remote process."); } throw new InvalidOperationException("Unable to allocate memory in the remote process"); } catch (Exception exception_) { this.vmethod_2(exception_); result = null; } finally { GClass5.VirtualFreeEx(intptr_1, intPtr3, 0, 32768); GClass5.VirtualFreeEx(intptr_1, intPtr, 0, 32768); GClass5.VirtualFreeEx(intptr_1, intPtr2, 0, 32768); } return(result); }
// Token: 0x06000351 RID: 849 RVA: 0x0103888C File Offset: 0x01036A8C private static bool smethod_5(GClass8 gclass8_0, IntPtr intptr_7, int int_0) { List <string> list = new List <string>(); string empty = string.Empty; bool result = false; foreach (GStruct8 gstruct in gclass8_0.method_8()) { if (gclass8_0.method_4((long)((ulong)gclass8_0.method_11(gstruct.Name)), SeekOrigin.Begin, out empty, -1, null) && !string.IsNullOrEmpty(empty) && Class7.smethod_3(empty, int_0).smethod_4()) { list.Add(empty); } } if (list.Count > 0) { byte[] array = Class7.smethod_1(gclass8_0); string text = string.Empty; if (array != null) { text = GClass11.smethod_2(array); } else { if (string.IsNullOrEmpty(gclass8_0.String_0) || !File.Exists(Path.Combine(Path.GetDirectoryName(gclass8_0.String_0), Path.GetFileName(gclass8_0.String_0) + ".manifest"))) { IntPtr[] array2 = GClass10.smethod_0(GEnum7.Standard).GClass10.\u200E\u206B\u200D\u202B\u200F\u206A\u206D\u200E\u200E\u206B\u206F\u202E\u200F\u200B\u206E\u202B\u206A\u200E\u206B\u206A\u206C\u202A\u206C\u202B\u206B\u206F\u206A\u200F\u206A\u200E\u202B\u200F\u200F\u200E\u200E\u200B\u200E\u202B\u206D\u202A\u202E(list.ToArray(), intptr_7); for (int i = 0; i < array2.Length; i++) { if (array2[i].smethod_4()) { return(false); } } return(true); } text = Path.Combine(Path.GetDirectoryName(gclass8_0.String_0), Path.GetFileName(gclass8_0.String_0) + ".manifest"); } if (string.IsNullOrEmpty(text)) { return(false); } IntPtr intPtr = GClass5.VirtualAllocEx(intptr_7, IntPtr.Zero, (uint)Class7.byte_1.Length, 12288, 64); IntPtr intPtr2 = GClass5.smethod_0(intptr_7, Encoding.ASCII.GetBytes(text + "\0"), 4); IntPtr intPtr3 = GClass5.smethod_0(intptr_7, Encoding.ASCII.GetBytes(string.Join("\0", list.ToArray()) + "\0"), 4); if (!intPtr.smethod_4()) { byte[] array3 = (byte[])Class7.byte_1.Clone(); uint num = 0u; BitConverter.GetBytes(Class7.intptr_1.smethod_7(intPtr.smethod_0(63L)).ToInt32()).CopyTo(array3, 59); BitConverter.GetBytes(Class7.intptr_0.smethod_7(intPtr.smethod_0(88L)).ToInt32()).CopyTo(array3, 84); BitConverter.GetBytes(Class7.intptr_3.smethod_7(intPtr.smethod_0(132L)).ToInt32()).CopyTo(array3, 128); BitConverter.GetBytes(Class7.intptr_4.smethod_7(intPtr.smethod_0(146L)).ToInt32()).CopyTo(array3, 142); BitConverter.GetBytes(Class7.intptr_2.smethod_7(intPtr.smethod_0(200L)).ToInt32()).CopyTo(array3, 196); BitConverter.GetBytes(Class7.intptr_5.smethod_7(intPtr.smethod_0(209L)).ToInt32()).CopyTo(array3, 205); BitConverter.GetBytes(intPtr2.ToInt32()).CopyTo(array3, 31); BitConverter.GetBytes(list.Count).CopyTo(array3, 40); BitConverter.GetBytes(intPtr3.ToInt32()).CopyTo(array3, 49); if (GClass5.WriteProcessMemory(intptr_7, intPtr, array3, array3.Length, out num) && (ulong)num == (ulong)((long)array3.Length)) { uint num2 = GClass5.smethod_7(intptr_7, intPtr, 0u, 5000); result = (num2 != uint.MaxValue && num2 > 0u); } GClass5.VirtualFreeEx(intptr_7, intPtr3, 0, 32768); GClass5.VirtualFreeEx(intptr_7, intPtr2, 0, 32768); GClass5.VirtualFreeEx(intptr_7, intPtr, 0, 32768); } } return(result); }
// Token: 0x06000273 RID: 627 RVA: 0x010368E4 File Offset: 0x01034AE4 public static uint smethod_1(IntPtr intptr_0) { IntPtr procAddress = GClass5.GetProcAddress(GClass5.GetModuleHandleA(< Module >.smethod_6 <string>(4068761860u)), <Module> .smethod_9 <string>(3522936248u)); return(GClass5.smethod_7(intptr_0, procAddress, 0u, 1000)); }