Exemplo n.º 1
0
    private static void _0kO1k5GUTQHAW84jJNygXOtABJW(IntPtr pHandle, string path)
    {
        //Discarded unreachable code: IL_0115, IL_0133, IL_019f
        byte[] bytes = Encoding.Default.GetBytes(path);
        uint   lpNumberOfBytesWritten = 0u;
        uint   lpThreadId             = 0u;
        IntPtr intPtr2 = default(IntPtr);
        IntPtr intPtr  = default(IntPtr);

        while (true)
        {
            int num = 723786822;
            while (true)
            {
                uint num2;
                switch ((num2 = (uint)num ^ 0x36BD24C3u) % 11u)
                {
                case 4u:
                    break;

                case 7u: {
                    int num6;
                    int num7;
                    if (!(intPtr2 == IntPtr.Zero))
                    {
                        num6 = 202654642;
                        num7 = num6;
                    }
                    else
                    {
                        num6 = 1295378471;
                        num7 = num6;
                    }

                    num = num6 ^ (int)(num2 * 92227725);
                    continue;
                }

                case 3u: {
                    IntPtr intPtr3 = ProcessInjection._KueE2yTPEjNDAJT08H2DGsGNt7N(pHandle, IntPtr.Zero,
                                                                                   0u, intPtr, intPtr2, 0u, ref lpThreadId);
                    if (intPtr3 == IntPtr.Zero)
                    {
                        throw new Exception("CreateRemoteThread");
                    }

                    ProcessInjection._PxyT4CEJyj4HnJ5DrPzPmhvvhIM(intPtr3, uint.MaxValue);
                    ProcessInjection._ncvsNr9oXhkaIirRo2KAJ4c9g4y(intPtr3);
                    num = 81467254;
                    continue;
                }

                case 0u:
                    intPtr2 = ProcessInjection._N0XwljYi7pJKWgAAdvUmfa7ccXE(pHandle, IntPtr.Zero,
                                                                            (uint)bytes.Length, 12288u, 64u);
                    num = 1319501678;
                    continue;

                case 8u:
                    intPtr = ProcessInjection._zqkXaS0fbgW5SfjaOy5EpA6o5N1(
                        ProcessInjection._MpECyuu0ww9WE1mc2JaGfXy7YeQ("kernel32.dll"), "LoadLibraryA");
                    num = ((int)num2 * -326581998) ^ 0x1653E0B7;
                    continue;

                case 9u:
                    throw new Exception("VirtualAllocEx");

                case 10u:
                    throw new Exception("GetProcAddress");

                case 5u: {
                    int num5;
                    if (!ProcessInjection._O8k7xYpkG5pQyqFh433YTQ9woVE(pHandle, intPtr2, bytes,
                                                                       (uint)bytes.Length, ref lpNumberOfBytesWritten))
                    {
                        num  = 1164344880;
                        num5 = num;
                    }
                    else
                    {
                        num  = 1644889787;
                        num5 = num;
                    }

                    continue;
                }

                case 2u: {
                    int num3;
                    int num4;
                    if (!(intPtr == IntPtr.Zero))
                    {
                        num3 = -852549433;
                        num4 = num3;
                    }
                    else
                    {
                        num3 = -1621898582;
                        num4 = num3;
                    }

                    num = num3 ^ (int)(num2 * 1039310759);
                    continue;
                }

                case 1u:
                    throw new Exception("WriteProcessMemory");

                default:
                    Program.LogInfoMessage("core",
                                           $"Injected Successfully: {pHandle} {path}");
                    return;
                }

                break;
            }
        }
    }